@camstack/addon-post-analysis 1.2.151 → 1.2.153

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as audioModeOf, A as NcSnoozeSchema, At as BaseAddon, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as discriminatedUnion, C as NcConditionDescriptorSchema, Ct as sceneMonitorCapability, D as NcRuleTargetSchema, Dt as videoclipsCapability, E as NcRuleSchema, Et as vectorDimFromBase64, Ft as nodePin, G as TimelapseRulePatchSchema, Gt as record, H as SceneMonitorSchema, Ht as number, I as RECORDING_EXPORT_MAX_READ_BYTES, It as sleep, J as VISIT_MERGE_GAP_MS, Jt as EventCategory, K as TimelapseRuleSchema, Kt as string, L as RetrainStatusSchema, Lt as _enum, M as NcSystemEventKindSchema, Mt as createEvent, N as NcTaxonomySchema, Nt as hydrateSchema, O as NcScheduleSchema, Ot as zoneAnalyticsCapability, P as OpsLogEntrySchema, Pt as isDeviceScopedCap, Q as audioMetricsCapability, Rt as array, S as NC_TAXONOMY, T as NcRulePatchSchema, Tt as systemEventFilterApplies, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as object, V as SCENE_DIVERGED, Vt as literal, W as TimelapseRuleInputSchema, Wt as partialRecord, X as alarmPanelCapability, Y as addonWidgetsSourceCapability, Z as assertTimelapseCadences, _ as MACRO_LABELS, _t as pickClusterStepModels, a as COCO_TO_MACRO, b as NC_DEFAULT_SNOOZE_MINUTES, bt as readDeviceStateFrom, ct as faceGalleryCapability, d as DeclaredDevices, dt as isDetectionMacroClass, et as buildEventKindDescriptor, f as EVENT_KIND_BY_CAP, ft as isScheduleActive, g as LabelAttributionSchema, h as FailureCounters, ht as notificationRulesCapability, i as CLUSTER_MODEL_SCOPED_STEPS, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as DeviceType, k as NcSnoozeInputSchema, kt as errMsg, l as DETECTION_MACRO_CLASSES, lt as failureContributionCapability, m as FULL_IMAGE_BBOX, mt as kebabToCamel, n as AnalyticsGroupRecordSchema, nt as customAction, o as DEFAULT_EVENT_COLOR, ot as encodeVectorBase64, p as EVENT_PAD_MS, pt as isSourceCap, q as TrackSourceSchema, qt as unknown, r as BaseDevice, rt as defineCustomActions, st as evaluateSensorEdge, t as AnalyticsGroupDetailSchema, tt as cosineSimilarity$1, v as NC_ALARM_SYSTEM_EVENT_KINDS, vt as pipelineAnalyticsCapability, w as NcRuleInputSchema, wt as subKindsOf, xt as readTimelapseGeneratedAt, y as NC_CONDITION_CATALOG, yt as plateGalleryCapability, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as boolean } from "../dist-B5K63Zmt.mjs";
+import { $ as audioMetricsCapability, A as NcSnoozeInputSchema, At as errMsg, B as SCENE_DEFAULT_ANCHOR_THRESHOLD, Bt as boolean, C as NC_TAXONOMY, D as NcRuleSchema, Dt as vectorDimFromBase64, E as NcRulePatchSchema, Et as systemEventFilterApplies, F as OpsLogEntrySchema, Ft as isDeviceScopedCap, G as TimelapseRuleInputSchema, Gt as partialRecord, H as SCENE_DIVERGED, Ht as literal, It as nodePin, J as TrackSourceSchema, Jt as unknown, K as TimelapseRulePatchSchema, Kt as record, L as RECORDING_EXPORT_MAX_READ_BYTES, Lt as sleep, M as NcSnoozeSuppressedSchema, Mt as DeviceType, N as NcSystemEventKindSchema, Nt as createEvent, O as NcRuleTargetSchema, Ot as videoclipsCapability, P as NcTaxonomySchema, Pt as hydrateSchema, Q as assertTimelapseCadences, R as RetrainStatusSchema, Rt as _enum, St as readTimelapseGeneratedAt, T as NcRuleInputSchema, Tt as subKindsOf, U as SceneMonitorSchema, Ut as number, V as SCENE_DEFAULT_UNCOVERED_POLICY, Vt as discriminatedUnion, W as TIMELAPSE_DENSE_FLOOR_SEC, Wt as object, X as addonWidgetsSourceCapability, Y as VISIT_MERGE_GAP_MS, Yt as EventCategory, Z as alarmPanelCapability, _ as MACRO_LABELS, a as COCO_TO_MACRO, at as deriveRecordingMode, b as NC_CONDITION_CATALOG, bt as plateGalleryCapability, ct as evaluateSensorEdge, d as DeclaredDevices, et as audioModeOf, f as EVENT_KIND_BY_CAP, ft as isDetectionMacroClass, g as LabelAttributionSchema, gt as notificationRulesCapability, h as FailureCounters, ht as kebabToCamel, i as CLUSTER_MODEL_SCOPED_STEPS, it as defineCustomActions, j as NcSnoozeSchema, jt as BaseAddon, k as NcScheduleSchema, kt as zoneAnalyticsCapability, l as DETECTION_MACRO_CLASSES, lt as faceGalleryCapability, m as FULL_IMAGE_BBOX, mt as isSourceCap, n as AnalyticsGroupRecordSchema, nt as cosineSimilarity$1, o as DEFAULT_EVENT_COLOR, p as EVENT_PAD_MS, pt as isScheduleActive, q as TimelapseRuleSchema, qt as string, r as BaseDevice, rt as customAction, st as encodeVectorBase64, t as AnalyticsGroupDetailSchema, tt as buildEventKindDescriptor, ut as failureContributionCapability, v as MediaFileKindEnum, vt as pickClusterStepModels, w as NcConditionDescriptorSchema, wt as sceneMonitorCapability, x as NC_DEFAULT_SNOOZE_MINUTES, xt as readDeviceStateFrom, y as NC_ALARM_SYSTEM_EVENT_KINDS, yt as pipelineAnalyticsCapability, zt as array } from "../dist-DDIu0Q1W.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -5406,12 +5406,6 @@ function buildAlarmButtons(input) {
 	}];
 }
 //#endregion
-//#region src/notification-center/cap-caller.ts
-function requireCapCaller(method, caller) {
-	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
-	return caller;
-}
-//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -5654,6 +5648,12 @@ var AudioWatcher = class {
 	}
 };
 //#endregion
+//#region src/notification-center/cap-caller.ts
+function requireCapCaller(method, caller) {
+	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
+	return caller;
+}
+//#endregion
 //#region src/shared/llm-vision/prompt-hygiene.ts
 /**
 * What a PIPELINE VALUE is allowed to look like once it is inside a prompt.
@@ -6288,25 +6288,46 @@ var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
 /** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
 var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
 /**
-* Kinds whose action is "go and look at why this camera stopped producing".
+* Kinds whose action is "go and look at this device's stream".
+*
+* BOTH DIRECTIONS. A recovery lands on the same page as the failure it undoes,
+* because "did it really come back, and what did it do while it was gone" is
+* an action and the page that answers it is the one the down-notification
+* already opened. On 2026-08-30 the operator's phone showed "Il dispositivo
+* Videocamera sala feste è online" with `tapAction.value: null` — the same
+* camera's `device-offline` an hour earlier opened the Stream Broker tab, and
+* the recovery opened nothing, purely because `device-online` had no entry
+* here.
 *
-* The legacy `camera-offline` is here for the same reason it is still in the
-* enum: outbox and history rows enqueued before the rename carry it, and an
+* The legacy `camera-*` pair is here for the same reason both are still in the
+* enum: outbox and history rows enqueued before the rename carry them, and an
 * old row is exactly the one whose action has to keep working.
+*
+* Kinds NOT here are kinds whose DOWN direction has no action either
+* (`node-online`/`node-offline`, `device-enabled`/`device-disabled`) — a
+* recovery does not earn a destination its failure was never given.
 */
-var DEVICE_DOWN_KINDS = new Set([
+var DEVICE_STREAM_KINDS = new Set([
 	"device-offline",
+	"device-online",
 	"stream-offline",
-	"camera-offline"
+	"stream-online",
+	"camera-offline",
+	"camera-online"
 ]);
 /**
 * Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
 *
-* A stream belongs to a camera and nothing else. The legacy `camera-offline`
-* is one too — that name is precisely the claim it made, and it is why the
-* kind was split into `device-offline` + a `deviceTypes` condition.
+* A stream belongs to a camera and nothing else. The legacy `camera-*` pair is
+* too — that name is precisely the claim it made, and it is why the kind was
+* split into `device-*` + a `deviceTypes` condition.
 */
-var CAMERA_BY_CONSTRUCTION_KINDS = new Set(["stream-offline", "camera-offline"]);
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set([
+	"stream-offline",
+	"stream-online",
+	"camera-offline",
+	"camera-online"
+]);
 function withParam(path, key, value) {
 	if (value === void 0 || value.length === 0) return path;
 	return `${path}?${key}=${encodeURIComponent(value)}`;
@@ -6321,7 +6342,7 @@ function withParam(path, key, value) {
 function systemEventTapPath(subject) {
 	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
 	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
-	if (DEVICE_DOWN_KINDS.has(subject.kind)) {
+	if (DEVICE_STREAM_KINDS.has(subject.kind)) {
 		const deviceId = subject.deviceId;
 		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
 		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
@@ -10723,16 +10744,26 @@ function incomingFromUpdateAvailable(facts, data) {
 		...nodeIds.length > 0 ? { nodeIds } : {}
 	});
 }
-/** Version-bearing `addon.updated` only — settings saves carry neither. */
+/**
+* Version-bearing `addon.updated` only — a settings save carries no versions
+* at all (`BaseAddon.updateGlobalSettings`).
+*
+* `toVersion` IS the discriminator, and `fromVersion` is not: the emitter
+* omits the predecessor when it cannot read what was installed (a first
+* install, an unreadable tree). Requiring both dropped those updates on the
+* floor entirely — the operator got no notification for an update that
+* happened — which is the price that was being paid to keep `'0.0.0'`
+* out. Report the half that is known; say nothing about the half that is not.
+*/
 function parseAddonUpdateComplete(data) {
 	const packageName = stringField(data, "packageName");
 	const fromVersion = stringField(data, "fromVersion");
 	const toVersion = stringField(data, "toVersion");
-	if (packageName === void 0 || fromVersion === void 0 || toVersion === void 0) return null;
+	if (packageName === void 0 || toVersion === void 0) return null;
 	const nodeId = stringField(data, "agent") ?? stringField(data, "nodeId");
 	return {
 		packageName,
-		fromVersion,
+		...fromVersion !== void 0 ? { fromVersion } : {},
 		toVersion,
 		...nodeId !== void 0 ? { nodeId } : {}
 	};
@@ -10742,7 +10773,10 @@ function incomingFromAddonUpdates(facts, updates) {
 	const packageNames = unique(updates.map((update) => update.packageName));
 	const nodeIds = unique(updates.map((update) => update.nodeId).filter((id) => id !== void 0));
 	const signature = updates.map((update) => `${update.nodeId ?? ""}:${update.packageName}@${update.toVersion}`).toSorted().join(",");
-	const list = updates.map((update) => update.nodeId !== void 0 ? `${update.packageName} ${update.fromVersion} → ${update.toVersion} (${update.nodeId})` : `${update.packageName} ${update.fromVersion} → ${update.toVersion}`).join("\n");
+	const list = updates.map((update) => {
+		const transition = update.fromVersion !== void 0 ? `${update.fromVersion} → ${update.toVersion}` : `→ ${update.toVersion}`;
+		return update.nodeId !== void 0 ? `${update.packageName} ${transition} (${update.nodeId})` : `${update.packageName} ${transition}`;
+	}).join("\n");
 	const head = updates[0];
 	return systemSubject({
 		facts,
@@ -23564,17 +23598,17 @@ function planRuleTest(input) {
 					deviceName: `camera ${String(systemScope.deviceId ?? deviceId)}`,
 					nodeId: systemScope.nodeId ?? "hub",
 					packageName: systemScope.packageName ?? "@camstack/server",
-					currentVersion: "0.0.0",
-					latestVersion: "0.0.0",
+					currentVersion: "1.0.0",
+					latestVersion: "1.0.1",
 					profile: "low",
 					seconds: "30",
 					devices: "cuda:0",
 					minutes: "15",
 					addons: TEST_CRASHED_RUNNER,
-					list: "@camstack/addon-pipeline 1.0.0 (current 0.0.0)",
+					list: "@camstack/addon-pipeline 1.0.1 (current 1.0.0)",
 					nodes: "hub",
-					fromVersion: "0.0.0",
-					toVersion: "0.0.1",
+					fromVersion: "1.0.0",
+					toVersion: "1.0.1",
 					title: "Export",
 					count: "1"
 				},
@@ -25638,6 +25672,67 @@ var MEDIA_INDEXES = [
 	{
 		name: "idx_media_location",
 		columns: ["locationId"]
+	}),
+	(
+	/**
+	* The events-management footprint — `GROUP BY deviceId` and
+	* `SUM(sizeBytes) WHERE deviceId = ?`. See {@link MediaStore.footprintByDevice}.
+	*
+	* **Why not `idx_media_device_ts`.** That index already leads with
+	* `deviceId`, so it can find the range — but it does not carry `sizeBytes`,
+	* so the sum has to fetch the table row behind every index entry it visits.
+	* Over the whole collection that is one scattered read of the entire ~1.25 M
+	* row table (`path` alone is ~80 characters per row) on the volume the
+	* recorder is writing to. With `sizeBytes` in the index the planner never
+	* touches the table: `SCAN … USING COVERING INDEX idx_media_device_size`.
+	*
+	* It has to be a NEW index rather than a third column on the existing one.
+	* `declareCollection` emits `CREATE INDEX IF NOT EXISTS` keyed on the index
+	* NAME, so widening `idx_media_device_ts` in place would be a silent no-op on
+	* every hub that already has it — the declaration would read as done and the
+	* query would still hit the table.
+	*
+	* **What it costs.** ~19 bytes of index per row (two integers plus the
+	* rowid), so ~24 MB at 1.25 M rows, plus one more b-tree maintained by every
+	* insert into a table taking ~92 k rows/day. At ~1 insert/s that maintenance
+	* is noise beside the JPEG write the same call performs. The cost that is not
+	* noise is the one-off: the first `declareCollection` after this ships builds
+	* the index over every existing row. Do not deploy it beside a running drain
+	* or seal — the same caveat `idx_media_location` carries, for the same
+	* reason.
+	*/
+	{
+		name: "idx_media_device_size",
+		columns: ["deviceId", "sizeBytes"]
+	}),
+	(
+	/**
+	* The per-KIND footprint — `COUNT(*)`/`SUM(sizeBytes) WHERE kind = ?`, and
+	* the same scoped to one camera. See {@link MediaStore.footprintByKind}.
+	*
+	* `kind` leads no existing index, so without this each of the thirteen
+	* per-kind questions is a full table scan and the breakdown costs thirteen of
+	* them. With it, each kind is a contiguous covering range and the thirteen
+	* together scan the index once — the cost of the whole breakdown is one pass
+	* over ~36 MB of index instead of thirteen passes over the table.
+	*
+	* `deviceId` sits between `kind` and `sizeBytes` so the per-camera variant
+	* (`WHERE kind = ? AND deviceId = ?`) stays covering too, for ~3 bytes a row
+	* more than `(kind, sizeBytes)` would cost. Without it that query finds its
+	* range from the index and then reads the table for every row in it.
+	*
+	* ~29 bytes of index per row, so ~36 MB at 1.25 M rows, and one more b-tree
+	* on every insert. Same one-off caveat as the two indexes above: the first
+	* declare builds it over every existing row, so do not ship it beside a
+	* running drain or seal.
+	*/
+	{
+		name: "idx_media_kind_device_size",
+		columns: [
+			"kind",
+			"deviceId",
+			"sizeBytes"
+		]
 	})
 ];
 /** The storage location of a media row/record: its stamped `locationId`, or
@@ -25724,7 +25819,7 @@ var MediaStore = class {
 		});
 	}
 	/** Persist a media blob and register its metadata row. Returns the
-	*  collection key (MediaFile.key) that callers store as reference. */
+	*  collection key (MediaFileRef.key) that callers store as reference. */
 	async put(params) {
 		if (this.writeGate) return this.writeGate.run(() => this.putUnchecked(params));
 		return this.putUnchecked(params);
@@ -26046,8 +26141,20 @@ var MediaStore = class {
 	* its device at write time, so scoping the query by it makes a media read
 	* for a device the caller cannot name return nothing — the DB itself
 	* enforces the boundary, no post-hoc ownership check to forget.
+	*
+	* `kinds` is the WORK filter, and it belongs here rather than on the answer.
+	* Every row this returns has had its blob read off disk and base64-encoded,
+	* so a caller that filters afterwards has already paid for every kind it is
+	* about to discard: measured on the live hub, one track's six kinds are
+	* 3 597 219 bytes and `thumbnailSmall` is 31 155 of them, and asking for the
+	* small one alone cost exactly as much as asking for all six. `kind` is a
+	* real column (see {@link MEDIA_COLUMNS}), so the narrowing happens in the
+	* query and the blobs of the other kinds are never opened.
+	*
+	* Absent (or empty) means every kind — the back-compat default, and the
+	* honest answer for a caller that has not decided what it needs.
 	*/
-	async listByOwner(ownerKind, ownerId, deviceId) {
+	async listByOwner(ownerKind, ownerId, deviceId, kinds) {
 		const rows = await this.store.query.query({
 			collection: MEDIA_COLLECTION,
 			filter: {
@@ -26059,6 +26166,7 @@ var MediaStore = class {
 					ownerId,
 					deviceId
 				},
+				...kinds !== void 0 && kinds.length > 0 ? { whereIn: { kind: [...kinds] } } : {},
 				orderBy: {
 					field: "timestamp",
 					direction: "asc"
@@ -26279,47 +26387,136 @@ var MediaStore = class {
 		};
 	}
 	/**
-	* On-demand footprint aggregation for the events-management UI: sum
-	* `sizeBytes` and count rows per device across the whole media collection.
-	* Pages by `id` (offset-based) so a large collection never loads at once.
-	* Metadata rows are small (no blob) — the image bytes live on the storage
-	* provider and are counted via the persisted `sizeBytes` column.
+	* On-demand footprint aggregation for the events-management UI: rows and
+	* summed `sizeBytes` per camera, across the whole media collection.
+	*
+	* ## Why this is a histogram plus one aggregate per camera
+	*
+	* It used to page the ENTIRE collection — `ORDER BY id LIMIT 1000 OFFSET n`,
+	* no predicate — and add `sizeBytes` up in JS. SQLite honours an OFFSET by
+	* stepping over `n` entries, so the walk is quadratic in the table: at the
+	* live hub's 1.25 M rows that is ~1 250 round trips and ~780 M index steps,
+	* with every row serialised across an RPC boundary and rebuilt in V8 to be
+	* added to a number. It timed out at 60 s on every call it ever made, and it
+	* is the only thing that can size the surplus-media deletion it gates.
+	*
+	* The answer is at most a few dozen `(deviceId, rows, bytes)` triples.
+	*
+	*  - The DEVICE SET comes from a histogram on `deviceId` with `bucketSize: 1`
+	*    — `GROUP BY deviceId`, served from `idx_media_device_size` as a covering
+	*    scan, the same trick `TrackStore.listDeviceIds` already uses (D56).
+	*    `bucket` IS the deviceId: the column is INTEGER and the bucket
+	*    expression is `CAST((deviceId - 0) / 1 AS INTEGER)`.
+	*  - The NUMBERS come from one `aggregate` per camera — `COUNT(*)` and
+	*    `SUM(sizeBytes)` in a single statement over an indexed `deviceId` range.
+	*
+	* Both figures for a camera come from the SAME statement deliberately. Taking
+	* `rows` from the histogram and `bytes` from the aggregate would let a write
+	* landing between the two produce a footprint whose row count and byte count
+	* describe different populations — a disagreement an operator sizing a
+	* deletion has no way to detect.
+	*
+	* A read that fails THROWS. It must never degrade to a zero: "this camera
+	* holds nothing" is precisely the claim a failed measurement must not be
+	* allowed to make to something about to delete (D295, D312).
 	*/
 	async footprintByDevice() {
-		const PAGE = 1e3;
+		const buckets = await this.store.histogram.query({
+			collection: MEDIA_COLLECTION,
+			field: "deviceId",
+			bucketSize: 1,
+			origin: 0
+		});
 		const out = /* @__PURE__ */ new Map();
-		let offset = 0;
-		for (;;) {
-			const rows = await this.store.query.query({
+		for (const bucket of buckets) {
+			if (bucket.count === 0 || !Number.isFinite(bucket.bucket)) continue;
+			const deviceId = bucket.bucket;
+			const agg = await this.store.aggregate.query({
 				collection: MEDIA_COLLECTION,
-				filter: {
-					orderBy: {
-						field: "id",
-						direction: "asc"
-					},
-					limit: PAGE,
-					offset
-				}
+				fields: [{
+					as: "bytes",
+					field: "sizeBytes",
+					op: "sum"
+				}],
+				filter: { where: { deviceId } }
+			});
+			if (agg.count === 0) continue;
+			const bytes = agg.values["bytes"];
+			out.set(deviceId, {
+				bytes: bytes ?? 0,
+				rows: agg.count
 			});
-			if (rows.length === 0) break;
-			for (const row of rows) {
-				const data = row.data;
-				const deviceId = Number(data["deviceId"]);
-				const sizeBytes = Number(data["sizeBytes"]);
-				if (!Number.isFinite(deviceId)) continue;
-				const acc = out.get(deviceId) ?? {
-					bytes: 0,
-					rows: 0
-				};
-				acc.bytes += Number.isFinite(sizeBytes) ? sizeBytes : 0;
-				acc.rows += 1;
-				out.set(deviceId, acc);
-			}
-			if (rows.length < PAGE) break;
-			offset += PAGE;
 		}
 		return out;
 	}
+	/**
+	* The media footprint broken down by KIND — fleet-wide, or for one camera.
+	*
+	* `footprintByDevice` answers "how much is where"; this answers "how much is
+	* WHAT", which is the axis a deletion decision turns on. The deletable set
+	* (the periodic `snapshot` filmstrip, the surplus per-edge motion stills) and
+	* the keep set (`firstFrame`, rolling `lastFrame`, `thumbnail` /
+	* `thumbnailSmall`, `keyFrame` / `keyFrameSmall`, the face and plate buffers,
+	* gallery media, the CLIP `crop`) are told apart by `kind` and by nothing
+	* else. A byte total cannot size a deletion; this can.
+	*
+	* One `aggregate` per kind, each an indexed covering range on
+	* `idx_media_kind_device_size`, plus ONE unfiltered aggregate for the totals.
+	*
+	* That last statement is the point of the design and not a spare round trip.
+	* `MediaFileKindEnum.options` is the closed set the writers use, but the
+	* TABLE is not closed: a row written by a retired path, or by a version that
+	* knew a kind this one does not, matches no per-kind query. Adding the kinds
+	* up to produce the total would make such a row invisible and the denominator
+	* quietly too small — the failure mode that matters most here, because the
+	* caller is about to delete against it. So the total is measured
+	* independently and the difference is REPORTED as `unaccounted*` rather than
+	* being absorbed.
+	*/
+	async footprintByKind(deviceId) {
+		const scope = deviceId === void 0 ? void 0 : { where: { deviceId } };
+		const fields = [{
+			as: "bytes",
+			field: "sizeBytes",
+			op: "sum"
+		}];
+		const totals = await this.store.aggregate.query({
+			collection: MEDIA_COLLECTION,
+			fields: [...fields],
+			...scope === void 0 ? {} : { filter: scope }
+		});
+		const kinds = [];
+		let countedRows = 0;
+		let countedBytes = 0;
+		for (const kind of MediaFileKindEnum.options) {
+			const agg = await this.store.aggregate.query({
+				collection: MEDIA_COLLECTION,
+				fields: [...fields],
+				filter: { where: {
+					kind,
+					...deviceId === void 0 ? {} : { deviceId }
+				} }
+			});
+			if (agg.count === 0) continue;
+			const bytes = agg.values["bytes"] ?? 0;
+			countedRows += agg.count;
+			countedBytes += bytes;
+			kinds.push({
+				kind,
+				rows: agg.count,
+				bytes
+			});
+		}
+		kinds.sort((a, b) => b.bytes - a.bytes);
+		const totalBytes = totals.values["bytes"] ?? 0;
+		return {
+			totalRows: totals.count,
+			totalBytes,
+			kinds,
+			unaccountedRows: totals.count - countedRows,
+			unaccountedBytes: totalBytes - countedBytes
+		};
+	}
 	/** Move a single media entry from one owner to another.
 	*  The new copy is written before the old one is removed.
 	*  The old-entry deletion is best-effort: on failure a warning is logged
@@ -27974,6 +28171,63 @@ var embeddingActions = defineCustomActions({
 	"embedding.reembedFacesStatus": customAction(NoInputSchema$1, ReembedFacesStatusSchema)
 });
 //#endregion
+//#region src/pipeline-analytics/media-file-url.ts
+/**
+* The plane path for one stored media key.
+*
+* `prefix` is `/addon/<addonId>/event-media` — a pure function of the addon
+* id, so it exists whether or not `dataPlane.serve` succeeded. A row that
+* named no address at all would be the silent drop this repo keeps paying for:
+* a client cannot tell "no bytes" from "no plane", and renders neither.
+*/
+function mediaFileUrl(prefix, key) {
+	return `${prefix}/${encodeURIComponent(key)}`;
+}
+/**
+* A stored row as the wire sees it: the ref, the address, and — transitionally
+* — the bytes.
+*
+* `base64` is copied through ONLY because the deployed viewer's track-detail
+* hero still requires the field to parse a row at all. See the `MediaFile`
+* docblock in `pipeline-analytics.cap.ts`; deleting the field is a one-line
+* change here and one in the schema.
+*
+* `provenance` is deliberately NOT spread: it is store-internal, and the
+* previous `{ ...row, kind }` shape published it by accident.
+*/
+function toWireMediaFile(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp,
+		url: mediaFileUrl(prefix, row.key),
+		base64: row.base64
+	};
+}
+/** The same row without its bytes — the manifest shape. Carries the SAME
+*  `url` as the byte read, so a client never builds the plane path itself. */
+function toWireMediaFileInfo(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp,
+		url: mediaFileUrl(prefix, row.key)
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/gallery-media-row.ts
+function toGalleryMediaRow(row, prefix) {
+	return {
+		key: row.key,
+		kind: row.kind,
+		url: mediaFileUrl(prefix, row.key),
+		sizeBytes: row.sizeBytes,
+		timestamp: row.timestamp
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/include-crops-default.ts
 function resolveIncludeCrops(input) {
 	return input?.includeCrops === true;
@@ -29633,6 +29887,7 @@ var FaceGalleryProvider = class {
 	logger;
 	refreshGallery;
 	eventMediaBaseUrl;
+	eventMediaPathPrefix;
 	emitFaceGalleryChanged;
 	constructor(deps) {
 		this.identityStore = deps.identityStore;
@@ -29643,6 +29898,7 @@ var FaceGalleryProvider = class {
 		this.logger = deps.logger;
 		this.refreshGallery = deps.refreshGallery;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
+		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 		this.emitFaceGalleryChanged = deps.emitFaceGalleryChanged;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
@@ -29830,13 +30086,7 @@ var FaceGalleryProvider = class {
 	* the enrolled identity copies — those live under identity owner).
 	*/
 	async getFaceMedia(input) {
-		return (await this.mediaStore.listByOwner("face", input.faceId)).map((m) => ({
-			key: m.key,
-			kind: m.kind,
-			base64: m.base64,
-			sizeBytes: m.sizeBytes,
-			timestamp: m.timestamp
-		}));
+		return (await this.mediaStore.listByOwner("face", input.faceId)).map((m) => toGalleryMediaRow(m, this.eventMediaPathPrefix()));
 	}
 	/**
 	* Assign a buffered face to an identity:
@@ -32547,50 +32797,136 @@ var FrameProcessor = class {
 		};
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/replay/frame-processor-pass.ts
+/** Bounded trackId → pending-upgrade map. Insertion-ordered, so the cap
+*  evicts the oldest record. */
+var PendingPreviewUpgrades = class {
+	entries = /* @__PURE__ */ new Map();
+	ttlMs;
+	maxEntries;
+	now;
+	constructor(options = {}) {
+		this.ttlMs = options.ttlMs ?? 9e5;
+		this.maxEntries = Math.max(1, options.maxEntries ?? 512);
+		this.now = options.now ?? (() => Date.now());
+	}
+	/** Record (or replace) a closed track's pending upgrade. Prunes expired
+	*  entries first, then evicts the oldest while over the cap. */
+	record(entry) {
+		this.prune();
+		this.entries.delete(entry.trackId);
+		this.entries.set(entry.trackId, entry);
+		while (this.entries.size > this.maxEntries) {
+			const oldest = this.entries.keys().next();
+			if (oldest.done === true) break;
+			this.entries.delete(oldest.value);
+		}
+	}
+	/** Claim a track's pending upgrade — removes it, so a second landing (or a
+	*  concurrent racer) finds nothing and the tile is rewritten at most once. */
+	take(trackId) {
+		this.prune();
+		const entry = this.entries.get(trackId);
+		if (entry === void 0) return void 0;
+		this.entries.delete(trackId);
+		return entry;
+	}
+	get size() {
+		return this.entries.size;
+	}
+	prune() {
+		const cutoff = this.now() - this.ttlMs;
+		for (const [trackId, entry] of this.entries) if (entry.recordedAtMs < cutoff) this.entries.delete(trackId);
+	}
+};
 /**
-* Run a FRESH `FrameProcessor` over a fixed, ordered sequence of frames and
-* return the tracks it produced.
-*
-* No `TrackStore`, no bus, no media — a track here is a summary built
-* ENTIRELY from `FrameProcessor.process()`'s in-memory return value.
+* Redeem a closed track's pending preview off a keyFrame that landed late.
+* Every non-`upgraded` outcome that had a pending entry logs itself — a
+* branch that leaves the stand-in in place must say so.
 */
-function runFrameProcessorPass(input) {
-	const processor = new FrameProcessor(input.deviceId, {}, {}, {}, input.source);
-	if (input.zones !== void 0) processor.setZones(input.zones);
-	if (input.detectionRules !== void 0) processor.setDetectionRules(input.detectionRules);
-	if (input.zoneMembershipMinOverlap !== void 0) processor.setZoneMembershipMinOverlap(input.zoneMembershipMinOverlap);
-	const accum = /* @__PURE__ */ new Map();
-	for (const { timestamp, frame } of input.frames) {
-		const result = processor.process({
-			timestamp,
-			frame
+async function runPreviewUpgrade(deps, input) {
+	const { deviceId, trackId } = input;
+	const pending = deps.takePending(trackId);
+	if (pending === void 0) return "no-pending";
+	const held = await deps.heldThumbnailProvenance(trackId);
+	if (held !== null && mediaProvenanceRank(held) >= mediaProvenanceRank("native")) {
+		deps.logger.info("late keyFrame: preview already native — no upgrade", {
+			tags: { deviceId },
+			meta: { trackId }
 		});
-		for (const td of result.tracked) {
-			const existing = accum.get(td.trackId);
-			const matched = td.matchedThisFrame ? 1 : 0;
-			if (existing === void 0) accum.set(td.trackId, {
-				className: td.className,
-				firstSeenMs: timestamp,
-				lastSeenMs: timestamp,
-				bbox: { ...td.bbox },
-				framesMatched: matched
-			});
-			else {
-				existing.className = td.className;
-				existing.lastSeenMs = timestamp;
-				existing.framesMatched += matched;
+		return "held-native";
+	}
+	if (pending.bestSeen === void 0) {
+		deps.logger.info("late keyFrame landed but no subject bbox was ever seen — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				heldProvenance: held
 			}
-		}
+		});
+		return "no-bbox";
 	}
-	return { tracks: [...accum.values()].map((t) => ({
-		className: t.className,
-		firstSeenMs: t.firstSeenMs,
-		lastSeenMs: t.lastSeenMs,
-		bbox: t.bbox,
-		framesMatched: t.framesMatched
-	})) };
+	if (pending.bestSeen.timestamp === void 0) {
+		deps.logger.info("late keyFrame: pending entry predates the motion guard — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				keyFrameKey: input.keyFrameKey,
+				heldProvenance: held
+			}
+		});
+		return "no-bbox";
+	}
+	const derived = await deps.derive({
+		deviceId,
+		mediaKey: input.keyFrameKey,
+		bbox: {
+			x: pending.bestSeen.x,
+			y: pending.bestSeen.y,
+			w: pending.bestSeen.w,
+			h: pending.bestSeen.h
+		},
+		frameWidth: pending.bestSeen.frameWidth,
+		frameHeight: pending.bestSeen.frameHeight,
+		timestamp: pending.bestSeen.timestamp
+	});
+	if (derived === null) {
+		deps.logger.info("late keyFrame preview upgrade failed (derive miss) — tile kept as-is", {
+			tags: { deviceId },
+			meta: {
+				trackId,
+				keyFrameKey: input.keyFrameKey,
+				heldProvenance: held
+			}
+		});
+		return "derive-miss";
+	}
+	await deps.put({
+		deviceId,
+		trackId,
+		kind: "thumbnail",
+		timestamp: input.timestamp,
+		data: derived.thumbnail,
+		provenance: "native"
+	});
+	await deps.put({
+		deviceId,
+		trackId,
+		kind: "thumbnailSmall",
+		timestamp: input.timestamp,
+		data: derived.thumbnailSmall,
+		provenance: "native"
+	});
+	await deps.clearPreviewMiss(deviceId, trackId);
+	deps.logger.info("best-shot upgraded from late keyFrame (stand-in replaced)", {
+		tags: { deviceId },
+		meta: {
+			trackId,
+			keyFrameKey: input.keyFrameKey,
+			replaced: held ?? "none",
+			skewMs: derived.skewMs
+		}
+	});
+	return "upgraded";
 }
 function isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, score) {
 	if (frameWidth <= 0 || frameHeight <= 0) return true;
@@ -32750,137 +33086,6 @@ function promoteSemanticBestFrame(deps, input) {
 		captured: true
 	};
 }
-/** Bounded trackId → pending-upgrade map. Insertion-ordered, so the cap
-*  evicts the oldest record. */
-var PendingPreviewUpgrades = class {
-	entries = /* @__PURE__ */ new Map();
-	ttlMs;
-	maxEntries;
-	now;
-	constructor(options = {}) {
-		this.ttlMs = options.ttlMs ?? 9e5;
-		this.maxEntries = Math.max(1, options.maxEntries ?? 512);
-		this.now = options.now ?? (() => Date.now());
-	}
-	/** Record (or replace) a closed track's pending upgrade. Prunes expired
-	*  entries first, then evicts the oldest while over the cap. */
-	record(entry) {
-		this.prune();
-		this.entries.delete(entry.trackId);
-		this.entries.set(entry.trackId, entry);
-		while (this.entries.size > this.maxEntries) {
-			const oldest = this.entries.keys().next();
-			if (oldest.done === true) break;
-			this.entries.delete(oldest.value);
-		}
-	}
-	/** Claim a track's pending upgrade — removes it, so a second landing (or a
-	*  concurrent racer) finds nothing and the tile is rewritten at most once. */
-	take(trackId) {
-		this.prune();
-		const entry = this.entries.get(trackId);
-		if (entry === void 0) return void 0;
-		this.entries.delete(trackId);
-		return entry;
-	}
-	get size() {
-		return this.entries.size;
-	}
-	prune() {
-		const cutoff = this.now() - this.ttlMs;
-		for (const [trackId, entry] of this.entries) if (entry.recordedAtMs < cutoff) this.entries.delete(trackId);
-	}
-};
-/**
-* Redeem a closed track's pending preview off a keyFrame that landed late.
-* Every non-`upgraded` outcome that had a pending entry logs itself — a
-* branch that leaves the stand-in in place must say so.
-*/
-async function runPreviewUpgrade(deps, input) {
-	const { deviceId, trackId } = input;
-	const pending = deps.takePending(trackId);
-	if (pending === void 0) return "no-pending";
-	const held = await deps.heldThumbnailProvenance(trackId);
-	if (held !== null && mediaProvenanceRank(held) >= mediaProvenanceRank("native")) {
-		deps.logger.info("late keyFrame: preview already native — no upgrade", {
-			tags: { deviceId },
-			meta: { trackId }
-		});
-		return "held-native";
-	}
-	if (pending.bestSeen === void 0) {
-		deps.logger.info("late keyFrame landed but no subject bbox was ever seen — tile kept as-is", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				heldProvenance: held
-			}
-		});
-		return "no-bbox";
-	}
-	if (pending.bestSeen.timestamp === void 0) {
-		deps.logger.info("late keyFrame: pending entry predates the motion guard — tile kept as-is", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				keyFrameKey: input.keyFrameKey,
-				heldProvenance: held
-			}
-		});
-		return "no-bbox";
-	}
-	const derived = await deps.derive({
-		deviceId,
-		mediaKey: input.keyFrameKey,
-		bbox: {
-			x: pending.bestSeen.x,
-			y: pending.bestSeen.y,
-			w: pending.bestSeen.w,
-			h: pending.bestSeen.h
-		},
-		frameWidth: pending.bestSeen.frameWidth,
-		frameHeight: pending.bestSeen.frameHeight,
-		timestamp: pending.bestSeen.timestamp
-	});
-	if (derived === null) {
-		deps.logger.info("late keyFrame preview upgrade failed (derive miss) — tile kept as-is", {
-			tags: { deviceId },
-			meta: {
-				trackId,
-				keyFrameKey: input.keyFrameKey,
-				heldProvenance: held
-			}
-		});
-		return "derive-miss";
-	}
-	await deps.put({
-		deviceId,
-		trackId,
-		kind: "thumbnail",
-		timestamp: input.timestamp,
-		data: derived.thumbnail,
-		provenance: "native"
-	});
-	await deps.put({
-		deviceId,
-		trackId,
-		kind: "thumbnailSmall",
-		timestamp: input.timestamp,
-		data: derived.thumbnailSmall,
-		provenance: "native"
-	});
-	await deps.clearPreviewMiss(deviceId, trackId);
-	deps.logger.info("best-shot upgraded from late keyFrame (stand-in replaced)", {
-		tags: { deviceId },
-		meta: {
-			trackId,
-			keyFrameKey: input.keyFrameKey,
-			replaced: held ?? "none",
-			skewMs: derived.skewMs
-		}
-	});
-	return "upgraded";
-}
 //#endregion
 //#region src/pipeline-analytics/store/zone-geometry.ts
 /**
@@ -34619,6 +34824,7 @@ var PlateGalleryProvider = class {
 	refreshGallery;
 	emitPlateGalleryChanged;
 	eventMediaBaseUrl;
+	eventMediaPathPrefix;
 	constructor(deps) {
 		this.plateStore = deps.plateStore;
 		this.vehicleStore = deps.vehicleStore;
@@ -34629,6 +34835,7 @@ var PlateGalleryProvider = class {
 		this.refreshGallery = deps.refreshGallery;
 		this.emitPlateGalleryChanged = deps.emitPlateGalleryChanged;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
+		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
 	safeEmitPlateGalleryChanged(payload) {
@@ -34699,13 +34906,7 @@ var PlateGalleryProvider = class {
 		return this.toPlateInfo(plate, nameMap, { includeCrops: false });
 	}
 	async getPlateMedia(input) {
-		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => ({
-			key: m.key,
-			kind: m.kind,
-			base64: m.base64,
-			sizeBytes: m.sizeBytes,
-			timestamp: m.timestamp
-		}));
+		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => toGalleryMediaRow(m, this.eventMediaPathPrefix()));
 	}
 	async searchPlates(input) {
 		const maxDistance = input.maxDistance ?? 1;
@@ -34948,6 +35149,51 @@ var PlateGalleryProvider = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/replay/frame-processor-pass.ts
+/**
+* Run a FRESH `FrameProcessor` over a fixed, ordered sequence of frames and
+* return the tracks it produced.
+*
+* No `TrackStore`, no bus, no media — a track here is a summary built
+* ENTIRELY from `FrameProcessor.process()`'s in-memory return value.
+*/
+function runFrameProcessorPass(input) {
+	const processor = new FrameProcessor(input.deviceId, {}, {}, {}, input.source);
+	if (input.zones !== void 0) processor.setZones(input.zones);
+	if (input.detectionRules !== void 0) processor.setDetectionRules(input.detectionRules);
+	if (input.zoneMembershipMinOverlap !== void 0) processor.setZoneMembershipMinOverlap(input.zoneMembershipMinOverlap);
+	const accum = /* @__PURE__ */ new Map();
+	for (const { timestamp, frame } of input.frames) {
+		const result = processor.process({
+			timestamp,
+			frame
+		});
+		for (const td of result.tracked) {
+			const existing = accum.get(td.trackId);
+			const matched = td.matchedThisFrame ? 1 : 0;
+			if (existing === void 0) accum.set(td.trackId, {
+				className: td.className,
+				firstSeenMs: timestamp,
+				lastSeenMs: timestamp,
+				bbox: { ...td.bbox },
+				framesMatched: matched
+			});
+			else {
+				existing.className = td.className;
+				existing.lastSeenMs = timestamp;
+				existing.framesMatched += matched;
+			}
+		}
+	}
+	return { tracks: [...accum.values()].map((t) => ({
+		className: t.className,
+		firstSeenMs: t.firstSeenMs,
+		lastSeenMs: t.lastSeenMs,
+		bbox: t.bbox,
+		framesMatched: t.framesMatched
+	})) };
+}
+//#endregion
 //#region src/pipeline-analytics/retention/disk-reconcile.ts
 /**
 * Disk-wins reconcile for pipeline analytics.
@@ -35012,92 +35258,6 @@ async function reconcileDeviceFromDisk(deps, deviceId) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
-/**
-* The operator button for the debug-media reclaim.
-*
-* The mechanism ships armed with nothing: **arming it is the operator's
-* call**. `mode` omitted means `report` — it counts, logs one line per camera
-* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
-* that has to be typed.
-*
-* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
-* earned it: dry-run default, explicit pacing, explicit blast radius, and a
-* report you can read instead of a log line you have to find.
-*/
-/**
-* `report` counts; `reclaim` deletes.
-*
-* `.default('report')` is load-bearing: the settings form sends `{}` for a
-* button with no fields, and the safe reading of an unstated intent is the one
-* that destroys nothing.
-*/
-var MediaReclaimActionModeSchema = _enum(["report", "reclaim"]).default("report");
-var MediaReclaimScopeSchema = _enum(["motion-still", "track-filmstrip"]);
-var MediaReclaimActionInputSchema = object({
-	mode: MediaReclaimActionModeSchema,
-	/** Which populations to walk. Omitted = both. */
-	scopes: array(MediaReclaimScopeSchema).min(1).optional(),
-	/** Restrict to these cameras. Omitted = every camera in retention scope. */
-	deviceIds: array(number().int()).min(1).optional(),
-	/** Start every device from the top instead of resuming its cursor. */
-	restart: boolean().optional(),
-	/** Rows read per statement. Smaller = more yields = a gentler pass. */
-	pageSize: number().int().min(50).max(5e3).optional(),
-	/** Rows EXAMINED per camera in this pass — the pacing bound. */
-	maxRowsPerDevice: number().int().min(1).max(5e5).optional(),
-	/** Rows DELETED per camera in this pass — the blast-radius bound. */
-	maxReclaimPerDevice: number().int().min(1).max(5e5).optional(),
-	/** Bytes released across the whole run — the disk-contention bound. */
-	maxBytesPerRun: number().int().min(1).optional(),
-	/** Wall-clock ceiling for the run. */
-	budgetMinutes: number().int().min(1).max(720).optional(),
-	/**
-	* Bytes per second the pass may release. The recordings volume sustains
-	* ~4 MB/s and the archive needs it more than this does; the default is half
-	* of that.
-	*/
-	throttleBytesPerSec: number().int().min(64 * 1024).optional(),
-	/**
-	* Minutes of immunity for a recent row. Protective ONLY — raising it can
-	* exclusively save rows, never select them.
-	*/
-	graceMinutes: number().int().min(1).max(10080).optional()
-});
-var MediaReclaimDeviceReportSchema = object({
-	deviceId: number(),
-	scope: MediaReclaimScopeSchema,
-	examined: number(),
-	eligible: number(),
-	reclaimed: number(),
-	bytesReclaimed: number(),
-	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
-	held: number(),
-	/** Rows kept because the owner could not be shown to be a motion event. */
-	unresolved: number(),
-	withinGrace: number(),
-	/** Deletes that REFUSED — the blob survived or the volume could not answer.
-	*  The row was kept and the cursor did not pass it. */
-	refused: number(),
-	stoppedBy: string(),
-	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
-	nextCursor: number()
-});
-var mediaReclaimActions = defineCustomActions({ "retention.mediaReclaim": customAction(MediaReclaimActionInputSchema, object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: boolean(),
-	mode: _enum(["report", "reclaim"]),
-	devices: array(MediaReclaimDeviceReportSchema),
-	totalExamined: number(),
-	totalEligible: number(),
-	totalReclaimed: number(),
-	totalBytesReclaimed: number(),
-	totalRefused: number(),
-	durationMs: number(),
-	/** Every device+scope reported `exhausted` — there is nothing left to do. */
-	complete: boolean()
-}), { auth: "admin" }) });
-//#endregion
 //#region src/pipeline-analytics/retention/media-reclaim.ts
 var MEDIA_RECLAIM_SCOPES = ["motion-still", "track-filmstrip"];
 var DEFAULT_MEDIA_RECLAIM_LIMITS = {
@@ -35308,6 +35468,92 @@ async function runMediaReclaim(input) {
 		cursors: nextCursors
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
+/**
+* The operator button for the debug-media reclaim.
+*
+* The mechanism ships armed with nothing: **arming it is the operator's
+* call**. `mode` omitted means `report` — it counts, logs one line per camera
+* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
+* that has to be typed.
+*
+* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
+* earned it: dry-run default, explicit pacing, explicit blast radius, and a
+* report you can read instead of a log line you have to find.
+*/
+/**
+* `report` counts; `reclaim` deletes.
+*
+* `.default('report')` is load-bearing: the settings form sends `{}` for a
+* button with no fields, and the safe reading of an unstated intent is the one
+* that destroys nothing.
+*/
+var MediaReclaimActionModeSchema = _enum(["report", "reclaim"]).default("report");
+var MediaReclaimScopeSchema = _enum(["motion-still", "track-filmstrip"]);
+var MediaReclaimActionInputSchema = object({
+	mode: MediaReclaimActionModeSchema,
+	/** Which populations to walk. Omitted = both. */
+	scopes: array(MediaReclaimScopeSchema).min(1).optional(),
+	/** Restrict to these cameras. Omitted = every camera in retention scope. */
+	deviceIds: array(number().int()).min(1).optional(),
+	/** Start every device from the top instead of resuming its cursor. */
+	restart: boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per camera in this pass — the pacing bound. */
+	maxRowsPerDevice: number().int().min(1).max(5e5).optional(),
+	/** Rows DELETED per camera in this pass — the blast-radius bound. */
+	maxReclaimPerDevice: number().int().min(1).max(5e5).optional(),
+	/** Bytes released across the whole run — the disk-contention bound. */
+	maxBytesPerRun: number().int().min(1).optional(),
+	/** Wall-clock ceiling for the run. */
+	budgetMinutes: number().int().min(1).max(720).optional(),
+	/**
+	* Bytes per second the pass may release. The recordings volume sustains
+	* ~4 MB/s and the archive needs it more than this does; the default is half
+	* of that.
+	*/
+	throttleBytesPerSec: number().int().min(64 * 1024).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them.
+	*/
+	graceMinutes: number().int().min(1).max(10080).optional()
+});
+var MediaReclaimDeviceReportSchema = object({
+	deviceId: number(),
+	scope: MediaReclaimScopeSchema,
+	examined: number(),
+	eligible: number(),
+	reclaimed: number(),
+	bytesReclaimed: number(),
+	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
+	held: number(),
+	/** Rows kept because the owner could not be shown to be a motion event. */
+	unresolved: number(),
+	withinGrace: number(),
+	/** Deletes that REFUSED — the blob survived or the volume could not answer.
+	*  The row was kept and the cursor did not pass it. */
+	refused: number(),
+	stoppedBy: string(),
+	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
+	nextCursor: number()
+});
+var mediaReclaimActions = defineCustomActions({ "retention.mediaReclaim": customAction(MediaReclaimActionInputSchema, object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: boolean(),
+	mode: _enum(["report", "reclaim"]),
+	devices: array(MediaReclaimDeviceReportSchema),
+	totalExamined: number(),
+	totalEligible: number(),
+	totalReclaimed: number(),
+	totalBytesReclaimed: number(),
+	totalRefused: number(),
+	durationMs: number(),
+	/** Every device+scope reported `exhausted` — there is nothing left to do. */
+	complete: boolean()
+}), { auth: "admin" }) });
 var OrphanAuditActionInputSchema = object({
 	mode: _enum(["report", "reclaim"]).default("report"),
 	/**
@@ -36627,6 +36873,28 @@ function trackMediaScopesForKinds(trackId, kinds) {
 	return kinds.some((kind) => DETAIL_CROP_KINDS.includes(kind)) ? scopes : scopes.filter((scope) => scope.publishCropAs === null);
 }
 /**
+* The STORED kinds worth reading from one scope for a `kinds` request, or
+* `null` when the scope cannot contribute to it at all.
+*
+* This is the same vocabulary translation {@link collectTrackMedia} performs on
+* the way out, moved to the way IN so it can narrow the query instead of the
+* answer. A caller naming `faceCrop` must ask the face owner for its stored
+* `crop` — asking it for `faceCrop` matches nothing, and asking it for
+* everything opens blobs the answer will discard.
+*
+* `undefined` means "every kind": the honest translation of an unfiltered
+* request, and the only safe answer for the open-ended track scope.
+*
+* `null` (skip) is only ever returned for a DETAIL owner whose one publishable
+* kind was not asked for. The track scope is never skipped — its kinds are
+* open-ended, and dropping it on a guess is how a listing starts lying.
+*/
+function storedKindsForScope(scope, kinds) {
+	if (kinds === void 0 || kinds.length === 0) return void 0;
+	if (scope.publishCropAs === null) return kinds;
+	return kinds.includes(scope.publishCropAs) ? [STORED_DETAIL_CROP_KIND] : null;
+}
+/**
 * Fold every scope's rows into ONE track media listing: detail crops
 * relabelled, everything filtered to `kinds`, ordered oldest first.
 *
@@ -36763,8 +37031,10 @@ var AnalyticsQueryFacade = class {
 		return this.withMediaUrl(events);
 	}
 	async getEventMedia(input) {
-		const all = await (this.deps.mediaStore()?.listByOwner("event", input.eventId, input.deviceId) ?? Promise.resolve([]));
-		return input.kind ? all.filter((m) => m.kind === input.kind) : all;
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
+		return (await store.listByOwner("event", input.eventId, input.deviceId, input.kind === void 0 ? void 0 : [input.kind])).map((row) => toWireMediaFile(row, prefix));
 	}
 	/**
 	* A track's media WITH the bytes, restricted to `kinds` when given.
@@ -36777,14 +37047,36 @@ var AnalyticsQueryFacade = class {
 	async getTrackMedia(input) {
 		const store = this.deps.mediaStore();
 		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
 		const scopes = trackMediaScopesForKinds(input.trackId, input.kinds);
-		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => ({
-			scope,
-			rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
-		}))), (row, kind) => ({
+		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => {
+			const stored = storedKindsForScope(scope, input.kinds);
+			if (stored === null) return {
+				scope,
+				rows: []
+			};
+			return {
+				scope,
+				rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId, stored)
+			};
+		})), (row, kind) => ({
 			...row,
 			kind
-		}), input.kinds);
+		}), input.kinds).map((row) => toWireMediaFile(row, prefix));
+	}
+	/**
+	* An event's media WITHOUT the bytes.
+	*
+	* Index rows only — it never opens a blob. The track detail modal unions
+	* this with {@link listTrackMedia} to build its filmstrip and then fetches
+	* each tile from the `event-media` plane by key, so the bytes this used to
+	* carry were read, base64'd, shipped and discarded.
+	*/
+	async listEventMedia(input) {
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
+		return (await store.listInfoByOwner("event", input.eventId, input.deviceId)).map((row) => toWireMediaFileInfo(row, prefix));
 	}
 	/**
 	* A track's media WITHOUT the bytes.
@@ -36802,13 +37094,14 @@ var AnalyticsQueryFacade = class {
 	async listTrackMedia(input) {
 		const store = this.deps.mediaStore();
 		if (store === null) return [];
+		const prefix = this.deps.eventMediaPathPrefix();
 		return collectTrackMedia(await Promise.all(trackMediaOwnerScopes(input.trackId).map(async (scope) => ({
 			scope,
 			rows: await store.listInfoByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
 		}))), (row, kind) => ({
 			...row,
 			kind
-		}), void 0);
+		}), void 0).map((row) => toWireMediaFileInfo(row, prefix));
 	}
 	async pruneEventsBefore(input) {
 		const eventStore = this.deps.eventStore();
@@ -36835,10 +37128,34 @@ var AnalyticsQueryFacade = class {
 	}
 	/**
 	* Durable event-store footprint for the events-management UI: event ROWS
-	* (motion + object + audio) counted per camera (indexed `count`) + total, and
-	* event-owned media BYTES on disk per camera (paged `sizeBytes` sum) + total.
-	* The device set is the union of cameras that have media OR persisted tracks;
-	* cameras with neither rows nor bytes are omitted.
+	* (motion + object + audio) per camera + total, and event-owned media BYTES
+	* on disk per camera + total. Cameras with neither rows nor bytes are
+	* omitted; the rest come back ordered by bytes, descending, which is the
+	* order the operator's table renders.
+	*
+	* ## The device set is a union of THREE sources
+	*
+	* It used to be `media ∪ tracks`, and a camera holding events but no media
+	* row and no persisted track was therefore invisible — not listed, and its
+	* events missing from `totalRows`. That combination is not exotic: media
+	* retention, a media deletion and `pruneTracksBefore` all run on clocks of
+	* their own, and every one of them can outlive the event rows. The number
+	* this method exists to produce is the denominator for a deletion, so an
+	* undercount is the one failure mode that matters, and it was silent.
+	*
+	* Events now contribute their own device set, so a camera is present if ANY
+	* of the three sources has ever heard of it.
+	*
+	* ## The cost is the answer, not the table
+	*
+	* Three grouped reads for the event rows (one per event collection, never
+	* three per camera), one grouped read plus one aggregate per camera for the
+	* media bytes, one for the track device set. The retired shape paid ~1 250
+	* round trips for the media half alone and timed out at 60 s on every call.
+	* See {@link MediaStore.footprintByDevice} and {@link EventStore.countByDevice}.
+	*
+	* A store that cannot answer THROWS rather than returning zeroes — see the
+	* same note on both.
 	*/
 	async getEventStoreFootprint() {
 		const eventStore = this.deps.eventStore();
@@ -36848,15 +37165,16 @@ var AnalyticsQueryFacade = class {
 			totalBytes: 0,
 			devices: []
 		};
-		const mediaByDevice = await mediaStore.footprintByDevice();
+		const [mediaByDevice, eventRowsByDevice] = await Promise.all([mediaStore.footprintByDevice(), eventStore.countByDevice()]);
 		const deviceIds = new Set(mediaByDevice.keys());
+		for (const id of eventRowsByDevice.keys()) deviceIds.add(id);
 		const trackStore = this.deps.trackStore();
 		if (trackStore) for (const id of await trackStore.listDeviceIds()) deviceIds.add(id);
 		const devices = [];
 		let totalRows = 0;
 		let totalBytes = 0;
 		for (const deviceId of deviceIds) {
-			const rows = await eventStore.countForDevice(deviceId);
+			const rows = eventRowsByDevice.get(deviceId) ?? 0;
 			const bytes = mediaByDevice.get(deviceId)?.bytes ?? 0;
 			if (rows === 0 && bytes === 0) continue;
 			totalRows += rows;
@@ -36875,6 +37193,26 @@ var AnalyticsQueryFacade = class {
 		};
 	}
 	/**
+	* The media footprint by KIND — the axis that says what is safe to delete.
+	* See {@link MediaStore.footprintByKind}.
+	*
+	* An absent media store is an empty breakdown, not a refusal: it is the same
+	* "the addon has not finished booting" branch every other method here takes,
+	* and the zeroes are accompanied by an empty `kinds` list, which no reader
+	* can mistake for a measured "there is nothing".
+	*/
+	async getEventMediaFootprintByKind(input) {
+		const mediaStore = this.deps.mediaStore();
+		if (!mediaStore) return {
+			totalRows: 0,
+			totalBytes: 0,
+			kinds: [],
+			unaccountedRows: 0,
+			unaccountedBytes: 0
+		};
+		return mediaStore.footprintByKind(input.deviceId);
+	}
+	/**
 	* Cluster-wide prune of events with `timestamp < olderThanMs` across every
 	* camera (via the device-agnostic `evictBefore`), deleting each pruned event's
 	* media in lockstep. Logs one global (`deviceId:null`) events ops-log row.
@@ -39253,6 +39591,31 @@ function createEventMediaHandler(deps) {
 }
 //#endregion
 //#region src/pipeline-analytics/event-thumbnail-resolver.ts
+/**
+* Rank `candidates` with `pick`, then open ONE blob — the winner's.
+*
+* The ladders decide on `kind` alone, so the bytes are dead weight until the
+* choice is made. Handing them pre-read rows meant a tile that serves the
+* 31 KB `thumbnailSmall` first read the whole 3 597 219-byte set, including a
+* 2.8 MB `keyFrame` no list view has ever rendered.
+*
+* A winner whose blob is GONE is dropped and the ladder re-run on the rest.
+* That fall-through is not an extra: `listByOwner` used to provide it for free
+* by skipping unreadable rows before the ladder ever saw them, and without it
+* an index row that outlived its file would 404 a tile that used to render.
+* Bounded by the candidate count — each attempt removes one row.
+*/
+async function readWinningBlob(candidates, pick, readBlob) {
+	let remaining = candidates;
+	while (remaining.length > 0) {
+		const winner = pick(remaining);
+		if (winner === void 0) return null;
+		const bytes = await readBlob(winner.key);
+		if (bytes !== null) return bytes;
+		remaining = remaining.filter((row) => row.key !== winner.key);
+	}
+	return null;
+}
 /** Pick an event-OWNED media blob: the tight `crop`, else the native-res boxed
 *  `fullFrameBoxed`, else any available file. Both preferred kinds are RETIRED
 *  for new tracks (served only for old stored rows). Undefined when the event
@@ -39303,15 +39666,24 @@ async function collectCropForcedMedia(source, id) {
 	};
 }
 /**
-* Resolve the default-path media for an event id: the event's own media when it
-* has any, else the owning track's fallback media. Returns `null` when neither
-* yields a blob (caller 404s → the surface shows an icon).
+* Which rows the default path should serve from, and how to rank them: the
+* event's OWN media when it has any, else the owning track's.
+*
+* It yields the candidate SET rather than a winner so the caller can open one
+* blob and, if that blob has gone, re-rank the rest ({@link readWinningBlob}).
+* Returning a single row would force the caller to read it blind and 404 a tile
+* whose index row outlived its file.
 */
-async function resolveDefaultEventMedia(deps) {
-	const owned = pickEventOwnedMedia(deps.eventFiles);
-	if (owned) return owned;
+async function collectDefaultEventMedia(deps) {
+	if (deps.eventFiles.length > 0) return {
+		candidates: deps.eventFiles,
+		pick: pickEventOwnedMedia
+	};
 	const trackId = await deps.getTrackIdForEvent(deps.eventId) ?? deps.eventId;
-	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
+	return {
+		candidates: await deps.listTrackMedia(trackId),
+		pick: pickTrackFallbackMedia
+	};
 }
 //#endregion
 //#region src/pipeline-analytics/face-settings.ts
@@ -44508,6 +44880,15 @@ function snapshot(j) {
 */
 var LOCATION_ID_FIELD = "locationId";
 /**
+* Unstamped rows claimed per bulk seal statement.
+*
+* Bounds two things at once: the number of bound parameters in the `IN` list,
+* and how long one `UPDATE` holds the write lock on the database every process
+* in the cluster reads configuration through. Deliberately well under SQLite's
+* variable ceiling, and small enough that a cancel lands within one statement.
+*/
+var SEAL_BATCH_SIZE = 500;
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
@@ -44739,6 +45120,17 @@ var MediaRelocateEngine = class {
 	}
 	async countSelected(mode, toLocationId, stop) {
 		try {
+			if (mode === "seal") {
+				let sealable = 0;
+				for (const collection of collectionsFor(mode)) {
+					if (stop()) return null;
+					sealable += await this.deps.store.count.query({
+						collection: collection.name,
+						filter: { where: { [LOCATION_ID_FIELD]: null } }
+					});
+				}
+				return { rows: sealable };
+			}
 			let rows = 0;
 			for (const collection of collectionsFor(mode)) {
 				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
@@ -44770,6 +45162,14 @@ var MediaRelocateEngine = class {
 			*  gets believed. */
 			let pathlessRows = 0;
 			job.filesTotal = (await this.countSelected(job.mode, job.toLocationId, () => job.cancelRequested))?.rows ?? null;
+			if (job.mode === "seal") {
+				for (const collection of collectionsFor(job.mode)) {
+					if (job.cancelRequested) break;
+					await this.sealCollection(collection.name, job);
+				}
+				job.state = job.cancelRequested ? "cancelled" : "done";
+				return;
+			}
 			for (const collection of collectionsFor(job.mode)) {
 				if (job.cancelRequested) break;
 				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
@@ -44777,20 +45177,6 @@ var MediaRelocateEngine = class {
 					if (job.cancelRequested) break;
 					const data = row.data;
 					if (!selectsRow(job.mode, job.toLocationId, data, isRetrain)) continue;
-					if (job.mode === "seal") {
-						try {
-							await this.stamp(collection.name, row.id, data, job.toLocationId);
-							job.filesMoved++;
-						} catch (err) {
-							failedRows++;
-							this.deps.logger.debug("event-media seal row failed", { meta: {
-								collection: collection.name,
-								key: row.id,
-								error: String(err)
-							} });
-						}
-						continue;
-					}
 					const from = mediaRowLocation(data);
 					const relativePath = String(data["path"] ?? "");
 					if (relativePath.length === 0) {
@@ -44853,6 +45239,73 @@ var MediaRelocateEngine = class {
 			this.deps.onFinished?.(snapshot(job));
 		}
 	}
+	/**
+	* Stamp every unstamped row of one collection with the job's target, in
+	* bounded bulk statements.
+	*
+	* ## What this replaced
+	*
+	* A per-row loop: page the whole collection through {@link pageRows}, then
+	* one `store.set.mutate` per selected row — a full-row UPSERT rewriting every
+	* column to change one field, one RPC each, plus a second full walk before it
+	* to produce the denominator. Measured on the live hub against the 464 902
+	* unstamped rows: **2.3 rows/s, falling to 0.7 rows/s under a competing
+	* drain**, i.e. over two and a half days for a metadata stamp that reads no
+	* file and moves no byte. It was cancelled. This is the write-side twin of
+	* the read-side walk {@link countUnstamped} retired, and the fourth instance
+	* of the same pattern found in one day — work looped over the door instead of
+	* pushed into the statement.
+	*
+	* ## The shape
+	*
+	* Probe the indexed `IS NULL` range for a batch of ids, then ONE
+	* `updateWhere` over those ids. Two round trips per {@link SEAL_BATCH_SIZE}
+	* rows instead of one write per row.
+	*
+	* The probe carries no cursor and needs none: the predicate CONSUMES itself.
+	* A stamped row leaves the range, so the next probe returns the next batch,
+	* and a run that is interrupted anywhere simply resumes on what is left. That
+	* is also why the seal is idempotent (a second run probes an empty range and
+	* stamps nothing) and why it cannot repoint a row that already names a
+	* different location — `IS NULL` never selects one.
+	*
+	* A single unbounded `UPDATE … WHERE locationId IS NULL` would be one
+	* statement instead of ~1 860, and is not used: half a million row rewrites,
+	* each maintaining four indexes, is an unbounded statement holding the write
+	* lock on a database the whole cluster reads configuration through, under an
+	* RPC deadline that must not be raised. Batching bounds the statement, keeps
+	* `cancel` responsive between batches, and keeps `filesMoved` honest.
+	*
+	* ## The termination guard
+	*
+	* If the probe finds rows and the update reports **0**, this THROWS. That is
+	* not defensive noise: it is precisely what a backend compiling
+	* `locationId = NULL` does — matches nothing, reports success (D312) — and
+	* against it a self-consuming loop never terminates and a non-looping one
+	* reports a completed seal having stamped nothing. Zero unstamped rows is the
+	* single value the migration gate reads as "safe to cut over".
+	*/
+	async sealCollection(collection, job) {
+		for (;;) {
+			if (job.cancelRequested) return;
+			const batch = await this.deps.store.query.query({
+				collection,
+				filter: {
+					where: { [LOCATION_ID_FIELD]: null },
+					limit: SEAL_BATCH_SIZE
+				},
+				columns: [LOCATION_ID_FIELD]
+			});
+			if (batch.length === 0) return;
+			const { updated } = await this.deps.store.updateWhere.mutate({
+				collection,
+				filter: { whereIn: { id: batch.map((row) => row.id) } },
+				data: { [LOCATION_ID_FIELD]: job.toLocationId }
+			});
+			if (updated === 0) throw new Error(`event-media seal stamped 0 of ${batch.length} unstamped row(s) in "${collection}" — the bulk predicate matched nothing, so the population cannot be sealed`);
+			job.filesMoved += updated;
+		}
+	}
 	async stamp(collection, key, data, locationId) {
 		await this.deps.store.set.mutate({
 			collection,
@@ -47418,6 +47871,70 @@ var PackageDropDetector = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
+/**
+* How much of the PERSON box must sit inside a vehicle box to be counted.
+*
+* 0.8 and not 1.0: a phantom raised on a car's window pillar or wing mirror
+* routinely pokes a little outside the vehicle box, and requiring total
+* containment would count almost none of them. 0.8 and not 0.5: half a person
+* box overlapping a car is what a pedestrian walking in front of one looks
+* like, and counting those would make the number mean "somebody was near a
+* car", which is not a defect.
+*/
+var CONTAINMENT_THRESHOLD = .8;
+/**
+* The classes that count as a vehicle for this test.
+*
+* A local list rather than a shared taxonomy on purpose: it exists to describe
+* ONE measurement, and a shared enum would make a change here silently change
+* detection behaviour somewhere else.
+*/
+var VEHICLE_CLASSES$1 = [
+	"car",
+	"truck",
+	"bus",
+	"motorcycle",
+	"vehicle"
+];
+/** Area of the intersection of two boxes. `0` when they do not overlap. */
+function intersectionArea(a, b) {
+	const left = Math.max(a.x, b.x);
+	const right = Math.min(a.x + a.w, b.x + b.w);
+	const top = Math.max(a.y, b.y);
+	const bottom = Math.min(a.y + a.h, b.y + b.h);
+	if (right <= left || bottom <= top) return 0;
+	return (right - left) * (bottom - top);
+}
+/**
+* Fraction of `person` that lies inside `vehicle`, in `[0,1]`.
+*
+* `0` for a degenerate person box: a zero-area box is inside everything and
+* inside nothing, and answering `1` would count every one of them.
+*/
+function containedFraction(person, vehicle) {
+	const area = person.w * person.h;
+	if (area <= 0) return 0;
+	return intersectionArea(person, vehicle) / area;
+}
+/**
+* Is this person box contained in any vehicle box in the same frame?
+*
+* Returns the fraction for the BEST-containing vehicle when it clears
+* {@link CONTAINMENT_THRESHOLD}, else `null`. The fraction rides along because
+* a counter that only ever says "yes" cannot later be re-thresholded against
+* what was actually measured.
+*/
+function personOverVehicle(person, neighbours, threshold = CONTAINMENT_THRESHOLD) {
+	let best = 0;
+	for (const neighbour of neighbours) {
+		if (!VEHICLE_CLASSES$1.includes(neighbour.className)) continue;
+		const fraction = containedFraction(person, neighbour.bbox);
+		if (fraction > best) best = fraction;
+	}
+	return best >= threshold ? best : null;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-evidence.ts
 /**
 * stationary-evidence — how a parked object EARNS a registry entry.
@@ -49949,83 +50466,6 @@ function buildRecordedStillPorts(input) {
 		})
 	};
 }
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-async function reconcileGallerySamples(deps, options) {
-	let checked = 0;
-	let reclaimed = 0;
-	let keyless = 0;
-	let skippedGrace = 0;
-	let stoppedByCeiling = false;
-	const identities = await deps.listIdentities();
-	for (const identity of identities) {
-		const samples = await deps.listSamples(identity.id);
-		for (const sample of samples) {
-			if (sample.mediaKey === void 0) {
-				keyless += 1;
-				continue;
-			}
-			if (options.now - sample.addedAt < options.graceMs) {
-				skippedGrace += 1;
-				continue;
-			}
-			if (reclaimed >= options.maxReclaimPerRun) {
-				stoppedByCeiling = true;
-				deps.logger.warn("gallery reconcile: reclaim ceiling reached — remaining dead references keep until the next run", { meta: { ceiling: options.maxReclaimPerRun } });
-				return {
-					checked,
-					reclaimed,
-					keyless,
-					skippedGrace,
-					stoppedByCeiling
-				};
-			}
-			let state;
-			try {
-				state = await deps.blobState(sample.mediaKey);
-			} catch (err) {
-				const reason = errorMessage(err);
-				deps.logger.warn("gallery reconcile: a blob probe FAILED — aborting the pass, keeping every row", { meta: {
-					sampleId: sample.id,
-					identity: identity.name,
-					error: reason
-				} });
-				return {
-					checked,
-					reclaimed,
-					keyless,
-					skippedGrace,
-					stoppedByCeiling,
-					aborted: reason
-				};
-			}
-			checked += 1;
-			if (state === "exists") continue;
-			await deps.removeSample(identity.id, sample.id);
-			reclaimed += 1;
-			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
-				sampleId: sample.id,
-				identity: identity.name,
-				mediaKey: sample.mediaKey,
-				state
-			} });
-		}
-	}
-	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
-		checked,
-		reclaimed,
-		keyless,
-		skippedGrace
-	} });
-	return {
-		checked,
-		reclaimed,
-		keyless,
-		skippedGrace,
-		stoppedByCeiling
-	};
-}
 //#endregion
 //#region src/pipeline-analytics/retention/embedding-orphan-scan.ts
 /** The scope id this leg reports and persists its cursor under. */
@@ -50142,6 +50582,83 @@ async function scanEmbeddingOrphans(deps, limits, cursor) {
 		nextCursor: Math.max(0, offset)
 	};
 }
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function reconcileGallerySamples(deps, options) {
+	let checked = 0;
+	let reclaimed = 0;
+	let keyless = 0;
+	let skippedGrace = 0;
+	let stoppedByCeiling = false;
+	const identities = await deps.listIdentities();
+	for (const identity of identities) {
+		const samples = await deps.listSamples(identity.id);
+		for (const sample of samples) {
+			if (sample.mediaKey === void 0) {
+				keyless += 1;
+				continue;
+			}
+			if (options.now - sample.addedAt < options.graceMs) {
+				skippedGrace += 1;
+				continue;
+			}
+			if (reclaimed >= options.maxReclaimPerRun) {
+				stoppedByCeiling = true;
+				deps.logger.warn("gallery reconcile: reclaim ceiling reached — remaining dead references keep until the next run", { meta: { ceiling: options.maxReclaimPerRun } });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling
+				};
+			}
+			let state;
+			try {
+				state = await deps.blobState(sample.mediaKey);
+			} catch (err) {
+				const reason = errorMessage(err);
+				deps.logger.warn("gallery reconcile: a blob probe FAILED — aborting the pass, keeping every row", { meta: {
+					sampleId: sample.id,
+					identity: identity.name,
+					error: reason
+				} });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling,
+					aborted: reason
+				};
+			}
+			checked += 1;
+			if (state === "exists") continue;
+			await deps.removeSample(identity.id, sample.id);
+			reclaimed += 1;
+			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
+				sampleId: sample.id,
+				identity: identity.name,
+				mediaKey: sample.mediaKey,
+				state
+			} });
+		}
+	}
+	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
+		checked,
+		reclaimed,
+		keyless,
+		skippedGrace
+	} });
+	return {
+		checked,
+		reclaimed,
+		keyless,
+		skippedGrace,
+		stoppedByCeiling
+	};
+}
 /**
 * Where the completion marker lives.
 *
@@ -51520,6 +52037,43 @@ var EventStore = class {
 		return motion + object + audio;
 	}
 	/**
+	* Persisted event rows (motion + object + audio) for EVERY device that has
+	* any — three round trips for the whole fleet.
+	*
+	* {@link countForDevice} answers one camera in three `COUNT(*)`s, which is
+	* right for one camera and wrong in a loop: the events-management footprint
+	* called it once per device, so the cost of "how many events does each camera
+	* hold" grew with the camera count for a result that is a few dozen integers.
+	*
+	* A histogram on `deviceId` with `bucketSize: 1` is `GROUP BY deviceId`, and
+	* every event collection already carries `idx_<kind>_device_ts`, which leads
+	* with `deviceId` — so the planner serves each of these from a covering index
+	* with no table access at all. `bucket` IS the deviceId (the column is
+	* INTEGER, the bucket expression is `CAST((deviceId - 0) / 1 AS INTEGER)`).
+	*
+	* Not best-effort: a failure propagates. The one caller is sizing a deletion,
+	* and a camera silently reported as holding zero events is the answer that
+	* must never come from a read that did not happen.
+	*/
+	async countByDevice() {
+		const perCollection = await Promise.all([
+			MOTION_EVENTS_COLLECTION,
+			OBJECT_EVENTS_COLLECTION,
+			AUDIO_EVENTS_COLLECTION
+		].map((collection) => this.store.histogram.query({
+			collection,
+			field: "deviceId",
+			bucketSize: 1,
+			origin: 0
+		})));
+		const out = /* @__PURE__ */ new Map();
+		for (const buckets of perCollection) for (const bucket of buckets) {
+			if (bucket.count === 0 || !Number.isFinite(bucket.bucket)) continue;
+			out.set(bucket.bucket, (out.get(bucket.bucket) ?? 0) + bucket.count);
+		}
+		return out;
+	}
+	/**
 	* Return per-kind event counts in equal-width time buckets.
 	*
 	* Each bucket maps to a `bucketStart = since + i * bucketMs`.
@@ -53204,14 +53758,14 @@ function isAfterCursor(row, cursor) {
 	if (row.lastSeen < cursor.lastSeen) return true;
 	return row.lastSeen === cursor.lastSeen && row.id < cursor.trackId;
 }
-var VEHICLE_CLASSES$1 = new Set([
+var VEHICLE_CLASSES = new Set([
 	"vehicle",
 	"car",
 	"truck",
 	"bus"
 ]);
 function motionlessMaxPxForClass(className) {
-	return VEHICLE_CLASSES$1.has(className.toLowerCase()) ? 8 : 40;
+	return VEHICLE_CLASSES.has(className.toLowerCase()) ? 8 : 40;
 }
 function netDisplacementPx(positions) {
 	const first = positions[0];
@@ -56971,70 +57525,6 @@ function hasWrappedDetection(entries) {
 	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
-/**
-* How much of the PERSON box must sit inside a vehicle box to be counted.
-*
-* 0.8 and not 1.0: a phantom raised on a car's window pillar or wing mirror
-* routinely pokes a little outside the vehicle box, and requiring total
-* containment would count almost none of them. 0.8 and not 0.5: half a person
-* box overlapping a car is what a pedestrian walking in front of one looks
-* like, and counting those would make the number mean "somebody was near a
-* car", which is not a defect.
-*/
-var CONTAINMENT_THRESHOLD = .8;
-/**
-* The classes that count as a vehicle for this test.
-*
-* A local list rather than a shared taxonomy on purpose: it exists to describe
-* ONE measurement, and a shared enum would make a change here silently change
-* detection behaviour somewhere else.
-*/
-var VEHICLE_CLASSES = [
-	"car",
-	"truck",
-	"bus",
-	"motorcycle",
-	"vehicle"
-];
-/** Area of the intersection of two boxes. `0` when they do not overlap. */
-function intersectionArea(a, b) {
-	const left = Math.max(a.x, b.x);
-	const right = Math.min(a.x + a.w, b.x + b.w);
-	const top = Math.max(a.y, b.y);
-	const bottom = Math.min(a.y + a.h, b.y + b.h);
-	if (right <= left || bottom <= top) return 0;
-	return (right - left) * (bottom - top);
-}
-/**
-* Fraction of `person` that lies inside `vehicle`, in `[0,1]`.
-*
-* `0` for a degenerate person box: a zero-area box is inside everything and
-* inside nothing, and answering `1` would count every one of them.
-*/
-function containedFraction(person, vehicle) {
-	const area = person.w * person.h;
-	if (area <= 0) return 0;
-	return intersectionArea(person, vehicle) / area;
-}
-/**
-* Is this person box contained in any vehicle box in the same frame?
-*
-* Returns the fraction for the BEST-containing vehicle when it clears
-* {@link CONTAINMENT_THRESHOLD}, else `null`. The fraction rides along because
-* a counter that only ever says "yes" cannot later be re-thresholded against
-* what was actually measured.
-*/
-function personOverVehicle(person, neighbours, threshold = CONTAINMENT_THRESHOLD) {
-	let best = 0;
-	for (const neighbour of neighbours) {
-		if (!VEHICLE_CLASSES.includes(neighbour.className)) continue;
-		const fraction = containedFraction(person, neighbour.bbox);
-		if (fraction > best) best = fraction;
-	}
-	return best >= threshold ? best : null;
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
 	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
@@ -63476,6 +63966,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	*  Set once the data-plane is registered; null until then (e.g. no
 	*  dataPlane facility in the current environment). */
 	eventMediaBaseUrl = null;
+	/**
+	* The SAME path, derived rather than observed — a pure function of the addon
+	* id, so it exists before `serve()` is attempted and survives its failure.
+	*
+	* `eventMediaBaseUrl` above answers "is the plane up?", which is the right
+	* question for the OPTIONAL `mediaUrl` stamp on a slim event projection.
+	* It is the wrong question for a media row's `url`, which is that row's only
+	* address: a row that dropped its address on a boot race would be
+	* indistinguishable from a row with no bytes, and this repo has already paid
+	* for one read that quietly returned less than it was asked for.
+	*/
+	eventMediaPathPrefix() {
+		return `/addon/${this.ctx.id}/event-media`;
+	}
 	lastActiveTrackIds = /* @__PURE__ */ new Map();
 	/** See `pipeline/suppressed-births.ts` — rejected births must not be
 	*  re-upserted, and must be forgotten when the tracker drops the id. */
@@ -63726,6 +64230,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		sensorEventStore: () => this.sensorEventStore,
 		opsLog: () => this.eventsOpsLog,
 		eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+		eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 		logger: () => this.ctx.logger,
 		zoneCatalogue: () => this.zoneCatalogue
 	});
@@ -66268,6 +66773,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			logger: this.ctx.logger,
 			refreshGallery: () => this.faceRecognizer?.refreshGallery(),
 			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+			eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 			emitFaceGalleryChanged: (payload) => this.emitFaceGalleryChanged(payload)
 		});
 		this.faceGalleryProvider = faceGallery;
@@ -66282,6 +66788,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				this.plateRecognizer?.refreshGallery();
 			},
 			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
+			eventMediaPathPrefix: () => this.eventMediaPathPrefix(),
 			emitPlateGalleryChanged: (payload) => this.emitPlateGalleryChanged(payload)
 		});
 		return [
@@ -69967,6 +70474,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	async listTrackMedia(input) {
 		return this.queryFacade.listTrackMedia(input);
 	}
+	/** What media an EVENT has, without any of it — the same manifest, for the
+	*  half of the detail modal's filmstrip that is event-owned. */
+	async listEventMedia(input) {
+		return this.queryFacade.listEventMedia(input);
+	}
 	/**
 	* Search object events by text using CLIP cosine similarity.
 	*
@@ -71285,6 +71797,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	async getEventStoreFootprint() {
 		return this.queryFacade.getEventStoreFootprint();
 	}
+	async getEventMediaFootprintByKind(input) {
+		return this.queryFacade.getEventMediaFootprintByKind(input);
+	}
 	async pruneEvents(input) {
 		return this.queryFacade.pruneEvents(input);
 	}
@@ -71687,31 +72202,44 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			return media;
 		}
 	}
+	/**
+	* Resolve an event/track id to ONE tile's bytes.
+	*
+	* Every ladder below ranks rows by `kind` alone, so this walks the INDEX
+	* (`listInfoByOwner`, no blob opened) and opens only the winner. It used to
+	* walk `listByOwner`, which reads and base64-encodes every blob an owner
+	* holds before the first comparison is made: measured on the live hub
+	* 2026-08-30, a track's six kinds are 3 597 219 bytes and the tile serves
+	* `thumbnailSmall` — 31 155 of them. An Events page of forty tiles read
+	* ~144 MB and allocated ~190 MB of base64 to deliver ~1.2 MB, all of it on
+	* the single-threaded post-analysis runner.
+	*/
 	async readEventThumbnail(id, preferKind) {
-		const eventFiles = await (this.mediaStore?.listByOwner("event", id) ?? Promise.resolve([]));
+		const listInfo = (ownerKind, ownerId) => this.mediaStore?.listInfoByOwner(ownerKind, ownerId) ?? Promise.resolve([]);
+		const getTrackIdForEvent = (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null);
+		const readBlob = async (key) => {
+			const file = await (this.mediaStore?.getByKey(key) ?? Promise.resolve(null));
+			return file === null ? null : {
+				bytes: Buffer.from(file.base64, "base64"),
+				key: file.key
+			};
+		};
+		const eventFiles = await listInfo("event", id);
 		if (preferKind !== void 0 && preferKind.length > 0) {
 			const layers = await collectCropForcedMedia({
-				listByOwner: (ownerKind, ownerId) => this.mediaStore?.listByOwner(ownerKind, ownerId) ?? Promise.resolve([]),
-				getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+				listByOwner: listInfo,
+				getTrackIdForEvent
 			}, id);
-			const chosen = resolveCropForcedMedia(layers.bodyFiles, (files) => pickCleanMedia(files, preferKind), layers.detailFiles);
-			if (!chosen) return null;
-			return {
-				bytes: Buffer.from(chosen.base64, "base64"),
-				key: chosen.key
-			};
+			const bodyKeys = new Set(layers.bodyFiles.map((f) => f.key));
+			return await readWinningBlob([...layers.bodyFiles, ...layers.detailFiles], (rows) => resolveCropForcedMedia(rows.filter((r) => bodyKeys.has(r.key)), (files) => pickCleanMedia(files, preferKind), rows.filter((r) => !bodyKeys.has(r.key))), readBlob);
 		}
-		const chosen = await resolveDefaultEventMedia({
+		const { candidates, pick } = await collectDefaultEventMedia({
 			eventId: id,
 			eventFiles,
-			listTrackMedia: (trackId) => this.mediaStore?.listByOwner("track", trackId) ?? Promise.resolve([]),
-			getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+			listTrackMedia: (trackId) => listInfo("track", trackId),
+			getTrackIdForEvent
 		});
-		if (!chosen) return null;
-		return {
-			bytes: Buffer.from(chosen.base64, "base64"),
-			key: chosen.key
-		};
+		return await readWinningBlob(candidates, pick, readBlob);
 	}
 	globalSettingsSchema(cap) {
 		return this.schema(buildGlobalSettingsSchema(cap));