@camstack/addon-post-analysis 1.2.148 → 1.2.151

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-1xYuXmDS.js");
+const require_dist = require("../dist-DpQno5NK.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -6270,12 +6270,86 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/system-event-tap-url.ts
+/** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
+var ADMIN_ADDONS_PATH = "/system/addons";
+var ADMIN_CLUSTER_PATH = "/system/cluster";
+var ADMIN_DEVICES_PATH = "/devices";
+/**
+* The query parameter naming a node.
+*
+* One spelling for both admin pages, mirrored by `NODE_PARAM` in
+* `packages/addon-admin-ui/src/lib/node-url-selection.ts` and pinned across
+* the two packages by `scripts/check-notification-tap-targets.ts`.
+*/
+var NODE_PARAM = "node";
+/** The device page's top-level tab parameter, read by `DeviceDetail`. */
+var TAB_PARAM = "tab";
+/** The Stream Broker tab id — a `WELL_KNOWN_TABS` member, hoisted `top-tab`. */
+var STREAM_BROKER_TAB = "stream-broker";
+/** `DeviceType.Camera`. Spelled here rather than imported so this stays a pure
+*  string map with no device-model dependency; the guard pins it. */
+var CAMERA_DEVICE_TYPE = "camera";
+/** Kinds whose action is "go and apply an ADDON update". */
+var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
+/** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
+var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
+/**
+* Kinds whose action is "go and look at why this camera stopped producing".
+*
+* The legacy `camera-offline` is here for the same reason it is still in the
+* enum: outbox and history rows enqueued before the rename carry it, and an
+* old row is exactly the one whose action has to keep working.
+*/
+var DEVICE_DOWN_KINDS = new Set([
+	"device-offline",
+	"stream-offline",
+	"camera-offline"
+]);
+/**
+* Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
+*
+* A stream belongs to a camera and nothing else. The legacy `camera-offline`
+* is one too — that name is precisely the claim it made, and it is why the
+* kind was split into `device-offline` + a `deviceTypes` condition.
+*/
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set(["stream-offline", "camera-offline"]);
+function withParam(path, key, value) {
+	if (value === void 0 || value.length === 0) return path;
+	return `${path}?${key}=${encodeURIComponent(value)}`;
+}
+/**
+* The admin path (with its query) a system event taps through to, or `null`
+* when the kind has no action.
+*
+* Exported for the cross-package guard and for tests that want the path
+* without a base; the dispatcher goes through {@link systemEventTapUrl}.
+*/
+function systemEventTapPath(subject) {
+	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
+	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
+	if (DEVICE_DOWN_KINDS.has(subject.kind)) {
+		const deviceId = subject.deviceId;
+		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
+		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
+		return CAMERA_BY_CONSTRUCTION_KINDS.has(subject.kind) || subject.deviceType === CAMERA_DEVICE_TYPE ? withParam(devicePath, TAB_PARAM, STREAM_BROKER_TAB) : devicePath;
+	}
+	return null;
+}
+/** Full URL, or `null` when the kind has no action or no base is reachable. */
+function systemEventTapUrl(subject, baseUrl) {
+	if (baseUrl === null || baseUrl.length === 0) return null;
+	const path = systemEventTapPath(subject);
+	if (path === null) return null;
+	return `${baseUrl.replace(/\/+$/, "")}${path}`;
+}
+//#endregion
 //#region src/notification-center/default-tap-url.ts
 /** The viewer's hosted base path under the hub. */
 var VIEWER_BASE_PATH = "/viewer/camstack";
 function defaultTapUrl(input) {
-	if (input.systemEvent === true) return null;
 	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (input.systemEvent !== void 0) return systemEventTapUrl(input.systemEvent, input.baseUrl);
 	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
 	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
 }
@@ -8868,13 +8942,14 @@ function trailAt(trail, timestamp) {
 * cannot be asked (no trail, no polygon) or when nobody qualifies.
 */
 function selectTriggerZoneCandidates(input) {
-	const { candidates, trail, polygons } = input;
+	const { candidates, trail, polygons, strict } = input;
 	if (candidates.length === 0 || trail.length === 0 || polygons.length === 0) return candidates;
 	const qualifying = candidates.filter((candidate) => {
 		const point = trailAt(trail, candidate.timestamp);
 		return point !== null && zoneOverlap(point, polygons) > 0;
 	});
-	return qualifying.length > 0 ? qualifying : candidates;
+	if (qualifying.length > 0) return qualifying;
+	return strict === true ? [] : candidates;
 }
 //#endregion
 //#region src/notification-center/dispatcher.ts
@@ -8912,6 +8987,24 @@ var NC_STILL_WAIT_MS = 3e3;
 * is the instant; the ladder then runs among the frames that are about it.
 */
 var NC_TRIGGER_STILL_MAX_AGE_MS = TRAIL_MATCH_MAX_MS;
+/**
+* Whether this row's subject can still be photographed AGAIN after its trigger.
+*
+* The one thing that separates a row worth waiting for from a row whose only
+* frame already exists. A live visual track keeps writing media for as long as
+* it is open — its first frame, its periodic snapshots, its last frame all land
+* after the instant a zone condition fired. Every other record is photographed
+* once: an audio window, a device event and a package event are served by the
+* still shelf, which D178 makes take ONE picture for a whole burst, and a
+* `track-end` row is by definition past the last of them.
+*
+* Waiting on the wrong side of this line has cost both ways in production — 3 s
+* of latency on a scream when nothing more was coming, and an empty doorstep on
+* 'Persona su Uscio' when something was.
+*/
+function canStillGainMedia(entry) {
+	return entry.recordKind === "object-event";
+}
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -9391,7 +9484,12 @@ var NcDispatcher = class {
 			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
 			timestampMs: subject.timestamp,
 			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
-			systemEvent: systemEvent !== void 0
+			...systemEvent !== void 0 ? { systemEvent: {
+				kind: systemEvent.kind,
+				...systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {},
+				...systemEvent.deviceType !== void 0 ? { deviceType: systemEvent.deviceType } : {},
+				...systemEvent.nodeId !== void 0 ? { nodeId: systemEvent.nodeId } : {}
+			} } : {}
 		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
@@ -9526,7 +9624,7 @@ var NcDispatcher = class {
 		const out = [];
 		const zoneIdsWanted = entry.payload.mediaZoneIds;
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
-		const firstLook = await this.resolveAttachment(entry, stillOverride, "any");
+		const firstLook = await this.resolveAttachment(entry, stillOverride, canStillGainMedia(entry) ? "trigger-only" : "any");
 		const footagePending = this.renderFootage(entry);
 		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : await this.waitForStill(entry, stillOverride);
 		const footage = await footagePending;
@@ -9770,20 +9868,34 @@ var NcDispatcher = class {
 	* throw. And when nothing qualifies, the full list comes back: a real picture
 	* beats no picture (the same rule D212 settled for the best shot).
 	*/
-	async narrowToTriggerZone(entry, ordered) {
+	async narrowToTriggerZone(entry, ordered, freshness) {
 		const zoneIds = entry.payload.triggerZoneIds;
 		const trackId = entry.payload.subject.trackId;
 		const getTrail = this.deps.getSubjectTrail;
 		const deviceId = entry.payload.subject.deviceId;
-		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2) return ordered;
+		const strict = freshness === "trigger-only";
+		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2 && !strict) return ordered;
 		try {
 			const [polygons, trail] = await Promise.all([this.deps.getZonePolygons?.(deviceId, zoneIds) ?? Promise.resolve([]), getTrail(deviceId, trackId)]);
 			const kept = selectTriggerZoneCandidates({
 				candidates: ordered,
 				trail,
 				polygons,
-				triggerAt: entry.payload.subject.timestamp
+				triggerAt: entry.payload.subject.timestamp,
+				strict
 			});
+			if (kept.length === 0) {
+				this.deps.logger.debug("no still from the zone that fired the rule — still waiting", {
+					tags: { deviceId },
+					meta: {
+						ruleId: entry.ruleId,
+						trackId,
+						zoneIds: zoneIds.join(","),
+						rejected: ordered.length
+					}
+				});
+				return kept;
+			}
 			if (kept.length === ordered.length) return kept;
 			this.deps.logger.info("still narrowed to the zone that fired the rule", {
 				tags: { deviceId },
@@ -9863,7 +9975,8 @@ var NcDispatcher = class {
 			for (const kind of preference) for (const file of files) if (file.kind === kind) ordered.push(file);
 			const inBand = this.narrowToTriggerInstant(entry, ordered, freshness);
 			if (inBand.length === 0) continue;
-			const shortlist = await this.narrowToTriggerZone(entry, inBand);
+			const shortlist = await this.narrowToTriggerZone(entry, inBand, freshness);
+			if (shortlist.length === 0) continue;
 			for (const file of shortlist) {
 				const raw = Buffer.from(file.base64, "base64");
 				if (raw.byteLength === 0) continue;
@@ -25509,13 +25622,46 @@ var MEDIA_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var MEDIA_INDEXES = [{
-	name: "idx_media_owner",
-	columns: ["ownerKind", "ownerId"]
-}, {
-	name: "idx_media_device_ts",
-	columns: ["deviceId", "timestamp"]
-}];
+var MEDIA_INDEXES = [
+	{
+		name: "idx_media_owner",
+		columns: ["ownerKind", "ownerId"]
+	},
+	{
+		name: "idx_media_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	(
+	/**
+	* The `locationId IS NULL` seal gate — see `media-relocate-engine.ts`.
+	*
+	* NULLs sort FIRST in a SQLite index, so `WHERE locationId IS NULL` is a
+	* contiguous range from the head of the b-tree: its cost is proportional to
+	* the ANSWER, not to the table. That is the property the gate needs. The
+	* question it must answer fastest is "are there none left", and with this
+	* index that is one seek that immediately falls off the end of an empty
+	* range — regardless of how many million stamped rows sit behind it.
+	*
+	* **What it costs.** One extra b-tree maintained by every insert into a
+	* table taking ~92 k rows/day, and roughly 25 bytes of index per row (~30 MB
+	* at 1.25 M rows). At ~1 insert/s sustained that maintenance is noise
+	* against the JPEG write the same call performs. The one-off cost is real
+	* and worth naming: the FIRST declare after this ships builds the index over
+	* every existing row, on a recordings volume that is currently saturated —
+	* expect the analytics addon's boot to stall for tens of seconds to a couple
+	* of minutes, once.
+	*
+	* A PARTIAL index (`WHERE locationId IS NULL`) would be smaller still and
+	* would cost nothing at all once sealed. It is not used because
+	* `CollectionIndexSchema` has no predicate and the schema fingerprint does
+	* not hash one — adding both to serve one query is a bigger change than the
+	* query deserves, and the plain index already makes the gate O(log n).
+	*/
+	{
+		name: "idx_media_location",
+		columns: ["locationId"]
+	})
+];
 /** The storage location of a media row/record: its stamped `locationId`, or
 *  the default `eventMedia` location for NULL (pre-multi-location) rows. */
 var DEFAULT_MEDIA_LOCATION = "eventMedia";
@@ -25812,6 +25958,112 @@ var MediaStore = class {
 		}
 	}
 	/**
+	* Delete one row and its blob, and CONFIRM the blob is gone before the row
+	* is forgotten (D148, read for this store).
+	*
+	* Every other delete on this class is best-effort: `deleteByKeyUnchecked`
+	* swallows the unlink error and drops the row anyway, and the underlying
+	* `fs.rm(…, { force: true })` cannot distinguish "removed it" from "there
+	* was nothing there". That is tolerable for a cascade whose whole subtree is
+	* going, and it is NOT tolerable for a bulk reclaim: a row deleted while its
+	* blob survives is 95 KiB that nothing will ever name again — the orphan
+	* class this codebase has spent the week sweeping.
+	*
+	* So the order is: unlink, re-probe, and only then delete the row. A probe
+	* that cannot answer (unreachable volume) THROWS, exactly like
+	* {@link referencedBlobState} — the caller must refuse, not assume absence.
+	*
+	* A row with no `path` is a row whose blob was never written; there is
+	* nothing to confirm and the row is removable.
+	*/
+	async deleteConfirmed(key) {
+		return this.gated(async () => {
+			const row = await this.store.get.query({
+				collection: MEDIA_COLLECTION,
+				key
+			});
+			if (!row) return {
+				rows: 0,
+				bytes: 0
+			};
+			const data = row;
+			const relativePath = String(data["path"] ?? "");
+			const bytes = Number(data["sizeBytes"] ?? 0);
+			if (relativePath.length > 0) {
+				const location = mediaRowLocation(data);
+				await this.storage.delete({
+					location,
+					relativePath
+				});
+				if (this.storage.exists) {
+					if (await this.storage.exists({
+						location,
+						relativePath
+					})) throw new Error(`media blob survived its delete: ${key} (${relativePath})`);
+				} else {
+					let readable = false;
+					try {
+						await this.storage.read({
+							location,
+							relativePath
+						});
+						readable = true;
+					} catch {}
+					if (readable) throw new Error(`media blob survived its delete: ${key} (${relativePath})`);
+				}
+			}
+			await this.store.delete.mutate({
+				collection: MEDIA_COLLECTION,
+				key
+			});
+			return {
+				rows: 1,
+				bytes: Number.isFinite(bytes) ? bytes : 0
+			};
+		});
+	}
+	/**
+	* A page of media rows of ONE kind for ONE device, timestamp-ascending from
+	* `afterMs`. The reclaim's cursor.
+	*
+	* `(deviceId, timestamp)` is `idx_media_device_ts`, so this is an index
+	* range scan — unlike a fleet-wide `kind = 'snapshot'` predicate, which has
+	* no index at all (`MEDIA_INDEXES`) and would table-scan 1.26 M rows on
+	* hub-main's single synchronous SQLite thread.
+	*/
+	async pageByKindForDevice(input) {
+		return (await this.store.query.query({
+			collection: MEDIA_COLLECTION,
+			columns: [
+				"id",
+				"ownerId",
+				"timestamp",
+				"sizeBytes"
+			],
+			filter: {
+				where: {
+					deviceId: input.deviceId,
+					ownerKind: input.ownerKind,
+					kind: input.kind
+				},
+				whereBetween: { timestamp: [input.afterMs, Number.MAX_SAFE_INTEGER] },
+				orderBy: {
+					field: "timestamp",
+					direction: "asc"
+				},
+				limit: input.limit
+			}
+		})).map((row) => {
+			const data = row.data;
+			return {
+				key: row.id,
+				ownerId: String(data["ownerId"] ?? ""),
+				timestamp: Number(data["timestamp"] ?? 0),
+				sizeBytes: Number(data["sizeBytes"] ?? 0)
+			};
+		});
+	}
+	/**
 	* `deviceId` is the AUTHORIZATION filter: every media row is stamped with
 	* its device at write time, so scoping the query by it makes a media read
 	* for a device the caller cannot name return nothing — the DB itself
@@ -28255,6 +28507,212 @@ function updateTrackAggregate(prev, match, opts) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/store/embedding-vector-index.ts
+/**
+* The vector indexes this addon owns, and the one client that talks to them.
+*
+* ## The three indexes, and what a row in each one IS
+*
+* | index | dim | encoder | one row is | ranked against |
+* | --- | --- | --- | --- | --- |
+* | `object-clip` | 512 | MobileCLIP image tower (`mobileclip-*`) | a TRACK's best-confidence object crop | a CLIP **text** vector — semantic search over footage |
+* | `face-arcface` | 512 | ArcFace (`arcface-r100` and successors) | the best face read of a TRACK, aligned to 112×112 | the enrolled gallery, to suggest or auto-confirm an identity |
+* | `identity-arcface` | 512 | the SAME ArcFace model | one ENROLLED face of a person | every live face detection, at recognition time |
+*
+* `plates`, `vehicles`, `vehicle-samples` and `identities` hold no vector of
+* any kind — a plate is a STRING and a score, a vehicle and an identity are a
+* name. They are named here because `vector-store.cap.ts` once claimed six
+* stores were waiting to migrate, and five of them being absent from this table
+* is the answer to "where are the other ones".
+*
+* ## Why `face-arcface` and `identity-arcface` are two indexes
+*
+* They hold the same 512 dims from the same model, and they are still separate.
+* An index is a set of rows that get ranked against each other and that live and
+* die together, and these are neither:
+*
+*  - a `face-arcface` row is TRACK-OWNED. It cascades away with its track and is
+*    capped per camera; it is a CANDIDATE.
+*  - an `identity-arcface` row is retention-EXEMPT forever. It is the ANSWER
+*    every candidate is measured against.
+*
+* Merged, every gallery load and every reconcile would carry a discriminating
+* filter, and the two ways that filter can fail are "a face is ranked against
+* itself" and "an enrolled person's only sample is reclaimed as a track orphan".
+* Sharing a dimension is not a reason to share an index.
+*/
+/** The buffered per-track ArcFace face vector (`pipeline-analytics:faces`). */
+var FACE_ARCFACE_INDEX = "face-arcface";
+/** The ENROLLED gallery (`pipeline-analytics:identity-samples`). */
+var IDENTITY_ARCFACE_INDEX = "identity-arcface";
+/**
+* The `className` each index stamps on its rows.
+*
+* A constant per index, exactly as `object-clip` stamps `embedding`. It is not
+* a subject class and must never be filtered on as one: it says which PRODUCER
+* wrote the row, which is what keeps a face vector out of a CLIP ranking.
+*/
+var FACE_VECTOR_CLASS = "face";
+var IDENTITY_VECTOR_CLASS = "identity";
+/**
+* One index, plus the lazy declaration every caller would otherwise re-derive.
+*
+* The dimension is not known at construction — it comes from whatever encoder
+* is active — so the index is declared on the first vector, exactly as
+* `ObjectEmbeddingStore` does it, and a failed declaration DISABLES writes for
+* that dim rather than letting an upsert fail against an index the provider has
+* never seen. A failed write clears the cache so the next one re-declares:
+* a provider swap under a running hub once left that cache warm and every write
+* throwing for hours.
+*/
+var EmbeddingVectorIndex = class {
+	index;
+	client;
+	logger;
+	declaredDim = null;
+	constructor(deps) {
+		this.index = deps.index;
+		this.client = deps.client;
+		this.logger = deps.logger;
+	}
+	/** The index name, for a log line that has to name which store dropped work. */
+	get name() {
+		return this.index;
+	}
+	async ensureIndex(dim) {
+		if (this.declaredDim === dim) return true;
+		try {
+			await this.client.declareIndex.mutate({
+				index: this.index,
+				dim,
+				metric: "cosine"
+			});
+			this.declaredDim = dim;
+			return true;
+		} catch (err) {
+			this.logger.warn("vector index declaration failed — writes disabled for this dim", { meta: {
+				index: this.index,
+				dim,
+				error: String(err)
+			} });
+			return false;
+		}
+	}
+	/**
+	* Write one vector. Returns whether it LANDED, never whether the call
+	* returned — the caller uses this to decide it may stop keeping its own copy,
+	* and "the mutate resolved" is not the same statement (D58).
+	*/
+	async put(input) {
+		if (input.embedding.length === 0) {
+			this.logger.warn("refused to index an empty vector", { meta: {
+				index: this.index,
+				id: input.id
+			} });
+			return false;
+		}
+		if (!await this.ensureIndex(input.embedding.length)) return false;
+		const metadata = {
+			...input.extra,
+			className: input.className,
+			modelId: input.modelId,
+			timestamp: input.timestamp,
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {}
+		};
+		try {
+			const result = await this.client.upsert.mutate({
+				index: this.index,
+				items: [{
+					id: input.id,
+					vector: require_dist.encodeVectorBase64(input.embedding),
+					metadata
+				}]
+			});
+			if (result.upserted === 0) {
+				this.logger.warn("vector upsert rejected", {
+					...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+					meta: {
+						index: this.index,
+						id: input.id,
+						rejected: result.rejected
+					}
+				});
+				return false;
+			}
+			return true;
+		} catch (err) {
+			this.declaredDim = null;
+			this.logger.warn("vector upsert failed", {
+				...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+				meta: {
+					index: this.index,
+					id: input.id,
+					error: String(err)
+				}
+			});
+			return false;
+		}
+	}
+	/**
+	* Read named vectors back as float arrays.
+	*
+	* An id with no row is simply ABSENT from the map — never a zero vector. A
+	* zero vector scores 0 against everything and would quietly un-enrol a person
+	* instead of failing, which is the reason `fetchByIds` drops an unreadable
+	* row rather than padding it.
+	*
+	* On a read failure the map is EMPTY and the failure is logged. An empty
+	* gallery is a visible outage; a partial one silently forgets people.
+	*/
+	async load(ids) {
+		const out = /* @__PURE__ */ new Map();
+		if (ids.length === 0) return out;
+		try {
+			const result = await this.client.fetchByIds.query({
+				index: this.index,
+				ids: [...ids]
+			});
+			for (const item of result.items) {
+				const buf = Buffer.from(item.vector, "base64");
+				if (buf.byteLength === 0 || buf.byteLength % 4 !== 0) continue;
+				const view = new Float32Array(buf.buffer, buf.byteOffset, buf.byteLength / 4);
+				out.set(item.id, Array.from(view));
+			}
+		} catch (err) {
+			this.logger.warn("vector fetch failed — no vectors returned for this call", { meta: {
+				index: this.index,
+				ids: ids.length,
+				error: String(err)
+			} });
+			return /* @__PURE__ */ new Map();
+		}
+		return out;
+	}
+	/**
+	* Drop named vectors.
+	*
+	* Best-effort and LOUD: these rows have exactly one owner and it is being
+	* deleted, so a delete that quietly did nothing leaves a vector nothing can
+	* ever reach by ownership again.
+	*/
+	async drop(ids) {
+		if (ids.length === 0) return;
+		try {
+			await this.client.deleteByIds.mutate({
+				index: this.index,
+				ids: [...ids]
+			});
+		} catch (err) {
+			this.declaredDim = null;
+			this.logger.warn("vector delete failed — rows left behind", { meta: {
+				index: this.index,
+				ids: ids.length,
+				error: String(err)
+			} });
+		}
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/store/face-sort.ts
 var DEFAULT_FACE_SORT = {
 	by: "timestamp",
@@ -28320,6 +28778,15 @@ function rankAndCap(faces, order, limit) {
 //#endregion
 //#region src/pipeline-analytics/store/face-store.ts
 /**
+* The model a row written before 2026-08-20 was produced by.
+*
+* Those rows predate `embeddingModelId`, and they were all this. The vector
+* index stamps a `modelId` on every row it holds, so a converted legacy row has
+* to be stamped with something true rather than left blank — a blank modelId in
+* the gallery is a vector the matcher cannot decide is comparable.
+*/
+var LEGACY_FACE_MODEL_ID = "arcface-r100";
+/**
 * @durable class=ledger owner=pipeline-analytics
 *   write="one UPSERT per track that produced a face detail — the id is
 *     'face-<trackId>', so a track has at most one row and the recognizer
@@ -28401,11 +28868,23 @@ var FACE_COLUMNS = [
 		type: "INTEGER",
 		notNull: true
 	},
+	(
+	/**
+	* LEGACY, drained on 2026-08-30 (D304). The ArcFace vector lives in the
+	* `face-arcface` vector index now, keyed by this row's id.
+	*
+	* The column stays declared and stays `notNull` because rows written before
+	* the conversion still carry their array and the conversion has to be able to
+	* read them. A CONVERTED row holds `[]` — two bytes, and the marker that says
+	* "the vector is in the index", which is what makes the conversion idempotent
+	* and observable. Nothing reads this column except the conversion and the
+	* fallback in {@link FaceStore.getWithEmbedding}.
+	*/
 	{
 		name: "embedding",
 		type: "JSON",
 		notNull: true
-	},
+	}),
 	{
 		name: "embeddingModelId",
 		type: "TEXT"
@@ -28489,8 +28968,9 @@ function buildTimestampWindow(input) {
 */
 function rowToFace(id, raw) {
 	const data = raw;
+	const { embedding: _legacyEmbedding, ...rest } = data;
 	return {
-		...data,
+		...rest,
 		id,
 		assigned: Boolean(data.assigned),
 		mediaKey: data.mediaKey ?? void 0,
@@ -28506,9 +28986,11 @@ function rowToFace(id, raw) {
 }
 var FaceStore = class {
 	store;
+	vectors;
 	logger;
 	constructor(deps) {
 		this.store = deps.store;
+		this.vectors = deps.vectors;
 		this.logger = deps.logger;
 	}
 	static async declare(store) {
@@ -28523,12 +29005,31 @@ var FaceStore = class {
 	* id per track → one entry per track). `set` replaces an existing row.
 	*/
 	async insert(face) {
-		const { id, ...rest } = face;
+		const { id, embedding, ...rest } = face;
+		if (!await this.vectors.put({
+			id,
+			embedding,
+			className: "face",
+			modelId: face.embeddingModelId ?? "arcface-r100",
+			timestamp: face.timestamp,
+			deviceId: face.deviceId,
+			extra: { trackId: face.trackId }
+		})) this.logger.warn("face row written WITHOUT a searchable vector", {
+			tags: { deviceId: face.deviceId },
+			meta: {
+				faceId: id,
+				index: this.vectors.name,
+				trackId: face.trackId
+			}
+		});
 		try {
 			await this.store.set.mutate({
 				collection: FACES_COLLECTION,
 				key: id,
-				value: rest
+				value: {
+					...rest,
+					embedding: []
+				}
 			});
 		} catch (err) {
 			this.logger.warn("FaceStore.insert failed", {
@@ -28541,6 +29042,111 @@ var FaceStore = class {
 		}
 	}
 	/**
+	* How an UNCONVERTED `faces` row becomes an index row.
+	*
+	* The only judgement here is the modelId: a row written before 2026-08-20
+	* carries no `embeddingModelId`, and those rows were all `arcface-r100`, so
+	* that is what they are stamped with — a KNOWN historical fact, not a
+	* fallback guess. A row that names some other model keeps its own.
+	*/
+	conversionSpec() {
+		return {
+			collection: FACES_COLLECTION,
+			vectors: this.vectors,
+			write: (id, embedding, data) => {
+				const deviceId = data["deviceId"];
+				const timestamp = data["timestamp"];
+				const trackId = data["trackId"];
+				const modelId = data["embeddingModelId"];
+				return {
+					id,
+					embedding,
+					className: FACE_VECTOR_CLASS,
+					modelId: typeof modelId === "string" && modelId.length > 0 ? modelId : LEGACY_FACE_MODEL_ID,
+					timestamp: typeof timestamp === "number" ? timestamp : 0,
+					...typeof deviceId === "number" ? { deviceId } : {},
+					...typeof trackId === "string" ? { extra: { trackId } } : {}
+				};
+			}
+		};
+	}
+	/**
+	* One face WITH its ArcFace vector — the enrolment and re-assignment read.
+	*
+	* Falls back to the row's legacy JSON column when the index has no vector for
+	* this id, which is exactly the window in which a row written before the
+	* conversion has not been converted yet. The fallback is LOGGED: it is
+	* correct, it is temporary, and a fallback nobody can count is a fallback that
+	* becomes permanent.
+	*/
+	async getWithEmbedding(faceId) {
+		const raw = await this.store.get.query({
+			collection: FACES_COLLECTION,
+			key: faceId
+		});
+		if (!raw) return null;
+		const face = rowToFace(faceId, raw);
+		const fromIndex = (await this.vectors.load([faceId])).get(faceId);
+		if (fromIndex !== void 0) return {
+			...face,
+			embedding: fromIndex
+		};
+		const legacy = raw.embedding;
+		if (Array.isArray(legacy) && legacy.length > 0 && legacy.every((n) => typeof n === "number")) {
+			this.logger.info("face vector served from the legacy JSON column", {
+				tags: { deviceId: face.deviceId },
+				meta: {
+					faceId,
+					why: "this row has not been converted into the vector index yet"
+				}
+			});
+			return {
+				...face,
+				embedding: legacy
+			};
+		}
+		this.logger.warn("face row has no vector in either home", {
+			tags: { deviceId: face.deviceId },
+			meta: {
+				faceId,
+				index: this.vectors.name
+			}
+		});
+		return null;
+	}
+	/**
+	* The ArcFace vectors of named rows, for the CLUSTERING pass.
+	*
+	* Ids with no vector are ABSENT from the map, never present with an empty
+	* array — the clustering loop skips a zero-length vector, so an empty array
+	* would turn "the index did not answer" into "these faces are not clusterable"
+	* and produce a confident zero.
+	*/
+	async loadEmbeddings(faceIds) {
+		const indexed = await this.vectors.load(faceIds);
+		const missing = faceIds.filter((id) => !indexed.has(id));
+		if (missing.length === 0) return indexed;
+		const out = new Map(indexed);
+		let fromLegacyColumn = 0;
+		for (const id of missing) {
+			const legacy = (await this.store.get.query({
+				collection: FACES_COLLECTION,
+				key: id
+			}))?.embedding;
+			if (!Array.isArray(legacy) || legacy.length === 0 || !legacy.every((n) => typeof n === "number")) continue;
+			out.set(id, legacy);
+			fromLegacyColumn += 1;
+		}
+		this.logger.info("face vectors served partly from the legacy JSON column", { meta: {
+			index: this.vectors.name,
+			asked: faceIds.length,
+			fromIndex: indexed.size,
+			fromLegacyColumn,
+			unavailable: missing.length - fromLegacyColumn
+		} });
+		return out;
+	}
+	/**
 	* Recent UNASSIGNED faces (the enrollment buffer), newest first.
 	*
 	* NOTE: `assigned` is normalized via `Boolean()` on read so the production
@@ -28660,6 +29266,7 @@ var FaceStore = class {
 				error: String(err)
 			} });
 		}
+		await this.vectors.drop([...deleted]);
 		this.announceSuggestedEvictions(suggestedVictims, deleted, input.maxSuggestedPerDevice);
 		return [...deleted];
 	}
@@ -28690,6 +29297,45 @@ var FaceStore = class {
 			});
 		}
 	}
+	/**
+	* Replace a buffered face's vector AND its model stamp, then confirm BOTH.
+	*
+	* The vector and the stamp live in two homes — the index and the row — and
+	* they must move together or not at all: a row stamped with the cluster model
+	* beside a vector from the previous one is a face the matcher believes is
+	* comparable and is not, which is worse than a face it refuses to compare.
+	*
+	* So: vector first (refuse if it does not land), row second, then a read-back
+	* of the stamp. Returns whether the whole move landed — never whether the
+	* calls returned (D58).
+	*/
+	async restampEmbedding(input) {
+		if (!await this.vectors.put({
+			id: input.faceId,
+			embedding: input.embedding,
+			className: "face",
+			modelId: input.modelId,
+			timestamp: input.timestamp,
+			deviceId: input.deviceId,
+			extra: { trackId: input.trackId }
+		})) {
+			this.logger.warn("face re-embed refused: the vector did not reach the index", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					faceId: input.faceId,
+					index: this.vectors.name
+				}
+			});
+			return false;
+		}
+		await this.update(input.faceId, { embeddingModelId: input.modelId });
+		await this.store.update.mutate({
+			collection: FACES_COLLECTION,
+			id: input.faceId,
+			data: { embedding: [] }
+		});
+		return (await this.get(input.faceId))?.embeddingModelId === input.modelId;
+	}
 	/** Flip `assigned` to true and record which identity was matched. Optionally persist the sample id. */
 	async markAssigned(faceId, identityId, sampleId) {
 		const data = {
@@ -28775,11 +29421,13 @@ var FaceStore = class {
 				collection: FACES_COLLECTION,
 				filter: { where: { trackId } }
 			})).filter((r) => !r.data.assigned);
+			const dropped = [];
 			for (const row of eligible) try {
 				await this.store.delete.mutate({
 					collection: FACES_COLLECTION,
 					key: row.id
 				});
+				dropped.push(row.id);
 				removed++;
 			} catch (err) {
 				this.logger.warn("FaceStore.deleteByTracks delete failed", { meta: {
@@ -28787,6 +29435,7 @@ var FaceStore = class {
 					error: String(err)
 				} });
 			}
+			await this.vectors.drop(dropped);
 		} catch (err) {
 			this.logger.warn("FaceStore.deleteByTracks query failed", { meta: {
 				trackId,
@@ -28812,7 +29461,9 @@ var FaceStore = class {
 				faceId,
 				error: String(err)
 			} });
+			return;
 		}
+		await this.vectors.drop([faceId]);
 	}
 	/**
 	* Retrieve a single face by id. Returns null if not found.
@@ -29231,7 +29882,7 @@ var FaceGalleryProvider = class {
 			await this.faceStore.clearAssignment(faceId);
 			await this.faceStore.update(faceId, { mediaKey: null });
 		}
-		const currentFace = await this.faceStore.get(faceId);
+		const currentFace = await this.faceStore.getWithEmbedding(faceId);
 		if (!currentFace) throw new Error(`FaceGalleryProvider.assignFace: face disappeared after pre-cleanup: ${faceId}`);
 		const enrolledModelId = currentFace.embeddingModelId ?? "arcface-r100";
 		const verdict = enrollmentPromiscuity(currentFace.embedding, enrolledModelId, identityId, await this.identityStore.loadGallery());
@@ -29416,10 +30067,21 @@ var FaceGalleryProvider = class {
 			threshold,
 			minClusterSize
 		} });
-		const clusters = clusterByEmbedding(faces.filter((f) => Array.isArray(f.embedding) && f.embedding.length > 0).map((f) => ({
-			id: f.id,
-			embedding: f.embedding
-		})), threshold).filter((c) => c.size >= minClusterSize);
+		const vectors = await this.faceStore.loadEmbeddings(faces.map((f) => f.id));
+		const items = [];
+		for (const face of faces) {
+			const embedding = vectors.get(face.id);
+			if (embedding === void 0 || embedding.length === 0) continue;
+			items.push({
+				id: face.id,
+				embedding
+			});
+		}
+		if (items.length < faces.length) this.logger.warn("suggestFaceClusters skipped faces with no vector in the index", { meta: {
+			scanned: faces.length,
+			clusterable: items.length
+		} });
+		const clusters = clusterByEmbedding(items, threshold).filter((c) => c.size >= minClusterSize);
 		return maxClusters === void 0 ? clusters : clusters.slice(0, maxClusters);
 	}
 };
@@ -32181,7 +32843,19 @@ async function runPreviewUpgrade(deps, input) {
 		});
 		return "no-bbox";
 	}
+	if (pending.bestSeen.timestamp === void 0) {
+		deps.logger.info("late keyFrame: pending entry predates the motion guard — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				keyFrameKey: input.keyFrameKey,
+				heldProvenance: held
+			}
+		});
+		return "no-bbox";
+	}
 	const derived = await deps.derive({
+		deviceId,
 		mediaKey: input.keyFrameKey,
 		bbox: {
 			x: pending.bestSeen.x,
@@ -32191,7 +32865,7 @@ async function runPreviewUpgrade(deps, input) {
 		},
 		frameWidth: pending.bestSeen.frameWidth,
 		frameHeight: pending.bestSeen.frameHeight,
-		timestamp: input.timestamp
+		timestamp: pending.bestSeen.timestamp
 	});
 	if (derived === null) {
 		deps.logger.info("late keyFrame preview upgrade failed (derive miss) — tile kept as-is", {
@@ -32555,6 +33229,28 @@ async function cascadeDeleteTracks(registry, trackStore, trackIds) {
 * `onInitialize`, not because their families are optional — a missing one means
 * the addon is not fully up, and the sweep does not run in that state.
 */
+/**
+* The optional legs that are NOT in the registry this call would build.
+*
+* `buildAnalyticsCascadeRegistry` pushes each optional store only `if` it is
+* there, and that `if` is silent. A hub whose `vector-store` capability was
+* unavailable at boot builds an embedding-less cascade and then prunes tracks
+* with it — every pass, for the whole life of the process — while the only
+* evidence is one warn at startup that scrolled away hours earlier. Every CLIP
+* vector for every track deleted in that window becomes an orphan that nothing
+* can reach by ownership again, because its owner is gone.
+*
+* So the omission is named and returned, and the caller LOGS it. A branch that
+* drops work says so; silence reads as "there was nothing to drop".
+*/
+function absentCascadeLegs(stores) {
+	const absent = [];
+	if (!stores.faceStore) absent.push("faces");
+	if (!stores.plateStore) absent.push("plates");
+	if (!stores.objectEmbeddingStore) absent.push("embeddings");
+	if (!stores.groupStore) absent.push("groups");
+	return absent;
+}
 function buildAnalyticsCascadeRegistry(stores) {
 	const registry = [stores.eventStore, stores.mediaStore];
 	if (stores.faceStore) registry.push(stores.faceStore);
@@ -32831,7 +33527,8 @@ var TrackCloser = class {
 					w: bestSeen.w,
 					h: bestSeen.h,
 					frameWidth: bestSeen.frameWidth,
-					frameHeight: bestSeen.frameHeight
+					frameHeight: bestSeen.frameHeight,
+					timestamp: bestSeen.timestamp
 				} } : {},
 				recordedAtMs: this.now()
 			});
@@ -32847,7 +33544,7 @@ var TrackCloser = class {
 		});
 		const keyFrameMediaKey = this.deps.residents.keyFrameKey(t.trackId);
 		const labelConfidence = this.bestLabelMatchConfidence(t.deviceId, t.trackId);
-		this.fireRecognizerEnds(t.deviceId, t.trackId);
+		this.fireRecognizerEnds(t.deviceId, t.trackId, t.positions);
 		const trackerPeak = this.deps.residents.bestFramePeak(t.trackId);
 		const importanceSummary = await this.scoreImportance(t, duration, trackerPeak?.confidence);
 		this.deps.residents.close(t.trackId, "end");
@@ -32906,14 +33603,14 @@ var TrackCloser = class {
 	/** Start face/plate `onTrackEnd` and wire the Design-B DEFERRED
 	*  keyFrame-key drop (drop only once the face promise settles — or
 	*  immediately when no face recognizer is active). */
-	fireRecognizerEnds(deviceId, trackId) {
+	fireRecognizerEnds(deviceId, trackId, subjectPath) {
 		const faceEnd = this.deps.faceRecognizer()?.onTrackEnd(deviceId, trackId);
 		const dropKeyFrameKey = () => {
 			this.deps.residents.dropKeyFrameKey(trackId);
 		};
 		if (faceEnd) faceEnd.finally(dropKeyFrameKey);
 		else dropKeyFrameKey();
-		this.deps.plateRecognizer()?.onTrackEnd(deviceId, trackId);
+		this.deps.plateRecognizer()?.onTrackEnd(deviceId, trackId, subjectPath);
 	}
 	/** Last-resort preview: commit the retained detection-raster subject crop
 	*  as the track's `thumbnail` (honest sub-native, never upscaled). */
@@ -32983,6 +33680,7 @@ var TrackCloser = class {
 		}
 		try {
 			const derived = await derive({
+				deviceId: t.deviceId,
 				mediaKey: keyFrame.key,
 				bbox: {
 					x: bestSeen.x,
@@ -32992,7 +33690,8 @@ var TrackCloser = class {
 				},
 				frameWidth: bestSeen.frameWidth,
 				frameHeight: bestSeen.frameHeight,
-				timestamp: keyFrame.timestamp
+				timestamp: bestSeen.timestamp,
+				subjectPath: t.positions
 			});
 			if (!derived) {
 				if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "derive-returned-null", { keyFrameKey: keyFrame.key });
@@ -33033,6 +33732,8 @@ var TrackCloser = class {
 					trackId: t.trackId,
 					keyFrameKey: keyFrame.key,
 					skewMs: derived.skewMs,
+					motion: derived.motion ?? null,
+					subjectIou: derived.subjectIou ?? null,
 					replaced: held?.provenance ?? null
 				}
 			});
@@ -34336,6 +35037,304 @@ async function reconcileDeviceFromDisk(deps, deviceId) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
+/**
+* The operator button for the debug-media reclaim.
+*
+* The mechanism ships armed with nothing: **arming it is the operator's
+* call**. `mode` omitted means `report` — it counts, logs one line per camera
+* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
+* that has to be typed.
+*
+* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
+* earned it: dry-run default, explicit pacing, explicit blast radius, and a
+* report you can read instead of a log line you have to find.
+*/
+/**
+* `report` counts; `reclaim` deletes.
+*
+* `.default('report')` is load-bearing: the settings form sends `{}` for a
+* button with no fields, and the safe reading of an unstated intent is the one
+* that destroys nothing.
+*/
+var MediaReclaimActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
+var MediaReclaimScopeSchema = require_dist._enum(["motion-still", "track-filmstrip"]);
+var MediaReclaimActionInputSchema = require_dist.object({
+	mode: MediaReclaimActionModeSchema,
+	/** Which populations to walk. Omitted = both. */
+	scopes: require_dist.array(MediaReclaimScopeSchema).min(1).optional(),
+	/** Restrict to these cameras. Omitted = every camera in retention scope. */
+	deviceIds: require_dist.array(require_dist.number().int()).min(1).optional(),
+	/** Start every device from the top instead of resuming its cursor. */
+	restart: require_dist.boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per camera in this pass — the pacing bound. */
+	maxRowsPerDevice: require_dist.number().int().min(1).max(5e5).optional(),
+	/** Rows DELETED per camera in this pass — the blast-radius bound. */
+	maxReclaimPerDevice: require_dist.number().int().min(1).max(5e5).optional(),
+	/** Bytes released across the whole run — the disk-contention bound. */
+	maxBytesPerRun: require_dist.number().int().min(1).optional(),
+	/** Wall-clock ceiling for the run. */
+	budgetMinutes: require_dist.number().int().min(1).max(720).optional(),
+	/**
+	* Bytes per second the pass may release. The recordings volume sustains
+	* ~4 MB/s and the archive needs it more than this does; the default is half
+	* of that.
+	*/
+	throttleBytesPerSec: require_dist.number().int().min(64 * 1024).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them.
+	*/
+	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
+});
+var MediaReclaimDeviceReportSchema = require_dist.object({
+	deviceId: require_dist.number(),
+	scope: MediaReclaimScopeSchema,
+	examined: require_dist.number(),
+	eligible: require_dist.number(),
+	reclaimed: require_dist.number(),
+	bytesReclaimed: require_dist.number(),
+	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
+	held: require_dist.number(),
+	/** Rows kept because the owner could not be shown to be a motion event. */
+	unresolved: require_dist.number(),
+	withinGrace: require_dist.number(),
+	/** Deletes that REFUSED — the blob survived or the volume could not answer.
+	*  The row was kept and the cursor did not pass it. */
+	refused: require_dist.number(),
+	stoppedBy: require_dist.string(),
+	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
+	nextCursor: require_dist.number()
+});
+var MediaReclaimActionResultSchema = require_dist.object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: require_dist.boolean(),
+	mode: require_dist._enum(["report", "reclaim"]),
+	devices: require_dist.array(MediaReclaimDeviceReportSchema),
+	totalExamined: require_dist.number(),
+	totalEligible: require_dist.number(),
+	totalReclaimed: require_dist.number(),
+	totalBytesReclaimed: require_dist.number(),
+	totalRefused: require_dist.number(),
+	durationMs: require_dist.number(),
+	/** Every device+scope reported `exhausted` — there is nothing left to do. */
+	complete: require_dist.boolean()
+});
+var mediaReclaimActions = require_dist.defineCustomActions({ "retention.mediaReclaim": require_dist.customAction(MediaReclaimActionInputSchema, MediaReclaimActionResultSchema, { auth: "admin" }) });
+//#endregion
+//#region src/pipeline-analytics/retention/media-reclaim.ts
+var MEDIA_RECLAIM_SCOPES = ["motion-still", "track-filmstrip"];
+var DEFAULT_MEDIA_RECLAIM_LIMITS = {
+	mode: "report",
+	pageSize: 500,
+	maxRowsPerDevice: 5e4,
+	maxReclaimPerDevice: 5e4,
+	maxBytesPerRun: 20 * 1024 * 1024 * 1024,
+	budgetMs: 30 * 6e4,
+	graceMs: 60 * 6e4,
+	throttleBytesPerSec: 2 * 1024 * 1024
+};
+function emptyTally() {
+	return {
+		examined: 0,
+		eligible: 0,
+		reclaimed: 0,
+		bytesReclaimed: 0,
+		held: 0,
+		unresolved: 0,
+		withinGrace: 0,
+		refused: 0
+	};
+}
+/**
+* Walk ONE device within ONE scope. Never throws: a probe failure ends the
+* device with what it has and a cursor that has not moved past anything
+* unfinished.
+*/
+async function reclaimDeviceScope(input) {
+	const { deviceId, scope, deps, limits } = input;
+	const tally = emptyTally();
+	const graceFloor = deps.now() - limits.graceMs;
+	let cursor = Math.max(0, input.cursor);
+	let byteBudget = input.byteBudget;
+	let stoppedBy = "exhausted";
+	for (;;) {
+		if (deps.now() >= input.deadlineMs) {
+			stoppedBy = "budget";
+			break;
+		}
+		if (tally.examined >= limits.maxRowsPerDevice) {
+			stoppedBy = "row-ceiling";
+			break;
+		}
+		const rows = await deps.page({
+			deviceId,
+			scope,
+			afterMs: cursor,
+			limit: limits.pageSize
+		});
+		if (rows.length === 0) break;
+		const ownerIds = [...new Set(rows.map((r) => r.ownerId).filter((id) => id.length > 0))];
+		let motionOwners = /* @__PURE__ */ new Set();
+		let pinnedOwners = /* @__PURE__ */ new Set();
+		try {
+			if (scope === "motion-still") motionOwners = ownerIds.length > 0 ? await deps.motionEventIds(ownerIds) : /* @__PURE__ */ new Set();
+			else pinnedOwners = ownerIds.length > 0 ? await deps.pinnedTrackIds(ownerIds) : /* @__PURE__ */ new Set();
+		} catch (err) {
+			deps.logger.warn("media reclaim: ownership probe failed — device abandoned for this run", {
+				tags: { deviceId },
+				meta: {
+					scope,
+					cursor,
+					error: String(err)
+				}
+			});
+			stoppedBy = "probe-failed";
+			break;
+		}
+		let pageBytes = 0;
+		let halted = null;
+		for (const row of rows) {
+			tally.examined += 1;
+			const advanceTo = row.timestamp;
+			if (row.timestamp > graceFloor) {
+				tally.withinGrace += 1;
+				cursor = advanceTo;
+				continue;
+			}
+			if (scope === "motion-still" && !motionOwners.has(row.ownerId)) {
+				tally.unresolved += 1;
+				cursor = advanceTo;
+				continue;
+			}
+			if (scope === "track-filmstrip" && pinnedOwners.has(row.ownerId)) {
+				tally.held += 1;
+				cursor = advanceTo;
+				continue;
+			}
+			tally.eligible += 1;
+			if (limits.mode === "report") {
+				cursor = advanceTo;
+				continue;
+			}
+			if (tally.reclaimed >= limits.maxReclaimPerDevice) {
+				halted = "reclaim-ceiling";
+				break;
+			}
+			if (byteBudget <= 0) {
+				halted = "byte-ceiling";
+				break;
+			}
+			try {
+				const gone = await deps.reclaim(row.key);
+				tally.reclaimed += gone.rows;
+				tally.bytesReclaimed += gone.bytes;
+				byteBudget -= gone.bytes;
+				pageBytes += gone.bytes;
+				cursor = advanceTo;
+			} catch (err) {
+				tally.refused += 1;
+				deps.logger.warn("media reclaim: delete refused — row kept", {
+					tags: { deviceId },
+					meta: {
+						scope,
+						key: row.key,
+						error: String(err)
+					}
+				});
+				halted = "delete-refused";
+				break;
+			}
+		}
+		if (halted !== null) {
+			stoppedBy = halted;
+			break;
+		}
+		if (limits.throttleBytesPerSec > 0 && pageBytes > 0 && deps.pace) await deps.pace(pageBytes / limits.throttleBytesPerSec * 1e3);
+		if (deps.breathe) await deps.breathe();
+		if (rows.length < limits.pageSize) break;
+	}
+	return {
+		deviceId,
+		scope,
+		examined: tally.examined,
+		eligible: tally.eligible,
+		reclaimed: tally.reclaimed,
+		bytesReclaimed: tally.bytesReclaimed,
+		held: tally.held,
+		unresolved: tally.unresolved,
+		withinGrace: tally.withinGrace,
+		refused: tally.refused,
+		stoppedBy,
+		nextCursor: cursor
+	};
+}
+/** Cursor key for one `(device, scope)` pair. */
+function mediaReclaimCursorKey(deviceId, scope) {
+	return `${scope}:${deviceId}`;
+}
+/**
+* Walk every `(device, scope)` pair under one shared byte budget and one
+* shared deadline, and log ONE summary line per device — never a line per row.
+*/
+async function runMediaReclaim(input) {
+	const startedAt = input.deps.now();
+	const deadlineMs = startedAt + input.limits.budgetMs;
+	const nextCursors = new Map(input.cursors);
+	const devices = [];
+	let byteBudget = input.limits.maxBytesPerRun;
+	for (const scope of input.scopes) for (const deviceId of input.deviceIds) {
+		if (input.deps.now() >= deadlineMs) break;
+		const key = mediaReclaimCursorKey(deviceId, scope);
+		const report = await reclaimDeviceScope({
+			deviceId,
+			scope,
+			cursor: input.cursors.get(key) ?? 0,
+			deps: input.deps,
+			limits: input.limits,
+			deadlineMs,
+			byteBudget
+		});
+		byteBudget -= report.bytesReclaimed;
+		nextCursors.set(key, report.stoppedBy === "exhausted" ? 0 : report.nextCursor);
+		devices.push(report);
+		if (report.examined > 0 || report.refused > 0) input.deps.logger.info("media reclaim window", {
+			tags: { deviceId },
+			meta: {
+				scope,
+				mode: input.limits.mode,
+				examined: report.examined,
+				eligible: report.eligible,
+				reclaimed: report.reclaimed,
+				bytesReclaimed: report.bytesReclaimed,
+				held: report.held,
+				unresolved: report.unresolved,
+				withinGrace: report.withinGrace,
+				refused: report.refused,
+				stoppedBy: report.stoppedBy,
+				nextCursor: report.nextCursor
+			}
+		});
+	}
+	const total = (pick) => devices.reduce((acc, r) => acc + pick(r), 0);
+	return {
+		report: {
+			mode: input.limits.mode,
+			devices,
+			totalExamined: total((r) => r.examined),
+			totalEligible: total((r) => r.eligible),
+			totalReclaimed: total((r) => r.reclaimed),
+			totalBytesReclaimed: total((r) => r.bytesReclaimed),
+			totalRefused: total((r) => r.refused),
+			durationMs: input.deps.now() - startedAt,
+			complete: devices.every((r) => r.stoppedBy === "exhausted")
+		},
+		cursors: nextCursors
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/retention/orphan-audit-actions.ts
 /**
 * The operator button for the orphan audit.
@@ -40277,13 +41276,29 @@ var RETRAIN_FRAME_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var RETRAIN_FRAME_INDEXES = [{
-	name: "idx_retrain_frames_track",
-	columns: ["trackId"]
-}, {
-	name: "idx_retrain_frames_device",
-	columns: ["deviceId", "copiedAt"]
-}];
+var RETRAIN_FRAME_INDEXES = [
+	{
+		name: "idx_retrain_frames_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_retrain_frames_device",
+		columns: ["deviceId", "copiedAt"]
+	},
+	(
+	/**
+	* The seal gate's other half. This collection is orders of magnitude smaller
+	* than `pipeline-analytics:media` — every row is an operator-staged frame —
+	* so the index buys much less here. It exists anyway because the gate reads
+	* the two lanes with ONE query shape, and a lane that answers by scanning is
+	* a lane that starts timing out the day the dataset grows. See
+	* `MEDIA_INDEXES` for the cost this is a small multiple of.
+	*/
+	{
+		name: "idx_retrain_frames_location",
+		columns: ["locationId"]
+	})
+];
 /**
 * The copy's id, derived from `(trackId, sourceMediaKey)`.
 *
@@ -43542,21 +44557,34 @@ function snapshot(j) {
 		entities: [...entitiesFor(j.mode)],
 		filesMoved: j.filesMoved,
 		bytesMoved: j.bytesMoved,
-		filesTotal: null,
+		filesTotal: j.filesTotal,
 		startedAt: j.startedAt,
 		finishedAt: j.finishedAt,
 		error: j.error
 	};
 }
 /**
+* The column both walked collections use for the storage location.
+*
+* Named once because it is now a QUERY PREDICATE (`where: { [it]: null }`) as
+* well as a row field. A predicate naming a column the collection cannot
+* express is refused by `count` rather than dropped, so a rename that misses
+* one site fails loudly instead of counting the whole table.
+*/
+var LOCATION_ID_FIELD = "locationId";
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
 * helper collapses "unstamped" and "stamped with the bare type ref" into one
 * answer, and only the first is a row whose meaning changes under a repoint.
+*
+* The in-JS twin of the `IS NULL` predicate {@link MediaRelocateEngine.countUnstamped}
+* sends. It stays because the PASS still walks rows and must decide per row;
+* the two must agree, and `unstamped-count-matches-the-pass` asserts they do.
 */
 function rowIsUnstamped(data) {
-	const id = data["locationId"];
+	const id = data[LOCATION_ID_FIELD];
 	return !(typeof id === "string" && id.length > 0);
 }
 /** True for the enrolled-gallery rows `move` skips and `gallery` selects. */
@@ -43564,6 +44592,40 @@ function rowIsGallery(data) {
 	const ownerKind = String(data["ownerKind"] ?? "");
 	return isMediaOwnerKind(ownerKind) && isRetentionExemptOwnerKind(ownerKind);
 }
+/**
+* Which collections a pass walks.
+*
+* ONE derivation, shared by the pass and by its pre-count. Two lists would let
+* an M counted over both collections face an N moved across one — the shape
+* D295 calls "a guard nobody believes".
+*/
+function collectionsFor(mode) {
+	if (mode === "gallery") return [{
+		name: MEDIA_COLLECTION,
+		order: "timestamp"
+	}];
+	return [{
+		name: MEDIA_COLLECTION,
+		order: "timestamp"
+	}, {
+		name: RETRAIN_FRAMES_COLLECTION,
+		order: "copiedAt"
+	}];
+}
+/**
+* Does this pass act on this row at all?
+*
+* A free function of `(mode, target)` rather than a method on the job, so the
+* pre-count that produces `filesTotal` and the walk that produces `filesMoved`
+* ask the SAME question. A separately-written predicate is how a denominator
+* ends up counting a different population than the numerator.
+*/
+function selectsRow(mode, toLocationId, data, isRetrain) {
+	if (mode === "seal") return rowIsUnstamped(data);
+	if (mediaRowLocation(data) === toLocationId) return false;
+	if (mode === "gallery") return !isRetrain && rowIsGallery(data);
+	return isRetrain || !rowIsGallery(data);
+}
 var MediaRelocateEngine = class {
 	deps;
 	jobs = /* @__PURE__ */ new Map();
@@ -43580,26 +44642,91 @@ var MediaRelocateEngine = class {
 		return true;
 	}
 	/**
-	* How many rows still carry no `locationId`, per collection.
+	* Rows that still carry no `locationId`, per collection.
 	*
-	* Read-only, and the ONLY number the migration planner's non-blocking gate
-	* is allowed to trust: it is counted here, against the rows themselves,
+	* Read-only, and the ONLY answer the migration planner's non-blocking gate
+	* is allowed to trust: it is measured here, against the rows themselves,
 	* rather than inferred from "a seal job reported done" — a seal that failed
 	* some rows still reports a terminal state.
+	*
+	* ── Why this is not the walk the rest of this file uses ──────────────────
+	*
+	* It used to be. It paged both collections through {@link pageRows} — 200
+	* rows per RPC, ordered by `timestamp`, a column that leads no index — and
+	* counted `rowIsUnstamped` in JS. On the live hub that is ~6 300 round trips
+	* over 1 254 576 rows, each paying its own sort, and it hit the 60 s RPC
+	* deadline **every time it was called since it shipped**. The gate it exists
+	* to serve could therefore never open, and 152 GB of event media could not
+	* be migrated.
+	*
+	* The walk is right for the PASS, which must visit every row to act on it.
+	* It was never right for a question the store can answer with a predicate,
+	* and the predicate is now expressible: `where: { locationId: null }`
+	* compiles to `IS NULL` (it used to compile to `= NULL`, which matches
+	* nothing and reports it as an answer — the number the gate treats as "safe
+	* to cut over"). With `idx_media_location` in place both statements read a
+	* contiguous range from the head of a b-tree.
+	*
+	* The cheap question is asked FIRST and on its own. `present` is a single
+	* seek and decides the gate; `rows` is a second statement and only decorates
+	* the refusal. So a count that cannot be taken still leaves a usable answer
+	* — `{ present: true, rows: null }` refuses just as hard — and `null` never
+	* degrades into `0`.
 	*/
 	async countUnstamped() {
-		const media = await this.countUnstampedIn(MEDIA_COLLECTION, "timestamp");
-		const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION, "copiedAt");
-		return {
-			media,
-			retrainFrames,
-			total: media + retrainFrames
-		};
+		try {
+			const media = await this.countUnstampedIn(MEDIA_COLLECTION);
+			const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION);
+			return {
+				media,
+				retrainFrames,
+				anyPresent: media.present || retrainFrames.present,
+				total: media.rows === null || retrainFrames.rows === null ? null : media.rows + retrainFrames.rows
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: could not determine whether any row is unstamped — a migration must treat this as unknown, never as sealed", { meta: { error: String(err) } });
+			return null;
+		}
 	}
-	async countUnstampedIn(collection, orderField) {
-		let unstamped = 0;
-		for await (const row of this.pageRows(collection, orderField)) if (rowIsUnstamped(row.data)) unstamped++;
-		return unstamped;
+	/**
+	* One collection's unstamped population: existence, then size.
+	*
+	* The `limit: 1` probe is deliberately a `query` and not a `count`: a count
+	* of a million matching rows still walks a million index entries, while the
+	* probe stops at the first one. Absence is proved by the same seek finding
+	* nothing, which is where the index earns its keep — after a seal, the range
+	* is empty and the answer is one b-tree descent.
+	*/
+	async countUnstampedIn(collection) {
+		if ((await this.deps.store.query.query({
+			collection,
+			filter: {
+				where: { [LOCATION_ID_FIELD]: null },
+				limit: 1
+			},
+			columns: [LOCATION_ID_FIELD]
+		})).length === 0) return {
+			present: false,
+			rows: 0
+		};
+		try {
+			return {
+				present: true,
+				rows: await this.deps.store.count.query({
+					collection,
+					filter: { where: { [LOCATION_ID_FIELD]: null } }
+				})
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: unstamped rows exist but could not be counted — reporting the population as unknown, not as empty", { meta: {
+				collection,
+				error: String(err)
+			} });
+			return {
+				present: true,
+				rows: null
+			};
+		}
 	}
 	start(input) {
 		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);
@@ -43612,6 +44739,7 @@ var MediaRelocateEngine = class {
 			deviceId: null,
 			filesMoved: 0,
 			bytesMoved: 0,
+			filesTotal: null,
 			startedAt: this.deps.now(),
 			finishedAt: null,
 			error: null,
@@ -43660,12 +44788,39 @@ var MediaRelocateEngine = class {
 			if (rows.length < PAGE_SIZE) return;
 		}
 	}
-	/** Does this pass act on this row at all? */
-	selects(job, data, isRetrain) {
-		if (job.mode === "seal") return rowIsUnstamped(data);
-		if (mediaRowLocation(data) === job.toLocationId) return false;
-		if (job.mode === "gallery") return !isRetrain && rowIsGallery(data);
-		return isRetrain || !rowIsGallery(data);
+	/**
+	* How many rows a pass would still act on against `toLocationId`.
+	*
+	* The media lane's **M**, and — read on its own — its residue: "how much of
+	* `eventMedia` is still not on the current default". Both come from here so
+	* neither can drift from what the pass actually moves.
+	*
+	* `null` is "the count could not be taken", never `0`. A zero here reads as
+	* "there is nothing left to move", which is precisely the claim a failed read
+	* must not be allowed to make (D295).
+	*/
+	async countSelectable(input) {
+		return this.countSelected(input.mode ?? "move", input.toLocationId, () => false);
+	}
+	async countSelected(mode, toLocationId, stop) {
+		try {
+			let rows = 0;
+			for (const collection of collectionsFor(mode)) {
+				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
+				for await (const row of this.pageRows(collection.name, collection.order)) {
+					if (stop()) return null;
+					if (selectsRow(mode, toLocationId, row.data, isRetrain)) rows++;
+				}
+			}
+			return { rows };
+		} catch (err) {
+			this.deps.logger.warn("media relocate: row count failed — this pass cannot say how much of the collection it saw", { meta: {
+				mode,
+				toLocationId,
+				error: String(err)
+			} });
+			return null;
+		}
 	}
 	async run(job, throttleMbps) {
 		const sleep = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -43679,23 +44834,14 @@ var MediaRelocateEngine = class {
 			*  rows in silence reads as "there were none", which is how a migration
 			*  gets believed. */
 			let pathlessRows = 0;
-			const collections = job.mode === "gallery" ? [{
-				name: MEDIA_COLLECTION,
-				order: "timestamp"
-			}] : [{
-				name: MEDIA_COLLECTION,
-				order: "timestamp"
-			}, {
-				name: RETRAIN_FRAMES_COLLECTION,
-				order: "copiedAt"
-			}];
-			for (const collection of collections) {
+			job.filesTotal = (await this.countSelected(job.mode, job.toLocationId, () => job.cancelRequested))?.rows ?? null;
+			for (const collection of collectionsFor(job.mode)) {
 				if (job.cancelRequested) break;
 				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
 				for await (const row of this.pageRows(collection.name, collection.order)) {
 					if (job.cancelRequested) break;
 					const data = row.data;
-					if (!this.selects(job, data, isRetrain)) continue;
+					if (!selectsRow(job.mode, job.toLocationId, data, isRetrain)) continue;
 					if (job.mode === "seal") {
 						try {
 							await this.stamp(collection.name, row.id, data, job.toLocationId);
@@ -43808,10 +44954,38 @@ var MediaSettingsSchema = require_dist.object({
 	*  0 = tight crop, 0.15 = expand each side by 15% of the box dimension,
 	*  max 2 (200%). */
 	cropPadding: require_dist.number().min(0).max(2).default(.15),
-	/** Master switch for periodic per-track snapshots (the timeline filmstrip +
-	*  the rolling `lastFrame` + the best `thumbnail`). When false, only the
-	*  per-track `firstFrame` and per-event media are produced. */
-	saveThumbnails: require_dist.boolean().default(true),
+	/**
+	* Per-camera DEBUG media. Default **false**, and it absorbs the retired
+	* `saveThumbnails` rather than sitting beside it (D62: a second switch that
+	* disagrees with the first is worse than no switch).
+	*
+	* What it gates, and only this:
+	*  - the periodic per-track `snapshot` filmstrip (`periodic-media-plan.ts`);
+	*  - the per-EDGE motion still — the debug surplus that
+	*    {@link decideMotionStill} otherwise reduces to one marker per
+	*    {@link MediaSettings.motionMarkerQuietMs} drought window.
+	*
+	* What it never gates, at any value: `firstFrame`, the rolling `lastFrame`,
+	* `thumbnail`/`thumbnailSmall`, `keyFrame`/`keyFrameSmall`, the face/plate
+	* buffers, gallery media, the CLIP search `crop` — and the quiet-period
+	* motion marker itself, which is the operator's fallback and must survive
+	* the default (a blank timeline on a quiet camera reads as broken).
+	*
+	* The rolling `lastFrame` deliberately moved OUT from under the old
+	* `saveThumbnails`: it is in the keep-set, and a debug switch may not take
+	* it away.
+	*/
+	debugMediaEnabled: require_dist.boolean().default(false),
+	/**
+	* The detection-drought window N for the motion marker: with debug media
+	* off, a motion off→on edge produces a still only when NO detection has run
+	* on this camera for this long AND no marker was produced in the last such
+	* window. Chosen from the observed fleet distribution of detection-free
+	* stretches (median 42 s, p75 201 s, p90 770 s) — 900 s sits just past p90,
+	* so nine stretches in ten produce nothing. See
+	* `services/motion-marker-policy.ts`.
+	*/
+	motionMarkerQuietMs: require_dist.number().int().min(6e4).max(360 * 6e4).default(9e5),
 	/** Cadence (ms) for the periodic per-track `snapshot` + rolling `lastFrame`.
 	*  A snapshot is captured for an active track only after this much wall-clock
 	*  has elapsed since its previous one. */
@@ -43840,7 +45014,8 @@ function resolveMediaSettings(raw) {
 	};
 	return {
 		cropPadding: pick("cropPadding"),
-		saveThumbnails: pick("saveThumbnails"),
+		debugMediaEnabled: pick("debugMediaEnabled"),
+		motionMarkerQuietMs: pick("motionMarkerQuietMs"),
 		snapshotIntervalMs: pick("snapshotIntervalMs"),
 		snapshotMovementThreshold: pick("snapshotMovementThreshold"),
 		snapshotMaxIdleMs: pick("snapshotMaxIdleMs")
@@ -44084,9 +45259,9 @@ function resolvePackageDropSettings(raw) {
 * can never duplicate one.
 */
 function planPeriodicMedia(input) {
-	const appendSnapshot = input.dueSnapshot;
+	const appendSnapshot = input.debugMediaEnabled && input.dueSnapshot;
 	const lastFrameInterval = input.lastFrameIntervalMs ?? input.intervalMs;
-	const lastFrameElapsed = input.saveThumbnails && Math.floor(input.now / lastFrameInterval) > Math.floor(input.lastFrameAt / lastFrameInterval);
+	const lastFrameElapsed = Math.floor(input.now / lastFrameInterval) > Math.floor(input.lastFrameAt / lastFrameInterval);
 	const firstFrameLanded = input.firstFrameLanded ?? true;
 	const rollingLastFrame = lastFrameElapsed && !appendSnapshot && firstFrameLanded;
 	const thumbnailLanded = input.thumbnailLanded ?? true;
@@ -44757,6 +45932,90 @@ function padBbox(bbox, padding) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/subject-agreement.ts
+/**
+* `subjectAgreement` — the ONE predicate for "a rectangle measured on frame A
+* is still honest against the pixels of frame B".
+*
+* Two durable display crops cut a rectangle out of a frame that is NOT the
+* frame the rectangle was measured on: the close-time thumbnail derive (the
+* best-seen subject box, cut from the persisted keyFrame) and the plate
+* gallery's last-resort crop (the plate rect at the best OCR read, cut from the
+* same keyFrame). Both were guarded on TIME alone, and time is the wrong
+* quantity: 1.5 s is nothing for a parked car and hundreds of native pixels for
+* a car crossing the frame. Confirmed on the operator's debug-marked tracks
+* (2026-08-30 triage): `e9c024bb` passed the time bound at 531–1179 ms and
+* stored a windshield and a patch of gravel, while `7613c0fa` — the same path,
+* 2579 ms of skew, a stationary vehicle — stored a perfectly framed plate.
+*
+* The quantity that separates those cases is MOTION, and the track's own
+* `positions` trail already records it. This asks the trail one question:
+*
+*   between the instant the rectangle was measured and the instant the pixels
+*   were captured, did the subject stay where it was?
+*
+* IoU over the two subject boxes answers it, and because both boxes come from
+* the SAME trail they are in the same detection-frame pixel space by
+* construction — there is no cross-space normalization to get wrong.
+*
+* D52's one-derivation discipline applied to the guard: this is the only place
+* the question is answered, and {@link createKeyFrameCrop} is its only caller,
+* so both defects share one contract instead of two drifting copies.
+*
+* `unknown` is a real verdict, not a failure: a track with no trail, or a trail
+* downsampled away from one of the two instants, carries NO motion evidence.
+* The caller then falls back to the temporal bound it always had — an absent
+* read changes nothing (D49).
+*/
+function nearestSample(path, atMs, maxSampleGapMs) {
+	let best;
+	let bestGap = Number.POSITIVE_INFINITY;
+	for (const sample of path) {
+		const gap = Math.abs(sample.timestamp - atMs);
+		if (gap < bestGap) {
+			bestGap = gap;
+			best = sample;
+		}
+	}
+	if (best === void 0 || bestGap > maxSampleGapMs) return void 0;
+	return {
+		bbox: best.bbox,
+		gapMs: bestGap
+	};
+}
+/**
+* Answer "did the subject stay put between the two instants?" from the track's
+* own position trail. Pure — no IO, no clock, no logging: the caller owns the
+* consequence and the line it writes.
+*/
+function subjectAgreement(query) {
+	if (query.path.length === 0) return {
+		kind: "unknown",
+		reason: "no-path"
+	};
+	const atMeasure = nearestSample(query.path, query.measuredAtMs, query.maxSampleGapMs);
+	if (atMeasure === void 0) return {
+		kind: "unknown",
+		reason: "no-sample-near-measure"
+	};
+	const atCut = nearestSample(query.path, query.cutFromMs, query.maxSampleGapMs);
+	if (atCut === void 0) return {
+		kind: "unknown",
+		reason: "no-sample-near-cut"
+	};
+	const overlap = iou$1(atMeasure.bbox, atCut.bbox);
+	const sampleGapMs = Math.max(atMeasure.gapMs, atCut.gapMs);
+	return overlap >= query.minIou ? {
+		kind: "agrees",
+		iou: overlap,
+		sampleGapMs
+	} : {
+		kind: "moved",
+		iou: overlap,
+		sampleGapMs
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/keyframe-crop.ts
 function createKeyFrameCrop(deps) {
 	return async (input) => {
@@ -44764,12 +46023,36 @@ function createKeyFrameCrop(deps) {
 		const media = await deps.getMedia(input.mediaKey);
 		if (!media) return null;
 		const skewMs = Math.abs(media.timestamp - input.timestamp);
-		if (skewMs > deps.maxSkewMs) {
-			deps.logger.debug("keyframe crop rejected — temporal skew too large", { meta: {
-				mediaKey: input.mediaKey,
-				skewMs,
-				maxSkewMs: deps.maxSkewMs
-			} });
+		const verdict = subjectAgreement({
+			path: input.subjectPath ?? [],
+			measuredAtMs: input.timestamp,
+			cutFromMs: media.timestamp,
+			minIou: deps.minSubjectIou,
+			maxSampleGapMs: deps.maxSubjectSampleGapMs
+		});
+		if (verdict.kind === "moved") {
+			deps.logger.info("keyframe crop refused — subject moved between the two instants", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					mediaKey: input.mediaKey,
+					skewMs,
+					subjectIou: verdict.iou,
+					minSubjectIou: deps.minSubjectIou,
+					sampleGapMs: verdict.sampleGapMs
+				}
+			});
+			return null;
+		}
+		if (verdict.kind === "unknown" && skewMs > deps.maxSkewMs) {
+			deps.logger.info("keyframe crop refused — temporal skew too large, no motion evidence", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					mediaKey: input.mediaKey,
+					skewMs,
+					maxSkewMs: deps.maxSkewMs,
+					unknownReason: verdict.reason
+				}
+			});
 			return null;
 		}
 		try {
@@ -44781,15 +46064,25 @@ function createKeyFrameCrop(deps) {
 				w: input.bbox.w / input.frameWidth,
 				h: input.bbox.h / input.frameHeight
 			}, input.padding);
-			return {
-				jpeg: await deps.cropRegionToJpeg(Buffer.from(rgb.bytes), rgb.width, rgb.height, norm),
-				skewMs
+			const jpeg = await deps.cropRegionToJpeg(Buffer.from(rgb.bytes), rgb.width, rgb.height, norm);
+			return verdict.kind === "agrees" ? {
+				jpeg,
+				skewMs,
+				motion: "agrees",
+				subjectIou: verdict.iou
+			} : {
+				jpeg,
+				skewMs,
+				motion: "unknown"
 			};
 		} catch (err) {
-			deps.logger.debug("keyframe crop derive failed", { meta: {
-				mediaKey: input.mediaKey,
-				error: err instanceof Error ? err.message : String(err)
-			} });
+			deps.logger.debug("keyframe crop derive failed", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					mediaKey: input.mediaKey,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
 			return null;
 		}
 	};
@@ -47632,6 +48925,52 @@ async function applyTrackFlags(deps, input) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/plate-matcher.ts
+/**
+* plate-matcher — name a plate read against the vehicle gallery by text vicinity.
+*
+* Parallel to face-matcher's `matchEmbedding`, but a plate is self-labeling:
+* distance is `plateDistance` (OCR-confusion-folded Levenshtein), not cosine.
+* There is no model-version gate (text has no embedding drift) and no ambiguity
+* `margin` (Levenshtein has no comparable normalized gap) — a tie is resolved
+* conservatively to NO match. The read's `score` weights how far it may match:
+* a high-confidence read (`score >= lowScoreFloor`) may match at `maxDistance`;
+* a low-confidence read is held to `lowScoreMaxDistance` (exact fold only).
+* "Prefer unassigned over wrong vehicle."
+*/
+/** Calibration placeholders — re-tune against real OCR score distributions. */
+var DEFAULT_PLATE_MATCH_OPTS = {
+	maxDistance: 1,
+	lowScoreFloor: .5,
+	lowScoreMaxDistance: 0
+};
+function matchPlateText(probe, gallery, opts) {
+	const allowed = probe.score >= opts.lowScoreFloor ? opts.maxDistance : opts.lowScoreMaxDistance;
+	const bestByVehicle = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		const dist = plateDistance(probe.text, s.text);
+		const prev = bestByVehicle.get(s.vehicleId);
+		if (prev === void 0 || dist < prev) bestByVehicle.set(s.vehicleId, dist);
+	}
+	if (bestByVehicle.size === 0) return null;
+	let bestId = null;
+	let bestDist = Infinity;
+	let tie = false;
+	for (const [vehicleId, dist] of bestByVehicle) {
+		if (dist > allowed) continue;
+		if (dist < bestDist) {
+			bestDist = dist;
+			bestId = vehicleId;
+			tie = false;
+		} else if (dist === bestDist) tie = true;
+	}
+	if (bestId === null || tie) return null;
+	return {
+		vehicleId: bestId,
+		distance: bestDist
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/plate-vote.ts
 /**
 * Per-character VOTE over a track's plate reads.
@@ -47773,52 +49112,6 @@ function votePlateText(reads) {
 	return out;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/plate-matcher.ts
-/**
-* plate-matcher — name a plate read against the vehicle gallery by text vicinity.
-*
-* Parallel to face-matcher's `matchEmbedding`, but a plate is self-labeling:
-* distance is `plateDistance` (OCR-confusion-folded Levenshtein), not cosine.
-* There is no model-version gate (text has no embedding drift) and no ambiguity
-* `margin` (Levenshtein has no comparable normalized gap) — a tie is resolved
-* conservatively to NO match. The read's `score` weights how far it may match:
-* a high-confidence read (`score >= lowScoreFloor`) may match at `maxDistance`;
-* a low-confidence read is held to `lowScoreMaxDistance` (exact fold only).
-* "Prefer unassigned over wrong vehicle."
-*/
-/** Calibration placeholders — re-tune against real OCR score distributions. */
-var DEFAULT_PLATE_MATCH_OPTS = {
-	maxDistance: 1,
-	lowScoreFloor: .5,
-	lowScoreMaxDistance: 0
-};
-function matchPlateText(probe, gallery, opts) {
-	const allowed = probe.score >= opts.lowScoreFloor ? opts.maxDistance : opts.lowScoreMaxDistance;
-	const bestByVehicle = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		const dist = plateDistance(probe.text, s.text);
-		const prev = bestByVehicle.get(s.vehicleId);
-		if (prev === void 0 || dist < prev) bestByVehicle.set(s.vehicleId, dist);
-	}
-	if (bestByVehicle.size === 0) return null;
-	let bestId = null;
-	let bestDist = Infinity;
-	let tie = false;
-	for (const [vehicleId, dist] of bestByVehicle) {
-		if (dist > allowed) continue;
-		if (dist < bestDist) {
-			bestDist = dist;
-			bestId = vehicleId;
-			tie = false;
-		} else if (dist === bestDist) tie = true;
-	}
-	if (bestId === null || tie) return null;
-	return {
-		vehicleId: bestId,
-		distance: bestDist
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/runtime/failure-report.ts
 /**
 * What `pipeline-analytics` reports through `failure-contribution` — the four
@@ -48150,9 +49443,16 @@ var PlateRecognizer = class {
 	bestLabelMatchConfidence(trackId) {
 		return this.bestPlate.get(trackId)?.score;
 	}
-	/** Persist the held best plate for a finished track as one PlateStore row
-	*  (crop → MediaStore under ownerKind 'plate'), then drop in-memory state. */
-	async onTrackEnd(deviceId, trackId) {
+	/**
+	* Persist the held best plate for a finished track as one PlateStore row
+	* (crop → MediaStore under ownerKind 'plate'), then drop in-memory state.
+	*
+	* @param subjectPath the closing track's position trail, supplied by the
+	* closer. It is what tells a parked car (whose plate rect is still honest
+	* seconds later) from a crossing one (whose rect points at the road it has
+	* already left) — the distinction the pure time bound could not make.
+	*/
+	async onTrackEnd(deviceId, trackId, subjectPath) {
 		const held = this.bestPlate.get(trackId);
 		this.bestPlate.delete(trackId);
 		if (held === void 0) return;
@@ -48161,12 +49461,14 @@ var PlateRecognizer = class {
 		let cropData = held.crop;
 		if (cropData === void 0 && keyFrameMediaKey !== void 0 && this.deps.deriveCropFromKeyFrame) try {
 			const derived = await this.deps.deriveCropFromKeyFrame({
+				deviceId,
 				mediaKey: keyFrameMediaKey,
 				bbox: held.bbox,
 				frameWidth: held.frameWidth,
 				frameHeight: held.frameHeight,
 				padding: held.cropPadding,
-				timestamp: held.timestamp
+				timestamp: held.timestamp,
+				...subjectPath !== void 0 ? { subjectPath } : {}
 			});
 			if (derived) {
 				cropData = derived.jpeg;
@@ -48177,10 +49479,18 @@ var PlateRecognizer = class {
 					},
 					meta: {
 						plateId,
-						skewMs: derived.skewMs
+						skewMs: derived.skewMs,
+						motion: derived.motion,
+						subjectIou: derived.subjectIou ?? null
 					}
 				});
-			}
+			} else this.deps.logger.info("plate crop not recovered — keyFrame derive refused or missed", {
+				tags: {
+					deviceId,
+					trackId
+				},
+				meta: { plateId }
+			});
 		} catch (err) {
 			this.deps.logger.debug("PlateRecognizer keyFrame crop derive failed", {
 				tags: { deviceId },
@@ -48781,6 +50091,122 @@ async function reconcileGallerySamples(deps, options) {
 		stoppedByCeiling
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/retention/embedding-orphan-scan.ts
+/** The scope id this leg reports and persists its cursor under. */
+var EMBEDDING_ORPHAN_SCOPE = "vector-index:object-clip";
+/**
+* Walk the index once, resuming at `cursor`.
+*
+* Never throws: a probe failure ends the pass with what it has and says which
+* bound stopped it, so a short pass can never be read as a clean one.
+*/
+async function scanEmbeddingOrphans(deps, limits, cursor) {
+	const tally = {
+		examined: 0,
+		orphans: 0,
+		reclaimed: 0,
+		kept: 0,
+		withinGrace: 0,
+		unresolvable: 0,
+		notReclaimed: 0
+	};
+	const deviceIds = /* @__PURE__ */ new Set();
+	const graceFloor = deps.now() - limits.graceMs;
+	let offset = Math.max(0, cursor);
+	let stoppedBy = "exhausted";
+	for (;;) {
+		if (tally.examined >= limits.maxRows) {
+			stoppedBy = "row-ceiling";
+			break;
+		}
+		let page;
+		try {
+			page = await deps.scanPage(offset, limits.pageSize);
+		} catch (err) {
+			deps.logger.warn("embedding orphan scan: index page failed — pass abandoned", { meta: {
+				scope: EMBEDDING_ORPHAN_SCOPE,
+				offset,
+				error: String(err)
+			} });
+			stoppedBy = "page-stalled";
+			break;
+		}
+		const named = page.rows.filter((r) => r.trackId !== null).map((r) => r.trackId ?? "");
+		let live;
+		try {
+			live = named.length > 0 ? await deps.liveTrackIds(named) : /* @__PURE__ */ new Set();
+		} catch (err) {
+			deps.logger.warn("embedding orphan scan: liveness probe failed — pass abandoned", { meta: {
+				scope: EMBEDDING_ORPHAN_SCOPE,
+				offset,
+				error: String(err)
+			} });
+			stoppedBy = "probe-failed";
+			break;
+		}
+		const doomed = [];
+		let ceilingHit = false;
+		for (const row of page.rows) {
+			tally.examined += 1;
+			if (row.trackId === null) {
+				tally.unresolvable += 1;
+				continue;
+			}
+			if (live.has(row.trackId)) {
+				tally.kept += 1;
+				continue;
+			}
+			if (row.timestamp === null || row.timestamp > graceFloor) {
+				tally.withinGrace += 1;
+				continue;
+			}
+			tally.orphans += 1;
+			if (row.deviceId !== null) deviceIds.add(row.deviceId);
+			if (limits.mode !== "reclaim") continue;
+			if (tally.reclaimed + doomed.length >= limits.maxReclaim) {
+				ceilingHit = true;
+				break;
+			}
+			doomed.push(row.id);
+		}
+		let reclaimedInPage = 0;
+		if (doomed.length > 0) {
+			const outcome = await deps.reclaim(doomed);
+			reclaimedInPage = outcome.deleted.length;
+			tally.reclaimed += outcome.deleted.length;
+			tally.notReclaimed += outcome.stillPresent.length;
+		}
+		if (deps.breathe) await deps.breathe();
+		if (ceilingHit) {
+			stoppedBy = "reclaim-ceiling";
+			offset += page.rows.length - reclaimedInPage;
+			break;
+		}
+		offset += page.rows.length - reclaimedInPage;
+		if (page.nextCursor === null) {
+			offset = 0;
+			break;
+		}
+		if (page.rows.length === 0) {
+			stoppedBy = "page-stalled";
+			break;
+		}
+	}
+	return {
+		scope: EMBEDDING_ORPHAN_SCOPE,
+		examined: tally.examined,
+		orphans: tally.orphans,
+		reclaimed: tally.reclaimed,
+		kept: tally.kept,
+		withinGrace: tally.withinGrace,
+		unresolvable: tally.unresolvable,
+		notReclaimed: tally.notReclaimed,
+		deviceIds: [...deviceIds],
+		stoppedBy,
+		nextCursor: Math.max(0, offset)
+	};
+}
 /**
 * Where the completion marker lives.
 *
@@ -50300,6 +51726,37 @@ var EventStore = class {
 		return found;
 	}
 	/**
+	* The SUBSET of `eventIds` that are MOTION events specifically.
+	*
+	* {@link existingEventIds} answers "is this event alive", which is the
+	* orphan audit's question. The media reclaim asks a narrower one: *is this
+	* event-owned snapshot a MOTION-VISIT still* — because the selection shape
+	* (`ownerKind: 'event', kind: 'snapshot'`) is not itself a guarantee.
+	* Nothing structurally prevents another writer landing an event-owned
+	* snapshot on an object or audio row, and the reclaim must not be the place
+	* that discovers it. A per-page indexed `whereIn` on one table is cheap
+	* where that mistake would not be.
+	*
+	* THROWS on a query failure, same contract and same reason.
+	*/
+	async existingMotionEventIds(eventIds) {
+		const found = /* @__PURE__ */ new Set();
+		for (let i = 0; i < eventIds.length; i += 500) {
+			const chunk = eventIds.slice(i, i + 500);
+			if (chunk.length === 0) continue;
+			const rows = await this.store.query.query({
+				collection: MOTION_EVENTS_COLLECTION,
+				columns: ["id"],
+				filter: {
+					whereIn: { id: [...chunk] },
+					limit: chunk.length
+				}
+			});
+			for (const row of rows) found.add(row.id);
+		}
+		return found;
+	}
+	/**
 	* Delete all events for a specific device with `timestamp < cutoffMs`
 	* (exclusive upper bound) across all three kinds, returning the per-kind
 	* deleted counts and the flattened list of deleted ids (so the caller can
@@ -50572,11 +52029,21 @@ var SAMPLE_COLUMNS$1 = [
 		type: "TEXT",
 		notNull: true
 	},
+	(
+	/**
+	* LEGACY, drained on 2026-08-30 (D304). The ArcFace vector lives in the
+	* `identity-arcface` vector index now, keyed by this row's id.
+	*
+	* Still declared and still `notNull`: rows written before the conversion carry
+	* their array, and `loadGallery` falls back to it for exactly as long as one
+	* of them has not been converted. A CONVERTED row holds `[]`, which is both
+	* the idempotence marker and the only way to see the conversion is done.
+	*/
 	{
 		name: "embedding",
 		type: "JSON",
 		notNull: true
-	},
+	}),
 	{
 		name: "mediaKey",
 		type: "TEXT"
@@ -50623,9 +52090,11 @@ var SAMPLE_COLUMNS$1 = [
 ];
 var IdentityStore = class {
 	store;
+	vectors;
 	logger;
 	constructor(deps) {
 		this.store = deps.store;
+		this.vectors = deps.vectors;
 		this.logger = deps.logger;
 	}
 	static async declare(store) {
@@ -50643,6 +52112,41 @@ var IdentityStore = class {
 			}]
 		});
 	}
+	/**
+	* How an UNCONVERTED `identity-samples` row becomes an index row.
+	*
+	* `modelId` is `notNull` on this collection, so unlike the faces buffer there
+	* is nothing to infer — a row that somehow holds no model is REFUSED and
+	* keeps its JSON. An enrolled vector stamped with a guessed model is a sample
+	* the matcher would compare across feature spaces, which is the one mistake
+	* this gallery cannot survive.
+	*/
+	conversionSpec() {
+		return {
+			collection: IDENTITY_SAMPLES_COLLECTION,
+			vectors: this.vectors,
+			write: (id, embedding, data) => {
+				const modelId = data["modelId"];
+				if (typeof modelId !== "string" || modelId.length === 0) return null;
+				const identityId = data["identityId"];
+				const deviceId = data["deviceId"];
+				const addedAt = data["addedAt"];
+				const source = data["source"];
+				return {
+					id,
+					embedding,
+					className: IDENTITY_VECTOR_CLASS,
+					modelId,
+					timestamp: typeof addedAt === "number" ? addedAt : 0,
+					...typeof deviceId === "number" ? { deviceId } : {},
+					extra: {
+						...typeof identityId === "string" ? { identityId } : {},
+						...typeof source === "string" ? { source } : {}
+					}
+				};
+			}
+		};
+	}
 	async createIdentity(input) {
 		const now = Date.now();
 		const identity = {
@@ -50677,11 +52181,13 @@ var IdentityStore = class {
 			collection: IDENTITY_SAMPLES_COLLECTION,
 			filter: { where: { identityId: id } }
 		});
+		const droppedSamples = [];
 		for (const s of samples) try {
 			await this.store.delete.mutate({
 				collection: IDENTITY_SAMPLES_COLLECTION,
 				key: s.id
 			});
+			droppedSamples.push(s.id);
 		} catch (err) {
 			this.logger.warn("deleteIdentity sample delete failed", { meta: {
 				identityId: id,
@@ -50689,6 +52195,7 @@ var IdentityStore = class {
 				error: String(err)
 			} });
 		}
+		await this.vectors.drop(droppedSamples);
 		await this.store.delete.mutate({
 			collection: IDENTITIES_COLLECTION,
 			key: id
@@ -50714,7 +52221,6 @@ var IdentityStore = class {
 		const sample = {
 			id: (0, node_crypto.randomUUID)(),
 			identityId: input.identityId,
-			embedding: input.embedding,
 			...input.mediaKey !== void 0 ? { mediaKey: input.mediaKey } : {},
 			...input.sourceMediaKey !== void 0 ? { sourceMediaKey: input.sourceMediaKey } : {},
 			source: input.source ?? "detected",
@@ -50723,12 +52229,27 @@ var IdentityStore = class {
 			dim: input.embedding.length,
 			addedAt: Date.now()
 		};
+		if (!await this.vectors.put({
+			id: sample.id,
+			embedding: input.embedding,
+			className: "identity",
+			modelId: input.modelId,
+			timestamp: sample.addedAt,
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			extra: {
+				identityId: input.identityId,
+				source: sample.source
+			}
+		})) throw new Error(`identity sample was not enrolled: its ${input.embedding.length}-dim vector could not be written to the gallery index`);
 		const { id, ...rest } = sample;
 		await this.store.insert.mutate({
 			collection: IDENTITY_SAMPLES_COLLECTION,
 			record: {
 				id,
-				data: rest
+				data: {
+					...rest,
+					embedding: []
+				}
 			}
 		});
 		const identity = (await this.listIdentities()).find((i) => i.id === input.identityId);
@@ -50777,6 +52298,7 @@ var IdentityStore = class {
 			collection: IDENTITY_SAMPLES_COLLECTION,
 			key: sampleId
 		});
+		await this.vectors.drop([sampleId]);
 		const identity = (await this.listIdentities()).find((i) => i.id === identityId);
 		if (identity) {
 			const patch = {
@@ -50804,16 +52326,46 @@ var IdentityStore = class {
 			collection: IDENTITY_SAMPLES_COLLECTION,
 			filter: {}
 		});
-		const gallery = [];
+		const wanted = [];
 		for (const r of rows) {
 			const d = r.data;
-			if (!Array.isArray(d.embedding) || typeof d.modelId !== "string" || typeof d.identityId !== "string") continue;
-			gallery.push({
-				identityId: d.identityId,
-				embedding: d.embedding,
-				modelId: d.modelId
-			});
+			if (typeof d.modelId === "string" && typeof d.identityId === "string") wanted.push(r.id);
 		}
+		const vectors = await this.vectors.load(wanted);
+		const gallery = [];
+		let fromLegacyColumn = 0;
+		let missing = 0;
+		for (const r of rows) {
+			const d = r.data;
+			if (typeof d.modelId !== "string" || typeof d.identityId !== "string") continue;
+			const indexed = vectors.get(r.id);
+			if (indexed !== void 0) {
+				gallery.push({
+					identityId: d.identityId,
+					embedding: indexed,
+					modelId: d.modelId
+				});
+				continue;
+			}
+			const legacy = d.embedding;
+			if (Array.isArray(legacy) && legacy.length > 0) {
+				fromLegacyColumn += 1;
+				gallery.push({
+					identityId: d.identityId,
+					embedding: legacy,
+					modelId: d.modelId
+				});
+				continue;
+			}
+			missing += 1;
+		}
+		if (fromLegacyColumn > 0 || missing > 0) this.logger.warn("identity gallery did not come entirely from the vector index", { meta: {
+			index: this.vectors.name,
+			enrolled: rows.length,
+			loaded: gallery.length,
+			fromLegacyColumn,
+			missing
+		} });
 		return gallery;
 	}
 	/**
@@ -50849,12 +52401,23 @@ var IdentityStore = class {
 	* holding 0).
 	*/
 	async restampSample(input) {
+		if (!await this.vectors.put({
+			id: input.sampleId,
+			embedding: input.embedding,
+			className: "identity",
+			modelId: input.modelId,
+			timestamp: Date.now(),
+			extra: { identityId: input.identityId }
+		})) return {
+			landed: false,
+			reason: "the re-embedded vector did not reach the gallery index"
+		};
 		try {
 			await this.store.update.mutate({
 				collection: IDENTITY_SAMPLES_COLLECTION,
 				id: input.sampleId,
 				data: {
-					embedding: input.embedding,
+					embedding: [],
 					modelId: input.modelId,
 					dim: input.dim
 				}
@@ -53142,6 +54705,53 @@ var TrackStore = class {
 		return found;
 	}
 	/**
+	* The SUBSET of `trackIds` that are PINNED — `retrainStatus: 'staging'` or
+	* `favourited: true`.
+	*
+	* A pin is the operator saying "keep this one". It is enforced against the
+	* age sweep (`listIdsBefore` excludes both), and it must be enforced against
+	* a bulk reclaim for exactly the same reason: a starred track whose
+	* filmstrip is gone is a pin that did not hold.
+	*
+	* **The ACTIVE (in-RAM) tracks count as pinned here.** A running track has
+	* no persisted row yet, so the table cannot answer for it; treating an
+	* unanswerable id as unpinned would delete the media of the camera's current
+	* subject. Unknown means protected — the inverse of {@link existingTrackIds},
+	* where unknown means alive, and the same safe direction.
+	*
+	* THROWS on a query failure. A probe that quietly under-reports here reads as
+	* "nothing is pinned".
+	*/
+	async pinnedTrackIds(trackIds) {
+		const PAGE = 500;
+		const found = /* @__PURE__ */ new Set();
+		for (const id of trackIds) if (this.active.has(id)) found.add(id);
+		for (let i = 0; i < trackIds.length; i += PAGE) {
+			const chunk = trackIds.slice(i, i + PAGE);
+			if (chunk.length === 0) continue;
+			const [staging, favourited] = await Promise.all([this.store.query.query({
+				collection: TRACKS_COLLECTION,
+				columns: ["id"],
+				filter: {
+					whereIn: { id: [...chunk] },
+					where: { retrainStatus: "staging" },
+					limit: chunk.length
+				}
+			}), this.store.query.query({
+				collection: TRACKS_COLLECTION,
+				columns: ["id"],
+				filter: {
+					whereIn: { id: [...chunk] },
+					where: { favourited: true },
+					limit: chunk.length
+				}
+			})]);
+			for (const row of staging) found.add(row.id);
+			for (const row of favourited) found.add(row.id);
+		}
+		return found;
+	}
+	/**
 	* The distinct set of deviceIds that currently have persisted tracks. Feeds
 	* the per-device retention sweep (design §6) so a device that stopped
 	* producing frames still has its aged track debris pruned. Paged scan +
@@ -54544,13 +56154,45 @@ async function runOrphanAudit(input) {
 * sees the audit in a flame graph needs to be able to make it smaller without a
 * release.
 *
-* `mode` defaults to `'report'`. That default is the whole safety argument (see
-* `orphan-audit.ts`): the audit observes before it is allowed to act.
+* `mode` defaults to `'reclaim'` as of 2026-08-30 (D304). It defaulted to
+* `'report'` from the day the engine shipped, and that default was right for
+* exactly as long as its premise held — see {@link OrphanAuditModeSchema}.
 */
 var ORPHAN_AUDIT_MODE_SETTING = "orphanAuditMode";
 var ORPHAN_AUDIT_INTERVAL_SETTING = "orphanAuditIntervalHours";
 var ORPHAN_AUDIT_PAGE_SIZE_SETTING = "orphanAuditPageSize";
-var OrphanAuditModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
+/**
+* `'reclaim'` is the default. Here is the argument, because reversing a
+* destructive default needs one on the record.
+*
+* The original default was `'report'`, and `orphan-audit.ts` states its reason
+* precisely: *"this engine's correctness rests entirely on an ownership model
+* that is being rewritten in the same change"*. Report mode existed to make
+* that model observable BEFORE it was load-bearing.
+*
+* That premise is spent. The model has run in production for weeks and has been
+* read: the `faces` scope reported 99 orphans among its oldest 300 rows and all
+* 99 were `assigned`, i.e. the exemption doing exactly what it claims; the
+* vector index reported 956 orphans per pass, of which the D58 re-derivability
+* check (a vector whose track is gone can neither be re-embedded nor returned)
+* accounts for all of them. What report mode had left to prove, it proved.
+*
+* What it did instead was nothing, forever. `reclaimed: 0` was logged every six
+* hours against a standing backlog, and a backstop that never acts is not a
+* backstop — it is a leftover that describes the right design, which this repo
+* has decided reads as verification and is worse than an absence.
+*
+* The blast radius is unchanged and bounded five ways (exempt owner kinds, the
+* grace window, probe-failure abandons the scope, an unresolvable row is kept,
+* and a per-scope reclaim ceiling that shows up in the report as `stoppedBy`).
+* An operator who wants observation-only sets `orphanAuditMode: 'report'` and
+* gets exactly the old behaviour; the knob did not move, only its default.
+*
+* NOTE what this does NOT change: an OPERATOR-triggered pass
+* (`retention.orphanAudit`) is still dry-run unless it names `mode` — it never
+* inherits this setting. Reclaiming on demand is still a word you have to type.
+*/
+var OrphanAuditModeSchema = require_dist._enum(["report", "reclaim"]).default("reclaim");
 /** Hours between passes. Hours, not minutes — this walks whole collections. */
 var OrphanAuditIntervalHoursSchema = require_dist.number().min(1).max(168).default(6);
 var OrphanAuditPageSizeSchema = require_dist.number().int().min(50).max(5e3).default(500);
@@ -54836,8 +56478,12 @@ var BindingCache = class {
 *
 * `confirm` (S4) is the confirmation-gate re-detect crop: it GATES track birth
 * (the frame path awaits it), so it ranks WITH `firstFrame` at 0 — it must
-* jump every queued lower-priority capture and its call site never sets a
-* `staleAfterMs` (a late confirmation still confirms). `face`/`plate` (S4) are
+* jump every queued lower-priority capture. It DOES set a `staleAfterMs`, and
+* it must: priority 0 means it is inserted at the head, so an entry here that
+* cannot expire makes the whole lane unrecoverable — every later arrival is
+* inserted at the tail and shed on admission. Its deadline is the gate's own
+* `timeoutMs`, past which its caller has already discarded the answer; see the
+* `fetchCrop` note in `pipeline-analytics/index.ts`. `face`/`plate` (S4) are
 * enrichment gallery crops — same rank as `embed`: nice-to-have media that
 * must never displace the track-media ladder above.
 *
@@ -54882,7 +56528,8 @@ var DEFAULT_MAX_IN_FLIGHT_PER_DEVICE = 3;
 var DEFAULT_LOG_WINDOW_MS = 6e4;
 /** One `capture queue full` line per device per this interval. The condition
 *  holds for as long as the lane is saturated; one line per shed request would
-*  be thousands. */
+*  be thousands. What the line REPORTS is the whole interval's shed count, not
+*  the one call that happened to break the throttle — see {@link OverflowWindow}. */
 var OVERFLOW_WARN_THROTTLE_MS = 6e4;
 var CaptureScheduler = class {
 	logger;
@@ -54896,8 +56543,8 @@ var CaptureScheduler = class {
 	/** holdKey → refcount of queued/running requests holding it. */
 	heldKeys = /* @__PURE__ */ new Map();
 	windows = /* @__PURE__ */ new Map();
-	/** Per-device throttle for the `capture queue full` warn. */
-	lastOverflowWarnAt = /* @__PURE__ */ new Map();
+	/** Per-device throttle + shed accumulator for the `capture queue full` warn. */
+	overflowWindows = /* @__PURE__ */ new Map();
 	onDropped;
 	onStarted;
 	constructor(options) {
@@ -54982,6 +56629,7 @@ var CaptureScheduler = class {
 		this.coalesced.clear();
 		this.heldKeys.clear();
 		this.windows.clear();
+		this.overflowWindows.clear();
 	}
 	/** Snapshot of the CURRENT window's counters (tests/ops introspection). */
 	counters(deviceId) {
@@ -55095,8 +56743,18 @@ var CaptureScheduler = class {
 			if (lane.queue.length > w.maxQueueDepth) w.maxQueueDepth = lane.queue.length;
 		});
 	}
-	/** Drop every queued entry already past its `staleAfterMs`. Entries without
-	*  one (e.g. `confirm`, which gates track birth) are never expired here. */
+	/**
+	* Drop every queued entry already past its `staleAfterMs`.
+	*
+	* An entry without one is never expired here — and that is a real hazard, not
+	* a convenience: combined with {@link insertByPriority} + {@link shedToCap},
+	* an unexpirable entry near the HEAD makes a saturated lane unrecoverable,
+	* because every later arrival lands at the tail and is shed on admission.
+	* `confirm` was the case that bit (see the `fetchCrop` note in
+	* `pipeline-analytics/index.ts`); `keyFrame` is the one kind that still omits
+	* a deadline, and it may, because nothing abandons it — a late keyFrame can
+	* still be served from the worker's scene-tile store and lands for real.
+	*/
 	dropExpired(deviceId, lane) {
 		const nowMs = this.now();
 		for (let i = lane.queue.length - 1; i >= 0; i -= 1) {
@@ -55109,9 +56767,14 @@ var CaptureScheduler = class {
 			entry.drop();
 		}
 	}
-	/** Shed from the tail (lowest priority, newest within it) until the lane is
-	*  at its cap. Loud: a capture that is dropped rather than merely late is a
-	*  missing thumbnail or first frame, and silence would read as "never asked". */
+	/**
+	* Shed from the tail (lowest priority, newest within it) until the lane is at
+	* its cap. Loud: a capture that is dropped rather than merely late is a
+	* missing thumbnail or first frame, and silence would read as "never asked".
+	*
+	* The warn is throttled but its `shed` count is NOT the throttled call's — it
+	* is every entry shed since the last line. See {@link OverflowWindow}.
+	*/
 	shedToCap(deviceId, lane) {
 		let shed = 0;
 		while (lane.queue.length > this.maxQueued) {
@@ -55124,19 +56787,41 @@ var CaptureScheduler = class {
 		}
 		if (shed === 0) return;
 		const nowMs = this.now();
-		if (nowMs - (this.lastOverflowWarnAt.get(deviceId) ?? Number.NEGATIVE_INFINITY) < OVERFLOW_WARN_THROTTLE_MS) return;
-		this.lastOverflowWarnAt.set(deviceId, nowMs);
+		const window = this.overflowWindow(deviceId, nowMs);
+		window.shed += shed;
+		if (nowMs - window.lastWarnAt < OVERFLOW_WARN_THROTTLE_MS) return;
+		const reported = window.shed;
+		const sinceMs = window.sinceMs;
+		window.shed = 0;
+		window.sinceMs = nowMs;
+		window.lastWarnAt = nowMs;
 		this.logger.warn("capture queue full — shedding the lowest-priority captures for this camera", {
 			tags: { deviceId },
 			meta: {
-				shed,
+				shed: reported,
+				windowSec: Math.round((nowMs - sinceMs) / 1e3),
 				cap: this.maxQueued,
 				queueDepth: lane.queue.length,
+				unexpirable: lane.queue.reduce((total, entry) => total + (entry.staleAfterMs === void 0 ? 1 : 0), 0),
 				inFlight: lane.inFlight,
 				budget: this.budget
 			}
 		});
 	}
+	/** The device's shed accumulator, created on first shed. A device that has
+	*  never overflowed carries no entry — and its first shed reports
+	*  immediately, because the condition is new. */
+	overflowWindow(deviceId, nowMs) {
+		const existing = this.overflowWindows.get(deviceId);
+		if (existing !== void 0) return existing;
+		const created = {
+			sinceMs: nowMs,
+			shed: 0,
+			lastWarnAt: Number.NEGATIVE_INFINITY
+		};
+		this.overflowWindows.set(deviceId, created);
+		return created;
+	}
 	insertByPriority(lane, entry) {
 		let index = lane.queue.length;
 		while (index > 0) {
@@ -57426,6 +59111,36 @@ var EventMediaDispatcher = class {
 		}
 	}
 };
+//#endregion
+//#region src/pipeline-analytics/services/motion-marker-policy.ts
+/**
+* Pure. No clock of its own, no store read, no await — it is called on the
+* motion event path at up to the provider's keepalive rate.
+*
+* A non-positive `quietMs` would make every edge a marker (`now - x >= 0` is
+* true for any mirror), which is the flood this module removes; it is clamped
+* by the schema (`motionMarkerQuietMs.min`), and the ordering below puts the
+* detection check first so the reason names the most useful fact.
+*/
+function decideMotionStill(input) {
+	if (input.debugMediaEnabled) return {
+		capture: true,
+		reason: "debug"
+	};
+	const { now, quietMs } = input;
+	if (input.lastDetectionAtMs !== void 0 && now - input.lastDetectionAtMs < quietMs) return {
+		capture: false,
+		reason: "detection-recent"
+	};
+	if (input.lastMarkerAtMs !== void 0 && now - input.lastMarkerAtMs < quietMs) return {
+		capture: false,
+		reason: "marker-recent"
+	};
+	return {
+		capture: true,
+		reason: "quiet-marker"
+	};
+}
 var SnapshotTimeoutError$1 = class extends Error {
 	constructor(ms) {
 		super(`snapshot cap timed out after ${ms}ms`);
@@ -57447,24 +59162,65 @@ function withTimeout$1(promise, ms) {
 var MotionEventSnapshotCapturer = class {
 	deps;
 	snapshotTimeoutMs;
+	/** Last ms a marker was written, per device. */
+	lastMarkerAt = /* @__PURE__ */ new Map();
+	/** Edges dropped since that device's last marker — reported on its line. */
+	suppressed = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 		this.snapshotTimeoutMs = deps.snapshotTimeoutMs ?? 2500;
 	}
 	/**
-	* Fetch a still and persist it as the motion event's snapshot. Never
-	* throws — the durable record is the motion row, already inserted by
-	* the caller.
+	* Judge the edge, and only if it survives, fetch a still and persist it as
+	* the motion event's snapshot. Never throws — the durable record is the
+	* motion row, already inserted by the caller.
+	*
+	* The two clocks the decision reads live HERE, per device: `lastMarkerAt`
+	* (so a drought yields one marker per window, not one per provider
+	* keepalive) and `suppressed` (so the drop is reported ON the next marker's
+	* line rather than 92 400 times a day).
 	*/
 	async capture(input) {
+		const decision = decideMotionStill({
+			debugMediaEnabled: input.policy.debugMediaEnabled,
+			now: input.timestamp,
+			lastDetectionAtMs: input.policy.lastDetectionAtMs,
+			lastMarkerAtMs: this.lastMarkerAt.get(input.deviceId),
+			quietMs: input.policy.quietMs
+		});
+		if (!decision.capture) {
+			this.suppressed.set(input.deviceId, (this.suppressed.get(input.deviceId) ?? 0) + 1);
+			return {
+				captured: false,
+				reason: decision.reason
+			};
+		}
+		this.lastMarkerAt.set(input.deviceId, input.timestamp);
+		const suppressed = this.suppressed.get(input.deviceId) ?? 0;
+		this.suppressed.delete(input.deviceId);
+		if (decision.reason === "quiet-marker") this.deps.logger.info("motion marker still: detection drought", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				eventId: input.eventId,
+				quietMs: input.policy.quietMs,
+				suppressedSinceLastMarker: suppressed,
+				lastDetectionAtMs: input.policy.lastDetectionAtMs ?? null
+			}
+		});
 		let snap;
 		try {
 			snap = await withTimeout$1(this.deps.snapshot.getSnapshot({ deviceId: input.deviceId }), this.snapshotTimeoutMs);
 		} catch (err) {
 			this.deps.onError?.(err instanceof SnapshotTimeoutError$1 ? "snapshotTimeout" : "snapshotFetch", err, input.deviceId);
-			return;
+			return {
+				captured: false,
+				reason: decision.reason
+			};
 		}
-		if (snap === null) return;
+		if (snap === null) return {
+			captured: false,
+			reason: decision.reason
+		};
 		const raw = Buffer.from(snap.base64, "base64");
 		let data = raw;
 		try {
@@ -57483,7 +59239,21 @@ var MotionEventSnapshotCapturer = class {
 			});
 		} catch (err) {
 			this.deps.onError?.("snapshotMedia", err, input.deviceId);
+			return {
+				captured: false,
+				reason: decision.reason
+			};
 		}
+		return {
+			captured: true,
+			reason: decision.reason
+		};
+	}
+	/** Drop a device's clocks when it unbinds — same lifetime as every other
+	*  per-device mirror on the addon. */
+	forgetDevice(deviceId) {
+		this.lastMarkerAt.delete(deviceId);
+		this.suppressed.delete(deviceId);
 	}
 };
 /**
@@ -57550,6 +59320,78 @@ async function projectSensorMarkers(deps, data, timestamp) {
 	}
 	return landed;
 }
+var SensorTransitionGate = class {
+	/** Last observed boolean, keyed by `${deviceId}:${capName}`. */
+	lastValues = /* @__PURE__ */ new Map();
+	/** Drops since the window opened, keyed by `${deviceId}:${capName}:${reason}`. */
+	drops = /* @__PURE__ */ new Map();
+	windowStartedAt;
+	startedAtMs;
+	now;
+	freshnessMs;
+	summaryWindowMs;
+	constructor(options) {
+		this.startedAtMs = options.startedAtMs;
+		this.now = options.now;
+		this.freshnessMs = options.firstSightingFreshnessMs ?? 3e4;
+		this.summaryWindowMs = options.summaryWindowMs ?? 6e5;
+		this.windowStartedAt = options.now();
+	}
+	/**
+	* Feed one `DeviceStateChanged` slice for a cap `EVENT_KIND_BY_CAP` maps.
+	*
+	* A cap with no boolean level passes through unconditionally. A cap that HAS
+	* one passes only when its boolean moved — in either direction.
+	*/
+	observe(deviceId, capName, slice) {
+		if (!require_dist.isSourceCap(capName)) return { changed: true };
+		const key = `${deviceId}:${capName}`;
+		const verdict = require_dist.evaluateSensorEdge({
+			capName,
+			slice,
+			prior: this.lastValues.get(key),
+			startedAtMs: this.startedAtMs,
+			nowMs: this.now(),
+			firstSightingFreshnessMs: this.freshnessMs
+		});
+		if (verdict.edge === "rising") {
+			this.lastValues.set(key, true);
+			return { changed: true };
+		}
+		if (verdict.value !== null) this.lastValues.set(key, verdict.value);
+		if (verdict.reason === "falling-edge") return { changed: true };
+		this.noteDrop(deviceId, capName, verdict.reason);
+		return {
+			changed: false,
+			reason: verdict.reason
+		};
+	}
+	/**
+	* The window's drops, or `[]` while the window is still open. Draining opens
+	* the next window.
+	*
+	* Sorted by `(deviceId, capName, reason)` so a line is comparable with the
+	* previous window's without the reader re-sorting it.
+	*/
+	takeDropSummary(nowMs) {
+		if (nowMs - this.windowStartedAt < this.summaryWindowMs) return [];
+		this.windowStartedAt = nowMs;
+		if (this.drops.size === 0) return [];
+		const out = [...this.drops.values()].sort((a, b) => a.deviceId - b.deviceId || a.capName.localeCompare(b.capName) || a.reason.localeCompare(b.reason));
+		this.drops.clear();
+		return out;
+	}
+	noteDrop(deviceId, capName, reason) {
+		const key = `${deviceId}:${capName}:${reason}`;
+		const prior = this.drops.get(key);
+		this.drops.set(key, {
+			deviceId,
+			capName,
+			reason,
+			count: (prior?.count ?? 0) + 1
+		});
+	}
+};
 //#endregion
 //#region src/pipeline-analytics/services/synthetic-track.ts
 /**
@@ -58733,10 +60575,23 @@ function buildGlobalSettingsSchema(cap) {
 			fields: [
 				{
 					type: "boolean",
-					key: "saveThumbnails",
-					label: "Save track thumbnails",
-					description: "Periodic snapshot crops attached to tracks for timeline review.",
-					default: true
+					key: "debugMediaEnabled",
+					label: "Debug media",
+					description: "Off (the default) keeps first/last frame, key frames, thumbnails and face/plate crops, and reduces motion-only stills to one marker per detection drought. On also stores the per-track filmstrip and a still on EVERY motion transition — diagnostic volume, roughly 95 KiB per transition.",
+					default: false
+				},
+				{
+					type: "slider",
+					key: "motionMarkerQuietMs",
+					label: "Motion marker after",
+					description: "With debug media off: a motion still is kept only when no detection has run on this camera for this long, and at most one per window. Fleet p90 of detection-free stretches is ~13 min.",
+					min: 6e4,
+					max: 216e5,
+					step: 6e4,
+					default: 9e5,
+					showValue: true,
+					unit: "min",
+					displayScale: 6e4
 				},
 				{
 					type: "slider",
@@ -59245,7 +61100,7 @@ function centroidMovedFraction(a, b, frameWidth, frameHeight) {
 }
 /**
 * Decide whether the periodic `snapshot` should be captured for a track THIS
-* frame. Pure: no side effects. The caller keeps the `saveThumbnails` master
+* frame. Pure: no side effects. The caller keeps the `debugMediaEnabled` master
 * switch and advances `lastSnapshotAt`/`lastSnapshotBbox` only when a capture
 * actually lands — so a skipped (stationary) frame leaves the clock untouched,
 * which naturally lets `maxIdleMs` fire and re-evaluates movement every frame
@@ -59411,6 +61266,129 @@ async function runAudioTrackClassMigration(deps, collection) {
 	deps.logger.info("audio track class migration", { meta: { ...stats } });
 	return stats;
 }
+/** Rows one pass will touch. A ceiling, not a target. */
+var CONVERSION_MAX_ROWS = 2e4;
+/** Ids named in the "could not convert" line before it stops. */
+var REFUSED_IDS_LOGGED = 10;
+/** A stored `embedding` column, narrowed. */
+function floatsOf(raw) {
+	if (!Array.isArray(raw)) return null;
+	const out = [];
+	for (const v of raw) {
+		if (typeof v !== "number" || !Number.isFinite(v)) return null;
+		out.push(v);
+	}
+	return out;
+}
+/**
+* Convert one collection. Never throws — a failed page ends the pass with what
+* it has, and the next boot picks the rest up.
+*/
+async function convertJsonEmbeddings(spec, deps) {
+	let examined = 0;
+	let alreadyConverted = 0;
+	let converted = 0;
+	let refused = 0;
+	let unusable = 0;
+	let offset = 0;
+	let stoppedBy = "exhausted";
+	const refusedIds = [];
+	while (examined < CONVERSION_MAX_ROWS) {
+		let rows;
+		try {
+			rows = await deps.store.query.query({
+				collection: spec.collection,
+				filter: {
+					orderBy: {
+						field: "id",
+						direction: "asc"
+					},
+					limit: 200,
+					offset
+				}
+			});
+		} catch (err) {
+			deps.logger.warn("embedding conversion: page failed — pass abandoned", { meta: {
+				collection: spec.collection,
+				offset,
+				error: String(err)
+			} });
+			stoppedBy = "page-failed";
+			break;
+		}
+		if (rows.length === 0) break;
+		for (const row of rows) {
+			examined += 1;
+			const data = row.data;
+			const raw = data["embedding"];
+			if (Array.isArray(raw) && raw.length === 0) {
+				alreadyConverted += 1;
+				continue;
+			}
+			const embedding = floatsOf(raw);
+			if (embedding === null || embedding.length === 0) {
+				unusable += 1;
+				continue;
+			}
+			const write = spec.write(row.id, embedding, data);
+			if (write === null || !await spec.vectors.put(write)) {
+				refused += 1;
+				if (refusedIds.length < REFUSED_IDS_LOGGED) refusedIds.push(row.id);
+				continue;
+			}
+			if (((await spec.vectors.load([row.id])).get(row.id)?.length ?? 0) !== embedding.length) {
+				refused += 1;
+				if (refusedIds.length < REFUSED_IDS_LOGGED) refusedIds.push(row.id);
+				continue;
+			}
+			try {
+				await deps.store.update.mutate({
+					collection: spec.collection,
+					id: row.id,
+					data: { embedding: [] }
+				});
+				converted += 1;
+			} catch (err) {
+				refused += 1;
+				deps.logger.warn("embedding conversion: row kept its JSON after a successful index write", { meta: {
+					collection: spec.collection,
+					id: row.id,
+					error: String(err)
+				} });
+			}
+		}
+		if (deps.breathe) await deps.breathe();
+		offset += rows.length;
+		if (rows.length < 200) break;
+	}
+	if (examined >= 2e4) stoppedBy = "row-ceiling";
+	if (refused > 0) deps.logger.warn("embedding conversion: rows could not be moved into the index", { meta: {
+		collection: spec.collection,
+		index: spec.vectors.name,
+		refused,
+		ids: refusedIds,
+		why: "the index refused the write or the row named no model — these rows KEEP their JSON vector and are retried on the next pass"
+	} });
+	deps.logger.info("embedding conversion", { meta: {
+		collection: spec.collection,
+		index: spec.vectors.name,
+		examined,
+		alreadyConverted,
+		converted,
+		refused,
+		unusable,
+		stoppedBy
+	} });
+	return {
+		collection: spec.collection,
+		examined,
+		alreadyConverted,
+		converted,
+		refused,
+		unusable,
+		stoppedBy
+	};
+}
 //#endregion
 //#region src/pipeline-analytics/store/object-embedding-store.ts
 /**
@@ -59662,10 +61640,19 @@ var ObjectEmbeddingStore = class {
 					score: match.score
 				});
 			}
+			if (result.effectiveTopK < input.limit) this.logger.warn("vector search ran with a smaller topK than requested", {
+				...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+				meta: {
+					index: OBJECT_CLIP_INDEX,
+					requested: input.limit,
+					effectiveTopK: result.effectiveTopK
+				}
+			});
 			return {
 				hits,
 				scanned: result.scanned,
-				truncated: result.truncated
+				truncated: result.truncated,
+				effectiveTopK: result.effectiveTopK
 			};
 		} catch (err) {
 			this.logger.warn("ObjectEmbeddingStore.searchByVector failed", {
@@ -59675,7 +61662,109 @@ var ObjectEmbeddingStore = class {
 			return {
 				hits: [],
 				scanned: 0,
-				truncated: false
+				truncated: false,
+				effectiveTopK: 0
+			};
+		}
+	}
+	/**
+	* ENUMERATE one page of the index, unranked.
+	*
+	* The orphan scan used to enumerate by asking for a KNN of 20,000 against a
+	* ZERO probe vector. Both halves were wrong. sqlite-vec clamps `k` to 4,096,
+	* so the scan saw 18.5% of the index and logged `examined: 4096` as though it
+	* had walked it; and a zero vector has no direction, so whatever the 4,096
+	* were, they were not a meaningful sample of anything. This asks the question
+	* the reconcile actually has — *what is in here* — through `vectorStore.scan`,
+	* which has no `k` ceiling because it computes no distance.
+	*
+	* An empty page is NOT the end of the index; `nextCursor === null` is.
+	*/
+	async scanRefs(cursor, limit) {
+		const page = await this.vectorStore.scan.query({
+			index: OBJECT_CLIP_INDEX,
+			cursor,
+			limit
+		});
+		const rows = [];
+		for (const item of page.items) {
+			const trackId = item.metadata["trackId"];
+			const deviceId = item.metadata["deviceId"];
+			const timestamp = item.metadata["timestamp"];
+			rows.push({
+				id: item.id,
+				trackId: typeof trackId === "string" && trackId.length > 0 ? trackId : item.id.length > 0 ? item.id : null,
+				deviceId: typeof deviceId === "number" ? deviceId : null,
+				timestamp: typeof timestamp === "number" ? timestamp : null
+			});
+		}
+		return {
+			rows,
+			nextCursor: page.nextCursor
+		};
+	}
+	/**
+	* Delete named vectors and CONFIRM they are gone.
+	*
+	* `deleteByIds` reports a row count the `vec0` backend cannot always produce,
+	* so "the call returned" has never been the same statement as "the row left"
+	* — and this store has already shipped one counter that could not tell those
+	* apart (`rebuilt: 704` against an index that moved by 0). The read-back is
+	* `getByIds`, which returns metadata and no vectors, so confirming a page of
+	* deletions costs one indexed lookup and not one byte of float.
+	*
+	* Returns the ids that are VERIFIABLY gone. Anything still present is
+	* returned as `stillPresent` for the caller to log — a delete that silently
+	* did nothing is how an orphan becomes permanent.
+	*/
+	async deleteVerified(ids) {
+		if (ids.length === 0) return {
+			deleted: [],
+			stillPresent: []
+		};
+		try {
+			await this.vectorStore.deleteByIds.mutate({
+				index: OBJECT_CLIP_INDEX,
+				ids: [...ids]
+			});
+		} catch (err) {
+			this.declaredDim = null;
+			this.logger.warn("object embedding delete failed — vectors kept", { meta: {
+				index: OBJECT_CLIP_INDEX,
+				ids: ids.length,
+				error: String(err)
+			} });
+			return {
+				deleted: [],
+				stillPresent: [...ids]
+			};
+		}
+		try {
+			const readBack = await this.vectorStore.getByIds.query({
+				index: OBJECT_CLIP_INDEX,
+				ids: [...ids]
+			});
+			const survivors = new Set(readBack.items.map((i) => i.id));
+			const deleted = ids.filter((id) => !survivors.has(id));
+			const stillPresent = ids.filter((id) => survivors.has(id));
+			if (stillPresent.length > 0) this.logger.warn("object embedding delete did not land — rows survived the delete", { meta: {
+				index: OBJECT_CLIP_INDEX,
+				asked: ids.length,
+				survived: stillPresent.length
+			} });
+			return {
+				deleted,
+				stillPresent
+			};
+		} catch (err) {
+			this.logger.warn("object embedding delete could not be verified", { meta: {
+				index: OBJECT_CLIP_INDEX,
+				ids: ids.length,
+				error: String(err)
+			} });
+			return {
+				deleted: [],
+				stillPresent: [...ids]
 			};
 		}
 	}
@@ -59722,13 +61811,15 @@ var ObjectEmbeddingStore = class {
 			deleted: 0,
 			refused: false
 		};
-		await this.deleteByTracks(orphans);
+		const { deleted, stillPresent } = await this.deleteVerified(orphans);
 		this.logger.info("object embedding orphans pruned", { meta: {
 			orphans: orphans.length,
+			deleted: deleted.length,
+			kept: stillPresent.length,
 			candidates: input.candidates.length
 		} });
 		return {
-			deleted: orphans.length,
+			deleted: deleted.length,
 			refused: false
 		};
 	}
@@ -59765,25 +61856,15 @@ var ObjectEmbeddingStore = class {
 			rows: 0,
 			bytes: 0
 		}];
-		try {
-			await this.vectorStore.deleteByIds.mutate({
-				index: OBJECT_CLIP_INDEX,
-				ids: [...trackIds]
-			});
-		} catch (err) {
-			this.logger.warn("ObjectEmbeddingStore.deleteByTracks failed", { meta: {
-				count: trackIds.length,
-				error: String(err)
-			} });
-			return [{
-				family: "embeddings",
-				rows: 0,
-				bytes: 0
-			}];
-		}
+		const { deleted, stillPresent } = await this.deleteVerified(trackIds);
+		if (stillPresent.length > 0) this.logger.warn("cascade left CLIP vectors behind — they are now unreachable by ownership", { meta: {
+			asked: trackIds.length,
+			kept: stillPresent.length,
+			why: "the track rows are deleted immediately after this leaf, so these vectors can only be reclaimed by the orphan audit"
+		} });
 		return [{
 			family: "embeddings",
-			rows: trackIds.length,
+			rows: deleted.length,
 			bytes: 0
 		}];
 	}
@@ -60729,15 +62810,19 @@ function buildStationarySnapshot(input) {
 */
 var ENCODER_INFO_TTL_MS = 6e4;
 /**
-* Rows the orphan sweep considers per pass, on both sides of the comparison.
+* Rows of the vector index one orphan pass may examine.
+*
+* Bounded so a retention tick cannot turn into a full-index scan; the rest is
+* left for the next tick, resumed from a cursor. Orphans are not urgent, they
+* are dead weight the search has to skip.
 *
-* Bounded so a retention tick cannot turn into a full-index scan. A pass that
-* does not reach everything simply leaves the rest for the next tick — orphans
-* are not urgent, they are just dead weight the search has to skip.
+* **This number is now real.** It used to be handed to a KNN as `topK`, where
+* sqlite-vec silently clamped it to 4,096 — so the audit saw 18.5% of a 22,128-
+* row index and reported `examined: 4096` as if it had walked the whole thing.
+* The pass enumerates through `vectorStore.scan` instead, which has no `k`
+* ceiling because it computes no distance. See `embedding-orphan-scan.ts`.
 */
 var EMBEDDING_ORPHAN_SCAN_LIMIT = 2e4;
-/** Dimension of the zero probe vector used to enumerate the index. */
-var EMBEDDING_ORPHAN_PROBE_DIM = 512;
 /**
 * Tracks fetched per page while rebuilding.
 *
@@ -60805,6 +62890,7 @@ var customActions = {
 	...embeddingActions,
 	...debugActions,
 	...orphanAuditActions,
+	...mediaReclaimActions,
 	...viewerSettingsActions,
 	...photoEnrollActions,
 	...faceRescoreActions,
@@ -60845,11 +62931,38 @@ var FACE_REEMBED_AUTO_CHECK_MS = 6e4;
 /** Padding applied to the parent bbox for the `cropJpeg` retry fallback when a
 *  scheduled detail call's frameHandle lease is already gone. */
 var DETAIL_FALLBACK_CROP_PADDING = .15;
-/** Max |keyFrame − plate-read| skew (ms) accepted for the DURABLE keyFrame-
-*  derived plate-crop last resort. A readable plate implies a slow/stopping
-*  vehicle, so within this window the subject barely moves off its bbox;
-*  beyond it the crop would show empty scene, so it is rejected (no image). */
+/** Max |keyFrame − measured| skew (ms) accepted for a DURABLE keyFrame-derived
+*  crop when the track's position trail carries NO motion evidence about the
+*  two instants. With evidence the motion guard decides instead — time was
+*  never the quantity that separated a right crop from a wrong one. */
 var KEYFRAME_CROP_MAX_SKEW_MS = 1500;
+/**
+* Subject-box IoU across the two instants at or above which a keyFrame-derived
+* crop is accepted whatever the skew.
+*
+* Chosen from the 2026-08-30 debug-marked tracks, where each crop's verdict
+* came from LOOKING at the stored image (`docs/design/
+* 2026-08-30-debug-marked-tracks-media-triage.md`):
+*
+*   `e9c024bb`  windshield, wrong   skew 1179 ms   IoU 0.063
+*   `4126f977`  gravel, wrong       skew  531 ms   IoU 0.318
+*   `7613c0fa`  plate framed, RIGHT skew 2579 ms   IoU 1.000
+*
+* Note the ordering: the only correct crop of the three has the LARGEST skew.
+* The healthy population sits far above the wrong pair too — subject IoU across
+* a 1500 ms lag is 0.83–1.00 on the eight debug tracks whose tiles frame their
+* subject. 0.5 is the midpoint of the empirical gap (0.318 → 1.000) and stays
+* well under that 0.83 floor. A refusal is not a lost tile: the close path
+* falls through to the retained detection-raster crop, which is right-moment
+* pixels by construction, so a false refusal costs resolution, not the image.
+*/
+var KEYFRAME_CROP_MIN_SUBJECT_IOU = .5;
+/** How far a position sample may sit from an instant and still be evidence
+*  about it. The trail is one sample per emitted frame and is downsampled only
+*  on long tracks (≈280–385 ms spacing at 60–95 s of life), so a full second
+*  covers a healthy trail many times over; past it the honest answer is "no
+*  evidence" and the temporal bound takes over. */
+var KEYFRAME_CROP_MAX_SAMPLE_GAP_MS = 1e3;
 /** How long the active CLIP model id (from the embedding-encoder) is cached
 *  before re-reading. */
 var CLIP_MODEL_ID_CACHE_TTL_MS = 6e4;
@@ -60861,7 +62974,9 @@ var CONFIRMATION_DETECTOR_CACHE_TTL_MS = 6e4;
 *  around the subject improves the confirmation detector's recall. */
 var CONFIRMATION_CROP_PADDING = .15;
 /** Cap the confirmation crop width so a 4K native surface never floods the
-*  transport just to confirm one small box. */
+*  transport just to confirm one small box. EXPORTED so a test can recognise a
+*  confirmation round trip among the runner's requests by the real constant
+*  rather than by a copy of the number that would silently stop matching. */
 var CONFIRMATION_CROP_MAX_WIDTH = 320;
 /** Staleness bound for QUEUED enrichment captures (face/plate gallery crops,
 *  object-embedding best crops, embedding full-frame fetches — S4). These are
@@ -61044,6 +63159,21 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	/** Ingest-side reverse index (sensor device → linked camera ids), TTL-cached
 	*  so the DeviceStateChanged handler stays cheap. */
 	linkedCamerasCache = null;
+	/**
+	* Whether a mapped sensor cap's slice carried a real TRANSITION.
+	*
+	* `DeviceStateChanged` is emitted on a slice diff, and a contact slice
+	* carries `lastChangedAt` beside `entryOpen` — so an availability flap or a
+	* provider-side device rebuild re-emits with the boolean unmoved. Every one
+	* of those became a `SensorEvent` row and a synthetic track until this gate
+	* existed. Built in the field initializer: `startedAtMs` is the moment this
+	* process began watching, which is the floor for a first sighting that is
+	* already active. See `services/sensor-transition-gate.ts`.
+	*/
+	sensorTransitions = new SensorTransitionGate({
+		startedAtMs: Date.now(),
+		now: () => Date.now()
+	});
 	/** The ONE projector of non-spatial events into synthetic snapshot-carrying
 	*  tracks — linked sensor/control state changes AND audio markers. */
 	syntheticTracks = null;
@@ -61725,6 +63855,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				decodeJpegToRgb: (base64) => decodeJpegToRgb(base64),
 				cropRegionToJpeg: (bytes, w, h, norm) => cropWideCentralSquareFromRgb(bytes, w, h, norm),
 				maxSkewMs: KEYFRAME_CROP_MAX_SKEW_MS,
+				minSubjectIou: KEYFRAME_CROP_MIN_SUBJECT_IOU,
+				maxSubjectSampleGapMs: KEYFRAME_CROP_MAX_SAMPLE_GAP_MS,
 				logger: this.ctx.logger.child("CloseKeyFrameThumbnail")
 			});
 			this._keyFrameThumbnailDerive = async (input) => {
@@ -61736,7 +63868,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				return {
 					thumbnail: derived.jpeg,
 					thumbnailSmall: await deriveThumbnailSmall(derived.jpeg),
-					skewMs: derived.skewMs
+					skewMs: derived.skewMs,
+					motion: derived.motion,
+					...derived.subjectIou !== void 0 ? { subjectIou: derived.subjectIou } : {}
 				};
 			};
 		}
@@ -61823,6 +63957,23 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	*  page rather than a full rescan. In RAM: losing them costs a rescan, and
 	*  persisting them would be a durable record of a purely advisory position. */
 	orphanAuditCursors = /* @__PURE__ */ new Map();
+	/** Resume points for the debug-media reclaim, keyed `<scope>:<deviceId>`.
+	*  In RAM like the audit's: the pass is resumable from zero at no cost
+	*  beyond re-walking a head that is already empty. */
+	mediaReclaimCursors = /* @__PURE__ */ new Map();
+	/** Single-flight latch — two concurrent passes would double the disk
+	*  pressure the pacing exists to avoid. */
+	mediaReclaimRunning = false;
+	/**
+	* The vector-index leg's resume cursor, kept in its OWN field.
+	*
+	* Not a key in {@link orphanAuditCursors}: `runOrphanAudit` returns a map
+	* built from ITS scopes and the caller assigns it wholesale, so a key added
+	* afterwards is dropped on the next run — the walk would silently restart at
+	* row 0 every six hours and never reach the tail of the index, which is the
+	* same failure the `k` clamp already caused once.
+	*/
+	orphanEmbeddingCursor = 0;
 	/** Re-entrancy guard — two whole-database scans must never overlap on the
 	*  thread that also serves frames. */
 	orphanAuditRunning = false;
@@ -61909,6 +64060,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				designatedNode: designated
 			} });
 		}
+		if (this.isPostProcessingNode) this.convertLegacyEmbeddingColumns(api);
 		const transport = createNativeFrameTransport({
 			api,
 			ownNodeId,
@@ -61960,6 +64112,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					...embeddingActions,
 					...debugActions,
 					...orphanAuditActions,
+					...mediaReclaimActions,
 					...viewerSettingsActions,
 					...photoEnrollActions,
 					...faceRescoreActions,
@@ -62155,6 +64308,37 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		});
 		this.ctx.logger.info("alarm panel wired to the notification center", { tags: { deviceId: panel.id } });
 	}
+	/**
+	* Move `faces.embedding` and `identity-samples.embedding` out of JSON text
+	* and into their vector indexes — once, in place, idempotently.
+	*
+	* Not awaited by the boot path and not a schema migration: see
+	* `embedding-json-conversion.ts` for why "converted" is a property of a row
+	* rather than a version number. Every failure mode here is safe — a row whose
+	* index write did not land keeps its array, and both readers fall back to it.
+	*/
+	async convertLegacyEmbeddingColumns(api) {
+		const faceStore = this.faceStore;
+		const identityStore = this.identityStore;
+		if (!faceStore || !identityStore) {
+			this.ctx.logger.warn("embedding conversion skipped — the gallery stores are not up", { meta: {
+				faceStore: faceStore !== null,
+				identityStore: identityStore !== null
+			} });
+			return;
+		}
+		const deps = {
+			store: api.settingsStore,
+			logger: this.ctx.logger.child("EmbeddingConversion"),
+			breathe: () => new Promise((resolve) => setImmediate(resolve))
+		};
+		try {
+			await convertJsonEmbeddings(faceStore.conversionSpec(), deps);
+			await convertJsonEmbeddings(identityStore.conversionSpec(), deps);
+		} catch (err) {
+			this.ctx.logger.warn("embedding conversion pass failed", { meta: { error: String(err) } });
+		}
+	}
 	async declareCollections(api) {
 		this.settingsStore = api.settingsStore;
 		await Promise.all([
@@ -62487,6 +64671,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.motionEventSnapshots = new MotionEventSnapshotCapturer({
 			snapshot: { getSnapshot: (i) => api.snapshot?.getSnapshot.query(i) ?? Promise.resolve(null) },
 			media: mediaStore,
+			logger: logger.child("MotionMarkerStill"),
 			onError: (scope, err, deviceId) => logger.warn("motion event snapshot failed", {
 				...deviceId !== void 0 ? { tags: { deviceId } } : {},
 				meta: {
@@ -62504,13 +64689,25 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				error: require_dist.errMsg(err)
 			} })
 		});
+		const galleryVectorStore = api.vectorStore;
+		if (galleryVectorStore === void 0) throw new Error("pipeline-analytics: the vector-store capability is unavailable, so the face and identity galleries have no home for their vectors — refusing to start recognition without one");
 		const identityStore = new IdentityStore({
 			store: api.settingsStore,
+			vectors: new EmbeddingVectorIndex({
+				index: IDENTITY_ARCFACE_INDEX,
+				client: galleryVectorStore,
+				logger: logger.child("IdentityVectors")
+			}),
 			logger: logger.child("IdentityStore")
 		});
 		this.identityStore = identityStore;
 		const faceStore = new FaceStore({
 			store: api.settingsStore,
+			vectors: new EmbeddingVectorIndex({
+				index: FACE_ARCFACE_INDEX,
+				client: galleryVectorStore,
+				logger: logger.child("FaceVectors")
+			}),
 			logger: logger.child("FaceStore")
 		});
 		this.faceStore = faceStore;
@@ -62632,6 +64829,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			decodeJpegToRgb: (base64) => decodeJpegToRgb(base64),
 			cropRegionToJpeg: async (bytes, w, h, norm) => (await extractCrop(bytes, w, h, norm)).crop,
 			maxSkewMs: KEYFRAME_CROP_MAX_SKEW_MS,
+			minSubjectIou: KEYFRAME_CROP_MIN_SUBJECT_IOU,
+			maxSubjectSampleGapMs: KEYFRAME_CROP_MAX_SAMPLE_GAP_MS,
 			logger: logger.child("KeyFrameCrop")
 		});
 		this.plateRecognizer = new PlateRecognizer({
@@ -63459,10 +65658,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				const limit = input.candidateLimit ?? 25;
 				const asked = input.deviceIds;
 				const known = new Set([...registry.deviceIds(), ...evidence?.deviceIdsWithCandidates() ?? []]);
-				return { devices: (asked === void 0 || asked.length === 0 ? [...known].sort((a, b) => a - b) : asked.filter((id) => known.has(id))).map((deviceId) => {
+				return { devices: (asked === void 0 || asked.length === 0 ? [...known].toSorted((a, b) => a - b) : asked.filter((id) => known.has(id))).map((deviceId) => {
 					const observedAt = registry.observedAt(deviceId);
 					const sessionOpenedAt = registry.sessionOpenedAt(deviceId);
-					const ordered = [...evidence?.candidatesFor(deviceId) ?? []].sort((a, b) => b.agreed - a.agreed);
+					const ordered = [...evidence?.candidatesFor(deviceId) ?? []].toSorted((a, b) => b.agreed - a.agreed);
 					return {
 						deviceId,
 						...sessionOpenedAt !== void 0 ? { sessionOpenedAt } : {},
@@ -63751,6 +65950,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.forgetDeviceProcessors(deviceId);
 		this.levelStateByDevice.delete(deviceId);
 		this.lastTrackActivityMs.delete(deviceId);
+		this.motionEventSnapshots?.forgetDevice(deviceId);
 		this.audioEpisodeByDevice.delete(deviceId);
 		for (const [episodeId, track] of this.audioEpisodeTracks) if (track.deviceId === deviceId) {
 			this.audioEpisodeTracks.delete(episodeId);
@@ -65163,12 +67363,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				deviceId,
 				trackId: candidate.trackId,
 				kind: "confirm",
+				staleAfterMs: config.timeoutMs,
 				exec: () => captureCrop(frameHandle, {
 					x: candidate.bbox.x,
 					y: candidate.bbox.y,
 					w: candidate.bbox.w,
 					h: candidate.bbox.h
-				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, CONFIRMATION_CROP_MAX_WIDTH, deviceId)
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, 320, deviceId)
 			}),
 			fetchFallbackCrop: (candidate) => {
 				const displayCrop = this.captureDisplayCropFn;
@@ -65178,7 +67379,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					y: candidate.bbox.y,
 					w: candidate.bbox.w,
 					h: candidate.bbox.h
-				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, CONFIRMATION_CROP_MAX_WIDTH);
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, 320);
 			},
 			redetect: (cropJpeg) => this.redetectCropForConfirmation(nodeId, deviceId, cropJpeg),
 			minConfidenceFor: (candidate) => this.phantomCells?.spawnBar({
@@ -65541,12 +67742,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	/**
 	* §5 — decide which active tracks need periodic media THIS frame. Pure over
 	* TrackStore.lastSnapshotAt + the per-track best-confidence map:
-	*  • `snapshot` (append) + `lastFrame` (rolling overwrite) fire together on
-	*    the snapshotIntervalMs cadence, gated by `saveThumbnails`;
+	*  • `snapshot` (append) fires on the snapshotIntervalMs cadence, gated by
+	*    `debugMediaEnabled`; the rolling `lastFrame` fires on its own cadence
+	*    and is NOT gated (it is in the keep-set);
 	*  • `thumbnail` (best) fires when confidence beats the held best per
 	*    `BEST_FRAME_POLICY` (hysteresis margin, rate-limited to one per
 	*    `minGapMs` — see `pipeline/best-selection-policies.ts`), and is
-	*    NOT gated by saveThumbnails (a single best still-frame is always useful).
+	*    never gated (a single best still-frame is always useful).
 	* The per-track best-confidence map is updated here as a side effect.
 	*/
 	/**
@@ -65958,9 +68160,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				});
 				continue;
 			}
-			const lastSnap = this.trackStore.lastSnapshotAt(t.trackId);
-			const dueSnapshot = media.saveThumbnails && evaluatePeriodicSnapshot({
-				lastSnapshotAt: lastSnap,
+			const dueSnapshot = evaluatePeriodicSnapshot({
+				lastSnapshotAt: this.trackStore.lastSnapshotAt(t.trackId),
 				lastSnapshotBbox: this.trackStore.lastSnapshotBbox(t.trackId),
 				currentBbox: t.bbox,
 				now: timestamp,
@@ -65985,7 +68186,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			const isNewBest = this.residents.observeBestFrame(deviceId, t.trackId, t.confidence, timestamp, edgeClear, centerScore, containment, sizeScore, squareFraction, false);
 			this.maybeEmitTrackLifecycleUpdate(deviceId, t, timestamp, isNewBest);
 			const plan = planPeriodicMedia({
-				saveThumbnails: media.saveThumbnails,
+				debugMediaEnabled: media.debugMediaEnabled,
 				dueSnapshot,
 				isNewBest,
 				thumbnailLanded: this.residents.isThumbnailLanded(t.trackId),
@@ -66414,11 +68615,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				timestamp: ev.timestamp
 			}
 		});
-		if (transitionedOn) await this.motionEventSnapshots?.capture({
-			deviceId,
-			eventId: ev.id,
-			timestamp: ev.timestamp
-		});
+		if (transitionedOn) await this.captureMotionMarkerStill(deviceId, ev.id, ev.timestamp);
 	}
 	/**
 	* Persist firmware-driven (onboard) motion events. Mirrors
@@ -66493,10 +68690,38 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				timestamp: ev.timestamp
 			}
 		});
-		if (transitionedOn) await this.motionEventSnapshots?.capture({
+		if (transitionedOn) await this.captureMotionMarkerStill(deviceId, ev.id, ev.timestamp);
+	}
+	/**
+	* The gate in front of the motion still. Both motion handlers reach it, so
+	* there is exactly one place that decides.
+	*
+	* With debug media OFF (the default) the still is the operator's fallback
+	* marker: produced only during a DETECTION DROUGHT, once per
+	* `motionMarkerQuietMs` window. See `services/motion-marker-policy.ts` for
+	* why the raw edge is not a scene fact — it is the provider's ~1 Hz
+	* keepalive beating against the analyzer's per-frame sample through one
+	* shared edge map.
+	*
+	* A dropped write is REPORTED, but as a per-window summary and never per
+	* event: the suppressed count since the last marker rides on the marker's
+	* own line. At 92 400 suppressions/day a line each would be the flood the
+	* logging rules exist to prevent, and a silent branch reads as "never
+	* happened".
+	*/
+	async captureMotionMarkerStill(deviceId, eventId, timestamp) {
+		const capturer = this.motionEventSnapshots;
+		if (!capturer) return;
+		const media = await this.resolveDeviceMediaSettings(deviceId);
+		await capturer.capture({
 			deviceId,
-			eventId: ev.id,
-			timestamp: ev.timestamp
+			eventId,
+			timestamp,
+			policy: {
+				debugMediaEnabled: media.debugMediaEnabled,
+				quietMs: media.motionMarkerQuietMs,
+				lastDetectionAtMs: this.lastTrackActivityMs.get(deviceId)
+			}
 		});
 	}
 	async sweepExpiredTracks() {
@@ -67235,7 +69460,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		};
 		if (faceEnd) faceEnd.finally(dropKeyFrame);
 		else dropKeyFrame();
-		this.plateRecognizer?.onTrackEnd(deviceId, track.trackId);
+		const promotedPath = this.trackStore?.getActiveByTrack(track.trackId)?.positions;
+		this.plateRecognizer?.onTrackEnd(deviceId, track.trackId, promotedPath);
 		this.residents.close(track.trackId, "stationary");
 		this.detailDispatcher?.onTrackEnded(deviceId, track.trackId);
 		this.overlayState.onTrackEnded(deviceId, track.trackId);
@@ -67573,11 +69799,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* press from the durable `doorbell.getStatus.lastPressedAt`. A dropped bus
 	* event is a missing history row and a missing notification — never wrong
 	* durable state.
+	*
+	* The FIRST question is whether the sensor changed at all. This event is
+	* emitted on a slice diff, and a level cap's slice carries its transition
+	* timestamp beside its boolean — so an availability flap or a device rebuild
+	* re-emits with the boolean unmoved. Both the row and the marker are gated on
+	* the same verdict, in that one place: two derivations of "did this happen"
+	* is one too many, and it is the mistake this handler already made once with
+	* "which cameras" (`resolveSensorEventCameras`).
 	*/
 	async handleSensorStateChanged(data, timestamp) {
 		const store = this.sensorEventStore;
 		const cache = this.linkedCamerasCache;
 		if (store === null || cache === null) return;
+		if (!this.sensorSliceCarriedATransition(data)) return;
 		const persisted = [];
 		try {
 			await ingestSensorStateChange({
@@ -67641,6 +69876,55 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		for (const ev of persisted) this.notificationCenter?.onSensorEventPersisted(ev, markerByCamera.get(ev.deviceId)?.trackId);
 	}
 	/**
+	* True when this slice carried a real transition of its sensor.
+	*
+	* A cap with no boolean level (`doorbell`, `button`, `lock-control`,
+	* `presence`, `enum-sensor`, `event-emitter`) always passes — its ARRIVAL is
+	* the event, and gating it would re-ship the silence of 2026-08-08. A cap
+	* that HAS one passes only when the boolean moved, in either direction.
+	*
+	* A slice that is not an object at all is refused rather than defaulted to
+	* `{}`: `evaluateSensorEdge` would read `non-boolean-value` from an empty
+	* object, which looks like a sensor reporting nonsense when what happened is
+	* that there was nothing to read. Same discipline as the recorder's
+	* `parseSensorStateChanged`.
+	*
+	* The drops are SUMMARISED, never logged one by one: this path carries every
+	* camera's native `motion` slice at motion rate.
+	*/
+	sensorSliceCarriedATransition(data) {
+		const slice = data.slice;
+		if (typeof slice !== "object" || slice === null || Array.isArray(slice)) {
+			this.ctx.logger.debug("sensor state change carried no slice — dropped", {
+				tags: { deviceId: data.deviceId },
+				meta: { capName: data.capName }
+			});
+			return false;
+		}
+		const verdict = this.sensorTransitions.observe(data.deviceId, data.capName, { ...slice });
+		this.flushSensorTransitionDrops();
+		return verdict.changed;
+	}
+	/**
+	* One `info` line per (device, cap, reason) per window, or none.
+	*
+	* A branch that drops work says so — but this one drops ~0.6 events/s
+	* fleet-wide in its steady state (every camera's native `motion`), so what it
+	* says is a COUNT. The line an operator greps when a real contact produced no
+	* marker is here, with the numeric `deviceId` of the SENSOR, and it says
+	* which verdict swallowed it.
+	*/
+	flushSensorTransitionDrops() {
+		for (const drop of this.sensorTransitions.takeDropSummary(Date.now())) this.ctx.logger.info("sensor state changes dropped — no transition", {
+			tags: { deviceId: drop.deviceId },
+			meta: {
+				capName: drop.capName,
+				reason: drop.reason,
+				count: drop.count
+			}
+		});
+	}
+	/**
 	* Say out loud that a MAPPED sensor cap ingested nothing, and why.
 	*
 	* BOTH branches are `debug`, deliberately. After the self-camera fix neither
@@ -67819,25 +70103,6 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		return runner.runStatelessStep.mutate(input, require_dist.nodePin(nodeId));
 	}
 	/**
-	* Every track id the track store still holds, across the given devices.
-	*
-	* Returned as a Set for the orphan sweep, which REFUSES an empty one — a
-	* store that failed to answer must not be read as "no tracks exist".
-	*/
-	async collectLiveTrackIds(deviceIds) {
-		const live = /* @__PURE__ */ new Set();
-		const trackStore = this.trackStore;
-		if (!trackStore) return live;
-		for (const deviceId of deviceIds) {
-			const page = await trackStore.queryRecentIds({
-				deviceIds: [deviceId],
-				limit: EMBEDDING_ORPHAN_SCAN_LIMIT
-			});
-			for (const trackId of page.trackIds) live.add(trackId);
-		}
-		return live;
-	}
-	/**
 	* The periodic ORPHAN AUDIT — ownership-keyed, wide interval, report-first.
 	*
 	* This is NOT a fifth age sweep and must never be mistaken for one. It takes
@@ -67938,7 +70203,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					}
 				});
 			}
-			await this.auditEmbeddingOrphans(limits);
+			await this.auditEmbeddingOrphans(limits, overrides?.restart === true);
 			if (report.totalOrphans > 0) this.eventsOpsLog?.append({
 				op: "orphan-audit",
 				reason: "maintenance",
@@ -67968,43 +70233,53 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* that failed to answer must never be read as "no tracks exist", which would
 	* wipe the whole index. In report mode nothing is deleted at all.
 	*/
-	async auditEmbeddingOrphans(limits) {
+	async auditEmbeddingOrphans(limits, restart) {
 		const embeddingStore = this.objectEmbeddingStore;
-		if (!embeddingStore) return;
-		try {
-			const deviceIds = await this.retentionDeviceIds();
-			const live = await this.collectLiveTrackIds(deviceIds);
-			const candidates = (await embeddingStore.searchByVector({
-				vector: new Float32Array(EMBEDDING_ORPHAN_PROBE_DIM),
-				limit: EMBEDDING_ORPHAN_SCAN_LIMIT
-			})).hits.map((h) => h.row.trackId);
-			const orphans = candidates.filter((id) => !live.has(id));
-			if (limits.mode !== "reclaim") {
-				this.ctx.logger.info("analytics orphan audit", { meta: {
-					mode: limits.mode,
-					collection: "vector-index:object-clip",
-					examined: candidates.length,
-					orphans: live.size === 0 ? 0 : orphans.length,
-					reclaimed: 0,
-					refused: live.size === 0
-				} });
-				return;
-			}
-			const result = await embeddingStore.pruneOrphans({
-				liveTrackIds: live,
-				candidates
-			});
-			this.ctx.logger.info("analytics orphan audit", { meta: {
-				mode: limits.mode,
-				collection: "vector-index:object-clip",
-				examined: candidates.length,
-				orphans: result.deleted,
-				reclaimed: result.deleted,
-				refused: result.refused
+		const trackStore = this.trackStore;
+		if (!embeddingStore || !trackStore) {
+			this.ctx.logger.warn("analytics orphan audit: vector-index leg skipped — stores not up", { meta: {
+				collection: EMBEDDING_ORPHAN_SCOPE,
+				embeddingStore: embeddingStore !== null,
+				trackStore: trackStore !== null
 			} });
-		} catch (err) {
-			this.ctx.logger.debug("analytics orphan audit (vector index) failed", { meta: { error: String(err) } });
+			return;
 		}
+		const report = await scanEmbeddingOrphans({
+			scanPage: (cursor, limit) => embeddingStore.scanRefs(cursor, limit),
+			liveTrackIds: (ids) => trackStore.existingTrackIds(ids),
+			reclaim: (ids) => embeddingStore.deleteVerified(ids),
+			now: () => Date.now(),
+			logger: this.ctx.logger,
+			breathe: () => new Promise((resolve) => setImmediate(resolve))
+		}, {
+			mode: limits.mode,
+			graceMs: limits.graceMs,
+			pageSize: limits.pageSize,
+			maxRows: Math.max(limits.maxRowsPerScope, EMBEDDING_ORPHAN_SCAN_LIMIT),
+			maxReclaim: limits.maxReclaimPerScope
+		}, restart ? 0 : this.orphanEmbeddingCursor);
+		this.orphanEmbeddingCursor = report.nextCursor;
+		this.ctx.logger.info("analytics orphan audit", { meta: {
+			mode: limits.mode,
+			collection: report.scope,
+			examined: report.examined,
+			orphans: report.orphans,
+			reclaimed: report.reclaimed,
+			kept: report.kept,
+			withinGrace: report.withinGrace,
+			unresolvable: report.unresolvable,
+			notReclaimed: report.notReclaimed,
+			stoppedBy: report.stoppedBy,
+			nextCursor: report.nextCursor
+		} });
+		for (const deviceId of report.deviceIds) this.ctx.logger.info("analytics orphan audit (device)", {
+			tags: { deviceId },
+			meta: {
+				deviceId,
+				collection: report.scope,
+				mode: limits.mode
+			}
+		});
 	}
 	/**
 	* Operator-tunable audit limits. `mode` and `pageSize` are SETTINGS because
@@ -68482,11 +70757,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		}, Buffer.from(file.base64, "base64"));
 		if (outcome.kind === "no-capable-node") return refuse("no-capable-node", outcome.reason);
 		if (outcome.kind === "failed") return refuse("failed", outcome.reason);
-		await faceStore.update(face.id, {
+		if (!await faceStore.restampEmbedding({
+			faceId: face.id,
+			deviceId: face.deviceId,
+			trackId: face.trackId,
+			timestamp: face.timestamp,
 			embedding: outcome.embedding,
-			embeddingModelId: clusterModelId
-		});
-		if ((await faceStore.get(face.id))?.embeddingModelId !== clusterModelId) return refuse("not-persisted", "the re-embedded vector did not land on the face row");
+			modelId: clusterModelId
+		})) return refuse("not-persisted", "the re-embedded vector did not land on the face row");
 		this.ctx.logger.info("face rescore: re-embedded into the cluster model space", {
 			tags: { deviceId: face.deviceId },
 			meta: {
@@ -68547,7 +70825,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const identityStore = this.identityStore;
 		if (!identityStore) throw new Error("face.rescoreTrack: the identity store is not ready");
 		const faceId = `face-${input.trackId}`;
-		const face = await faceStore.get(faceId);
+		const face = await faceStore.getWithEmbedding(faceId);
 		if (!face) throw new Error(`face.rescoreTrack: no buffered face for track ${input.trackId}`);
 		if (face.deviceId !== input.deviceId) throw new Error(`face.rescoreTrack: face ${faceId} belongs to device ${face.deviceId}, not ${input.deviceId}`);
 		const clusterModelId = await resolveClusterModelPin(api, FACE_EMBEDDING_STEP_ID, { warn: (m, e) => this.ctx.logger.warn(m, e) });
@@ -68759,9 +71037,95 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			"embedding.wipe": async () => this.wipeObjectEmbeddings(),
 			"embedding.reembedFaces": async (input) => this.runFaceReembedPass(input),
 			"embedding.reembedFacesStatus": async () => this.getFaceReembedStatus(),
-			"retention.orphanAudit": async (input) => this.runOrphanAuditNow(input)
+			"retention.orphanAudit": async (input) => this.runOrphanAuditNow(input),
+			"retention.mediaReclaim": async (input) => this.runMediaReclaimNow(input)
 		};
 	}
+	/**
+	* One operator-driven debug-media reclaim pass — the entry point behind
+	* `retention.mediaReclaim`.
+	*
+	* DRY RUN BY DEFAULT. Draining the standing 111 GB means running this with
+	* `mode: 'reclaim'` repeatedly until `complete` is true; each run resumes
+	* from the per-device cursors this method keeps, and a run that is cut short
+	* has still only forgotten rows whose blobs it proved gone.
+	*
+	* Single-flight: a second call while a pass is in flight returns
+	* `ran: false` rather than doubling the disk pressure the pacing exists to
+	* avoid.
+	*/
+	async runMediaReclaimNow(rawInput) {
+		const input = MediaReclaimActionInputSchema.parse(rawInput);
+		const mediaStore = this.mediaStore;
+		const eventStore = this.eventStore;
+		const trackStore = this.trackStore;
+		const empty = {
+			ran: false,
+			mode: input.mode,
+			devices: [],
+			totalExamined: 0,
+			totalEligible: 0,
+			totalReclaimed: 0,
+			totalBytesReclaimed: 0,
+			totalRefused: 0,
+			durationMs: 0,
+			complete: false
+		};
+		if (!mediaStore || !eventStore || !trackStore) return empty;
+		if (this.mediaReclaimRunning) return empty;
+		this.mediaReclaimRunning = true;
+		try {
+			const limits = {
+				mode: input.mode,
+				pageSize: input.pageSize ?? DEFAULT_MEDIA_RECLAIM_LIMITS.pageSize,
+				maxRowsPerDevice: input.maxRowsPerDevice ?? DEFAULT_MEDIA_RECLAIM_LIMITS.maxRowsPerDevice,
+				maxReclaimPerDevice: input.maxReclaimPerDevice ?? DEFAULT_MEDIA_RECLAIM_LIMITS.maxReclaimPerDevice,
+				maxBytesPerRun: input.maxBytesPerRun ?? DEFAULT_MEDIA_RECLAIM_LIMITS.maxBytesPerRun,
+				budgetMs: input.budgetMinutes !== void 0 ? input.budgetMinutes * 6e4 : DEFAULT_MEDIA_RECLAIM_LIMITS.budgetMs,
+				graceMs: input.graceMinutes !== void 0 ? input.graceMinutes * 6e4 : DEFAULT_MEDIA_RECLAIM_LIMITS.graceMs,
+				throttleBytesPerSec: input.throttleBytesPerSec ?? DEFAULT_MEDIA_RECLAIM_LIMITS.throttleBytesPerSec
+			};
+			const scopes = input.scopes ?? MEDIA_RECLAIM_SCOPES;
+			const { report, cursors } = await runMediaReclaim({
+				deviceIds: input.deviceIds ?? await this.retentionDeviceIds(),
+				scopes,
+				limits,
+				cursors: input.restart === true ? /* @__PURE__ */ new Map() : this.mediaReclaimCursors,
+				deps: {
+					page: ({ deviceId, scope, afterMs, limit }) => mediaStore.pageByKindForDevice({
+						deviceId,
+						ownerKind: scope === "motion-still" ? "event" : "track",
+						kind: "snapshot",
+						afterMs,
+						limit
+					}),
+					motionEventIds: (ids) => eventStore.existingMotionEventIds(ids),
+					pinnedTrackIds: (ids) => trackStore.pinnedTrackIds(ids),
+					reclaim: (key) => mediaStore.deleteConfirmed(key),
+					now: () => Date.now(),
+					logger: this.ctx.logger,
+					breathe: () => new Promise((resolve) => setImmediate(resolve)),
+					pace: (ms) => ms <= 0 ? Promise.resolve() : new Promise((resolve) => setTimeout(resolve, ms))
+				}
+			});
+			this.mediaReclaimCursors = cursors;
+			if (limits.mode === "reclaim" && report.totalReclaimed > 0) await this.eventsOpsLog?.append({
+				op: "prune",
+				reason: "operator",
+				deviceId: null,
+				itemsAffected: report.totalReclaimed,
+				bytesReclaimed: report.totalBytesReclaimed,
+				detail: `debug-media reclaim (${scopes.join("+")}): ${report.totalReclaimed} rows, ${report.totalRefused} refused, complete=${report.complete}`
+			});
+			return {
+				ran: true,
+				...report,
+				devices: [...report.devices]
+			};
+		} finally {
+			this.mediaReclaimRunning = false;
+		}
+	}
 	/** Progress of the detached rebuild — the only way to observe a long pass. */
 	async getObjectEmbeddingRebuildStatus() {
 		const state = this.rebuildState;
@@ -68813,7 +71177,16 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {}
 		});
 		const ranked = search.hits;
-		if (ranked.length === 0) return [];
+		if (ranked.length === 0) {
+			if (input.classFilter !== void 0) this.ctx.logger.warn("searchObjectEvents: classFilter matched nothing", {
+				...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+				meta: {
+					classFilter: input.classFilter,
+					why: "the index's className column carries the CLIP step's output class, not the track's class — only that value can match"
+				}
+			});
+			return [];
+		}
 		const embeddingMediaKeyByTrackId = /* @__PURE__ */ new Map();
 		const keyFrameKeyByTrackId = /* @__PURE__ */ new Map();
 		for (const { row } of ranked) {
@@ -68879,15 +71252,21 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const mediaStore = this.mediaStore;
 		const trackStore = this.trackStore;
 		if (!eventStore || !mediaStore || !trackStore) return null;
+		const stores = {
+			eventStore,
+			mediaStore,
+			faceStore: this.faceStore,
+			plateStore: this.plateStore,
+			objectEmbeddingStore: this.objectEmbeddingStore,
+			groupStore: this.groupStore
+		};
+		const absent = absentCascadeLegs(stores);
+		if (absent.length > 0) this.ctx.logger.warn("track cascade is missing a leg — its rows will be left behind", { meta: {
+			absent,
+			why: "an optional store was not bound at boot; the track root is still deleted, so these families can only be reclaimed by the orphan audit"
+		} });
 		return {
-			registry: buildAnalyticsCascadeRegistry({
-				eventStore,
-				mediaStore,
-				faceStore: this.faceStore,
-				plateStore: this.plateStore,
-				objectEmbeddingStore: this.objectEmbeddingStore,
-				groupStore: this.groupStore
-			}),
+			registry: buildAnalyticsCascadeRegistry(stores),
 			trackStore
 		};
 	}
@@ -69042,6 +71421,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		if (!this.mediaRelocate) throw new Error("media relocation unavailable");
 		return this.mediaRelocate.countUnstamped();
 	}
+	/**
+	* How many rows a pass would still act on against `toLocationId`.
+	*
+	* The media lane's denominator AND its residue, from the one predicate the
+	* pass itself uses. `null` means the count could not be taken — never `0`,
+	* which would read as "there is nothing left to move".
+	*/
+	async countRelocatableMedia(input) {
+		if (!this.mediaRelocate) throw new Error("media relocation unavailable");
+		return this.mediaRelocate.countSelectable(input);
+	}
 	/** Every relocate job this addon knows about, newest first (in RAM: the
 	*  move is resumable, so a lost list costs nothing but the display). */
 	async listRelocateMediaJobs() {
@@ -69450,6 +71840,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.sensitivitySettingsCache.delete(input.deviceId);
 		this.trackingSettingsCache.delete(input.deviceId);
 		this.confirmationGateSettingsCache.delete(input.deviceId);
+		this.mediaSettingsCache.delete(input.deviceId);
 		this.forgetDeviceProcessors(input.deviceId);
 		return { success: true };
 	}
@@ -69483,6 +71874,7 @@ function withMean(row) {
 	};
 }
 //#endregion
+exports.CONFIRMATION_CROP_MAX_WIDTH = CONFIRMATION_CROP_MAX_WIDTH;
 exports.DETECTION_PIPELINE_SECTION_IDS = DETECTION_PIPELINE_SECTION_IDS;
 exports.customActions = customActions;
 exports.default = PipelineAnalyticsAddon;