@camstack/addon-post-analysis 1.2.273 → 1.2.274

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as TrackSourceSchema, $t as literal, A as NcRuleInputSchema, At as resolveLocationMode, B as OpsLogEntrySchema, Bt as CamProfileSchema, C as MediaFileKindEnum, Ct as occupancyScope, Dt as plateGalleryCapability, E as NC_DEFAULT_SNOOZE_MINUTES, Et as pipelineAnalyticsCapability, F as NcSnoozeInputSchema, Ft as systemEventFilterApplies, G as SCENE_DEFAULT_ANCHOR_THRESHOLD, Gt as hydrateSchema, H as RECORDING_EXPORT_MAX_READ_BYTES, Ht as createEvent, I as NcSnoozeSchema, It as vectorDimFromBase64, J as SceneMonitorSchema, Jt as sleep$1, K as SCENE_DEFAULT_UNCOVERED_POLICY, Kt as isDeviceScopedCap, L as NcSnoozeSuppressedSchema, Lt as zoneAnalyticsCapability, M as NcRuleSchema, Mt as sceneMonitorCapability, N as NcRuleTargetSchema, Nt as storageOccupancyCapability, O as NC_TAXONOMY, Ot as readDeviceStateFrom, P as NcScheduleSchema, Pt as subKindsOf, Q as TimelapseRuleSchema, Qt as discriminatedUnion, R as NcSystemEventKindSchema, Rt as errMsg$1, S as MOTION_CLOSE_AFTER_MS, St as notificationRulesCapability, T as NC_CONDITION_CATALOG, Tt as pickClusterStepModels, U as RetrainStatusSchema, Ut as customAction, Vt as DeviceType, Wt as defineCustomActions, X as TimelapseRuleInputSchema, Xt as array, Y as TIMELAPSE_DENSE_FLOOR_SEC, Yt as _enum, Z as TimelapseRulePatchSchema, Zt as boolean, _ as FailureCounters, _t as isMediaOwnerType, a as CLUSTER_MODEL_SCOPED_STEPS, an as unknown, at as buildEventKindDescriptor, b as MAX_BIRTH_DECISION_RECORDS, bt as kebabToCamel, dt as evictionPolicyOfLocation, en as number, et as addonWidgetsSourceCapability, f as DeclaredDevices, ft as faceGalleryCapability, g as FULL_IMAGE_BBOX, gt as isEventOwnerType, h as FIRST_LEVEL_MACRO_CLASSES, ht as isDetectionMacroClass, i as BirthDecisionRecordSchema, in as string, it as audioModeOf, j as NcRulePatchSchema, k as NcConditionDescriptorSchema, kt as readTimelapseGeneratedAt, lt as encodeVectorBase64, m as EVENT_OWNER_TYPES, n as ArchivedDebugNoteSchema, nn as partialRecord, nt as assertTimelapseCadences, o as COCO_TO_MACRO, on as EventCategory, ot as cosineSimilarity$1, p as EVENT_KIND_BY_CAP, pt as failureContributionCapability, q as SCENE_DIVERGED, qt as nodePin, r as BaseDevice, rn as record, rt as audioMetricsCapability, s as DEFAULT_EVENT_COLOR, st as deriveRecordingMode, t as AUDIO_MACRO_LABELS, tn as object, tt as alarmPanelCapability, u as DETECTION_MACRO_CLASSES, ut as evaluateSensorEdge, v as LabelAttributionSchema, vt as isScheduleActive, w as NC_ALARM_SYSTEM_EVENT_KINDS, xt as mayWriteToLocation, y as MAX_ARCHIVED_DEBUG_NOTES, yt as isSourceCap, z as NcTaxonomySchema, zt as BaseAddon } from "../dist-PZVHV70g.mjs";
+import { $ as TimelapseRuleSchema, $t as discriminatedUnion, A as NcRuleInputSchema, At as readTimelapseGeneratedAt, B as OpsLogEntrySchema, Bt as BaseAddon, C as MediaFileKindEnum, Ct as notificationRulesCapability, Dt as pipelineAnalyticsCapability, E as NC_DEFAULT_SNOOZE_MINUTES, Et as pickClusterStepModels, F as NcSnoozeInputSchema, Ft as subKindsOf, Gt as defineCustomActions, H as RECORDING_EXPORT_MAX_READ_BYTES, Ht as DeviceType, I as NcSnoozeSchema, It as systemEventFilterApplies, J as SCENE_DIVERGED, Jt as nodePin, K as SCENE_DEFAULT_ANCHOR_THRESHOLD, Kt as hydrateSchema, L as NcSnoozeSuppressedSchema, Lt as vectorDimFromBase64, M as NcRuleSchema, N as NcRuleTargetSchema, Nt as sceneMonitorCapability, O as NC_TAXONOMY, Ot as plateGalleryCapability, P as NcScheduleSchema, Pt as storageOccupancyCapability, Q as TimelapseRulePatchSchema, Qt as boolean, R as NcSystemEventKindSchema, Rt as zoneAnalyticsCapability, S as MOTION_CLOSE_AFTER_MS, St as mayWriteToLocation, T as NC_CONDITION_CATALOG, U as RECORDING_SOURCE_CAMSTACK_ADDON, Ut as createEvent, Vt as CamProfileSchema, W as RetrainStatusSchema, Wt as customAction, X as TIMELAPSE_DENSE_FLOOR_SEC, Xt as _enum, Y as SceneMonitorSchema, Yt as sleep$1, Z as TimelapseRuleInputSchema, Zt as array, _ as FailureCounters, _t as isEventOwnerType, a as CLUSTER_MODEL_SCOPED_STEPS, an as string, at as audioModeOf, b as MAX_BIRTH_DECISION_RECORDS, bt as isSourceCap, ct as deriveRecordingMode, dt as evaluateSensorEdge, en as literal, et as TrackSourceSchema, f as DeclaredDevices, ft as evictionPolicyOfLocation, g as FULL_IMAGE_BBOX, gt as isDetectionMacroClass, h as FIRST_LEVEL_MACRO_CLASSES, i as BirthDecisionRecordSchema, in as record, it as audioMetricsCapability, j as NcRulePatchSchema, jt as resolveLocationMode, k as NcConditionDescriptorSchema, kt as readDeviceStateFrom, m as EVENT_OWNER_TYPES, mt as failureContributionCapability, n as ArchivedDebugNoteSchema, nn as object, nt as alarmPanelCapability, o as COCO_TO_MACRO, on as unknown, ot as buildEventKindDescriptor, p as EVENT_KIND_BY_CAP, pt as faceGalleryCapability, q as SCENE_DEFAULT_UNCOVERED_POLICY, qt as isDeviceScopedCap, r as BaseDevice, rn as partialRecord, rt as assertTimelapseCadences, s as DEFAULT_EVENT_COLOR, sn as EventCategory, st as cosineSimilarity$1, t as AUDIO_MACRO_LABELS, tn as number, tt as addonWidgetsSourceCapability, u as DETECTION_MACRO_CLASSES, ut as encodeVectorBase64, v as LabelAttributionSchema, vt as isMediaOwnerType, w as NC_ALARM_SYSTEM_EVENT_KINDS, wt as occupancyScope, xt as kebabToCamel, y as MAX_ARCHIVED_DEBUG_NOTES, yt as isScheduleActive, z as NcTaxonomySchema, zt as errMsg$1 } from "../dist-DDko6srJ.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -41691,6 +41691,160 @@ var TrackResidentState = class {
 		if (resident.rasterFallback === void 0) resident.rasterFallback = fallback;
 	}
 };
+/**
+* The shipped limits.
+*
+* `minTracks` 12 / `minSamples` 200: the four live cameras sampled above
+* produced 697–8739 samples from 42–51 tracks in a single 60-track read, so a
+* camera that cannot clear these has genuinely not been watched enough.
+* `maxTracks` 200 bounds the read: the `positions` blob averages ~10 kB a row
+* (`track-store.ts`), so this pass is ~2 MB of JSON at its worst.
+*/
+var DEFAULT_STILLNESS_CALIBRATION_LIMITS = {
+	minTracks: 12,
+	minSamples: 200,
+	maxTracks: 200,
+	minIntervalSec: .02,
+	maxIntervalSec: 3,
+	quantile: .25,
+	floorFactor: .02,
+	ceilFactor: .25,
+	minBar: .001,
+	maxBar: 1
+};
+/** Linear-interpolated quantile. `NaN` for an empty list — never 0, which
+*  would read as a measured zero (D393). */
+function quantileOf(values, p) {
+	if (values.length === 0) return NaN;
+	const sorted = [...values].sort((a, b) => a - b);
+	const idx = (sorted.length - 1) * Math.min(Math.max(p, 0), 1);
+	const lo = Math.floor(idx);
+	const hi = Math.ceil(idx);
+	const at = sorted[lo];
+	const next = sorted[hi];
+	if (at === void 0 || next === void 0) return NaN;
+	return at + (next - at) * (idx - lo);
+}
+/**
+* Per-sample centroid speeds for a camera, in subject-box-diagonals per second.
+*
+* A pair of consecutive positions contributes a sample only when the interval
+* between them is inside `[minIntervalSec, maxIntervalSec]` and the later box
+* has a positive diagonal. A gap outside that band is a session boundary or a
+* duplicate read, not a measurement of how fast anything travelled; a box with
+* no size is unknown geometry, and unknown is never a sample.
+*/
+function collectStillnessSamples(tracks, limits) {
+	const speeds = [];
+	const intervals = [];
+	const diagonals = [];
+	let trackCount = 0;
+	const read = tracks.slice(0, limits.maxTracks);
+	for (const track of read) {
+		const positions = [...track.positions].sort((a, b) => a.timestamp - b.timestamp);
+		let contributed = false;
+		for (let i = 1; i < positions.length; i++) {
+			const prev = positions[i - 1];
+			const cur = positions[i];
+			if (prev === void 0 || cur === void 0) continue;
+			const dtSec = (cur.timestamp - prev.timestamp) / 1e3;
+			if (dtSec < limits.minIntervalSec || dtSec > limits.maxIntervalSec) continue;
+			const diagonal = Math.hypot(cur.bbox.w, cur.bbox.h);
+			if (!(diagonal > 0)) continue;
+			const travelled = Math.hypot(cur.x - prev.x, cur.y - prev.y);
+			speeds.push(travelled / diagonal / dtSec);
+			intervals.push(dtSec);
+			diagonals.push(diagonal);
+			contributed = true;
+		}
+		if (contributed) trackCount++;
+	}
+	return {
+		speeds,
+		intervals,
+		diagonals,
+		trackCount,
+		tracksRead: read.length
+	};
+}
+function measure$1(samples) {
+	return {
+		trackCount: samples.trackCount,
+		sampleCount: samples.speeds.length,
+		p25: quantileOf(samples.speeds, .25),
+		p50: quantileOf(samples.speeds, .5),
+		p90: quantileOf(samples.speeds, .9),
+		medianIntervalSec: quantileOf(samples.intervals, .5),
+		medianSubjectDiagonalPx: quantileOf(samples.diagonals, .5)
+	};
+}
+/**
+* Choose this camera's stillness speed bar, or refuse with a named reason.
+*
+* The order of the gates is the order of the questions: is there anything at
+* all, is it enough tracks, is it enough samples, and did anything on this
+* camera ever actually move. The last one is not pedantry — the whole method
+* scales the bar against the camera's own travel, so with no travel there is
+* nothing to scale against and the default is the honest answer.
+*/
+function calibrateStillnessSpeed(samples, limits) {
+	const measurement = measure$1(samples);
+	if (samples.tracksRead === 0) return {
+		ok: false,
+		reason: "no-tracks",
+		measurement
+	};
+	if (samples.trackCount < limits.minTracks) return {
+		ok: false,
+		reason: "too-few-tracks",
+		measurement
+	};
+	if (samples.speeds.length < limits.minSamples) return {
+		ok: false,
+		reason: "too-few-samples",
+		measurement
+	};
+	if (!(measurement.p90 > 0)) return {
+		ok: false,
+		reason: "no-motion-evidence",
+		measurement
+	};
+	const rawBar = quantileOf(samples.speeds, limits.quantile);
+	const floor = measurement.p90 * limits.floorFactor;
+	const ceiling = measurement.p90 * limits.ceilFactor;
+	let bar = rawBar;
+	let clampedBy = "none";
+	if (bar < floor) {
+		bar = floor;
+		clampedBy = "floor";
+	} else if (bar > ceiling) {
+		bar = ceiling;
+		clampedBy = "ceiling";
+	}
+	if (bar < limits.minBar) {
+		bar = limits.minBar;
+		clampedBy = "min";
+	} else if (bar > limits.maxBar) {
+		bar = limits.maxBar;
+		clampedBy = "max";
+	}
+	return {
+		ok: true,
+		bar,
+		rawBar,
+		clampedBy,
+		measurement
+	};
+}
+/** One line an operator can read: what was measured, from how much, and what
+*  rule produced the stored number. Kept short — it rides the settings blob. */
+function describeStillnessCalibration(outcome) {
+	const m = outcome.measurement;
+	const n = (v) => Number.isFinite(v) ? v.toFixed(4) : "unknown";
+	const evidence = `${m.sampleCount} samples / ${m.trackCount} tracks, p25 ${n(m.p25)}, p50 ${n(m.p50)}, p90 ${n(m.p90)} subject-diagonals/s`;
+	if (!outcome.ok) return `refused (${outcome.reason}) — ${evidence}`;
+	return `bar ${n(outcome.bar)} (raw ${n(outcome.rawBar)}, clamp ${outcome.clampedBy}) — ${evidence}`;
+}
 //#endregion
 //#region src/pipeline-analytics/pipeline/plate-clustering.ts
 /**
@@ -47641,6 +47795,182 @@ async function retentionScopeDeviceIds(deps, onError) {
 	return [...ids];
 }
 //#endregion
+//#region src/pipeline-analytics/stillness-calibration-actions.ts
+/**
+* stillness-calibration-actions — "measure this camera's own stillness scale".
+*
+* ## Why an `addons.custom` action and not a cap method
+*
+* Same reason as `face.rescoreTrack` beside it: a cap method's wire schema
+* lives in `@camstack/types`, which travels inside the `@camstack/server`
+* closure, so a new one is not callable until a server train ships. Here the
+* schema lives in this addon's own dist and the hub forwards an opaque
+* envelope, so `camstack deploy` is the whole delivery.
+*
+* ## Why `apply` is explicit and not a fallback
+*
+* A calibration run READS recorded tracks and does arithmetic. Applying it
+* WRITES the camera's settings and changes what the tracker calls settled from
+* the next frame on. Those are different enough in consequence that a button
+* labelled "calibrate" must not choose between them on the operator's behalf —
+* the run reports, the operator applies. A REFUSED run never writes the bar
+* whatever `apply` says; it writes only the note, so the refusal and its reason
+* are visible in the form instead of being a toast that scrolls away.
+*/
+/** Mirrors `StillnessCalibrationRefusal` — kept literal so the wire schema is
+*  self-describing and a new reason is a deliberate edit in both places. */
+var StillnessRefusalSchema = _enum([
+	"no-tracks",
+	"too-few-tracks",
+	"too-few-samples",
+	"no-motion-evidence"
+]);
+var StillnessMeasurementSchema = object({
+	/** Tracks that contributed at least one speed sample. */
+	trackCount: number().int(),
+	/** Tracks the pass actually read, after the cost bound. */
+	tracksRead: number().int(),
+	sampleCount: number().int(),
+	/** Speed quantiles, subject-box-diagonals per second. `null` when there was
+	*  nothing to measure — never 0, which would read as a measured stillness
+	*  (D393). */
+	p25: number().nullable(),
+	p50: number().nullable(),
+	p90: number().nullable(),
+	/** Median gap between stored positions (s) — the camera's real cadence. */
+	medianIntervalSec: number().nullable(),
+	/** Median subject box diagonal (px) the speeds were normalised by. */
+	medianSubjectDiagonalPx: number().nullable()
+});
+var stillnessCalibrationActions = defineCustomActions({ 
+/**
+* `admin` because it WRITES a per-camera detection threshold when `apply` is
+* set, and because the report describes how the camera's subjects move,
+* which is not a viewer-level fact.
+*/
+"stillness.calibrate": customAction(object({
+	deviceId: number().int(),
+	/** How far back to read. Bounded: this pass parses ~10 kB of trajectory a
+	*  row, so the window is a suggestion and `maxTracks` is the real bound. */
+	sinceHours: number().min(.25).max(720).default(72),
+	/** Hard cost bound on tracks read, newest first. */
+	maxTracks: number().int().min(1).max(1e3).default(200),
+	/**
+	* Write the chosen bar onto the camera. Never implicit, and never done at
+	* all for a refused run.
+	*/
+	apply: boolean().default(false)
+}), object({
+	deviceId: number().int(),
+	/** The window actually read (epoch ms). */
+	since: number().int(),
+	until: number().int(),
+	accepted: boolean(),
+	/** Why it refused. Absent on an accepted run. */
+	reason: StillnessRefusalSchema.optional(),
+	/** The chosen bar, subject-box-diagonals per second. Absent on a refusal —
+	*  never 0, which the settings layer reads as "uncalibrated". */
+	bar: number().optional(),
+	/** The raw quantile before the rails, so the clamp is arguable. */
+	rawBar: number().optional(),
+	clampedBy: _enum([
+		"none",
+		"floor",
+		"ceiling",
+		"min",
+		"max"
+	]).optional(),
+	measurement: StillnessMeasurementSchema,
+	/** The bar this camera was on BEFORE the run — `null` = uncalibrated. Read
+	*  before any write, so the operator sees both numbers. */
+	previousBar: number().nullable(),
+	/** Whether the camera's settings were actually written. */
+	applied: boolean(),
+	/** The one-line note stored on the camera (accepted or refused). */
+	note: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}) });
+//#endregion
+//#region src/pipeline-analytics/stillness-settings.ts
+/**
+* Per-device STILLNESS SCALE — the one number that says how fast a subject on
+* THIS camera has to move before it is travelling.
+*
+* A threshold belongs to whoever GENERATES the event, per device, never baked
+* into a classifier default. The judgement this feeds is
+* `StateAnalyzer.speedSaysSettled`; the measurement behind the number is
+* `pipeline/tracker/stillness-scale.ts`, which also carries the live
+* measurement showing why one number cannot serve a 30 m driveway and a 2 m
+* doorway.
+*
+* Cascade and shape mirror `stationary-settings` / `media-settings`: a
+* per-device override on top of the default, resolved per FIELD, and a parse
+* that never throws on a bad blob.
+*
+* **Absent behaves exactly as today.** The device store is a flat numeric blob
+* with no room for "unset", so the stored form of absent is `0` — and `0` is
+* not a bar anyone could want (it would mean nothing on this camera is ever
+* still) and not a value the calibration can produce (`minBar`). The decision
+* layer never sees it: {@link resolveStillSpeedFracPerSec} maps it to
+* `undefined`, and `undefined` is what leaves `StateAnalyzer` on its original
+* absolute `velocityThreshold` path.
+*/
+var StillnessSettingsSchema = object({
+	/**
+	* The camera's "not travelling" bar: centroid speed as a fraction of the
+	* SUBJECT's own box diagonal, per second. `0` = not calibrated (see above).
+	*
+	* Measured p50 on the live hub 2026-09-19, for scale: 0.0136 (device 592,
+	* close view, mostly parked subjects) to 0.3081 (device 615, far view, only
+	* transits).
+	*/
+	stillnessSpeedFracPerSec: number().min(0).max(1).default(0),
+	/**
+	* When the number above was last CHOSEN — by a calibration run or by the
+	* operator. `0` = never. Purely a readout; nothing gates on it.
+	*/
+	stillnessCalibratedAt: number().int().min(0).default(0),
+	/**
+	* What the last calibration run measured and decided, in one line
+	* (`describeStillnessCalibration`) — including a REFUSAL and its named
+	* reason, because "why is this camera still on the default" has to be
+	* answerable without re-running anything.
+	*/
+	stillnessCalibrationNote: string().max(400).default("")
+});
+var STILLNESS_DEFAULTS = StillnessSettingsSchema.parse({});
+/**
+* Resolve a per-device store blob into typed stillness settings. Unknown or
+* invalid fields fall back to the default for that field — including a bar
+* outside the calibration's own rails, which is refused rather than clamped:
+* a number the calibration could never have produced is not evidence about
+* this camera, and silently bending it into range would present it as if it
+* were.
+*/
+function resolveStillnessSettings(raw) {
+	const pick = (key) => {
+		const parsed = StillnessSettingsSchema.shape[key].safeParse(raw[key]);
+		return parsed.success ? parsed.data : STILLNESS_DEFAULTS[key];
+	};
+	return {
+		stillnessSpeedFracPerSec: pick("stillnessSpeedFracPerSec"),
+		stillnessCalibratedAt: pick("stillnessCalibratedAt"),
+		stillnessCalibrationNote: pick("stillnessCalibrationNote")
+	};
+}
+/**
+* The bar the decision layer gets: a positive, in-rails number, or
+* `undefined` for "this camera is not calibrated — judge it exactly as
+* before". The ONE place the stored-zero convention is interpreted.
+*/
+function resolveStillSpeedFracPerSec(settings) {
+	const bar = settings.stillnessSpeedFracPerSec;
+	if (!(bar >= .001) || bar > 1) return void 0;
+	return bar;
+}
+//#endregion
 //#region src/pipeline-analytics/viewer-settings-actions.ts
 /**
 * Viewer settings snapshots — hub-shared named blobs of the viewer's stores.
@@ -47860,336 +48190,6 @@ function makeViewerSettingsActionHandlers(store) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/stillness-calibration-actions.ts
-/**
-* stillness-calibration-actions — "measure this camera's own stillness scale".
-*
-* ## Why an `addons.custom` action and not a cap method
-*
-* Same reason as `face.rescoreTrack` beside it: a cap method's wire schema
-* lives in `@camstack/types`, which travels inside the `@camstack/server`
-* closure, so a new one is not callable until a server train ships. Here the
-* schema lives in this addon's own dist and the hub forwards an opaque
-* envelope, so `camstack deploy` is the whole delivery.
-*
-* ## Why `apply` is explicit and not a fallback
-*
-* A calibration run READS recorded tracks and does arithmetic. Applying it
-* WRITES the camera's settings and changes what the tracker calls settled from
-* the next frame on. Those are different enough in consequence that a button
-* labelled "calibrate" must not choose between them on the operator's behalf —
-* the run reports, the operator applies. A REFUSED run never writes the bar
-* whatever `apply` says; it writes only the note, so the refusal and its reason
-* are visible in the form instead of being a toast that scrolls away.
-*/
-/** Mirrors `StillnessCalibrationRefusal` — kept literal so the wire schema is
-*  self-describing and a new reason is a deliberate edit in both places. */
-var StillnessRefusalSchema = _enum([
-	"no-tracks",
-	"too-few-tracks",
-	"too-few-samples",
-	"no-motion-evidence"
-]);
-var StillnessMeasurementSchema = object({
-	/** Tracks that contributed at least one speed sample. */
-	trackCount: number().int(),
-	/** Tracks the pass actually read, after the cost bound. */
-	tracksRead: number().int(),
-	sampleCount: number().int(),
-	/** Speed quantiles, subject-box-diagonals per second. `null` when there was
-	*  nothing to measure — never 0, which would read as a measured stillness
-	*  (D393). */
-	p25: number().nullable(),
-	p50: number().nullable(),
-	p90: number().nullable(),
-	/** Median gap between stored positions (s) — the camera's real cadence. */
-	medianIntervalSec: number().nullable(),
-	/** Median subject box diagonal (px) the speeds were normalised by. */
-	medianSubjectDiagonalPx: number().nullable()
-});
-var stillnessCalibrationActions = defineCustomActions({ 
-/**
-* `admin` because it WRITES a per-camera detection threshold when `apply` is
-* set, and because the report describes how the camera's subjects move,
-* which is not a viewer-level fact.
-*/
-"stillness.calibrate": customAction(object({
-	deviceId: number().int(),
-	/** How far back to read. Bounded: this pass parses ~10 kB of trajectory a
-	*  row, so the window is a suggestion and `maxTracks` is the real bound. */
-	sinceHours: number().min(.25).max(720).default(72),
-	/** Hard cost bound on tracks read, newest first. */
-	maxTracks: number().int().min(1).max(1e3).default(200),
-	/**
-	* Write the chosen bar onto the camera. Never implicit, and never done at
-	* all for a refused run.
-	*/
-	apply: boolean().default(false)
-}), object({
-	deviceId: number().int(),
-	/** The window actually read (epoch ms). */
-	since: number().int(),
-	until: number().int(),
-	accepted: boolean(),
-	/** Why it refused. Absent on an accepted run. */
-	reason: StillnessRefusalSchema.optional(),
-	/** The chosen bar, subject-box-diagonals per second. Absent on a refusal —
-	*  never 0, which the settings layer reads as "uncalibrated". */
-	bar: number().optional(),
-	/** The raw quantile before the rails, so the clamp is arguable. */
-	rawBar: number().optional(),
-	clampedBy: _enum([
-		"none",
-		"floor",
-		"ceiling",
-		"min",
-		"max"
-	]).optional(),
-	measurement: StillnessMeasurementSchema,
-	/** The bar this camera was on BEFORE the run — `null` = uncalibrated. Read
-	*  before any write, so the operator sees both numbers. */
-	previousBar: number().nullable(),
-	/** Whether the camera's settings were actually written. */
-	applied: boolean(),
-	/** The one-line note stored on the camera (accepted or refused). */
-	note: string()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}) });
-/**
-* The shipped limits.
-*
-* `minTracks` 12 / `minSamples` 200: the four live cameras sampled above
-* produced 697–8739 samples from 42–51 tracks in a single 60-track read, so a
-* camera that cannot clear these has genuinely not been watched enough.
-* `maxTracks` 200 bounds the read: the `positions` blob averages ~10 kB a row
-* (`track-store.ts`), so this pass is ~2 MB of JSON at its worst.
-*/
-var DEFAULT_STILLNESS_CALIBRATION_LIMITS = {
-	minTracks: 12,
-	minSamples: 200,
-	maxTracks: 200,
-	minIntervalSec: .02,
-	maxIntervalSec: 3,
-	quantile: .25,
-	floorFactor: .02,
-	ceilFactor: .25,
-	minBar: .001,
-	maxBar: 1
-};
-/** Linear-interpolated quantile. `NaN` for an empty list — never 0, which
-*  would read as a measured zero (D393). */
-function quantileOf(values, p) {
-	if (values.length === 0) return NaN;
-	const sorted = [...values].sort((a, b) => a - b);
-	const idx = (sorted.length - 1) * Math.min(Math.max(p, 0), 1);
-	const lo = Math.floor(idx);
-	const hi = Math.ceil(idx);
-	const at = sorted[lo];
-	const next = sorted[hi];
-	if (at === void 0 || next === void 0) return NaN;
-	return at + (next - at) * (idx - lo);
-}
-/**
-* Per-sample centroid speeds for a camera, in subject-box-diagonals per second.
-*
-* A pair of consecutive positions contributes a sample only when the interval
-* between them is inside `[minIntervalSec, maxIntervalSec]` and the later box
-* has a positive diagonal. A gap outside that band is a session boundary or a
-* duplicate read, not a measurement of how fast anything travelled; a box with
-* no size is unknown geometry, and unknown is never a sample.
-*/
-function collectStillnessSamples(tracks, limits) {
-	const speeds = [];
-	const intervals = [];
-	const diagonals = [];
-	let trackCount = 0;
-	const read = tracks.slice(0, limits.maxTracks);
-	for (const track of read) {
-		const positions = [...track.positions].sort((a, b) => a.timestamp - b.timestamp);
-		let contributed = false;
-		for (let i = 1; i < positions.length; i++) {
-			const prev = positions[i - 1];
-			const cur = positions[i];
-			if (prev === void 0 || cur === void 0) continue;
-			const dtSec = (cur.timestamp - prev.timestamp) / 1e3;
-			if (dtSec < limits.minIntervalSec || dtSec > limits.maxIntervalSec) continue;
-			const diagonal = Math.hypot(cur.bbox.w, cur.bbox.h);
-			if (!(diagonal > 0)) continue;
-			const travelled = Math.hypot(cur.x - prev.x, cur.y - prev.y);
-			speeds.push(travelled / diagonal / dtSec);
-			intervals.push(dtSec);
-			diagonals.push(diagonal);
-			contributed = true;
-		}
-		if (contributed) trackCount++;
-	}
-	return {
-		speeds,
-		intervals,
-		diagonals,
-		trackCount,
-		tracksRead: read.length
-	};
-}
-function measure$1(samples) {
-	return {
-		trackCount: samples.trackCount,
-		sampleCount: samples.speeds.length,
-		p25: quantileOf(samples.speeds, .25),
-		p50: quantileOf(samples.speeds, .5),
-		p90: quantileOf(samples.speeds, .9),
-		medianIntervalSec: quantileOf(samples.intervals, .5),
-		medianSubjectDiagonalPx: quantileOf(samples.diagonals, .5)
-	};
-}
-/**
-* Choose this camera's stillness speed bar, or refuse with a named reason.
-*
-* The order of the gates is the order of the questions: is there anything at
-* all, is it enough tracks, is it enough samples, and did anything on this
-* camera ever actually move. The last one is not pedantry — the whole method
-* scales the bar against the camera's own travel, so with no travel there is
-* nothing to scale against and the default is the honest answer.
-*/
-function calibrateStillnessSpeed(samples, limits) {
-	const measurement = measure$1(samples);
-	if (samples.tracksRead === 0) return {
-		ok: false,
-		reason: "no-tracks",
-		measurement
-	};
-	if (samples.trackCount < limits.minTracks) return {
-		ok: false,
-		reason: "too-few-tracks",
-		measurement
-	};
-	if (samples.speeds.length < limits.minSamples) return {
-		ok: false,
-		reason: "too-few-samples",
-		measurement
-	};
-	if (!(measurement.p90 > 0)) return {
-		ok: false,
-		reason: "no-motion-evidence",
-		measurement
-	};
-	const rawBar = quantileOf(samples.speeds, limits.quantile);
-	const floor = measurement.p90 * limits.floorFactor;
-	const ceiling = measurement.p90 * limits.ceilFactor;
-	let bar = rawBar;
-	let clampedBy = "none";
-	if (bar < floor) {
-		bar = floor;
-		clampedBy = "floor";
-	} else if (bar > ceiling) {
-		bar = ceiling;
-		clampedBy = "ceiling";
-	}
-	if (bar < limits.minBar) {
-		bar = limits.minBar;
-		clampedBy = "min";
-	} else if (bar > limits.maxBar) {
-		bar = limits.maxBar;
-		clampedBy = "max";
-	}
-	return {
-		ok: true,
-		bar,
-		rawBar,
-		clampedBy,
-		measurement
-	};
-}
-/** One line an operator can read: what was measured, from how much, and what
-*  rule produced the stored number. Kept short — it rides the settings blob. */
-function describeStillnessCalibration(outcome) {
-	const m = outcome.measurement;
-	const n = (v) => Number.isFinite(v) ? v.toFixed(4) : "unknown";
-	const evidence = `${m.sampleCount} samples / ${m.trackCount} tracks, p25 ${n(m.p25)}, p50 ${n(m.p50)}, p90 ${n(m.p90)} subject-diagonals/s`;
-	if (!outcome.ok) return `refused (${outcome.reason}) — ${evidence}`;
-	return `bar ${n(outcome.bar)} (raw ${n(outcome.rawBar)}, clamp ${outcome.clampedBy}) — ${evidence}`;
-}
-//#endregion
-//#region src/pipeline-analytics/stillness-settings.ts
-/**
-* Per-device STILLNESS SCALE — the one number that says how fast a subject on
-* THIS camera has to move before it is travelling.
-*
-* A threshold belongs to whoever GENERATES the event, per device, never baked
-* into a classifier default. The judgement this feeds is
-* `StateAnalyzer.speedSaysSettled`; the measurement behind the number is
-* `pipeline/tracker/stillness-scale.ts`, which also carries the live
-* measurement showing why one number cannot serve a 30 m driveway and a 2 m
-* doorway.
-*
-* Cascade and shape mirror `stationary-settings` / `media-settings`: a
-* per-device override on top of the default, resolved per FIELD, and a parse
-* that never throws on a bad blob.
-*
-* **Absent behaves exactly as today.** The device store is a flat numeric blob
-* with no room for "unset", so the stored form of absent is `0` — and `0` is
-* not a bar anyone could want (it would mean nothing on this camera is ever
-* still) and not a value the calibration can produce (`minBar`). The decision
-* layer never sees it: {@link resolveStillSpeedFracPerSec} maps it to
-* `undefined`, and `undefined` is what leaves `StateAnalyzer` on its original
-* absolute `velocityThreshold` path.
-*/
-var StillnessSettingsSchema = object({
-	/**
-	* The camera's "not travelling" bar: centroid speed as a fraction of the
-	* SUBJECT's own box diagonal, per second. `0` = not calibrated (see above).
-	*
-	* Measured p50 on the live hub 2026-09-19, for scale: 0.0136 (device 592,
-	* close view, mostly parked subjects) to 0.3081 (device 615, far view, only
-	* transits).
-	*/
-	stillnessSpeedFracPerSec: number().min(0).max(1).default(0),
-	/**
-	* When the number above was last CHOSEN — by a calibration run or by the
-	* operator. `0` = never. Purely a readout; nothing gates on it.
-	*/
-	stillnessCalibratedAt: number().int().min(0).default(0),
-	/**
-	* What the last calibration run measured and decided, in one line
-	* (`describeStillnessCalibration`) — including a REFUSAL and its named
-	* reason, because "why is this camera still on the default" has to be
-	* answerable without re-running anything.
-	*/
-	stillnessCalibrationNote: string().max(400).default("")
-});
-var STILLNESS_DEFAULTS = StillnessSettingsSchema.parse({});
-/**
-* Resolve a per-device store blob into typed stillness settings. Unknown or
-* invalid fields fall back to the default for that field — including a bar
-* outside the calibration's own rails, which is refused rather than clamped:
-* a number the calibration could never have produced is not evidence about
-* this camera, and silently bending it into range would present it as if it
-* were.
-*/
-function resolveStillnessSettings(raw) {
-	const pick = (key) => {
-		const parsed = StillnessSettingsSchema.shape[key].safeParse(raw[key]);
-		return parsed.success ? parsed.data : STILLNESS_DEFAULTS[key];
-	};
-	return {
-		stillnessSpeedFracPerSec: pick("stillnessSpeedFracPerSec"),
-		stillnessCalibratedAt: pick("stillnessCalibratedAt"),
-		stillnessCalibrationNote: pick("stillnessCalibrationNote")
-	};
-}
-/**
-* The bar the decision layer gets: a positive, in-rails number, or
-* `undefined` for "this camera is not calibrated — judge it exactly as
-* before". The ONE place the stored-zero convention is interpreted.
-*/
-function resolveStillSpeedFracPerSec(settings) {
-	const bar = settings.stillnessSpeedFracPerSec;
-	if (!(bar >= .001) || bar > 1) return void 0;
-	return bar;
-}
-//#endregion
 //#region src/pipeline-analytics/viewer-settings-legacy-adoption.ts
 /**
 * @durable class=config owner=pipeline-analytics
@@ -48367,6 +48367,230 @@ async function adoptLegacyViewerSettingsSnapshots(deps) {
 	return retired;
 }
 /**
+* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
+*
+* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
+* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
+* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
+* one encode per event over a ~12 s window, not a permanent transcode child
+* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
+* it was measured on a real 615 720p cut before being chosen: **0.23 s of
+* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
+* The re-encode is smaller than what it replaces.
+*
+* So both attachments now agree on the timeline as well as on the window: one
+* clip, one rate, two containers.
+*/
+var DEFAULT_SPEED = 4;
+/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
+*  at or below 1080p is an identity scale and the broker copies it. */
+var RING_MP4_MAX_WIDTH = 1920;
+/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
+var RING_MP4_FPS = 15;
+var NO_MEDIA = {
+	mp4: null,
+	gif: null,
+	source: "none",
+	startOffsetMs: null,
+	endOffsetMs: null,
+	profile: null,
+	video: null
+};
+var EventMediaService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Cut this event. Never throws — a notification that lost its media is still
+	* a notification, and every branch that drops it logs why.
+	*/
+	async cut(request) {
+		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
+		const produced = await this.produce(request);
+		if (produced !== null) return produced;
+		return this.fallbackToRing(request);
+	}
+	async produce(request) {
+		const deviceId = request.deviceId;
+		const log = this.deps.logger;
+		const kinds = [];
+		if (request.wantMp4) kinds.push("mp4");
+		if (request.wantGif) kinds.push("gif");
+		let production;
+		try {
+			production = await this.deps.produce({
+				deviceId,
+				aroundMs: request.aroundMs,
+				preSeconds: request.preRollSec,
+				postSeconds: request.postRollSec,
+				kinds,
+				gifMaxWidth: 640,
+				gifFps: 12,
+				gifSpeed: 4,
+				speed: request.speed ?? DEFAULT_SPEED,
+				...request.profile !== void 0 ? { profile: request.profile } : {}
+			});
+		} catch (err) {
+			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return null;
+		}
+		const mp4 = await this.redeem(deviceId, production.media, "mp4");
+		const gif = await this.redeem(deviceId, production.media, "gif");
+		if (mp4 === null && gif === null) {
+			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: {
+					kinds: kinds.join(","),
+					profile: production.profile
+				}
+			});
+			return null;
+		}
+		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
+		const endOffsetMs = production.coverage.toTs - request.aroundMs;
+		log.info("nc media: one production, every attachment", {
+			tags: { deviceId },
+			meta: {
+				profile: production.profile,
+				video: production.video,
+				mp4Bytes: mp4?.byteLength ?? null,
+				gifBytes: gif?.byteLength ?? null,
+				startOffsetMs,
+				endOffsetMs,
+				sharedWindow: true
+			}
+		});
+		return {
+			mp4,
+			gif,
+			source: "produced",
+			startOffsetMs,
+			endOffsetMs,
+			profile: production.profile,
+			video: production.video
+		};
+	}
+	/**
+	* Redeem one artifact handle at the node that produced it.
+	*
+	* `null` is not an error here — a production simply may not carry the kind
+	* (a gif whose derive failed says so on the broker's own log line). A handle
+	* that FAILS to redeem is different and is logged, because it means the bytes
+	* existed and did not arrive.
+	*/
+	async redeem(deviceId, media, kind) {
+		const artifact = media.find((m) => m.kind === kind);
+		if (artifact === void 0) return null;
+		try {
+			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
+			if (res === null) {
+				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
+					tags: { deviceId },
+					meta: {
+						kind,
+						handle: artifact.handle,
+						nodeId: artifact.nodeId
+					}
+				});
+				return null;
+			}
+			const buf = Buffer.from(res.base64, "base64");
+			if (buf.byteLength === 0) return null;
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
+				tags: { deviceId },
+				meta: {
+					kind,
+					handle: artifact.handle,
+					nodeId: artifact.nodeId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
+	*
+	* Weaker than a production and deliberately so — the coherence here rests on
+	* the two calls being given IDENTICAL parameters rather than on there being
+	* one render. That is defensible because the ring only ever grows forward and
+	* `windowAround` selects by wall clock around the same instant, so two calls
+	* seconds apart choose the same packets; the one thing that could differ is
+	* the rendition, so the profile is pinned to whatever the FIRST call actually
+	* used and handed to the second.
+	*
+	* It exists for one reason: a hub whose `@camstack/server` predates the
+	* production method must not stop attaching footage, and three of the four
+	* live rules on this install ask for a gif and nothing else.
+	*/
+	async fallbackToRing(request) {
+		const deviceId = request.deviceId;
+		const speed = request.speed ?? DEFAULT_SPEED;
+		const window = {
+			deviceId,
+			aroundMs: request.aroundMs,
+			preRollSec: request.preRollSec,
+			postRollSec: request.postRollSec,
+			speed,
+			...request.profile !== void 0 ? { profile: request.profile } : {}
+		};
+		try {
+			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
+				...window,
+				format: "mp4",
+				maxWidth: RING_MP4_MAX_WIDTH,
+				fps: RING_MP4_FPS
+			}) : null;
+			const gif = request.wantGif ? await this.deps.renderRingClip({
+				...window,
+				format: "gif",
+				maxWidth: 640,
+				fps: 12 / 4,
+				speed: 4
+			}) : null;
+			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
+				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
+					tags: { deviceId },
+					meta: { aroundMs: request.aroundMs }
+				});
+				return NO_MEDIA;
+			}
+			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
+				tags: { deviceId },
+				meta: {
+					mp4Bytes: mp4?.byteLength ?? null,
+					gifBytes: gif?.byteLength ?? null,
+					profile: request.profile ?? null,
+					sharedWindow: "by-parameters"
+				}
+			});
+			return {
+				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
+				gif: gif !== null && gif.byteLength > 0 ? gif : null,
+				source: "ring-fallback",
+				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
+				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
+				profile: request.profile ?? null,
+				video: null
+			};
+		} catch (err) {
+			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return NO_MEDIA;
+		}
+	}
+};
+/**
 * How long the recorder keeps the file we are about to read and delete.
 *
 * `maxLifeMs` is `z.number().int().positive()` on the capability, so "do not
@@ -48620,230 +48844,6 @@ function decodeBase64(base64) {
 		return null;
 	}
 }
-/**
-* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
-*
-* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
-* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
-* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
-* one encode per event over a ~12 s window, not a permanent transcode child
-* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
-* it was measured on a real 615 720p cut before being chosen: **0.23 s of
-* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
-* The re-encode is smaller than what it replaces.
-*
-* So both attachments now agree on the timeline as well as on the window: one
-* clip, one rate, two containers.
-*/
-var DEFAULT_SPEED = 4;
-/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
-*  at or below 1080p is an identity scale and the broker copies it. */
-var RING_MP4_MAX_WIDTH = 1920;
-/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
-var RING_MP4_FPS = 15;
-var NO_MEDIA = {
-	mp4: null,
-	gif: null,
-	source: "none",
-	startOffsetMs: null,
-	endOffsetMs: null,
-	profile: null,
-	video: null
-};
-var EventMediaService = class {
-	deps;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Cut this event. Never throws — a notification that lost its media is still
-	* a notification, and every branch that drops it logs why.
-	*/
-	async cut(request) {
-		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
-		const produced = await this.produce(request);
-		if (produced !== null) return produced;
-		return this.fallbackToRing(request);
-	}
-	async produce(request) {
-		const deviceId = request.deviceId;
-		const log = this.deps.logger;
-		const kinds = [];
-		if (request.wantMp4) kinds.push("mp4");
-		if (request.wantGif) kinds.push("gif");
-		let production;
-		try {
-			production = await this.deps.produce({
-				deviceId,
-				aroundMs: request.aroundMs,
-				preSeconds: request.preRollSec,
-				postSeconds: request.postRollSec,
-				kinds,
-				gifMaxWidth: 640,
-				gifFps: 12,
-				gifSpeed: 4,
-				speed: request.speed ?? DEFAULT_SPEED,
-				...request.profile !== void 0 ? { profile: request.profile } : {}
-			});
-		} catch (err) {
-			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return null;
-		}
-		const mp4 = await this.redeem(deviceId, production.media, "mp4");
-		const gif = await this.redeem(deviceId, production.media, "gif");
-		if (mp4 === null && gif === null) {
-			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
-				tags: { deviceId },
-				meta: {
-					kinds: kinds.join(","),
-					profile: production.profile
-				}
-			});
-			return null;
-		}
-		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
-		const endOffsetMs = production.coverage.toTs - request.aroundMs;
-		log.info("nc media: one production, every attachment", {
-			tags: { deviceId },
-			meta: {
-				profile: production.profile,
-				video: production.video,
-				mp4Bytes: mp4?.byteLength ?? null,
-				gifBytes: gif?.byteLength ?? null,
-				startOffsetMs,
-				endOffsetMs,
-				sharedWindow: true
-			}
-		});
-		return {
-			mp4,
-			gif,
-			source: "produced",
-			startOffsetMs,
-			endOffsetMs,
-			profile: production.profile,
-			video: production.video
-		};
-	}
-	/**
-	* Redeem one artifact handle at the node that produced it.
-	*
-	* `null` is not an error here — a production simply may not carry the kind
-	* (a gif whose derive failed says so on the broker's own log line). A handle
-	* that FAILS to redeem is different and is logged, because it means the bytes
-	* existed and did not arrive.
-	*/
-	async redeem(deviceId, media, kind) {
-		const artifact = media.find((m) => m.kind === kind);
-		if (artifact === void 0) return null;
-		try {
-			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
-			if (res === null) {
-				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
-					tags: { deviceId },
-					meta: {
-						kind,
-						handle: artifact.handle,
-						nodeId: artifact.nodeId
-					}
-				});
-				return null;
-			}
-			const buf = Buffer.from(res.base64, "base64");
-			if (buf.byteLength === 0) return null;
-			const bytes = new Uint8Array(buf.byteLength);
-			bytes.set(buf);
-			return bytes;
-		} catch (err) {
-			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
-				tags: { deviceId },
-				meta: {
-					kind,
-					handle: artifact.handle,
-					nodeId: artifact.nodeId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-			return null;
-		}
-	}
-	/**
-	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
-	*
-	* Weaker than a production and deliberately so — the coherence here rests on
-	* the two calls being given IDENTICAL parameters rather than on there being
-	* one render. That is defensible because the ring only ever grows forward and
-	* `windowAround` selects by wall clock around the same instant, so two calls
-	* seconds apart choose the same packets; the one thing that could differ is
-	* the rendition, so the profile is pinned to whatever the FIRST call actually
-	* used and handed to the second.
-	*
-	* It exists for one reason: a hub whose `@camstack/server` predates the
-	* production method must not stop attaching footage, and three of the four
-	* live rules on this install ask for a gif and nothing else.
-	*/
-	async fallbackToRing(request) {
-		const deviceId = request.deviceId;
-		const speed = request.speed ?? DEFAULT_SPEED;
-		const window = {
-			deviceId,
-			aroundMs: request.aroundMs,
-			preRollSec: request.preRollSec,
-			postRollSec: request.postRollSec,
-			speed,
-			...request.profile !== void 0 ? { profile: request.profile } : {}
-		};
-		try {
-			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
-				...window,
-				format: "mp4",
-				maxWidth: RING_MP4_MAX_WIDTH,
-				fps: RING_MP4_FPS
-			}) : null;
-			const gif = request.wantGif ? await this.deps.renderRingClip({
-				...window,
-				format: "gif",
-				maxWidth: 640,
-				fps: 12 / 4,
-				speed: 4
-			}) : null;
-			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
-				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
-					tags: { deviceId },
-					meta: { aroundMs: request.aroundMs }
-				});
-				return NO_MEDIA;
-			}
-			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
-				tags: { deviceId },
-				meta: {
-					mp4Bytes: mp4?.byteLength ?? null,
-					gifBytes: gif?.byteLength ?? null,
-					profile: request.profile ?? null,
-					sharedWindow: "by-parameters"
-				}
-			});
-			return {
-				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
-				gif: gif !== null && gif.byteLength > 0 ? gif : null,
-				source: "ring-fallback",
-				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
-				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
-				profile: request.profile ?? null,
-				video: null
-			};
-		} catch (err) {
-			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return NO_MEDIA;
-		}
-	}
-};
 //#endregion
 //#region src/shared/frame/crop-extractor.ts
 /**
@@ -57114,6 +57114,41 @@ function resolveMediaSettings(raw) {
 		snapshotMaxIdleMs: pick("snapshotMaxIdleMs")
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/our-recording-availability.ts
+/**
+* Coverage of OUR archive, asked of the `recording` collection by name.
+*
+* `recording` became a device collection on 2026-09-24 (D625): a camera may
+* have several sources of recorded coverage and every read names one. Every
+* read in this addon wants the same one — the footage OUR recorder wrote,
+* because everything downstream of it (a recorded clip cut, a timelapse, the
+* earliest-footage floor of a retention sweep) is about bytes we hold and can
+* export. A camera's own SD card is not an answer to any of those questions.
+*
+* It also owns the `read: 'unreadable'` rule, in one place: a read that FAILED
+* throws here rather than arriving downstream as an empty range list. Every
+* caller of this module treats "no ranges" as "recording is off for this
+* camera" and acts on it — dropping the attachment, skipping the render,
+* lowering the sweep floor — so folding a failed read into that shape would
+* make an unreachable recorder look exactly like a camera nobody records
+* (D393). The callers already handle a throw and log it as a read failure.
+*/
+/** Our coverage of `[fromMs, toMs)`, or a throw naming the failed read. */
+async function ourRecordingAvailability(api, input) {
+	const answer = await api.recording.getAvailability.query({
+		deviceId: input.deviceId,
+		provider: RECORDING_SOURCE_CAMSTACK_ADDON,
+		fromMs: input.fromMs,
+		toMs: input.toMs,
+		...input.profile !== void 0 ? { profile: input.profile } : {}
+	});
+	if (answer.read === "unreadable") throw new Error(`recording.getAvailability: the CamStack archive was unreadable for device ${String(input.deviceId)} — no claim is made about its footage`);
+	return {
+		ranges: answer.ranges,
+		profilesWithFootage: answer.profilesWithFootage
+	};
+}
 function toDetectionBbox(bbox) {
 	return {
 		x: bbox.x,
@@ -58405,6 +58440,17 @@ function resolveSearchThumbnailUrl(input) {
 	return `${input.baseUrl}/${encodeURIComponent(id)}`;
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
+/**
+* May a suppression verdict RETRACT this birth?
+*
+* `false` means hold: keep the track, log the held verdict, and let the
+* ordinary lifetime decide. It never means "confirmed".
+*/
+function suppressionMayRetract(source) {
+	return source !== "onboard";
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/package/package-area-gate.ts
 /**
 * Decide whether a package-class box is plausibly parcel-sized.
@@ -61098,65 +61144,6 @@ var StationaryEvidenceLedger = class {
 		for (const row of excess) this.forgetKey(row.key);
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
-function planStationaryTrackDisposal(input) {
-	const trackIds = [input.liveTrackId];
-	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
-	const keepMediaIds = /* @__PURE__ */ new Set();
-	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
-	return {
-		trackIds,
-		keepMediaIds
-	};
-}
-/**
-* Run the plan. The live track is dropped from RAM FIRST so it can never be
-* persisted by a sweep racing this call; the cascade then removes what every
-* track owned, sparing the entry's key frame, and deletes the row (a no-op for
-* the never-persisted live track).
-*
-* Never silent: the line names the entity, what went and what was kept — a
-* deleted track is dropped work, and the operator asked for it by name.
-*/
-async function disposeStationaryTracks(deps, plan) {
-	const [liveTrackId] = plan.trackIds;
-	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
-	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
-	const result = await runTrackCascadeBatch({
-		registry: [...deps.leaves, sparingMedia],
-		trackStore: deps.trackStore,
-		deviceId: deps.deviceId,
-		onTrackCleanup: deps.onTrackCleanup,
-		onFailure: (trackId, err) => {
-			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
-				tags: { deviceId: deps.deviceId },
-				meta: {
-					deviceId: deps.deviceId,
-					entryId: deps.entryId,
-					trackId,
-					error: String(err)
-				}
-			});
-		}
-	}, plan.trackIds);
-	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
-		tags: { deviceId: deps.deviceId },
-		meta: {
-			deviceId: deps.deviceId,
-			entryId: deps.entryId,
-			trackIds: plan.trackIds,
-			keptMediaIds: [...plan.keepMediaIds],
-			deleted: result.deleted,
-			failed: result.failed,
-			mediaRows: result.tally.media
-		}
-	});
-	return {
-		deleted: result.deleted,
-		failed: result.failed
-	};
-}
 /**
 * How long the same weak box must keep being seen before it may re-anchor.
 *
@@ -62098,6 +62085,97 @@ function rowToEntry(id, data) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
+function planStationaryTrackDisposal(input) {
+	const trackIds = [input.liveTrackId];
+	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
+	const keepMediaIds = /* @__PURE__ */ new Set();
+	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
+	return {
+		trackIds,
+		keepMediaIds
+	};
+}
+/**
+* Run the plan. The live track is dropped from RAM FIRST so it can never be
+* persisted by a sweep racing this call; the cascade then removes what every
+* track owned, sparing the entry's key frame, and deletes the row (a no-op for
+* the never-persisted live track).
+*
+* Never silent: the line names the entity, what went and what was kept — a
+* deleted track is dropped work, and the operator asked for it by name.
+*/
+async function disposeStationaryTracks(deps, plan) {
+	const [liveTrackId] = plan.trackIds;
+	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
+	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
+	const result = await runTrackCascadeBatch({
+		registry: [...deps.leaves, sparingMedia],
+		trackStore: deps.trackStore,
+		deviceId: deps.deviceId,
+		onTrackCleanup: deps.onTrackCleanup,
+		onFailure: (trackId, err) => {
+			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
+				tags: { deviceId: deps.deviceId },
+				meta: {
+					deviceId: deps.deviceId,
+					entryId: deps.entryId,
+					trackId,
+					error: String(err)
+				}
+			});
+		}
+	}, plan.trackIds);
+	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
+		tags: { deviceId: deps.deviceId },
+		meta: {
+			deviceId: deps.deviceId,
+			entryId: deps.entryId,
+			trackIds: plan.trackIds,
+			keptMediaIds: [...plan.keepMediaIds],
+			deleted: result.deleted,
+			failed: result.failed,
+			mediaRows: result.tally.media
+		}
+	});
+	return {
+		deleted: result.deleted,
+		failed: result.failed
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/stationary-planes.ts
+/**
+* WHICH detection planes carry the stationary machinery.
+*
+* A plane qualifies when it produces OBJECT BOXES on decoded frames — because
+* that is what the registry needs to decide an object is parked: a box, a
+* class, and an observed clock that only advances while frames flow.
+*
+* Both root detectors qualify. `pipeline` is the ML tree; `onboard` is the
+* camera's own firmware, and the boxes it produces are paired with a decoded
+* frame in that frame's pixel space — the same plane, entered by a different
+* door. `sensor` and `audio` do not: they carry no geometry to park.
+*
+* It used to be `source === 'pipeline'`, in five places, each explaining that
+* the gate "runs on that plane". The reason given was WHERE the flood it was
+* written for had been measured (617, the ML plane), never an argument that the
+* firmware's boxes were unfit. The cost of the accident, on device 640: a still
+* object is never promoted, so it holds `hasLiveTrack` true for as long as it
+* sits there, and every detection session runs to its 120 s cap instead of
+* closing on cooldown — `closed at the max-hold cap with a subject still
+* present`. The camera's lazy stream is then torn down and rebuilt on the next
+* detection, on a battery camera.
+*
+* One predicate and not five comparisons, because five copies of a rule drift:
+* this repo has already paid for that with two authorities on one function
+* (D62).
+*/
+/** Does this detection plane run the stationary registry, gate and promotion? */
+function planeRunsStationary(source) {
+	return source === "pipeline" || source === "onboard";
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/suppressed-births.ts
 /**
 * Memory of births the confirmation gate rejected, per device.
@@ -63013,49 +63091,6 @@ function hasKeyFrame(source) {
 	return source.keyFrame !== null && source.bbox !== null;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/stationary-planes.ts
-/**
-* WHICH detection planes carry the stationary machinery.
-*
-* A plane qualifies when it produces OBJECT BOXES on decoded frames — because
-* that is what the registry needs to decide an object is parked: a box, a
-* class, and an observed clock that only advances while frames flow.
-*
-* Both root detectors qualify. `pipeline` is the ML tree; `onboard` is the
-* camera's own firmware, and the boxes it produces are paired with a decoded
-* frame in that frame's pixel space — the same plane, entered by a different
-* door. `sensor` and `audio` do not: they carry no geometry to park.
-*
-* It used to be `source === 'pipeline'`, in five places, each explaining that
-* the gate "runs on that plane". The reason given was WHERE the flood it was
-* written for had been measured (617, the ML plane), never an argument that the
-* firmware's boxes were unfit. The cost of the accident, on device 640: a still
-* object is never promoted, so it holds `hasLiveTrack` true for as long as it
-* sits there, and every detection session runs to its 120 s cap instead of
-* closing on cooldown — `closed at the max-hold cap with a subject still
-* present`. The camera's lazy stream is then torn down and rebuilt on the next
-* detection, on a battery camera.
-*
-* One predicate and not five comparisons, because five copies of a rule drift:
-* this repo has already paid for that with two authorities on one function
-* (D62).
-*/
-/** Does this detection plane run the stationary registry, gate and promotion? */
-function planeRunsStationary(source) {
-	return source === "pipeline" || source === "onboard";
-}
-//#endregion
-//#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
-/**
-* May a suppression verdict RETRACT this birth?
-*
-* `false` means hold: keep the track, log the held verdict, and let the
-* ordinary lifetime decide. It never means "confirmed".
-*/
-function suppressionMayRetract(source) {
-	return source !== "onboard";
-}
-//#endregion
 //#region src/pipeline-analytics/rebuild-source-loader.ts
 /**
 * Assemble one track's rebuild inputs, reading at most ONE blob.
@@ -78266,7 +78301,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) }),
 			timelapse: {
 				store: center.timelapseStore,
-				getRecordingConfig: (deviceId) => api.recording.getDeviceConfig.query({ deviceId }).catch(() => null),
+				getRecordingConfig: (deviceId) => api.recordingArchive.getDeviceConfig.query({ deviceId }).catch(() => null),
 				runNow: (input) => center.runTimelapseNow(input)
 			},
 			summary: {
@@ -79359,7 +79394,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 					logger: logger.child("RecordedClip"),
 					now: () => Date.now(),
 					sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-					getAvailability: (input) => api.recording.getAvailability.query(input),
+					getAvailability: (input) => ourRecordingAvailability(api, input),
 					createExport: (input) => api.recordingExport.createExport.mutate({ ...input }),
 					getExport: (input) => api.recordingExport.getExport.query(input),
 					readExportBytes: (input) => api.recordingExport.readExportBytes.query(input),
@@ -79613,7 +79648,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	buildTimelapsePorts(api, stores) {
 		return {
 			getAvailability: async ({ deviceId, fromMs, toMs, profile }) => {
-				const availability = await api.recording.getAvailability.query({
+				const availability = await ourRecordingAvailability(api, {
 					deviceId,
 					fromMs,
 					toMs,
@@ -83804,7 +83839,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		if (cached && Date.now() - cached.at < 10 * 6e4) return cached.value;
 		let value = null;
 		try {
-			const res = await this.ctx.api.recording.getAvailability.query({
+			const res = await ourRecordingAvailability(this.ctx.api, {
 				deviceId,
 				fromMs: 0,
 				toMs: Date.now()
@@ -85850,7 +85885,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		} });
 		const deviceIds = input.deviceId !== void 0 ? [input.deviceId] : await trackStore.listDeviceIds();
 		const recordedStills = new RecordedStillService(buildRecordedStillPorts({
-			api: this.ctx.api.recording,
+			api: this.ctx.api.recordingArchive,
 			logger: this.ctx.logger
 		}));
 		const deps = {