scope classification attributes to allowed cameras

* pin genai review frames to the main stream

* retain previews as long as either stream has recordings

* watch sub stream recording health separately from main

* reject record_sub on the same input as record and document the role

* derive recording paths from the cache segment timestamp

Recording paths carry one second of resolution, but since sub stream recording start times are resolved to fractional wall clock, anchored to the cache file mtime and chained to the previous segment's end. A stream cutting segments faster than once a second resolves consecutive segments into the same second, so two rows collide on the unique path index and the batch insert fails. The cache segment name is unique per camera stream and second by construction because ffmpeg names segments with strftime, so the recording path is now built from that timestamp while the row keeps the resolved start time. This also restores the path semantics from before sub stream recording, when start times came straight from the cache filename.

Nothing derives times from recording paths: playback offsets, stream switching, and export all use the row's start time, which is unchanged, and the recordings sync matches files by exact path string.

* keep the rest of a recording batch when one row conflicts

* only publish record_sub status when a sub stream is configured

* don't shadow camera_cfg when publishing empty cache streams

* back off restarts when a recording stream goes stale

* give the shared sub stream grace on any capture thread reset

* include segment details in recording discard warnings

.cspell/frigate-dictionary.txt

@@ -8,6 +8,7 @@ amdgpu
 analyzeduration
 Annke
 apexcharts
+Aqara
 arange
 argmax
 argmin
@@ -64,6 +65,7 @@ dsize
 dtype
 ECONNRESET
 edgetpu
+Eufy
 facenet
 fastapi
 faststart
@@ -82,6 +84,7 @@ frontdoor
 fstype
 fullchain
 fullscreen
+gatekeep
 genai
 generativeai
 genpts

.github/DISCUSSION_TEMPLATE/beta-support.yml

@@ -10,8 +10,11 @@ body:
 
         Before submitting, read the [beta documentation][docs].
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [docs]: https://docs-dev.frigate.video/
         [discussions]: https://github.com/blakeblackshear/frigate/discussions
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/camera-support.yml

@@ -8,9 +8,12 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/config-support.yml

@@ -8,9 +8,12 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/detector-support.yml

@@ -8,9 +8,12 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/general-support.yml

@@ -8,9 +8,12 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/hardware-acceleration-support.yml

@@ -8,9 +8,12 @@ body:
 
         Before submitting your support request, please [search the discussions][discussions], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your question has already been answered by the community.
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/question.yml

@@ -10,9 +10,12 @@ body:
 
         **If you are looking for support, start a new discussion and use a support category.**
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: textarea
     id: description
     attributes:

.github/DISCUSSION_TEMPLATE/report-a-bug.yml

@@ -12,11 +12,14 @@ body:
 
         **If you are unsure if your issue is actually a bug or not, please submit a support request first.**
 
+        By posting here you agree to follow our [AI policy][ai-policy]. Posts that appear to be written by an AI on your behalf may be closed without a response.
+
         [discussions]: https://www.github.com/blakeblackshear/frigate/discussions
         [prs]: https://www.github.com/blakeblackshear/frigate/pulls
         [docs]: https://docs.frigate.video
         [faq]: https://github.com/blakeblackshear/frigate/discussions/12724
         [ai]: https://docs.frigate.video
+        [ai-policy]: https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
   - type: checkboxes
     attributes:
       label: Checklist

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,6 +7,13 @@ assignees: ''
 
 ---
 
+<!--
+  By posting here you agree to follow our AI policy:
+  https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md
+
+  Requests that appear to be written by an AI on your behalf may be closed without a response.
+-->
+
 **Describe what you are trying to accomplish and why in non technical terms**
 I want to be able to ... so that I can ... 
 

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-_Please read the [contributing guidelines](https://github.com/blakeblackshear/frigate/blob/dev/CONTRIBUTING.md) before submitting a PR._
+_Please read the [contributing guidelines](https://github.com/blakeblackshear/frigate/blob/dev/CONTRIBUTING.md) and the [AI policy](https://github.com/blakeblackshear/frigate/blob/dev/AI_POLICY.md) before submitting a PR. Every PR must be read and submitted by a person, and PRs that appear to be unreviewed AI output will be closed without review._
 
 ## Proposed change
 

.github/workflows/ci.yml

@@ -42,6 +42,89 @@ jobs:
           tags: ${{ steps.setup.outputs.image-name }}-amd64
           cache-from: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64
           cache-to: type=registry,ref=${{ steps.setup.outputs.cache-name }}-amd64,mode=max
+  smoke_test:
+    runs-on: ubuntu-22.04
+    name: AMD64 Smoke Test
+    needs:
+      - amd64_build
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Set up QEMU and Buildx
+        id: setup
+        uses: ./.github/actions/setup
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Start container
+        run: |
+          mkdir -p /tmp/frigate-config
+          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config/config.yml
+          docker run -d --name frigate --shm-size 256m \
+            -v /tmp/frigate-config:/config \
+            -p 5000:5000 -p 8971:8971 \
+            ${{ steps.setup.outputs.image-name }}-amd64
+      - name: Wait for API
+        run: |
+          for i in $(seq 1 60); do
+            curl -fs http://127.0.0.1:5000/api/version && exit 0
+            sleep 5
+          done
+          echo "API never came up"; docker logs frigate; exit 1
+      - name: Assert security headers and permissions
+        run: |
+          headers=$(curl -ksI https://127.0.0.1:8971/)
+          echo "$headers"
+          echo "$headers" | grep -qi "x-content-type-options: nosniff"
+          echo "$headers" | grep -qi "referrer-policy: strict-origin-when-cross-origin"
+          # server_tokens off: Server header must not include a version.
+          # written as an if rather than "! grep", because bash exempts a
+          # negated command from set -e and the assertion would never fail
+          if echo "$headers" | grep -qiE "^server: nginx/[0-9]"; then
+            echo "Server header leaks the nginx version; server_tokens is not off"
+            exit 1
+          fi
+          # Frigate never ships frame-ancestors: HA's Webpage card and iframe
+          # panels frame it cross-origin and it would break them silently
+          if echo "$headers" | grep -qi "frame-ancestors"; then
+            echo "response carries frame-ancestors, which breaks cross-origin iframe embedding"
+            exit 1
+          fi
+          docker exec frigate /usr/local/nginx/sbin/nginx -t
+          docker exec frigate stat -c %a /etc/letsencrypt/live/frigate/privkey.pem | grep -qx 600
+          docker exec frigate stat -c %a /dev/shm/go2rtc.yaml | grep -qx 640
+      - name: Assert PUID/PGID remapping
+        run: |
+          mkdir -p /tmp/frigate-config-puid
+          printf 'mqtt:\n  enabled: false\ncameras: {}\n' > /tmp/frigate-config-puid/config.yml
+          docker run -d --name frigate-puid --shm-size 256m \
+            -e PUID=1500 -e PGID=1500 \
+            -v /tmp/frigate-config-puid:/config \
+            ${{ steps.setup.outputs.image-name }}-amd64
+          up=0
+          for i in $(seq 1 60); do
+            docker exec frigate-puid curl -fs http://127.0.0.1:5000/api/version && up=1 && break
+            sleep 5
+          done
+          if [ "$up" -ne 1 ]; then echo "PUID container never became healthy"; docker logs frigate-puid; exit 1; fi
+          docker exec frigate-puid id -u frigate | grep -qx 1500
+          docker exec frigate-puid id -g frigate | grep -qx 1500
+          docker exec frigate-puid cat /config/.permissions_version | grep -qx "1:1500:1500"
+          # second boot must skip the sweep (sentinel hit). Poll rather than
+          # sleep: the string can only come from the second boot (the first
+          # had no sentinel), so grepping the full log is unambiguous.
+          docker restart frigate-puid
+          ok=0
+          for i in $(seq 1 30); do
+            docker logs frigate-puid 2>&1 | grep -q "already applied" && ok=1 && break
+            sleep 2
+          done
+          if [ "$ok" -ne 1 ]; then echo "sentinel skip never logged"; docker logs frigate-puid; exit 1; fi
+          docker rm -f frigate-puid
+      - name: Teardown
+        if: always()
+        run: docker rm -f frigate || true
   arm64_build:
     runs-on: ubuntu-22.04-arm
     name: ARM Build

.github/workflows/pull_request.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - run: npm install
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - run: npm install
@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - run: npm install
@@ -112,7 +112,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: 20.x
       - name: Install devcontainer cli

.gitignore

@@ -12,6 +12,7 @@ config/*
 models
 *.mp4
 *.db
+*.db-*
 *.csv
 frigate/version.py
 web/build

AI_POLICY.md

@@ -0,0 +1,126 @@
+# Frigate AI Policy
+
+## TL;DR
+
+- **Use AI tools if they help you.** We do too. This is about what you post, not which tools you use to write it.
+- **A person has to read it and send it.** Don't wire a bot or an agent up to post on your behalf.
+- **Write your posts yourself.** Your own words, the template filled in, and you answering maintainers rather than your assistant.
+- **Don't paste an AI's guess at the cause as though it were a diagnosis.** Tell us what you actually observed.
+- **Read your code before you submit it.** Disclose that AI was used, and be ready to explain every line.
+- **If we misjudge something you wrote, just say so.** We'll take you at your word.
+
+The rest of this document explains each of these, and why.
+
+## Scope
+
+AI tools are a reality of modern development and we're not opposed to their use. You are responsible for anything you submit, however it was produced, and we are responsible for anything we merge and release. We hold a high bar for both.
+
+This policy applies everywhere this project is discussed: issues, discussions, pull requests, code reviews, and commit comments.
+
+## Why this exists
+
+Frigate is built and supported by a small group of maintainers and a community of volunteers who read every post and review every pull request. Nobody here is paid to do it, and time spent reading a post is time not spent fixing bugs or building features.
+
+We're not opposed to AI tools. We use them too. But content generated by an AI and submitted without review costs a real person real time, and usually gives them less to work with than a few honest sentences would have. That is the problem this policy addresses.
+
+## A person has to be in the loop
+
+Every issue, discussion, comment, and pull request here must be read and submitted by a person. Using an AI tool to help you write is fine. Wiring one up to post on your behalf is not.
+
+Specifically, do not:
+
+- Connect a bot or agent to GitHub that opens issues, discussions, or pull requests without you reading them first
+- Post output from a tool you have not read
+- Use tooling to file bulk or drive-by contributions across the repository
+
+We will close anything we believe was posted without a person reading it, and we may mark it as spam. Posts that skip the templates are the most common sign of this.
+
+## Issues, discussions, and comments
+
+We do not mind if you use AI tools to help you write. Do not have tools post unreviewed content on your behalf. We may hide any comment we believe to be unreviewed AI output.
+
+Keep posts to what is needed to communicate your point. A long, confidently written, AI-padded post is harder to help with than a short direct one, not easier, and it is usually obvious.
+
+**Describe your actual problem in your own words.** Tell us what you did, what you expected, and what actually happened. That is the information we need, and only you have it.
+
+**Do not paste an AI's guess at the cause as though it were a diagnosis.** It is frequently wrong in ways that send everyone down the wrong path, and it buries the details that would have led to the real answer. We would rather see what you observed than what a model inferred.
+
+**Fill in the template completely.** The templates ask for logs, config, version, and hardware because those are the things needed to help you. An AI cannot supply them for you, and a post missing them cannot be acted on.
+
+**Answer maintainers yourself.** If we ask you a question, we are asking _you_, not your AI assistant. These are the spaces where we build trust and understanding with the community, and that only works if we're talking to each other. Using AI to fix your grammar or clarity is fine, but the substance has to be yours.
+
+This applies to pull request descriptions and review replies as much as it does to bug reports and discussions.
+
+### Quoting AI output
+
+If you want to include something an AI told you, it must be:
+
+- In a quote block, using `>`
+- Disclosed as AI output, saying which tool it came from
+- Accompanied by your own comment explaining why you think it is relevant
+
+Keep the excerpt short. Do not paste long transcripts.
+
+### Non-native English speakers
+
+AI is genuinely useful for participating in a project that operates in English, and we would rather hear from you through a translation tool than not hear from you at all. Using AI to improve the grammar or clarity of something you wrote yourself is fine.
+
+If you are translating your posts, make sure the translation says what you meant. Including your original text in a `<details>` block helps us verify the translation if something reads oddly, and keeps the thread readable.
+
+## Code contributions
+
+We need to understand your relationship with the code you're submitting. The more AI was involved, the more important it is that you've genuinely reviewed, tested, and understood what it produced.
+
+Because of the long-term maintenance burden every merged change creates, we require a human in the loop who understands the work the AI produced. Pull requests that appear to be unreviewed AI output will be closed without review.
+
+### Requirements when AI is used
+
+If AI is used to generate any portion of the code, contributors must adhere to the following requirements:
+
+1. **Explicitly disclose the manner in which AI was employed.** The PR template asks for this. Be honest, this won't automatically disqualify your PR. We'd rather have an honest disclosure than find out later. Trust matters more than method.
+2. **Perform a comprehensive manual review prior to submitting the pull request.** Don't submit code you haven't read carefully and tested locally.
+3. **Be prepared to explain every line of code you submitted when asked about it by a maintainer.** If you can't explain why something works the way it does, you're not ready to submit it.
+4. **Check for an existing pull request addressing the same change.** If one exists, comment there and work with its author instead of opening a duplicate.
+5. **It is strictly prohibited to use AI to write your posts for you** (bug reports, feature requests, pull request descriptions, GitHub discussions, responding to humans, etc.). We need to hear from _you_, not your AI assistant. These are the spaces where we build trust and understanding with contributors, and that only works if we're talking to each other.
+
+### Established contributors
+
+Contributors with a long history of thoughtful, quality contributions to Frigate have earned trust through that track record. The level of scrutiny we apply to AI usage naturally reflects that trust. This isn't a formal exemption, it's just how trust works. If you've been around, we know how you think and how you work. If you're new, we're still getting to know you, and clear disclosure helps build that relationship.
+
+### What this means in practice
+
+We're not trying to gatekeep how you write code. Use whatever tools make you productive. But there's a difference between using AI as a tool to implement something you understand and handing a feature request to an AI and submitting whatever comes back. The former is fine. The latter creates maintenance risk for the project.
+
+Some honest context: when we review a PR, we're not just evaluating whether the code works today. We're evaluating whether we can maintain it, debug it, and extend it long-term, often without the original author's involvement. Code that the author doesn't deeply understand is code that nobody understands, and that's a liability.
+
+One more thing worth saying directly: most maintainers already have access to the same AI tools you do. A PR that's entirely AI-generated, where the author can't explain the design, debug issues independently, or engage substantively in design discussions, doesn't offer something we couldn't produce ourselves. What makes a contribution genuinely valuable is the human judgment and domain understanding behind it, as well as the engagement during review that shapes it into something we can confidently take on long-term.
+
+## Our use of AI
+
+The Frigate documentation site has an "Ask AI" search that answers questions from the docs, and we may use AI tooling to help with triage and project management. Like any automated tooling, it is not always right.
+
+If an AI tool leaves a comment on your contribution, treat it the way you would any other comment. If you think it is wrong, say so, and a brief explanation is enough. Maintainers always have the final say.
+
+## Enforcement
+
+Contributions and posts that do not follow this policy will be closed. Depending on the situation, maintainers may also:
+
+- Hide or delete comments that appear to be unreviewed AI output
+- Mark automated content as spam
+- Close an issue, discussion, or pull request without further review
+- Lock a conversation
+- Temporarily or permanently block an account from participating in the project
+
+Repeated violations may result in being blocked from contributing to Frigate.
+
+### When we get it wrong
+
+There is no reliable way to detect this, and we're not going to pretend otherwise. Whether something reads as unreviewed AI output is a judgment call, usually made quickly, by a volunteer with limited time and no way to know for certain. These calls are subjective and we won't always get them right.
+
+If it happens to you, just say so. A short reply telling us you wrote it yourself is enough, and we'll take you at your word and pick the conversation back up. We would much rather occasionally reopen something we misjudged than treat everyone who posts here as a suspect.
+
+We'd ask for some understanding in return. These calls get made quickly because the volume is real, and time spent second-guessing them is time not spent helping the person in the next thread.
+
+## Attribution
+
+Portions of this policy are adapted from the [Open Home Foundation AI Policy](https://developers.home-assistant.io/docs/ai_policy/).

CONTRIBUTING.md

@@ -2,6 +2,8 @@
 
 Thank you for your interest in contributing to Frigate. This document covers the expectations and guidelines for contributions. Please read it before submitting a pull request.
 
+All participation in this project, including pull requests, issues, and discussions, is covered by our [AI policy](AI_POLICY.md).
+
 ## Before you start
 
 ### Bugfixes
@@ -21,28 +23,16 @@ Before writing code for a new feature:
 
 ## AI usage policy
 
-AI tools are a reality of modern development and we're not opposed to their use. But we need to understand your relationship with the code you're submitting. The more AI was involved, the more important it is that you've genuinely reviewed, tested, and understood what it produced.
+AI tools are a reality of modern development and we're not opposed to their use. But we need to understand your relationship with the code you're submitting, and we need to hear from you rather than from your AI assistant.
 
-### Requirements when AI is used
+**Read the [AI policy](AI_POLICY.md) before you open a pull request.** It is short, and it applies to everything you post here. The parts that most often catch people out:
 
-If AI is used to generate any portion of the code, contributors must adhere to the following requirements:
+- A person has to be in the loop. Don't wire a bot or agent up to open pull requests, issues, or discussions on your behalf.
+- Disclose how AI was used. The PR template asks for this. Be honest, it won't automatically disqualify your PR.
+- Review and test everything you submit, and be prepared to explain every line when asked.
+- Don't use AI to write your PR description or your replies to maintainers.
 
-1. **Explicitly disclose the manner in which AI was employed.** The PR template asks for this. Be honest — this won't automatically disqualify your PR. We'd rather have an honest disclosure than find out later. Trust matters more than method.
-2. **Perform a comprehensive manual review prior to submitting the pull request.** Don't submit code you haven't read carefully and tested locally.
-3. **Be prepared to explain every line of code they submitted when asked about it by a maintainer.** If you can't explain why something works the way it does, you're not ready to submit it.
-4. **It is strictly prohibited to use AI to write your posts for you** (bug reports, feature requests, pull request descriptions, GitHub discussions, responding to humans, etc.). We need to hear from _you_, not your AI assistant. These are the spaces where we build trust and understanding with contributors, and that only works if we're talking to each other.
-
-### Established contributors
-
-Contributors with a long history of thoughtful, quality contributions to Frigate have earned trust through that track record. The level of scrutiny we apply to AI usage naturally reflects that trust. This isn't a formal exemption — it's just how trust works. If you've been around, we know how you think and how you work. If you're new, we're still getting to know you, and clear disclosure helps build that relationship.
-
-### What this means in practice
-
-We're not trying to gatekeep how you write code. Use whatever tools make you productive. But there's a difference between using AI as a tool to implement something you understand and handing a feature request to an AI and submitting whatever comes back. The former is fine. The latter creates maintenance risk for the project.
-
-Some honest context: when we review a PR, we're not just evaluating whether the code works today. We're evaluating whether we can maintain it, debug it, and extend it long-term — often without the original author's involvement. Code that the author doesn't deeply understand is code that nobody understands, and that's a liability.
-
-One more thing worth saying directly: most maintainers already have access to the same AI tools you do. A PR that's entirely AI-generated — where the author can't explain the design, debug issues independently, or engage substantively in design discussions — doesn't offer something we couldn't produce ourselves. What makes a contribution genuinely valuable is the human judgment and domain understanding behind it, as well as the engagement during review that shapes it into something we can confidently take on long-term.
+Pull requests that appear to be unreviewed AI output will be closed without review.
 
 ## Pull request guidelines
 

Makefile

@@ -1,7 +1,7 @@
 default_target: local
 
 COMMIT_HASH := $(shell git log -1 --pretty=format:"%h"|tail -1)
-VERSION = 0.18.0
+VERSION = 0.19.0
 IMAGE_REPO ?= ghcr.io/blakeblackshear/frigate
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
 BOARDS= #Initialized empty

audio-labelmap.txt

@@ -24,7 +24,7 @@ yell
 sigh
 singing
 choir
-sodeling
+yodeling
 chant
 mantra
 child_singing

docker/main/Dockerfile

@@ -60,10 +60,10 @@ ARG DEBIAN_FRONTEND
 RUN --mount=type=bind,source=docker/main/build_intel_media_driver.sh,target=/deps/build_intel_media_driver.sh \
     /deps/build_intel_media_driver.sh
 
-FROM scratch AS go2rtc
+FROM wget AS go2rtc
 ARG TARGETARCH
-WORKDIR /rootfs/usr/local/go2rtc/bin
-ADD --link --chmod=755 "https://github.com/AlexxIT/go2rtc/releases/download/v1.9.14/go2rtc_linux_${TARGETARCH}" go2rtc
+RUN --mount=type=bind,source=docker/main/install_go2rtc.sh,target=/deps/install_go2rtc.sh \
+    /deps/install_go2rtc.sh
 
 FROM wget AS tempio
 ARG TARGETARCH
@@ -81,10 +81,10 @@ RUN --mount=type=bind,source=docker/main/install_tempio.sh,target=/deps/install_
 FROM base_host AS ov-converter
 ARG DEBIAN_FRONTEND
 
-# Install OpenVino Runtime and Dev library
+# Install OpenVINO for model conversion
 COPY docker/main/requirements-ov.txt /requirements-ov.txt
 RUN apt-get -qq update \
-    && apt-get -qq install -y wget python3 python3-dev python3-distutils gcc pkg-config libhdf5-dev \
+    && apt-get -qq install -y wget python3 python3-distutils \
     && wget -q https://bootstrap.pypa.io/get-pip.py -O get-pip.py \
     && sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' get-pip.py \
     && python3 get-pip.py "pip" \
@@ -265,6 +265,23 @@ ENV PATH="/usr/local/go2rtc/bin:/usr/local/tempio/bin:/usr/local/nginx/sbin:${PA
 RUN --mount=type=bind,source=docker/main/install_deps.sh,target=/deps/install_deps.sh \
     /deps/install_deps.sh
 
+# Runtime users. frigate may be remapped at start via PUID/PGID (init-usermod)
+# or replaced entirely with docker's --user. go2rtc is intentionally separate
+# and more restricted. frigate-data is the shared group for /config access.
+# -o tolerates variant base images that already contain uid/gid 1000.
+RUN groupadd -o --gid 1000 frigate \
+    && useradd -o --uid 1000 --gid frigate --no-create-home --shell /usr/sbin/nologin frigate \
+    && groupadd --system go2rtc \
+    && useradd --system --gid go2rtc --no-create-home --shell /usr/sbin/nologin go2rtc \
+    && groupadd --system frigate-data \
+    && usermod -aG frigate-data frigate \
+    && usermod -aG frigate-data go2rtc \
+    && for grp in video render plugdev audio; do \
+         if getent group "$grp" >/dev/null; then \
+           usermod -aG "$grp" frigate && usermod -aG "$grp" go2rtc; \
+         fi; \
+       done
+
 ENV DEFAULT_FFMPEG_VERSION="8.0"
 ENV INCLUDED_FFMPEG_VERSIONS="${DEFAULT_FFMPEG_VERSION}:7.0:5.0"
 
@@ -307,6 +324,11 @@ HEALTHCHECK --start-period=300s --start-interval=5s --interval=15s --timeout=5s
 # Frigate deps with Node.js and NPM for devcontainer
 FROM deps AS devcontainer
 
+# /config here is the developer's bind-mounted checkout, not a data volume, so
+# the prepare ownership sweep must not run: it would chown the source tree to
+# the runtime uid and lock out any container user that isn't 1000.
+ENV FRIGATE_RUN_AS_ROOT=true
+
 # Do not start the actual Frigate service on devcontainer as it will be started by VS Code
 # But start a fake service for simulating the logs
 COPY docker/main/fake_frigate_run /etc/s6-overlay/s6-rc.d/frigate/run

docker/main/build_ov_model.py

@@ -1,11 +1,106 @@
-import openvino as ov
-from openvino.tools import mo
+"""Convert the default SSDLite MobileNet v2 model to OpenVINO IR.
 
-ov_model = mo.convert_model(
-    "/models/ssdlite_mobilenet_v2_coco_2018_05_09/frozen_inference_graph.pb",
-    compress_to_fp16=True,
-    transformations_config="/usr/local/lib/python3.11/dist-packages/openvino/tools/mo/front/tf/ssd_v2_support.json",
-    tensorflow_object_detection_api_pipeline_config="/models/ssdlite_mobilenet_v2_coco_2018_05_09/pipeline.config",
-    reverse_input_channels=True,
+Replaces the legacy openvino-dev Model Optimizer conversion. The TensorFlow
+frontend translates the Object Detection API pre and post processors literally,
+producing per-class NonMaxSuppression, NonZero ops and map loops with data
+dependent shapes that the GPU plugin handles very badly. Both are cut out the
+way ssd_v2_support.json used to do it: the preprocessor is an identity at the
+native 300x300 input, and the postprocessor becomes a single fused
+DetectionOutput. The result is the [1, 1, 100, 7] tensor that Frigate's
+OpenVINO detector expects, with the input flipped to BGR to match the legacy
+reverse_input_channels behavior.
+"""
+
+import numpy as np
+import openvino as ov
+from openvino import opset8 as ops
+from openvino.preprocess import PrePostProcessor
+
+MODEL_DIR = "/models/ssdlite_mobilenet_v2_coco_2018_05_09"
+OUTPUT_PATH = "/models/ssdlite_mobilenet_v2.xml"
+INPUT_SHAPE = [1, 300, 300, 3]
+
+# faster_rcnn_box_coder divides the deltas by pipeline.config's y/x/height/width
+# scales of 10/10/5/5, which DetectionOutput expresses as per-prior variances.
+BOX_VARIANCES = np.float32([0.1, 0.1, 0.2, 0.2])
+
+model = ov.convert_model(
+    f"{MODEL_DIR}/frozen_inference_graph.pb",
+    input=[("image_tensor:0", INPUT_SHAPE)],
 )
-ov.save_model(ov_model, "/models/ssdlite_mobilenet_v2.xml")
+
+nodes = {op.get_friendly_name(): op for op in model.get_ordered_ops()}
+parameter = model.get_parameters()[0]
+
+preprocessor = nodes["Preprocessor/map/TensorArrayStack/TensorArrayGatherV3"]
+box_deltas = nodes["Postprocessor/Reshape_1"].output(0)
+class_scores = nodes["Postprocessor/convert_scores"].output(0)
+anchors_output = nodes["Postprocessor/Reshape"].output(0)
+
+# The anchors only depend on the static input shape, so fold them into a
+# constant and drop the generator subgraph with the rest of the postprocessor.
+probe = ov.Core().compile_model(
+    ov.Model([anchors_output, preprocessor.output(0)], [parameter], "probe"), "CPU"
+)
+probe_input = np.random.default_rng(0).integers(0, 255, INPUT_SHAPE, dtype=np.uint8)
+anchors, resized = (out.copy() for out in probe([probe_input]).values())
+
+assert np.allclose(resized, probe_input, atol=1e-3), (
+    "preprocessor is not an identity at 300x300, it cannot be bypassed"
+)
+
+image = ops.convert(parameter, "f32")
+
+for consumer in list(preprocessor.output(0).get_target_inputs()):
+    consumer.replace_source_output(image.output(0))
+
+# (ymin, xmin, ymax, xmax) -> (xmin, ymin, xmax, ymax)
+priors = anchors[:, [1, 0, 3, 2]].astype(np.float32).reshape(-1)
+variances = np.tile(BOX_VARIANCES, len(anchors))
+proposals = ops.constant(np.stack([priors, variances])[np.newaxis])
+
+# (ty, tx, th, tw) -> (dx, dy, dw, dh) for the CENTER_SIZE decode
+box_logits = ops.reshape(ops.gather(box_deltas, [1, 0, 3, 2], 1), [1, -1], False)
+class_preds = ops.reshape(class_scores, [1, -1], False)
+
+detections = ops.detection_output(
+    box_logits,
+    class_preds,
+    proposals,
+    {
+        "background_label_id": 0,
+        "top_k": 100,
+        "keep_top_k": [100],
+        "nms_threshold": 0.6,
+        "confidence_threshold": 0.3,
+        "code_type": "caffe.PriorBoxParameter.CENTER_SIZE",
+        "share_location": True,
+        "variance_encoded_in_target": False,
+        "normalized": True,
+        "clip_before_nms": False,
+        "clip_after_nms": True,
+        "decrease_label_id": False,
+    },
+)
+detections.output(0).get_tensor().set_names({"detection_out"})
+
+model = ov.Model([detections], [parameter], "ssdlite_mobilenet_v2")
+
+ppp = PrePostProcessor(model)
+ppp.input().tensor().set_layout(ov.Layout("NHWC"))
+ppp.input().preprocess().reverse_channels()
+model = ppp.build()
+
+# Fail the build rather than silently ship the dynamically shaped graph again.
+op_types = [op.get_type_name() for op in model.get_ordered_ops()]
+assert op_types.count("DetectionOutput") == 1, "postprocessor was not fused"
+
+for dynamic_op in ("NonMaxSuppression", "NonZero", "Loop", "TensorIterator"):
+    assert dynamic_op not in op_types, f"{dynamic_op} left in the graph"
+
+output_shape = model.outputs[0].get_partial_shape()
+assert output_shape.is_static and list(output_shape) == [1, 1, 100, 7], (
+    f"unexpected detector output shape {output_shape}"
+)
+
+ov.save_model(model, OUTPUT_PATH, compress_to_fp16=True)

docker/main/build_sqlite_vec.sh

@@ -2,7 +2,7 @@
 
 set -euxo pipefail
 
-SQLITE_VEC_VERSION="0.1.3"
+SQLITE_VEC_VERSION="0.1.9"
 
 source /etc/os-release
 

docker/main/install_deps.sh

@@ -28,7 +28,13 @@ update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
 mkdir -p -m 600 /root/.gnupg
 
 # install coral runtime
+# sha256 digests of the release debs; update when bumping the libedgetpu release.
+declare -A edgetpu_checksums=(
+    ["amd64"]="63fd00989d29160fa9894e115156a9abe456e88751fc9be89d26e4696200441b"
+    ["arm64"]="eab8aa4576b4dbf738135d8094f32270b24117f77147d25cbe0f49d0144d85f2"
+)
 wget -q -O /tmp/libedgetpu1-max.deb "https://github.com/feranick/libedgetpu/releases/download/16.0TF2.17.1-1/libedgetpu1-max_16.0tf2.17.1-1.bookworm_${TARGETARCH}.deb"
+echo "${edgetpu_checksums[${TARGETARCH}]}  /tmp/libedgetpu1-max.deb" | sha256sum -c -
 unset DEBIAN_FRONTEND
 yes | dpkg -i /tmp/libedgetpu1-max.deb && export DEBIAN_FRONTEND=noninteractive
 rm /tmp/libedgetpu1-max.deb
@@ -45,36 +51,41 @@ if [[ "${TARGETARCH}" == "arm64" ]]; then
     fi
 fi
 
+# sha256 digests of the ffmpeg builds, keyed "<install dir>-<arch>".
+# Upstream publishes no checksums; these come from a one-time fetch and guard
+# against later substitution. Update when bumping a build URL.
+declare -A ffmpeg_checksums=(
+    ["5.0-amd64"]="377abec133f9d9e8014dee1b91c9684ac8bb0b5b7d80100a57116ff837c4c0d4"
+    ["7.0-amd64"]="e13860eb90409c8218319c928067834ce450128e86f24cfed5cfe91ce6e31037"
+    ["8.0-amd64"]="9bac85054d351cdc89c0a4f45c8ea5c44df94009aabd964b719bbadd56aedae9"
+    ["5.0-arm64"]="57ee475407bad49910ba9b946428396e30cf075ea28a7912fbe1aa2578085af0"
+    ["7.0-arm64"]="16c8b04e9d0ea9c769ad964c4c453fcf05121a1947237329d2e9d8a5e43e2a3c"
+    ["8.0-arm64"]="cd91948468d0f11ce795a2cdaa0c69911bd1db313b49bb19c22512beb88cde69"
+)
+
+# the tarballs nest their binaries under a directory named for the arch, which
+# matches TARGETARCH for both builds we consume
+install_ffmpeg() {
+    local dir="$1" url="$2"
+    mkdir -p "/usr/lib/ffmpeg/${dir}"
+    wget -qO ffmpeg.tar.xz "${url}"
+    echo "${ffmpeg_checksums[${dir}-${TARGETARCH}]}  ffmpeg.tar.xz" | sha256sum -c -
+    tar -xf ffmpeg.tar.xz -C "/usr/lib/ffmpeg/${dir}" --strip-components 1 "${TARGETARCH}/bin/ffmpeg" "${TARGETARCH}/bin/ffprobe"
+    rm -f ffmpeg.tar.xz
+}
+
 # ffmpeg -> amd64
 if [[ "${TARGETARCH}" == "amd64" ]]; then
-    mkdir -p /usr/lib/ffmpeg/5.0
-    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
-    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
-    rm -rf ffmpeg.tar.xz
-    mkdir -p /usr/lib/ffmpeg/7.0
-    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linux64-gpl-7.0.tar.xz"
-    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
-    rm -rf ffmpeg.tar.xz
-    mkdir -p /usr/lib/ffmpeg/8.0
-    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linux64-gpl-8.1.tar.xz"
-    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/8.0 --strip-components 1 amd64/bin/ffmpeg amd64/bin/ffprobe
-    rm -rf ffmpeg.tar.xz
+    install_ffmpeg 5.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linux64-gpl-5.1.tar.xz"
+    install_ffmpeg 7.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linux64-gpl-7.0.tar.xz"
+    install_ffmpeg 8.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linux64-gpl-8.1.tar.xz"
 fi
 
 # ffmpeg -> arm64
 if [[ "${TARGETARCH}" == "arm64" ]]; then
-    mkdir -p /usr/lib/ffmpeg/5.0
-    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
-    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/5.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
-    rm -f ffmpeg.tar.xz
-    mkdir -p /usr/lib/ffmpeg/7.0
-    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linuxarm64-gpl-7.0.tar.xz"
-    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/7.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
-    rm -f ffmpeg.tar.xz
-    mkdir -p /usr/lib/ffmpeg/8.0
-    wget -qO ffmpeg.tar.xz "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linuxarm64-gpl-8.1.tar.xz"
-    tar -xf ffmpeg.tar.xz -C /usr/lib/ffmpeg/8.0 --strip-components 1 arm64/bin/ffmpeg arm64/bin/ffprobe
-    rm -f ffmpeg.tar.xz
+    install_ffmpeg 5.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2022-07-31-12-37/ffmpeg-n5.1-2-g915ef932a3-linuxarm64-gpl-5.1.tar.xz"
+    install_ffmpeg 7.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2024-09-19-12-51/ffmpeg-n7.0.2-18-g3e6cec1286-linuxarm64-gpl-7.0.tar.xz"
+    install_ffmpeg 8.0 "https://github.com/NickM-27/FFmpeg-Builds/releases/download/autobuild-2026-06-02-14-20/ffmpeg-n8.1.1-9-g58d4114d36-linuxarm64-gpl-8.1.tar.xz"
 fi
 
 # arch specific packages
@@ -120,27 +131,56 @@ if [[ "${TARGETARCH}" == "amd64" ]]; then
     apt-get -qq install -y libtbb12
 
     # install legacy and standard intel compute packages
+    # sha256 digests of the driver debs, taken from the ww<week>.sum asset
+    # compute-runtime ships per release and the checksum.sha256 on npu-driver
+    # v1.19.0; intel-graphics-compiler and level-zero publish none, so those
+    # five are hash-what-you-get. Refresh after a version bump with
+    # `curl -sL <url> | sha256sum`, cross-checking upstream's sum where the
+    # release still has one. npu-driver stopped publishing them after v1.19.0.
+    declare -A intel_checksums=(
+        ["libigdgmm12_22.9.0_amd64.deb"]="9d712f71c18baee076de9961dda71e8089291e1bd0deb5d649ab5ba5de114f97"
+        ["intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb"]="bbe71e4f414259e06a10cde72c29a2bd78d41b2bb2f6f8463b1806797fe66e85"
+        ["intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb"]="40dfbd15ab62de036a00824b304a2aa1fa2d81ad60ef83da09cfe3c5a80c429f"
+        ["intel-igc-opencl_1.0.17537.24_amd64.deb"]="dd016400f87fa2b6a9fa9fbcca7eb4a2629174a29de679709f9bec5cede88b0e"
+        ["intel-igc-core_1.0.17537.24_amd64.deb"]="c1e1ecdfe2064c047c552651cfdcdafc504f2033afafba65654338b880048b67"
+        ["intel-opencl-icd_26.14.37833.4-0_amd64.deb"]="2e15eeb4fe9c1bba467a655967373eec6a20dd04cc7159de53c359f17ab53e41"
+        ["libze-intel-gpu1_26.14.37833.4-0_amd64.deb"]="34ce5791160d87ce6d54edb558a4030858ee1dad2afb067b9c5c58d4cde774c6"
+        ["intel-igc-opencl-2_2.32.7+21184_amd64.deb"]="3c9bddbfe558279402bbeaabcf9c63b8de46b956b0ad9625415fd35dda53ad52"
+        ["intel-igc-core-2_2.32.7+21184_amd64.deb"]="64e5230788e3a31e611e8d815a141b1facb91e5f0ef239233ef3f0614bfe3fd6"
+        ["level-zero_1.28.2+u22.04_amd64.deb"]="9015a579abef960166f8e943858d5c81fd4199a960f07260c1da66038257effb"
+        ["intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="8087bfcc0872d7976d0163203c7c783a4176f813c473766587e86c7b34135dff"
+        ["intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="740219c03495f8812c03ab74baf8199acf17d13929001105418d4ba226ba2290"
+        ["intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb"]="f4f5eb97aa7da52c7fec97e4ddfb43aae01703bbadc767bae1f2d4faf342ba42"
+    )
+
+    fetch_intel_deb() {
+        local url="$1" name
+        name=$(basename "$url")
+        wget -q "$url"
+        echo "${intel_checksums[${name}]}  ${name}" | sha256sum -c -
+    }
+
     # see https://github.com/intel/compute-runtime/blob/master/LEGACY_PLATFORMS.md for more info
     # needed core package
-    wget https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libigdgmm12_22.9.0_amd64.deb
+    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libigdgmm12_22.9.0_amd64.deb
     dpkg -i libigdgmm12_22.9.0_amd64.deb
     rm libigdgmm12_22.9.0_amd64.deb
 
     # legacy compute-runtime packages
-    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
-    wget https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
-    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
-    wget https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
+    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb
+    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-level-zero-gpu-legacy1_1.5.30872.36_amd64.deb
+    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb
+    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb
     # standard compute-runtime packages
-    wget https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/intel-opencl-icd_26.14.37833.4-0_amd64.deb
-    wget https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libze-intel-gpu1_26.14.37833.4-0_amd64.deb
-    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-opencl-2_2.32.7+21184_amd64.deb
-    wget https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-core-2_2.32.7+21184_amd64.deb
+    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/intel-opencl-icd_26.14.37833.4-0_amd64.deb
+    fetch_intel_deb https://github.com/intel/compute-runtime/releases/download/26.14.37833.4/libze-intel-gpu1_26.14.37833.4-0_amd64.deb
+    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-opencl-2_2.32.7+21184_amd64.deb
+    fetch_intel_deb https://github.com/intel/intel-graphics-compiler/releases/download/v2.32.7/intel-igc-core-2_2.32.7+21184_amd64.deb
     # npu packages
-    wget https://github.com/oneapi-src/level-zero/releases/download/v1.28.2/level-zero_1.28.2+u22.04_amd64.deb
-    wget https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
-    wget https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
-    wget https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    fetch_intel_deb https://github.com/oneapi-src/level-zero/releases/download/v1.28.2/level-zero_1.28.2+u22.04_amd64.deb
+    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-driver-compiler-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-fw-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
+    fetch_intel_deb https://github.com/intel/linux-npu-driver/releases/download/v1.19.0/intel-level-zero-npu_1.19.0.20250707-16111289554_ubuntu22.04_amd64.deb
 
     dpkg -i *.deb
     rm *.deb

docker/main/install_go2rtc.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -euxo pipefail
+
+go2rtc_version="1.9.14"
+
+# sha256 digests of the release binaries; update when bumping go2rtc_version.
+declare -A go2rtc_checksums=(
+    ["amd64"]="32d616af226bd731678ffde328b94cfb94e30339bfefc469cfb76323144615a6"
+    ["arm64"]="359fabade8a7a51e81a55fe6df6b0ef81764a5e1d63179577534eaaa71904b50"
+)
+
+dest_dir="/rootfs/usr/local/go2rtc/bin"
+mkdir -p "${dest_dir}"
+
+wget -qO "${dest_dir}/go2rtc" \
+    "https://github.com/AlexxIT/go2rtc/releases/download/v${go2rtc_version}/go2rtc_linux_${TARGETARCH}"
+echo "${go2rtc_checksums[${TARGETARCH}]}  ${dest_dir}/go2rtc" | sha256sum -c -
+chmod 755 "${dest_dir}/go2rtc"

docker/main/install_hailort.sh

@@ -4,11 +4,29 @@ set -euxo pipefail
 
 hailo_version="4.21.0"
 
+# sha256 digests of the release artifacts; update when bumping hailo_version.
+# The runtime tarball is keyed by TARGETARCH, the wheel by the python arch tag.
+declare -A hailort_checksums=(
+    ["amd64"]="0a57ac5f7cc8c2c3668133189d9285b55f498e8cb219797e203f6f5015fec4b3"
+    ["arm64"]="dd840548eb5d0d147c99aee2cb013d39d64be09c5bc63061171fcfacf4547b3f"
+    ["x86_64"]="8112a973ab48095399b29d883f31987828df5861b8553f614c89f098a67b3fb6"
+    ["aarch64"]="658432a43573280d472f6402d7934669effe7f163ba3dffa31c50bbeeaa7c01d"
+)
+
 if [[ "${TARGETARCH}" == "amd64" ]]; then
     arch="x86_64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
     arch="aarch64"
 fi
 
-wget -qO- "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-debian12-${TARGETARCH}.tar.gz" | tar -C / -xzf -
-wget -P /wheels/ "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"
+# downloaded rather than streamed into tar because streaming and verifying the
+# digest before extraction are mutually exclusive
+wget -qO /tmp/hailort.tar.gz "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-debian12-${TARGETARCH}.tar.gz"
+echo "${hailort_checksums[${TARGETARCH}]}  /tmp/hailort.tar.gz" | sha256sum -c -
+tar -C / -xzf /tmp/hailort.tar.gz
+rm -f /tmp/hailort.tar.gz
+
+wheel="/wheels/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"
+mkdir -p /wheels
+wget -qO "${wheel}" "https://github.com/frigate-nvr/hailort/releases/download/v${hailo_version}/hailort-${hailo_version}-cp311-cp311-linux_${arch}.whl"
+echo "${hailort_checksums[${arch}]}  ${wheel}" | sha256sum -c -

docker/main/install_s6_overlay.sh

@@ -4,6 +4,15 @@ set -euxo pipefail
 
 s6_version="3.2.1.0"
 
+# sha256 digests of the release artifacts, from the .sha256 files published at
+# https://github.com/just-containers/s6-overlay/releases/tag/v3.2.1.0
+# Update these when bumping s6_version.
+declare -A s6_checksums=(
+    ["noarch"]="42e038a9a00fc0fef70bf0bc42f625a9c14f8ecdfe77d4ad93281edf717e10c5"
+    ["x86_64"]="8bcbc2cada58426f976b159dcc4e06cbb1454d5f39252b3bb0c778ccf71c9435"
+    ["aarch64"]="c8fd6b1f0380d399422fc986a1e6799f6a287e2cfa24813ad0b6a4fb4fa755cc"
+)
+
 if [[ "${TARGETARCH}" == "amd64" ]]; then
     s6_arch="x86_64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -12,8 +21,15 @@ fi
 
 mkdir -p /rootfs/
 
-wget -qO- "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-noarch.tar.xz" |
-    tar -C /rootfs/ -Jxpf -
+download_and_extract() {
+    local arch="$1"
+    local tarball="/tmp/s6-overlay-${arch}.tar.xz"
+    wget -qO "${tarball}" \
+        "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-${arch}.tar.xz"
+    echo "${s6_checksums[${arch}]}  ${tarball}" | sha256sum -c -
+    tar -C /rootfs/ -Jxpf "${tarball}"
+    rm -f "${tarball}"
+}
 
-wget -qO- "https://github.com/just-containers/s6-overlay/releases/download/v${s6_version}/s6-overlay-${s6_arch}.tar.xz" |
-    tar -C /rootfs/ -Jxpf -
+download_and_extract "noarch"
+download_and_extract "${s6_arch}"

docker/main/install_tempio.sh

@@ -4,6 +4,14 @@ set -euxo pipefail
 
 tempio_version="2021.09.0"
 
+# sha256 digests of the release binaries; update when bumping tempio_version.
+# Upstream publishes no checksums, so these come from a one-time fetch and
+# guard against later substitution rather than the original download.
+declare -A tempio_checksums=(
+    ["amd64"]="b7b93ebfd24c1161cec7aecfad62ab51f2241149358cef354b86cdbc6a60546f"
+    ["aarch64"]="3a5c32981ba68b75ed9b28497429e5a5cecbeb74c3b821b035a48b37609bb895"
+)
+
 if [[ "${TARGETARCH}" == "amd64" ]]; then
     arch="amd64"
 elif [[ "${TARGETARCH}" == "arm64" ]]; then
@@ -13,4 +21,5 @@ fi
 mkdir -p /rootfs/usr/local/tempio/bin
 
 wget -q -O /rootfs/usr/local/tempio/bin/tempio "https://github.com/home-assistant/tempio/releases/download/${tempio_version}/tempio_${arch}"
+echo "${tempio_checksums[${arch}]}  /rootfs/usr/local/tempio/bin/tempio" | sha256sum -c -
 chmod 755 /rootfs/usr/local/tempio/bin/tempio

docker/main/requirements-ov.txt

@@ -1,3 +1,2 @@
 numpy
-tensorflow
-openvino-dev>=2024.0.0
+openvino >= 2026.2.0

docker/main/requirements-wheels.txt

@@ -79,7 +79,5 @@ sherpa-onnx==1.12.*
 faster-whisper==1.1.*
 librosa==0.11.*
 soundfile==0.13.*
-# DeGirum detector
-degirum == 0.16.*
 # Memory profiling
 memray == 1.15.*

docker/main/rootfs/etc/s6-overlay/s6-rc.d/certsync-log/run

@@ -1,4 +1,12 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-exec logutil-service /dev/shm/logs/certsync
+if [[ "$(id -u)" -eq 0 ]]; then
+    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
+    exec logutil-service /dev/shm/logs/certsync
+fi
+
+# Non-root (--user) fallback: logutil-service cannot change UID, so run
+# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
+# shellcheck disable=SC2086
+exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/certsync

docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate-log/run

@@ -1,4 +1,12 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-exec logutil-service /dev/shm/logs/frigate
+if [[ "$(id -u)" -eq 0 ]]; then
+    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
+    exec logutil-service /dev/shm/logs/frigate
+fi
+
+# Non-root (--user) fallback: logutil-service cannot change UID, so run
+# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
+# shellcheck disable=SC2086
+exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/frigate

docker/main/rootfs/etc/s6-overlay/s6-rc.d/go2rtc-log/run

@@ -1,4 +1,12 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-exec logutil-service /dev/shm/logs/go2rtc
+if [[ "$(id -u)" -eq 0 ]]; then
+    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
+    exec logutil-service /dev/shm/logs/go2rtc
+fi
+
+# Non-root (--user) fallback: logutil-service cannot change UID, so run
+# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
+# shellcheck disable=SC2086
+exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/go2rtc

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/run

@@ -0,0 +1,61 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+# Remap the frigate user to PUID/PGID and register EXTRA_GROUPS.
+# No-op when: started with --user (euid != 0), FRIGATE_RUN_AS_ROOT=true,
+# or PUID/PGID already match.
+
+set -o errexit -o nounset -o pipefail
+
+if [[ "$(id -u)" -ne 0 ]]; then
+    # Started with docker --user; the host owns UID mapping entirely.
+    exit 0
+fi
+
+if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
+    echo "[INFO] FRIGATE_RUN_AS_ROOT=true: skipping user remapping"
+    exit 0
+fi
+
+puid="${PUID:-1000}"
+pgid="${PGID:-1000}"
+
+if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
+    echo "[ERROR] PUID and PGID must be numeric, got '${puid}' and '${pgid}'" >&2
+    exit 1
+fi
+
+# Remapping to 0 would make the frigate user root, so every service would keep
+# full privilege while reporting a successful migration.
+if [[ "$puid" -eq 0 || "$pgid" -eq 0 ]]; then
+    echo "[ERROR] PUID/PGID 0 would run the services as root and defeat the privilege separation." >&2
+    echo "[ERROR] Set FRIGATE_RUN_AS_ROOT=true if you want to keep running as root." >&2
+    exit 1
+fi
+
+current_uid="$(id -u frigate)"
+current_gid="$(id -g frigate)"
+
+if [[ "$puid" != "$current_uid" || "$pgid" != "$current_gid" ]]; then
+    if [[ ! -w /etc/passwd ]]; then
+        echo "[ERROR] PUID/PGID remapping needs a writable /etc and is not compatible with read_only: true." >&2
+        echo "[ERROR] Either remove read_only and keep PUID, or drop PUID/PGID and use docker's user: ${puid}:${pgid} instead." >&2
+        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
+        exit 1
+    fi
+    echo "[INFO] Remapping frigate user to ${puid}:${pgid}"
+    groupmod -o -g "$pgid" frigate
+    usermod -o -u "$puid" frigate
+fi
+
+# EXTRA_GROUPS: numeric host GIDs granting device access (e.g. host render/video)
+if [[ -n "${EXTRA_GROUPS:-}" ]]; then
+    for gid in ${EXTRA_GROUPS//,/ }; do
+        if ! getent group "$gid" >/dev/null; then
+            groupadd -o -g "$gid" "frigate-extra-${gid}"
+        fi
+        group_name="$(getent group "$gid" | cut -d: -f1)"
+        usermod -aG "$group_name" frigate
+        usermod -aG "$group_name" go2rtc
+        echo "[INFO] Added frigate and go2rtc to supplementary group ${group_name} (gid ${gid})"
+    done
+fi

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/type

@@ -0,0 +1 @@
+oneshot

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-usermod/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-usermod/run

docker/main/rootfs/etc/s6-overlay/s6-rc.d/log-prepare/run

@@ -7,5 +7,12 @@ set -o errexit -o nounset -o pipefail
 dirs=(/dev/shm/logs/frigate /dev/shm/logs/go2rtc /dev/shm/logs/nginx /dev/shm/logs/certsync)
 
 mkdir -p "${dirs[@]}"
-chown nobody:nogroup "${dirs[@]}"
+
+# logutil-service drops s6-log to nobody, so the dirs must stay nobody-owned
+# in root mode. Under docker --user we are already the (only) target user,
+# chown would fail, and the plain s6-log fallback in the *-log services
+# writes as us (the mkdir above is sufficient, /dev/shm is 1777).
+if [[ "$(id -u)" -eq 0 ]]; then
+    chown nobody:nogroup "${dirs[@]}"
+fi
 chmod 02755 "${dirs[@]}"

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx-log/run

@@ -1,4 +1,12 @@
 #!/command/with-contenv bash
 # shellcheck shell=bash
 
-exec logutil-service /dev/shm/logs/nginx
+if [[ "$(id -u)" -eq 0 ]]; then
+    # logutil-service drops to nobody and applies S6_LOGGING_SCRIPT
+    exec logutil-service /dev/shm/logs/nginx
+fi
+
+# Non-root (--user) fallback: logutil-service cannot change UID, so run
+# s6-log directly with the same directives S6_LOGGING_SCRIPT configures.
+# shellcheck disable=SC2086
+exec s6-log ${S6_LOGGING_SCRIPT:-T 1 n0 s10000000 T} /dev/shm/logs/nginx

docker/main/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -77,15 +77,20 @@ if [ ! \( -f "$letsencrypt_path/privkey.pem" -a -f "$letsencrypt_path/fullchain.
     openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
         -subj "/O=FRIGATE DEFAULT CERT/CN=*" \
         -keyout "$letsencrypt_path/privkey.pem" -out "$letsencrypt_path/fullchain.pem" 2>/dev/null
+    chmod 600 "$letsencrypt_path/privkey.pem"
+    chmod 644 "$letsencrypt_path/fullchain.pem"
 fi
 
+# nginx settings are read once; both templates consume them
+nginx_settings=$(python3 /usr/local/nginx/get_nginx_settings.py)
+
 # build templates for optional FRIGATE_BASE_PATH environment variable
-python3 /usr/local/nginx/get_nginx_settings.py | \
+echo "$nginx_settings" | \
     tempio -template /usr/local/nginx/templates/base_path.gotmpl \
            -out /usr/local/nginx/conf/base_path.conf
 
 # build templates for additional network settings
-python3 /usr/local/nginx/get_nginx_settings.py | \
+echo "$nginx_settings" | \
     tempio -template /usr/local/nginx/templates/listen.gotmpl \
            -out /usr/local/nginx/conf/listen.conf
 

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run

@@ -144,3 +144,16 @@ rm -f /dev/shm/.frigate-is-stopping
 
 migrate_addon_config_dir
 migrate_db_from_media_to_config
+
+# Align volume ownership with the runtime user (one sweep per PUID/schema
+# change, guarded by the sentinel; see fix-ownership). The escape hatch
+# deletes the sentinel instead: ownership is never mutated while it is on,
+# so the next non-root boot must re-sweep whatever root created meanwhile.
+if [[ "$(id -u)" -eq 0 ]]; then
+    if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
+        rm -f /config/.permissions_version
+    else
+        /usr/local/bin/fix-ownership --sentinel /config/.permissions_version \
+            "${PUID:-1000}" "${PGID:-1000}" /config /media/frigate
+    fi
+fi

docker/main/rootfs/usr/local/bin/fix-ownership

@@ -0,0 +1,129 @@
+#!/bin/bash
+# Single source of truth for aligning volume ownership with the runtime user.
+#
+# Usage: fix-ownership [--dry-run] [--sentinel FILE] UID GID PATH [PATH...]
+#
+#   --dry-run    report what would change, touch nothing
+#   --sentinel   skip entirely when FILE already records "SCHEMA:UID:GID";
+#                write it after a successful run (used by the boot path so
+#                multi-TB volumes are swept once per UID/schema change, not
+#                on every boot)
+#
+# Only files whose uid OR gid differs are touched, so re-runs are cheap.
+# Top-level /config additionally grants group frigate-data TRAVERSE ONLY
+# (g+rx) so the separate go2rtc user can reach its pre-created HomeKit file
+# on hosts where /config is mounted 0700. Never g+w: directory write means
+# unlink rights over frigate.db/config.yml, and would let a compromised
+# go2rtc plant /config/go2rtc, which the go2rtc run script executes
+# preferentially, as root under the escape hatch.
+
+set -o errexit -o nounset -o pipefail
+
+# Permissions-layout epoch. Bump to force a one-time re-sweep on upgrade
+# (e.g. when the privilege-drop release must capture files created as root
+# since the previous sweep).
+schema=1
+
+dry_run=0
+sentinel=""
+
+while [[ "${1:-}" == --* ]]; do
+    case "$1" in
+        --dry-run) dry_run=1; shift ;;
+        --sentinel)
+            if [[ -z "${2:-}" ]]; then
+                echo "[ERROR] fix-ownership: --sentinel requires a file argument" >&2
+                exit 2
+            fi
+            sentinel="$2"; shift 2 ;;
+        *) echo "[ERROR] fix-ownership: unknown option $1" >&2; exit 2 ;;
+    esac
+done
+
+if [[ $# -lt 3 ]]; then
+    echo "Usage: fix-ownership [--dry-run] [--sentinel FILE] UID GID PATH..." >&2
+    exit 2
+fi
+
+target_uid="$1"
+target_gid="$2"
+shift 2
+
+if [[ "$(id -u)" -ne 0 ]]; then
+    echo "[INFO] fix-ownership: not running as root, skipping (ownership is managed by the host in --user mode)"
+    exit 0
+fi
+
+# A dry run always inspects: the sentinel records what a past sweep did, not
+# what the volume looks like now, and reporting from it would hide later drift.
+if [[ "$dry_run" -eq 0 && -n "$sentinel" && -f "$sentinel" && "$(cat "$sentinel")" == "${schema}:${target_uid}:${target_gid}" ]]; then
+    echo "[INFO] fix-ownership: ${target_uid}:${target_gid} (schema ${schema}) already applied, skipping"
+    exit 0
+fi
+
+# A sweep that could not chown everything must not be recorded as complete:
+# the sentinel would make every later boot skip it and the entries would stay
+# unreachable once services run unprivileged.
+swept_clean=1
+
+for path in "$@"; do
+    # An absent root is an incomplete sweep, not a finished one: /media/frigate
+    # is not in the image, so a boot before the volume is mounted would
+    # otherwise record success and the volume would never be swept once added.
+    if [[ ! -d "$path" ]]; then
+        swept_clean=0
+        echo "[WARN] fix-ownership: $path does not exist, skipping; will retry on next boot"
+        continue
+    fi
+
+    # find may fail mid-walk on a live volume (file deleted under it) or on a
+    # stale mount. Tolerate it rather than aborting under errexit, but never
+    # read a failed scan as "nothing to do": that would record the sweep as
+    # complete without having looked.
+    if ! count=$(find "$path" \( -not -uid "$target_uid" -o -not -gid "$target_gid" \) -printf '.' 2>/dev/null | wc -c); then
+        swept_clean=0
+        echo "[WARN] fix-ownership: could not scan ${path}; will retry on next boot"
+        continue
+    fi
+
+    if [[ "$count" -eq 0 ]]; then
+        echo "[INFO] fix-ownership: $path already owned by ${target_uid}:${target_gid}, nothing to do"
+        continue
+    fi
+
+    # find does not descend symlinks and chown -h retargets the link itself, so
+    # anything behind a symlinked directory is outside this sweep. Following
+    # them is not an option: a link could walk the chown out of the volume.
+    if [[ -n "$(find "$path" -type l -xtype d -print -quit 2>/dev/null)" ]]; then
+        echo "[WARN] fix-ownership: ${path} contains symlinked directories; ownership behind them is not managed and must be aligned by hand"
+    fi
+
+    echo "[WARN] fix-ownership: adjusting ownership of ${count} entries under ${path}; on large recordings volumes this can take a long time"
+    if [[ "$dry_run" -eq 1 ]]; then
+        echo "[INFO] fix-ownership: dry run, not changing ${path}"
+        continue
+    fi
+
+    find "$path" \( -not -uid "$target_uid" -o -not -gid "$target_gid" \) \
+        -exec chown -h "${target_uid}:${target_gid}" {} + || {
+        swept_clean=0
+        echo "[WARN] fix-ownership: some entries under ${path} could not be updated (deleted mid-sweep or chown denied); will retry on next mismatch"
+    }
+done
+
+# go2rtc (separate user) must be able to REACH its HomeKit state in /config.
+# Write access is per-file, not per-directory: go2rtc's PatchConfig rewrites
+# the first -config file via os.WriteFile (in-place truncate, no rename,
+# verified against go2rtc v1.9.14 internal/app/config.go), and the file is
+# always pre-created by setup_homekit_config before go2rtc starts, so
+# O_CREATE never needs directory write. See header comment for why g+w is
+# forbidden here.
+if [[ "$dry_run" -eq 0 && -d /config ]]; then
+    chgrp frigate-data /config 2>/dev/null || true
+    chmod g+rx /config 2>/dev/null || true
+fi
+
+if [[ "$dry_run" -eq 0 && -n "$sentinel" && "$swept_clean" -eq 1 ]]; then
+    echo "${schema}:${target_uid}:${target_gid}" > "$sentinel" || \
+        echo "[WARN] fix-ownership: could not write ${sentinel}; the sweep will run again on next boot"
+fi

docker/main/rootfs/usr/local/go2rtc/create_config.py

@@ -3,13 +3,12 @@
 import json
 import os
 import sys
-from pathlib import Path
 from typing import Any
 
 from ruamel.yaml import YAML
 
 sys.path.insert(0, "/opt/frigate")
-from frigate.config.env import substitute_frigate_vars
+from frigate.config.env import apply_config_env_vars, substitute_frigate_vars
 from frigate.const import (
     BIRDSEYE_PIPE,
     LIBAVFORMAT_VERSION_MAJOR,
@@ -25,15 +24,6 @@ sys.path.remove("/opt/frigate")
 
 yaml = YAML()
 
-FRIGATE_ENV_VARS = {k: v for k, v in os.environ.items() if k.startswith("FRIGATE_")}
-# read docker secret files as env vars too
-if os.path.isdir("/run/secrets"):
-    for secret_file in os.listdir("/run/secrets"):
-        if secret_file.startswith("FRIGATE_"):
-            FRIGATE_ENV_VARS[secret_file] = (
-                Path(os.path.join("/run/secrets", secret_file)).read_text().strip()
-            )
-
 config_file = find_config_file()
 
 try:
@@ -47,6 +37,20 @@ try:
 except FileNotFoundError:
     config: dict[str, Any] = {}
 
+# No validator runs here, so install environment_vars ourselves. FRIGATE_
+# names only: anything else lands in os.environ, where the exec gate reads
+# GO2RTC_ALLOW_ARBITRARY_EXEC.
+config_env_vars = config.get("environment_vars")
+apply_config_env_vars(
+    {
+        key: value
+        for key, value in config_env_vars.items()
+        if str(key).startswith("FRIGATE_")
+    }
+    if isinstance(config_env_vars, dict)
+    else {}
+)
+
 go2rtc_config: dict[str, Any] = config.get("go2rtc", {})
 
 # Need to enable CORS for go2rtc so the frigate integration / card work automatically
@@ -113,7 +117,7 @@ for name in list(go2rtc_config.get("streams", {})):
 
     if isinstance(stream, str):
         try:
-            formatted_stream = stream.format(**FRIGATE_ENV_VARS)
+            formatted_stream = substitute_frigate_vars(stream)
             if is_restricted_go2rtc_source(formatted_stream):
                 print(
                     f"[ERROR] Stream '{name}' uses a restricted source (echo/expr/exec) which is disabled by default for security. "
@@ -122,7 +126,7 @@ for name in list(go2rtc_config.get("streams", {})):
                 del go2rtc_config["streams"][name]
                 continue
             go2rtc_config["streams"][name] = formatted_stream
-        except KeyError as e:
+        except ValueError as e:
             print(
                 "[ERROR] Invalid substitution found, see https://docs.frigate.video/configuration/restream#advanced-restream-configurations for more info."
             )
@@ -132,7 +136,7 @@ for name in list(go2rtc_config.get("streams", {})):
         filtered_streams = []
         for i, stream_item in enumerate(stream):
             try:
-                formatted_stream = stream_item.format(**FRIGATE_ENV_VARS)
+                formatted_stream = substitute_frigate_vars(stream_item)
                 if is_restricted_go2rtc_source(formatted_stream):
                     print(
                         f"[ERROR] Stream '{name}' item {i + 1} uses a restricted source (echo/expr/exec) which is disabled by default for security. "
@@ -141,7 +145,7 @@ for name in list(go2rtc_config.get("streams", {})):
                     continue
 
                 filtered_streams.append(formatted_stream)
-            except KeyError as e:
+            except ValueError as e:
                 print(
                     "[ERROR] Invalid substitution found, see https://docs.frigate.video/configuration/restream#advanced-restream-configurations for more info."
                 )
@@ -185,3 +189,6 @@ if config.get("birdseye", {}).get("restream", False):
 # Write go2rtc_config to /dev/shm/go2rtc.yaml
 with open("/dev/shm/go2rtc.yaml", "w") as f:
     yaml.dump(go2rtc_config, f)
+
+# config contains camera credentials; do not leave it world-readable
+os.chmod("/dev/shm/go2rtc.yaml", 0o640)

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -11,6 +11,7 @@ events {
 
 http {
     map_hash_bucket_size 256;
+    server_tokens off;
 
     include mime.types;
     default_type application/octet-stream;
@@ -62,6 +63,7 @@ http {
 
     server {
         include listen.conf;
+        include security_headers.conf;
 
         # enable HTTP/2 for TLS connections to eliminate browser 6-connection limit
         http2 on;
@@ -75,6 +77,12 @@ http {
         vod_align_segments_to_key_frames on;
         vod_manifest_segment_durations_mode accurate;
         vod_ignore_edit_list on;
+        # short leading segments at each playlist start; sources start at
+        # the seek target, so the ladder applies to every seek. Only
+        # effective when clips declare real keyFrameDurations
+        vod_bootstrap_segment_durations 1000;
+        vod_bootstrap_segment_durations 2000;
+        vod_bootstrap_segment_durations 4000;
         vod_segment_duration 10000;
 
         # MPEG-TS settings (not used when fMP4 is enabled, kept for reference)
@@ -117,6 +125,7 @@ http {
             secure_token $args;
             secure_token_types application/vnd.apple.mpegurl;
 
+            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
 
@@ -133,6 +142,7 @@ http {
 
         location /stream/ {
             include auth_request.conf;
+            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
 
@@ -154,6 +164,7 @@ http {
             }
 
             expires 7d;
+            include security_headers.conf;
             add_header Cache-Control "public";
             autoindex on;
             root /media/frigate;
@@ -246,6 +257,7 @@ http {
 
         location /api/ {
             include auth_request.conf;
+            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
             proxy_pass http://frigate_api/;
@@ -312,29 +324,34 @@ http {
 
         location / {
             # do not require auth for static assets
+            include security_headers.conf;
             add_header Cache-Control "no-store";
             expires off;
 
             location /assets/ {
                 access_log off;
                 expires 1y;
+                include security_headers.conf;
                 add_header Cache-Control "public";
             }
 
             location /fonts/ {
                 access_log off;
                 expires 1y;
+                include security_headers.conf;
                 add_header Cache-Control "public";
             }
 
             location /locales/ {
                 access_log off;
+                include security_headers.conf;
                 add_header Cache-Control "public";
             }
 
             location ~ ^/.*-([A-Za-z0-9]+)\.webmanifest$ {
                 access_log off;
                 expires 1y;
+                include security_headers.conf;
                 add_header Cache-Control "public";
                 default_type application/json;
                 proxy_set_header Accept-Encoding "";

docker/main/rootfs/usr/local/nginx/conf/security_headers.conf

@@ -0,0 +1,5 @@
+# Deliberately no X-Frame-Options or CSP frame-ancestors: HA's Webpage card and
+# iframe panels frame Frigate cross-origin, and either would break them
+# silently. Bind-mount this file to add your own.
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;

docker/migration/fix-permissions.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Ahead-of-time volume ownership migration for switching Frigate to non-root.
+# Run from the host BEFORE enabling PUID/PGID or --user:
+#
+#   ./fix-permissions.sh [--dry-run] <config_dir> <media_dir> [PUID] [PGID]
+#
+# Wraps the image's fix-ownership helper so there is exactly one
+# implementation of the chown logic. Requires an image that contains the
+# helper (any release that includes non-root support).
+
+set -o errexit -o nounset -o pipefail
+
+IMAGE="${FRIGATE_IMAGE:-ghcr.io/blakeblackshear/frigate:stable}"
+
+dry_run_flag=""
+if [[ "${1:-}" == "--dry-run" ]]; then
+    dry_run_flag="--dry-run"
+    shift
+fi
+
+if [[ $# -lt 2 ]]; then
+    echo "Usage: $0 [--dry-run] <config_dir> <media_dir> [PUID] [PGID]" >&2
+    exit 2
+fi
+
+config_dir="$1"
+media_dir="$2"
+puid="${3:-1000}"
+pgid="${4:-1000}"
+
+# The ids are interpolated into the container's bash -c source below, so
+# anything but digits would be reparsed as shell rather than passed through
+if ! [[ "$puid" =~ ^[0-9]+$ && "$pgid" =~ ^[0-9]+$ ]]; then
+    echo "[ERROR] PUID and PGID must be numeric, got '${puid}' and '${pgid}'" >&2
+    exit 2
+fi
+
+echo "[INFO] Using image ${IMAGE} (override with FRIGATE_IMAGE=...)"
+# shellcheck disable=SC2086
+docker run --rm \
+    -v "${config_dir}:/config" \
+    -v "${media_dir}:/media/frigate" \
+    --entrypoint bash \
+    "${IMAGE}" \
+    -c "command -v fix-ownership >/dev/null || { echo '[ERROR] this Frigate image predates non-root support; set FRIGATE_IMAGE to a release that includes it' >&2; exit 1; }; exec fix-ownership ${dry_run_flag} ${puid} ${pgid} /config /media/frigate"

docs/docs/configuration/advanced/reference.md

@@ -11,6 +11,8 @@ It is not recommended to copy this full configuration file. Only specify values
 
 :::
 
+Sections marked `# NOTE: Can be overridden at the camera level` can be set globally and then adjusted per camera. See [Global and Camera-Level Configuration](../config_overrides.md) for how that works.
+
 ```yaml
 mqtt:
   # Optional: Enable mqtt server (default: shown below)
@@ -54,17 +56,6 @@ mqtt:
   # 2 = exactly once
   qos: 0
 
-# Optional: Detectors configuration. Defaults to a single CPU detector
-detectors:
-  # Required: name of the detector
-  detector_name:
-    # Required: type of the detector
-    # Frigate provides many types, see https://docs.frigate.video/configuration/object_detectors for more details (default: shown below)
-    # Additional detector types can also be plugged in.
-    # Detectors may require additional configuration.
-    # Refer to the Detectors configuration page for more information.
-    type: cpu
-
 # Optional: Database configuration
 database:
   # The path to store the SQLite DB (default: shown below)
@@ -155,43 +146,56 @@ auth:
       - front_door
       - back_yard
 
-# Optional: model modifications
+# Optional: object detection models. Defaults to a single model on a CPU detector.
 # NOTE: The default values are for the EdgeTPU detector.
 # Other detectors will require the model config to be set.
-model:
-  # Required: path to the model. Frigate+ models use plus://<model_id> (default: automatic based on detector)
-  path: /edgetpu_model.tflite
-  # Required: path to the labelmap (default: shown below)
-  labelmap_path: /labelmap.txt
-  # Required: Object detection model input width (default: shown below)
-  width: 320
-  # Required: Object detection model input height (default: shown below)
-  height: 320
-  # Required: Object detection model input colorspace
-  # Valid values are rgb, bgr, or yuv. (default: shown below)
-  input_pixel_format: rgb
-  # Required: Object detection model input tensor format
-  # Valid values are nhwc or nchw (default: shown below)
-  input_tensor: nhwc
-  # Optional: Data type of the model input tensor
-  # Valid values are float, float_denorm, or int (default: shown below)
-  input_dtype: int
-  # Required: Object detection model type, currently only used with the OpenVINO detector
-  # Valid values are ssd, yolox, yolonas (default: shown below)
-  model_type: ssd
-  # Required: Label name modifications. These are merged into the standard labelmap.
-  labelmap:
-    2: vehicle
-  # Optional: Map of object labels to their attribute labels (default: depends on model)
-  attributes_map:
-    person:
-      - amazon
-      - face
-    car:
-      - amazon
-      - fedex
-      - license_plate
-      - ups
+models:
+    # Optional: the camera environment this model is for (default: shown below)
+    # Cameras select a model by setting detect -> scene to a matching value, and
+    # a model with a scene of all is used by any camera that does not set one.
+    # Valid values are all, indoor, outdoor, indoor_thermal, outdoor_thermal
+  - scene: all
+    # Required: hardware this model runs on, as <detector> or <detector>:<device>
+    # See https://docs.frigate.video/configuration/object_detectors for the
+    # detectors available and the devices each one accepts. All of a model's
+    # devices must use the same detector. Listing the same device more than once
+    # runs additional inference processes on it.
+    devices:
+      - edgetpu:pci:0
+    # Required: path to the model. Frigate+ models use plus://<model_id> (default: automatic based on detector)
+    path: /edgetpu_model.tflite
+    # Required: path to the labelmap (default: shown below)
+    labelmap_path: /labelmap.txt
+    # Required: Object detection model input width (default: shown below)
+    width: 320
+    # Required: Object detection model input height (default: shown below)
+    height: 320
+    # Required: Object detection model input colorspace
+    # Valid values are rgb, bgr, or yuv. (default: shown below)
+    input_pixel_format: rgb
+    # Required: Object detection model input tensor format
+    # Valid values are nhwc, nchw, hwnc, or hwcn (default: shown below)
+    input_tensor: nhwc
+    # Optional: Data type of the model input tensor
+    # Valid values are float, float_denorm, or int (default: shown below)
+    input_dtype: int
+    # Required: Object detection model architecture, used by detectors that support more
+    # than one model type (openvino, onnx, rknn, memryx, axengine, synaptics, and others)
+    # Valid values are ssd, yolox, yolonas, yolo-generic, rfdetr, dfine (default: shown below)
+    model_type: ssd
+    # Required: Label name modifications. These are merged into the standard labelmap.
+    labelmap:
+      2: vehicle
+    # Optional: Map of object labels to their attribute labels (default: depends on model)
+    attributes_map:
+      person:
+        - amazon
+        - face
+      car:
+        - amazon
+        - fedex
+        - license_plate
+        - ups
 
 # Optional: Audio Events Configuration
 # NOTE: Can be overridden at the camera level
@@ -214,6 +218,8 @@ audio:
     - fire_alarm
     - speech
     - yell
+  # Optional: Audio label name modifications. These are merged into the standard audio labelmap.
+  labelmap: {}
   # Optional: Filters to configure detection.
   filters:
     # Label that matches label in listen config.
@@ -248,11 +254,15 @@ birdseye:
   # Optional: Encoding quality of the mpeg1 feed (default: shown below)
   # 1 is the highest quality, and 31 is the lowest. Lower quality feeds utilize less CPU resources.
   quality: 8
-  # Optional: Mode of the view. Available options are: objects, motion, and continuous
-  #   objects - cameras are included if they have had a tracked object within the last 30 seconds
-  #   motion - cameras are included if motion was detected in the last 30 seconds
-  #   continuous - all cameras are included always
-  mode: objects
+  # Optional: Activity types that include cameras in Birdseye (default: shown below)
+  # Multiple activity types can be listed at the same time.
+  #   continuous:  all cameras are included always
+  #   motion:      included if motion was detected within the inactivity threshold
+  #   all_objects: included if a tracked object was present within the inactivity threshold
+  #   alerts:      included while an alert review item is in progress
+  #   detections:  included while a detection review item is in progress
+  modes:
+    - all_objects
   # Optional: Threshold for camera activity to stop showing camera (default: shown below)
   inactivity_threshold: 30
   # Optional: Configure the birdseye layout
@@ -284,6 +294,8 @@ ffmpeg:
     detect: -threads 2 -f rawvideo -pix_fmt yuv420p
     # Optional: output args for record streams (default: shown below)
     record: preset-record-generic
+    # Optional: output args for sub stream record streams (default: the record output args above)
+    # record_sub: preset-record-generic
   # Optional: Time in seconds to wait before ffmpeg retries connecting to the camera. (default: shown below)
   # If set too low, frigate will retry a connection to the camera's stream too frequently, using up the limited streams some cameras can allow at once
   # If set too high, then if a ffmpeg crash or camera stream timeout occurs, you could potentially lose up to a maximum of retry_interval second(s) of footage
@@ -303,6 +315,10 @@ detect:
   width: 1280
   # Optional: height of the frame for the input with the detect role (default: use native stream resolution)
   height: 720
+  # Optional: the environment this camera looks at, which picks the model it runs on
+  # (default: the model with a scene of all)
+  # Valid values are all, indoor, outdoor, indoor_thermal, outdoor_thermal
+  scene: outdoor
   # Optional: desired fps for your camera for the input with the detect role (default: shown below)
   # NOTE: Recommended value of 5. Ideally, try and reduce your FPS on the camera.
   fps: 5
@@ -468,8 +484,8 @@ review:
     detections: False
     # Optional: Activity Context Prompt to give context to the GenAI what activity is and is not suspicious.
     # It is important to be direct and detailed. See documentation for the default prompt structure.
-    activity_context_prompt: """Define what is and is not suspicious
-"""
+    activity_context_prompt: |
+      Define what is and is not suspicious
     # Optional: Image source for GenAI (default: preview)
     # Options: "preview" (uses cached preview frames at ~180p) or "recordings" (extracts frames from recordings at 480p)
     # Using "recordings" provides better image quality but uses more tokens per image.
@@ -634,6 +650,42 @@ record:
       #       For example, if the camera retain mode is "motion", the segments without motion are
       #       never stored, so setting the mode to "all" here won't bring them back.
       mode: motion
+  # Optional: Sub stream recording settings
+  # Records a second, lower quality stream for quality selection during playback
+  # and extended low quality retention. Requires the record_sub role to be assigned
+  # to one of the camera's inputs.
+  sub:
+    # Optional: Enable sub stream recording (default: shown below)
+    # NOTE: Recording must also be enabled for sub stream recording to run.
+    enabled: False
+    # Optional: Continuous retention settings for sub stream recordings
+    continuous:
+      # Optional: Number of days to retain sub stream recordings regardless of tracked objects or motion (default: shown below)
+      days: 0
+    # Optional: Motion retention settings for sub stream recordings
+    motion:
+      # Optional: Number of days to retain sub stream recordings triggered by motion (default: shown below)
+      days: 0
+    # Optional: Retention settings for sub stream recordings of alerts
+    # NOTE: Pre and post capture windows are taken from the main alerts config above.
+    alerts:
+      # Required: Retention days (default: shown below)
+      days: 10
+      # Optional: Mode for retention. (default: shown below)
+      #   all - save all sub stream recording segments for alerts regardless of activity
+      #   motion - save all sub stream recording segments for alerts with any detected motion
+      #   active_objects - save all sub stream recording segments for alerts with active/moving objects
+      mode: motion
+    # Optional: Retention settings for sub stream recordings of detections
+    # NOTE: Pre and post capture windows are taken from the main detections config above.
+    detections:
+      # Required: Retention days (default: shown below)
+      days: 10
+      # Optional: Mode for retention. (default: shown below)
+      #   all - save all sub stream recording segments for detections regardless of activity
+      #   motion - save all sub stream recording segments for detections with any detected motion
+      #   active_objects - save all sub stream recording segments for detections with active/moving objects
+      mode: motion
 
 # Optional: Configuration for the snapshots written to the clips directory for each tracked object
 # Timestamp, bounding_box, crop and height settings are applied by default to API requests for snapshots.
@@ -813,7 +865,8 @@ classification:
         cameras:
           camera_name:
             # Required: Crop of image frame on this camera to run classification on
-            crop: [0, 180, 220, 400]
+            # [x1, y1, x2, y2] as decimals between 0 and 1, relative to the detect resolution
+            crop: [0.0, 0.25, 0.3, 0.85]
         # Optional: If classification should be run when motion is detected in the crop (default: shown below)
         motion: False
         # Optional: Interval to run classification on in seconds (default: shown below)
@@ -884,7 +937,7 @@ cameras:
         # Required: the path to the stream
         # NOTE: path may include environment variables or docker secrets, which must begin with 'FRIGATE_' and be referenced in {}
         - path: rtsp://viewer:{FRIGATE_RTSP_PASSWORD}@10.0.10.10:554/cam/realmonitor?channel=1&subtype=2
-          # Required: list of roles for this stream. valid values are: audio,detect,record
+          # Required: list of roles for this stream. valid values are: audio,detect,record,record_sub
           # NOTICE: In addition to assigning the audio, detect, and record roles
           # they must also be enabled in the camera config.
           roles:
@@ -977,7 +1030,9 @@ cameras:
       # Optional: Adjust sort order of cameras in the UI. Larger numbers come later (default: shown below)
       # By default the cameras are sorted alphabetically.
       order: 0
-      # Optional: Whether or not to show the camera in the Frigate UI (default: shown below)
+      # Optional: Whether or not to show the camera on the default All Cameras live dashboard.
+      # The camera is still available everywhere else, including camera groups and settings
+      # (default: shown below)
       dashboard: True
       # Optional: Whether this camera is visible in review (the review page and its camera
       # filter, motion review, and the history view) (default: shown below)

docs/docs/configuration/advanced/system.md

@@ -63,15 +63,9 @@ go2rtc:
 
 ### `environment_vars`
 
-This section can be used to set environment variables for those unable to modify the environment of the container, like within Home Assistant OS. Docker users should set environment variables in their `docker run` command (`-e FRIGATE_MQTT_PASSWORD=secret`) or `docker-compose.yml` file (`environment:` section) instead. Note that values set here are stored in plain text in your config file, so if the goal is to keep credentials out of your configuration, use Docker environment variables or Docker secrets instead.
+This section sets environment variables in the Frigate process for those unable to modify the environment of the container, like within Home Assistant OS. It's meant for process settings such as `LIBVA_DRIVER_NAME` or the TensorFlow thread counts below. Docker users should set environment variables in their `docker run` command (`-e LIBVA_DRIVER_NAME=i965`) or `docker-compose.yml` file (`environment:` section) instead. Values set here are stored in plain text in your config file, so credentials belong in `secrets.yaml`, Docker environment variables, or Docker secrets instead.
 
-Variables prefixed with `FRIGATE_` can be referenced in config fields that support environment variable substitution (such as MQTT host and credentials, camera stream URLs, and ONVIF host and credentials) using the `{FRIGATE_VARIABLE_NAME}` syntax.
-
-:::note
-
-The `go2rtc` section is an exception. go2rtc runs as a separate process, so its stream definitions can only be substituted with variables that exist in the container's environment (set via Docker `-e`, the `environment:` section of `docker-compose.yml`, or Docker secrets). Variables defined in the `environment_vars` block above are not available to go2rtc streams. Home Assistant app users, who cannot set container environment variables, must instead put credentials directly in their go2rtc stream URLs.
-
-:::
+Names prefixed with `FRIGATE_` set here also take part in `{FRIGATE_VARIABLE_NAME}` substitution (see [below](#substitution-sources-and-precedence)), but `secrets.yaml` is the better home for them.
 
 <ConfigTabs>
 <TabItem value="ui">
@@ -80,23 +74,17 @@ Navigate to <NavPath path="Settings > System > Environment variables" /> to add
 
 | Field             | Description                                               |
 | ----------------- | --------------------------------------------------------- |
-| **Variable name** | The environment variable name (e.g., `FRIGATE_MQTT_USER`) |
+| **Variable name** | The environment variable name (e.g., `LIBVA_DRIVER_NAME`) |
 | **Value**         | The value for the variable                                |
 
-Variables defined here can be referenced elsewhere in your configuration using the `{FRIGATE_VARIABLE_NAME}` syntax.
+Names prefixed with `FRIGATE_` can also be referenced elsewhere in your configuration using the `{FRIGATE_VARIABLE_NAME}` syntax.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
 environment_vars:
-  FRIGATE_MQTT_USER: my_mqtt_user
-  FRIGATE_MQTT_PASSWORD: my_mqtt_password
-
-mqtt:
-  host: "{FRIGATE_MQTT_HOST}"
-  user: "{FRIGATE_MQTT_USER}"
-  password: "{FRIGATE_MQTT_PASSWORD}"
+  LIBVA_DRIVER_NAME: i965
 ```
 
 </TabItem>
@@ -130,6 +118,51 @@ environment_vars:
 </TabItem>
 </ConfigTabs>
 
+### `secrets.yaml`
+
+A `secrets.yaml` file next to your `config.yml` is an additional source of `FRIGATE_` variables, for installs that can't set container environment variables or mount Docker secrets. It's a flat map of names to values, and it is never read or written by the Frigate UI:
+
+```yaml
+FRIGATE_CAM_USER: viewer
+FRIGATE_CAM_PASS: "p@ss w0rd"
+FRIGATE_MQTT_HOST: mqtt.internal.example
+```
+
+For Docker this is `/config/secrets.yaml` inside the container, so it lives in whatever host directory you mounted at `/config`. For the Home Assistant App it's `/addon_configs/<addon_directory>/secrets.yaml`, in the same folder as your `config.yml`; see [the App config directory](../config.md#accessing-app-config-dir) for the directory name for your variant.
+
+Names must start with `FRIGATE_`, and nesting is not supported. `secrets.yaml` feeds `{FRIGATE_VARIABLE_NAME}` substitution, so the handful of variables Frigate reads straight from the process environment, such as `FRIGATE_JWT_SECRET`, still need a container environment variable or a Docker secret.
+
+### Substitution sources and precedence
+
+The same `{FRIGATE_VARIABLE_NAME}` placeholder resolves from four sources. When a name is defined in more than one, the higher one wins and a warning at startup names which source was used.
+
+| Priority    | Source                | Where it's set                                                             | Who can use it                 |
+| ----------- | --------------------- | -------------------------------------------------------------------------- | ------------------------------ |
+| 1 (highest) | Docker secrets        | Files in `/run/secrets`, or the directory named by `CREDENTIALS_DIRECTORY` | Docker, systemd                |
+| 2           | Container environment | `docker run -e`, the `environment:` section of `docker-compose.yml`        | Docker                         |
+| 3           | `secrets.yaml`        | Next to `config.yml`, see above                                            | Everyone, including the HA App |
+| 4 (lowest)  | `environment_vars`    | The block in `config.yml` described above                                  | Everyone, including the HA App |
+
+For example, with this `secrets.yaml`:
+
+```yaml
+FRIGATE_MQTT_PASSWORD: from_secrets
+```
+
+and this `config.yml`:
+
+```yaml
+environment_vars:
+  FRIGATE_MQTT_PASSWORD: from_config
+
+mqtt:
+  password: "{FRIGATE_MQTT_PASSWORD}"
+```
+
+the password resolves to `from_secrets`, and the log shows `FRIGATE_MQTT_PASSWORD is defined in more than one place, using the value from secrets.yaml`. Add `-e FRIGATE_MQTT_PASSWORD=from_env` to the container and it resolves to `from_env` instead.
+
+Referencing a name that no source defines is a config validation error naming the field.
+
 ### `database`
 
 Tracked object and recording information is managed in a sqlite database at `/config/frigate.db`. If that database is deleted, recordings will be orphaned and will need to be cleaned up manually. They also won't show up in the Media Browser within Home Assistant.
@@ -177,7 +210,7 @@ Custom models may also require different input tensor formats. The colorspace co
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and open the **Custom Model** tab to configure the model path, dimensions, and input format.
+Navigate to <NavPath path="Settings > System > Detection models" /> and, on the model you want to change, open the **Custom Model** tab to configure the model path, dimensions, and input format.
 
 | Field                                         | Description                          |
 | --------------------------------------------- | ------------------------------------ |
@@ -192,12 +225,14 @@ Navigate to <NavPath path="Settings > System > Detectors and model" /> and open
 
 ```yaml
 # Optional: model config
-model:
-  path: /path/to/model
-  width: 320
-  height: 320
-  input_tensor: "nhwc"
-  input_pixel_format: "bgr"
+models:
+  - devices:
+      - openvino:GPU
+    path: /path/to/model
+    width: 320
+    height: 320
+    input_tensor: "nhwc"
+    input_pixel_format: "bgr"
 ```
 
 </TabItem>
@@ -214,15 +249,15 @@ If the labelmap is customized then the labels used for alerts will need to be ad
 The labelmap can be customized to your needs. A common reason to do this is to combine multiple object types that are easily confused when you don't need to be as granular such as car/truck. By default, truck is renamed to car because they are often confused. You cannot add new object types, but you can change the names of existing objects in the model.
 
 ```yaml
-model:
-  labelmap:
-    2: vehicle
-    3: vehicle
-    5: vehicle
-    7: vehicle
-    15: animal
-    16: animal
-    17: animal
+models:
+  - labelmap:
+      2: vehicle
+      3: vehicle
+      5: vehicle
+      7: vehicle
+      15: animal
+      16: animal
+      17: animal
 ```
 
 Note that if you rename objects in the labelmap, you will also need to update your `objects -> track` list as well.
@@ -293,6 +328,10 @@ networking:
 
 This setting is for advanced users. For the majority of use cases it's recommended to change the `ports` section of your Docker compose file or use the Docker `run` `--publish` option instead, e.g. `-p 443:8971`. Changing Frigate's ports may break some integrations.
 
+The internal and external ports must be different port numbers, and Frigate will refuse to start otherwise. Requests arriving on the internal port are treated as authenticated admins, so pointing both at the same port would remove authentication from the external one.
+
+Nginx binds these ports when it starts, so port changes only take effect after Frigate restarts.
+
 :::
 
 ### Customizing the Nginx configuration
@@ -335,7 +374,7 @@ For example:
 ```
 services:
   frigate:
-    image: blakeblackshear/frigate:latest
+    image: ghcr.io/blakeblackshear/frigate:stable
     environment:
       - FRIGATE_BASE_PATH=/frigate
 ```

docs/docs/configuration/audio_detectors.md

@@ -114,6 +114,30 @@ audio:
 </TabItem>
 </ConfigTabs>
 
+#### Grouping Audio Labels
+
+Related audio classes can be grouped under one label by mapping their numeric
+class IDs to the same name. Add the grouped name to `listen` and use it for any
+corresponding filter:
+
+```yaml
+audio:
+  listen:
+    - dogs
+  labelmap:
+    69: dogs # dog
+    70: dogs # bark
+    75: dogs # whimper_dog
+  filters:
+    dogs:
+      threshold: 0.8
+```
+
+Class IDs are zero-based indices in
+[`audio-labelmap.txt`](https://github.com/blakeblackshear/frigate/blob/dev/audio-labelmap.txt),
+so each ID is one less than the displayed file line number.
+Audio label mappings are separate from the object detector's `model.labelmap`.
+
 ### Common Audio Labels
 
 The labelmap includes hundreds of sound types. The labels below are the ones most users may find practical, grouped by what they're typically used for. Use the exact label string from the left column in your `listen` config, or search for the label in the Frigate UI directly.
@@ -256,7 +280,7 @@ The only field that is valid at the camera level is `enabled`.
 
 #### Live transcription
 
-The single camera Live view in the Frigate UI supports live transcription of audio for streams defined with the `audio` role. Use the Enable/Disable Live Audio Transcription button/switch to toggle transcription processing. When speech is heard, the UI will display a black box over the top of the camera stream with text. The MQTT topic `frigate/<camera_name>/audio/transcription` will also be updated in real-time with transcribed text.
+The single camera Live view in the Frigate UI supports live transcription of audio for streams defined with the `audio` role. Use the Enable/Disable Live Audio Transcription button/switch to toggle transcription processing, or toggle it outside of the UI with the [`frigate/<camera_name>/audio_transcription/set`](/integrations/mqtt#frigatecamera_nameaudio_transcriptionset) MQTT topic or the HTTP API. When speech is heard, the UI will display a black box over the top of the camera stream with text. The MQTT topic `frigate/<camera_name>/audio/transcription` will also be updated in real-time with transcribed text.
 
 Results can be error-prone due to a number of factors, including:
 
@@ -272,7 +296,7 @@ If you have CUDA hardware, you can experiment with the `large` `whisper` model o
 
 #### Transcription and translation of `speech` audio events
 
-Any `speech` events in Explore can be transcribed and/or translated through the Transcribe button in the Tracked Object Details pane.
+Any `speech` events in Explore can be transcribed and/or translated through the Transcribe button (the microphone icon) in the Tracked Object Details pane.
 
 In order to use transcription and translation for past events, you must enable audio detection and define `speech` as an audio type to listen for. To have `speech` events translated into the language of your choice, set the `language` config parameter with the correct [language code](https://github.com/openai/whisper/blob/main/whisper/tokenizer.py#L10).
 
@@ -294,7 +318,7 @@ Recorded `speech` events will always use a `whisper` model, regardless of the `m
 
    Because transcription is **serialized (one event at a time)** and speech events can be generated far faster than they can be processed, an auto-transcribe toggle would very quickly create an ever-growing backlog and degrade core functionality. For the amount of engineering and risk involved, it adds **very little practical value** for the majority of deployments, which are often on low-powered, edge hardware.
 
-   If you hear speech that's actually important and worth saving/indexing for the future, **just press the transcribe button in Explore** on that specific `speech` event - that keeps things explicit, reliable, and under your control.
+   If you hear speech that's actually important and worth saving/indexing for the future, **just press the transcribe button (the microphone icon) in Explore** on that specific `speech` event - that keeps things explicit, reliable, and under your control.
 
    Other options are being considered for future versions of Frigate to add transcription options that support external `whisper` Docker containers. A single transcription service could then be shared by Frigate and other applications (for example, Home Assistant Voice), and run on more powerful machines when available.
 

docs/docs/configuration/authentication.md

@@ -262,6 +262,19 @@ In this example:
 
 - Admin precedence: if the `admin` mapping matches, Frigate resolves the session to `admin` to avoid accidental downgrade when a user belongs to multiple groups (for example both `admin` and `viewer` groups).
 
+:::note
+
+If a user isn't getting the role you expect, enable debug logging to see exactly what headers Frigate is receiving from your proxy:
+
+```yaml
+logger:
+  default: info
+  logs:
+    frigate.api.auth: debug
+```
+
+:::
+
 #### Port Considerations
 
 **Authenticated Port (8971)**

docs/docs/configuration/birdseye.md

@@ -18,13 +18,17 @@ Each camera tile in Birdseye is composed from the frames of the stream assigned
 
 ## Birdseye Behavior
 
-### Birdseye Modes
+### Birdseye Activity Types
 
-Birdseye offers different modes to customize which cameras show under which circumstances.
+Birdseye offers independent activity types that control when cameras are shown. Multiple activity types can be listed together.
 
-- **continuous:** All cameras are always included
-- **motion:** Cameras that have detected motion within the last 30 seconds are included
-- **objects:** Cameras that have tracked an active object within the last 30 seconds are included
+- **continuous:** The camera is always included
+- **motion:** The camera is included when motion was detected within the last 30 seconds
+- **all_objects:** The camera is included when a tracked object is present, active or stationary
+- **alerts:** The camera is included while an alert review item is in progress
+- **detections:** The camera is included while a detection review item is in progress
+
+`alerts` and `detections` follow the review item's own lifetime, so the camera is removed as soon as the review item ends. Which objects qualify for each is set in [review configuration](./review.md).
 
 ### Custom Birdseye Icon
 
@@ -39,27 +43,29 @@ To include a camera in Birdseye view only for specific circumstances, or exclude
 
 **Global settings:** Navigate to <NavPath path="Settings > System > Birdseye" /> to configure the default Birdseye behavior for all cameras.
 
-**Per-camera overrides:** Navigate to <NavPath path="Settings > Camera configuration > Birdseye" /> to override the mode or disable Birdseye for a specific camera.
+**Per-camera overrides:** Navigate to <NavPath path="Settings > Camera configuration > Birdseye" /> to override the activity types or disable Birdseye for a specific camera.
 
-| Field               | Description                                                   |
-| ------------------- | ------------------------------------------------------------- |
-| **Enable Birdseye** | Whether this camera appears in Birdseye view                  |
-| **Tracking mode**   | When to show the camera: `continuous`, `motion`, or `objects` |
+| Field                  | Description                                                |
+| ---------------------- | ---------------------------------------------------------- |
+| **Enable Birdseye**    | Whether this camera appears in Birdseye view               |
+| **Activity types**     | Conditions that determine when to show the camera          |
 
 </TabItem>
 <TabItem value="yaml">
 
-```yaml {8-10,12-14}
+```yaml {10-12,15-16}
 # Include all cameras by default in Birdseye view
 birdseye:
   enabled: True
-  mode: continuous
+  modes:
+    - continuous
 
 cameras:
   front:
-    # Only include the "front" camera in Birdseye view when objects are detected
+    # Only include the "front" camera in Birdseye view when an alert is in progress
     birdseye:
-      mode: objects
+      modes:
+        - alerts
   back:
     # Exclude the "back" camera from Birdseye view
     birdseye:
@@ -71,7 +77,7 @@ cameras:
 
 ### Birdseye Inactivity
 
-By default birdseye shows all cameras that have had the configured activity in the last 30 seconds. This threshold can be configured.
+By default birdseye shows all cameras that have had the configured activity in the last 30 seconds. This threshold can be configured, and applies to the `motion` and `all_objects` activity types only.
 
 <ConfigTabs>
 <TabItem value="ui">
@@ -140,7 +146,8 @@ Navigate to <NavPath path="Settings > System > Birdseye" /> and in the **Camera
 # Include all cameras by default in Birdseye view
 birdseye:
   enabled: True
-  mode: continuous
+  modes:
+    - continuous
 
 cameras:
   front:

docs/docs/configuration/camera_specific.md

@@ -165,7 +165,7 @@ If available, recommended settings are:
 
 #### Setup via the Add Camera Wizard
 
-The Add Camera Wizard is the recommended way to add a standard Reolink camera. Before starting, make sure [HTTP is enabled](https://support.reolink.com/articles/360003452893-How-to-Access-Reolink-Cameras-NVRs-Home-Hub-Locally-via-Web-Browsers/) in the camera's advanced network settings. The wizard uses the camera's HTTP API to determine its resolution and choose the recommended stream type from the table above.
+The [Add Camera Wizard](cameras.md#adding-a-camera-with-the-add-camera-wizard) is the recommended way to add a standard Reolink camera. Before starting, make sure [HTTP is enabled](https://support.reolink.com/articles/360003452893-How-to-Access-Reolink-Cameras-NVRs-Home-Hub-Locally-via-Web-Browsers/) in the camera's advanced network settings. The wizard uses the camera's HTTP API to determine its resolution and choose the recommended stream type from the table above.
 
 1. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />.
 2. Choose **Manual selection** as the stream detection method and select **Reolink** as the camera brand.

docs/docs/configuration/cameras.md

@@ -7,6 +7,74 @@ import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
 
+## Adding a camera with the Add Camera Wizard
+
+The Add Camera Wizard is the recommended way to add a camera. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />. The wizard connects to your camera, tests each stream, and writes the camera's configuration for you, including the [go2rtc](go2rtc.md) restream and the live view stream mapping, so a standard setup needs no hand-written YAML.
+
+### Step 1: Name and connection
+
+Enter a name for the camera along with its host or IP address and credentials, then choose how the wizard should find the camera's streams:
+
+- **Probe camera** queries the camera over ONVIF (the ONVIF port is usually 80 or 8080) and asks it for its stream URLs. Some cameras use a separate ONVIF/service account rather than the device admin user, and some require **Use digest authentication** to be enabled.
+- **Manual selection** builds a stream URL from a template for the camera brand you pick (Dahua/Amcrest/EmpireTech, Hikvision/Uniview/Annke, Ubiquiti, Reolink, Axis, TP-Link, or Foscam). Choose **Other** to enter a custom RTSP URL directly. Non-RTSP stream types must be [configured manually](#setting-up-camera-inputs).
+
+The name you enter is lowercased and spaces become underscores. If the result still isn't a valid config key, the wizard generates a safe name and stores what you typed as `friendly_name`.
+
+### Step 2: Probe or snapshot
+
+In probe mode, the wizard reports what the camera returned (manufacturer, model, firmware, profile count, and whether PTZ, presets, and [autotracking](autotracking.md) are supported) along with the RTSP URLs it discovered. Test each candidate to see its resolution, frame rate, and codecs together with a snapshot, then select the one you want to use.
+
+In manual mode, the wizard tests the templated URL and shows the same metadata and snapshot.
+
+If no RTSP URLs are found, the credentials may be wrong or the camera may not support ONVIF. Go back and use manual selection instead.
+
+### Step 3: Stream configuration
+
+Assign [roles](#setting-up-camera-inputs) to the stream, and use **Add Another Stream** to add the camera's other streams, for example a substream for `detect` alongside the main stream for `record`. At least one stream must have the `detect` role before you can continue.
+
+**Reduce connections to camera** routes that input through the go2rtc restream so Frigate and the live view share a single connection to the camera instead of each opening their own. See [restream](restream.md) for more detail.
+
+### Step 4: Validation and testing
+
+Connect each stream to get a live preview, an estimated bandwidth figure, and a list of validation results. The wizard checks for the most common misconfigurations, including:
+
+- A detect resolution that is too high (increased resource usage) or too low for reliable detection, or one it could not probe at all
+- A stream marked `record` whose audio codec is not AAC, or that has no audio at all
+- A stream marked `audio` that carries no audio stream
+- Using a restreamed input for the `record` role
+- Brand-specific issues, such as an RTSP stream on a Reolink camera that should use http-flv, or a Dahua/Hikvision substream selected for `detect`
+
+**Use stream compatibility mode** passes the stream through go2rtc's ffmpeg module. Enable it if a stream fails to load after several attempts. Note that this also prevents [two way talk](/configuration/live#two-way-talk) from being detected for that stream.
+
+**Save New Camera** writes the configuration and starts the camera right away. No restart is required.
+
+Other features, including [hardware acceleration](hardware_acceleration_video.md), [two way talk](/configuration/live#two-way-talk), and audio transcoding, is configured after the camera has been added. For camera model specific quirks, see the [camera specific](camera_specific.md) docs.
+
+## Deleting a camera
+
+Click **Delete Camera** in <NavPath path="Settings > Global configuration > Camera management" />, choose the camera, and confirm. Deleting a camera requires the `admin` role and cannot be undone.
+
+:::warning
+
+Deleting a camera permanently removes its recordings, tracked objects, and configuration. If you only want to stop processing a camera, set its state to **Off** or **Disabled** in <NavPath path="Settings > Global configuration > Camera management" /> instead. See [camera state](/configuration/live#camera-state).
+
+:::
+
+Deleting a camera removes:
+
+- The camera's section of your config file, along with its entries in any [role](authentication.md#user-roles) camera list. A custom role left with no cameras is removed as well.
+- Every database record for the camera: tracked objects, review items, recordings, previews, timeline entries, the saved region grid, and [triggers](semantic_search.md#triggers).
+- Every media file for the camera: recordings, snapshots, thumbnails, and preview clips.
+
+[Exports](/usage/exports) are kept by default, so saved footage survives the deletion of the camera it came from. Turn on **Also delete exports for this camera** in the confirmation step to remove those too.
+
+The camera's processes are stopped and the change takes effect immediately, so no restart is required. If the resulting config cannot be parsed, Frigate restores the previous config and reports an error instead of leaving Frigate in a broken state.
+
+Two things are not cleaned up for you:
+
+- **go2rtc streams.** Frigate makes a best effort to stop a running [go2rtc](go2rtc.md) stream named after the camera, but stream entries in your config file remain and are recreated on the next restart. Remove them in <NavPath path="Settings > System > go2rtc streams" /> or in your config file.
+- **Camera groups.** A deleted camera stays listed in any [camera group](#setting-up-camera-groups) that referenced it. The group skips the missing camera, so this is harmless, but you can edit the group to drop the stale entry.
+
 ## Setting Up Camera Inputs
 
 Several inputs can be configured for each camera and the role of each input can be mixed and matched based on your needs. This allows you to use a lower resolution stream for object detection, but create recordings from a higher resolution stream, or vice versa.
@@ -15,11 +83,12 @@ A camera is enabled by default but can be disabled by using `enabled: False`. Ca
 
 Each role can only be assigned to one input per camera. The options for roles are as follows:
 
-| Role     | Description                                                                         |
-| -------- | ----------------------------------------------------------------------------------- |
-| `detect` | Main feed for object detection. [docs](object_detectors.md)                         |
-| `record` | Saves segments of the video feed based on configuration settings. [docs](record.md) |
-| `audio`  | Feed for audio based detection. [docs](audio_detectors.md)                          |
+| Role         | Description                                                                                                  |
+| ------------ | ------------------------------------------------------------------------------------------------------------ |
+| `detect`     | Main feed for object detection. [docs](object_detectors.md)                                                  |
+| `record`     | Saves segments of the video feed based on configuration settings. [docs](record.md)                          |
+| `record_sub` | Saves segments of a second, lower quality stream with its own retention. [docs](record.md#sub-stream-recording) |
+| `audio`      | Feed for audio based detection. [docs](audio_detectors.md)                                                   |
 
 <ConfigTabs>
 <TabItem value="ui">
@@ -69,7 +138,7 @@ Additional cameras are simply added under the camera configuration section.
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and use the add camera button to configure each additional camera.
+Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and use the [Add Camera Wizard](#adding-a-camera-with-the-add-camera-wizard) to configure each additional camera.
 
 </TabItem>
 <TabItem value="yaml">

docs/docs/configuration/config.md

@@ -20,7 +20,7 @@ Settings are organized into two scopes:
 - **Global configuration**: values under <NavPath path="Settings > Global configuration" /> apply to every camera by default. This is where you set the baseline behavior for object detection, recording, snapshots, motion, and so on.
 - **Camera configuration**: values under <NavPath path="Settings > Camera configuration" /> apply to a single camera. Use the camera selector button at the top of these pages to choose which camera you are editing.
 
-When a camera-level section is left untouched, the camera simply inherits the global values. Changing a value on a camera page **overrides** the global value for that camera only: the global setting and every other camera are unaffected. This mirrors how the YAML works, where a value set under `cameras.<name>` takes precedence over the same value set at the top level.
+When a camera-level section is left untouched, the camera simply inherits the global values. Changing a value on a camera page **overrides** the global value for that camera only: the global setting and every other camera are unaffected. This mirrors how the YAML works, where a value set under `cameras.<name>` takes precedence over the same value set at the top level. See [Global and Camera-Level Configuration](./config_overrides.md) for the full details, including how lists and maps are handled and which settings must be enabled globally first.
 
 To undo an override and go back to inheriting from the parent scope, use the reset button at the bottom of the section:
 
@@ -100,7 +100,7 @@ VS Code supports JSON schemas for automatically validating configuration files.
 
 ## Environment Variable Substitution
 
-Frigate supports the use of environment variables starting with `FRIGATE_` **only** where specifically indicated in the [reference config](./advanced/reference.md). For example, the following values can be replaced at runtime by using environment variables:
+Frigate supports the use of environment variables starting with `FRIGATE_` **only** where specifically indicated in the [reference config](./advanced/reference.md). See [substitution sources and precedence](./advanced/system.md#substitution-sources-and-precedence) for where those values can come from, including `secrets.yaml`. For example, the following values can be replaced at runtime by using environment variables:
 
 ```yaml
 mqtt:
@@ -130,7 +130,8 @@ go2rtc:
 
 ```yaml
 genai:
-  api_key: "{FRIGATE_GENAI_API_KEY}"
+  my_provider:
+    api_key: "{FRIGATE_GENAI_API_KEY}"
 ```
 
 ## Common configuration examples
@@ -153,7 +154,7 @@ Here are some common starter configuration examples. These can be configured thr
 
 1. Navigate to <NavPath path="Settings > System > MQTT" /> and configure the MQTT connection to your Home Assistant Mosquitto broker
 2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `Raspberry Pi (H.264)`
-3. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`
+3. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown
 4. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
 5. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
 6. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
@@ -171,10 +172,9 @@ mqtt:
 ffmpeg:
   hwaccel_args: preset-rpi-64-h264
 
-detectors:
-  coral:
-    type: edgetpu
-    device: usb
+models:
+  - devices:
+      - edgetpu:usb
 
 record:
   enabled: True
@@ -232,7 +232,7 @@ cameras:
 
 1. Navigate to <NavPath path="Settings > System > MQTT" /> and set **Enable MQTT** to off
 2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `VAAPI (Intel/AMD GPU)`
-3. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`
+3. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown
 4. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
 5. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
 6. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
@@ -248,10 +248,9 @@ mqtt:
 ffmpeg:
   hwaccel_args: preset-vaapi
 
-detectors:
-  coral:
-    type: edgetpu
-    device: usb
+models:
+  - devices:
+      - edgetpu:usb
 
 record:
   enabled: True
@@ -309,8 +308,8 @@ cameras:
 
 1. Navigate to <NavPath path="Settings > System > MQTT" /> and configure the connection to your MQTT broker
 2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `VAAPI (Intel/AMD GPU)`
-3. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `openvino` and **Device** `AUTO`
-4. On the same page, in the **Custom Model** tab, configure the OpenVINO model path and settings
+3. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Intel GPU** from the **Hardware** dropdown
+4. On the same model, open the **Custom Model** tab and configure the OpenVINO model path and settings
 5. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
 6. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
 7. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
@@ -328,15 +327,12 @@ mqtt:
 ffmpeg:
   hwaccel_args: preset-vaapi
 
-detectors:
-  ov:
-    type: openvino
-    device: AUTO
-
-model:
-  width: 300
-  height: 300
-  input_tensor: nhwc
+models:
+  - devices:
+      - openvino:AUTO
+    width: 300
+    height: 300
+    input_tensor: nhwc
   input_pixel_format: bgr
   path: /openvino-model/ssdlite_mobilenet_v2.xml
   labelmap_path: /openvino-model/coco_91cl_bkgr.txt

docs/docs/configuration/config_overrides.md

@@ -0,0 +1,244 @@
+---
+id: config_overrides
+title: Global and Camera-Level Configuration
+---
+
+import ConfigTabs from "@site/src/components/ConfigTabs";
+import TabItem from "@theme/TabItem";
+import NavPath from "@site/src/components/NavPath";
+
+Most of Frigate's configuration can be set once for all cameras and then adjusted for individual cameras. The global value acts as the default for every camera, and any camera can override it.
+
+This page explains how that inheritance works. For a tour of the Settings UI itself, see [Frigate Configuration](./config.md).
+
+## The basics
+
+Set a value globally and every camera uses it. Set the same value on a camera and that camera uses its own value instead.
+
+<ConfigTabs>
+<TabItem value="ui">
+
+1. Navigate to <NavPath path="Settings > Global configuration > Object detection" /> and set **Detect FPS** to `5`. Every camera now detects at 5 fps.
+2. Navigate to <NavPath path="Settings > Camera configuration > Object detection" />, select the `driveway` camera, and set **Detect FPS** to `10`.
+
+The `driveway` camera now detects at 10 fps. Every other camera still uses the global value of 5.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+detect:
+  fps: 5 # every camera detects at 5 fps
+
+cameras:
+  front_door:
+    ffmpeg: ...
+  driveway:
+    ffmpeg: ...
+    detect:
+      fps: 10 # except this one
+```
+
+`front_door` inherits `fps: 5`, and `driveway` uses `10`.
+
+</TabItem>
+</ConfigTabs>
+
+## Overrides apply per value, not per section
+
+Overriding one value in a section does not detach the rest of that section. Everything you don't set on the camera still comes from the global configuration.
+
+<ConfigTabs>
+<TabItem value="ui">
+
+If you set a camera's **Motion threshold** but leave **Contour area** alone, only the threshold is overridden. The contour area continues to follow <NavPath path="Settings > Global configuration > Motion detection" />, and changing it there still affects that camera.
+
+Open a section to see which values are overridden: the section header indicates how many fields differ from the global configuration.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+motion:
+  threshold: 30
+  contour_area: 10
+
+cameras:
+  driveway:
+    motion:
+      threshold: 40
+```
+
+The `driveway` camera ends up with `threshold: 40` and `contour_area: 10`. Only the value you wrote was overridden.
+
+</TabItem>
+</ConfigTabs>
+
+## Returning a camera to the global value
+
+<ConfigTabs>
+<TabItem value="ui">
+
+A camera section that has its own values shows an **Overridden** badge. To remove the override and go back to inheriting, use the **Reset to Global** button at the bottom of the section.
+
+</TabItem>
+<TabItem value="yaml">
+
+Frigate treats a camera value as an override because it is written in the config file, not because it differs from the global value. Repeating the global value under a camera still creates an override:
+
+```yaml
+snapshots:
+  enabled: true
+
+cameras:
+  driveway:
+    snapshots:
+      enabled: true # this is an override, even though it matches
+```
+
+If you later change the global `snapshots.enabled` to `false`, `driveway` keeps saving snapshots, because it has its own value. To make a camera follow the global value again, delete the key from the camera rather than setting it to match.
+
+</TabItem>
+</ConfigTabs>
+
+## Lists replace, maps merge
+
+This is the distinction that surprises people most.
+
+**Lists are replaced entirely.** A camera's list does not add to the global list, it takes its place.
+
+<ConfigTabs>
+<TabItem value="ui">
+
+The camera page shows the objects the camera is currently tracking, starting from the global list. Changing that selection under <NavPath path="Settings > Camera configuration > Objects" /> replaces the list for that camera, so make sure every object you want tracked is selected, not just the ones you are adding.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+objects:
+  track:
+    - person
+    - car
+
+cameras:
+  backyard:
+    objects:
+      track:
+        - dog # backyard tracks ONLY dog, not person or car
+```
+
+To track `dog` in addition to the global objects, list all of them on the camera.
+
+</TabItem>
+</ConfigTabs>
+
+An empty list is a valid override, and is the normal way to opt a camera out of something:
+
+```yaml
+review:
+  alerts:
+    labels:
+      - person
+
+cameras:
+  street:
+    review:
+      alerts:
+        labels: [] # this camera never creates alerts
+```
+
+**Maps are merged key by key.** A camera can add an entry without redeclaring the others.
+
+<ConfigTabs>
+<TabItem value="ui">
+
+Adding a filter for one object under <NavPath path="Settings > Camera configuration > Objects" /> does not remove the filters inherited from <NavPath path="Settings > Global configuration > Objects" />. The camera keeps both.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+objects:
+  filters:
+    person:
+      min_area: 5000
+
+cameras:
+  driveway:
+    objects:
+      filters:
+        car:
+          min_area: 10000
+```
+
+The `driveway` camera ends up with both the `car` filter it defined and the `person` filter from the global configuration.
+
+</TabItem>
+</ConfigTabs>
+
+## Which settings can be overridden
+
+Most, but not all. The [full reference config](./advanced/reference.md) is the authoritative source: sections that support camera-level overrides are marked with the comment `# NOTE: Can be overridden at the camera level`. In the UI, a setting can be overridden if it appears under both <NavPath path="Settings > Global configuration" /> and <NavPath path="Settings > Camera configuration" />.
+
+A few things worth knowing beyond that:
+
+- Some sections are **global only** and have no camera-level equivalent, including `go2rtc`, `genai` providers, `classification`, `telemetry`, `camera_groups`, and `ui`.
+- Some sections exist **only at the camera level**, such as `zones` and `onvif`.
+- Some sections are **partially overridable**, meaning a camera accepts only a few of the keys available globally. `face_recognition`, `lpr`, and `audio_transcription` work this way, and the reference config notes which keys apply.
+
+## Enrichments that must be enabled globally first
+
+License plate recognition and face recognition are special: the global setting is not just a default, it is a switch that must be on before any camera can use the feature. Enabling one on a camera while it is disabled globally is a configuration error, and Frigate will refuse to start:
+
+```
+Camera driveway has lpr enabled but lpr is disabled at the global level of the config. You must enable lpr at the global level.
+```
+
+Enable the feature globally, then turn it off on the cameras that don't need it.
+
+<ConfigTabs>
+<TabItem value="ui">
+
+1. Navigate to <NavPath path="Settings > Global configuration > License plate recognition" /> and enable **LPR**.
+2. Navigate to <NavPath path="Settings > Camera configuration > License plate recognition" />, select each camera that should not run LPR, and disable the **Enable LPR** toggle.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+lpr:
+  enabled: true
+
+cameras:
+  driveway:
+    ffmpeg: ... # inherits lpr, enabled
+  backyard:
+    ffmpeg: ...
+    lpr:
+      enabled: false # opted out
+```
+
+</TabItem>
+</ConfigTabs>
+
+:::note
+
+This applies only to `lpr` and `face_recognition`, because the global setting controls whether the supporting background process starts at all. Other features do not work this way. Audio transcription, for example, can be enabled on a single camera without being enabled globally.
+
+:::
+
+## Profiles
+
+[Profiles](./profiles.md) add a further layer on top of everything described above. A profile is a named set of camera overrides that you can switch on and off while Frigate is running, for example to change detection and recording behavior when you leave the house.
+
+Profiles are applied on top of a camera's already-resolved configuration, so a profile value wins over both the camera and the global value while that profile is active. Profiles cover a subset of the camera sections and do not modify your config file.
+
+## Summary
+
+- A camera inherits every value you don't set on it.
+- Overriding one value does not detach the rest of the section.
+- Writing a value on a camera overrides it, even if it matches the global value. Remove it to inherit again.
+- Lists replace the global list. Maps merge into it.
+- An empty list is an override, not an omission.
+- `lpr` and `face_recognition` must be enabled globally before a camera can use them.

docs/docs/configuration/custom_classification/object_classification.md

@@ -11,7 +11,7 @@ Object classification allows you to train a custom MobileNetV2 classification mo
 
 :::info
 
-Training a custom object classification model requires a one-time internet connection to download MobileNetV2 base weights. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
+Training a custom object classification model requires an internet connection to download MobileNetV2 base weights. By default these weights are not cached in `/config/`, so they are downloaded again after the container is recreated. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
 
 :::
 

docs/docs/configuration/custom_classification/state_classification.md

@@ -11,7 +11,7 @@ State classification allows you to train a custom MobileNetV2 classification mod
 
 :::info
 
-Training a custom state classification model requires a one-time internet connection to download MobileNetV2 base weights. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
+Training a custom state classification model requires an internet connection to download MobileNetV2 base weights. By default these weights are not cached in `/config/`, so they are downloaded again after the container is recreated. Once trained, the model runs fully offline. See [Network Requirements](/frigate/network_requirements#one-time-model-downloads) for details.
 
 :::
 
@@ -73,9 +73,13 @@ classification:
         interval: 10 # also run every N seconds (optional)
         cameras:
           front:
-            crop: [0, 180, 220, 400]
+            # [x1, y1, x2, y2] as decimals between 0 and 1, relative to the
+            # camera's detect resolution
+            crop: [0.0, 0.25, 0.3, 0.85]
 ```
 
+Crop coordinates are normalized: each value is a fraction of the camera's `detect` width or height, not a pixel value. Drawing the crop in the UI wizard writes these values for you.
+
 An optional config, `save_attempts`, can be set as a key under the model name. This defines the number of classification attempts to save in the Recent Classifications tab. For state classification models, the default is 100.
 
 </TabItem>

docs/docs/configuration/face_recognition.md

@@ -232,7 +232,21 @@ Once front-facing images are performing well, start choosing slightly off-angle
 
 Start with the [Usage](#usage) section and re-read the [Model Requirements](#model-requirements) above.
 
-1. Ensure `person` is being _detected_. A `person` will automatically be scanned by Frigate for a face. Any detected faces will appear in the Recent Recognitions tab in the Frigate UI's Face Library.
+1. Enable debug logs to see exactly what Frigate is doing.
+   - Enable debug logs for face recognition by adding `frigate.data_processing.real_time.face: debug` to your `logger` configuration. Restart Frigate after this change.
+
+     ```yaml
+     logger:
+       default: info
+       logs:
+         # highlight-next-line
+         frigate.data_processing.real_time.face: debug
+     ```
+
+   - These logs report where the pipeline stopped for each `person` object, such as no face being found within the person's bounding box, the detected face being smaller than `min_area`, or a face being recognized but scoring too low.
+   - If you see no face-related messages at all, also add `frigate.embeddings.maintainer: debug` to confirm that the face processor was created at startup and that `person` updates are reaching it.
+
+2. Ensure `person` is being _detected_. A `person` will automatically be scanned by Frigate for a face. Any detected faces will appear in the Recent Recognitions tab in the Frigate UI's Face Library.
 
    If you are using a Frigate+ or `face` detecting model:
    - Watch the [debug view](/usage/live#the-single-camera-view) to ensure that `face` is being detected along with `person`.
@@ -242,7 +256,7 @@ Start with the [Usage](#usage) section and re-read the [Model Requirements](#mod
    - Check your `detect` stream resolution and ensure it is sufficiently high enough to capture face details on `person` objects.
    - You may need to lower your `detection_threshold` if faces are not being detected.
 
-2. Any detected faces will then be _recognized_.
+3. Any detected faces will then be _recognized_.
    - Make sure you have trained at least one face per the recommendations above.
    - Adjust `recognition_threshold` settings per the suggestions [above](#advanced-configuration).
 

docs/docs/configuration/ffmpeg_presets.md

@@ -106,3 +106,5 @@ Output arguments are passed to FFmpeg after your camera source and control how r
 | preset-record-mjpeg              | Record - MJPEG Cameras          | Record an MJPEG stream              | Restreaming the MJPEG stream is recommended instead                                                                                                               |
 | preset-record-jpeg               | Record - JPEG Cameras           | Record a live JPEG                  | Restreaming the live JPEG is recommended instead                                                                                                                  |
 | preset-record-ubiquiti           | Record - Ubiquiti Cameras       | Record a Ubiquiti stream with audio | Handles Ubiquiti's non-standard audio format                                                                                                                      |
+
+These presets apply to the `record` output args. If [sub stream recording](/configuration/record#sub-stream-recording) is enabled, the same args are used for the `record_sub` role unless `output_args.record_sub` is set, which accepts the same presets and manual args.

docs/docs/configuration/genai/config.md

@@ -6,12 +6,46 @@ title: Configuring Generative AI
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
+import FaqItem from "@site/src/components/FaqItem";
 
 ## Configuration
 
-A Generative AI provider can be configured in the global config, which will make the Generative AI features available for use. There are currently 4 native providers available to integrate with Frigate. Other providers that support the OpenAI standard API can also be used. See the OpenAI-Compatible section below.
+A Generative AI provider can be configured in the global config, which will make the Generative AI features available for use. There are currently 5 native providers available to integrate with Frigate. Other providers that support the OpenAI standard API can also be used. See the OpenAI-Compatible section below.
 
-To use Generative AI, you must define a single provider at the global level of your Frigate configuration. If the provider you choose requires an API key, you may either directly paste it in your configuration, or store it in an environment variable prefixed with `FRIGATE_`.
+`genai` is a map of named providers. Each key under `genai` is a name you choose, and its value is that provider's settings:
+
+<ConfigTabs>
+<TabItem value="ui">
+
+1. Navigate to <NavPath path="Settings > Enrichments > Generative AI" />.
+   - Click **Add** and enter a **Provider name**. Any name of letters, numbers, hyphens, and underscores is accepted, but it cannot be changed from the UI after the provider is created.
+   - Set **Provider** to the service you are using (e.g., `ollama`)
+   - Set **Base URL**, **API key**, and **Model** as required by that provider
+   - Set **Roles** to the roles this provider should handle.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+genai:
+  my_provider: # any name you like
+    provider: ollama
+    base_url: http://localhost:11434
+    model: qwen3-vl:4b
+    roles:
+      - descriptions
+      - embeddings
+      - chat
+```
+
+</TabItem>
+</ConfigTabs>
+
+The examples on this page all use `my_provider`, but the name is arbitrary and is only used to reference the provider elsewhere in the config (for example, `semantic_search.model`).
+
+Each provider handles one or more **roles**: `chat`, `descriptions`, and `embeddings`. A provider handles all three by default, and each role may be assigned to exactly one provider. Define a single provider if you want it to do everything, or split the roles across several providers using the `roles` option.
+
+If the provider you choose requires an API key, you may either directly paste it in your configuration, or store it in an environment variable prefixed with `FRIGATE_`.
 
 ## Local Providers
 
@@ -25,14 +59,23 @@ Running Generative AI models on CPU is not recommended, as high inference times
 
 ### Recommended Local Models
 
-You must use a vision-capable model with Frigate. The following models are recommended for local deployment:
+#### Vision models
 
-| Model      | Notes                                                                                                                                                                |
-| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `qwen3-vl` | Strong visual and situational understanding, enhanced ability to identify smaller objects and interactions with object.                                              |
-| `qwen3.5`  | Strong situational understanding, but missing DeepStack from qwen3-vl leading to worse performance for identifying objects in people's hand and other small details. |
-| `qwen3.6`  | Strong situational understanding, similar to qwen3-vl                                                                                                                |
-| `gemma4`   | Strong situational understanding, sometimes resorts to more vague terms like 'interacts' instead of assigning a specific action.                                     |
+You must use a vision-capable model with Frigate. The following models are recommended for local deployment of the `descriptions` and `chat` roles:
+
+| Model               | Notes                                                                                                                                                                |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `qwen3-vl`          | Strong visual and situational understanding, enhanced ability to identify smaller objects and interactions with object.                                              |
+| `qwen3.6`/`qwen3.8` | Strong situational understanding, but missing DeepStack from qwen3-vl leading to worse performance for identifying objects in people's hand and other small details. |
+| `gemma4`            | Strong situational understanding, sometimes resorts to more vague terms like 'interacts' instead of assigning a specific action.                                     |
+
+#### Embedding models
+
+The `embeddings` role needs a different kind of model. Text queries are matched against the stored image embeddings, so the model must be trained to place images and text into the same vector space. A chat or description model will still return vectors when asked, but those vectors are not trained for retrieval and text searches will return poor matches with no error to indicate why.
+
+| Model                | Notes                                                                                                                                                               |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `qwen3-vl-embedding` | Multimodal embeddings for [Semantic Search](/configuration/semantic_search#genai-provider). Must be served by llama.cpp started with `--embeddings` and `--mmproj`. |
 
 :::info
 
@@ -78,23 +121,26 @@ All llama.cpp native options can be passed through `provider_options`, including
    - Set **Provider** to `llamacpp`
    - Set **Base URL** to your llama.cpp server address (e.g., `http://localhost:8080`)
    - Set **Model** to the name of your model
-   - Under **Provider Options**, set `context_size` to tell Frigate your context size so it can send the appropriate amount of information
+   - Optionally, under **Provider Options**, set `context_size` to override the context size Frigate detects from the server
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
 genai:
-  provider: llamacpp
-  base_url: http://localhost:8080
-  model: your-model-name
-  provider_options:
-    context_size: 16000 # Tell Frigate your context size so it can send the appropriate amount of information.
+  my_provider:
+    provider: llamacpp
+    base_url: http://localhost:8080
+    model: your-model-name
+    provider_options:
+      context_size: 16000 # Optional, overrides the context size reported by the server.
 ```
 
 </TabItem>
 </ConfigTabs>
 
+Frigate queries the llama.cpp server for the model's context size at startup and logs it along with the other detected capabilities. If `context_size` is set in `provider_options`, that value is always used instead, even when the server reports its own.
+
 ### Ollama
 
 [Ollama](https://ollama.com/) allows you to self-host large language models and keep everything running locally. It is highly recommended to host this server on a machine with an Nvidia graphics card, or on a Apple silicon Mac for best performance.
@@ -127,13 +173,14 @@ Note that Frigate will not automatically download the model you specify in your
 
 ```yaml
 genai:
-  provider: ollama
-  base_url: http://localhost:11434
-  model: qwen3-vl:4b
-  provider_options: # other Ollama client options can be defined
-    keep_alive: -1
-    options:
-      num_ctx: 8192 # make sure the context matches other services that are using ollama
+  my_provider:
+    provider: ollama
+    base_url: http://localhost:11434
+    model: qwen3-vl:4b
+    provider_options: # other Ollama client options can be defined
+      keep_alive: -1
+      options:
+        num_ctx: 8192 # make sure the context matches other services that are using ollama
 ```
 
 </TabItem>
@@ -149,11 +196,12 @@ For OpenAI-compatible servers (such as llama.cpp) that don't expose the configur
 
 ```yaml
 genai:
-  provider: openai
-  base_url: http://your-llama-server
-  model: your-model-name
-  provider_options:
-    context_size: 8192 # Specify the configured context size
+  my_provider:
+    provider: openai
+    base_url: http://your-llama-server
+    model: your-model-name
+    provider_options:
+      context_size: 8192 # Specify the configured context size
 ```
 
 This ensures Frigate uses the correct context window size when generating prompts.
@@ -176,10 +224,11 @@ This ensures Frigate uses the correct context window size when generating prompt
 
 ```yaml
 genai:
-  provider: openai
-  base_url: http://your-server:port
-  api_key: your-api-key # May not be required for local servers
-  model: your-model-name
+  my_provider:
+    provider: openai
+    base_url: http://your-server:port
+    api_key: your-api-key # May not be required for local servers
+    model: your-model-name
 ```
 
 </TabItem>
@@ -217,19 +266,21 @@ Ollama also supports [cloud models](https://ollama.com/cloud), where model infer
 
 ```yaml
 genai:
-  provider: ollama
-  base_url: http://localhost:11434
-  model: cloud-model-name
+  my_provider:
+    provider: ollama
+    base_url: http://localhost:11434
+    model: cloud-model-name
 ```
 
 or when using Ollama Cloud directly
 
 ```yaml
 genai:
-  provider: ollama
-  base_url: https://ollama.com
-  model: cloud-model-name
-  api_key: your-api-key
+  my_provider:
+    provider: ollama
+    base_url: https://ollama.com
+    model: cloud-model-name
+    api_key: your-api-key
 ```
 
 </TabItem>
@@ -267,9 +318,10 @@ To start using Gemini, you must first get an API key from [Google AI Studio](htt
 
 ```yaml
 genai:
-  provider: gemini
-  api_key: "{FRIGATE_GEMINI_API_KEY}"
-  model: gemini-2.5-flash
+  my_provider:
+    provider: gemini
+    api_key: "{FRIGATE_GEMINI_API_KEY}"
+    model: gemini-2.5-flash
 ```
 
 </TabItem>
@@ -279,12 +331,13 @@ genai:
 
 To use a different Gemini-compatible API endpoint, set the `provider_options` with the `base_url` key to your provider's API URL. For example:
 
-```yaml {4,5}
+```yaml {5,6}
 genai:
-  provider: gemini
-  ...
-  provider_options:
-    base_url: https://...
+  my_provider:
+    provider: gemini
+    ...
+    provider_options:
+      base_url: https://...
 ```
 
 Other HTTP options are available, see the [python-genai documentation](https://github.com/googleapis/python-genai).
@@ -318,9 +371,10 @@ To start using OpenAI, you must first [create an API key](https://platform.opena
 
 ```yaml
 genai:
-  provider: openai
-  api_key: "{FRIGATE_OPENAI_API_KEY}"
-  model: gpt-4o
+  my_provider:
+    provider: openai
+    api_key: "{FRIGATE_OPENAI_API_KEY}"
+    model: gpt-4o
 ```
 
 </TabItem>
@@ -336,13 +390,14 @@ To use a different OpenAI-compatible API endpoint, set the `OPENAI_BASE_URL` env
 
 For OpenAI-compatible servers (such as llama.cpp) that don't expose the configured context size in the API response, you can manually specify the context size in `provider_options`:
 
-```yaml {5,6}
+```yaml {6,7}
 genai:
-  provider: openai
-  base_url: http://your-llama-server
-  model: your-model-name
-  provider_options:
-    context_size: 8192 # Specify the configured context size
+  my_provider:
+    provider: openai
+    base_url: http://your-llama-server
+    model: your-model-name
+    provider_options:
+      context_size: 8192 # Specify the configured context size
 ```
 
 This ensures Frigate uses the correct context window size when generating prompts.
@@ -377,11 +432,91 @@ To start using Azure OpenAI, you must first [create a resource](https://learn.mi
 
 ```yaml
 genai:
-  provider: azure_openai
-  base_url: https://instance.cognitiveservices.azure.com/openai/responses?api-version=2025-04-01-preview
-  model: gpt-5-mini
-  api_key: "{FRIGATE_OPENAI_API_KEY}"
+  my_provider:
+    provider: azure_openai
+    base_url: https://instance.cognitiveservices.azure.com/openai/responses?api-version=2025-04-01-preview
+    model: gpt-5-mini
+    api_key: "{FRIGATE_OPENAI_API_KEY}"
 ```
 
 </TabItem>
 </ConfigTabs>
+
+## FAQ
+
+<FaqItem id="how-do-i-debug-genai-issues" question="How do I debug GenAI issues?">
+
+Frigate's Generative AI features are configured and enabled separately. [Review descriptions and summaries](/configuration/genai/genai_review) live under `review.genai`, and [object descriptions](/configuration/genai/genai_objects) live under `objects.genai`. Configuring a provider on this page does not enable either feature, and enabling one does not enable the other. Decide which of the two is not working, then work through the steps below.
+
+1. Confirm a provider is available and holds the `descriptions` role.
+   - Review descriptions, review summaries, and object descriptions all use the provider that has the `descriptions` role assigned in <NavPath path="Settings > Enrichments > Generative AI > Roles" /> (`genai.<provider>.roles`).
+   - A provider is contacted the first time one of its roles is actually used. A provider holding the `embeddings` role for semantic search is initialized during startup, while a `descriptions` provider is not initialized until the first description is requested, which may be well after boot.
+   - In <NavPath path="Settings > Enrichments > Generative AI" />, use **Refresh models** next to the model field. It queries the provider for its model list and is a quick way to verify that the base URL, API key, and network path between Frigate and your provider are correct.
+
+2. Confirm the feature you expect is actually enabled.
+   - Object descriptions are disabled by default. Turn on <NavPath path="Settings > Global configuration > Objects > GenAI object config > Enable GenAI" /> (`objects.genai.enabled`), either globally or per camera. This is the most common reason custom prompts appear to be ignored while review summaries are still being generated.
+   - Review descriptions are disabled by default. Turn on <NavPath path="Settings > Global configuration > Review > GenAI config > Enable GenAI descriptions" /> (`review.genai.enabled`). Once enabled, alerts are described by default but detections are not, so a detection-only review item will never get a summary unless **Enable GenAI for detections** (`review.genai.detections`) is also on.
+
+3. If object descriptions are never requested, check the filters that skip generation.
+   - <NavPath path="Settings > Global configuration > Objects > GenAI object config > GenAI objects" /> (`objects.genai.objects`) limits generation to specific labels, and **Required zones** (`objects.genai.required_zones`) requires the object to have entered one of those zones. If either is set and does not match, Frigate skips the request silently.
+   - Thumbnails are only collected while an object is moving. Objects that go stationary early contribute fewer frames.
+   - **Use snapshots** (`objects.genai.use_snapshot`) requires snapshots to be enabled for the camera. If the snapshot cannot be read, Frigate logs `Cannot load snapshot for <id>, file not found` and no description is generated.
+   - **Send on end** (`objects.genai.send_triggers.tracked_object_end`) is on by default. If you have turned it off in favor of **Early GenAI trigger** (`objects.genai.send_triggers.after_significant_updates`), descriptions are only requested once that number of updates is reached.
+
+4. Enable debug logs to see exactly what Frigate is doing. Restart Frigate after this change. The next step also requires a restart, so turn both on at the same time to avoid restarting twice.
+
+   ```yaml
+   logger:
+     default: info
+     logs:
+       # highlight-start
+       frigate.genai: debug
+       frigate.data_processing.post.object_descriptions: debug
+       frigate.data_processing.post.review_descriptions: debug
+       # highlight-end
+   ```
+
+5. Save the exact images and prompts that were sent to your provider.
+   - Turn on **Save thumbnails** for the feature you are debugging (`review.genai.debug_save_thumbnails` or `objects.genai.debug_save_thumbnails`). Both features write to `/media/frigate/clips/genai-requests/`, and these files are admin-only.
+   - Review descriptions write `genai-requests/<review_id>/` containing the numbered frames that were sent, plus `prompt.txt` and `response.txt` with the exact prompt and the raw, unparsed model response.
+   - Review summary reports write `genai-requests/<start_ts>-<end_ts>/prompt.txt` and `response.txt`. No images are involved, since a report summarizes existing review descriptions.
+   - Object descriptions write `genai-requests/<event_id>/` containing the numbered thumbnails. The prompt for object descriptions is not written to a file, it is only visible in the debug logs from step 4.
+   - Look at the saved images before blaming the model. If the object is small, blurry, or out of frame, no prompt will fix the result. For object descriptions, consider turning on **Use snapshots** (`objects.genai.use_snapshot`) to send a higher quality image. For review items, consider setting **Review image source** (`review.genai.image_source`) to `recordings` for 480p frames instead of the lower resolution preview frames.
+
+<ConfigTabs>
+<TabItem value="ui">
+
+For review descriptions, navigate to <NavPath path="Settings > Global configuration > Review" /> and set **GenAI config > Save thumbnails** to on.
+
+For object descriptions, navigate to <NavPath path="Settings > Global configuration > Objects" />, expand **GenAI object config**, and set **Save thumbnails** to on.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+review:
+  genai:
+    enabled: true
+    # highlight-next-line
+    debug_save_thumbnails: true
+
+objects:
+  genai:
+    enabled: true
+    # highlight-next-line
+    debug_save_thumbnails: true
+```
+
+</TabItem>
+</ConfigTabs>
+
+6. Verify the prompt is what you think it is.
+   - Object description prompts are the ones you control directly. A camera-level <NavPath path="Settings > Camera configuration > Objects > GenAI object config > Caption prompt" /> (`objects.genai.prompt`) overrides the global one, and an entry in **Object prompts** (`objects.genai.object_prompts`) for a label overrides both for that label. Only `{label}`, `{sub_label}`, and `{camera}` are substituted.
+   - Review description prompts are built by Frigate and request a structured JSON response, so they are not fully replaceable. The parts you control are <NavPath path="Settings > Global configuration > Review > GenAI config > Activity context prompt" /> (`review.genai.activity_context_prompt`) and **Additional concerns** (`review.genai.additional_concerns`). Keep the activity context prompt general, since overly specific rules will sway the model's threat level scoring.
+
+7. If descriptions are generated but the results are poor or inconsistent, look at the model and the context window.
+   - Empty fields, missing `shortSummary` values, or `Failed to parse review description` errors usually mean the model is not following the requested JSON schema. Smaller models struggle with structured output. Try a larger parameter size or one of the [recommended models](#recommended-local-models).
+   - Frigate calculates how many frames to send from the context size the provider reports. If your server reports a different value than it is actually running with, frames will be truncated or the request will fail. Pin the value by adding `context_size` under <NavPath path="Settings > Enrichments > Generative AI > Provider options" /> (`genai.<provider>.provider_options`), and for Ollama also confirm `options.num_ctx` there matches the context you have configured.
+   - Check **Review Description Speed** and **Object Description Speed** in <NavPath path="System metrics > Enrichments" />. If inference takes tens of seconds, requests will queue behind each other and descriptions will appear to stop. For Ollama, review `OLLAMA_NUM_PARALLEL`, `OLLAMA_MAX_QUEUE`, and `OLLAMA_MAX_LOADED_MODELS` so that concurrent requests from Frigate are handled the way you expect.
+
+</FaqItem>

docs/docs/configuration/genai/objects.md

@@ -52,9 +52,10 @@ You can define custom prompts at the global level and per-object type. To config
 
 ```yaml
 genai:
-  provider: ollama
-  base_url: http://localhost:11434
-  model: qwen3-vl:8b-instruct
+  my_provider:
+    provider: ollama
+    base_url: http://localhost:11434
+    model: qwen3-vl:8b-instruct
 
 objects:
   genai:
@@ -112,3 +113,7 @@ Many providers also have a public facing chat interface for their models. Downlo
 - OpenAI - [ChatGPT](https://chatgpt.com)
 - Gemini - [Google AI Studio](https://aistudio.google.com)
 - Ollama - [Open WebUI](https://docs.openwebui.com/)
+
+## Troubleshooting
+
+If descriptions are not being generated, or the generated descriptions are not what you expect, see [How do I debug GenAI issues?](/configuration/genai/genai_config#how-do-i-debug-genai-issues).

docs/docs/configuration/genai/review_summaries.md

@@ -201,3 +201,7 @@ Along with individual review item summaries, Generative AI can also produce a si
 Review reports can be requested via the [API](/integrations/api/generate-review-summary-review-summarize-start-start-ts-end-end-ts-post) by sending a POST request to `/api/review/summarize/start/{start_ts}/end/{end_ts}` with Unix timestamps.
 
 For Home Assistant users, there is a built-in service (`frigate.review_summarize`) that makes it easy to request review reports as part of automations or scripts. This allows you to automatically generate daily summaries, vacation reports, or custom time period reports based on your specific needs.
+
+## Troubleshooting
+
+If summaries are not being generated, or the generated summaries are not what you expect, see [How do I debug GenAI issues?](/configuration/genai/genai_config#how-do-i-debug-genai-issues).

docs/docs/configuration/go2rtc.md

@@ -15,7 +15,7 @@ Frigate uses the bundled go2rtc to power a number of key features:
 
 :::tip[Most users no longer need to configure go2rtc by hand]
 
-The **camera setup wizard** is the recommended way to add cameras. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />, and the wizard probes your camera and writes its configuration for you, including the go2rtc restream and the live stream mapping, so go2rtc is set up automatically.
+The [**camera setup wizard**](cameras.md#adding-a-camera-with-the-add-camera-wizard) is the recommended way to add cameras. Click **Add Camera** in <NavPath path="Settings > Global configuration > Camera management" />, and the wizard probes your camera and writes its configuration for you, including the go2rtc restream and the live stream mapping, so go2rtc is set up automatically.
 
 This guide is mainly useful if you are **upgrading from an older version and have existing cameras that don't yet use go2rtc**, or if you want to fine-tune a stream by hand (for example, to transcode a codec your browser can't play). The [go2rtc troubleshooting guide](/troubleshooting/go2rtc) applies regardless of how your cameras were added.
 
@@ -67,4 +67,6 @@ If your stream won't play, has no audio, uses excessive CPU, or otherwise misbeh
 
 ## Homekit Configuration
 
-To add camera streams to Homekit Frigate must be configured in docker to use `host` networking mode. Once that is done, you can use the go2rtc WebUI (accessed via port 1984, which is disabled by default) to export a camera to Homekit. Any changes made will automatically be saved to `/config/go2rtc_homekit.yml`.
+To export camera streams to HomeKit, Frigate must be configured in docker to use `host` networking mode. HomeKit settings are stored in `/config/go2rtc_homekit.yml` rather than in your Frigate config, and are edited through the go2rtc config editor at `http://<frigate_host>:1984/editor.html`. Pairings are saved back to that file automatically.
+
+See the [HomeKit integration docs](/integrations/homekit) for the full setup, including the video and audio requirements HomeKit places on the stream.

docs/docs/configuration/hardware_acceleration_video.md

@@ -312,8 +312,9 @@ ffmpeg:
 
 :::note
 
-If running Frigate through Docker, you either need to run in privileged mode or
-map the `/dev/video*` devices to Frigate. With Docker Compose add:
+If running Frigate through Docker, map the relevant `/dev/video*` devices into
+the container. Running in privileged mode also works but grants far more access
+than needed. With Docker Compose add:
 
 ```yaml {4-5}
 services:

docs/docs/configuration/live.md

@@ -34,7 +34,7 @@ If you are using go2rtc, you should adjust the following settings in your camera
 
 - Video codec: **H.264** - provides the most compatible video codec with all Live view technologies and browsers. Avoid any kind of "smart codec" or "+" codec like _H.264+_ or _H.265+_. as these non-standard codecs remove keyframes (see below).
 - Audio codec: **AAC** - provides the most compatible audio codec with all Live view technologies and browsers that support audio.
-- I-frame interval (sometimes called the keyframe interval, the interframe space, or the GOP length): match your camera's frame rate, or choose "1x" (for interframe space on Reolink cameras). For example, if your stream outputs 20fps, your i-frame interval should be 20 (or 1x on Reolink). Values higher than the frame rate will cause the stream to take longer to begin playback. See [this page](https://gardinal.net/understanding-the-keyframe-interval/) for more on keyframes. For many users this may not be an issue, but it should be noted that a 1x i-frame interval will cause more storage utilization if you are using the stream for the `record` role as well.
+- I-frame interval (sometimes called the keyframe interval, the interframe space, or the GOP length): match your camera's frame rate, or choose "1x" (for interframe space on Reolink cameras). For example, if your stream outputs 20fps, your i-frame interval should be 20 (or 1x on Reolink). Values higher than the frame rate will cause the stream to take longer to begin playback. See [this page](https://web.archive.org/web/20251213190836/https://gardinal.net/understanding-the-keyframe-interval/) for more on keyframes. For many users this may not be an issue, but it should be noted that a 1x i-frame interval will cause more storage utilization if you are using the stream for the `record` role as well.
 
 The default video and audio codec on your camera may not always be compatible with your browser, which is why setting them to H.264 and AAC is recommended. See the [go2rtc docs](https://github.com/AlexxIT/go2rtc?tab=readme-ov-file#codecs-madness) for codec support information.
 
@@ -196,7 +196,7 @@ services:
 
 :::
 
-See [go2rtc WebRTC docs](https://github.com/AlexxIT/go2rtc/tree/v1.8.3#module-webrtc) for more information about this.
+See [go2rtc WebRTC docs](https://github.com/AlexxIT/go2rtc/tree/v1.9.14#module-webrtc) for more information about this.
 
 ### Two way talk
 
@@ -334,7 +334,7 @@ When your browser runs into problems playing back your camera streams, it will l
 
 - **stalled**
   - What it means: Playback has stalled because the player has fallen too far behind live (extended buffering or no data arriving).
-  - What to try: This is usually indicative of the browser struggling to decode too many high-resolution streams at once. Try selecting a lower-bandwidth stream (substream), reduce the number of live streams open, improve the network connection, or lower the camera resolution. Also check your camera's keyframe (I-frame) interval: shorter intervals make playback start and recover faster. You can also try increasing the timeout value in the UI pane of Frigate's settings.
+  - What to try: This is usually indicative of the browser struggling to decode too many high-resolution streams at once. Try selecting a lower-bandwidth stream (substream), reduce the number of live streams open, improve the network connection, or lower the camera resolution. Also check your camera's keyframe (I-frame) interval: shorter intervals make playback start and recover faster. You can also try increasing the timeout value in <NavPath path="Settings > UI" /> .
 
   - Possible console messages from the player code:
     - `Buffer time (10 seconds) exceeded, browser may not be playing media correctly.`

docs/docs/configuration/notifications.md

@@ -6,6 +6,7 @@ title: Notifications
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
+import FaqItem from "@site/src/components/FaqItem";
 
 # Notifications
 
@@ -21,7 +22,7 @@ Push notifications require internet access from the Frigate server to the browse
 
 In order to use notifications the following requirements must be met:
 
-- Frigate must be accessed via a secure `https` connection ([see the authorization docs](/configuration/authentication)).
+- Frigate must be accessed via a secure `https` connection while signed in as a Frigate user ([see the authorization docs](/configuration/authentication)).
 - A supported browser must be used. Currently Chrome, Firefox, and Safari are known to be supported.
 - In order for notifications to be usable externally, Frigate must be accessible externally.
 - For iOS devices, some users have also indicated that the Notifications switch needs to be enabled in iOS Settings --> Apps --> Safari --> Advanced --> Features.
@@ -85,7 +86,13 @@ cameras:
 
 ### Registration
 
-Once notifications are enabled, press the `Register for Notifications` button on all devices that you would like to receive notifications on. This will register the background worker. After this Frigate must be restarted and then notifications will begin to be sent.
+Once notifications are enabled, press the `Register This Device` button on all devices that you would like to receive notifications on. This will register the background worker. After this Frigate must be restarted and then notifications will begin to be sent.
+
+:::warning
+
+Each registration is attached to the Frigate user account you are signed in as, so you must register over a secure connection to the authenticated port (`8971`). Reverse proxies and tunnels should point at port `8971`.
+
+:::
 
 ## Supported Notifications
 
@@ -104,3 +111,62 @@ Different platforms handle notifications differently, some settings changes may
 ### Android
 
 Most Android phones have battery optimization settings. To get reliable Notification delivery the browser (Chrome, Firefox) should have battery optimizations disabled. If Frigate is running as a PWA then the Frigate app should have battery optimizations disabled as well.
+
+## Notifications FAQ
+
+<FaqItem id="how-do-i-debug-notifications-issues" question="How do I debug notifications issues?">
+
+Push notifications involve Frigate, your browser, and your browser vendor's push service, so it helps to work from the server outward.
+
+1. Enable debug logs for the push client by adding `frigate.comms.webpush: debug` to your `logger` configuration. Restart Frigate after this change.
+
+   ```yaml
+   logger:
+     default: info
+     logs:
+       # highlight-next-line
+       frigate.comms.webpush: debug
+   ```
+
+   These logs show exactly where a notification stopped, including:
+   - `Email must be provided for push notifications to be sent` means the global `email` field is empty and nothing will ever be sent.
+   - `Sending test notification` and `Sending push notification for <camera>, review ID <id>` mean Frigate handed the message off to the push service.
+   - `Skipping notification for <camera> - in global cooldown period` (or `camera-specific cooldown period`) means your [cooldown](#configuration) values suppressed it.
+   - `Notifications for <camera> are currently suspended` means notifications were suspended from <NavPath path="Settings > Notifications" /> or MQTT.
+   - `Notification endpoint expired for <user>, received 410` means that device's subscription is no longer valid and it must be re-registered.
+   - `Failed to send notification to <user> :: <status>` means the push service rejected the message. A `401` or `403` usually points at a VAPID or `email` problem, and a `5xx` is a problem on the push service's end.
+   - If you see no messages at all when an alert occurs, the notification was never queued. Confirm an actual **alert** was created (notifications are not sent for detections), and that notifications are enabled both globally and for that camera.
+
+2. Verify the basics that most reports come down to:
+   - Frigate must be reached over `https` with a certificate your device trusts. Browsers silently refuse to register a service worker otherwise, and a self-signed certificate that is not installed as trusted on the device will fail.
+   - On iOS, notifications only work when Frigate has been installed to the Home Screen via **Share > Add to Home Screen** and opened from that icon. Safari and Chrome tabs cannot receive web push on iOS.
+   - Each device must be registered individually, and Frigate must be restarted after registering before anything can be sent, including test notifications.
+   - The Frigate server needs outbound internet access to the browser vendor's push service. See [Network Requirements](/frigate/network_requirements#push-notifications).
+
+3. Test from the UI. Use the `Send a test notification` button in <NavPath path="Settings > Notifications" />. If the log shows `Sending test notification` but nothing arrives on the device, the problem is between the push service and your device rather than in Frigate.
+
+4. Check the browser side on the device that is not receiving notifications:
+   - Confirm the site's notification permission is set to **Allow** in your browser or OS settings, and that a focus/do not disturb mode is not hiding them.
+   - In desktop browsers, open Developer Tools > Application > Service Workers and confirm `notifications-worker.js` is registered and activated. Unregistering it and registering the device again will rebuild a broken subscription.
+   - Check the browser console and your reverse proxy logs for failures loading `/notifications-worker.js` or errors on `/api/notifications/register`.
+
+</FaqItem>
+
+<FaqItem id="why-did-notifications-stop-arriving-after-working-for-a-while" question="Why did notifications stop arriving after working for a while?">
+
+Push subscriptions are issued by the browser vendor and can be revoked, most often after a browser update, after clearing site data, or when a device has been offline for an extended period. When this happens the device still appears registered in Frigate, but the push service rejects the message. The debug logs will show `Notification endpoint expired` with a `404` or `410` status.
+
+Unregister and re-register the affected device from <NavPath path="Settings > Notifications" />, then restart Frigate.
+
+</FaqItem>
+
+<FaqItem id="why-am-i-not-getting-notifications-for-one-specific-camera" question="Why am I not getting notifications for one specific camera?">
+
+Work through these in order:
+
+- Notifications are only sent for **alerts**. If the camera is producing detections instead, adjust the camera's `review > alerts > labels` so the objects you care about are classified as alerts.
+- Confirm notifications are enabled for that camera in <NavPath path="Settings > Camera configuration > Notifications" />.
+- Check the camera's `cooldown` value, and remember that the global cooldown applies across all cameras. A busy camera can consume the global cooldown and suppress a quieter one.
+- If [authentication](/configuration/authentication) is enabled with roles, users only receive notifications for the cameras their role grants access to.
+
+</FaqItem>

docs/docs/configuration/object_detectors.md

@@ -24,7 +24,6 @@ Frigate supports multiple different detectors that work on different types of ha
 - [Coral EdgeTPU](#edge-tpu-detector): The Google Coral EdgeTPU is available in USB, Mini PCIe, and m.2 formats allowing for a wide range of compatibility with devices.
 - [Hailo](#hailo-8): The Hailo8 and Hailo8L AI Acceleration module is available in m.2 format with a HAT for RPi devices, offering a wide range of compatibility with devices.
 - <CommunityBadge /> [MemryX](#memryx-mx3): The MX3 Acceleration module is available in m.2 format, offering broad compatibility across various platforms.
-- <CommunityBadge /> [DeGirum](#degirum): Service for using hardware devices in the cloud or locally. Hardware and models provided on the cloud on [their website](https://hub.degirum.com).
 
 **AMD**
 
@@ -69,12 +68,66 @@ Frigate supports multiple different detectors that work on different types of ha
 
 :::note
 
-Multiple detectors can not be mixed for object detection (ex: OpenVINO and Coral EdgeTPU can not be used for object detection at the same time).
+A single model can not be spread across different detector types (ex: OpenVINO and Coral EdgeTPU can not run the same model at the same time). Configuring more than one model, each on its own detector type, is supported.
 
 This does not affect using hardware for accelerating other tasks such as [semantic search](./semantic_search.md)
 
 :::
 
+### Configuring models and hardware
+
+Object detection is configured with a `models` list. Each entry describes one model and the hardware it runs on:
+
+```yaml
+models:
+  - devices:
+      - openvino:GPU
+    path: /config/model_cache/yolov9-s.onnx
+    model_type: yolo-generic
+    width: 320
+    height: 320
+```
+
+Each entry in `devices` is a detector type, optionally followed by a colon and a device for that detector, such as `edgetpu:pci:0`, `openvino:NPU`, or `tensorrt:0`. The per-detector sections below document the device values each one accepts. Listing several devices runs the model on all of them, and listing the **same** device more than once runs additional inference processes against it, which can improve throughput on hardware that keeps up with more than one stream:
+
+```yaml
+models:
+  - devices:
+      - openvino:GPU
+      - openvino:GPU
+```
+
+Coral EdgeTPU and MemryX accelerators can only be opened by one process, so those devices can not be repeated.
+
+### Running more than one model
+
+Cameras can be split across models by scene, which is useful when indoor and outdoor cameras benefit from differently trained models. Each model declares the `scene` it is for, and each camera picks one with `detect -> scene`:
+
+```yaml
+models:
+  - scene: outdoor
+    path: plus://your-outdoor-model
+    devices:
+      - edgetpu:pci:0
+  - scene: indoor
+    path: /config/model_cache/indoor.onnx
+    model_type: yolo-generic
+    devices:
+      - openvino:GPU
+
+cameras:
+  driveway:
+    detect:
+      scene: outdoor
+    ...
+  hallway:
+    detect:
+      scene: indoor
+    ...
+```
+
+Available scenes are `all`, `indoor`, `outdoor`, `indoor_thermal`, and `outdoor_thermal`. A model with a scene of `all` is used by every camera that does not set one, and `all` is the default when a model does not declare a scene. Changing a camera's scene requires a restart.
+
 ### Choosing a model size
 
 Along with picking a detector for your hardware, you will choose a model's **input resolution** (such as `320x320` or `640x640`) and, for model families like YOLOv9, a **variant size** (`tiny`, `small`, etc.). Both affect the balance between accuracy and the inference time your hardware can sustain.
@@ -93,11 +146,11 @@ The best detection accuracy comes from a model trained on images that look like
 
 # Officially Supported Detectors
 
-Frigate provides a number of builtin detector types. By default, Frigate will use a single CPU detector. Other detectors may require additional configuration as described below. When using multiple detectors they will run in dedicated processes, but pull from a common queue of detection requests from across all cameras.
+Frigate provides a number of builtin detector types. By default, Frigate will use a single CPU detector. Other detectors may require additional configuration as described below. Each of a model's devices runs in a dedicated process, and they pull from a common queue of detection requests from the cameras assigned to that model.
 
 ## Edge TPU Detector
 
-The Edge TPU detector type runs TensorFlow Lite models utilizing the Google Coral delegate for hardware acceleration. To configure an Edge TPU detector, set the `"type"` attribute to `"edgetpu"`.
+The Edge TPU detector type runs TensorFlow Lite models utilizing the Google Coral delegate for hardware acceleration. To use it, prefix a model's device with `edgetpu`.
 
 The Edge TPU device can be specified using the `"device"` attribute according to the [Documentation for the TensorFlow Lite Python API](https://coral.ai/docs/edgetpu/multiple-edgetpu/#using-the-tensorflow-lite-python-api). If not set, the delegate will use the first device it finds.
 
@@ -112,16 +165,15 @@ See [common Edge TPU troubleshooting steps](/troubleshooting/edgetpu) if the Edg
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `usb`.
+Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors:
-  coral:
-    type: edgetpu
-    device: usb
+models:
+  - devices:
+      - edgetpu:usb
 ```
 
 </TabItem>
@@ -132,19 +184,16 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors, specifying `usb:0` and `usb:1` as the device for each.
+Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown and check each Coral the model should run on.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors:
-  coral1:
-    type: edgetpu
-    device: usb:0
-  coral2:
-    type: edgetpu
-    device: usb:1
+models:
+  - devices:
+      - edgetpu:usb:0
+      - edgetpu:usb:1
 ```
 
 </TabItem>
@@ -157,16 +206,15 @@ _warning: may have [compatibility issues](https://github.com/blakeblackshear/fri
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then leave the device field empty.
+Navigate to <NavPath path="Settings > System > Detection models" /> and select the **Coral EdgeTPU** entry from the **Hardware** dropdown.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors:
-  coral:
-    type: edgetpu
-    device: ""
+models:
+  - devices:
+      - 'edgetpu:'
 ```
 
 </TabItem>
@@ -177,16 +225,15 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `pci`.
+Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (PCIe)** from the **Hardware** dropdown.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors:
-  coral:
-    type: edgetpu
-    device: pci
+models:
+  - devices:
+      - edgetpu:pci
 ```
 
 </TabItem>
@@ -197,19 +244,16 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors, specifying `pci:0` and `pci:1` as the device for each.
+Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (PCIe)** from the **Hardware** dropdown and check each Coral the model should run on.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors:
-  coral1:
-    type: edgetpu
-    device: pci:0
-  coral2:
-    type: edgetpu
-    device: pci:1
+models:
+  - devices:
+      - edgetpu:pci:0
+      - edgetpu:pci:1
 ```
 
 </TabItem>
@@ -220,19 +264,16 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors with different device types (e.g., `usb` and `pci`).
+Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown. USB and PCIe Corals are listed as separate hardware, so mixing the two on one model has to be done in YAML.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors:
-  coral_usb:
-    type: edgetpu
-    device: usb
-  coral_pci:
-    type: edgetpu
-    device: pci
+models:
+  - devices:
+      - edgetpu:usb
+      - edgetpu:pci
 ```
 
 </TabItem>
@@ -274,7 +315,7 @@ Hailo8 supports all models in the Hailo Model Zoo that include HailoRT post-proc
 
 ## OpenVINO Detector
 
-The OpenVINO detector type runs an OpenVINO IR model on AMD and Intel CPUs, Intel GPUs and Intel NPUs. To configure an OpenVINO detector, set the `"type"` attribute to `"openvino"`.
+The OpenVINO detector type runs an OpenVINO IR model on AMD and Intel CPUs, Intel GPUs and Intel NPUs. To use it, prefix a model's device with `openvino`.
 
 The OpenVINO device to be used is specified using the `"device"` attribute according to the naming conventions in the [Device Documentation](https://docs.openvino.ai/2025/openvino-workflow/running-inference/inference-devices-and-modes.html). The most common devices are `CPU`, `GPU`, or `NPU`.
 
@@ -287,17 +328,22 @@ OpenVINO is supported on 6th Gen Intel platforms (Skylake) and newer. It will al
 When using many cameras one detector may not be enough to keep up. Multiple detectors can be defined assuming GPU resources are available. An example configuration would be:
 
 ```yaml
-detectors:
-  ov_0:
-    type: openvino
-    device: GPU # or NPU
-  ov_1:
-    type: openvino
-    device: GPU # or NPU
+models:
+  - devices:
+      - openvino:GPU # or NPU
+      - openvino:GPU # or NPU
 ```
 
 :::
 
+### Intel NPU host requirements {#intel-npu-requirements}
+
+The NPU firmware is loaded by the host kernel and is not part of the Frigate image. Everything else the NPU needs is bundled in the container, so host NPU libraries should never be mounted in.
+
+Frigate bundles a specific version of Intel's [linux-npu-driver](https://github.com/intel/linux-npu-driver/releases), and the host firmware must come from that release or a newer one. Firmware older than the bundled driver may fail with `MAPPED_INFERENCE_VERSION is NOT compatible with the ELF`, where `Expected` is the version the firmware supports and `received` is the version the bundled compiler produced. Distributions often package older firmware than the driver Frigate ships, so check the build date on the host with `sudo dmesg | grep -i vpu` and update it there if needed.
+
+Intel NPUs cannot be used under Home Assistant OS, which does not include the NPU firmware.
+
 ### Configuration {#configuration-openvino}
 
 <ModelConfigDropdown detectorTitle="OpenVINO" models={objectDetectorsModels.openvino.models} />
@@ -306,6 +352,12 @@ detectors:
 
 ## Apple Silicon detector
 
+:::warning
+
+The network-based detectors (Deepstack and the Apple Silicon client) are being reworked. Their extra options no longer have a place in the config, so only the endpoint carried in the device string is honored right now: Deepstack ignores `api_key` and `api_timeout`, and the Apple Silicon client ignores `request_timeout_ms` and `linger_ms`. Anything else is dropped when your config is migrated.
+
+:::
+
 The NPU in Apple Silicon can't be accessed from within a container, so the [Apple Silicon detector client](https://github.com/frigate-nvr/apple-silicon-detector) must first be setup. It is recommended to use the Frigate docker image with `-standard-arm64` suffix, for example `ghcr.io/blakeblackshear/frigate:stable-standard-arm64`.
 
 ### Setup {#setup-apple-silicon}
@@ -446,11 +498,10 @@ If the correct build is used for your GPU then the GPU will be detected and used
 When using many cameras one detector may not be enough to keep up. Multiple detectors can be defined assuming GPU resources are available. An example configuration would be:
 
 ```yaml
-detectors:
-  onnx_0:
-    type: onnx
-  onnx_1:
-    type: onnx
+models:
+  - devices:
+      - onnx
+      - onnx
 ```
 
 :::
@@ -463,7 +514,7 @@ detectors:
 
 ## CPU Detector (not recommended)
 
-The CPU detector type runs a TensorFlow Lite model utilizing the CPU without hardware acceleration. It is recommended to use a hardware accelerated detector type instead for better performance. To configure a CPU based detector, set the `"type"` attribute to `"cpu"`.
+The CPU detector type runs a TensorFlow Lite model utilizing the CPU without hardware acceleration. It is recommended to use a hardware accelerated detector type instead for better performance. To use it, set a model's device to `cpu`.
 
 :::danger
 
@@ -473,7 +524,7 @@ The CPU detector is not recommended for general use. If you do not have GPU or E
 
 The number of threads used by the interpreter can be specified using the `"num_threads"` attribute, and defaults to `3.`
 
-A TensorFlow Lite model is provided in the container at `/cpu_model.tflite` and is used by this detector type by default. To provide your own model, bind mount the file into the container and provide the path with `model.path`.
+A TensorFlow Lite model is provided in the container at `/cpu_model.tflite` and is used by this detector type by default. To provide your own model, bind mount the file into the container and provide the path with the model's `path`.
 
 ### Configuration {#configuration-cpu}
 
@@ -483,6 +534,12 @@ When using CPU detectors, you can add one CPU detector per camera. Adding more d
 
 ## Deepstack / CodeProject.AI Server Detector
 
+:::warning
+
+The network-based detectors (Deepstack and the Apple Silicon client) are being reworked. Their extra options no longer have a place in the config, so only the endpoint carried in the device string is honored right now: Deepstack ignores `api_key` and `api_timeout`, and the Apple Silicon client ignores `request_timeout_ms` and `linger_ms`. Anything else is dropped when your config is migrated.
+
+:::
+
 The Deepstack / CodeProject.AI Server detector for Frigate allows you to integrate Deepstack and CodeProject.AI object detection capabilities into Frigate. CodeProject.AI and DeepStack are open-source AI platforms that can be run on various devices such as the Raspberry Pi, Nvidia Jetson, and other compatible hardware. It is important to note that the integration is performed over the network, so the inference times may not be as fast as native Frigate detectors, but it still provides an efficient and reliable solution for object detection and tracking.
 
 ### Setup {#setup-deepstack}
@@ -545,7 +602,7 @@ For detailed instructions on compiling models, refer to the [MemryX Compiler](ht
 
 3. Depending on the model, the compiler may also generate a cropped post-processing network. If present, it will be named with the suffix `_post.onnx`.
 
-4. Bind-mount the `.zip` file into the container and specify its path using `model.path` in your config.
+4. Bind-mount the `.zip` file into the container and specify its path using the model's `path` in your config.
 
 5. Update `labelmap_path` to match your custom model's labels.
 
@@ -675,13 +732,10 @@ If no custom model is provided, the RKNN detector downloads a default model from
 When using many cameras one detector may not be enough to keep up. Multiple detectors can be defined assuming NPU resources are available. An example configuration would be:
 
 ```yaml
-detectors:
-  rknn_0:
-    type: rknn
-    num_cores: 0
-  rknn_1:
-    type: rknn
-    num_cores: 0
+models:
+  - devices:
+      - rknn:0
+      - rknn:0
 ```
 
 :::
@@ -755,87 +809,6 @@ Explanation of the parameters:
   - **example**: Specifying `output_name = "frigate-{quant}-{input_basename}-{soc}-v{tk_version}"` could result in a model called `frigate-i8-my_model-rk3588-v2.3.0.rknn`.
 - `config`: Configuration passed to `rknn-toolkit2` for model conversion. For an explanation of all available parameters have a look at section "2.2. Model configuration" of [this manual](https://github.com/MarcA711/rknn-toolkit2/releases/download/v2.3.2/03_Rockchip_RKNPU_API_Reference_RKNN_Toolkit2_V2.3.2_EN.pdf).
 
-## DeGirum
-
-DeGirum is a detector that can use any type of hardware listed on [their website](https://hub.degirum.com). DeGirum can be used with local hardware through a DeGirum AI Server, or through the use of `@local`. You can also connect directly to DeGirum's AI Hub to run inferences. **Please Note:** This detector _cannot_ be used for commercial purposes.
-
-### Configuration {#configuration-degirum}
-
-#### AI Server Inference
-
-Before starting with the config file for this section, you must first launch an AI server. DeGirum has an AI server ready to use as a docker container. Add this to your `docker-compose.yml` to get started:
-
-```yaml
-degirum_detector:
-  container_name: degirum
-  image: degirum/aiserver:latest
-  privileged: true
-  ports:
-    - "8778:8778"
-```
-
-All supported hardware will automatically be found on your AI server host as long as relevant runtimes and drivers are properly installed on your machine. Refer to [DeGirum's docs site](https://docs.degirum.com/pysdk/runtimes-and-drivers) if you have any trouble.
-
-Once completed, configure the detector as follows:
-
-<ModelConfigDropdown detectorTitle="DeGirum" models={objectDetectorsModels.degirumAiServer.models} />
-
-Setting up a model in the `config.yml` is similar to setting up an AI server.
-You can set it to:
-
-- A model listed on the [AI Hub](https://hub.degirum.com), given that the correct zoo name is listed in your detector
-  - If this is what you choose to do, the correct model will be downloaded onto your machine before running.
-- A local directory acting as a zoo. See DeGirum's docs site [for more information](https://docs.degirum.com/pysdk/user-guide-pysdk/organizing-models#model-zoo-directory-structure).
-- A path to some model.json.
-
-```yaml
-model:
-  path: ./mobilenet_v2_ssd_coco--300x300_quant_n2x_orca1_1 # directory to model .json and file
-  width: 300 # width is in the model name as the first number in the "int"x"int" section
-  height: 300 # height is in the model name as the second number in the "int"x"int" section
-  input_pixel_format: rgb/bgr # look at the model.json to figure out which to put here
-```
-
-#### Local Inference
-
-It is also possible to eliminate the need for an AI server and run the hardware directly. The benefit of this approach is that you eliminate any bottlenecks that occur when transferring prediction results from the AI server docker container to the frigate one. However, the method of implementing local inference is different for every device and hardware combination, so it's usually more trouble than it's worth. A general guideline to achieve this would be:
-
-1. Ensuring that the frigate docker container has the runtime you want to use. So for instance, running `@local` for Hailo means making sure the container you're using has the Hailo runtime installed.
-2. To double check the runtime is detected by the DeGirum detector, make sure the `degirum sys-info` command properly shows whatever runtimes you mean to install.
-3. Create a DeGirum detector in your configuration.
-
-<ModelConfigDropdown detectorTitle="DeGirum" models={objectDetectorsModels.degirumLocal.models} />
-
-Once `degirum_detector` is setup, you can choose a model through 'model' section in the `config.yml` file.
-
-```yaml
-model:
-  path: mobilenet_v2_ssd_coco--300x300_quant_n2x_orca1_1
-  width: 300 # width is in the model name as the first number in the "int"x"int" section
-  height: 300 # height is in the model name as the second number in the "int"x"int" section
-  input_pixel_format: rgb/bgr # look at the model.json to figure out which to put here
-```
-
-#### AI Hub Cloud Inference
-
-If you do not possess whatever hardware you want to run, there's also the option to run cloud inferences. Do note that your detection fps might need to be lowered as network latency does significantly slow down this method of detection. For use with Frigate, we highly recommend using a local AI server as described above. To set up cloud inferences,
-
-1. Sign up at [DeGirum's AI Hub](https://hub.degirum.com).
-2. Get an access token.
-3. Create a DeGirum detector in your configuration.
-
-<ModelConfigDropdown detectorTitle="DeGirum" models={objectDetectorsModels.degirumCloud.models} />
-
-Once `degirum_detector` is setup, you can choose a model through 'model' section in the `config.yml` file.
-
-```yaml
-model:
-  path: mobilenet_v2_ssd_coco--300x300_quant_n2x_orca1_1
-  width: 300 # width is in the model name as the first number in the "int"x"int" section
-  height: 300 # height is in the model name as the second number in the "int"x"int" section
-  input_pixel_format: rgb/bgr # look at the model.json to figure out which to put here
-```
-
 ## AXERA
 
 Hardware accelerated object detection is supported on the following SoCs:

docs/docs/configuration/profiles.md

@@ -126,7 +126,7 @@ Only the fields you explicitly set in a profile override are applied. All other
 
 ## Activating Profiles
 
-Profiles can be activated and deactivated via the Frigate UI, [MQTT](/integrations/mqtt#frigateprofileset), or the Home Assistant integration.
+Profiles can be activated and deactivated via the Frigate UI, [MQTT](/integrations/mqtt#frigateprofileset), the [HTTP API](../integrations/api/camera-set-camera-camera-name-set-feature-sub-command-put.api.mdx), or the Home Assistant integration.
 
 In the Frigate UI, open the Settings cog and select **Profiles** from the submenu to see all defined profiles. From there you can activate any profile or deactivate the current one. The active profile is indicated in the UI so you always know which profile is in effect.
 
@@ -232,6 +232,21 @@ No. Only one profile can be active at a time. Activating a new profile automatic
 
 When you delete a base zone or mask in the Frigate UI, any profile overrides for that entry are deleted automatically as part of the same operation. If you remove a base entry by editing your config file directly and leave a profile override behind, the config will fail validation at startup until the orphaned override is removed as well.
 
+### How do I make a YAML profile track no objects at all?
+
+Set the tracked object list explicitly to an empty list in the profile:
+
+```yaml
+cameras:
+  front_door:
+    profiles:
+      home:
+        objects:
+          track: []
+```
+
+Leaving the `objects` section empty (or omitting `track`) does not clear the list. Empty sections set no fields, so the profile inherits the full tracked object list from the base config, including anything set at the global level. The same applies to other lists, such as `audio.listen`.
+
 ### Why are some settings missing when I configure a profile override?
 
 Fields that require a Frigate restart to take effect cannot be overridden by profiles, since profiles are applied at runtime without restarting. Those fields are hidden when editing a profile override and can only be changed on the base configuration.

docs/docs/configuration/record.md

@@ -275,6 +275,163 @@ record:
 
 This configuration will retain recording segments that overlap with alerts and detections for 10 days. Because multiple tracked objects can reference the same recording segments, this avoids storing duplicate footage for overlapping tracked objects and reduces overall storage needs.
 
+## Sub Stream Recording
+
+In addition to the main recording stream, Frigate can record a second, lower quality stream for each camera. This serves two purposes:
+
+- **Quality selection during playback**: A quality selector (`Auto`, `Original`, or `Low`) appears in History view for cameras with sub stream recording enabled. `Original` and `Low` play only that stream's recordings. Time ranges where the selected stream has no footage are skipped during playback, and the selector notes when the selected stream has no recordings at all in the viewed time range. With `Auto` (the default), playback prefers the original quality and automatically falls back to the low quality stream when the connection cannot keep up, or for time ranges where the original recordings have expired. The selector shows each stream's video codec and audio details beneath the options; footage recorded by older Frigate versions shows no details.
+- **Extended retention**: Sub stream recordings have their own retention settings, fully independent of the main recordings. By giving the low quality recordings a longer retention period, you can keep weeks or months of low quality history using a fraction of the storage, and that history remains playable after the main recordings expire. Playback falls back to the low quality recordings automatically, and the timeline shows a muted treatment for time ranges where only low quality footage remains. Timeline previews are kept for as long as either stream still has recordings, so scrubbing works across the whole retained history.
+
+### Configuring sub stream recording
+
+Sub stream recording uses the `record_sub` input role. This role can be assigned to the same input as `detect`, so in the common case where detect already uses the camera's sub stream, no additional camera connection is needed. Like the main recording stream, sub stream segments are copied directly from the camera stream without re-encoding, so the recording quality is determined by the source stream.
+
+The following examples keep 7 days of full quality continuous recordings and 60 days of low quality continuous recordings:
+
+<ConfigTabs>
+<TabItem value="ui">
+
+Navigate to <NavPath path="Settings > Camera configuration > Streams (FFmpeg)" /> and select the camera.
+
+- In **Camera inputs**, enable the **Record (Sub Stream)** role on the stream you want to record at low quality, commonly the same stream that has the **Detect** role. Only one stream may have this role, and it cannot be assigned to the same stream as the **Record** role.
+
+Navigate to <NavPath path="Settings > Camera configuration > Recording" /> and select the camera.
+
+- Set **Enable recording** to on
+- Set **Continuous retention > Retention days** to `7`
+- Set **Sub stream recording > Enable sub stream recording** to on
+- Set **Sub stream recording > Sub stream continuous retention > Retention days** to `60`
+
+The camera setup wizard also offers the **Record (Sub Stream)** role when assigning stream roles for a newly added camera.
+
+</TabItem>
+<TabItem value="yaml">
+
+```yaml
+cameras:
+  front_door:
+    ffmpeg:
+      inputs:
+        - path: rtsp://camera/main
+          roles:
+            - record
+        - path: rtsp://camera/sub
+          roles:
+            - detect
+            - record_sub
+    record:
+      enabled: true
+      continuous:
+        days: 7
+      sub:
+        enabled: true
+        continuous:
+          days: 60
+```
+
+If your camera does not provide a suitable sub stream (or the sub stream is already used at a resolution you don't want to record), you can use a go2rtc transcode as the source for `record_sub` instead:
+
+```yaml
+go2rtc:
+  streams:
+    front_door: rtsp://camera/main
+    front_door_lq: ffmpeg:front_door#video=h264#width=854#hardware
+
+cameras:
+  front_door:
+    ffmpeg:
+      inputs:
+        - path: rtsp://127.0.0.1:8554/front_door
+          input_args: preset-rtsp-restream
+          roles:
+            - detect
+            - record
+        - path: rtsp://127.0.0.1:8554/front_door_lq
+          input_args: preset-rtsp-restream
+          roles:
+            - record_sub
+    record:
+      enabled: true
+      continuous:
+        days: 7
+      sub:
+        enabled: true
+        continuous:
+          days: 60
+```
+
+</TabItem>
+</ConfigTabs>
+
+The `record.sub` config supports the same retention structure as the main recording config: `continuous`, `motion`, `alerts`, and `detections` each with their own `days` (and `mode` for alerts and detections). The pre-capture and post-capture windows for alerts and detections are taken from the main `record.alerts` and `record.detections` config. Extending `sub.alerts.days` or `sub.detections.days` beyond the main values also keeps those review items visible in the review timeline for the longer window, with playback falling back to the low quality stream once the main recordings expire.
+
+:::note
+
+Recording must be enabled (`record.enabled`) for sub stream recording to run, and Frigate will fail to start if `record.sub.enabled` is set without a `record_sub` role assigned to one of the camera's inputs.
+
+:::
+
+### How Auto picks a quality
+
+`Auto` measures throughput on every segment download and compares it against the original stream's bitrate (computed from the recorded footage itself). Playback drops to the low quality stream when any of these happen:
+
+- A freeze lasts 4 seconds (10 seconds when it starts within 2 seconds of a seek, since the seek target is rarely buffered), or freezes total 7 seconds within the last minute.
+- 3 downloads in a row measure below the original bitrate plus 10%, dropping quality before a stall ever becomes visible.
+- No first frame appears within 10 seconds, or loading fails outright.
+
+Playback returns to full quality only when measured throughput exceeds the original bitrate by 50%, checked continuously while playing the low quality stream and again at each new hour. The asymmetric thresholds (1.1x to drop, 1.5x to return) keep a borderline connection from switching back and forth.
+
+The most recent measurement is remembered on the device: a connection last measured below the original bitrate (or below 3 Mbps when the bitrate is not yet known) starts playback on the low quality stream so a first frame appears immediately, then upgrades within a few segments if the speed allows.
+
+The quality selector shows which stream Auto is currently playing and why. A browser with Data Saver enabled stays on the low quality stream, a browser that cannot decode the original stream's codec (for example H.265 without HEVC support) plays the low quality stream for that camera, and pinning `Original` or `Low` bypasses Auto entirely.
+
+### Sub stream output args
+
+By default the sub stream is recorded with the same [output args](/configuration/ffmpeg_presets#output-args-presets) as the main recording stream, so it inherits any customization made to `ffmpeg.output_args.record`. Setting `ffmpeg.output_args.record_sub` gives the sub stream its own args instead. Like all `ffmpeg` config, this can be set globally or per camera.
+
+The most common reason to set this is a pair of streams whose audio differs. Many cameras send AAC on the main stream but PCM on the sub stream, and PCM cannot be copied into an mp4 recording. Copying the main stream's audio avoids re-encoding audio that is already AAC, while the sub stream still needs to be transcoded:
+
+```yaml
+ffmpeg:
+  output_args:
+    # main stream audio is already AAC, so copy it
+    record: preset-record-generic-audio-copy
+    # sub stream audio is PCM, so transcode it to AAC
+    record_sub: preset-record-generic-audio-aac
+```
+
+Other reasons to set this are recording a sub stream whose codec needs a different preset than the main stream, such as `preset-record-mjpeg`, or forcing a matching audio sample rate across the two streams with manual args ending in `-c:a aac -ar 16000`.
+
+:::warning
+
+Avoid removing audio from only one of the two streams (for example with `-an`). When one stream has audio and the other does not, playback of time ranges that combine both qualities is silent, so stripping audio from the sub stream also silences the merged timeline.
+
+:::
+
+### Which stream do features use?
+
+As a general rule, features that read recordings prefer the main stream and fall back to the sub stream for time ranges where the main recordings have expired. Analytics features use only the main stream.
+
+| Feature                                                                                  | Stream used                                                                                                   |
+| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| Recording playback (History and Review)                                                  | Both (main preferred with sub fallback by default), or exactly one stream when a quality is selected manually |
+| Tracking details and Explore clip playback                                               | Main, falling back to sub where the main recordings have expired                                              |
+| Exports and clip downloads                                                               | Main; sub is used when no main recordings remain in the range (streams are never mixed in one file)           |
+| Frames grabbed from a recording in History (download snapshot, submit frame to Frigate+) | Main preferred, sub fallback                                                                                  |
+| Audio extraction (e.g., transcription)                                                   | Main preferred, sub fallback                                                                                  |
+| Motion search                                                                            | Main only                                                                                                     |
+| Review timeline motion data                                                              | Main only                                                                                                     |
+| Storage usage statistics                                                                 | Both streams counted, and listed separately per camera                                                        |
+
+This table covers only features that read recordings from disk. Tracked object snapshots and thumbnails (the images shown in Explore and sent with notifications, and the images submitted to Frigate+ from a tracked object) are captured live from the `detect` stream as the object is tracked, never from recordings, so sub stream recording does not affect them.
+
+### Trade-offs
+
+- Recording a second stream increases overall storage use. The increase is typically small relative to the main recordings, since the low quality stream is much smaller. Both streams are cached before being written to disk, so cache use goes up as well. See [the `/tmp/cache` area is separate](#the-tmpcache-area-is-separate) if you start seeing `No space left on device` errors after enabling it.
+- The go2rtc transcode approach continuously encodes the low quality stream, which uses CPU or GPU resources. This cost only applies to the transcode path; recording the camera's native sub stream does not re-encode. See the [go2rtc hardware acceleration documentation](https://github.com/AlexxIT/go2rtc?tab=readme-ov-file#source-ffmpeg) for accelerating the transcode.
+- Many camera sub streams do not include audio. If the source stream has no audio, the low quality recordings will not have audio.
+- **Matching video codecs and audio settings between the two streams gives the smoothest playback.** When playback combines both qualities on one timeline (the default `Auto` behavior: for example original quality during events with low quality in between, or low quality history after the original recordings expire) and the streams use different video codecs or audio settings, for example H.265 on the main stream and H.264 on the sub stream, or 16 kHz audio on one and 8 kHz on the other, playback still works: Frigate inserts a decoder reset at each quality transition, which can cause a barely-perceptible pause there. Configuring both streams in the camera's firmware to use the same video codec, audio codec, and sample rate makes transitions fully seamless, and a mismatched audio sample rate can also be corrected with [sub stream output args](#sub-stream-output-args). If one stream has audio and the other does not, combined time ranges play **without audio**; selecting a single quality with the playback selector always keeps that stream's audio.
+
 ## Can I have "continuous" recordings, but only at certain times?
 
 Using Frigate UI, Home Assistant, or MQTT, cameras can be automated to only record in certain situations or at certain times.

docs/docs/configuration/restream.md

@@ -221,7 +221,7 @@ For security reasons, the `echo:`, `expr:`, and `exec:` stream sources are disab
 
 If you attempt to use these sources in your configuration, the streams will be removed and an error message will be printed in the logs.
 
-To enable these sources, you must set the environment variable `GO2RTC_ALLOW_ARBITRARY_EXEC=true`. This can be done in your Docker Compose file or container environment:
+To enable these sources, you must set the environment variable `GO2RTC_ALLOW_ARBITRARY_EXEC=true`. This can be done in your Docker Compose file or container environment, or for Home Assistant App users with the `go2rtc_allow_arbitrary_exec` option in the App's configuration. The `environment_vars` section of the Frigate config can't enable it:
 
 ```yaml
 environment:

docs/docs/configuration/review.md

@@ -121,6 +121,31 @@ cameras:
 </TabItem>
 </ConfigTabs>
 
+## Categorizing manual events
+
+Events created with the [create manual event API](../integrations/api/create-event-events-camera-name-label-create-post.api.mdx) are categorized with the same label lists, using the label from the request path:
+
+1. If alerts are enabled and the label is listed in `review -> alerts -> labels`, the review item is an alert.
+2. Otherwise, if detections are enabled and the label is listed in `review -> detections -> labels`, the review item is a detection.
+3. If the label is in neither list, the review item is an alert, or no review item is created if alerts are disabled.
+
+This means manual events are alerts unless you explicitly list their label as a detection label. For example, to have PIR sensors create detections instead of alerts, post to `/api/events/front_door/pir_sensor/create` with the following config:
+
+```yaml {5-7}
+cameras:
+  front_door:
+    review:
+      detections:
+        labels:
+          - pir_sensor
+```
+
+:::note
+
+Required zones do not apply to manual events, since they are created through the API rather than by the object tracker. Setting `review -> alerts -> labels` to an empty list also does not stop manual events from becoming alerts, as a label in neither list still falls back to an alert.
+
+:::
+
 ## Restricting review items to specific zones
 
 By default a review item will be created if any `review -> alerts -> labels` and `review -> detections -> labels` are detected anywhere in the camera frame. You will likely want to configure review items to only be created when the object enters an area of interest, [see the zone docs for more information](./zones.md#restricting-alerts-and-detections-to-specific-zones)

docs/docs/configuration/semantic_search.md

@@ -163,8 +163,8 @@ genai:
     model: your-model-name
     roles:
       - embeddings
-      - vision
-      - tools
+      - descriptions
+      - chat
 
 semantic_search:
   enabled: True

docs/docs/frigate/installation.md

@@ -78,7 +78,7 @@ Users of the Snapcraft build of Docker cannot use storage locations outside your
 
 Frigate utilizes shared memory to store frames during processing. The default `shm-size` provided by Docker is **64MB**.
 
-The default shm size of **128MB** is fine for setups with **2 cameras** detecting at **720p**. If Frigate is exiting with "Bus error" messages, it is likely because you have too many high resolution cameras and you need to specify a higher shm size, using [`--shm-size`](https://docs.docker.com/engine/reference/run/#runtime-constraints-on-resources) (or [`service.shm_size`](https://docs.docker.com/compose/compose-file/compose-file-v2/#shm_size) in Docker Compose).
+The default shm size of **128MB** is fine for setups with **2 cameras** detecting at **720p**. If Frigate is exiting with "Bus error" messages, it is likely because you have too many high resolution cameras and you need to specify a higher shm size, using [`--shm-size`](https://docs.docker.com/engine/reference/run/#runtime-constraints-on-resources) (or [`service.shm_size`](https://docs.docker.com/compose/compose-file/compose-file-v2/#shm_size) in Docker Compose). If raising the shm size does not help, check your [process and file limits](#process-and-file-limits) as well.
 
 The Frigate container also stores logs in shm, which can take up to **40MB**, so make sure to take this into account in your math as well.
 
@@ -86,6 +86,30 @@ The Frigate container also stores logs in shm, which can take up to **40MB**, so
 
 The shm size cannot be set per container for Home Assistant Apps. However, this is probably not required since by default Home Assistant Supervisor allocates `/dev/shm` with half the size of your total memory. If your machine has 8GB of memory, chances are that Frigate will have access to up to 4GB without any additional configuration.
 
+### Process and file limits
+
+Frigate runs many processes and opens a number of shared memory files. Installs with a large number of cameras can exceed the default limits your container runtime applies.
+
+Hitting the PID limit logs `RuntimeError: can't start new thread`, often followed by a "Bus error" that makes it look like an shm sizing problem. Compare the current count against the max from inside the container:
+
+```bash
+cat /sys/fs/cgroup/pids.current
+cat /sys/fs/cgroup/pids.max
+```
+
+If these are close, raise the limit with [`--pids-limit`](https://docs.docker.com/engine/containers/resource_constraints/) (or `service.pids_limit` in Docker Compose).
+
+Running out of file descriptors logs `OSError: [Errno 24] Too many open files`. Raise the limit in Docker Compose:
+
+```yaml
+services:
+  frigate:
+    ulimits:
+      nofile:
+        soft: 65535
+        hard: 65535
+```
+
 ## Extra Steps for Specific Hardware
 
 The following sections contain additional setup steps that are only required if you are using specific hardware. If you are not using any of these hardware types, you can skip to the [Docker](#docker) installation section.
@@ -484,14 +508,13 @@ Generate a Frigate Docker Compose configuration based on your hardware and requi
 
 <DockerComposeGenerator/>
 
-
   </TabItem>
   <TabItem value="original" label="Example Docker Compose File">
 ```yaml
 services:
   frigate:
     container_name: frigate
-    privileged: true # this may not be necessary for all setups
+    # privileged: true # ONLY enable if your hardware requires it (see hardware-specific docs); prefer the device mappings below
     restart: unless-stopped
     stop_grace_period: 30s # allow enough time to shut down the various services
     image: ghcr.io/blakeblackshear/frigate:stable
@@ -523,6 +546,33 @@ services:
   </TabItem>
 </Tabs>
 
+### Recommended security options
+
+Frigate does not need elevated container privileges for most setups. The
+following hardens the container; add the `devices`/`group_add` entries your
+hardware requires (see the hardware acceleration docs):
+
+```yaml
+services:
+  frigate:
+    ...
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+```
+
+:::note
+
+`telemetry.stats.network_bandwidth` uses nethogs, which requires root with
+NET_ADMIN/NET_RAW capabilities. If you enable that stat, omit `cap_drop: [ALL]`
+or add `cap_add: [NET_ADMIN, NET_RAW]`.
+
+Platforms that genuinely require `privileged: true` (MemryX, some QNAP setups)
+are called out in their own sections and are unaffected by this guidance.
+
+:::
+
 **Docker CLI**
 
 If you can't use Docker Compose, you can run the container with something similar to this:
@@ -589,6 +639,8 @@ Home Assistant OS users can install via the App repository.
 5. Start the App
 6. Use the _Open Web UI_ button to access the Frigate UI, then click in the _cog icon_ > _Configuration editor_ and configure Frigate to your liking
 
+App users who can't set container environment variables can put `FRIGATE_` values in a `secrets.yaml` next to `config.yml` in `/addon_configs/<addon_directory>` instead. See [`secrets.yaml`](../configuration/advanced/system.md#secretsyaml).
+
 There are several variants of the App available:
 
 | App Variant                | Description                                                |

docs/docs/frigate/network_requirements.md

@@ -34,6 +34,12 @@ The following models are downloaded automatically the first time their associate
 | [Custom classification](/configuration/custom_classification/state_classification) (training) | MobileNetV2 ImageNet base weights (via Keras)                              | Google storage       |
 | [Audio transcription](/configuration/advanced/system)                                         | Whisper or Sherpa-ONNX streaming model                                     | HuggingFace / OpenAI |
 
+:::note
+
+The MobileNetV2 base weights are the one exception to the `/config/model_cache/` rule. They are also the only entry that is not downloaded when the feature is enabled: Frigate fetches them when a training run actually starts.
+
+:::
+
 ### Hardware-Specific Detector Models
 
 If you are using one of the following hardware detectors and have not provided your own model file, a default model will be downloaded on first startup:
@@ -75,7 +81,7 @@ If your Frigate instance has restricted internet access, you can point model dow
 | `HF_ENDPOINT`                       | `https://huggingface.co`            | Semantic search, Sherpa-ONNX, AXEngine models |
 | `GITHUB_ENDPOINT`                   | `https://github.com`                | Face recognition, LPR, RKNN models            |
 | `GITHUB_RAW_ENDPOINT`               | `https://raw.githubusercontent.com` | Bird classification                           |
-| `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` | Google storage (Keras default)      | Custom classification training                |
+| `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` | Unset (Keras uses its own default)  | Custom classification training                |
 
 ## Optional Cloud Services
 
@@ -147,9 +153,23 @@ When running as a Home Assistant App, the go2rtc startup script queries the loca
 To run Frigate in an air-gapped or offline environment:
 
 1. **Pre-download models**: Start Frigate with internet access once with all desired features enabled. Models will be cached in `/config/model_cache/`.
-2. **Disable version check**: Set `telemetry.version_check: false` in your configuration.
-3. **Block outbound model requests**: Set the `HF_HUB_OFFLINE=1` and `TRANSFORMERS_OFFLINE=1` environment variables to prevent HuggingFace and Transformers from attempting any network requests.
-4. **Avoid cloud features**: Do not configure Frigate+, Generative AI providers that require internet, or cloud MQTT brokers.
-5. **Use local model mirrors**: If limited internet is available, set the `HF_ENDPOINT`, `GITHUB_ENDPOINT`, and `GITHUB_RAW_ENDPOINT` environment variables to point to local mirrors.
+2. **Pre-download the training base weights**: If you plan to train custom classification models, set `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` before training, then run one training job while online. Without this variable the base weights are cached outside `/config/` and are lost whenever the container is recreated, so a later training run will fail offline. If the machine never has internet access, copy the weights in manually as described below.
+3. **Disable version check**: Set `telemetry.version_check: false` in your configuration.
+4. **Block outbound model requests**: Set the `HF_HUB_OFFLINE=1` and `TRANSFORMERS_OFFLINE=1` environment variables to prevent HuggingFace and Transformers from attempting any network requests.
+5. **Avoid cloud features**: Do not configure Frigate+, Generative AI providers that require internet, or cloud MQTT brokers.
+6. **Use local model mirrors**: If limited internet is available, set the `HF_ENDPOINT`, `GITHUB_ENDPOINT`, `GITHUB_RAW_ENDPOINT`, and `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` environment variables to point to local mirrors.
 
 After these steps, Frigate will operate with no outbound internet connections.
+
+### Manually Copying the Training Base Weights
+
+On a machine with internet access, download the weights:
+
+```bash
+curl -L -o mobilenet_v2_weights.h5 \
+  "https://storage.googleapis.com/tensorflow/keras-applications/mobilenet_v2/mobilenet_v2_weights_tf_dim_ordering_tf_kernels_0.35_224_no_top.h5"
+```
+
+Copy the file into your Frigate config volume as `/config/model_cache/MobileNet/mobilenet_v2_weights.h5`, keeping that exact filename, then set the environment variable `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` in your Docker compose file to the URL above and restart Frigate.
+
+The variable must be set even though the URL is never contacted. If it is unset, Frigate ignores the copied file and asks Keras to download the weights instead.

docs/docs/guides/getting_started.md

@@ -144,7 +144,7 @@ At this point you should be able to start Frigate and a basic config will be cre
 
 ### Step 2: Add a camera
 
-Click the **Add Camera** button in <NavPath path="Settings > Global configuration > Camera management" /> to use the camera setup wizard to get your first camera added into Frigate.
+Click the **Add Camera** button in <NavPath path="Settings > Global configuration > Camera management" /> to use the camera setup wizard to get your first camera added into Frigate. See [Adding a camera with the Add Camera Wizard](../configuration/cameras.md#adding-a-camera-with-the-add-camera-wizard) for a walkthrough of each step.
 
 ### Step 3: Configure hardware acceleration (recommended)
 
@@ -204,8 +204,8 @@ You need to refer to **Configure hardware acceleration** above to enable the con
 <ConfigTabs>
 <TabItem value="ui">
 
-1. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `OpenVINO` and **Device** `GPU`
-2. On the same page, in the **Custom Model** tab, configure the model settings for OpenVINO:
+1. Navigate to <NavPath path="Settings > System > Detection models" /> and select **Intel GPU** from the **Hardware** dropdown
+2. On the same model, open the **Custom Model** tab and configure the model settings for OpenVINO:
 
 | Field                                    | Value                                      |
 | ---------------------------------------- | ------------------------------------------ |
@@ -222,15 +222,12 @@ You need to refer to **Configure hardware acceleration** above to enable the con
 ```yaml {3-6,9-15,20-21}
 mqtt: ...
 
-detectors: # <---- add detectors
-  ov:
-    type: openvino  # <---- use openvino detector
-    device: GPU
-
-# We will use the default MobileNet_v2 model from OpenVINO.
-model:
-  width: 300
-  height: 300
+models: # <---- add models
+  - devices:
+      - openvino:GPU # <---- use the openvino detector on the GPU
+    # We will use the default MobileNet_v2 model from OpenVINO.
+    width: 300
+    height: 300
   input_tensor: nhwc
   input_pixel_format: bgr
   path: /openvino-model/ssdlite_mobilenet_v2.xml
@@ -273,7 +270,7 @@ services:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`.
+Navigate to <NavPath path="Settings > System > Detection models" /> and select **Coral EdgeTPU (USB)** from the **Hardware** dropdown.
 
 </TabItem>
 <TabItem value="yaml">
@@ -281,10 +278,9 @@ Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a
 ```yaml {3-6,11-12}
 mqtt: ...
 
-detectors: # <---- add detectors
-  coral:
-    type: edgetpu
-    device: usb
+models: # <---- add models
+  - devices:
+      - edgetpu:usb
 
 cameras:
   name_of_your_camera:
@@ -321,10 +317,9 @@ If you are using YAML to configure Frigate instead of the UI, your configuration
 mqtt:
   enabled: False
 
-detectors:
-  coral:
-    type: edgetpu
-    device: usb
+models:
+  - devices:
+      - edgetpu:usb
 
 cameras:
   name_of_your_camera:
@@ -357,7 +352,7 @@ In order to review activity in the Frigate UI, recordings need to be enabled.
 ```yaml {16-17}
 mqtt: ...
 
-detectors: ...
+models: ...
 
 cameras:
   name_of_your_camera:

docs/docs/integrations/home-assistant.md

@@ -281,7 +281,7 @@ For advanced usecases, this behavior can be changed with the [RTSP URL
 template](#options) option. When set, this string will override the default stream
 address that is derived from the default behavior described above. This option supports
 [jinja2 templates](https://jinja.palletsprojects.com/) and has the `camera` dict
-variables from [Frigate API](../integrations/api)
+variables from [Frigate API](/integrations/api/frigate-http-api)
 available for the template. Note that no Home Assistant state is available to the
 template, only the camera dict from Frigate.
 

docs/docs/integrations/homekit.md

@@ -3,35 +3,100 @@ id: homekit
 title: HomeKit
 ---
 
-Frigate cameras can be integrated with Apple HomeKit through go2rtc. This allows you to view your camera streams directly in the Apple Home app on your iOS, iPadOS, macOS, and tvOS devices.
+Frigate cameras can be exported to Apple HomeKit through go2rtc. Each exported camera appears as an accessory in the Apple Home app on your iOS, iPadOS, macOS, and tvOS devices.
 
 ## Overview
 
-HomeKit integration is handled entirely through go2rtc, which is embedded in Frigate. go2rtc provides the necessary HomeKit Accessory Protocol (HAP) server to expose your cameras to HomeKit.
+Exporting cameras is handled entirely through go2rtc, which is embedded in Frigate. go2rtc provides the necessary HomeKit Accessory Protocol (HAP) server, so your camera is published to HomeKit as an accessory in its own right.
 
-## Setup
+:::note
 
-All HomeKit configuration and pairing should be done through the **go2rtc WebUI**.
+This is the opposite of importing a HomeKit camera. go2rtc can also pair with an existing HomeKit camera (Aqara, Eve, Eufy, and similar) and use it as a stream source, which is what the `add` page of the go2rtc WebUI is for. That page discovers HomeKit accessories on your network and will not list your Frigate cameras. It is not used for exporting.
 
-### Accessing the go2rtc WebUI
-
-The go2rtc WebUI is available at:
-
-```
-http://<frigate_host>:1984
-```
-
-Replace `<frigate_host>` with the IP address or hostname of your Frigate server.
-
-### Pairing Cameras
-
-1. Navigate to the go2rtc WebUI at `http://<frigate_host>:1984`
-2. Use the `add` section to add a new camera to HomeKit
-3. Follow the on-screen instructions to generate pairing codes for your cameras
+:::
 
 ## Requirements
 
-- Frigate must be accessible on your local network using host network_mode
-- Your iOS device must be on the same network as Frigate
-- Port 1984 must be accessible for the go2rtc WebUI
-- For detailed go2rtc configuration options, refer to the [go2rtc documentation](https://github.com/AlexxIT/go2rtc)
+- Frigate must be running with `network_mode: host` so that HomeKit can discover your cameras over mDNS
+- Your Apple device must be on the same network as Frigate
+- Port 1984 must be accessible so you can reach the go2rtc WebUI
+
+HomeKit also places strict limits on the stream itself. go2rtc passes your stream through without resizing or re-encoding it, so the stream you export must already meet these requirements:
+
+- **Video:** H.264 at 1920x1080, 1280x720, or 320x240
+- **Audio:** Opus, mono, 16 kHz
+
+A camera's full resolution stream usually does not qualify. See [Exporting a compatible stream](#exporting-a-compatible-stream) below.
+
+## Configuration
+
+HomeKit settings are stored in `/config/go2rtc_homekit.yml`. This is a separate file from your Frigate config, because go2rtc needs to write your pairings back to it when you pair a device.
+
+Edit it using the go2rtc config editor, which writes to that file directly:
+
+```
+http://<frigate_host>:1984/editor.html
+```
+
+Replace `<frigate_host>` with the IP address or hostname of your Frigate server. The editor will be empty until you add a HomeKit section, since this file holds only your HomeKit settings and not the rest of your go2rtc config.
+
+:::warning
+
+Do not put the `homekit:` section in the `go2rtc:` section of your Frigate config.
+
+Frigate regenerates that config on every startup, so go2rtc cannot save your pairings to it. Pairing will appear to succeed and then fail after the next restart with `PairVerify with unknown client_id`. If the section exists in both places, your saved pairings are erased on every restart.
+
+:::
+
+Add an entry for each camera you want to export. The key must match the name of a go2rtc stream, and the pin must be 8 digits. This is the number the Home app calls the setup code:
+
+```yaml
+homekit:
+  front_door:
+    name: Front Door
+    pin: "12345678"
+```
+
+If the key does not match a go2rtc stream, go2rtc logs `[homekit] missing stream:` at startup and the camera will not appear in the Home app.
+
+:::note
+
+go2rtc derives each accessory's HomeKit identity from this key, so renaming it later means the camera appears as a new accessory and has to be paired again. Settle on the name before you pair.
+
+:::
+
+Frigate keeps only the `homekit:` section of this file when it starts, so do not store streams or other go2rtc settings in it.
+
+### Exporting a compatible stream
+
+If a camera's stream does not meet the requirements listed above, define a scaled restream in your Frigate config and point HomeKit at that stream instead of the original:
+
+```yaml
+go2rtc:
+  streams:
+    front_door:
+      - rtsp://user:password@192.168.1.50:554/stream
+    front_door_homekit:
+      - "ffmpeg:front_door#video=h264#width=1280#height=720#audio=opus/16000"
+```
+
+```yaml
+# /config/go2rtc_homekit.yml
+homekit:
+  front_door_homekit:
+    name: Front Door
+    pin: "12345678"
+```
+
+Add `#hardware=cuda`, `#hardware=vaapi`, or the appropriate value for your system to transcode using your GPU. Note that NVENC cannot encode H.264 wider than 4096 pixels, so very wide streams must be scaled down as shown above rather than only re-encoded.
+
+## Pairing Cameras
+
+1. Restart Frigate after adding the `homekit:` section
+2. In the Apple Home app, choose **Add Accessory**, then **More options** to enter a code manually
+3. Select your camera and enter the pin you configured as the setup code
+4. Confirm that a `pairings:` list now appears under the camera in `/config/go2rtc_homekit.yml`
+
+Pairings are saved back to that file automatically. If step 4 shows no `pairings:` list, check the Frigate log for `[homekit] can't save`, which means the `homekit:` section is missing from `/config/go2rtc_homekit.yml`.
+
+For detailed go2rtc configuration options, refer to the [go2rtc documentation](https://github.com/AlexxIT/go2rtc).

docs/docs/integrations/mqtt.md

@@ -16,7 +16,7 @@ MQTT requires a network connection to your broker. This is typically local, but
 ### `frigate/available`
 
 Designed to be used as an availability topic with Home Assistant. Possible message are:
-"online": published when Frigate is running (on startup)
+"online": published once Frigate is running and has published its initial state. Note that this is published on every connection to the broker, so it is republished if the broker restarts or the connection drops and recovers, without Frigate itself restarting.
 "stopped": published when Frigate is stopped normally
 "offline": published automatically by the MQTT broker if Frigate disconnects unexpectedly (via MQTT Will Message)
 
@@ -292,7 +292,9 @@ Topic with the currently active profile name. Published value is the profile nam
 
 ### `frigate/notifications/set`
 
-Topic to turn notifications on and off. Expected values are `ON` and `OFF`.
+Topic to turn notifications on and off for all cameras. Expected values are `ON` and `OFF`.
+
+Only available when notifications are enabled in the config. Not persisted across Frigate restarts.
 
 ### `frigate/notifications/state`
 
@@ -302,12 +304,14 @@ Topic with current state of notifications. Published values are `ON` and `OFF`.
 
 ### `frigate/<camera_name>/status/<role>`
 
-Publishes the current health status of each role that is enabled (`audio`, `detect`, `record`). Possible values are:
+Publishes the current health status of each role that is enabled (`audio`, `detect`, `record`, `record_sub`). `record_sub` is only published for cameras with [sub stream recording](/configuration/record#sub-stream-recording) enabled, and is tracked separately from `record` so a healthy main stream can't hide a stalled sub stream. Possible values are:
 
 - `online`: Stream is running and being processed
 - `offline`: Stream is offline and is being restarted
 - `disabled`: Camera is currently turned off (either at runtime via the `enabled/set` topic, or persistently via the configuration file). See [Camera state](/configuration/live#camera-state) for the distinction.
 
+These reflect the state of Frigate's process for that role, not the camera's reachability, so an unreachable camera alternates between `offline` and `online` as the watchdog restarts ffmpeg. Wait for the status to hold steady (for example with Home Assistant's `for:`) rather than acting on a single message.
+
 ### `frigate/<camera_name>/<object_name>`
 
 Publishes the count of objects for the camera for use as a sensor in Home Assistant.
@@ -390,6 +394,18 @@ Topic to turn audio detection for a camera on and off. Expected values are `ON`
 
 Topic with current state of audio detection for a camera. Published values are `ON` and `OFF`.
 
+### `frigate/<camera_name>/audio_transcription/set`
+
+Topic to turn [live audio transcription](/configuration/audio_detectors#live-transcription) for a camera on and off. Expected values are `ON` and `OFF`. Transcribed text is published to `frigate/<camera_name>/audio/transcription`.
+
+`ON` is ignored unless audio transcription is enabled in the config for the camera. Unlike the other camera toggles, this one is not persisted across Frigate restarts.
+
+**NOTE:** Requires audio detection and transcription to be enabled
+
+### `frigate/<camera_name>/audio_transcription/state`
+
+Topic with current state of live audio transcription for a camera. Published values are `ON` and `OFF`.
+
 ### `frigate/<camera_name>/recordings/set`
 
 Topic to turn recordings for a camera on and off. Expected values are `ON` and `OFF`. The change is persisted across Frigate restarts (see [Runtime toggle persistence](/configuration/live#runtime-toggle-persistence)).
@@ -537,35 +553,42 @@ must be enabled in the configuration.
 
 Topic with current state of Birdseye for a camera. Published values are `ON` and `OFF`.
 
-### `frigate/<camera_name>/birdseye_mode/set`
+### `frigate/<camera_name>/birdseye_modes/set`
 
-Topic to set Birdseye mode for a camera. Birdseye offers different modes to customize under which circumstances the camera is shown.
+Topic to set the Birdseye activity types for a camera. Send one uppercase activity type or combine multiple types with commas, for example `MOTION,ALERTS`.
 
-_Note: Changing the value from `CONTINUOUS` -> `MOTION | OBJECTS` will take up to 30 seconds for
+_Note: Changing the value from `CONTINUOUS` to non-continuous activity types will take up to 30 seconds for
 the camera to be removed from the view._
 
-| Command      | Description                                                       |
-| ------------ | ----------------------------------------------------------------- |
-| `CONTINUOUS` | Always included                                                   |
-| `MOTION`     | Show when detected motion within the last 30 seconds are included |
-| `OBJECTS`    | Shown if an active object tracked within the last 30 seconds      |
+| Command       | Description                                                      |
+| ------------- | ---------------------------------------------------------------- |
+| `CONTINUOUS`  | Always included                                                  |
+| `MOTION`      | Shown if motion was detected within the last 30 seconds          |
+| `ALL_OBJECTS` | Shown if a tracked object was present within the last 30 seconds |
+| `ALERTS`      | Shown while an alert review item is in progress                  |
+| `DETECTIONS`  | Shown while a detection review item is in progress               |
+| `NONE`        | Never included                                                   |
 
-### `frigate/<camera_name>/birdseye_mode/state`
+### `frigate/<camera_name>/birdseye_modes/state`
 
-Topic with current state of the Birdseye mode for a camera. Published values are `CONTINUOUS`, `MOTION`, `OBJECTS`.
+Topic with the current Birdseye activity types for a camera. Multiple enabled types are published as a comma-separated value in the order `CONTINUOUS`, `MOTION`, `ALL_OBJECTS`, `ALERTS`, `DETECTIONS`. `NONE` is published when no activity types are enabled.
 
 ### `frigate/<camera_name>/notifications/set`
 
-Topic to turn notifications on and off. Expected values are `ON` and `OFF`.
+Topic to turn notifications for a camera on and off. Expected values are `ON` and `OFF`.
+
+`ON` is ignored unless notifications are enabled in the config for the camera. This is not persisted across Frigate restarts. It is the same control the UI labels **Suspend until restart**.
 
 ### `frigate/<camera_name>/notifications/state`
 
-Topic with current state of notifications. Published values are `ON` and `OFF`.
+Topic with current state of notifications. Published values are `ON` and `OFF`. This is the authoritative topic for whether a camera will notify.
 
 ### `frigate/<camera_name>/notifications/suspend`
 
-Topic to suspend notifications for a certain number of minutes. Expected value is an integer.
+Topic to suspend notifications for a certain number of minutes. Expected value is an integer. Separate from `notifications/set`: it does not change `notifications/state`, and is ignored while notifications are off.
 
 ### `frigate/<camera_name>/notifications/suspended`
 
-Topic with timestamp that notifications are suspended until. Published value is a UNIX timestamp, or 0 if notifications are not suspended.
+Topic with timestamp that notifications are suspended until. Published value is a UNIX timestamp, or 0 if there is no timed suspension.
+
+`0` does not mean notifications are enabled: `notifications/set` `OFF` clears the timed suspension, so this publishes `0` while `notifications/state` is `OFF`.

docs/docs/integrations/plus.md

@@ -59,13 +59,12 @@ You can view all of your submitted images at [https://plus.frigate.video](https:
 
 Once you have [requested your first model](../plus/first_model.md) and gotten your own model ID, it can be used with a special model path. No other information needs to be configured for Frigate+ models because it fetches the remaining config from Frigate+ automatically.
 
-You can either choose the new model from the <NavPath path="Settings > System > Detectors and model" /> pane in the Frigate UI (the **Frigate+ Model** tab), or manually set the model at the root level in your config:
+You can either choose the new model from the <NavPath path="Settings > System > Detection models" /> pane in the Frigate UI (on the **Frigate+** tab of the model you want to change), or set it on that model in your config:
 
 ```yaml
-detectors: ...
-
-model:
-  path: plus://<your_model_id>
+models:
+  - devices: ...
+    path: plus://<your_model_id>
 ```
 
 :::note
@@ -79,10 +78,11 @@ Models are downloaded into the `/config/model_cache` folder and only downloaded
 If needed, you can override the labelmap for Frigate+ models. This is not recommended as renaming labels will break the Submit to Frigate+ feature if the labels are not available in Frigate+.
 
 ```yaml
-model:
-  path: plus://<your_model_id>
-  labelmap:
-    3: animal
-    4: animal
-    5: animal
+models:
+  - devices: ...
+    path: plus://<your_model_id>
+    labelmap:
+      3: animal
+      4: animal
+      5: animal
 ```

docs/docs/plus/first_model.md

@@ -30,16 +30,15 @@ Models available in Frigate+ can be used with a special model path. No other inf
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detectors and model" />. In the **Detection Model** section, choose the **Frigate+** tab. Select your new Frigate+ model from the **Available Frigate+ models** dropdown, then click **Save**. Restart Frigate to apply the change.
+Navigate to <NavPath path="Settings > System > Detection models" />. On the model you want to change, choose the **Frigate+** tab and select your new Frigate+ model from the **Available Frigate+ models** dropdown, then click **Save**. Restart Frigate to apply the change.
 
 </TabItem>
 <TabItem value="yaml">
 
 ```yaml
-detectors: ...
-
-model:
-  path: plus://<your_model_id>
+models:
+  - devices: ...
+    path: plus://<your_model_id>
 ```
 
 :::tip

docs/docs/troubleshooting/common_errors.md

@@ -0,0 +1,238 @@
+---
+id: common_errors
+title: Common Error Messages
+---
+
+import FaqItem from "@site/src/components/FaqItem";
+
+This page is an index of error messages you might see in Frigate's logs, what each one means, and where to go next. It is organized by the kind of problem, not by which component logged the message.
+
+Two things to know before you start:
+
+- **Many of these messages come from FFmpeg, go2rtc, GPU drivers, or the operating system, not from Frigate itself.** Frigate captures and re-logs their output, so the log level shown in the Frigate UI does not always reflect the original severity.
+- **Wrapped errors put the real cause on the next line.** When Frigate logs a generic message like `Error occurred when attempting to maintain recording cache`, the actual exception is logged immediately after it. When a camera's FFmpeg process exits, Frigate logs `The following ffmpeg logs include the last 100 lines prior to exit` and dumps that camera's FFmpeg output. Always read those lines, they are where the answer usually is.
+
+## Camera connection and streams
+
+<FaqItem id="connection-refused-no-route-to-host-401-404" question="Connection refused / No route to host / 401 Unauthorized / 404 Not Found">
+
+These are FFmpeg errors about reaching the camera (or the go2rtc restream). `Connection refused` and `No route to host` mean nothing is listening at that address or the host is unreachable; `401 Unauthorized` is wrong credentials; `404 Not Found` is a wrong stream path (or a `restream` input pointing at a go2rtc stream name that does not exist). A camera that has hit its concurrent-connection limit can also return `refused` or `401` on a URL that works in VLC.
+
+See [go2rtc troubleshooting](/troubleshooting/go2rtc#1-read-the-go2rtc-logs) for how to isolate the stream.
+
+</FaqItem>
+
+<FaqItem id="no-frames-received-in-20-seconds" question="No frames received from <camera> in 20 seconds. Exiting ffmpeg...">
+
+FFmpeg is running but has stopped delivering video for 20 seconds, so Frigate's camera watchdog restarts it. The stream connected at least once, then went quiet: a camera reboot, a network drop, the camera evicting the connection, or a stalled decoder. If it repeats on a loop, the stream is unstable.
+
+</FaqItem>
+
+<FaqItem id="ffmpeg-process-crashed-unexpectedly" question="Ffmpeg process crashed unexpectedly for <camera>">
+
+The detect FFmpeg process exited on its own. This message is only the notification; the cause is in the 100 FFmpeg log lines Frigate dumps right after it (look for a `Failed to sync surface`, `Connection refused`, codec, or audio error in that block). Related watchdog messages include `<camera> exceeded fps limit`, which means the camera is delivering frames faster than `detect.fps` (usually a camera whose real frame rate differs from what is configured).
+
+</FaqItem>
+
+<FaqItem id="non-monotonically-increasing-dts" question="Non-monotonic DTS / non monotonically increasing dts to muxer / Queue input is backward in time">
+
+These are FFmpeg messages indicating the camera sent packets with out-of-order timestamps, either on the video or the audio stream. Timestamp jitter like this is common with WiFi cameras and restreamed or proxied sources; other causes are a camera "Smart Codec" / H.264+ / H.265+ mode or a camera clock that jumps. A sustained flood of these messages usually precedes the stream stalling and the watchdog restarting FFmpeg.
+
+In most cases, the fix is to improve the network, reduce system resource usage, or switch to non-WiFi cameras. In general, WiFi cameras are [not recommended](https://ipcamtalk.com/threads/multiple-cameras-high-bandwidth.77100/#post-861110).
+
+On the video stream, this can affect recordings: because they are copied without re-encoding, FFmpeg cannot fix the timestamps, and the segment muxer often splits early, producing one-second segments and a cache backlog. See [Recordings: segments are only 1 second long](/troubleshooting/recordings#segments-are-only-1-second-long).
+
+On the audio stream, the messages can come from the output's audio encoding. If the audio stream is the problem, it may help to have go2rtc transcode it by adding `#audio=aac` to the camera's go2rtc stream to produce clean timestamps for everything consuming the restream.
+
+</FaqItem>
+
+<FaqItem id="bad-cseq" question="RTP: PT=xx: bad cseq (packet loss / reordering)">
+
+An FFmpeg message meaning RTP packets arrived out of sequence, which almost always means the stream is using UDP transport. Frigate's RTSP presets force TCP, so seeing this points at a custom `input_args`, `preset-rtsp-udp`, or a go2rtc source that is not using TCP. Switch to TCP unless your camera is [UDP-only](/configuration/camera_specific#udp-only-cameras).
+
+</FaqItem>
+
+<FaqItem id="error-while-decoding-mb-non-existing-pps" question="error while decoding MB / non-existing PPS referenced (corrupt frames)">
+
+FFmpeg decoder messages meaning the received video bitstream was incomplete or damaged. A few of these at every stream start are normal (the decoder connected before the first keyframe) and Frigate discards them. A continuous stream of them means real packet loss, from Wi-Fi or a saturated link, an overloaded camera, or an FFmpeg restart loop caused by another problem. Fix the underlying instability rather than the message.
+
+</FaqItem>
+
+<FaqItem id="could-not-find-codec-parameters" question="Could not find codec parameters for stream ... unspecified size">
+
+An FFmpeg message meaning it probed the stream but never saw enough decodable video to determine the frame size, often because the probe window ended before the first keyframe on a long-GOP stream, or because the stream is not delivering usable video. If it is a Reolink HTTP stream, use `preset-http-reolink`, which raises the probe size for exactly this case.
+
+</FaqItem>
+
+## Recording
+
+<FaqItem id="no-new-recording-segments" question="No new recording segments were created for <camera> in the last 120s">
+
+Frigate's record watchdog is restarting the record FFmpeg process because no valid segment has reached the cache. This means the record stream is not connecting or the segments are being rejected (see the audio-codec entry below).
+
+See [Recordings: the record stream isn't connecting](/troubleshooting/recordings#the-record-stream-isnt-connecting).
+
+</FaqItem>
+
+<FaqItem id="invalid-or-missing-video-stream-in-segment" question="Invalid or missing video stream in segment. Discarding.">
+
+A cached recording segment failed validation (no readable video stream) and was deleted. The most common cause is a segment that was truncated because the record FFmpeg process was killed mid-write, so this often appears alongside, and as a consequence of, the record-stream restarts above. A segment containing only audio triggers it too.
+
+</FaqItem>
+
+<FaqItem id="incompatible-audio-codec" question="Recordings silently fail to save (incompatible audio codec)">
+
+Some camera audio codecs (G.711 variants such as `pcm_alaw` and `pcm_mulaw`) cannot be stored in an MP4 container, so segments never finalize even though live view works.
+
+See [Recordings: incompatible audio codec](/troubleshooting/recordings#incompatible-audio-codec-recordings-silently-fail-to-save) for the FFmpeg preset that transcodes the audio to AAC.
+
+</FaqItem>
+
+<FaqItem id="error-maintaining-recording-cache" question="Error occurred when attempting to maintain recording cache">
+
+A generic wrapper; the real exception is on the next log line. Frequently it is `[Errno 28] No space left on device` or `[Errno 17] File exists` on a network share.
+
+See [Recordings cache warnings and errors](/troubleshooting/recordings#i-see-the-message-error--error-occurred-when-attempting-to-maintain-recording-cache), which covers this message and the common `Errno` cases.
+
+</FaqItem>
+
+## Hardware acceleration
+
+<FaqItem id="failed-to-sync-surface" question="Failed to sync surface / Failed to download frame: -5 / Error while filtering">
+
+A VAAPI/QSV hardware frame-sync failure between FFmpeg and the GPU driver, not a Frigate bug. It usually appears when the detect stream is being scaled or decoded on the GPU.
+
+See [GPU: Failed to download frame: -5](/troubleshooting/gpu#failed-to-download-frame--5), which lists the fixes in order (switch VAAPI/QSV preset, change `LIBVA_DRIVER_NAME`, use an H.264 substream, match detect resolution and fps to the stream).
+
+</FaqItem>
+
+<FaqItem id="no-decoder-surfaces-left" question="No decoder surfaces left / Can't allocate a surface">
+
+Both mean the GPU ran out of decode surfaces: `No decoder surfaces left` is NVIDIA NVDEC, `Can't allocate a surface` is Intel QSV. This is surface-pool exhaustion, typically from too many concurrent hardware-decoded cameras on one GPU (consumer NVIDIA cards have a driver-enforced limit on simultaneous decode sessions). Reduce the number of cameras decoding on that GPU, decode some on the CPU, or move to hardware without the session cap.
+
+</FaqItem>
+
+<FaqItem id="nvidia-container-cli-nvml-error" question="nvidia-container-cli: nvml error: driver not loaded">
+
+This comes from the NVIDIA container runtime while starting the container, not from Frigate, and the container never starts. The NVIDIA driver is not loaded on the host. Confirm `nvidia-smi` works on the host itself (not inside the container) before troubleshooting Frigate. In a VM or LXC, the driver must be available inside the guest. See [Hardware: Nvidia GPU](/configuration/hardware_acceleration_video).
+
+</FaqItem>
+
+## Detectors and models
+
+<FaqItem id="illegal-instruction" question="Illegal instruction (core dumped)">
+
+The process was killed by the CPU for executing an unsupported instruction. There are two distinct causes in Frigate:
+
+- **A Coral EdgeTPU** on a newer kernel with an outdated gasket driver. See [EdgeTPU: Illegal instruction](/troubleshooting/edgetpu#attempting-to-load-tpu-as-pci--fatal-python-error-illegal-instruction).
+- **A CPU without AVX/AVX2**, when enabling semantic search, face recognition, license plate recognition, classification, or audio transcription. These features use libraries compiled with AVX and crash immediately on CPUs that lack it (commonly Intel Celeron/Pentium before the 2020 Tiger Lake generation). See the [CPU requirements](/frigate/planning_setup#cpu).
+
+</FaqItem>
+
+<FaqItem id="onnx-invalidprotobuf" question="ONNX Runtime InvalidProtobuf / failed to load model">
+
+ONNX Runtime could not parse the model file. The file exists but its contents are not a valid ONNX model, usually a corrupted or interrupted download in `model_cache`, or the wrong file pointed at by a model's `path`. Delete the cached model file so Frigate re-downloads it, and confirm the model's `path` points at an actual `.onnx` model. See [ONNX detector configuration](/configuration/object_detectors#onnx).
+
+</FaqItem>
+
+<FaqItem id="cuda-failure-999-901" question="CUDA failure 999 / CUDA failure 901">
+
+ONNX Runtime CUDA errors. `999` (`cudaErrorUnknown`) is a general, unrecoverable CUDA context failure, usually a driver/runtime version mismatch between the host and the container or a GPU in a bad state. `901` is a CUDA-graph capture error, which points at a custom model whose operations are not capture-safe. For `999`, align the host driver with the container's CUDA version and confirm the GPU is healthy.
+
+</FaqItem>
+
+<FaqItem id="openvino-no-supported-devices" question="Can't get OPTIMIZATION_CAPABILITIES property as no supported devices found">
+
+OpenVINO could not find the configured device (usually `GPU` or `NPU`). Most often the `/dev/dri` render node is not passed into the container, or the wrong render node is mapped when an iGPU and a discrete GPU coexist.
+
+See [GPU: no supported devices found](/troubleshooting/gpu#cant-get-optimization_capabilities-property-as-no-supported-devices-found).
+
+</FaqItem>
+
+## Memory and storage
+
+<FaqItem id="fatal-python-error-bus-error" question="Fatal Python error: Bus error">
+
+Frigate ran out of shared memory (`/dev/shm`). The container's `shm_size` is too small for the number and resolution of your detect streams, or you added cameras after startup without increasing it.
+
+See [Calculating required shm-size](/frigate/installation#calculating-required-shm-size). If you cannot increase `shm_size`, lowering the `SHM_MAX_FRAMES` environment variable reduces how many frames Frigate buffers per camera.
+
+</FaqItem>
+
+<FaqItem id="errno-28-no-space-left" question="[Errno 28] No space left on device">
+
+A filesystem is full: the recordings volume (`/media/frigate`), the cache tmpfs (`/tmp/cache`), or `/dev/shm`. Check which one, and note that inode exhaustion can produce this while `df -h` still shows free space.
+
+See [Recordings: No space left on device](/troubleshooting/recordings#i-see-the-message-error--error-occurred-when-attempting-to-maintain-recording-cache).
+
+</FaqItem>
+
+<FaqItem id="container-exits-with-no-logs" question="The container exits or restarts with no error in the logs">
+
+A silent exit is usually the host or container out-of-memory killer. Because `/dev/shm` and `/tmp/cache` are memory-backed, they count against the container's memory limit, so aggressive shm or cache sizing can trigger it. Give the container more memory, or reduce shm/cache sizing, and check the host's OOM messages (`dmesg`).
+
+</FaqItem>
+
+## Database
+
+<FaqItem id="database-is-locked" question="database is locked">
+
+SQLite could not acquire the write lock. Frigate's timeout already scales with camera count, so under normal local-disk operation this essentially only happens when the database is on a network share (SMB/NFS), where file locking is unreliable, or when two instances point at the same file.
+
+See [Database is locked](/troubleshooting/faqs#error-database-is-locked).
+
+</FaqItem>
+
+<FaqItem id="database-disk-image-is-malformed" question="database disk image is malformed">
+
+The SQLite database file is corrupted, typically after hard power loss, a network-share database, or a filesystem with unsafe write semantics. Frigate does not repair it automatically, but the database can usually be recovered by hand.
+
+**Stop Frigate first**, then work on the database file directly (by default `/config/frigate.db`). Start by checking what is actually wrong:
+
+```bash
+sqlite3 frigate.db "PRAGMA integrity_check;"
+```
+
+If the only problems reported are index-related (lines such as `row 14 missing from index recordings_path` or `non-unique entry in index ...`), rebuilding the indexes is usually enough and is the least destructive fix:
+
+```bash
+sqlite3 frigate.db "REINDEX;"
+```
+
+If the integrity check reports page or byte-level corruption instead (for example `Multiple uses for byte 2706 of page 142272`), dump the readable contents into a new database:
+
+```bash
+# dump what can still be read
+sqlite3 frigate.db .dump > frigate.dump
+
+# keep the corrupt file, then rebuild from the dump
+mv frigate.db frigate.db.bak
+cat frigate.dump | sqlite3 frigate.db
+
+# confirm the rebuilt database is clean, this should print "ok"
+sqlite3 frigate.db "PRAGMA integrity_check;"
+```
+
+Rows stored in the corrupted pages cannot be recovered, so expect to lose some tracked objects, review items, or thumbnails. Recordings themselves are files on disk and are not affected.
+
+As a last resort, stop Frigate, delete `frigate.db`, and restart. Frigate recreates it, but existing recordings lose all of their metadata. If a `backup.db` exists next to your database, Frigate wrote it before the last schema migration and restoring it recovers everything up to that point.
+
+Repeat corruption usually points at the underlying storage: move the database off a network share, and on Raspberry Pi check power delivery and the SD card or SSD.
+
+</FaqItem>
+
+## Startup and web access
+
+<FaqItem id="unable-to-start-frigate-in-safe-mode" question="Unable to start Frigate in safe mode / Starting Frigate in safe mode">
+
+When your config fails validation at startup, Frigate prints the validation errors (with line numbers), then starts in **safe mode**: a minimal configuration with no cameras and MQTT disabled, so the UI stays reachable. In safe mode the only available page is the Config Editor, which shows the validation errors so you can fix them, then save and restart. Note that recording retention and storage cleanup do **not** run while in safe mode, so do not leave a low-disk system sitting in it.
+
+`Unable to start Frigate in safe mode` means even the minimal config failed, which points at an error in your `auth`, `proxy`, or `database` section, or a config file that is not valid YAML at all. Safe mode is not sticky; fix the config and restart and Frigate returns to normal.
+
+</FaqItem>
+
+<FaqItem id="502-bad-gateway" question="502 Bad Gateway / connection refused to 127.0.0.1:5001">
+
+The web server is up but the Frigate backend (port 5001) is not answering yet. By far the most common reason is that the page was loaded during startup: the API binds last, after database migrations (which can take minutes on a large database), model downloads, and process startup, while the web server is already serving. Wait for startup to finish. If it persists, the backend has failed to start, and the reason is earlier in the logs. This also explains a `connection refused to 127.0.0.1:5001` seen while loading `/ws`, because every authenticated request first makes an auth subrequest to that port.
+
+</FaqItem>

docs/docs/troubleshooting/cpu.md

@@ -3,7 +3,31 @@ id: cpu
 title: High CPU Usage
 ---
 
-High CPU usage can impact Frigate's performance and responsiveness. This guide outlines the most effective configuration changes to help reduce CPU consumption and optimize resource usage.
+High CPU usage can impact Frigate's performance and responsiveness. This guide explains how to interpret the CPU values Frigate reports and outlines the most effective configuration changes to help reduce CPU consumption and optimize resource usage.
+
+## Understanding Frigate's Reported CPU Usage
+
+Frigate's CPU percentages often look much higher than what the host reports. Usually both numbers are correct and are simply measured against different denominators, so confirm you actually have a problem before tuning anything.
+
+### Per-process values are relative to a single core
+
+The values Frigate reports for FFmpeg, capture, detect, detector, and other processes follow the same convention as `top`: 100% means one CPU core is fully saturated, not that the whole system is saturated. A multithreaded process such as FFmpeg can legitimately report well over 100%.
+
+Host and hypervisor tools instead report a percentage of the machine's total capacity across all cores. This includes `docker stats`, the `htop` summary, the Proxmox summary graph, the Unraid dashboard, Synology Resource Monitor, and Home Assistant's system monitor sensors. To reconcile the two:
+
+```
+host percentage ≈ (sum of Frigate's process percentages) / (number of cores)
+```
+
+On a 4 core system, an FFmpeg process reporting 100% is consuming one quarter of the machine, so the host will show roughly 25 to 30% once the remaining Frigate processes are included. That same 100% on a 16 core system is about 6%. Frigate's own warning thresholds use the per-core convention as well, so an FFmpeg process is flagged at 20% of a single core, not 20% of the system.
+
+### Instantaneous samples and averages measure different things
+
+Frigate collects stats every 15 seconds, and the `cpu` value covers only the interval since the previous collection. The `cpu_average` value in the stats API and MQTT payload is the average across the entire life of the process, and it is what the high CPU usage warnings are based on. Host dashboards generally plot data averaged over a longer window, so a single Frigate sample can show a peak that a host graph never displays. A process that has just started, such as FFmpeg after a camera reconnect, reports 0 until it has been sampled twice.
+
+### The system-wide value depends on what the container can see
+
+The system CPU value is read from `/proc/stat`. Under Docker that file belongs to the host, so the value covers the entire machine including workloads unrelated to Frigate, and it will not match `docker stats` for the Frigate container. Under an LXC container, lxcfs virtualizes `/proc/stat` and the value reflects only the cores assigned to the container. In a virtual machine, the guest sees only its assigned vCPUs while the hypervisor divides by every physical thread on the node, so guest and host percentages will not agree even when both are accurate.
 
 ## 1. Hardware Acceleration for Video Decoding
 
@@ -72,3 +96,19 @@ The model you use significantly impacts detector performance. Frigate provides d
 - Larger models (640x640): Slower inference, can sometimes have higher accuracy on very large objects that take up a majority of the frame.
 
 For more detail on picking the right size, see [Choosing a model size](../configuration/object_detectors.md#choosing-a-model-size).
+
+## 3. Reducing Detector CPU Usage
+
+**Priority: High**
+
+The **Detector CPU Usage** metric measures the CPU spent converting frames into the tensor format the model expects and post-processing the model's output. It does not include inference, so this value can be high even when you've configured a GPU, NPU, or Coral for object detection.
+
+This metric scales with how many detections per second Frigate runs and how expensive each one is to prepare. Tuning [motion detection](../configuration/motion_detection) is usually the first recommendation to reduce the number of detections. Additionally, you can:
+
+- **Lower `detect -> fps`.** 5 is the recommended value for nearly all cameras. Running at 10 doubles the frames eligible for detection and is one of the largest contributors to this metric.
+- **Use a 320x320 model.** A 640x640 model has 4 times as many pixels to transpose, convert, and copy on every inference.
+- **Prefer a model that takes integer input.** Models configured with `input_dtype: float` require each frame to be converted to float32 and normalized on the CPU first. Models taking `int` input, such as the tflite models used by the Edge TPU, skip that step.
+- **Do not match the detect resolution to the model resolution.** The detect stream should match your camera's aspect ratio, for example `1280x720`, not the model's input size. Frigate crops and scales regions of motion itself, so an oversized detect stream only adds work.
+- **Tune stationary object behavior.** Objects that never settle into a stationary state are re-detected continuously. Raising `detect -> stationary -> interval` reduces how often detection runs on objects that are already parked. See [stationary objects](../configuration/stationary_objects).
+
+Adding [more detector instances](#multiple-detector-instances) spreads this work across more CPU cores, but does not reduce the total CPU used.

docs/docs/troubleshooting/dummy-camera.md

@@ -39,7 +39,7 @@ The per-clip variation is typically quite low and is mostly an artifact of keyfr
 
 Debug Replay lets you re-run Frigate's detection pipeline against a section of recorded video without manually configuring a dummy camera. It automatically extracts the recording, creates a temporary camera with the same detection settings as the original, and loops the clip through the pipeline so you can observe detections in real time.
 
-The replay camera behaves like a live camera feed rather than History's video player: it loops the clip continuously as Frigate analyzes it and has no playback controls, so you cannot pause, scrub, or step through it frame by frame.
+The replay camera behaves like a live camera feed rather than History's video player: it loops the clip continuously as Frigate analyzes it and has no playback controls, so you cannot pause, scrub, or step through it frame by frame. The Debug Replay camera does not save recordings or snapshots or surface anything in Explore, but it otherwise behaves like a regular camera, including running enrichments such as Face Recognition, LPR, and custom classification.
 
 Debug Replay isn't intended to be a one-stop pane for all Frigate diagnostics or a comprehensive debugging environment for every Frigate feature. It merely makes it easier to spin up a "dummy camera" and perform some common adjustments in real time. You'll still need to use the normal tools (logs, an MQTT client, etc) to debug your feature.
 

docs/docs/troubleshooting/faqs.md

@@ -65,9 +65,17 @@ This is because Frigate does not run in host mode so localhost points to the Fri
 
 ### How do I know if my camera is offline
 
-A camera being offline can be detected via MQTT or /api/stats, the camera_fps for any offline camera will be 0.
+Frigate publishes a per-role health status to [`frigate/<camera_name>/status/<role>`](/integrations/mqtt#frigatecamera_namestatusrole), where `<role>` is each enabled role on the camera (`detect`, `record`, and `audio`). The published value is one of:
 
-Also, Home Assistant will mark any offline camera as being unavailable when the camera is offline.
+- `online`: Frigate's process for that role is running normally
+- `offline`: the process is down and Frigate is restarting it
+- `disabled`: the camera is turned off, either at runtime or in the configuration file
+
+These reflect the state of Frigate's process for that role, not the camera's reachability, so an unreachable camera alternates between `offline` and `online` as the watchdog restarts ffmpeg. Wait for the status to hold steady (for example with Home Assistant's `for:`) rather than acting on a single message.
+
+Because the status is per role, a camera whose substream is fine but whose recording stream has dropped will report `online` for `detect` and `offline` for `record`. The status is republished whenever it changes.
+
+You can also detect an offline camera through `/api/stats`, where `camera_fps` will be 0.
 
 ### How can I view the Frigate log files without using the Web UI?
 
@@ -125,6 +133,12 @@ cameras:
       height: 720
 ```
 
+### What is the `version` key in my config file?
+
+`version` records the config format that your config was last migrated to. On startup Frigate compares it against the format the running version expects, and if it is older it copies your config to `/config/backup_config.yaml`, rewrites it to the new format, and updates `version` as the final step. A config with no `version` key is assumed to predate 0.14 and is migrated from there.
+
+Frigate manages this key for you, so do not set or edit it. Raising it makes Frigate skip migrations your config still needs, and lowering it re-runs migrations against config that has already been converted. Either can leave you with a config that no longer validates.
+
 ### Why does Frigate keep creating new tracked objects for my parked car?
 
 Stationary tracking is designed to _prevent_ this: a parked car should remain a single tracked object rather than generating new ones. If you're repeatedly getting new tracked objects for the same car, it's likely that Frigate is losing the object and re-detecting it as a new one.

docs/docs/troubleshooting/recordings.md

@@ -428,3 +428,19 @@ You'll want to:
 - [Tune your motion detection settings](/configuration/motion_detection) either by editing your config file or by using the UI's Motion Tuner.
 
 </FaqItem>
+
+<FaqItem id="my-timeline-previews-are-black-after-restarting-frigate-or-recreating-the-container" question="My timeline previews are black after restarting Frigate or recreating the container. Why?">
+
+The scrubbing previews (the timelapse clips shown when dragging the History timeline, the secondary-camera previews, and the preview that plays when hovering a review card) are not recorded continuously. Frigate caches low-resolution preview frames in `/tmp/cache` throughout each hour and only assembles them into a finished preview clip **at the top of the hour**.
+
+In the recommended configuration, `/tmp/cache` is a small in-memory (`tmpfs`) area. When Frigate starts, it tries to restore the current hour's cached frames, so a **soft restart from the UI** preserves them. But if you recreate the Docker container or stop Frigate forcibly by any other means partway through an hour, the in-memory cache is discarded, so no preview clip is produced for that partial hour.
+
+This is expected behavior, not a bug:
+
+- Previews for hours that already completed and were written to disk are unaffected.
+- The next full hour after a restart will generate previews normally.
+- This is unrelated to `shm_size`; increasing shared memory does not change it.
+
+To avoid the gap, use the **Restart Frigate** button in the UI's Settings menu rather than recreating the container when possible.
+
+</FaqItem>

docs/docs/usage/exports.md

@@ -34,7 +34,7 @@ All of your exports live on the **Exports** page, reachable from the main naviga
 - **Rename** it, and
 - **Delete** it: deleting is the only way an export is removed.
 
-You can also select multiple exports at once to **delete** them in bulk, or to **add them to** (or **remove them from**) a [case](#cases).
+You can also select multiple exports at once to **delete** them in bulk, or to **add them to** (or **remove them from**) a [case](#cases). To download multiple exports as a zip archive, add them to a **case** and use the Download button there.
 
 ## Cases
 

docs/docs/usage/live.md

@@ -40,7 +40,7 @@ Deleting a group also clears any custom layout you saved for it.
 
 ## Rearranging a camera group layout
 
-On desktop and tablet, each camera group has its own freely-arrangeable grid. Enter **Edit Layout** mode from the layout button in the lower-right corner: camera tiles gain a drag handle and corner resize handles. Drag a tile to reposition it and drag a corner to resize it (the aspect ratio is preserved). Exit edit mode to save. The layout is stored in your browser per device, so each device can have its own arrangement.
+On desktop and tablet, each camera group has its own freely-arrangeable grid. Enter **Edit Layout** mode from the layout button in the lower-right corner: camera tiles gain a drag handle and corner resize handles. Drag a tile to reposition it and drag a corner to resize it (the aspect ratio is preserved). Exit edit mode to save. The layout is stored in your browser per device, so each device can have its own arrangement, and layouts can be exported to a file and imported on another device.
 
 The default **All Cameras** dashboard is not manually arrangeable. It automatically sizes tiles based on each camera's aspect ratio (wide cameras span two columns, tall cameras span two rows).
 
@@ -68,7 +68,7 @@ For non-default groups, the context menu also exposes **Streaming Settings** for
 - the **streaming method**: **No Streaming**, **Smart Streaming** (recommended), or **Continuous Streaming** (higher bandwidth), and
 - **compatibility mode**, for devices that have trouble rendering the default player.
 
-These settings are saved per group and per device in your browser, not in your config file.
+These settings are saved per group and per device in your browser, not in your config file, and can be exported to a file and imported on another device.
 
 ## The single-camera view
 

docs/scripts/lib/nav_map.py

@@ -63,8 +63,7 @@ SYSTEM_NAV: dict[str, tuple[str, str]] = {
     "environment_vars": ("System", "Environment variables"),
     "telemetry": ("System", "Telemetry"),
     "birdseye": ("System", "Birdseye"),
-    "detectors": ("System", "Detectors and model"),
-    "model": ("System", "Detectors and model"),
+    "models": ("System", "Detection models"),
 }
 
 # All known top-level config section keys

docs/sidebars.ts

@@ -30,6 +30,7 @@ const sidebars: SidebarsConfig = {
     ],
     Configuration: [
       "configuration/config",
+      "configuration/config_overrides",
       {
         type: "category",
         label: "Detectors",
@@ -165,6 +166,7 @@ const sidebars: SidebarsConfig = {
     ],
     Troubleshooting: [
       "troubleshooting/faqs",
+      "troubleshooting/common_errors",
       "troubleshooting/go2rtc",
       "troubleshooting/recordings",
       "troubleshooting/dummy-camera",

docs/src/components/DockerComposeGenerator/config/config.yaml

@@ -219,6 +219,8 @@ hardware:
       - host: "/run/mxa_manager"
         container: "/run/mxa_manager"
         comment: "MemryX manager"
+    privileged: true
+    privilegedReason: "required by MemryX to reach the max-manager"
 
   - id: "axera"
     label: "AXERA Accelerator"

docs/src/components/DockerComposeGenerator/config/types.ts

@@ -104,6 +104,10 @@ export interface DeviceConfig {
   extraHosts?: string[];
   /** Security options, e.g. ["apparmor=unconfined"] */
   securityOpt?: string[];
+  /** Set only when this device type cannot work without full privileged mode */
+  privileged?: boolean;
+  /** Why privileged mode is required, rendered as an inline comment */
+  privilegedReason?: string;
   /** Whether this device type needs the NVIDIA GPU config UI */
   needsNvidiaConfig?: boolean;
 }
@@ -127,6 +131,10 @@ export interface HardwareOption {
   volumes?: VolumeMapping[];
   /** Extra environment variables */
   env?: Record<string, string>;
+  /** Set only when this hardware cannot work without full privileged mode */
+  privileged?: boolean;
+  /** Why privileged mode is required, rendered as an inline comment */
+  privilegedReason?: string;
 }
 
 /** Port definition */

docs/src/components/DockerComposeGenerator/generator/index.ts

@@ -1,6 +1,7 @@
 import type {
   DeviceConfig,
   DeviceMapping,
+  HardwareOption,
   VolumeMapping,
 } from "../config/types";
 import { hardwareMap } from "../config";
@@ -194,13 +195,32 @@ function buildExtraHosts(device: DeviceConfig): string[] {
 }
 
 function buildSecurityOpt(device: DeviceConfig): string[] {
-  if (!device.securityOpt?.length) return [];
+  // no-new-privileges is the baseline for every setup; device-specific entries
+  // are appended so only one security_opt key is ever emitted
   return [
     "    security_opt:",
-    ...device.securityOpt.map((s) => `      - ${s}`),
+    "      - no-new-privileges:true",
+    ...(device.securityOpt ?? []).map((s) => `      - ${s}`),
   ];
 }
 
+/**
+ * Emit privileged mode only for hardware that genuinely cannot work without it.
+ * Everything else gets device mappings, which grant far less access.
+ */
+function buildPrivileged(
+  device: DeviceConfig,
+  selectedHardware: HardwareOption[]
+): string[] {
+  const requiring = [device, ...selectedHardware].filter((c) => c.privileged);
+  if (!requiring.length) return [];
+  const reasons = requiring
+    .map((c) => c.privilegedReason)
+    .filter((r): r is string => Boolean(r));
+  const comment = reasons.length ? ` # ${reasons.join("; ")}` : "";
+  return [`    privileged: true${comment}`];
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -217,11 +237,14 @@ export function generateDockerCompose(input: GeneratorInput): string {
   const hwVolumes: VolumeMapping[] = [];
   const hwEnv: Record<string, string> = {};
 
+  const selectedHw: HardwareOption[] = [];
+
   for (const hwId of input.selectedHardware) {
     const hw = hardwareMap.get(hwId);
     if (!hw) continue;
     // Skip GPU device mapping for tensorrt images (it uses deploy instead)
     if (hw.id === "gpu" && device.imageTag === "stable-tensorrt") continue;
+    selectedHw.push(hw);
     hwDevices.push(...(hw.devices ?? []));
     hwVolumes.push(...(hw.volumes ?? []));
     Object.assign(hwEnv, hw.env ?? {});
@@ -231,7 +254,7 @@ export function generateDockerCompose(input: GeneratorInput): string {
     "services:",
     "  frigate:",
     "    container_name: frigate",
-    "    privileged: true # This may not be necessary for all setups",
+    ...buildPrivileged(device, selectedHw),
     "    restart: unless-stopped",
     "    stop_grace_period: 30s # Allow enough time to shut down the various services",
     ...buildImage(device),

docs/static/frigate-api.yaml

@@ -693,6 +693,43 @@ paths:
         **Access:** Admin role required.
 
         Set a camera feature state. Use camera_name='*' to target all cameras.
+
+        The value to set is sent in the request body as `{"value": "<value>"}`.
+
+        | Feature | Accepted values |
+        | --- | --- |
+        | `enabled` | `ON`, `OFF` |
+        | `detect` | `ON`, `OFF` |
+        | `motion` | `ON`, `OFF` |
+        | `recordings` | `ON`, `OFF` |
+        | `snapshots` | `ON`, `OFF` |
+        | `audio` | `ON`, `OFF` |
+        | `audio_transcription` | `ON`, `OFF` |
+        | `notifications` | `ON`, `OFF` |
+        | `review_alerts` | `ON`, `OFF` |
+        | `review_detections` | `ON`, `OFF` |
+        | `object_descriptions` | `ON`, `OFF` |
+        | `review_descriptions` | `ON`, `OFF` |
+        | `improve_contrast` | `ON`, `OFF` |
+        | `ptz_autotracker` | `ON`, `OFF` |
+        | `birdseye` | `ON`, `OFF` |
+        | `birdseye_modes` | `CONTINUOUS`, `MOTION`, `ALL_OBJECTS`, `ALERTS`, `DETECTIONS`, `NONE`, or a comma-separated combination |
+        | `motion_contour_area` | integer |
+        | `motion_threshold` | integer |
+        | `motion_mask` | `ON`, `OFF` |
+        | `object_mask` | `ON`, `OFF` |
+        | `zone` | `ON`, `OFF` |
+        | `profile` | a profile name, or `none` to deactivate |
+
+        `motion_mask`, `object_mask`, and `zone` require the `sub_command` path
+        parameter to be set to the name of the mask or zone. All other features
+        reject a sub-command.
+
+        `profile` applies globally rather than per camera, so it requires
+        `camera_name` to be `*`.
+
+        These features map to the equivalent MQTT topics, which document the
+        behavior of each value in more detail.
       operationId: 
         camera_set_camera__camera_name__set__feature___sub_command__put
       parameters:
@@ -746,6 +783,43 @@ paths:
         **Access:** Admin role required.
 
         Set a camera feature state. Use camera_name='*' to target all cameras.
+
+        The value to set is sent in the request body as `{"value": "<value>"}`.
+
+        | Feature | Accepted values |
+        | --- | --- |
+        | `enabled` | `ON`, `OFF` |
+        | `detect` | `ON`, `OFF` |
+        | `motion` | `ON`, `OFF` |
+        | `recordings` | `ON`, `OFF` |
+        | `snapshots` | `ON`, `OFF` |
+        | `audio` | `ON`, `OFF` |
+        | `audio_transcription` | `ON`, `OFF` |
+        | `notifications` | `ON`, `OFF` |
+        | `review_alerts` | `ON`, `OFF` |
+        | `review_detections` | `ON`, `OFF` |
+        | `object_descriptions` | `ON`, `OFF` |
+        | `review_descriptions` | `ON`, `OFF` |
+        | `improve_contrast` | `ON`, `OFF` |
+        | `ptz_autotracker` | `ON`, `OFF` |
+        | `birdseye` | `ON`, `OFF` |
+        | `birdseye_modes` | `CONTINUOUS`, `MOTION`, `ALL_OBJECTS`, `ALERTS`, `DETECTIONS`, `NONE`, or a comma-separated combination |
+        | `motion_contour_area` | integer |
+        | `motion_threshold` | integer |
+        | `motion_mask` | `ON`, `OFF` |
+        | `object_mask` | `ON`, `OFF` |
+        | `zone` | `ON`, `OFF` |
+        | `profile` | a profile name, or `none` to deactivate |
+
+        `motion_mask`, `object_mask`, and `zone` require the `sub_command` path
+        parameter to be set to the name of the mask or zone. All other features
+        reject a sub-command.
+
+        `profile` applies globally rather than per camera, so it requires
+        `camera_name` to be `*`.
+
+        These features map to the equivalent MQTT topics, which document the
+        behavior of each value in more detail.
       operationId: camera_set_camera__camera_name__set__feature__put
       parameters:
         - name: camera_name
@@ -1402,10 +1476,12 @@ paths:
         - Classification
       summary: Get custom classification attributes
       description: |-
-        **Access:** Admin role required.
+        **Access:** Any authenticated user.
 
         Returns custom classification attributes for a given object type.
             Only includes models with classification_type set to 'attribute'.
+            Callers without access to every camera only receive values that have been
+            recorded on the cameras they can access.
             By default returns a flat sorted list of all attribute labels.
             If group_by_model is true, returns attributes grouped by model name.
       operationId: get_custom_attributes_classification_attributes_get
@@ -1436,8 +1512,8 @@ paths:
               schema:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
-        - frigateAdminAuth: []
-      x-required-role: admin
+        - frigateUserAuth: []
+      x-required-role: any
   /classification/{name}/train:
     get:
       tags:
@@ -2234,15 +2310,15 @@ paths:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
         - frigateUserAuth: []
-      x-required-role: any
-      description: '**Access:** Any authenticated user.'
+      x-required-role: camera
+      description: '**Access:** Authenticated user with access to the referenced camera.'
   /review/summarize/start/{start_ts}/end/{end_ts}:
     post:
       tags:
         - Review
       summary: Generate Review Summary
       description: |-
-        **Access:** Admin role required.
+        **Access:** Authenticated user with access to all cameras.
 
         Use GenAI to summarize review items over a period of time.
       operationId: 
@@ -2273,8 +2349,8 @@ paths:
               schema:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
-        - frigateAdminAuth: []
-      x-required-role: admin
+        - frigateUserAuth: []
+      x-required-role: all_cameras
   /:
     get:
       tags:
@@ -2872,6 +2948,44 @@ paths:
         - frigateUserAuth: []
       x-required-role: any
       description: '**Access:** Any authenticated user.'
+  /categorized_object_names:
+    get:
+      tags:
+        - App
+      summary: Get known object names by object type
+      description: |-
+        **Access:** Any authenticated user.
+
+        Returns the sub labels and attributes this install can attach,
+            grouped by object type. Unlike /sub_labels, which reflects what has already been
+            detected, this reads the config and model files, so it covers recognized face
+            names, named license plates, custom object classification categories, and the
+            detector attributes of tracked objects.
+      operationId: categorized_object_names_categorized_object_names_get
+      parameters:
+        - name: object_type
+          in: query
+          required: false
+          schema:
+            anyOf:
+              - type: string
+              - type: 'null'
+            title: Object Type
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema: {}
+        '422':
+          description: Validation Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+      security:
+        - frigateUserAuth: []
+      x-required-role: any
   /audio_labels:
     get:
       tags:
@@ -3898,6 +4012,49 @@ paths:
       security:
         - frigateAdminAuth: []
       x-required-role: admin
+  /hardware/probe:
+    get:
+      tags:
+        - Hardware
+      summary: Probe Hardware
+      description: |-
+        **Access:** Admin role required.
+
+        Get the object detection hardware attached to this system.
+
+        Args:
+            refresh: Probe again instead of returning the cached result
+
+        Returns:
+            Every kind of detection hardware that was found
+      operationId: probe_hardware_hardware_probe_get
+      parameters:
+        - name: refresh
+          in: query
+          required: false
+          schema:
+            type: boolean
+            default: false
+            title: Refresh
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/DetectionHardware'
+                title: Response Probe Hardware Hardware Probe Get
+        '422':
+          description: Validation Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+      security:
+        - frigateAdminAuth: []
+      x-required-role: admin
   /events:
     get:
       tags:
@@ -5019,6 +5176,7 @@ paths:
             NOTES:
             - Creating a manual event does not trigger an update to /events MQTT topic.
             - If a duration is set to null, the event will need to be ended manually by calling /events/{event_id}/end.
+            - The review item is an alert unless the label is listed in the camera's review -> detections -> labels config.
       operationId: create_event_events__camera_name___label__create_post
       parameters:
         - name: camera_name
@@ -5909,6 +6067,65 @@ paths:
       security:
         - frigateUserAuth: []
       x-required-role: camera
+  /vod/{camera_name}/{stream}/start/{start_ts}/end/{end_ts}:
+    get:
+      tags:
+        - Media
+      summary: Vod Ts Stream
+      description: |-
+        **Access:** Authenticated user with access to the referenced camera.
+
+        Returns an HLS playlist pinned to one stream type (main or sub) for the specified timestamp-range on the specified camera. Append /master.m3u8 or /index.m3u8 for HLS playback.
+      operationId: 
+        vod_ts_stream_vod__camera_name___stream__start__start_ts__end__end_ts__get
+      parameters:
+        - name: camera_name
+          in: path
+          required: true
+          schema:
+            anyOf:
+              - type: string
+              - type: 'null'
+            title: Camera Name
+        - name: stream
+          in: path
+          required: true
+          schema:
+            $ref: '#/components/schemas/VodStreamPreference'
+        - name: start_ts
+          in: path
+          required: true
+          schema:
+            type: number
+            title: Start Ts
+        - name: end_ts
+          in: path
+          required: true
+          schema:
+            type: number
+            title: End Ts
+        - name: force_discontinuity
+          in: query
+          required: false
+          schema:
+            type: boolean
+            default: false
+            title: Force Discontinuity
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema: {}
+        '422':
+          description: Validation Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+      security:
+        - frigateUserAuth: []
+      x-required-role: camera
   /events/{event_id}/snapshot.jpg:
     get:
       tags:
@@ -6847,6 +7064,63 @@ paths:
       security:
         - frigateUserAuth: []
       x-required-role: camera
+  /{camera_name}/recordings/coverage:
+    get:
+      tags:
+        - Recordings
+      summary: Recordings Coverage
+      description: |-
+        **Access:** Authenticated user with access to the referenced camera.
+
+        Returns merged recording coverage spans plus codec compatibility.
+
+        codecs_compatible is false only when more than one known video codec
+        appears across the range's rows, the case where the merged vod route
+        degrades to a single-stream manifest.
+      operationId: recordings_coverage__camera_name__recordings_coverage_get
+      parameters:
+        - name: camera_name
+          in: path
+          required: true
+          schema:
+            anyOf:
+              - type: string
+              - type: 'null'
+            title: Camera Name
+        - name: after
+          in: query
+          required: true
+          schema:
+            type: number
+            title: After
+        - name: before
+          in: query
+          required: true
+          schema:
+            type: number
+            title: Before
+        - name: timelines
+          in: query
+          required: false
+          schema:
+            type: boolean
+            default: false
+            title: Timelines
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema: {}
+        '422':
+          description: Validation Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/HTTPValidationError'
+      security:
+        - frigateUserAuth: []
+      x-required-role: camera
   /{camera_name}/recordings:
     get:
       tags:
@@ -7034,7 +7308,9 @@ paths:
               schema:
                 $ref: '#/components/schemas/DebugReplayStartResponse'
         '400':
-          description: Invalid camera, time range, or no recordings
+          description: Invalid camera or time range
+        '404':
+          description: No recordings in the requested time range
         '409':
           description: A replay session is already active
         '422':
@@ -7611,6 +7887,46 @@ components:
       required:
         - ids
       title: DeleteFaceImagesBody
+    DetectionHardware:
+      properties:
+        key:
+          type: string
+          title: Hardware key
+          description: Stable identifier for this kind of hardware.
+        detector:
+          type: string
+          title: Detector type
+          description: The detector that drives this hardware.
+        name:
+          type: string
+          title: Hardware name
+          description: Human readable name for this kind of hardware.
+        units:
+          items:
+            $ref: '#/components/schemas/HardwareUnit'
+          type: array
+          title: Units
+          description: Each physical piece of this hardware that was found.
+        count:
+          type: integer
+          title: Unit count
+          description: How many units were found.
+        unlimited:
+          type: boolean
+          title: Unlimited detectors
+          description: Whether this hardware can run more inference processes 
+            than there are units.
+      type: object
+      required:
+        - key
+        - detector
+        - name
+        - units
+        - count
+        - unlimited
+      title: DetectionHardware
+      description: A kind of detection hardware, and every unit of it that was 
+        found.
     EventCreateResponse:
       properties:
         success:
@@ -8244,6 +8560,11 @@ components:
       properties:
         provider:
           $ref: '#/components/schemas/GenAIProviderEnum'
+        name:
+          anyOf:
+            - type: string
+            - type: 'null'
+          title: Name
         api_key:
           anyOf:
             - type: string
@@ -8333,6 +8654,24 @@ components:
           title: Detail
       type: object
       title: HTTPValidationError
+    HardwareUnit:
+      properties:
+        device:
+          type: string
+          title: Device string
+          description: The value to put in a model's devices list, for example 
+            'edgetpu:pci:1'.
+        label:
+          type: string
+          title: Unit label
+          description: How to identify this unit among others of the same kind, 
+            for example 'PCIe 1'.
+      type: object
+      required:
+        - device
+        - label
+      title: HardwareUnit
+      description: One physical piece of hardware.
     Last24HoursReview:
       properties:
         reviewed_alert:
@@ -8823,6 +9162,17 @@ components:
         - msg
         - type
       title: ValidationError
+    VodStreamPreference:
+      type: string
+      enum:
+        - main
+        - sub
+      title: VodStreamPreference
+      description: |-
+        Stream pin for the path-segment VOD route.
+
+        nginx-vod derives its mapping fetch URI from the playlist URL path
+        (query params are dropped), so the preference must be a path segment.
   securitySchemes:
     frigateAdminAuth:
       type: apiKey

frigate/api/app.py

@@ -31,6 +31,10 @@ from frigate.api.auth import (
     get_allowed_cameras_for_filter,
     require_role,
 )
+from frigate.api.config_util import (
+    publish_camera_section_updates,
+    swap_runtime_config,
+)
 from frigate.api.defs.query.app_query_parameters import AppTimelineHourlyQueryParameters
 from frigate.api.defs.request.app_body import (
     AppConfigSetBody,
@@ -67,6 +71,7 @@ from frigate.util.config import (
     find_config_file,
     redact_credential,
 )
+from frigate.util.object_names import get_categorized_object_names
 from frigate.util.schema import get_config_schema
 from frigate.util.services import (
     get_nvidia_driver_info,
@@ -195,7 +200,7 @@ def genai_models(request: Request):
         "before saving the configuration."
     ),
 )
-async def genai_probe(body: GenAIProbeBody):
+async def genai_probe(request: Request, body: GenAIProbeBody):
     load_providers()
 
     provider_cls = PROVIDERS.get(body.provider)
@@ -205,6 +210,13 @@ async def genai_probe(body: GenAIProbeBody):
             content={"success": False, "message": "Unknown provider"},
         )
 
+    api_key = body.api_key
+    if api_key == REDACTED_CREDENTIAL_SENTINEL:
+        saved_cfg = (
+            request.app.frigate_config.genai.get(body.name) if body.name else None
+        )
+        api_key = saved_cfg.api_key if saved_cfg else None
+
     # The OpenAI-compatible SDKs accept "timeout" as a constructor kwarg via
     # provider_options; other plugins use GenAIClient.timeout passed below.
     # Don't inject timeout for Gemini — its HttpOptions interprets the value
@@ -216,7 +228,7 @@ async def genai_probe(body: GenAIProbeBody):
     try:
         transient_cfg = GenAIConfig(
             provider=body.provider,
-            api_key=body.api_key,
+            api_key=api_key,
             base_url=body.base_url,
             provider_options=probe_provider_options,
             # model is required by the schema but irrelevant for listing.
@@ -280,10 +292,6 @@ def config(request: Request):
     config: dict[str, dict[str, Any]] = config_obj.model_dump(
         mode="json", warnings="none", exclude_none=True
     )
-    config["detectors"] = {
-        name: detector.model_dump(mode="json", warnings="none", exclude_none=True)
-        for name, detector in config_obj.detectors.items()
-    }
 
     # remove environment_vars for non-admin users
     if request.headers.get("remote-role") != "admin":
@@ -364,31 +372,28 @@ def config(request: Request):
         config["go2rtc"]["streams"][stream_name] = cleaned
 
     config["plus"] = {"enabled": request.app.frigate_config.plus_api.is_active()}
-    config["model"]["colormap"] = config_obj.model.colormap
-    config["model"]["all_attributes"] = config_obj.model.all_attributes
-    config["model"]["non_logo_attributes"] = config_obj.model.non_logo_attributes
 
-    # Add model plus data if plus is enabled
-    if config["plus"]["enabled"]:
-        model_path = config.get("model", {}).get("path")
-        if model_path:
-            model_json_path = FilePath(model_path).with_suffix(".json")
+    for index, model in enumerate(config_obj.models):
+        model_dict = config["models"][index]
+        model_dict["colormap"] = model.colormap
+        model_dict["all_attributes"] = model.all_attributes
+        model_dict["non_logo_attributes"] = model.non_logo_attributes
+        model_dict["labelmap"] = model.merged_labelmap
+
+        if not config["plus"]["enabled"]:
+            continue
+
+        # Add model plus data if plus is enabled
+        model_dict["plus"] = None
+
+        if model.path:
+            model_json_path = FilePath(model.path).with_suffix(".json")
+
             try:
                 with open(model_json_path) as f:
-                    model_plus_data = json.load(f)
-                config["model"]["plus"] = model_plus_data
-            except FileNotFoundError:
-                config["model"]["plus"] = None
-            except json.JSONDecodeError:
-                config["model"]["plus"] = None
-        else:
-            config["model"]["plus"] = None
-
-    # use merged labelamp
-    for detector_config in config["detectors"].values():
-        detector_config["model"]["labelmap"] = (
-            request.app.frigate_config.model.merged_labelmap
-        )
+                    model_dict["plus"] = json.load(f)
+            except (FileNotFoundError, json.JSONDecodeError):
+                pass
 
     return JSONResponse(content=config)
 
@@ -915,19 +920,7 @@ def config_set(request: Request, body: AppConfigSetBody):
 
             if body.requires_restart == 0 or body.update_topic:
                 old_config: FrigateConfig = request.app.frigate_config
-                request.app.frigate_config = config
-                request.app.genai_manager.update_config(config)
-
-                if request.app.profile_manager is not None:
-                    request.app.profile_manager.update_config(config)
-
-                if request.app.stats_emitter is not None:
-                    request.app.stats_emitter.config = config
-
-                if request.app.dispatcher is not None:
-                    request.app.dispatcher.config = config
-                    for comm in request.app.dispatcher.comms:
-                        comm.config = config
+                swap_runtime_config(request.app, config)
 
                 if body.update_topic:
                     if body.update_topic.startswith("config/cameras/"):
@@ -967,11 +960,26 @@ def config_set(request: Request, body: AppConfigSetBody):
                             body.update_topic, settings
                         )
 
+                        # a config/cameras/* topic publishes camera copies, a
+                        # global topic the global object. FrigateConfig.parse
+                        # folds some global sections down into every camera,
+                        # and workers read both objects, so any such section
+                        # needs its camera copies sent alongside the global
+                        # publish above.
+                        if body.update_topic == "config/birdseye":
+                            publish_camera_section_updates(
+                                request.app, config, CameraConfigUpdateEnum.birdseye
+                            )
+
             return JSONResponse(
                 content=(
                     {
                         "success": True,
-                        "message": "Config successfully updated, restart to apply",
+                        "message": (
+                            "Config successfully updated"
+                            if body.requires_restart == 0
+                            else "Config successfully updated, restart to apply"
+                        ),
                     }
                 ),
                 status_code=200,
@@ -1299,9 +1307,41 @@ def get_sub_labels(
     return JSONResponse(content=sub_labels)
 
 
+@router.get(
+    "/categorized_object_names",
+    dependencies=[Depends(allow_any_authenticated())],
+    summary="Get known object names by object type",
+    description="""Returns the sub labels and attributes this install can attach,
+    grouped by object type. Unlike /sub_labels, which reflects what has already been
+    detected, this reads the config and model files, so it covers recognized face
+    names, named license plates, custom object classification categories, and the
+    detector attributes of tracked objects.""",
+)
+def categorized_object_names(
+    request: Request,
+    object_type: str | None = None,
+    allowed_cameras: list[str] = Depends(get_allowed_cameras_for_filter),
+):
+    return JSONResponse(
+        content=get_categorized_object_names(
+            request.app.frigate_config, allowed_cameras, object_type
+        )
+    )
+
+
 @router.get("/audio_labels", dependencies=[Depends(allow_any_authenticated())])
-def get_audio_labels():
+def get_audio_labels(request: Request):
     labels = load_labels("/audio-labelmap.txt", prefill=521)
+
+    # configured overrides group several audio classes under one label, and the
+    # detector merges them over the defaults at runtime. Offer them here too, or
+    # a grouped label could never be picked in the UI.
+    config: FrigateConfig = request.app.frigate_config
+    labels.update(config.audio.labelmap)
+
+    for camera in config.cameras.values():
+        labels.update(camera.audio.labelmap)
+
     return JSONResponse(content=labels)
 
 
@@ -1323,11 +1363,14 @@ def plusModels(request: Request, filterByCurrentModelDetector: bool = False):
 
     modelList = models["list"]
 
+    config: FrigateConfig = request.app.frigate_config
+    primary_model = config.primary_model
+
     # current model type
-    modelType = request.app.frigate_config.model.model_type
+    modelType = primary_model.model_type
 
     # current detectorType for comparing to supportedDetectors
-    detectorType = list(request.app.frigate_config.detectors.values())[0].type
+    detectorType = config.devices_for_model(primary_model)[0].detector
 
     validModels = []
 

frigate/api/auth.py

@@ -31,7 +31,7 @@ from frigate.api.media_auth import (
     deny_response_for_media_uri,
     is_role_restricted,
 )
-from frigate.config import AuthConfig, NetworkingConfig, ProxyConfig
+from frigate.config import AuthConfig, ProxyConfig
 from frigate.const import CONFIG_DIR, JWT_SECRET_ENV_VAR, PASSWORD_HASH_ALGORITHM
 from frigate.models import User
 
@@ -83,8 +83,10 @@ def require_admin_by_default():
         "/nvinfo",
         "/labels",
         "/sub_labels",
+        "/categorized_object_names",
         "/plus/models",
         "/recognized_license_plates",
+        "/classification/attributes",
         "/timeline",
         "/timeline/hourly",
         "/recordings/storage",
@@ -620,18 +622,18 @@ def resolve_role(
 def auth(request: Request):
     auth_config: AuthConfig = request.app.frigate_config.auth
     proxy_config: ProxyConfig = request.app.frigate_config.proxy
-    networking_config: NetworkingConfig = request.app.frigate_config.networking
 
     success_response = Response("", status_code=202)
 
-    # handle case where internal port is a string with ip:port
-    internal_port = networking_config.listen.internal
-    if type(internal_port) is str:
-        internal_port = int(internal_port.split(":")[-1])
-
     # dont require auth if the request is on the internal port
-    # this header is set by Frigate's nginx proxy, so it cant be spoofed
-    if int(request.headers.get("x-server-port", default=0)) == internal_port:
+    # this header is set by Frigate's nginx proxy, so it cant be spoofed.
+    # the port is the boot-time snapshot rather than the live config value:
+    # nginx's listeners are fixed at container start, so an in-memory config
+    # change must never move the port that is trusted here
+    if (
+        int(request.headers.get("x-server-port", default=0))
+        == request.app.auth_internal_port
+    ):
         success_response.headers["remote-user"] = "anonymous"
         success_response.headers["remote-role"] = "admin"
         return success_response
@@ -857,9 +859,12 @@ def login(request: Request, body: AppPostLoginBody):
     user = body.user
     password = body.password
 
+    remote_addr = get_remote_addr(request)
+
     try:
         db_user: User = User.get_by_id(user)
     except DoesNotExist:
+        logger.warning(f"Login failed for unknown user '{user}' from {remote_addr}")
         return JSONResponse(content={"message": "Login failed"}, status_code=401)
 
     password_hash = db_user.password_hash
@@ -887,6 +892,10 @@ def login(request: Request, body: AppPostLoginBody):
             request.app.frigate_config.auth.admin_first_time_login = False
 
         return response
+
+    logger.warning(
+        f"Login failed for user '{user}' (invalid password) from {remote_addr}"
+    )
     return JSONResponse(content={"message": "Login failed"}, status_code=401)
 
 
@@ -971,6 +980,7 @@ def delete_user(request: Request, username: str):
     summary="Update user password",
     description="Updates a user's password. Users can only change their own password unless they have admin role. Requires the current password to verify identity for non-admin users. Password must be at least 12 characters long. If user changes their own password, a new JWT cookie is automatically issued.",
 )
+@limiter.limit(limit_value=rateLimiter.get_limit)
 async def update_password(
     request: Request,
     username: str,
@@ -984,10 +994,11 @@ async def update_password(
     current_username = current_user.get("username")
     current_role = current_user.get("role")
 
-    # viewers can only change their own password
-    if current_role == "viewer" and current_username != username:
+    # Only admins may target another account. This has to cover every non-admin
+    # role rather than just viewer, since custom roles are arbitrary names
+    if current_role != "admin" and current_username != username:
         raise HTTPException(
-            status_code=403, detail="Viewers can only update their own password"
+            status_code=403, detail="Users can only update their own password"
         )
 
     HASH_ITERATIONS = request.app.frigate_config.auth.hash_iterations
@@ -1251,3 +1262,23 @@ async def get_allowed_cameras_for_filter(request: Request):
     all_camera_names = set(request.app.frigate_config.cameras.keys())
     roles_dict = request.app.frigate_config.auth.roles
     return User.get_allowed_cameras(role, roles_dict, all_camera_names)
+
+
+async def require_full_camera_access(
+    request: Request,
+    allowed_cameras: list[str] = Depends(get_allowed_cameras_for_filter),
+):
+    """Dependency for endpoints returning data that spans every camera.
+
+    Some responses cannot be meaningfully scoped to a subset of cameras, so
+    rather than filter them the endpoint is limited to callers who can already
+    see every camera. Admin and viewer always qualify; a custom role qualifies
+    only when its camera list covers all configured cameras.
+    """
+    all_camera_names = set(request.app.frigate_config.cameras.keys())
+
+    if not all_camera_names.issubset(allowed_cameras):
+        raise HTTPException(
+            status_code=403,
+            detail="Access to all cameras is required for this endpoint",
+        )

frigate/api/camera.py

@@ -25,6 +25,7 @@ from frigate.api.auth import (
     require_go2rtc_stream_access,
     require_role,
 )
+from frigate.api.config_util import swap_runtime_config
 from frigate.api.defs.request.app_body import CameraSetBody
 from frigate.api.defs.tags import Tags
 from frigate.config import FrigateConfig
@@ -32,7 +33,7 @@ from frigate.config.camera.updater import (
     CameraConfigUpdateEnum,
     CameraConfigUpdateTopic,
 )
-from frigate.config.env import substitute_frigate_vars
+from frigate.config.env import UnknownVariableError, substitute_frigate_vars
 from frigate.models import User
 from frigate.util.builtin import clean_camera_user_pass, get_record_segment_time
 from frigate.util.camera_cleanup import cleanup_camera_db, cleanup_camera_files
@@ -165,7 +166,7 @@ def go2rtc_add_stream(request: Request, stream_name: str, src: str = ""):
         if src:
             try:
                 resolved_src = substitute_frigate_vars(src)
-            except KeyError:
+            except UnknownVariableError:
                 resolved_src = src
 
             if is_restricted_go2rtc_source(resolved_src):
@@ -650,6 +651,32 @@ async def _connect_onvif_camera(
     raise first_error
 
 
+def _supports_continuous_pan_tilt(nodes) -> bool:
+    """Whether any PTZ node advertises continuous pan/tilt velocity.
+
+    The web UI's directional controls issue ContinuousMove with a PanTilt
+    velocity, so continuous pan/tilt is what makes those controls usable. This
+    is intentionally narrower than ptz_supported, which is true for any device
+    exposing the ONVIF PTZ service - including zoom/focus-only varifocal lenses.
+    """
+    for node in nodes or []:
+        spaces = getattr(node, "SupportedPTZSpaces", None) or (
+            node.get("SupportedPTZSpaces") if isinstance(node, dict) else None
+        )
+        if spaces is None:
+            continue
+
+        continuous = getattr(spaces, "ContinuousPanTiltVelocitySpace", None) or (
+            spaces.get("ContinuousPanTiltVelocitySpace")
+            if isinstance(spaces, dict)
+            else None
+        )
+        if continuous:
+            return True
+
+    return False
+
+
 @router.get(
     "/onvif/probe",
     dependencies=[Depends(require_role(["admin"]))],
@@ -807,6 +834,7 @@ async def onvif_probe(
 
         # Check PTZ support and capabilities
         ptz_supported = False
+        pan_tilt_supported = False
         presets_count = 0
         autotrack_supported = False
 
@@ -840,6 +868,15 @@ async def onvif_probe(
                     logger.debug(f"Failed to get presets: {e}")
                     presets_count = 0
 
+            # Check for real (continuous) pan/tilt, which the UI controls need
+            if ptz_supported:
+                try:
+                    nodes = await ptz_service.GetNodes()
+                    pan_tilt_supported = _supports_continuous_pan_tilt(nodes)
+                    logger.debug(f"Continuous pan/tilt supported: {pan_tilt_supported}")
+                except Exception as e:
+                    logger.debug(f"Failed to read PTZ nodes for pan/tilt support: {e}")
+
             # Check for autotracking support - requires both FOV relative movement and MoveStatus
             if ptz_supported and first_profile_token and ptz_config_token:
                 # First check for FOV relative movement support
@@ -959,6 +996,7 @@ async def onvif_probe(
             "firmware_version": device_info["firmware_version"],
             "profiles_count": profiles_count,
             "ptz_supported": ptz_supported,
+            "pan_tilt_supported": pan_tilt_supported,
             "presets_count": presets_count,
             "autotrack_supported": autotrack_supported,
         }
@@ -1254,9 +1292,14 @@ async def delete_camera(
                     status_code=500,
                 )
 
-            # Update runtime config
-            request.app.frigate_config = config
-            request.app.genai_manager.update_config(config)
+            # rebind every collaborator to the new config and re-layer runtime
+            # toggles for the surviving cameras, same as /api/config/set
+            swap_runtime_config(request.app, config)
+
+            # drop the deleted camera's persisted overrides so a camera later
+            # added under the same name doesn't inherit them
+            if request.app.dispatcher is not None:
+                request.app.dispatcher.clear_runtime_state_for_camera(camera_name)
 
             # Publish removal to stop ffmpeg processes and clean up runtime state
             request.app.config_publisher.publish_update(
@@ -1322,7 +1365,45 @@ def camera_set(
     body: CameraSetBody,
     sub_command: str | None = None,
 ):
-    """Set a camera feature state. Use camera_name='*' to target all cameras."""
+    """Set a camera feature state. Use camera_name='*' to target all cameras.
+
+    The value to set is sent in the request body as `{"value": "<value>"}`.
+
+    | Feature | Accepted values |
+    | --- | --- |
+    | `enabled` | `ON`, `OFF` |
+    | `detect` | `ON`, `OFF` |
+    | `motion` | `ON`, `OFF` |
+    | `recordings` | `ON`, `OFF` |
+    | `snapshots` | `ON`, `OFF` |
+    | `audio` | `ON`, `OFF` |
+    | `audio_transcription` | `ON`, `OFF` |
+    | `notifications` | `ON`, `OFF` |
+    | `review_alerts` | `ON`, `OFF` |
+    | `review_detections` | `ON`, `OFF` |
+    | `object_descriptions` | `ON`, `OFF` |
+    | `review_descriptions` | `ON`, `OFF` |
+    | `improve_contrast` | `ON`, `OFF` |
+    | `ptz_autotracker` | `ON`, `OFF` |
+    | `birdseye` | `ON`, `OFF` |
+    | `birdseye_modes` | `CONTINUOUS`, `MOTION`, `ALL_OBJECTS`, `ALERTS`, `DETECTIONS`, `NONE`, or a comma-separated combination |
+    | `motion_contour_area` | integer |
+    | `motion_threshold` | integer |
+    | `motion_mask` | `ON`, `OFF` |
+    | `object_mask` | `ON`, `OFF` |
+    | `zone` | `ON`, `OFF` |
+    | `profile` | a profile name, or `none` to deactivate |
+
+    `motion_mask`, `object_mask`, and `zone` require the `sub_command` path
+    parameter to be set to the name of the mask or zone. All other features
+    reject a sub-command.
+
+    `profile` applies globally rather than per camera, so it requires
+    `camera_name` to be `*`.
+
+    These features map to the equivalent MQTT topics, which document the
+    behavior of each value in more detail.
+    """
     dispatcher = request.app.dispatcher
     frigate_config: FrigateConfig = request.app.frigate_config
 

frigate/api/chat.py

@@ -7,7 +7,7 @@ import operator
 import time
 from datetime import datetime
 from functools import reduce
-from typing import Any
+from typing import Any, Literal
 
 import cv2
 from fastapi import APIRouter, Body, Depends, HTTPException, Request
@@ -37,6 +37,7 @@ from frigate.api.defs.response.chat_response import (
 from frigate.api.defs.tags import Tags
 from frigate.api.event import _build_attribute_filter_clause, events
 from frigate.config import FrigateConfig
+from frigate.config.classification import SemanticSearchModelEnum
 from frigate.genai.prompts import (
     build_chat_system_prompt,
     get_attribute_classifications,
@@ -49,6 +50,7 @@ from frigate.jobs.vlm_watch import (
     stop_vlm_watch_job,
 )
 from frigate.models import Event
+from frigate.util.object_names import get_categorized_object_names
 
 logger = logging.getLogger(__name__)
 
@@ -86,10 +88,23 @@ def get_tools(request: Request) -> JSONResponse:
     tools = get_tool_definitions(
         semantic_search_enabled=semantic_search_enabled,
         attribute_classifications=attribute_classifications,
+        embeddings_language=_embeddings_language(config),
     )
     return JSONResponse(content={"tools": tools})
 
 
+def _embeddings_language(config: FrigateConfig) -> Literal["english", "multi"]:
+    """Return the language capability of the configured embeddings model.
+
+    JinaV1 is English-only; every other option (JinaV2 or a GenAI embeddings
+    provider) handles multiple languages.
+    """
+    if config.semantic_search.model == SemanticSearchModelEnum.jinav1:
+        return "english"
+
+    return "multi"
+
+
 def _resolve_zones(
     zones: list[str],
     config: FrigateConfig,
@@ -98,11 +113,14 @@ def _resolve_zones(
     """Map zone names to their canonical config keys, case-insensitively.
 
     LLMs frequently echo a user's casing ("Front Yard") instead of the
-    configured key ("front_yard"). The downstream zone filter is a SQLite GLOB
-    over the JSON-encoded zones column, which is case-sensitive — so an
-    unnormalized name silently returns zero matches. Build a lookup over the
-    relevant cameras' configured zones and substitute when we find a match;
-    unknown names pass through so behavior matches what the model asked for.
+    configured key ("front_yard"), or fall back to a zone's friendly name
+    ("Front Walkway") instead of its ID ("front_walk"). The downstream zone
+    filter is a SQLite GLOB over the JSON-encoded zones column, which stores
+    config keys and is case-sensitive — so an unnormalized name silently
+    returns zero matches. Build a lookup over the relevant cameras' configured
+    zones, keyed by both the config key and the friendly name, and substitute
+    when we find a match; unknown names pass through so behavior matches what
+    the model asked for.
     """
     if not zones:
         return zones
@@ -112,8 +130,11 @@ def _resolve_zones(
         camera_config = config.cameras.get(camera_id)
         if camera_config is None:
             continue
-        for zone_name in camera_config.zones.keys():
+        for zone_name, zone_config in camera_config.zones.items():
             lookup.setdefault(zone_name.lower(), zone_name)
+            lookup.setdefault(
+                zone_config.get_formatted_name(zone_name).lower(), zone_name
+            )
 
     return [lookup.get(z.lower(), z) for z in zones]
 
@@ -519,6 +540,11 @@ async def execute_tool(
     if tool_name == "search_objects":
         return await _execute_search_objects(request, arguments, allowed_cameras)
 
+    if tool_name == "get_categorized_object_names":
+        return JSONResponse(
+            content=_execute_get_categorized_object_names(request, allowed_cameras)
+        )
+
     if tool_name == "find_similar_objects":
         result = await _execute_find_similar_objects(
             request, arguments, allowed_cameras
@@ -571,7 +597,7 @@ async def _execute_get_live_context(
 
     try:
         frame_processor = request.app.detected_frames_processor
-        camera_state = frame_processor.camera_states.get(camera)
+        camera_state = frame_processor.get_camera_state(camera)
 
         if camera_state is None:
             return {
@@ -635,7 +661,7 @@ async def _get_live_frame_image_url(
         return None
     try:
         frame_processor = request.app.detected_frames_processor
-        if camera not in frame_processor.camera_states:
+        if frame_processor.get_camera_state(camera) is None:
             return None
         frame = frame_processor.get_current_frame(camera, {})
         if frame is None:
@@ -697,6 +723,21 @@ async def _execute_set_camera_state(
     return {"success": True, "camera": camera, "feature": feature, "value": value}
 
 
+def _execute_get_categorized_object_names(
+    request: Request,
+    allowed_cameras: list[str],
+) -> dict[str, Any]:
+    names = get_categorized_object_names(request.app.frigate_config, allowed_cameras)
+
+    if not names:
+        return {
+            "names": {},
+            "message": "No names configured; search by label or semantic_query.",
+        }
+
+    return {"names": names}
+
+
 async def _execute_tool_internal(
     tool_name: str,
     arguments: dict[str, Any],
@@ -721,6 +762,8 @@ async def _execute_tool_internal(
         except (json.JSONDecodeError, AttributeError) as e:
             logger.warning(f"Failed to extract tool result: {e}")
             return {"error": "Failed to parse tool result"}
+    elif tool_name == "get_categorized_object_names":
+        return _execute_get_categorized_object_names(request, allowed_cameras)
     elif tool_name == "find_similar_objects":
         return await _execute_find_similar_objects(request, arguments, allowed_cameras)
     elif tool_name == "set_camera_state":
@@ -753,8 +796,8 @@ async def _execute_tool_internal(
     else:
         logger.error(
             "Tool call failed: unknown tool %r. Expected one of: search_objects, find_similar_objects, "
-            "get_live_context, start_camera_watch, stop_camera_watch, get_profile_status, get_recap. "
-            "Arguments received: %s",
+            "get_categorized_object_names, get_live_context, start_camera_watch, stop_camera_watch, "
+            "get_profile_status, get_recap. Arguments received: %s",
             tool_name,
             json.dumps(arguments),
         )
@@ -1134,6 +1177,7 @@ async def chat_completion(
     tools = get_tool_definitions(
         semantic_search_enabled=semantic_search_enabled,
         attribute_classifications=attribute_classifications,
+        embeddings_language=_embeddings_language(config),
     )
     conversation = []
 

frigate/api/classification.py

@@ -11,11 +11,14 @@ from typing import Any
 import cv2
 from fastapi import APIRouter, Depends, Request, UploadFile
 from fastapi.responses import JSONResponse
-from pathvalidate import sanitize_filename
-from peewee import DoesNotExist
+from peewee import DoesNotExist, fn
 from playhouse.shortcuts import model_to_dict
 
-from frigate.api.auth import require_role
+from frigate.api.auth import (
+    allow_any_authenticated,
+    get_allowed_cameras_for_filter,
+    require_role,
+)
 from frigate.api.defs.request.classification_body import (
     AudioTranscriptionBody,
     DeleteFaceImagesBody,
@@ -43,12 +46,21 @@ from frigate.util.classification import (
     write_training_metadata,
 )
 from frigate.util.file import get_event_snapshot
+from frigate.util.path import safe_join, sanitize_path_component
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(tags=[Tags.classification])
 
 
+def invalid_name_response(value: str) -> JSONResponse:
+    """Response for a name that cannot be used as a path component."""
+    return JSONResponse(
+        content={"success": False, "message": f"Invalid name: {value}"},
+        status_code=400,
+    )
+
+
 @router.get(
     "/faces",
     response_model=FacesResponse,
@@ -98,9 +110,7 @@ def reclassify_face(request: Request, body: dict = None):
         )
 
     json: dict[str, Any] = body or {}
-    training_file = os.path.join(
-        FACE_DIR, f"train/{sanitize_filename(json.get('training_file', ''))}"
-    )
+    training_file = safe_join(FACE_DIR, "train", json.get("training_file", ""))
 
     if not training_file or not os.path.isfile(training_file):
         return JSONResponse(
@@ -150,8 +160,10 @@ def train_face(request: Request, name: str, body: dict = None):
         )
 
     json: dict[str, Any] = body or {}
-    training_file_name = sanitize_filename(json.get("training_file", ""))
-    training_file = os.path.join(FACE_DIR, f"train/{training_file_name}")
+    training_file_name = json.get("training_file", "")
+    training_file = (
+        safe_join(FACE_DIR, "train", training_file_name) if training_file_name else None
+    )
     event_id = json.get("event_id")
 
     if not training_file_name and not event_id:
@@ -165,7 +177,9 @@ def train_face(request: Request, name: str, body: dict = None):
             status_code=400,
         )
 
-    if training_file_name and not os.path.isfile(training_file):
+    if training_file_name and (
+        training_file is None or not os.path.isfile(training_file)
+    ):
         return JSONResponse(
             content=(
                 {
@@ -176,9 +190,13 @@ def train_face(request: Request, name: str, body: dict = None):
             status_code=404,
         )
 
-    sanitized_name = sanitize_filename(name)
+    sanitized_name = sanitize_path_component(name)
+    new_file_folder = safe_join(FACE_DIR, name)
+
+    if sanitized_name is None or new_file_folder is None:
+        return invalid_name_response(name)
+
     new_name = f"{sanitized_name}-{datetime.datetime.now().timestamp()}.webp"
-    new_file_folder = os.path.join(FACE_DIR, f"{sanitized_name}")
 
     os.makedirs(new_file_folder, exist_ok=True)
 
@@ -261,9 +279,12 @@ async def create_face(request: Request, name: str):
             content={"message": "Face recognition is not enabled.", "success": False},
         )
 
-    os.makedirs(
-        os.path.join(FACE_DIR, sanitize_filename(name.replace(" ", "_"))), exist_ok=True
-    )
+    face_folder = safe_join(FACE_DIR, name.replace(" ", "_"))
+
+    if face_folder is None:
+        return invalid_name_response(name)
+
+    os.makedirs(face_folder, exist_ok=True)
     return JSONResponse(
         status_code=200,
         content={"success": False, "message": "Successfully created face folder."},
@@ -287,6 +308,9 @@ def register_face(request: Request, name: str, file: UploadFile):
             content={"message": "Face recognition is not enabled.", "success": False},
         )
 
+    if sanitize_path_component(name) is None:
+        return invalid_name_response(name)
+
     context: EmbeddingsContext = request.app.embeddings
     result = None if context is None else context.register_face(name, file.file.read())
 
@@ -356,8 +380,8 @@ def reclassify_face_image(request: Request, name: str, body: dict = None):
         )
 
     json: dict[str, Any] = body or {}
-    image_id = sanitize_filename(json.get("id", ""))
-    new_name = sanitize_filename(json.get("new_name", ""))
+    image_id = sanitize_path_component(json.get("id", ""))
+    new_name = sanitize_path_component(json.get("new_name", ""))
 
     if not image_id or not new_name:
         return JSONResponse(
@@ -381,7 +405,12 @@ def reclassify_face_image(request: Request, name: str, body: dict = None):
             status_code=400,
         )
 
-    source_folder = os.path.join(FACE_DIR, sanitize_filename(name))
+    source_folder = safe_join(FACE_DIR, name)
+    target_folder = safe_join(FACE_DIR, new_name)
+
+    if source_folder is None or target_folder is None:
+        return invalid_name_response(name)
+
     source_file = os.path.join(source_folder, image_id)
 
     if not os.path.isfile(source_file):
@@ -396,7 +425,6 @@ def reclassify_face_image(request: Request, name: str, body: dict = None):
         )
 
     target_filename = f"{new_name}-{datetime.datetime.now().timestamp()}.webp"
-    target_folder = os.path.join(FACE_DIR, new_name)
 
     os.makedirs(target_folder, exist_ok=True)
     shutil.move(source_file, os.path.join(target_folder, target_filename))
@@ -430,8 +458,19 @@ def deregister_faces(request: Request, name: str, body: DeleteFaceImagesBody):
             content={"message": "Face recognition is not enabled.", "success": False},
         )
 
+    sanitized_name = sanitize_path_component(name)
+
+    if sanitized_name is None:
+        return invalid_name_response(name)
+
+    sanitized_ids = [
+        component
+        for component in map(sanitize_path_component, body.ids)
+        if component is not None
+    ]
+
     context: EmbeddingsContext = request.app.embeddings
-    context.delete_face_ids(name, map(lambda file: sanitize_filename(file), body.ids))
+    context.delete_face_ids(sanitized_name, sanitized_ids)
     return JSONResponse(
         content=({"success": True, "message": "Successfully deleted faces."}),
         status_code=200,
@@ -642,7 +681,11 @@ def transcribe_audio(request: Request, body: AudioTranscriptionBody):
 def get_classification_dataset(name: str):
     dataset_dict: dict[str, list[str]] = {}
 
-    dataset_dir = os.path.join(CLIPS_DIR, sanitize_filename(name), "dataset")
+    sanitized_name = sanitize_path_component(name)
+    dataset_dir = safe_join(CLIPS_DIR, name, "dataset")
+
+    if sanitized_name is None or dataset_dir is None:
+        return invalid_name_response(name)
 
     if not os.path.exists(dataset_dir):
         return JSONResponse(
@@ -664,8 +707,8 @@ def get_classification_dataset(name: str):
             dataset_dict[category_name].append(file)
 
     # Get training metadata
-    metadata = read_training_metadata(sanitize_filename(name))
-    current_image_count = get_dataset_image_count(sanitize_filename(name))
+    metadata = read_training_metadata(sanitized_name)
+    current_image_count = get_dataset_image_count(sanitized_name)
 
     if metadata is None:
         training_metadata = {
@@ -700,18 +743,81 @@ def get_classification_dataset(name: str):
     )
 
 
+def get_observed_attributes(
+    model_attributes: dict[str, list[str]],
+    object_labels: set[str],
+    allowed_cameras: list[str],
+) -> dict[str, set[str]]:
+    """Get the attribute values recorded on the given cameras.
+
+    Args:
+        model_attributes: Labels each attribute model can emit, keyed by model name
+        object_labels: Object types those models run on
+        allowed_cameras: Cameras the caller has access to
+
+    Returns:
+        Values seen for each model, keyed by model name
+    """
+    if not model_attributes or not object_labels or not allowed_cameras:
+        return {}
+
+    model_names = list(model_attributes.keys())
+
+    query = (
+        Event.select(
+            *[
+                fn.json_extract(Event.data, f'$."{model_name}"')
+                for model_name in model_names
+            ]
+        )
+        .where(
+            (Event.camera << allowed_cameras) & (Event.label << sorted(object_labels))
+        )
+        .distinct()
+        .tuples()
+    )
+
+    targets = {
+        model_name: set(attributes)
+        for model_name, attributes in model_attributes.items()
+    }
+    observed: dict[str, set[str]] = {model_name: set() for model_name in model_names}
+
+    for row in query.iterator():
+        found = False
+
+        for model_name, value in zip(model_names, row):
+            if isinstance(value, str) and value not in observed[model_name]:
+                observed[model_name].add(value)
+                found = True
+
+        if found and all(
+            observed[model_name] >= targets[model_name] for model_name in model_names
+        ):
+            break
+
+    return observed
+
+
 @router.get(
     "/classification/attributes",
+    dependencies=[Depends(allow_any_authenticated())],
     summary="Get custom classification attributes",
     description="""Returns custom classification attributes for a given object type.
     Only includes models with classification_type set to 'attribute'.
+    Callers without access to every camera only receive values that have been
+    recorded on the cameras they can access.
     By default returns a flat sorted list of all attribute labels.
     If group_by_model is true, returns attributes grouped by model name.""",
 )
 def get_custom_attributes(
-    request: Request, object_type: str = None, group_by_model: bool = False
+    request: Request,
+    object_type: str = None,
+    group_by_model: bool = False,
+    allowed_cameras: list[str] = Depends(get_allowed_cameras_for_filter),
 ):
     models_with_attributes = {}
+    objects_by_model = {}
 
     for (
         model_key,
@@ -729,8 +835,8 @@ def get_custom_attributes(
         if object_type is not None and object_type not in model_objects:
             continue
 
-        dataset_dir = os.path.join(CLIPS_DIR, sanitize_filename(model_key), "dataset")
-        if not os.path.exists(dataset_dir):
+        dataset_dir = safe_join(CLIPS_DIR, model_key, "dataset")
+        if dataset_dir is None or not os.path.exists(dataset_dir):
             continue
 
         attributes = []
@@ -742,6 +848,32 @@ def get_custom_attributes(
         if attributes:
             model_name = model_config.name or model_key
             models_with_attributes[model_name] = sorted(attributes)
+            objects_by_model[model_name] = model_objects
+
+    # the dataset holds every label a model can emit, including ones never
+    # applied to an event, so callers without full camera access are limited to
+    # the values actually recorded on the cameras they can see
+    all_cameras = set(request.app.frigate_config.cameras.keys())
+
+    if models_with_attributes and not all_cameras.issubset(allowed_cameras):
+        observed = get_observed_attributes(
+            models_with_attributes,
+            set().union(*objects_by_model.values()),
+            allowed_cameras,
+        )
+        models_with_attributes = {
+            model_name: [
+                attribute
+                for attribute in attributes
+                if attribute in observed.get(model_name, set())
+            ]
+            for model_name, attributes in models_with_attributes.items()
+        }
+        models_with_attributes = {
+            model_name: attributes
+            for model_name, attributes in models_with_attributes.items()
+            if attributes
+        }
 
     if group_by_model:
         return JSONResponse(content=models_with_attributes)
@@ -760,7 +892,10 @@ def get_custom_attributes(
     The name must exist in the classification models. Returns a success message or an error if the name is invalid.""",
 )
 def get_classification_images(name: str):
-    train_dir = os.path.join(CLIPS_DIR, sanitize_filename(name), "train")
+    train_dir = safe_join(CLIPS_DIR, name, "train")
+
+    if train_dir is None:
+        return invalid_name_response(name)
 
     if not os.path.exists(train_dir):
         return JSONResponse(status_code=200, content=[])
@@ -831,15 +966,17 @@ def delete_classification_dataset_images(
 
     json: dict[str, Any] = body or {}
     list_of_ids = json.get("ids", "")
-    folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", sanitize_filename(category)
-    )
+    sanitized_name = sanitize_path_component(name)
+    folder = safe_join(CLIPS_DIR, name, "dataset", category)
+
+    if sanitized_name is None or folder is None:
+        return invalid_name_response(name)
 
     deleted_count = 0
     for id in list_of_ids:
-        file_path = os.path.join(folder, sanitize_filename(id))
+        file_path = safe_join(folder, id)
 
-        if os.path.isfile(file_path):
+        if file_path and os.path.isfile(file_path):
             os.unlink(file_path)
             deleted_count += 1
 
@@ -850,7 +987,6 @@ def delete_classification_dataset_images(
     # This ensures the dataset is marked as changed after deletion
     # (even if the total count happens to be the same after adding and deleting)
     if deleted_count > 0:
-        sanitized_name = sanitize_filename(name)
         metadata = read_training_metadata(sanitized_name)
         if metadata:
             last_count = metadata.get("last_training_image_count", 0)
@@ -888,8 +1024,8 @@ def reclassify_classification_image(
         )
 
     json: dict[str, Any] = body or {}
-    image_id = sanitize_filename(json.get("id", ""))
-    new_category = sanitize_filename(json.get("new_category", ""))
+    image_id = sanitize_path_component(json.get("id", ""))
+    new_category = sanitize_path_component(json.get("new_category", ""))
 
     if not image_id or not new_category:
         return JSONResponse(
@@ -913,10 +1049,13 @@ def reclassify_classification_image(
             status_code=400,
         )
 
-    sanitized_name = sanitize_filename(name)
-    source_folder = os.path.join(
-        CLIPS_DIR, sanitized_name, "dataset", sanitize_filename(category)
-    )
+    sanitized_name = sanitize_path_component(name)
+    source_folder = safe_join(CLIPS_DIR, name, "dataset", category)
+    target_folder = safe_join(CLIPS_DIR, name, "dataset", new_category)
+
+    if sanitized_name is None or source_folder is None or target_folder is None:
+        return invalid_name_response(name)
+
     source_file = os.path.join(source_folder, image_id)
 
     if not os.path.isfile(source_file):
@@ -933,7 +1072,6 @@ def reclassify_classification_image(
     random_id = "".join(random.choices(string.ascii_lowercase + string.digits, k=6))
     timestamp = datetime.datetime.now().timestamp()
     new_name = f"{new_category}-{timestamp}-{random_id}.png"
-    target_folder = os.path.join(CLIPS_DIR, sanitized_name, "dataset", new_category)
 
     os.makedirs(target_folder, exist_ok=True)
 
@@ -983,7 +1121,7 @@ def rename_classification_category(
         )
 
     json: dict[str, Any] = body or {}
-    new_category = sanitize_filename(json.get("new_category", ""))
+    new_category = sanitize_path_component(json.get("new_category", ""))
 
     if not new_category:
         return JSONResponse(
@@ -996,12 +1134,12 @@ def rename_classification_category(
             status_code=400,
         )
 
-    old_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", sanitize_filename(old_category)
-    )
-    new_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", new_category
-    )
+    sanitized_name = sanitize_path_component(name)
+    old_folder = safe_join(CLIPS_DIR, name, "dataset", old_category)
+    new_folder = safe_join(CLIPS_DIR, name, "dataset", new_category)
+
+    if sanitized_name is None or old_folder is None or new_folder is None:
+        return invalid_name_response(name)
 
     if not os.path.exists(old_folder):
         return JSONResponse(
@@ -1030,7 +1168,6 @@ def rename_classification_category(
 
         # Mark dataset as ready to train by resetting training metadata
         # This ensures the dataset is marked as changed after renaming
-        sanitized_name = sanitize_filename(name)
         write_training_metadata(sanitized_name, 0)
 
         return JSONResponse(
@@ -1078,13 +1215,20 @@ def categorize_classification_image(request: Request, name: str, body: dict = No
         )
 
     json: dict[str, Any] = body or {}
-    category = sanitize_filename(json.get("category", ""))
-    training_file_name = sanitize_filename(json.get("training_file", ""))
-    training_file = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "train", training_file_name
+    category = sanitize_path_component(json.get("category", ""))
+    training_file_name = json.get("training_file", "")
+    training_file = (
+        safe_join(CLIPS_DIR, name, "train", training_file_name)
+        if training_file_name
+        else None
     )
 
-    if training_file_name and not os.path.isfile(training_file):
+    if category is None:
+        return invalid_name_response(json.get("category", ""))
+
+    if training_file_name and (
+        training_file is None or not os.path.isfile(training_file)
+    ):
         return JSONResponse(
             content=(
                 {
@@ -1098,9 +1242,10 @@ def categorize_classification_image(request: Request, name: str, body: dict = No
     random_id = "".join(random.choices(string.ascii_lowercase + string.digits, k=6))
     timestamp = datetime.datetime.now().timestamp()
     new_name = f"{category}-{timestamp}-{random_id}.png"
-    new_file_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", category
-    )
+    new_file_folder = safe_join(CLIPS_DIR, name, "dataset", category)
+
+    if new_file_folder is None:
+        return invalid_name_response(name)
 
     os.makedirs(new_file_folder, exist_ok=True)
 
@@ -1138,9 +1283,10 @@ def create_classification_category(request: Request, name: str, category: str):
             status_code=404,
         )
 
-    category_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", sanitize_filename(category)
-    )
+    category_folder = safe_join(CLIPS_DIR, name, "dataset", category)
+
+    if category_folder is None:
+        return invalid_name_response(category)
 
     os.makedirs(category_folder, exist_ok=True)
 
@@ -1179,12 +1325,15 @@ def delete_classification_train_images(request: Request, name: str, body: dict =
 
     json: dict[str, Any] = body or {}
     list_of_ids = json.get("ids", "")
-    folder = os.path.join(CLIPS_DIR, sanitize_filename(name), "train")
+    folder = safe_join(CLIPS_DIR, name, "train")
+
+    if folder is None:
+        return invalid_name_response(name)
 
     for id in list_of_ids:
-        file_path = os.path.join(folder, sanitize_filename(id))
+        file_path = safe_join(folder, id)
 
-        if os.path.isfile(file_path):
+        if file_path and os.path.isfile(file_path):
             os.unlink(file_path)
 
     return JSONResponse(
@@ -1201,7 +1350,11 @@ def delete_classification_train_images(request: Request, name: str, body: dict =
 )
 async def generate_state_examples(request: Request, body: GenerateStateExamplesBody):
     """Generate examples for state classification."""
-    model_name = sanitize_filename(body.model_name)
+    model_name = sanitize_path_component(body.model_name)
+
+    if model_name is None:
+        return invalid_name_response(body.model_name)
+
     cameras_normalized = {
         camera_name: tuple(crop)
         for camera_name, crop in body.cameras.items()
@@ -1224,7 +1377,11 @@ async def generate_state_examples(request: Request, body: GenerateStateExamplesB
 )
 async def generate_object_examples(request: Request, body: GenerateObjectExamplesBody):
     """Generate examples for object classification."""
-    model_name = sanitize_filename(body.model_name)
+    model_name = sanitize_path_component(body.model_name)
+
+    if model_name is None:
+        return invalid_name_response(body.model_name)
+
     collect_object_classification_examples(model_name, body.label)
 
     return JSONResponse(
@@ -1243,10 +1400,16 @@ async def generate_object_examples(request: Request, body: GenerateObjectExample
     Returns a success message.""",
 )
 def delete_classification_model(request: Request, name: str):
-    sanitized_name = sanitize_filename(name)
+    # This endpoint intentionally accepts models that are not in the config, so
+    # there is no allow list to fall back on. Both paths below are recursive
+    # deletes, so an unusable name has to be rejected outright.
+    data_dir = safe_join(CLIPS_DIR, name)
+    model_dir = safe_join(MODEL_CACHE_DIR, name)
+
+    if data_dir is None or model_dir is None:
+        return invalid_name_response(name)
 
     # Delete the classification model's data directory in clips
-    data_dir = os.path.join(CLIPS_DIR, sanitized_name)
     if os.path.exists(data_dir):
         try:
             shutil.rmtree(data_dir)
@@ -1255,7 +1418,6 @@ def delete_classification_model(request: Request, name: str):
             logger.debug(f"Failed to delete data directory for {name}: {e}")
 
     # Delete the classification model's files in model_cache
-    model_dir = os.path.join(MODEL_CACHE_DIR, sanitized_name)
     if os.path.exists(model_dir):
         try:
             shutil.rmtree(model_dir)

frigate/api/config_util.py

@@ -0,0 +1,63 @@
+"""Shared helpers for applying a freshly parsed config to the running app."""
+
+from fastapi import FastAPI
+
+from frigate.config import FrigateConfig
+from frigate.config.camera.updater import (
+    CameraConfigUpdateEnum,
+    CameraConfigUpdateTopic,
+)
+
+
+def publish_camera_section_updates(
+    app: FastAPI, config: FrigateConfig, update_type: CameraConfigUpdateEnum
+) -> None:
+    """Broadcast every camera's re-resolved value for a global section.
+
+    Global sections are folded into each camera at parse time and the camera
+    copies are what workers read, so send them rather than leave a worker to
+    guess which cameras were inheriting.
+    """
+    for camera_name, camera_config in config.cameras.items():
+        settings = getattr(camera_config, update_type.name, None)
+
+        if settings is None:
+            continue
+
+        app.config_publisher.publish_update(
+            CameraConfigUpdateTopic(update_type, camera_name), settings
+        )
+
+
+def swap_runtime_config(app: FastAPI, config: FrigateConfig) -> None:
+    """Point every long-lived collaborator at a newly parsed config object.
+
+    Both /api/config/set and camera deletion re-parse yaml into a fresh
+    FrigateConfig and must rebind the same set of references, or the API and
+    the dispatcher drift onto different objects (the API reports one camera
+    state while the dispatcher acts on another). Runtime toggle overrides are
+    re-layered last: the swap rebuilt every camera from yaml, so without this a
+    camera the user turned off would silently come back on.
+    """
+    app.frigate_config = config
+
+    if app.config_holder is not None:
+        app.config_holder.set(config)
+
+    app.genai_manager.update_config(config)
+
+    if app.profile_manager is not None:
+        app.profile_manager.update_config(config)
+
+    if app.stats_emitter is not None:
+        app.stats_emitter.config = config
+
+    if app.dispatcher is not None:
+        app.dispatcher.config = config
+
+        for comm in app.dispatcher.comms:
+            comm.config = config
+
+        # workers still hold the live toggle values, so correct only the
+        # config object here rather than re-broadcasting every override
+        app.dispatcher.reapply_runtime_state_to_config()

frigate/api/debug_replay.py

@@ -13,6 +13,7 @@ from frigate.api.auth import require_role
 from frigate.api.defs.tags import Tags
 from frigate.jobs.debug_replay import (
     ExportDebugReplaySource,
+    NoRecordingsError,
     RecordingDebugReplaySource,
     start_debug_replay_job,
 )
@@ -74,7 +75,8 @@ class DebugReplayStopResponse(BaseModel):
     response_model=DebugReplayStartResponse,
     status_code=202,
     responses={
-        400: {"description": "Invalid camera, time range, or no recordings"},
+        400: {"description": "Invalid camera or time range"},
+        404: {"description": "No recordings in the requested time range"},
         409: {"description": "A replay session is already active"},
     },
     dependencies=[Depends(require_role(["admin"]))],
@@ -113,6 +115,14 @@ async def start_debug_replay(request: Request, body: DebugReplayStartBody):
             },
             status_code=409,
         )
+    except NoRecordingsError:
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "No recordings found in the selected time range",
+            },
+            status_code=404,
+        )
     except ValueError:
         logger.exception("Rejected debug replay start request")
         return JSONResponse(