This is the Tier 3 internet/connectivity sourcing pass (working/internet/source-internet.md, re-verified live 2026-08-05). This is a light refresh of the prior publish: the cable run status, the Lightwire plan, the 4G backup hardware pricing, and the Starlink pricing were all re-checked live today and found unchanged in substance from the last publish. No pricing regressions and no discontinued hardware were found.

Cable Run to Shed

Status: CONFIRMED COMPLETE. Ed has directly confirmed the fibre cable has been run to the shed and is working.

Hardware installed — settled state:

Settled state (unchanged this refresh): the TL-SG116P was purchased some time ago and has been installed and connected at the shed router all along. There was never a separate interim non-PoE switch — an earlier miscommunication to that effect was corrected and resettled in an earlier pass, and today's re-verification confirms no further change. It has 120W of PoE budget across 16 ports, ample headroom for the alarm communicator and future access-control readers whenever those are installed — no further switch procurement or installation decision remains. (Cameras still connect directly to the NVR's own built-in PoE ports, not to this switch — see requirements.md and integration.md for the full PoE architecture.)

What remains open on this line item:

• Reconcile the actual invoiced cost of the trench/conduit/labour against the ~$750–$1,100 planning estimate below — a record-keeping task, not a decision point
• Run the post-cable-run peak-hour speed test from the shed end via the ER706W (see Open Questions) — not yet done, and not blocked by anything physical

Estimated costs (planning figures, not yet reconciled against actual spend):

Primary Connectivity

Option A -- Lightwire Fixed Wireless Unlimited

Status: Locked in — not subject to selection. Ed is under a 24-month contract. Live, working, and confirmed reaching the shed end-to-end.

Plan comparison (fetched from lightwire.co/homes, 2026-08-05):

A promotion ("2 months free," code SUMMERCREDIT, stated valid through 20 March 2026) was observed on the plan page but that date has already passed — this reads as stale marketing copy and is not actionable.

Requirements compliance:

Alternative fixed-line/fibre check: no evidence of a new fibre or competing fixed-wireless provider now serving Te Waerenga Road, Hamurana that would beat Lightwire's upload figures. Rural Hamurana has historically sat outside the UFB fibre footprint, and Ed is contractually locked into a 24-month Lightwire term regardless. Recommendation: do not pursue a switch.

Risks: upload is not speed-guaranteed; peak-hour congestion on the fixed-wireless tower is unverified — this is the single biggest open risk in the whole internet plan, and it is trivially actionable (a speed test plus a phone call).

Backup Connectivity Options (Phase 2)

The following address backup/failover only. The primary Lightwire link (Option A above) is not subject to selection.

Option B -- 4G Mobile Backup Router

What it provides: a cellular router on the ER706W's WAN2 port, providing failover connectivity when Lightwire drops.

Hardware (re-verified live NZ retail pricing and availability, 2026-08-05):

Recommendation on hardware: the MR6400 at ~$119–$159 is the right choice — it meets the WAN2 failover requirement, is the cheapest option, and is confirmed as a currently-listed, actively-sold model across multiple independent NZ retailers this session. The MR6500v's extra ~$90–$130 buys VoIP telephony capability that is not needed here.

SIM/plan options — re-verified 2026-08-05:

All three IoT SIM pricing pages remain gated behind a sales quote as of this session — unchanged from the prior research pass. Treat any prior "$15–$25/month" planning estimate as an unconfirmed placeholder only, not a verified figure, until an actual quote is obtained.

Requirements compliance:

• Backup bandwidth: PASS — rural 4G typically 2-10 Mbps upload, well above the ~1 Mbps backup-mode demand — pending the coverage test below
• Alarm cellular independence: PASS — the alarm communicator has its own separate SIM/path, entirely unaffected by this router
• Gate/NVR offline behaviour: NOT APPLICABLE — both are independent of any internet path, backup included

Phase 1 cost: $0 (deferred to Phase 2, per guidance)

Phase 2 cost (this session's re-verified hardware price range): ~$119–$159 hardware (MR6400, one-off) + IoT SIM monthly cost (unconfirmed pending quote) = hardware cost confirmed; ongoing cost still requires a direct quote from Spark Business, One NZ, or M2M One before budgeting

What this locks in: nothing contractual — IoT SIMs are typically no-term or short-term per all three providers' own product descriptions

Risks:

• 4G/5G coverage at the shed is still unconfirmed on-site — a physical walk-test with test SIMs on both Spark and One NZ, not something research can resolve. This is the binding prerequisite before any Phase 2 hardware spend, and is entirely independent of the (now-complete) fibre cable run.
• Actual IoT SIM pricing is not published by any of the three providers checked this session — get a direct quote before committing
• Rural 4G upload is lower and more variable than Lightwire; acceptable for backup-mode (alarm heartbeat + occasional live-view), not as a primary link

Verdict: recommended for Phase 2, subject to on-site 4G coverage check and IoT SIM quotes.

Option C -- No Backup (Phase 1)

What this means: Lightwire remains the sole internet path through Phase 1. No backup hardware purchased or configured.

Operational impact during a Lightwire outage:

Phase 1 cost: $0 additional — Lightwire $139/month only.

Pros: zero additional cost; simplest configuration; all safety-critical functions remain operational during outages; ER706W WAN2 stays available for Phase 2 without any hardware change already made.

Cons: remote camera view and remote PIN management are lost during any Lightwire outage; on-site physical access is needed to review footage during an outage.

Verdict: recommended for Phase 1, unchanged conclusion this refresh.

Option D -- Starlink

What it would provide: satellite-based backup or primary connectivity, independent of local fixed-wireless tower congestion.

Live-verified NZ pricing, 2026-08-05 (via secondary-source corroboration — direct fetch of starlink.com/nz returned no retrievable content this session):

Verification note: these figures are corroborated across three independent, current (2026) NZ-focused secondary sources rather than a direct fetch of Starlink's own page, which is a weaker verification standard than the direct-fetch confirmation achieved for Lightwire.

Why it is still not recommended: even at the cheaper Residential Lite tier ($85/month), Starlink as a backup-only connection costs more per month than the entire MR6400 + IoT SIM 4G backup solution, for a role that only restores remote visibility — not any operationally critical function (gate access, alarm, and recording all continue regardless of internet status). At Residential Standard ($170/month), it now costs more than the primary Lightwire plan itself. Prices have risen, not fallen, since the prior pass, which strengthens rather than weakens the case against Starlink as backup.

Verdict: not recommended. Only reconsider if the Phase 2 4G walk-test comes back negative for both Spark and One NZ coverage — get a live, current Starlink NZ quote at that point, as pricing has moved twice in recent months.

Recommended Setup Summary

Network Configuration Notes

ER706W VLAN and firewall configuration:

• VLAN 10 — Camera network: NVR + all IP cameras; outbound to Hik-Connect relay servers only; deny inbound from VLAN 20; no port forwarding
• VLAN 20 — Management network: alarm communicator, access control system, operator devices on-site; outbound to alarm monitoring cloud and general internet; deny inbound from VLAN 10
• Router hardening: change all default passwords (ER706W, TL-SG116P switch, cameras, NVR); disable UPnP; disable remote management unless VPN is configured; enable firewall logging
• WAN failover (Phase 2): WAN1 = Lightwire (primary), WAN2 = 4G router (failover only, not load-balancing); health check against 8.8.8.8 and 1.1.1.1 on both links

Speed test and upload monitoring — the single highest-priority open action:

• Overdue peak-hour test: run speedtest.net or fast.com from the ER706W at the shed during peak hours (3pm-10pm weekday); upload should be consistently at or above 3.5 Mbps. Open since 2026-04-09, still not done as of this refresh, and not blocked by installation status.
• Fibre-link-integrity check: while running the above test, confirm the shed-end reading is consistent with the house-end connection, to rule out any loss introduced by the media converter/SFP/fibre run itself.
• Ongoing monitoring: review ER706W WAN bandwidth logs monthly for unexpected upload consumers (e.g. accidental NVR cloud backup).

NZ Supplier Options for Networking Hardware — Verification Summary (this session, 2026-08-05)

Source

Integration design is drawn from .claude/knowledge/integration/security-infrastructure.md (version 9, last-updated 2026-08-05, status POPULATED). This is a targeted refresh of the prior (v7) publish. v9's substantive change is a correction to a stale camera-NVR alarm-input assumption (see "NVR alarm inputs" below) plus an explicit clarification of the NVR's PoE architecture — it does not change the shed switch position (settled at v7) or any bandwidth, UPS, or connectivity figure.

How Infrastructure Connects to Other Systems

Cameras (Hik-Connect P2P)

The Hikvision NVR and cameras sit on VLAN 10. The NVR registers with Hik-Connect, Hikvision's cloud relay service. Remote live-view and playback are available via the Hik-Connect app or iVMS-4200 desktop client without port forwarding or a static IP address.

The NVR requires outbound access to Hik-Connect relay servers (TCP 80, 443, and Hik-Connect-specific ports including 8000, 8200, and 554 for RTSP). The ER706W firewall must allow these outbound connections from VLAN 10 and deny all inbound connections from the internet to the camera VLAN. No direct internet exposure of any camera or the NVR is required or recommended.

If the internet drops, the NVR continues recording locally. Hik-Connect remote view is unavailable until connectivity is restored — an explicitly accepted Phase 1 risk, and a live-tested condition rather than a theoretical one, since the fibre link to the shed is confirmed working.

Bandwidth constraint (load-bearing, unchanged): H.265 encoding is mandatory on all cameras. The Lightwire upload ceiling (~5 Mbps typical) is only met if all cameras use H.265. H.264 would approximately double the upstream live-view sub-stream demand and risk breaching the ceiling under concurrent use. This is a disqualifying criterion for camera procurement, not a preference.

NVR alarm inputs — corrected v9: earlier passes treated the NVR's alarm-input count as needing to scale with bay count (read in practice as "≥8 alarm inputs required"), which wrongly excluded or down-ranked NVR models with fewer inputs. This was a stale assumption about wiring topology, not a real requirement: the 12 bay-door reed switches wire into the alarm panel's own zones, not the NVR, and the panel sends a single PGM relay trigger to just one NVR alarm input. The corrected floor is a minimum of 1 NVR alarm input (2 if a second PGM output is used for a separate purpose). This does not change any internet, bandwidth, or connectivity requirement — it is a camera/NVR sourcing correction, noted here because it flows from the same v9 refresh.

NVR PoE architecture — clarified v9: the NVR's own built-in PoE ports (e.g. the 16-port budget on a DS-7616NI-K2/16P) form a dedicated, self-contained network for cameras only. They are not a general-purpose switch — they do not extend network access to non-camera devices and do not compete with or reduce the capacity of the separately-owned TL-SG116P switch, which remains fully available for the alarm communicator and future access-control readers regardless of which NVR is chosen.

Alarms (Dual-Path Communicator)

The alarm communicator sits on VLAN 20 (management). It uses the internet path (IP primary) to send heartbeats and alarm events to the monitoring centre. If the IP path drops, it automatically fails over to its own cellular SIM — mandatory, not a nice-to-have.

Communicator model (unaffected by this refresh): the required communicator is the TL280LE (LTE 4G + Ethernet, $499 NZD at Alarm Warehouse NZ). The previously specified TL2803GR is obsolete 3G/HSPA-only hardware and has been non-functional since New Zealand's nationwide 3G network shutdown completed 2 April 2026 — it must not be procured, and if one has already been purchased it needs physically exchanging, not just correcting on paper. TL280E (IP-only, no cellular backup) is excluded for the Grade 3 target. Whether the correct TL280LE unit has actually been purchased and installed remains a separate, still-open question — this is genuinely unresolved, and is not the same question as the switch, which is settled.

Switch dependency (settled, unchanged this refresh): the communicator's ethernet/IP path depends on a PoE switch being purchased and installed. That dependency is fully resolved on the switch side — the TL-SG116P is confirmed purchased and already installed and in use at the shed. This is true regardless of which communicator model ends up fitted; it does not, on its own, resolve the separate open question of which communicator model has actually been purchased. The cellular path is, and always was, independent of both the switch and the router's WAN status.

The ER706W being on UPS is important here: keeping the router online during a brief power outage delays the point at which the alarm communicator loses its IP path and triggers cellular fallback, reducing unnecessary cellular-path alarm traffic during short power cuts.

The alarm communicator's cellular SIM is entirely independent of any Phase 2 4G backup router SIM — separate devices on separate networks. The alarm panel's cellular path is unaffected by whether the backup router is functioning.

Access Control (EasyGate Phase 1 — No Network Dependency)

The EasyGate wireless keypad (433.92 MHz RF, HCS101 rolling code) operates entirely independently of the network — no data interface, no API, no audit log, no network connectivity. Customer gate access is not affected by any internet or network outage.

In Phase 1, the gate camera (on VLAN 10, NVR-recorded) and a manual PIN register are the sole access records. The gate camera specification is therefore load-bearing for consent evidence — it must capture vehicle registration plates and driver identity clearly enough to substitute for a digital access log.

In Phase 2, a wired Wiegand or OSDP reader wired to an access control panel (e.g. Inner Range Inception or DS-K2602) will be added on VLAN 20. Like the alarm communicator, a PoE reader/panel will draw from the shed's PoE switch — the TL-SG116P is confirmed purchased and already installed at the shed with 120W/16-port budget and ample headroom for this, so no separate switch procurement is needed for Phase 2 sequencing. Remote management of customer PIN codes requires an internet connection; during a Lightwire outage, remote PIN management is unavailable and the gate must continue operating on locally stored credentials.

VLAN Topology

Lightwire (house) -> MC210CS media converter -> OS2 fibre (CONFIRMED COMPLETE) -> ER706W SFP WAN port (shed)

  ER706W LAN -> TL-SG116P PoE switch (purchased, installed, and connected at the shed router -- settled state)
  NVR built-in PoE ports (VLAN 10) -> IP cameras -- cameras draw PoE directly from the NVR, a dedicated camera-only network, not the switch

  TL-SG116P port group -> alarm communicator (VLAN 20: management) -- IP path no longer switch-blocked
  TL-SG116P port group -> access control panel (VLAN 20: management, Phase 2) -- no switch dependency remains
  ER706W WiFi -> operator use on-site (VLAN 20: management)

VLAN 10 — Camera network:

• Members: NVR, IP cameras
• Outbound allowed: Hik-Connect relay servers (TCP 80, 443, 8000, 8200, 554)
• Inbound from internet: denied — no port forwarding to any camera or NVR
• Inbound from VLAN 20: denied
• Lateral movement between cameras: denied
• NVR to camera access: allowed

VLAN 20 — Management network:

• Members: alarm communicator, access control panel (Phase 2), operator devices on-site
• Outbound allowed: alarm monitoring cloud servers, access control cloud service, general internet for management
• Inbound from VLAN 10: denied

Router hardening (required before deployment):

• Change default admin password on ER706W, TL-SG116P switch, all cameras and the NVR
• Disable UPnP on ER706W
• Disable remote management on ER706W web UI (use Omada cloud controller instead)
• Enable firewall logging on ER706W for incident investigation

WAN Failover Configuration (Phase 2)

• WAN1: Lightwire (OS2 fibre via MC210CS into ER706W SFP WAN port) — live and working
• WAN2: 4G router LAN ethernet into ER706W WAN2 ethernet port
• Mode: Failover only — NOT load balancing. Camera and alarm traffic must not be split across both WAN links simultaneously.
• Health check: ER706W pings 8.8.8.8 and 1.1.1.1 on both WAN links; failover triggers automatically when WAN1 health check fails.

Starlink is retained in options.md only as a fallback if on-site 4G coverage proves inadequate — the Phase 2 backup decision is unchanged from the prior pass.

PoE Switch: Fully Resolved (no remaining decision)

Prior versions of this document carried a purchase-timing question, working from a since-corrected position that the switch had not yet been purchased. That question no longer exists and is unchanged by this refresh. The TL-SG116P is confirmed purchased and has been installed and connected at the shed router all along — there was never a separate interim non-PoE switch. source-cameras and source-alarms should both treat the TL-SG116P as existing, installed infrastructure with a 120W/16-port PoE budget available for the alarm communicator and future access control readers; no further switch procurement decision is needed. A prior Tier 3 recommendation to purchase a standalone TL-SG108PE for the alarm/access-control PoE need is moot and has been dropped from options.md.

UPS Requirements

Cameras connect directly to the NVR's own built-in 16-port PoE budget (230W budget on the DS-7616NI-K2/16P), not to the switch — this is a dedicated, self-contained camera-only network (clarified v9). The TL-SG116P (120W budget across 16 ports, confirmed purchased and installed) carries only the alarm communicator, future access control readers, and other peripherals — not cameras.

Systems that must stay online during a mains power outage:

Protected-load and runtime figures:

The switch's own wattage estimate (~18W with headroom) is unchanged. This runtime is short for a rural site where outages can be prolonged. A larger unit (e.g. 1500 VA/900W) would proportionally extend both figures and is worth Ed weighing against the modest cost difference — unresolved.

Minimum UPS specification (unchanged):

• Type: line-interactive with automatic voltage regulation (AVR)
• Output waveform: pure sine wave preferred
• VA rating: 1000 VA / 600W minimum
• Minimum one UPS alarm output or dry contact for fault notification
• The alarm panel's internal SLA battery and the EasyGate's own batteries are both explicitly excluded from UPS load calculation

Cross-System Interactions and Constraints

1. H.265 is a disqualifying camera procurement criterion, not a preference. Unchanged.

2. EasyGate has no electronic log — the gate camera is load-bearing for consent evidence. Unchanged. Planning consultant confirmation that CCTV-based logging is acceptable consent evidence remains outstanding (compliance/consent area).

3. Internet failure and power failure are independent failure modes. No single point of failure locks out customers or disables security recording in Phase 1. The fibre link and the shed's PoE switch that these failure modes would affect are both confirmed live, not theoretical.

4. Alarm communicator model — confirmed required platform (TL280LE), still not confirmed as purchased. Unresolved and explicitly decoupled from the (resolved) switch question. This is an actionable procurement/exchange check for Ed/Tom, not a research task.

5. BWoF — infrastructure systems do not trigger it. The ER706W, TL-SG116P switch, NVR, cameras, and cabling are not Specified Systems under the Building (Specified Systems) Regulations 2005. See the compliance area documentation for the fire/security alarm BWoF boundary.

6. ONVIF Profile T required — impacts camera VLAN design. All cameras must support ONVIF Profile T (Profile S alone is confirmed insufficient). Enforced at procurement; the VLAN 10 firewall rules must allow the ONVIF Profile T and RTSP ports required for NVR integration.

7. PoE switch purchase and installation timing is fully resolved. No further switch procurement decision remains — see the dedicated section above.

8. Alarm IP path is no longer blocked by the switch; the communicator model itself is the remaining open item. Even proceeding with early alarm installation, the switch will not be the obstacle to IP-based remote arm/disarm — confirming and, if necessary, exchanging the communicator hardware is.

9 (new v9). NVR alarm-input count is not an internet/connectivity constraint. A stale "≥8 alarm inputs required" assumption in camera/NVR sourcing has been corrected to a floor of 1 (2 if a second PGM output is used). This affects camera/NVR model selection only — it does not change any bandwidth, VLAN, PoE, or UPS figure in this document.

Source

Tier 1 requirements are drawn from .claude/knowledge/technical/infrastructure-requirements.md (version 6, last-updated 2026-08-05, status POPULATED). v6 is a communicator-hardware correction only (obsolete TL2803GR replaced throughout with TL280LE, matching the correction already applied in the Tier 2 compound document) — it does not change any bandwidth, cabling, or UPS figure carried forward from v5. v5 itself was the final entry in a same-day correction sequence on the shed PoE switch: v2 said purchased and installed (correct); v3 wrongly said not purchased at all; v4 partially reversed that, saying purchased but not installed with a separate interim non-PoE switch in place (also wrong); v5 settled it — there was never a separate non-PoE switch, and the TL-SG116P has been installed and connected at the shed router all along. This refresh confirms no further Tier 1 change since v6.

Bandwidth Requirements

• The site uses a local NVR-recording architecture specifically because Lightwire's upload is only ~5 Mbps — continuous cloud upload of 4 cameras at 4MP H.265 would need ~6 Mbps, which exceeds the ceiling; local recording avoids this entirely.
• H.265 (HEVC) is mandatory on every camera. H.264 roughly doubles bitrate at the same resolution/framerate and would push the system over the upload ceiling even for a single remote viewer.
• Worst-case concurrent upload demand across all systems (CCTV live-view, motion-clip bursts, alarm heartbeat, access control, general overhead) is ~3.5 Mbps; typical concurrent demand is ~1.0-1.5 Mbps.
• Minimum plan requirement: 5 Mbps sustained upload, 10 Mbps download. The Lightwire Unlimited plan meets this under typical conditions only — upload is not speed-guaranteed, so peak-hour testing is required before relying on the budget. This test remains outstanding and is unblocked, since the shed-end link is confirmed live.

Power Requirements

• A dedicated 10A general-purpose circuit is required at the shed for IT/security equipment, installed by a licensed electrician under AS/NZS 3000:2018. It must not be shared with the roller door opener motors (motor switching creates voltage transients) or lighting circuits.
• Total estimated shed IT/security load: ~133W at Phase 1 (4 cameras via NVR PoE), ~155W at Phase 2 (6 cameras). A single 10A/240V circuit (2,400W) is well within this — power capacity is not a constraint at any projected phase.
• Cameras draw PoE directly from the NVR's own 16-port built-in PoE budget (230W on the DS-7616NI-K2/16P), not from the shed switch — this is a dedicated, self-contained camera-only network, not a general-purpose switch, and it does not compete with or reduce the TL-SG116P's capacity. The TP-Link TL-SG116P (16-port PoE+, 120W budget) carries the alarm communicator and future access control readers instead — it is confirmed purchased and has been installed and connected at the shed router all along; there is no outstanding purchase, installation, or model-selection task on the switch.
• PoE standard: 802.3af (15.4W/port) is sufficient for the specified 4MP Hikvision cameras (6-9W draw); both the NVR's built-in ports and the TL-SG116P support 802.3at (PoE+, 30W/port) for future headroom.

UPS Requirements

• Type: line-interactive with automatic voltage regulation (AVR) — handles rural voltage sags without unnecessary battery switching.
• Output waveform: pure sine wave preferred, for NVR HDD motors and networking hardware.
• VA rating: 1000 VA / 600W minimum recommended; covers Phase 1 comfortably and Phase 2 growth without replacement.
• Minimum acceptable runtime: 5-10 minutes at full load (133W) — sufficient only for a graceful NVR shutdown; any UPS providing less is not suitable.
• Recommended runtime: 30-60 minutes at core load (90W, camera PoE excluded) — covers short rural outages and keeps the alarm's IP path up longer before cellular fallback triggers.
• Protected load includes the TL-SG116P switch (~18W with headroom, unchanged wattage estimate) alongside the router and NVR — the switch's inclusion in the UPS load calculation is not new, only its confirmed purchased/installed status is.
• The alarm panel's own internal SLA battery (4+ hours standby) and the EasyGate's own batteries are both explicitly excluded from UPS load calculation — they are independent of mains and of the UPS.

Cabling Requirements

• House-to-shed link: 200m OS2 LC-LC single-mode fibre, chosen because the ~86-88m outside run plus interior runs exceeds the Cat6 100m copper limit with no margin. OS2 attenuation at 200m is negligible (~0.07 dB); fibre is immune to electrical interference and ground-loop risk between buildings with potentially different earth potentials; armoured construction gives rodent protection.
• This run is confirmed complete and working (Ed's direct on-site report) — the ER706W router with the TL-SG116P PoE switch is installed and operating at the shed end.
• Burial depth: minimum 300mm under paddock/lawn, 450mm under any vehicle track or machinery crossing. Steel armouring must be earthed at one end only (shed end) to prevent it acting as a lightning conductor path.
• Intra-shed camera/alarm cabling: Cat6 UTP or FTP (shielded preferred in the metal shed environment). Conduit must be run to every planned camera position at initial installation, including positions not used in Phase 1 — retrofitting later is significantly more expensive.

Standards and Compliance

• AS/NZS 3000:2018 (Wiring Rules) — governs the dedicated 10A power circuit and equipment cabinet earthing.
• AS/NZS 3080:2013 (Telecommunications installations in buildings) — governs the Cat6 structured cabling.
• AS/NZS 2201.1:2007 (Intruder alarm systems) — governs alarm panel installation, cabling, and earthing.
• NZS 4512:2021 (Fire detection and alarm systems) — relevant only if fire detection is ever wired into the alarm panel; not applicable to Phase 1 or Phase 2 as currently specified (see compliance area for the BWoF implications of that change).
• EN 50131 Grade 3 — target physical security grade for the alarm system when correctly specified with a dual-path communicator.

Key Protocol Requirements

• Camera ONVIF: Profile T mandatory; Profile S alone is excluded.
• Camera codec: H.265 (HEVC) mandatory — load-bearing for the bandwidth model; H.264 required only as a fallback for compatibility.
• Camera streaming: RTSP required for NVR integration.
• Alarm communicator: a dual-path (IP + cellular) unit is mandatory for the Grade 3 target; an IP-only unit is excluded. The required model is the TL280LE (LTE 4G + Ethernet) — the obsolete TL2803GR (non-functional since NZ's 3G shutdown, 2 April 2026) is excluded outright. Whichever unit is confirmed in hand, its IP path is no longer PoE-switch-blocked: the TL-SG116P is purchased and installed.
• Cloud architecture: no continuous upstream cloud camera upload — NVR local recording only, with Hik-Connect P2P relay for remote access; no port forwarding to the NVR or any camera.
• Access control (Phase 2): Wiegand or OSDP reader; panel must support CSV/JSON log export; PDF-only export is disqualifying.

What This Rules Out

• Any camera without ONVIF Profile T support.
• Continuous cloud-upload camera architectures (bandwidth cannot support it).
• H.264-only cameras, or cameras defaulting to H.264 for the remote sub-stream.
• Any alarm communicator without a cellular backup path, for the Grade 3 target — including the obsolete TL2803GR, which cannot function on any current NZ network.
• Sharing the IT/security power circuit with the roller door opener motors.
• A UPS providing less than 5 minutes of runtime at full Phase 1 load.
• Any further procurement or installation of a shed PoE switch — this need no longer exists; the TL-SG116P already fulfils it.