@camstack/addon-post-analysis 1.2.150 → 1.2.151

package/dist/{dist-C8cA7PX_.mjs → dist-B5K63Zmt.mjs}

@@ -8242,6 +8242,21 @@ var RelocateJobSchema = object({
 	bytesMoved: number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -8310,14 +8325,42 @@ var RelocateMediaInputSchema = object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = object({
-	media: number().int().nonnegative(),
-	retrainFrames: number().int().nonnegative(),
-	total: number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -8428,6 +8471,10 @@ var StorageMigrationMoveProgressSchema = object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: number().int().nonnegative().nullable(),
 	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */
@@ -20455,6 +20502,17 @@ var pipelineAnalyticsCapability = {
 		* happens to stamp it. This count is what the migration planner's
 		* non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
 		* it to zero.
+		*
+		* TWO indexed statements per collection, not a walk. It used to page the
+		* whole collection at 200 rows per RPC ordered by an unindexed column, so
+		* on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+		* time it was called, and the migration it gates could never start. The
+		* cheap question (`present`: is there at least one) is asked first and
+		* separately from the expensive one (`rows`), because only the first has
+		* to be answerable for the gate to do its job.
+		*
+		* **`null` is "not measurable", never zero** — at either level. An
+		* unreadable collection must not read as a sealed one.
 		*/
 		countUnstampedEventMedia: method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
 		/**

package/dist/{dist-BTviHGUC.js → dist-DpQno5NK.js}

@@ -8273,6 +8273,21 @@ var RelocateJobSchema = object({
 	bytesMoved: number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -8341,14 +8356,42 @@ var RelocateMediaInputSchema = object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = object({
-	media: number().int().nonnegative(),
-	retrainFrames: number().int().nonnegative(),
-	total: number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -8459,6 +8502,10 @@ var StorageMigrationMoveProgressSchema = object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: number().int().nonnegative().nullable(),
 	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */
@@ -20486,6 +20533,17 @@ var pipelineAnalyticsCapability = {
 		* happens to stamp it. This count is what the migration planner's
 		* non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
 		* it to zero.
+		*
+		* TWO indexed statements per collection, not a walk. It used to page the
+		* whole collection at 200 rows per RPC ordered by an unindexed column, so
+		* on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+		* time it was called, and the migration it gates could never start. The
+		* cheap question (`present`: is there at least one) is asked first and
+		* separately from the expensive one (`rows`), because only the first has
+		* to be answerable for the gate to do its job.
+		*
+		* **`null` is "not measurable", never zero** — at either level. An
+		* unreadable collection must not read as a sealed one.
 		*/
 		countUnstampedEventMedia: method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
 		/**

package/dist/embedding-encoder/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BTviHGUC.js");
+const require_dist = require("../dist-DpQno5NK.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/embedding-encoder/index.mjs

@@ -1,4 +1,4 @@
-import { At as BaseAddon, F as PoolMemoryWatchdog, St as resolvePoolMemoryPolicy, at as embeddingEncoderCapability, gt as parseProcStatus, ut as hfModelUrl } from "../dist-C8cA7PX_.mjs";
+import { At as BaseAddon, F as PoolMemoryWatchdog, St as resolvePoolMemoryPolicy, at as embeddingEncoderCapability, gt as parseProcStatus, ut as hfModelUrl } from "../dist-B5K63Zmt.mjs";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DZGvAMuh.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-bK-ELdFD.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.48",
+		version: "1.2.49",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.126",
+		version: "1.2.127",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.89",
+		version: "1.2.90",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",

package/dist/pipeline-analytics/{hostInit-DgkTmoHq.mjs → hostInit-CgUMPlDe.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.126",
+				version: "1.2.127",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.48",
+				version: "1.2.49",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.89",
+				version: "1.2.90",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BTviHGUC.js");
+const require_dist = require("../dist-DpQno5NK.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -6270,12 +6270,86 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/system-event-tap-url.ts
+/** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
+var ADMIN_ADDONS_PATH = "/system/addons";
+var ADMIN_CLUSTER_PATH = "/system/cluster";
+var ADMIN_DEVICES_PATH = "/devices";
+/**
+* The query parameter naming a node.
+*
+* One spelling for both admin pages, mirrored by `NODE_PARAM` in
+* `packages/addon-admin-ui/src/lib/node-url-selection.ts` and pinned across
+* the two packages by `scripts/check-notification-tap-targets.ts`.
+*/
+var NODE_PARAM = "node";
+/** The device page's top-level tab parameter, read by `DeviceDetail`. */
+var TAB_PARAM = "tab";
+/** The Stream Broker tab id — a `WELL_KNOWN_TABS` member, hoisted `top-tab`. */
+var STREAM_BROKER_TAB = "stream-broker";
+/** `DeviceType.Camera`. Spelled here rather than imported so this stays a pure
+*  string map with no device-model dependency; the guard pins it. */
+var CAMERA_DEVICE_TYPE = "camera";
+/** Kinds whose action is "go and apply an ADDON update". */
+var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
+/** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
+var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
+/**
+* Kinds whose action is "go and look at why this camera stopped producing".
+*
+* The legacy `camera-offline` is here for the same reason it is still in the
+* enum: outbox and history rows enqueued before the rename carry it, and an
+* old row is exactly the one whose action has to keep working.
+*/
+var DEVICE_DOWN_KINDS = new Set([
+	"device-offline",
+	"stream-offline",
+	"camera-offline"
+]);
+/**
+* Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
+*
+* A stream belongs to a camera and nothing else. The legacy `camera-offline`
+* is one too — that name is precisely the claim it made, and it is why the
+* kind was split into `device-offline` + a `deviceTypes` condition.
+*/
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set(["stream-offline", "camera-offline"]);
+function withParam(path, key, value) {
+	if (value === void 0 || value.length === 0) return path;
+	return `${path}?${key}=${encodeURIComponent(value)}`;
+}
+/**
+* The admin path (with its query) a system event taps through to, or `null`
+* when the kind has no action.
+*
+* Exported for the cross-package guard and for tests that want the path
+* without a base; the dispatcher goes through {@link systemEventTapUrl}.
+*/
+function systemEventTapPath(subject) {
+	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
+	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
+	if (DEVICE_DOWN_KINDS.has(subject.kind)) {
+		const deviceId = subject.deviceId;
+		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
+		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
+		return CAMERA_BY_CONSTRUCTION_KINDS.has(subject.kind) || subject.deviceType === CAMERA_DEVICE_TYPE ? withParam(devicePath, TAB_PARAM, STREAM_BROKER_TAB) : devicePath;
+	}
+	return null;
+}
+/** Full URL, or `null` when the kind has no action or no base is reachable. */
+function systemEventTapUrl(subject, baseUrl) {
+	if (baseUrl === null || baseUrl.length === 0) return null;
+	const path = systemEventTapPath(subject);
+	if (path === null) return null;
+	return `${baseUrl.replace(/\/+$/, "")}${path}`;
+}
+//#endregion
 //#region src/notification-center/default-tap-url.ts
 /** The viewer's hosted base path under the hub. */
 var VIEWER_BASE_PATH = "/viewer/camstack";
 function defaultTapUrl(input) {
-	if (input.systemEvent === true) return null;
 	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (input.systemEvent !== void 0) return systemEventTapUrl(input.systemEvent, input.baseUrl);
 	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
 	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
 }
@@ -8868,13 +8942,14 @@ function trailAt(trail, timestamp) {
 * cannot be asked (no trail, no polygon) or when nobody qualifies.
 */
 function selectTriggerZoneCandidates(input) {
-	const { candidates, trail, polygons } = input;
+	const { candidates, trail, polygons, strict } = input;
 	if (candidates.length === 0 || trail.length === 0 || polygons.length === 0) return candidates;
 	const qualifying = candidates.filter((candidate) => {
 		const point = trailAt(trail, candidate.timestamp);
 		return point !== null && zoneOverlap(point, polygons) > 0;
 	});
-	return qualifying.length > 0 ? qualifying : candidates;
+	if (qualifying.length > 0) return qualifying;
+	return strict === true ? [] : candidates;
 }
 //#endregion
 //#region src/notification-center/dispatcher.ts
@@ -8912,6 +8987,24 @@ var NC_STILL_WAIT_MS = 3e3;
 * is the instant; the ladder then runs among the frames that are about it.
 */
 var NC_TRIGGER_STILL_MAX_AGE_MS = TRAIL_MATCH_MAX_MS;
+/**
+* Whether this row's subject can still be photographed AGAIN after its trigger.
+*
+* The one thing that separates a row worth waiting for from a row whose only
+* frame already exists. A live visual track keeps writing media for as long as
+* it is open — its first frame, its periodic snapshots, its last frame all land
+* after the instant a zone condition fired. Every other record is photographed
+* once: an audio window, a device event and a package event are served by the
+* still shelf, which D178 makes take ONE picture for a whole burst, and a
+* `track-end` row is by definition past the last of them.
+*
+* Waiting on the wrong side of this line has cost both ways in production — 3 s
+* of latency on a scream when nothing more was coming, and an empty doorstep on
+* 'Persona su Uscio' when something was.
+*/
+function canStillGainMedia(entry) {
+	return entry.recordKind === "object-event";
+}
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -9391,7 +9484,12 @@ var NcDispatcher = class {
 			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
 			timestampMs: subject.timestamp,
 			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
-			systemEvent: systemEvent !== void 0
+			...systemEvent !== void 0 ? { systemEvent: {
+				kind: systemEvent.kind,
+				...systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {},
+				...systemEvent.deviceType !== void 0 ? { deviceType: systemEvent.deviceType } : {},
+				...systemEvent.nodeId !== void 0 ? { nodeId: systemEvent.nodeId } : {}
+			} } : {}
 		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
@@ -9526,7 +9624,7 @@ var NcDispatcher = class {
 		const out = [];
 		const zoneIdsWanted = entry.payload.mediaZoneIds;
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
-		const firstLook = await this.resolveAttachment(entry, stillOverride, "any");
+		const firstLook = await this.resolveAttachment(entry, stillOverride, canStillGainMedia(entry) ? "trigger-only" : "any");
 		const footagePending = this.renderFootage(entry);
 		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : await this.waitForStill(entry, stillOverride);
 		const footage = await footagePending;
@@ -9770,20 +9868,34 @@ var NcDispatcher = class {
 	* throw. And when nothing qualifies, the full list comes back: a real picture
 	* beats no picture (the same rule D212 settled for the best shot).
 	*/
-	async narrowToTriggerZone(entry, ordered) {
+	async narrowToTriggerZone(entry, ordered, freshness) {
 		const zoneIds = entry.payload.triggerZoneIds;
 		const trackId = entry.payload.subject.trackId;
 		const getTrail = this.deps.getSubjectTrail;
 		const deviceId = entry.payload.subject.deviceId;
-		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2) return ordered;
+		const strict = freshness === "trigger-only";
+		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2 && !strict) return ordered;
 		try {
 			const [polygons, trail] = await Promise.all([this.deps.getZonePolygons?.(deviceId, zoneIds) ?? Promise.resolve([]), getTrail(deviceId, trackId)]);
 			const kept = selectTriggerZoneCandidates({
 				candidates: ordered,
 				trail,
 				polygons,
-				triggerAt: entry.payload.subject.timestamp
+				triggerAt: entry.payload.subject.timestamp,
+				strict
 			});
+			if (kept.length === 0) {
+				this.deps.logger.debug("no still from the zone that fired the rule — still waiting", {
+					tags: { deviceId },
+					meta: {
+						ruleId: entry.ruleId,
+						trackId,
+						zoneIds: zoneIds.join(","),
+						rejected: ordered.length
+					}
+				});
+				return kept;
+			}
 			if (kept.length === ordered.length) return kept;
 			this.deps.logger.info("still narrowed to the zone that fired the rule", {
 				tags: { deviceId },
@@ -9863,7 +9975,8 @@ var NcDispatcher = class {
 			for (const kind of preference) for (const file of files) if (file.kind === kind) ordered.push(file);
 			const inBand = this.narrowToTriggerInstant(entry, ordered, freshness);
 			if (inBand.length === 0) continue;
-			const shortlist = await this.narrowToTriggerZone(entry, inBand);
+			const shortlist = await this.narrowToTriggerZone(entry, inBand, freshness);
+			if (shortlist.length === 0) continue;
 			for (const file of shortlist) {
 				const raw = Buffer.from(file.base64, "base64");
 				if (raw.byteLength === 0) continue;
@@ -25509,13 +25622,46 @@ var MEDIA_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var MEDIA_INDEXES = [{
-	name: "idx_media_owner",
-	columns: ["ownerKind", "ownerId"]
-}, {
-	name: "idx_media_device_ts",
-	columns: ["deviceId", "timestamp"]
-}];
+var MEDIA_INDEXES = [
+	{
+		name: "idx_media_owner",
+		columns: ["ownerKind", "ownerId"]
+	},
+	{
+		name: "idx_media_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	(
+	/**
+	* The `locationId IS NULL` seal gate — see `media-relocate-engine.ts`.
+	*
+	* NULLs sort FIRST in a SQLite index, so `WHERE locationId IS NULL` is a
+	* contiguous range from the head of the b-tree: its cost is proportional to
+	* the ANSWER, not to the table. That is the property the gate needs. The
+	* question it must answer fastest is "are there none left", and with this
+	* index that is one seek that immediately falls off the end of an empty
+	* range — regardless of how many million stamped rows sit behind it.
+	*
+	* **What it costs.** One extra b-tree maintained by every insert into a
+	* table taking ~92 k rows/day, and roughly 25 bytes of index per row (~30 MB
+	* at 1.25 M rows). At ~1 insert/s sustained that maintenance is noise
+	* against the JPEG write the same call performs. The one-off cost is real
+	* and worth naming: the FIRST declare after this ships builds the index over
+	* every existing row, on a recordings volume that is currently saturated —
+	* expect the analytics addon's boot to stall for tens of seconds to a couple
+	* of minutes, once.
+	*
+	* A PARTIAL index (`WHERE locationId IS NULL`) would be smaller still and
+	* would cost nothing at all once sealed. It is not used because
+	* `CollectionIndexSchema` has no predicate and the schema fingerprint does
+	* not hash one — adding both to serve one query is a bigger change than the
+	* query deserves, and the plain index already makes the gate O(log n).
+	*/
+	{
+		name: "idx_media_location",
+		columns: ["locationId"]
+	})
+];
 /** The storage location of a media row/record: its stamped `locationId`, or
 *  the default `eventMedia` location for NULL (pre-multi-location) rows. */
 var DEFAULT_MEDIA_LOCATION = "eventMedia";
@@ -41130,13 +41276,29 @@ var RETRAIN_FRAME_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var RETRAIN_FRAME_INDEXES = [{
-	name: "idx_retrain_frames_track",
-	columns: ["trackId"]
-}, {
-	name: "idx_retrain_frames_device",
-	columns: ["deviceId", "copiedAt"]
-}];
+var RETRAIN_FRAME_INDEXES = [
+	{
+		name: "idx_retrain_frames_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_retrain_frames_device",
+		columns: ["deviceId", "copiedAt"]
+	},
+	(
+	/**
+	* The seal gate's other half. This collection is orders of magnitude smaller
+	* than `pipeline-analytics:media` — every row is an operator-staged frame —
+	* so the index buys much less here. It exists anyway because the gate reads
+	* the two lanes with ONE query shape, and a lane that answers by scanning is
+	* a lane that starts timing out the day the dataset grows. See
+	* `MEDIA_INDEXES` for the cost this is a small multiple of.
+	*/
+	{
+		name: "idx_retrain_frames_location",
+		columns: ["locationId"]
+	})
+];
 /**
 * The copy's id, derived from `(trackId, sourceMediaKey)`.
 *
@@ -44402,14 +44564,27 @@ function snapshot(j) {
 	};
 }
 /**
+* The column both walked collections use for the storage location.
+*
+* Named once because it is now a QUERY PREDICATE (`where: { [it]: null }`) as
+* well as a row field. A predicate naming a column the collection cannot
+* express is refused by `count` rather than dropped, so a rename that misses
+* one site fails loudly instead of counting the whole table.
+*/
+var LOCATION_ID_FIELD = "locationId";
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
 * helper collapses "unstamped" and "stamped with the bare type ref" into one
 * answer, and only the first is a row whose meaning changes under a repoint.
+*
+* The in-JS twin of the `IS NULL` predicate {@link MediaRelocateEngine.countUnstamped}
+* sends. It stays because the PASS still walks rows and must decide per row;
+* the two must agree, and `unstamped-count-matches-the-pass` asserts they do.
 */
 function rowIsUnstamped(data) {
-	const id = data["locationId"];
+	const id = data[LOCATION_ID_FIELD];
 	return !(typeof id === "string" && id.length > 0);
 }
 /** True for the enrolled-gallery rows `move` skips and `gallery` selects. */
@@ -44467,26 +44642,91 @@ var MediaRelocateEngine = class {
 		return true;
 	}
 	/**
-	* How many rows still carry no `locationId`, per collection.
+	* Rows that still carry no `locationId`, per collection.
 	*
-	* Read-only, and the ONLY number the migration planner's non-blocking gate
-	* is allowed to trust: it is counted here, against the rows themselves,
+	* Read-only, and the ONLY answer the migration planner's non-blocking gate
+	* is allowed to trust: it is measured here, against the rows themselves,
 	* rather than inferred from "a seal job reported done" — a seal that failed
 	* some rows still reports a terminal state.
+	*
+	* ── Why this is not the walk the rest of this file uses ──────────────────
+	*
+	* It used to be. It paged both collections through {@link pageRows} — 200
+	* rows per RPC, ordered by `timestamp`, a column that leads no index — and
+	* counted `rowIsUnstamped` in JS. On the live hub that is ~6 300 round trips
+	* over 1 254 576 rows, each paying its own sort, and it hit the 60 s RPC
+	* deadline **every time it was called since it shipped**. The gate it exists
+	* to serve could therefore never open, and 152 GB of event media could not
+	* be migrated.
+	*
+	* The walk is right for the PASS, which must visit every row to act on it.
+	* It was never right for a question the store can answer with a predicate,
+	* and the predicate is now expressible: `where: { locationId: null }`
+	* compiles to `IS NULL` (it used to compile to `= NULL`, which matches
+	* nothing and reports it as an answer — the number the gate treats as "safe
+	* to cut over"). With `idx_media_location` in place both statements read a
+	* contiguous range from the head of a b-tree.
+	*
+	* The cheap question is asked FIRST and on its own. `present` is a single
+	* seek and decides the gate; `rows` is a second statement and only decorates
+	* the refusal. So a count that cannot be taken still leaves a usable answer
+	* — `{ present: true, rows: null }` refuses just as hard — and `null` never
+	* degrades into `0`.
 	*/
 	async countUnstamped() {
-		const media = await this.countUnstampedIn(MEDIA_COLLECTION, "timestamp");
-		const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION, "copiedAt");
-		return {
-			media,
-			retrainFrames,
-			total: media + retrainFrames
-		};
+		try {
+			const media = await this.countUnstampedIn(MEDIA_COLLECTION);
+			const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION);
+			return {
+				media,
+				retrainFrames,
+				anyPresent: media.present || retrainFrames.present,
+				total: media.rows === null || retrainFrames.rows === null ? null : media.rows + retrainFrames.rows
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: could not determine whether any row is unstamped — a migration must treat this as unknown, never as sealed", { meta: { error: String(err) } });
+			return null;
+		}
 	}
-	async countUnstampedIn(collection, orderField) {
-		let unstamped = 0;
-		for await (const row of this.pageRows(collection, orderField)) if (rowIsUnstamped(row.data)) unstamped++;
-		return unstamped;
+	/**
+	* One collection's unstamped population: existence, then size.
+	*
+	* The `limit: 1` probe is deliberately a `query` and not a `count`: a count
+	* of a million matching rows still walks a million index entries, while the
+	* probe stops at the first one. Absence is proved by the same seek finding
+	* nothing, which is where the index earns its keep — after a seal, the range
+	* is empty and the answer is one b-tree descent.
+	*/
+	async countUnstampedIn(collection) {
+		if ((await this.deps.store.query.query({
+			collection,
+			filter: {
+				where: { [LOCATION_ID_FIELD]: null },
+				limit: 1
+			},
+			columns: [LOCATION_ID_FIELD]
+		})).length === 0) return {
+			present: false,
+			rows: 0
+		};
+		try {
+			return {
+				present: true,
+				rows: await this.deps.store.count.query({
+					collection,
+					filter: { where: { [LOCATION_ID_FIELD]: null } }
+				})
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: unstamped rows exist but could not be counted — reporting the population as unknown, not as empty", { meta: {
+				collection,
+				error: String(err)
+			} });
+			return {
+				present: true,
+				rows: null
+			};
+		}
 	}
 	start(input) {
 		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as audioModeOf, A as NcSnoozeSchema, At as BaseAddon, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as discriminatedUnion, C as NcConditionDescriptorSchema, Ct as sceneMonitorCapability, D as NcRuleTargetSchema, Dt as videoclipsCapability, E as NcRuleSchema, Et as vectorDimFromBase64, Ft as nodePin, G as TimelapseRulePatchSchema, Gt as record, H as SceneMonitorSchema, Ht as number, I as RECORDING_EXPORT_MAX_READ_BYTES, It as sleep, J as VISIT_MERGE_GAP_MS, Jt as EventCategory, K as TimelapseRuleSchema, Kt as string, L as RetrainStatusSchema, Lt as _enum, M as NcSystemEventKindSchema, Mt as createEvent, N as NcTaxonomySchema, Nt as hydrateSchema, O as NcScheduleSchema, Ot as zoneAnalyticsCapability, P as OpsLogEntrySchema, Pt as isDeviceScopedCap, Q as audioMetricsCapability, Rt as array, S as NC_TAXONOMY, T as NcRulePatchSchema, Tt as systemEventFilterApplies, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as object, V as SCENE_DIVERGED, Vt as literal, W as TimelapseRuleInputSchema, Wt as partialRecord, X as alarmPanelCapability, Y as addonWidgetsSourceCapability, Z as assertTimelapseCadences, _ as MACRO_LABELS, _t as pickClusterStepModels, a as COCO_TO_MACRO, b as NC_DEFAULT_SNOOZE_MINUTES, bt as readDeviceStateFrom, ct as faceGalleryCapability, d as DeclaredDevices, dt as isDetectionMacroClass, et as buildEventKindDescriptor, f as EVENT_KIND_BY_CAP, ft as isScheduleActive, g as LabelAttributionSchema, h as FailureCounters, ht as notificationRulesCapability, i as CLUSTER_MODEL_SCOPED_STEPS, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as DeviceType, k as NcSnoozeInputSchema, kt as errMsg, l as DETECTION_MACRO_CLASSES, lt as failureContributionCapability, m as FULL_IMAGE_BBOX, mt as kebabToCamel, n as AnalyticsGroupRecordSchema, nt as customAction, o as DEFAULT_EVENT_COLOR, ot as encodeVectorBase64, p as EVENT_PAD_MS, pt as isSourceCap, q as TrackSourceSchema, qt as unknown, r as BaseDevice, rt as defineCustomActions, st as evaluateSensorEdge, t as AnalyticsGroupDetailSchema, tt as cosineSimilarity$1, v as NC_ALARM_SYSTEM_EVENT_KINDS, vt as pipelineAnalyticsCapability, w as NcRuleInputSchema, wt as subKindsOf, xt as readTimelapseGeneratedAt, y as NC_CONDITION_CATALOG, yt as plateGalleryCapability, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as boolean } from "../dist-C8cA7PX_.mjs";
+import { $ as audioModeOf, A as NcSnoozeSchema, At as BaseAddon, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as discriminatedUnion, C as NcConditionDescriptorSchema, Ct as sceneMonitorCapability, D as NcRuleTargetSchema, Dt as videoclipsCapability, E as NcRuleSchema, Et as vectorDimFromBase64, Ft as nodePin, G as TimelapseRulePatchSchema, Gt as record, H as SceneMonitorSchema, Ht as number, I as RECORDING_EXPORT_MAX_READ_BYTES, It as sleep, J as VISIT_MERGE_GAP_MS, Jt as EventCategory, K as TimelapseRuleSchema, Kt as string, L as RetrainStatusSchema, Lt as _enum, M as NcSystemEventKindSchema, Mt as createEvent, N as NcTaxonomySchema, Nt as hydrateSchema, O as NcScheduleSchema, Ot as zoneAnalyticsCapability, P as OpsLogEntrySchema, Pt as isDeviceScopedCap, Q as audioMetricsCapability, Rt as array, S as NC_TAXONOMY, T as NcRulePatchSchema, Tt as systemEventFilterApplies, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as object, V as SCENE_DIVERGED, Vt as literal, W as TimelapseRuleInputSchema, Wt as partialRecord, X as alarmPanelCapability, Y as addonWidgetsSourceCapability, Z as assertTimelapseCadences, _ as MACRO_LABELS, _t as pickClusterStepModels, a as COCO_TO_MACRO, b as NC_DEFAULT_SNOOZE_MINUTES, bt as readDeviceStateFrom, ct as faceGalleryCapability, d as DeclaredDevices, dt as isDetectionMacroClass, et as buildEventKindDescriptor, f as EVENT_KIND_BY_CAP, ft as isScheduleActive, g as LabelAttributionSchema, h as FailureCounters, ht as notificationRulesCapability, i as CLUSTER_MODEL_SCOPED_STEPS, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as DeviceType, k as NcSnoozeInputSchema, kt as errMsg, l as DETECTION_MACRO_CLASSES, lt as failureContributionCapability, m as FULL_IMAGE_BBOX, mt as kebabToCamel, n as AnalyticsGroupRecordSchema, nt as customAction, o as DEFAULT_EVENT_COLOR, ot as encodeVectorBase64, p as EVENT_PAD_MS, pt as isSourceCap, q as TrackSourceSchema, qt as unknown, r as BaseDevice, rt as defineCustomActions, st as evaluateSensorEdge, t as AnalyticsGroupDetailSchema, tt as cosineSimilarity$1, v as NC_ALARM_SYSTEM_EVENT_KINDS, vt as pipelineAnalyticsCapability, w as NcRuleInputSchema, wt as subKindsOf, xt as readTimelapseGeneratedAt, y as NC_CONDITION_CATALOG, yt as plateGalleryCapability, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as boolean } from "../dist-B5K63Zmt.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -6263,12 +6263,86 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/system-event-tap-url.ts
+/** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
+var ADMIN_ADDONS_PATH = "/system/addons";
+var ADMIN_CLUSTER_PATH = "/system/cluster";
+var ADMIN_DEVICES_PATH = "/devices";
+/**
+* The query parameter naming a node.
+*
+* One spelling for both admin pages, mirrored by `NODE_PARAM` in
+* `packages/addon-admin-ui/src/lib/node-url-selection.ts` and pinned across
+* the two packages by `scripts/check-notification-tap-targets.ts`.
+*/
+var NODE_PARAM = "node";
+/** The device page's top-level tab parameter, read by `DeviceDetail`. */
+var TAB_PARAM = "tab";
+/** The Stream Broker tab id — a `WELL_KNOWN_TABS` member, hoisted `top-tab`. */
+var STREAM_BROKER_TAB = "stream-broker";
+/** `DeviceType.Camera`. Spelled here rather than imported so this stays a pure
+*  string map with no device-model dependency; the guard pins it. */
+var CAMERA_DEVICE_TYPE = "camera";
+/** Kinds whose action is "go and apply an ADDON update". */
+var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
+/** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
+var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
+/**
+* Kinds whose action is "go and look at why this camera stopped producing".
+*
+* The legacy `camera-offline` is here for the same reason it is still in the
+* enum: outbox and history rows enqueued before the rename carry it, and an
+* old row is exactly the one whose action has to keep working.
+*/
+var DEVICE_DOWN_KINDS = new Set([
+	"device-offline",
+	"stream-offline",
+	"camera-offline"
+]);
+/**
+* Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
+*
+* A stream belongs to a camera and nothing else. The legacy `camera-offline`
+* is one too — that name is precisely the claim it made, and it is why the
+* kind was split into `device-offline` + a `deviceTypes` condition.
+*/
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set(["stream-offline", "camera-offline"]);
+function withParam(path, key, value) {
+	if (value === void 0 || value.length === 0) return path;
+	return `${path}?${key}=${encodeURIComponent(value)}`;
+}
+/**
+* The admin path (with its query) a system event taps through to, or `null`
+* when the kind has no action.
+*
+* Exported for the cross-package guard and for tests that want the path
+* without a base; the dispatcher goes through {@link systemEventTapUrl}.
+*/
+function systemEventTapPath(subject) {
+	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
+	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
+	if (DEVICE_DOWN_KINDS.has(subject.kind)) {
+		const deviceId = subject.deviceId;
+		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
+		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
+		return CAMERA_BY_CONSTRUCTION_KINDS.has(subject.kind) || subject.deviceType === CAMERA_DEVICE_TYPE ? withParam(devicePath, TAB_PARAM, STREAM_BROKER_TAB) : devicePath;
+	}
+	return null;
+}
+/** Full URL, or `null` when the kind has no action or no base is reachable. */
+function systemEventTapUrl(subject, baseUrl) {
+	if (baseUrl === null || baseUrl.length === 0) return null;
+	const path = systemEventTapPath(subject);
+	if (path === null) return null;
+	return `${baseUrl.replace(/\/+$/, "")}${path}`;
+}
+//#endregion
 //#region src/notification-center/default-tap-url.ts
 /** The viewer's hosted base path under the hub. */
 var VIEWER_BASE_PATH = "/viewer/camstack";
 function defaultTapUrl(input) {
-	if (input.systemEvent === true) return null;
 	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (input.systemEvent !== void 0) return systemEventTapUrl(input.systemEvent, input.baseUrl);
 	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
 	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
 }
@@ -8861,13 +8935,14 @@ function trailAt(trail, timestamp) {
 * cannot be asked (no trail, no polygon) or when nobody qualifies.
 */
 function selectTriggerZoneCandidates(input) {
-	const { candidates, trail, polygons } = input;
+	const { candidates, trail, polygons, strict } = input;
 	if (candidates.length === 0 || trail.length === 0 || polygons.length === 0) return candidates;
 	const qualifying = candidates.filter((candidate) => {
 		const point = trailAt(trail, candidate.timestamp);
 		return point !== null && zoneOverlap(point, polygons) > 0;
 	});
-	return qualifying.length > 0 ? qualifying : candidates;
+	if (qualifying.length > 0) return qualifying;
+	return strict === true ? [] : candidates;
 }
 //#endregion
 //#region src/notification-center/dispatcher.ts
@@ -8905,6 +8980,24 @@ var NC_STILL_WAIT_MS = 3e3;
 * is the instant; the ladder then runs among the frames that are about it.
 */
 var NC_TRIGGER_STILL_MAX_AGE_MS = TRAIL_MATCH_MAX_MS;
+/**
+* Whether this row's subject can still be photographed AGAIN after its trigger.
+*
+* The one thing that separates a row worth waiting for from a row whose only
+* frame already exists. A live visual track keeps writing media for as long as
+* it is open — its first frame, its periodic snapshots, its last frame all land
+* after the instant a zone condition fired. Every other record is photographed
+* once: an audio window, a device event and a package event are served by the
+* still shelf, which D178 makes take ONE picture for a whole burst, and a
+* `track-end` row is by definition past the last of them.
+*
+* Waiting on the wrong side of this line has cost both ways in production — 3 s
+* of latency on a scream when nothing more was coming, and an empty doorstep on
+* 'Persona su Uscio' when something was.
+*/
+function canStillGainMedia(entry) {
+	return entry.recordKind === "object-event";
+}
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -9384,7 +9477,12 @@ var NcDispatcher = class {
 			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
 			timestampMs: subject.timestamp,
 			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
-			systemEvent: systemEvent !== void 0
+			...systemEvent !== void 0 ? { systemEvent: {
+				kind: systemEvent.kind,
+				...systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {},
+				...systemEvent.deviceType !== void 0 ? { deviceType: systemEvent.deviceType } : {},
+				...systemEvent.nodeId !== void 0 ? { nodeId: systemEvent.nodeId } : {}
+			} } : {}
 		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
@@ -9519,7 +9617,7 @@ var NcDispatcher = class {
 		const out = [];
 		const zoneIdsWanted = entry.payload.mediaZoneIds;
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
-		const firstLook = await this.resolveAttachment(entry, stillOverride, "any");
+		const firstLook = await this.resolveAttachment(entry, stillOverride, canStillGainMedia(entry) ? "trigger-only" : "any");
 		const footagePending = this.renderFootage(entry);
 		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : await this.waitForStill(entry, stillOverride);
 		const footage = await footagePending;
@@ -9763,20 +9861,34 @@ var NcDispatcher = class {
 	* throw. And when nothing qualifies, the full list comes back: a real picture
 	* beats no picture (the same rule D212 settled for the best shot).
 	*/
-	async narrowToTriggerZone(entry, ordered) {
+	async narrowToTriggerZone(entry, ordered, freshness) {
 		const zoneIds = entry.payload.triggerZoneIds;
 		const trackId = entry.payload.subject.trackId;
 		const getTrail = this.deps.getSubjectTrail;
 		const deviceId = entry.payload.subject.deviceId;
-		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2) return ordered;
+		const strict = freshness === "trigger-only";
+		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2 && !strict) return ordered;
 		try {
 			const [polygons, trail] = await Promise.all([this.deps.getZonePolygons?.(deviceId, zoneIds) ?? Promise.resolve([]), getTrail(deviceId, trackId)]);
 			const kept = selectTriggerZoneCandidates({
 				candidates: ordered,
 				trail,
 				polygons,
-				triggerAt: entry.payload.subject.timestamp
+				triggerAt: entry.payload.subject.timestamp,
+				strict
 			});
+			if (kept.length === 0) {
+				this.deps.logger.debug("no still from the zone that fired the rule — still waiting", {
+					tags: { deviceId },
+					meta: {
+						ruleId: entry.ruleId,
+						trackId,
+						zoneIds: zoneIds.join(","),
+						rejected: ordered.length
+					}
+				});
+				return kept;
+			}
 			if (kept.length === ordered.length) return kept;
 			this.deps.logger.info("still narrowed to the zone that fired the rule", {
 				tags: { deviceId },
@@ -9856,7 +9968,8 @@ var NcDispatcher = class {
 			for (const kind of preference) for (const file of files) if (file.kind === kind) ordered.push(file);
 			const inBand = this.narrowToTriggerInstant(entry, ordered, freshness);
 			if (inBand.length === 0) continue;
-			const shortlist = await this.narrowToTriggerZone(entry, inBand);
+			const shortlist = await this.narrowToTriggerZone(entry, inBand, freshness);
+			if (shortlist.length === 0) continue;
 			for (const file of shortlist) {
 				const raw = Buffer.from(file.base64, "base64");
 				if (raw.byteLength === 0) continue;
@@ -25487,13 +25600,46 @@ var MEDIA_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var MEDIA_INDEXES = [{
-	name: "idx_media_owner",
-	columns: ["ownerKind", "ownerId"]
-}, {
-	name: "idx_media_device_ts",
-	columns: ["deviceId", "timestamp"]
-}];
+var MEDIA_INDEXES = [
+	{
+		name: "idx_media_owner",
+		columns: ["ownerKind", "ownerId"]
+	},
+	{
+		name: "idx_media_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	(
+	/**
+	* The `locationId IS NULL` seal gate — see `media-relocate-engine.ts`.
+	*
+	* NULLs sort FIRST in a SQLite index, so `WHERE locationId IS NULL` is a
+	* contiguous range from the head of the b-tree: its cost is proportional to
+	* the ANSWER, not to the table. That is the property the gate needs. The
+	* question it must answer fastest is "are there none left", and with this
+	* index that is one seek that immediately falls off the end of an empty
+	* range — regardless of how many million stamped rows sit behind it.
+	*
+	* **What it costs.** One extra b-tree maintained by every insert into a
+	* table taking ~92 k rows/day, and roughly 25 bytes of index per row (~30 MB
+	* at 1.25 M rows). At ~1 insert/s sustained that maintenance is noise
+	* against the JPEG write the same call performs. The one-off cost is real
+	* and worth naming: the FIRST declare after this ships builds the index over
+	* every existing row, on a recordings volume that is currently saturated —
+	* expect the analytics addon's boot to stall for tens of seconds to a couple
+	* of minutes, once.
+	*
+	* A PARTIAL index (`WHERE locationId IS NULL`) would be smaller still and
+	* would cost nothing at all once sealed. It is not used because
+	* `CollectionIndexSchema` has no predicate and the schema fingerprint does
+	* not hash one — adding both to serve one query is a bigger change than the
+	* query deserves, and the plain index already makes the gate O(log n).
+	*/
+	{
+		name: "idx_media_location",
+		columns: ["locationId"]
+	})
+];
 /** The storage location of a media row/record: its stamped `locationId`, or
 *  the default `eventMedia` location for NULL (pre-multi-location) rows. */
 var DEFAULT_MEDIA_LOCATION = "eventMedia";
@@ -41066,13 +41212,29 @@ var RETRAIN_FRAME_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var RETRAIN_FRAME_INDEXES = [{
-	name: "idx_retrain_frames_track",
-	columns: ["trackId"]
-}, {
-	name: "idx_retrain_frames_device",
-	columns: ["deviceId", "copiedAt"]
-}];
+var RETRAIN_FRAME_INDEXES = [
+	{
+		name: "idx_retrain_frames_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_retrain_frames_device",
+		columns: ["deviceId", "copiedAt"]
+	},
+	(
+	/**
+	* The seal gate's other half. This collection is orders of magnitude smaller
+	* than `pipeline-analytics:media` — every row is an operator-staged frame —
+	* so the index buys much less here. It exists anyway because the gate reads
+	* the two lanes with ONE query shape, and a lane that answers by scanning is
+	* a lane that starts timing out the day the dataset grows. See
+	* `MEDIA_INDEXES` for the cost this is a small multiple of.
+	*/
+	{
+		name: "idx_retrain_frames_location",
+		columns: ["locationId"]
+	})
+];
 /**
 * The copy's id, derived from `(trackId, sourceMediaKey)`.
 *
@@ -44337,14 +44499,27 @@ function snapshot(j) {
 	};
 }
 /**
+* The column both walked collections use for the storage location.
+*
+* Named once because it is now a QUERY PREDICATE (`where: { [it]: null }`) as
+* well as a row field. A predicate naming a column the collection cannot
+* express is refused by `count` rather than dropped, so a rename that misses
+* one site fails loudly instead of counting the whole table.
+*/
+var LOCATION_ID_FIELD = "locationId";
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
 * helper collapses "unstamped" and "stamped with the bare type ref" into one
 * answer, and only the first is a row whose meaning changes under a repoint.
+*
+* The in-JS twin of the `IS NULL` predicate {@link MediaRelocateEngine.countUnstamped}
+* sends. It stays because the PASS still walks rows and must decide per row;
+* the two must agree, and `unstamped-count-matches-the-pass` asserts they do.
 */
 function rowIsUnstamped(data) {
-	const id = data["locationId"];
+	const id = data[LOCATION_ID_FIELD];
 	return !(typeof id === "string" && id.length > 0);
 }
 /** True for the enrolled-gallery rows `move` skips and `gallery` selects. */
@@ -44402,26 +44577,91 @@ var MediaRelocateEngine = class {
 		return true;
 	}
 	/**
-	* How many rows still carry no `locationId`, per collection.
+	* Rows that still carry no `locationId`, per collection.
 	*
-	* Read-only, and the ONLY number the migration planner's non-blocking gate
-	* is allowed to trust: it is counted here, against the rows themselves,
+	* Read-only, and the ONLY answer the migration planner's non-blocking gate
+	* is allowed to trust: it is measured here, against the rows themselves,
 	* rather than inferred from "a seal job reported done" — a seal that failed
 	* some rows still reports a terminal state.
+	*
+	* ── Why this is not the walk the rest of this file uses ──────────────────
+	*
+	* It used to be. It paged both collections through {@link pageRows} — 200
+	* rows per RPC, ordered by `timestamp`, a column that leads no index — and
+	* counted `rowIsUnstamped` in JS. On the live hub that is ~6 300 round trips
+	* over 1 254 576 rows, each paying its own sort, and it hit the 60 s RPC
+	* deadline **every time it was called since it shipped**. The gate it exists
+	* to serve could therefore never open, and 152 GB of event media could not
+	* be migrated.
+	*
+	* The walk is right for the PASS, which must visit every row to act on it.
+	* It was never right for a question the store can answer with a predicate,
+	* and the predicate is now expressible: `where: { locationId: null }`
+	* compiles to `IS NULL` (it used to compile to `= NULL`, which matches
+	* nothing and reports it as an answer — the number the gate treats as "safe
+	* to cut over"). With `idx_media_location` in place both statements read a
+	* contiguous range from the head of a b-tree.
+	*
+	* The cheap question is asked FIRST and on its own. `present` is a single
+	* seek and decides the gate; `rows` is a second statement and only decorates
+	* the refusal. So a count that cannot be taken still leaves a usable answer
+	* — `{ present: true, rows: null }` refuses just as hard — and `null` never
+	* degrades into `0`.
 	*/
 	async countUnstamped() {
-		const media = await this.countUnstampedIn(MEDIA_COLLECTION, "timestamp");
-		const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION, "copiedAt");
-		return {
-			media,
-			retrainFrames,
-			total: media + retrainFrames
-		};
+		try {
+			const media = await this.countUnstampedIn(MEDIA_COLLECTION);
+			const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION);
+			return {
+				media,
+				retrainFrames,
+				anyPresent: media.present || retrainFrames.present,
+				total: media.rows === null || retrainFrames.rows === null ? null : media.rows + retrainFrames.rows
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: could not determine whether any row is unstamped — a migration must treat this as unknown, never as sealed", { meta: { error: String(err) } });
+			return null;
+		}
 	}
-	async countUnstampedIn(collection, orderField) {
-		let unstamped = 0;
-		for await (const row of this.pageRows(collection, orderField)) if (rowIsUnstamped(row.data)) unstamped++;
-		return unstamped;
+	/**
+	* One collection's unstamped population: existence, then size.
+	*
+	* The `limit: 1` probe is deliberately a `query` and not a `count`: a count
+	* of a million matching rows still walks a million index entries, while the
+	* probe stops at the first one. Absence is proved by the same seek finding
+	* nothing, which is where the index earns its keep — after a seal, the range
+	* is empty and the answer is one b-tree descent.
+	*/
+	async countUnstampedIn(collection) {
+		if ((await this.deps.store.query.query({
+			collection,
+			filter: {
+				where: { [LOCATION_ID_FIELD]: null },
+				limit: 1
+			},
+			columns: [LOCATION_ID_FIELD]
+		})).length === 0) return {
+			present: false,
+			rows: 0
+		};
+		try {
+			return {
+				present: true,
+				rows: await this.deps.store.count.query({
+					collection,
+					filter: { where: { [LOCATION_ID_FIELD]: null } }
+				})
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: unstamped rows exist but could not be counted — reporting the population as unknown, not as empty", { meta: {
+				collection,
+				error: String(err)
+			} });
+			return {
+				present: true,
+				rows: null
+			};
+		}
 	}
 	start(input) {
 		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DZGvAMuh.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-bK-ELdFD.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.150",
+  "version": "1.2.151",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",