@camstack/addon-post-analysis 1.2.153 → 1.2.155

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as audioMetricsCapability, A as NcSnoozeInputSchema, At as errMsg, B as SCENE_DEFAULT_ANCHOR_THRESHOLD, Bt as boolean, C as NC_TAXONOMY, D as NcRuleSchema, Dt as vectorDimFromBase64, E as NcRulePatchSchema, Et as systemEventFilterApplies, F as OpsLogEntrySchema, Ft as isDeviceScopedCap, G as TimelapseRuleInputSchema, Gt as partialRecord, H as SCENE_DIVERGED, Ht as literal, It as nodePin, J as TrackSourceSchema, Jt as unknown, K as TimelapseRulePatchSchema, Kt as record, L as RECORDING_EXPORT_MAX_READ_BYTES, Lt as sleep, M as NcSnoozeSuppressedSchema, Mt as DeviceType, N as NcSystemEventKindSchema, Nt as createEvent, O as NcRuleTargetSchema, Ot as videoclipsCapability, P as NcTaxonomySchema, Pt as hydrateSchema, Q as assertTimelapseCadences, R as RetrainStatusSchema, Rt as _enum, St as readTimelapseGeneratedAt, T as NcRuleInputSchema, Tt as subKindsOf, U as SceneMonitorSchema, Ut as number, V as SCENE_DEFAULT_UNCOVERED_POLICY, Vt as discriminatedUnion, W as TIMELAPSE_DENSE_FLOOR_SEC, Wt as object, X as addonWidgetsSourceCapability, Y as VISIT_MERGE_GAP_MS, Yt as EventCategory, Z as alarmPanelCapability, _ as MACRO_LABELS, a as COCO_TO_MACRO, at as deriveRecordingMode, b as NC_CONDITION_CATALOG, bt as plateGalleryCapability, ct as evaluateSensorEdge, d as DeclaredDevices, et as audioModeOf, f as EVENT_KIND_BY_CAP, ft as isDetectionMacroClass, g as LabelAttributionSchema, gt as notificationRulesCapability, h as FailureCounters, ht as kebabToCamel, i as CLUSTER_MODEL_SCOPED_STEPS, it as defineCustomActions, j as NcSnoozeSchema, jt as BaseAddon, k as NcScheduleSchema, kt as zoneAnalyticsCapability, l as DETECTION_MACRO_CLASSES, lt as faceGalleryCapability, m as FULL_IMAGE_BBOX, mt as isSourceCap, n as AnalyticsGroupRecordSchema, nt as cosineSimilarity$1, o as DEFAULT_EVENT_COLOR, p as EVENT_PAD_MS, pt as isScheduleActive, q as TimelapseRuleSchema, qt as string, r as BaseDevice, rt as customAction, st as encodeVectorBase64, t as AnalyticsGroupDetailSchema, tt as buildEventKindDescriptor, ut as failureContributionCapability, v as MediaFileKindEnum, vt as pickClusterStepModels, w as NcConditionDescriptorSchema, wt as sceneMonitorCapability, x as NC_DEFAULT_SNOOZE_MINUTES, xt as readDeviceStateFrom, y as NC_ALARM_SYSTEM_EVENT_KINDS, yt as pipelineAnalyticsCapability, zt as array } from "../dist-DDIu0Q1W.mjs";
+import { $ as audioMetricsCapability, A as NcSnoozeInputSchema, At as errMsg, B as SCENE_DEFAULT_ANCHOR_THRESHOLD, Bt as boolean, C as NC_TAXONOMY, D as NcRuleSchema, Dt as vectorDimFromBase64, E as NcRulePatchSchema, Et as systemEventFilterApplies, F as OpsLogEntrySchema, Ft as isDeviceScopedCap, G as TimelapseRuleInputSchema, Gt as partialRecord, H as SCENE_DIVERGED, Ht as literal, It as nodePin, J as TrackSourceSchema, Jt as unknown, K as TimelapseRulePatchSchema, Kt as record, L as RECORDING_EXPORT_MAX_READ_BYTES, Lt as sleep, M as NcSnoozeSuppressedSchema, Mt as DeviceType, N as NcSystemEventKindSchema, Nt as createEvent, O as NcRuleTargetSchema, Ot as videoclipsCapability, P as NcTaxonomySchema, Pt as hydrateSchema, Q as assertTimelapseCadences, R as RetrainStatusSchema, Rt as _enum, St as readTimelapseGeneratedAt, T as NcRuleInputSchema, Tt as subKindsOf, U as SceneMonitorSchema, Ut as number, V as SCENE_DEFAULT_UNCOVERED_POLICY, Vt as discriminatedUnion, W as TIMELAPSE_DENSE_FLOOR_SEC, Wt as object, X as addonWidgetsSourceCapability, Y as VISIT_MERGE_GAP_MS, Yt as EventCategory, Z as alarmPanelCapability, _ as MACRO_LABELS, a as COCO_TO_MACRO, at as deriveRecordingMode, b as NC_CONDITION_CATALOG, bt as plateGalleryCapability, ct as evaluateSensorEdge, d as DeclaredDevices, et as audioModeOf, f as EVENT_KIND_BY_CAP, ft as isDetectionMacroClass, g as LabelAttributionSchema, gt as notificationRulesCapability, h as FailureCounters, ht as kebabToCamel, i as CLUSTER_MODEL_SCOPED_STEPS, it as defineCustomActions, j as NcSnoozeSchema, jt as BaseAddon, k as NcScheduleSchema, kt as zoneAnalyticsCapability, l as DETECTION_MACRO_CLASSES, lt as faceGalleryCapability, m as FULL_IMAGE_BBOX, mt as isSourceCap, n as AnalyticsGroupRecordSchema, nt as cosineSimilarity$1, o as DEFAULT_EVENT_COLOR, p as EVENT_PAD_MS, pt as isScheduleActive, q as TimelapseRuleSchema, qt as string, r as BaseDevice, rt as customAction, st as encodeVectorBase64, t as AnalyticsGroupDetailSchema, tt as buildEventKindDescriptor, ut as failureContributionCapability, v as MediaFileKindEnum, vt as pickClusterStepModels, w as NcConditionDescriptorSchema, wt as sceneMonitorCapability, x as NC_DEFAULT_SNOOZE_MINUTES, xt as readDeviceStateFrom, y as NC_ALARM_SYSTEM_EVENT_KINDS, yt as pipelineAnalyticsCapability, zt as array } from "../dist-DqNo8CCq.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -106,6 +106,8 @@ function actionTtlMs(subject) {
 		case "snooze": return SNOOZE_ACTION_TTL_MS;
 		case "alarm": return subject.action === "disarm" ? ALARM_DISARM_TTL_MS : DEFAULT_ACTION_TTL_MS;
 		case "sequence": return DEFAULT_ACTION_TTL_MS;
+		case "addon-update": return DEFAULT_ACTION_TTL_MS;
+		case "server-update": return DEFAULT_ACTION_TTL_MS;
 	}
 }
 var NcActionTokenRegistry = class {
@@ -175,9 +177,9 @@ var NcActionTokenRegistry = class {
 /**
 * What a spent grant DID, in the operator's own terms.
 *
-* Per `kind`, because the three families answer different questions and one
+* Per `kind`, because the families answer different questions and one
 * generic "Done" would leave a snooze indistinguishable from an open gate on
-* the page a tap lands on. The switch is exhaustive by construction — a fourth
+* the page a tap lands on. The switch is exhaustive by construction — a new
 * grant family will not compile until it has a sentence here.
 */
 function describeGrant(grant) {
@@ -185,6 +187,8 @@ function describeGrant(grant) {
 		case "sequence": return `${grant.ruleName} — ${grant.sequence}`;
 		case "snooze": return grant.classes === void 0 || grant.classes.length === 0 ? `Silenced for ${grant.minutes} min` : `Silenced for ${grant.minutes} min — ${grant.classes.join(", ")}`;
 		case "alarm": return grant.action === "disarm" ? "Alarm disarmed" : `Alarm armed${grant.mode !== void 0 ? ` (${grant.mode})` : ""}`;
+		case "addon-update": return `${grant.packages.length} addon update(s) on ${grant.nodeId}`;
+		case "server-update": return `Server update on ${grant.nodeId}`;
 	}
 }
 /** The audit line's `meta`, per family. A snooze that logged a `sequence` it
@@ -215,6 +219,15 @@ function grantMeta(grant) {
 			mode: grant.mode ?? null,
 			panelDeviceId: grant.panelDeviceId
 		};
+		case "addon-update": return {
+			...common,
+			nodeId: grant.nodeId,
+			packages: grant.packages
+		};
+		case "server-update": return {
+			...common,
+			nodeId: grant.nodeId
+		};
 	}
 }
 /** What the human standing in front of the page is told. */
@@ -4724,6 +4737,40 @@ var SceneMonitorProvider = class {
 	async listScenes(input) {
 		return this.statusFor(input.deviceId);
 	}
+	/**
+	* `listScenes` for a SET, in one round trip.
+	*
+	* `/scenes` renders every camera and re-reads them behind the push slice on a
+	* 30 s safety net. Fanned out client-side that was one request per camera to
+	* read `statusFor`, which is an in-memory merge this provider already holds —
+	* all cost, no work. The work here is identical; only the transport
+	* collapses.
+	*
+	* **Every requested id gets a row.** A camera `statusFor` cannot answer for
+	* is `status: null`, which is NOT `monitors: []`: this feature's whole
+	* failure mode is silence reading as "nothing configured", and a batch that
+	* dropped the row would have made an unreachable camera invisible instead of
+	* reported.
+	*/
+	async listScenesBatch(input) {
+		return input.deviceIds.map((deviceId) => {
+			try {
+				return {
+					deviceId,
+					status: this.statusFor(deviceId)
+				};
+			} catch (err) {
+				this.deps.logger.warn("scene status could not be read", {
+					tags: { deviceId },
+					meta: { error: String(err) }
+				});
+				return {
+					deviceId,
+					status: null
+				};
+			}
+		});
+	}
 	async getStatus(input) {
 		return this.statusFor(input.deviceId);
 	}
@@ -5406,6 +5453,98 @@ function buildAlarmButtons(input) {
 	}];
 }
 //#endregion
+//#region src/notification-center/addon-update-apply.ts
+/**
+* The frozen packages that STILL have an update, in the order the row listed
+* them.
+*
+* Order matters: the notification's body listed them in that order, and an
+* operator watching addons restart should see them go in the order they read.
+*/
+function pendingPackages(frozen, updatable) {
+	const available = new Set(updatable);
+	return frozen.filter((name) => available.has(name));
+}
+/**
+* `done` only when every package the button promised was applied and nothing
+* was skipped or failed — the ONE case where a single number is the whole
+* truth. Anything else states all three counts, because a sentence that hides
+* one of them is a sentence that reports work it did not do.
+*/
+function addonUpdateSentence(report) {
+	if (report.applied.length === 0 && report.failed.length === 0) return "uptodate";
+	if (report.applied.length === report.requested && report.failed.length === 0) return "done";
+	return "partial";
+}
+//#endregion
+//#region src/notification-center/addon-update-buttons.ts
+/** The id this button travels under — in the callback and in the audit line. */
+var ADDON_UPDATE_BUTTON_ID = "addon-update-apply";
+function addonUpdateButtonRefusal(subject, recipient) {
+	if (subject.kind !== "addon-update-available") return "not-an-addon-update";
+	if ((subject.packageNames ?? []).length === 0) return "no-packages";
+	if (subject.nodeId === void 0) return "several-nodes";
+	if (recipient.ownerUserId === void 0) return "unowned-target";
+	return null;
+}
+/**
+* The button, or none.
+*
+* Returns an array rather than a nullable, so the caller composes it with the
+* other families by spreading — and so "which buttons survived" has one shape.
+*/
+function buildAddonUpdateButtons(input) {
+	const subject = input.subject;
+	if (addonUpdateButtonRefusal(subject, input.recipient) !== null) return [];
+	const packages = subject.packageNames ?? [];
+	const nodeId = subject.nodeId ?? "";
+	return [{
+		id: ADDON_UPDATE_BUTTON_ID,
+		label: input.label({
+			count: packages.length,
+			nodeId
+		}),
+		url: input.mintUrl({
+			actionId: ADDON_UPDATE_BUTTON_ID,
+			packages,
+			nodeId
+		}),
+		destructive: true,
+		mode: "background"
+	}];
+}
+//#endregion
+//#region src/notification-center/server-update-buttons.ts
+/** The id this button travels under — in the callback and in the audit line. */
+var SERVER_UPDATE_BUTTON_ID = "server-update-apply";
+function serverUpdateButtonRefusal(subject, recipient) {
+	if (subject.kind !== "server-update-available") return "not-a-server-update";
+	if (subject.nodeId === void 0) return "several-nodes";
+	if (recipient.ownerUserId === void 0) return "unowned-target";
+	return null;
+}
+/**
+* The button, or none.
+*
+* Returns an array rather than a nullable, so the caller composes it with the
+* other families by spreading — and so "which buttons survived" has one shape.
+*/
+function buildServerUpdateButtons(input) {
+	const subject = input.subject;
+	if (serverUpdateButtonRefusal(subject, input.recipient) !== null) return [];
+	const nodeId = subject.nodeId ?? "";
+	return [{
+		id: SERVER_UPDATE_BUTTON_ID,
+		label: input.label({ nodeId }),
+		url: input.mintUrl({
+			actionId: SERVER_UPDATE_BUTTON_ID,
+			nodeId
+		}),
+		destructive: true,
+		mode: "background"
+	}];
+}
+//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -8471,6 +8610,29 @@ var en_default = {
 	"button.alarm.arm.night": "Arm night",
 	"button.alarm.arm.vacation": "Arm vacation",
 	"button.alarm.arm.custom_bypass": "Arm custom",
+	"button.addon-update.apply": {
+		"one": "Update {{count}} addon on {{nodeId}}",
+		"other": "Update {{count}} addons on {{nodeId}}"
+	},
+	"action.addon-update.title": "Addon update",
+	"action.addon-update.started": {
+		"one": "Updating {{count}} addon on {{nodeId}}…",
+		"other": "Updating {{count}} addons on {{nodeId}}…"
+	},
+	"action.addon-update.done": {
+		"one": "{{applied}} addon updated on {{nodeId}}",
+		"other": "{{applied}} addons updated on {{nodeId}}"
+	},
+	"action.addon-update.partial": "{{nodeId}}: {{applied}} updated, {{skipped}} already current, {{failed}} failed",
+	"action.addon-update.uptodate": "Already up to date on {{nodeId}} — nothing to do",
+	"action.addon-update.unknown": "Could not read what needs updating on {{nodeId}} — nothing was changed. Open CamStack.",
+	"button.server-update.apply": "Update server on {{nodeId}}",
+	"action.server-update.title": "Server update",
+	"action.server-update.started": "Updating server on {{nodeId}}…",
+	"action.server-update.restarting": "Server update staged on {{nodeId}} — the node is restarting. You will hear when it comes back.",
+	"action.server-update.uptodate": "Already up to date on {{nodeId}} — nothing to do",
+	"action.server-update.unknown": "Could not read whether {{nodeId}} still needs a server update — nothing was changed. Open CamStack.",
+	"action.server-update.failed": "Server update on {{nodeId}} was refused — nothing was changed. Open CamStack.",
 	"summary.title": "Summary — {{rule}}",
 	"summary.body.window": "{{from}}→{{to}}",
 	"summary.body.events": {
@@ -8693,6 +8855,29 @@ var it_default = {
 	"button.alarm.arm.night": "Arma notte",
 	"button.alarm.arm.vacation": "Arma vacanza",
 	"button.alarm.arm.custom_bypass": "Arma personalizzato",
+	"button.addon-update.apply": {
+		"one": "Aggiorna {{count}} addon su {{nodeId}}",
+		"other": "Aggiorna {{count}} addon su {{nodeId}}"
+	},
+	"action.addon-update.title": "Aggiornamento addon",
+	"action.addon-update.started": {
+		"one": "Aggiornamento di {{count}} addon su {{nodeId}}…",
+		"other": "Aggiornamento di {{count}} addon su {{nodeId}}…"
+	},
+	"action.addon-update.done": {
+		"one": "{{applied}} addon aggiornato su {{nodeId}}",
+		"other": "{{applied}} addon aggiornati su {{nodeId}}"
+	},
+	"action.addon-update.partial": "{{nodeId}}: {{applied}} aggiornati, {{skipped}} già aggiornati, {{failed}} falliti",
+	"action.addon-update.uptodate": "Già aggiornato su {{nodeId}} — niente da fare",
+	"action.addon-update.unknown": "Non è stato possibile leggere cosa aggiornare su {{nodeId}} — non è stato cambiato nulla. Apri CamStack.",
+	"button.server-update.apply": "Aggiorna server su {{nodeId}}",
+	"action.server-update.title": "Aggiornamento server",
+	"action.server-update.started": "Aggiornamento server su {{nodeId}}…",
+	"action.server-update.restarting": "Aggiornamento server predisposto su {{nodeId}} — il nodo si riavvia. Ti avviseremo quando torna.",
+	"action.server-update.uptodate": "Già aggiornato su {{nodeId}} — niente da fare",
+	"action.server-update.unknown": "Non è stato possibile leggere se {{nodeId}} ha ancora bisogno di un aggiornamento server — non è stato cambiato nulla. Apri CamStack.",
+	"action.server-update.failed": "L'aggiornamento server su {{nodeId}} è stato rifiutato — non è stato cambiato nulla. Apri CamStack.",
 	"summary.title": "Riepilogo — {{rule}}",
 	"summary.body.window": "{{from}}→{{to}}",
 	"summary.body.events": {
@@ -9420,7 +9605,7 @@ var NcDispatcher = class {
 				targetId: target.id,
 				...target.ownerUserId !== void 0 ? { ownerUserId: target.ownerUserId } : {},
 				...entry.payload.subject.className !== void 0 ? { className: entry.payload.subject.className } : {},
-				...entry.payload.subject.systemEvent !== void 0 ? { systemEventKind: entry.payload.subject.systemEvent.kind } : {}
+				...entry.payload.subject.systemEvent !== void 0 ? { systemEvent: entry.payload.subject.systemEvent } : {}
 			});
 		} catch (err) {
 			this.deps.logger.warn("notification buttons could not be minted — sending without them", {
@@ -20154,7 +20339,7 @@ var NotificationCenter = class NotificationCenter {
 				return id;
 			}
 		});
-		const alarmKind = alarmButtonKind(input.systemEventKind);
+		const alarmKind = alarmButtonKind(input.systemEvent?.kind);
 		const panel = this.alarmPanel;
 		const alarmButtons = alarmKind === null ? [] : buildAlarmButtons({
 			kind: alarmKind,
@@ -20190,6 +20375,84 @@ var NotificationCenter = class NotificationCenter {
 				return id;
 			}
 		});
+		const systemEvent = input.systemEvent;
+		const recipient = input.ownerUserId !== void 0 ? { ownerUserId: input.ownerUserId } : {};
+		const updateRefusal = systemEvent === void 0 ? "not-an-addon-update" : addonUpdateButtonRefusal(systemEvent, recipient);
+		const updateButtons = systemEvent === void 0 ? [] : buildAddonUpdateButtons({
+			subject: systemEvent,
+			recipient,
+			label: ({ count, nodeId }) => this.texts.text({
+				key: "button.addon-update.apply",
+				vars: {
+					count: String(count),
+					nodeId
+				},
+				count
+			}),
+			mintUrl: ({ actionId, packages, nodeId }) => {
+				const id = randomUUID();
+				drafts.push({
+					id,
+					ttlMs: actionTtlMs({ kind: "addon-update" }),
+					grant: (expiresAt) => ({
+						kind: "addon-update",
+						id,
+						packages,
+						nodeId,
+						deviceId: input.deviceId,
+						actionId,
+						targetId: input.targetId,
+						expiresAt
+					})
+				});
+				return id;
+			}
+		});
+		if (updateRefusal === "several-nodes" || updateRefusal === "unowned-target") this.logger.info("addon-update notification carries no apply button", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				ruleId: input.ruleId,
+				reason: updateRefusal,
+				targetId: input.targetId,
+				nodeIds: systemEvent?.nodeIds ?? [],
+				packages: systemEvent?.packageNames ?? []
+			}
+		});
+		const serverRefusal = systemEvent === void 0 ? "not-a-server-update" : serverUpdateButtonRefusal(systemEvent, recipient);
+		const serverButtons = systemEvent === void 0 ? [] : buildServerUpdateButtons({
+			subject: systemEvent,
+			recipient,
+			label: ({ nodeId }) => this.texts.text({
+				key: "button.server-update.apply",
+				vars: { nodeId }
+			}),
+			mintUrl: ({ actionId, nodeId }) => {
+				const id = randomUUID();
+				drafts.push({
+					id,
+					ttlMs: actionTtlMs({ kind: "server-update" }),
+					grant: (expiresAt) => ({
+						kind: "server-update",
+						id,
+						nodeId,
+						deviceId: input.deviceId,
+						actionId,
+						targetId: input.targetId,
+						expiresAt
+					})
+				});
+				return id;
+			}
+		});
+		if (serverRefusal === "several-nodes" || serverRefusal === "unowned-target") this.logger.info("server-update notification carries no apply button", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				ruleId: input.ruleId,
+				reason: serverRefusal,
+				targetId: input.targetId,
+				nodeIds: systemEvent?.nodeIds ?? []
+			}
+		});
 		if (alarmKind !== null && panel === null) this.logger.info("alarm notification carries no buttons — this node owns no panel", {
 			tags: { deviceId: input.deviceId },
 			meta: {
@@ -20200,7 +20463,9 @@ var NotificationCenter = class NotificationCenter {
 		const out = [
 			...sequenceButtons,
 			...snoozeButtons,
-			...alarmButtons
+			...alarmButtons,
+			...updateButtons,
+			...serverButtons
 		];
 		if (out.length === 0) return [];
 		const now = this.now();
@@ -20321,7 +20586,213 @@ var NotificationCenter = class NotificationCenter {
 			case "snooze": return this.applyGrantedSnooze(grant);
 			case "alarm": return this.applyGrantedAlarm(grant);
 			case "sequence": return this.runGrantedSequence(grant);
+			case "addon-update": return this.applyGrantedAddonUpdate(grant);
+			case "server-update": return this.applyGrantedServerUpdate(grant);
+		}
+	}
+	/**
+	* Apply the addon updates one notification was about.
+	*
+	* The whole shape of this method is the answer to "a button that reports
+	* success for work it did not do":
+	*
+	*  1. **The cheap question first.** Ask the registry what is still out of
+	*     date on that node. A read that FAILS changes nothing and says so — it
+	*     is never read as "everything is current" and never as "apply the frozen
+	*     list anyway".
+	*  2. **Nothing to do is an outcome, not a success.** A frozen list the
+	*     operator already applied (from the Addons page, from auto-update, or by
+	*     tapping the copy of this notification that went to their other phone)
+	*     produces one announcement and zero `updatePackage` calls.
+	*  3. **The operator hears twice.** A background POST returns while the
+	*     updates run for minutes, so the tap is acknowledged BEFORE the first
+	*     apply and the verdict follows it. Tapping into silence is worse than no
+	*     button.
+	*
+	* The announcements go back to `grant.targetId` — the delivery this button
+	* was minted for, which is the only addressee a tap can honestly name (a tap
+	* identifies nobody; same reasoning as the snooze grant's frozen `userId`).
+	*
+	* Throws only when NOTHING was applied and something went wrong, so the
+	* plane's line says the run failed rather than reporting a spent token as a
+	* success.
+	*/
+	async applyGrantedAddonUpdate(grant) {
+		const apply = this.deps.applyAddonUpdate;
+		const list = this.deps.listAddonUpdates;
+		if (apply === void 0 || list === void 0) throw new Error("no addon updater is wired on this node");
+		let updatable;
+		try {
+			updatable = await list(grant.nodeId);
+		} catch (err) {
+			this.logger.warn("addon update button changed nothing — could not read what needs updating", { meta: {
+				nodeId: grant.nodeId,
+				packages: grant.packages,
+				error: String(err)
+			} });
+			await this.announceAddonUpdate(grant, "unknown", { nodeId: grant.nodeId });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+		const pending = pendingPackages(grant.packages, updatable);
+		const skipped = grant.packages.filter((name) => !pending.includes(name));
+		if (pending.length === 0) {
+			this.logger.info("addon update button applied nothing — every package is already current", { meta: {
+				nodeId: grant.nodeId,
+				packages: grant.packages
+			} });
+			await this.announceAddonUpdate(grant, "uptodate", { nodeId: grant.nodeId }, {
+				requested: grant.packages.length,
+				applied: [],
+				skipped,
+				failed: []
+			});
+			return;
+		}
+		await this.announceAddonUpdate(grant, "started", {
+			count: String(pending.length),
+			nodeId: grant.nodeId
+		}, void 0, pending.length);
+		const applied = [];
+		const failed = [];
+		for (const packageName of pending) try {
+			const result = await apply({
+				packageName,
+				nodeId: grant.nodeId
+			});
+			if (result.ok) applied.push(packageName);
+			else {
+				failed.push(packageName);
+				this.logger.warn("addon update from a notification button failed", { meta: {
+					nodeId: grant.nodeId,
+					packageName,
+					error: result.error
+				} });
+			}
+		} catch (err) {
+			failed.push(packageName);
+			this.logger.warn("addon update from a notification button threw", { meta: {
+				nodeId: grant.nodeId,
+				packageName,
+				error: String(err)
+			} });
+		}
+		const report = {
+			requested: grant.packages.length,
+			applied,
+			skipped,
+			failed
+		};
+		this.logger.info("addon updates applied from a notification button", { meta: {
+			nodeId: grant.nodeId,
+			requested: report.requested,
+			applied: applied.length,
+			skipped: skipped.length,
+			failed
+		} });
+		await this.announceAddonUpdate(grant, addonUpdateSentence(report), {
+			nodeId: grant.nodeId,
+			applied: String(applied.length),
+			skipped: String(skipped.length),
+			failed: String(failed.length)
+		}, report, applied.length);
+		if (applied.length === 0 && failed.length > 0) throw new Error(`no package updated on ${grant.nodeId} (${failed.join(", ")})`);
+	}
+	/**
+	* Stage the server update one notification was about.
+	*
+	* The shape matches the addon-update runner, with one extra constraint: the
+	* **start announcement leaves BEFORE apply**. Applying the hub kills this
+	* process; a tap that went into silence because the process died mid-apply
+	* is worse than no button. The reboot itself is confirmed by the existing
+	* `server-updated` event on reconnect — this method does not wait for it.
+	*
+	* Throws when nothing was staged and something went wrong, so the plane's
+	* line says the run failed rather than reporting a spent token as a success.
+	*/
+	async applyGrantedServerUpdate(grant) {
+		const apply = this.deps.applyServerUpdate;
+		const check = this.deps.checkServerUpdate;
+		if (apply === void 0 || check === void 0) throw new Error("no server updater is wired on this node");
+		let stillAvailable;
+		try {
+			stillAvailable = await check(grant.nodeId);
+		} catch (err) {
+			this.logger.warn("server update button changed nothing — could not read whether an update is still needed", { meta: {
+				nodeId: grant.nodeId,
+				error: String(err)
+			} });
+			await this.announceServerUpdate(grant, "unknown", { nodeId: grant.nodeId });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+		if (!stillAvailable) {
+			this.logger.info("server update button applied nothing — already current", { meta: { nodeId: grant.nodeId } });
+			await this.announceServerUpdate(grant, "uptodate", { nodeId: grant.nodeId });
+			return;
+		}
+		await this.announceServerUpdate(grant, "started", { nodeId: grant.nodeId });
+		let result;
+		try {
+			result = await apply({ nodeId: grant.nodeId });
+		} catch (err) {
+			this.logger.warn("server update from a notification button threw", { meta: {
+				nodeId: grant.nodeId,
+				error: String(err)
+			} });
+			await this.announceServerUpdate(grant, "failed", { nodeId: grant.nodeId });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+		if (!result.ok) {
+			this.logger.warn("server update from a notification button was refused", { meta: {
+				nodeId: grant.nodeId,
+				error: result.error
+			} });
+			await this.announceServerUpdate(grant, "failed", { nodeId: grant.nodeId });
+			throw new Error(result.error);
 		}
+		this.logger.info("server update staged from a notification button", { meta: { nodeId: grant.nodeId } });
+		await this.announceServerUpdate(grant, "restarting", { nodeId: grant.nodeId });
+	}
+	/**
+	* One sentence about a server-update tap, to the target the notification
+	* went to. Best-effort — `deliverAnnouncement` never throws — because an
+	* announcement that failed must not turn a staging that HAPPENED into a run
+	* the plane reports as failed.
+	*/
+	async announceServerUpdate(grant, sentence, vars) {
+		const targetId = grant.targetId;
+		if (targetId === void 0) return;
+		await this.dispatcher.deliverAnnouncement({
+			reason: `server-update-${sentence}`,
+			targetId,
+			title: this.texts.text({ key: "action.server-update.title" }),
+			body: this.texts.text({
+				key: `action.server-update.${sentence}`,
+				vars
+			})
+		});
+	}
+	/**
+	* One sentence about an update tap, to the target the notification went to.
+	*
+	* Best-effort by construction — `deliverAnnouncement` never throws and never
+	* retries — because an announcement that failed must not turn an update that
+	* HAPPENED into a run the plane reports as failed.
+	*/
+	async announceAddonUpdate(grant, sentence, vars, report, count) {
+		const targetId = grant.targetId;
+		if (targetId === void 0) return;
+		const body = this.texts.text({
+			key: `action.addon-update.${sentence}`,
+			vars,
+			...count !== void 0 ? { count } : {}
+		});
+		const failedNames = report?.failed ?? [];
+		await this.dispatcher.deliverAnnouncement({
+			reason: `addon-update-${sentence}`,
+			targetId,
+			title: this.texts.text({ key: "action.addon-update.title" }),
+			body: failedNames.length > 0 ? `${body}\n${failedNames.join(", ")}` : body
+		});
 	}
 	async runGrantedSequence(grant) {
 		if (this.actionRunner === null) throw new Error("no actuator is wired on this node");
@@ -25764,7 +26235,7 @@ var DEFAULT_MEDIA_LOCATION = "eventMedia";
 * whose contract is disposal.** The gallery's row lives on the data volume;
 * its blob belongs there too, and now does. See D197.
 */
-var GALLERY_MEDIA_LOCATION = "galleryMedia";
+var GALLERY_MEDIA_LOCATION = "addon-data";
 /**
 * The location a new blob is written to, derived from its owner kind.
 *
@@ -26661,7 +27132,7 @@ var MediaStore = class {
 			for (const row of rows) {
 				const data = row.data;
 				const from = mediaRowLocation(data);
-				if (from === "galleryMedia") continue;
+				if (from === "addon-data") continue;
 				const relativePath = String(data["path"] ?? "");
 				const deviceId = Number(data["deviceId"]);
 				if (relativePath.length === 0) continue;
@@ -29037,30 +29508,57 @@ var LEGACY_FACE_MODEL_ID = "arcface-r100";
 */
 var FACES_COLLECTION = "pipeline-analytics:faces";
 /**
-* Rows per page for the two whole-collection sweeps below.
+* Rows per page for `pruneCapOverflow`, the ONE remaining walk of this
+* collection.
 *
-* A face row is one of the two WIDEST row shapes in the hub's database: it
-* carries a JSON `embedding` on every single row, measured at **10.8 KB
-* average** where a motion event is 78 bytes. Both sweeps used to read the
-* collection in ONE statement with no `limit`.
+* It is a walk that DOES WORK: the capacity bound has to consider every row to
+* decide which ones leave, and it runs on the maintenance pass, not on a
+* request. That is the shape D320 permits. What it must not do is drag the
+* whole row across for four scalars — see the projection there.
 *
-* To be exact about what that did and did not cause: this table holds **372
-* rows / 4.0 MB** on the live hub, so it was *not* the read that killed
-* hub-main on 2026-08-07 (that was the multi-camera track feed — see
-* `RECENT_FANOUT_ROW_BUDGET` in `track-store.ts`). It is a full scan whose cost
-* grows with a table nothing else bounds, which is the same defect one incident
-* earlier. `pruneCapOverflow` is what keeps the row count small — and it was
-* itself one of the two unbounded readers, so the bound and the thing enforcing
-* it were the same loop.
+* The two READS that used to page here do not any more. They asked a question
+* ("the newest N faces that are still unassigned"), the question is a
+* predicate, and a predicate answers it in one statement whose cost is the
+* ANSWER rather than the table.
 *
-* The engine now refuses an unbounded read (`query-bounds.ts`), so paging here
-* is not belt-and-braces: without it these two methods would silently see only
-* the newest N rows and the buffer would grow forever.
-*
-* 1 000 keeps peak transfer around 11 MB while staying under the engine's own
-* cap, so the page is always the caller's bound and never the engine's.
+* The engine refuses an unbounded read (`query-bounds.ts`) and truncates a
+* limitless one at `SETTINGS_QUERY_DEFAULT_ROW_CAP` with a WARN nobody can act
+* on, so every read below carries an explicit `limit`.
 */
 var FACE_SWEEP_PAGE = 1e3;
+/**
+* The widest window a single gallery read may materialise before it REFUSES.
+*
+* It bounds only the reads whose size the CALLER did not name: an unbounded
+* `listAllRecentFaces`, and the `suggestionConfidence` order, which cannot stop
+* early because the most certain suggestion may be the oldest row (`face-sort.ts`).
+* A caller's own `limit` is honoured verbatim at any table size — asking for
+* 500 and getting 500 is being served, not being truncated.
+*
+* 10 000 because that is above what `pruneCapOverflow` actually permits to
+* exist: 29 cameras × (50 ordinary + 200 suggested) = 7 250 unassigned rows,
+* plus whatever the operator has enrolled. It sits under the engine's
+* `SETTINGS_QUERY_HARD_ROW_CAP` (20 000) so the engine never truncates first —
+* this bound is the one that speaks, and it speaks by throwing.
+*
+* The alternative was to answer with the rows it managed to read. A short list
+* and a complete one are the same array, and a gallery that quietly stops
+* showing a face is exactly the failure this whole change exists to avoid.
+*/
+var FACE_WINDOW_MAX_ROWS = 1e4;
+/**
+* A gallery read whose window is wider than {@link FACE_WINDOW_MAX_ROWS}.
+*
+* Distinct type so a router can map it to a 400 and an operator can be told
+* *"the buffer is too large to rank in one pass — narrow the window"* instead
+* of being shown a page that silently lost its tail.
+*/
+var FaceWindowTooWideError = class extends Error {
+	constructor(rows) {
+		super(`face window exceeds ${String(FACE_WINDOW_MAX_ROWS)} rows (read ${String(rows)}) — refusing to answer with the part that fit; narrow with deviceIds / since / until, or pass an explicit limit`);
+		this.name = "FaceWindowTooWideError";
+	}
+};
 /** How many evicted face ids one per-camera eviction line names before it
 *  stops — enough to find the rows, not enough to turn a log line into a page. */
 var SUGGESTED_EVICTION_IDS_LOGGED = 10;
@@ -29162,13 +29660,128 @@ var FACE_COLUMNS = [
 		type: "REAL"
 	}
 ];
-var FACE_INDEXES = [{
-	name: "idx_faces_device_ts",
-	columns: ["deviceId", "timestamp"]
-}, {
-	name: "idx_faces_track",
-	columns: ["trackId"]
-}];
+/**
+* What every gallery query orders by, and what the three of them filter on.
+*
+* Before these existed, EVERY read of this collection was
+* `SCAN … | USE TEMP B-TREE FOR ORDER BY` — a full table scan plus a sort of
+* the whole table, to hand back the newest 500 rows. Measured with
+* `EXPLAIN QUERY PLAN` over a 20 000-row copy of this exact schema:
+*
+* | query | before | after |
+* | --- | --- | --- |
+* | newest N | `SCAN + TEMP B-TREE` | `SCAN USING idx_faces_ts` |
+* | newest N unassigned | `SCAN + TEMP B-TREE` | `SEARCH USING idx_faces_assigned_ts (assigned=?)` |
+* | newest N recognized | `SCAN + TEMP B-TREE` | `SEARCH USING idx_faces_assigned_ts (assigned=?)` |
+* | faces of one identity | `SCAN + TEMP B-TREE` | `SEARCH USING idx_faces_identity_ts (recognizedIdentityId=?)` |
+*
+* The sort disappearing is the point: with an ordered index the statement stops
+* at the `LIMIT`, so the cost is the ANSWER. Without it the cost is the table,
+* and this table is bounded only by `pruneCapOverflow` — it went from 372 rows
+* (2026-08-25) to 1 612 (2026-08-31) while a UI polled it every 30 seconds.
+*
+* `idx_faces_ts` is NOT redundant beside `idx_faces_assigned_ts`: a composite
+* leading on `assigned` cannot serve an unfiltered `ORDER BY timestamp`.
+* Three b-trees over a few thousand narrow rows is tens of KB, against one
+* UPSERT per track that produces a face — the write rate this pays at.
+*/
+var FACE_INDEXES = [
+	{
+		name: "idx_faces_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	{
+		name: "idx_faces_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_faces_ts",
+		columns: ["timestamp"]
+	},
+	{
+		name: "idx_faces_assigned_ts",
+		columns: ["assigned", "timestamp"]
+	},
+	{
+		name: "idx_faces_identity_ts",
+		columns: ["recognizedIdentityId", "timestamp"]
+	}
+];
+/**
+* The columns a {@link Face} is built from — every declared column EXCEPT the
+* drained legacy `embedding`, derived mechanically so a column added tomorrow
+* arrives without anyone remembering this list.
+*
+* Mechanical on purpose. A hand-written projection is how a field silently
+* stops arriving: the row comes back missing the key, `rowToFace` reads
+* `undefined`, and "the database says nothing" is indistinguishable from "I did
+* not ask". The engine REFUSES a column it cannot serve
+* (`resolveProjection`) — the projection is the one part of a query that is not
+* allowed to be forgiving — so a stale name here is a throw, not a wrong value.
+*
+* `embedding` is the only exclusion, and it is the whole reason to project:
+* it is a `notNull` JSON column on the widest row shape in the database, it is
+* dropped by `rowToFace` on arrival, and {@link Face} has no field for it. A
+* caller that wants floats asks by name ({@link FaceStore.getWithEmbedding},
+* {@link FaceStore.loadEmbeddings}). Since D304 drained it to `[]` the saving
+* is small — 23 B/row, measured on the live hub — but the column is still
+* declared, still `notNull`, and an unconverted row still carries ~10.8 KB of
+* it. Projecting is what keeps that a fact about ONE row rather than about
+* every gallery poll.
+*/
+var FACE_LIST_COLUMNS = FACE_COLUMNS.map((c) => c.name).filter((name) => name !== "embedding" && name !== "id");
+/**
+* The four scalars `pruneCapOverflow` decides on.
+*
+* Its docblock has always said *"only four scalars per row survive the page"*.
+* They survived the PAGE; the query still dragged every column — the embedding
+* included — across the RPC boundary and through V8 first. A leftover that
+* describes the right design reads as verification, so the projection now makes
+* the sentence true.
+*/
+var FACE_CAP_COLUMNS = [
+	"deviceId",
+	"timestamp",
+	"assigned",
+	"suggestedIdentityId"
+];
+/** One camera reference per identity — see {@link FaceStore.listCameraRefsForIdentity}. */
+var FACE_REF_COLUMNS = ["deviceId"];
+/**
+* A gallery view as a STORE PREDICATE.
+*
+* Every one of the four is expressible, and that is the whole finding behind
+* this change. They were applied in JS, over pages the store had already
+* chosen, which is why `limit` counted rows that PASSED and the read had to
+* sweep until enough had: with `filter: 'unassigned'` the newest N rows may be
+* entirely assigned while matches wait just beyond them. Pushed down, `limit`
+* IS the store's limit, and the sweep has nothing left to do.
+*
+* **Two of them name null, and null is the trap.** `recognizedIdentityId` is a
+* nullable TEXT column, so "has an identity" is `IS NOT NULL` — which
+* `whereNot: { field: null }` compiles to since D312, and which before D312
+* compiled to `(expr IS NULL OR expr != NULL)`: TRUE for a NULL row and NULL
+* for every other, i.e. precisely the rows it was asked to exclude. A predicate
+* that silently matched nothing would report "no recognized faces" forever and
+* every assertion about the rows returned would agree with it. Verified against
+* the live hub before shipping: 1 612 rows, `where {assigned:false}` → 1 444,
+* `whereNot {recognizedIdentityId:null}` → 247.
+*
+* `assigned` is `BOOLEAN NOT NULL`; the backend serialises `false` to `0` at
+* the bind (`serializeColumnValue`) and decodes `0` back to `false` on read, so
+* plain equality is correct and no null semantics are involved.
+*/
+function faceFilterPredicate(filter) {
+	switch (filter) {
+		case "unassigned": return { where: { assigned: false } };
+		case "recognized": return {
+			where: { assigned: false },
+			whereNot: { recognizedIdentityId: null }
+		};
+		case "identified": return { whereNot: { recognizedIdentityId: null } };
+		case "all": return {};
+	}
+}
 /**
 * `since` / `until` as a store predicate.
 *
@@ -29203,6 +29816,7 @@ function rowToFace(id, raw) {
 	return {
 		...rest,
 		id,
+		embeddingModelId: data.embeddingModelId ?? void 0,
 		assigned: Boolean(data.assigned),
 		mediaKey: data.mediaKey ?? void 0,
 		recognizedIdentityId: data.recognizedIdentityId ?? void 0,
@@ -29431,16 +30045,21 @@ var FaceStore = class {
 	*/
 	async pruneCapOverflow(input) {
 		/**
-		* Paged, not one statement. Only four scalars per row survive the page —
-		* the `embedding` string that dominates the row is dropped as soon as the
-		* page goes out of scope, so peak heap is one page rather than the whole
-		* face table. The prune still considers EVERY row, which is what makes it a
-		* capacity bound rather than a bound on the newest page.
+		* Paged, not one statement, and PROJECTED to the four scalars the decision
+		* needs — this sentence used to be true only of what survived the page,
+		* while the query still dragged every column, `embedding` included, across
+		* the RPC boundary and through V8 first.
+		*
+		* This is the one walk of the collection that remains, and D320 permits it:
+		* it must touch every row to ACT on it, and it runs on the maintenance
+		* pass, not on a request. The prune still considers EVERY row, which is
+		* what makes it a capacity bound rather than a bound on the newest page.
 		*/
 		const byDevice = /* @__PURE__ */ new Map();
 		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
 			const rows = await this.store.query.query({
 				collection: FACES_COLLECTION,
+				columns: FACE_CAP_COLUMNS,
 				filter: {
 					orderBy: {
 						field: "timestamp",
@@ -29734,29 +30353,38 @@ var FaceStore = class {
 	*  - 'recognized'           → !assigned && recognizedIdentityId != null
 	*  - 'identified'           → recognizedIdentityId != null, including manual assignments
 	*
-	* `deviceIds`, `since` and `until` are pushed INTO the query — they narrow
-	* what is read, not what is returned. `filter` and the ordering cannot be
-	* (the first is a computed predicate, the second is a contract this backend
-	* does not implement — see `face-sort.ts`), so they are applied here.
-	*
-	* **`limit` counts rows that PASSED the filter, never rows that were
-	* discarded.** That is the whole reason this pages instead of asking the
-	* store for `limit` rows: with `filter:'unassigned'` the newest N rows may be
-	* entirely assigned while matches wait just beyond them.
-	*
-	* The previous answer was to fetch the WHOLE collection and slice after
-	* filtering. That is the read that killed hub-main (`query-bounds.ts`) —
-	* every face row carries a JSON `embedding`, so "all rows" is the widest
-	* table in the database materialised at once, to render a gallery of at most
-	* a few hundred tiles.
-	*
-	* So: PAGE. Under the default `timestamp` order the store's paging already
-	* emits rows in the answer's order, so the sweep stops the moment enough
-	* MATCHES exist and the common case costs one page. Under
-	* `suggestionConfidence` it cannot — the most certain suggestion may be the
-	* oldest row — so the sweep walks the window and folds each page through
-	* `rankAndCap`, which holds the RETAINED set to `limit` even though the read
-	* is wider. Narrow the read with `since` / `until`.
+	* **Every part of the question is now a store predicate** — `deviceIds`,
+	* `since` / `until` AND `filter` ({@link faceFilterPredicate}) — so `limit`
+	* is the STORE's limit and one statement is the whole answer.
+	*
+	* That is the change. This used to page: `filter` was a JS predicate applied
+	* to rows the store had already chosen, so `limit` counted rows that PASSED
+	* and the read had to sweep until enough had, up to `FACE_SWEEP_MAX_PAGES`
+	* (1 000) × `FACE_SWEEP_PAGE` (1 000) — a million rows, `offset`-paged,
+	* behind a UI polling every 30 seconds. On the live hub that meant reading
+	* all 1 612 rows over 2 round trips to produce a 60-row `recognized` page,
+	* every 30 s, per open tab, and growing with a table only `pruneCapOverflow`
+	* bounds. It is the same family as `MediaRelocateEngine.pageRows`, which put
+	* a ~16 s standing queue in front of every settings-store call in the cluster
+	* (D320) — smaller, on a longer timer, and the same shape.
+	*
+	* `offset` is gone with it, not merely unnecessary: the recognizer UPSERTs
+	* into this collection continuously, so page two at `offset: N` starts N rows
+	* past a set that may have gained or lost its first N (D295 rule 1, D320 R3).
+	*
+	* ## What still cannot be pushed, and what that costs
+	*
+	* The `suggestionConfidence` ORDER stays here. `ORDER BY suggestedMatchScore`
+	* would let the backend decide where a scoreless row goes — SQLite collates
+	* NULL first on ASC and last on DESC — and the contract is that it sorts LAST
+	* in BOTH directions (`face-sort.ts`). So that order reads the whole FILTERED
+	* window and ranks it. Filtered, which is the improvement: the window is the
+	* unassigned buffer, not the table.
+	*
+	* A window it cannot read whole REFUSES ({@link FaceWindowTooWideError}).
+	* Ranking the part that fit is exactly "most certain among the newest N",
+	* which is the defect that order was added to remove, and it is invisible in
+	* the rows returned.
 	*
 	* An **empty `deviceIds` reads nothing at all**: `[]` is a request for no
 	* cameras, not an omission (the `deviceManager.listFleet` contract).
@@ -29765,74 +30393,86 @@ var FaceStore = class {
 		if (input.deviceIds !== void 0 && input.deviceIds.length === 0) return [];
 		const order = resolveFaceSort(input);
 		const pagingServesTheOrder = sortIsServedByTimestampPaging(order);
-		const filterMode = input.filter ?? "all";
-		const matches = (f) => {
-			if (filterMode === "unassigned") return !f.assigned;
-			if (filterMode === "recognized") return !f.assigned && f.recognizedIdentityId != null;
-			if (filterMode === "identified") return f.recognizedIdentityId != null;
-			return true;
-		};
-		const storeFilter = {
-			...input.deviceIds !== void 0 ? { whereIn: { deviceId: [...new Set(input.deviceIds)] } } : {},
-			...buildTimestampWindow(input),
-			orderBy: {
-				field: "timestamp",
-				direction: pagingServesTheOrder ? order.direction : "desc"
+		/**
+		* The caller's `limit` bounds the READ only when the store's ordering is
+		* already the answer's. Under `suggestionConfidence` the most certain
+		* suggestion may be the oldest row, so the read is the window and `limit`
+		* bounds only what is RETAINED (`rankAndCap`).
+		*/
+		const callerBounded = pagingServesTheOrder && input.limit !== void 0;
+		const readLimit = callerBounded ? input.limit ?? 0 : 10001;
+		const rows = await this.store.query.query({
+			collection: FACES_COLLECTION,
+			columns: FACE_LIST_COLUMNS,
+			filter: {
+				...input.deviceIds !== void 0 ? { whereIn: { deviceId: [...new Set(input.deviceIds)] } } : {},
+				...buildTimestampWindow(input),
+				...faceFilterPredicate(input.filter ?? "all"),
+				orderBy: {
+					field: "timestamp",
+					direction: pagingServesTheOrder ? order.direction : "desc"
+				},
+				limit: readLimit
 			}
-		};
-		let result = [];
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					...storeFilter,
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			const matched = [];
-			for (const r of rows) {
-				const face = rowToFace(r.id, r.data);
-				if (matches(face)) matched.push(face);
-			}
-			if (pagingServesTheOrder) {
-				const merged = [...result, ...matched];
-				if (input.limit !== void 0 && merged.length >= input.limit) return merged.slice(0, input.limit);
-				result = merged;
-			} else result = rankAndCap([...result, ...matched], order, input.limit);
-			if (rows.length < 1e3) break;
-		}
-		return pagingServesTheOrder ? result : rankAndCap(result, order, input.limit);
+		});
+		if (!callerBounded && rows.length > 1e4) throw new FaceWindowTooWideError(rows.length);
+		const faces = rows.map((r) => rowToFace(r.id, r.data));
+		return pagingServesTheOrder ? faces : rankAndCap(faces, order, input.limit);
 	}
-	/** One real face row per camera currently attributed to an identity. */
+	/**
+	* One real face row per camera currently attributed to an identity.
+	*
+	* `recognizedIdentityId` is indexed (`idx_faces_identity_ts`), so this is a
+	* bounded index walk over the identity's own rows rather than the
+	* `offset`-paged sweep of the whole collection it used to be. It projects
+	* `deviceId` alone — the answer is a device id and a row id, and the row id
+	* is the record key.
+	*/
 	async listCameraRefsForIdentity(identityId) {
+		const rows = await this.identityRows(identityId, FACE_REF_COLUMNS);
 		const byDevice = /* @__PURE__ */ new Map();
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					where: { recognizedIdentityId: identityId },
-					orderBy: {
-						field: "timestamp",
-						direction: "desc"
-					},
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			for (const row of rows) {
-				const deviceId = Number(row.data["deviceId"]);
-				if (Number.isInteger(deviceId) && !byDevice.has(deviceId)) byDevice.set(deviceId, row.id);
-			}
-			if (rows.length < 1e3) break;
+		for (const row of rows) {
+			const deviceId = Number(row.data["deviceId"]);
+			if (Number.isInteger(deviceId) && !byDevice.has(deviceId)) byDevice.set(deviceId, row.id);
 		}
 		return [...byDevice].map(([deviceId, faceId]) => ({
 			deviceId,
 			faceId
 		}));
 	}
+	/**
+	* Every face row currently attributed to an identity, id only.
+	*
+	* `deleteIdentity` detaches these before the identity goes. It used to get
+	* them by listing the WHOLE collection with `filter: 'all'` and no limit and
+	* comparing in JS — which past `SETTINGS_QUERY_DEFAULT_ROW_CAP` would have
+	* detached the rows that fit and left the rest pointing at a deleted
+	* identity, silently, with a WARN in the engine that no caller can see.
+	*/
+	async listFaceIdsForIdentity(identityId) {
+		return (await this.identityRows(identityId, FACE_REF_COLUMNS)).map((r) => r.id);
+	}
+	/**
+	* The rows of one identity, newest first, bounded and REFUSING rather than
+	* narrowing. Shared by the two callers above so they cannot disagree about
+	* what "this identity's faces" means.
+	*/
+	async identityRows(identityId, columns) {
+		const rows = await this.store.query.query({
+			collection: FACES_COLLECTION,
+			columns,
+			filter: {
+				where: { recognizedIdentityId: identityId },
+				orderBy: {
+					field: "timestamp",
+					direction: "desc"
+				},
+				limit: 10001
+			}
+		});
+		if (rows.length > 1e4) throw new FaceWindowTooWideError(rows.length);
+		return rows;
+	}
 };
 //#endregion
 //#region src/pipeline-analytics/face-gallery-provider.ts
@@ -29949,8 +30589,7 @@ var FaceGalleryProvider = class {
 		});
 	}
 	async deleteIdentity(input) {
-		const faces = await this.faceStore.listAllRecentFaces({ filter: "all" });
-		for (const f of faces) if (f.recognizedIdentityId === input.id) await this.unassignFace({ faceId: f.id });
+		for (const faceId of await this.faceStore.listFaceIdsForIdentity(input.id)) await this.unassignFace({ faceId });
 		await this.mediaStore.deleteForOwner("identity", [input.id]);
 		await this.identityStore.deleteIdentity(input.id);
 		this.refreshGallery();
@@ -30023,8 +30662,7 @@ var FaceGalleryProvider = class {
 			sortBy: input?.sortBy,
 			sortDirection: input?.sortDirection
 		});
-		const identities = await this.identityStore.listIdentities();
-		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
+		const nameMap = await this.identityStore.namesFor(faces.flatMap((f) => f.recognizedIdentityId != null ? [f.recognizedIdentityId] : []));
 		const includeCrops = resolveIncludeCrops(input);
 		return mapWithConcurrency(faces, FACE_CROP_FETCH_CONCURRENCY, async (face) => {
 			const base64 = includeCrops ? await this.faceCropBase64(face) : void 0;
@@ -30060,8 +30698,7 @@ var FaceGalleryProvider = class {
 		const face = await this.faceStore.get("face-" + input.trackId);
 		if (!face) return null;
 		if (face.deviceId !== input.deviceId) return null;
-		const identities = await this.identityStore.listIdentities();
-		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
+		const nameMap = await this.identityStore.namesFor(face.recognizedIdentityId != null ? [face.recognizedIdentityId] : []);
 		const identityName = face.recognizedIdentityId ? nameMap.get(face.recognizedIdentityId) : void 0;
 		const cropUrl = this.cropUrlFor(face);
 		return {
@@ -34878,9 +35515,14 @@ var PlateGalleryProvider = class {
 			...cropUrl !== void 0 ? { cropUrl } : {}
 		};
 	}
-	async vehicleNameMap() {
-		const vehicles = await this.vehicleStore.listVehicles();
-		return new Map(vehicles.map((v) => [v.id, v.name]));
+	/**
+	* Names for the vehicles THESE PLATES reference — not the collection.
+	*
+	* A page of unassigned reads references none, and then this costs no round
+	* trip at all. See `VehicleStore.namesFor`.
+	*/
+	async vehicleNameMap(plates) {
+		return this.vehicleStore.namesFor(plates.flatMap((p) => p.recognizedVehicleId != null ? [p.recognizedVehicleId] : []));
 	}
 	/**
 	* `includeCrops` defaults to `true` — the pre-existing behaviour, kept so no
@@ -34895,14 +35537,14 @@ var PlateGalleryProvider = class {
 			...input?.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
 			...input?.limit !== void 0 ? { limit: input.limit } : {}
 		});
-		const nameMap = await this.vehicleNameMap();
+		const nameMap = await this.vehicleNameMap(rows);
 		const includeCrops = resolveIncludeCrops(input);
 		return Promise.all(rows.map((p) => this.toPlateInfo(p, nameMap, { includeCrops })));
 	}
 	async getPlateByTrack(input) {
 		const plate = await this.plateStore.get(`plate-${input.trackId}`);
 		if (!plate || plate.deviceId !== input.deviceId) return null;
-		const nameMap = await this.vehicleNameMap();
+		const nameMap = await this.vehicleNameMap([plate]);
 		return this.toPlateInfo(plate, nameMap, { includeCrops: false });
 	}
 	async getPlateMedia(input) {
@@ -34915,7 +35557,7 @@ var PlateGalleryProvider = class {
 			dist: plateDistance(input.text, p.text)
 		})).filter((x) => x.dist <= maxDistance).toSorted((a, b) => a.dist - b.dist || b.p.timestamp - a.p.timestamp);
 		const limited = input.limit !== void 0 ? scored.slice(0, input.limit) : scored;
-		const nameMap = await this.vehicleNameMap();
+		const nameMap = await this.vehicleNameMap(limited.map((x) => x.p));
 		const includeCrops = input.includeCrops ?? true;
 		return Promise.all(limited.map((x) => this.toPlateInfo(x.p, nameMap, { includeCrops })));
 	}
@@ -34990,8 +35632,7 @@ var PlateGalleryProvider = class {
 		await this.vehicleStore.renameVehicle(input.id, input.name);
 	}
 	async deleteVehicle(input) {
-		const plates = await this.plateStore.listAllRecentPlates({});
-		for (const p of plates) if (p.recognizedVehicleId === input.id) await this.unassignPlate({ plateId: p.id });
+		for (const plateId of await this.plateStore.listPlateIdsForVehicle(input.id)) await this.unassignPlate({ plateId });
 		await this.mediaStore.deleteForOwner("vehicle", [input.id]);
 		await this.vehicleStore.deleteVehicle(input.id);
 		this.refreshGallery();
@@ -35434,6 +36075,7 @@ async function runMediaReclaim(input) {
 		byteBudget -= report.bytesReclaimed;
 		nextCursors.set(key, report.stoppedBy === "exhausted" ? 0 : report.nextCursor);
 		devices.push(report);
+		input.onDevice?.(report);
 		if (report.examined > 0 || report.refused > 0) input.deps.logger.info("media reclaim window", {
 			tags: { deviceId },
 			meta: {
@@ -35468,33 +36110,10 @@ async function runMediaReclaim(input) {
 		cursors: nextCursors
 	};
 }
-//#endregion
-//#region src/pipeline-analytics/retention/media-reclaim-actions.ts
-/**
-* The operator button for the debug-media reclaim.
-*
-* The mechanism ships armed with nothing: **arming it is the operator's
-* call**. `mode` omitted means `report` — it counts, logs one line per camera
-* and returns rows/bytes per device, and deletes nothing. `reclaim` is a word
-* that has to be typed.
-*
-* Everything about the shape is borrowed from `orphan-audit-actions.ts`, which
-* earned it: dry-run default, explicit pacing, explicit blast radius, and a
-* report you can read instead of a log line you have to find.
-*/
-/**
-* `report` counts; `reclaim` deletes.
-*
-* `.default('report')` is load-bearing: the settings form sends `{}` for a
-* button with no fields, and the safe reading of an unstated intent is the one
-* that destroys nothing.
-*/
-var MediaReclaimActionModeSchema = _enum(["report", "reclaim"]).default("report");
-var MediaReclaimScopeSchema = _enum(["motion-still", "track-filmstrip"]);
 var MediaReclaimActionInputSchema = object({
-	mode: MediaReclaimActionModeSchema,
+	mode: _enum(["report", "reclaim"]).default("report"),
 	/** Which populations to walk. Omitted = both. */
-	scopes: array(MediaReclaimScopeSchema).min(1).optional(),
+	scopes: array(_enum(["motion-still", "track-filmstrip"])).min(1).optional(),
 	/** Restrict to these cameras. Omitted = every camera in retention scope. */
 	deviceIds: array(number().int()).min(1).optional(),
 	/** Start every device from the top instead of resuming its cursor. */
@@ -35521,39 +36140,28 @@ var MediaReclaimActionInputSchema = object({
 	*/
 	graceMinutes: number().int().min(1).max(10080).optional()
 });
-var MediaReclaimDeviceReportSchema = object({
-	deviceId: number(),
-	scope: MediaReclaimScopeSchema,
-	examined: number(),
-	eligible: number(),
-	reclaimed: number(),
-	bytesReclaimed: number(),
-	/** Rows kept because the owning track is pinned (`staging`/`favourited`). */
-	held: number(),
-	/** Rows kept because the owner could not be shown to be a motion event. */
-	unresolved: number(),
-	withinGrace: number(),
-	/** Deletes that REFUSED — the blob survived or the volume could not answer.
-	*  The row was kept and the cursor did not pass it. */
-	refused: number(),
-	stoppedBy: string(),
-	/** Where the NEXT pass resumes. `0` = this device+scope was walked to the end. */
-	nextCursor: number()
+var MediaReclaimStartedSchema = object({
+	started: boolean(),
+	alreadyRunning: boolean()
 });
-var mediaReclaimActions = defineCustomActions({ "retention.mediaReclaim": customAction(MediaReclaimActionInputSchema, object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: boolean(),
-	mode: _enum(["report", "reclaim"]),
-	devices: array(MediaReclaimDeviceReportSchema),
+var MediaReclaimStatusSchema = object({
+	running: boolean(),
+	mode: _enum(["report", "reclaim"]).nullable(),
 	totalExamined: number(),
 	totalEligible: number(),
 	totalReclaimed: number(),
 	totalBytesReclaimed: number(),
 	totalRefused: number(),
-	durationMs: number(),
-	/** Every device+scope reported `exhausted` — there is nothing left to do. */
-	complete: boolean()
-}), { auth: "admin" }) });
+	devicesDone: number(),
+	complete: boolean().nullable(),
+	startedAtMs: number().nullable(),
+	finishedAtMs: number().nullable(),
+	error: string().nullable()
+});
+var mediaReclaimActions = defineCustomActions({
+	"retention.mediaReclaim": customAction(MediaReclaimActionInputSchema, MediaReclaimStartedSchema, { auth: "admin" }),
+	"retention.mediaReclaimStatus": customAction(object({}), MediaReclaimStatusSchema, { auth: "admin" })
+});
 var OrphanAuditActionInputSchema = object({
 	mode: _enum(["report", "reclaim"]).default("report"),
 	/**
@@ -40608,6 +41216,7 @@ function createLocationAwareMediaStorage(deps) {
 	const roots = /* @__PURE__ */ new Map();
 	let defaultBypassInvalidated = false;
 	const rootOf = async (locationId) => {
+		if (deps.galleryLocationId !== void 0 && deps.galleryRoot !== void 0 && locationId === deps.galleryLocationId) return deps.galleryRoot;
 		const cached = roots.get(locationId);
 		if (cached !== void 0) return cached;
 		const root = await deps.resolveRoot(locationId);
@@ -43114,7 +43723,7 @@ var PhotoAnalysisSessions = class {
 *     a magnet that recognises every degraded probe as its owner, and 22 of 50
 *     live samples were enrolled that way on 2026-08-18;
 *  3. both blobs are written under `ownerKind: 'identity'`, which is what puts
-*     them on `galleryMedia` — the location a footage wipe cannot reach (D197);
+*     them in the addon data dir — the location a footage wipe cannot reach (D197);
 *  4. the row is written last, and if it does not land BOTH blobs are reclaimed.
 *     An orphan under `identity` is exempt from every sweep this repo has, so
 *     it would otherwise live forever.
@@ -44845,6 +45454,45 @@ function pickWritableMediaLocation(locations, currentDefaultId) {
 }
 //#endregion
 //#region src/pipeline-analytics/media-relocate-engine.ts
+/**
+* Event-media relocation engine (entity-routing spec, Phase 4) — the
+* analytics sibling of the recorder's footage mover. Each addon moves ONLY
+* what it owns (addons never touch each other's files).
+*
+* Per row: read blob from its CURRENT location → write to the target →
+* stamp `row.locationId` → delete the old blob. The row update lands between
+* the two blob operations, so a crash leaves the row pointing at a location
+* that still holds valid bytes (the old blob is only deleted after the row
+* points away from it). Rows already at the target are skipped — a re-run
+* RESUMES.
+*
+* Paging: timestamp-cursor over the media collection, with a seen-id set
+* bridging equal-timestamp boundaries. The PASS pages because it must visit
+* every row to act on it; that is not true of every question asked about this
+* collection, and `countUnstamped` no longer pages — see its docblock, and the
+* 60 s timeout that shape cost.
+*
+* (This header used to claim `WHERE locationId IS NULL` was inexpressible
+* through the store's filter. It was expressible, and that was the problem:
+* `where: { locationId: null }` compiled to `= NULL`, which matches nothing
+* and reports it as `0`. The filter layer now compiles it to `IS NULL`.)
+*
+* ── Three passes, one engine (see `MediaRelocateModeSchema`) ──────────────
+*
+* `move` is the historical pass. `seal` and `gallery` are the SAME walk with a
+* different row predicate and a different per-row action, deliberately not a
+* second mover: the walk, the cursor, the tie-bridging and the failure
+* accounting are the hard parts and they are already right here.
+*
+*   - `seal` exists because a row with `locationId: NULL` means "wherever
+*     `eventMedia` points NOW" (`media-store.ts:396`). A repoint moves that
+*     pointer and every NULL row starts reading from the new disk while its
+*     bytes are on the old one. `seal` is a ROW-ONLY pass — no blob is read,
+*     written or deleted — that nails those rows to the location they are
+*     actually on before anything repoints.
+*   - `gallery` is the inverse selection of `move`: only the retention-exempt
+*     enrolled-gallery rows, which `move` skips on purpose (D197).
+*/
 var PAGE_SIZE = 200;
 var DEFAULT_THROTTLE_MBPS = 40;
 /** What a pass touches, reported on the job so an ops-log row says which of the
@@ -44889,6 +45537,59 @@ var LOCATION_ID_FIELD = "locationId";
 */
 var SEAL_BATCH_SIZE = 500;
 /**
+* Rows one CENSUS may visit before it answers `null`.
+*
+* A census is the read-only question behind `storageMigration.residue` — "how
+* much would a pass still act on". It is NOT the pass: a pass walks the whole
+* collection because it has to touch every row, and pays for that walk once,
+* under an operator's explicit start.
+*
+* 20 000 rows is 100 round trips at {@link PAGE_SIZE} — ~26 ms of engine time
+* on a healthy store, and a ceiling that cannot become the cluster's queue. A
+* collection larger than this is one a WALK cannot answer questions about; the
+* honest reply is "I could not answer" (D295), and the structural fix is an
+* indexed `COUNT(*)`, which needs `locationId` sealed first and is deliberately
+* not smuggled in behind a bound.
+*/
+var MEDIA_CENSUS_ROW_BUDGET = 2e4;
+/**
+* Wall clock one CENSUS may spend before it answers `null`.
+*
+* The row budget bounds a healthy store; this one bounds a sick store, where
+* 100 round trips at a 16 s queue depth is 27 minutes. Read through
+* `deps.now`, so it is deterministic under test and does not need a timer.
+*/
+var MEDIA_CENSUS_DEADLINE_MS = 2e4;
+/**
+* What one census may spend, and what it has spent.
+*
+* Explicit rather than folded into the `stop` callback: `stop` means "someone
+* asked me to stop" and the budget means "I am not allowed to continue", and a
+* pass passes `null` here because a pass is allowed to walk the whole
+* collection. Two concepts, two parameters — the walk that ran unbounded for
+* a day did so because ONE `stop: () => false` stood for both.
+*/
+var CensusBudget = class {
+	now;
+	maxRows;
+	rows = 0;
+	deadlineAt;
+	constructor(now, maxRows, maxMs) {
+		this.now = now;
+		this.maxRows = maxRows;
+		this.deadlineAt = now() + maxMs;
+	}
+	get rowsVisited() {
+		return this.rows;
+	}
+	/** Visit one row. `true` means the budget is spent and the census must stop. */
+	spend() {
+		this.rows += 1;
+		if (this.rows > this.maxRows) return true;
+		return this.rows % PAGE_SIZE === 0 && this.now() >= this.deadlineAt;
+	}
+};
+/**
 * True when the row names NO location — the population `seal` exists for.
 *
 * Deliberately NOT `mediaRowLocation(data) === DEFAULT_MEDIA_LOCATION`: that
@@ -44945,9 +45646,26 @@ function selectsRow(mode, toLocationId, data, isRetrain) {
 var MediaRelocateEngine = class {
 	deps;
 	jobs = /* @__PURE__ */ new Map();
+	/** Censuses in flight, keyed by the QUESTION — see {@link countSelectable}. */
+	censuses = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/**
+	* Retire every census in flight. They answer `null`, and stop reading.
+	*
+	* @returns how many were retired.
+	*/
+	cancelCensuses(reason) {
+		const retired = this.censuses.size;
+		if (retired === 0) return 0;
+		for (const run of this.censuses.values()) run.abort();
+		this.deps.logger.info("media relocate: standing censuses retired", { meta: {
+			retired,
+			reason
+		} });
+		return retired;
+	}
 	list() {
 		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
 	}
@@ -45046,6 +45764,7 @@ var MediaRelocateEngine = class {
 	}
 	start(input) {
 		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a media relocation is already running (${j.jobId})`);
+		this.cancelCensuses("a relocate pass started");
 		const job = {
 			jobId: this.deps.newId(),
 			state: "running",
@@ -45116,9 +45835,31 @@ var MediaRelocateEngine = class {
 	* must not be allowed to make (D295).
 	*/
 	async countSelectable(input) {
-		return this.countSelected(input.mode ?? "move", input.toLocationId, () => false);
+		const mode = input.mode ?? "move";
+		const key = `${mode}|${input.toLocationId}`;
+		const running = this.censuses.get(key);
+		if (running !== void 0) return running.promise;
+		let aborted = false;
+		const budget = new CensusBudget(this.deps.now, MEDIA_CENSUS_ROW_BUDGET, MEDIA_CENSUS_DEADLINE_MS);
+		const promise = this.countSelected(mode, input.toLocationId, () => aborted, budget).finally(() => {
+			this.censuses.delete(key);
+		});
+		this.censuses.set(key, {
+			promise,
+			abort: () => {
+				aborted = true;
+			}
+		});
+		return promise;
 	}
-	async countSelected(mode, toLocationId, stop) {
+	/**
+	* @param stop  someone asked this walk to stop (an operator cancel, or
+	*   {@link cancelCensuses}). Answers `null`.
+	* @param budget what this walk is allowed to spend, or `null` for a PASS —
+	*   a pass walks the whole collection because it must touch every row, and
+	*   an operator started it explicitly.
+	*/
+	async countSelected(mode, toLocationId, stop, budget) {
 		try {
 			if (mode === "seal") {
 				let sealable = 0;
@@ -45135,7 +45876,25 @@ var MediaRelocateEngine = class {
 			for (const collection of collectionsFor(mode)) {
 				const isRetrain = collection.name === RETRAIN_FRAMES_COLLECTION;
 				for await (const row of this.pageRows(collection.name, collection.order)) {
-					if (stop()) return null;
+					if (stop()) {
+						this.deps.logger.warn("media relocate: census stopped before it finished — reporting the residue as unknown, not as empty", { meta: {
+							mode,
+							toLocationId,
+							collection: collection.name
+						} });
+						return null;
+					}
+					if (budget !== null && budget.spend()) {
+						this.deps.logger.warn("media relocate: census exceeded its budget — this collection is larger than a walk can answer", { meta: {
+							mode,
+							toLocationId,
+							collection: collection.name,
+							rowsVisited: budget.rowsVisited,
+							rowBudget: MEDIA_CENSUS_ROW_BUDGET,
+							deadlineMs: MEDIA_CENSUS_DEADLINE_MS
+						} });
+						return null;
+					}
 					if (selectsRow(mode, toLocationId, row.data, isRetrain)) rows++;
 				}
 			}
@@ -45161,7 +45920,7 @@ var MediaRelocateEngine = class {
 			*  rows in silence reads as "there were none", which is how a migration
 			*  gets believed. */
 			let pathlessRows = 0;
-			job.filesTotal = (await this.countSelected(job.mode, job.toLocationId, () => job.cancelRequested))?.rows ?? null;
+			job.filesTotal = (await this.countSelected(job.mode, job.toLocationId, () => job.cancelRequested, null))?.rows ?? null;
 			if (job.mode === "seal") {
 				for (const collection of collectionsFor(job.mode)) {
 					if (job.cancelRequested) break;
@@ -52690,6 +53449,50 @@ var IdentityStore = class {
 			key: id
 		});
 	}
+	/**
+	* `identityId → name` for exactly the identities asked about.
+	*
+	* The decorating half of a face or plate page needs a NAME per referenced
+	* identity, and it used to get it by reading the whole `identities`
+	* collection — unbounded, unprojected, on every 30 s poll of
+	* `faceGallery.listRecentFaces`, and again on every `getFaceByTrack`. The
+	* table is small (4 rows on the live hub on 2026-08-31) so the bytes were
+	* never the problem; the SHAPE was. It is a second question whose cost is
+	* proportional to a collection, asked on a timer, to answer a question about
+	* a page — and it carried no `limit`, so past
+	* `SETTINGS_QUERY_DEFAULT_ROW_CAP` it would have handed back a name map
+	* missing entries, shape-identical to a complete one (D320).
+	*
+	* **An empty request costs no round trip at all.** With
+	* `filter: 'unassigned'` — the view the operator lives in — a page
+	* references no identity, and the honest number of queries for that is zero.
+	* `whereIn` with an empty list matches nothing, so asking anyway would be an
+	* RPC to be told what the caller already knew.
+	*
+	* A cache belongs in the owner of the fact, and this store IS the owner —
+	* but a name here changes only when the operator renames, through this same
+	* store, and the read is now one indexed `IN` over at most a page's worth of
+	* ids. There is nothing left to cache that would not be a second authority
+	* over a fact one round trip away (D224).
+	*/
+	async namesFor(identityIds) {
+		const ids = [...new Set(identityIds)];
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.store.query.query({
+			collection: IDENTITIES_COLLECTION,
+			columns: ["name"],
+			filter: {
+				whereIn: { id: ids },
+				limit: ids.length
+			}
+		});
+		const names = /* @__PURE__ */ new Map();
+		for (const r of rows) {
+			const name = r.data["name"];
+			if (typeof name === "string") names.set(r.id, name);
+		}
+		return names;
+	}
 	async listIdentities() {
 		return (await this.store.query.query({
 			collection: IDENTITIES_COLLECTION,
@@ -53231,13 +54034,55 @@ var PLATE_COLUMNS = [
 		type: "JSON"
 	}
 ];
-var PLATE_INDEXES = [{
-	name: "idx_plates_device_ts",
-	columns: ["deviceId", "timestamp"]
-}, {
-	name: "idx_plates_track",
-	columns: ["trackId"]
-}];
+/**
+* What the gallery orders by, and what the vehicle-scoped read filters on.
+*
+* The face twin's `EXPLAIN QUERY PLAN` measurement applies verbatim: without an
+* index on `timestamp`, `ORDER BY timestamp DESC LIMIT 500` is
+* `SCAN + USE TEMP B-TREE FOR ORDER BY` — the read was already BOUNDED at 200,
+* and still sorted the whole table to produce the newest N. A bound caps what
+* comes back; only an ordered index caps what is read.
+*/
+var PLATE_INDEXES = [
+	{
+		name: "idx_plates_device_ts",
+		columns: ["deviceId", "timestamp"]
+	},
+	{
+		name: "idx_plates_track",
+		columns: ["trackId"]
+	},
+	{
+		name: "idx_plates_ts",
+		columns: ["timestamp"]
+	},
+	{
+		name: "idx_plates_vehicle_ts",
+		columns: ["recognizedVehicleId", "timestamp"]
+	}
+];
+/**
+* The widest plate window a single read may materialise before it REFUSES.
+*
+* The corpus reads (`searchPlates`, `suggestPlateClusters`) are genuinely
+* corpus-shaped — fuzzy text distance is not a predicate — so they cannot be
+* narrowed the way the gallery list was. What they CAN do is stop lying: they
+* carried no `limit` at all, so the engine imposed
+* `SETTINGS_QUERY_DEFAULT_ROW_CAP` and handed back the first 2 000 rows with a
+* WARN no caller can see. A search over the newest 2 000 of 50 000 plates and a
+* search over all of them are the same array (D320 R3).
+*
+* 10 000 mirrors the faces ceiling and stays under the engine's hard cap so the
+* engine never truncates first.
+*/
+var PLATE_WINDOW_MAX_ROWS = 1e4;
+/** A corpus read whose window is wider than {@link PLATE_WINDOW_MAX_ROWS}. */
+var PlateWindowTooWideError = class extends Error {
+	constructor(rows) {
+		super(`plate window exceeds ${String(PLATE_WINDOW_MAX_ROWS)} rows (read ${String(rows)}) — refusing to answer with the part that fit`);
+		this.name = "PlateWindowTooWideError";
+	}
+};
 var PlateStore = class {
 	store;
 	logger;
@@ -53302,18 +54147,53 @@ var PlateStore = class {
 			}
 		})).map((r) => this.normalizeRow(r));
 	}
-	/** List ALL recent plate reads across devices, newest first. */
+	/**
+	* List ALL recent plate reads across devices, newest first.
+	*
+	* The corpus read, for the two passes whose question is not a predicate
+	* (fuzzy text search, text clustering). It carries an explicit `limit` and
+	* REFUSES past it rather than handing back the part that fit: without one the
+	* engine imposed its own cap and truncated silently, and a search over the
+	* newest 2 000 plates looks exactly like a search over all of them.
+	*/
 	async listAllRecentPlates(input) {
-		return (await this.store.query.query({
+		const bounded = input.limit !== void 0;
+		const rows = await this.store.query.query({
 			collection: PLATES_COLLECTION,
 			filter: {
 				orderBy: {
 					field: "timestamp",
 					direction: "desc"
 				},
-				...input.limit !== void 0 ? { limit: input.limit } : {}
+				limit: bounded ? input.limit ?? 0 : 10001
 			}
-		})).map((r) => this.normalizeRow(r));
+		});
+		if (!bounded && rows.length > 1e4) throw new PlateWindowTooWideError(rows.length);
+		return rows.map((r) => this.normalizeRow(r));
+	}
+	/**
+	* Every plate row currently attributed to a vehicle, id only.
+	*
+	* `deleteVehicle` detaches these before the vehicle goes. It used to list the
+	* WHOLE buffer and compare in JS — the `deleteIdentity` defect verbatim, and
+	* past the engine's row cap it would detach the plates that fit and leave the
+	* rest pointing at a vehicle that no longer exists.
+	*/
+	async listPlateIdsForVehicle(vehicleId) {
+		const rows = await this.store.query.query({
+			collection: PLATES_COLLECTION,
+			columns: ["deviceId"],
+			filter: {
+				where: { recognizedVehicleId: vehicleId },
+				orderBy: {
+					field: "timestamp",
+					direction: "desc"
+				},
+				limit: 10001
+			}
+		});
+		if (rows.length > 1e4) throw new PlateWindowTooWideError(rows.length);
+		return rows.map((r) => r.id);
 	}
 	async get(plateId) {
 		const raw = await this.store.get.query({
@@ -55973,6 +56853,38 @@ var VehicleStore = class {
 			key: id
 		});
 	}
+	/**
+	* `vehicleId → name` for exactly the vehicles asked about — the plate twin of
+	* `IdentityStore.namesFor`, and it exists for the same reason.
+	*
+	* The decorating half of a plate page needs a NAME per referenced vehicle,
+	* and it got it by reading the whole `vehicles` collection: unbounded,
+	* unprojected, on every 30 s poll of `plateGallery.listPlates` and again on
+	* every `getPlateByTrack` and `searchPlates`. The live table holds **0 rows**
+	* — the bytes were never the point. The shape was: a question proportional to
+	* a collection, on a timer, to decorate a page.
+	*
+	* An empty request costs no round trip: `whereIn` over an empty list matches
+	* nothing, so asking would be an RPC to be told what the caller knew.
+	*/
+	async namesFor(vehicleIds) {
+		const ids = [...new Set(vehicleIds)];
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.store.query.query({
+			collection: VEHICLES_COLLECTION,
+			columns: ["name"],
+			filter: {
+				whereIn: { id: ids },
+				limit: ids.length
+			}
+		});
+		const names = /* @__PURE__ */ new Map();
+		for (const r of rows) {
+			const name = r.data["name"];
+			if (typeof name === "string") names.set(r.id, name);
+		}
+		return names;
+	}
 	async listVehicles() {
 		return (await this.store.query.query({
 			collection: VEHICLES_COLLECTION,
@@ -62944,6 +63856,50 @@ var ZoneAnalyticsProvider = class {
 		return this.snapshots.get(deviceId) ?? await this.hydrateFromRegistry(deviceId);
 	}
 	/**
+	* The same snapshot, for a SET of cameras, in one round trip.
+	*
+	* The Events page's Stationary section polls this every 15 s for every
+	* selected camera. Fanned out client-side that is one browser → hub →
+	* post-analysis round trip per camera to read a `Map.get`; the answer costs
+	* nothing and the transport costs everything. The per-device work here is
+	* unchanged — the same live snapshot, the same parked-registry hydration when
+	* there is no live one — and it runs concurrently inside the owner.
+	*
+	* **Three outcomes stay three.** A camera with a reading, a camera with none
+	* yet (`snapshot: null`, `read: 'read'`), and a camera the owner could not
+	* answer for (`read: 'unreadable'`). The hydration reaches a durable store
+	* and can throw; letting that throw become `snapshot: null` would render an
+	* unread camera as a camera with nothing parked, which is a definite claim
+	* nobody made.
+	*/
+	async getCurrentSnapshotBatch({ deviceIds }) {
+		return Promise.all(deviceIds.map(async (deviceId) => {
+			const live = this.snapshots.get(deviceId);
+			if (live !== void 0) return {
+				deviceId,
+				read: "read",
+				snapshot: live
+			};
+			try {
+				return {
+					deviceId,
+					read: "read",
+					snapshot: await this.hydrateFromRegistry(deviceId)
+				};
+			} catch (err) {
+				this.ctx.logger.warn("occupancy snapshot could not be read", {
+					tags: { deviceId },
+					meta: { error: String(err) }
+				});
+				return {
+					deviceId,
+					read: "unreadable",
+					snapshot: null
+				};
+			}
+		}));
+	}
+	/**
 	* The cameras a LIVE snapshot exists for.
 	*
 	* The Notification Center's occupancy dry-run ("as of now, would this rule
@@ -63286,6 +64242,20 @@ var TIMELAPSE_TRACK_QUERY_LIMIT = 2e3;
 * window rather than a random slice of it.
 */
 var TIMELAPSE_EVENT_QUERY_LIMIT = 1e4;
+var IDLE_MEDIA_RECLAIM = {
+	running: false,
+	mode: null,
+	totalExamined: 0,
+	totalEligible: 0,
+	totalReclaimed: 0,
+	totalBytesReclaimed: 0,
+	totalRefused: 0,
+	devicesDone: 0,
+	complete: null,
+	startedAtMs: null,
+	finishedAtMs: null,
+	error: null
+};
 var PIPELINE_ANALYTICS_ADDON_ID = "pipeline-analytics";
 /** Artefact index ⇄ shelf reconcile cadence. Hourly: the two only drift on the
 *  bounds' own timescale (14 days / 2000 entries / 2 GiB). */
@@ -64401,9 +65371,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	*  In RAM like the audit's: the pass is resumable from zero at no cost
 	*  beyond re-walking a head that is already empty. */
 	mediaReclaimCursors = /* @__PURE__ */ new Map();
-	/** Single-flight latch — two concurrent passes would double the disk
-	*  pressure the pacing exists to avoid. */
-	mediaReclaimRunning = false;
+	/** Live state of the detached debug-media reclaim — see `reclaimDebugMedia`. */
+	mediaReclaimState = { ...IDLE_MEDIA_RECLAIM };
 	/**
 	* The vector-index leg's resume cursor, kept in its OWN field.
 	*
@@ -64843,6 +65812,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		const routed = createLocationAwareMediaStorage({
 			base: storage,
 			defaultLocation: "eventMedia",
+			galleryLocationId: GALLERY_MEDIA_LOCATION,
+			galleryRoot: path.join(this.ctx.dataDir, "gallery"),
 			resolveRoot: (locationId) => this.ctx.api.storage.resolve.query({
 				location: locationId,
 				relativePath: ""
@@ -65502,6 +66473,43 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			},
 			resolveArtifactUrl: async (artifactId) => await this.ncArtifactPlane?.mintUrl(artifactId) ?? null,
 			mintActionUrl: (input) => this.ncActionMintUrl?.(input) ?? Promise.resolve(null),
+			listAddonUpdates: async (nodeId) => {
+				return (await this.ctx.api.addons.listUpdates.query({ nodeId })).filter((update) => !update.isSystem).map((update) => update.name);
+			},
+			applyAddonUpdate: async ({ packageName, nodeId }) => {
+				try {
+					await this.ctx.api.addons.updatePackage.mutate({
+						name: packageName,
+						nodeId
+					});
+					return { ok: true };
+				} catch (err) {
+					return {
+						ok: false,
+						error: errMsg(err)
+					};
+				}
+			},
+			checkServerUpdate: async (nodeId) => {
+				const result = await this.ctx.api.serverManagement.checkServerUpdate.mutate({ nodeId });
+				if (result.error) throw new Error(result.error);
+				return result.updateAvailable;
+			},
+			applyServerUpdate: async ({ nodeId }) => {
+				try {
+					const result = await this.ctx.api.serverManagement.applyServerUpdate.mutate({ nodeId });
+					if (!result.accepted) return {
+						ok: false,
+						error: result.message
+					};
+					return { ok: true };
+				} catch (err) {
+					return {
+						ok: false,
+						error: errMsg(err)
+					};
+				}
+			},
 			readDeviceStates: async (ids) => {
 				const out = /* @__PURE__ */ new Map();
 				for (const id of ids) try {
@@ -66434,19 +67442,6 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	async reconcileGalleryMediaLocation() {
 		const mediaStore = this.mediaStore;
 		if (!mediaStore) return;
-		try {
-			await this.ctx.api.storage.resolve.query({
-				location: GALLERY_MEDIA_LOCATION,
-				relativePath: ""
-			});
-		} catch (err) {
-			this.ctx.logger.error("gallery media location is NOT available — enrolling a face, a plate or a scene reference will FAIL until it is", { meta: {
-				location: GALLERY_MEDIA_LOCATION,
-				error: errMsg(err),
-				hint: "the declaration is seeded when a storage-provider registers; restart this node so the manifest is re-read (D197). Refusing the write is deliberate — the alternative is the footage volume, which is where the last gallery was lost."
-			} });
-			return;
-		}
 		try {
 			const result = await mediaStore.relocateExemptMediaToGallery();
 			if (result.relocated === 0 && result.missing === 0 && result.failed === 0) return;
@@ -70461,6 +71456,36 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			return [];
 		}
 	}
+	/**
+	* `getKeyEvents` for a SET of cameras, in one round trip.
+	*
+	* The Detection Intelligence events feed asked this of every selected camera
+	* on a 30 s timer — N browser → hub → post-analysis round trips for N
+	* independent, already-indexed store queries. The queries are unchanged and
+	* still run per camera (each is `where deviceId` + a `firstSeen` range
+	* against its own index, and `limit` stays PER CAMERA so a busy camera cannot
+	* starve a quiet one of its rows); what collapses is the transport.
+	*
+	* Every requested id gets a row. `getKeyEvents` already degrades to `[]`
+	* rather than throwing, so a per-camera failure is reported exactly as it was
+	* before this method existed — this does not make it worse, and the row
+	* carries the `deviceId` the single method's output never did.
+	*/
+	async getKeyEventsBatch(input) {
+		return Promise.all(input.deviceIds.map(async (deviceId) => {
+			return {
+				deviceId,
+				events: await this.getKeyEvents({
+					deviceId,
+					since: input.since,
+					until: input.until,
+					...input.limit !== void 0 ? { limit: input.limit } : {},
+					...input.minImportance !== void 0 ? { minImportance: input.minImportance } : {},
+					...input.classFilter !== void 0 ? { classFilter: input.classFilter } : {}
+				})
+			};
+		}));
+	}
 	async getAudioEvents(input) {
 		return this.queryFacade.getAudioEvents(input);
 	}
@@ -71485,42 +72510,58 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			"embedding.reembedFaces": async (input) => this.runFaceReembedPass(input),
 			"embedding.reembedFacesStatus": async () => this.getFaceReembedStatus(),
 			"retention.orphanAudit": async (input) => this.runOrphanAuditNow(input),
-			"retention.mediaReclaim": async (input) => this.runMediaReclaimNow(input)
+			"retention.mediaReclaim": async (input) => this.reclaimDebugMedia(input),
+			"retention.mediaReclaimStatus": async () => this.getMediaReclaimStatus()
 		};
 	}
 	/**
-	* One operator-driven debug-media reclaim pass — the entry point behind
-	* `retention.mediaReclaim`.
-	*
-	* DRY RUN BY DEFAULT. Draining the standing 111 GB means running this with
-	* `mode: 'reclaim'` repeatedly until `complete` is true; each run resumes
-	* from the per-device cursors this method keeps, and a run that is cut short
-	* has still only forgotten rows whose blobs it proved gone.
+	* Start a debug-media reclaim pass. DETACHED.
 	*
-	* Single-flight: a second call while a pass is in flight returns
-	* `ran: false` rather than doubling the disk pressure the pacing exists to
-	* avoid.
+	* Returns `{ started }` immediately. The walk is tens of minutes at 2 MB/s;
+	* awaiting it is a timeout, not a verdict. Poll {@link getMediaReclaimStatus}.
+	* Dry-run unless `mode: 'reclaim'`. A second call while one is in flight is
+	* `alreadyRunning`, not a second walk on the same spindle.
 	*/
-	async runMediaReclaimNow(rawInput) {
+	async reclaimDebugMedia(rawInput) {
 		const input = MediaReclaimActionInputSchema.parse(rawInput);
+		if (this.mediaReclaimState.running) {
+			this.ctx.logger.info("debug-media reclaim already running — request ignored");
+			return {
+				started: false,
+				alreadyRunning: true
+			};
+		}
 		const mediaStore = this.mediaStore;
 		const eventStore = this.eventStore;
 		const trackStore = this.trackStore;
-		const empty = {
-			ran: false,
+		if (!mediaStore || !eventStore || !trackStore) {
+			this.ctx.logger.warn("reclaimDebugMedia: analytics stores unavailable");
+			return {
+				started: false,
+				alreadyRunning: false
+			};
+		}
+		this.mediaReclaimState = {
+			...IDLE_MEDIA_RECLAIM,
+			running: true,
 			mode: input.mode,
-			devices: [],
-			totalExamined: 0,
-			totalEligible: 0,
-			totalReclaimed: 0,
-			totalBytesReclaimed: 0,
-			totalRefused: 0,
-			durationMs: 0,
-			complete: false
+			startedAtMs: Date.now()
+		};
+		this.ctx.logger.info("debug-media reclaim starting", { meta: {
+			mode: input.mode,
+			restart: input.restart === true
+		} });
+		this.executeMediaReclaim(input, mediaStore, eventStore, trackStore);
+		return {
+			started: true,
+			alreadyRunning: false
 		};
-		if (!mediaStore || !eventStore || !trackStore) return empty;
-		if (this.mediaReclaimRunning) return empty;
-		this.mediaReclaimRunning = true;
+	}
+	/**
+	* The walk itself. Called DETACHED from {@link reclaimDebugMedia}; never
+	* await this from an RPC.
+	*/
+	async executeMediaReclaim(input, mediaStore, eventStore, trackStore) {
 		try {
 			const limits = {
 				mode: input.mode,
@@ -71538,6 +72579,19 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				scopes,
 				limits,
 				cursors: input.restart === true ? /* @__PURE__ */ new Map() : this.mediaReclaimCursors,
+				onDevice: (device) => {
+					const s = this.mediaReclaimState;
+					if (!s.running) return;
+					this.mediaReclaimState = {
+						...s,
+						totalExamined: s.totalExamined + device.examined,
+						totalEligible: s.totalEligible + device.eligible,
+						totalReclaimed: s.totalReclaimed + device.reclaimed,
+						totalBytesReclaimed: s.totalBytesReclaimed + device.bytesReclaimed,
+						totalRefused: s.totalRefused + device.refused,
+						devicesDone: s.devicesDone + 1
+					};
+				},
 				deps: {
 					page: ({ deviceId, scope, afterMs, limit }) => mediaStore.pageByKindForDevice({
 						deviceId,
@@ -71564,15 +72618,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				bytesReclaimed: report.totalBytesReclaimed,
 				detail: `debug-media reclaim (${scopes.join("+")}): ${report.totalReclaimed} rows, ${report.totalRefused} refused, complete=${report.complete}`
 			});
-			return {
-				ran: true,
-				...report,
-				devices: [...report.devices]
+			this.mediaReclaimState = {
+				...this.mediaReclaimState,
+				running: false,
+				totalExamined: report.totalExamined,
+				totalEligible: report.totalEligible,
+				totalReclaimed: report.totalReclaimed,
+				totalBytesReclaimed: report.totalBytesReclaimed,
+				totalRefused: report.totalRefused,
+				complete: report.complete,
+				finishedAtMs: Date.now()
 			};
-		} finally {
-			this.mediaReclaimRunning = false;
+			this.ctx.logger.info("debug-media reclaim finished", { meta: {
+				mode: report.mode,
+				examined: report.totalExamined,
+				reclaimed: report.totalReclaimed,
+				bytesReclaimed: report.totalBytesReclaimed,
+				complete: report.complete
+			} });
+		} catch (err) {
+			this.mediaReclaimState = {
+				...this.mediaReclaimState,
+				running: false,
+				finishedAtMs: Date.now(),
+				error: err instanceof Error ? err.message : String(err),
+				complete: false
+			};
+			this.ctx.logger.warn("debug-media reclaim failed", { meta: { error: String(err) } });
 		}
 	}
+	/** Progress of the detached reclaim — the only way to observe a long pass. */
+	async getMediaReclaimStatus() {
+		return { ...this.mediaReclaimState };
+	}
 	/** Progress of the detached rebuild — the only way to observe a long pass. */
 	async getObjectEmbeddingRebuildStatus() {
 		const state = this.rebuildState;