@camstack/addon-post-analysis 1.2.100 → 1.2.102

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as encodeVectorBase64, A as RetrainStatusSchema, At as literal, B as TrackSourceSchema, C as NcSnoozeSchema, Ct as isDeviceScopedCap, D as OpsLogEntrySchema, Dt as array, E as NcTaxonomySchema, Et as _enum, F as SceneMonitorSchema, Ft as string, G as audioMetricsCapability, H as addonWidgetsSourceCapability, I as TIMELAPSE_DENSE_FLOOR_SEC, It as unknown, J as cosineSimilarity$1, K as audioModeOf, L as TimelapseRuleInputSchema, Lt as EventCategory, M as SCENE_DEFAULT_ANCHOR_THRESHOLD, Mt as object, N as SCENE_DEFAULT_UNCOVERED_POLICY, Nt as partialRecord, Ot as boolean, P as SCENE_DIVERGED, Pt as record, R as TimelapseRulePatchSchema, S as NcSnoozeInputSchema, St as hydrateSchema, T as NcSystemEventKindSchema, Tt as sleep, U as alarmPanelCapability, V as VISIT_MERGE_GAP_MS, W as assertTimelapseCadences, X as defineCustomActions, Y as customAction, Z as deriveRecordingMode, _ as NcRuleInputSchema, _t as zoneAnalyticsCapability, at as notificationRulesCapability, b as NcRuleTargetSchema, bt as DeviceType, c as EVENT_PAD_MS, ct as plateGalleryCapability, d as NC_ALARM_SYSTEM_EVENT_KINDS, et as faceGalleryCapability, f as NC_CONDITION_CATALOG, ft as sceneMonitorCapability, g as NcConditionDescriptorSchema, gt as videoclipsCapability, h as NC_TAXONOMY, ht as vectorDimFromBase64, i as DETECTION_MACRO_CLASSES, it as kebabToCamel, jt as number, k as RECORDING_EXPORT_MAX_READ_BYTES, kt as discriminatedUnion, l as LabelAttributionSchema, lt as readDeviceStateFrom, mt as systemEventFilterApplies, n as DEFAULT_EVENT_COLOR, nt as isDetectionMacroClass, o as DeclaredDevices, p as NC_DEFAULT_SNOOZE_MINUTES, pt as subKindsOf, q as buildEventKindDescriptor, rt as isScheduleActive, s as EVENT_KIND_BY_CAP, st as pipelineAnalyticsCapability, t as BaseDevice, u as MACRO_LABELS, ut as readTimelapseGeneratedAt, v as NcRulePatchSchema, vt as errMsg, w as NcSnoozeSuppressedSchema, wt as nodePin, x as NcScheduleSchema, xt as createEvent, y as NcRuleSchema, yt as BaseAddon, z as TimelapseRuleSchema } from "../dist-ecY_-nDx.mjs";
+import { $ as encodeVectorBase64, A as RetrainStatusSchema, At as literal, B as TrackSourceSchema, C as NcSnoozeSchema, Ct as isDeviceScopedCap, D as OpsLogEntrySchema, Dt as array, E as NcTaxonomySchema, Et as _enum, F as SceneMonitorSchema, Ft as string, G as audioMetricsCapability, H as addonWidgetsSourceCapability, I as TIMELAPSE_DENSE_FLOOR_SEC, It as unknown, J as cosineSimilarity$1, K as audioModeOf, L as TimelapseRuleInputSchema, Lt as EventCategory, M as SCENE_DEFAULT_ANCHOR_THRESHOLD, Mt as object, N as SCENE_DEFAULT_UNCOVERED_POLICY, Nt as partialRecord, Ot as boolean, P as SCENE_DIVERGED, Pt as record, R as TimelapseRulePatchSchema, S as NcSnoozeInputSchema, St as hydrateSchema, T as NcSystemEventKindSchema, Tt as sleep, U as alarmPanelCapability, V as VISIT_MERGE_GAP_MS, W as assertTimelapseCadences, X as defineCustomActions, Y as customAction, Z as deriveRecordingMode, _ as NcRuleInputSchema, _t as zoneAnalyticsCapability, at as notificationRulesCapability, b as NcRuleTargetSchema, bt as DeviceType, c as EVENT_PAD_MS, ct as plateGalleryCapability, d as NC_ALARM_SYSTEM_EVENT_KINDS, et as faceGalleryCapability, f as NC_CONDITION_CATALOG, ft as sceneMonitorCapability, g as NcConditionDescriptorSchema, gt as videoclipsCapability, h as NC_TAXONOMY, ht as vectorDimFromBase64, i as DETECTION_MACRO_CLASSES, it as kebabToCamel, jt as number, k as RECORDING_EXPORT_MAX_READ_BYTES, kt as discriminatedUnion, l as LabelAttributionSchema, lt as readDeviceStateFrom, mt as systemEventFilterApplies, n as DEFAULT_EVENT_COLOR, nt as isDetectionMacroClass, o as DeclaredDevices, p as NC_DEFAULT_SNOOZE_MINUTES, pt as subKindsOf, q as buildEventKindDescriptor, rt as isScheduleActive, s as EVENT_KIND_BY_CAP, st as pipelineAnalyticsCapability, t as BaseDevice, u as MACRO_LABELS, ut as readTimelapseGeneratedAt, v as NcRulePatchSchema, vt as errMsg, w as NcSnoozeSuppressedSchema, wt as nodePin, x as NcScheduleSchema, xt as createEvent, y as NcRuleSchema, yt as BaseAddon, z as TimelapseRuleSchema } from "../dist-CZm8slPB.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -8297,23 +8297,23 @@ var en_default = {
 	},
 	"class.other": "{{name}}",
 	"group.others.person": {
-		"one": "1 other person",
+		"one": "{{count}} other person",
 		"other": "{{count}} other people"
 	},
 	"group.others.vehicle": {
-		"one": "1 other vehicle",
+		"one": "{{count}} other vehicle",
 		"other": "{{count}} other vehicles"
 	},
 	"group.others.animal": {
-		"one": "1 other animal",
+		"one": "{{count}} other animal",
 		"other": "{{count}} other animals"
 	},
 	"group.others.package": {
-		"one": "1 other package",
+		"one": "{{count}} other package",
 		"other": "{{count}} other packages"
 	},
 	"group.others.other": {
-		"one": "1 other {{classNoun}}",
+		"one": "{{count}} other {{classNoun}}",
 		"other": "{{count}} other {{classNoun}}"
 	},
 	"occupancy.body": "{{scope}} {{op}} ({{count}}/{{capacity}})",
@@ -8352,8 +8352,11 @@ var en_default = {
 		"one": "{{count}} addon update available",
 		"other": "{{count}} addon updates available"
 	},
+	"system.addon-update-available.title.onNode": {
+		"one": "{{count}} addon update available on {{nodeId}}",
+		"other": "{{count}} addon updates available on {{nodeId}}"
+	},
 	"system.addon-update-available.body": "{{list}}",
-	"system.addon-update-available.body.onNode": "{{packageName}} {{latestVersion}} is available (current {{currentVersion}}) on node {{nodeId}}",
 	"system.server-update-available.title": {
 		"one": "Server update available on {{count}} node",
 		"other": "Server update available on {{count}} nodes"
@@ -8368,6 +8371,7 @@ var en_default = {
 	"system.addon-updated.body": "{{list}}",
 	"system.server-updated.title": "Server updated",
 	"system.server-updated.body": "{{packageName}} on {{nodeId}} is now {{toVersion}} (was {{fromVersion}})",
+	"system.server-updated.body.toOnly": "{{packageName}} on {{nodeId}} is now {{toVersion}}",
 	"system.server-updated.body.plain": "{{packageName}} on {{nodeId}} was updated",
 	"system.export-completed.title": "Export ready",
 	"system.export-completed.body": "The footage export is ready",
@@ -8511,23 +8515,23 @@ var it_default = {
 	},
 	"class.other": "{{name}}",
 	"group.others.person": {
-		"one": "1 altra persona",
+		"one": "{{count}} altra persona",
 		"other": "{{count}} altre persone"
 	},
 	"group.others.vehicle": {
-		"one": "1 altro veicolo",
+		"one": "{{count}} altro veicolo",
 		"other": "{{count}} altri veicoli"
 	},
 	"group.others.animal": {
-		"one": "1 altro animale",
+		"one": "{{count}} altro animale",
 		"other": "{{count}} altri animali"
 	},
 	"group.others.package": {
-		"one": "1 altro pacco",
+		"one": "{{count}} altro pacco",
 		"other": "{{count}} altri pacchi"
 	},
 	"group.others.other": {
-		"one": "1 altro {{classNoun}}",
+		"one": "{{count}} altro {{classNoun}}",
 		"other": "{{count}} altri {{classNoun}}"
 	},
 	"occupancy.body": "{{scope}} {{op}} ({{count}}/{{capacity}})",
@@ -8566,8 +8570,11 @@ var it_default = {
 		"one": "{{count}} aggiornamento addon disponibile",
 		"other": "{{count}} aggiornamenti addon disponibili"
 	},
+	"system.addon-update-available.title.onNode": {
+		"one": "{{count}} aggiornamento addon disponibile su {{nodeId}}",
+		"other": "{{count}} aggiornamenti addon disponibili su {{nodeId}}"
+	},
 	"system.addon-update-available.body": "{{list}}",
-	"system.addon-update-available.body.onNode": "{{packageName}} {{latestVersion}} è disponibile (attuale {{currentVersion}}) sul nodo {{nodeId}}",
 	"system.server-update-available.title": {
 		"one": "Aggiornamento server disponibile su {{count}} nodo",
 		"other": "Aggiornamento server disponibile su {{count}} nodi"
@@ -8582,6 +8589,7 @@ var it_default = {
 	"system.addon-updated.body": "{{list}}",
 	"system.server-updated.title": "Server aggiornato",
 	"system.server-updated.body": "{{packageName}} sul nodo {{nodeId}} è ora {{toVersion}} (era {{fromVersion}})",
+	"system.server-updated.body.toOnly": "{{packageName}} sul nodo {{nodeId}} è ora {{toVersion}}",
 	"system.server-updated.body.plain": "{{packageName}} sul nodo {{nodeId}} è stato aggiornato",
 	"system.export-completed.title": "Export pronto",
 	"system.export-completed.body": "L'export del filmato è pronto",
@@ -10404,15 +10412,15 @@ function incomingFromUpdateAvailable(facts, data) {
 	const nodeIds = unique(packages.map((pkg) => pkg.nodeId).filter((id) => id !== void 0));
 	const packageNames = unique(packages.map((pkg) => pkg.packageName));
 	const signature = packages.map((pkg) => `${pkg.nodeId ?? ""}:${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",");
-	const list = packages.map(formatAvailableLine).join("\n");
-	const nodes = nodeIds.join(", ");
 	const head = packages[0];
 	const oneNode = nodeIds.length === 1 ? nodeIds[0] : void 0;
+	const list = packages.map((pkg) => formatAvailableLine(pkg, oneNode !== void 0)).join("\n");
+	const nodes = nodeIds.join(", ");
 	return systemSubject({
 		facts,
 		kind,
 		subject: addon ? `packages:addon:${signature}` : `packages:server:${signature}`,
-		titleKey: `system.${kind}.title`,
+		titleKey: addon && oneNode !== void 0 ? `system.${kind}.title.onNode` : `system.${kind}.title`,
 		bodyKey: !addon && oneNode !== void 0 ? `system.${kind}.body.onNode` : !addon && nodeIds.length > 1 ? `system.${kind}.body.onNodes` : `system.${kind}.body`,
 		textParams: {
 			list,
@@ -10471,12 +10479,12 @@ function incomingFromAddonUpdates(facts, updates) {
 function incomingFromServerUpdated(facts, data) {
 	const kind = stringField(data, "kind");
 	const requestedBy = stringField(data, "requestedBy");
-	if (!(kind === "framework-update" || kind === "framework-bulk-update" || requestedBy !== void 0 && requestedBy.startsWith("server-update:"))) return null;
 	const packageName = stringField(data, "packageName") ?? "@camstack/server";
 	const fromVersion = stringField(data, "fromVersion");
 	const toVersion = stringField(data, "toVersion") ?? versionFromRequestedBy(requestedBy);
+	if (!(kind === "framework-update" || kind === "framework-bulk-update" || requestedBy !== void 0 && requestedBy.startsWith("server-update:") && toVersion !== void 0)) return null;
 	const nodeId = stringField(data, "nodeId") ?? "hub";
-	const bodyKey = fromVersion !== void 0 && toVersion !== void 0 ? "system.server-updated.body" : "system.server-updated.body.plain";
+	const bodyKey = toVersion === void 0 ? "system.server-updated.body.plain" : fromVersion === void 0 ? "system.server-updated.body.toOnly" : "system.server-updated.body";
 	return systemSubject({
 		facts,
 		kind: "server-updated",
@@ -10557,9 +10565,15 @@ function updatePackages(data) {
 		...nodeId !== void 0 ? { nodeId } : {}
 	}];
 }
-function formatAvailableLine(pkg) {
-	const line = `${pkg.packageName} ${pkg.latestVersion} (current ${pkg.currentVersion})`;
-	return pkg.nodeId !== void 0 ? `${line} on ${pkg.nodeId}` : line;
+/**
+* One line of an availability list — the SAME shape the completed-update list
+* uses (`incomingFromAddonUpdates`), and deliberately word-free: the list is a
+* frozen param, so any English in it ("current") is delivered verbatim to an
+* Italian household. An arrow is not a language.
+*/
+function formatAvailableLine(pkg, nodeNamedInTitle) {
+	const line = `${pkg.packageName} ${pkg.currentVersion} → ${pkg.latestVersion}`;
+	return pkg.nodeId !== void 0 && !nodeNamedInTitle ? `${line} (${pkg.nodeId})` : line;
 }
 function versionFromRequestedBy(requestedBy) {
 	if (requestedBy === void 0) return void 0;
@@ -28789,19 +28803,29 @@ var BEST_FRAME_POLICY = {
 	sizeAware: true
 };
 /**
-* Best FACE (face-recognizer hold buffer) — confidence-only, no hysteresis, no
-* rate limit. WHY: the face path must keep the TRUE highest-confidence face —
-* accepting a new best only swaps an already-decoded crop buffer in memory
-* (cheap; no capture is triggered), and a track may live well under the
-* best-frame rate-limit window, so a gap/hysteresis would silently discard the
-* real peak for nothing. This was the face path's de-facto behavior all along
-* (it constructed the tracker with defaults); S9 declares it.
+* Best FACE (face-recognizer hold buffer) — SIZE-AWARE, no hysteresis, no rate
+* limit.
+*
+* No hysteresis / no gap, unchanged: accepting a new best only swaps an
+* already-decoded crop buffer in memory (cheap; no capture is triggered), and a
+* track may live well under the best-frame rate-limit window, so a gap would
+* silently discard the real peak for nothing.
+*
+* `sizeAware` since 2026-08-19. It used to be confidence-ONLY, and that was the
+* wrong ranking: SCRFD saturates its confidence on surveillance footage, so a
+* 12 px face and a 40 px face both answer ~0.9 and the track simply kept
+* whichever arrived first. The size that matters is the face's DETECTION-FRAME
+* short side, because that bounds the landmark precision the alignment warp
+* consumes — `face-size-score.ts` carries the measurement that set the
+* reference. Because `minGapMs` is 0 here, enabling this does NOT switch on the
+* decisive-improvement rate-limit bypass (there is no rate limit to bypass); it
+* only adds the size factor to the ranking.
 */
 var BEST_FACE_POLICY = {
 	hysteresis: 0,
 	minGapMs: 0,
 	edgeAware: false,
-	sizeAware: false
+	sizeAware: true
 };
 /**
 * Best OBJECT (CLIP) embedding + its tight crop — confidence-only in-memory
@@ -30999,8 +31023,14 @@ function reportUnvouchedClips(deps, deviceId, clips) {
 * @durable class=config owner=pipeline-analytics
 *   write="a signed-in viewer user saves a named snapshot of their local stores"
 *   retention="none — a row goes only when its owner deletes it"
+*
+* Renamed from the bare `viewer-settings-snapshots` on 2026-08-19: an addon
+* collection carries its owner's prefix, and the bare name sat in the same flat
+* namespace as the kernel's `users` / `system-settings`. Rows already written
+* under the old name are adopted at boot by
+* `viewer-settings-legacy-adoption.ts`.
 */
-var VIEWER_SETTINGS_SNAPSHOTS_COLLECTION = "viewer-settings-snapshots";
+var VIEWER_SETTINGS_SNAPSHOTS_COLLECTION = "pipeline-analytics:viewer-settings-snapshots";
 var COLUMNS = [
 	{
 		name: "id",
@@ -31099,7 +31129,7 @@ var ViewerSettingsSnapshotStore = class {
 			collection: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
 			columns: [...COLUMNS],
 			indexes: [{
-				name: "idx_viewer_settings_owner",
+				name: "idx_pa_viewer_settings_owner",
 				columns: ["ownerUserId"]
 			}]
 		});
@@ -31198,6 +31228,183 @@ function makeViewerSettingsActionHandlers(store) {
 		}
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/viewer-settings-legacy-adoption.ts
+/**
+* @durable class=config owner=pipeline-analytics
+*   write="NOTHING writes it any more — it is the pre-2026-08-19 bare name of
+*     `pipeline-analytics:viewer-settings-snapshots`, declared here only so its
+*     surviving rows can be READ once and moved"
+*   retention="drained, not pruned: a row goes as soon as the successor is
+*     confirmed to hold the same id. The table is empty and inert once every
+*     hub has booted this addon; it is then dropped through the kernel's
+*     `RETIRED_COLLECTIONS` and this module deleted."
+*
+* Bare, and therefore a namespacing violation — hence the single
+* `ALLOWED_BARE` entry in `scripts/check-collection-namespacing.ts`, which
+* names this file and the condition for removing both.
+*/
+var LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION = "viewer-settings-snapshots";
+/**
+* The ORIGINAL column list, byte-for-byte.
+*
+* Do not "tidy" this to reference the successor's constant: they are allowed to
+* diverge, and the day they do, a shared constant would silently rebuild the
+* legacy table and destroy the rows.
+*/
+var LEGACY_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ownerUserId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ownerUsername",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "blob",
+		type: "JSON",
+		notNull: true
+	}
+];
+/** Bounded read: this table held 1 row on the reference hub. */
+var LEGACY_READ_LIMIT = 500;
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+function asRows(raw) {
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const item of raw) {
+		if (typeof item !== "object" || item === null) continue;
+		const id = Reflect.get(item, "id");
+		const data = Reflect.get(item, "data");
+		if (typeof id !== "string" || typeof data !== "object" || data === null) continue;
+		out.push({
+			id,
+			data
+		});
+	}
+	return out;
+}
+/**
+* Move every legacy row into the successor and clear the legacy table.
+*
+* Returns the number of legacy rows RETIRED — the completion metric, not the
+* number written. A row copied but not yet verified counts as zero and is
+* retried on the next boot, which is the safe direction.
+*/
+async function adoptLegacyViewerSettingsSnapshots(deps) {
+	await deps.store.declareCollection.mutate({
+		collection: LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+		columns: LEGACY_COLUMNS
+	});
+	let legacy;
+	try {
+		legacy = asRows(await deps.store.query.query({
+			collection: LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+			filter: { limit: LEGACY_READ_LIMIT }
+		}));
+	} catch (err) {
+		deps.logger.warn("viewer-settings legacy adoption skipped — legacy read failed", { meta: {
+			collection: LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+			error: errText(err)
+		} });
+		return 0;
+	}
+	if (legacy.length === 0) return 0;
+	let existing;
+	try {
+		existing = new Set(asRows(await deps.store.query.query({
+			collection: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+			filter: { limit: LEGACY_READ_LIMIT }
+		})).map((r) => r.id));
+	} catch (err) {
+		deps.logger.warn("viewer-settings legacy adoption skipped — successor read failed", { meta: {
+			collection: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+			error: errText(err)
+		} });
+		return 0;
+	}
+	let written = 0;
+	for (const row of legacy) {
+		if (existing.has(row.id)) continue;
+		try {
+			await deps.store.set.mutate({
+				collection: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+				key: row.id,
+				value: row.data
+			});
+			written += 1;
+		} catch (err) {
+			deps.logger.warn("viewer-settings legacy adoption — one row failed to write", { meta: {
+				snapshotId: row.id,
+				error: errText(err)
+			} });
+		}
+	}
+	let landed;
+	try {
+		landed = new Set(asRows(await deps.store.query.query({
+			collection: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+			filter: { limit: LEGACY_READ_LIMIT }
+		})).map((r) => r.id));
+	} catch (err) {
+		deps.logger.warn("viewer-settings legacy adoption — verification read failed, legacy rows kept", { meta: {
+			written,
+			error: errText(err)
+		} });
+		return 0;
+	}
+	let retired = 0;
+	for (const row of legacy) {
+		if (!landed.has(row.id)) continue;
+		try {
+			await deps.store.delete.mutate({
+				collection: LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+				key: row.id
+			});
+			retired += 1;
+		} catch (err) {
+			deps.logger.warn("viewer-settings legacy adoption — one legacy row failed to delete", { meta: {
+				snapshotId: row.id,
+				error: errText(err)
+			} });
+		}
+	}
+	deps.logger.warn("viewer-settings snapshots adopted from the legacy bare collection", { meta: {
+		from: LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+		to: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+		found: legacy.length,
+		written,
+		retired,
+		kept: legacy.length - retired
+	} });
+	return retired;
+}
 /**
 * The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
 *
@@ -32005,7 +32212,11 @@ var AudioDetectionSettingsSchema = object({
 	*  thresholds, is what bounds the worst case — a mis-tuned threshold can
 	*  only ever cost the operator this many markers a day. */
 	audioMarkerMaxPerDay: number().int().positive().default(12),
-	/** Materialize one event + one synthetic track per classified episode. */
+	/** Materialize one event + one synthetic track per classified episode.
+	*  OFF switches off the GROUPING only — classified audio still persists an
+	*  event (class change, then one per 5 s heartbeat) and still reaches the
+	*  Notification Center; it just opens no synthetic track. A knob that names
+	*  the grouping must never silence the path (D62). */
 	audioEpisodeEnabled: boolean().default(true),
 	/** Class must be heard continuously this long before the episode opens. */
 	audioEpisodeOpenHoldSec: number().nonnegative().default(1.5),
@@ -34225,11 +34436,44 @@ async function resolveDefaultEventMedia(deps) {
 	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/embedding-magnitude-gate.ts
+/**
+* `null` = accept. A verdict = refuse, carrying both numbers so the caller can
+* name them in a log.
+*
+* Accepts unconditionally when the bound is 0 (disabled) or when the magnitude
+* is absent / non-finite — an older runner that does not report it must keep
+* working exactly as before, never be silently gated to nothing. Pure.
+*/
+function embeddingMagnitudeVerdict(magnitude, bound) {
+	if (!(bound > 0)) return null;
+	if (magnitude === void 0 || !Number.isFinite(magnitude)) return null;
+	if (magnitude <= bound) return null;
+	return {
+		magnitude,
+		bound
+	};
+}
+/**
+* Map a detection-frame face short side to the 0..1 `sizeScore` the
+* {@link ./best-detection-tracker.BestDetectionTracker} multiplies into its
+* effective score. Linear up to {@link FACE_SIZE_SCORE_REFERENCE_PX}, saturated
+* above it, 0 for a missing/degenerate measurement (so an unmeasurable face can
+* never outrank a measured one). Pure.
+*/
+function faceSizeScore(detectionFrameShortSidePx) {
+	if (!Number.isFinite(detectionFrameShortSidePx) || detectionFrameShortSidePx <= 0) return 0;
+	if (detectionFrameShortSidePx >= 32) return 1;
+	return detectionFrameShortSidePx / 32;
+}
+//#endregion
 //#region src/pipeline-analytics/face-recognizer.ts
 /** Attribution of an identity resolved by the in-process ArcFace matcher. */
 var FACE_RECOGNIZER_STEP_ID = "face-recognizer";
 /** At most one "dropping imageless track" log per this interval, per recognizer. */
 var FACE_IMAGELESS_LOG_THROTTLE_MS = 6e4;
+/** At most one 'embedding magnitude' sample line per device per this interval. */
+var FACE_MAGNITUDE_LOG_THROTTLE_MS = 6e4;
 /**
 * arcface model id stamped on a detail-plane face candidate when the gallery is
 * empty (collect-only). The detail-subtree result carries no `embeddingModelId`
@@ -34244,6 +34488,8 @@ var FaceRecognizer = class {
 	names = /* @__PURE__ */ new Map();
 	aggregates = /* @__PURE__ */ new Map();
 	bestFace = /* @__PURE__ */ new Map();
+	/** Per-device throttle clock for the magnitude sample line. */
+	lastMagnitudeLogAt = /* @__PURE__ */ new Map();
 	/**
 	* Peak identity-MATCH cosine per track for the currently-assigned identity
 	* (NOT the detection confidence held in {@link bestFace}). Reset on an
@@ -34293,6 +34539,21 @@ var FaceRecognizer = class {
 	* input source moves from the per-frame plane to this per-track call.
 	*/
 	async ingestFaceDetail(input) {
+		const verdict = embeddingMagnitudeVerdict(input.embeddingMagnitude, input.settings.maxEmbeddingMagnitude);
+		if (verdict !== null) {
+			this.deps.logger.info("face: dropping detail — raw embedding magnitude over bound", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					trackId: input.trackId,
+					magnitude: Number(verdict.magnitude.toFixed(3)),
+					bound: verdict.bound,
+					score: input.score,
+					...input.nativeFaceShortSidePx !== void 0 ? { nativeFaceShortSidePx: input.nativeFaceShortSidePx } : {}
+				}
+			});
+			return;
+		}
+		this.logEmbeddingMagnitude(input);
 		const modelId = this.gallery[0]?.modelId ?? FALLBACK_FACE_MODEL_ID;
 		const candidate = {
 			trackId: input.trackId,
@@ -34319,6 +34580,30 @@ var FaceRecognizer = class {
 			...input.frameHandle !== void 0 ? { frameHandle: input.frameHandle } : {}
 		});
 	}
+	/**
+	* At most one magnitude line per device per
+	* {@link FACE_MAGNITUDE_LOG_THROTTLE_MS}. This is the ONLY way the operator
+	* can see where this cluster's usable and degenerate face populations sit, so
+	* it must exist before `maxEmbeddingMagnitude` can honestly be turned on.
+	*/
+	logEmbeddingMagnitude(input) {
+		const magnitude = input.embeddingMagnitude;
+		if (magnitude === void 0 || !Number.isFinite(magnitude)) return;
+		const now = Date.now();
+		if (now - (this.lastMagnitudeLogAt.get(input.deviceId) ?? 0) < FACE_MAGNITUDE_LOG_THROTTLE_MS) return;
+		this.lastMagnitudeLogAt.set(input.deviceId, now);
+		this.deps.logger.info("face: embedding magnitude", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				trackId: input.trackId,
+				magnitude: Number(magnitude.toFixed(3)),
+				bound: input.settings.maxEmbeddingMagnitude,
+				score: input.score,
+				detectionFrameShortSidePx: input.faceBbox !== void 0 ? Math.round(Math.min(input.faceBbox.w, input.faceBbox.h)) : 0,
+				...input.nativeFaceShortSidePx !== void 0 ? { nativeFaceShortSidePx: Math.round(input.nativeFaceShortSidePx) } : {}
+			}
+		});
+	}
 	async processFrame(input) {
 		const { settings } = input;
 		const candidates = input.tracked.filter((t) => Array.isArray(t.embedding) && t.embedding.length > 0 && typeof t.embeddingModelId === "string" && t.confidence >= settings.minFaceConfidence && (t.nativeFaceShortSidePx ?? (t.faceBbox ? Math.min(t.faceBbox.w, t.faceBbox.h) : void 0) ?? Number.POSITIVE_INFINITY) >= settings.minFacePx);
@@ -34380,7 +34665,8 @@ var FaceRecognizer = class {
 			}
 			const recognizedIdentityId = state.assignedIdentityId ?? void 0;
 			const held = this.bestFace.get(c.trackId);
-			const isNewBest = this.bestTracker.observe(c.trackId, c.confidence, input.timestamp);
+			const detectionFrameShortSidePx = c.faceBbox !== void 0 ? Math.min(c.faceBbox.w, c.faceBbox.h) : 0;
+			const isNewBest = this.bestTracker.observe(c.trackId, c.confidence, input.timestamp, void 0, void 0, void 0, faceSizeScore(detectionFrameShortSidePx));
 			const needsCrop = held !== void 0 && held.crop === void 0;
 			if (isNewBest || needsCrop) {
 				const cropBbox = c.faceBbox ?? c.bbox;
@@ -34640,14 +34926,38 @@ var FaceSettingsSchema = object({
 	* stripped from the per-device schema).
 	*/
 	enabled: boolean().default(true),
-	/** Cosine similarity (on L2-normalized arcface vectors) required to match.
-	*  Raised 0.55→0.62 (2026-07-23 face-quality batch): 0.55 was implausibly
-	*  loose against thin/low-quality galleries and produced ~25-40% visually
-	*  wrong auto-assignments in the 12h audit. */
-	similarityThreshold: number().min(0).max(1).default(.62),
-	/** Reject ambiguous matches: require best − secondBest ≥ margin. Raised
-	*  0.10→0.15 (2026-07-23 face-quality batch) to widen the confusion gap. */
-	margin: number().min(0).max(1).default(.15),
+	/**
+	* Cosine similarity (on L2-normalized arcface vectors) required to match.
+	*
+	* History: 0.55→0.62 on 2026-07-23, then back to 0.55 on 2026-08-18 once the
+	* dead `assignUniquePerFrame` margin and the poisoned gallery were fixed —
+	* with both repaired, genuine probes scored median 0.38 / p90 0.51, so 0.62
+	* left almost nothing recognisable. That retune lived only as a RUNTIME
+	* override until 2026-08-19; it is the schema default now, because a default
+	* nobody runs is a decision nobody made.
+	*
+	* ⚠ NOT the end state. 0.55 is the least-bad value for the CURRENT crop
+	* quality, where most of what reaches ArcFace is not a correctly aligned
+	* face (measured 2026-08-19 over 60 live crops pulled from the hub: 20%
+	* aligned, 18% marginal, 62% misaligned or containing no detectable face).
+	* On correctly aligned crops the SAME models separate at a far lower
+	* operating point — 300 LFW pairs gave genuine median 0.605 / impostor p90
+	* 0.175, best accuracy 98.3% at threshold 0.28.
+	*
+	* Recalibration plan, in this order:
+	*   1. land the landmark-precision gate (the alignment fix),
+	*   2. re-enrol the gallery from crops produced AFTER it,
+	*   3. re-measure genuine/impostor over a week of post-fix traffic,
+	*   4. expect to lower this toward ~0.30, and `margin` with it.
+	* Lowering it BEFORE step 1 would be actively harmful: a misaligned crop
+	* scores ~0.9 against everything, so the degenerate population sits ABOVE
+	* any threshold you could pick — the knob cannot reach it.
+	*/
+	similarityThreshold: number().min(0).max(1).default(.55),
+	/** Reject ambiguous matches: require best − secondBest ≥ margin. 0.10→0.15
+	*  (2026-07-23), then →0.12 (2026-08-18) alongside the threshold retune —
+	*  same story and the same recalibration plan as {@link similarityThreshold}. */
+	margin: number().min(0).max(1).default(.12),
 	/** Minimum face-detection confidence for a face to be considered. */
 	minFaceConfidence: number().min(0).max(1).default(.5),
 	/**
@@ -34691,6 +35001,33 @@ var FaceSettingsSchema = object({
 	*  1 (0 confirmations would assign on a single noisy frame — nonsensical;
 	*  such a value falls back to the default). */
 	confirmFrames: number().int().min(1).default(3),
+	/**
+	* Upper bound on the RAW ArcFace feature magnitude a face may have and still
+	* be embedded into the buffer / matched / enrolled. `0` (the default) DISABLES
+	* the gate.
+	*
+	* This exists because a degenerate crop does not score LOW, it scores HIGH:
+	* measured on this cluster 2026-08-18/19, 28.8% of all pairs of DIFFERENT
+	* faces exceeded cosine 0.90 and the worst 40% of the face population had
+	* collapsed onto effectively one vector (mean pairwise cosine 0.976). No
+	* similarity threshold can reach that — it sits above every threshold — so the
+	* only defence is to refuse the embedding before it is stored or compared.
+	*
+	* Direction: for this model the DEGENERATE crops carry the LARGER norm (the
+	* inverse of the MagFace convention), hence a maximum. Over 140 LFW faces
+	* through this exact model and preprocessing, usable crops sat at ≈4.4 (p95
+	* 5.25) regardless of size, grey level or blur, while information-free crops
+	* jumped to 10–16; a bound of 6.0 kept 97.6% of usable crops and rejected
+	* 93.2% of degenerate ones.
+	*
+	* Default 0 ON PURPOSE. Those numbers are LFW's, not this cluster's, and the
+	* magnitude has never been observable here — `result-assembler` discarded it
+	* one line after computing it. The field and its logging ship first; set a
+	* real bound once a week of live `face: embedding magnitude` lines says where
+	* this cluster's populations actually sit. Enabling a gate against a number
+	* nobody has measured in production is how recognition silently stops.
+	*/
+	maxEmbeddingMagnitude: number().min(0).default(0),
 	/** Max buffered faces kept per device. */
 	bufferMaxPerDevice: number().int().min(0).default(50)
 });
@@ -34709,6 +35046,7 @@ function resolveFaceSettings(raw) {
 		recognitionMinFacePx: pick("recognitionMinFacePx"),
 		suggestionMinCosine: pick("suggestionMinCosine"),
 		minIdentitySamples: pick("minIdentitySamples"),
+		maxEmbeddingMagnitude: pick("maxEmbeddingMagnitude"),
 		confirmFrames: pick("confirmFrames"),
 		bufferMaxPerDevice: pick("bufferMaxPerDevice")
 	};
@@ -39180,6 +39518,147 @@ async function applyTrackFlags(deps, input) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/plate-vote.ts
+/**
+* Per-character VOTE over a track's plate reads.
+*
+* A track produces up to `plate-ocr`'s `cadence.maxPerTrack` reads of the SAME
+* physical plate, from different frames. The recognizer used to keep the single
+* read with the highest OCR score (`holdBest`, argmax) — and OCR score does not
+* correlate with correctness. In the 2026-08 audit the top-scoring read of a
+* track was routinely the wrong one while two lower-scoring reads agreed on the
+* right glyph: score ranks how confident the recognizer was about the pixels it
+* saw, not how much of the plate those pixels were.
+*
+* So the reads vote. Each read is normalized (upper, alnum only), aligned to a
+* reference read, and contributes its OCR score to whichever glyph it saw at
+* each reference position; the winner per position is the output. Two reads
+* that agree beat one confident read that disagrees, which is the whole point.
+*
+* ALIGNMENT — reads differ in length (4–9 glyphs live: a dropped leading
+* district letter, a hallucinated trailing glyph). A positional vote on raw
+* indices would let one missing character shift every later column and destroy
+* the agreement it was supposed to measure. Each read is therefore aligned to
+* the reference by Levenshtein traceback: a match or substitution votes at the
+* reference position it aligned to, an insertion votes nowhere, and a deletion
+* simply abstains at that position.
+*
+* REFERENCE — the length carrying the most SCORE MASS wins (a hallucinated
+* 9-glyph read does not get to set the output length just by being longest);
+* ties inside that length go to the highest-scoring read. With ≤5 reads this is
+* the honest cheap heuristic: there is no third source of truth to consult.
+*/
+/**
+* Align `candidate` to `reference` by Levenshtein traceback. Returns one entry
+* per REFERENCE position: the candidate glyph that aligned there, or `null`
+* when the candidate had nothing at that position (a deletion). Candidate
+* insertions are dropped — they have no reference column to vote in.
+*/
+function alignToReference(reference, candidate) {
+	const n = reference.length;
+	const m = candidate.length;
+	const dist = [];
+	for (let i = 0; i <= n; i++) {
+		const row = new Array(m + 1).fill(0);
+		row[0] = i;
+		dist.push(row);
+	}
+	const first = dist[0];
+	if (first === void 0) return [];
+	for (let j = 0; j <= m; j++) first[j] = j;
+	for (let i = 1; i <= n; i++) {
+		const prev = dist[i - 1];
+		const cur = dist[i];
+		if (prev === void 0 || cur === void 0) continue;
+		for (let j = 1; j <= m; j++) {
+			const cost = reference[i - 1] === candidate[j - 1] ? 0 : 1;
+			cur[j] = Math.min((prev[j] ?? 0) + 1, (cur[j - 1] ?? 0) + 1, (prev[j - 1] ?? 0) + cost);
+		}
+	}
+	const aligned = new Array(n).fill(null);
+	let i = n;
+	let j = m;
+	while (i > 0 && j > 0) {
+		const cur = dist[i];
+		const prev = dist[i - 1];
+		if (cur === void 0 || prev === void 0) break;
+		const cost = reference[i - 1] === candidate[j - 1] ? 0 : 1;
+		if (cur[j] === (prev[j - 1] ?? 0) + cost) {
+			aligned[i - 1] = candidate[j - 1] ?? null;
+			i--;
+			j--;
+		} else if (cur[j] === (prev[j] ?? 0) + 1) i--;
+		else j--;
+	}
+	return aligned;
+}
+/** The read whose LENGTH carries the most score mass; ties → highest score. */
+function pickReference(reads) {
+	const massByLength = /* @__PURE__ */ new Map();
+	for (const r of reads) massByLength.set(r.text.length, (massByLength.get(r.text.length) ?? 0) + r.score);
+	let bestLength = 0;
+	let bestMass = -1;
+	for (const [length, mass] of massByLength) if (mass > bestMass || mass === bestMass && length < bestLength) {
+		bestMass = mass;
+		bestLength = length;
+	}
+	let reference = "";
+	let referenceScore = -1;
+	for (const r of reads) if (r.text.length === bestLength && r.score > referenceScore) {
+		referenceScore = r.score;
+		reference = r.text;
+	}
+	return reference;
+}
+/**
+* Confidence-weighted per-character vote over a track's plate reads. Returns
+* the normalized winning text (`''` when there is nothing to vote on).
+*/
+function votePlateText(reads) {
+	const normalized = [];
+	for (const r of reads) {
+		const text = normalizePlate(r.text);
+		if (text.length > 0) normalized.push({
+			text,
+			score: r.score
+		});
+	}
+	if (normalized.length === 0) return "";
+	const only = normalized[0];
+	if (normalized.length === 1 && only !== void 0) return only.text;
+	const reference = pickReference(normalized);
+	if (reference.length === 0) return "";
+	const columns = [];
+	for (let i = 0; i < reference.length; i++) columns.push(/* @__PURE__ */ new Map());
+	for (const r of normalized) {
+		const aligned = r.text === reference ? [...r.text] : alignToReference(reference, r.text);
+		for (let i = 0; i < reference.length; i++) {
+			const glyph = aligned[i];
+			if (glyph === null || glyph === void 0) continue;
+			const column = columns[i];
+			if (column === void 0) continue;
+			column.set(glyph, (column.get(glyph) ?? 0) + r.score);
+		}
+	}
+	let out = "";
+	for (let i = 0; i < reference.length; i++) {
+		const column = columns[i];
+		const referenceGlyph = reference[i] ?? "";
+		if (column === void 0 || column.size === 0) {
+			out += referenceGlyph;
+			continue;
+		}
+		let bestGlyph = referenceGlyph;
+		let bestMass = column.get(referenceGlyph) ?? -1;
+		for (const [glyph, mass] of column) if (mass > bestMass) {
+			bestMass = mass;
+			bestGlyph = glyph;
+		}
+		out += bestGlyph;
+	}
+	return out;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/plate-matcher.ts
 /**
 * plate-matcher — name a plate read against the vehicle gallery by text vicinity.
@@ -39228,11 +39707,11 @@ function matchPlateText(probe, gallery, opts) {
 //#endregion
 //#region src/pipeline-analytics/plate-recognizer.ts
 /**
-* PlateRecognizer — buffers the best license-plate OCR read per vehicle track
-* for the plate gallery. Unlike faces there is NO gallery matching: the OCR text
-* IS the label and already rides on the event via the detection pipeline. This
-* only collects per-track reads (+ a tight plate crop) so the gallery can group,
-* review and search them. Mirrors FaceRecognizer's hold→onTrackEnd lifecycle.
+* PlateRecognizer — collects EVERY license-plate OCR read a vehicle track
+* produces and stores their per-character VOTE (`plate-vote.ts`) at close, plus
+* the max-score read's crop for the gallery tile. Unlike faces there is NO
+* gallery matching: the OCR text IS the label and already rides on the event via
+* the detection pipeline. Mirrors FaceRecognizer's hold→onTrackEnd lifecycle.
 */
 var PlateRecognizer = class {
 	deps;
@@ -39295,7 +39774,7 @@ var PlateRecognizer = class {
 		const minConfidence = input.minConfidence ?? 0;
 		const candidates = input.tracked.filter((t) => typeof t.plateText === "string" && t.plateText.length > 0 && typeof t.plateScore === "number" && t.plateScore >= minConfidence && t.plateBbox !== void 0);
 		if (candidates.length === 0) return;
-		for (const c of candidates) await this.holdBest({
+		for (const c of candidates) await this.observeRead({
 			deviceId: input.deviceId,
 			trackId: c.trackId,
 			text: c.plateText,
@@ -39318,15 +39797,50 @@ var PlateRecognizer = class {
 	* gallery stays empty (0 plateCrop) — the observed live gap.
 	*/
 	async observePlateRead(input) {
-		if (!isPlausiblePlateRead(input.text, input.score)) return;
-		if (input.score < (input.minConfidence ?? 0)) return;
-		await this.holdBest(input);
+		const minConfidence = input.minConfidence ?? 0;
+		const reason = !isPlausiblePlateRead(input.text, input.score) ? "implausible" : input.score < minConfidence ? "below-min-confidence" : null;
+		if (reason !== null) {
+			this.deps.logger.info("plate: read discarded", {
+				tags: {
+					deviceId: input.deviceId,
+					trackId: input.trackId
+				},
+				meta: {
+					text: input.text,
+					score: input.score,
+					minConfidence,
+					reason
+				}
+			});
+			return;
+		}
+		await this.observeRead(input);
 	}
-	/** Hold the highest-scoring plate read per track, capturing a tight crop the
-	*  first time a new best is seen (shared by the per-frame + detail-plane paths). */
-	async holdBest(input) {
+	/**
+	* Record one plate read for a track (shared by the per-frame + detail-plane
+	* paths).
+	*
+	* EVERY read is kept for the close-time vote — a track's reads disagree, and
+	* the disagreement is the signal. The crop + geometry still track the
+	* MAX-SCORE read: the vote decides the text, but the picture the operator
+	* reviews should be the sharpest frame the track produced.
+	*
+	* The read list is capped at {@link MAX_VOTING_READS} in ARRIVAL order, not
+	* by score: evicting the lowest-scoring read would re-introduce the very
+	* ranking this vote exists to stop trusting.
+	*/
+	async observeRead(input) {
 		const held = this.bestPlate.get(input.trackId);
-		if (held !== void 0 && input.score <= held.score) return;
+		const vote = {
+			text: input.text,
+			score: input.score
+		};
+		if (held !== void 0 && input.score <= held.score) {
+			if (held.reads.length < 5) held.reads.push(vote);
+			return;
+		}
+		const reads = held?.reads ?? [];
+		if (reads.length < 5) reads.push(vote);
 		let crop;
 		if (input.frameHandle !== void 0) try {
 			crop = await this.deps.captureCrop(input.frameHandle, input.bbox, input.frameWidth, input.frameHeight, input.cropPadding, input.trackId, input.deviceId) ?? void 0;
@@ -39342,6 +39856,7 @@ var PlateRecognizer = class {
 		this.bestPlate.set(input.trackId, {
 			text: input.text,
 			score: input.score,
+			reads,
 			bbox: input.bbox,
 			timestamp: input.timestamp,
 			frameWidth: input.frameWidth,
@@ -39418,14 +39933,16 @@ var PlateRecognizer = class {
 				}
 			});
 		}
-		const match = this.matchVehicle(held.text, held.score);
+		const voted = votePlateText(held.reads);
+		const text = voted.length > 0 && isPlausiblePlateRead(voted, held.score) ? voted : normalizePlate(held.text);
+		const match = this.matchVehicle(text, held.score);
 		try {
 			await this.deps.plateStore.insert({
 				id: plateId,
 				deviceId,
 				trackId,
 				timestamp: held.timestamp,
-				text: normalizePlate(held.text),
+				text,
 				score: held.score,
 				...mediaKey !== void 0 ? { mediaKey } : {},
 				corrected: false,
@@ -39446,7 +39963,10 @@ var PlateRecognizer = class {
 				},
 				meta: {
 					plateId,
-					text: normalizePlate(held.text),
+					text,
+					bestRead: normalizePlate(held.text),
+					reads: held.reads.map((r) => `${normalizePlate(r.text)}@${r.score.toFixed(2)}`),
+					votedFromReads: held.reads.length,
 					score: held.score,
 					hasCrop: mediaKey !== void 0,
 					recognizedVehicleId: match?.vehicleId ?? null
@@ -39960,6 +40480,129 @@ function buildRecordedStillPorts(input) {
 		})
 	};
 }
+/** Where the completion marker lives. */
+var MIGRATION_MARKER_COLLECTION = "pipeline-analytics:migrations";
+var MIGRATION_MARKER_KEY = "label-tier-4g";
+/**
+* The decision for ONE row, exposed so the rule is testable without a store.
+*
+* `null` = leave the row alone.
+*/
+function decideRowMigration(data, now) {
+	const label = data["label"];
+	if (typeof label !== "string" || label.length === 0) return null;
+	if (typeof data["subLabel"] === "string" && data["subLabel"].length > 0) return null;
+	if (data["labelMeta"] !== null && data["labelMeta"] !== void 0) return null;
+	if (isMacroClass(label)) return {
+		label: null,
+		labelScore: null,
+		labelMeta: null
+	};
+	return {
+		label: null,
+		labelScore: null,
+		labelMeta: null,
+		subLabel: label,
+		subLabelScore: null,
+		subLabelMeta: {
+			stepId: MIGRATION_STEP_ID,
+			decidedAt: now
+		}
+	};
+}
+/** Migrate one collection, paged and bounded. */
+async function migrateCollectionLabelTiers(deps, collection) {
+	let scanned = 0;
+	let demoted = 0;
+	let cleared = 0;
+	let skipped = 0;
+	let offset = 0;
+	let truncated = false;
+	for (;;) {
+		if (scanned >= 2e5) {
+			truncated = true;
+			break;
+		}
+		const rows = await deps.store.query.query({
+			collection,
+			filter: {
+				limit: 500,
+				offset
+			}
+		});
+		if (rows.length === 0) break;
+		for (const row of rows) {
+			scanned++;
+			const patch = decideRowMigration(row.data, deps.now());
+			if (patch === null) {
+				skipped++;
+				continue;
+			}
+			try {
+				await deps.store.update.mutate({
+					collection,
+					id: row.id,
+					data: patch
+				});
+				if (patch["subLabel"] === void 0) cleared++;
+				else demoted++;
+			} catch (err) {
+				deps.logger.warn("label tier migration row failed", { meta: {
+					collection,
+					id: row.id,
+					error: String(err)
+				} });
+				skipped++;
+			}
+		}
+		if (rows.length < 500) break;
+		offset += rows.length;
+	}
+	return {
+		collection,
+		scanned,
+		demoted,
+		cleared,
+		skipped,
+		truncated
+	};
+}
+/**
+* Run the migration across the collections that carry the tiered columns, once.
+*
+* The marker short-circuits a completed migration; it is written only when
+* NEITHER collection was truncated, so an interrupted pass resumes on the next
+* boot instead of declaring itself done.
+*/
+async function runLabelTierMigration(deps, collections) {
+	try {
+		const marker = await deps.store.get.query({
+			collection: MIGRATION_MARKER_COLLECTION,
+			key: MIGRATION_MARKER_KEY
+		});
+		if (marker !== null && marker !== void 0) return [];
+	} catch {}
+	const stats = [];
+	for (const collection of collections) stats.push(await migrateCollectionLabelTiers(deps, collection));
+	if (stats.every((s) => !s.truncated)) try {
+		await deps.store.set.mutate({
+			collection: MIGRATION_MARKER_COLLECTION,
+			key: MIGRATION_MARKER_KEY,
+			value: { completedAt: deps.now() }
+		});
+	} catch (err) {
+		deps.logger.warn("label tier migration marker failed", { meta: { error: String(err) } });
+	}
+	for (const s of stats) deps.logger.info("label tier migration", { meta: {
+		collection: s.collection,
+		scanned: s.scanned,
+		demoted: s.demoted,
+		cleared: s.cleared,
+		skipped: s.skipped,
+		truncated: s.truncated
+	} });
+	return stats;
+}
 //#endregion
 //#region src/durable/lts-aggregator.ts
 /** Wall-clock bucket width. Five minutes, matching HA's statistics tier. */
@@ -45151,6 +45794,55 @@ var ANALYTICS_COLLECTIONS = [
 			why: "a five-minute statistics row summarises an INTERVAL, not an entity — there is no owner it can be orphaned from. Its bound is a ROW CAP per (subject, series, scope) enforced by the aggregator itself (105,120 rows ≈ one year), deliberately not an age sweep: D61 collapsed ten disagreeing age clocks into one, and an LTS series has no clock but its own."
 		}
 	},
+	{
+		collection: RETRAIN_ANNOTATIONS_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "the ground truth an operator DREW. It declares `trackId` and must be classified by hand for that reason: the id is provenance, not ownership. The dataset addresses COPIES (D81), which is precisely what makes a 'trained' track evictable again — so a track ageing out leaves the annotations standing. Rows go only through `deleteForFrame`, when the operator deselects the frame. Deleting one because its track expired would destroy labelling work no sweep can recreate."
+		}
+	},
+	{
+		collection: RETRAIN_FRAMES_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "the frame COPIES the dataset owns outright, under a `retrain` prefix no owner cascade and no age sweep walks (D81). Also declares `trackId` as provenance. Rows go only through `deleteFrame`, after their annotations, on operator deselection. NOTE: nothing caps this table or the disk it consumes — that is a deliberate decision, not an oversight, and it is the one collection here whose bound is an operator's habit."
+		}
+	},
+	{
+		collection: SCENE_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "operator intent — one row per (deviceId, monitorId), created and destroyed by scene CRUD or by a device-removal sweep. Nothing retention does can orphan it, and no age clock applies: a scene the operator configured and never revisits is not stale, it is configured."
+		}
+	},
+	{
+		collection: SCENE_LATCH_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "it IS owned — by the scene set — but the owner-cleanup is self-contained: `pruneExcept(the scene set)` runs on every scene reload, so a latch whose scene is gone is collected there and never by retention. Deliberately NOT `owner-indirection`: that kind puts a collection into `auditableCollections()`, and the orphan audit resolves exactly one indirection, that of `pipeline-analytics:media`."
+		}
+	},
+	{
+		collection: MIGRATION_MARKER_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "a one-row completion marker for the label-tier 4g pass. It summarises a one-time event, so there is no entity it can be orphaned from — and its PRESENCE is what stops the migration running again, so deleting it is not cleanup, it is a re-run over every track, face and object-event row."
+		}
+	},
+	{
+		collection: VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "a hub user's named snapshot of their own viewer layout. It is not analytics data — it happens to live in this addon because the actions ride `addons.custom`. Owned by the user who saved it and deleted only by them; no track, device or event can orphan it, and no age applies."
+		}
+	},
+	{
+		collection: LEGACY_VIEWER_SETTINGS_SNAPSHOTS_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "the drained predecessor of the row above, declared only so its rows can be read once and moved (`viewer-settings-legacy-adoption.ts`). Retention must never touch it: its rows go one way only, to the successor, gated on a re-read that confirms they landed. Delete this entry together with that module."
+		}
+	},
 	{
 		collection: STATIONARY_COLLECTION,
 		classification: {
@@ -49627,7 +50319,7 @@ function buildGlobalSettingsSchema() {
 					type: "boolean",
 					key: "audioEpisodeEnabled",
 					label: "Create audio episodes",
-					description: "When off, classified audio still notifies from other paths but does not open a synthetic track or coalesce classification events.",
+					description: "Off switches off the GROUPING only: classified audio still persists an event and still notifies, but no timeline track is opened and a long sound is no longer collapsed into one episode (one event per class change, then one every 5 s while it lasts).",
 					default: AUDIO_DETECTION_DEFAULTS.audioEpisodeEnabled
 				},
 				{
@@ -49753,6 +50445,15 @@ function buildGlobalSettingsSchema() {
 					step: 1,
 					default: FACE_DEFAULTS.confirmFrames
 				},
+				{
+					type: "number",
+					key: "maxEmbeddingMagnitude",
+					label: "Max embedding magnitude (0 = off)",
+					description: "Refuse a face whose RAW ArcFace feature magnitude exceeds this, before it is buffered, matched or enrolled. A degenerate crop does not score LOW against the gallery — it scores HIGH against everything — so no similarity threshold can catch it; the raw magnitude can. On this model a usable face sits around 4.4 whatever its size, grey level or blur, while an information-free crop jumps to 10–16. Leave at 0 until the \"face: embedding magnitude\" log lines show where YOUR cameras sit; a bound guessed from someone else's data silently stops recognising everybody.",
+					min: 0,
+					step: .5,
+					default: FACE_DEFAULTS.maxEmbeddingMagnitude
+				},
 				{
 					type: "number",
 					key: "bufferMaxPerDevice",
@@ -49830,129 +50531,6 @@ function evaluatePeriodicSnapshot(input) {
 		movedFraction
 	};
 }
-/** Where the completion marker lives. */
-var MIGRATION_MARKER_COLLECTION = "pipeline-analytics:migrations";
-var MIGRATION_MARKER_KEY = "label-tier-4g";
-/**
-* The decision for ONE row, exposed so the rule is testable without a store.
-*
-* `null` = leave the row alone.
-*/
-function decideRowMigration(data, now) {
-	const label = data["label"];
-	if (typeof label !== "string" || label.length === 0) return null;
-	if (typeof data["subLabel"] === "string" && data["subLabel"].length > 0) return null;
-	if (data["labelMeta"] !== null && data["labelMeta"] !== void 0) return null;
-	if (isMacroClass(label)) return {
-		label: null,
-		labelScore: null,
-		labelMeta: null
-	};
-	return {
-		label: null,
-		labelScore: null,
-		labelMeta: null,
-		subLabel: label,
-		subLabelScore: null,
-		subLabelMeta: {
-			stepId: MIGRATION_STEP_ID,
-			decidedAt: now
-		}
-	};
-}
-/** Migrate one collection, paged and bounded. */
-async function migrateCollectionLabelTiers(deps, collection) {
-	let scanned = 0;
-	let demoted = 0;
-	let cleared = 0;
-	let skipped = 0;
-	let offset = 0;
-	let truncated = false;
-	for (;;) {
-		if (scanned >= 2e5) {
-			truncated = true;
-			break;
-		}
-		const rows = await deps.store.query.query({
-			collection,
-			filter: {
-				limit: 500,
-				offset
-			}
-		});
-		if (rows.length === 0) break;
-		for (const row of rows) {
-			scanned++;
-			const patch = decideRowMigration(row.data, deps.now());
-			if (patch === null) {
-				skipped++;
-				continue;
-			}
-			try {
-				await deps.store.update.mutate({
-					collection,
-					id: row.id,
-					data: patch
-				});
-				if (patch["subLabel"] === void 0) cleared++;
-				else demoted++;
-			} catch (err) {
-				deps.logger.warn("label tier migration row failed", { meta: {
-					collection,
-					id: row.id,
-					error: String(err)
-				} });
-				skipped++;
-			}
-		}
-		if (rows.length < 500) break;
-		offset += rows.length;
-	}
-	return {
-		collection,
-		scanned,
-		demoted,
-		cleared,
-		skipped,
-		truncated
-	};
-}
-/**
-* Run the migration across the collections that carry the tiered columns, once.
-*
-* The marker short-circuits a completed migration; it is written only when
-* NEITHER collection was truncated, so an interrupted pass resumes on the next
-* boot instead of declaring itself done.
-*/
-async function runLabelTierMigration(deps, collections) {
-	try {
-		const marker = await deps.store.get.query({
-			collection: MIGRATION_MARKER_COLLECTION,
-			key: MIGRATION_MARKER_KEY
-		});
-		if (marker !== null && marker !== void 0) return [];
-	} catch {}
-	const stats = [];
-	for (const collection of collections) stats.push(await migrateCollectionLabelTiers(deps, collection));
-	if (stats.every((s) => !s.truncated)) try {
-		await deps.store.set.mutate({
-			collection: MIGRATION_MARKER_COLLECTION,
-			key: MIGRATION_MARKER_KEY,
-			value: { completedAt: deps.now() }
-		});
-	} catch (err) {
-		deps.logger.warn("label tier migration marker failed", { meta: { error: String(err) } });
-	}
-	for (const s of stats) deps.logger.info("label tier migration", { meta: {
-		collection: s.collection,
-		scanned: s.scanned,
-		demoted: s.demoted,
-		cleared: s.cleared,
-		skipped: s.skipped,
-		truncated: s.truncated
-	} });
-	return stats;
-}
 //#endregion
 //#region src/pipeline-analytics/store/object-embedding-store.ts
 /**
@@ -51256,6 +51834,16 @@ var OVERLAY_SYNTHESIS_WARN_THROTTLE_MS = 6e4;
 var AUDIO_EPISODE_VISUAL_QUIET_MS = 2e3;
 /** Persist lastSeen on an open synthetic audio track at most this often. */
 var AUDIO_EPISODE_PERSIST_MS = 2e3;
+/**
+* Coalescing window for classified audio inserts when episodes are OFF.
+*
+* With `audioEpisodeEnabled: false` there is no hysteresis to collapse a sound
+* into one row, but the classifier still fires at ~30 Hz — so the pre-episode
+* rule applies again: while the SAME class persists, one row per heartbeat;
+* a class change inserts immediately. The knob turns off the grouping, never
+* the persistence (D62).
+*/
+var AUDIO_EVENT_HEARTBEAT_MS = 5e3;
 var MOTION_EVENT_HEARTBEAT_MS = 5e3;
 /**
 * Stored media kinds that carry NO drawn bounding box, in fallback preference
@@ -52364,6 +52952,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			ViewerSettingsSnapshotStore.declare(api.settingsStore)
 		]);
 		this.viewerSettingsSnapshots = new ViewerSettingsSnapshotStore(api.settingsStore);
+		try {
+			await adoptLegacyViewerSettingsSnapshots({
+				store: api.settingsStore,
+				logger: this.ctx.logger.child("viewer-settings")
+			});
+		} catch (err) {
+			this.ctx.logger.warn("viewer-settings legacy adoption threw", { meta: { error: errMsg(err) } });
+		}
 		runLabelTierMigration({
 			store: api.settingsStore,
 			logger: this.ctx.logger,
@@ -55103,6 +55699,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			frameHeight: frame.frameHeight,
 			score: detail.score,
 			embedding: decodeEmbeddingBase64(detail.embedding),
+			...detail.embeddingMagnitude !== void 0 ? { embeddingMagnitude: detail.embeddingMagnitude } : {},
 			parentBbox: { ...frame.bbox },
 			...detail.bbox !== void 0 ? { faceBbox: { ...detail.bbox } } : {},
 			...detail.nativeFaceShortSidePx !== void 0 ? { nativeFaceShortSidePx: detail.nativeFaceShortSidePx } : {},
@@ -55570,7 +56167,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				return;
 		}
 	}
-	async openAudioEpisode(input, ref) {
+	/**
+	* The ONE writer for a classified audio observation: the durable row, the
+	* Notification Center hook fired in the same persist moment (D-2), the
+	* track-level `audioLabels` stamp, and the telemetry event.
+	*
+	* Shared by both routes on purpose. `audioEpisodeEnabled` selects WHEN this
+	* runs (once per episode, or once per heartbeat), never WHETHER — a knob
+	* that names the grouping must not be able to silence the classified path
+	* (D62). This body was inlined in `openAudioEpisode` and the knob-off camera
+	* therefore persisted nothing at all.
+	*/
+	async persistClassifiedAudio(input) {
 		const ev = {
 			id: randomUUID(),
 			deviceId: input.deviceId,
@@ -55579,18 +56187,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			rms: input.rms,
 			dbfs: input.dbfs,
 			classification: {
-				className: ref.className,
+				className: input.className,
 				...input.originalClass !== void 0 ? { originalClass: input.originalClass } : {},
 				score: input.score
 			}
 		};
 		this.lastAudioInsertByDevice.set(input.deviceId, {
-			className: ref.className,
+			className: input.className,
 			atMs: input.timestamp
 		});
 		await this.eventStore.insertAudio(ev);
 		this.notificationCenter?.onAudioEventPersisted(ev);
-		this.trackStore?.addAudioLabelEpisode(input.deviceId, ref.className, input.score, input.timestamp);
+		this.trackStore?.addAudioLabelEpisode(input.deviceId, input.className, input.score, input.timestamp);
 		this.ctx.eventBus.emit({
 			id: `pa-${ev.id}`,
 			timestamp: new Date(ev.timestamp),
@@ -55607,6 +56215,25 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				timestamp: ev.timestamp
 			}
 		});
+	}
+	/**
+	* Classified audio with episodes OFF: persist on class change or heartbeat,
+	* and open NO synthetic track. This is the whole of what the knob switches —
+	* the timeline track and the episode coalescing — and it is what the form
+	* promises.
+	*/
+	async persistClassifiedAudioUngrouped(input) {
+		const last = this.lastAudioInsertByDevice.get(input.deviceId);
+		const sameClass = last?.className === input.className;
+		const heartbeatDue = last === void 0 || input.timestamp - last.atMs >= AUDIO_EVENT_HEARTBEAT_MS;
+		if (sameClass && !heartbeatDue) return;
+		await this.persistClassifiedAudio(input);
+	}
+	async openAudioEpisode(input, ref) {
+		await this.persistClassifiedAudio({
+			...input,
+			className: ref.className
+		});
 		if (this.hasLiveVisualTrack(input.deviceId, input.timestamp)) return;
 		const materializer = this.syntheticTracks;
 		if (materializer === null) return;
@@ -55718,19 +56345,26 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				});
 				return;
 			}
-			await this.driveAudioEpisode({
+			const classified = {
 				deviceId,
 				timestamp,
 				className: route.className,
 				score: topClassification.score,
-				originalClass: topClassification.debug?.originalClass,
+				...topClassification.debug?.originalClass !== void 0 ? { originalClass: topClassification.debug.originalClass } : {},
 				rms: level?.rms ?? 0,
-				dbfs: level?.dbfs ?? 0,
+				dbfs: level?.dbfs ?? 0
+			};
+			if (!settings.audioEpisodeEnabled) {
+				await this.persistClassifiedAudioUngrouped(classified);
+				return;
+			}
+			await this.driveAudioEpisode({
+				...classified,
 				knobs: this.audioEpisodeKnobs(settings)
 			});
 			return;
 		}
-		await this.driveAudioEpisode({
+		if (settings.audioEpisodeEnabled) await this.driveAudioEpisode({
 			deviceId,
 			timestamp,
 			className: null,