@camstack/addon-post-analysis 1.2.118 → 1.2.119

package/dist/{dist-CO6pe7bi.js → dist-BtIolp2d.js}

@@ -5831,6 +5831,13 @@ var BaseAddon = class {
 	_readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
 	/** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
 	_registeredCapNames = [];
+	/**
+	* True only after `readAddonStore` actually answered. Constructor
+	* defaults look like stored config when the store is down — a forked
+	* addon that auto-starts from those defaults (cloudflare-tunnel quick
+	* mode, 2026-08-25) is not "the operator chose this".
+	*/
+	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
 	constructor(defaults) {
@@ -6231,7 +6238,9 @@ var BaseAddon = class {
 		];
 		let lastErr;
 		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-			return await settings.readAddonStore() ?? {};
+			const stored = await settings.readAddonStore() ?? {};
+			this.settingsStoreReady = true;
+			return stored;
 		} catch (err) {
 			lastErr = err;
 			const msg = err instanceof Error ? err.message : String(err);
@@ -6239,6 +6248,7 @@ var BaseAddon = class {
 			if (attempt === delaysMs.length) break;
 			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
 		}
+		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}

package/dist/{dist-Gn2fFMov.mjs → dist-R0Wd863b.mjs}

@@ -5800,6 +5800,13 @@ var BaseAddon = class {
 	_readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
 	/** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
 	_registeredCapNames = [];
+	/**
+	* True only after `readAddonStore` actually answered. Constructor
+	* defaults look like stored config when the store is down — a forked
+	* addon that auto-starts from those defaults (cloudflare-tunnel quick
+	* mode, 2026-08-25) is not "the operator chose this".
+	*/
+	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
 	constructor(defaults) {
@@ -6200,7 +6207,9 @@ var BaseAddon = class {
 		];
 		let lastErr;
 		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-			return await settings.readAddonStore() ?? {};
+			const stored = await settings.readAddonStore() ?? {};
+			this.settingsStoreReady = true;
+			return stored;
 		} catch (err) {
 			lastErr = err;
 			const msg = err instanceof Error ? err.message : String(err);
@@ -6208,6 +6217,7 @@ var BaseAddon = class {
 			if (attempt === delaysMs.length) break;
 			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
 		}
+		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}

package/dist/embedding-encoder/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CO6pe7bi.js");
+const require_dist = require("../dist-BtIolp2d.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_dist.__toESM(node_fs, 1);
 node_fs = require_dist.__toESM(node_fs);

package/dist/embedding-encoder/index.mjs

@@ -1,4 +1,4 @@
-import { M as PoolMemoryWatchdog, at as hfModelUrl, gt as resolvePoolMemoryPolicy, nt as embeddingEncoderCapability, ut as parseProcStatus, wt as BaseAddon } from "../dist-Gn2fFMov.mjs";
+import { M as PoolMemoryWatchdog, at as hfModelUrl, gt as resolvePoolMemoryPolicy, nt as embeddingEncoderCapability, ut as parseProcStatus, wt as BaseAddon } from "../dist-R0Wd863b.mjs";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import "node:fs";

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-BYzwylnw.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-CEBcz1NX.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.102",
+		version: "1.2.103",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",

package/dist/pipeline-analytics/{hostInit-TlKH3NQ8.mjs → hostInit-CP5WsAw5.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.102",
+				version: "1.2.103",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CO6pe7bi.js");
+const require_dist = require("../dist-BtIolp2d.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -4398,10 +4398,28 @@ var SCENE_LATCH_INDEXES = [{
 function sceneKey(deviceId, monitorId) {
 	return `${deviceId}:${monitorId}`;
 }
+/**
+* Reseed cap for BOTH scene ledgers.
+*
+* `DurableLedger` defaults to 100_000 and its own docblock says the owner "sets
+* it from the row set it expects". Neither scene ledger did, so the 30s
+* reconcile asked SQLite — through hub-main's event loop, which is the
+* cluster's only queue (D181) — for up to a hundred thousand rows twice a tick,
+* on a hub holding one scene and one latch (measured live 2026-08-25). A bound
+* nobody chose is not a bound.
+*
+* A scene is an operator-drawn monitor on ONE camera and a latch is at most one
+* row per scene, so the row set is `cameras x monitors-per-camera`. 5_000 is
+* ~5 monitors on each of a thousand cameras — far past any installation this
+* ships to, and still small enough that a runaway write loop is CAUGHT by the
+* bound instead of being paged in whole.
+*/
+var SCENE_LEDGER_LOAD_LIMIT = 5e3;
 var SCENE_CONFIG_SPEC = {
 	collection: SCENE_COLLECTION,
 	columns: SCENE_COLUMNS,
 	indexes: SCENE_INDEXES,
+	loadLimit: SCENE_LEDGER_LOAD_LIMIT,
 	writeMode: "write-behind",
 	keyOf: (row) => row.key,
 	toValue: (row) => ({
@@ -4417,6 +4435,7 @@ var SCENE_LATCH_SPEC = {
 	collection: SCENE_LATCH_COLLECTION,
 	columns: SCENE_LATCH_COLUMNS,
 	indexes: SCENE_LATCH_INDEXES,
+	loadLimit: SCENE_LEDGER_LOAD_LIMIT,
 	writeMode: "write-through",
 	keyOf: (row) => row.key,
 	toValue: (row) => ({
@@ -4446,6 +4465,9 @@ var SceneStore = class {
 	config;
 	latch;
 	logger;
+	/** `scenes/latches` as last announced. Null until the first load, so the
+	*  first one always speaks. */
+	lastLoggedCounts = null;
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.config = new DurableLedger({
@@ -4470,10 +4492,20 @@ var SceneStore = class {
 	* a container recreate, "loaded 0" is the one line that explains why every
 	* scene suddenly reads `unknown`, and its absence is what turns a data loss
 	* into a three-hour hunt.
+	*
+	* ON CHANGE ONLY, though — including the first load, where there is nothing
+	* to compare against. This runs on the 30s `SCENE_RELOAD_INTERVAL_MS` tick on
+	* every node, and it used to print unconditionally: measured live 2026-08-25,
+	* `scene state loaded {scenes=1 latches=1}` every 30 seconds forever. A count
+	* reprinted unchanged twice a minute is exactly how the "loaded 0" this line
+	* exists for gets scrolled past.
 	*/
 	async load() {
 		const scenes = await this.config.load();
 		const latches = await this.latch.load();
+		const counts = `${scenes.length}/${latches.length}`;
+		if (counts === this.lastLoggedCounts) return;
+		this.lastLoggedCounts = counts;
 		this.logger.info("scene state loaded", { meta: {
 			scenes: scenes.length,
 			latches: latches.length
@@ -8539,6 +8571,49 @@ var NC_LANGUAGES = ["en", "it"];
 *  surface's view all validate against this one, so a third language is added
 *  to `NC_LANGUAGES` and nowhere else. */
 var NcLanguageSchema = require_dist._enum(NC_LANGUAGES);
+/**
+* Whether two snapshots say the same thing.
+*
+* ## Why this is a function and not `===`
+*
+* The reload guard in `reloadTexts()` used to be
+* `before.overrides === next.overrides`, and `next` comes from
+* `NcTextCatalogStore.load()`, which `parse()`s the row through zod on every
+* call. The right-hand side is therefore a NEW object on every tick by
+* construction: the comparison was `false` at byte-identical content, forever.
+* Measured on the live hub 2026-08-25: 58 "notification texts loaded" lines in
+* 30 minutes on a hub whose language had not changed, from a line whose own
+* docblock promises it fires on CHANGE only.
+*
+* The document is two levels deep and installation-small (at most one entry per
+* language, each a flat key→string map), so the comparison is written out
+* rather than reached for through a deep-equal dependency — and written out it
+* can state the direction that matters: a REMOVED key must not read as equal,
+* which a one-directional key walk would get wrong.
+*/
+function ncTextSnapshotsEqual(a, b) {
+	if (a.language !== b.language) return false;
+	return overrideMapsEqual(a.overrides, b.overrides);
+}
+function overrideMapsEqual(a, b) {
+	const languages = new Set([...Object.keys(a), ...Object.keys(b)]);
+	for (const language of languages) {
+		const left = a[language];
+		const right = b[language];
+		if (left === void 0 || right === void 0) {
+			if (Object.keys(left ?? right ?? {}).length > 0) return false;
+			continue;
+		}
+		if (!flatMapsEqual(left, right)) return false;
+	}
+	return true;
+}
+function flatMapsEqual(a, b) {
+	const keys = Object.keys(a);
+	if (keys.length !== Object.keys(b).length) return false;
+	for (const key of keys) if (a[key] !== b[key]) return false;
+	return true;
+}
 /** The shipped files, keyed by language. Data, never mutated. */
 var NC_TEXT_BUNDLES = {
 	en: en_default,
@@ -22484,7 +22559,7 @@ var NotificationCenter = class NotificationCenter {
 		const before = this.texts.snapshot;
 		const next = await this.textStore.load();
 		this.texts.apply(next);
-		if (before.language === next.language && before.overrides === next.overrides) return;
+		if (ncTextSnapshotsEqual(before, next)) return;
 		this.logger.info("notification texts loaded", { meta: {
 			language: next.language,
 			overriddenKeys: Object.values(next.overrides).reduce((sum, keys) => sum + Object.keys(keys ?? {}).length, 0)
@@ -35459,6 +35534,18 @@ var EmbeddingDispatcher = class {
 	logger;
 	getRemoteFrame;
 	lastEmbedTime = /* @__PURE__ */ new Map();
+	/**
+	* trackId -> the frame pinned for it. Each entry holds a WHOLE decoded RGB
+	* frame (`PendingCrop.frameData`, ~0.7 MB), not a crop.
+	*
+	* Under the shipped `cropStrategy: 'first'` this doubles as the in-flight
+	* DEDUPE FLAG — `'first'` gates on `!pendingCrops.has(trackId)` — and there
+	* is no flush timer for that strategy, so nothing ever sweeps it. Until
+	* 2026-08-25 the delete lived on `processOne`'s success path only: an
+	* `extractCrop` throw or an `encoder.encode` rejection (a cross-process cap
+	* over UDS, with no timeout) stranded the frame permanently AND made that
+	* trackId un-embeddable forever. `processOne` now releases in a `finally`.
+	*/
 	pendingCrops = /* @__PURE__ */ new Map();
 	flushTimer = null;
 	unsubscribe = null;
@@ -35616,7 +35703,6 @@ var EmbeddingDispatcher = class {
 			this._processedCount++;
 			this._totalInferenceMs += inferenceMs;
 			this.lastEmbedTime.set(pending.deviceId, Date.now());
-			this.pendingCrops.delete(pending.trackId);
 			const embeddingId = `${pending.deviceId}/${pending.trackId}/${Date.now()}`;
 			const payload = {
 				deviceId: Number(pending.deviceId),
@@ -35648,8 +35734,21 @@ var EmbeddingDispatcher = class {
 					error: String(err)
 				}
 			});
+		} finally {
+			if (this.pendingCrops.get(pending.trackId) === pending) this.pendingCrops.delete(pending.trackId);
 		}
 	}
+	/**
+	* Decoded frames currently pinned in {@link pendingCrops}.
+	*
+	* ~0.7 MB each (a whole RGB detection frame, not a crop), so this number IS
+	* the dispatcher's memory footprint. Exposed because the entries are
+	* invisible in every functional read: a stranded one looks exactly like a
+	* track that was never detected.
+	*/
+	pendingFrameCount() {
+		return this.pendingCrops.size;
+	}
 };
 /**
 * Re-embed every listed track from its key frame.
@@ -51444,9 +51543,14 @@ function deriveFrameDispatchKind(content) {
 }
 var DEFAULT_MAX_IN_FLIGHT_PER_DEVICE = 3;
 var DEFAULT_LOG_WINDOW_MS = 6e4;
+/** One `capture queue full` line per device per this interval. The condition
+*  holds for as long as the lane is saturated; one line per shed request would
+*  be thousands. */
+var OVERFLOW_WARN_THROTTLE_MS = 6e4;
 var CaptureScheduler = class {
 	logger;
 	budget;
+	maxQueued;
 	windowMs;
 	now;
 	lanes = /* @__PURE__ */ new Map();
@@ -51455,9 +51559,12 @@ var CaptureScheduler = class {
 	/** holdKey → refcount of queued/running requests holding it. */
 	heldKeys = /* @__PURE__ */ new Map();
 	windows = /* @__PURE__ */ new Map();
+	/** Per-device throttle for the `capture queue full` warn. */
+	lastOverflowWarnAt = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.logger = options.logger;
 		this.budget = options.maxInFlightPerDevice ?? DEFAULT_MAX_IN_FLIGHT_PER_DEVICE;
+		this.maxQueued = Math.max(1, options.maxQueuedPerDevice ?? 24);
 		this.windowMs = options.logWindowMs ?? DEFAULT_LOG_WINDOW_MS;
 		this.now = options.now ?? Date.now;
 	}
@@ -51527,6 +51634,7 @@ var CaptureScheduler = class {
 			failed: w.failed,
 			coalesced: w.coalesced,
 			droppedStale: w.droppedStale,
+			droppedOverflow: w.droppedOverflow,
 			cancelled: w.cancelled,
 			maxQueueDepth: w.maxQueueDepth
 		};
@@ -51575,7 +51683,37 @@ var CaptureScheduler = class {
 			throw err;
 		});
 	}
-	/** Queue an over-budget request (priority-ordered, FIFO within priority). */
+	/**
+	* Queue an over-budget request (priority-ordered, FIFO within priority),
+	* under a BOUND enforced here rather than at dequeue.
+	*
+	* ## Why the queue needs its own bound
+	*
+	* `staleAfterMs` is evaluated in {@link pump}, and `pump` only touches the
+	* queue while `inFlight < budget`. A lane that stays saturated therefore
+	* never inspects its queue at all — nothing expires, nothing is shed, and the
+	* queue grows for as long as the pressure lasts. The budget bounds concurrent
+	* WORK; it has never bounded queued work.
+	*
+	* That gap is not theoretical: the per-frame batch dispatch PINS a ~0.7 MB
+	* copy of the detection frame BEFORE queueing (so ring recycling cannot
+	* invalidate it), and the queued closure holds that copy alive. Measured on
+	* the live hub, `hub/pipeline-analytics` ran at rss=3911MB with heapUsed only
+	* 153MB and arrayBuffers=2281MB — 2.28 GB of JS-reachable Buffers, roughly
+	* 3 200 pinned frames, in a runner whose heap limit is 1216 MB. The call site
+	* that pins them says the cost is "bounded by the lane"; it was not.
+	*
+	* Two things happen on the way in, in this order:
+	*
+	*  1. **expire what is already dead.** Entries past their `staleAfterMs` are
+	*     dropped now. They were doomed the moment they expired; `pump` simply
+	*     never got to look. This is the reclaim that costs nothing.
+	*  2. **shed the least important.** Still over the cap, the TAIL goes — the
+	*     queue is ordered by priority, so the tail is by construction the work
+	*     this scheduler already ranked last. Whether that is the newcomer or an
+	*     older low-priority entry is decided by the same ordering that decides
+	*     execution, so a `firstFrame` never loses its place to an `embed`.
+	*/
 	enqueue(lane, input) {
 		return new Promise((resolve, reject) => {
 			const entry = {
@@ -51588,11 +51726,53 @@ var CaptureScheduler = class {
 				},
 				drop: () => resolve(null)
 			};
+			this.dropExpired(input.deviceId, lane);
 			this.insertByPriority(lane, entry);
+			this.shedToCap(input.deviceId, lane);
 			const w = this.window(input.deviceId);
 			if (lane.queue.length > w.maxQueueDepth) w.maxQueueDepth = lane.queue.length;
 		});
 	}
+	/** Drop every queued entry already past its `staleAfterMs`. Entries without
+	*  one (e.g. `confirm`, which gates track birth) are never expired here. */
+	dropExpired(deviceId, lane) {
+		const nowMs = this.now();
+		for (let i = lane.queue.length - 1; i >= 0; i -= 1) {
+			const entry = lane.queue[i];
+			if (entry === void 0) continue;
+			if (entry.staleAfterMs === void 0 || nowMs - entry.enqueuedAt <= entry.staleAfterMs) continue;
+			lane.queue.splice(i, 1);
+			this.bump(deviceId, "droppedStale");
+			entry.drop();
+		}
+	}
+	/** Shed from the tail (lowest priority, newest within it) until the lane is
+	*  at its cap. Loud: a capture that is dropped rather than merely late is a
+	*  missing thumbnail or first frame, and silence would read as "never asked". */
+	shedToCap(deviceId, lane) {
+		let shed = 0;
+		while (lane.queue.length > this.maxQueued) {
+			const victim = lane.queue.pop();
+			if (victim === void 0) break;
+			this.bump(deviceId, "droppedOverflow");
+			victim.drop();
+			shed += 1;
+		}
+		if (shed === 0) return;
+		const nowMs = this.now();
+		if (nowMs - (this.lastOverflowWarnAt.get(deviceId) ?? Number.NEGATIVE_INFINITY) < OVERFLOW_WARN_THROTTLE_MS) return;
+		this.lastOverflowWarnAt.set(deviceId, nowMs);
+		this.logger.warn("capture queue full — shedding the lowest-priority captures for this camera", {
+			tags: { deviceId },
+			meta: {
+				shed,
+				cap: this.maxQueued,
+				queueDepth: lane.queue.length,
+				inFlight: lane.inFlight,
+				budget: this.budget
+			}
+		});
+	}
 	insertByPriority(lane, entry) {
 		let index = lane.queue.length;
 		while (index > 0) {
@@ -51639,6 +51819,7 @@ var CaptureScheduler = class {
 			failed: 0,
 			coalesced: 0,
 			droppedStale: 0,
+			droppedOverflow: 0,
 			cancelled: 0,
 			maxQueueDepth: 0
 		};
@@ -51663,6 +51844,7 @@ var CaptureScheduler = class {
 				failed: w.failed,
 				coalesced: w.coalesced,
 				droppedStale: w.droppedStale,
+				droppedOverflow: w.droppedOverflow,
 				cancelled: w.cancelled,
 				maxQueueDepth: w.maxQueueDepth,
 				queueDepth: this.queueDepth(deviceId),
@@ -53233,8 +53415,14 @@ var EventMediaDispatcher = class {
 	* scheduler request against a 3-slot device lane and can start seconds late,
 	* by which time the handle's ring slot is usually recycled and the by-handle
 	* resolve in {@link captureForFrame} finds nothing (the 2026-07-23 boxed-tile
-	* regression). ~0.7MB per pinned frame, freed with the batch — bounded by the
-	* lane. Returns `null` on a genuine live-window miss.
+	* regression). ~0.7MB per pinned frame, freed with the batch.
+	*
+	* THE COPY IS ONLY AS BOUNDED AS THE QUEUE THAT HOLDS IT. This said "bounded
+	* by the lane" while the lane bounded in-flight execs (3) and nothing at all
+	* bounded the queue behind them, so a saturated camera accumulated pinned
+	* frames without limit — 2.28 GB of `arrayBuffers` measured on the live hub.
+	* Every caller must therefore pass `staleAfterMs`, and `CaptureScheduler`
+	* caps queue depth per device. Returns `null` on a genuine live-window miss.
 	*
 	* Both miss paths are WARN, throttled to one line per device per minute. They
 	* are the FIRST half of a pair whose second half (`capture batch lost`) has
@@ -60708,6 +60896,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 						hasSnapshot: snapshotTargets.some((t) => t.appendSnapshot)
 					}),
 					holdKeys: heldCaptureKeys,
+					staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
 					exec: () => pinnedFramePromise.then((pinnedFrame) => dispatcher.captureForFrame({
 						deviceId,
 						frameHandle,
@@ -61637,7 +61826,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.captureScheduler.request({
 			deviceId,
 			kind: "thumbnail",
+			trackId,
 			holdKeys: [captureCoalesceKey(deviceId, "thumbnail", trackId)],
+			staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
 			exec: async () => {
 				const [pinnedFrame, media] = await Promise.all([pinnedFramePromise, this.resolveDeviceMediaSettings(deviceId)]);
 				const res = await dispatcher.captureForFrame({

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as customAction, A as NcTaxonomySchema, At as sleep, B as TIMELAPSE_DENSE_FLOOR_SEC, Bt as string, C as NcRuleSchema, Ct as errMsg, D as NcSnoozeSchema, Dt as hydrateSchema, E as NcSnoozeInputSchema, Et as createEvent, Ft as literal, G as VISIT_MERGE_GAP_MS, H as TimelapseRulePatchSchema, Ht as EventCategory, I as SCENE_DEFAULT_ANCHOR_THRESHOLD, It as number, J as assertTimelapseCadences, K as addonWidgetsSourceCapability, L as SCENE_DEFAULT_UNCOVERED_POLICY, Lt as object, Mt as array, N as RECORDING_EXPORT_MAX_READ_BYTES, Nt as boolean, O as NcSnoozeSuppressedSchema, Ot as isDeviceScopedCap, P as RetrainStatusSchema, Pt as discriminatedUnion, Q as cosineSimilarity$1, R as SCENE_DIVERGED, Rt as partialRecord, S as NcRulePatchSchema, St as zoneAnalyticsCapability, T as NcScheduleSchema, Tt as DeviceType, U as TimelapseRuleSchema, V as TimelapseRuleInputSchema, Vt as unknown, W as TrackSourceSchema, X as audioModeOf, Y as audioMetricsCapability, Z as buildEventKindDescriptor, _ as NC_DEFAULT_SNOOZE_MINUTES, _t as sceneMonitorCapability, a as DEFAULT_EVENT_COLOR, b as NcConditionDescriptorSchema, bt as vectorDimFromBase64, ct as kebabToCamel, d as EVENT_PAD_MS, dt as pickClusterStepModels, et as defineCustomActions, f as FULL_IMAGE_BBOX, ft as pipelineAnalyticsCapability, g as NC_CONDITION_CATALOG, h as NC_ALARM_SYSTEM_EVENT_KINDS, ht as readTimelapseGeneratedAt, i as CLUSTER_MODEL_SCOPED_STEPS, it as faceGalleryCapability, j as OpsLogEntrySchema, jt as _enum, k as NcSystemEventKindSchema, kt as nodePin, l as DeclaredDevices, lt as notificationRulesCapability, m as MACRO_LABELS, mt as readDeviceStateFrom, n as AnalyticsGroupRecordSchema, ot as isDetectionMacroClass, p as LabelAttributionSchema, pt as plateGalleryCapability, q as alarmPanelCapability, r as BaseDevice, rt as encodeVectorBase64, s as DETECTION_MACRO_CLASSES, st as isScheduleActive, t as AnalyticsGroupDetailSchema, tt as deriveRecordingMode, u as EVENT_KIND_BY_CAP, vt as subKindsOf, w as NcRuleTargetSchema, wt as BaseAddon, x as NcRuleInputSchema, xt as videoclipsCapability, y as NC_TAXONOMY, yt as systemEventFilterApplies, z as SceneMonitorSchema, zt as record } from "../dist-Gn2fFMov.mjs";
+import { $ as customAction, A as NcTaxonomySchema, At as sleep, B as TIMELAPSE_DENSE_FLOOR_SEC, Bt as string, C as NcRuleSchema, Ct as errMsg, D as NcSnoozeSchema, Dt as hydrateSchema, E as NcSnoozeInputSchema, Et as createEvent, Ft as literal, G as VISIT_MERGE_GAP_MS, H as TimelapseRulePatchSchema, Ht as EventCategory, I as SCENE_DEFAULT_ANCHOR_THRESHOLD, It as number, J as assertTimelapseCadences, K as addonWidgetsSourceCapability, L as SCENE_DEFAULT_UNCOVERED_POLICY, Lt as object, Mt as array, N as RECORDING_EXPORT_MAX_READ_BYTES, Nt as boolean, O as NcSnoozeSuppressedSchema, Ot as isDeviceScopedCap, P as RetrainStatusSchema, Pt as discriminatedUnion, Q as cosineSimilarity$1, R as SCENE_DIVERGED, Rt as partialRecord, S as NcRulePatchSchema, St as zoneAnalyticsCapability, T as NcScheduleSchema, Tt as DeviceType, U as TimelapseRuleSchema, V as TimelapseRuleInputSchema, Vt as unknown, W as TrackSourceSchema, X as audioModeOf, Y as audioMetricsCapability, Z as buildEventKindDescriptor, _ as NC_DEFAULT_SNOOZE_MINUTES, _t as sceneMonitorCapability, a as DEFAULT_EVENT_COLOR, b as NcConditionDescriptorSchema, bt as vectorDimFromBase64, ct as kebabToCamel, d as EVENT_PAD_MS, dt as pickClusterStepModels, et as defineCustomActions, f as FULL_IMAGE_BBOX, ft as pipelineAnalyticsCapability, g as NC_CONDITION_CATALOG, h as NC_ALARM_SYSTEM_EVENT_KINDS, ht as readTimelapseGeneratedAt, i as CLUSTER_MODEL_SCOPED_STEPS, it as faceGalleryCapability, j as OpsLogEntrySchema, jt as _enum, k as NcSystemEventKindSchema, kt as nodePin, l as DeclaredDevices, lt as notificationRulesCapability, m as MACRO_LABELS, mt as readDeviceStateFrom, n as AnalyticsGroupRecordSchema, ot as isDetectionMacroClass, p as LabelAttributionSchema, pt as plateGalleryCapability, q as alarmPanelCapability, r as BaseDevice, rt as encodeVectorBase64, s as DETECTION_MACRO_CLASSES, st as isScheduleActive, t as AnalyticsGroupDetailSchema, tt as deriveRecordingMode, u as EVENT_KIND_BY_CAP, vt as subKindsOf, w as NcRuleTargetSchema, wt as BaseAddon, x as NcRuleInputSchema, xt as videoclipsCapability, y as NC_TAXONOMY, yt as systemEventFilterApplies, z as SceneMonitorSchema, zt as record } from "../dist-R0Wd863b.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -4391,10 +4391,28 @@ var SCENE_LATCH_INDEXES = [{
 function sceneKey(deviceId, monitorId) {
 	return `${deviceId}:${monitorId}`;
 }
+/**
+* Reseed cap for BOTH scene ledgers.
+*
+* `DurableLedger` defaults to 100_000 and its own docblock says the owner "sets
+* it from the row set it expects". Neither scene ledger did, so the 30s
+* reconcile asked SQLite — through hub-main's event loop, which is the
+* cluster's only queue (D181) — for up to a hundred thousand rows twice a tick,
+* on a hub holding one scene and one latch (measured live 2026-08-25). A bound
+* nobody chose is not a bound.
+*
+* A scene is an operator-drawn monitor on ONE camera and a latch is at most one
+* row per scene, so the row set is `cameras x monitors-per-camera`. 5_000 is
+* ~5 monitors on each of a thousand cameras — far past any installation this
+* ships to, and still small enough that a runaway write loop is CAUGHT by the
+* bound instead of being paged in whole.
+*/
+var SCENE_LEDGER_LOAD_LIMIT = 5e3;
 var SCENE_CONFIG_SPEC = {
 	collection: SCENE_COLLECTION,
 	columns: SCENE_COLUMNS,
 	indexes: SCENE_INDEXES,
+	loadLimit: SCENE_LEDGER_LOAD_LIMIT,
 	writeMode: "write-behind",
 	keyOf: (row) => row.key,
 	toValue: (row) => ({
@@ -4410,6 +4428,7 @@ var SCENE_LATCH_SPEC = {
 	collection: SCENE_LATCH_COLLECTION,
 	columns: SCENE_LATCH_COLUMNS,
 	indexes: SCENE_LATCH_INDEXES,
+	loadLimit: SCENE_LEDGER_LOAD_LIMIT,
 	writeMode: "write-through",
 	keyOf: (row) => row.key,
 	toValue: (row) => ({
@@ -4439,6 +4458,9 @@ var SceneStore = class {
 	config;
 	latch;
 	logger;
+	/** `scenes/latches` as last announced. Null until the first load, so the
+	*  first one always speaks. */
+	lastLoggedCounts = null;
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.config = new DurableLedger({
@@ -4463,10 +4485,20 @@ var SceneStore = class {
 	* a container recreate, "loaded 0" is the one line that explains why every
 	* scene suddenly reads `unknown`, and its absence is what turns a data loss
 	* into a three-hour hunt.
+	*
+	* ON CHANGE ONLY, though — including the first load, where there is nothing
+	* to compare against. This runs on the 30s `SCENE_RELOAD_INTERVAL_MS` tick on
+	* every node, and it used to print unconditionally: measured live 2026-08-25,
+	* `scene state loaded {scenes=1 latches=1}` every 30 seconds forever. A count
+	* reprinted unchanged twice a minute is exactly how the "loaded 0" this line
+	* exists for gets scrolled past.
 	*/
 	async load() {
 		const scenes = await this.config.load();
 		const latches = await this.latch.load();
+		const counts = `${scenes.length}/${latches.length}`;
+		if (counts === this.lastLoggedCounts) return;
+		this.lastLoggedCounts = counts;
 		this.logger.info("scene state loaded", { meta: {
 			scenes: scenes.length,
 			latches: latches.length
@@ -8532,6 +8564,49 @@ var NC_LANGUAGES = ["en", "it"];
 *  surface's view all validate against this one, so a third language is added
 *  to `NC_LANGUAGES` and nowhere else. */
 var NcLanguageSchema = _enum(NC_LANGUAGES);
+/**
+* Whether two snapshots say the same thing.
+*
+* ## Why this is a function and not `===`
+*
+* The reload guard in `reloadTexts()` used to be
+* `before.overrides === next.overrides`, and `next` comes from
+* `NcTextCatalogStore.load()`, which `parse()`s the row through zod on every
+* call. The right-hand side is therefore a NEW object on every tick by
+* construction: the comparison was `false` at byte-identical content, forever.
+* Measured on the live hub 2026-08-25: 58 "notification texts loaded" lines in
+* 30 minutes on a hub whose language had not changed, from a line whose own
+* docblock promises it fires on CHANGE only.
+*
+* The document is two levels deep and installation-small (at most one entry per
+* language, each a flat key→string map), so the comparison is written out
+* rather than reached for through a deep-equal dependency — and written out it
+* can state the direction that matters: a REMOVED key must not read as equal,
+* which a one-directional key walk would get wrong.
+*/
+function ncTextSnapshotsEqual(a, b) {
+	if (a.language !== b.language) return false;
+	return overrideMapsEqual(a.overrides, b.overrides);
+}
+function overrideMapsEqual(a, b) {
+	const languages = new Set([...Object.keys(a), ...Object.keys(b)]);
+	for (const language of languages) {
+		const left = a[language];
+		const right = b[language];
+		if (left === void 0 || right === void 0) {
+			if (Object.keys(left ?? right ?? {}).length > 0) return false;
+			continue;
+		}
+		if (!flatMapsEqual(left, right)) return false;
+	}
+	return true;
+}
+function flatMapsEqual(a, b) {
+	const keys = Object.keys(a);
+	if (keys.length !== Object.keys(b).length) return false;
+	for (const key of keys) if (a[key] !== b[key]) return false;
+	return true;
+}
 /** The shipped files, keyed by language. Data, never mutated. */
 var NC_TEXT_BUNDLES = {
 	en: en_default,
@@ -22462,7 +22537,7 @@ var NotificationCenter = class NotificationCenter {
 		const before = this.texts.snapshot;
 		const next = await this.textStore.load();
 		this.texts.apply(next);
-		if (before.language === next.language && before.overrides === next.overrides) return;
+		if (ncTextSnapshotsEqual(before, next)) return;
 		this.logger.info("notification texts loaded", { meta: {
 			language: next.language,
 			overriddenKeys: Object.values(next.overrides).reduce((sum, keys) => sum + Object.keys(keys ?? {}).length, 0)
@@ -35397,6 +35472,18 @@ var EmbeddingDispatcher = class {
 	logger;
 	getRemoteFrame;
 	lastEmbedTime = /* @__PURE__ */ new Map();
+	/**
+	* trackId -> the frame pinned for it. Each entry holds a WHOLE decoded RGB
+	* frame (`PendingCrop.frameData`, ~0.7 MB), not a crop.
+	*
+	* Under the shipped `cropStrategy: 'first'` this doubles as the in-flight
+	* DEDUPE FLAG — `'first'` gates on `!pendingCrops.has(trackId)` — and there
+	* is no flush timer for that strategy, so nothing ever sweeps it. Until
+	* 2026-08-25 the delete lived on `processOne`'s success path only: an
+	* `extractCrop` throw or an `encoder.encode` rejection (a cross-process cap
+	* over UDS, with no timeout) stranded the frame permanently AND made that
+	* trackId un-embeddable forever. `processOne` now releases in a `finally`.
+	*/
 	pendingCrops = /* @__PURE__ */ new Map();
 	flushTimer = null;
 	unsubscribe = null;
@@ -35554,7 +35641,6 @@ var EmbeddingDispatcher = class {
 			this._processedCount++;
 			this._totalInferenceMs += inferenceMs;
 			this.lastEmbedTime.set(pending.deviceId, Date.now());
-			this.pendingCrops.delete(pending.trackId);
 			const embeddingId = `${pending.deviceId}/${pending.trackId}/${Date.now()}`;
 			const payload = {
 				deviceId: Number(pending.deviceId),
@@ -35586,8 +35672,21 @@ var EmbeddingDispatcher = class {
 					error: String(err)
 				}
 			});
+		} finally {
+			if (this.pendingCrops.get(pending.trackId) === pending) this.pendingCrops.delete(pending.trackId);
 		}
 	}
+	/**
+	* Decoded frames currently pinned in {@link pendingCrops}.
+	*
+	* ~0.7 MB each (a whole RGB detection frame, not a crop), so this number IS
+	* the dispatcher's memory footprint. Exposed because the entries are
+	* invisible in every functional read: a stranded one looks exactly like a
+	* track that was never detected.
+	*/
+	pendingFrameCount() {
+		return this.pendingCrops.size;
+	}
 };
 /**
 * Re-embed every listed track from its key frame.
@@ -51381,9 +51480,14 @@ function deriveFrameDispatchKind(content) {
 }
 var DEFAULT_MAX_IN_FLIGHT_PER_DEVICE = 3;
 var DEFAULT_LOG_WINDOW_MS = 6e4;
+/** One `capture queue full` line per device per this interval. The condition
+*  holds for as long as the lane is saturated; one line per shed request would
+*  be thousands. */
+var OVERFLOW_WARN_THROTTLE_MS = 6e4;
 var CaptureScheduler = class {
 	logger;
 	budget;
+	maxQueued;
 	windowMs;
 	now;
 	lanes = /* @__PURE__ */ new Map();
@@ -51392,9 +51496,12 @@ var CaptureScheduler = class {
 	/** holdKey → refcount of queued/running requests holding it. */
 	heldKeys = /* @__PURE__ */ new Map();
 	windows = /* @__PURE__ */ new Map();
+	/** Per-device throttle for the `capture queue full` warn. */
+	lastOverflowWarnAt = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.logger = options.logger;
 		this.budget = options.maxInFlightPerDevice ?? DEFAULT_MAX_IN_FLIGHT_PER_DEVICE;
+		this.maxQueued = Math.max(1, options.maxQueuedPerDevice ?? 24);
 		this.windowMs = options.logWindowMs ?? DEFAULT_LOG_WINDOW_MS;
 		this.now = options.now ?? Date.now;
 	}
@@ -51464,6 +51571,7 @@ var CaptureScheduler = class {
 			failed: w.failed,
 			coalesced: w.coalesced,
 			droppedStale: w.droppedStale,
+			droppedOverflow: w.droppedOverflow,
 			cancelled: w.cancelled,
 			maxQueueDepth: w.maxQueueDepth
 		};
@@ -51512,7 +51620,37 @@ var CaptureScheduler = class {
 			throw err;
 		});
 	}
-	/** Queue an over-budget request (priority-ordered, FIFO within priority). */
+	/**
+	* Queue an over-budget request (priority-ordered, FIFO within priority),
+	* under a BOUND enforced here rather than at dequeue.
+	*
+	* ## Why the queue needs its own bound
+	*
+	* `staleAfterMs` is evaluated in {@link pump}, and `pump` only touches the
+	* queue while `inFlight < budget`. A lane that stays saturated therefore
+	* never inspects its queue at all — nothing expires, nothing is shed, and the
+	* queue grows for as long as the pressure lasts. The budget bounds concurrent
+	* WORK; it has never bounded queued work.
+	*
+	* That gap is not theoretical: the per-frame batch dispatch PINS a ~0.7 MB
+	* copy of the detection frame BEFORE queueing (so ring recycling cannot
+	* invalidate it), and the queued closure holds that copy alive. Measured on
+	* the live hub, `hub/pipeline-analytics` ran at rss=3911MB with heapUsed only
+	* 153MB and arrayBuffers=2281MB — 2.28 GB of JS-reachable Buffers, roughly
+	* 3 200 pinned frames, in a runner whose heap limit is 1216 MB. The call site
+	* that pins them says the cost is "bounded by the lane"; it was not.
+	*
+	* Two things happen on the way in, in this order:
+	*
+	*  1. **expire what is already dead.** Entries past their `staleAfterMs` are
+	*     dropped now. They were doomed the moment they expired; `pump` simply
+	*     never got to look. This is the reclaim that costs nothing.
+	*  2. **shed the least important.** Still over the cap, the TAIL goes — the
+	*     queue is ordered by priority, so the tail is by construction the work
+	*     this scheduler already ranked last. Whether that is the newcomer or an
+	*     older low-priority entry is decided by the same ordering that decides
+	*     execution, so a `firstFrame` never loses its place to an `embed`.
+	*/
 	enqueue(lane, input) {
 		return new Promise((resolve, reject) => {
 			const entry = {
@@ -51525,11 +51663,53 @@ var CaptureScheduler = class {
 				},
 				drop: () => resolve(null)
 			};
+			this.dropExpired(input.deviceId, lane);
 			this.insertByPriority(lane, entry);
+			this.shedToCap(input.deviceId, lane);
 			const w = this.window(input.deviceId);
 			if (lane.queue.length > w.maxQueueDepth) w.maxQueueDepth = lane.queue.length;
 		});
 	}
+	/** Drop every queued entry already past its `staleAfterMs`. Entries without
+	*  one (e.g. `confirm`, which gates track birth) are never expired here. */
+	dropExpired(deviceId, lane) {
+		const nowMs = this.now();
+		for (let i = lane.queue.length - 1; i >= 0; i -= 1) {
+			const entry = lane.queue[i];
+			if (entry === void 0) continue;
+			if (entry.staleAfterMs === void 0 || nowMs - entry.enqueuedAt <= entry.staleAfterMs) continue;
+			lane.queue.splice(i, 1);
+			this.bump(deviceId, "droppedStale");
+			entry.drop();
+		}
+	}
+	/** Shed from the tail (lowest priority, newest within it) until the lane is
+	*  at its cap. Loud: a capture that is dropped rather than merely late is a
+	*  missing thumbnail or first frame, and silence would read as "never asked". */
+	shedToCap(deviceId, lane) {
+		let shed = 0;
+		while (lane.queue.length > this.maxQueued) {
+			const victim = lane.queue.pop();
+			if (victim === void 0) break;
+			this.bump(deviceId, "droppedOverflow");
+			victim.drop();
+			shed += 1;
+		}
+		if (shed === 0) return;
+		const nowMs = this.now();
+		if (nowMs - (this.lastOverflowWarnAt.get(deviceId) ?? Number.NEGATIVE_INFINITY) < OVERFLOW_WARN_THROTTLE_MS) return;
+		this.lastOverflowWarnAt.set(deviceId, nowMs);
+		this.logger.warn("capture queue full — shedding the lowest-priority captures for this camera", {
+			tags: { deviceId },
+			meta: {
+				shed,
+				cap: this.maxQueued,
+				queueDepth: lane.queue.length,
+				inFlight: lane.inFlight,
+				budget: this.budget
+			}
+		});
+	}
 	insertByPriority(lane, entry) {
 		let index = lane.queue.length;
 		while (index > 0) {
@@ -51576,6 +51756,7 @@ var CaptureScheduler = class {
 			failed: 0,
 			coalesced: 0,
 			droppedStale: 0,
+			droppedOverflow: 0,
 			cancelled: 0,
 			maxQueueDepth: 0
 		};
@@ -51600,6 +51781,7 @@ var CaptureScheduler = class {
 				failed: w.failed,
 				coalesced: w.coalesced,
 				droppedStale: w.droppedStale,
+				droppedOverflow: w.droppedOverflow,
 				cancelled: w.cancelled,
 				maxQueueDepth: w.maxQueueDepth,
 				queueDepth: this.queueDepth(deviceId),
@@ -53170,8 +53352,14 @@ var EventMediaDispatcher = class {
 	* scheduler request against a 3-slot device lane and can start seconds late,
 	* by which time the handle's ring slot is usually recycled and the by-handle
 	* resolve in {@link captureForFrame} finds nothing (the 2026-07-23 boxed-tile
-	* regression). ~0.7MB per pinned frame, freed with the batch — bounded by the
-	* lane. Returns `null` on a genuine live-window miss.
+	* regression). ~0.7MB per pinned frame, freed with the batch.
+	*
+	* THE COPY IS ONLY AS BOUNDED AS THE QUEUE THAT HOLDS IT. This said "bounded
+	* by the lane" while the lane bounded in-flight execs (3) and nothing at all
+	* bounded the queue behind them, so a saturated camera accumulated pinned
+	* frames without limit — 2.28 GB of `arrayBuffers` measured on the live hub.
+	* Every caller must therefore pass `staleAfterMs`, and `CaptureScheduler`
+	* caps queue depth per device. Returns `null` on a genuine live-window miss.
 	*
 	* Both miss paths are WARN, throttled to one line per device per minute. They
 	* are the FIRST half of a pair whose second half (`capture batch lost`) has
@@ -60645,6 +60833,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						hasSnapshot: snapshotTargets.some((t) => t.appendSnapshot)
 					}),
 					holdKeys: heldCaptureKeys,
+					staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
 					exec: () => pinnedFramePromise.then((pinnedFrame) => dispatcher.captureForFrame({
 						deviceId,
 						frameHandle,
@@ -61574,7 +61763,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		this.captureScheduler.request({
 			deviceId,
 			kind: "thumbnail",
+			trackId,
 			holdKeys: [captureCoalesceKey(deviceId, "thumbnail", trackId)],
+			staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
 			exec: async () => {
 				const [pinnedFrame, media] = await Promise.all([pinnedFramePromise, this.resolveDeviceMediaSettings(deviceId)]);
 				const res = await dispatcher.captureForFrame({

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-BYzwylnw.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-CEBcz1NX.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.118",
+  "version": "1.2.119",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",