@camstack/addon-post-analysis 1.2.150 → 1.2.152

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as audioModeOf, A as NcSnoozeSchema, At as BaseAddon, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as discriminatedUnion, C as NcConditionDescriptorSchema, Ct as sceneMonitorCapability, D as NcRuleTargetSchema, Dt as videoclipsCapability, E as NcRuleSchema, Et as vectorDimFromBase64, Ft as nodePin, G as TimelapseRulePatchSchema, Gt as record, H as SceneMonitorSchema, Ht as number, I as RECORDING_EXPORT_MAX_READ_BYTES, It as sleep, J as VISIT_MERGE_GAP_MS, Jt as EventCategory, K as TimelapseRuleSchema, Kt as string, L as RetrainStatusSchema, Lt as _enum, M as NcSystemEventKindSchema, Mt as createEvent, N as NcTaxonomySchema, Nt as hydrateSchema, O as NcScheduleSchema, Ot as zoneAnalyticsCapability, P as OpsLogEntrySchema, Pt as isDeviceScopedCap, Q as audioMetricsCapability, Rt as array, S as NC_TAXONOMY, T as NcRulePatchSchema, Tt as systemEventFilterApplies, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as object, V as SCENE_DIVERGED, Vt as literal, W as TimelapseRuleInputSchema, Wt as partialRecord, X as alarmPanelCapability, Y as addonWidgetsSourceCapability, Z as assertTimelapseCadences, _ as MACRO_LABELS, _t as pickClusterStepModels, a as COCO_TO_MACRO, b as NC_DEFAULT_SNOOZE_MINUTES, bt as readDeviceStateFrom, ct as faceGalleryCapability, d as DeclaredDevices, dt as isDetectionMacroClass, et as buildEventKindDescriptor, f as EVENT_KIND_BY_CAP, ft as isScheduleActive, g as LabelAttributionSchema, h as FailureCounters, ht as notificationRulesCapability, i as CLUSTER_MODEL_SCOPED_STEPS, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as DeviceType, k as NcSnoozeInputSchema, kt as errMsg, l as DETECTION_MACRO_CLASSES, lt as failureContributionCapability, m as FULL_IMAGE_BBOX, mt as kebabToCamel, n as AnalyticsGroupRecordSchema, nt as customAction, o as DEFAULT_EVENT_COLOR, ot as encodeVectorBase64, p as EVENT_PAD_MS, pt as isSourceCap, q as TrackSourceSchema, qt as unknown, r as BaseDevice, rt as defineCustomActions, st as evaluateSensorEdge, t as AnalyticsGroupDetailSchema, tt as cosineSimilarity$1, v as NC_ALARM_SYSTEM_EVENT_KINDS, vt as pipelineAnalyticsCapability, w as NcRuleInputSchema, wt as subKindsOf, xt as readTimelapseGeneratedAt, y as NC_CONDITION_CATALOG, yt as plateGalleryCapability, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as boolean } from "../dist-C8cA7PX_.mjs";
+import { $ as audioModeOf, A as NcSnoozeSchema, At as BaseAddon, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as discriminatedUnion, C as NcConditionDescriptorSchema, Ct as sceneMonitorCapability, D as NcRuleTargetSchema, Dt as videoclipsCapability, E as NcRuleSchema, Et as vectorDimFromBase64, Ft as nodePin, G as TimelapseRulePatchSchema, Gt as record, H as SceneMonitorSchema, Ht as number, I as RECORDING_EXPORT_MAX_READ_BYTES, It as sleep, J as VISIT_MERGE_GAP_MS, Jt as EventCategory, K as TimelapseRuleSchema, Kt as string, L as RetrainStatusSchema, Lt as _enum, M as NcSystemEventKindSchema, Mt as createEvent, N as NcTaxonomySchema, Nt as hydrateSchema, O as NcScheduleSchema, Ot as zoneAnalyticsCapability, P as OpsLogEntrySchema, Pt as isDeviceScopedCap, Q as audioMetricsCapability, Rt as array, S as NC_TAXONOMY, T as NcRulePatchSchema, Tt as systemEventFilterApplies, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as object, V as SCENE_DIVERGED, Vt as literal, W as TimelapseRuleInputSchema, Wt as partialRecord, X as alarmPanelCapability, Y as addonWidgetsSourceCapability, Z as assertTimelapseCadences, _ as MACRO_LABELS, _t as pickClusterStepModels, a as COCO_TO_MACRO, b as NC_DEFAULT_SNOOZE_MINUTES, bt as readDeviceStateFrom, ct as faceGalleryCapability, d as DeclaredDevices, dt as isDetectionMacroClass, et as buildEventKindDescriptor, f as EVENT_KIND_BY_CAP, ft as isScheduleActive, g as LabelAttributionSchema, h as FailureCounters, ht as notificationRulesCapability, i as CLUSTER_MODEL_SCOPED_STEPS, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as DeviceType, k as NcSnoozeInputSchema, kt as errMsg, l as DETECTION_MACRO_CLASSES, lt as failureContributionCapability, m as FULL_IMAGE_BBOX, mt as kebabToCamel, n as AnalyticsGroupRecordSchema, nt as customAction, o as DEFAULT_EVENT_COLOR, ot as encodeVectorBase64, p as EVENT_PAD_MS, pt as isSourceCap, q as TrackSourceSchema, qt as unknown, r as BaseDevice, rt as defineCustomActions, st as evaluateSensorEdge, t as AnalyticsGroupDetailSchema, tt as cosineSimilarity$1, v as NC_ALARM_SYSTEM_EVENT_KINDS, vt as pipelineAnalyticsCapability, w as NcRuleInputSchema, wt as subKindsOf, xt as readTimelapseGeneratedAt, y as NC_CONDITION_CATALOG, yt as plateGalleryCapability, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as boolean } from "../dist-DSg_jDMt.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -5406,12 +5406,6 @@ function buildAlarmButtons(input) {
 	}];
 }
 //#endregion
-//#region src/notification-center/cap-caller.ts
-function requireCapCaller(method, caller) {
-	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
-	return caller;
-}
-//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -5654,6 +5648,12 @@ var AudioWatcher = class {
 	}
 };
 //#endregion
+//#region src/notification-center/cap-caller.ts
+function requireCapCaller(method, caller) {
+	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
+	return caller;
+}
+//#endregion
 //#region src/shared/llm-vision/prompt-hygiene.ts
 /**
 * What a PIPELINE VALUE is allowed to look like once it is inside a prompt.
@@ -6263,12 +6263,107 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/system-event-tap-url.ts
+/** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
+var ADMIN_ADDONS_PATH = "/system/addons";
+var ADMIN_CLUSTER_PATH = "/system/cluster";
+var ADMIN_DEVICES_PATH = "/devices";
+/**
+* The query parameter naming a node.
+*
+* One spelling for both admin pages, mirrored by `NODE_PARAM` in
+* `packages/addon-admin-ui/src/lib/node-url-selection.ts` and pinned across
+* the two packages by `scripts/check-notification-tap-targets.ts`.
+*/
+var NODE_PARAM = "node";
+/** The device page's top-level tab parameter, read by `DeviceDetail`. */
+var TAB_PARAM = "tab";
+/** The Stream Broker tab id — a `WELL_KNOWN_TABS` member, hoisted `top-tab`. */
+var STREAM_BROKER_TAB = "stream-broker";
+/** `DeviceType.Camera`. Spelled here rather than imported so this stays a pure
+*  string map with no device-model dependency; the guard pins it. */
+var CAMERA_DEVICE_TYPE = "camera";
+/** Kinds whose action is "go and apply an ADDON update". */
+var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
+/** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
+var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
+/**
+* Kinds whose action is "go and look at this device's stream".
+*
+* BOTH DIRECTIONS. A recovery lands on the same page as the failure it undoes,
+* because "did it really come back, and what did it do while it was gone" is
+* an action and the page that answers it is the one the down-notification
+* already opened. On 2026-08-30 the operator's phone showed "Il dispositivo
+* Videocamera sala feste è online" with `tapAction.value: null` — the same
+* camera's `device-offline` an hour earlier opened the Stream Broker tab, and
+* the recovery opened nothing, purely because `device-online` had no entry
+* here.
+*
+* The legacy `camera-*` pair is here for the same reason both are still in the
+* enum: outbox and history rows enqueued before the rename carry them, and an
+* old row is exactly the one whose action has to keep working.
+*
+* Kinds NOT here are kinds whose DOWN direction has no action either
+* (`node-online`/`node-offline`, `device-enabled`/`device-disabled`) — a
+* recovery does not earn a destination its failure was never given.
+*/
+var DEVICE_STREAM_KINDS = new Set([
+	"device-offline",
+	"device-online",
+	"stream-offline",
+	"stream-online",
+	"camera-offline",
+	"camera-online"
+]);
+/**
+* Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
+*
+* A stream belongs to a camera and nothing else. The legacy `camera-*` pair is
+* too — that name is precisely the claim it made, and it is why the kind was
+* split into `device-*` + a `deviceTypes` condition.
+*/
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set([
+	"stream-offline",
+	"stream-online",
+	"camera-offline",
+	"camera-online"
+]);
+function withParam(path, key, value) {
+	if (value === void 0 || value.length === 0) return path;
+	return `${path}?${key}=${encodeURIComponent(value)}`;
+}
+/**
+* The admin path (with its query) a system event taps through to, or `null`
+* when the kind has no action.
+*
+* Exported for the cross-package guard and for tests that want the path
+* without a base; the dispatcher goes through {@link systemEventTapUrl}.
+*/
+function systemEventTapPath(subject) {
+	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
+	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
+	if (DEVICE_STREAM_KINDS.has(subject.kind)) {
+		const deviceId = subject.deviceId;
+		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
+		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
+		return CAMERA_BY_CONSTRUCTION_KINDS.has(subject.kind) || subject.deviceType === CAMERA_DEVICE_TYPE ? withParam(devicePath, TAB_PARAM, STREAM_BROKER_TAB) : devicePath;
+	}
+	return null;
+}
+/** Full URL, or `null` when the kind has no action or no base is reachable. */
+function systemEventTapUrl(subject, baseUrl) {
+	if (baseUrl === null || baseUrl.length === 0) return null;
+	const path = systemEventTapPath(subject);
+	if (path === null) return null;
+	return `${baseUrl.replace(/\/+$/, "")}${path}`;
+}
+//#endregion
 //#region src/notification-center/default-tap-url.ts
 /** The viewer's hosted base path under the hub. */
 var VIEWER_BASE_PATH = "/viewer/camstack";
 function defaultTapUrl(input) {
-	if (input.systemEvent === true) return null;
 	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (input.systemEvent !== void 0) return systemEventTapUrl(input.systemEvent, input.baseUrl);
 	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
 	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
 }
@@ -8861,13 +8956,14 @@ function trailAt(trail, timestamp) {
 * cannot be asked (no trail, no polygon) or when nobody qualifies.
 */
 function selectTriggerZoneCandidates(input) {
-	const { candidates, trail, polygons } = input;
+	const { candidates, trail, polygons, strict } = input;
 	if (candidates.length === 0 || trail.length === 0 || polygons.length === 0) return candidates;
 	const qualifying = candidates.filter((candidate) => {
 		const point = trailAt(trail, candidate.timestamp);
 		return point !== null && zoneOverlap(point, polygons) > 0;
 	});
-	return qualifying.length > 0 ? qualifying : candidates;
+	if (qualifying.length > 0) return qualifying;
+	return strict === true ? [] : candidates;
 }
 //#endregion
 //#region src/notification-center/dispatcher.ts
@@ -8905,6 +9001,24 @@ var NC_STILL_WAIT_MS = 3e3;
 * is the instant; the ladder then runs among the frames that are about it.
 */
 var NC_TRIGGER_STILL_MAX_AGE_MS = TRAIL_MATCH_MAX_MS;
+/**
+* Whether this row's subject can still be photographed AGAIN after its trigger.
+*
+* The one thing that separates a row worth waiting for from a row whose only
+* frame already exists. A live visual track keeps writing media for as long as
+* it is open — its first frame, its periodic snapshots, its last frame all land
+* after the instant a zone condition fired. Every other record is photographed
+* once: an audio window, a device event and a package event are served by the
+* still shelf, which D178 makes take ONE picture for a whole burst, and a
+* `track-end` row is by definition past the last of them.
+*
+* Waiting on the wrong side of this line has cost both ways in production — 3 s
+* of latency on a scream when nothing more was coming, and an empty doorstep on
+* 'Persona su Uscio' when something was.
+*/
+function canStillGainMedia(entry) {
+	return entry.recordKind === "object-event";
+}
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -9384,7 +9498,12 @@ var NcDispatcher = class {
 			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
 			timestampMs: subject.timestamp,
 			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
-			systemEvent: systemEvent !== void 0
+			...systemEvent !== void 0 ? { systemEvent: {
+				kind: systemEvent.kind,
+				...systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {},
+				...systemEvent.deviceType !== void 0 ? { deviceType: systemEvent.deviceType } : {},
+				...systemEvent.nodeId !== void 0 ? { nodeId: systemEvent.nodeId } : {}
+			} } : {}
 		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
@@ -9519,7 +9638,7 @@ var NcDispatcher = class {
 		const out = [];
 		const zoneIdsWanted = entry.payload.mediaZoneIds;
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
-		const firstLook = await this.resolveAttachment(entry, stillOverride, "any");
+		const firstLook = await this.resolveAttachment(entry, stillOverride, canStillGainMedia(entry) ? "trigger-only" : "any");
 		const footagePending = this.renderFootage(entry);
 		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : await this.waitForStill(entry, stillOverride);
 		const footage = await footagePending;
@@ -9763,20 +9882,34 @@ var NcDispatcher = class {
 	* throw. And when nothing qualifies, the full list comes back: a real picture
 	* beats no picture (the same rule D212 settled for the best shot).
 	*/
-	async narrowToTriggerZone(entry, ordered) {
+	async narrowToTriggerZone(entry, ordered, freshness) {
 		const zoneIds = entry.payload.triggerZoneIds;
 		const trackId = entry.payload.subject.trackId;
 		const getTrail = this.deps.getSubjectTrail;
 		const deviceId = entry.payload.subject.deviceId;
-		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2) return ordered;
+		const strict = freshness === "trigger-only";
+		if (zoneIds === void 0 || zoneIds.length === 0 || trackId === void 0 || getTrail === void 0 || ordered.length < 2 && !strict) return ordered;
 		try {
 			const [polygons, trail] = await Promise.all([this.deps.getZonePolygons?.(deviceId, zoneIds) ?? Promise.resolve([]), getTrail(deviceId, trackId)]);
 			const kept = selectTriggerZoneCandidates({
 				candidates: ordered,
 				trail,
 				polygons,
-				triggerAt: entry.payload.subject.timestamp
+				triggerAt: entry.payload.subject.timestamp,
+				strict
 			});
+			if (kept.length === 0) {
+				this.deps.logger.debug("no still from the zone that fired the rule — still waiting", {
+					tags: { deviceId },
+					meta: {
+						ruleId: entry.ruleId,
+						trackId,
+						zoneIds: zoneIds.join(","),
+						rejected: ordered.length
+					}
+				});
+				return kept;
+			}
 			if (kept.length === ordered.length) return kept;
 			this.deps.logger.info("still narrowed to the zone that fired the rule", {
 				tags: { deviceId },
@@ -9856,7 +9989,8 @@ var NcDispatcher = class {
 			for (const kind of preference) for (const file of files) if (file.kind === kind) ordered.push(file);
 			const inBand = this.narrowToTriggerInstant(entry, ordered, freshness);
 			if (inBand.length === 0) continue;
-			const shortlist = await this.narrowToTriggerZone(entry, inBand);
+			const shortlist = await this.narrowToTriggerZone(entry, inBand, freshness);
+			if (shortlist.length === 0) continue;
 			for (const file of shortlist) {
 				const raw = Buffer.from(file.base64, "base64");
 				if (raw.byteLength === 0) continue;
@@ -10610,16 +10744,26 @@ function incomingFromUpdateAvailable(facts, data) {
 		...nodeIds.length > 0 ? { nodeIds } : {}
 	});
 }
-/** Version-bearing `addon.updated` only — settings saves carry neither. */
+/**
+* Version-bearing `addon.updated` only — a settings save carries no versions
+* at all (`BaseAddon.updateGlobalSettings`).
+*
+* `toVersion` IS the discriminator, and `fromVersion` is not: the emitter
+* omits the predecessor when it cannot read what was installed (a first
+* install, an unreadable tree). Requiring both dropped those updates on the
+* floor entirely — the operator got no notification for an update that
+* happened — which is the price that was being paid to keep `'0.0.0'`
+* out. Report the half that is known; say nothing about the half that is not.
+*/
 function parseAddonUpdateComplete(data) {
 	const packageName = stringField(data, "packageName");
 	const fromVersion = stringField(data, "fromVersion");
 	const toVersion = stringField(data, "toVersion");
-	if (packageName === void 0 || fromVersion === void 0 || toVersion === void 0) return null;
+	if (packageName === void 0 || toVersion === void 0) return null;
 	const nodeId = stringField(data, "agent") ?? stringField(data, "nodeId");
 	return {
 		packageName,
-		fromVersion,
+		...fromVersion !== void 0 ? { fromVersion } : {},
 		toVersion,
 		...nodeId !== void 0 ? { nodeId } : {}
 	};
@@ -10629,7 +10773,10 @@ function incomingFromAddonUpdates(facts, updates) {
 	const packageNames = unique(updates.map((update) => update.packageName));
 	const nodeIds = unique(updates.map((update) => update.nodeId).filter((id) => id !== void 0));
 	const signature = updates.map((update) => `${update.nodeId ?? ""}:${update.packageName}@${update.toVersion}`).toSorted().join(",");
-	const list = updates.map((update) => update.nodeId !== void 0 ? `${update.packageName} ${update.fromVersion} → ${update.toVersion} (${update.nodeId})` : `${update.packageName} ${update.fromVersion} → ${update.toVersion}`).join("\n");
+	const list = updates.map((update) => {
+		const transition = update.fromVersion !== void 0 ? `${update.fromVersion} → ${update.toVersion}` : `→ ${update.toVersion}`;
+		return update.nodeId !== void 0 ? `${update.packageName} ${transition} (${update.nodeId})` : `${update.packageName} ${transition}`;
+	}).join("\n");
 	const head = updates[0];
 	return systemSubject({
 		facts,
@@ -23451,17 +23598,17 @@ function planRuleTest(input) {
 					deviceName: `camera ${String(systemScope.deviceId ?? deviceId)}`,
 					nodeId: systemScope.nodeId ?? "hub",
 					packageName: systemScope.packageName ?? "@camstack/server",
-					currentVersion: "0.0.0",
-					latestVersion: "0.0.0",
+					currentVersion: "1.0.0",
+					latestVersion: "1.0.1",
 					profile: "low",
 					seconds: "30",
 					devices: "cuda:0",
 					minutes: "15",
 					addons: TEST_CRASHED_RUNNER,
-					list: "@camstack/addon-pipeline 1.0.0 (current 0.0.0)",
+					list: "@camstack/addon-pipeline 1.0.1 (current 1.0.0)",
 					nodes: "hub",
-					fromVersion: "0.0.0",
-					toVersion: "0.0.1",
+					fromVersion: "1.0.0",
+					toVersion: "1.0.1",
 					title: "Export",
 					count: "1"
 				},
@@ -25487,13 +25634,46 @@ var MEDIA_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var MEDIA_INDEXES = [{
-	name: "idx_media_owner",
-	columns: ["ownerKind", "ownerId"]
-}, {
-	name: "idx_media_device_ts",
-	columns: ["deviceId", "timestamp"]
-}];
+var MEDIA_INDEXES = [
+	{
+		name: "idx_media_owner",
+		columns: ["ownerKind", "ownerId"]
+	},
+	{
+		name: "idx_media_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	(
+	/**
+	* The `locationId IS NULL` seal gate — see `media-relocate-engine.ts`.
+	*
+	* NULLs sort FIRST in a SQLite index, so `WHERE locationId IS NULL` is a
+	* contiguous range from the head of the b-tree: its cost is proportional to
+	* the ANSWER, not to the table. That is the property the gate needs. The
+	* question it must answer fastest is "are there none left", and with this
+	* index that is one seek that immediately falls off the end of an empty
+	* range — regardless of how many million stamped rows sit behind it.
+	*
+	* **What it costs.** One extra b-tree maintained by every insert into a
+	* table taking ~92 k rows/day, and roughly 25 bytes of index per row (~30 MB
+	* at 1.25 M rows). At ~1 insert/s sustained that maintenance is noise
+	* against the JPEG write the same call performs. The one-off cost is real
+	* and worth naming: the FIRST declare after this ships builds the index over
+	* every existing row, on a recordings volume that is currently saturated —
+	* expect the analytics addon's boot to stall for tens of seconds to a couple
+	* of minutes, once.
+	*
+	* A PARTIAL index (`WHERE locationId IS NULL`) would be smaller still and
+	* would cost nothing at all once sealed. It is not used because
+	* `CollectionIndexSchema` has no predicate and the schema fingerprint does
+	* not hash one — adding both to serve one query is a bigger change than the
+	* query deserves, and the plain index already makes the gate O(log n).
+	*/
+	{
+		name: "idx_media_location",
+		columns: ["locationId"]
+	})
+];
 /** The storage location of a media row/record: its stamped `locationId`, or
 *  the default `eventMedia` location for NULL (pre-multi-location) rows. */
 var DEFAULT_MEDIA_LOCATION = "eventMedia";
@@ -25578,7 +25758,7 @@ var MediaStore = class {
 		});
 	}
 	/** Persist a media blob and register its metadata row. Returns the
-	*  collection key (MediaFile.key) that callers store as reference. */
+	*  collection key (MediaFileRef.key) that callers store as reference. */
 	async put(params) {
 		if (this.writeGate) return this.writeGate.run(() => this.putUnchecked(params));
 		return this.putUnchecked(params);
@@ -25900,8 +26080,20 @@ var MediaStore = class {
 	* its device at write time, so scoping the query by it makes a media read
 	* for a device the caller cannot name return nothing — the DB itself
 	* enforces the boundary, no post-hoc ownership check to forget.
+	*
+	* `kinds` is the WORK filter, and it belongs here rather than on the answer.
+	* Every row this returns has had its blob read off disk and base64-encoded,
+	* so a caller that filters afterwards has already paid for every kind it is
+	* about to discard: measured on the live hub, one track's six kinds are
+	* 3 597 219 bytes and `thumbnailSmall` is 31 155 of them, and asking for the
+	* small one alone cost exactly as much as asking for all six. `kind` is a
+	* real column (see {@link MEDIA_COLUMNS}), so the narrowing happens in the
+	* query and the blobs of the other kinds are never opened.
+	*
+	* Absent (or empty) means every kind — the back-compat default, and the
+	* honest answer for a caller that has not decided what it needs.
 	*/
-	async listByOwner(ownerKind, ownerId, deviceId) {
+	async listByOwner(ownerKind, ownerId, deviceId, kinds) {
 		const rows = await this.store.query.query({
 			collection: MEDIA_COLLECTION,
 			filter: {
@@ -25913,6 +26105,7 @@ var MediaStore = class {
 					ownerId,
 					deviceId
 				},
+				...kinds !== void 0 && kinds.length > 0 ? { whereIn: { kind: [...kinds] } } : {},
 				orderBy: {
 					field: "timestamp",
 					direction: "asc"
@@ -27828,6 +28021,63 @@ var embeddingActions = defineCustomActions({
 	"embedding.reembedFacesStatus": customAction(NoInputSchema$1, ReembedFacesStatusSchema)
 });
 //#endregion
+//#region src/pipeline-analytics/media-file-url.ts
+/**
+* The plane path for one stored media key.
+*
+* `prefix` is `/addon/<addonId>/event-media` — a pure function of the addon
+* id, so it exists whether or not `dataPlane.serve` succeeded. A row that
+* named no address at all would be the silent drop this repo keeps paying for:
+* a client cannot tell "no bytes" from "no plane", and renders neither.
+*/
+function mediaFileUrl(prefix, key) {
+	return `${prefix}/${encodeURIComponent(key)}`;
+}
+/**
+* A stored row as the wire sees it: the ref, the address, and — transitionally
+* — the bytes.
+*
+* `base64` is copied through ONLY because the deployed viewer's track-detail
+* hero still requires the field to parse a row at all. See the `MediaFile`
+* docblock in `pipeline-analytics.cap.ts`; deleting the field is a one-line
+* change here and one in the schema.
+*
+* `provenance` is deliberately NOT spread: it is store-internal, and the
+* previous `{ ...row, kind }` shape published it by accident.
+*/
+function toWireMediaFile(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp,
+		url: mediaFileUrl(prefix, row.key),
+		base64: row.base64
+	};
+}
+/** The same row without its bytes — the manifest shape. Carries the SAME
+*  `url` as the byte read, so a client never builds the plane path itself. */
+function toWireMediaFileInfo(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp,
+		url: mediaFileUrl(prefix, row.key)
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/gallery-media-row.ts
+function toGalleryMediaRow(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		url: mediaFileUrl(prefix, row.key),
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/include-crops-default.ts
 function resolveIncludeCrops(input) {
 	return input?.includeCrops === true;
@@ -29487,6 +29737,7 @@ var FaceGalleryProvider = class {
 	logger;
 	refreshGallery;
 	eventMediaBaseUrl;
+	eventMediaPathPrefix;
 	emitFaceGalleryChanged;
 	constructor(deps) {
 		this.identityStore = deps.identityStore;
@@ -29497,6 +29748,7 @@ var FaceGalleryProvider = class {
 		this.logger = deps.logger;
 		this.refreshGallery = deps.refreshGallery;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
+		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 		this.emitFaceGalleryChanged = deps.emitFaceGalleryChanged;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
@@ -29684,13 +29936,7 @@ var FaceGalleryProvider = class {
 	* the enrolled identity copies — those live under identity owner).
 	*/
 	async getFaceMedia(input) {
-		return (await this.mediaStore.listByOwner("face", input.faceId)).map((m) => ({
-			key: m.key,
-			kind: m.kind,
-			base64: m.base64,
-			sizeBytes: m.sizeBytes,
-			timestamp: m.timestamp
-		}));
+		return (await this.mediaStore.listByOwner("face", input.faceId)).map((m) => toGalleryMediaRow(m, this.eventMediaPathPrefix()));
 	}
 	/**
 	* Assign a buffered face to an identity:
@@ -32401,209 +32647,6 @@ var FrameProcessor = class {
 		};
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/replay/frame-processor-pass.ts
-/**
-* Run a FRESH `FrameProcessor` over a fixed, ordered sequence of frames and
-* return the tracks it produced.
-*
-* No `TrackStore`, no bus, no media — a track here is a summary built
-* ENTIRELY from `FrameProcessor.process()`'s in-memory return value.
-*/
-function runFrameProcessorPass(input) {
-	const processor = new FrameProcessor(input.deviceId, {}, {}, {}, input.source);
-	if (input.zones !== void 0) processor.setZones(input.zones);
-	if (input.detectionRules !== void 0) processor.setDetectionRules(input.detectionRules);
-	if (input.zoneMembershipMinOverlap !== void 0) processor.setZoneMembershipMinOverlap(input.zoneMembershipMinOverlap);
-	const accum = /* @__PURE__ */ new Map();
-	for (const { timestamp, frame } of input.frames) {
-		const result = processor.process({
-			timestamp,
-			frame
-		});
-		for (const td of result.tracked) {
-			const existing = accum.get(td.trackId);
-			const matched = td.matchedThisFrame ? 1 : 0;
-			if (existing === void 0) accum.set(td.trackId, {
-				className: td.className,
-				firstSeenMs: timestamp,
-				lastSeenMs: timestamp,
-				bbox: { ...td.bbox },
-				framesMatched: matched
-			});
-			else {
-				existing.className = td.className;
-				existing.lastSeenMs = timestamp;
-				existing.framesMatched += matched;
-			}
-		}
-	}
-	return { tracks: [...accum.values()].map((t) => ({
-		className: t.className,
-		firstSeenMs: t.firstSeenMs,
-		lastSeenMs: t.lastSeenMs,
-		bbox: t.bbox,
-		framesMatched: t.framesMatched
-	})) };
-}
-function isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, score) {
-	if (frameWidth <= 0 || frameHeight <= 0) return true;
-	if (score !== void 0 && score >= .5) return true;
-	if (bbox.w * bbox.h / (frameWidth * frameHeight) >= .85) return false;
-	if (bbox.h >= frameHeight * .95) return false;
-	if (bbox.w >= frameWidth * .95) return false;
-	return true;
-}
-/**
-* Minimum fraction of the track's BEST-SEEN bbox area a retry frame's bbox must
-* still cover to be an acceptable best-`thumbnail` RETRY subject. 0.45 tolerates
-* normal breathing of the tracker box (~2/3 per side) while rejecting the
-* degenerate shrink (observed live 2026-07-22: a car born at 78px retried at
-* 26px once the native lease warmed — a ~0.11 area fraction — and the landed
-* "best" thumbnail was a sliver of a distant car).
-*/
-var RETRY_MIN_FRACTION_OF_BEST = .45;
-/**
-* RETRY-ONLY gate (#27-A degenerate-retry fix): on a cold on-motion session the
-* native lease misses the first seconds, so the large-subject captures return
-* null and the per-frame retry re-fires with the CURRENT frame's bbox. By the
-* time the lease warms the subject may have shrunk to a sliver; capturing THAT
-* frame lands a genuine-native-but-useless thumbnail and `thumbnailLanded`
-* stops all further retries. Reject a retry whose current bbox area has
-* collapsed below `minFractionOfBest` of the track's best-seen bbox area.
-*
-* Applies ONLY to the `!thumbnailLanded` retry path — a genuine new-best
-* capture is never routed through this gate (the caller bypasses it on
-* `isNewBest`). With no best-seen reference (or a degenerate one) there is no
-* info to reject on → plausible.
-*/
-function isPlausibleRetryBox(current, bestSeen, minFractionOfBest = RETRY_MIN_FRACTION_OF_BEST) {
-	if (bestSeen === null) return true;
-	const bestArea = bestSeen.w * bestSeen.h;
-	if (bestArea <= 0) return true;
-	return current.w * current.h >= minFractionOfBest * bestArea;
-}
-//#endregion
-//#region src/pipeline-analytics/pipeline/semantic-promotion.ts
-/**
-* Compose the {@link SemanticRecognitionFrame} for a plate read / accepted
-* fine classification. ONE rule, enforced here rather than at the call site:
-* the promoted `bbox` is ALWAYS the SUBJECT box (`frame.bbox`), never the
-* detail box — see {@link DetailAttributionResult.bbox} for what feeding the
-* detail box cost. The face path (`face-recognizer.ts` `onSemanticMatch`)
-* already passes its body box; this keeps the plate/classification path on the
-* same discipline.
-*/
-function semanticFrameForDetailAttribution(deviceId, trackId, detail, frame) {
-	return {
-		deviceId,
-		trackId,
-		timestamp: frame.timestamp,
-		bbox: {
-			x: frame.bbox.x,
-			y: frame.bbox.y,
-			w: frame.bbox.w,
-			h: frame.bbox.h
-		},
-		frameWidth: frame.frameWidth,
-		frameHeight: frame.frameHeight,
-		kind: detail.className === "plate" ? "plate" : "classification",
-		score: detail.score,
-		confidence: frame.confidence,
-		...frame.frameHandle !== void 0 ? { frameHandle: frame.frameHandle } : {}
-	};
-}
-/**
-* Offer the recognition frame to the best-frame ranking with the semantic
-* tier. On a win: record the best-seen bbox (plausible boxes only — an
-* envelope-exploded box must not poison the retry reference, mirroring
-* `buildSnapshotTargets`) and re-fire the captures when the pixels are still
-* reachable.
-*/
-function promoteSemanticBestFrame(deps, input) {
-	const { deviceId, trackId, bbox, frameWidth, frameHeight, timestamp } = input;
-	if (!deps.observeBestFrame({
-		deviceId,
-		trackId,
-		confidence: input.confidence,
-		timestamp,
-		edgeClear: isEdgeClear({
-			bbox,
-			frameWidth,
-			frameHeight
-		}),
-		centerScore: bboxCenterScore(bbox, frameWidth, frameHeight),
-		containment: bboxContainment(bbox, frameWidth, frameHeight),
-		sizeScore: bboxSizeScore(bbox, frameWidth, frameHeight),
-		squareFraction: centralSquareContainmentFraction(bbox, {
-			W: frameWidth,
-			H: frameHeight
-		}),
-		semantic: true
-	})) {
-		deps.logger.debug("best-shot: semantic frame did not beat the held peak", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				kind: input.kind,
-				score: input.score,
-				timestamp
-			}
-		});
-		return {
-			promoted: false,
-			captured: false
-		};
-	}
-	const plausible = isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, input.confidence);
-	if (plausible) deps.recordBestSeenBbox(deviceId, trackId, {
-		x: bbox.x,
-		y: bbox.y,
-		w: bbox.w,
-		h: bbox.h,
-		frameWidth,
-		frameHeight,
-		timestamp
-	});
-	if (!plausible || input.frameHandle === void 0) {
-		deps.logger.info("best-shot: semantic promotion without capture", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				kind: input.kind,
-				score: input.score,
-				timestamp,
-				reason: plausible ? "no frame handle" : "implausible box"
-			}
-		});
-		return {
-			promoted: true,
-			captured: false
-		};
-	}
-	deps.captureBestShot({
-		deviceId,
-		trackId,
-		timestamp,
-		bbox,
-		frameWidth,
-		frameHeight,
-		frameHandle: input.frameHandle
-	});
-	deps.logger.info("best-shot: semantic promotion", {
-		tags: { deviceId },
-		meta: {
-			trackId,
-			kind: input.kind,
-			score: input.score,
-			timestamp
-		}
-	});
-	return {
-		promoted: true,
-		captured: true
-	};
-}
 /** Bounded trackId → pending-upgrade map. Insertion-ordered, so the cap
 *  evicts the oldest record. */
 var PendingPreviewUpgrades = class {
@@ -32735,6 +32778,164 @@ async function runPreviewUpgrade(deps, input) {
 	});
 	return "upgraded";
 }
+function isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, score) {
+	if (frameWidth <= 0 || frameHeight <= 0) return true;
+	if (score !== void 0 && score >= .5) return true;
+	if (bbox.w * bbox.h / (frameWidth * frameHeight) >= .85) return false;
+	if (bbox.h >= frameHeight * .95) return false;
+	if (bbox.w >= frameWidth * .95) return false;
+	return true;
+}
+/**
+* Minimum fraction of the track's BEST-SEEN bbox area a retry frame's bbox must
+* still cover to be an acceptable best-`thumbnail` RETRY subject. 0.45 tolerates
+* normal breathing of the tracker box (~2/3 per side) while rejecting the
+* degenerate shrink (observed live 2026-07-22: a car born at 78px retried at
+* 26px once the native lease warmed — a ~0.11 area fraction — and the landed
+* "best" thumbnail was a sliver of a distant car).
+*/
+var RETRY_MIN_FRACTION_OF_BEST = .45;
+/**
+* RETRY-ONLY gate (#27-A degenerate-retry fix): on a cold on-motion session the
+* native lease misses the first seconds, so the large-subject captures return
+* null and the per-frame retry re-fires with the CURRENT frame's bbox. By the
+* time the lease warms the subject may have shrunk to a sliver; capturing THAT
+* frame lands a genuine-native-but-useless thumbnail and `thumbnailLanded`
+* stops all further retries. Reject a retry whose current bbox area has
+* collapsed below `minFractionOfBest` of the track's best-seen bbox area.
+*
+* Applies ONLY to the `!thumbnailLanded` retry path — a genuine new-best
+* capture is never routed through this gate (the caller bypasses it on
+* `isNewBest`). With no best-seen reference (or a degenerate one) there is no
+* info to reject on → plausible.
+*/
+function isPlausibleRetryBox(current, bestSeen, minFractionOfBest = RETRY_MIN_FRACTION_OF_BEST) {
+	if (bestSeen === null) return true;
+	const bestArea = bestSeen.w * bestSeen.h;
+	if (bestArea <= 0) return true;
+	return current.w * current.h >= minFractionOfBest * bestArea;
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/semantic-promotion.ts
+/**
+* Compose the {@link SemanticRecognitionFrame} for a plate read / accepted
+* fine classification. ONE rule, enforced here rather than at the call site:
+* the promoted `bbox` is ALWAYS the SUBJECT box (`frame.bbox`), never the
+* detail box — see {@link DetailAttributionResult.bbox} for what feeding the
+* detail box cost. The face path (`face-recognizer.ts` `onSemanticMatch`)
+* already passes its body box; this keeps the plate/classification path on the
+* same discipline.
+*/
+function semanticFrameForDetailAttribution(deviceId, trackId, detail, frame) {
+	return {
+		deviceId,
+		trackId,
+		timestamp: frame.timestamp,
+		bbox: {
+			x: frame.bbox.x,
+			y: frame.bbox.y,
+			w: frame.bbox.w,
+			h: frame.bbox.h
+		},
+		frameWidth: frame.frameWidth,
+		frameHeight: frame.frameHeight,
+		kind: detail.className === "plate" ? "plate" : "classification",
+		score: detail.score,
+		confidence: frame.confidence,
+		...frame.frameHandle !== void 0 ? { frameHandle: frame.frameHandle } : {}
+	};
+}
+/**
+* Offer the recognition frame to the best-frame ranking with the semantic
+* tier. On a win: record the best-seen bbox (plausible boxes only — an
+* envelope-exploded box must not poison the retry reference, mirroring
+* `buildSnapshotTargets`) and re-fire the captures when the pixels are still
+* reachable.
+*/
+function promoteSemanticBestFrame(deps, input) {
+	const { deviceId, trackId, bbox, frameWidth, frameHeight, timestamp } = input;
+	if (!deps.observeBestFrame({
+		deviceId,
+		trackId,
+		confidence: input.confidence,
+		timestamp,
+		edgeClear: isEdgeClear({
+			bbox,
+			frameWidth,
+			frameHeight
+		}),
+		centerScore: bboxCenterScore(bbox, frameWidth, frameHeight),
+		containment: bboxContainment(bbox, frameWidth, frameHeight),
+		sizeScore: bboxSizeScore(bbox, frameWidth, frameHeight),
+		squareFraction: centralSquareContainmentFraction(bbox, {
+			W: frameWidth,
+			H: frameHeight
+		}),
+		semantic: true
+	})) {
+		deps.logger.debug("best-shot: semantic frame did not beat the held peak", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				kind: input.kind,
+				score: input.score,
+				timestamp
+			}
+		});
+		return {
+			promoted: false,
+			captured: false
+		};
+	}
+	const plausible = isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, input.confidence);
+	if (plausible) deps.recordBestSeenBbox(deviceId, trackId, {
+		x: bbox.x,
+		y: bbox.y,
+		w: bbox.w,
+		h: bbox.h,
+		frameWidth,
+		frameHeight,
+		timestamp
+	});
+	if (!plausible || input.frameHandle === void 0) {
+		deps.logger.info("best-shot: semantic promotion without capture", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				kind: input.kind,
+				score: input.score,
+				timestamp,
+				reason: plausible ? "no frame handle" : "implausible box"
+			}
+		});
+		return {
+			promoted: true,
+			captured: false
+		};
+	}
+	deps.captureBestShot({
+		deviceId,
+		trackId,
+		timestamp,
+		bbox,
+		frameWidth,
+		frameHeight,
+		frameHandle: input.frameHandle
+	});
+	deps.logger.info("best-shot: semantic promotion", {
+		tags: { deviceId },
+		meta: {
+			trackId,
+			kind: input.kind,
+			score: input.score,
+			timestamp
+		}
+	});
+	return {
+		promoted: true,
+		captured: true
+	};
+}
 //#endregion
 //#region src/pipeline-analytics/store/zone-geometry.ts
 /**
@@ -34473,6 +34674,7 @@ var PlateGalleryProvider = class {
 	refreshGallery;
 	emitPlateGalleryChanged;
 	eventMediaBaseUrl;
+	eventMediaPathPrefix;
 	constructor(deps) {
 		this.plateStore = deps.plateStore;
 		this.vehicleStore = deps.vehicleStore;
@@ -34483,6 +34685,7 @@ var PlateGalleryProvider = class {
 		this.refreshGallery = deps.refreshGallery;
 		this.emitPlateGalleryChanged = deps.emitPlateGalleryChanged;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
+		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
 	safeEmitPlateGalleryChanged(payload) {
@@ -34553,13 +34756,7 @@ var PlateGalleryProvider = class {
 		return this.toPlateInfo(plate, nameMap, { includeCrops: false });
 	}
 	async getPlateMedia(input) {
-		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => ({
-			key: m.key,
-			kind: m.kind,
-			base64: m.base64,
-			sizeBytes: m.sizeBytes,
-			timestamp: m.timestamp
-		}));
+		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => toGalleryMediaRow(m, this.eventMediaPathPrefix()));
 	}
 	async searchPlates(input) {
 		const maxDistance = input.maxDistance ?? 1;
@@ -34802,6 +34999,51 @@ var PlateGalleryProvider = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/replay/frame-processor-pass.ts
+/**
+* Run a FRESH `FrameProcessor` over a fixed, ordered sequence of frames and
+* return the tracks it produced.
+*
+* No `TrackStore`, no bus, no media — a track here is a summary built
+* ENTIRELY from `FrameProcessor.process()`'s in-memory return value.
+*/
+function runFrameProcessorPass(input) {
+	const processor = new FrameProcessor(input.deviceId, {}, {}, {}, input.source);
+	if (input.zones !== void 0) processor.setZones(input.zones);
+	if (input.detectionRules !== void 0) processor.setDetectionRules(input.detectionRules);
+	if (input.zoneMembershipMinOverlap !== void 0) processor.setZoneMembershipMinOverlap(input.zoneMembershipMinOverlap);
+	const accum = /* @__PURE__ */ new Map();
+	for (const { timestamp, frame } of input.frames) {
+		const result = processor.process({
+			timestamp,
+			frame
+		});
+		for (const td of result.tracked) {
+			const existing = accum.get(td.trackId);
+			const matched = td.matchedThisFrame ? 1 : 0;
+			if (existing === void 0) accum.set(td.trackId, {
+				className: td.className,
+				firstSeenMs: timestamp,
+				lastSeenMs: timestamp,
+				bbox: { ...td.bbox },
+				framesMatched: matched
+			});
+			else {
+				existing.className = td.className;
+				existing.lastSeenMs = timestamp;
+				existing.framesMatched += matched;
+			}
+		}
+	}
+	return { tracks: [...accum.values()].map((t) => ({
+		className: t.className,
+		firstSeenMs: t.firstSeenMs,
+		lastSeenMs: t.lastSeenMs,
+		bbox: t.bbox,
+		framesMatched: t.framesMatched
+	})) };
+}
+//#endregion
 //#region src/pipeline-analytics/retention/disk-reconcile.ts
 /**
 * Disk-wins reconcile for pipeline analytics.
@@ -34866,92 +35108,6 @@ async function reconcileDeviceFromDisk(deps, deviceId) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
-/**
-* The operator button for the debug-media reclaim.
-*
-* The mechanism ships armed with nothing: **arming it is the operator's
-* call**. `mode` omitted means `report` — it counts, logs one line per camera
-* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
-* that has to be typed.
-*
-* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
-* earned it: dry-run default, explicit pacing, explicit blast radius, and a
-* report you can read instead of a log line you have to find.
-*/
-/**
-* `report` counts; `reclaim` deletes.
-*
-* `.default('report')` is load-bearing: the settings form sends `{}` for a
-* button with no fields, and the safe reading of an unstated intent is the one
-* that destroys nothing.
-*/
-var MediaReclaimActionModeSchema = _enum(["report", "reclaim"]).default("report");
-var MediaReclaimScopeSchema = _enum(["motion-still", "track-filmstrip"]);
-var MediaReclaimActionInputSchema = object({
-	mode: MediaReclaimActionModeSchema,
-	/** Which populations to walk. Omitted = both. */
-	scopes: array(MediaReclaimScopeSchema).min(1).optional(),
-	/** Restrict to these cameras. Omitted = every camera in retention scope. */
-	deviceIds: array(number().int()).min(1).optional(),
-	/** Start every device from the top instead of resuming its cursor. */
-	restart: boolean().optional(),
-	/** Rows read per statement. Smaller = more yields = a gentler pass. */
-	pageSize: number().int().min(50).max(5e3).optional(),
-	/** Rows EXAMINED per camera in this pass — the pacing bound. */
-	maxRowsPerDevice: number().int().min(1).max(5e5).optional(),
-	/** Rows DELETED per camera in this pass — the blast-radius bound. */
-	maxReclaimPerDevice: number().int().min(1).max(5e5).optional(),
-	/** Bytes released across the whole run — the disk-contention bound. */
-	maxBytesPerRun: number().int().min(1).optional(),
-	/** Wall-clock ceiling for the run. */
-	budgetMinutes: number().int().min(1).max(720).optional(),
-	/**
-	* Bytes per second the pass may release. The recordings volume sustains
-	* ~4 MB/s and the archive needs it more than this does; the default is half
-	* of that.
-	*/
-	throttleBytesPerSec: number().int().min(64 * 1024).optional(),
-	/**
-	* Minutes of immunity for a recent row. Protective ONLY — raising it can
-	* exclusively save rows, never select them.
-	*/
-	graceMinutes: number().int().min(1).max(10080).optional()
-});
-var MediaReclaimDeviceReportSchema = object({
-	deviceId: number(),
-	scope: MediaReclaimScopeSchema,
-	examined: number(),
-	eligible: number(),
-	reclaimed: number(),
-	bytesReclaimed: number(),
-	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
-	held: number(),
-	/** Rows kept because the owner could not be shown to be a motion event. */
-	unresolved: number(),
-	withinGrace: number(),
-	/** Deletes that REFUSED — the blob survived or the volume could not answer.
-	*  The row was kept and the cursor did not pass it. */
-	refused: number(),
-	stoppedBy: string(),
-	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
-	nextCursor: number()
-});
-var mediaReclaimActions = defineCustomActions({ "retention.mediaReclaim": customAction(MediaReclaimActionInputSchema, object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: boolean(),
-	mode: _enum(["report", "reclaim"]),
-	devices: array(MediaReclaimDeviceReportSchema),
-	totalExamined: number(),
-	totalEligible: number(),
-	totalReclaimed: number(),
-	totalBytesReclaimed: number(),
-	totalRefused: number(),
-	durationMs: number(),
-	/** Every device+scope reported `exhausted` — there is nothing left to do. */
-	complete: boolean()
-}), { auth: "admin" }) });
-//#endregion
 //#region src/pipeline-analytics/retention/media-reclaim.ts
 var MEDIA_RECLAIM_SCOPES = ["motion-still", "track-filmstrip"];
 var DEFAULT_MEDIA_RECLAIM_LIMITS = {
@@ -35162,6 +35318,92 @@ async function runMediaReclaim(input) {
 		cursors: nextCursors
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
+/**
+* The operator button for the debug-media reclaim.
+*
+* The mechanism ships armed with nothing: **arming it is the operator's
+* call**. `mode` omitted means `report` — it counts, logs one line per camera
+* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
+* that has to be typed.
+*
+* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
+* earned it: dry-run default, explicit pacing, explicit blast radius, and a
+* report you can read instead of a log line you have to find.
+*/
+/**
+* `report` counts; `reclaim` deletes.
+*
+* `.default('report')` is load-bearing: the settings form sends `{}` for a
+* button with no fields, and the safe reading of an unstated intent is the one
+* that destroys nothing.
+*/
+var MediaReclaimActionModeSchema = _enum(["report", "reclaim"]).default("report");
+var MediaReclaimScopeSchema = _enum(["motion-still", "track-filmstrip"]);
+var MediaReclaimActionInputSchema = object({
+	mode: MediaReclaimActionModeSchema,
+	/** Which populations to walk. Omitted = both. */
+	scopes: array(MediaReclaimScopeSchema).min(1).optional(),
+	/** Restrict to these cameras. Omitted = every camera in retention scope. */
+	deviceIds: array(number().int()).min(1).optional(),
+	/** Start every device from the top instead of resuming its cursor. */
+	restart: boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per camera in this pass — the pacing bound. */
+	maxRowsPerDevice: number().int().min(1).max(5e5).optional(),
+	/** Rows DELETED per camera in this pass — the blast-radius bound. */
+	maxReclaimPerDevice: number().int().min(1).max(5e5).optional(),
+	/** Bytes released across the whole run — the disk-contention bound. */
+	maxBytesPerRun: number().int().min(1).optional(),
+	/** Wall-clock ceiling for the run. */
+	budgetMinutes: number().int().min(1).max(720).optional(),
+	/**
+	* Bytes per second the pass may release. The recordings volume sustains
+	* ~4 MB/s and the archive needs it more than this does; the default is half
+	* of that.
+	*/
+	throttleBytesPerSec: number().int().min(64 * 1024).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them.
+	*/
+	graceMinutes: number().int().min(1).max(10080).optional()
+});
+var MediaReclaimDeviceReportSchema = object({
+	deviceId: number(),
+	scope: MediaReclaimScopeSchema,
+	examined: number(),
+	eligible: number(),
+	reclaimed: number(),
+	bytesReclaimed: number(),
+	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
+	held: number(),
+	/** Rows kept because the owner could not be shown to be a motion event. */
+	unresolved: number(),
+	withinGrace: number(),
+	/** Deletes that REFUSED — the blob survived or the volume could not answer.
+	*  The row was kept and the cursor did not pass it. */
+	refused: number(),
+	stoppedBy: string(),
+	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
+	nextCursor: number()
+});
+var mediaReclaimActions = defineCustomActions({ "retention.mediaReclaim": customAction(MediaReclaimActionInputSchema, object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: boolean(),
+	mode: _enum(["report", "reclaim"]),
+	devices: array(MediaReclaimDeviceReportSchema),
+	totalExamined: number(),
+	totalEligible: number(),
+	totalReclaimed: number(),
+	totalBytesReclaimed: number(),
+	totalRefused: number(),
+	durationMs: number(),
+	/** Every device+scope reported `exhausted` — there is nothing left to do. */
+	complete: boolean()
+}), { auth: "admin" }) });
 var OrphanAuditActionInputSchema = object({
 	mode: _enum(["report", "reclaim"]).default("report"),
 	/**
@@ -36481,6 +36723,28 @@ function trackMediaScopesForKinds(trackId, kinds) {
 	return kinds.some((kind) => DETAIL_CROP_KINDS.includes(kind)) ? scopes : scopes.filter((scope) => scope.publishCropAs === null);
 }
 /**
+* The STORED kinds worth reading from one scope for a `kinds` request, or
+* `null` when the scope cannot contribute to it at all.
+*
+* This is the same vocabulary translation {@link collectTrackMedia} performs on
+* the way out, moved to the way IN so it can narrow the query instead of the
+* answer. A caller naming `faceCrop` must ask the face owner for its stored
+* `crop` — asking it for `faceCrop` matches nothing, and asking it for
+* everything opens blobs the answer will discard.
+*
+* `undefined` means "every kind": the honest translation of an unfiltered
+* request, and the only safe answer for the open-ended track scope.
+*
+* `null` (skip) is only ever returned for a DETAIL owner whose one publishable
+* kind was not asked for. The track scope is never skipped — its kinds are
+* open-ended, and dropping it on a guess is how a listing starts lying.
+*/
+function storedKindsForScope(scope, kinds) {
+	if (kinds === void 0 || kinds.length === 0) return void 0;
+	if (scope.publishCropAs === null) return kinds;
+	return kinds.includes(scope.publishCropAs) ? [STORED_DETAIL_CROP_KIND] : null;
+}
+/**
 * Fold every scope's rows into ONE track media listing: detail crops
 * relabelled, everything filtered to `kinds`, ordered oldest first.
 *
@@ -36617,8 +36881,10 @@ var AnalyticsQueryFacade = class {
 		return this.withMediaUrl(events);
 	}
 	async getEventMedia(input) {
-		const all = await (this.deps.mediaStore()?.listByOwner("event", input.eventId, input.deviceId) ?? Promise.resolve([]));
-		return input.kind ? all.filter((m) => m.kind === input.kind) : all;
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
+		return (await store.listByOwner("event", input.eventId, input.deviceId, input.kind === void 0 ? void 0 : [input.kind])).map((row) => toWireMediaFile(row, prefix));
 	}
 	/**
 	* A track's media WITH the bytes, restricted to `kinds` when given.
@@ -36631,14 +36897,36 @@ var AnalyticsQueryFacade = class {
 	async getTrackMedia(input) {
 		const store = this.deps.mediaStore();
 		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
 		const scopes = trackMediaScopesForKinds(input.trackId, input.kinds);
-		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => ({
-			scope,
-			rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
-		}))), (row, kind) => ({
+		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => {
+			const stored = storedKindsForScope(scope, input.kinds);
+			if (stored === null) return {
+				scope,
+				rows: []
+			};
+			return {
+				scope,
+				rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId, stored)
+			};
+		})), (row, kind) => ({
 			...row,
 			kind
-		}), input.kinds);
+		}), input.kinds).map((row) => toWireMediaFile(row, prefix));
+	}
+	/**
+	* An event's media WITHOUT the bytes.
+	*
+	* Index rows only — it never opens a blob. The track detail modal unions
+	* this with {@link listTrackMedia} to build its filmstrip and then fetches
+	* each tile from the `event-media` plane by key, so the bytes this used to
+	* carry were read, base64'd, shipped and discarded.
+	*/
+	async listEventMedia(input) {
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
+		return (await store.listInfoByOwner("event", input.eventId, input.deviceId)).map((row) => toWireMediaFileInfo(row, prefix));
 	}
 	/**
 	* A track's media WITHOUT the bytes.
@@ -36656,13 +36944,14 @@ var AnalyticsQueryFacade = class {
 	async listTrackMedia(input) {
 		const store = this.deps.mediaStore();
 		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
 		return collectTrackMedia(await Promise.all(trackMediaOwnerScopes(input.trackId).map(async (scope) => ({
 			scope,
 			rows: await store.listInfoByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
 		}))), (row, kind) => ({
 			...row,
 			kind
-		}), void 0);
+		}), void 0).map((row) => toWireMediaFileInfo(row, prefix));
 	}
 	async pruneEventsBefore(input) {
 		const eventStore = this.deps.eventStore();
@@ -39107,6 +39396,31 @@ function createEventMediaHandler(deps) {
 }
 //#endregion
 //#region src/pipeline-analytics/event-thumbnail-resolver.ts
+/**
+* Rank `candidates` with `pick`, then open ONE blob — the winner's.
+*
+* The ladders decide on `kind` alone, so the bytes are dead weight until the
+* choice is made. Handing them pre-read rows meant a tile that serves the
+* 31 KB `thumbnailSmall` first read the whole 3 597 219-byte set, including a
+* 2.8 MB `keyFrame` no list view has ever rendered.
+*
+* A winner whose blob is GONE is dropped and the ladder re-run on the rest.
+* That fall-through is not an extra: `listByOwner` used to provide it for free
+* by skipping unreadable rows before the ladder ever saw them, and without it
+* an index row that outlived its file would 404 a tile that used to render.
+* Bounded by the candidate count — each attempt removes one row.
+*/
+async function readWinningBlob(candidates, pick, readBlob) {
+	let remaining = candidates;
+	while (remaining.length > 0) {
+		const winner = pick(remaining);
+		if (winner === void 0) return null;
+		const bytes = await readBlob(winner.key);
+		if (bytes !== null) return bytes;
+		remaining = remaining.filter((row) => row.key !== winner.key);
+	}
+	return null;
+}
 /** Pick an event-OWNED media blob: the tight `crop`, else the native-res boxed
 *  `fullFrameBoxed`, else any available file. Both preferred kinds are RETIRED
 *  for new tracks (served only for old stored rows). Undefined when the event
@@ -39157,15 +39471,24 @@ async function collectCropForcedMedia(source, id) {
 	};
 }
 /**
-* Resolve the default-path media for an event id: the event's own media when it
-* has any, else the owning track's fallback media. Returns `null` when neither
-* yields a blob (caller 404s → the surface shows an icon).
+* Which rows the default path should serve from, and how to rank them: the
+* event's OWN media when it has any, else the owning track's.
+*
+* It yields the candidate SET rather than a winner so the caller can open one
+* blob and, if that blob has gone, re-rank the rest ({@link readWinningBlob}).
+* Returning a single row would force the caller to read it blind and 404 a tile
+* whose index row outlived its file.
 */
-async function resolveDefaultEventMedia(deps) {
-	const owned = pickEventOwnedMedia(deps.eventFiles);
-	if (owned) return owned;
+async function collectDefaultEventMedia(deps) {
+	if (deps.eventFiles.length > 0) return {
+		candidates: deps.eventFiles,
+		pick: pickEventOwnedMedia
+	};
 	const trackId = await deps.getTrackIdForEvent(deps.eventId) ?? deps.eventId;
-	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
+	return {
+		candidates: await deps.listTrackMedia(trackId),
+		pick: pickTrackFallbackMedia
+	};
 }
 //#endregion
 //#region src/pipeline-analytics/face-settings.ts
@@ -41066,13 +41389,29 @@ var RETRAIN_FRAME_COLUMNS = [
 		type: "TEXT"
 	})
 ];
-var RETRAIN_FRAME_INDEXES = [{
-	name: "idx_retrain_frames_track",
-	columns: ["trackId"]
-}, {
-	name: "idx_retrain_frames_device",
-	columns: ["deviceId", "copiedAt"]
-}];
+var RETRAIN_FRAME_INDEXES = [
+	{
+		name: "idx_retrain_frames_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_retrain_frames_device",
+		columns: ["deviceId", "copiedAt"]
+	},
+	(
+	/**
+	* The seal gate's other half. This collection is orders of magnitude smaller
+	* than `pipeline-analytics:media` — every row is an operator-staged frame —
+	* so the index buys much less here. It exists anyway because the gate reads
+	* the two lanes with ONE query shape, and a lane that answers by scanning is
+	* a lane that starts timing out the day the dataset grows. See
+	* `MEDIA_INDEXES` for the cost this is a small multiple of.
+	*/
+	{
+		name: "idx_retrain_frames_location",
+		columns: ["locationId"]
+	})
+];
 /**
 * The copy's id, derived from `(trackId, sourceMediaKey)`.
 *
@@ -44337,14 +44676,27 @@ function snapshot(j) {
 	};
 }
 /**
+* The column both walked collections use for the storage location.
+*
+* Named once because it is now a QUERY PREDICATE (`where: { [it]: null }`) as
+* well as a row field. A predicate naming a column the collection cannot
+* express is refused by `count` rather than dropped, so a rename that misses
+* one site fails loudly instead of counting the whole table.
+*/
+var LOCATION_ID_FIELD = "locationId";
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
 * helper collapses "unstamped" and "stamped with the bare type ref" into one
 * answer, and only the first is a row whose meaning changes under a repoint.
+*
+* The in-JS twin of the `IS NULL` predicate {@link MediaRelocateEngine.countUnstamped}
+* sends. It stays because the PASS still walks rows and must decide per row;
+* the two must agree, and `unstamped-count-matches-the-pass` asserts they do.
 */
 function rowIsUnstamped(data) {
-	const id = data["locationId"];
+	const id = data[LOCATION_ID_FIELD];
 	return !(typeof id === "string" && id.length > 0);
 }
 /** True for the enrolled-gallery rows `move` skips and `gallery` selects. */
@@ -44402,26 +44754,91 @@ var MediaRelocateEngine = class {
 		return true;
 	}
 	/**
-	* How many rows still carry no `locationId`, per collection.
+	* Rows that still carry no `locationId`, per collection.
 	*
-	* Read-only, and the ONLY number the migration planner's non-blocking gate
-	* is allowed to trust: it is counted here, against the rows themselves,
+	* Read-only, and the ONLY answer the migration planner's non-blocking gate
+	* is allowed to trust: it is measured here, against the rows themselves,
 	* rather than inferred from "a seal job reported done" — a seal that failed
 	* some rows still reports a terminal state.
+	*
+	* ── Why this is not the walk the rest of this file uses ──────────────────
+	*
+	* It used to be. It paged both collections through {@link pageRows} — 200
+	* rows per RPC, ordered by `timestamp`, a column that leads no index — and
+	* counted `rowIsUnstamped` in JS. On the live hub that is ~6 300 round trips
+	* over 1 254 576 rows, each paying its own sort, and it hit the 60 s RPC
+	* deadline **every time it was called since it shipped**. The gate it exists
+	* to serve could therefore never open, and 152 GB of event media could not
+	* be migrated.
+	*
+	* The walk is right for the PASS, which must visit every row to act on it.
+	* It was never right for a question the store can answer with a predicate,
+	* and the predicate is now expressible: `where: { locationId: null }`
+	* compiles to `IS NULL` (it used to compile to `= NULL`, which matches
+	* nothing and reports it as an answer — the number the gate treats as "safe
+	* to cut over"). With `idx_media_location` in place both statements read a
+	* contiguous range from the head of a b-tree.
+	*
+	* The cheap question is asked FIRST and on its own. `present` is a single
+	* seek and decides the gate; `rows` is a second statement and only decorates
+	* the refusal. So a count that cannot be taken still leaves a usable answer
+	* — `{ present: true, rows: null }` refuses just as hard — and `null` never
+	* degrades into `0`.
 	*/
 	async countUnstamped() {
-		const media = await this.countUnstampedIn(MEDIA_COLLECTION, "timestamp");
-		const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION, "copiedAt");
-		return {
-			media,
-			retrainFrames,
-			total: media + retrainFrames
-		};
+		try {
+			const media = await this.countUnstampedIn(MEDIA_COLLECTION);
+			const retrainFrames = await this.countUnstampedIn(RETRAIN_FRAMES_COLLECTION);
+			return {
+				media,
+				retrainFrames,
+				anyPresent: media.present || retrainFrames.present,
+				total: media.rows === null || retrainFrames.rows === null ? null : media.rows + retrainFrames.rows
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: could not determine whether any row is unstamped — a migration must treat this as unknown, never as sealed", { meta: { error: String(err) } });
+			return null;
+		}
 	}
-	async countUnstampedIn(collection, orderField) {
-		let unstamped = 0;
-		for await (const row of this.pageRows(collection, orderField)) if (rowIsUnstamped(row.data)) unstamped++;
-		return unstamped;
+	/**
+	* One collection's unstamped population: existence, then size.
+	*
+	* The `limit: 1` probe is deliberately a `query` and not a `count`: a count
+	* of a million matching rows still walks a million index entries, while the
+	* probe stops at the first one. Absence is proved by the same seek finding
+	* nothing, which is where the index earns its keep — after a seal, the range
+	* is empty and the answer is one b-tree descent.
+	*/
+	async countUnstampedIn(collection) {
+		if ((await this.deps.store.query.query({
+			collection,
+			filter: {
+				where: { [LOCATION_ID_FIELD]: null },
+				limit: 1
+			},
+			columns: [LOCATION_ID_FIELD]
+		})).length === 0) return {
+			present: false,
+			rows: 0
+		};
+		try {
+			return {
+				present: true,
+				rows: await this.deps.store.count.query({
+					collection,
+					filter: { where: { [LOCATION_ID_FIELD]: null } }
+				})
+			};
+		} catch (err) {
+			this.deps.logger.warn("event-media seal gate: unstamped rows exist but could not be counted — reporting the population as unknown, not as empty", { meta: {
+				collection,
+				error: String(err)
+			} });
+			return {
+				present: true,
+				rows: null
+			};
+		}
 	}
 	start(input) {
 		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);
@@ -47178,6 +47595,70 @@ var PackageDropDetector = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
+/**
+* How much of the PERSON box must sit inside a vehicle box to be counted.
+*
+* 0.8 and not 1.0: a phantom raised on a car's window pillar or wing mirror
+* routinely pokes a little outside the vehicle box, and requiring total
+* containment would count almost none of them. 0.8 and not 0.5: half a person
+* box overlapping a car is what a pedestrian walking in front of one looks
+* like, and counting those would make the number mean "somebody was near a
+* car", which is not a defect.
+*/
+var CONTAINMENT_THRESHOLD = .8;
+/**
+* The classes that count as a vehicle for this test.
+*
+* A local list rather than a shared taxonomy on purpose: it exists to describe
+* ONE measurement, and a shared enum would make a change here silently change
+* detection behaviour somewhere else.
+*/
+var VEHICLE_CLASSES$1 = [
+	"car",
+	"truck",
+	"bus",
+	"motorcycle",
+	"vehicle"
+];
+/** Area of the intersection of two boxes. `0` when they do not overlap. */
+function intersectionArea(a, b) {
+	const left = Math.max(a.x, b.x);
+	const right = Math.min(a.x + a.w, b.x + b.w);
+	const top = Math.max(a.y, b.y);
+	const bottom = Math.min(a.y + a.h, b.y + b.h);
+	if (right <= left || bottom <= top) return 0;
+	return (right - left) * (bottom - top);
+}
+/**
+* Fraction of `person` that lies inside `vehicle`, in `[0,1]`.
+*
+* `0` for a degenerate person box: a zero-area box is inside everything and
+* inside nothing, and answering `1` would count every one of them.
+*/
+function containedFraction(person, vehicle) {
+	const area = person.w * person.h;
+	if (area <= 0) return 0;
+	return intersectionArea(person, vehicle) / area;
+}
+/**
+* Is this person box contained in any vehicle box in the same frame?
+*
+* Returns the fraction for the BEST-containing vehicle when it clears
+* {@link CONTAINMENT_THRESHOLD}, else `null`. The fraction rides along because
+* a counter that only ever says "yes" cannot later be re-thresholded against
+* what was actually measured.
+*/
+function personOverVehicle(person, neighbours, threshold = CONTAINMENT_THRESHOLD) {
+	let best = 0;
+	for (const neighbour of neighbours) {
+		if (!VEHICLE_CLASSES$1.includes(neighbour.className)) continue;
+		const fraction = containedFraction(person, neighbour.bbox);
+		if (fraction > best) best = fraction;
+	}
+	return best >= threshold ? best : null;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-evidence.ts
 /**
 * stationary-evidence — how a parked object EARNS a registry entry.
@@ -49709,83 +50190,6 @@ function buildRecordedStillPorts(input) {
 		})
 	};
 }
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-async function reconcileGallerySamples(deps, options) {
-	let checked = 0;
-	let reclaimed = 0;
-	let keyless = 0;
-	let skippedGrace = 0;
-	let stoppedByCeiling = false;
-	const identities = await deps.listIdentities();
-	for (const identity of identities) {
-		const samples = await deps.listSamples(identity.id);
-		for (const sample of samples) {
-			if (sample.mediaKey === void 0) {
-				keyless += 1;
-				continue;
-			}
-			if (options.now - sample.addedAt < options.graceMs) {
-				skippedGrace += 1;
-				continue;
-			}
-			if (reclaimed >= options.maxReclaimPerRun) {
-				stoppedByCeiling = true;
-				deps.logger.warn("gallery reconcile: reclaim ceiling reached — remaining dead references keep until the next run", { meta: { ceiling: options.maxReclaimPerRun } });
-				return {
-					checked,
-					reclaimed,
-					keyless,
-					skippedGrace,
-					stoppedByCeiling
-				};
-			}
-			let state;
-			try {
-				state = await deps.blobState(sample.mediaKey);
-			} catch (err) {
-				const reason = errorMessage(err);
-				deps.logger.warn("gallery reconcile: a blob probe FAILED — aborting the pass, keeping every row", { meta: {
-					sampleId: sample.id,
-					identity: identity.name,
-					error: reason
-				} });
-				return {
-					checked,
-					reclaimed,
-					keyless,
-					skippedGrace,
-					stoppedByCeiling,
-					aborted: reason
-				};
-			}
-			checked += 1;
-			if (state === "exists") continue;
-			await deps.removeSample(identity.id, sample.id);
-			reclaimed += 1;
-			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
-				sampleId: sample.id,
-				identity: identity.name,
-				mediaKey: sample.mediaKey,
-				state
-			} });
-		}
-	}
-	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
-		checked,
-		reclaimed,
-		keyless,
-		skippedGrace
-	} });
-	return {
-		checked,
-		reclaimed,
-		keyless,
-		skippedGrace,
-		stoppedByCeiling
-	};
-}
 //#endregion
 //#region src/pipeline-analytics/retention/embedding-orphan-scan.ts
 /** The scope id this leg reports and persists its cursor under. */
@@ -49902,6 +50306,83 @@ async function scanEmbeddingOrphans(deps, limits, cursor) {
 		nextCursor: Math.max(0, offset)
 	};
 }
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function reconcileGallerySamples(deps, options) {
+	let checked = 0;
+	let reclaimed = 0;
+	let keyless = 0;
+	let skippedGrace = 0;
+	let stoppedByCeiling = false;
+	const identities = await deps.listIdentities();
+	for (const identity of identities) {
+		const samples = await deps.listSamples(identity.id);
+		for (const sample of samples) {
+			if (sample.mediaKey === void 0) {
+				keyless += 1;
+				continue;
+			}
+			if (options.now - sample.addedAt < options.graceMs) {
+				skippedGrace += 1;
+				continue;
+			}
+			if (reclaimed >= options.maxReclaimPerRun) {
+				stoppedByCeiling = true;
+				deps.logger.warn("gallery reconcile: reclaim ceiling reached — remaining dead references keep until the next run", { meta: { ceiling: options.maxReclaimPerRun } });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling
+				};
+			}
+			let state;
+			try {
+				state = await deps.blobState(sample.mediaKey);
+			} catch (err) {
+				const reason = errorMessage(err);
+				deps.logger.warn("gallery reconcile: a blob probe FAILED — aborting the pass, keeping every row", { meta: {
+					sampleId: sample.id,
+					identity: identity.name,
+					error: reason
+				} });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling,
+					aborted: reason
+				};
+			}
+			checked += 1;
+			if (state === "exists") continue;
+			await deps.removeSample(identity.id, sample.id);
+			reclaimed += 1;
+			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
+				sampleId: sample.id,
+				identity: identity.name,
+				mediaKey: sample.mediaKey,
+				state
+			} });
+		}
+	}
+	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
+		checked,
+		reclaimed,
+		keyless,
+		skippedGrace
+	} });
+	return {
+		checked,
+		reclaimed,
+		keyless,
+		skippedGrace,
+		stoppedByCeiling
+	};
+}
 /**
 * Where the completion marker lives.
 *
@@ -52964,14 +53445,14 @@ function isAfterCursor(row, cursor) {
 	if (row.lastSeen < cursor.lastSeen) return true;
 	return row.lastSeen === cursor.lastSeen && row.id < cursor.trackId;
 }
-var VEHICLE_CLASSES$1 = new Set([
+var VEHICLE_CLASSES = new Set([
 	"vehicle",
 	"car",
 	"truck",
 	"bus"
 ]);
 function motionlessMaxPxForClass(className) {
-	return VEHICLE_CLASSES$1.has(className.toLowerCase()) ? 8 : 40;
+	return VEHICLE_CLASSES.has(className.toLowerCase()) ? 8 : 40;
 }
 function netDisplacementPx(positions) {
 	const first = positions[0];
@@ -56731,70 +57212,6 @@ function hasWrappedDetection(entries) {
 	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
-/**
-* How much of the PERSON box must sit inside a vehicle box to be counted.
-*
-* 0.8 and not 1.0: a phantom raised on a car's window pillar or wing mirror
-* routinely pokes a little outside the vehicle box, and requiring total
-* containment would count almost none of them. 0.8 and not 0.5: half a person
-* box overlapping a car is what a pedestrian walking in front of one looks
-* like, and counting those would make the number mean "somebody was near a
-* car", which is not a defect.
-*/
-var CONTAINMENT_THRESHOLD = .8;
-/**
-* The classes that count as a vehicle for this test.
-*
-* A local list rather than a shared taxonomy on purpose: it exists to describe
-* ONE measurement, and a shared enum would make a change here silently change
-* detection behaviour somewhere else.
-*/
-var VEHICLE_CLASSES = [
-	"car",
-	"truck",
-	"bus",
-	"motorcycle",
-	"vehicle"
-];
-/** Area of the intersection of two boxes. `0` when they do not overlap. */
-function intersectionArea(a, b) {
-	const left = Math.max(a.x, b.x);
-	const right = Math.min(a.x + a.w, b.x + b.w);
-	const top = Math.max(a.y, b.y);
-	const bottom = Math.min(a.y + a.h, b.y + b.h);
-	if (right <= left || bottom <= top) return 0;
-	return (right - left) * (bottom - top);
-}
-/**
-* Fraction of `person` that lies inside `vehicle`, in `[0,1]`.
-*
-* `0` for a degenerate person box: a zero-area box is inside everything and
-* inside nothing, and answering `1` would count every one of them.
-*/
-function containedFraction(person, vehicle) {
-	const area = person.w * person.h;
-	if (area <= 0) return 0;
-	return intersectionArea(person, vehicle) / area;
-}
-/**
-* Is this person box contained in any vehicle box in the same frame?
-*
-* Returns the fraction for the BEST-containing vehicle when it clears
-* {@link CONTAINMENT_THRESHOLD}, else `null`. The fraction rides along because
-* a counter that only ever says "yes" cannot later be re-thresholded against
-* what was actually measured.
-*/
-function personOverVehicle(person, neighbours, threshold = CONTAINMENT_THRESHOLD) {
-	let best = 0;
-	for (const neighbour of neighbours) {
-		if (!VEHICLE_CLASSES.includes(neighbour.className)) continue;
-		const fraction = containedFraction(person, neighbour.bbox);
-		if (fraction > best) best = fraction;
-	}
-	return best >= threshold ? best : null;
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
 	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
@@ -63236,6 +63653,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	*  Set once the data-plane is registered; null until then (e.g. no
 	*  dataPlane facility in the current environment). */
 	eventMediaBaseUrl = null;
+	/**
+	* The SAME path, derived rather than observed — a pure function of the addon
+	* id, so it exists before `serve()` is attempted and survives its failure.
+	*
+	* `eventMediaBaseUrl` above answers "is the plane up?", which is the right
+	* question for the OPTIONAL `mediaUrl` stamp on a slim event projection.
+	* It is the wrong question for a media row's `url`, which is that row's only
+	* address: a row that dropped its address on a boot race would be
+	* indistinguishable from a row with no bytes, and this repo has already paid
+	* for one read that quietly returned less than it was asked for.
+	*/
+	eventMediaPathPrefix() {
+		return `/addon/${this.ctx.id}/event-media`;
+	}
 	lastActiveTrackIds = /* @__PURE__ */ new Map();
 	/** See `pipeline/suppressed-births.ts` — rejected births must not be
 	*  re-upserted, and must be forgotten when the tracker drops the id. */
@@ -63486,6 +63917,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		sensorEventStore: () => this.sensorEventStore,
 		opsLog: () => this.eventsOpsLog,
 		eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+		eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 		logger: () => this.ctx.logger,
 		zoneCatalogue: () => this.zoneCatalogue
 	});
@@ -66028,6 +66460,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			logger: this.ctx.logger,
 			refreshGallery: () => this.faceRecognizer?.refreshGallery(),
 			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+			eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 			emitFaceGalleryChanged: (payload) => this.emitFaceGalleryChanged(payload)
 		});
 		this.faceGalleryProvider = faceGallery;
@@ -66042,6 +66475,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				this.plateRecognizer?.refreshGallery();
 			},
 			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+			eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 			emitPlateGalleryChanged: (payload) => this.emitPlateGalleryChanged(payload)
 		});
 		return [
@@ -69727,6 +70161,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	async listTrackMedia(input) {
 		return this.queryFacade.listTrackMedia(input);
 	}
+	/** What media an EVENT has, without any of it — the same manifest, for the
+	*  half of the detail modal's filmstrip that is event-owned. */
+	async listEventMedia(input) {
+		return this.queryFacade.listEventMedia(input);
+	}
 	/**
 	* Search object events by text using CLIP cosine similarity.
 	*
@@ -71447,31 +71886,44 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			return media;
 		}
 	}
+	/**
+	* Resolve an event/track id to ONE tile's bytes.
+	*
+	* Every ladder below ranks rows by `kind` alone, so this walks the INDEX
+	* (`listInfoByOwner`, no blob opened) and opens only the winner. It used to
+	* walk `listByOwner`, which reads and base64-encodes every blob an owner
+	* holds before the first comparison is made: measured on the live hub
+	* 2026-08-30, a track's six kinds are 3 597 219 bytes and the tile serves
+	* `thumbnailSmall` — 31 155 of them. An Events page of forty tiles read
+	* ~144 MB and allocated ~190 MB of base64 to deliver ~1.2 MB, all of it on
+	* the single-threaded post-analysis runner.
+	*/
 	async readEventThumbnail(id, preferKind) {
-		const eventFiles = await (this.mediaStore?.listByOwner("event", id) ?? Promise.resolve([]));
+		const listInfo = (ownerKind, ownerId) => this.mediaStore?.listInfoByOwner(ownerKind, ownerId) ?? Promise.resolve([]);
+		const getTrackIdForEvent = (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null);
+		const readBlob = async (key) => {
+			const file = await (this.mediaStore?.getByKey(key) ?? Promise.resolve(null));
+			return file === null ? null : {
+				bytes: Buffer.from(file.base64, "base64"),
+				key: file.key
+			};
+		};
+		const eventFiles = await listInfo("event", id);
 		if (preferKind !== void 0 && preferKind.length > 0) {
 			const layers = await collectCropForcedMedia({
-				listByOwner: (ownerKind, ownerId) => this.mediaStore?.listByOwner(ownerKind, ownerId) ?? Promise.resolve([]),
-				getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+				listByOwner: listInfo,
+				getTrackIdForEvent
 			}, id);
-			const chosen = resolveCropForcedMedia(layers.bodyFiles, (files) => pickCleanMedia(files, preferKind), layers.detailFiles);
-			if (!chosen) return null;
-			return {
-				bytes: Buffer.from(chosen.base64, "base64"),
-				key: chosen.key
-			};
+			const bodyKeys = new Set(layers.bodyFiles.map((f) => f.key));
+			return await readWinningBlob([...layers.bodyFiles, ...layers.detailFiles], (rows) => resolveCropForcedMedia(rows.filter((r) => bodyKeys.has(r.key)), (files) => pickCleanMedia(files, preferKind), rows.filter((r) => !bodyKeys.has(r.key))), readBlob);
 		}
-		const chosen = await resolveDefaultEventMedia({
+		const { candidates, pick } = await collectDefaultEventMedia({
 			eventId: id,
 			eventFiles,
-			listTrackMedia: (trackId) => this.mediaStore?.listByOwner("track", trackId) ?? Promise.resolve([]),
-			getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+			listTrackMedia: (trackId) => listInfo("track", trackId),
+			getTrackIdForEvent
 		});
-		if (!chosen) return null;
-		return {
-			bytes: Buffer.from(chosen.base64, "base64"),
-			key: chosen.key
-		};
+		return await readWinningBlob(candidates, pick, readBlob);
 	}
 	globalSettingsSchema(cap) {
 		return this.schema(buildGlobalSettingsSchema(cap));