@camstack/addon-post-analysis 1.2.152 → 1.2.154

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as audioModeOf, A as NcSnoozeSchema, At as BaseAddon, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as discriminatedUnion, C as NcConditionDescriptorSchema, Ct as sceneMonitorCapability, D as NcRuleTargetSchema, Dt as videoclipsCapability, E as NcRuleSchema, Et as vectorDimFromBase64, Ft as nodePin, G as TimelapseRulePatchSchema, Gt as record, H as SceneMonitorSchema, Ht as number, I as RECORDING_EXPORT_MAX_READ_BYTES, It as sleep, J as VISIT_MERGE_GAP_MS, Jt as EventCategory, K as TimelapseRuleSchema, Kt as string, L as RetrainStatusSchema, Lt as _enum, M as NcSystemEventKindSchema, Mt as createEvent, N as NcTaxonomySchema, Nt as hydrateSchema, O as NcScheduleSchema, Ot as zoneAnalyticsCapability, P as OpsLogEntrySchema, Pt as isDeviceScopedCap, Q as audioMetricsCapability, Rt as array, S as NC_TAXONOMY, T as NcRulePatchSchema, Tt as systemEventFilterApplies, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as object, V as SCENE_DIVERGED, Vt as literal, W as TimelapseRuleInputSchema, Wt as partialRecord, X as alarmPanelCapability, Y as addonWidgetsSourceCapability, Z as assertTimelapseCadences, _ as MACRO_LABELS, _t as pickClusterStepModels, a as COCO_TO_MACRO, b as NC_DEFAULT_SNOOZE_MINUTES, bt as readDeviceStateFrom, ct as faceGalleryCapability, d as DeclaredDevices, dt as isDetectionMacroClass, et as buildEventKindDescriptor, f as EVENT_KIND_BY_CAP, ft as isScheduleActive, g as LabelAttributionSchema, h as FailureCounters, ht as notificationRulesCapability, i as CLUSTER_MODEL_SCOPED_STEPS, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as DeviceType, k as NcSnoozeInputSchema, kt as errMsg, l as DETECTION_MACRO_CLASSES, lt as failureContributionCapability, m as FULL_IMAGE_BBOX, mt as kebabToCamel, n as AnalyticsGroupRecordSchema, nt as customAction, o as DEFAULT_EVENT_COLOR, ot as encodeVectorBase64, p as EVENT_PAD_MS, pt as isSourceCap, q as TrackSourceSchema, qt as unknown, r as BaseDevice, rt as defineCustomActions, st as evaluateSensorEdge, t as AnalyticsGroupDetailSchema, tt as cosineSimilarity$1, v as NC_ALARM_SYSTEM_EVENT_KINDS, vt as pipelineAnalyticsCapability, w as NcRuleInputSchema, wt as subKindsOf, xt as readTimelapseGeneratedAt, y as NC_CONDITION_CATALOG, yt as plateGalleryCapability, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as boolean } from "../dist-DSg_jDMt.mjs";
+import { $ as audioMetricsCapability, A as NcSnoozeInputSchema, At as errMsg, B as SCENE_DEFAULT_ANCHOR_THRESHOLD, Bt as boolean, C as NC_TAXONOMY, D as NcRuleSchema, Dt as vectorDimFromBase64, E as NcRulePatchSchema, Et as systemEventFilterApplies, F as OpsLogEntrySchema, Ft as isDeviceScopedCap, G as TimelapseRuleInputSchema, Gt as partialRecord, H as SCENE_DIVERGED, Ht as literal, It as nodePin, J as TrackSourceSchema, Jt as unknown, K as TimelapseRulePatchSchema, Kt as record, L as RECORDING_EXPORT_MAX_READ_BYTES, Lt as sleep, M as NcSnoozeSuppressedSchema, Mt as DeviceType, N as NcSystemEventKindSchema, Nt as createEvent, O as NcRuleTargetSchema, Ot as videoclipsCapability, P as NcTaxonomySchema, Pt as hydrateSchema, Q as assertTimelapseCadences, R as RetrainStatusSchema, Rt as _enum, St as readTimelapseGeneratedAt, T as NcRuleInputSchema, Tt as subKindsOf, U as SceneMonitorSchema, Ut as number, V as SCENE_DEFAULT_UNCOVERED_POLICY, Vt as discriminatedUnion, W as TIMELAPSE_DENSE_FLOOR_SEC, Wt as object, X as addonWidgetsSourceCapability, Y as VISIT_MERGE_GAP_MS, Yt as EventCategory, Z as alarmPanelCapability, _ as MACRO_LABELS, a as COCO_TO_MACRO, at as deriveRecordingMode, b as NC_CONDITION_CATALOG, bt as plateGalleryCapability, ct as evaluateSensorEdge, d as DeclaredDevices, et as audioModeOf, f as EVENT_KIND_BY_CAP, ft as isDetectionMacroClass, g as LabelAttributionSchema, gt as notificationRulesCapability, h as FailureCounters, ht as kebabToCamel, i as CLUSTER_MODEL_SCOPED_STEPS, it as defineCustomActions, j as NcSnoozeSchema, jt as BaseAddon, k as NcScheduleSchema, kt as zoneAnalyticsCapability, l as DETECTION_MACRO_CLASSES, lt as faceGalleryCapability, m as FULL_IMAGE_BBOX, mt as isSourceCap, n as AnalyticsGroupRecordSchema, nt as cosineSimilarity$1, o as DEFAULT_EVENT_COLOR, p as EVENT_PAD_MS, pt as isScheduleActive, q as TimelapseRuleSchema, qt as string, r as BaseDevice, rt as customAction, st as encodeVectorBase64, t as AnalyticsGroupDetailSchema, tt as buildEventKindDescriptor, ut as failureContributionCapability, v as MediaFileKindEnum, vt as pickClusterStepModels, w as NcConditionDescriptorSchema, wt as sceneMonitorCapability, x as NC_DEFAULT_SNOOZE_MINUTES, xt as readDeviceStateFrom, y as NC_ALARM_SYSTEM_EVENT_KINDS, yt as pipelineAnalyticsCapability, zt as array } from "../dist-D6iC--Gh.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -106,6 +106,7 @@ function actionTtlMs(subject) {
 		case "snooze": return SNOOZE_ACTION_TTL_MS;
 		case "alarm": return subject.action === "disarm" ? ALARM_DISARM_TTL_MS : DEFAULT_ACTION_TTL_MS;
 		case "sequence": return DEFAULT_ACTION_TTL_MS;
+		case "addon-update": return DEFAULT_ACTION_TTL_MS;
 	}
 }
 var NcActionTokenRegistry = class {
@@ -185,6 +186,7 @@ function describeGrant(grant) {
 		case "sequence": return `${grant.ruleName} — ${grant.sequence}`;
 		case "snooze": return grant.classes === void 0 || grant.classes.length === 0 ? `Silenced for ${grant.minutes} min` : `Silenced for ${grant.minutes} min — ${grant.classes.join(", ")}`;
 		case "alarm": return grant.action === "disarm" ? "Alarm disarmed" : `Alarm armed${grant.mode !== void 0 ? ` (${grant.mode})` : ""}`;
+		case "addon-update": return `${grant.packages.length} addon update(s) on ${grant.nodeId}`;
 	}
 }
 /** The audit line's `meta`, per family. A snooze that logged a `sequence` it
@@ -215,6 +217,11 @@ function grantMeta(grant) {
 			mode: grant.mode ?? null,
 			panelDeviceId: grant.panelDeviceId
 		};
+		case "addon-update": return {
+			...common,
+			nodeId: grant.nodeId,
+			packages: grant.packages
+		};
 	}
 }
 /** What the human standing in front of the page is told. */
@@ -4724,6 +4731,40 @@ var SceneMonitorProvider = class {
 	async listScenes(input) {
 		return this.statusFor(input.deviceId);
 	}
+	/**
+	* `listScenes` for a SET, in one round trip.
+	*
+	* `/scenes` renders every camera and re-reads them behind the push slice on a
+	* 30 s safety net. Fanned out client-side that was one request per camera to
+	* read `statusFor`, which is an in-memory merge this provider already holds —
+	* all cost, no work. The work here is identical; only the transport
+	* collapses.
+	*
+	* **Every requested id gets a row.** A camera `statusFor` cannot answer for
+	* is `status: null`, which is NOT `monitors: []`: this feature's whole
+	* failure mode is silence reading as "nothing configured", and a batch that
+	* dropped the row would have made an unreachable camera invisible instead of
+	* reported.
+	*/
+	async listScenesBatch(input) {
+		return input.deviceIds.map((deviceId) => {
+			try {
+				return {
+					deviceId,
+					status: this.statusFor(deviceId)
+				};
+			} catch (err) {
+				this.deps.logger.warn("scene status could not be read", {
+					tags: { deviceId },
+					meta: { error: String(err) }
+				});
+				return {
+					deviceId,
+					status: null
+				};
+			}
+		});
+	}
 	async getStatus(input) {
 		return this.statusFor(input.deviceId);
 	}
@@ -5406,6 +5447,67 @@ function buildAlarmButtons(input) {
 	}];
 }
 //#endregion
+//#region src/notification-center/addon-update-apply.ts
+/**
+* The frozen packages that STILL have an update, in the order the row listed
+* them.
+*
+* Order matters: the notification's body listed them in that order, and an
+* operator watching addons restart should see them go in the order they read.
+*/
+function pendingPackages(frozen, updatable) {
+	const available = new Set(updatable);
+	return frozen.filter((name) => available.has(name));
+}
+/**
+* `done` only when every package the button promised was applied and nothing
+* was skipped or failed — the ONE case where a single number is the whole
+* truth. Anything else states all three counts, because a sentence that hides
+* one of them is a sentence that reports work it did not do.
+*/
+function addonUpdateSentence(report) {
+	if (report.applied.length === 0 && report.failed.length === 0) return "uptodate";
+	if (report.applied.length === report.requested && report.failed.length === 0) return "done";
+	return "partial";
+}
+//#endregion
+//#region src/notification-center/addon-update-buttons.ts
+/** The id this button travels under — in the callback and in the audit line. */
+var ADDON_UPDATE_BUTTON_ID = "addon-update-apply";
+function addonUpdateButtonRefusal(subject, recipient) {
+	if (subject.kind !== "addon-update-available") return "not-an-addon-update";
+	if ((subject.packageNames ?? []).length === 0) return "no-packages";
+	if (subject.nodeId === void 0) return "several-nodes";
+	if (recipient.ownerUserId === void 0) return "unowned-target";
+	return null;
+}
+/**
+* The button, or none.
+*
+* Returns an array rather than a nullable, so the caller composes it with the
+* other families by spreading — and so "which buttons survived" has one shape.
+*/
+function buildAddonUpdateButtons(input) {
+	const subject = input.subject;
+	if (addonUpdateButtonRefusal(subject, input.recipient) !== null) return [];
+	const packages = subject.packageNames ?? [];
+	const nodeId = subject.nodeId ?? "";
+	return [{
+		id: ADDON_UPDATE_BUTTON_ID,
+		label: input.label({
+			count: packages.length,
+			nodeId
+		}),
+		url: input.mintUrl({
+			actionId: ADDON_UPDATE_BUTTON_ID,
+			packages,
+			nodeId
+		}),
+		destructive: true,
+		mode: "background"
+	}];
+}
+//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -8471,6 +8573,22 @@ var en_default = {
 	"button.alarm.arm.night": "Arm night",
 	"button.alarm.arm.vacation": "Arm vacation",
 	"button.alarm.arm.custom_bypass": "Arm custom",
+	"button.addon-update.apply": {
+		"one": "Update {{count}} addon on {{nodeId}}",
+		"other": "Update {{count}} addons on {{nodeId}}"
+	},
+	"action.addon-update.title": "Addon update",
+	"action.addon-update.started": {
+		"one": "Updating {{count}} addon on {{nodeId}}…",
+		"other": "Updating {{count}} addons on {{nodeId}}…"
+	},
+	"action.addon-update.done": {
+		"one": "{{applied}} addon updated on {{nodeId}}",
+		"other": "{{applied}} addons updated on {{nodeId}}"
+	},
+	"action.addon-update.partial": "{{nodeId}}: {{applied}} updated, {{skipped}} already current, {{failed}} failed",
+	"action.addon-update.uptodate": "Already up to date on {{nodeId}} — nothing to do",
+	"action.addon-update.unknown": "Could not read what needs updating on {{nodeId}} — nothing was changed. Open CamStack.",
 	"summary.title": "Summary — {{rule}}",
 	"summary.body.window": "{{from}}→{{to}}",
 	"summary.body.events": {
@@ -8693,6 +8811,22 @@ var it_default = {
 	"button.alarm.arm.night": "Arma notte",
 	"button.alarm.arm.vacation": "Arma vacanza",
 	"button.alarm.arm.custom_bypass": "Arma personalizzato",
+	"button.addon-update.apply": {
+		"one": "Aggiorna {{count}} addon su {{nodeId}}",
+		"other": "Aggiorna {{count}} addon su {{nodeId}}"
+	},
+	"action.addon-update.title": "Aggiornamento addon",
+	"action.addon-update.started": {
+		"one": "Aggiornamento di {{count}} addon su {{nodeId}}…",
+		"other": "Aggiornamento di {{count}} addon su {{nodeId}}…"
+	},
+	"action.addon-update.done": {
+		"one": "{{applied}} addon aggiornato su {{nodeId}}",
+		"other": "{{applied}} addon aggiornati su {{nodeId}}"
+	},
+	"action.addon-update.partial": "{{nodeId}}: {{applied}} aggiornati, {{skipped}} già aggiornati, {{failed}} falliti",
+	"action.addon-update.uptodate": "Già aggiornato su {{nodeId}} — niente da fare",
+	"action.addon-update.unknown": "Non è stato possibile leggere cosa aggiornare su {{nodeId}} — non è stato cambiato nulla. Apri CamStack.",
 	"summary.title": "Riepilogo — {{rule}}",
 	"summary.body.window": "{{from}}→{{to}}",
 	"summary.body.events": {
@@ -9420,7 +9554,7 @@ var NcDispatcher = class {
 				targetId: target.id,
 				...target.ownerUserId !== void 0 ? { ownerUserId: target.ownerUserId } : {},
 				...entry.payload.subject.className !== void 0 ? { className: entry.payload.subject.className } : {},
-				...entry.payload.subject.systemEvent !== void 0 ? { systemEventKind: entry.payload.subject.systemEvent.kind } : {}
+				...entry.payload.subject.systemEvent !== void 0 ? { systemEvent: entry.payload.subject.systemEvent } : {}
 			});
 		} catch (err) {
 			this.deps.logger.warn("notification buttons could not be minted — sending without them", {
@@ -20154,7 +20288,7 @@ var NotificationCenter = class NotificationCenter {
 				return id;
 			}
 		});
-		const alarmKind = alarmButtonKind(input.systemEventKind);
+		const alarmKind = alarmButtonKind(input.systemEvent?.kind);
 		const panel = this.alarmPanel;
 		const alarmButtons = alarmKind === null ? [] : buildAlarmButtons({
 			kind: alarmKind,
@@ -20190,6 +20324,49 @@ var NotificationCenter = class NotificationCenter {
 				return id;
 			}
 		});
+		const systemEvent = input.systemEvent;
+		const recipient = input.ownerUserId !== void 0 ? { ownerUserId: input.ownerUserId } : {};
+		const updateRefusal = systemEvent === void 0 ? "not-an-addon-update" : addonUpdateButtonRefusal(systemEvent, recipient);
+		const updateButtons = systemEvent === void 0 ? [] : buildAddonUpdateButtons({
+			subject: systemEvent,
+			recipient,
+			label: ({ count, nodeId }) => this.texts.text({
+				key: "button.addon-update.apply",
+				vars: {
+					count: String(count),
+					nodeId
+				},
+				count
+			}),
+			mintUrl: ({ actionId, packages, nodeId }) => {
+				const id = randomUUID();
+				drafts.push({
+					id,
+					ttlMs: actionTtlMs({ kind: "addon-update" }),
+					grant: (expiresAt) => ({
+						kind: "addon-update",
+						id,
+						packages,
+						nodeId,
+						deviceId: input.deviceId,
+						actionId,
+						targetId: input.targetId,
+						expiresAt
+					})
+				});
+				return id;
+			}
+		});
+		if (updateRefusal === "several-nodes" || updateRefusal === "unowned-target") this.logger.info("addon-update notification carries no apply button", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				ruleId: input.ruleId,
+				reason: updateRefusal,
+				targetId: input.targetId,
+				nodeIds: systemEvent?.nodeIds ?? [],
+				packages: systemEvent?.packageNames ?? []
+			}
+		});
 		if (alarmKind !== null && panel === null) this.logger.info("alarm notification carries no buttons — this node owns no panel", {
 			tags: { deviceId: input.deviceId },
 			meta: {
@@ -20200,7 +20377,8 @@ var NotificationCenter = class NotificationCenter {
 		const out = [
 			...sequenceButtons,
 			...snoozeButtons,
-			...alarmButtons
+			...alarmButtons,
+			...updateButtons
 		];
 		if (out.length === 0) return [];
 		const now = this.now();
@@ -20321,8 +20499,139 @@ var NotificationCenter = class NotificationCenter {
 			case "snooze": return this.applyGrantedSnooze(grant);
 			case "alarm": return this.applyGrantedAlarm(grant);
 			case "sequence": return this.runGrantedSequence(grant);
+			case "addon-update": return this.applyGrantedAddonUpdate(grant);
 		}
 	}
+	/**
+	* Apply the addon updates one notification was about.
+	*
+	* The whole shape of this method is the answer to "a button that reports
+	* success for work it did not do":
+	*
+	*  1. **The cheap question first.** Ask the registry what is still out of
+	*     date on that node. A read that FAILS changes nothing and says so — it
+	*     is never read as "everything is current" and never as "apply the frozen
+	*     list anyway".
+	*  2. **Nothing to do is an outcome, not a success.** A frozen list the
+	*     operator already applied (from the Addons page, from auto-update, or by
+	*     tapping the copy of this notification that went to their other phone)
+	*     produces one announcement and zero `updatePackage` calls.
+	*  3. **The operator hears twice.** A background POST returns while the
+	*     updates run for minutes, so the tap is acknowledged BEFORE the first
+	*     apply and the verdict follows it. Tapping into silence is worse than no
+	*     button.
+	*
+	* The announcements go back to `grant.targetId` — the delivery this button
+	* was minted for, which is the only addressee a tap can honestly name (a tap
+	* identifies nobody; same reasoning as the snooze grant's frozen `userId`).
+	*
+	* Throws only when NOTHING was applied and something went wrong, so the
+	* plane's line says the run failed rather than reporting a spent token as a
+	* success.
+	*/
+	async applyGrantedAddonUpdate(grant) {
+		const apply = this.deps.applyAddonUpdate;
+		const list = this.deps.listAddonUpdates;
+		if (apply === void 0 || list === void 0) throw new Error("no addon updater is wired on this node");
+		let updatable;
+		try {
+			updatable = await list(grant.nodeId);
+		} catch (err) {
+			this.logger.warn("addon update button changed nothing — could not read what needs updating", { meta: {
+				nodeId: grant.nodeId,
+				packages: grant.packages,
+				error: String(err)
+			} });
+			await this.announceAddonUpdate(grant, "unknown", { nodeId: grant.nodeId });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+		const pending = pendingPackages(grant.packages, updatable);
+		const skipped = grant.packages.filter((name) => !pending.includes(name));
+		if (pending.length === 0) {
+			this.logger.info("addon update button applied nothing — every package is already current", { meta: {
+				nodeId: grant.nodeId,
+				packages: grant.packages
+			} });
+			await this.announceAddonUpdate(grant, "uptodate", { nodeId: grant.nodeId }, {
+				requested: grant.packages.length,
+				applied: [],
+				skipped,
+				failed: []
+			});
+			return;
+		}
+		await this.announceAddonUpdate(grant, "started", {
+			count: String(pending.length),
+			nodeId: grant.nodeId
+		}, void 0, pending.length);
+		const applied = [];
+		const failed = [];
+		for (const packageName of pending) try {
+			const result = await apply({
+				packageName,
+				nodeId: grant.nodeId
+			});
+			if (result.ok) applied.push(packageName);
+			else {
+				failed.push(packageName);
+				this.logger.warn("addon update from a notification button failed", { meta: {
+					nodeId: grant.nodeId,
+					packageName,
+					error: result.error
+				} });
+			}
+		} catch (err) {
+			failed.push(packageName);
+			this.logger.warn("addon update from a notification button threw", { meta: {
+				nodeId: grant.nodeId,
+				packageName,
+				error: String(err)
+			} });
+		}
+		const report = {
+			requested: grant.packages.length,
+			applied,
+			skipped,
+			failed
+		};
+		this.logger.info("addon updates applied from a notification button", { meta: {
+			nodeId: grant.nodeId,
+			requested: report.requested,
+			applied: applied.length,
+			skipped: skipped.length,
+			failed
+		} });
+		await this.announceAddonUpdate(grant, addonUpdateSentence(report), {
+			nodeId: grant.nodeId,
+			applied: String(applied.length),
+			skipped: String(skipped.length),
+			failed: String(failed.length)
+		}, report, applied.length);
+		if (applied.length === 0 && failed.length > 0) throw new Error(`no package updated on ${grant.nodeId} (${failed.join(", ")})`);
+	}
+	/**
+	* One sentence about an update tap, to the target the notification went to.
+	*
+	* Best-effort by construction — `deliverAnnouncement` never throws and never
+	* retries — because an announcement that failed must not turn an update that
+	* HAPPENED into a run the plane reports as failed.
+	*/
+	async announceAddonUpdate(grant, sentence, vars, report, count) {
+		const targetId = grant.targetId;
+		if (targetId === void 0) return;
+		const body = this.texts.text({
+			key: `action.addon-update.${sentence}`,
+			vars,
+			...count !== void 0 ? { count } : {}
+		});
+		const failedNames = report?.failed ?? [];
+		await this.dispatcher.deliverAnnouncement({
+			reason: `addon-update-${sentence}`,
+			targetId,
+			title: this.texts.text({ key: "action.addon-update.title" }),
+			body: failedNames.length > 0 ? `${body}\n${failedNames.join(", ")}` : body
+		});
+	}
 	async runGrantedSequence(grant) {
 		if (this.actionRunner === null) throw new Error("no actuator is wired on this node");
 		const rule = this.rules.get(grant.ruleId);
@@ -25672,6 +25981,67 @@ var MEDIA_INDEXES = [
 	{
 		name: "idx_media_location",
 		columns: ["locationId"]
+	}),
+	(
+	/**
+	* The events-management footprint — `GROUP BY deviceId` and
+	* `SUM(sizeBytes) WHERE deviceId = ?`. See {@link MediaStore.footprintByDevice}.
+	*
+	* **Why not `idx_media_device_ts`.** That index already leads with
+	* `deviceId`, so it can find the range — but it does not carry `sizeBytes`,
+	* so the sum has to fetch the table row behind every index entry it visits.
+	* Over the whole collection that is one scattered read of the entire ~1.25 M
+	* row table (`path` alone is ~80 characters per row) on the volume the
+	* recorder is writing to. With `sizeBytes` in the index the planner never
+	* touches the table: `SCAN … USING COVERING INDEX idx_media_device_size`.
+	*
+	* It has to be a NEW index rather than a third column on the existing one.
+	* `declareCollection` emits `CREATE INDEX IF NOT EXISTS` keyed on the index
+	* NAME, so widening `idx_media_device_ts` in place would be a silent no-op on
+	* every hub that already has it — the declaration would read as done and the
+	* query would still hit the table.
+	*
+	* **What it costs.** ~19 bytes of index per row (two integers plus the
+	* rowid), so ~24 MB at 1.25 M rows, plus one more b-tree maintained by every
+	* insert into a table taking ~92 k rows/day. At ~1 insert/s that maintenance
+	* is noise beside the JPEG write the same call performs. The cost that is not
+	* noise is the one-off: the first `declareCollection` after this ships builds
+	* the index over every existing row. Do not deploy it beside a running drain
+	* or seal — the same caveat `idx_media_location` carries, for the same
+	* reason.
+	*/
+	{
+		name: "idx_media_device_size",
+		columns: ["deviceId", "sizeBytes"]
+	}),
+	(
+	/**
+	* The per-KIND footprint — `COUNT(*)`/`SUM(sizeBytes) WHERE kind = ?`, and
+	* the same scoped to one camera. See {@link MediaStore.footprintByKind}.
+	*
+	* `kind` leads no existing index, so without this each of the thirteen
+	* per-kind questions is a full table scan and the breakdown costs thirteen of
+	* them. With it, each kind is a contiguous covering range and the thirteen
+	* together scan the index once — the cost of the whole breakdown is one pass
+	* over ~36 MB of index instead of thirteen passes over the table.
+	*
+	* `deviceId` sits between `kind` and `sizeBytes` so the per-camera variant
+	* (`WHERE kind = ? AND deviceId = ?`) stays covering too, for ~3 bytes a row
+	* more than `(kind, sizeBytes)` would cost. Without it that query finds its
+	* range from the index and then reads the table for every row in it.
+	*
+	* ~29 bytes of index per row, so ~36 MB at 1.25 M rows, and one more b-tree
+	* on every insert. Same one-off caveat as the two indexes above: the first
+	* declare builds it over every existing row, so do not ship it beside a
+	* running drain or seal.
+	*/
+	{
+		name: "idx_media_kind_device_size",
+		columns: [
+			"kind",
+			"deviceId",
+			"sizeBytes"
+		]
 	})
 ];
 /** The storage location of a media row/record: its stamped `locationId`, or
@@ -26326,47 +26696,136 @@ var MediaStore = class {
 		};
 	}
 	/**
-	* On-demand footprint aggregation for the events-management UI: sum
-	* `sizeBytes` and count rows per device across the whole media collection.
-	* Pages by `id` (offset-based) so a large collection never loads at once.
-	* Metadata rows are small (no blob) — the image bytes live on the storage
-	* provider and are counted via the persisted `sizeBytes` column.
+	* On-demand footprint aggregation for the events-management UI: rows and
+	* summed `sizeBytes` per camera, across the whole media collection.
+	*
+	* ## Why this is a histogram plus one aggregate per camera
+	*
+	* It used to page the ENTIRE collection — `ORDER BY id LIMIT 1000 OFFSET n`,
+	* no predicate — and add `sizeBytes` up in JS. SQLite honours an OFFSET by
+	* stepping over `n` entries, so the walk is quadratic in the table: at the
+	* live hub's 1.25 M rows that is ~1 250 round trips and ~780 M index steps,
+	* with every row serialised across an RPC boundary and rebuilt in V8 to be
+	* added to a number. It timed out at 60 s on every call it ever made, and it
+	* is the only thing that can size the surplus-media deletion it gates.
+	*
+	* The answer is at most a few dozen `(deviceId, rows, bytes)` triples.
+	*
+	*  - The DEVICE SET comes from a histogram on `deviceId` with `bucketSize: 1`
+	*    — `GROUP BY deviceId`, served from `idx_media_device_size` as a covering
+	*    scan, the same trick `TrackStore.listDeviceIds` already uses (D56).
+	*    `bucket` IS the deviceId: the column is INTEGER and the bucket
+	*    expression is `CAST((deviceId - 0) / 1 AS INTEGER)`.
+	*  - The NUMBERS come from one `aggregate` per camera — `COUNT(*)` and
+	*    `SUM(sizeBytes)` in a single statement over an indexed `deviceId` range.
+	*
+	* Both figures for a camera come from the SAME statement deliberately. Taking
+	* `rows` from the histogram and `bytes` from the aggregate would let a write
+	* landing between the two produce a footprint whose row count and byte count
+	* describe different populations — a disagreement an operator sizing a
+	* deletion has no way to detect.
+	*
+	* A read that fails THROWS. It must never degrade to a zero: "this camera
+	* holds nothing" is precisely the claim a failed measurement must not be
+	* allowed to make to something about to delete (D295, D312).
 	*/
 	async footprintByDevice() {
-		const PAGE = 1e3;
+		const buckets = await this.store.histogram.query({
+			collection: MEDIA_COLLECTION,
+			field: "deviceId",
+			bucketSize: 1,
+			origin: 0
+		});
 		const out = /* @__PURE__ */ new Map();
-		let offset = 0;
-		for (;;) {
-			const rows = await this.store.query.query({
+		for (const bucket of buckets) {
+			if (bucket.count === 0 || !Number.isFinite(bucket.bucket)) continue;
+			const deviceId = bucket.bucket;
+			const agg = await this.store.aggregate.query({
 				collection: MEDIA_COLLECTION,
-				filter: {
-					orderBy: {
-						field: "id",
-						direction: "asc"
-					},
-					limit: PAGE,
-					offset
-				}
+				fields: [{
+					as: "bytes",
+					field: "sizeBytes",
+					op: "sum"
+				}],
+				filter: { where: { deviceId } }
+			});
+			if (agg.count === 0) continue;
+			const bytes = agg.values["bytes"];
+			out.set(deviceId, {
+				bytes: bytes ?? 0,
+				rows: agg.count
 			});
-			if (rows.length === 0) break;
-			for (const row of rows) {
-				const data = row.data;
-				const deviceId = Number(data["deviceId"]);
-				const sizeBytes = Number(data["sizeBytes"]);
-				if (!Number.isFinite(deviceId)) continue;
-				const acc = out.get(deviceId) ?? {
-					bytes: 0,
-					rows: 0
-				};
-				acc.bytes += Number.isFinite(sizeBytes) ? sizeBytes : 0;
-				acc.rows += 1;
-				out.set(deviceId, acc);
-			}
-			if (rows.length < PAGE) break;
-			offset += PAGE;
 		}
 		return out;
 	}
+	/**
+	* The media footprint broken down by KIND — fleet-wide, or for one camera.
+	*
+	* `footprintByDevice` answers "how much is where"; this answers "how much is
+	* WHAT", which is the axis a deletion decision turns on. The deletable set
+	* (the periodic `snapshot` filmstrip, the surplus per-edge motion stills) and
+	* the keep set (`firstFrame`, rolling `lastFrame`, `thumbnail` /
+	* `thumbnailSmall`, `keyFrame` / `keyFrameSmall`, the face and plate buffers,
+	* gallery media, the CLIP `crop`) are told apart by `kind` and by nothing
+	* else. A byte total cannot size a deletion; this can.
+	*
+	* One `aggregate` per kind, each an indexed covering range on
+	* `idx_media_kind_device_size`, plus ONE unfiltered aggregate for the totals.
+	*
+	* That last statement is the point of the design and not a spare round trip.
+	* `MediaFileKindEnum.options` is the closed set the writers use, but the
+	* TABLE is not closed: a row written by a retired path, or by a version that
+	* knew a kind this one does not, matches no per-kind query. Adding the kinds
+	* up to produce the total would make such a row invisible and the denominator
+	* quietly too small — the failure mode that matters most here, because the
+	* caller is about to delete against it. So the total is measured
+	* independently and the difference is REPORTED as `unaccounted*` rather than
+	* being absorbed.
+	*/
+	async footprintByKind(deviceId) {
+		const scope = deviceId === void 0 ? void 0 : { where: { deviceId } };
+		const fields = [{
+			as: "bytes",
+			field: "sizeBytes",
+			op: "sum"
+		}];
+		const totals = await this.store.aggregate.query({
+			collection: MEDIA_COLLECTION,
+			fields: [...fields],
+			...scope === void 0 ? {} : { filter: scope }
+		});
+		const kinds = [];
+		let countedRows = 0;
+		let countedBytes = 0;
+		for (const kind of MediaFileKindEnum.options) {
+			const agg = await this.store.aggregate.query({
+				collection: MEDIA_COLLECTION,
+				fields: [...fields],
+				filter: { where: {
+					kind,
+					...deviceId === void 0 ? {} : { deviceId }
+				} }
+			});
+			if (agg.count === 0) continue;
+			const bytes = agg.values["bytes"] ?? 0;
+			countedRows += agg.count;
+			countedBytes += bytes;
+			kinds.push({
+				kind,
+				rows: agg.count,
+				bytes
+			});
+		}
+		kinds.sort((a, b) => b.bytes - a.bytes);
+		const totalBytes = totals.values["bytes"] ?? 0;
+		return {
+			totalRows: totals.count,
+			totalBytes,
+			kinds,
+			unaccountedRows: totals.count - countedRows,
+			unaccountedBytes: totalBytes - countedBytes
+		};
+	}
 	/** Move a single media entry from one owner to another.
 	*  The new copy is written before the old one is removed.
 	*  The old-entry deletion is best-effort: on failure a warning is logged
@@ -28887,30 +29346,57 @@ var LEGACY_FACE_MODEL_ID = "arcface-r100";
 */
 var FACES_COLLECTION = "pipeline-analytics:faces";
 /**
-* Rows per page for the two whole-collection sweeps below.
-*
-* A face row is one of the two WIDEST row shapes in the hub's database: it
-* carries a JSON `embedding` on every single row, measured at **10.8 KB
-* average** where a motion event is 78 bytes. Both sweeps used to read the
-* collection in ONE statement with no `limit`.
+* Rows per page for `pruneCapOverflow`, the ONE remaining walk of this
+* collection.
 *
-* To be exact about what that did and did not cause: this table holds **372
-* rows / 4.0 MB** on the live hub, so it was *not* the read that killed
-* hub-main on 2026-08-07 (that was the multi-camera track feed — see
-* `RECENT_FANOUT_ROW_BUDGET` in `track-store.ts`). It is a full scan whose cost
-* grows with a table nothing else bounds, which is the same defect one incident
-* earlier. `pruneCapOverflow` is what keeps the row count small — and it was
-* itself one of the two unbounded readers, so the bound and the thing enforcing
-* it were the same loop.
+* It is a walk that DOES WORK: the capacity bound has to consider every row to
+* decide which ones leave, and it runs on the maintenance pass, not on a
+* request. That is the shape D320 permits. What it must not do is drag the
+* whole row across for four scalars — see the projection there.
 *
-* The engine now refuses an unbounded read (`query-bounds.ts`), so paging here
-* is not belt-and-braces: without it these two methods would silently see only
-* the newest N rows and the buffer would grow forever.
+* The two READS that used to page here do not any more. They asked a question
+* ("the newest N faces that are still unassigned"), the question is a
+* predicate, and a predicate answers it in one statement whose cost is the
+* ANSWER rather than the table.
 *
-* 1 000 keeps peak transfer around 11 MB while staying under the engine's own
-* cap, so the page is always the caller's bound and never the engine's.
+* The engine refuses an unbounded read (`query-bounds.ts`) and truncates a
+* limitless one at `SETTINGS_QUERY_DEFAULT_ROW_CAP` with a WARN nobody can act
+* on, so every read below carries an explicit `limit`.
 */
 var FACE_SWEEP_PAGE = 1e3;
+/**
+* The widest window a single gallery read may materialise before it REFUSES.
+*
+* It bounds only the reads whose size the CALLER did not name: an unbounded
+* `listAllRecentFaces`, and the `suggestionConfidence` order, which cannot stop
+* early because the most certain suggestion may be the oldest row (`face-sort.ts`).
+* A caller's own `limit` is honoured verbatim at any table size — asking for
+* 500 and getting 500 is being served, not being truncated.
+*
+* 10 000 because that is above what `pruneCapOverflow` actually permits to
+* exist: 29 cameras × (50 ordinary + 200 suggested) = 7 250 unassigned rows,
+* plus whatever the operator has enrolled. It sits under the engine's
+* `SETTINGS_QUERY_HARD_ROW_CAP` (20 000) so the engine never truncates first —
+* this bound is the one that speaks, and it speaks by throwing.
+*
+* The alternative was to answer with the rows it managed to read. A short list
+* and a complete one are the same array, and a gallery that quietly stops
+* showing a face is exactly the failure this whole change exists to avoid.
+*/
+var FACE_WINDOW_MAX_ROWS = 1e4;
+/**
+* A gallery read whose window is wider than {@link FACE_WINDOW_MAX_ROWS}.
+*
+* Distinct type so a router can map it to a 400 and an operator can be told
+* *"the buffer is too large to rank in one pass — narrow the window"* instead
+* of being shown a page that silently lost its tail.
+*/
+var FaceWindowTooWideError = class extends Error {
+	constructor(rows) {
+		super(`face window exceeds ${String(FACE_WINDOW_MAX_ROWS)} rows (read ${String(rows)}) — refusing to answer with the part that fit; narrow with deviceIds / since / until, or pass an explicit limit`);
+		this.name = "FaceWindowTooWideError";
+	}
+};
 /** How many evicted face ids one per-camera eviction line names before it
 *  stops — enough to find the rows, not enough to turn a log line into a page. */
 var SUGGESTED_EVICTION_IDS_LOGGED = 10;
@@ -29012,13 +29498,128 @@ var FACE_COLUMNS = [
 		type: "REAL"
 	}
 ];
-var FACE_INDEXES = [{
-	name: "idx_faces_device_ts",
-	columns: ["deviceId", "timestamp"]
-}, {
-	name: "idx_faces_track",
-	columns: ["trackId"]
-}];
+/**
+* What every gallery query orders by, and what the three of them filter on.
+*
+* Before these existed, EVERY read of this collection was
+* `SCAN … | USE TEMP B-TREE FOR ORDER BY` — a full table scan plus a sort of
+* the whole table, to hand back the newest 500 rows. Measured with
+* `EXPLAIN QUERY PLAN` over a 20 000-row copy of this exact schema:
+*
+* | query | before | after |
+* | --- | --- | --- |
+* | newest N | `SCAN + TEMP B-TREE` | `SCAN USING idx_faces_ts` |
+* | newest N unassigned | `SCAN + TEMP B-TREE` | `SEARCH USING idx_faces_assigned_ts (assigned=?)` |
+* | newest N recognized | `SCAN + TEMP B-TREE` | `SEARCH USING idx_faces_assigned_ts (assigned=?)` |
+* | faces of one identity | `SCAN + TEMP B-TREE` | `SEARCH USING idx_faces_identity_ts (recognizedIdentityId=?)` |
+*
+* The sort disappearing is the point: with an ordered index the statement stops
+* at the `LIMIT`, so the cost is the ANSWER. Without it the cost is the table,
+* and this table is bounded only by `pruneCapOverflow` — it went from 372 rows
+* (2026-08-25) to 1 612 (2026-08-31) while a UI polled it every 30 seconds.
+*
+* `idx_faces_ts` is NOT redundant beside `idx_faces_assigned_ts`: a composite
+* leading on `assigned` cannot serve an unfiltered `ORDER BY timestamp`.
+* Three b-trees over a few thousand narrow rows is tens of KB, against one
+* UPSERT per track that produces a face — the write rate this pays at.
+*/
+var FACE_INDEXES = [
+	{
+		name: "idx_faces_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	{
+		name: "idx_faces_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_faces_ts",
+		columns: ["timestamp"]
+	},
+	{
+		name: "idx_faces_assigned_ts",
+		columns: ["assigned", "timestamp"]
+	},
+	{
+		name: "idx_faces_identity_ts",
+		columns: ["recognizedIdentityId", "timestamp"]
+	}
+];
+/**
+* The columns a {@link Face} is built from — every declared column EXCEPT the
+* drained legacy `embedding`, derived mechanically so a column added tomorrow
+* arrives without anyone remembering this list.
+*
+* Mechanical on purpose. A hand-written projection is how a field silently
+* stops arriving: the row comes back missing the key, `rowToFace` reads
+* `undefined`, and "the database says nothing" is indistinguishable from "I did
+* not ask". The engine REFUSES a column it cannot serve
+* (`resolveProjection`) — the projection is the one part of a query that is not
+* allowed to be forgiving — so a stale name here is a throw, not a wrong value.
+*
+* `embedding` is the only exclusion, and it is the whole reason to project:
+* it is a `notNull` JSON column on the widest row shape in the database, it is
+* dropped by `rowToFace` on arrival, and {@link Face} has no field for it. A
+* caller that wants floats asks by name ({@link FaceStore.getWithEmbedding},
+* {@link FaceStore.loadEmbeddings}). Since D304 drained it to `[]` the saving
+* is small — 23 B/row, measured on the live hub — but the column is still
+* declared, still `notNull`, and an unconverted row still carries ~10.8 KB of
+* it. Projecting is what keeps that a fact about ONE row rather than about
+* every gallery poll.
+*/
+var FACE_LIST_COLUMNS = FACE_COLUMNS.map((c) => c.name).filter((name) => name !== "embedding" && name !== "id");
+/**
+* The four scalars `pruneCapOverflow` decides on.
+*
+* Its docblock has always said *"only four scalars per row survive the page"*.
+* They survived the PAGE; the query still dragged every column — the embedding
+* included — across the RPC boundary and through V8 first. A leftover that
+* describes the right design reads as verification, so the projection now makes
+* the sentence true.
+*/
+var FACE_CAP_COLUMNS = [
+	"deviceId",
+	"timestamp",
+	"assigned",
+	"suggestedIdentityId"
+];
+/** One camera reference per identity — see {@link FaceStore.listCameraRefsForIdentity}. */
+var FACE_REF_COLUMNS = ["deviceId"];
+/**
+* A gallery view as a STORE PREDICATE.
+*
+* Every one of the four is expressible, and that is the whole finding behind
+* this change. They were applied in JS, over pages the store had already
+* chosen, which is why `limit` counted rows that PASSED and the read had to
+* sweep until enough had: with `filter: 'unassigned'` the newest N rows may be
+* entirely assigned while matches wait just beyond them. Pushed down, `limit`
+* IS the store's limit, and the sweep has nothing left to do.
+*
+* **Two of them name null, and null is the trap.** `recognizedIdentityId` is a
+* nullable TEXT column, so "has an identity" is `IS NOT NULL` — which
+* `whereNot: { field: null }` compiles to since D312, and which before D312
+* compiled to `(expr IS NULL OR expr != NULL)`: TRUE for a NULL row and NULL
+* for every other, i.e. precisely the rows it was asked to exclude. A predicate
+* that silently matched nothing would report "no recognized faces" forever and
+* every assertion about the rows returned would agree with it. Verified against
+* the live hub before shipping: 1 612 rows, `where {assigned:false}` → 1 444,
+* `whereNot {recognizedIdentityId:null}` → 247.
+*
+* `assigned` is `BOOLEAN NOT NULL`; the backend serialises `false` to `0` at
+* the bind (`serializeColumnValue`) and decodes `0` back to `false` on read, so
+* plain equality is correct and no null semantics are involved.
+*/
+function faceFilterPredicate(filter) {
+	switch (filter) {
+		case "unassigned": return { where: { assigned: false } };
+		case "recognized": return {
+			where: { assigned: false },
+			whereNot: { recognizedIdentityId: null }
+		};
+		case "identified": return { whereNot: { recognizedIdentityId: null } };
+		case "all": return {};
+	}
+}
 /**
 * `since` / `until` as a store predicate.
 *
@@ -29053,6 +29654,7 @@ function rowToFace(id, raw) {
 	return {
 		...rest,
 		id,
+		embeddingModelId: data.embeddingModelId ?? void 0,
 		assigned: Boolean(data.assigned),
 		mediaKey: data.mediaKey ?? void 0,
 		recognizedIdentityId: data.recognizedIdentityId ?? void 0,
@@ -29281,16 +29883,21 @@ var FaceStore = class {
 	*/
 	async pruneCapOverflow(input) {
 		/**
-		* Paged, not one statement. Only four scalars per row survive the page —
-		* the `embedding` string that dominates the row is dropped as soon as the
-		* page goes out of scope, so peak heap is one page rather than the whole
-		* face table. The prune still considers EVERY row, which is what makes it a
-		* capacity bound rather than a bound on the newest page.
+		* Paged, not one statement, and PROJECTED to the four scalars the decision
+		* needs — this sentence used to be true only of what survived the page,
+		* while the query still dragged every column, `embedding` included, across
+		* the RPC boundary and through V8 first.
+		*
+		* This is the one walk of the collection that remains, and D320 permits it:
+		* it must touch every row to ACT on it, and it runs on the maintenance
+		* pass, not on a request. The prune still considers EVERY row, which is
+		* what makes it a capacity bound rather than a bound on the newest page.
 		*/
 		const byDevice = /* @__PURE__ */ new Map();
 		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
 			const rows = await this.store.query.query({
 				collection: FACES_COLLECTION,
+				columns: FACE_CAP_COLUMNS,
 				filter: {
 					orderBy: {
 						field: "timestamp",
@@ -29584,29 +30191,38 @@ var FaceStore = class {
 	*  - 'recognized'           → !assigned && recognizedIdentityId != null
 	*  - 'identified'           → recognizedIdentityId != null, including manual assignments
 	*
-	* `deviceIds`, `since` and `until` are pushed INTO the query — they narrow
-	* what is read, not what is returned. `filter` and the ordering cannot be
-	* (the first is a computed predicate, the second is a contract this backend
-	* does not implement — see `face-sort.ts`), so they are applied here.
-	*
-	* **`limit` counts rows that PASSED the filter, never rows that were
-	* discarded.** That is the whole reason this pages instead of asking the
-	* store for `limit` rows: with `filter:'unassigned'` the newest N rows may be
-	* entirely assigned while matches wait just beyond them.
-	*
-	* The previous answer was to fetch the WHOLE collection and slice after
-	* filtering. That is the read that killed hub-main (`query-bounds.ts`) —
-	* every face row carries a JSON `embedding`, so "all rows" is the widest
-	* table in the database materialised at once, to render a gallery of at most
-	* a few hundred tiles.
-	*
-	* So: PAGE. Under the default `timestamp` order the store's paging already
-	* emits rows in the answer's order, so the sweep stops the moment enough
-	* MATCHES exist and the common case costs one page. Under
-	* `suggestionConfidence` it cannot — the most certain suggestion may be the
-	* oldest row — so the sweep walks the window and folds each page through
-	* `rankAndCap`, which holds the RETAINED set to `limit` even though the read
-	* is wider. Narrow the read with `since` / `until`.
+	* **Every part of the question is now a store predicate** — `deviceIds`,
+	* `since` / `until` AND `filter` ({@link faceFilterPredicate}) — so `limit`
+	* is the STORE's limit and one statement is the whole answer.
+	*
+	* That is the change. This used to page: `filter` was a JS predicate applied
+	* to rows the store had already chosen, so `limit` counted rows that PASSED
+	* and the read had to sweep until enough had, up to `FACE_SWEEP_MAX_PAGES`
+	* (1 000) × `FACE_SWEEP_PAGE` (1 000) — a million rows, `offset`-paged,
+	* behind a UI polling every 30 seconds. On the live hub that meant reading
+	* all 1 612 rows over 2 round trips to produce a 60-row `recognized` page,
+	* every 30 s, per open tab, and growing with a table only `pruneCapOverflow`
+	* bounds. It is the same family as `MediaRelocateEngine.pageRows`, which put
+	* a ~16 s standing queue in front of every settings-store call in the cluster
+	* (D320) — smaller, on a longer timer, and the same shape.
+	*
+	* `offset` is gone with it, not merely unnecessary: the recognizer UPSERTs
+	* into this collection continuously, so page two at `offset: N` starts N rows
+	* past a set that may have gained or lost its first N (D295 rule 1, D320 R3).
+	*
+	* ## What still cannot be pushed, and what that costs
+	*
+	* The `suggestionConfidence` ORDER stays here. `ORDER BY suggestedMatchScore`
+	* would let the backend decide where a scoreless row goes — SQLite collates
+	* NULL first on ASC and last on DESC — and the contract is that it sorts LAST
+	* in BOTH directions (`face-sort.ts`). So that order reads the whole FILTERED
+	* window and ranks it. Filtered, which is the improvement: the window is the
+	* unassigned buffer, not the table.
+	*
+	* A window it cannot read whole REFUSES ({@link FaceWindowTooWideError}).
+	* Ranking the part that fit is exactly "most certain among the newest N",
+	* which is the defect that order was added to remove, and it is invisible in
+	* the rows returned.
 	*
 	* An **empty `deviceIds` reads nothing at all**: `[]` is a request for no
 	* cameras, not an omission (the `deviceManager.listFleet` contract).
@@ -29615,74 +30231,86 @@ var FaceStore = class {
 		if (input.deviceIds !== void 0 && input.deviceIds.length === 0) return [];
 		const order = resolveFaceSort(input);
 		const pagingServesTheOrder = sortIsServedByTimestampPaging(order);
-		const filterMode = input.filter ?? "all";
-		const matches = (f) => {
-			if (filterMode === "unassigned") return !f.assigned;
-			if (filterMode === "recognized") return !f.assigned && f.recognizedIdentityId != null;
-			if (filterMode === "identified") return f.recognizedIdentityId != null;
-			return true;
-		};
-		const storeFilter = {
-			...input.deviceIds !== void 0 ? { whereIn: { deviceId: [...new Set(input.deviceIds)] } } : {},
-			...buildTimestampWindow(input),
-			orderBy: {
-				field: "timestamp",
-				direction: pagingServesTheOrder ? order.direction : "desc"
+		/**
+		* The caller's `limit` bounds the READ only when the store's ordering is
+		* already the answer's. Under `suggestionConfidence` the most certain
+		* suggestion may be the oldest row, so the read is the window and `limit`
+		* bounds only what is RETAINED (`rankAndCap`).
+		*/
+		const callerBounded = pagingServesTheOrder && input.limit !== void 0;
+		const readLimit = callerBounded ? input.limit ?? 0 : 10001;
+		const rows = await this.store.query.query({
+			collection: FACES_COLLECTION,
+			columns: FACE_LIST_COLUMNS,
+			filter: {
+				...input.deviceIds !== void 0 ? { whereIn: { deviceId: [...new Set(input.deviceIds)] } } : {},
+				...buildTimestampWindow(input),
+				...faceFilterPredicate(input.filter ?? "all"),
+				orderBy: {
+					field: "timestamp",
+					direction: pagingServesTheOrder ? order.direction : "desc"
+				},
+				limit: readLimit
 			}
-		};
-		let result = [];
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					...storeFilter,
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			const matched = [];
-			for (const r of rows) {
-				const face = rowToFace(r.id, r.data);
-				if (matches(face)) matched.push(face);
-			}
-			if (pagingServesTheOrder) {
-				const merged = [...result, ...matched];
-				if (input.limit !== void 0 && merged.length >= input.limit) return merged.slice(0, input.limit);
-				result = merged;
-			} else result = rankAndCap([...result, ...matched], order, input.limit);
-			if (rows.length < 1e3) break;
-		}
-		return pagingServesTheOrder ? result : rankAndCap(result, order, input.limit);
+		});
+		if (!callerBounded && rows.length > 1e4) throw new FaceWindowTooWideError(rows.length);
+		const faces = rows.map((r) => rowToFace(r.id, r.data));
+		return pagingServesTheOrder ? faces : rankAndCap(faces, order, input.limit);
 	}
-	/** One real face row per camera currently attributed to an identity. */
+	/**
+	* One real face row per camera currently attributed to an identity.
+	*
+	* `recognizedIdentityId` is indexed (`idx_faces_identity_ts`), so this is a
+	* bounded index walk over the identity's own rows rather than the
+	* `offset`-paged sweep of the whole collection it used to be. It projects
+	* `deviceId` alone — the answer is a device id and a row id, and the row id
+	* is the record key.
+	*/
 	async listCameraRefsForIdentity(identityId) {
+		const rows = await this.identityRows(identityId, FACE_REF_COLUMNS);
 		const byDevice = /* @__PURE__ */ new Map();
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					where: { recognizedIdentityId: identityId },
-					orderBy: {
-						field: "timestamp",
-						direction: "desc"
-					},
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			for (const row of rows) {
-				const deviceId = Number(row.data["deviceId"]);
-				if (Number.isInteger(deviceId) && !byDevice.has(deviceId)) byDevice.set(deviceId, row.id);
-			}
-			if (rows.length < 1e3) break;
+		for (const row of rows) {
+			const deviceId = Number(row.data["deviceId"]);
+			if (Number.isInteger(deviceId) && !byDevice.has(deviceId)) byDevice.set(deviceId, row.id);
 		}
 		return [...byDevice].map(([deviceId, faceId]) => ({
 			deviceId,
 			faceId
 		}));
 	}
+	/**
+	* Every face row currently attributed to an identity, id only.
+	*
+	* `deleteIdentity` detaches these before the identity goes. It used to get
+	* them by listing the WHOLE collection with `filter: 'all'` and no limit and
+	* comparing in JS — which past `SETTINGS_QUERY_DEFAULT_ROW_CAP` would have
+	* detached the rows that fit and left the rest pointing at a deleted
+	* identity, silently, with a WARN in the engine that no caller can see.
+	*/
+	async listFaceIdsForIdentity(identityId) {
+		return (await this.identityRows(identityId, FACE_REF_COLUMNS)).map((r) => r.id);
+	}
+	/**
+	* The rows of one identity, newest first, bounded and REFUSING rather than
+	* narrowing. Shared by the two callers above so they cannot disagree about
+	* what "this identity's faces" means.
+	*/
+	async identityRows(identityId, columns) {
+		const rows = await this.store.query.query({
+			collection: FACES_COLLECTION,
+			columns,
+			filter: {
+				where: { recognizedIdentityId: identityId },
+				orderBy: {
+					field: "timestamp",
+					direction: "desc"
+				},
+				limit: 10001
+			}
+		});
+		if (rows.length > 1e4) throw new FaceWindowTooWideError(rows.length);
+		return rows;
+	}
 };
 //#endregion
 //#region src/pipeline-analytics/face-gallery-provider.ts
@@ -29799,8 +30427,7 @@ var FaceGalleryProvider = class {
 		});
 	}
 	async deleteIdentity(input) {
-		const faces = await this.faceStore.listAllRecentFaces({ filter: "all" });
-		for (const f of faces) if (f.recognizedIdentityId === input.id) await this.unassignFace({ faceId: f.id });
+		for (const faceId of await this.faceStore.listFaceIdsForIdentity(input.id)) await this.unassignFace({ faceId });
 		await this.mediaStore.deleteForOwner("identity", [input.id]);
 		await this.identityStore.deleteIdentity(input.id);
 		this.refreshGallery();
@@ -29873,8 +30500,7 @@ var FaceGalleryProvider = class {
 			sortBy: input?.sortBy,
 			sortDirection: input?.sortDirection
 		});
-		const identities = await this.identityStore.listIdentities();
-		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
+		const nameMap = await this.identityStore.namesFor(faces.flatMap((f) => f.recognizedIdentityId != null ? [f.recognizedIdentityId] : []));
 		const includeCrops = resolveIncludeCrops(input);
 		return mapWithConcurrency(faces, FACE_CROP_FETCH_CONCURRENCY, async (face) => {
 			const base64 = includeCrops ? await this.faceCropBase64(face) : void 0;
@@ -29910,8 +30536,7 @@ var FaceGalleryProvider = class {
 		const face = await this.faceStore.get("face-" + input.trackId);
 		if (!face) return null;
 		if (face.deviceId !== input.deviceId) return null;
-		const identities = await this.identityStore.listIdentities();
-		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
+		const nameMap = await this.identityStore.namesFor(face.recognizedIdentityId != null ? [face.recognizedIdentityId] : []);
 		const identityName = face.recognizedIdentityId ? nameMap.get(face.recognizedIdentityId) : void 0;
 		const cropUrl = this.cropUrlFor(face);
 		return {
@@ -34728,9 +35353,14 @@ var PlateGalleryProvider = class {
 			...cropUrl !== void 0 ? { cropUrl } : {}
 		};
 	}
-	async vehicleNameMap() {
-		const vehicles = await this.vehicleStore.listVehicles();
-		return new Map(vehicles.map((v) => [v.id, v.name]));
+	/**
+	* Names for the vehicles THESE PLATES reference — not the collection.
+	*
+	* A page of unassigned reads references none, and then this costs no round
+	* trip at all. See `VehicleStore.namesFor`.
+	*/
+	async vehicleNameMap(plates) {
+		return this.vehicleStore.namesFor(plates.flatMap((p) => p.recognizedVehicleId != null ? [p.recognizedVehicleId] : []));
 	}
 	/**
 	* `includeCrops` defaults to `true` — the pre-existing behaviour, kept so no
@@ -34745,14 +35375,14 @@ var PlateGalleryProvider = class {
 			...input?.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
 			...input?.limit !== void 0 ? { limit: input.limit } : {}
 		});
-		const nameMap = await this.vehicleNameMap();
+		const nameMap = await this.vehicleNameMap(rows);
 		const includeCrops = resolveIncludeCrops(input);
 		return Promise.all(rows.map((p) => this.toPlateInfo(p, nameMap, { includeCrops })));
 	}
 	async getPlateByTrack(input) {
 		const plate = await this.plateStore.get(`plate-${input.trackId}`);
 		if (!plate || plate.deviceId !== input.deviceId) return null;
-		const nameMap = await this.vehicleNameMap();
+		const nameMap = await this.vehicleNameMap([plate]);
 		return this.toPlateInfo(plate, nameMap, { includeCrops: false });
 	}
 	async getPlateMedia(input) {
@@ -34765,7 +35395,7 @@ var PlateGalleryProvider = class {
 			dist: plateDistance(input.text, p.text)
 		})).filter((x) => x.dist <= maxDistance).toSorted((a, b) => a.dist - b.dist || b.p.timestamp - a.p.timestamp);
 		const limited = input.limit !== void 0 ? scored.slice(0, input.limit) : scored;
-		const nameMap = await this.vehicleNameMap();
+		const nameMap = await this.vehicleNameMap(limited.map((x) => x.p));
 		const includeCrops = input.includeCrops ?? true;
 		return Promise.all(limited.map((x) => this.toPlateInfo(x.p, nameMap, { includeCrops })));
 	}
@@ -34840,8 +35470,7 @@ var PlateGalleryProvider = class {
 		await this.vehicleStore.renameVehicle(input.id, input.name);
 	}
 	async deleteVehicle(input) {
-		const plates = await this.plateStore.listAllRecentPlates({});
-		for (const p of plates) if (p.recognizedVehicleId === input.id) await this.unassignPlate({ plateId: p.id });
+		for (const plateId of await this.plateStore.listPlateIdsForVehicle(input.id)) await this.unassignPlate({ plateId });
 		await this.mediaStore.deleteForOwner("vehicle", [input.id]);
 		await this.vehicleStore.deleteVehicle(input.id);
 		this.refreshGallery();
@@ -36978,10 +37607,34 @@ var AnalyticsQueryFacade = class {
 	}
 	/**
 	* Durable event-store footprint for the events-management UI: event ROWS
-	* (motion + object + audio) counted per camera (indexed `count`) + total, and
-	* event-owned media BYTES on disk per camera (paged `sizeBytes` sum) + total.
-	* The device set is the union of cameras that have media OR persisted tracks;
-	* cameras with neither rows nor bytes are omitted.
+	* (motion + object + audio) per camera + total, and event-owned media BYTES
+	* on disk per camera + total. Cameras with neither rows nor bytes are
+	* omitted; the rest come back ordered by bytes, descending, which is the
+	* order the operator's table renders.
+	*
+	* ## The device set is a union of THREE sources
+	*
+	* It used to be `media ∪ tracks`, and a camera holding events but no media
+	* row and no persisted track was therefore invisible — not listed, and its
+	* events missing from `totalRows`. That combination is not exotic: media
+	* retention, a media deletion and `pruneTracksBefore` all run on clocks of
+	* their own, and every one of them can outlive the event rows. The number
+	* this method exists to produce is the denominator for a deletion, so an
+	* undercount is the one failure mode that matters, and it was silent.
+	*
+	* Events now contribute their own device set, so a camera is present if ANY
+	* of the three sources has ever heard of it.
+	*
+	* ## The cost is the answer, not the table
+	*
+	* Three grouped reads for the event rows (one per event collection, never
+	* three per camera), one grouped read plus one aggregate per camera for the
+	* media bytes, one for the track device set. The retired shape paid ~1 250
+	* round trips for the media half alone and timed out at 60 s on every call.
+	* See {@link MediaStore.footprintByDevice} and {@link EventStore.countByDevice}.
+	*
+	* A store that cannot answer THROWS rather than returning zeroes — see the
+	* same note on both.
 	*/
 	async getEventStoreFootprint() {
 		const eventStore = this.deps.eventStore();
@@ -36991,15 +37644,16 @@ var AnalyticsQueryFacade = class {
 			totalBytes: 0,
 			devices: []
 		};
-		const mediaByDevice = await mediaStore.footprintByDevice();
+		const [mediaByDevice, eventRowsByDevice] = await Promise.all([mediaStore.footprintByDevice(), eventStore.countByDevice()]);
 		const deviceIds = new Set(mediaByDevice.keys());
+		for (const id of eventRowsByDevice.keys()) deviceIds.add(id);
 		const trackStore = this.deps.trackStore();
 		if (trackStore) for (const id of await trackStore.listDeviceIds()) deviceIds.add(id);
 		const devices = [];
 		let totalRows = 0;
 		let totalBytes = 0;
 		for (const deviceId of deviceIds) {
-			const rows = await eventStore.countForDevice(deviceId);
+			const rows = eventRowsByDevice.get(deviceId) ?? 0;
 			const bytes = mediaByDevice.get(deviceId)?.bytes ?? 0;
 			if (rows === 0 && bytes === 0) continue;
 			totalRows += rows;
@@ -37018,6 +37672,26 @@ var AnalyticsQueryFacade = class {
 		};
 	}
 	/**
+	* The media footprint by KIND — the axis that says what is safe to delete.
+	* See {@link MediaStore.footprintByKind}.
+	*
+	* An absent media store is an empty breakdown, not a refusal: it is the same
+	* "the addon has not finished booting" branch every other method here takes,
+	* and the zeroes are accompanied by an empty `kinds` list, which no reader
+	* can mistake for a measured "there is nothing".
+	*/
+	async getEventMediaFootprintByKind(input) {
+		const mediaStore = this.deps.mediaStore();
+		if (!mediaStore) return {
+			totalRows: 0,
+			totalBytes: 0,
+			kinds: [],
+			unaccountedRows: 0,
+			unaccountedBytes: 0
+		};
+		return mediaStore.footprintByKind(input.deviceId);
+	}
+	/**
 	* Cluster-wide prune of events with `timestamp < olderThanMs` across every
 	* camera (via the device-agnostic `evictBefore`), deleting each pruned event's
 	* media in lockstep. Logs one global (`deviceId:null`) events ops-log row.
@@ -44650,6 +45324,45 @@ function pickWritableMediaLocation(locations, currentDefaultId) {
 }
 //#endregion
 //#region src/pipeline-analytics/media-relocate-engine.ts
+/**
+* Event-media relocation engine (entity-routing spec, Phase 4) — the
+* analytics sibling of the recorder's footage mover. Each addon moves ONLY
+* what it owns (addons never touch each other's files).
+*
+* Per row: read blob from its CURRENT location → write to the target →
+* stamp `row.locationId` → delete the old blob. The row update lands between
+* the two blob operations, so a crash leaves the row pointing at a location
+* that still holds valid bytes (the old blob is only deleted after the row
+* points away from it). Rows already at the target are skipped — a re-run
+* RESUMES.
+*
+* Paging: timestamp-cursor over the media collection, with a seen-id set
+* bridging equal-timestamp boundaries. The PASS pages because it must visit
+* every row to act on it; that is not true of every question asked about this
+* collection, and `countUnstamped` no longer pages — see its docblock, and the
+* 60 s timeout that shape cost.
+*
+* (This header used to claim `WHERE locationId IS NULL` was inexpressible
+* through the store's filter. It was expressible, and that was the problem:
+* `where: { locationId: null }` compiled to `= NULL`, which matches nothing
+* and reports it as `0`. The filter layer now compiles it to `IS NULL`.)
+*
+* ── Three passes, one engine (see `MediaRelocateModeSchema`) ──────────────
+*
+* `move` is the historical pass. `seal` and `gallery` are the SAME walk with a
+* different row predicate and a different per-row action, deliberately not a
+* second mover: the walk, the cursor, the tie-bridging and the failure
+* accounting are the hard parts and they are already right here.
+*
+*   - `seal` exists because a row with `locationId: NULL` means "wherever
+*     `eventMedia` points NOW" (`media-store.ts:396`). A repoint moves that
+*     pointer and every NULL row starts reading from the new disk while its
+*     bytes are on the old one. `seal` is a ROW-ONLY pass — no blob is read,
+*     written or deleted — that nails those rows to the location they are
+*     actually on before anything repoints.
+*   - `gallery` is the inverse selection of `move`: only the retention-exempt
+*     enrolled-gallery rows, which `move` skips on purpose (D197).
+*/
 var PAGE_SIZE = 200;
 var DEFAULT_THROTTLE_MBPS = 40;
 /** What a pass touches, reported on the job so an ops-log row says which of the
@@ -44685,6 +45398,68 @@ function snapshot(j) {
 */
 var LOCATION_ID_FIELD = "locationId";
 /**
+* Unstamped rows claimed per bulk seal statement.
+*
+* Bounds two things at once: the number of bound parameters in the `IN` list,
+* and how long one `UPDATE` holds the write lock on the database every process
+* in the cluster reads configuration through. Deliberately well under SQLite's
+* variable ceiling, and small enough that a cancel lands within one statement.
+*/
+var SEAL_BATCH_SIZE = 500;
+/**
+* Rows one CENSUS may visit before it answers `null`.
+*
+* A census is the read-only question behind `storageMigration.residue` — "how
+* much would a pass still act on". It is NOT the pass: a pass walks the whole
+* collection because it has to touch every row, and pays for that walk once,
+* under an operator's explicit start.
+*
+* 20 000 rows is 100 round trips at {@link PAGE_SIZE} — ~26 ms of engine time
+* on a healthy store, and a ceiling that cannot become the cluster's queue. A
+* collection larger than this is one a WALK cannot answer questions about; the
+* honest reply is "I could not answer" (D295), and the structural fix is an
+* indexed `COUNT(*)`, which needs `locationId` sealed first and is deliberately
+* not smuggled in behind a bound.
+*/
+var MEDIA_CENSUS_ROW_BUDGET = 2e4;
+/**
+* Wall clock one CENSUS may spend before it answers `null`.
+*
+* The row budget bounds a healthy store; this one bounds a sick store, where
+* 100 round trips at a 16 s queue depth is 27 minutes. Read through
+* `deps.now`, so it is deterministic under test and does not need a timer.
+*/
+var MEDIA_CENSUS_DEADLINE_MS = 2e4;
+/**
+* What one census may spend, and what it has spent.
+*
+* Explicit rather than folded into the `stop` callback: `stop` means "someone
+* asked me to stop" and the budget means "I am not allowed to continue", and a
+* pass passes `null` here because a pass is allowed to walk the whole
+* collection. Two concepts, two parameters — the walk that ran unbounded for
+* a day did so because ONE `stop: () => false` stood for both.
+*/
+var CensusBudget = class {
+	now;
+	maxRows;
+	rows = 0;
+	deadlineAt;
+	constructor(now, maxRows, maxMs) {
+		this.now = now;
+		this.maxRows = maxRows;
+		this.deadlineAt = now() + maxMs;
+	}
+	get rowsVisited() {
+		return this.rows;
+	}
+	/** Visit one row. `true` means the budget is spent and the census must stop. */
+	spend() {
+		this.rows += 1;
+		if (this.rows > this.maxRows) return true;
+		return this.rows % PAGE_SIZE === 0 && this.now() >= this.deadlineAt;
+	}
+};
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
@@ -44741,9 +45516,26 @@ function selectsRow(mode, toLocationId, data, isRetrain) {
 var MediaRelocateEngine = class {
 	deps;
 	jobs = /* @__PURE__ */ new Map();
+	/** Censuses in flight, keyed by the QUESTION — see {@link countSelectable}. */
+	censuses = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/**
+	* Retire every census in flight. They answer `null`, and stop reading.
+	*
+	* @returns how many were retired.
+	*/
+	cancelCensuses(reason) {
+		const retired = this.censuses.size;
+		if (retired === 0) return 0;
+		for (const run of this.censuses.values()) run.abort();
+		this.deps.logger.info("media relocate: standing censuses retired", { meta: {
+			retired,
+			reason
+		} });
+		return retired;
+	}
 	list() {
 		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
 	}
@@ -44842,6 +45634,7 @@ var MediaRelocateEngine = class {
 	}
 	start(input) {
 		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);
+		this.cancelCensuses("a relocate pass started");
 		const job = {
 			jobId: this.deps.newId(),
 			state: "running",
@@ -44912,15 +45705,66 @@ var MediaRelocateEngine = class {
 	* must not be allowed to make (D295).
 	*/
 	async countSelectable(input) {
-		return this.countSelected(input.mode ?? "move", input.toLocationId, () => false);
+		const mode = input.mode ?? "move";
+		const key = `${mode}|${input.toLocationId}`;
+		const running = this.censuses.get(key);
+		if (running !== void 0) return running.promise;
+		let aborted = false;
+		const budget = new CensusBudget(this.deps.now, MEDIA_CENSUS_ROW_BUDGET, MEDIA_CENSUS_DEADLINE_MS);
+		const promise = this.countSelected(mode, input.toLocationId, () => aborted, budget).finally(() => {
+			this.censuses.delete(key);
+		});
+		this.censuses.set(key, {
+			promise,
+			abort: () => {
+				aborted = true;
+			}
+		});
+		return promise;
 	}
-	async countSelected(mode, toLocationId, stop) {
+	/**
+	* @param stop  someone asked this walk to stop (an operator cancel, or
+	*   {@link cancelCensuses}). Answers `null`.
+	* @param budget what this walk is allowed to spend, or `null` for a PASS —
+	*   a pass walks the whole collection because it must touch every row, and
+	*   an operator started it explicitly.
+	*/
+	async countSelected(mode, toLocationId, stop, budget) {
 		try {
+			if (mode === "seal") {
+				let sealable = 0;
+				for (const collection of collectionsFor(mode)) {
+					if (stop()) return null;
+					sealable += await this.deps.store.count.query({
+						collection: collection.name,
+						filter: { where: { [LOCATION_ID_FIELD]: null } }
+					});
+				}
+				return { rows: sealable };
+			}
 			let rows = 0;
 			for (const collection of collectionsFor(mode)) {
 				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
 				for await (const row of this.pageRows(collection.name, collection.order)) {
-					if (stop()) return null;
+					if (stop()) {
+						this.deps.logger.warn("media relocate: census stopped before it finished — reporting the residue as unknown, not as empty", { meta: {
+							mode,
+							toLocationId,
+							collection: collection.name
+						} });
+						return null;
+					}
+					if (budget !== null && budget.spend()) {
+						this.deps.logger.warn("media relocate: census exceeded its budget — this collection is larger than a walk can answer", { meta: {
+							mode,
+							toLocationId,
+							collection: collection.name,
+							rowsVisited: budget.rowsVisited,
+							rowBudget: MEDIA_CENSUS_ROW_BUDGET,
+							deadlineMs: MEDIA_CENSUS_DEADLINE_MS
+						} });
+						return null;
+					}
 					if (selectsRow(mode, toLocationId, row.data, isRetrain)) rows++;
 				}
 			}
@@ -44946,7 +45790,15 @@ var MediaRelocateEngine = class {
 			*  rows in silence reads as "there were none", which is how a migration
 			*  gets believed. */
 			let pathlessRows = 0;
-			job.filesTotal = (await this.countSelected(job.mode, job.toLocationId, () => job.cancelRequested))?.rows ?? null;
+			job.filesTotal = (await this.countSelected(job.mode, job.toLocationId, () => job.cancelRequested, null))?.rows ?? null;
+			if (job.mode === "seal") {
+				for (const collection of collectionsFor(job.mode)) {
+					if (job.cancelRequested) break;
+					await this.sealCollection(collection.name, job);
+				}
+				job.state = job.cancelRequested ? "cancelled" : "done";
+				return;
+			}
 			for (const collection of collectionsFor(job.mode)) {
 				if (job.cancelRequested) break;
 				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
@@ -44954,20 +45806,6 @@ var MediaRelocateEngine = class {
 					if (job.cancelRequested) break;
 					const data = row.data;
 					if (!selectsRow(job.mode, job.toLocationId, data, isRetrain)) continue;
-					if (job.mode === "seal") {
-						try {
-							await this.stamp(collection.name, row.id, data, job.toLocationId);
-							job.filesMoved++;
-						} catch (err) {
-							failedRows++;
-							this.deps.logger.debug("event-media seal row failed", { meta: {
-								collection: collection.name,
-								key: row.id,
-								error: String(err)
-							} });
-						}
-						continue;
-					}
 					const from = mediaRowLocation(data);
 					const relativePath = String(data["path"] ?? "");
 					if (relativePath.length === 0) {
@@ -45030,6 +45868,73 @@ var MediaRelocateEngine = class {
 			this.deps.onFinished?.(snapshot(job));
 		}
 	}
+	/**
+	* Stamp every unstamped row of one collection with the job's target, in
+	* bounded bulk statements.
+	*
+	* ## What this replaced
+	*
+	* A per-row loop: page the whole collection through {@link pageRows}, then
+	* one `store.set.mutate` per selected row — a full-row UPSERT rewriting every
+	* column to change one field, one RPC each, plus a second full walk before it
+	* to produce the denominator. Measured on the live hub against the 464 902
+	* unstamped rows: **2.3 rows/s, falling to 0.7 rows/s under a competing
+	* drain**, i.e. over two and a half days for a metadata stamp that reads no
+	* file and moves no byte. It was cancelled. This is the write-side twin of
+	* the read-side walk {@link countUnstamped} retired, and the fourth instance
+	* of the same pattern found in one day — work looped over the door instead of
+	* pushed into the statement.
+	*
+	* ## The shape
+	*
+	* Probe the indexed `IS NULL` range for a batch of ids, then ONE
+	* `updateWhere` over those ids. Two round trips per {@link SEAL_BATCH_SIZE}
+	* rows instead of one write per row.
+	*
+	* The probe carries no cursor and needs none: the predicate CONSUMES itself.
+	* A stamped row leaves the range, so the next probe returns the next batch,
+	* and a run that is interrupted anywhere simply resumes on what is left. That
+	* is also why the seal is idempotent (a second run probes an empty range and
+	* stamps nothing) and why it cannot repoint a row that already names a
+	* different location — `IS NULL` never selects one.
+	*
+	* A single unbounded `UPDATE … WHERE locationId IS NULL` would be one
+	* statement instead of ~1 860, and is not used: half a million row rewrites,
+	* each maintaining four indexes, is an unbounded statement holding the write
+	* lock on a database the whole cluster reads configuration through, under an
+	* RPC deadline that must not be raised. Batching bounds the statement, keeps
+	* `cancel` responsive between batches, and keeps `filesMoved` honest.
+	*
+	* ## The termination guard
+	*
+	* If the probe finds rows and the update reports **0**, this THROWS. That is
+	* not defensive noise: it is precisely what a backend compiling
+	* `locationId = NULL` does — matches nothing, reports success (D312) — and
+	* against it a self-consuming loop never terminates and a non-looping one
+	* reports a completed seal having stamped nothing. Zero unstamped rows is the
+	* single value the migration gate reads as "safe to cut over".
+	*/
+	async sealCollection(collection, job) {
+		for (;;) {
+			if (job.cancelRequested) return;
+			const batch = await this.deps.store.query.query({
+				collection,
+				filter: {
+					where: { [LOCATION_ID_FIELD]: null },
+					limit: SEAL_BATCH_SIZE
+				},
+				columns: [LOCATION_ID_FIELD]
+			});
+			if (batch.length === 0) return;
+			const { updated } = await this.deps.store.updateWhere.mutate({
+				collection,
+				filter: { whereIn: { id: batch.map((row) => row.id) } },
+				data: { [LOCATION_ID_FIELD]: job.toLocationId }
+			});
+			if (updated === 0) throw new Error(`event-media seal stamped 0 of ${batch.length} unstamped row(s) in "${collection}" — the bulk predicate matched nothing, so the population cannot be sealed`);
+			job.filesMoved += updated;
+		}
+	}
 	async stamp(collection, key, data, locationId) {
 		await this.deps.store.set.mutate({
 			collection,
@@ -51761,6 +52666,43 @@ var EventStore = class {
 		return motion + object + audio;
 	}
 	/**
+	* Persisted event rows (motion + object + audio) for EVERY device that has
+	* any — three round trips for the whole fleet.
+	*
+	* {@link countForDevice} answers one camera in three `COUNT(*)`s, which is
+	* right for one camera and wrong in a loop: the events-management footprint
+	* called it once per device, so the cost of "how many events does each camera
+	* hold" grew with the camera count for a result that is a few dozen integers.
+	*
+	* A histogram on `deviceId` with `bucketSize: 1` is `GROUP BY deviceId`, and
+	* every event collection already carries `idx_<kind>_device_ts`, which leads
+	* with `deviceId` — so the planner serves each of these from a covering index
+	* with no table access at all. `bucket` IS the deviceId (the column is
+	* INTEGER, the bucket expression is `CAST((deviceId - 0) / 1 AS INTEGER)`).
+	*
+	* Not best-effort: a failure propagates. The one caller is sizing a deletion,
+	* and a camera silently reported as holding zero events is the answer that
+	* must never come from a read that did not happen.
+	*/
+	async countByDevice() {
+		const perCollection = await Promise.all([
+			MOTION_EVENTS_COLLECTION,
+			OBJECT_EVENTS_COLLECTION,
+			AUDIO_EVENTS_COLLECTION
+		].map((collection) => this.store.histogram.query({
+			collection,
+			field: "deviceId",
+			bucketSize: 1,
+			origin: 0
+		})));
+		const out = /* @__PURE__ */ new Map();
+		for (const buckets of perCollection) for (const bucket of buckets) {
+			if (bucket.count === 0 || !Number.isFinite(bucket.bucket)) continue;
+			out.set(bucket.bucket, (out.get(bucket.bucket) ?? 0) + bucket.count);
+		}
+		return out;
+	}
+	/**
 	* Return per-kind event counts in equal-width time buckets.
 	*
 	* Each bucket maps to a `bucketStart = since + i * bucketMs`.
@@ -52377,6 +53319,50 @@ var IdentityStore = class {
 			key: id
 		});
 	}
+	/**
+	* `identityId → name` for exactly the identities asked about.
+	*
+	* The decorating half of a face or plate page needs a NAME per referenced
+	* identity, and it used to get it by reading the whole `identities`
+	* collection — unbounded, unprojected, on every 30 s poll of
+	* `faceGallery.listRecentFaces`, and again on every `getFaceByTrack`. The
+	* table is small (4 rows on the live hub on 2026-08-31) so the bytes were
+	* never the problem; the SHAPE was. It is a second question whose cost is
+	* proportional to a collection, asked on a timer, to answer a question about
+	* a page — and it carried no `limit`, so past
+	* `SETTINGS_QUERY_DEFAULT_ROW_CAP` it would have handed back a name map
+	* missing entries, shape-identical to a complete one (D320).
+	*
+	* **An empty request costs no round trip at all.** With
+	* `filter: 'unassigned'` — the view the operator lives in — a page
+	* references no identity, and the honest number of queries for that is zero.
+	* `whereIn` with an empty list matches nothing, so asking anyway would be an
+	* RPC to be told what the caller already knew.
+	*
+	* A cache belongs in the owner of the fact, and this store IS the owner —
+	* but a name here changes only when the operator renames, through this same
+	* store, and the read is now one indexed `IN` over at most a page's worth of
+	* ids. There is nothing left to cache that would not be a second authority
+	* over a fact one round trip away (D224).
+	*/
+	async namesFor(identityIds) {
+		const ids = [...new Set(identityIds)];
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.store.query.query({
+			collection: IDENTITIES_COLLECTION,
+			columns: ["name"],
+			filter: {
+				whereIn: { id: ids },
+				limit: ids.length
+			}
+		});
+		const names = /* @__PURE__ */ new Map();
+		for (const r of rows) {
+			const name = r.data["name"];
+			if (typeof name === "string") names.set(r.id, name);
+		}
+		return names;
+	}
 	async listIdentities() {
 		return (await this.store.query.query({
 			collection: IDENTITIES_COLLECTION,
@@ -52918,13 +53904,55 @@ var PLATE_COLUMNS = [
 		type: "JSON"
 	}
 ];
-var PLATE_INDEXES = [{
-	name: "idx_plates_device_ts",
-	columns: ["deviceId", "timestamp"]
-}, {
-	name: "idx_plates_track",
-	columns: ["trackId"]
-}];
+/**
+* What the gallery orders by, and what the vehicle-scoped read filters on.
+*
+* The face twin's `EXPLAIN QUERY PLAN` measurement applies verbatim: without an
+* index on `timestamp`, `ORDER BY timestamp DESC LIMIT 500` is
+* `SCAN + USE TEMP B-TREE FOR ORDER BY` — the read was already BOUNDED at 200,
+* and still sorted the whole table to produce the newest N. A bound caps what
+* comes back; only an ordered index caps what is read.
+*/
+var PLATE_INDEXES = [
+	{
+		name: "idx_plates_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	{
+		name: "idx_plates_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_plates_ts",
+		columns: ["timestamp"]
+	},
+	{
+		name: "idx_plates_vehicle_ts",
+		columns: ["recognizedVehicleId", "timestamp"]
+	}
+];
+/**
+* The widest plate window a single read may materialise before it REFUSES.
+*
+* The corpus reads (`searchPlates`, `suggestPlateClusters`) are genuinely
+* corpus-shaped — fuzzy text distance is not a predicate — so they cannot be
+* narrowed the way the gallery list was. What they CAN do is stop lying: they
+* carried no `limit` at all, so the engine imposed
+* `SETTINGS_QUERY_DEFAULT_ROW_CAP` and handed back the first 2 000 rows with a
+* WARN no caller can see. A search over the newest 2 000 of 50 000 plates and a
+* search over all of them are the same array (D320 R3).
+*
+* 10 000 mirrors the faces ceiling and stays under the engine's hard cap so the
+* engine never truncates first.
+*/
+var PLATE_WINDOW_MAX_ROWS = 1e4;
+/** A corpus read whose window is wider than {@link PLATE_WINDOW_MAX_ROWS}. */
+var PlateWindowTooWideError = class extends Error {
+	constructor(rows) {
+		super(`plate window exceeds ${String(PLATE_WINDOW_MAX_ROWS)} rows (read ${String(rows)}) — refusing to answer with the part that fit`);
+		this.name = "PlateWindowTooWideError";
+	}
+};
 var PlateStore = class {
 	store;
 	logger;
@@ -52989,18 +54017,53 @@ var PlateStore = class {
 			}
 		})).map((r) => this.normalizeRow(r));
 	}
-	/** List ALL recent plate reads across devices, newest first. */
+	/**
+	* List ALL recent plate reads across devices, newest first.
+	*
+	* The corpus read, for the two passes whose question is not a predicate
+	* (fuzzy text search, text clustering). It carries an explicit `limit` and
+	* REFUSES past it rather than handing back the part that fit: without one the
+	* engine imposed its own cap and truncated silently, and a search over the
+	* newest 2 000 plates looks exactly like a search over all of them.
+	*/
 	async listAllRecentPlates(input) {
-		return (await this.store.query.query({
+		const bounded = input.limit !== void 0;
+		const rows = await this.store.query.query({
 			collection: PLATES_COLLECTION,
 			filter: {
 				orderBy: {
 					field: "timestamp",
 					direction: "desc"
 				},
-				...input.limit !== void 0 ? { limit: input.limit } : {}
+				limit: bounded ? input.limit ?? 0 : 10001
 			}
-		})).map((r) => this.normalizeRow(r));
+		});
+		if (!bounded && rows.length > 1e4) throw new PlateWindowTooWideError(rows.length);
+		return rows.map((r) => this.normalizeRow(r));
+	}
+	/**
+	* Every plate row currently attributed to a vehicle, id only.
+	*
+	* `deleteVehicle` detaches these before the vehicle goes. It used to list the
+	* WHOLE buffer and compare in JS — the `deleteIdentity` defect verbatim, and
+	* past the engine's row cap it would detach the plates that fit and leave the
+	* rest pointing at a vehicle that no longer exists.
+	*/
+	async listPlateIdsForVehicle(vehicleId) {
+		const rows = await this.store.query.query({
+			collection: PLATES_COLLECTION,
+			columns: ["deviceId"],
+			filter: {
+				where: { recognizedVehicleId: vehicleId },
+				orderBy: {
+					field: "timestamp",
+					direction: "desc"
+				},
+				limit: 10001
+			}
+		});
+		if (rows.length > 1e4) throw new PlateWindowTooWideError(rows.length);
+		return rows.map((r) => r.id);
 	}
 	async get(plateId) {
 		const raw = await this.store.get.query({
@@ -55660,6 +56723,38 @@ var VehicleStore = class {
 			key: id
 		});
 	}
+	/**
+	* `vehicleId → name` for exactly the vehicles asked about — the plate twin of
+	* `IdentityStore.namesFor`, and it exists for the same reason.
+	*
+	* The decorating half of a plate page needs a NAME per referenced vehicle,
+	* and it got it by reading the whole `vehicles` collection: unbounded,
+	* unprojected, on every 30 s poll of `plateGallery.listPlates` and again on
+	* every `getPlateByTrack` and `searchPlates`. The live table holds **0 rows**
+	* — the bytes were never the point. The shape was: a question proportional to
+	* a collection, on a timer, to decorate a page.
+	*
+	* An empty request costs no round trip: `whereIn` over an empty list matches
+	* nothing, so asking would be an RPC to be told what the caller knew.
+	*/
+	async namesFor(vehicleIds) {
+		const ids = [...new Set(vehicleIds)];
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.store.query.query({
+			collection: VEHICLES_COLLECTION,
+			columns: ["name"],
+			filter: {
+				whereIn: { id: ids },
+				limit: ids.length
+			}
+		});
+		const names = /* @__PURE__ */ new Map();
+		for (const r of rows) {
+			const name = r.data["name"];
+			if (typeof name === "string") names.set(r.id, name);
+		}
+		return names;
+	}
 	async listVehicles() {
 		return (await this.store.query.query({
 			collection: VEHICLES_COLLECTION,
@@ -62631,6 +63726,50 @@ var ZoneAnalyticsProvider = class {
 		return this.snapshots.get(deviceId) ?? await this.hydrateFromRegistry(deviceId);
 	}
 	/**
+	* The same snapshot, for a SET of cameras, in one round trip.
+	*
+	* The Events page's Stationary section polls this every 15 s for every
+	* selected camera. Fanned out client-side that is one browser → hub →
+	* post-analysis round trip per camera to read a `Map.get`; the answer costs
+	* nothing and the transport costs everything. The per-device work here is
+	* unchanged — the same live snapshot, the same parked-registry hydration when
+	* there is no live one — and it runs concurrently inside the owner.
+	*
+	* **Three outcomes stay three.** A camera with a reading, a camera with none
+	* yet (`snapshot: null`, `read: 'read'`), and a camera the owner could not
+	* answer for (`read: 'unreadable'`). The hydration reaches a durable store
+	* and can throw; letting that throw become `snapshot: null` would render an
+	* unread camera as a camera with nothing parked, which is a definite claim
+	* nobody made.
+	*/
+	async getCurrentSnapshotBatch({ deviceIds }) {
+		return Promise.all(deviceIds.map(async (deviceId) => {
+			const live = this.snapshots.get(deviceId);
+			if (live !== void 0) return {
+				deviceId,
+				read: "read",
+				snapshot: live
+			};
+			try {
+				return {
+					deviceId,
+					read: "read",
+					snapshot: await this.hydrateFromRegistry(deviceId)
+				};
+			} catch (err) {
+				this.ctx.logger.warn("occupancy snapshot could not be read", {
+					tags: { deviceId },
+					meta: { error: String(err) }
+				});
+				return {
+					deviceId,
+					read: "unreadable",
+					snapshot: null
+				};
+			}
+		}));
+	}
+	/**
 	* The cameras a LIVE snapshot exists for.
 	*
 	* The Notification Center's occupancy dry-run ("as of now, would this rule
@@ -65189,6 +66328,23 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			},
 			resolveArtifactUrl: async (artifactId) => await this.ncArtifactPlane?.mintUrl(artifactId) ?? null,
 			mintActionUrl: (input) => this.ncActionMintUrl?.(input) ?? Promise.resolve(null),
+			listAddonUpdates: async (nodeId) => {
+				return (await this.ctx.api.addons.listUpdates.query({ nodeId })).filter((update) => !update.isSystem).map((update) => update.name);
+			},
+			applyAddonUpdate: async ({ packageName, nodeId }) => {
+				try {
+					await this.ctx.api.addons.updatePackage.mutate({
+						name: packageName,
+						nodeId
+					});
+					return { ok: true };
+				} catch (err) {
+					return {
+						ok: false,
+						error: errMsg(err)
+					};
+				}
+			},
 			readDeviceStates: async (ids) => {
 				const out = /* @__PURE__ */ new Map();
 				for (const id of ids) try {
@@ -70148,6 +71304,36 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			return [];
 		}
 	}
+	/**
+	* `getKeyEvents` for a SET of cameras, in one round trip.
+	*
+	* The Detection Intelligence events feed asked this of every selected camera
+	* on a 30 s timer — N browser → hub → post-analysis round trips for N
+	* independent, already-indexed store queries. The queries are unchanged and
+	* still run per camera (each is `where deviceId` + a `firstSeen` range
+	* against its own index, and `limit` stays PER CAMERA so a busy camera cannot
+	* starve a quiet one of its rows); what collapses is the transport.
+	*
+	* Every requested id gets a row. `getKeyEvents` already degrades to `[]`
+	* rather than throwing, so a per-camera failure is reported exactly as it was
+	* before this method existed — this does not make it worse, and the row
+	* carries the `deviceId` the single method's output never did.
+	*/
+	async getKeyEventsBatch(input) {
+		return Promise.all(input.deviceIds.map(async (deviceId) => {
+			return {
+				deviceId,
+				events: await this.getKeyEvents({
+					deviceId,
+					since: input.since,
+					until: input.until,
+					...input.limit !== void 0 ? { limit: input.limit } : {},
+					...input.minImportance !== void 0 ? { minImportance: input.minImportance } : {},
+					...input.classFilter !== void 0 ? { classFilter: input.classFilter } : {}
+				})
+			};
+		}));
+	}
 	async getAudioEvents(input) {
 		return this.queryFacade.getAudioEvents(input);
 	}
@@ -71484,6 +72670,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	async getEventStoreFootprint() {
 		return this.queryFacade.getEventStoreFootprint();
 	}
+	async getEventMediaFootprintByKind(input) {
+		return this.queryFacade.getEventMediaFootprintByKind(input);
+	}
 	async pruneEvents(input) {
 		return this.queryFacade.pruneEvents(input);
 	}