@camstack/addon-post-analysis 1.2.106 → 1.2.108

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as deriveRecordingMode, At as array, B as TimelapseRulePatchSchema, Bt as EventCategory, C as NcScheduleSchema, Ct as DeviceType, D as NcSystemEventKindSchema, Dt as nodePin, E as NcSnoozeSuppressedSchema, Et as isDeviceScopedCap, F as SCENE_DEFAULT_UNCOVERED_POLICY, Ft as object, G as alarmPanelCapability, H as TrackSourceSchema, I as SCENE_DIVERGED, It as partialRecord, J as audioModeOf, K as assertTimelapseCadences, L as SceneMonitorSchema, Lt as record, M as RetrainStatusSchema, Mt as discriminatedUnion, Nt as literal, O as NcTaxonomySchema, Ot as sleep, P as SCENE_DEFAULT_ANCHOR_THRESHOLD, Pt as number, Q as defineCustomActions, R as TIMELAPSE_DENSE_FLOOR_SEC, Rt as string, S as NcRuleTargetSchema, St as BaseAddon, T as NcSnoozeSchema, Tt as hydrateSchema, U as VISIT_MERGE_GAP_MS, V as TimelapseRuleSchema, W as addonWidgetsSourceCapability, X as cosineSimilarity$1, Y as buildEventKindDescriptor, Z as customAction, _ as NC_TAXONOMY, _t as systemEventFilterApplies, a as DETECTION_MACRO_CLASSES, at as isScheduleActive, b as NcRulePatchSchema, bt as zoneAnalyticsCapability, c as EVENT_KIND_BY_CAP, d as LabelAttributionSchema, dt as plateGalleryCapability, f as MACRO_LABELS, ft as readDeviceStateFrom, gt as subKindsOf, h as NC_DEFAULT_SNOOZE_MINUTES, ht as sceneMonitorCapability, it as isDetectionMacroClass, j as RECORDING_EXPORT_MAX_READ_BYTES, jt as boolean, k as OpsLogEntrySchema, kt as _enum, l as EVENT_PAD_MS, lt as pickClusterStepModels, m as NC_CONDITION_CATALOG, n as CLUSTER_MODEL_SCOPED_STEPS, nt as faceGalleryCapability, ot as kebabToCamel, p as NC_ALARM_SYSTEM_EVENT_KINDS, pt as readTimelapseGeneratedAt, q as audioMetricsCapability, r as DEFAULT_EVENT_COLOR, s as DeclaredDevices, st as notificationRulesCapability, t as BaseDevice, tt as encodeVectorBase64, u as FULL_IMAGE_BBOX, ut as pipelineAnalyticsCapability, v as NcConditionDescriptorSchema, vt as vectorDimFromBase64, w as NcSnoozeInputSchema, wt as createEvent, x as NcRuleSchema, xt as errMsg, y as NcRuleInputSchema, yt as videoclipsCapability, z as TimelapseRuleInputSchema, zt as unknown } from "../dist-DiU9qiuA.mjs";
+import { $ as deriveRecordingMode, At as array, B as TimelapseRulePatchSchema, Bt as EventCategory, C as NcScheduleSchema, Ct as DeviceType, D as NcSystemEventKindSchema, Dt as nodePin, E as NcSnoozeSuppressedSchema, Et as isDeviceScopedCap, F as SCENE_DEFAULT_UNCOVERED_POLICY, Ft as object, G as alarmPanelCapability, H as TrackSourceSchema, I as SCENE_DIVERGED, It as partialRecord, J as audioModeOf, K as assertTimelapseCadences, L as SceneMonitorSchema, Lt as record, M as RetrainStatusSchema, Mt as discriminatedUnion, Nt as literal, O as NcTaxonomySchema, Ot as sleep, P as SCENE_DEFAULT_ANCHOR_THRESHOLD, Pt as number, Q as defineCustomActions, R as TIMELAPSE_DENSE_FLOOR_SEC, Rt as string, S as NcRuleTargetSchema, St as BaseAddon, T as NcSnoozeSchema, Tt as hydrateSchema, U as VISIT_MERGE_GAP_MS, V as TimelapseRuleSchema, W as addonWidgetsSourceCapability, X as cosineSimilarity$1, Y as buildEventKindDescriptor, Z as customAction, _ as NC_TAXONOMY, _t as systemEventFilterApplies, a as DETECTION_MACRO_CLASSES, at as isScheduleActive, b as NcRulePatchSchema, bt as zoneAnalyticsCapability, c as EVENT_KIND_BY_CAP, d as LabelAttributionSchema, dt as plateGalleryCapability, f as MACRO_LABELS, ft as readDeviceStateFrom, gt as subKindsOf, h as NC_DEFAULT_SNOOZE_MINUTES, ht as sceneMonitorCapability, it as isDetectionMacroClass, j as RECORDING_EXPORT_MAX_READ_BYTES, jt as boolean, k as OpsLogEntrySchema, kt as _enum, l as EVENT_PAD_MS, lt as pickClusterStepModels, m as NC_CONDITION_CATALOG, n as CLUSTER_MODEL_SCOPED_STEPS, nt as faceGalleryCapability, ot as kebabToCamel, p as NC_ALARM_SYSTEM_EVENT_KINDS, pt as readTimelapseGeneratedAt, q as audioMetricsCapability, r as DEFAULT_EVENT_COLOR, s as DeclaredDevices, st as notificationRulesCapability, t as BaseDevice, tt as encodeVectorBase64, u as FULL_IMAGE_BBOX, ut as pipelineAnalyticsCapability, v as NcConditionDescriptorSchema, vt as vectorDimFromBase64, w as NcSnoozeInputSchema, wt as createEvent, x as NcRuleSchema, xt as errMsg, y as NcRuleInputSchema, yt as videoclipsCapability, z as TimelapseRuleInputSchema, zt as unknown } from "../dist-DFNQ5VB_.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -5567,279 +5567,6 @@ function observeLabel(deviceId, spec, sample, now) {
 		spec
 	};
 }
-/** JPEG quality for the downscaled full frame — matches the crop path. */
-var FULL_FRAME_QUALITY = 80;
-/**
-* Downscale an already-encoded JPEG full frame to FIT WITHIN
-* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
-* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
-* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
-* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
-* at night) is never stored or served — the privacy fix moved to CAPTURE time.
-*/
-async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
-	return sharp(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
-		fit: "inside",
-		withoutEnlargement: true
-	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
-}
-//#endregion
-//#region src/notification-center/still-shelf.ts
-/**
-* The still shelf — the PHOTOGRAPH a notification carries when nothing it can
-* name owns a frame.
-*
-* ## Why a trigger needs one at all
-*
-* The attachment ladder resolves media by OWNER, and most triggers have one: an
-* object or package event owns its crops, a closed track owns its best shot, a
-* doorbell press owns the marker track the same press projected
-* (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
-* counted (`chooseOccupancyMediaOwner`). Two triggers own nothing, and for the
-* same reason in both cases — the subject is an ABSENCE:
-*
-*  - an **audio** match: nothing was boxed, nothing was tracked, and —
-*    deliberately — nothing is persisted at all. A confirmed window is a claim
-*    about sound that has already stopped, and `event-intake.ts` states why
-*    replaying it later would be wrong.
-*  - an **occupancy** edge whose scope is EMPTY — "posto libero". The vehicle
-*    whose departure IS the news has left, so `chooseOccupancyMediaOwner` names
-*    nobody and the ladder logs `no still could be resolved … owners=[]`.
-*
-* So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
-* of the trigger. Not of the sound, not of the object that left — of what the
-* camera can see now that it happened. For a freed parking space that is
-* exactly the answer the operator wants: the space, empty.
-*
-* **One shelf, not two.** The mechanism is identical down to the reuse window,
-* and the only thing that differs between the two triggers is the GATE deciding
-* that a photograph is owed at all — which belongs at the trigger site, where
-* the rules are, and not here. A twin module would be a second derivation of
-* one thing. The trigger rides along as {@link NcStillTrigger} only so the logs
-* can say which absence they are about.
-*
-* ## Three properties, and each one is a decision
-*
-* **It is not a record.** The bytes live here, in RAM, under an owner id and a
-* TTL that covers the outbox's whole retry horizon — and nowhere else. The
-* alternative was the doorbell's: materialise a synthetic marker track through
-* `SyntheticTrackMaterializer` and let the notification name it. That would put
-* a durable Track on the camera's timeline for every confirmed window and every
-* emptied zone, feeding the digest's `listTracks`, retention, and the audio-
-* marker feature's own operator ceilings (`audio-marker-projector.ts` exists
-* precisely to bound how many audio markers a camera may emit). A notification
-* must not manufacture timeline history as a side effect of wanting a picture.
-*
-* **The capture STARTS immediately and is never awaited.** The subject is
-* transient — a scream is over before a snapshot round-trip completes, and a
-* freed space is about to be taken by the next car — so the fetch is kicked off
-* at the trigger, before the rule evaluation runs, and the owner id is minted
-* synchronously so the outbox row can name it. The bytes land while the row
-* waits in the queue, and the dispatcher's existing bounded still-wait (or the
-* pause its own footage render already costs) picks them up. A camera that
-* never answers costs the picture and never the notification.
-*
-* **Two triggers seconds apart share ONE capture.** A barking dog confirms
-* repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
-* rule's cooldown is its only brake, and the cooldown is applied AFTER this.
-* Without a reuse window this would photograph a camera at whatever rate the
-* sound happens to occur. Each trigger still gets its OWN owner id, so two
-* outbox rows are never mistaken for one subject; they merely point at the same
-* frame, which is the truth — the scene did not change in ten seconds. The
-* window is per CAMERA and trigger-agnostic for the same reason: a sound and an
-* emptied zone ten seconds apart are two claims about one scene.
-*
-* Nothing here is silent: a capture that lands and a camera that refuses each
-* emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
-* and 615 not" is the only form that question is ever asked in.
-*/
-/**
-* The owner-id namespace. It is what routes a lookup here instead of to the
-* media store, and it is the reason the dispatcher needs no audio or occupancy
-* branch — `getMediaForOwner` answers for all of them under one signature.
-*/
-var NC_STILL_SHELF_PREFIX = "nc-still:";
-/** True for an owner id this shelf minted. */
-function isStillShelfId(id) {
-	return id.startsWith(NC_STILL_SHELF_PREFIX);
-}
-/**
-* How long the bytes are held.
-*
-* The outbox retries 8 times with a 5 s → 300 s backoff, which tops out around
-* ten minutes; fifteen covers that with room for a slow drain. Past it the row
-* ships text-only, which is the correct degradation for a photograph of a scene
-* that is a quarter of an hour stale anyway.
-*/
-var NC_STILL_SHELF_TTL_MS = 15 * 6e4;
-/** A hanging snapshot cap must not pin a capture slot forever. */
-var SNAPSHOT_TIMEOUT_MS = 8e3;
-/**
-* Hard bound on held captures. Reached only if every camera on the hub triggers
-* one inside a single TTL; the oldest is dropped first, which costs a
-* fifteen-minute-old picture nobody is waiting for.
-*/
-var MAX_CAPTURES = 64;
-var NcStillShelf = class {
-	deps;
-	/** captureId → the photograph. */
-	captures = /* @__PURE__ */ new Map();
-	/** ownerId → captureId. Several owners may name one capture (the reuse window). */
-	owners = /* @__PURE__ */ new Map();
-	/** deviceId → its newest capture, for the reuse window. */
-	newest = /* @__PURE__ */ new Map();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Photograph `deviceId` for a trigger at `atMs`, and return the owner id the
-	* subject should name. SYNCHRONOUS by contract: the caller is on the trigger
-	* path and the outbox row is built from what this returns.
-	*/
-	capture(deviceId, atMs, trigger) {
-		const now = this.deps.now();
-		this.prune(now);
-		const ownerId = `${NC_STILL_SHELF_PREFIX}${randomUUID()}`;
-		const recent = this.newest.get(deviceId);
-		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
-			this.owners.set(ownerId, recent.captureId);
-			return ownerId;
-		}
-		const captureId = randomUUID();
-		this.captures.set(captureId, {
-			deviceId,
-			trigger,
-			startedAt: now,
-			expiresAt: now + NC_STILL_SHELF_TTL_MS,
-			files: []
-		});
-		this.newest.set(deviceId, {
-			captureId,
-			at: now
-		});
-		this.owners.set(ownerId, captureId);
-		this.fetch(captureId, deviceId, atMs, trigger);
-		return ownerId;
-	}
-	/**
-	* The media an owner id holds, or `undefined` when this shelf never minted
-	* it. An EMPTY array is a different answer: the capture exists and has not
-	* landed (or never will), which is exactly the case the dispatcher's bounded
-	* wait and its `no still could be resolved` line are for.
-	*/
-	get(ownerId) {
-		const captureId = this.owners.get(ownerId);
-		if (captureId === void 0) return void 0;
-		return this.captures.get(captureId)?.files ?? [];
-	}
-	/** Drop expired captures and the owners that named them. */
-	prune(now) {
-		for (const [captureId, held] of this.captures) {
-			if (held.expiresAt > now) continue;
-			this.captures.delete(captureId);
-			if (this.newest.get(held.deviceId)?.captureId === captureId) this.newest.delete(held.deviceId);
-		}
-		while (this.captures.size > MAX_CAPTURES) {
-			const oldest = this.captures.keys().next();
-			if (oldest.done === true) break;
-			const held = this.captures.get(oldest.value);
-			this.captures.delete(oldest.value);
-			if (held !== void 0 && this.newest.get(held.deviceId)?.captureId === oldest.value) this.newest.delete(held.deviceId);
-		}
-		for (const [ownerId, captureId] of this.owners) if (!this.captures.has(captureId)) this.owners.delete(ownerId);
-	}
-	/** Drop everything (shutdown). */
-	clear() {
-		this.captures.clear();
-		this.owners.clear();
-		this.newest.clear();
-	}
-	async fetch(captureId, deviceId, atMs, trigger) {
-		try {
-			const shot = await withTimeout$3(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
-			if (shot === null || shot.base64.length === 0) {
-				this.reportMiss(deviceId, trigger, "the camera returned no snapshot");
-				return;
-			}
-			const raw = Buffer.from(shot.base64, "base64");
-			let data = raw;
-			try {
-				data = await downscaleFullFrameJpeg(raw, 960, 540);
-			} catch {}
-			const held = this.captures.get(captureId);
-			if (held === void 0) return;
-			this.captures.set(captureId, {
-				...held,
-				files: stillShelfMedia(data, atMs)
-			});
-			this.deps.logger.info(`${trigger} still captured`, {
-				tags: { deviceId },
-				meta: {
-					trigger,
-					bytes: data.byteLength,
-					tookMs: this.deps.now() - held.startedAt
-				}
-			});
-		} catch (err) {
-			this.reportMiss(deviceId, trigger, err instanceof Error ? err.message : String(err));
-		}
-	}
-	/**
-	* A branch that drops work says so. This one costs the operator the picture
-	* on a notification they DID receive, so it is a warn and it carries the
-	* camera — the only key the question is ever asked with.
-	*/
-	reportMiss(deviceId, trigger, reason) {
-		this.deps.logger.warn(`the camera did not answer the ${trigger} still — this notification ships text-only`, {
-			tags: { deviceId },
-			meta: {
-				trigger,
-				reason
-			}
-		});
-	}
-};
-/**
-* The photograph, in the three kinds the CLEAN-SCENE ladders ask for.
-*
-* `keyFrameSmall` leads because it is the first rung of both `attach: 'best'`
-* and `attach: 'keyFrame'` on a track owner; `keyFrame` and `fullFrame` answer
-* `frame: 'full'` and `frame: 'boxed'`'s honest degrade. There is deliberately
-* no `crop` / `thumbnail`: nothing was boxed, so `frame: 'cropped'` resolves
-* NOTHING and the notification ships text-only with the ordinary line saying
-* so. Inventing a centre crop would answer a different question from the one
-* the operator asked.
-*/
-function stillShelfMedia(data, timestamp) {
-	const base64 = data.toString("base64");
-	const file = (kind) => ({
-		key: `${NC_STILL_SHELF_PREFIX}${kind}`,
-		kind,
-		base64,
-		sizeBytes: data.byteLength,
-		timestamp
-	});
-	return [
-		file("keyFrameSmall"),
-		file("keyFrame"),
-		file("fullFrame")
-	];
-}
-/** Reject if `promise` does not settle within `ms`. */
-function withTimeout$3(promise, ms) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			reject(/* @__PURE__ */ new Error(`snapshot cap timed out after ${String(ms)}ms`));
-		}, ms);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
 //#endregion
 //#region src/shared/llm-vision/prompt-hygiene.ts
 /**
@@ -8900,6 +8627,58 @@ var NcTextCatalog = class {
 	}
 };
 //#endregion
+//#region src/notification-center/trigger-zone-still.ts
+/**
+* How far a candidate's instant may sit from the nearest trail point before the
+* trail stops speaking for it.
+*
+* 2 s. The live detection cadence on this install is 100–300 ms and the widest
+* real gap inside a track is a couple of seconds (a session gap); beyond that
+* the nearest point is about a different moment, and answering "in the zone"
+* from it would be a guess. An unanswerable candidate is treated as NOT
+* qualifying — never as disqualifying the others, and never as a reason to ship
+* nothing.
+*/
+var TRAIL_MATCH_MAX_MS = 2e3;
+/** Overlap of a normalized box with the union of the zones — the maximum over
+*  the polygons, which is what "any of these zones" means for one box. */
+function zoneOverlap(point, polygons) {
+	let best = 0;
+	for (const polygon of polygons) {
+		if (polygon.length < 3) continue;
+		const overlap = bboxPolygonOverlap(point.bbox, polygon);
+		if (overlap > best) best = overlap;
+	}
+	return best;
+}
+/** The trail point closest to `timestamp`, or null when none is close enough. */
+function trailAt(trail, timestamp) {
+	let best = null;
+	let bestDelta = Number.POSITIVE_INFINITY;
+	for (const point of trail) {
+		const delta = Math.abs(point.timestamp - timestamp);
+		if (delta < bestDelta) {
+			bestDelta = delta;
+			best = point;
+		}
+	}
+	return best !== null && bestDelta <= 2e3 ? best : null;
+}
+/**
+* The candidates that show the subject inside the triggering zone, in the order
+* they were given. Every candidate comes back unchanged when the question
+* cannot be asked (no trail, no polygon) or when nobody qualifies.
+*/
+function selectTriggerZoneCandidates(input) {
+	const { candidates, trail, polygons } = input;
+	if (candidates.length === 0 || trail.length === 0 || polygons.length === 0) return candidates;
+	const qualifying = candidates.filter((candidate) => {
+		const point = trailAt(trail, candidate.timestamp);
+		return point !== null && zoneOverlap(point, polygons) > 0;
+	});
+	return qualifying.length > 0 ? qualifying : candidates;
+}
+//#endregion
 //#region src/notification-center/dispatcher.ts
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
 /**
@@ -8913,6 +8692,28 @@ var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
 * text-only rather than holding the alarm any longer.
 */
 var NC_STILL_WAIT_MS = 3e3;
+/**
+* How far a still's OWN instant may sit from the trigger and still count as
+* being ABOUT the trigger, for a `delivery: 'immediate'` rule.
+*
+* Derived from {@link TRAIL_MATCH_MAX_MS} rather than repeated: that constant
+* already answers "can the subject's trail speak for this instant", and the two
+* gates run back to back on the same candidate list (moment, then place). If
+* they disagreed, a frame could be judged in-zone for a moment the age gate had
+* already ruled a different one.
+*
+* The value is measured, not chosen: on the 54 live fires of 'Persona su Uscio'
+* a full-scene frame within ±1 s of the trigger existed for 52 (96%) and within
+* ±2 s for 53 (98%), while the frame that produced the operator's report was
+* +4901 ms. Widening this to 5 s would re-admit exactly that frame.
+*
+* It is NOT the ladder's top rung that has to be in band — that rung is the
+* native keyFrame, whose capture misses and retries (36 misses over 105 track
+* starts on device 615 in 6 h), so it is in band only 46% of the time. Holding
+* out for the KIND the rule asked for would wait for the late frame. The gate
+* is the instant; the ladder then runs among the frames that are about it.
+*/
+var NC_TRIGGER_STILL_MAX_AGE_MS = TRAIL_MATCH_MAX_MS;
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -9495,9 +9296,10 @@ var NcDispatcher = class {
 		const out = [];
 		const zoneIdsWanted = entry.payload.mediaZoneIds;
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
-		const firstLook = await this.resolveAttachment(entry, stillOverride);
-		const footage = await this.renderFootage(entry);
-		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : footage.attempted ? await this.resolveAttachment(entry, stillOverride) ?? await this.waitForStill(entry, stillOverride) : await this.waitForStill(entry, stillOverride);
+		const firstLook = await this.resolveAttachment(entry, stillOverride, "any");
+		const footagePending = this.renderFootage(entry);
+		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : await this.waitForStill(entry, stillOverride);
+		const footage = await footagePending;
 		if (still !== null) {
 			const zoneIds = zoneIdsWanted;
 			if (zoneIds !== void 0 && zoneIds.length > 0) {
@@ -9603,20 +9405,27 @@ var NcDispatcher = class {
 	/**
 	* Poll the still ladder for {@link NC_STILL_WAIT_MS}, then give up.
 	*
-	* Only reached when the rule asked for NO footage: with a render in the
-	* dispatch there is a 7–8 s wait to look again after, and this would add
-	* latency to a notification that is already late. Bounded and then abandoned
-	* — a text-only notification about a person at the door beats a punctual one
-	* nobody received.
+	* Runs for EVERY rule now, footage or not, and concurrently with the render:
+	* the still's deadline is its own. Track media lands 1.5–5.5 s after the
+	* trigger, so a notification built at the instant of the trigger routinely
+	* resolves nothing and this is what recovers it.
+	*
+	* Each attempt asks for a frame from the trigger instant and nothing else, so
+	* a poll that has not found one keeps waiting rather than settling for a
+	* later frame that happens to be ranked higher. The give-up pass is the one
+	* place a later frame is accepted, and it says so.
+	*
+	* Bounded and then abandoned — a text-only notification about a person at the
+	* door beats a punctual one nobody received.
 	*/
 	async waitForStill(entry, policyOverride) {
 		const subject = entry.payload.subject;
-		if (this.now() - subject.timestamp > 3e4) return null;
+		if (this.now() - subject.timestamp > 3e4) return this.resolveAttachment(entry, policyOverride, "any");
 		if (subject.eventId === void 0 && subject.trackId === void 0) return null;
 		const attempts = Math.floor(NC_STILL_WAIT_MS / 500);
 		for (let i = 0; i < attempts; i += 1) {
 			await this.sleep(500);
-			const still = await this.resolveAttachment(entry, policyOverride);
+			const still = await this.resolveAttachment(entry, policyOverride, "trigger-only");
 			if (still !== null) {
 				this.deps.logger.info("the still landed during the bounded wait", {
 					tags: { deviceId: entry.payload.subject.deviceId },
@@ -9630,7 +9439,7 @@ var NcDispatcher = class {
 				return still;
 			}
 		}
-		return null;
+		return this.resolveAttachment(entry, policyOverride, "any");
 	}
 	/** Crop a JPEG to the padded bbox of the given zones (normalized polygons →
 	*  pixel rect via sharp metadata). Null on any failure — caller falls back
@@ -9721,7 +9530,86 @@ var NcDispatcher = class {
 		bytes.set(composed.bytes);
 		return bytes;
 	}
-	async resolveAttachment(entry, policyOverride) {
+	/**
+	* Drop the candidate stills that show the subject OUTSIDE the zone that fired
+	* the rule. A filter, never a re-rank: the ladder still decides which kind of
+	* picture the rule gets, among the frames that are about the right thing.
+	*
+	* Every unanswerable case returns the list untouched — no frozen zones, no
+	* track to trail, no dep wired, no polygon resolved, an empty trail, or a
+	* throw. And when nothing qualifies, the full list comes back: a real picture
+	* beats no picture (the same rule D212 settled for the best shot).
+	*/
+	async narrowToTriggerZone(entry, ordered) {
+		const zoneIds = entry.payload.triggerZoneIds;
+		const trackId = entry.payload.subject.trackId;
+		const getTrail = this.deps.getSubjectTrail;
+		const deviceId = entry.payload.subject.deviceId;
+		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2) return ordered;
+		try {
+			const [polygons, trail] = await Promise.all([this.deps.getZonePolygons?.(deviceId, zoneIds) ?? Promise.resolve([]), getTrail(deviceId, trackId)]);
+			const kept = selectTriggerZoneCandidates({
+				candidates: ordered,
+				trail,
+				polygons,
+				triggerAt: entry.payload.subject.timestamp
+			});
+			if (kept.length === ordered.length) return kept;
+			this.deps.logger.info("still narrowed to the zone that fired the rule", {
+				tags: { deviceId },
+				meta: {
+					ruleId: entry.ruleId,
+					trackId,
+					zoneIds: zoneIds.join(","),
+					was: ordered[0]?.kind ?? null,
+					wasOffsetMs: ordered[0] !== void 0 ? ordered[0].timestamp - entry.payload.subject.timestamp : null,
+					now: kept[0]?.kind ?? null,
+					nowOffsetMs: kept[0] !== void 0 ? kept[0].timestamp - entry.payload.subject.timestamp : null,
+					dropped: ordered.length - kept.length
+				}
+			});
+			return kept;
+		} catch (err) {
+			this.deps.logger.debug("trigger-zone still narrowing failed — shipping the plain ladder", {
+				tags: { deviceId },
+				meta: {
+					ruleId: entry.ruleId,
+					error: String(err)
+				}
+			});
+			return ordered;
+		}
+	}
+	/**
+	* Keep only the stills that are ABOUT the trigger instant.
+	*
+	* Applies to `delivery: 'immediate'` and nothing else: a track-end rule is
+	* legitimately about the whole track, and a system event has no instant of
+	* its own to be near. Under `any` the list is never emptied — the best
+	* out-of-band frame ships instead, and the degrade is REPORTED, because
+	* "the picture is from nine seconds later" is the difference between a
+	* notification that is late and one that is about something else.
+	*/
+	narrowToTriggerInstant(entry, ordered, freshness) {
+		if (entry.payload.delivery !== "immediate" || ordered.length === 0) return ordered;
+		const triggerAt = entry.payload.subject.timestamp;
+		const inBand = ordered.filter((file) => Math.abs(file.timestamp - triggerAt) <= NC_TRIGGER_STILL_MAX_AGE_MS);
+		if (inBand.length > 0 || freshness === "trigger-only") return inBand;
+		const chosen = ordered[0];
+		if (chosen !== void 0) this.deps.logger.info("no still from the trigger instant — shipping a later frame", {
+			tags: { deviceId: entry.payload.subject.deviceId },
+			meta: {
+				ruleId: entry.ruleId,
+				recordId: entry.recordId,
+				kind: chosen.kind,
+				offsetMs: chosen.timestamp - triggerAt,
+				boundMs: NC_TRIGGER_STILL_MAX_AGE_MS,
+				waitedMs: NC_STILL_WAIT_MS
+			}
+		});
+		return ordered;
+	}
+	async resolveAttachment(entry, policyOverride, freshness = "any") {
 		const policy = policyOverride ?? entry.payload.media;
 		if (policy === "none") return null;
 		const frame = policyOverride === void 0 ? entry.payload.mediaFrame : void 0;
@@ -9741,9 +9629,12 @@ var NcDispatcher = class {
 			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
 			if (files.length === 0) continue;
 			const preference = frame !== void 0 ? framePreference(frame, owner.kind) : policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
-			for (const kind of preference) {
-				const file = files.find((f) => f.kind === kind);
-				if (file === void 0) continue;
+			const ordered = [];
+			for (const kind of preference) for (const file of files) if (file.kind === kind) ordered.push(file);
+			const inBand = this.narrowToTriggerInstant(entry, ordered, freshness);
+			if (inBand.length === 0) continue;
+			const shortlist = await this.narrowToTriggerZone(entry, inBand);
+			for (const file of shortlist) {
 				const raw = Buffer.from(file.base64, "base64");
 				if (raw.byteLength === 0) continue;
 				const bytes = new Uint8Array(raw.byteLength);
@@ -11092,268 +10983,6 @@ function rowToRecord(id, data) {
 		sealed: data["sealed"] === true
 	};
 }
-//#endregion
-//#region src/notification-center/liveness-ledger.ts
-/**
-* @durable class=ledger owner=notification-center
-*   write="a liveness state TRANSITION the centre accepted (seed or flip); a no-flip writes nothing"
-*   retention="none, deliberately — one row per device plus one per node, bounded by the installation. NOT pruned against the device directory: a prune is work destroyed on a fallible read (D49/D130)."
-*/
-var NC_LIVENESS_COLLECTION = "notification-center:liveness";
-var NC_LIVENESS_COLUMNS = [
-	(
-	/** The subject the intake minted (`device:617`, `node:agent-1`) — one row
-	*  each, so the two families can never collide on a key. */
-	{
-		name: "subject",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	}),
-	(
-	/** `online` | `offline` — the STATE, not the kind, so a legacy `camera-*`
-	*  row and a `device-*` event describing the same fact compare equal. */
-	{
-		name: "state",
-		type: "TEXT",
-		notNull: true
-	}),
-	(
-	/** The kind that last wrote the row. Telemetry: it makes the table readable
-	*  when someone asks "why did 617 not notify". */
-	{
-		name: "kind",
-		type: "TEXT",
-		notNull: true
-	}),
-	(
-	/** Absent on a node row. Indexed — every question about a device is asked
-	*  per-device. */
-	{
-		name: "deviceId",
-		type: "INTEGER"
-	}),
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var NC_LIVENESS_INDEXES = [{
-	name: "idx_nc_liveness_device",
-	columns: ["deviceId"]
-}];
-/**
-* The kinds the ledger governs — see the module docblock for why the stream
-* and switch families are absent.
-*/
-var NC_LEDGERED_KINDS = new Set([
-	"device-online",
-	"device-offline",
-	"node-online",
-	"node-offline",
-	"camera-online",
-	"camera-offline"
-]);
-/**
-* Reduce a system-event subject to a ledger observation, or `null` when the
-* kind is not one the ledger governs.
-*
-* The ONE place that decides which kinds are gated: a caller that branched on
-* a `kind.startsWith('device-')` prefix would silently pull the operator's
-* disable switch into a liveness ledger, which is the mistake the docblock
-* spells out.
-*/
-function ledgeredLiveness(system) {
-	if (!NC_LEDGERED_KINDS.has(system.kind)) return null;
-	const state = system.kind.endsWith("-offline") ? "offline" : "online";
-	return {
-		subject: system.subject,
-		kind: system.kind,
-		state,
-		...system.deviceId !== void 0 ? { deviceId: system.deviceId } : {}
-	};
-}
-/**
-* The ledger's mechanics, declared once. Everything policy-shaped is right
-* here in this object: what the KEY is, what the persisted row looks like, and
-* — the only decision the primitive cannot make — WHAT COUNTS AS THE SAME
-* FACT. For liveness the fact is the STATE, so a legacy `camera-online` row
-* and a `device-online` event describing it compare equal, and a repeat never
-* moves `updatedAt`.
-*
-* The reseed is uncapped in practice: the row set is bounded by the
-* installation — one row per device plus one per node — so the primitive's
-* default ceiling still bounds a pathological read. Deliberately NOT pruned
-* against the device directory: a prune is work DESTROYED on a fallible read
-* (D49), and a directory that answered empty once would wipe the ledger and
-* re-arm the very flood this file exists to prevent. A removed device leaves
-* exactly one row behind, and a re-added one re-seeds correctly.
-*/
-var NC_LIVENESS_SPEC = {
-	collection: NC_LIVENESS_COLLECTION,
-	columns: NC_LIVENESS_COLUMNS,
-	indexes: NC_LIVENESS_INDEXES,
-	writeMode: "write-behind",
-	keyOf: (row) => row.subject,
-	toValue: rowToValue$1,
-	fromRecord: recordToRow$2,
-	equalFact: (held, incoming) => held.state === incoming.state,
-	deviceIdOf: (row) => row.deviceId
-};
-var NcLivenessLedger = class {
-	ledger;
-	constructor(deps) {
-		this.ledger = new DurableLedger({
-			spec: NC_LIVENESS_SPEC,
-			store: deps.store,
-			logger: deps.logger
-		});
-	}
-	static declare(store) {
-		return DurableLedger.declare(store, NC_LIVENESS_SPEC);
-	}
-	/**
-	* Boot reseed — the whole point of the file. Returns the row count so the
-	* caller can say out loud how much memory it recovered; "loaded 0" after a
-	* container recreate is the one line that would have explained tonight.
-	*
-	* A failed load KEEPS whatever is already mirrored (the primitive's contract
-	* rule 2) rather than clearing it: dropping the memory is what caused the
-	* flood, so no error path may do it on purpose.
-	*/
-	async load() {
-		return (await this.ledger.load()).length;
-	}
-	/**
-	* Boot seed from the DEVICE DIRECTORY — the second half of the reseed, and
-	* the fix for the outage this ledger used to swallow.
-	*
-	* ## The hole
-	*
-	* {@link load} recovers what the ledger itself accepted. A device that has
-	* never produced a liveness event since the ledger was created has no row at
-	* all, so its FIRST observation ever seeds silently — and if that first
-	* observation is the camera DYING, the outage is thrown away. Live cost,
-	* 2026-08-13 21:36 CEST: the operator unplugged four cameras and received two
-	* notifications. `device:584` and `device:587` had never spoken; their
-	* unplugging was recorded and never announced. A camera that is quiet until
-	* it dies is a camera whose death is silent, indefinitely.
-	*
-	* ## Why only the ONLINE ones
-	*
-	* The directory is the device manager's own `online` flag (D132 §3: the
-	* authority seeds the mirror at boot and stays the authority). Seeding only
-	* the devices it calls ONLINE is what makes this change one-directional:
-	*
-	*  - a row seeded `online` can only ever turn a later `device.offline` into a
-	*    notification — a true sentence about a device that just went away;
-	*  - it can NEVER turn a `device.online` into one, and that is the only shape
-	*    the 2026-08-13 notification flood (D130) ever had.
-	*
-	* A device the directory calls offline — which is also what a cold or
-	* still-settling directory would say — gets no row and keeps today's
-	* behaviour exactly. Failing toward discard, unchanged.
-	*
-	* ## D49
-	*
-	* An EXISTING row is never overwritten. The ledger is the authority for what
-	* it accepted; the directory is a mirror refreshed on a tick and may be
-	* stale. A stale `online` overwriting an accepted `offline` would make the
-	* camera's real recovery a no-flip and lose it. A failed directory read
-	* simply yields an empty list here and seeds nothing.
-	*
-	* ## Staged, not persisted
-	*
-	* The seed is DERIVED from an authority that is read again on every boot, so
-	* losing it costs nothing — the next boot re-derives it. `stage` therefore
-	* advances the mirror without a write, which matters on this hub: the
-	* pipeline-analytics runner respawns several times an hour, and persisting
-	* ~500 re-derivable rows on each respawn would offer thousands of pointless
-	* commits a day to the checkpoint lottery (D96). The first real
-	* {@link observe} flip persists through the ordinary write-behind path.
-	*
-	* Returns how many rows were seeded, so the caller can say it out loud.
-	*/
-	seedFromDirectory(identities, now) {
-		let seeded = 0;
-		for (const identity of identities) {
-			if (identity.online !== true) continue;
-			const subject = `device:${identity.deviceId}`;
-			if (this.ledger.has(subject)) continue;
-			this.ledger.stage({
-				subject,
-				state: "online",
-				kind: "device-online",
-				deviceId: identity.deviceId,
-				updatedAt: now
-			});
-			seeded += 1;
-		}
-		return seeded;
-	}
-	/** The in-RAM mirror, subject-ordered so two readers agree. */
-	snapshot() {
-		return this.ledger.snapshot().toSorted((a, b) => a.subject.localeCompare(b.subject));
-	}
-	/** The state the ledger currently accepts for a subject, if any. */
-	stateOf(subject) {
-		return this.ledger.get(subject)?.state;
-	}
-	/**
-	* Judge ONE observation and advance the ledger.
-	*
-	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
-	* alone, so an event can never be gated on an I/O that might fail (D49). The
-	* durable write is kicked off behind it and its failure changes no verdict.
-	*
-	* `no-flip` leaves the row untouched — including its `updatedAt`, which
-	* therefore means "when this subject last CHANGED", not "when it last
-	* spoke". That is the timestamp anyone reading the table wants.
-	*/
-	observe(observation, now) {
-		return this.ledger.observe({
-			subject: observation.subject,
-			state: observation.state,
-			kind: observation.kind,
-			...observation.deviceId !== void 0 ? { deviceId: observation.deviceId } : {},
-			updatedAt: now
-		});
-	}
-};
-/** The persisted column map (the `subject` PK is passed separately). */
-function rowToValue$1(row) {
-	return {
-		state: row.state,
-		kind: row.kind,
-		...row.deviceId !== void 0 ? { deviceId: row.deviceId } : {},
-		updatedAt: row.updatedAt
-	};
-}
-/**
-* Structurally validate one persisted record. A row whose state is not one of
-* the two known values is `null` — skipped, so the subject re-seeds cold
-* (silent) rather than hydrating a state nothing can ever equal, which would
-* make every future event a phantom flip.
-*/
-function recordToRow$2(subject, data) {
-	if (subject.length === 0) return null;
-	const state = data["state"];
-	if (state !== "online" && state !== "offline") return null;
-	const kind = data["kind"];
-	if (typeof kind !== "string" || kind.length === 0) return null;
-	const updatedAt = Number(data["updatedAt"]);
-	if (!Number.isFinite(updatedAt)) return null;
-	const rawDeviceId = data["deviceId"];
-	const deviceId = typeof rawDeviceId === "number" && Number.isFinite(rawDeviceId) ? rawDeviceId : void 0;
-	return {
-		subject,
-		state,
-		kind,
-		...deviceId !== void 0 ? { deviceId } : {},
-		updatedAt
-	};
-}
 function isDeviceLivenessKind(kind) {
 	return kind === "device-online" || kind === "device-offline" || kind === "camera-online" || kind === "camera-offline";
 }
@@ -11416,6 +11045,268 @@ var DeviceLivenessHoldoff = class {
 	}
 };
 //#endregion
+//#region src/notification-center/liveness-ledger.ts
+/**
+* @durable class=ledger owner=notification-center
+*   write="a liveness state TRANSITION the centre accepted (seed or flip); a no-flip writes nothing"
+*   retention="none, deliberately — one row per device plus one per node, bounded by the installation. NOT pruned against the device directory: a prune is work destroyed on a fallible read (D49/D130)."
+*/
+var NC_LIVENESS_COLLECTION = "notification-center:liveness";
+var NC_LIVENESS_COLUMNS = [
+	(
+	/** The subject the intake minted (`device:617`, `node:agent-1`) — one row
+	*  each, so the two families can never collide on a key. */
+	{
+		name: "subject",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	(
+	/** `online` | `offline` — the STATE, not the kind, so a legacy `camera-*`
+	*  row and a `device-*` event describing the same fact compare equal. */
+	{
+		name: "state",
+		type: "TEXT",
+		notNull: true
+	}),
+	(
+	/** The kind that last wrote the row. Telemetry: it makes the table readable
+	*  when someone asks "why did 617 not notify". */
+	{
+		name: "kind",
+		type: "TEXT",
+		notNull: true
+	}),
+	(
+	/** Absent on a node row. Indexed — every question about a device is asked
+	*  per-device. */
+	{
+		name: "deviceId",
+		type: "INTEGER"
+	}),
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var NC_LIVENESS_INDEXES = [{
+	name: "idx_nc_liveness_device",
+	columns: ["deviceId"]
+}];
+/**
+* The kinds the ledger governs — see the module docblock for why the stream
+* and switch families are absent.
+*/
+var NC_LEDGERED_KINDS = new Set([
+	"device-online",
+	"device-offline",
+	"node-online",
+	"node-offline",
+	"camera-online",
+	"camera-offline"
+]);
+/**
+* Reduce a system-event subject to a ledger observation, or `null` when the
+* kind is not one the ledger governs.
+*
+* The ONE place that decides which kinds are gated: a caller that branched on
+* a `kind.startsWith('device-')` prefix would silently pull the operator's
+* disable switch into a liveness ledger, which is the mistake the docblock
+* spells out.
+*/
+function ledgeredLiveness(system) {
+	if (!NC_LEDGERED_KINDS.has(system.kind)) return null;
+	const state = system.kind.endsWith("-offline") ? "offline" : "online";
+	return {
+		subject: system.subject,
+		kind: system.kind,
+		state,
+		...system.deviceId !== void 0 ? { deviceId: system.deviceId } : {}
+	};
+}
+/**
+* The ledger's mechanics, declared once. Everything policy-shaped is right
+* here in this object: what the KEY is, what the persisted row looks like, and
+* — the only decision the primitive cannot make — WHAT COUNTS AS THE SAME
+* FACT. For liveness the fact is the STATE, so a legacy `camera-online` row
+* and a `device-online` event describing it compare equal, and a repeat never
+* moves `updatedAt`.
+*
+* The reseed is uncapped in practice: the row set is bounded by the
+* installation — one row per device plus one per node — so the primitive's
+* default ceiling still bounds a pathological read. Deliberately NOT pruned
+* against the device directory: a prune is work DESTROYED on a fallible read
+* (D49), and a directory that answered empty once would wipe the ledger and
+* re-arm the very flood this file exists to prevent. A removed device leaves
+* exactly one row behind, and a re-added one re-seeds correctly.
+*/
+var NC_LIVENESS_SPEC = {
+	collection: NC_LIVENESS_COLLECTION,
+	columns: NC_LIVENESS_COLUMNS,
+	indexes: NC_LIVENESS_INDEXES,
+	writeMode: "write-behind",
+	keyOf: (row) => row.subject,
+	toValue: rowToValue$1,
+	fromRecord: recordToRow$2,
+	equalFact: (held, incoming) => held.state === incoming.state,
+	deviceIdOf: (row) => row.deviceId
+};
+var NcLivenessLedger = class {
+	ledger;
+	constructor(deps) {
+		this.ledger = new DurableLedger({
+			spec: NC_LIVENESS_SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, NC_LIVENESS_SPEC);
+	}
+	/**
+	* Boot reseed — the whole point of the file. Returns the row count so the
+	* caller can say out loud how much memory it recovered; "loaded 0" after a
+	* container recreate is the one line that would have explained tonight.
+	*
+	* A failed load KEEPS whatever is already mirrored (the primitive's contract
+	* rule 2) rather than clearing it: dropping the memory is what caused the
+	* flood, so no error path may do it on purpose.
+	*/
+	async load() {
+		return (await this.ledger.load()).length;
+	}
+	/**
+	* Boot seed from the DEVICE DIRECTORY — the second half of the reseed, and
+	* the fix for the outage this ledger used to swallow.
+	*
+	* ## The hole
+	*
+	* {@link load} recovers what the ledger itself accepted. A device that has
+	* never produced a liveness event since the ledger was created has no row at
+	* all, so its FIRST observation ever seeds silently — and if that first
+	* observation is the camera DYING, the outage is thrown away. Live cost,
+	* 2026-08-13 21:36 CEST: the operator unplugged four cameras and received two
+	* notifications. `device:584` and `device:587` had never spoken; their
+	* unplugging was recorded and never announced. A camera that is quiet until
+	* it dies is a camera whose death is silent, indefinitely.
+	*
+	* ## Why only the ONLINE ones
+	*
+	* The directory is the device manager's own `online` flag (D132 §3: the
+	* authority seeds the mirror at boot and stays the authority). Seeding only
+	* the devices it calls ONLINE is what makes this change one-directional:
+	*
+	*  - a row seeded `online` can only ever turn a later `device.offline` into a
+	*    notification — a true sentence about a device that just went away;
+	*  - it can NEVER turn a `device.online` into one, and that is the only shape
+	*    the 2026-08-13 notification flood (D130) ever had.
+	*
+	* A device the directory calls offline — which is also what a cold or
+	* still-settling directory would say — gets no row and keeps today's
+	* behaviour exactly. Failing toward discard, unchanged.
+	*
+	* ## D49
+	*
+	* An EXISTING row is never overwritten. The ledger is the authority for what
+	* it accepted; the directory is a mirror refreshed on a tick and may be
+	* stale. A stale `online` overwriting an accepted `offline` would make the
+	* camera's real recovery a no-flip and lose it. A failed directory read
+	* simply yields an empty list here and seeds nothing.
+	*
+	* ## Staged, not persisted
+	*
+	* The seed is DERIVED from an authority that is read again on every boot, so
+	* losing it costs nothing — the next boot re-derives it. `stage` therefore
+	* advances the mirror without a write, which matters on this hub: the
+	* pipeline-analytics runner respawns several times an hour, and persisting
+	* ~500 re-derivable rows on each respawn would offer thousands of pointless
+	* commits a day to the checkpoint lottery (D96). The first real
+	* {@link observe} flip persists through the ordinary write-behind path.
+	*
+	* Returns how many rows were seeded, so the caller can say it out loud.
+	*/
+	seedFromDirectory(identities, now) {
+		let seeded = 0;
+		for (const identity of identities) {
+			if (identity.online !== true) continue;
+			const subject = `device:${identity.deviceId}`;
+			if (this.ledger.has(subject)) continue;
+			this.ledger.stage({
+				subject,
+				state: "online",
+				kind: "device-online",
+				deviceId: identity.deviceId,
+				updatedAt: now
+			});
+			seeded += 1;
+		}
+		return seeded;
+	}
+	/** The in-RAM mirror, subject-ordered so two readers agree. */
+	snapshot() {
+		return this.ledger.snapshot().toSorted((a, b) => a.subject.localeCompare(b.subject));
+	}
+	/** The state the ledger currently accepts for a subject, if any. */
+	stateOf(subject) {
+		return this.ledger.get(subject)?.state;
+	}
+	/**
+	* Judge ONE observation and advance the ledger.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so an event can never be gated on an I/O that might fail (D49). The
+	* durable write is kicked off behind it and its failure changes no verdict.
+	*
+	* `no-flip` leaves the row untouched — including its `updatedAt`, which
+	* therefore means "when this subject last CHANGED", not "when it last
+	* spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(observation, now) {
+		return this.ledger.observe({
+			subject: observation.subject,
+			state: observation.state,
+			kind: observation.kind,
+			...observation.deviceId !== void 0 ? { deviceId: observation.deviceId } : {},
+			updatedAt: now
+		});
+	}
+};
+/** The persisted column map (the `subject` PK is passed separately). */
+function rowToValue$1(row) {
+	return {
+		state: row.state,
+		kind: row.kind,
+		...row.deviceId !== void 0 ? { deviceId: row.deviceId } : {},
+		updatedAt: row.updatedAt
+	};
+}
+/**
+* Structurally validate one persisted record. A row whose state is not one of
+* the two known values is `null` — skipped, so the subject re-seeds cold
+* (silent) rather than hydrating a state nothing can ever equal, which would
+* make every future event a phantom flip.
+*/
+function recordToRow$2(subject, data) {
+	if (subject.length === 0) return null;
+	const state = data["state"];
+	if (state !== "online" && state !== "offline") return null;
+	const kind = data["kind"];
+	if (typeof kind !== "string" || kind.length === 0) return null;
+	const updatedAt = Number(data["updatedAt"]);
+	if (!Number.isFinite(updatedAt)) return null;
+	const rawDeviceId = data["deviceId"];
+	const deviceId = typeof rawDeviceId === "number" && Number.isFinite(rawDeviceId) ? rawDeviceId : void 0;
+	return {
+		subject,
+		state,
+		kind,
+		...deviceId !== void 0 ? { deviceId } : {},
+		updatedAt
+	};
+}
+//#endregion
 //#region src/notification-center/occupancy-watcher.ts
 /** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
 var FRAME_SCOPE = "@frame";
@@ -13782,6 +13673,279 @@ var NcSnoozeStore = class {
 		return parsed.success ? parsed.data : null;
 	}
 };
+/** JPEG quality for the downscaled full frame — matches the crop path. */
+var FULL_FRAME_QUALITY = 80;
+/**
+* Downscale an already-encoded JPEG full frame to FIT WITHIN
+* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
+* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
+* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
+* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
+* at night) is never stored or served — the privacy fix moved to CAPTURE time.
+*/
+async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
+	return sharp(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
+		fit: "inside",
+		withoutEnlargement: true
+	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
+}
+//#endregion
+//#region src/notification-center/still-shelf.ts
+/**
+* The still shelf — the PHOTOGRAPH a notification carries when nothing it can
+* name owns a frame.
+*
+* ## Why a trigger needs one at all
+*
+* The attachment ladder resolves media by OWNER, and most triggers have one: an
+* object or package event owns its crops, a closed track owns its best shot, a
+* doorbell press owns the marker track the same press projected
+* (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
+* counted (`chooseOccupancyMediaOwner`). Two triggers own nothing, and for the
+* same reason in both cases — the subject is an ABSENCE:
+*
+*  - an **audio** match: nothing was boxed, nothing was tracked, and —
+*    deliberately — nothing is persisted at all. A confirmed window is a claim
+*    about sound that has already stopped, and `event-intake.ts` states why
+*    replaying it later would be wrong.
+*  - an **occupancy** edge whose scope is EMPTY — "posto libero". The vehicle
+*    whose departure IS the news has left, so `chooseOccupancyMediaOwner` names
+*    nobody and the ladder logs `no still could be resolved … owners=[]`.
+*
+* So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
+* of the trigger. Not of the sound, not of the object that left — of what the
+* camera can see now that it happened. For a freed parking space that is
+* exactly the answer the operator wants: the space, empty.
+*
+* **One shelf, not two.** The mechanism is identical down to the reuse window,
+* and the only thing that differs between the two triggers is the GATE deciding
+* that a photograph is owed at all — which belongs at the trigger site, where
+* the rules are, and not here. A twin module would be a second derivation of
+* one thing. The trigger rides along as {@link NcStillTrigger} only so the logs
+* can say which absence they are about.
+*
+* ## Three properties, and each one is a decision
+*
+* **It is not a record.** The bytes live here, in RAM, under an owner id and a
+* TTL that covers the outbox's whole retry horizon — and nowhere else. The
+* alternative was the doorbell's: materialise a synthetic marker track through
+* `SyntheticTrackMaterializer` and let the notification name it. That would put
+* a durable Track on the camera's timeline for every confirmed window and every
+* emptied zone, feeding the digest's `listTracks`, retention, and the audio-
+* marker feature's own operator ceilings (`audio-marker-projector.ts` exists
+* precisely to bound how many audio markers a camera may emit). A notification
+* must not manufacture timeline history as a side effect of wanting a picture.
+*
+* **The capture STARTS immediately and is never awaited.** The subject is
+* transient — a scream is over before a snapshot round-trip completes, and a
+* freed space is about to be taken by the next car — so the fetch is kicked off
+* at the trigger, before the rule evaluation runs, and the owner id is minted
+* synchronously so the outbox row can name it. The bytes land while the row
+* waits in the queue, and the dispatcher's existing bounded still-wait (or the
+* pause its own footage render already costs) picks them up. A camera that
+* never answers costs the picture and never the notification.
+*
+* **Two triggers seconds apart share ONE capture.** A barking dog confirms
+* repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
+* rule's cooldown is its only brake, and the cooldown is applied AFTER this.
+* Without a reuse window this would photograph a camera at whatever rate the
+* sound happens to occur. Each trigger still gets its OWN owner id, so two
+* outbox rows are never mistaken for one subject; they merely point at the same
+* frame, which is the truth — the scene did not change in ten seconds. The
+* window is per CAMERA and trigger-agnostic for the same reason: a sound and an
+* emptied zone ten seconds apart are two claims about one scene.
+*
+* Nothing here is silent: a capture that lands and a camera that refuses each
+* emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
+* and 615 not" is the only form that question is ever asked in.
+*/
+/**
+* The owner-id namespace. It is what routes a lookup here instead of to the
+* media store, and it is the reason the dispatcher needs no audio or occupancy
+* branch — `getMediaForOwner` answers for all of them under one signature.
+*/
+var NC_STILL_SHELF_PREFIX = "nc-still:";
+/** True for an owner id this shelf minted. */
+function isStillShelfId(id) {
+	return id.startsWith(NC_STILL_SHELF_PREFIX);
+}
+/**
+* How long the bytes are held.
+*
+* The outbox retries 8 times with a 5 s → 300 s backoff, which tops out around
+* ten minutes; fifteen covers that with room for a slow drain. Past it the row
+* ships text-only, which is the correct degradation for a photograph of a scene
+* that is a quarter of an hour stale anyway.
+*/
+var NC_STILL_SHELF_TTL_MS = 15 * 6e4;
+/** A hanging snapshot cap must not pin a capture slot forever. */
+var SNAPSHOT_TIMEOUT_MS = 8e3;
+/**
+* Hard bound on held captures. Reached only if every camera on the hub triggers
+* one inside a single TTL; the oldest is dropped first, which costs a
+* fifteen-minute-old picture nobody is waiting for.
+*/
+var MAX_CAPTURES = 64;
+var NcStillShelf = class {
+	deps;
+	/** captureId → the photograph. */
+	captures = /* @__PURE__ */ new Map();
+	/** ownerId → captureId. Several owners may name one capture (the reuse window). */
+	owners = /* @__PURE__ */ new Map();
+	/** deviceId → its newest capture, for the reuse window. */
+	newest = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Photograph `deviceId` for a trigger at `atMs`, and return the owner id the
+	* subject should name. SYNCHRONOUS by contract: the caller is on the trigger
+	* path and the outbox row is built from what this returns.
+	*/
+	capture(deviceId, atMs, trigger) {
+		const now = this.deps.now();
+		this.prune(now);
+		const ownerId = `${NC_STILL_SHELF_PREFIX}${randomUUID()}`;
+		const recent = this.newest.get(deviceId);
+		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
+			this.owners.set(ownerId, recent.captureId);
+			return ownerId;
+		}
+		const captureId = randomUUID();
+		this.captures.set(captureId, {
+			deviceId,
+			trigger,
+			startedAt: now,
+			expiresAt: now + NC_STILL_SHELF_TTL_MS,
+			files: []
+		});
+		this.newest.set(deviceId, {
+			captureId,
+			at: now
+		});
+		this.owners.set(ownerId, captureId);
+		this.fetch(captureId, deviceId, atMs, trigger);
+		return ownerId;
+	}
+	/**
+	* The media an owner id holds, or `undefined` when this shelf never minted
+	* it. An EMPTY array is a different answer: the capture exists and has not
+	* landed (or never will), which is exactly the case the dispatcher's bounded
+	* wait and its `no still could be resolved` line are for.
+	*/
+	get(ownerId) {
+		const captureId = this.owners.get(ownerId);
+		if (captureId === void 0) return void 0;
+		return this.captures.get(captureId)?.files ?? [];
+	}
+	/** Drop expired captures and the owners that named them. */
+	prune(now) {
+		for (const [captureId, held] of this.captures) {
+			if (held.expiresAt > now) continue;
+			this.captures.delete(captureId);
+			if (this.newest.get(held.deviceId)?.captureId === captureId) this.newest.delete(held.deviceId);
+		}
+		while (this.captures.size > MAX_CAPTURES) {
+			const oldest = this.captures.keys().next();
+			if (oldest.done === true) break;
+			const held = this.captures.get(oldest.value);
+			this.captures.delete(oldest.value);
+			if (held !== void 0 && this.newest.get(held.deviceId)?.captureId === oldest.value) this.newest.delete(held.deviceId);
+		}
+		for (const [ownerId, captureId] of this.owners) if (!this.captures.has(captureId)) this.owners.delete(ownerId);
+	}
+	/** Drop everything (shutdown). */
+	clear() {
+		this.captures.clear();
+		this.owners.clear();
+		this.newest.clear();
+	}
+	async fetch(captureId, deviceId, atMs, trigger) {
+		try {
+			const shot = await withTimeout$3(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
+			if (shot === null || shot.base64.length === 0) {
+				this.reportMiss(deviceId, trigger, "the camera returned no snapshot");
+				return;
+			}
+			const raw = Buffer.from(shot.base64, "base64");
+			let data = raw;
+			try {
+				data = await downscaleFullFrameJpeg(raw, 960, 540);
+			} catch {}
+			const held = this.captures.get(captureId);
+			if (held === void 0) return;
+			this.captures.set(captureId, {
+				...held,
+				files: stillShelfMedia(data, atMs)
+			});
+			this.deps.logger.info(`${trigger} still captured`, {
+				tags: { deviceId },
+				meta: {
+					trigger,
+					bytes: data.byteLength,
+					tookMs: this.deps.now() - held.startedAt
+				}
+			});
+		} catch (err) {
+			this.reportMiss(deviceId, trigger, err instanceof Error ? err.message : String(err));
+		}
+	}
+	/**
+	* A branch that drops work says so. This one costs the operator the picture
+	* on a notification they DID receive, so it is a warn and it carries the
+	* camera — the only key the question is ever asked with.
+	*/
+	reportMiss(deviceId, trigger, reason) {
+		this.deps.logger.warn(`the camera did not answer the ${trigger} still — this notification ships text-only`, {
+			tags: { deviceId },
+			meta: {
+				trigger,
+				reason
+			}
+		});
+	}
+};
+/**
+* The photograph, in the three kinds the CLEAN-SCENE ladders ask for.
+*
+* `keyFrameSmall` leads because it is the first rung of both `attach: 'best'`
+* and `attach: 'keyFrame'` on a track owner; `keyFrame` and `fullFrame` answer
+* `frame: 'full'` and `frame: 'boxed'`'s honest degrade. There is deliberately
+* no `crop` / `thumbnail`: nothing was boxed, so `frame: 'cropped'` resolves
+* NOTHING and the notification ships text-only with the ordinary line saying
+* so. Inventing a centre crop would answer a different question from the one
+* the operator asked.
+*/
+function stillShelfMedia(data, timestamp) {
+	const base64 = data.toString("base64");
+	const file = (kind) => ({
+		key: `${NC_STILL_SHELF_PREFIX}${kind}`,
+		kind,
+		base64,
+		sizeBytes: data.byteLength,
+		timestamp
+	});
+	return [
+		file("keyFrameSmall"),
+		file("keyFrame"),
+		file("fullFrame")
+	];
+}
+/** Reject if `promise` does not settle within `ms`. */
+function withTimeout$3(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`snapshot cap timed out after ${String(ms)}ms`));
+		}, ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
 //#endregion
 //#region src/notification-center/summary/summary-ai.ts
 /**
@@ -21841,6 +22005,7 @@ var NotificationCenter = class NotificationCenter {
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: noMedia ? "none" : mediaRule.media.attach,
 				...!noMedia && mediaRule.media.zoneCrop === true && cropZoneIds !== void 0 ? { mediaZoneIds: [...cropZoneIds] } : {},
+				...!noMedia && cropZoneIds !== void 0 ? { triggerZoneIds: [...cropZoneIds] } : {},
 				...confirm !== void 0 ? {
 					confirm,
 					...cooldown !== void 0 ? { cooldown } : {}
@@ -25917,37 +26082,61 @@ function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples)
 	return eligible;
 }
 /**
-* Match a probe embedding against the gallery. Only samples with the same
-* `modelId` AND the same dimension are compared (model-version safety). Returns
-* the best identity when its score ≥ threshold and it beats the best OTHER
-* identity by ≥ margin; otherwise null.
+* THE scoring authority. Every identity with at least one sample comparable to
+* the probe (same `modelId` AND same dimension — model-version safety), scored
+* against its best such sample, sorted best-first.
+*
+* Extracted from `matchEmbedding`, which is now a thin decision on top of it,
+* so that "what would the pipeline score this face" has exactly ONE
+* implementation. `face-rescore.ts` — the operator's recompute button — reads
+* the same rows the matcher decides from; a second scoring pass written for the
+* UI would be free to drift, and a UI that disagrees with the pipeline is worse
+* than no UI.
 */
-function matchEmbedding(probe, gallery, opts) {
+function rankIdentities(probe, gallery, minIdentitySamples) {
 	const probeVec = new Float32Array(probe.embedding);
-	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
 	const bestByIdentity = /* @__PURE__ */ new Map();
+	const countByIdentity = /* @__PURE__ */ new Map();
 	for (const s of gallery) {
 		if (s.modelId !== probe.modelId) continue;
 		if (s.embedding.length !== probe.embedding.length) continue;
-		if (!eligible.has(s.identityId)) continue;
 		const score = cosineSimilarity$1(probeVec, new Float32Array(s.embedding));
 		const prev = bestByIdentity.get(s.identityId);
 		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+		countByIdentity.set(s.identityId, (countByIdentity.get(s.identityId) ?? 0) + 1);
 	}
-	if (bestByIdentity.size === 0) return null;
-	let bestId = null;
-	let bestScore = -Infinity;
-	let secondScore = -Infinity;
-	for (const [id, score] of bestByIdentity) if (score > bestScore) {
-		secondScore = bestScore;
-		bestScore = score;
-		bestId = id;
-	} else if (score > secondScore) secondScore = score;
-	if (bestId === null || bestScore < opts.threshold) return null;
-	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
+	const rows = [];
+	for (const [identityId, score] of bestByIdentity) {
+		const sampleCount = countByIdentity.get(identityId) ?? 0;
+		rows.push({
+			identityId,
+			score,
+			sampleCount,
+			eligible: sampleCount >= minIdentitySamples
+		});
+	}
+	rows.sort((a, b) => b.score - a.score);
+	return rows;
+}
+/**
+* Match a probe embedding against the gallery. Only samples with the same
+* `modelId` AND the same dimension are compared (model-version safety). Returns
+* the best identity when its score ≥ threshold and it beats the best OTHER
+* identity by ≥ margin; otherwise null.
+*
+* The scores come from {@link rankIdentities}; this function is only the
+* decision (eligibility filter, threshold, ambiguity guard).
+*/
+function matchEmbedding(probe, gallery, opts) {
+	const ranked = rankIdentities(probe, gallery, opts.minIdentitySamples ?? 1).filter((r) => r.eligible);
+	const best = ranked[0];
+	if (best === void 0) return null;
+	if (best.score < opts.threshold) return null;
+	const second = ranked[1];
+	if (second !== void 0 && best.score - second.score < opts.margin) return null;
 	return {
-		identityId: bestId,
-		score: bestScore
+		identityId: best.identityId,
+		score: best.score
 	};
 }
 /**
@@ -26086,17 +26275,6 @@ function updateTrackAggregate(prev, match, opts) {
 /** Attribution of a face identity NAMED BY THE OPERATOR in the gallery. */
 var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
 /**
-* Model id assumed for a face row that recorded none.
-*
-* Every row written before 2026-08-20 predates `Face.embeddingModelId`, and
-* every one of them was embedded with `arcface-r100` — it was the only face
-* model the step had ever defaulted to. So this is a statement about history,
-* NOT a default for new work: a face that names its model is stamped with the
-* model it names, because a sample that lies about its feature space defeats
-* the only guard `face-matcher` has.
-*/
-var LEGACY_MODEL_ID = "arcface-r100";
-/**
 * How many face crops `listRecentFaces` resolves at once.
 *
 * Each crop costs a store round-trip plus a disk read, so the page is I/O-bound
@@ -26338,7 +26516,7 @@ var FaceGalleryProvider = class {
 		}
 		const currentFace = await this.faceStore.get(faceId);
 		if (!currentFace) throw new Error(`FaceGalleryProvider.assignFace: face disappeared after pre-cleanup: ${faceId}`);
-		const enrolledModelId = currentFace.embeddingModelId ?? LEGACY_MODEL_ID;
+		const enrolledModelId = currentFace.embeddingModelId ?? "arcface-r100";
 		const verdict = enrollmentPromiscuity(currentFace.embedding, enrolledModelId, identityId, await this.identityStore.loadGallery());
 		if (verdict !== null) {
 			this.logger.warn("assignFace refused: embedding too close to a FOREIGN identity sample", {
@@ -26511,6 +26689,314 @@ var FaceGalleryProvider = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/face-rescore.ts
+/**
+* face-rescore — score ONE face against the gallery AS IT IS RIGHT NOW.
+*
+* ## Why this exists: the suggestion on a track is stale by construction
+*
+* `Face.suggestedIdentityId` / `suggestedMatchScore` are not computed when you
+* look at a track. They are computed DURING live detection, frame by frame
+* (`face-recognizer.ts` — the suggestion band), and the per-track peak is
+* persisted when the track CLOSES. They are a photograph of what the gallery
+* said at that instant.
+*
+* So every enrolment after that instant is invisible to them. The operator's
+* real workflow is the exact case this breaks: assign ten faces to build a
+* person up, then open an older unassigned track and ask "does it match NOW?"
+* — and read a number that was decided before any of those ten existed. There
+* is no background job that refreshes it and there should not be one (the
+* gallery changes on every assign; re-scoring every buffered face each time is
+* work nobody asked for). The honest fix is to make the question askable on
+* demand. That is this module, and that is the button.
+*
+* ## What it does NOT do
+*
+* It does not run inference. The face's embedding is already persisted, and
+* matching is pure arithmetic over vectors — so a recompute is a read plus a
+* few thousand dot products, not a pipeline pass. Re-embedding is a SEPARATE,
+* explicitly-requested action (see the action's `reembed` flag): a button
+* labelled "recompute" must never silently spend GPU.
+*
+* ## The model gate is not an optimisation, it is the difference between a
+* number and noise
+*
+* A cosine between vectors from two different face models is a well-formed
+* float with no meaning. `face-matcher` has always refused to compare across
+* `modelId`, which means a face embedded before a model flip scores against
+* NOTHING — and the trap is that "nothing" renders identically to "no match".
+* This module names that state (`model-mismatch`) so the UI can say "this face
+* is in an old feature space" instead of showing 0% and letting the operator
+* conclude the person is not there.
+*/
+/** The empty report every "cannot score" path returns, so shape never varies. */
+function emptyReport(verdict, input, comparable) {
+	return {
+		verdict,
+		comparable,
+		probeModelId: input.probe.modelId,
+		clusterModelId: input.clusterModelId,
+		params: input.params,
+		identities: []
+	};
+}
+/**
+* Decide the verdict from the ELIGIBLE ranking, using exactly the gates
+* `matchEmbedding` uses — it is called here rather than re-implemented, so the
+* "would auto-assign" claim is the matcher's own answer and cannot drift.
+*/
+function decide(eligible, input) {
+	const best = eligible[0];
+	if (best === void 0) return {
+		verdict: "no-eligible-identity",
+		winnerId: null
+	};
+	const match = matchEmbedding(input.probe, input.gallery, {
+		threshold: input.params.threshold,
+		margin: input.params.margin,
+		minIdentitySamples: input.params.minIdentitySamples
+	});
+	if (match !== null) return {
+		verdict: "auto-assignable",
+		winnerId: match.identityId
+	};
+	if (best.score >= input.params.threshold) return {
+		verdict: "ambiguous",
+		winnerId: null
+	};
+	if (best.score >= input.params.suggestionMinCosine) return {
+		verdict: "suggestion",
+		winnerId: null
+	};
+	return {
+		verdict: "below-threshold",
+		winnerId: null
+	};
+}
+/**
+* Score one probe against the gallery as it stands, and say what the pipeline
+* would do with it. Pure: every input is passed in, nothing is read or written.
+*/
+function buildFaceRescoreReport(input) {
+	if (input.probe.modelId !== input.clusterModelId) return emptyReport("model-mismatch", input, false);
+	const ranked = rankIdentities(input.probe, input.gallery, input.params.minIdentitySamples);
+	if (ranked.length === 0) return emptyReport("empty-gallery", input, true);
+	const eligible = ranked.filter((r) => r.eligible);
+	const { verdict, winnerId } = decide(eligible, input);
+	const identities = ranked.map((r) => ({
+		identityId: r.identityId,
+		name: input.identityNames.get(r.identityId) ?? r.identityId,
+		score: r.score,
+		sampleCount: r.sampleCount,
+		eligible: r.eligible,
+		meetsThreshold: r.score >= input.params.threshold,
+		wouldAutoAssign: r.identityId === winnerId
+	}));
+	const [best, second] = eligible;
+	return {
+		verdict,
+		comparable: true,
+		probeModelId: input.probe.modelId,
+		clusterModelId: input.clusterModelId,
+		params: input.params,
+		identities,
+		...best !== void 0 && second !== void 0 ? { runnerUpGap: best.score - second.score } : {}
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/face-rescore-actions.ts
+/**
+* face-rescore-actions — "score this face against the gallery AS IT IS NOW".
+*
+* ## Why an `addons.custom` action and not a `faceGallery` cap method
+*
+* Same reason `photo.*`, `embedding.*` and `debug.*` ride this bridge: a cap
+* method's wire schema lives in `@camstack/types`, which travels inside the
+* `@camstack/server` closure, so a new one is not callable until a server train
+* ships — however current the addon is. Here the schema lives in the addon's
+* own dist and the hub forwards an opaque envelope, so `camstack deploy` is the
+* whole delivery.
+*
+* ## Why re-embedding is an explicit flag and not a fallback
+*
+* `face.rescoreTrack` with `reembed: false` (the default) reads a persisted
+* vector and does arithmetic — microseconds, no GPU, no node hop. With
+* `reembed: true` it runs the `face-embedding` step on a cluster node. Those
+* are different enough in cost and in consequence (a re-embed WRITES the face
+* row) that a button labelled "recompute" must not choose between them on the
+* operator's behalf. The report says whether a re-embed is possible
+* (`reembedAvailable`); the operator asks for it.
+*
+* See `face-rescore.ts` for why the number already on the track is stale by
+* construction — that is the whole reason this action exists.
+*/
+var FaceRescoreVerdictSchema = _enum([
+	"auto-assignable",
+	"ambiguous",
+	"suggestion",
+	"below-threshold",
+	"no-eligible-identity",
+	"empty-gallery",
+	"model-mismatch"
+]);
+var FaceRescoreParamsSchema = object({
+	threshold: number(),
+	margin: number(),
+	minIdentitySamples: number().int(),
+	/** DERIVED from `threshold`, never stored (D222) — see `suggestionBandFactor`. */
+	suggestionMinCosine: number(),
+	/** The fraction of `threshold` that `suggestionMinCosine` is, so the report
+	*  states the RULE and not only its current result. */
+	suggestionBandFactor: number()
+});
+var FaceRescoreIdentityRowSchema = object({
+	identityId: string(),
+	name: string(),
+	/** Raw cosine. The UI formats; the wire stays in the matcher's units. */
+	score: number(),
+	sampleCount: number().int(),
+	eligible: boolean(),
+	meetsThreshold: boolean(),
+	wouldAutoAssign: boolean()
+});
+/**
+* Why a re-embed did not happen, in the addon's vocabulary.
+*
+* `not-a-template` is the one that matters and the one that is easy to get
+* wrong: a face's stored crop is the 112×112 ArcFace template ONLY when the
+* detection carried landmarks. When it does not, the crop is a padded bbox cut
+* — and feeding THAT to `face-embedding` as a whole frame produces a vector
+* that is plausible and useless, exactly the trap `face-reembed-pass.ts`
+* documents from the other direction. Refusing is the honest answer.
+*/
+var FaceReembedRefusalSchema = _enum([
+	"not-requested",
+	"no-pixels",
+	"not-a-template",
+	"no-capable-node",
+	"failed",
+	"not-persisted"
+]);
+var FaceReembedReportSchema = object({
+	attempted: boolean(),
+	/** True only when a NEW vector was embedded AND read back off the face row. */
+	succeeded: boolean(),
+	reason: FaceReembedRefusalSchema.optional(),
+	detail: string().optional(),
+	/** The model the re-embed pinned — the cluster row's, never a substitute. */
+	modelId: string().optional()
+});
+var faceRescoreActions = defineCustomActions({ 
+/**
+* Read-only by default. `admin` because the report names every enrolled
+* person and how well an arbitrary face matches them — the gallery's shape,
+* which is not a viewer-level fact.
+*/
+"face.rescoreTrack": customAction(object({
+	deviceId: number().int(),
+	trackId: string().min(1),
+	/**
+	* Run `face-embedding` over the face's stored aligned template first, so a
+	* face left in a superseded feature space becomes comparable again. Costs a
+	* node round-trip and WRITES the face row. Never implicit.
+	*/
+	reembed: boolean().default(false)
+}), object({
+	faceId: string(),
+	deviceId: number().int(),
+	trackId: string(),
+	/** The face's current assignment, so the UI can mark "already this person". */
+	assigned: boolean(),
+	assignedIdentityId: string().optional(),
+	/** What the track has been SHOWING until now — persisted at detection time.
+	*  Returned so the UI can put the stale number beside the fresh one. */
+	storedSuggestedIdentityId: string().optional(),
+	storedSuggestedMatchScore: number().optional(),
+	verdict: FaceRescoreVerdictSchema,
+	comparable: boolean(),
+	probeModelId: string(),
+	clusterModelId: string(),
+	params: FaceRescoreParamsSchema,
+	identities: array(FaceRescoreIdentityRowSchema).readonly(),
+	runnerUpGap: number().optional(),
+	/** Whether a `reembed: true` retry could actually do anything. Lets the UI
+	*  offer the escape hatch only when it exists. */
+	reembedAvailable: boolean(),
+	reembed: FaceReembedReportSchema
+}), {
+	kind: "mutation",
+	auth: "admin"
+}) });
+//#endregion
+//#region src/pipeline-analytics/pipeline/closed-row-media-gate.ts
+var DEFAULT_LOG_MIN_GAP_MS = 6e4;
+var DEFAULT_MAX_TRACKED = 512;
+var WRITE = {
+	refuse: false,
+	log: false,
+	closedAgeMs: 0,
+	suppressed: 0
+};
+var ClosedRowMediaGate = class {
+	logMinGapMs;
+	maxTracked;
+	/** trackId → sampling state, insertion-ordered so the oldest evicts first. */
+	sampling = /* @__PURE__ */ new Map();
+	constructor(options = {}) {
+		this.logMinGapMs = options.logMinGapMs ?? DEFAULT_LOG_MIN_GAP_MS;
+		this.maxTracked = options.maxTracked ?? DEFAULT_MAX_TRACKED;
+	}
+	/**
+	* @param rowClosedAt when the store closed this track's row, or `undefined`
+	*   when it holds no such record — which always means WRITE.
+	*/
+	evaluate(trackId, rowClosedAt, nowMs) {
+		if (rowClosedAt === void 0) return WRITE;
+		const closedAgeMs = Math.max(0, nowMs - rowClosedAt);
+		const existing = this.sampling.get(trackId);
+		if (existing === void 0) {
+			this.remember(trackId, {
+				lastLoggedAt: nowMs,
+				suppressed: 0
+			});
+			return {
+				refuse: true,
+				log: true,
+				closedAgeMs,
+				suppressed: 0
+			};
+		}
+		if (nowMs - existing.lastLoggedAt < this.logMinGapMs) {
+			existing.suppressed += 1;
+			return {
+				refuse: true,
+				log: false,
+				closedAgeMs,
+				suppressed: existing.suppressed
+			};
+		}
+		const suppressed = existing.suppressed;
+		existing.lastLoggedAt = nowMs;
+		existing.suppressed = 0;
+		return {
+			refuse: true,
+			log: true,
+			closedAgeMs,
+			suppressed
+		};
+	}
+	/** Drop all sampling state (addon dispose). */
+	clear() {
+		this.sampling.clear();
+	}
+	remember(trackId, state) {
+		this.sampling.set(trackId, state);
+		if (this.sampling.size <= this.maxTracked) return;
+		const oldest = this.sampling.keys().next();
+		if (!oldest.done) this.sampling.delete(oldest.value);
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/edge-clear.ts
 /**
 * edge-clear — pure geometry for "is the subject fully in frame?" best-frame
@@ -35295,6 +35781,210 @@ async function resolveDefaultEventMedia(deps) {
 	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
 }
 //#endregion
+//#region src/pipeline-analytics/face-settings.ts
+/**
+* Per-device face-recognition settings. Cascade: a per-device override on top
+* of the global default, resolved per field (an invalid/missing value falls
+* back to its default — parse never throws). Mirrors `audio-detection-settings`.
+*/
+var FaceSettingsSchema = object({
+	/**
+	* GLOBAL master switch only — a temporary kill for the whole face-recognition
+	* post-processor. On by default; the recognizer runs whenever the per-device
+	* detection pipeline produces face embeddings (the pipeline steps ARE the
+	* per-camera control). Not a per-device override — see
+	* `resolveGlobalFaceEnabled` / `getDeviceSettingsContribution` (the field is
+	* stripped from the per-device schema).
+	*/
+	enabled: boolean().default(true),
+	/**
+	* Cosine similarity (on L2-normalized arcface vectors) required to match.
+	*
+	* History: 0.55→0.62 on 2026-07-23, then back to 0.55 on 2026-08-18 once the
+	* dead `assignUniquePerFrame` margin and the poisoned gallery were fixed —
+	* with both repaired, genuine probes scored median 0.38 / p90 0.51, so 0.62
+	* left almost nothing recognisable. That retune lived only as a RUNTIME
+	* override until 2026-08-19; it is the schema default now, because a default
+	* nobody runs is a decision nobody made.
+	*
+	* ⚠ NOT the end state. 0.55 is the least-bad value for the CURRENT crop
+	* quality, where most of what reaches ArcFace is not a correctly aligned
+	* face (measured 2026-08-19 over 60 live crops pulled from the hub: 20%
+	* aligned, 18% marginal, 62% misaligned or containing no detectable face).
+	* On correctly aligned crops the SAME models separate at a far lower
+	* operating point — 300 LFW pairs gave genuine median 0.605 / impostor p90
+	* 0.175, best accuracy 98.3% at threshold 0.28.
+	*
+	* Recalibration plan, in this order:
+	*   1. land the landmark-precision gate (the alignment fix),
+	*   2. re-enrol the gallery from crops produced AFTER it,
+	*   3. re-measure genuine/impostor over a week of post-fix traffic,
+	*   4. expect to lower this toward ~0.30, and `margin` with it.
+	* Lowering it BEFORE step 1 would be actively harmful: a misaligned crop
+	* scores ~0.9 against everything, so the degenerate population sits ABOVE
+	* any threshold you could pick — the knob cannot reach it.
+	*/
+	similarityThreshold: number().min(0).max(1).default(.55),
+	/** Reject ambiguous matches: require best − secondBest ≥ margin. 0.10→0.15
+	*  (2026-07-23), then →0.12 (2026-08-18) alongside the threshold retune —
+	*  same story and the same recalibration plan as {@link similarityThreshold}. */
+	margin: number().min(0).max(1).default(.12),
+	/** Minimum face-detection confidence for a face to be considered. */
+	minFaceConfidence: number().min(0).max(1).default(.5),
+	/**
+	* Minimum face bbox size (px, shorter side, NATIVE scale when the runner
+	* measured it, else detection-frame space) for a face to be DETECTED and
+	* COLLECTED into the recent-faces buffer. Below this the face is dropped
+	* BEFORE ingest/enrolment (#26.1). This is the DETECTION/collection floor —
+	* NOT the auto-assignment floor (see {@link recognitionMinFacePx}).
+	*/
+	minFacePx: number().min(0).default(30),
+	/**
+	* Minimum face short side (px, NATIVE scale when the runner measured it, else
+	* detection-frame space) for a collected face to be eligible for AUTO-MATCH
+	* (identity assignment). Separate from — and ≥ — {@link minFacePx}: faces
+	* between `minFacePx` and this floor are still detected, cropped, and stored
+	* in the buffer (available for MANUAL assignment), but are NEVER auto-assigned
+	* an identity. ArcFace embeddings below ~48px are unreliable and drove the
+	* observed false positives (2026-07-23 face-quality batch). A face below this
+	* floor keeps `recognizedIdentityId` UNSET (fail-safe).
+	*/
+	recognitionMinFacePx: number().min(0).default(48),
+	/**
+	* Minimum enrolled-sample count an identity must have before it can be an
+	* AUTO-MATCH target. A single-sample identity is an unreliable sink (one noisy
+	* enrolment attracted 81% of matches); identities below this are excluded from
+	* automatic matching until more samples are enrolled (#26.3).
+	*/
+	minIdentitySamples: number().int().min(1).default(2),
+	/** Frames an identity must be confirmed before a track is assigned. Floor of
+	*  1 (0 confirmations would assign on a single noisy frame — nonsensical;
+	*  such a value falls back to the default). */
+	confirmFrames: number().int().min(1).default(3),
+	/**
+	* Upper bound on the RAW ArcFace feature magnitude a face may have and still
+	* be embedded into the buffer / matched / enrolled. `0` (the default) DISABLES
+	* the gate.
+	*
+	* This exists because a degenerate crop does not score LOW, it scores HIGH:
+	* measured on this cluster 2026-08-18/19, 28.8% of all pairs of DIFFERENT
+	* faces exceeded cosine 0.90 and the worst 40% of the face population had
+	* collapsed onto effectively one vector (mean pairwise cosine 0.976). No
+	* similarity threshold can reach that — it sits above every threshold — so the
+	* only defence is to refuse the embedding before it is stored or compared.
+	*
+	* Direction: for this model the DEGENERATE crops carry the LARGER norm (the
+	* inverse of the MagFace convention), hence a maximum. Over 140 LFW faces
+	* through this exact model and preprocessing, usable crops sat at ≈4.4 (p95
+	* 5.25) regardless of size, grey level or blur, while information-free crops
+	* jumped to 10–16; a bound of 6.0 kept 97.6% of usable crops and rejected
+	* 93.2% of degenerate ones.
+	*
+	* Default 0 ON PURPOSE. Those numbers are LFW's, not this cluster's, and the
+	* magnitude has never been observable here — `result-assembler` discarded it
+	* one line after computing it. The field and its logging ship first; set a
+	* real bound once a week of live `face: embedding magnitude` lines says where
+	* this cluster's populations actually sit. Enabling a gate against a number
+	* nobody has measured in production is how recognition silently stops.
+	*/
+	maxEmbeddingMagnitude: number().min(0).default(0),
+	/** Max buffered faces kept per device. */
+	bufferMaxPerDevice: number().int().min(0).default(50)
+});
+var FACE_DEFAULTS = FaceSettingsSchema.parse({});
+function resolveFaceSettings(raw) {
+	const pick = (key) => {
+		const parsed = FaceSettingsSchema.shape[key].safeParse(raw[key]);
+		return parsed.success ? parsed.data : FACE_DEFAULTS[key];
+	};
+	return {
+		enabled: pick("enabled"),
+		similarityThreshold: pick("similarityThreshold"),
+		margin: pick("margin"),
+		minFaceConfidence: pick("minFaceConfidence"),
+		minFacePx: pick("minFacePx"),
+		recognitionMinFacePx: pick("recognitionMinFacePx"),
+		minIdentitySamples: pick("minIdentitySamples"),
+		maxEmbeddingMagnitude: pick("maxEmbeddingMagnitude"),
+		confirmFrames: pick("confirmFrames"),
+		bufferMaxPerDevice: pick("bufferMaxPerDevice")
+	};
+}
+/**
+* The suggestion band opens at 80% of the assignment threshold.
+*
+* ## Why derived and not a knob
+*
+* `suggestionMinCosine` used to be its own operator-overridable field. Two
+* independent numbers described ONE band, so they could contradict each other
+* — and on the live hub they did. The 2026-08-19 retune lowered
+* `similarityThreshold` to 0.45 and left the suggestion floor at its 0.50
+* default, which INVERTS the band: `[0.50, 0.45)` is empty, so from that moment
+* the recognizer could not produce a single suggestion. Nothing errored,
+* nothing logged, and the form showed two plausible numbers side by side. That
+* is the D62 shape — a second authority over a fact that already had one — and
+* the fix is the same: delete the second authority rather than police it.
+*
+* Derived, the band cannot invert for ANY threshold, which is the property
+* `face-settings.spec.ts` pins over the whole domain rather than at samples.
+*
+* ## Why 0.8
+*
+* The operator's number, and it matches what the band was for: a near-miss is
+* a probe that scored within a fifth of the bar. At the schema default (0.55)
+* it reproduces a 0.44 floor — close to the 0.50 the band shipped with in
+* 2026-07 — and it TRACKS every future retune, which is the whole point: the
+* recalibration plan on {@link FaceSettingsSchema.shape.similarityThreshold}
+* expects the threshold to fall toward ~0.30 once alignment lands, and a fixed
+* floor would have to be remembered and moved by hand each time.
+*/
+var SUGGESTION_BAND_FACTOR = .8;
+/** Decimal places the derived floor is rounded to. `0.8 * 0.45` is
+*  `0.36000000000000004` in IEEE754, and an operator reading "36.000000000004%"
+*  in a report has been told the number is untrustworthy. */
+var DERIVED_PRECISION = 1e4;
+/**
+* The cosine floor of the suggestion band for a given assignment threshold.
+*
+* INVARIANT, total over `[0, 1]`: the result is never ABOVE the threshold, and
+* is strictly below it for every threshold > 0 — so the band
+* `[floor, threshold)` can never be empty. Rounding is applied only when it
+* preserves that (for a threshold small enough that rounding would reach it,
+* the exact product is returned instead).
+*/
+function deriveSuggestionMinCosine(similarityThreshold) {
+	const exact = similarityThreshold * SUGGESTION_BAND_FACTOR;
+	const rounded = Math.round(exact * DERIVED_PRECISION) / DERIVED_PRECISION;
+	return rounded < similarityThreshold ? rounded : exact;
+}
+/**
+* The settings key that used to hold the suggestion floor. Named once, here,
+* because the ONLY code allowed to mention it now is the migration that removes
+* it from a store.
+*/
+var STORED_SUGGESTION_MIN_COSINE_KEY = "suggestionMinCosine";
+/**
+* Plan the removal of a persisted suggestion floor from one settings blob.
+*
+* `null` = nothing to do, which is the steady state after the first pass and
+* for every store that never had one. Absence of the key IS the migration
+* marker — no flag, no version row, and re-running is a no-op.
+*
+* The patch uses `undefined`, never `null`: the settings merge preserves an
+* explicit `null` as a STORED value, which would leave exactly the
+* accepted-but-ignored residue this exists to remove, while `undefined`
+* survives the merge as a key with no value and is dropped by the JSON
+* serialisation the blob round-trips through.
+*/
+function planStoredSuggestionPurge(raw) {
+	const was = raw[STORED_SUGGESTION_MIN_COSINE_KEY];
+	if (was === void 0) return null;
+	return {
+		was,
+		patch: { [STORED_SUGGESTION_MIN_COSINE_KEY]: void 0 }
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/embedding-magnitude-gate.ts
 /**
 * `null` = accept. A verdict = refuse, carrying both numbers so the caller can
@@ -35542,7 +36232,7 @@ var FaceRecognizer = class {
 				embedding: c.embedding,
 				modelId: c.embeddingModelId
 			}, this.gallery, {
-				threshold: settings.suggestionMinCosine,
+				threshold: deriveSuggestionMinCosine(settings.similarityThreshold),
 				margin: settings.margin,
 				minIdentitySamples: settings.minIdentitySamples
 			});
@@ -35835,148 +36525,6 @@ var FaceRecognizer = class {
 	}
 };
 //#endregion
-//#region src/pipeline-analytics/face-settings.ts
-/**
-* Per-device face-recognition settings. Cascade: a per-device override on top
-* of the global default, resolved per field (an invalid/missing value falls
-* back to its default — parse never throws). Mirrors `audio-detection-settings`.
-*/
-var FaceSettingsSchema = object({
-	/**
-	* GLOBAL master switch only — a temporary kill for the whole face-recognition
-	* post-processor. On by default; the recognizer runs whenever the per-device
-	* detection pipeline produces face embeddings (the pipeline steps ARE the
-	* per-camera control). Not a per-device override — see
-	* `resolveGlobalFaceEnabled` / `getDeviceSettingsContribution` (the field is
-	* stripped from the per-device schema).
-	*/
-	enabled: boolean().default(true),
-	/**
-	* Cosine similarity (on L2-normalized arcface vectors) required to match.
-	*
-	* History: 0.55→0.62 on 2026-07-23, then back to 0.55 on 2026-08-18 once the
-	* dead `assignUniquePerFrame` margin and the poisoned gallery were fixed —
-	* with both repaired, genuine probes scored median 0.38 / p90 0.51, so 0.62
-	* left almost nothing recognisable. That retune lived only as a RUNTIME
-	* override until 2026-08-19; it is the schema default now, because a default
-	* nobody runs is a decision nobody made.
-	*
-	* ⚠ NOT the end state. 0.55 is the least-bad value for the CURRENT crop
-	* quality, where most of what reaches ArcFace is not a correctly aligned
-	* face (measured 2026-08-19 over 60 live crops pulled from the hub: 20%
-	* aligned, 18% marginal, 62% misaligned or containing no detectable face).
-	* On correctly aligned crops the SAME models separate at a far lower
-	* operating point — 300 LFW pairs gave genuine median 0.605 / impostor p90
-	* 0.175, best accuracy 98.3% at threshold 0.28.
-	*
-	* Recalibration plan, in this order:
-	*   1. land the landmark-precision gate (the alignment fix),
-	*   2. re-enrol the gallery from crops produced AFTER it,
-	*   3. re-measure genuine/impostor over a week of post-fix traffic,
-	*   4. expect to lower this toward ~0.30, and `margin` with it.
-	* Lowering it BEFORE step 1 would be actively harmful: a misaligned crop
-	* scores ~0.9 against everything, so the degenerate population sits ABOVE
-	* any threshold you could pick — the knob cannot reach it.
-	*/
-	similarityThreshold: number().min(0).max(1).default(.55),
-	/** Reject ambiguous matches: require best − secondBest ≥ margin. 0.10→0.15
-	*  (2026-07-23), then →0.12 (2026-08-18) alongside the threshold retune —
-	*  same story and the same recalibration plan as {@link similarityThreshold}. */
-	margin: number().min(0).max(1).default(.12),
-	/** Minimum face-detection confidence for a face to be considered. */
-	minFaceConfidence: number().min(0).max(1).default(.5),
-	/**
-	* Minimum face bbox size (px, shorter side, NATIVE scale when the runner
-	* measured it, else detection-frame space) for a face to be DETECTED and
-	* COLLECTED into the recent-faces buffer. Below this the face is dropped
-	* BEFORE ingest/enrolment (#26.1). This is the DETECTION/collection floor —
-	* NOT the auto-assignment floor (see {@link recognitionMinFacePx}).
-	*/
-	minFacePx: number().min(0).default(30),
-	/**
-	* Minimum face short side (px, NATIVE scale when the runner measured it, else
-	* detection-frame space) for a collected face to be eligible for AUTO-MATCH
-	* (identity assignment). Separate from — and ≥ — {@link minFacePx}: faces
-	* between `minFacePx` and this floor are still detected, cropped, and stored
-	* in the buffer (available for MANUAL assignment), but are NEVER auto-assigned
-	* an identity. ArcFace embeddings below ~48px are unreliable and drove the
-	* observed false positives (2026-07-23 face-quality batch). A face below this
-	* floor keeps `recognizedIdentityId` UNSET (fail-safe).
-	*/
-	recognitionMinFacePx: number().min(0).default(48),
-	/**
-	* Lower cosine bound of the SUGGESTION band (2026-07-24). A face whose best
-	* gallery match MISSES auto-assignment but is still plausible surfaces as a
-	* SUGGESTION (persisted `suggestedIdentityId`/`suggestedMatchScore`, never an
-	* assignment) when EITHER: its match cosine is in [`suggestionMinCosine`,
-	* `similarityThreshold`) AND its face clears the recognition size floor; OR its
-	* cosine is ≥ `similarityThreshold` but the face is below the recognition floor
-	* (blocked ONLY by size). Below this cosine nothing is suggested. Operator-
-	* overridable per field, like the other face thresholds.
-	*/
-	suggestionMinCosine: number().min(0).max(1).default(.5),
-	/**
-	* Minimum enrolled-sample count an identity must have before it can be an
-	* AUTO-MATCH target. A single-sample identity is an unreliable sink (one noisy
-	* enrolment attracted 81% of matches); identities below this are excluded from
-	* automatic matching until more samples are enrolled (#26.3).
-	*/
-	minIdentitySamples: number().int().min(1).default(2),
-	/** Frames an identity must be confirmed before a track is assigned. Floor of
-	*  1 (0 confirmations would assign on a single noisy frame — nonsensical;
-	*  such a value falls back to the default). */
-	confirmFrames: number().int().min(1).default(3),
-	/**
-	* Upper bound on the RAW ArcFace feature magnitude a face may have and still
-	* be embedded into the buffer / matched / enrolled. `0` (the default) DISABLES
-	* the gate.
-	*
-	* This exists because a degenerate crop does not score LOW, it scores HIGH:
-	* measured on this cluster 2026-08-18/19, 28.8% of all pairs of DIFFERENT
-	* faces exceeded cosine 0.90 and the worst 40% of the face population had
-	* collapsed onto effectively one vector (mean pairwise cosine 0.976). No
-	* similarity threshold can reach that — it sits above every threshold — so the
-	* only defence is to refuse the embedding before it is stored or compared.
-	*
-	* Direction: for this model the DEGENERATE crops carry the LARGER norm (the
-	* inverse of the MagFace convention), hence a maximum. Over 140 LFW faces
-	* through this exact model and preprocessing, usable crops sat at ≈4.4 (p95
-	* 5.25) regardless of size, grey level or blur, while information-free crops
-	* jumped to 10–16; a bound of 6.0 kept 97.6% of usable crops and rejected
-	* 93.2% of degenerate ones.
-	*
-	* Default 0 ON PURPOSE. Those numbers are LFW's, not this cluster's, and the
-	* magnitude has never been observable here — `result-assembler` discarded it
-	* one line after computing it. The field and its logging ship first; set a
-	* real bound once a week of live `face: embedding magnitude` lines says where
-	* this cluster's populations actually sit. Enabling a gate against a number
-	* nobody has measured in production is how recognition silently stops.
-	*/
-	maxEmbeddingMagnitude: number().min(0).default(0),
-	/** Max buffered faces kept per device. */
-	bufferMaxPerDevice: number().int().min(0).default(50)
-});
-var FACE_DEFAULTS = FaceSettingsSchema.parse({});
-function resolveFaceSettings(raw) {
-	const pick = (key) => {
-		const parsed = FaceSettingsSchema.shape[key].safeParse(raw[key]);
-		return parsed.success ? parsed.data : FACE_DEFAULTS[key];
-	};
-	return {
-		enabled: pick("enabled"),
-		similarityThreshold: pick("similarityThreshold"),
-		margin: pick("margin"),
-		minFaceConfidence: pick("minFaceConfidence"),
-		minFacePx: pick("minFacePx"),
-		recognitionMinFacePx: pick("recognitionMinFacePx"),
-		suggestionMinCosine: pick("suggestionMinCosine"),
-		minIdentitySamples: pick("minIdentitySamples"),
-		maxEmbeddingMagnitude: pick("maxEmbeddingMagnitude"),
-		confirmFrames: pick("confirmFrames"),
-		bufferMaxPerDevice: pick("bufferMaxPerDevice")
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/location-aware-media-storage.ts
 /**
 * Location-aware blob storage for event media (entity-routing spec, Phase 3).
@@ -46163,7 +46711,8 @@ function parseCloseReason(value) {
 }
 var DEFAULT_CONFIG = {
 	ttlMs: 3e4,
-	maxPositionHistory: 300
+	maxPositionHistory: 300,
+	closedRowMemory: 4096
 };
 /** `queryRecent` page-size defaults (mirrors the cap input's bounds). */
 var RECENT_DEFAULT_LIMIT = 200;
@@ -46480,6 +47029,20 @@ function cloneTrack(t) {
 }
 var TrackStore = class {
 	active = /* @__PURE__ */ new Map();
+	/**
+	* trackId → the instant THIS store closed (or deleted) the track's row.
+	*
+	* The `active` map alone cannot answer "is this row still open?": a sighting
+	* for an already-closed id re-creates a fresh active entry (`upsert`), which
+	* is exactly how a person track closed 4.4 minutes earlier received a dog's
+	* `thumbnail`, `keyFrame` and `lastFrame` on 2026-08-21. This is POSITIVE
+	* knowledge of a close the store performed — an id it has never heard of, or
+	* one evicted by the bound below, reads as WRITABLE (D49): losing a live
+	* track's media is worse than tolerating a late write.
+	*
+	* Insertion-ordered and bounded by `closedRowMemory` (oldest evicted first).
+	*/
+	closedRows = /* @__PURE__ */ new Map();
 	config;
 	logger;
 	store;
@@ -46501,6 +47064,25 @@ var TrackStore = class {
 			indexes: [...TRACKS_INDEXES]
 		});
 	}
+	/**
+	* When this store CLOSED the track's row (TTL expiry, early close, or the
+	* cascade delete), or `undefined` when it holds no such record.
+	*
+	* `undefined` is not "still open" — it is "no evidence of a close", and every
+	* caller must treat it as permission to write (D49). Read by the frame path's
+	* best-media gate; in-memory and infallible by construction.
+	*/
+	rowClosedAt(trackId) {
+		return this.closedRows.get(trackId);
+	}
+	/** Remember a close. Bounded, oldest-first — an evicted entry fails OPEN. */
+	noteRowClosed(trackId, atMs) {
+		this.closedRows.delete(trackId);
+		this.closedRows.set(trackId, atMs);
+		if (this.closedRows.size <= this.config.closedRowMemory) return;
+		const oldest = this.closedRows.keys().next();
+		if (!oldest.done) this.closedRows.delete(oldest.value);
+	}
 	/** Create or update the track record for a sighting in this frame. */
 	upsert(params) {
 		const existing = this.active.get(params.trackId);
@@ -46699,6 +47281,7 @@ var TrackStore = class {
 				});
 			}
 			this.active.delete(trackId);
+			this.noteRowClosed(trackId, nowMs);
 			expired.push(record);
 		}
 		return expired;
@@ -47066,6 +47649,7 @@ var TrackStore = class {
 	}
 	clearAll() {
 		this.active.clear();
+		this.closedRows.clear();
 	}
 	/**
 	* Drop a single active track WITHOUT persisting it as a historical row. Used
@@ -47113,6 +47697,7 @@ var TrackStore = class {
 		const record = cloneTrack(t);
 		await this.persistCompleted(record);
 		this.active.delete(trackId);
+		this.noteRowClosed(trackId, Date.now());
 		return true;
 	}
 	/** Delete the persisted track row (keyed by trackId) and drop the in-RAM
@@ -47123,6 +47708,7 @@ var TrackStore = class {
 			key: trackId
 		});
 		this.active.delete(trackId);
+		this.noteRowClosed(trackId, Date.now());
 	}
 	/**
 	* A page of persisted track ids for a device whose `lastSeen < cutoffMs`
@@ -52452,13 +53038,38 @@ function retagRetentionSection(sections) {
 	} : s);
 }
 /**
+* Key of the read-only readout that replaced the `suggestionMinCosine` knob
+* (D222).
+*
+* It is `readonlyField: true`, so the form renders it display-only with no
+* mutation handler and it can never enter a settings patch — it carries a
+* derived value and must not become the second stored authority it replaced.
+* Its value is injected at hydrate time by the addon's `getGlobalSettings`
+* override, the same mechanism `detection-pipeline` uses for its live
+* model-substitution readout.
+*/
+var SUGGESTION_THRESHOLD_READOUT_KEY = "suggestionThresholdReadout";
+/** Percent, at most one decimal, without a trailing `.0`. Cosines here are
+*  two-decimal operator values; `36.0%` reads like false precision. */
+function asPercent(value) {
+	return `${(value * 100).toFixed(1).replace(/\.0$/, "")}%`;
+}
+/**
+* The sentence beside the similarity threshold: what is being suggested from,
+* and the rule it comes from. Both, always — a number that moves whenever
+* another number moves reads as a bug unless the rule is on screen with it.
+*/
+function formatSuggestionThresholdReadout(similarityThreshold) {
+	return `${asPercent(deriveSuggestionMinCosine(similarityThreshold))} — ${asPercent(SUGGESTION_BAND_FACTOR)} of the ${asPercent(similarityThreshold)} match threshold`;
+}
+/**
 * Fields that live ONLY on the global settings page and must never surface in a
 * per-device contribution. The face-recognition `enabled` switch is the GLOBAL
 * master kill for the whole subsystem — per-camera face production is governed
 * by each device's detection-pipeline steps, so a per-device toggle would be
 * misleading. Keyed by section id → set of field keys to drop.
 */
-var GLOBAL_ONLY_FIELDS = { "face-recognition": new Set(["enabled"]) };
+var GLOBAL_ONLY_FIELDS = { "face-recognition": new Set(["enabled", SUGGESTION_THRESHOLD_READOUT_KEY]) };
 /** Whole sections that are cluster-wide (global page only) and must NOT appear
 *  in a per-device contribution. */
 var GLOBAL_ONLY_SECTIONS = new Set(["cluster-post-processing"]);
@@ -52940,7 +53551,7 @@ function buildGlobalSettingsSchema() {
 					type: "number",
 					key: "similarityThreshold",
 					label: "Similarity threshold",
-					description: "Cosine similarity (0–1) required to match a face to a known identity. Higher = stricter.",
+					description: "Cosine similarity (0–1) required to match a face to a known identity. Higher = stricter. This is the ONLY face-match bar: the suggestion band below it is derived from this value (80% of it), so it moves with every change you make here and can never end up above it.",
 					min: 0,
 					max: 1,
 					step: .05,
@@ -52987,14 +53598,12 @@ function buildGlobalSettingsSchema() {
 					unit: "px"
 				},
 				{
-					type: "number",
-					key: "suggestionMinCosine",
-					label: "Suggestion threshold",
-					description: "Lower cosine bound (0–1) of the SUGGESTION band. A plausible match that misses auto-assignment — cosine between this value and the similarity threshold with a large-enough face, or above the similarity threshold but below the recognition size floor — is surfaced as a one-tap SUGGESTION instead of being assigned. The face stays unassigned. Below this cosine nothing is suggested.",
-					min: 0,
-					max: 1,
-					step: .05,
-					default: FACE_DEFAULTS.suggestionMinCosine
+					type: "text",
+					key: SUGGESTION_THRESHOLD_READOUT_KEY,
+					label: "Suggestion threshold (derived)",
+					description: "Read-only. A plausible match that misses auto-assignment — a cosine between this value and the similarity threshold with a large-enough face, or above the similarity threshold but below the recognition size floor — is surfaced as a one-tap SUGGESTION instead of being assigned; the face stays unassigned. This floor is always 80% of the similarity threshold above, so lowering the threshold widens what is offered instead of silently closing the band.",
+					readonlyField: true,
+					default: ""
 				},
 				{
 					type: "number",
@@ -54477,7 +55086,8 @@ var customActions = {
 	...debugActions,
 	...orphanAuditActions,
 	...viewerSettingsActions,
-	...photoEnrollActions
+	...photoEnrollActions,
+	...faceRescoreActions
 };
 /**
 * Assist threshold when the caller does not pin one. Packages have their own
@@ -54666,7 +55276,7 @@ var MOTIONLESS_MAX_PX = 8;
 var PHANTOM_CELL_PX = 32;
 /** How long a cell remembers its closes. */
 var PHANTOM_CELL_WINDOW_MS = 360 * 6e4;
-var PipelineAnalyticsAddon = class extends BaseAddon {
+var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	/** Recent SHORT+MOTIONLESS track closes per `<device>:<class>:<cell>` —
 	*  see {@link noteShortMotionlessTrack}. Measurement only; each entry is
 	*  filtered against the 6-hour window on write, so it stays bounded. */
@@ -55198,6 +55808,11 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  queued captures via the onClose hook) and `closeDevice` finally clears
 	*  per-track state on device removal (the two documented leaks). */
 	residents = new TrackResidentState({ onClose: (trackId) => this.captureScheduler.cancelForTrack(trackId) });
+	/** Defence in depth for the 2026-08-21 `b50e09f7` incident: a row the track
+	*  store has already CLOSED never earns another media target, whatever the
+	*  tracker keeps handing back. Reads the store's in-RAM close record only —
+	*  see `pipeline/closed-row-media-gate.ts` for why it can only fail OPEN. */
+	closedRowMediaGate = new ClosedRowMediaGate();
 	/** Windowed per-device aggregation of the "media capture" diagnostic — the
 	*  per-capture line is debug; a 60s per-counter SUM lands at info (~1
 	*  line/min/device instead of one per §5 cadence tick, see media-capture-log.ts). */
@@ -55535,13 +56150,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					...debugActions,
 					...orphanAuditActions,
 					...viewerSettingsActions,
-					...photoEnrollActions
+					...photoEnrollActions,
+					...faceRescoreActions
 				},
 				actionHandlers: {
 					...ncHandlers,
 					...this.buildEmbeddingActionHandlers(),
 					...this.buildDebugActionHandlers(),
 					...this.buildPhotoEnrollActionHandlers(),
+					...this.buildFaceRescoreActionHandlers(),
 					...this.viewerSettingsSnapshots ? makeViewerSettingsActionHandlers(this.viewerSettingsSnapshots) : {}
 				}
 			} : {}
@@ -56413,6 +57030,21 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					});
 				},
 				getMediaForOwner: (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, ownerId),
+				getSubjectTrail: async (deviceId, trackId) => {
+					const dims = this.lastFrameDimsByDevice.get(deviceId);
+					if (dims === void 0 || dims.w <= 0 || dims.h <= 0) return [];
+					const track = stores.trackStore.getActiveByTrack(trackId) ?? await stores.trackStore.getPersistedByTrackId(trackId);
+					if (track === null || track === void 0) return [];
+					return track.positions.map((p) => ({
+						timestamp: p.timestamp,
+						bbox: {
+							x: p.bbox.x / dims.w,
+							y: p.bbox.y / dims.h,
+							w: p.bbox.w / dims.w,
+							h: p.bbox.h / dims.h
+						}
+					}));
+				},
 				getDeviceName,
 				buildActions: (input) => this.notificationCenter?.mintButtons(input) ?? Promise.resolve([])
 			},
@@ -59090,6 +59722,19 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		const targets = [];
 		for (const t of tracked) {
 			if (t.matchedThisFrame === false) continue;
+			const verdict = this.closedRowMediaGate.evaluate(t.trackId, this.trackStore.rowClosedAt(t.trackId), Date.now());
+			if (verdict.refuse) {
+				if (verdict.log) this.ctx.logger.warn("track media refused: row already closed", {
+					tags: { deviceId },
+					meta: {
+						trackId: t.trackId,
+						className: t.className,
+						closedAgeMs: verdict.closedAgeMs,
+						suppressed: verdict.suppressed
+					}
+				});
+				continue;
+			}
 			const lastSnap = this.trackStore.lastSnapshotAt(t.trackId);
 			const dueSnapshot = media.saveThumbnails && evaluatePeriodicSnapshot({
 				lastSnapshotAt: lastSnap,
@@ -59719,6 +60364,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		try {
 			const deviceIds = await this.retentionDeviceIds();
 			await this.migrateRetiredRetentionSettings(deviceIds);
+			await this.purgeStoredSuggestionThreshold(deviceIds);
 			await this.runTrackRetentionSweep(deviceIds, now);
 			const eventStore = this.eventStore;
 			const sensorEventStore = this.sensorEventStore;
@@ -59838,6 +60484,96 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			}
 		}
 	}
+	/** Whether the GLOBAL store has been checked for a stored suggestion floor
+	*  this process, and which devices have. One announcement, not a heartbeat. */
+	storedSuggestionCheckedGlobal = false;
+	storedSuggestionCheckedDevices = /* @__PURE__ */ new Set();
+	/**
+	* One-time: announce the suggestion floor D222 retired, then unset it —
+	* globally and per device.
+	*
+	* Removing the field from the schema already makes a stored value inert
+	* (`resolveFaceSettings` reads declared fields only). That is not enough. A
+	* number sitting in the blob is an authority waiting to be re-adopted by the
+	* next reader who greps for it, and it is what the operator last typed — so
+	* it must leave the store AND be said out loud, because the value in force
+	* changes: this hub carried `suggestionMinCosine: 0.33` against a 0.45
+	* threshold, and the band is 0.36 from now on. Silence here would be the
+	* same defect one layer up — an operator discovering three weeks later that
+	* their number stopped applying.
+	*
+	* Absence of the key IS the marker: no flag, no version row, re-running is a
+	* no-op. The write goes through `updateGlobalSettings` / `writeDeviceStore`
+	* (never a raw store write), and the patch unsets with `undefined` — an
+	* explicit `null` would survive the merge as exactly the residue being
+	* removed.
+	*/
+	async purgeStoredSuggestionThreshold(deviceIds) {
+		const settings = this.ctxIfReady?.settings;
+		if (!settings) return;
+		if (!this.storedSuggestionCheckedGlobal) {
+			this.storedSuggestionCheckedGlobal = true;
+			try {
+				const plan = planStoredSuggestionPurge(await this.resolveGlobalStore());
+				if (plan !== null) {
+					const global = resolveFaceSettings(await this.resolveGlobalStore());
+					this.announceRetiredSuggestionThreshold({
+						scope: "global",
+						was: plan.was,
+						threshold: global.similarityThreshold
+					});
+					await this.updateGlobalSettings(plan.patch);
+				}
+			} catch (err) {
+				this.storedSuggestionCheckedGlobal = false;
+				this.ctx.logger.warn("face suggestion threshold purge failed — will retry", { meta: {
+					scope: "global",
+					error: String(err)
+				} });
+			}
+		}
+		for (const deviceId of deviceIds) {
+			if (this.storedSuggestionCheckedDevices.has(deviceId)) continue;
+			this.storedSuggestionCheckedDevices.add(deviceId);
+			try {
+				const plan = planStoredSuggestionPurge(await settings.readDeviceStore(deviceId));
+				if (plan === null) continue;
+				const effective = await this.resolveDeviceFaceSettings(deviceId);
+				this.announceRetiredSuggestionThreshold({
+					scope: "device",
+					was: plan.was,
+					threshold: effective.similarityThreshold,
+					deviceId
+				});
+				await settings.writeDeviceStore(deviceId, plan.patch);
+			} catch (err) {
+				this.storedSuggestionCheckedDevices.delete(deviceId);
+				this.ctx.logger.warn("face suggestion threshold purge failed — will retry", {
+					tags: { deviceId },
+					meta: {
+						scope: "device",
+						error: String(err)
+					}
+				});
+			}
+		}
+	}
+	/** The one line the operator can read to see what their number became. Both
+	*  numbers, and the rule between them, or it does not explain anything. */
+	announceRetiredSuggestionThreshold(found) {
+		this.ctx.logger.warn("face suggestion threshold RETIRED — it is derived from the match threshold now", {
+			...found.deviceId !== void 0 ? { tags: { deviceId: found.deviceId } } : {},
+			meta: {
+				scope: found.scope,
+				setting: STORED_SUGGESTION_MIN_COSINE_KEY,
+				wasSetTo: found.was,
+				similarityThreshold: found.threshold,
+				bandFactor: SUGGESTION_BAND_FACTOR,
+				nowInForce: deriveSuggestionMinCosine(found.threshold),
+				why: "two knobs over one band could disagree, and did — a 0.45 threshold against a 0.50 floor made the suggestion band [0.50, 0.45) empty, so nothing could be suggested at all (D222)."
+			}
+		});
+	}
 	/**
 	* Hold the unassigned face + plate buffers to their per-device capacity.
 	*
@@ -61344,6 +62080,205 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			byIdentity: [...progress.byIdentity]
 		};
 	}
+	/**
+	* Side of the canonical ArcFace aligned template, in pixels
+	* (`ARCFACE_TEMPLATE_112` / `face-align.ts` on the runner). A stored face crop
+	* of exactly this size IS the template the embedder was fed; any other size
+	* is a padded bbox cut that only looks like one.
+	*/
+	static ARCFACE_TEMPLATE_PX = 112;
+	/**
+	* Re-embed ONE buffered face from its stored crop, into the cluster's current
+	* `face-embedding` space, and persist the result on the face row.
+	*
+	* Persisting is not optional. `assignFace` enrols `face.embedding` verbatim,
+	* so a rescore that computed a fresh vector, showed the operator a convincing
+	* percentage and then threw the vector away would enrol the STALE one the
+	* moment they acted on it — the gallery would gain a sample in a space the
+	* matcher cannot reach, which is precisely the failure the whole re-embed
+	* pass exists to undo.
+	*
+	* The 112×112 check is the load-bearing guard. A face's crop is the ArcFace
+	* template only when the detection carried landmarks; otherwise it is a
+	* padded bbox cut, and `face-embedding` over THAT as a whole frame returns a
+	* vector that passes every gate and means nothing (`face-reembed-pass.ts`
+	* documents the mirror-image trap). Refusing beats answering.
+	*/
+	async reembedBufferedFace(face, clusterModelId) {
+		const api = this.ctx.api;
+		const faceStore = this.faceStore;
+		const mediaStore = this.mediaStore;
+		const refuse = (reason, detail) => {
+			this.ctx.logger.warn("face rescore: re-embed refused", {
+				tags: { deviceId: face.deviceId },
+				meta: {
+					faceId: face.id,
+					trackId: face.trackId,
+					reason,
+					detail,
+					clusterModelId
+				}
+			});
+			return {
+				report: {
+					attempted: true,
+					succeeded: false,
+					reason,
+					detail,
+					modelId: clusterModelId
+				},
+				embedding: null
+			};
+		};
+		if (!api || !faceStore || !mediaStore) return refuse("failed", "the addon API or the face/media stores are not ready");
+		if (face.mediaKey === void 0 || face.mediaKey === "") return refuse("no-pixels", "this face kept no crop — there is nothing to re-embed from");
+		const file = await mediaStore.getByKey(face.mediaKey);
+		if (file === null) return refuse("no-pixels", `the crop blob ${face.mediaKey} is gone`);
+		const raster = await decodeJpegToRgb(file.base64);
+		const templatePx = PipelineAnalyticsAddon.ARCFACE_TEMPLATE_PX;
+		if (raster.width !== templatePx || raster.height !== templatePx) return refuse("not-a-template", `the stored crop is ${raster.width}×${raster.height}, not the ${templatePx}² aligned template — this face was captured without landmarks, so re-embedding it would produce a plausible and meaningless vector`);
+		const outcome = await new FaceReembedEmbedder({
+			runStatelessStep: (nodeId, stepInput) => this.runRebuildStepOn(nodeId, stepInput),
+			logger: { warn: (m, e) => this.ctx.logger.warn(m, e) }
+		}, await this.resolveRebuildNodes(api, void 0), clusterModelId).embed({
+			sampleId: face.id,
+			identityId: face.recognizedIdentityId ?? "",
+			identityName: `track ${face.trackId}`,
+			modelId: face.embeddingModelId ?? "arcface-r100",
+			dim: face.embedding.length,
+			mediaKey: face.mediaKey
+		}, Buffer.from(file.base64, "base64"));
+		if (outcome.kind === "no-capable-node") return refuse("no-capable-node", outcome.reason);
+		if (outcome.kind === "failed") return refuse("failed", outcome.reason);
+		await faceStore.update(face.id, {
+			embedding: outcome.embedding,
+			embeddingModelId: clusterModelId
+		});
+		if ((await faceStore.get(face.id))?.embeddingModelId !== clusterModelId) return refuse("not-persisted", "the re-embedded vector did not land on the face row");
+		this.ctx.logger.info("face rescore: re-embedded into the cluster model space", {
+			tags: { deviceId: face.deviceId },
+			meta: {
+				faceId: face.id,
+				trackId: face.trackId,
+				from: face.embeddingModelId ?? "arcface-r100",
+				to: clusterModelId,
+				dim: outcome.dim
+			}
+		});
+		return {
+			report: {
+				attempted: true,
+				succeeded: true,
+				modelId: clusterModelId
+			},
+			embedding: outcome.embedding
+		};
+	}
+	/**
+	* The matcher parameters in force for one device, as the report echoes them.
+	*
+	* The suggestion floor is DERIVED here and nowhere else in this class
+	* (D222) — and it is reported WITH `suggestionBandFactor`, because a floor
+	* that moves whenever the threshold moves reads as a bug unless the rule is
+	* on screen beside it. There is no stored `suggestionMinCosine` to report:
+	* the one the live hub carried (0.33) decided nothing from the moment this
+	* shipped, and the retention pass removes it.
+	*/
+	faceRescoreParams(settings) {
+		return {
+			threshold: settings.similarityThreshold,
+			margin: settings.margin,
+			minIdentitySamples: settings.minIdentitySamples,
+			suggestionMinCosine: deriveSuggestionMinCosine(settings.similarityThreshold),
+			suggestionBandFactor: SUGGESTION_BAND_FACTOR
+		};
+	}
+	/**
+	* `face.rescoreTrack` — the operator's "what does the gallery say NOW?".
+	*
+	* See `face-rescore.ts` for why the number already on the track cannot answer
+	* that: it was computed during live detection and persisted at track close,
+	* so every enrolment made since is invisible to it.
+	*/
+	async rescoreFaceForTrack(input) {
+		const api = this.ctx.api;
+		if (!api) throw new Error("face.rescoreTrack: the addon API is not available");
+		const faceStore = this.faceStore;
+		if (!faceStore) throw new Error("face.rescoreTrack: the face store is not ready");
+		const identityStore = this.identityStore;
+		if (!identityStore) throw new Error("face.rescoreTrack: the identity store is not ready");
+		const faceId = `face-${input.trackId}`;
+		const face = await faceStore.get(faceId);
+		if (!face) throw new Error(`face.rescoreTrack: no buffered face for track ${input.trackId}`);
+		if (face.deviceId !== input.deviceId) throw new Error(`face.rescoreTrack: face ${faceId} belongs to device ${face.deviceId}, not ${input.deviceId}`);
+		const clusterModelId = await resolveClusterModelPin(api, FACE_EMBEDDING_STEP_ID, { warn: (m, e) => this.ctx.logger.warn(m, e) });
+		if (clusterModelId === null) throw new Error("face.rescoreTrack: the cluster face-embedding model could not be resolved");
+		const settings = await this.resolveDeviceFaceSettings(input.deviceId);
+		const params = this.faceRescoreParams(settings);
+		let probeEmbedding = face.embedding;
+		let probeModelId = face.embeddingModelId ?? "arcface-r100";
+		let reembed = {
+			attempted: false,
+			succeeded: false,
+			reason: "not-requested"
+		};
+		if (input.reembed) {
+			const outcome = await this.reembedBufferedFace(face, clusterModelId);
+			reembed = outcome.report;
+			if (outcome.embedding !== null) {
+				probeEmbedding = outcome.embedding;
+				probeModelId = clusterModelId;
+			}
+		}
+		const [gallery, identities] = await Promise.all([identityStore.loadGallery(), identityStore.listIdentities()]);
+		const report = buildFaceRescoreReport({
+			probe: {
+				embedding: probeEmbedding,
+				modelId: probeModelId
+			},
+			gallery,
+			identityNames: new Map(identities.map((i) => [i.id, i.name])),
+			clusterModelId,
+			params
+		});
+		this.ctx.logger.info("face rescore", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				trackId: input.trackId,
+				faceId,
+				verdict: report.verdict,
+				probeModelId,
+				clusterModelId,
+				gallerySamples: gallery.length,
+				scored: report.identities.length,
+				best: report.identities[0]?.name ?? null,
+				bestScore: report.identities[0]?.score ?? null,
+				storedSuggestion: face.suggestedMatchScore ?? null,
+				reembedded: reembed.succeeded
+			}
+		});
+		return {
+			faceId,
+			deviceId: face.deviceId,
+			trackId: face.trackId,
+			assigned: face.assigned,
+			...face.recognizedIdentityId != null ? { assignedIdentityId: face.recognizedIdentityId } : {},
+			...face.suggestedIdentityId != null ? { storedSuggestedIdentityId: face.suggestedIdentityId } : {},
+			...face.suggestedMatchScore != null ? { storedSuggestedMatchScore: face.suggestedMatchScore } : {},
+			verdict: report.verdict,
+			comparable: report.comparable,
+			probeModelId: report.probeModelId,
+			clusterModelId: report.clusterModelId,
+			params: report.params,
+			identities: report.identities,
+			...report.runnerUpGap !== void 0 ? { runnerUpGap: report.runnerUpGap } : {},
+			reembedAvailable: probeModelId !== clusterModelId && face.mediaKey !== void 0 && face.mediaKey !== "",
+			reembed
+		};
+	}
+	buildFaceRescoreActionHandlers() {
+		return { "face.rescoreTrack": (input) => this.rescoreFaceForTrack(input) };
+	}
 	buildPhotoEnrollActionHandlers() {
 		return {
 			"photo.analyze": async (input) => {
@@ -62040,6 +62975,30 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	globalSettingsSchema() {
 		return this.schema(buildGlobalSettingsSchema());
 	}
+	/**
+	* The only reason this is overridden: the face suggestion floor is DERIVED
+	* (D222), so the form has to be able to SHOW it without storing it.
+	*
+	* The schema is a static declaration and cannot interpolate a live value, so
+	* the readout's value is injected into the hydrate blob here — the same
+	* mechanism `detection-pipeline` uses for its model-substitution readout.
+	* It is a `readonlyField`, so it renders display-only, never enters a patch,
+	* and never reaches the store: the operator sees what their threshold
+	* implies and has nothing to contradict it with. Everything else about this
+	* call is `BaseAddon`'s.
+	*/
+	async getGlobalSettings(overlay, cap, nodeId) {
+		const stored = await this.resolveGlobalStore(nodeId, cap);
+		const merged = overlay ? {
+			...stored,
+			...overlay
+		} : stored;
+		const readout = formatSuggestionThresholdReadout(resolveFaceSettings(merged).similarityThreshold);
+		return super.getGlobalSettings({
+			...merged,
+			[SUGGESTION_THRESHOLD_READOUT_KEY]: readout
+		}, cap, nodeId);
+	}
 	async getDeviceSettingsContribution(input) {
 		if (!await this.isCameraDevice(input.deviceId)) return null;
 		const schema = this.globalSettingsSchema();