@camstack/addon-post-analysis 1.2.272 → 1.2.274

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as TimelapseRuleSchema, $t as array, A as NcConditionDescriptorSchema, At as readDeviceStateFrom, B as NcTaxonomySchema, Bt as zoneAnalyticsCapability, C as MOTION_CLOSE_AFTER_MS, Ct as mayWriteToLocation, D as NC_DEFAULT_SNOOZE_MINUTES, Dt as pickClusterStepModels, E as NC_CONDITION_CATALOG, F as NcScheduleSchema, Ft as storageOccupancyCapability, Gt as createEvent, Ht as BaseAddon, I as NcSnoozeInputSchema, It as subKindsOf, J as SCENE_DIVERGED, Jt as hydrateSchema, K as SCENE_DEFAULT_ANCHOR_THRESHOLD, Kt as customAction, L as NcSnoozeSchema, Lt as systemEventFilterApplies, M as NcRulePatchSchema, Mt as resolveLocationMode, N as NcRuleSchema, Ot as pipelineAnalyticsCapability, P as NcRuleTargetSchema, Pt as sceneMonitorCapability, Q as TimelapseRulePatchSchema, Qt as _enum, R as NcSnoozeSuppressedSchema, Rt as vectorDimFromBase64, St as kebabToCamel, T as NC_ALARM_SYSTEM_EVENT_KINDS, Tt as occupancyScope, U as RECORDING_EXPORT_MAX_READ_BYTES, Ut as CamProfileSchema, V as OpsLogEntrySchema, Vt as errMsg$1, W as RetrainStatusSchema, Wt as DeviceType, X as TIMELAPSE_DENSE_FLOOR_SEC, Xt as nodePin, Y as SceneMonitorSchema, Yt as isDeviceScopedCap, Z as TimelapseRuleInputSchema, Zt as sleep$1, _ as FULL_IMAGE_BBOX, _t as isDetectionMacroClass, a as CLUSTER_MODEL_SCOPED_STEPS, an as partialRecord, at as audioMetricsCapability, b as MAX_ARCHIVED_DEBUG_NOTES, bt as isScheduleActive, cn as unknown, ct as cosineSimilarity$1, dt as encodeVectorBase64, en as boolean, et as TrackSourceSchema, f as DeclaredDevices, ft as evaluateSensorEdge, g as FIRST_LEVEL_MACRO_CLASSES, h as EVENT_PAD_MS, ht as failureContributionCapability, i as BirthDecisionRecordSchema, in as object, it as assertTimelapseCadences, j as NcRuleInputSchema, jt as readTimelapseGeneratedAt, k as NC_TAXONOMY, kt as plateGalleryCapability, ln as EventCategory, lt as deriveRecordingMode, m as EVENT_OWNER_TYPES, mt as faceGalleryCapability, n as ArchivedDebugNoteSchema, nn as literal, nt as addonWidgetsSourceCapability, o as COCO_TO_MACRO, on as record, ot as audioModeOf, p as EVENT_KIND_BY_CAP, pt as evictionPolicyOfLocation, q as SCENE_DEFAULT_UNCOVERED_POLICY, qt as defineCustomActions, r as BaseDevice, rn as number, rt as alarmPanelCapability, s as DEFAULT_EVENT_COLOR, sn as string, st as buildEventKindDescriptor, t as AUDIO_MACRO_LABELS, tn as discriminatedUnion, tt as VISIT_MERGE_GAP_MS, u as DETECTION_MACRO_CLASSES, v as FailureCounters, vt as isEventOwnerType, w as MediaFileKindEnum, wt as notificationRulesCapability, x as MAX_BIRTH_DECISION_RECORDS, xt as isSourceCap, y as LabelAttributionSchema, yt as isMediaOwnerType, z as NcSystemEventKindSchema, zt as videoclipsCapability } from "../dist-4BOLDrB1.mjs";
+import { $ as TimelapseRuleSchema, $t as discriminatedUnion, A as NcRuleInputSchema, At as readTimelapseGeneratedAt, B as OpsLogEntrySchema, Bt as BaseAddon, C as MediaFileKindEnum, Ct as notificationRulesCapability, Dt as pipelineAnalyticsCapability, E as NC_DEFAULT_SNOOZE_MINUTES, Et as pickClusterStepModels, F as NcSnoozeInputSchema, Ft as subKindsOf, Gt as defineCustomActions, H as RECORDING_EXPORT_MAX_READ_BYTES, Ht as DeviceType, I as NcSnoozeSchema, It as systemEventFilterApplies, J as SCENE_DIVERGED, Jt as nodePin, K as SCENE_DEFAULT_ANCHOR_THRESHOLD, Kt as hydrateSchema, L as NcSnoozeSuppressedSchema, Lt as vectorDimFromBase64, M as NcRuleSchema, N as NcRuleTargetSchema, Nt as sceneMonitorCapability, O as NC_TAXONOMY, Ot as plateGalleryCapability, P as NcScheduleSchema, Pt as storageOccupancyCapability, Q as TimelapseRulePatchSchema, Qt as boolean, R as NcSystemEventKindSchema, Rt as zoneAnalyticsCapability, S as MOTION_CLOSE_AFTER_MS, St as mayWriteToLocation, T as NC_CONDITION_CATALOG, U as RECORDING_SOURCE_CAMSTACK_ADDON, Ut as createEvent, Vt as CamProfileSchema, W as RetrainStatusSchema, Wt as customAction, X as TIMELAPSE_DENSE_FLOOR_SEC, Xt as _enum, Y as SceneMonitorSchema, Yt as sleep$1, Z as TimelapseRuleInputSchema, Zt as array, _ as FailureCounters, _t as isEventOwnerType, a as CLUSTER_MODEL_SCOPED_STEPS, an as string, at as audioModeOf, b as MAX_BIRTH_DECISION_RECORDS, bt as isSourceCap, ct as deriveRecordingMode, dt as evaluateSensorEdge, en as literal, et as TrackSourceSchema, f as DeclaredDevices, ft as evictionPolicyOfLocation, g as FULL_IMAGE_BBOX, gt as isDetectionMacroClass, h as FIRST_LEVEL_MACRO_CLASSES, i as BirthDecisionRecordSchema, in as record, it as audioMetricsCapability, j as NcRulePatchSchema, jt as resolveLocationMode, k as NcConditionDescriptorSchema, kt as readDeviceStateFrom, m as EVENT_OWNER_TYPES, mt as failureContributionCapability, n as ArchivedDebugNoteSchema, nn as object, nt as alarmPanelCapability, o as COCO_TO_MACRO, on as unknown, ot as buildEventKindDescriptor, p as EVENT_KIND_BY_CAP, pt as faceGalleryCapability, q as SCENE_DEFAULT_UNCOVERED_POLICY, qt as isDeviceScopedCap, r as BaseDevice, rn as partialRecord, rt as assertTimelapseCadences, s as DEFAULT_EVENT_COLOR, sn as EventCategory, st as cosineSimilarity$1, t as AUDIO_MACRO_LABELS, tn as number, tt as addonWidgetsSourceCapability, u as DETECTION_MACRO_CLASSES, ut as encodeVectorBase64, v as LabelAttributionSchema, vt as isMediaOwnerType, w as NC_ALARM_SYSTEM_EVENT_KINDS, wt as occupancyScope, xt as kebabToCamel, y as MAX_ARCHIVED_DEBUG_NOTES, yt as isScheduleActive, z as NcTaxonomySchema, zt as errMsg$1 } from "../dist-DDko6srJ.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -41691,6 +41691,160 @@ var TrackResidentState = class {
 		if (resident.rasterFallback === void 0) resident.rasterFallback = fallback;
 	}
 };
+/**
+* The shipped limits.
+*
+* `minTracks` 12 / `minSamples` 200: the four live cameras sampled above
+* produced 697–8739 samples from 42–51 tracks in a single 60-track read, so a
+* camera that cannot clear these has genuinely not been watched enough.
+* `maxTracks` 200 bounds the read: the `positions` blob averages ~10 kB a row
+* (`track-store.ts`), so this pass is ~2 MB of JSON at its worst.
+*/
+var DEFAULT_STILLNESS_CALIBRATION_LIMITS = {
+	minTracks: 12,
+	minSamples: 200,
+	maxTracks: 200,
+	minIntervalSec: .02,
+	maxIntervalSec: 3,
+	quantile: .25,
+	floorFactor: .02,
+	ceilFactor: .25,
+	minBar: .001,
+	maxBar: 1
+};
+/** Linear-interpolated quantile. `NaN` for an empty list — never 0, which
+*  would read as a measured zero (D393). */
+function quantileOf(values, p) {
+	if (values.length === 0) return NaN;
+	const sorted = [...values].sort((a, b) => a - b);
+	const idx = (sorted.length - 1) * Math.min(Math.max(p, 0), 1);
+	const lo = Math.floor(idx);
+	const hi = Math.ceil(idx);
+	const at = sorted[lo];
+	const next = sorted[hi];
+	if (at === void 0 || next === void 0) return NaN;
+	return at + (next - at) * (idx - lo);
+}
+/**
+* Per-sample centroid speeds for a camera, in subject-box-diagonals per second.
+*
+* A pair of consecutive positions contributes a sample only when the interval
+* between them is inside `[minIntervalSec, maxIntervalSec]` and the later box
+* has a positive diagonal. A gap outside that band is a session boundary or a
+* duplicate read, not a measurement of how fast anything travelled; a box with
+* no size is unknown geometry, and unknown is never a sample.
+*/
+function collectStillnessSamples(tracks, limits) {
+	const speeds = [];
+	const intervals = [];
+	const diagonals = [];
+	let trackCount = 0;
+	const read = tracks.slice(0, limits.maxTracks);
+	for (const track of read) {
+		const positions = [...track.positions].sort((a, b) => a.timestamp - b.timestamp);
+		let contributed = false;
+		for (let i = 1; i < positions.length; i++) {
+			const prev = positions[i - 1];
+			const cur = positions[i];
+			if (prev === void 0 || cur === void 0) continue;
+			const dtSec = (cur.timestamp - prev.timestamp) / 1e3;
+			if (dtSec < limits.minIntervalSec || dtSec > limits.maxIntervalSec) continue;
+			const diagonal = Math.hypot(cur.bbox.w, cur.bbox.h);
+			if (!(diagonal > 0)) continue;
+			const travelled = Math.hypot(cur.x - prev.x, cur.y - prev.y);
+			speeds.push(travelled / diagonal / dtSec);
+			intervals.push(dtSec);
+			diagonals.push(diagonal);
+			contributed = true;
+		}
+		if (contributed) trackCount++;
+	}
+	return {
+		speeds,
+		intervals,
+		diagonals,
+		trackCount,
+		tracksRead: read.length
+	};
+}
+function measure$1(samples) {
+	return {
+		trackCount: samples.trackCount,
+		sampleCount: samples.speeds.length,
+		p25: quantileOf(samples.speeds, .25),
+		p50: quantileOf(samples.speeds, .5),
+		p90: quantileOf(samples.speeds, .9),
+		medianIntervalSec: quantileOf(samples.intervals, .5),
+		medianSubjectDiagonalPx: quantileOf(samples.diagonals, .5)
+	};
+}
+/**
+* Choose this camera's stillness speed bar, or refuse with a named reason.
+*
+* The order of the gates is the order of the questions: is there anything at
+* all, is it enough tracks, is it enough samples, and did anything on this
+* camera ever actually move. The last one is not pedantry — the whole method
+* scales the bar against the camera's own travel, so with no travel there is
+* nothing to scale against and the default is the honest answer.
+*/
+function calibrateStillnessSpeed(samples, limits) {
+	const measurement = measure$1(samples);
+	if (samples.tracksRead === 0) return {
+		ok: false,
+		reason: "no-tracks",
+		measurement
+	};
+	if (samples.trackCount < limits.minTracks) return {
+		ok: false,
+		reason: "too-few-tracks",
+		measurement
+	};
+	if (samples.speeds.length < limits.minSamples) return {
+		ok: false,
+		reason: "too-few-samples",
+		measurement
+	};
+	if (!(measurement.p90 > 0)) return {
+		ok: false,
+		reason: "no-motion-evidence",
+		measurement
+	};
+	const rawBar = quantileOf(samples.speeds, limits.quantile);
+	const floor = measurement.p90 * limits.floorFactor;
+	const ceiling = measurement.p90 * limits.ceilFactor;
+	let bar = rawBar;
+	let clampedBy = "none";
+	if (bar < floor) {
+		bar = floor;
+		clampedBy = "floor";
+	} else if (bar > ceiling) {
+		bar = ceiling;
+		clampedBy = "ceiling";
+	}
+	if (bar < limits.minBar) {
+		bar = limits.minBar;
+		clampedBy = "min";
+	} else if (bar > limits.maxBar) {
+		bar = limits.maxBar;
+		clampedBy = "max";
+	}
+	return {
+		ok: true,
+		bar,
+		rawBar,
+		clampedBy,
+		measurement
+	};
+}
+/** One line an operator can read: what was measured, from how much, and what
+*  rule produced the stored number. Kept short — it rides the settings blob. */
+function describeStillnessCalibration(outcome) {
+	const m = outcome.measurement;
+	const n = (v) => Number.isFinite(v) ? v.toFixed(4) : "unknown";
+	const evidence = `${m.sampleCount} samples / ${m.trackCount} tracks, p25 ${n(m.p25)}, p50 ${n(m.p50)}, p90 ${n(m.p90)} subject-diagonals/s`;
+	if (!outcome.ok) return `refused (${outcome.reason}) — ${evidence}`;
+	return `bar ${n(outcome.bar)} (raw ${n(outcome.rawBar)}, clamp ${outcome.clampedBy}) — ${evidence}`;
+}
 //#endregion
 //#region src/pipeline-analytics/pipeline/plate-clustering.ts
 /**
@@ -47641,389 +47795,180 @@ async function retentionScopeDeviceIds(deps, onError) {
 	return [...ids];
 }
 //#endregion
-//#region src/pipeline-analytics/videoclip-visits.ts
-/**
-* Videoclip visits — the grain a clip should have on an events-mode camera.
-*
-* Disk writes one fMP4 per ffmpeg roll (~8–12 s). The recorder calendar merges
-* only gaps ≤ 5 s, so a single pantry walk shows up as several availability
-* ranges with ~8 s GOP holes between them. Analytics then mints one 15 s clip
-* per motion heartbeat. A *visit* is the keep-window those fragments belong
-* to: cluster availability with {@link VISIT_MERGE_GAP_MS}, annotate with
-* overlapping events. No second copy of the media; the files stay the source
-* of truth.
-*/
-/** Synthetic event-id slot in `analytics:<start>:<end>:<id>` for a visit clip. */
-var VISIT_EVENT_ID = "visit";
-function clusterFootageVisits(ranges, gapMs = VISIT_MERGE_GAP_MS) {
-	if (ranges.length === 0) return [];
-	const sorted = [...ranges].toSorted((a, b) => a.startMs - b.startMs);
-	const visits = [];
-	let pieces = [sorted[0]];
-	let endMs = sorted[0].endMs;
-	for (let i = 1; i < sorted.length; i++) {
-		const next = sorted[i];
-		if (next.startMs <= endMs + gapMs) {
-			pieces.push(next);
-			endMs = Math.max(endMs, next.endMs);
-			continue;
-		}
-		visits.push(finishVisit(pieces, endMs));
-		pieces = [next];
-		endMs = next.endMs;
-	}
-	visits.push(finishVisit(pieces, endMs));
-	return visits;
-}
-function finishVisit(pieces, endMs) {
-	const holes = [];
-	for (let i = 1; i < pieces.length; i++) {
-		const prevEnd = pieces[i - 1].endMs;
-		const nextStart = pieces[i].startMs;
-		if (nextStart > prevEnd) holes.push({
-			startMs: prevEnd,
-			endMs: nextStart
-		});
-	}
-	return {
-		startMs: pieces[0].startMs,
-		endMs,
-		ranges: pieces,
-		holes
-	};
-}
-var KIND_ORDER = [
-	"object",
-	"motion",
-	"audio"
-];
-function eventOverlapsVisit(event, visit, pad) {
-	if (event.timestamp >= visit.startMs && event.timestamp <= visit.endMs) return true;
-	const windowStart = event.timestamp - pad.preMs;
-	const windowEnd = event.timestamp + pad.postMs;
-	return windowStart < visit.endMs && windowEnd > visit.startMs;
-}
-function dominantKind(attached) {
-	for (const kind of KIND_ORDER) if (attached.some((a) => a.kind === kind)) return kind;
-	return "motion";
-}
+//#region src/pipeline-analytics/stillness-calibration-actions.ts
 /**
-* The instant a recorded still can actually be decoded inside a visit: the
-* midpoint of its LONGEST contiguous range.
+* stillness-calibration-actions — "measure this camera's own stillness scale".
+*
+* ## Why an `addons.custom` action and not a cap method
+*
+* Same reason as `face.rescoreTrack` beside it: a cap method's wire schema
+* lives in `@camstack/types`, which travels inside the `@camstack/server`
+* closure, so a new one is not callable until a server train ships. Here the
+* schema lives in this addon's own dist and the hub forwards an opaque
+* envelope, so `camstack deploy` is the whole delivery.
+*
+* ## Why `apply` is explicit and not a fallback
 *
-* NOT the midpoint of the visit. A visit spans its holes by construction (it is
-* ranges glued across gaps up to `VISIT_MERGE_GAP_MS`), so the naive midpoint
-* lands in dead air roughly as often as not and the recorder's still route
-* answers 204 for a visit with plenty of footage.
+* A calibration run READS recorded tracks and does arithmetic. Applying it
+* WRITES the camera's settings and changes what the tracker calls settled from
+* the next frame on. Those are different enough in consequence that a button
+* labelled "calibrate" must not choose between them on the operator's behalf —
+* the run reports, the operator applies. A REFUSED run never writes the bar
+* whatever `apply` says; it writes only the note, so the refusal and its reason
+* are visible in the form instead of being a toast that scrolls away.
 */
-function stillInstantMs(ranges) {
-	let best;
-	for (const range of ranges) if (best === void 0 || range.endMs - range.startMs > best.endMs - best.startMs) best = range;
-	if (best === void 0) return void 0;
-	return Math.floor((best.startMs + best.endMs) / 2);
-}
+/** Mirrors `StillnessCalibrationRefusal` — kept literal so the wire schema is
+*  self-describing and a new reason is a deliberate edit in both places. */
+var StillnessRefusalSchema = _enum([
+	"no-tracks",
+	"too-few-tracks",
+	"too-few-samples",
+	"no-motion-evidence"
+]);
+var StillnessMeasurementSchema = object({
+	/** Tracks that contributed at least one speed sample. */
+	trackCount: number().int(),
+	/** Tracks the pass actually read, after the cost bound. */
+	tracksRead: number().int(),
+	sampleCount: number().int(),
+	/** Speed quantiles, subject-box-diagonals per second. `null` when there was
+	*  nothing to measure — never 0, which would read as a measured stillness
+	*  (D393). */
+	p25: number().nullable(),
+	p50: number().nullable(),
+	p90: number().nullable(),
+	/** Median gap between stored positions (s) — the camera's real cadence. */
+	medianIntervalSec: number().nullable(),
+	/** Median subject box diagonal (px) the speeds were normalised by. */
+	medianSubjectDiagonalPx: number().nullable()
+});
+var stillnessCalibrationActions = defineCustomActions({ 
 /**
-* The distinct object classes attached to a visit, most frequent first,
-* capped at {@link MAX_CLIP_LABELS}. Empty when nothing classified overlapped
-* — the caller then omits the field so a motion/audio-only visit keeps its
-* kind label instead of carrying an empty array every consumer length-checks.
+* `admin` because it WRITES a per-camera detection threshold when `apply` is
+* set, and because the report describes how the camera's subjects move,
+* which is not a viewer-level fact.
 */
-function dominantLabels(attached) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const a of attached) {
-		if (a.kind !== "object") continue;
-		const name = a.event.className;
-		if (typeof name !== "string" || name.length === 0) continue;
-		counts.set(name, (counts.get(name) ?? 0) + 1);
-	}
-	return [...counts.entries()].toSorted((x, y) => y[1] - x[1]).slice(0, 3).map(([name]) => name);
-}
-function visitsToClips(visits, events, pad, vouched) {
-	const tagged = [
-		...events.object.map((event) => ({
-			kind: "object",
-			event
-		})),
-		...events.motion.map((event) => ({
-			kind: "motion",
-			event
-		})),
-		...events.audio.map((event) => ({
-			kind: "audio",
-			event
-		}))
-	];
-	return visits.map((visit) => {
-		const attached = tagged.filter((t) => eventOverlapsVisit(t.event, visit, pad));
-		const kind = dominantKind(attached);
-		const withThumb = attached.find((a) => a.kind === kind && a.event.mediaUrl && vouched.has(a.event.id)) ?? attached.find((a) => a.event.mediaUrl && vouched.has(a.event.id));
-		const stillAtMs = stillInstantMs(visit.ranges);
-		const labels = dominantLabels(attached);
-		return {
-			id: `analytics:${visit.startMs}:${visit.endMs}:${VISIT_EVENT_ID}`,
-			source: "analytics",
-			kind,
-			timeRange: {
-				startMs: visit.startMs,
-				endMs: visit.endMs
-			},
-			...withThumb?.event.mediaUrl !== void 0 ? { thumbnail: withThumb.event.mediaUrl } : {},
-			...stillAtMs !== void 0 ? { stillAtMs } : {},
-			eventIds: attached.slice(0, 24).map((a) => a.event.id),
-			eventCount: attached.length,
-			holes: [...visit.holes],
-			...labels.length > 0 ? { labels } : {}
-		};
-	}).toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
-}
+"stillness.calibrate": customAction(object({
+	deviceId: number().int(),
+	/** How far back to read. Bounded: this pass parses ~10 kB of trajectory a
+	*  row, so the window is a suggestion and `maxTracks` is the real bound. */
+	sinceHours: number().min(.25).max(720).default(72),
+	/** Hard cost bound on tracks read, newest first. */
+	maxTracks: number().int().min(1).max(1e3).default(200),
+	/**
+	* Write the chosen bar onto the camera. Never implicit, and never done at
+	* all for a refused run.
+	*/
+	apply: boolean().default(false)
+}), object({
+	deviceId: number().int(),
+	/** The window actually read (epoch ms). */
+	since: number().int(),
+	until: number().int(),
+	accepted: boolean(),
+	/** Why it refused. Absent on an accepted run. */
+	reason: StillnessRefusalSchema.optional(),
+	/** The chosen bar, subject-box-diagonals per second. Absent on a refusal —
+	*  never 0, which the settings layer reads as "uncalibrated". */
+	bar: number().optional(),
+	/** The raw quantile before the rails, so the clamp is arguable. */
+	rawBar: number().optional(),
+	clampedBy: _enum([
+		"none",
+		"floor",
+		"ceiling",
+		"min",
+		"max"
+	]).optional(),
+	measurement: StillnessMeasurementSchema,
+	/** The bar this camera was on BEFORE the run — `null` = uncalibrated. Read
+	*  before any write, so the operator sees both numbers. */
+	previousBar: number().nullable(),
+	/** Whether the camera's settings were actually written. */
+	applied: boolean(),
+	/** The one-line note stored on the camera (accepted or refused). */
+	note: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}) });
 //#endregion
-//#region src/pipeline-analytics/videoclips-provider.ts
-/**
-* Default `videoclips` provider — composes recorded footage visits with the
-* analytics event log. A clip is a time-WINDOW over existing footage, never a
-* separate file: `getClipPlayback` resolves to
-* `recording.getPlaybackManifest(startMs, endMs)`.
-*
-* When availability is present the grain is a *visit* (events-mode keep-window
-* clustered at `VISIT_MERGE_GAP_MS`), not one clip per motion heartbeat. The
-* clip id still encodes the window (`analytics:<startMs>:<endMs>:visit`) so
-* playback is self-contained. Without availability (or when that read fails)
-* the provider falls back to per-event padded windows.
-*
-* Pure helpers (`eventsToClips` / `clusterFootageVisits` / `clipIdFor` /
-* `parseClipId`) are unit-tested in isolation; the provider factory wires
-* injected fetch/resolve deps so the compose logic is testable without I/O.
-*/
-var SOURCE = "analytics";
-/** The addon that registers this provider — stamped on its source row. */
-var ANALYTICS_ADDON_ID = "pipeline-analytics";
-/**
-* Backstop on the ANNOTATION read — never on the clip list.
-*
-* A visit is annotated by every event inside it, so the clip `limit` must not
-* reach this fetch (one 615 visit legitimately spans 2 345 motion rows). This
-* bound exists only so a pathological camera-day cannot pull an unbounded page:
-* the store orders `timestamp DESC`, so a truncation drops the OLDEST rows and
-* the EARLIEST visits silently lose their annotations — which is why hitting it
-* is logged, per camera, rather than absorbed.
-*/
-var VISIT_EVENT_FETCH_LIMIT = 5e3;
-function clipIdFor(eventId, startMs, endMs) {
-	return `${SOURCE}:${startMs}:${endMs}:${eventId}`;
-}
-/** Parse a default-provider clip id back into its window + event id. Returns
-*  `null` for any id this provider did not mint (e.g. a native clip id). */
-function parseClipId(clipId) {
-	const parts = clipId.split(":");
-	if (parts.length < 4 || parts[0] !== SOURCE) return null;
-	const startMs = Number(parts[1]);
-	const endMs = Number(parts[2]);
-	if (!Number.isFinite(startMs) || !Number.isFinite(endMs)) return null;
-	const eventId = parts.slice(3).join(":");
-	if (!eventId) return null;
-	return {
-		eventId,
-		startMs,
-		endMs
-	};
-}
-/** Map per-kind events into time-ranged clips, newest-first. Pure. */
-function eventsToClips(events, pad, vouched) {
-	const make = (e, kind) => {
-		const startMs = e.timestamp - pad.preMs;
-		const endMs = e.timestamp + pad.postMs;
-		return {
-			id: clipIdFor(e.id, startMs, endMs),
-			source: SOURCE,
-			kind,
-			timeRange: {
-				startMs,
-				endMs
-			},
-			...e.mediaUrl !== void 0 && vouched.has(e.id) ? { thumbnail: e.mediaUrl } : {}
-		};
-	};
-	return [
-		...events.motion.map((e) => make(e, "motion")),
-		...events.object.map((e) => make(e, "object")),
-		...events.audio.map((e) => make(e, "audio"))
-	].toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
-}
-/** Every id in the three buckets, in the order the composers tag them. */
-function allEventIds(events) {
-	return [
-		...events.motion,
-		...events.object,
-		...events.audio
-	].map((e) => e.id);
-}
-/**
-* Resolve the event ids whose `mediaUrl` is backed by real bytes, mirroring
-* `resolveDefaultEventMedia`: the event's OWN media when it has any, else its
-* owning TRACK's. Up to four batched index reads — one PER EVENT KIND that has
-* any ids (D476: `motion` / `object` / `audio` are separate owner kinds now,
-* so a single combined read can no longer ask "does any of these ids own
-* media" — a motion id and an object id can be the same number post-D474 and
-* are answered by different rows) — plus the track fallback, only over the
-* object events the first pass did not already answer for (motion and audio
-* are trackless roots, so they never need it).
-*
-* THROWS on a failed read. The caller fails closed on the CLAIM and open on the
-* LIST; swallowing here would collapse those two opposite directions into one.
-*/
-async function resolveVouchedEvents(deviceId, events, fetchMediaOwners) {
-	const ownMedia = /* @__PURE__ */ new Set();
-	for (const ownerType of EVENT_OWNER_TYPES) {
-		const ownerIds = events[ownerType].map((e) => e.id);
-		if (ownerIds.length === 0) continue;
-		const found = await fetchMediaOwners({
-			deviceId,
-			ownerKind: ownerType,
-			ownerIds
-		});
-		for (const id of found) ownMedia.add(id);
-	}
-	const residualTracks = [];
-	const seenTracks = /* @__PURE__ */ new Set();
-	for (const event of events.object) {
-		const trackId = event.trackId;
-		if (trackId === void 0 || ownMedia.has(event.id) || seenTracks.has(trackId)) continue;
-		seenTracks.add(trackId);
-		residualTracks.push(trackId);
-	}
-	const trackMedia = residualTracks.length === 0 ? /* @__PURE__ */ new Set() : await fetchMediaOwners({
-		deviceId,
-		ownerKind: "track",
-		ownerIds: residualTracks
-	});
-	const vouched = new Set(ownMedia);
-	for (const event of events.object) {
-		const trackId = event.trackId;
-		if (trackId !== void 0 && trackMedia.has(trackId)) vouched.add(event.id);
-	}
-	return vouched;
-}
-/** Keep only clips that actually touch the caller's window. The reads are
-*  widened by {@link leftOverhangMs}; the ANSWER is not. */
-function intersectsWindow(clip, since, until) {
-	return clip.timeRange.startMs < until && clip.timeRange.endMs > since;
-}
+//#region src/pipeline-analytics/stillness-settings.ts
 /**
-* How far BEFORE `since` the event + availability reads must reach.
+* Per-device STILLNESS SCALE — the one number that says how fast a subject on
+* THIS camera has to move before it is travelling.
 *
-* A visit straddling `since` keeps its heartbeat rows and loses the transition
-* row — the only one that ever carries a snapshot — so the same visit shows a
-* picture or doesn't depending on where the operator scrolled. One wider range
-* scan on an indexed column buys a list that stops changing under the cursor.
+* A threshold belongs to whoever GENERATES the event, per device, never baked
+* into a classifier default. The judgement this feeds is
+* `StateAnalyzer.speedSaysSettled`; the measurement behind the number is
+* `pipeline/tracker/stillness-scale.ts`, which also carries the live
+* measurement showing why one number cannot serve a 30 m driveway and a 2 m
+* doorway.
+*
+* Cascade and shape mirror `stationary-settings` / `media-settings`: a
+* per-device override on top of the default, resolved per FIELD, and a parse
+* that never throws on a bad blob.
+*
+* **Absent behaves exactly as today.** The device store is a flat numeric blob
+* with no room for "unset", so the stored form of absent is `0` — and `0` is
+* not a bar anyone could want (it would mean nothing on this camera is ever
+* still) and not a value the calibration can produce (`minBar`). The decision
+* layer never sees it: {@link resolveStillSpeedFracPerSec} maps it to
+* `undefined`, and `undefined` is what leaves `StateAnalyzer` on its original
+* absolute `velocityThreshold` path.
 */
-function leftOverhangMs(pad) {
-	return VISIT_MERGE_GAP_MS + pad.preMs;
-}
-function createVideoclipsProvider(deps) {
+var StillnessSettingsSchema = object({
+	/**
+	* The camera's "not travelling" bar: centroid speed as a fraction of the
+	* SUBJECT's own box diagonal, per second. `0` = not calibrated (see above).
+	*
+	* Measured p50 on the live hub 2026-09-19, for scale: 0.0136 (device 592,
+	* close view, mostly parked subjects) to 0.3081 (device 615, far view, only
+	* transits).
+	*/
+	stillnessSpeedFracPerSec: number().min(0).max(1).default(0),
+	/**
+	* When the number above was last CHOSEN — by a calibration run or by the
+	* operator. `0` = never. Purely a readout; nothing gates on it.
+	*/
+	stillnessCalibratedAt: number().int().min(0).default(0),
+	/**
+	* What the last calibration run measured and decided, in one line
+	* (`describeStillnessCalibration`) — including a REFUSAL and its named
+	* reason, because "why is this camera still on the default" has to be
+	* answerable without re-running anything.
+	*/
+	stillnessCalibrationNote: string().max(400).default("")
+});
+var STILLNESS_DEFAULTS = StillnessSettingsSchema.parse({});
+/**
+* Resolve a per-device store blob into typed stillness settings. Unknown or
+* invalid fields fall back to the default for that field — including a bar
+* outside the calibration's own rails, which is refused rather than clamped:
+* a number the calibration could never have produced is not evidence about
+* this camera, and silently bending it into range would present it as if it
+* were.
+*/
+function resolveStillnessSettings(raw) {
+	const pick = (key) => {
+		const parsed = StillnessSettingsSchema.shape[key].safeParse(raw[key]);
+		return parsed.success ? parsed.data : STILLNESS_DEFAULTS[key];
+	};
 	return {
-		listClips: async ({ deviceId, since, until, limit }) => {
-			const readSince = since - leftOverhangMs(deps.defaultPad);
-			const events = await deps.fetchEvents({
-				deviceId,
-				since: readSince,
-				until,
-				limit: deps.fetchAvailability ? VISIT_EVENT_FETCH_LIMIT : limit
-			});
-			warnOnTruncatedFetch(deps, deviceId, events);
-			let vouched = /* @__PURE__ */ new Set();
-			try {
-				vouched = await resolveVouchedEvents(deviceId, events, deps.fetchMediaOwners);
-			} catch (err) {
-				deps.logWarn?.("videoclips: media presence read failed — listing without thumbnails", {
-					deviceId,
-					events: allEventIds(events).length,
-					error: err instanceof Error ? err.message : String(err)
-				});
-			}
-			let clips = eventsToClips(events, deps.defaultPad, vouched);
-			if (deps.fetchAvailability) try {
-				clips = visitsToClips(clusterFootageVisits(await deps.fetchAvailability({
-					deviceId,
-					since: readSince,
-					until
-				}), VISIT_MERGE_GAP_MS), events, deps.defaultPad, vouched);
-			} catch (err) {
-				deps.logWarn?.("videoclips: availability read failed — listing unfiltered", {
-					deviceId,
-					error: err instanceof Error ? err.message : String(err)
-				});
-			}
-			const inWindow = clips.filter((c) => intersectsWindow(c, since, until));
-			const answer = limit != null ? inWindow.slice(0, limit) : inWindow;
-			reportUnvouchedClips(deps, deviceId, answer);
-			return answer;
-		},
-		/**
-		* The one source this provider serves, on every camera: the hub's own
-		* analytics visits over recorded footage.
-		*
-		* Always `ok`, and that is not optimism — this source IS the process
-		* answering the call, so there is no reachability question to report. A
-		* read that fails INSIDE `listClips` degrades that list (and logs it); a
-		* source that cannot be reached at all is reported by the collection
-		* dispatcher, which is the only layer that can tell the difference.
-		* `label` is what the picker draws.
-		*/
-		listSources: async () => [{
-			source: SOURCE,
-			addonId: ANALYTICS_ADDON_ID,
-			label: "CamStack recordings",
-			availability: { state: "ok" }
-		}],
-		getClipPlayback: async ({ deviceId, clipId }) => {
-			const parsed = parseClipId(clipId);
-			if (!parsed) throw new Error(`videoclips: unrecognized clipId "${clipId}"`);
-			return {
-				...await deps.resolvePlayback({
-					deviceId,
-					startMs: parsed.startMs,
-					endMs: parsed.endMs
-				}),
-				format: "hls"
-			};
-		}
+		stillnessSpeedFracPerSec: pick("stillnessSpeedFracPerSec"),
+		stillnessCalibratedAt: pick("stillnessCalibratedAt"),
+		stillnessCalibrationNote: pick("stillnessCalibrationNote")
 	};
 }
-/** The annotation backstop biting is a SILENT loss of the earliest visits'
-*  events — say so, per camera, instead of shipping a thinner list. */
-function warnOnTruncatedFetch(deps, deviceId, events) {
-	if (!deps.fetchAvailability) return;
-	const truncated = [
-		"motion",
-		"object",
-		"audio"
-	].filter((kind) => events[kind].length >= VISIT_EVENT_FETCH_LIMIT);
-	if (truncated.length === 0) return;
-	deps.logWarn?.("videoclips: annotation fetch truncated — earliest visits lose their events", {
-		deviceId,
-		kinds: truncated,
-		limit: VISIT_EVENT_FETCH_LIMIT
-	});
-}
-/** The operator's acceptance criterion as a number: a rising count on one
-*  camera is its motion-snapshot capturer failing, not a quiet day. */
-function reportUnvouchedClips(deps, deviceId, clips) {
-	const clipsWithoutStill = clips.filter((c) => c.thumbnail === void 0).length;
-	if (clipsWithoutStill === 0) return;
-	deps.logInfo?.("videoclips: visit has no vouched still", {
-		deviceId,
-		clipsWithoutStill,
-		clips: clips.length
-	});
-}
-//#endregion
-//#region src/pipeline-analytics/videoclips-shared.ts
-/** Stringify the numeric event ids of one bucket. Lossless. */
-function toEventLike(events) {
-	return events.map((e) => ({
-		...e,
-		id: String(e.id)
-	}));
+/**
+* The bar the decision layer gets: a positive, in-rails number, or
+* `undefined` for "this camera is not calibrated — judge it exactly as
+* before". The ONE place the stored-zero convention is interpreted.
+*/
+function resolveStillSpeedFracPerSec(settings) {
+	const bar = settings.stillnessSpeedFracPerSec;
+	if (!(bar >= .001) || bar > 1) return void 0;
+	return bar;
 }
 //#endregion
 //#region src/pipeline-analytics/viewer-settings-actions.ts
@@ -48245,336 +48190,6 @@ function makeViewerSettingsActionHandlers(store) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/stillness-calibration-actions.ts
-/**
-* stillness-calibration-actions — "measure this camera's own stillness scale".
-*
-* ## Why an `addons.custom` action and not a cap method
-*
-* Same reason as `face.rescoreTrack` beside it: a cap method's wire schema
-* lives in `@camstack/types`, which travels inside the `@camstack/server`
-* closure, so a new one is not callable until a server train ships. Here the
-* schema lives in this addon's own dist and the hub forwards an opaque
-* envelope, so `camstack deploy` is the whole delivery.
-*
-* ## Why `apply` is explicit and not a fallback
-*
-* A calibration run READS recorded tracks and does arithmetic. Applying it
-* WRITES the camera's settings and changes what the tracker calls settled from
-* the next frame on. Those are different enough in consequence that a button
-* labelled "calibrate" must not choose between them on the operator's behalf —
-* the run reports, the operator applies. A REFUSED run never writes the bar
-* whatever `apply` says; it writes only the note, so the refusal and its reason
-* are visible in the form instead of being a toast that scrolls away.
-*/
-/** Mirrors `StillnessCalibrationRefusal` — kept literal so the wire schema is
-*  self-describing and a new reason is a deliberate edit in both places. */
-var StillnessRefusalSchema = _enum([
-	"no-tracks",
-	"too-few-tracks",
-	"too-few-samples",
-	"no-motion-evidence"
-]);
-var StillnessMeasurementSchema = object({
-	/** Tracks that contributed at least one speed sample. */
-	trackCount: number().int(),
-	/** Tracks the pass actually read, after the cost bound. */
-	tracksRead: number().int(),
-	sampleCount: number().int(),
-	/** Speed quantiles, subject-box-diagonals per second. `null` when there was
-	*  nothing to measure — never 0, which would read as a measured stillness
-	*  (D393). */
-	p25: number().nullable(),
-	p50: number().nullable(),
-	p90: number().nullable(),
-	/** Median gap between stored positions (s) — the camera's real cadence. */
-	medianIntervalSec: number().nullable(),
-	/** Median subject box diagonal (px) the speeds were normalised by. */
-	medianSubjectDiagonalPx: number().nullable()
-});
-var stillnessCalibrationActions = defineCustomActions({ 
-/**
-* `admin` because it WRITES a per-camera detection threshold when `apply` is
-* set, and because the report describes how the camera's subjects move,
-* which is not a viewer-level fact.
-*/
-"stillness.calibrate": customAction(object({
-	deviceId: number().int(),
-	/** How far back to read. Bounded: this pass parses ~10 kB of trajectory a
-	*  row, so the window is a suggestion and `maxTracks` is the real bound. */
-	sinceHours: number().min(.25).max(720).default(72),
-	/** Hard cost bound on tracks read, newest first. */
-	maxTracks: number().int().min(1).max(1e3).default(200),
-	/**
-	* Write the chosen bar onto the camera. Never implicit, and never done at
-	* all for a refused run.
-	*/
-	apply: boolean().default(false)
-}), object({
-	deviceId: number().int(),
-	/** The window actually read (epoch ms). */
-	since: number().int(),
-	until: number().int(),
-	accepted: boolean(),
-	/** Why it refused. Absent on an accepted run. */
-	reason: StillnessRefusalSchema.optional(),
-	/** The chosen bar, subject-box-diagonals per second. Absent on a refusal —
-	*  never 0, which the settings layer reads as "uncalibrated". */
-	bar: number().optional(),
-	/** The raw quantile before the rails, so the clamp is arguable. */
-	rawBar: number().optional(),
-	clampedBy: _enum([
-		"none",
-		"floor",
-		"ceiling",
-		"min",
-		"max"
-	]).optional(),
-	measurement: StillnessMeasurementSchema,
-	/** The bar this camera was on BEFORE the run — `null` = uncalibrated. Read
-	*  before any write, so the operator sees both numbers. */
-	previousBar: number().nullable(),
-	/** Whether the camera's settings were actually written. */
-	applied: boolean(),
-	/** The one-line note stored on the camera (accepted or refused). */
-	note: string()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}) });
-/**
-* The shipped limits.
-*
-* `minTracks` 12 / `minSamples` 200: the four live cameras sampled above
-* produced 697–8739 samples from 42–51 tracks in a single 60-track read, so a
-* camera that cannot clear these has genuinely not been watched enough.
-* `maxTracks` 200 bounds the read: the `positions` blob averages ~10 kB a row
-* (`track-store.ts`), so this pass is ~2 MB of JSON at its worst.
-*/
-var DEFAULT_STILLNESS_CALIBRATION_LIMITS = {
-	minTracks: 12,
-	minSamples: 200,
-	maxTracks: 200,
-	minIntervalSec: .02,
-	maxIntervalSec: 3,
-	quantile: .25,
-	floorFactor: .02,
-	ceilFactor: .25,
-	minBar: .001,
-	maxBar: 1
-};
-/** Linear-interpolated quantile. `NaN` for an empty list — never 0, which
-*  would read as a measured zero (D393). */
-function quantileOf(values, p) {
-	if (values.length === 0) return NaN;
-	const sorted = [...values].sort((a, b) => a - b);
-	const idx = (sorted.length - 1) * Math.min(Math.max(p, 0), 1);
-	const lo = Math.floor(idx);
-	const hi = Math.ceil(idx);
-	const at = sorted[lo];
-	const next = sorted[hi];
-	if (at === void 0 || next === void 0) return NaN;
-	return at + (next - at) * (idx - lo);
-}
-/**
-* Per-sample centroid speeds for a camera, in subject-box-diagonals per second.
-*
-* A pair of consecutive positions contributes a sample only when the interval
-* between them is inside `[minIntervalSec, maxIntervalSec]` and the later box
-* has a positive diagonal. A gap outside that band is a session boundary or a
-* duplicate read, not a measurement of how fast anything travelled; a box with
-* no size is unknown geometry, and unknown is never a sample.
-*/
-function collectStillnessSamples(tracks, limits) {
-	const speeds = [];
-	const intervals = [];
-	const diagonals = [];
-	let trackCount = 0;
-	const read = tracks.slice(0, limits.maxTracks);
-	for (const track of read) {
-		const positions = [...track.positions].sort((a, b) => a.timestamp - b.timestamp);
-		let contributed = false;
-		for (let i = 1; i < positions.length; i++) {
-			const prev = positions[i - 1];
-			const cur = positions[i];
-			if (prev === void 0 || cur === void 0) continue;
-			const dtSec = (cur.timestamp - prev.timestamp) / 1e3;
-			if (dtSec < limits.minIntervalSec || dtSec > limits.maxIntervalSec) continue;
-			const diagonal = Math.hypot(cur.bbox.w, cur.bbox.h);
-			if (!(diagonal > 0)) continue;
-			const travelled = Math.hypot(cur.x - prev.x, cur.y - prev.y);
-			speeds.push(travelled / diagonal / dtSec);
-			intervals.push(dtSec);
-			diagonals.push(diagonal);
-			contributed = true;
-		}
-		if (contributed) trackCount++;
-	}
-	return {
-		speeds,
-		intervals,
-		diagonals,
-		trackCount,
-		tracksRead: read.length
-	};
-}
-function measure$1(samples) {
-	return {
-		trackCount: samples.trackCount,
-		sampleCount: samples.speeds.length,
-		p25: quantileOf(samples.speeds, .25),
-		p50: quantileOf(samples.speeds, .5),
-		p90: quantileOf(samples.speeds, .9),
-		medianIntervalSec: quantileOf(samples.intervals, .5),
-		medianSubjectDiagonalPx: quantileOf(samples.diagonals, .5)
-	};
-}
-/**
-* Choose this camera's stillness speed bar, or refuse with a named reason.
-*
-* The order of the gates is the order of the questions: is there anything at
-* all, is it enough tracks, is it enough samples, and did anything on this
-* camera ever actually move. The last one is not pedantry — the whole method
-* scales the bar against the camera's own travel, so with no travel there is
-* nothing to scale against and the default is the honest answer.
-*/
-function calibrateStillnessSpeed(samples, limits) {
-	const measurement = measure$1(samples);
-	if (samples.tracksRead === 0) return {
-		ok: false,
-		reason: "no-tracks",
-		measurement
-	};
-	if (samples.trackCount < limits.minTracks) return {
-		ok: false,
-		reason: "too-few-tracks",
-		measurement
-	};
-	if (samples.speeds.length < limits.minSamples) return {
-		ok: false,
-		reason: "too-few-samples",
-		measurement
-	};
-	if (!(measurement.p90 > 0)) return {
-		ok: false,
-		reason: "no-motion-evidence",
-		measurement
-	};
-	const rawBar = quantileOf(samples.speeds, limits.quantile);
-	const floor = measurement.p90 * limits.floorFactor;
-	const ceiling = measurement.p90 * limits.ceilFactor;
-	let bar = rawBar;
-	let clampedBy = "none";
-	if (bar < floor) {
-		bar = floor;
-		clampedBy = "floor";
-	} else if (bar > ceiling) {
-		bar = ceiling;
-		clampedBy = "ceiling";
-	}
-	if (bar < limits.minBar) {
-		bar = limits.minBar;
-		clampedBy = "min";
-	} else if (bar > limits.maxBar) {
-		bar = limits.maxBar;
-		clampedBy = "max";
-	}
-	return {
-		ok: true,
-		bar,
-		rawBar,
-		clampedBy,
-		measurement
-	};
-}
-/** One line an operator can read: what was measured, from how much, and what
-*  rule produced the stored number. Kept short — it rides the settings blob. */
-function describeStillnessCalibration(outcome) {
-	const m = outcome.measurement;
-	const n = (v) => Number.isFinite(v) ? v.toFixed(4) : "unknown";
-	const evidence = `${m.sampleCount} samples / ${m.trackCount} tracks, p25 ${n(m.p25)}, p50 ${n(m.p50)}, p90 ${n(m.p90)} subject-diagonals/s`;
-	if (!outcome.ok) return `refused (${outcome.reason}) — ${evidence}`;
-	return `bar ${n(outcome.bar)} (raw ${n(outcome.rawBar)}, clamp ${outcome.clampedBy}) — ${evidence}`;
-}
-//#endregion
-//#region src/pipeline-analytics/stillness-settings.ts
-/**
-* Per-device STILLNESS SCALE — the one number that says how fast a subject on
-* THIS camera has to move before it is travelling.
-*
-* A threshold belongs to whoever GENERATES the event, per device, never baked
-* into a classifier default. The judgement this feeds is
-* `StateAnalyzer.speedSaysSettled`; the measurement behind the number is
-* `pipeline/tracker/stillness-scale.ts`, which also carries the live
-* measurement showing why one number cannot serve a 30 m driveway and a 2 m
-* doorway.
-*
-* Cascade and shape mirror `stationary-settings` / `media-settings`: a
-* per-device override on top of the default, resolved per FIELD, and a parse
-* that never throws on a bad blob.
-*
-* **Absent behaves exactly as today.** The device store is a flat numeric blob
-* with no room for "unset", so the stored form of absent is `0` — and `0` is
-* not a bar anyone could want (it would mean nothing on this camera is ever
-* still) and not a value the calibration can produce (`minBar`). The decision
-* layer never sees it: {@link resolveStillSpeedFracPerSec} maps it to
-* `undefined`, and `undefined` is what leaves `StateAnalyzer` on its original
-* absolute `velocityThreshold` path.
-*/
-var StillnessSettingsSchema = object({
-	/**
-	* The camera's "not travelling" bar: centroid speed as a fraction of the
-	* SUBJECT's own box diagonal, per second. `0` = not calibrated (see above).
-	*
-	* Measured p50 on the live hub 2026-09-19, for scale: 0.0136 (device 592,
-	* close view, mostly parked subjects) to 0.3081 (device 615, far view, only
-	* transits).
-	*/
-	stillnessSpeedFracPerSec: number().min(0).max(1).default(0),
-	/**
-	* When the number above was last CHOSEN — by a calibration run or by the
-	* operator. `0` = never. Purely a readout; nothing gates on it.
-	*/
-	stillnessCalibratedAt: number().int().min(0).default(0),
-	/**
-	* What the last calibration run measured and decided, in one line
-	* (`describeStillnessCalibration`) — including a REFUSAL and its named
-	* reason, because "why is this camera still on the default" has to be
-	* answerable without re-running anything.
-	*/
-	stillnessCalibrationNote: string().max(400).default("")
-});
-var STILLNESS_DEFAULTS = StillnessSettingsSchema.parse({});
-/**
-* Resolve a per-device store blob into typed stillness settings. Unknown or
-* invalid fields fall back to the default for that field — including a bar
-* outside the calibration's own rails, which is refused rather than clamped:
-* a number the calibration could never have produced is not evidence about
-* this camera, and silently bending it into range would present it as if it
-* were.
-*/
-function resolveStillnessSettings(raw) {
-	const pick = (key) => {
-		const parsed = StillnessSettingsSchema.shape[key].safeParse(raw[key]);
-		return parsed.success ? parsed.data : STILLNESS_DEFAULTS[key];
-	};
-	return {
-		stillnessSpeedFracPerSec: pick("stillnessSpeedFracPerSec"),
-		stillnessCalibratedAt: pick("stillnessCalibratedAt"),
-		stillnessCalibrationNote: pick("stillnessCalibrationNote")
-	};
-}
-/**
-* The bar the decision layer gets: a positive, in-rails number, or
-* `undefined` for "this camera is not calibrated — judge it exactly as
-* before". The ONE place the stored-zero convention is interpreted.
-*/
-function resolveStillSpeedFracPerSec(settings) {
-	const bar = settings.stillnessSpeedFracPerSec;
-	if (!(bar >= .001) || bar > 1) return void 0;
-	return bar;
-}
-//#endregion
 //#region src/pipeline-analytics/viewer-settings-legacy-adoption.ts
 /**
 * @durable class=config owner=pipeline-analytics
@@ -48752,6 +48367,230 @@ async function adoptLegacyViewerSettingsSnapshots(deps) {
 	return retired;
 }
 /**
+* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
+*
+* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
+* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
+* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
+* one encode per event over a ~12 s window, not a permanent transcode child
+* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
+* it was measured on a real 615 720p cut before being chosen: **0.23 s of
+* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
+* The re-encode is smaller than what it replaces.
+*
+* So both attachments now agree on the timeline as well as on the window: one
+* clip, one rate, two containers.
+*/
+var DEFAULT_SPEED = 4;
+/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
+*  at or below 1080p is an identity scale and the broker copies it. */
+var RING_MP4_MAX_WIDTH = 1920;
+/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
+var RING_MP4_FPS = 15;
+var NO_MEDIA = {
+	mp4: null,
+	gif: null,
+	source: "none",
+	startOffsetMs: null,
+	endOffsetMs: null,
+	profile: null,
+	video: null
+};
+var EventMediaService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Cut this event. Never throws — a notification that lost its media is still
+	* a notification, and every branch that drops it logs why.
+	*/
+	async cut(request) {
+		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
+		const produced = await this.produce(request);
+		if (produced !== null) return produced;
+		return this.fallbackToRing(request);
+	}
+	async produce(request) {
+		const deviceId = request.deviceId;
+		const log = this.deps.logger;
+		const kinds = [];
+		if (request.wantMp4) kinds.push("mp4");
+		if (request.wantGif) kinds.push("gif");
+		let production;
+		try {
+			production = await this.deps.produce({
+				deviceId,
+				aroundMs: request.aroundMs,
+				preSeconds: request.preRollSec,
+				postSeconds: request.postRollSec,
+				kinds,
+				gifMaxWidth: 640,
+				gifFps: 12,
+				gifSpeed: 4,
+				speed: request.speed ?? DEFAULT_SPEED,
+				...request.profile !== void 0 ? { profile: request.profile } : {}
+			});
+		} catch (err) {
+			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return null;
+		}
+		const mp4 = await this.redeem(deviceId, production.media, "mp4");
+		const gif = await this.redeem(deviceId, production.media, "gif");
+		if (mp4 === null && gif === null) {
+			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: {
+					kinds: kinds.join(","),
+					profile: production.profile
+				}
+			});
+			return null;
+		}
+		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
+		const endOffsetMs = production.coverage.toTs - request.aroundMs;
+		log.info("nc media: one production, every attachment", {
+			tags: { deviceId },
+			meta: {
+				profile: production.profile,
+				video: production.video,
+				mp4Bytes: mp4?.byteLength ?? null,
+				gifBytes: gif?.byteLength ?? null,
+				startOffsetMs,
+				endOffsetMs,
+				sharedWindow: true
+			}
+		});
+		return {
+			mp4,
+			gif,
+			source: "produced",
+			startOffsetMs,
+			endOffsetMs,
+			profile: production.profile,
+			video: production.video
+		};
+	}
+	/**
+	* Redeem one artifact handle at the node that produced it.
+	*
+	* `null` is not an error here — a production simply may not carry the kind
+	* (a gif whose derive failed says so on the broker's own log line). A handle
+	* that FAILS to redeem is different and is logged, because it means the bytes
+	* existed and did not arrive.
+	*/
+	async redeem(deviceId, media, kind) {
+		const artifact = media.find((m) => m.kind === kind);
+		if (artifact === void 0) return null;
+		try {
+			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
+			if (res === null) {
+				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
+					tags: { deviceId },
+					meta: {
+						kind,
+						handle: artifact.handle,
+						nodeId: artifact.nodeId
+					}
+				});
+				return null;
+			}
+			const buf = Buffer.from(res.base64, "base64");
+			if (buf.byteLength === 0) return null;
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
+				tags: { deviceId },
+				meta: {
+					kind,
+					handle: artifact.handle,
+					nodeId: artifact.nodeId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
+	*
+	* Weaker than a production and deliberately so — the coherence here rests on
+	* the two calls being given IDENTICAL parameters rather than on there being
+	* one render. That is defensible because the ring only ever grows forward and
+	* `windowAround` selects by wall clock around the same instant, so two calls
+	* seconds apart choose the same packets; the one thing that could differ is
+	* the rendition, so the profile is pinned to whatever the FIRST call actually
+	* used and handed to the second.
+	*
+	* It exists for one reason: a hub whose `@camstack/server` predates the
+	* production method must not stop attaching footage, and three of the four
+	* live rules on this install ask for a gif and nothing else.
+	*/
+	async fallbackToRing(request) {
+		const deviceId = request.deviceId;
+		const speed = request.speed ?? DEFAULT_SPEED;
+		const window = {
+			deviceId,
+			aroundMs: request.aroundMs,
+			preRollSec: request.preRollSec,
+			postRollSec: request.postRollSec,
+			speed,
+			...request.profile !== void 0 ? { profile: request.profile } : {}
+		};
+		try {
+			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
+				...window,
+				format: "mp4",
+				maxWidth: RING_MP4_MAX_WIDTH,
+				fps: RING_MP4_FPS
+			}) : null;
+			const gif = request.wantGif ? await this.deps.renderRingClip({
+				...window,
+				format: "gif",
+				maxWidth: 640,
+				fps: 12 / 4,
+				speed: 4
+			}) : null;
+			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
+				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
+					tags: { deviceId },
+					meta: { aroundMs: request.aroundMs }
+				});
+				return NO_MEDIA;
+			}
+			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
+				tags: { deviceId },
+				meta: {
+					mp4Bytes: mp4?.byteLength ?? null,
+					gifBytes: gif?.byteLength ?? null,
+					profile: request.profile ?? null,
+					sharedWindow: "by-parameters"
+				}
+			});
+			return {
+				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
+				gif: gif !== null && gif.byteLength > 0 ? gif : null,
+				source: "ring-fallback",
+				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
+				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
+				profile: request.profile ?? null,
+				video: null
+			};
+		} catch (err) {
+			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return NO_MEDIA;
+		}
+	}
+};
+/**
 * How long the recorder keeps the file we are about to read and delete.
 *
 * `maxLifeMs` is `z.number().int().positive()` on the capability, so "do not
@@ -49005,230 +48844,6 @@ function decodeBase64(base64) {
 		return null;
 	}
 }
-/**
-* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
-*
-* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
-* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
-* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
-* one encode per event over a ~12 s window, not a permanent transcode child
-* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
-* it was measured on a real 615 720p cut before being chosen: **0.23 s of
-* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
-* The re-encode is smaller than what it replaces.
-*
-* So both attachments now agree on the timeline as well as on the window: one
-* clip, one rate, two containers.
-*/
-var DEFAULT_SPEED = 4;
-/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
-*  at or below 1080p is an identity scale and the broker copies it. */
-var RING_MP4_MAX_WIDTH = 1920;
-/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
-var RING_MP4_FPS = 15;
-var NO_MEDIA = {
-	mp4: null,
-	gif: null,
-	source: "none",
-	startOffsetMs: null,
-	endOffsetMs: null,
-	profile: null,
-	video: null
-};
-var EventMediaService = class {
-	deps;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Cut this event. Never throws — a notification that lost its media is still
-	* a notification, and every branch that drops it logs why.
-	*/
-	async cut(request) {
-		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
-		const produced = await this.produce(request);
-		if (produced !== null) return produced;
-		return this.fallbackToRing(request);
-	}
-	async produce(request) {
-		const deviceId = request.deviceId;
-		const log = this.deps.logger;
-		const kinds = [];
-		if (request.wantMp4) kinds.push("mp4");
-		if (request.wantGif) kinds.push("gif");
-		let production;
-		try {
-			production = await this.deps.produce({
-				deviceId,
-				aroundMs: request.aroundMs,
-				preSeconds: request.preRollSec,
-				postSeconds: request.postRollSec,
-				kinds,
-				gifMaxWidth: 640,
-				gifFps: 12,
-				gifSpeed: 4,
-				speed: request.speed ?? DEFAULT_SPEED,
-				...request.profile !== void 0 ? { profile: request.profile } : {}
-			});
-		} catch (err) {
-			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return null;
-		}
-		const mp4 = await this.redeem(deviceId, production.media, "mp4");
-		const gif = await this.redeem(deviceId, production.media, "gif");
-		if (mp4 === null && gif === null) {
-			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
-				tags: { deviceId },
-				meta: {
-					kinds: kinds.join(","),
-					profile: production.profile
-				}
-			});
-			return null;
-		}
-		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
-		const endOffsetMs = production.coverage.toTs - request.aroundMs;
-		log.info("nc media: one production, every attachment", {
-			tags: { deviceId },
-			meta: {
-				profile: production.profile,
-				video: production.video,
-				mp4Bytes: mp4?.byteLength ?? null,
-				gifBytes: gif?.byteLength ?? null,
-				startOffsetMs,
-				endOffsetMs,
-				sharedWindow: true
-			}
-		});
-		return {
-			mp4,
-			gif,
-			source: "produced",
-			startOffsetMs,
-			endOffsetMs,
-			profile: production.profile,
-			video: production.video
-		};
-	}
-	/**
-	* Redeem one artifact handle at the node that produced it.
-	*
-	* `null` is not an error here — a production simply may not carry the kind
-	* (a gif whose derive failed says so on the broker's own log line). A handle
-	* that FAILS to redeem is different and is logged, because it means the bytes
-	* existed and did not arrive.
-	*/
-	async redeem(deviceId, media, kind) {
-		const artifact = media.find((m) => m.kind === kind);
-		if (artifact === void 0) return null;
-		try {
-			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
-			if (res === null) {
-				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
-					tags: { deviceId },
-					meta: {
-						kind,
-						handle: artifact.handle,
-						nodeId: artifact.nodeId
-					}
-				});
-				return null;
-			}
-			const buf = Buffer.from(res.base64, "base64");
-			if (buf.byteLength === 0) return null;
-			const bytes = new Uint8Array(buf.byteLength);
-			bytes.set(buf);
-			return bytes;
-		} catch (err) {
-			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
-				tags: { deviceId },
-				meta: {
-					kind,
-					handle: artifact.handle,
-					nodeId: artifact.nodeId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-			return null;
-		}
-	}
-	/**
-	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
-	*
-	* Weaker than a production and deliberately so — the coherence here rests on
-	* the two calls being given IDENTICAL parameters rather than on there being
-	* one render. That is defensible because the ring only ever grows forward and
-	* `windowAround` selects by wall clock around the same instant, so two calls
-	* seconds apart choose the same packets; the one thing that could differ is
-	* the rendition, so the profile is pinned to whatever the FIRST call actually
-	* used and handed to the second.
-	*
-	* It exists for one reason: a hub whose `@camstack/server` predates the
-	* production method must not stop attaching footage, and three of the four
-	* live rules on this install ask for a gif and nothing else.
-	*/
-	async fallbackToRing(request) {
-		const deviceId = request.deviceId;
-		const speed = request.speed ?? DEFAULT_SPEED;
-		const window = {
-			deviceId,
-			aroundMs: request.aroundMs,
-			preRollSec: request.preRollSec,
-			postRollSec: request.postRollSec,
-			speed,
-			...request.profile !== void 0 ? { profile: request.profile } : {}
-		};
-		try {
-			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
-				...window,
-				format: "mp4",
-				maxWidth: RING_MP4_MAX_WIDTH,
-				fps: RING_MP4_FPS
-			}) : null;
-			const gif = request.wantGif ? await this.deps.renderRingClip({
-				...window,
-				format: "gif",
-				maxWidth: 640,
-				fps: 12 / 4,
-				speed: 4
-			}) : null;
-			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
-				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
-					tags: { deviceId },
-					meta: { aroundMs: request.aroundMs }
-				});
-				return NO_MEDIA;
-			}
-			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
-				tags: { deviceId },
-				meta: {
-					mp4Bytes: mp4?.byteLength ?? null,
-					gifBytes: gif?.byteLength ?? null,
-					profile: request.profile ?? null,
-					sharedWindow: "by-parameters"
-				}
-			});
-			return {
-				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
-				gif: gif !== null && gif.byteLength > 0 ? gif : null,
-				source: "ring-fallback",
-				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
-				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
-				profile: request.profile ?? null,
-				video: null
-			};
-		} catch (err) {
-			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return NO_MEDIA;
-		}
-	}
-};
 //#endregion
 //#region src/shared/frame/crop-extractor.ts
 /**
@@ -57499,6 +57114,41 @@ function resolveMediaSettings(raw) {
 		snapshotMaxIdleMs: pick("snapshotMaxIdleMs")
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/our-recording-availability.ts
+/**
+* Coverage of OUR archive, asked of the `recording` collection by name.
+*
+* `recording` became a device collection on 2026-09-24 (D625): a camera may
+* have several sources of recorded coverage and every read names one. Every
+* read in this addon wants the same one — the footage OUR recorder wrote,
+* because everything downstream of it (a recorded clip cut, a timelapse, the
+* earliest-footage floor of a retention sweep) is about bytes we hold and can
+* export. A camera's own SD card is not an answer to any of those questions.
+*
+* It also owns the `read: 'unreadable'` rule, in one place: a read that FAILED
+* throws here rather than arriving downstream as an empty range list. Every
+* caller of this module treats "no ranges" as "recording is off for this
+* camera" and acts on it — dropping the attachment, skipping the render,
+* lowering the sweep floor — so folding a failed read into that shape would
+* make an unreachable recorder look exactly like a camera nobody records
+* (D393). The callers already handle a throw and log it as a read failure.
+*/
+/** Our coverage of `[fromMs, toMs)`, or a throw naming the failed read. */
+async function ourRecordingAvailability(api, input) {
+	const answer = await api.recording.getAvailability.query({
+		deviceId: input.deviceId,
+		provider: RECORDING_SOURCE_CAMSTACK_ADDON,
+		fromMs: input.fromMs,
+		toMs: input.toMs,
+		...input.profile !== void 0 ? { profile: input.profile } : {}
+	});
+	if (answer.read === "unreadable") throw new Error(`recording.getAvailability: the CamStack archive was unreadable for device ${String(input.deviceId)} — no claim is made about its footage`);
+	return {
+		ranges: answer.ranges,
+		profilesWithFootage: answer.profilesWithFootage
+	};
+}
 function toDetectionBbox(bbox) {
 	return {
 		x: bbox.x,
@@ -58790,6 +58440,17 @@ function resolveSearchThumbnailUrl(input) {
 	return `${input.baseUrl}/${encodeURIComponent(id)}`;
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
+/**
+* May a suppression verdict RETRACT this birth?
+*
+* `false` means hold: keep the track, log the held verdict, and let the
+* ordinary lifetime decide. It never means "confirmed".
+*/
+function suppressionMayRetract(source) {
+	return source !== "onboard";
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/package/package-area-gate.ts
 /**
 * Decide whether a package-class box is plausibly parcel-sized.
@@ -61483,65 +61144,6 @@ var StationaryEvidenceLedger = class {
 		for (const row of excess) this.forgetKey(row.key);
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
-function planStationaryTrackDisposal(input) {
-	const trackIds = [input.liveTrackId];
-	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
-	const keepMediaIds = /* @__PURE__ */ new Set();
-	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
-	return {
-		trackIds,
-		keepMediaIds
-	};
-}
-/**
-* Run the plan. The live track is dropped from RAM FIRST so it can never be
-* persisted by a sweep racing this call; the cascade then removes what every
-* track owned, sparing the entry's key frame, and deletes the row (a no-op for
-* the never-persisted live track).
-*
-* Never silent: the line names the entity, what went and what was kept — a
-* deleted track is dropped work, and the operator asked for it by name.
-*/
-async function disposeStationaryTracks(deps, plan) {
-	const [liveTrackId] = plan.trackIds;
-	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
-	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
-	const result = await runTrackCascadeBatch({
-		registry: [...deps.leaves, sparingMedia],
-		trackStore: deps.trackStore,
-		deviceId: deps.deviceId,
-		onTrackCleanup: deps.onTrackCleanup,
-		onFailure: (trackId, err) => {
-			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
-				tags: { deviceId: deps.deviceId },
-				meta: {
-					deviceId: deps.deviceId,
-					entryId: deps.entryId,
-					trackId,
-					error: String(err)
-				}
-			});
-		}
-	}, plan.trackIds);
-	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
-		tags: { deviceId: deps.deviceId },
-		meta: {
-			deviceId: deps.deviceId,
-			entryId: deps.entryId,
-			trackIds: plan.trackIds,
-			keptMediaIds: [...plan.keepMediaIds],
-			deleted: result.deleted,
-			failed: result.failed,
-			mediaRows: result.tally.media
-		}
-	});
-	return {
-		deleted: result.deleted,
-		failed: result.failed
-	};
-}
 /**
 * How long the same weak box must keep being seen before it may re-anchor.
 *
@@ -62483,6 +62085,97 @@ function rowToEntry(id, data) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
+function planStationaryTrackDisposal(input) {
+	const trackIds = [input.liveTrackId];
+	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
+	const keepMediaIds = /* @__PURE__ */ new Set();
+	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
+	return {
+		trackIds,
+		keepMediaIds
+	};
+}
+/**
+* Run the plan. The live track is dropped from RAM FIRST so it can never be
+* persisted by a sweep racing this call; the cascade then removes what every
+* track owned, sparing the entry's key frame, and deletes the row (a no-op for
+* the never-persisted live track).
+*
+* Never silent: the line names the entity, what went and what was kept — a
+* deleted track is dropped work, and the operator asked for it by name.
+*/
+async function disposeStationaryTracks(deps, plan) {
+	const [liveTrackId] = plan.trackIds;
+	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
+	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
+	const result = await runTrackCascadeBatch({
+		registry: [...deps.leaves, sparingMedia],
+		trackStore: deps.trackStore,
+		deviceId: deps.deviceId,
+		onTrackCleanup: deps.onTrackCleanup,
+		onFailure: (trackId, err) => {
+			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
+				tags: { deviceId: deps.deviceId },
+				meta: {
+					deviceId: deps.deviceId,
+					entryId: deps.entryId,
+					trackId,
+					error: String(err)
+				}
+			});
+		}
+	}, plan.trackIds);
+	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
+		tags: { deviceId: deps.deviceId },
+		meta: {
+			deviceId: deps.deviceId,
+			entryId: deps.entryId,
+			trackIds: plan.trackIds,
+			keptMediaIds: [...plan.keepMediaIds],
+			deleted: result.deleted,
+			failed: result.failed,
+			mediaRows: result.tally.media
+		}
+	});
+	return {
+		deleted: result.deleted,
+		failed: result.failed
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/stationary-planes.ts
+/**
+* WHICH detection planes carry the stationary machinery.
+*
+* A plane qualifies when it produces OBJECT BOXES on decoded frames — because
+* that is what the registry needs to decide an object is parked: a box, a
+* class, and an observed clock that only advances while frames flow.
+*
+* Both root detectors qualify. `pipeline` is the ML tree; `onboard` is the
+* camera's own firmware, and the boxes it produces are paired with a decoded
+* frame in that frame's pixel space — the same plane, entered by a different
+* door. `sensor` and `audio` do not: they carry no geometry to park.
+*
+* It used to be `source === 'pipeline'`, in five places, each explaining that
+* the gate "runs on that plane". The reason given was WHERE the flood it was
+* written for had been measured (617, the ML plane), never an argument that the
+* firmware's boxes were unfit. The cost of the accident, on device 640: a still
+* object is never promoted, so it holds `hasLiveTrack` true for as long as it
+* sits there, and every detection session runs to its 120 s cap instead of
+* closing on cooldown — `closed at the max-hold cap with a subject still
+* present`. The camera's lazy stream is then torn down and rebuilt on the next
+* detection, on a battery camera.
+*
+* One predicate and not five comparisons, because five copies of a rule drift:
+* this repo has already paid for that with two authorities on one function
+* (D62).
+*/
+/** Does this detection plane run the stationary registry, gate and promotion? */
+function planeRunsStationary(source) {
+	return source === "pipeline" || source === "onboard";
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/suppressed-births.ts
 /**
 * Memory of births the confirmation gate rejected, per device.
@@ -63398,49 +63091,6 @@ function hasKeyFrame(source) {
 	return source.keyFrame !== null && source.bbox !== null;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/stationary-planes.ts
-/**
-* WHICH detection planes carry the stationary machinery.
-*
-* A plane qualifies when it produces OBJECT BOXES on decoded frames — because
-* that is what the registry needs to decide an object is parked: a box, a
-* class, and an observed clock that only advances while frames flow.
-*
-* Both root detectors qualify. `pipeline` is the ML tree; `onboard` is the
-* camera's own firmware, and the boxes it produces are paired with a decoded
-* frame in that frame's pixel space — the same plane, entered by a different
-* door. `sensor` and `audio` do not: they carry no geometry to park.
-*
-* It used to be `source === 'pipeline'`, in five places, each explaining that
-* the gate "runs on that plane". The reason given was WHERE the flood it was
-* written for had been measured (617, the ML plane), never an argument that the
-* firmware's boxes were unfit. The cost of the accident, on device 640: a still
-* object is never promoted, so it holds `hasLiveTrack` true for as long as it
-* sits there, and every detection session runs to its 120 s cap instead of
-* closing on cooldown — `closed at the max-hold cap with a subject still
-* present`. The camera's lazy stream is then torn down and rebuilt on the next
-* detection, on a battery camera.
-*
-* One predicate and not five comparisons, because five copies of a rule drift:
-* this repo has already paid for that with two authorities on one function
-* (D62).
-*/
-/** Does this detection plane run the stationary registry, gate and promotion? */
-function planeRunsStationary(source) {
-	return source === "pipeline" || source === "onboard";
-}
-//#endregion
-//#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
-/**
-* May a suppression verdict RETRACT this birth?
-*
-* `false` means hold: keep the track, log the held verdict, and let the
-* ordinary lifetime decide. It never means "confirmed".
-*/
-function suppressionMayRetract(source) {
-	return source !== "onboard";
-}
-//#endregion
 //#region src/pipeline-analytics/rebuild-source-loader.ts
 /**
 * Assemble one track's rebuild inputs, reading at most ONE blob.
@@ -78572,7 +78222,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		await step("buildSceneMonitor", () => this.buildSceneMonitor(api, logger));
 		this.startSweepTimers();
 		this.ctx.logger.info("pipeline-analytics subscribers installed");
-		const providers = await step("buildProviderRegistrations", () => this.buildProviderRegistrations(api, stores, capProviders));
+		const providers = await step("buildProviderRegistrations", () => this.buildProviderRegistrations(stores, capProviders));
 		const isHub = ownNodeId === "hub";
 		const ncHandlers = isHub ? this.buildNcActionHandlers(api) : void 0;
 		this.discardJob = createDiscardJob({
@@ -78651,7 +78301,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) }),
 			timelapse: {
 				store: center.timelapseStore,
-				getRecordingConfig: (deviceId) => api.recording.getDeviceConfig.query({ deviceId }).catch(() => null),
+				getRecordingConfig: (deviceId) => api.recordingArchive.getDeviceConfig.query({ deviceId }).catch(() => null),
 				runNow: (input) => center.runTimelapseNow(input)
 			},
 			summary: {
@@ -79744,7 +79394,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 					logger: logger.child("RecordedClip"),
 					now: () => Date.now(),
 					sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-					getAvailability: (input) => api.recording.getAvailability.query(input),
+					getAvailability: (input) => ourRecordingAvailability(api, input),
 					createExport: (input) => api.recordingExport.createExport.mutate({ ...input }),
 					getExport: (input) => api.recordingExport.getExport.query(input),
 					readExportBytes: (input) => api.recordingExport.readExportBytes.query(input),
@@ -79998,7 +79648,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	buildTimelapsePorts(api, stores) {
 		return {
 			getAvailability: async ({ deviceId, fromMs, toMs, profile }) => {
-				const availability = await api.recording.getAvailability.query({
+				const availability = await ourRecordingAvailability(api, {
 					deviceId,
 					fromMs,
 					toMs,
@@ -80976,71 +80626,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			});
 		}
 	}
-	buildProviderRegistrations(api, stores, providers) {
+	buildProviderRegistrations(stores, providers) {
 		const widgetsProvider = createAnalyticsWidgetsProvider();
-		const videoclipsProvider = createVideoclipsProvider({
-			defaultPad: EVENT_PAD_MS,
-			fetchEvents: async ({ deviceId, since, until, limit }) => {
-				const [motion, object, audio] = await Promise.all([
-					this.getMotionEvents({
-						deviceId,
-						since,
-						until,
-						limit,
-						projection: "slim"
-					}),
-					this.getObjectEvents({
-						deviceId,
-						since,
-						until,
-						limit,
-						projection: "slim"
-					}),
-					this.getAudioEvents({
-						deviceId,
-						since,
-						until,
-						limit,
-						projection: "slim"
-					})
-				]);
-				return {
-					motion: toEventLike(motion),
-					object: toEventLike(object),
-					audio: toEventLike(audio)
-				};
-			},
-			fetchMediaOwners: async ({ deviceId, ownerKind, ownerIds }) => {
-				return stores.mediaStore.ownersWithMedia(ownerKind, ownerIds, deviceId);
-			},
-			fetchAvailability: async ({ deviceId, since, until }) => {
-				return (await api.recording.getAvailability.query({
-					deviceId,
-					fromMs: since,
-					toMs: until
-				})).ranges;
-			},
-			logWarn: (message, meta) => this.ctx.logger.warn(message, {
-				tags: { deviceId: Number(meta["deviceId"]) },
-				meta
-			}),
-			logInfo: (message, meta) => this.ctx.logger.info(message, {
-				tags: { deviceId: Number(meta["deviceId"]) },
-				meta
-			}),
-			resolvePlayback: async ({ deviceId, startMs, endMs }) => {
-				const manifest = await api.recording.getPlaybackManifest.query({
-					deviceId,
-					fromMs: startMs,
-					toMs: endMs
-				});
-				if (manifest.playbackUrl == null) throw new Error(`videoclips: no footage for clip window [${startMs},${endMs}] on device ${deviceId}`);
-				return {
-					playbackUrl: manifest.playbackUrl,
-					playbackEndpoints: manifest.playbackEndpoints
-				};
-			}
-		});
 		const faceGallery = new FaceGalleryProvider({
 			identityStore: stores.identityStore,
 			faceStore: stores.faceStore,
@@ -81103,10 +80690,6 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				capability: addonWidgetsSourceCapability,
 				provider: widgetsProvider
 			},
-			{
-				capability: videoclipsCapability,
-				provider: videoclipsProvider
-			},
 			{
 				capability: faceGalleryCapability,
 				provider: faceGallery
@@ -84256,7 +83839,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		if (cached && Date.now() - cached.at < 10 * 6e4) return cached.value;
 		let value = null;
 		try {
-			const res = await this.ctx.api.recording.getAvailability.query({
+			const res = await ourRecordingAvailability(this.ctx.api, {
 				deviceId,
 				fromMs: 0,
 				toMs: Date.now()
@@ -85759,6 +85342,24 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		return this.queryFacade.listEventMedia(input);
 	}
 	/**
+	* Which of `ownerIds` hold at least ONE media row — the media-PRESENCE probe,
+	* on the wire because the `videoclips` source lives in the addon that owns
+	* the FOOTAGE now (D560).
+	*
+	* A pass-through to {@link MediaStore.ownersWithMedia}, which batches by
+	* `whereIn` and pages: the N+1 this exists to prevent is one query per owner,
+	* and a process boundary in front of it would multiply that, not absorb it.
+	*
+	* It THROWS rather than answering partially, and the empty ask costs no read
+	* at all — a caller with nothing to probe must not pay a round trip for it.
+	*/
+	async ownersWithMedia(input) {
+		if (input.ownerIds.length === 0) return [];
+		const store = this.mediaStore;
+		if (store === null) throw new Error(`pipelineAnalytics.ownersWithMedia: the media index is not open on this node — refusing rather than answering "these owners have nothing" (device ${String(input.deviceId)})`);
+		return [...await store.ownersWithMedia(input.ownerKind, input.ownerIds, input.deviceId)];
+	}
+	/**
 	* Search object events by text using CLIP cosine similarity.
 	*
 	* Flow:
@@ -86284,7 +85885,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		} });
 		const deviceIds = input.deviceId !== void 0 ? [input.deviceId] : await trackStore.listDeviceIds();
 		const recordedStills = new RecordedStillService(buildRecordedStillPorts({
-			api: this.ctx.api.recording,
+			api: this.ctx.api.recordingArchive,
 			logger: this.ctx.logger
 		}));
 		const deps = {