@camstack/addon-post-analysis 1.2.151 → 1.2.152

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DpQno5NK.js");
+const require_dist = require("../dist-Bw6cidiJ.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -5413,12 +5413,6 @@ function buildAlarmButtons(input) {
 	}];
 }
 //#endregion
-//#region src/notification-center/cap-caller.ts
-function requireCapCaller(method, caller) {
-	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
-	return caller;
-}
-//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -5661,6 +5655,12 @@ var AudioWatcher = class {
 	}
 };
 //#endregion
+//#region src/notification-center/cap-caller.ts
+function requireCapCaller(method, caller) {
+	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
+	return caller;
+}
+//#endregion
 //#region src/shared/llm-vision/prompt-hygiene.ts
 /**
 * What a PIPELINE VALUE is allowed to look like once it is inside a prompt.
@@ -6295,25 +6295,46 @@ var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
 /** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
 var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
 /**
-* Kinds whose action is "go and look at why this camera stopped producing".
+* Kinds whose action is "go and look at this device's stream".
+*
+* BOTH DIRECTIONS. A recovery lands on the same page as the failure it undoes,
+* because "did it really come back, and what did it do while it was gone" is
+* an action and the page that answers it is the one the down-notification
+* already opened. On 2026-08-30 the operator's phone showed "Il dispositivo
+* Videocamera sala feste è online" with `tapAction.value: null` — the same
+* camera's `device-offline` an hour earlier opened the Stream Broker tab, and
+* the recovery opened nothing, purely because `device-online` had no entry
+* here.
 *
-* The legacy `camera-offline` is here for the same reason it is still in the
-* enum: outbox and history rows enqueued before the rename carry it, and an
+* The legacy `camera-*` pair is here for the same reason both are still in the
+* enum: outbox and history rows enqueued before the rename carry them, and an
 * old row is exactly the one whose action has to keep working.
+*
+* Kinds NOT here are kinds whose DOWN direction has no action either
+* (`node-online`/`node-offline`, `device-enabled`/`device-disabled`) — a
+* recovery does not earn a destination its failure was never given.
 */
-var DEVICE_DOWN_KINDS = new Set([
+var DEVICE_STREAM_KINDS = new Set([
 	"device-offline",
+	"device-online",
 	"stream-offline",
-	"camera-offline"
+	"stream-online",
+	"camera-offline",
+	"camera-online"
 ]);
 /**
 * Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
 *
-* A stream belongs to a camera and nothing else. The legacy `camera-offline`
-* is one too — that name is precisely the claim it made, and it is why the
-* kind was split into `device-offline` + a `deviceTypes` condition.
+* A stream belongs to a camera and nothing else. The legacy `camera-*` pair is
+* too — that name is precisely the claim it made, and it is why the kind was
+* split into `device-*` + a `deviceTypes` condition.
 */
-var CAMERA_BY_CONSTRUCTION_KINDS = new Set(["stream-offline", "camera-offline"]);
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set([
+	"stream-offline",
+	"stream-online",
+	"camera-offline",
+	"camera-online"
+]);
 function withParam(path, key, value) {
 	if (value === void 0 || value.length === 0) return path;
 	return `${path}?${key}=${encodeURIComponent(value)}`;
@@ -6328,7 +6349,7 @@ function withParam(path, key, value) {
 function systemEventTapPath(subject) {
 	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
 	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
-	if (DEVICE_DOWN_KINDS.has(subject.kind)) {
+	if (DEVICE_STREAM_KINDS.has(subject.kind)) {
 		const deviceId = subject.deviceId;
 		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
 		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
@@ -10730,16 +10751,26 @@ function incomingFromUpdateAvailable(facts, data) {
 		...nodeIds.length > 0 ? { nodeIds } : {}
 	});
 }
-/** Version-bearing `addon.updated` only — settings saves carry neither. */
+/**
+* Version-bearing `addon.updated` only — a settings save carries no versions
+* at all (`BaseAddon.updateGlobalSettings`).
+*
+* `toVersion` IS the discriminator, and `fromVersion` is not: the emitter
+* omits the predecessor when it cannot read what was installed (a first
+* install, an unreadable tree). Requiring both dropped those updates on the
+* floor entirely — the operator got no notification for an update that
+* happened — which is the price that was being paid to keep `'0.0.0'`
+* out. Report the half that is known; say nothing about the half that is not.
+*/
 function parseAddonUpdateComplete(data) {
 	const packageName = stringField(data, "packageName");
 	const fromVersion = stringField(data, "fromVersion");
 	const toVersion = stringField(data, "toVersion");
-	if (packageName === void 0 || fromVersion === void 0 || toVersion === void 0) return null;
+	if (packageName === void 0 || toVersion === void 0) return null;
 	const nodeId = stringField(data, "agent") ?? stringField(data, "nodeId");
 	return {
 		packageName,
-		fromVersion,
+		...fromVersion !== void 0 ? { fromVersion } : {},
 		toVersion,
 		...nodeId !== void 0 ? { nodeId } : {}
 	};
@@ -10749,7 +10780,10 @@ function incomingFromAddonUpdates(facts, updates) {
 	const packageNames = unique(updates.map((update) => update.packageName));
 	const nodeIds = unique(updates.map((update) => update.nodeId).filter((id) => id !== void 0));
 	const signature = updates.map((update) => `${update.nodeId ?? ""}:${update.packageName}@${update.toVersion}`).toSorted().join(",");
-	const list = updates.map((update) => update.nodeId !== void 0 ? `${update.packageName} ${update.fromVersion} → ${update.toVersion} (${update.nodeId})` : `${update.packageName} ${update.fromVersion} → ${update.toVersion}`).join("\n");
+	const list = updates.map((update) => {
+		const transition = update.fromVersion !== void 0 ? `${update.fromVersion} → ${update.toVersion}` : `→ ${update.toVersion}`;
+		return update.nodeId !== void 0 ? `${update.packageName} ${transition} (${update.nodeId})` : `${update.packageName} ${transition}`;
+	}).join("\n");
 	const head = updates[0];
 	return systemSubject({
 		facts,
@@ -23586,17 +23620,17 @@ function planRuleTest(input) {
 					deviceName: `camera ${String(systemScope.deviceId ?? deviceId)}`,
 					nodeId: systemScope.nodeId ?? "hub",
 					packageName: systemScope.packageName ?? "@camstack/server",
-					currentVersion: "0.0.0",
-					latestVersion: "0.0.0",
+					currentVersion: "1.0.0",
+					latestVersion: "1.0.1",
 					profile: "low",
 					seconds: "30",
 					devices: "cuda:0",
 					minutes: "15",
 					addons: TEST_CRASHED_RUNNER,
-					list: "@camstack/addon-pipeline 1.0.0 (current 0.0.0)",
+					list: "@camstack/addon-pipeline 1.0.1 (current 1.0.0)",
 					nodes: "hub",
-					fromVersion: "0.0.0",
-					toVersion: "0.0.1",
+					fromVersion: "1.0.0",
+					toVersion: "1.0.1",
 					title: "Export",
 					count: "1"
 				},
@@ -25746,7 +25780,7 @@ var MediaStore = class {
 		});
 	}
 	/** Persist a media blob and register its metadata row. Returns the
-	*  collection key (MediaFile.key) that callers store as reference. */
+	*  collection key (MediaFileRef.key) that callers store as reference. */
 	async put(params) {
 		if (this.writeGate) return this.writeGate.run(() => this.putUnchecked(params));
 		return this.putUnchecked(params);
@@ -26068,8 +26102,20 @@ var MediaStore = class {
 	* its device at write time, so scoping the query by it makes a media read
 	* for a device the caller cannot name return nothing — the DB itself
 	* enforces the boundary, no post-hoc ownership check to forget.
+	*
+	* `kinds` is the WORK filter, and it belongs here rather than on the answer.
+	* Every row this returns has had its blob read off disk and base64-encoded,
+	* so a caller that filters afterwards has already paid for every kind it is
+	* about to discard: measured on the live hub, one track's six kinds are
+	* 3 597 219 bytes and `thumbnailSmall` is 31 155 of them, and asking for the
+	* small one alone cost exactly as much as asking for all six. `kind` is a
+	* real column (see {@link MEDIA_COLUMNS}), so the narrowing happens in the
+	* query and the blobs of the other kinds are never opened.
+	*
+	* Absent (or empty) means every kind — the back-compat default, and the
+	* honest answer for a caller that has not decided what it needs.
 	*/
-	async listByOwner(ownerKind, ownerId, deviceId) {
+	async listByOwner(ownerKind, ownerId, deviceId, kinds) {
 		const rows = await this.store.query.query({
 			collection: MEDIA_COLLECTION,
 			filter: {
@@ -26081,6 +26127,7 @@ var MediaStore = class {
 					ownerId,
 					deviceId
 				},
+				...kinds !== void 0 && kinds.length > 0 ? { whereIn: { kind: [...kinds] } } : {},
 				orderBy: {
 					field: "timestamp",
 					direction: "asc"
@@ -27997,6 +28044,63 @@ var embeddingActions = require_dist.defineCustomActions({
 	"embedding.reembedFacesStatus": require_dist.customAction(NoInputSchema$1, ReembedFacesStatusSchema)
 });
 //#endregion
+//#region src/pipeline-analytics/media-file-url.ts
+/**
+* The plane path for one stored media key.
+*
+* `prefix` is `/addon/<addonId>/event-media` — a pure function of the addon
+* id, so it exists whether or not `dataPlane.serve` succeeded. A row that
+* named no address at all would be the silent drop this repo keeps paying for:
+* a client cannot tell "no bytes" from "no plane", and renders neither.
+*/
+function mediaFileUrl(prefix, key) {
+	return `${prefix}/${encodeURIComponent(key)}`;
+}
+/**
+* A stored row as the wire sees it: the ref, the address, and — transitionally
+* — the bytes.
+*
+* `base64` is copied through ONLY because the deployed viewer's track-detail
+* hero still requires the field to parse a row at all. See the `MediaFile`
+* docblock in `pipeline-analytics.cap.ts`; deleting the field is a one-line
+* change here and one in the schema.
+*
+* `provenance` is deliberately NOT spread: it is store-internal, and the
+* previous `{ ...row, kind }` shape published it by accident.
+*/
+function toWireMediaFile(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp,
+		url: mediaFileUrl(prefix, row.key),
+		base64: row.base64
+	};
+}
+/** The same row without its bytes — the manifest shape. Carries the SAME
+*  `url` as the byte read, so a client never builds the plane path itself. */
+function toWireMediaFileInfo(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp,
+		url: mediaFileUrl(prefix, row.key)
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/gallery-media-row.ts
+function toGalleryMediaRow(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		url: mediaFileUrl(prefix, row.key),
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/include-crops-default.ts
 function resolveIncludeCrops(input) {
 	return input?.includeCrops === true;
@@ -29656,6 +29760,7 @@ var FaceGalleryProvider = class {
 	logger;
 	refreshGallery;
 	eventMediaBaseUrl;
+	eventMediaPathPrefix;
 	emitFaceGalleryChanged;
 	constructor(deps) {
 		this.identityStore = deps.identityStore;
@@ -29666,6 +29771,7 @@ var FaceGalleryProvider = class {
 		this.logger = deps.logger;
 		this.refreshGallery = deps.refreshGallery;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
+		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 		this.emitFaceGalleryChanged = deps.emitFaceGalleryChanged;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
@@ -29853,13 +29959,7 @@ var FaceGalleryProvider = class {
 	* the enrolled identity copies — those live under identity owner).
 	*/
 	async getFaceMedia(input) {
-		return (await this.mediaStore.listByOwner("face", input.faceId)).map((m) => ({
-			key: m.key,
-			kind: m.kind,
-			base64: m.base64,
-			sizeBytes: m.sizeBytes,
-			timestamp: m.timestamp
-		}));
+		return (await this.mediaStore.listByOwner("face", input.faceId)).map((m) => toGalleryMediaRow(m, this.eventMediaPathPrefix()));
 	}
 	/**
 	* Assign a buffered face to an identity:
@@ -32572,50 +32672,136 @@ var FrameProcessor = class {
 		};
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/replay/frame-processor-pass.ts
+/** Bounded trackId → pending-upgrade map. Insertion-ordered, so the cap
+*  evicts the oldest record. */
+var PendingPreviewUpgrades = class {
+	entries = /* @__PURE__ */ new Map();
+	ttlMs;
+	maxEntries;
+	now;
+	constructor(options = {}) {
+		this.ttlMs = options.ttlMs ?? 9e5;
+		this.maxEntries = Math.max(1, options.maxEntries ?? 512);
+		this.now = options.now ?? (() => Date.now());
+	}
+	/** Record (or replace) a closed track's pending upgrade. Prunes expired
+	*  entries first, then evicts the oldest while over the cap. */
+	record(entry) {
+		this.prune();
+		this.entries.delete(entry.trackId);
+		this.entries.set(entry.trackId, entry);
+		while (this.entries.size > this.maxEntries) {
+			const oldest = this.entries.keys().next();
+			if (oldest.done === true) break;
+			this.entries.delete(oldest.value);
+		}
+	}
+	/** Claim a track's pending upgrade — removes it, so a second landing (or a
+	*  concurrent racer) finds nothing and the tile is rewritten at most once. */
+	take(trackId) {
+		this.prune();
+		const entry = this.entries.get(trackId);
+		if (entry === void 0) return void 0;
+		this.entries.delete(trackId);
+		return entry;
+	}
+	get size() {
+		return this.entries.size;
+	}
+	prune() {
+		const cutoff = this.now() - this.ttlMs;
+		for (const [trackId, entry] of this.entries) if (entry.recordedAtMs < cutoff) this.entries.delete(trackId);
+	}
+};
 /**
-* Run a FRESH `FrameProcessor` over a fixed, ordered sequence of frames and
-* return the tracks it produced.
-*
-* No `TrackStore`, no bus, no media — a track here is a summary built
-* ENTIRELY from `FrameProcessor.process()`'s in-memory return value.
+* Redeem a closed track's pending preview off a keyFrame that landed late.
+* Every non-`upgraded` outcome that had a pending entry logs itself — a
+* branch that leaves the stand-in in place must say so.
 */
-function runFrameProcessorPass(input) {
-	const processor = new FrameProcessor(input.deviceId, {}, {}, {}, input.source);
-	if (input.zones !== void 0) processor.setZones(input.zones);
-	if (input.detectionRules !== void 0) processor.setDetectionRules(input.detectionRules);
-	if (input.zoneMembershipMinOverlap !== void 0) processor.setZoneMembershipMinOverlap(input.zoneMembershipMinOverlap);
-	const accum = /* @__PURE__ */ new Map();
-	for (const { timestamp, frame } of input.frames) {
-		const result = processor.process({
-			timestamp,
-			frame
+async function runPreviewUpgrade(deps, input) {
+	const { deviceId, trackId } = input;
+	const pending = deps.takePending(trackId);
+	if (pending === void 0) return "no-pending";
+	const held = await deps.heldThumbnailProvenance(trackId);
+	if (held !== null && mediaProvenanceRank(held) >= mediaProvenanceRank("native")) {
+		deps.logger.info("late keyFrame: preview already native — no upgrade", {
+			tags: { deviceId },
+			meta: { trackId }
 		});
-		for (const td of result.tracked) {
-			const existing = accum.get(td.trackId);
-			const matched = td.matchedThisFrame ? 1 : 0;
-			if (existing === void 0) accum.set(td.trackId, {
-				className: td.className,
-				firstSeenMs: timestamp,
-				lastSeenMs: timestamp,
-				bbox: { ...td.bbox },
-				framesMatched: matched
-			});
-			else {
-				existing.className = td.className;
-				existing.lastSeenMs = timestamp;
-				existing.framesMatched += matched;
+		return "held-native";
+	}
+	if (pending.bestSeen === void 0) {
+		deps.logger.info("late keyFrame landed but no subject bbox was ever seen — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				heldProvenance: held
 			}
-		}
+		});
+		return "no-bbox";
 	}
-	return { tracks: [...accum.values()].map((t) => ({
-		className: t.className,
-		firstSeenMs: t.firstSeenMs,
-		lastSeenMs: t.lastSeenMs,
-		bbox: t.bbox,
-		framesMatched: t.framesMatched
-	})) };
+	if (pending.bestSeen.timestamp === void 0) {
+		deps.logger.info("late keyFrame: pending entry predates the motion guard — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				keyFrameKey: input.keyFrameKey,
+				heldProvenance: held
+			}
+		});
+		return "no-bbox";
+	}
+	const derived = await deps.derive({
+		deviceId,
+		mediaKey: input.keyFrameKey,
+		bbox: {
+			x: pending.bestSeen.x,
+			y: pending.bestSeen.y,
+			w: pending.bestSeen.w,
+			h: pending.bestSeen.h
+		},
+		frameWidth: pending.bestSeen.frameWidth,
+		frameHeight: pending.bestSeen.frameHeight,
+		timestamp: pending.bestSeen.timestamp
+	});
+	if (derived === null) {
+		deps.logger.info("late keyFrame preview upgrade failed (derive miss) — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				keyFrameKey: input.keyFrameKey,
+				heldProvenance: held
+			}
+		});
+		return "derive-miss";
+	}
+	await deps.put({
+		deviceId,
+		trackId,
+		kind: "thumbnail",
+		timestamp: input.timestamp,
+		data: derived.thumbnail,
+		provenance: "native"
+	});
+	await deps.put({
+		deviceId,
+		trackId,
+		kind: "thumbnailSmall",
+		timestamp: input.timestamp,
+		data: derived.thumbnailSmall,
+		provenance: "native"
+	});
+	await deps.clearPreviewMiss(deviceId, trackId);
+	deps.logger.info("best-shot upgraded from late keyFrame (stand-in replaced)", {
+		tags: { deviceId },
+		meta: {
+			trackId,
+			keyFrameKey: input.keyFrameKey,
+			replaced: held ?? "none",
+			skewMs: derived.skewMs
+		}
+	});
+	return "upgraded";
 }
 function isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, score) {
 	if (frameWidth <= 0 || frameHeight <= 0) return true;
@@ -32775,137 +32961,6 @@ function promoteSemanticBestFrame(deps, input) {
 		captured: true
 	};
 }
-/** Bounded trackId → pending-upgrade map. Insertion-ordered, so the cap
-*  evicts the oldest record. */
-var PendingPreviewUpgrades = class {
-	entries = /* @__PURE__ */ new Map();
-	ttlMs;
-	maxEntries;
-	now;
-	constructor(options = {}) {
-		this.ttlMs = options.ttlMs ?? 9e5;
-		this.maxEntries = Math.max(1, options.maxEntries ?? 512);
-		this.now = options.now ?? (() => Date.now());
-	}
-	/** Record (or replace) a closed track's pending upgrade. Prunes expired
-	*  entries first, then evicts the oldest while over the cap. */
-	record(entry) {
-		this.prune();
-		this.entries.delete(entry.trackId);
-		this.entries.set(entry.trackId, entry);
-		while (this.entries.size > this.maxEntries) {
-			const oldest = this.entries.keys().next();
-			if (oldest.done === true) break;
-			this.entries.delete(oldest.value);
-		}
-	}
-	/** Claim a track's pending upgrade — removes it, so a second landing (or a
-	*  concurrent racer) finds nothing and the tile is rewritten at most once. */
-	take(trackId) {
-		this.prune();
-		const entry = this.entries.get(trackId);
-		if (entry === void 0) return void 0;
-		this.entries.delete(trackId);
-		return entry;
-	}
-	get size() {
-		return this.entries.size;
-	}
-	prune() {
-		const cutoff = this.now() - this.ttlMs;
-		for (const [trackId, entry] of this.entries) if (entry.recordedAtMs < cutoff) this.entries.delete(trackId);
-	}
-};
-/**
-* Redeem a closed track's pending preview off a keyFrame that landed late.
-* Every non-`upgraded` outcome that had a pending entry logs itself — a
-* branch that leaves the stand-in in place must say so.
-*/
-async function runPreviewUpgrade(deps, input) {
-	const { deviceId, trackId } = input;
-	const pending = deps.takePending(trackId);
-	if (pending === void 0) return "no-pending";
-	const held = await deps.heldThumbnailProvenance(trackId);
-	if (held !== null && mediaProvenanceRank(held) >= mediaProvenanceRank("native")) {
-		deps.logger.info("late keyFrame: preview already native — no upgrade", {
-			tags: { deviceId },
-			meta: { trackId }
-		});
-		return "held-native";
-	}
-	if (pending.bestSeen === void 0) {
-		deps.logger.info("late keyFrame landed but no subject bbox was ever seen — tile kept as-is", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				heldProvenance: held
-			}
-		});
-		return "no-bbox";
-	}
-	if (pending.bestSeen.timestamp === void 0) {
-		deps.logger.info("late keyFrame: pending entry predates the motion guard — tile kept as-is", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				keyFrameKey: input.keyFrameKey,
-				heldProvenance: held
-			}
-		});
-		return "no-bbox";
-	}
-	const derived = await deps.derive({
-		deviceId,
-		mediaKey: input.keyFrameKey,
-		bbox: {
-			x: pending.bestSeen.x,
-			y: pending.bestSeen.y,
-			w: pending.bestSeen.w,
-			h: pending.bestSeen.h
-		},
-		frameWidth: pending.bestSeen.frameWidth,
-		frameHeight: pending.bestSeen.frameHeight,
-		timestamp: pending.bestSeen.timestamp
-	});
-	if (derived === null) {
-		deps.logger.info("late keyFrame preview upgrade failed (derive miss) — tile kept as-is", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				keyFrameKey: input.keyFrameKey,
-				heldProvenance: held
-			}
-		});
-		return "derive-miss";
-	}
-	await deps.put({
-		deviceId,
-		trackId,
-		kind: "thumbnail",
-		timestamp: input.timestamp,
-		data: derived.thumbnail,
-		provenance: "native"
-	});
-	await deps.put({
-		deviceId,
-		trackId,
-		kind: "thumbnailSmall",
-		timestamp: input.timestamp,
-		data: derived.thumbnailSmall,
-		provenance: "native"
-	});
-	await deps.clearPreviewMiss(deviceId, trackId);
-	deps.logger.info("best-shot upgraded from late keyFrame (stand-in replaced)", {
-		tags: { deviceId },
-		meta: {
-			trackId,
-			keyFrameKey: input.keyFrameKey,
-			replaced: held ?? "none",
-			skewMs: derived.skewMs
-		}
-	});
-	return "upgraded";
-}
 //#endregion
 //#region src/pipeline-analytics/store/zone-geometry.ts
 /**
@@ -34644,6 +34699,7 @@ var PlateGalleryProvider = class {
 	refreshGallery;
 	emitPlateGalleryChanged;
 	eventMediaBaseUrl;
+	eventMediaPathPrefix;
 	constructor(deps) {
 		this.plateStore = deps.plateStore;
 		this.vehicleStore = deps.vehicleStore;
@@ -34654,6 +34710,7 @@ var PlateGalleryProvider = class {
 		this.refreshGallery = deps.refreshGallery;
 		this.emitPlateGalleryChanged = deps.emitPlateGalleryChanged;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
+		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
 	safeEmitPlateGalleryChanged(payload) {
@@ -34724,13 +34781,7 @@ var PlateGalleryProvider = class {
 		return this.toPlateInfo(plate, nameMap, { includeCrops: false });
 	}
 	async getPlateMedia(input) {
-		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => ({
-			key: m.key,
-			kind: m.kind,
-			base64: m.base64,
-			sizeBytes: m.sizeBytes,
-			timestamp: m.timestamp
-		}));
+		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => toGalleryMediaRow(m, this.eventMediaPathPrefix()));
 	}
 	async searchPlates(input) {
 		const maxDistance = input.maxDistance ?? 1;
@@ -34973,6 +35024,51 @@ var PlateGalleryProvider = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/replay/frame-processor-pass.ts
+/**
+* Run a FRESH `FrameProcessor` over a fixed, ordered sequence of frames and
+* return the tracks it produced.
+*
+* No `TrackStore`, no bus, no media — a track here is a summary built
+* ENTIRELY from `FrameProcessor.process()`'s in-memory return value.
+*/
+function runFrameProcessorPass(input) {
+	const processor = new FrameProcessor(input.deviceId, {}, {}, {}, input.source);
+	if (input.zones !== void 0) processor.setZones(input.zones);
+	if (input.detectionRules !== void 0) processor.setDetectionRules(input.detectionRules);
+	if (input.zoneMembershipMinOverlap !== void 0) processor.setZoneMembershipMinOverlap(input.zoneMembershipMinOverlap);
+	const accum = /* @__PURE__ */ new Map();
+	for (const { timestamp, frame } of input.frames) {
+		const result = processor.process({
+			timestamp,
+			frame
+		});
+		for (const td of result.tracked) {
+			const existing = accum.get(td.trackId);
+			const matched = td.matchedThisFrame ? 1 : 0;
+			if (existing === void 0) accum.set(td.trackId, {
+				className: td.className,
+				firstSeenMs: timestamp,
+				lastSeenMs: timestamp,
+				bbox: { ...td.bbox },
+				framesMatched: matched
+			});
+			else {
+				existing.className = td.className;
+				existing.lastSeenMs = timestamp;
+				existing.framesMatched += matched;
+			}
+		}
+	}
+	return { tracks: [...accum.values()].map((t) => ({
+		className: t.className,
+		firstSeenMs: t.firstSeenMs,
+		lastSeenMs: t.lastSeenMs,
+		bbox: t.bbox,
+		framesMatched: t.framesMatched
+	})) };
+}
+//#endregion
 //#region src/pipeline-analytics/retention/disk-reconcile.ts
 /**
 * Disk-wins reconcile for pipeline analytics.
@@ -35037,93 +35133,6 @@ async function reconcileDeviceFromDisk(deps, deviceId) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
-/**
-* The operator button for the debug-media reclaim.
-*
-* The mechanism ships armed with nothing: **arming it is the operator's
-* call**. `mode` omitted means `report` — it counts, logs one line per camera
-* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
-* that has to be typed.
-*
-* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
-* earned it: dry-run default, explicit pacing, explicit blast radius, and a
-* report you can read instead of a log line you have to find.
-*/
-/**
-* `report` counts; `reclaim` deletes.
-*
-* `.default('report')` is load-bearing: the settings form sends `{}` for a
-* button with no fields, and the safe reading of an unstated intent is the one
-* that destroys nothing.
-*/
-var MediaReclaimActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
-var MediaReclaimScopeSchema = require_dist._enum(["motion-still", "track-filmstrip"]);
-var MediaReclaimActionInputSchema = require_dist.object({
-	mode: MediaReclaimActionModeSchema,
-	/** Which populations to walk. Omitted = both. */
-	scopes: require_dist.array(MediaReclaimScopeSchema).min(1).optional(),
-	/** Restrict to these cameras. Omitted = every camera in retention scope. */
-	deviceIds: require_dist.array(require_dist.number().int()).min(1).optional(),
-	/** Start every device from the top instead of resuming its cursor. */
-	restart: require_dist.boolean().optional(),
-	/** Rows read per statement. Smaller = more yields = a gentler pass. */
-	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
-	/** Rows EXAMINED per camera in this pass — the pacing bound. */
-	maxRowsPerDevice: require_dist.number().int().min(1).max(5e5).optional(),
-	/** Rows DELETED per camera in this pass — the blast-radius bound. */
-	maxReclaimPerDevice: require_dist.number().int().min(1).max(5e5).optional(),
-	/** Bytes released across the whole run — the disk-contention bound. */
-	maxBytesPerRun: require_dist.number().int().min(1).optional(),
-	/** Wall-clock ceiling for the run. */
-	budgetMinutes: require_dist.number().int().min(1).max(720).optional(),
-	/**
-	* Bytes per second the pass may release. The recordings volume sustains
-	* ~4 MB/s and the archive needs it more than this does; the default is half
-	* of that.
-	*/
-	throttleBytesPerSec: require_dist.number().int().min(64 * 1024).optional(),
-	/**
-	* Minutes of immunity for a recent row. Protective ONLY — raising it can
-	* exclusively save rows, never select them.
-	*/
-	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
-});
-var MediaReclaimDeviceReportSchema = require_dist.object({
-	deviceId: require_dist.number(),
-	scope: MediaReclaimScopeSchema,
-	examined: require_dist.number(),
-	eligible: require_dist.number(),
-	reclaimed: require_dist.number(),
-	bytesReclaimed: require_dist.number(),
-	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
-	held: require_dist.number(),
-	/** Rows kept because the owner could not be shown to be a motion event. */
-	unresolved: require_dist.number(),
-	withinGrace: require_dist.number(),
-	/** Deletes that REFUSED — the blob survived or the volume could not answer.
-	*  The row was kept and the cursor did not pass it. */
-	refused: require_dist.number(),
-	stoppedBy: require_dist.string(),
-	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
-	nextCursor: require_dist.number()
-});
-var MediaReclaimActionResultSchema = require_dist.object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: require_dist.boolean(),
-	mode: require_dist._enum(["report", "reclaim"]),
-	devices: require_dist.array(MediaReclaimDeviceReportSchema),
-	totalExamined: require_dist.number(),
-	totalEligible: require_dist.number(),
-	totalReclaimed: require_dist.number(),
-	totalBytesReclaimed: require_dist.number(),
-	totalRefused: require_dist.number(),
-	durationMs: require_dist.number(),
-	/** Every device+scope reported `exhausted` — there is nothing left to do. */
-	complete: require_dist.boolean()
-});
-var mediaReclaimActions = require_dist.defineCustomActions({ "retention.mediaReclaim": require_dist.customAction(MediaReclaimActionInputSchema, MediaReclaimActionResultSchema, { auth: "admin" }) });
-//#endregion
 //#region src/pipeline-analytics/retention/media-reclaim.ts
 var MEDIA_RECLAIM_SCOPES = ["motion-still", "track-filmstrip"];
 var DEFAULT_MEDIA_RECLAIM_LIMITS = {
@@ -35335,6 +35344,93 @@ async function runMediaReclaim(input) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
+/**
+* The operator button for the debug-media reclaim.
+*
+* The mechanism ships armed with nothing: **arming it is the operator's
+* call**. `mode` omitted means `report` — it counts, logs one line per camera
+* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
+* that has to be typed.
+*
+* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
+* earned it: dry-run default, explicit pacing, explicit blast radius, and a
+* report you can read instead of a log line you have to find.
+*/
+/**
+* `report` counts; `reclaim` deletes.
+*
+* `.default('report')` is load-bearing: the settings form sends `{}` for a
+* button with no fields, and the safe reading of an unstated intent is the one
+* that destroys nothing.
+*/
+var MediaReclaimActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
+var MediaReclaimScopeSchema = require_dist._enum(["motion-still", "track-filmstrip"]);
+var MediaReclaimActionInputSchema = require_dist.object({
+	mode: MediaReclaimActionModeSchema,
+	/** Which populations to walk. Omitted = both. */
+	scopes: require_dist.array(MediaReclaimScopeSchema).min(1).optional(),
+	/** Restrict to these cameras. Omitted = every camera in retention scope. */
+	deviceIds: require_dist.array(require_dist.number().int()).min(1).optional(),
+	/** Start every device from the top instead of resuming its cursor. */
+	restart: require_dist.boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per camera in this pass — the pacing bound. */
+	maxRowsPerDevice: require_dist.number().int().min(1).max(5e5).optional(),
+	/** Rows DELETED per camera in this pass — the blast-radius bound. */
+	maxReclaimPerDevice: require_dist.number().int().min(1).max(5e5).optional(),
+	/** Bytes released across the whole run — the disk-contention bound. */
+	maxBytesPerRun: require_dist.number().int().min(1).optional(),
+	/** Wall-clock ceiling for the run. */
+	budgetMinutes: require_dist.number().int().min(1).max(720).optional(),
+	/**
+	* Bytes per second the pass may release. The recordings volume sustains
+	* ~4 MB/s and the archive needs it more than this does; the default is half
+	* of that.
+	*/
+	throttleBytesPerSec: require_dist.number().int().min(64 * 1024).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them.
+	*/
+	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
+});
+var MediaReclaimDeviceReportSchema = require_dist.object({
+	deviceId: require_dist.number(),
+	scope: MediaReclaimScopeSchema,
+	examined: require_dist.number(),
+	eligible: require_dist.number(),
+	reclaimed: require_dist.number(),
+	bytesReclaimed: require_dist.number(),
+	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
+	held: require_dist.number(),
+	/** Rows kept because the owner could not be shown to be a motion event. */
+	unresolved: require_dist.number(),
+	withinGrace: require_dist.number(),
+	/** Deletes that REFUSED — the blob survived or the volume could not answer.
+	*  The row was kept and the cursor did not pass it. */
+	refused: require_dist.number(),
+	stoppedBy: require_dist.string(),
+	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
+	nextCursor: require_dist.number()
+});
+var MediaReclaimActionResultSchema = require_dist.object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: require_dist.boolean(),
+	mode: require_dist._enum(["report", "reclaim"]),
+	devices: require_dist.array(MediaReclaimDeviceReportSchema),
+	totalExamined: require_dist.number(),
+	totalEligible: require_dist.number(),
+	totalReclaimed: require_dist.number(),
+	totalBytesReclaimed: require_dist.number(),
+	totalRefused: require_dist.number(),
+	durationMs: require_dist.number(),
+	/** Every device+scope reported `exhausted` — there is nothing left to do. */
+	complete: require_dist.boolean()
+});
+var mediaReclaimActions = require_dist.defineCustomActions({ "retention.mediaReclaim": require_dist.customAction(MediaReclaimActionInputSchema, MediaReclaimActionResultSchema, { auth: "admin" }) });
+//#endregion
 //#region src/pipeline-analytics/retention/orphan-audit-actions.ts
 /**
 * The operator button for the orphan audit.
@@ -36691,6 +36787,28 @@ function trackMediaScopesForKinds(trackId, kinds) {
 	return kinds.some((kind) => DETAIL_CROP_KINDS.includes(kind)) ? scopes : scopes.filter((scope) => scope.publishCropAs === null);
 }
 /**
+* The STORED kinds worth reading from one scope for a `kinds` request, or
+* `null` when the scope cannot contribute to it at all.
+*
+* This is the same vocabulary translation {@link collectTrackMedia} performs on
+* the way out, moved to the way IN so it can narrow the query instead of the
+* answer. A caller naming `faceCrop` must ask the face owner for its stored
+* `crop` — asking it for `faceCrop` matches nothing, and asking it for
+* everything opens blobs the answer will discard.
+*
+* `undefined` means "every kind": the honest translation of an unfiltered
+* request, and the only safe answer for the open-ended track scope.
+*
+* `null` (skip) is only ever returned for a DETAIL owner whose one publishable
+* kind was not asked for. The track scope is never skipped — its kinds are
+* open-ended, and dropping it on a guess is how a listing starts lying.
+*/
+function storedKindsForScope(scope, kinds) {
+	if (kinds === void 0 || kinds.length === 0) return void 0;
+	if (scope.publishCropAs === null) return kinds;
+	return kinds.includes(scope.publishCropAs) ? [STORED_DETAIL_CROP_KIND] : null;
+}
+/**
 * Fold every scope's rows into ONE track media listing: detail crops
 * relabelled, everything filtered to `kinds`, ordered oldest first.
 *
@@ -36827,8 +36945,10 @@ var AnalyticsQueryFacade = class {
 		return this.withMediaUrl(events);
 	}
 	async getEventMedia(input) {
-		const all = await (this.deps.mediaStore()?.listByOwner("event", input.eventId, input.deviceId) ?? Promise.resolve([]));
-		return input.kind ? all.filter((m) => m.kind === input.kind) : all;
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
+		return (await store.listByOwner("event", input.eventId, input.deviceId, input.kind === void 0 ? void 0 : [input.kind])).map((row) => toWireMediaFile(row, prefix));
 	}
 	/**
 	* A track's media WITH the bytes, restricted to `kinds` when given.
@@ -36841,14 +36961,36 @@ var AnalyticsQueryFacade = class {
 	async getTrackMedia(input) {
 		const store = this.deps.mediaStore();
 		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
 		const scopes = trackMediaScopesForKinds(input.trackId, input.kinds);
-		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => ({
-			scope,
-			rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
-		}))), (row, kind) => ({
+		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => {
+			const stored = storedKindsForScope(scope, input.kinds);
+			if (stored === null) return {
+				scope,
+				rows: []
+			};
+			return {
+				scope,
+				rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId, stored)
+			};
+		})), (row, kind) => ({
 			...row,
 			kind
-		}), input.kinds);
+		}), input.kinds).map((row) => toWireMediaFile(row, prefix));
+	}
+	/**
+	* An event's media WITHOUT the bytes.
+	*
+	* Index rows only — it never opens a blob. The track detail modal unions
+	* this with {@link listTrackMedia} to build its filmstrip and then fetches
+	* each tile from the `event-media` plane by key, so the bytes this used to
+	* carry were read, base64'd, shipped and discarded.
+	*/
+	async listEventMedia(input) {
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
+		return (await store.listInfoByOwner("event", input.eventId, input.deviceId)).map((row) => toWireMediaFileInfo(row, prefix));
 	}
 	/**
 	* A track's media WITHOUT the bytes.
@@ -36866,13 +37008,14 @@ var AnalyticsQueryFacade = class {
 	async listTrackMedia(input) {
 		const store = this.deps.mediaStore();
 		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
 		return collectTrackMedia(await Promise.all(trackMediaOwnerScopes(input.trackId).map(async (scope) => ({
 			scope,
 			rows: await store.listInfoByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
 		}))), (row, kind) => ({
 			...row,
 			kind
-		}), void 0);
+		}), void 0).map((row) => toWireMediaFileInfo(row, prefix));
 	}
 	async pruneEventsBefore(input) {
 		const eventStore = this.deps.eventStore();
@@ -39317,6 +39460,31 @@ function createEventMediaHandler(deps) {
 }
 //#endregion
 //#region src/pipeline-analytics/event-thumbnail-resolver.ts
+/**
+* Rank `candidates` with `pick`, then open ONE blob — the winner's.
+*
+* The ladders decide on `kind` alone, so the bytes are dead weight until the
+* choice is made. Handing them pre-read rows meant a tile that serves the
+* 31 KB `thumbnailSmall` first read the whole 3 597 219-byte set, including a
+* 2.8 MB `keyFrame` no list view has ever rendered.
+*
+* A winner whose blob is GONE is dropped and the ladder re-run on the rest.
+* That fall-through is not an extra: `listByOwner` used to provide it for free
+* by skipping unreadable rows before the ladder ever saw them, and without it
+* an index row that outlived its file would 404 a tile that used to render.
+* Bounded by the candidate count — each attempt removes one row.
+*/
+async function readWinningBlob(candidates, pick, readBlob) {
+	let remaining = candidates;
+	while (remaining.length > 0) {
+		const winner = pick(remaining);
+		if (winner === void 0) return null;
+		const bytes = await readBlob(winner.key);
+		if (bytes !== null) return bytes;
+		remaining = remaining.filter((row) => row.key !== winner.key);
+	}
+	return null;
+}
 /** Pick an event-OWNED media blob: the tight `crop`, else the native-res boxed
 *  `fullFrameBoxed`, else any available file. Both preferred kinds are RETIRED
 *  for new tracks (served only for old stored rows). Undefined when the event
@@ -39367,15 +39535,24 @@ async function collectCropForcedMedia(source, id) {
 	};
 }
 /**
-* Resolve the default-path media for an event id: the event's own media when it
-* has any, else the owning track's fallback media. Returns `null` when neither
-* yields a blob (caller 404s → the surface shows an icon).
+* Which rows the default path should serve from, and how to rank them: the
+* event's OWN media when it has any, else the owning track's.
+*
+* It yields the candidate SET rather than a winner so the caller can open one
+* blob and, if that blob has gone, re-rank the rest ({@link readWinningBlob}).
+* Returning a single row would force the caller to read it blind and 404 a tile
+* whose index row outlived its file.
 */
-async function resolveDefaultEventMedia(deps) {
-	const owned = pickEventOwnedMedia(deps.eventFiles);
-	if (owned) return owned;
+async function collectDefaultEventMedia(deps) {
+	if (deps.eventFiles.length > 0) return {
+		candidates: deps.eventFiles,
+		pick: pickEventOwnedMedia
+	};
 	const trackId = await deps.getTrackIdForEvent(deps.eventId) ?? deps.eventId;
-	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
+	return {
+		candidates: await deps.listTrackMedia(trackId),
+		pick: pickTrackFallbackMedia
+	};
 }
 //#endregion
 //#region src/pipeline-analytics/face-settings.ts
@@ -47483,6 +47660,70 @@ var PackageDropDetector = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
+/**
+* How much of the PERSON box must sit inside a vehicle box to be counted.
+*
+* 0.8 and not 1.0: a phantom raised on a car's window pillar or wing mirror
+* routinely pokes a little outside the vehicle box, and requiring total
+* containment would count almost none of them. 0.8 and not 0.5: half a person
+* box overlapping a car is what a pedestrian walking in front of one looks
+* like, and counting those would make the number mean "somebody was near a
+* car", which is not a defect.
+*/
+var CONTAINMENT_THRESHOLD = .8;
+/**
+* The classes that count as a vehicle for this test.
+*
+* A local list rather than a shared taxonomy on purpose: it exists to describe
+* ONE measurement, and a shared enum would make a change here silently change
+* detection behaviour somewhere else.
+*/
+var VEHICLE_CLASSES$1 = [
+	"car",
+	"truck",
+	"bus",
+	"motorcycle",
+	"vehicle"
+];
+/** Area of the intersection of two boxes. `0` when they do not overlap. */
+function intersectionArea(a, b) {
+	const left = Math.max(a.x, b.x);
+	const right = Math.min(a.x + a.w, b.x + b.w);
+	const top = Math.max(a.y, b.y);
+	const bottom = Math.min(a.y + a.h, b.y + b.h);
+	if (right <= left || bottom <= top) return 0;
+	return (right - left) * (bottom - top);
+}
+/**
+* Fraction of `person` that lies inside `vehicle`, in `[0,1]`.
+*
+* `0` for a degenerate person box: a zero-area box is inside everything and
+* inside nothing, and answering `1` would count every one of them.
+*/
+function containedFraction(person, vehicle) {
+	const area = person.w * person.h;
+	if (area <= 0) return 0;
+	return intersectionArea(person, vehicle) / area;
+}
+/**
+* Is this person box contained in any vehicle box in the same frame?
+*
+* Returns the fraction for the BEST-containing vehicle when it clears
+* {@link CONTAINMENT_THRESHOLD}, else `null`. The fraction rides along because
+* a counter that only ever says "yes" cannot later be re-thresholded against
+* what was actually measured.
+*/
+function personOverVehicle(person, neighbours, threshold = CONTAINMENT_THRESHOLD) {
+	let best = 0;
+	for (const neighbour of neighbours) {
+		if (!VEHICLE_CLASSES$1.includes(neighbour.className)) continue;
+		const fraction = containedFraction(person, neighbour.bbox);
+		if (fraction > best) best = fraction;
+	}
+	return best >= threshold ? best : null;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-evidence.ts
 /**
 * stationary-evidence — how a parked object EARNS a registry entry.
@@ -50014,83 +50255,6 @@ function buildRecordedStillPorts(input) {
 		})
 	};
 }
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-async function reconcileGallerySamples(deps, options) {
-	let checked = 0;
-	let reclaimed = 0;
-	let keyless = 0;
-	let skippedGrace = 0;
-	let stoppedByCeiling = false;
-	const identities = await deps.listIdentities();
-	for (const identity of identities) {
-		const samples = await deps.listSamples(identity.id);
-		for (const sample of samples) {
-			if (sample.mediaKey === void 0) {
-				keyless += 1;
-				continue;
-			}
-			if (options.now - sample.addedAt < options.graceMs) {
-				skippedGrace += 1;
-				continue;
-			}
-			if (reclaimed >= options.maxReclaimPerRun) {
-				stoppedByCeiling = true;
-				deps.logger.warn("gallery reconcile: reclaim ceiling reached — remaining dead references keep until the next run", { meta: { ceiling: options.maxReclaimPerRun } });
-				return {
-					checked,
-					reclaimed,
-					keyless,
-					skippedGrace,
-					stoppedByCeiling
-				};
-			}
-			let state;
-			try {
-				state = await deps.blobState(sample.mediaKey);
-			} catch (err) {
-				const reason = errorMessage(err);
-				deps.logger.warn("gallery reconcile: a blob probe FAILED — aborting the pass, keeping every row", { meta: {
-					sampleId: sample.id,
-					identity: identity.name,
-					error: reason
-				} });
-				return {
-					checked,
-					reclaimed,
-					keyless,
-					skippedGrace,
-					stoppedByCeiling,
-					aborted: reason
-				};
-			}
-			checked += 1;
-			if (state === "exists") continue;
-			await deps.removeSample(identity.id, sample.id);
-			reclaimed += 1;
-			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
-				sampleId: sample.id,
-				identity: identity.name,
-				mediaKey: sample.mediaKey,
-				state
-			} });
-		}
-	}
-	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
-		checked,
-		reclaimed,
-		keyless,
-		skippedGrace
-	} });
-	return {
-		checked,
-		reclaimed,
-		keyless,
-		skippedGrace,
-		stoppedByCeiling
-	};
-}
 //#endregion
 //#region src/pipeline-analytics/retention/embedding-orphan-scan.ts
 /** The scope id this leg reports and persists its cursor under. */
@@ -50207,6 +50371,83 @@ async function scanEmbeddingOrphans(deps, limits, cursor) {
 		nextCursor: Math.max(0, offset)
 	};
 }
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function reconcileGallerySamples(deps, options) {
+	let checked = 0;
+	let reclaimed = 0;
+	let keyless = 0;
+	let skippedGrace = 0;
+	let stoppedByCeiling = false;
+	const identities = await deps.listIdentities();
+	for (const identity of identities) {
+		const samples = await deps.listSamples(identity.id);
+		for (const sample of samples) {
+			if (sample.mediaKey === void 0) {
+				keyless += 1;
+				continue;
+			}
+			if (options.now - sample.addedAt < options.graceMs) {
+				skippedGrace += 1;
+				continue;
+			}
+			if (reclaimed >= options.maxReclaimPerRun) {
+				stoppedByCeiling = true;
+				deps.logger.warn("gallery reconcile: reclaim ceiling reached — remaining dead references keep until the next run", { meta: { ceiling: options.maxReclaimPerRun } });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling
+				};
+			}
+			let state;
+			try {
+				state = await deps.blobState(sample.mediaKey);
+			} catch (err) {
+				const reason = errorMessage(err);
+				deps.logger.warn("gallery reconcile: a blob probe FAILED — aborting the pass, keeping every row", { meta: {
+					sampleId: sample.id,
+					identity: identity.name,
+					error: reason
+				} });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling,
+					aborted: reason
+				};
+			}
+			checked += 1;
+			if (state === "exists") continue;
+			await deps.removeSample(identity.id, sample.id);
+			reclaimed += 1;
+			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
+				sampleId: sample.id,
+				identity: identity.name,
+				mediaKey: sample.mediaKey,
+				state
+			} });
+		}
+	}
+	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
+		checked,
+		reclaimed,
+		keyless,
+		skippedGrace
+	} });
+	return {
+		checked,
+		reclaimed,
+		keyless,
+		skippedGrace,
+		stoppedByCeiling
+	};
+}
 /**
 * Where the completion marker lives.
 *
@@ -53269,14 +53510,14 @@ function isAfterCursor(row, cursor) {
 	if (row.lastSeen < cursor.lastSeen) return true;
 	return row.lastSeen === cursor.lastSeen && row.id < cursor.trackId;
 }
-var VEHICLE_CLASSES$1 = new Set([
+var VEHICLE_CLASSES = new Set([
 	"vehicle",
 	"car",
 	"truck",
 	"bus"
 ]);
 function motionlessMaxPxForClass(className) {
-	return VEHICLE_CLASSES$1.has(className.toLowerCase()) ? 8 : 40;
+	return VEHICLE_CLASSES.has(className.toLowerCase()) ? 8 : 40;
 }
 function netDisplacementPx(positions) {
 	const first = positions[0];
@@ -57036,70 +57277,6 @@ function hasWrappedDetection(entries) {
 	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
-/**
-* How much of the PERSON box must sit inside a vehicle box to be counted.
-*
-* 0.8 and not 1.0: a phantom raised on a car's window pillar or wing mirror
-* routinely pokes a little outside the vehicle box, and requiring total
-* containment would count almost none of them. 0.8 and not 0.5: half a person
-* box overlapping a car is what a pedestrian walking in front of one looks
-* like, and counting those would make the number mean "somebody was near a
-* car", which is not a defect.
-*/
-var CONTAINMENT_THRESHOLD = .8;
-/**
-* The classes that count as a vehicle for this test.
-*
-* A local list rather than a shared taxonomy on purpose: it exists to describe
-* ONE measurement, and a shared enum would make a change here silently change
-* detection behaviour somewhere else.
-*/
-var VEHICLE_CLASSES = [
-	"car",
-	"truck",
-	"bus",
-	"motorcycle",
-	"vehicle"
-];
-/** Area of the intersection of two boxes. `0` when they do not overlap. */
-function intersectionArea(a, b) {
-	const left = Math.max(a.x, b.x);
-	const right = Math.min(a.x + a.w, b.x + b.w);
-	const top = Math.max(a.y, b.y);
-	const bottom = Math.min(a.y + a.h, b.y + b.h);
-	if (right <= left || bottom <= top) return 0;
-	return (right - left) * (bottom - top);
-}
-/**
-* Fraction of `person` that lies inside `vehicle`, in `[0,1]`.
-*
-* `0` for a degenerate person box: a zero-area box is inside everything and
-* inside nothing, and answering `1` would count every one of them.
-*/
-function containedFraction(person, vehicle) {
-	const area = person.w * person.h;
-	if (area <= 0) return 0;
-	return intersectionArea(person, vehicle) / area;
-}
-/**
-* Is this person box contained in any vehicle box in the same frame?
-*
-* Returns the fraction for the BEST-containing vehicle when it clears
-* {@link CONTAINMENT_THRESHOLD}, else `null`. The fraction rides along because
-* a counter that only ever says "yes" cannot later be re-thresholded against
-* what was actually measured.
-*/
-function personOverVehicle(person, neighbours, threshold = CONTAINMENT_THRESHOLD) {
-	let best = 0;
-	for (const neighbour of neighbours) {
-		if (!VEHICLE_CLASSES.includes(neighbour.className)) continue;
-		const fraction = containedFraction(person, neighbour.bbox);
-		if (fraction > best) best = fraction;
-	}
-	return best >= threshold ? best : null;
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
 	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
@@ -63541,6 +63718,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	*  Set once the data-plane is registered; null until then (e.g. no
 	*  dataPlane facility in the current environment). */
 	eventMediaBaseUrl = null;
+	/**
+	* The SAME path, derived rather than observed — a pure function of the addon
+	* id, so it exists before `serve()` is attempted and survives its failure.
+	*
+	* `eventMediaBaseUrl` above answers "is the plane up?", which is the right
+	* question for the OPTIONAL `mediaUrl` stamp on a slim event projection.
+	* It is the wrong question for a media row's `url`, which is that row's only
+	* address: a row that dropped its address on a boot race would be
+	* indistinguishable from a row with no bytes, and this repo has already paid
+	* for one read that quietly returned less than it was asked for.
+	*/
+	eventMediaPathPrefix() {
+		return `/addon/${this.ctx.id}/event-media`;
+	}
 	lastActiveTrackIds = /* @__PURE__ */ new Map();
 	/** See `pipeline/suppressed-births.ts` — rejected births must not be
 	*  re-upserted, and must be forgotten when the tracker drops the id. */
@@ -63791,6 +63982,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		sensorEventStore: () => this.sensorEventStore,
 		opsLog: () => this.eventsOpsLog,
 		eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+		eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 		logger: () => this.ctx.logger,
 		zoneCatalogue: () => this.zoneCatalogue
 	});
@@ -66333,6 +66525,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			logger: this.ctx.logger,
 			refreshGallery: () => this.faceRecognizer?.refreshGallery(),
 			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+			eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 			emitFaceGalleryChanged: (payload) => this.emitFaceGalleryChanged(payload)
 		});
 		this.faceGalleryProvider = faceGallery;
@@ -66347,6 +66540,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				this.plateRecognizer?.refreshGallery();
 			},
 			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+			eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 			emitPlateGalleryChanged: (payload) => this.emitPlateGalleryChanged(payload)
 		});
 		return [
@@ -70032,6 +70226,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	async listTrackMedia(input) {
 		return this.queryFacade.listTrackMedia(input);
 	}
+	/** What media an EVENT has, without any of it — the same manifest, for the
+	*  half of the detail modal's filmstrip that is event-owned. */
+	async listEventMedia(input) {
+		return this.queryFacade.listEventMedia(input);
+	}
 	/**
 	* Search object events by text using CLIP cosine similarity.
 	*
@@ -71752,31 +71951,44 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			return media;
 		}
 	}
+	/**
+	* Resolve an event/track id to ONE tile's bytes.
+	*
+	* Every ladder below ranks rows by `kind` alone, so this walks the INDEX
+	* (`listInfoByOwner`, no blob opened) and opens only the winner. It used to
+	* walk `listByOwner`, which reads and base64-encodes every blob an owner
+	* holds before the first comparison is made: measured on the live hub
+	* 2026-08-30, a track's six kinds are 3 597 219 bytes and the tile serves
+	* `thumbnailSmall` — 31 155 of them. An Events page of forty tiles read
+	* ~144 MB and allocated ~190 MB of base64 to deliver ~1.2 MB, all of it on
+	* the single-threaded post-analysis runner.
+	*/
 	async readEventThumbnail(id, preferKind) {
-		const eventFiles = await (this.mediaStore?.listByOwner("event", id) ?? Promise.resolve([]));
+		const listInfo = (ownerKind, ownerId) => this.mediaStore?.listInfoByOwner(ownerKind, ownerId) ?? Promise.resolve([]);
+		const getTrackIdForEvent = (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null);
+		const readBlob = async (key) => {
+			const file = await (this.mediaStore?.getByKey(key) ?? Promise.resolve(null));
+			return file === null ? null : {
+				bytes: Buffer.from(file.base64, "base64"),
+				key: file.key
+			};
+		};
+		const eventFiles = await listInfo("event", id);
 		if (preferKind !== void 0 && preferKind.length > 0) {
 			const layers = await collectCropForcedMedia({
-				listByOwner: (ownerKind, ownerId) => this.mediaStore?.listByOwner(ownerKind, ownerId) ?? Promise.resolve([]),
-				getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+				listByOwner: listInfo,
+				getTrackIdForEvent
 			}, id);
-			const chosen = resolveCropForcedMedia(layers.bodyFiles, (files) => pickCleanMedia(files, preferKind), layers.detailFiles);
-			if (!chosen) return null;
-			return {
-				bytes: Buffer.from(chosen.base64, "base64"),
-				key: chosen.key
-			};
+			const bodyKeys = new Set(layers.bodyFiles.map((f) => f.key));
+			return await readWinningBlob([...layers.bodyFiles, ...layers.detailFiles], (rows) => resolveCropForcedMedia(rows.filter((r) => bodyKeys.has(r.key)), (files) => pickCleanMedia(files, preferKind), rows.filter((r) => !bodyKeys.has(r.key))), readBlob);
 		}
-		const chosen = await resolveDefaultEventMedia({
+		const { candidates, pick } = await collectDefaultEventMedia({
 			eventId: id,
 			eventFiles,
-			listTrackMedia: (trackId) => this.mediaStore?.listByOwner("track", trackId) ?? Promise.resolve([]),
-			getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+			listTrackMedia: (trackId) => listInfo("track", trackId),
+			getTrackIdForEvent
 		});
-		if (!chosen) return null;
-		return {
-			bytes: Buffer.from(chosen.base64, "base64"),
-			key: chosen.key
-		};
+		return await readWinningBlob(candidates, pick, readBlob);
 	}
 	globalSettingsSchema(cap) {
 		return this.schema(buildGlobalSettingsSchema(cap));