@camstack/addon-post-analysis 1.2.273 → 1.2.275

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-m5QdWXqR.js");
+const require_dist = require("../dist-Br0p61E2.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -1460,7 +1460,8 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		return {
 			...this.readDelays(),
 			announceArm: this.config.get("announceArm"),
-			announceTargets: [...this.config.get("announceTargets")]
+			announceTargets: [...this.config.get("announceTargets")],
+			nonBlocking: []
 		};
 	}
 	/**
@@ -10822,6 +10823,23 @@ function requireCapCaller(method, caller) {
 	return caller;
 }
 //#endregion
+//#region src/notification-center/clock-text.ts
+/**
+* `{{time}}` — hours and minutes in the NOTIFICATION language.
+*
+* It used to be `toLocaleTimeString()` in the server's own locale, so an
+* Italian hub running an English container sent "8:05:13 PM" inside an
+* Italian sentence. The time zone is the host's unless a caller (a spec)
+* pins one.
+*/
+function ncClockText(language, atMs, timeZone) {
+	return new Intl.DateTimeFormat(language, {
+		hour: "2-digit",
+		minute: "2-digit",
+		...timeZone !== void 0 ? { timeZone } : {}
+	}).format(new Date(atMs));
+}
+//#endregion
 //#region src/notification-center/system-event-tap-url.ts
 /** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
 var ADMIN_ADDONS_PATH = "/system/addons";
@@ -12790,8 +12808,7 @@ var NcDispatcher = class {
 	async buildNotification(entry, target) {
 		const subject = entry.payload.subject;
 		const systemEvent = subject.systemEvent;
-		const displayDeviceId = systemEvent?.deviceId ?? subject.deviceId;
-		const deviceName = systemEvent !== void 0 && systemEvent.deviceId === void 0 ? "system" : await this.deps.getDeviceName(displayDeviceId).catch(() => null) ?? `camera ${displayDeviceId}`;
+		const deviceName = await notificationDeviceName(entry, this.deps.getDeviceName);
 		const alarmSource = systemEvent?.alarmSource;
 		const zoneLabels = systemEvent === void 0 ? await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones) : alarmSource?.zones !== void 0 && alarmSource.zones.length > 0 ? await resolveZoneLabels(this.deps.getZoneNames, alarmSource.deviceId, alarmSource.zones) : [];
 		const vars = buildTemplateVars(this.texts, entry, deviceName, zoneLabels);
@@ -13545,17 +13562,25 @@ async function resolveZoneLabels(getZoneNames, deviceId, zoneIds) {
 function percentOf(confidence) {
 	return confidence !== void 0 ? `${Math.round(confidence * 100)}%` : "";
 }
+/** What `{{camera}}` renders on a system row that names no device. */
+var NC_DEVICELESS_CAMERA_NAME = "system";
 /**
-* The variable map ONE render pass sees: scalars, then the composites built
-* from them, then the params a system-event row froze at intake.
+* The name `{{camera}}` renders for a row — the ONE derivation, shared by the
+* dispatcher and the template-variable parity spec.
 *
-* The three groups are layered in that order deliberately. A composite
-* (`{{subject}}`, `{{inZones}}`, `{{op}}`) is a finished phrase and must not be
-* visible to the fragments it was built from — that is the depth bound, and it
-* is enforced by `text-compose.ts` never being handed this map. The frozen
-* params go last because they are the row's own truth about a system event and
-* outrank the live vocabulary for exactly those names.
+* A system row that names no device (a node, a backup, an update) renders the
+* filler {@link NC_DEVICELESS_CAMERA_NAME}: there is no camera to name, which
+* is why the catalog offers `{{camera}}` on a system rule only for the kinds
+* that carry a device (template-vars.ts). Everything else asks the directory,
+* and falls back to `camera <id>` when it cannot answer.
 */
+async function notificationDeviceName(entry, getDeviceName) {
+	const subject = entry.payload.subject;
+	const systemEvent = subject.systemEvent;
+	if (systemEvent !== void 0 && systemEvent.deviceId === void 0) return NC_DEVICELESS_CAMERA_NAME;
+	const displayDeviceId = systemEvent?.deviceId ?? subject.deviceId;
+	return await getDeviceName(displayDeviceId).catch(() => null) ?? `camera ${displayDeviceId}`;
+}
 /** Class composition of a group, busiest classes in first-seen order. */
 function classCounts(members) {
 	const counts = /* @__PURE__ */ new Map();
@@ -13565,7 +13590,18 @@ function classCounts(members) {
 		count
 	}));
 }
-function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
+/**
+* The variable map ONE render pass sees: scalars, then the composites built
+* from them, then the params a system-event row froze at intake.
+*
+* The three groups are layered in that order deliberately. A composite
+* (`{{subject}}`, `{{inZones}}`, `{{op}}`) is a finished phrase and must not be
+* visible to the fragments it was built from — that is the depth bound, and it
+* is enforced by `text-compose.ts` never being handed this map. The frozen
+* params go last because they are the row's own truth about a system event and
+* outrank the live vocabulary for exactly those names.
+*/
+function buildTemplateVars(texts, entry, deviceName, zoneLabels, timeZone) {
 	const subject = entry.payload.subject;
 	const occupancy = subject.occupancy;
 	const systemEvent = subject.systemEvent;
@@ -13573,7 +13609,7 @@ function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
 	const group = entry.payload.group;
 	return {
 		camera: deviceName,
-		class: detection?.className ?? subject.className,
+		class: detection?.className ?? (systemEvent !== void 0 ? "" : subject.className),
 		label: detection?.label ?? subject.label ?? "",
 		zones: zoneLabels.join(", "),
 		subject: detection?.className !== void 0 ? ncSubjectText(texts, {
@@ -13586,10 +13622,14 @@ function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
 		}),
 		detectionSummary: group !== void 0 && group.members.length > 1 ? ncDetectionSummary(texts, classCounts(group.members)) : "",
 		inZones: ncInZonesText(texts, zoneLabels),
-		scope: occupancy?.zone ?? deviceName,
+		scope: occupancy !== void 0 ? occupancy.zone ?? deviceName : "",
 		zone: occupancy?.zone ?? zoneLabels[0] ?? "",
 		confidence: percentOf(detection?.confidence ?? subject.confidence),
-		time: new Date(subject.timestamp).toLocaleTimeString(),
+		time: ncClockText(texts.language, subject.timestamp, timeZone),
+		sounds: subject.audio?.labels.join(", ") ?? "",
+		hitPercent: subject.audio?.hitPercent !== void 0 ? `${Math.round(subject.audio.hitPercent)}` : "",
+		db: subject.audio?.peakDbfs !== void 0 ? `${Math.round(subject.audio.peakDbfs)}` : "",
+		eventType: subject.eventType ?? "",
 		rule: entry.payload.ruleName,
 		count: occupancy !== void 0 ? `${occupancy.count}` : group !== void 0 && group.members.length > 1 ? `${group.members.length}` : "",
 		capacity: occupancy !== void 0 ? `${occupancy.capacity}` : "",
@@ -17420,12 +17460,22 @@ var NcRuleStore = class {
 		await this.ledger.put(rule);
 		return rule;
 	}
-	/** Apply a partial patch. Immutable: returns the NEW rule object. */
-	async update(ruleId, patch) {
+	/**
+	* Apply a partial patch. Immutable: returns the NEW rule object.
+	*
+	* `clear` names optional fields to REMOVE before the merge — an omitted key
+	* keeps its stored value, so this is how an editor empties one. Setting and
+	* clearing the same key is a contradiction and is refused rather than
+	* resolved by ordering.
+	*/
+	async update(ruleId, patch, clear = []) {
 		const existing = this.ledger.get(ruleId);
 		if (!existing) throw new Error(`notification rule not found: ${ruleId}`);
+		const conflict = clear.find((key) => patch[key] !== void 0);
+		if (conflict !== void 0) throw new Error(`notification rule patch both sets and clears '${conflict}'`);
+		const cleared = new Set(clear);
 		const candidate = {
-			...existing,
+			...Object.fromEntries(Object.entries(existing).filter(([key]) => !cleared.has(key))),
 			...patch,
 			id: existing.id,
 			createdBy: existing.createdBy,
@@ -19333,13 +19383,18 @@ function clockOf$2(atMs) {
 	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
 /** Template vocabulary. Deliberately the SAME names the detection and timelapse
-*  bodies use (`rule`, `from`, `to`, `time`) plus the digest-only ones. */
-function templateVars$1(input) {
+*  bodies use (`rule`, `from`, `to`, `time`) plus the digest-only ones.
+*
+* Exported as `summaryTemplateVars` — not just an implementation detail of
+* {@link buildSummaryOutboxInputs} — so the parity spec
+* (`template-var-parity.spec.ts`) can assert this map directly against the
+* catalog, the same way `buildTemplateVars` is asserted for rule rows. */
+function summaryTemplateVars(input) {
 	return {
 		rule: input.ruleName,
 		from: clockOf$2(input.window.startMs),
 		to: clockOf$2(input.window.endMs),
-		time: clockOf$2(input.generatedAt),
+		time: ncClockText(input.texts.language, input.generatedAt),
 		events: String(input.tileCount),
 		cameras: String(input.cameraCount),
 		matched: String(input.matchedCount),
@@ -19446,7 +19501,7 @@ function summaryCaptionText(input) {
 * @returns rows ready for `NcOutbox.enqueue` — never sent from here.
 */
 function buildSummaryOutboxInputs(input) {
-	const vars = templateVars$1(input);
+	const vars = summaryTemplateVars(input);
 	const optedOut = new Set(input.disabledTargetIds ?? []);
 	const title = renderTemplate(input.template?.title, vars) ?? input.texts.text({
 		key: "summary.title",
@@ -21685,6 +21740,67 @@ async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
 	return files;
 }
 //#endregion
+//#region src/notification-center/template-preview.ts
+/**
+* `previewTemplate` — render a rule's draft title/body against EXAMPLE values,
+* so an operator sees `{{scope}}: {{count}}/{{capacity}}` become
+* `Cancello: 3/2` before saving the rule, not after the first real event.
+*
+* Pure with respect to the caller: it never sends anything, and the only
+* side-channel it reads is the live `NcTextCatalog` handed in, so a preview
+* always speaks the hub's CURRENT language and CURRENT overrides — the same
+* words a delivered notification would use.
+*/
+/**
+* The instant `{{time}}` is previewed at — fixed, and in UTC, so the example
+* is the same on every host: "20:05" in Italian, "08:05 PM" in English.
+*/
+var PREVIEW_INSTANT_MS = Date.UTC(2026, 8, 24, 20, 5);
+var PREVIEW_TIME_ZONE = "UTC";
+/**
+* The example map: every declared example, with the COMPOSITES rendered by the
+* real composers so the preview speaks the hub's language exactly as a
+* delivered notification would.
+*/
+function exampleVars(texts) {
+	return {
+		...Object.fromEntries(require_dist.NC_TEMPLATE_VARS.filter((d) => d.dynamic === void 0).map((d) => [d.name, d.example])),
+		subject: ncSubjectText(texts, {
+			className: "person",
+			label: "Mario",
+			labelKind: "identity"
+		}),
+		inZones: ncInZonesText(texts, ["Cancello"]),
+		op: ncOccupancyOp(texts, true),
+		time: ncClockText(texts.language, PREVIEW_INSTANT_MS, PREVIEW_TIME_ZONE),
+		detectionSummary: ncDetectionSummary(texts, [{
+			className: "person",
+			count: 2
+		}, {
+			className: "car",
+			count: 1
+		}])
+	};
+}
+var DYNAMIC_EXAMPLE = "3";
+function previewTemplate(texts, input) {
+	const ctx = input.context;
+	const allowed = new Set(require_dist.templateVarsFor(ctx).map((d) => d.name));
+	const examples = exampleVars(texts);
+	const used = [input.template.title ?? "", input.template.body ?? ""].flatMap((t) => [...templatePlaceholders(t)]);
+	const unknown = [...new Set(used.filter((name) => !require_dist.isKnownTemplateVar(name, ctx)))];
+	const vars = {};
+	for (const name of used) {
+		if (!require_dist.isKnownTemplateVar(name, ctx)) continue;
+		vars[name] = allowed.has(name) ? examples[name] ?? "" : DYNAMIC_EXAMPLE;
+	}
+	return {
+		title: renderTemplate(input.template.title, vars),
+		body: renderTemplate(input.template.body, vars),
+		unknown
+	};
+}
+//#endregion
 //#region src/notification-center/text-catalog-view.ts
 /**
 * The text catalog, projected for an EDITOR — Phase 2's read model, pure.
@@ -22124,14 +22240,19 @@ function clockOf(atMs) {
 	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
 /** Template vocabulary. Deliberately the same NAMES the rule templates use
-*  (`camera`, `rule`, `time`) plus the timelapse-only ones. */
-function templateVars(input) {
+*  (`camera`, `rule`, `time`) plus the timelapse-only ones.
+*
+* Exported as `timelapseTemplateVars` — not just an implementation detail of
+* {@link buildTimelapseOutboxInputs} — so the parity spec
+* (`template-var-parity.spec.ts`) can assert this map directly against the
+* catalog, the same way `buildTemplateVars` is asserted for rule rows. */
+function timelapseTemplateVars(input) {
 	return {
 		camera: input.deviceName ?? `camera ${input.deviceId}`,
 		rule: input.ruleName,
 		from: clockOf(input.window.startMs),
 		to: clockOf(input.window.endMs),
-		time: clockOf(input.generatedAt),
+		time: ncClockText(input.texts.language, input.generatedAt),
 		coverage: String(input.coverage.percent),
 		events: String(input.denseRanges),
 		...detectionTemplateVars(input.texts, input.detections ?? NO_DETECTIONS)
@@ -22212,7 +22333,7 @@ function timelapseRecordId(deviceId, windowEndMs) {
 * @returns rows ready for `NcOutbox.enqueue` — never sent from here.
 */
 function buildTimelapseOutboxInputs(input) {
-	const vars = templateVars(input);
+	const vars = timelapseTemplateVars(input);
 	const optedOut = new Set(input.disabledTargetIds ?? []);
 	const title = renderTemplate(input.template?.title, vars) ?? input.texts.text({
 		key: "timelapse.title",
@@ -23195,7 +23316,8 @@ function consumablesSliceOf(event) {
 var NC_ALARM_SETTINGS_FALLBACK = {
 	...DEFAULT_DELAYS,
 	announceArm: false,
-	announceTargets: []
+	announceTargets: [],
+	nonBlocking: []
 };
 /**
 * How often the "matched NO rule" report may fire per device. Long enough that
@@ -24445,6 +24567,10 @@ var NotificationCenter = class NotificationCenter {
 	get textCatalogEditor() {
 		return this.textEditor;
 	}
+	/** The live catalog every producer renders with — the preview must use the same one. */
+	get textCatalog() {
+		return this.texts;
+	}
 	/**
 	* Produce the last closed window for one camera of one timelapse rule, now.
 	*
@@ -25307,17 +25433,19 @@ var NotificationCenter = class NotificationCenter {
 				} });
 				return { rule: created };
 			},
-			updateRule: async ({ ruleId, patch, caller }) => {
+			updateRule: async ({ ruleId, patch, clear, caller }) => {
 				if (patch.targets !== void 0) await this.validateTargetRefs(patch.targets.map((t) => t.targetId));
-				if (patch.targets !== void 0 || patch.targetUsers !== void 0) {
+				const clearsUsers = clear?.includes("targetUsers") ?? false;
+				if (patch.targets !== void 0 || patch.targetUsers !== void 0 || clearsUsers) {
 					const existing = this.rules.get(ruleId);
-					NotificationCenter.assertHasAddressee(patch.targets ?? existing?.targets ?? [], patch.targetUsers ?? existing?.targetUsers);
+					NotificationCenter.assertHasAddressee(patch.targets ?? existing?.targets ?? [], clearsUsers ? void 0 : patch.targetUsers ?? existing?.targetUsers);
 				}
 				const { disabledTargetIds: _optOut, ...safePatch } = patch;
-				const updated = await this.rules.update(ruleId, safePatch);
+				const updated = await this.rules.update(ruleId, safePatch, clear ?? []);
 				this.logger.info("notification rule updated", { meta: {
 					ruleId,
-					by: caller.userId
+					by: caller.userId,
+					...clear && clear.length > 0 ? { cleared: clear } : {}
 				} });
 				return { rule: updated };
 			},
@@ -25334,6 +25462,8 @@ var NotificationCenter = class NotificationCenter {
 				catalog: [...require_dist.NC_CONDITION_CATALOG],
 				taxonomy: require_dist.NC_TAXONOMY
 			}),
+			getTemplateCatalog: async () => ({ vars: [...require_dist.NC_TEMPLATE_VARS] }),
+			previewTemplate: async (input) => previewTemplate(this.texts, input),
 			getHistory: async ({ filter }) => {
 				const entries = await this.outbox.queryHistory({
 					...filter.ruleId !== void 0 ? { ruleId: filter.ruleId } : {},
@@ -26521,6 +26651,12 @@ var NotificationCenter = class NotificationCenter {
 					...subject.observedAt !== void 0 ? { observedAt: subject.observedAt } : {},
 					...subject.occupancy !== void 0 ? { occupancy: frozenOccupancy(rule, subject.occupancy) } : {},
 					...subject.packagePhase !== void 0 ? { packagePhase: subject.packagePhase } : {},
+					...subject.audioWindow !== void 0 ? { audio: {
+						labels: subject.audioWindow.labels,
+						...subject.audioWindow.mode === "level" ? { hitPercent: subject.audioWindow.hitPercent } : {},
+						...subject.audioWindow.peakDbfs !== void 0 ? { peakDbfs: subject.audioWindow.peakDbfs } : {}
+					} } : {},
+					...subject.eventType !== void 0 ? { eventType: subject.eventType } : {},
 					...subject.systemEvent !== void 0 ? { systemEvent: subject.systemEvent } : {}
 				}
 			};
@@ -27709,14 +27845,13 @@ var ncActions = require_dist.defineCustomActions({
 		catalog: require_dist.array(require_dist.NcConditionDescriptorSchema),
 		taxonomy: require_dist.NcTaxonomySchema
 	})),
+	"nc.getTemplateCatalog": require_dist.customAction(require_dist.object({}), require_dist.object({ vars: require_dist.array(require_dist.NcTemplateVarDescriptorSchema) })),
+	"nc.previewTemplate": require_dist.customAction(require_dist.NcTemplatePreviewInputSchema, require_dist.NcTemplatePreviewSchema, { kind: "mutation" }),
 	"nc.createRule": require_dist.customAction(require_dist.object({ rule: require_dist.NcRuleInputSchema }), require_dist.object({ rule: require_dist.NcRuleSchema }), {
 		kind: "mutation",
 		caller: "required"
 	}),
-	"nc.updateRule": require_dist.customAction(require_dist.object({
-		ruleId: require_dist.string(),
-		patch: require_dist.NcRulePatchSchema
-	}), require_dist.object({ rule: require_dist.NcRuleSchema }), {
+	"nc.updateRule": require_dist.customAction(require_dist.NcRuleUpdateInputSchema, require_dist.object({ rule: require_dist.NcRuleSchema }), {
 		kind: "mutation",
 		caller: "required"
 	}),
@@ -27735,14 +27870,17 @@ var ncActions = require_dist.defineCustomActions({
 	/**
 	* THE AI SECTION of the ordinary rules — read and write.
 	*
-	* A pair of its own rather than two more keys on `nc.createRule` /
-	* `nc.updateRule`, and that is the whole point of the design: those two
-	* validate against `NcRuleInputSchema` from `@camstack/types`, which the
-	* addon resolves from the `@camstack/server` closure at runtime — so a new
-	* key on them is SILENTLY STRIPPED at save until a framework train lands and
-	* is installed. These two validate against a schema that lives in the addon
-	* (`rule-ai.ts`), so a field added to it is live on the next
-	* `camstack deploy packages/addon-post-analysis`.
+	* A pair of its own rather than two more keys on the rule CRUD, and that is
+	* the whole point of the design. The addon builds self-contained and INLINES
+	* `@camstack/types`, so its own copy of `NcRuleInputSchema` is never the
+	* problem and nothing here fails at load. The coupling is the HUB: the cap
+	* route (`notificationRules.createRule` / `updateRule`, which the admin
+	* editor uses) validates input against the copy of `@camstack/types` that
+	* `@camstack/system` inlines (`bundleTypesMainEntry`), so a new key on
+	* `NcRuleInputSchema` is SILENTLY STRIPPED there until a `@camstack/server`
+	* release carrying it is installed. These two validate only here, against a
+	* schema that lives in the addon (`rule-ai.ts`), so a field added to it is
+	* live on the next `camstack deploy packages/addon-post-analysis`.
 	*
 	* Scoped exactly as the rule CRUD is: reading needs a rule the caller can
 	* SEE, writing needs one they own (admins bypass ownership, never the caller
@@ -28234,6 +28372,12 @@ function makeNcActionHandlers(deps) {
 			catalog: [...require_dist.NC_CONDITION_CATALOG],
 			taxonomy: require_dist.NC_TAXONOMY
 		}),
+		"nc.getTemplateCatalog": async () => ({ vars: [...require_dist.NC_TEMPLATE_VARS] }),
+		"nc.previewTemplate": async (input) => {
+			const texts = deps.previewTexts;
+			if (texts === void 0) throw new Error("nc.previewTemplate: text catalog not wired");
+			return previewTemplate(texts, input);
+		},
 		"nc.createRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
 			const parsed = require_dist.NcRuleInputSchema.parse(input.rule);
@@ -28254,10 +28398,11 @@ function makeNcActionHandlers(deps) {
 			const patch = require_dist.NcRulePatchSchema.parse(input.patch);
 			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
 			const { ownerUserId: _owner, disabledTargetIds: _optOut, ...safe } = patch;
-			const rule = await deps.ruleStore.update(input.ruleId, safe);
+			const rule = await deps.ruleStore.update(input.ruleId, safe, input.clear ?? []);
 			deps.logger.info("nc rule updated", { meta: {
 				ruleId: rule.id,
-				owner: c.userId
+				owner: c.userId,
+				...input.clear && input.clear.length > 0 ? { cleared: input.clear } : {}
 			} });
 			return { rule };
 		},
@@ -41716,6 +41861,160 @@ var TrackResidentState = class {
 		if (resident.rasterFallback === void 0) resident.rasterFallback = fallback;
 	}
 };
+/**
+* The shipped limits.
+*
+* `minTracks` 12 / `minSamples` 200: the four live cameras sampled above
+* produced 697–8739 samples from 42–51 tracks in a single 60-track read, so a
+* camera that cannot clear these has genuinely not been watched enough.
+* `maxTracks` 200 bounds the read: the `positions` blob averages ~10 kB a row
+* (`track-store.ts`), so this pass is ~2 MB of JSON at its worst.
+*/
+var DEFAULT_STILLNESS_CALIBRATION_LIMITS = {
+	minTracks: 12,
+	minSamples: 200,
+	maxTracks: 200,
+	minIntervalSec: .02,
+	maxIntervalSec: 3,
+	quantile: .25,
+	floorFactor: .02,
+	ceilFactor: .25,
+	minBar: .001,
+	maxBar: 1
+};
+/** Linear-interpolated quantile. `NaN` for an empty list — never 0, which
+*  would read as a measured zero (D393). */
+function quantileOf(values, p) {
+	if (values.length === 0) return NaN;
+	const sorted = [...values].sort((a, b) => a - b);
+	const idx = (sorted.length - 1) * Math.min(Math.max(p, 0), 1);
+	const lo = Math.floor(idx);
+	const hi = Math.ceil(idx);
+	const at = sorted[lo];
+	const next = sorted[hi];
+	if (at === void 0 || next === void 0) return NaN;
+	return at + (next - at) * (idx - lo);
+}
+/**
+* Per-sample centroid speeds for a camera, in subject-box-diagonals per second.
+*
+* A pair of consecutive positions contributes a sample only when the interval
+* between them is inside `[minIntervalSec, maxIntervalSec]` and the later box
+* has a positive diagonal. A gap outside that band is a session boundary or a
+* duplicate read, not a measurement of how fast anything travelled; a box with
+* no size is unknown geometry, and unknown is never a sample.
+*/
+function collectStillnessSamples(tracks, limits) {
+	const speeds = [];
+	const intervals = [];
+	const diagonals = [];
+	let trackCount = 0;
+	const read = tracks.slice(0, limits.maxTracks);
+	for (const track of read) {
+		const positions = [...track.positions].sort((a, b) => a.timestamp - b.timestamp);
+		let contributed = false;
+		for (let i = 1; i < positions.length; i++) {
+			const prev = positions[i - 1];
+			const cur = positions[i];
+			if (prev === void 0 || cur === void 0) continue;
+			const dtSec = (cur.timestamp - prev.timestamp) / 1e3;
+			if (dtSec < limits.minIntervalSec || dtSec > limits.maxIntervalSec) continue;
+			const diagonal = Math.hypot(cur.bbox.w, cur.bbox.h);
+			if (!(diagonal > 0)) continue;
+			const travelled = Math.hypot(cur.x - prev.x, cur.y - prev.y);
+			speeds.push(travelled / diagonal / dtSec);
+			intervals.push(dtSec);
+			diagonals.push(diagonal);
+			contributed = true;
+		}
+		if (contributed) trackCount++;
+	}
+	return {
+		speeds,
+		intervals,
+		diagonals,
+		trackCount,
+		tracksRead: read.length
+	};
+}
+function measure$1(samples) {
+	return {
+		trackCount: samples.trackCount,
+		sampleCount: samples.speeds.length,
+		p25: quantileOf(samples.speeds, .25),
+		p50: quantileOf(samples.speeds, .5),
+		p90: quantileOf(samples.speeds, .9),
+		medianIntervalSec: quantileOf(samples.intervals, .5),
+		medianSubjectDiagonalPx: quantileOf(samples.diagonals, .5)
+	};
+}
+/**
+* Choose this camera's stillness speed bar, or refuse with a named reason.
+*
+* The order of the gates is the order of the questions: is there anything at
+* all, is it enough tracks, is it enough samples, and did anything on this
+* camera ever actually move. The last one is not pedantry — the whole method
+* scales the bar against the camera's own travel, so with no travel there is
+* nothing to scale against and the default is the honest answer.
+*/
+function calibrateStillnessSpeed(samples, limits) {
+	const measurement = measure$1(samples);
+	if (samples.tracksRead === 0) return {
+		ok: false,
+		reason: "no-tracks",
+		measurement
+	};
+	if (samples.trackCount < limits.minTracks) return {
+		ok: false,
+		reason: "too-few-tracks",
+		measurement
+	};
+	if (samples.speeds.length < limits.minSamples) return {
+		ok: false,
+		reason: "too-few-samples",
+		measurement
+	};
+	if (!(measurement.p90 > 0)) return {
+		ok: false,
+		reason: "no-motion-evidence",
+		measurement
+	};
+	const rawBar = quantileOf(samples.speeds, limits.quantile);
+	const floor = measurement.p90 * limits.floorFactor;
+	const ceiling = measurement.p90 * limits.ceilFactor;
+	let bar = rawBar;
+	let clampedBy = "none";
+	if (bar < floor) {
+		bar = floor;
+		clampedBy = "floor";
+	} else if (bar > ceiling) {
+		bar = ceiling;
+		clampedBy = "ceiling";
+	}
+	if (bar < limits.minBar) {
+		bar = limits.minBar;
+		clampedBy = "min";
+	} else if (bar > limits.maxBar) {
+		bar = limits.maxBar;
+		clampedBy = "max";
+	}
+	return {
+		ok: true,
+		bar,
+		rawBar,
+		clampedBy,
+		measurement
+	};
+}
+/** One line an operator can read: what was measured, from how much, and what
+*  rule produced the stored number. Kept short — it rides the settings blob. */
+function describeStillnessCalibration(outcome) {
+	const m = outcome.measurement;
+	const n = (v) => Number.isFinite(v) ? v.toFixed(4) : "unknown";
+	const evidence = `${m.sampleCount} samples / ${m.trackCount} tracks, p25 ${n(m.p25)}, p50 ${n(m.p50)}, p90 ${n(m.p90)} subject-diagonals/s`;
+	if (!outcome.ok) return `refused (${outcome.reason}) — ${evidence}`;
+	return `bar ${n(outcome.bar)} (raw ${n(outcome.rawBar)}, clamp ${outcome.clampedBy}) — ${evidence}`;
+}
 //#endregion
 //#region src/pipeline-analytics/pipeline/plate-clustering.ts
 /**
@@ -47714,6 +48013,184 @@ async function retentionScopeDeviceIds(deps, onError) {
 	return [...ids];
 }
 //#endregion
+//#region src/pipeline-analytics/stillness-calibration-actions.ts
+/**
+* stillness-calibration-actions — "measure this camera's own stillness scale".
+*
+* ## Why an `addons.custom` action and not a cap method
+*
+* Same reason as `face.rescoreTrack` beside it: a cap method's wire schema
+* lives in `@camstack/types`, which travels inside the `@camstack/server`
+* closure, so a new one is not callable until a server train ships. Here the
+* schema lives in this addon's own dist and the hub forwards an opaque
+* envelope, so `camstack deploy` is the whole delivery.
+*
+* ## Why `apply` is explicit and not a fallback
+*
+* A calibration run READS recorded tracks and does arithmetic. Applying it
+* WRITES the camera's settings and changes what the tracker calls settled from
+* the next frame on. Those are different enough in consequence that a button
+* labelled "calibrate" must not choose between them on the operator's behalf —
+* the run reports, the operator applies. A REFUSED run never writes the bar
+* whatever `apply` says; it writes only the note, so the refusal and its reason
+* are visible in the form instead of being a toast that scrolls away.
+*/
+/** Mirrors `StillnessCalibrationRefusal` — kept literal so the wire schema is
+*  self-describing and a new reason is a deliberate edit in both places. */
+var StillnessRefusalSchema = require_dist._enum([
+	"no-tracks",
+	"too-few-tracks",
+	"too-few-samples",
+	"no-motion-evidence"
+]);
+var StillnessMeasurementSchema = require_dist.object({
+	/** Tracks that contributed at least one speed sample. */
+	trackCount: require_dist.number().int(),
+	/** Tracks the pass actually read, after the cost bound. */
+	tracksRead: require_dist.number().int(),
+	sampleCount: require_dist.number().int(),
+	/** Speed quantiles, subject-box-diagonals per second. `null` when there was
+	*  nothing to measure — never 0, which would read as a measured stillness
+	*  (D393). */
+	p25: require_dist.number().nullable(),
+	p50: require_dist.number().nullable(),
+	p90: require_dist.number().nullable(),
+	/** Median gap between stored positions (s) — the camera's real cadence. */
+	medianIntervalSec: require_dist.number().nullable(),
+	/** Median subject box diagonal (px) the speeds were normalised by. */
+	medianSubjectDiagonalPx: require_dist.number().nullable()
+});
+var StillnessCalibrateInputSchema = require_dist.object({
+	deviceId: require_dist.number().int(),
+	/** How far back to read. Bounded: this pass parses ~10 kB of trajectory a
+	*  row, so the window is a suggestion and `maxTracks` is the real bound. */
+	sinceHours: require_dist.number().min(.25).max(720).default(72),
+	/** Hard cost bound on tracks read, newest first. */
+	maxTracks: require_dist.number().int().min(1).max(1e3).default(200),
+	/**
+	* Write the chosen bar onto the camera. Never implicit, and never done at
+	* all for a refused run.
+	*/
+	apply: require_dist.boolean().default(false)
+});
+var StillnessCalibrateResultSchema = require_dist.object({
+	deviceId: require_dist.number().int(),
+	/** The window actually read (epoch ms). */
+	since: require_dist.number().int(),
+	until: require_dist.number().int(),
+	accepted: require_dist.boolean(),
+	/** Why it refused. Absent on an accepted run. */
+	reason: StillnessRefusalSchema.optional(),
+	/** The chosen bar, subject-box-diagonals per second. Absent on a refusal —
+	*  never 0, which the settings layer reads as "uncalibrated". */
+	bar: require_dist.number().optional(),
+	/** The raw quantile before the rails, so the clamp is arguable. */
+	rawBar: require_dist.number().optional(),
+	clampedBy: require_dist._enum([
+		"none",
+		"floor",
+		"ceiling",
+		"min",
+		"max"
+	]).optional(),
+	measurement: StillnessMeasurementSchema,
+	/** The bar this camera was on BEFORE the run — `null` = uncalibrated. Read
+	*  before any write, so the operator sees both numbers. */
+	previousBar: require_dist.number().nullable(),
+	/** Whether the camera's settings were actually written. */
+	applied: require_dist.boolean(),
+	/** The one-line note stored on the camera (accepted or refused). */
+	note: require_dist.string()
+});
+var stillnessCalibrationActions = require_dist.defineCustomActions({ 
+/**
+* `admin` because it WRITES a per-camera detection threshold when `apply` is
+* set, and because the report describes how the camera's subjects move,
+* which is not a viewer-level fact.
+*/
+"stillness.calibrate": require_dist.customAction(StillnessCalibrateInputSchema, StillnessCalibrateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}) });
+//#endregion
+//#region src/pipeline-analytics/stillness-settings.ts
+/**
+* Per-device STILLNESS SCALE — the one number that says how fast a subject on
+* THIS camera has to move before it is travelling.
+*
+* A threshold belongs to whoever GENERATES the event, per device, never baked
+* into a classifier default. The judgement this feeds is
+* `StateAnalyzer.speedSaysSettled`; the measurement behind the number is
+* `pipeline/tracker/stillness-scale.ts`, which also carries the live
+* measurement showing why one number cannot serve a 30 m driveway and a 2 m
+* doorway.
+*
+* Cascade and shape mirror `stationary-settings` / `media-settings`: a
+* per-device override on top of the default, resolved per FIELD, and a parse
+* that never throws on a bad blob.
+*
+* **Absent behaves exactly as today.** The device store is a flat numeric blob
+* with no room for "unset", so the stored form of absent is `0` — and `0` is
+* not a bar anyone could want (it would mean nothing on this camera is ever
+* still) and not a value the calibration can produce (`minBar`). The decision
+* layer never sees it: {@link resolveStillSpeedFracPerSec} maps it to
+* `undefined`, and `undefined` is what leaves `StateAnalyzer` on its original
+* absolute `velocityThreshold` path.
+*/
+var StillnessSettingsSchema = require_dist.object({
+	/**
+	* The camera's "not travelling" bar: centroid speed as a fraction of the
+	* SUBJECT's own box diagonal, per second. `0` = not calibrated (see above).
+	*
+	* Measured p50 on the live hub 2026-09-19, for scale: 0.0136 (device 592,
+	* close view, mostly parked subjects) to 0.3081 (device 615, far view, only
+	* transits).
+	*/
+	stillnessSpeedFracPerSec: require_dist.number().min(0).max(1).default(0),
+	/**
+	* When the number above was last CHOSEN — by a calibration run or by the
+	* operator. `0` = never. Purely a readout; nothing gates on it.
+	*/
+	stillnessCalibratedAt: require_dist.number().int().min(0).default(0),
+	/**
+	* What the last calibration run measured and decided, in one line
+	* (`describeStillnessCalibration`) — including a REFUSAL and its named
+	* reason, because "why is this camera still on the default" has to be
+	* answerable without re-running anything.
+	*/
+	stillnessCalibrationNote: require_dist.string().max(400).default("")
+});
+var STILLNESS_DEFAULTS = StillnessSettingsSchema.parse({});
+/**
+* Resolve a per-device store blob into typed stillness settings. Unknown or
+* invalid fields fall back to the default for that field — including a bar
+* outside the calibration's own rails, which is refused rather than clamped:
+* a number the calibration could never have produced is not evidence about
+* this camera, and silently bending it into range would present it as if it
+* were.
+*/
+function resolveStillnessSettings(raw) {
+	const pick = (key) => {
+		const parsed = StillnessSettingsSchema.shape[key].safeParse(raw[key]);
+		return parsed.success ? parsed.data : STILLNESS_DEFAULTS[key];
+	};
+	return {
+		stillnessSpeedFracPerSec: pick("stillnessSpeedFracPerSec"),
+		stillnessCalibratedAt: pick("stillnessCalibratedAt"),
+		stillnessCalibrationNote: pick("stillnessCalibrationNote")
+	};
+}
+/**
+* The bar the decision layer gets: a positive, in-rails number, or
+* `undefined` for "this camera is not calibrated — judge it exactly as
+* before". The ONE place the stored-zero convention is interpreted.
+*/
+function resolveStillSpeedFracPerSec(settings) {
+	const bar = settings.stillnessSpeedFracPerSec;
+	if (!(bar >= .001) || bar > 1) return void 0;
+	return bar;
+}
+//#endregion
 //#region src/pipeline-analytics/viewer-settings-actions.ts
 /**
 * Viewer settings snapshots — hub-shared named blobs of the viewer's stores.
@@ -47934,338 +48411,6 @@ function makeViewerSettingsActionHandlers(store) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/stillness-calibration-actions.ts
-/**
-* stillness-calibration-actions — "measure this camera's own stillness scale".
-*
-* ## Why an `addons.custom` action and not a cap method
-*
-* Same reason as `face.rescoreTrack` beside it: a cap method's wire schema
-* lives in `@camstack/types`, which travels inside the `@camstack/server`
-* closure, so a new one is not callable until a server train ships. Here the
-* schema lives in this addon's own dist and the hub forwards an opaque
-* envelope, so `camstack deploy` is the whole delivery.
-*
-* ## Why `apply` is explicit and not a fallback
-*
-* A calibration run READS recorded tracks and does arithmetic. Applying it
-* WRITES the camera's settings and changes what the tracker calls settled from
-* the next frame on. Those are different enough in consequence that a button
-* labelled "calibrate" must not choose between them on the operator's behalf —
-* the run reports, the operator applies. A REFUSED run never writes the bar
-* whatever `apply` says; it writes only the note, so the refusal and its reason
-* are visible in the form instead of being a toast that scrolls away.
-*/
-/** Mirrors `StillnessCalibrationRefusal` — kept literal so the wire schema is
-*  self-describing and a new reason is a deliberate edit in both places. */
-var StillnessRefusalSchema = require_dist._enum([
-	"no-tracks",
-	"too-few-tracks",
-	"too-few-samples",
-	"no-motion-evidence"
-]);
-var StillnessMeasurementSchema = require_dist.object({
-	/** Tracks that contributed at least one speed sample. */
-	trackCount: require_dist.number().int(),
-	/** Tracks the pass actually read, after the cost bound. */
-	tracksRead: require_dist.number().int(),
-	sampleCount: require_dist.number().int(),
-	/** Speed quantiles, subject-box-diagonals per second. `null` when there was
-	*  nothing to measure — never 0, which would read as a measured stillness
-	*  (D393). */
-	p25: require_dist.number().nullable(),
-	p50: require_dist.number().nullable(),
-	p90: require_dist.number().nullable(),
-	/** Median gap between stored positions (s) — the camera's real cadence. */
-	medianIntervalSec: require_dist.number().nullable(),
-	/** Median subject box diagonal (px) the speeds were normalised by. */
-	medianSubjectDiagonalPx: require_dist.number().nullable()
-});
-var StillnessCalibrateInputSchema = require_dist.object({
-	deviceId: require_dist.number().int(),
-	/** How far back to read. Bounded: this pass parses ~10 kB of trajectory a
-	*  row, so the window is a suggestion and `maxTracks` is the real bound. */
-	sinceHours: require_dist.number().min(.25).max(720).default(72),
-	/** Hard cost bound on tracks read, newest first. */
-	maxTracks: require_dist.number().int().min(1).max(1e3).default(200),
-	/**
-	* Write the chosen bar onto the camera. Never implicit, and never done at
-	* all for a refused run.
-	*/
-	apply: require_dist.boolean().default(false)
-});
-var StillnessCalibrateResultSchema = require_dist.object({
-	deviceId: require_dist.number().int(),
-	/** The window actually read (epoch ms). */
-	since: require_dist.number().int(),
-	until: require_dist.number().int(),
-	accepted: require_dist.boolean(),
-	/** Why it refused. Absent on an accepted run. */
-	reason: StillnessRefusalSchema.optional(),
-	/** The chosen bar, subject-box-diagonals per second. Absent on a refusal —
-	*  never 0, which the settings layer reads as "uncalibrated". */
-	bar: require_dist.number().optional(),
-	/** The raw quantile before the rails, so the clamp is arguable. */
-	rawBar: require_dist.number().optional(),
-	clampedBy: require_dist._enum([
-		"none",
-		"floor",
-		"ceiling",
-		"min",
-		"max"
-	]).optional(),
-	measurement: StillnessMeasurementSchema,
-	/** The bar this camera was on BEFORE the run — `null` = uncalibrated. Read
-	*  before any write, so the operator sees both numbers. */
-	previousBar: require_dist.number().nullable(),
-	/** Whether the camera's settings were actually written. */
-	applied: require_dist.boolean(),
-	/** The one-line note stored on the camera (accepted or refused). */
-	note: require_dist.string()
-});
-var stillnessCalibrationActions = require_dist.defineCustomActions({ 
-/**
-* `admin` because it WRITES a per-camera detection threshold when `apply` is
-* set, and because the report describes how the camera's subjects move,
-* which is not a viewer-level fact.
-*/
-"stillness.calibrate": require_dist.customAction(StillnessCalibrateInputSchema, StillnessCalibrateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}) });
-/**
-* The shipped limits.
-*
-* `minTracks` 12 / `minSamples` 200: the four live cameras sampled above
-* produced 697–8739 samples from 42–51 tracks in a single 60-track read, so a
-* camera that cannot clear these has genuinely not been watched enough.
-* `maxTracks` 200 bounds the read: the `positions` blob averages ~10 kB a row
-* (`track-store.ts`), so this pass is ~2 MB of JSON at its worst.
-*/
-var DEFAULT_STILLNESS_CALIBRATION_LIMITS = {
-	minTracks: 12,
-	minSamples: 200,
-	maxTracks: 200,
-	minIntervalSec: .02,
-	maxIntervalSec: 3,
-	quantile: .25,
-	floorFactor: .02,
-	ceilFactor: .25,
-	minBar: .001,
-	maxBar: 1
-};
-/** Linear-interpolated quantile. `NaN` for an empty list — never 0, which
-*  would read as a measured zero (D393). */
-function quantileOf(values, p) {
-	if (values.length === 0) return NaN;
-	const sorted = [...values].sort((a, b) => a - b);
-	const idx = (sorted.length - 1) * Math.min(Math.max(p, 0), 1);
-	const lo = Math.floor(idx);
-	const hi = Math.ceil(idx);
-	const at = sorted[lo];
-	const next = sorted[hi];
-	if (at === void 0 || next === void 0) return NaN;
-	return at + (next - at) * (idx - lo);
-}
-/**
-* Per-sample centroid speeds for a camera, in subject-box-diagonals per second.
-*
-* A pair of consecutive positions contributes a sample only when the interval
-* between them is inside `[minIntervalSec, maxIntervalSec]` and the later box
-* has a positive diagonal. A gap outside that band is a session boundary or a
-* duplicate read, not a measurement of how fast anything travelled; a box with
-* no size is unknown geometry, and unknown is never a sample.
-*/
-function collectStillnessSamples(tracks, limits) {
-	const speeds = [];
-	const intervals = [];
-	const diagonals = [];
-	let trackCount = 0;
-	const read = tracks.slice(0, limits.maxTracks);
-	for (const track of read) {
-		const positions = [...track.positions].sort((a, b) => a.timestamp - b.timestamp);
-		let contributed = false;
-		for (let i = 1; i < positions.length; i++) {
-			const prev = positions[i - 1];
-			const cur = positions[i];
-			if (prev === void 0 || cur === void 0) continue;
-			const dtSec = (cur.timestamp - prev.timestamp) / 1e3;
-			if (dtSec < limits.minIntervalSec || dtSec > limits.maxIntervalSec) continue;
-			const diagonal = Math.hypot(cur.bbox.w, cur.bbox.h);
-			if (!(diagonal > 0)) continue;
-			const travelled = Math.hypot(cur.x - prev.x, cur.y - prev.y);
-			speeds.push(travelled / diagonal / dtSec);
-			intervals.push(dtSec);
-			diagonals.push(diagonal);
-			contributed = true;
-		}
-		if (contributed) trackCount++;
-	}
-	return {
-		speeds,
-		intervals,
-		diagonals,
-		trackCount,
-		tracksRead: read.length
-	};
-}
-function measure$1(samples) {
-	return {
-		trackCount: samples.trackCount,
-		sampleCount: samples.speeds.length,
-		p25: quantileOf(samples.speeds, .25),
-		p50: quantileOf(samples.speeds, .5),
-		p90: quantileOf(samples.speeds, .9),
-		medianIntervalSec: quantileOf(samples.intervals, .5),
-		medianSubjectDiagonalPx: quantileOf(samples.diagonals, .5)
-	};
-}
-/**
-* Choose this camera's stillness speed bar, or refuse with a named reason.
-*
-* The order of the gates is the order of the questions: is there anything at
-* all, is it enough tracks, is it enough samples, and did anything on this
-* camera ever actually move. The last one is not pedantry — the whole method
-* scales the bar against the camera's own travel, so with no travel there is
-* nothing to scale against and the default is the honest answer.
-*/
-function calibrateStillnessSpeed(samples, limits) {
-	const measurement = measure$1(samples);
-	if (samples.tracksRead === 0) return {
-		ok: false,
-		reason: "no-tracks",
-		measurement
-	};
-	if (samples.trackCount < limits.minTracks) return {
-		ok: false,
-		reason: "too-few-tracks",
-		measurement
-	};
-	if (samples.speeds.length < limits.minSamples) return {
-		ok: false,
-		reason: "too-few-samples",
-		measurement
-	};
-	if (!(measurement.p90 > 0)) return {
-		ok: false,
-		reason: "no-motion-evidence",
-		measurement
-	};
-	const rawBar = quantileOf(samples.speeds, limits.quantile);
-	const floor = measurement.p90 * limits.floorFactor;
-	const ceiling = measurement.p90 * limits.ceilFactor;
-	let bar = rawBar;
-	let clampedBy = "none";
-	if (bar < floor) {
-		bar = floor;
-		clampedBy = "floor";
-	} else if (bar > ceiling) {
-		bar = ceiling;
-		clampedBy = "ceiling";
-	}
-	if (bar < limits.minBar) {
-		bar = limits.minBar;
-		clampedBy = "min";
-	} else if (bar > limits.maxBar) {
-		bar = limits.maxBar;
-		clampedBy = "max";
-	}
-	return {
-		ok: true,
-		bar,
-		rawBar,
-		clampedBy,
-		measurement
-	};
-}
-/** One line an operator can read: what was measured, from how much, and what
-*  rule produced the stored number. Kept short — it rides the settings blob. */
-function describeStillnessCalibration(outcome) {
-	const m = outcome.measurement;
-	const n = (v) => Number.isFinite(v) ? v.toFixed(4) : "unknown";
-	const evidence = `${m.sampleCount} samples / ${m.trackCount} tracks, p25 ${n(m.p25)}, p50 ${n(m.p50)}, p90 ${n(m.p90)} subject-diagonals/s`;
-	if (!outcome.ok) return `refused (${outcome.reason}) — ${evidence}`;
-	return `bar ${n(outcome.bar)} (raw ${n(outcome.rawBar)}, clamp ${outcome.clampedBy}) — ${evidence}`;
-}
-//#endregion
-//#region src/pipeline-analytics/stillness-settings.ts
-/**
-* Per-device STILLNESS SCALE — the one number that says how fast a subject on
-* THIS camera has to move before it is travelling.
-*
-* A threshold belongs to whoever GENERATES the event, per device, never baked
-* into a classifier default. The judgement this feeds is
-* `StateAnalyzer.speedSaysSettled`; the measurement behind the number is
-* `pipeline/tracker/stillness-scale.ts`, which also carries the live
-* measurement showing why one number cannot serve a 30 m driveway and a 2 m
-* doorway.
-*
-* Cascade and shape mirror `stationary-settings` / `media-settings`: a
-* per-device override on top of the default, resolved per FIELD, and a parse
-* that never throws on a bad blob.
-*
-* **Absent behaves exactly as today.** The device store is a flat numeric blob
-* with no room for "unset", so the stored form of absent is `0` — and `0` is
-* not a bar anyone could want (it would mean nothing on this camera is ever
-* still) and not a value the calibration can produce (`minBar`). The decision
-* layer never sees it: {@link resolveStillSpeedFracPerSec} maps it to
-* `undefined`, and `undefined` is what leaves `StateAnalyzer` on its original
-* absolute `velocityThreshold` path.
-*/
-var StillnessSettingsSchema = require_dist.object({
-	/**
-	* The camera's "not travelling" bar: centroid speed as a fraction of the
-	* SUBJECT's own box diagonal, per second. `0` = not calibrated (see above).
-	*
-	* Measured p50 on the live hub 2026-09-19, for scale: 0.0136 (device 592,
-	* close view, mostly parked subjects) to 0.3081 (device 615, far view, only
-	* transits).
-	*/
-	stillnessSpeedFracPerSec: require_dist.number().min(0).max(1).default(0),
-	/**
-	* When the number above was last CHOSEN — by a calibration run or by the
-	* operator. `0` = never. Purely a readout; nothing gates on it.
-	*/
-	stillnessCalibratedAt: require_dist.number().int().min(0).default(0),
-	/**
-	* What the last calibration run measured and decided, in one line
-	* (`describeStillnessCalibration`) — including a REFUSAL and its named
-	* reason, because "why is this camera still on the default" has to be
-	* answerable without re-running anything.
-	*/
-	stillnessCalibrationNote: require_dist.string().max(400).default("")
-});
-var STILLNESS_DEFAULTS = StillnessSettingsSchema.parse({});
-/**
-* Resolve a per-device store blob into typed stillness settings. Unknown or
-* invalid fields fall back to the default for that field — including a bar
-* outside the calibration's own rails, which is refused rather than clamped:
-* a number the calibration could never have produced is not evidence about
-* this camera, and silently bending it into range would present it as if it
-* were.
-*/
-function resolveStillnessSettings(raw) {
-	const pick = (key) => {
-		const parsed = StillnessSettingsSchema.shape[key].safeParse(raw[key]);
-		return parsed.success ? parsed.data : STILLNESS_DEFAULTS[key];
-	};
-	return {
-		stillnessSpeedFracPerSec: pick("stillnessSpeedFracPerSec"),
-		stillnessCalibratedAt: pick("stillnessCalibratedAt"),
-		stillnessCalibrationNote: pick("stillnessCalibrationNote")
-	};
-}
-/**
-* The bar the decision layer gets: a positive, in-rails number, or
-* `undefined` for "this camera is not calibrated — judge it exactly as
-* before". The ONE place the stored-zero convention is interpreted.
-*/
-function resolveStillSpeedFracPerSec(settings) {
-	const bar = settings.stillnessSpeedFracPerSec;
-	if (!(bar >= .001) || bar > 1) return void 0;
-	return bar;
-}
-//#endregion
 //#region src/pipeline-analytics/viewer-settings-legacy-adoption.ts
 /**
 * @durable class=config owner=pipeline-analytics
@@ -48443,6 +48588,230 @@ async function adoptLegacyViewerSettingsSnapshots(deps) {
 	return retired;
 }
 /**
+* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
+*
+* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
+* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
+* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
+* one encode per event over a ~12 s window, not a permanent transcode child
+* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
+* it was measured on a real 615 720p cut before being chosen: **0.23 s of
+* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
+* The re-encode is smaller than what it replaces.
+*
+* So both attachments now agree on the timeline as well as on the window: one
+* clip, one rate, two containers.
+*/
+var DEFAULT_SPEED = 4;
+/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
+*  at or below 1080p is an identity scale and the broker copies it. */
+var RING_MP4_MAX_WIDTH = 1920;
+/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
+var RING_MP4_FPS = 15;
+var NO_MEDIA = {
+	mp4: null,
+	gif: null,
+	source: "none",
+	startOffsetMs: null,
+	endOffsetMs: null,
+	profile: null,
+	video: null
+};
+var EventMediaService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Cut this event. Never throws — a notification that lost its media is still
+	* a notification, and every branch that drops it logs why.
+	*/
+	async cut(request) {
+		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
+		const produced = await this.produce(request);
+		if (produced !== null) return produced;
+		return this.fallbackToRing(request);
+	}
+	async produce(request) {
+		const deviceId = request.deviceId;
+		const log = this.deps.logger;
+		const kinds = [];
+		if (request.wantMp4) kinds.push("mp4");
+		if (request.wantGif) kinds.push("gif");
+		let production;
+		try {
+			production = await this.deps.produce({
+				deviceId,
+				aroundMs: request.aroundMs,
+				preSeconds: request.preRollSec,
+				postSeconds: request.postRollSec,
+				kinds,
+				gifMaxWidth: 640,
+				gifFps: 12,
+				gifSpeed: 4,
+				speed: request.speed ?? DEFAULT_SPEED,
+				...request.profile !== void 0 ? { profile: request.profile } : {}
+			});
+		} catch (err) {
+			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return null;
+		}
+		const mp4 = await this.redeem(deviceId, production.media, "mp4");
+		const gif = await this.redeem(deviceId, production.media, "gif");
+		if (mp4 === null && gif === null) {
+			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: {
+					kinds: kinds.join(","),
+					profile: production.profile
+				}
+			});
+			return null;
+		}
+		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
+		const endOffsetMs = production.coverage.toTs - request.aroundMs;
+		log.info("nc media: one production, every attachment", {
+			tags: { deviceId },
+			meta: {
+				profile: production.profile,
+				video: production.video,
+				mp4Bytes: mp4?.byteLength ?? null,
+				gifBytes: gif?.byteLength ?? null,
+				startOffsetMs,
+				endOffsetMs,
+				sharedWindow: true
+			}
+		});
+		return {
+			mp4,
+			gif,
+			source: "produced",
+			startOffsetMs,
+			endOffsetMs,
+			profile: production.profile,
+			video: production.video
+		};
+	}
+	/**
+	* Redeem one artifact handle at the node that produced it.
+	*
+	* `null` is not an error here — a production simply may not carry the kind
+	* (a gif whose derive failed says so on the broker's own log line). A handle
+	* that FAILS to redeem is different and is logged, because it means the bytes
+	* existed and did not arrive.
+	*/
+	async redeem(deviceId, media, kind) {
+		const artifact = media.find((m) => m.kind === kind);
+		if (artifact === void 0) return null;
+		try {
+			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
+			if (res === null) {
+				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
+					tags: { deviceId },
+					meta: {
+						kind,
+						handle: artifact.handle,
+						nodeId: artifact.nodeId
+					}
+				});
+				return null;
+			}
+			const buf = Buffer.from(res.base64, "base64");
+			if (buf.byteLength === 0) return null;
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
+				tags: { deviceId },
+				meta: {
+					kind,
+					handle: artifact.handle,
+					nodeId: artifact.nodeId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
+	*
+	* Weaker than a production and deliberately so — the coherence here rests on
+	* the two calls being given IDENTICAL parameters rather than on there being
+	* one render. That is defensible because the ring only ever grows forward and
+	* `windowAround` selects by wall clock around the same instant, so two calls
+	* seconds apart choose the same packets; the one thing that could differ is
+	* the rendition, so the profile is pinned to whatever the FIRST call actually
+	* used and handed to the second.
+	*
+	* It exists for one reason: a hub whose `@camstack/server` predates the
+	* production method must not stop attaching footage, and three of the four
+	* live rules on this install ask for a gif and nothing else.
+	*/
+	async fallbackToRing(request) {
+		const deviceId = request.deviceId;
+		const speed = request.speed ?? DEFAULT_SPEED;
+		const window = {
+			deviceId,
+			aroundMs: request.aroundMs,
+			preRollSec: request.preRollSec,
+			postRollSec: request.postRollSec,
+			speed,
+			...request.profile !== void 0 ? { profile: request.profile } : {}
+		};
+		try {
+			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
+				...window,
+				format: "mp4",
+				maxWidth: RING_MP4_MAX_WIDTH,
+				fps: RING_MP4_FPS
+			}) : null;
+			const gif = request.wantGif ? await this.deps.renderRingClip({
+				...window,
+				format: "gif",
+				maxWidth: 640,
+				fps: 12 / 4,
+				speed: 4
+			}) : null;
+			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
+				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
+					tags: { deviceId },
+					meta: { aroundMs: request.aroundMs }
+				});
+				return NO_MEDIA;
+			}
+			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
+				tags: { deviceId },
+				meta: {
+					mp4Bytes: mp4?.byteLength ?? null,
+					gifBytes: gif?.byteLength ?? null,
+					profile: request.profile ?? null,
+					sharedWindow: "by-parameters"
+				}
+			});
+			return {
+				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
+				gif: gif !== null && gif.byteLength > 0 ? gif : null,
+				source: "ring-fallback",
+				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
+				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
+				profile: request.profile ?? null,
+				video: null
+			};
+		} catch (err) {
+			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return NO_MEDIA;
+		}
+	}
+};
+/**
 * How long the recorder keeps the file we are about to read and delete.
 *
 * `maxLifeMs` is `z.number().int().positive()` on the capability, so "do not
@@ -48696,230 +49065,6 @@ function decodeBase64(base64) {
 		return null;
 	}
 }
-/**
-* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
-*
-* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
-* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
-* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
-* one encode per event over a ~12 s window, not a permanent transcode child
-* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
-* it was measured on a real 615 720p cut before being chosen: **0.23 s of
-* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
-* The re-encode is smaller than what it replaces.
-*
-* So both attachments now agree on the timeline as well as on the window: one
-* clip, one rate, two containers.
-*/
-var DEFAULT_SPEED = 4;
-/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
-*  at or below 1080p is an identity scale and the broker copies it. */
-var RING_MP4_MAX_WIDTH = 1920;
-/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
-var RING_MP4_FPS = 15;
-var NO_MEDIA = {
-	mp4: null,
-	gif: null,
-	source: "none",
-	startOffsetMs: null,
-	endOffsetMs: null,
-	profile: null,
-	video: null
-};
-var EventMediaService = class {
-	deps;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Cut this event. Never throws — a notification that lost its media is still
-	* a notification, and every branch that drops it logs why.
-	*/
-	async cut(request) {
-		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
-		const produced = await this.produce(request);
-		if (produced !== null) return produced;
-		return this.fallbackToRing(request);
-	}
-	async produce(request) {
-		const deviceId = request.deviceId;
-		const log = this.deps.logger;
-		const kinds = [];
-		if (request.wantMp4) kinds.push("mp4");
-		if (request.wantGif) kinds.push("gif");
-		let production;
-		try {
-			production = await this.deps.produce({
-				deviceId,
-				aroundMs: request.aroundMs,
-				preSeconds: request.preRollSec,
-				postSeconds: request.postRollSec,
-				kinds,
-				gifMaxWidth: 640,
-				gifFps: 12,
-				gifSpeed: 4,
-				speed: request.speed ?? DEFAULT_SPEED,
-				...request.profile !== void 0 ? { profile: request.profile } : {}
-			});
-		} catch (err) {
-			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return null;
-		}
-		const mp4 = await this.redeem(deviceId, production.media, "mp4");
-		const gif = await this.redeem(deviceId, production.media, "gif");
-		if (mp4 === null && gif === null) {
-			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
-				tags: { deviceId },
-				meta: {
-					kinds: kinds.join(","),
-					profile: production.profile
-				}
-			});
-			return null;
-		}
-		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
-		const endOffsetMs = production.coverage.toTs - request.aroundMs;
-		log.info("nc media: one production, every attachment", {
-			tags: { deviceId },
-			meta: {
-				profile: production.profile,
-				video: production.video,
-				mp4Bytes: mp4?.byteLength ?? null,
-				gifBytes: gif?.byteLength ?? null,
-				startOffsetMs,
-				endOffsetMs,
-				sharedWindow: true
-			}
-		});
-		return {
-			mp4,
-			gif,
-			source: "produced",
-			startOffsetMs,
-			endOffsetMs,
-			profile: production.profile,
-			video: production.video
-		};
-	}
-	/**
-	* Redeem one artifact handle at the node that produced it.
-	*
-	* `null` is not an error here — a production simply may not carry the kind
-	* (a gif whose derive failed says so on the broker's own log line). A handle
-	* that FAILS to redeem is different and is logged, because it means the bytes
-	* existed and did not arrive.
-	*/
-	async redeem(deviceId, media, kind) {
-		const artifact = media.find((m) => m.kind === kind);
-		if (artifact === void 0) return null;
-		try {
-			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
-			if (res === null) {
-				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
-					tags: { deviceId },
-					meta: {
-						kind,
-						handle: artifact.handle,
-						nodeId: artifact.nodeId
-					}
-				});
-				return null;
-			}
-			const buf = Buffer.from(res.base64, "base64");
-			if (buf.byteLength === 0) return null;
-			const bytes = new Uint8Array(buf.byteLength);
-			bytes.set(buf);
-			return bytes;
-		} catch (err) {
-			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
-				tags: { deviceId },
-				meta: {
-					kind,
-					handle: artifact.handle,
-					nodeId: artifact.nodeId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-			return null;
-		}
-	}
-	/**
-	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
-	*
-	* Weaker than a production and deliberately so — the coherence here rests on
-	* the two calls being given IDENTICAL parameters rather than on there being
-	* one render. That is defensible because the ring only ever grows forward and
-	* `windowAround` selects by wall clock around the same instant, so two calls
-	* seconds apart choose the same packets; the one thing that could differ is
-	* the rendition, so the profile is pinned to whatever the FIRST call actually
-	* used and handed to the second.
-	*
-	* It exists for one reason: a hub whose `@camstack/server` predates the
-	* production method must not stop attaching footage, and three of the four
-	* live rules on this install ask for a gif and nothing else.
-	*/
-	async fallbackToRing(request) {
-		const deviceId = request.deviceId;
-		const speed = request.speed ?? DEFAULT_SPEED;
-		const window = {
-			deviceId,
-			aroundMs: request.aroundMs,
-			preRollSec: request.preRollSec,
-			postRollSec: request.postRollSec,
-			speed,
-			...request.profile !== void 0 ? { profile: request.profile } : {}
-		};
-		try {
-			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
-				...window,
-				format: "mp4",
-				maxWidth: RING_MP4_MAX_WIDTH,
-				fps: RING_MP4_FPS
-			}) : null;
-			const gif = request.wantGif ? await this.deps.renderRingClip({
-				...window,
-				format: "gif",
-				maxWidth: 640,
-				fps: 12 / 4,
-				speed: 4
-			}) : null;
-			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
-				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
-					tags: { deviceId },
-					meta: { aroundMs: request.aroundMs }
-				});
-				return NO_MEDIA;
-			}
-			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
-				tags: { deviceId },
-				meta: {
-					mp4Bytes: mp4?.byteLength ?? null,
-					gifBytes: gif?.byteLength ?? null,
-					profile: request.profile ?? null,
-					sharedWindow: "by-parameters"
-				}
-			});
-			return {
-				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
-				gif: gif !== null && gif.byteLength > 0 ? gif : null,
-				source: "ring-fallback",
-				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
-				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
-				profile: request.profile ?? null,
-				video: null
-			};
-		} catch (err) {
-			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-			return NO_MEDIA;
-		}
-	}
-};
 //#endregion
 //#region src/shared/frame/crop-extractor.ts
 /**
@@ -57190,6 +57335,41 @@ function resolveMediaSettings(raw) {
 		snapshotMaxIdleMs: pick("snapshotMaxIdleMs")
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/our-recording-availability.ts
+/**
+* Coverage of OUR archive, asked of the `recording` collection by name.
+*
+* `recording` became a device collection on 2026-09-24 (D625): a camera may
+* have several sources of recorded coverage and every read names one. Every
+* read in this addon wants the same one — the footage OUR recorder wrote,
+* because everything downstream of it (a recorded clip cut, a timelapse, the
+* earliest-footage floor of a retention sweep) is about bytes we hold and can
+* export. A camera's own SD card is not an answer to any of those questions.
+*
+* It also owns the `read: 'unreadable'` rule, in one place: a read that FAILED
+* throws here rather than arriving downstream as an empty range list. Every
+* caller of this module treats "no ranges" as "recording is off for this
+* camera" and acts on it — dropping the attachment, skipping the render,
+* lowering the sweep floor — so folding a failed read into that shape would
+* make an unreachable recorder look exactly like a camera nobody records
+* (D393). The callers already handle a throw and log it as a read failure.
+*/
+/** Our coverage of `[fromMs, toMs)`, or a throw naming the failed read. */
+async function ourRecordingAvailability(api, input) {
+	const answer = await api.recording.getAvailability.query({
+		deviceId: input.deviceId,
+		provider: require_dist.RECORDING_SOURCE_CAMSTACK_ADDON,
+		fromMs: input.fromMs,
+		toMs: input.toMs,
+		...input.profile !== void 0 ? { profile: input.profile } : {}
+	});
+	if (answer.read === "unreadable") throw new Error(`recording.getAvailability: the CamStack archive was unreadable for device ${String(input.deviceId)} — no claim is made about its footage`);
+	return {
+		ranges: answer.ranges,
+		profilesWithFootage: answer.profilesWithFootage
+	};
+}
 function toDetectionBbox(bbox) {
 	return {
 		x: bbox.x,
@@ -58481,6 +58661,17 @@ function resolveSearchThumbnailUrl(input) {
 	return `${input.baseUrl}/${encodeURIComponent(id)}`;
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
+/**
+* May a suppression verdict RETRACT this birth?
+*
+* `false` means hold: keep the track, log the held verdict, and let the
+* ordinary lifetime decide. It never means "confirmed".
+*/
+function suppressionMayRetract(source) {
+	return source !== "onboard";
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/package/package-area-gate.ts
 /**
 * Decide whether a package-class box is plausibly parcel-sized.
@@ -61174,65 +61365,6 @@ var StationaryEvidenceLedger = class {
 		for (const row of excess) this.forgetKey(row.key);
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
-function planStationaryTrackDisposal(input) {
-	const trackIds = [input.liveTrackId];
-	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
-	const keepMediaIds = /* @__PURE__ */ new Set();
-	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
-	return {
-		trackIds,
-		keepMediaIds
-	};
-}
-/**
-* Run the plan. The live track is dropped from RAM FIRST so it can never be
-* persisted by a sweep racing this call; the cascade then removes what every
-* track owned, sparing the entry's key frame, and deletes the row (a no-op for
-* the never-persisted live track).
-*
-* Never silent: the line names the entity, what went and what was kept — a
-* deleted track is dropped work, and the operator asked for it by name.
-*/
-async function disposeStationaryTracks(deps, plan) {
-	const [liveTrackId] = plan.trackIds;
-	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
-	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
-	const result = await runTrackCascadeBatch({
-		registry: [...deps.leaves, sparingMedia],
-		trackStore: deps.trackStore,
-		deviceId: deps.deviceId,
-		onTrackCleanup: deps.onTrackCleanup,
-		onFailure: (trackId, err) => {
-			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
-				tags: { deviceId: deps.deviceId },
-				meta: {
-					deviceId: deps.deviceId,
-					entryId: deps.entryId,
-					trackId,
-					error: String(err)
-				}
-			});
-		}
-	}, plan.trackIds);
-	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
-		tags: { deviceId: deps.deviceId },
-		meta: {
-			deviceId: deps.deviceId,
-			entryId: deps.entryId,
-			trackIds: plan.trackIds,
-			keptMediaIds: [...plan.keepMediaIds],
-			deleted: result.deleted,
-			failed: result.failed,
-			mediaRows: result.tally.media
-		}
-	});
-	return {
-		deleted: result.deleted,
-		failed: result.failed
-	};
-}
 /**
 * How long the same weak box must keep being seen before it may re-anchor.
 *
@@ -62174,6 +62306,97 @@ function rowToEntry(id, data) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
+function planStationaryTrackDisposal(input) {
+	const trackIds = [input.liveTrackId];
+	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
+	const keepMediaIds = /* @__PURE__ */ new Set();
+	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
+	return {
+		trackIds,
+		keepMediaIds
+	};
+}
+/**
+* Run the plan. The live track is dropped from RAM FIRST so it can never be
+* persisted by a sweep racing this call; the cascade then removes what every
+* track owned, sparing the entry's key frame, and deletes the row (a no-op for
+* the never-persisted live track).
+*
+* Never silent: the line names the entity, what went and what was kept — a
+* deleted track is dropped work, and the operator asked for it by name.
+*/
+async function disposeStationaryTracks(deps, plan) {
+	const [liveTrackId] = plan.trackIds;
+	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
+	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
+	const result = await runTrackCascadeBatch({
+		registry: [...deps.leaves, sparingMedia],
+		trackStore: deps.trackStore,
+		deviceId: deps.deviceId,
+		onTrackCleanup: deps.onTrackCleanup,
+		onFailure: (trackId, err) => {
+			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
+				tags: { deviceId: deps.deviceId },
+				meta: {
+					deviceId: deps.deviceId,
+					entryId: deps.entryId,
+					trackId,
+					error: String(err)
+				}
+			});
+		}
+	}, plan.trackIds);
+	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
+		tags: { deviceId: deps.deviceId },
+		meta: {
+			deviceId: deps.deviceId,
+			entryId: deps.entryId,
+			trackIds: plan.trackIds,
+			keptMediaIds: [...plan.keepMediaIds],
+			deleted: result.deleted,
+			failed: result.failed,
+			mediaRows: result.tally.media
+		}
+	});
+	return {
+		deleted: result.deleted,
+		failed: result.failed
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/stationary-planes.ts
+/**
+* WHICH detection planes carry the stationary machinery.
+*
+* A plane qualifies when it produces OBJECT BOXES on decoded frames — because
+* that is what the registry needs to decide an object is parked: a box, a
+* class, and an observed clock that only advances while frames flow.
+*
+* Both root detectors qualify. `pipeline` is the ML tree; `onboard` is the
+* camera's own firmware, and the boxes it produces are paired with a decoded
+* frame in that frame's pixel space — the same plane, entered by a different
+* door. `sensor` and `audio` do not: they carry no geometry to park.
+*
+* It used to be `source === 'pipeline'`, in five places, each explaining that
+* the gate "runs on that plane". The reason given was WHERE the flood it was
+* written for had been measured (617, the ML plane), never an argument that the
+* firmware's boxes were unfit. The cost of the accident, on device 640: a still
+* object is never promoted, so it holds `hasLiveTrack` true for as long as it
+* sits there, and every detection session runs to its 120 s cap instead of
+* closing on cooldown — `closed at the max-hold cap with a subject still
+* present`. The camera's lazy stream is then torn down and rebuilt on the next
+* detection, on a battery camera.
+*
+* One predicate and not five comparisons, because five copies of a rule drift:
+* this repo has already paid for that with two authorities on one function
+* (D62).
+*/
+/** Does this detection plane run the stationary registry, gate and promotion? */
+function planeRunsStationary(source) {
+	return source === "pipeline" || source === "onboard";
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/suppressed-births.ts
 /**
 * Memory of births the confirmation gate rejected, per device.
@@ -63089,49 +63312,6 @@ function hasKeyFrame(source) {
 	return source.keyFrame !== null && source.bbox !== null;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/stationary-planes.ts
-/**
-* WHICH detection planes carry the stationary machinery.
-*
-* A plane qualifies when it produces OBJECT BOXES on decoded frames — because
-* that is what the registry needs to decide an object is parked: a box, a
-* class, and an observed clock that only advances while frames flow.
-*
-* Both root detectors qualify. `pipeline` is the ML tree; `onboard` is the
-* camera's own firmware, and the boxes it produces are paired with a decoded
-* frame in that frame's pixel space — the same plane, entered by a different
-* door. `sensor` and `audio` do not: they carry no geometry to park.
-*
-* It used to be `source === 'pipeline'`, in five places, each explaining that
-* the gate "runs on that plane". The reason given was WHERE the flood it was
-* written for had been measured (617, the ML plane), never an argument that the
-* firmware's boxes were unfit. The cost of the accident, on device 640: a still
-* object is never promoted, so it holds `hasLiveTrack` true for as long as it
-* sits there, and every detection session runs to its 120 s cap instead of
-* closing on cooldown — `closed at the max-hold cap with a subject still
-* present`. The camera's lazy stream is then torn down and rebuilt on the next
-* detection, on a battery camera.
-*
-* One predicate and not five comparisons, because five copies of a rule drift:
-* this repo has already paid for that with two authorities on one function
-* (D62).
-*/
-/** Does this detection plane run the stationary registry, gate and promotion? */
-function planeRunsStationary(source) {
-	return source === "pipeline" || source === "onboard";
-}
-//#endregion
-//#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
-/**
-* May a suppression verdict RETRACT this birth?
-*
-* `false` means hold: keep the track, log the held verdict, and let the
-* ordinary lifetime decide. It never means "confirmed".
-*/
-function suppressionMayRetract(source) {
-	return source !== "onboard";
-}
-//#endregion
 //#region src/pipeline-analytics/rebuild-source-loader.ts
 /**
 * Assemble one track's rebuild inputs, reading at most ONE blob.
@@ -71703,9 +71883,111 @@ async function projectSensorMarkers(deps, data, timestamp) {
 	}
 	return landed;
 }
+//#endregion
+//#region src/pipeline-analytics/services/sensor-transition-gate.ts
+/**
+* The gate between "a `DeviceStateChanged` arrived for a mapped sensor cap"
+* and "the sensor actually CHANGED".
+*
+* ## What this fixes
+*
+* `handleSensorStateChanged` treated the ARRIVAL of the bus event as the
+* assertion, and never looked at the slice. It cannot: the kernel mirror
+* (`device-state-mirror.ts` `applySingleCapUpdate`) diffs the whole SLICE, and
+* a contact slice carries `lastChangedAt` beside `entryOpen`. Anything that
+* moves the timestamp without moving the boolean is a `DeviceStateChanged`,
+* and downstream it became a `SensorEvent` row and a synthetic `contact` track
+* on the linked camera's timeline.
+*
+* Measured on camera 615 / contact sensor 4131, 2026-08-29→30: **30 of 35**
+* contact events were one of two non-events.
+*
+*  - The RECOVERY family. The Zigbee entity flaps `off → unavailable → off`
+*    (03:22:37→03:23:28, 03:56:51→03:58:19, 04:40:05→04:45:45). The HA
+*    provider drops the `unavailable` push and writes the recovery, whose
+*    `entryOpen` is still `false` and whose `lastChangedAt` is HA's fresh
+*    `last_changed`. The mirror diffs, and emits.
+*  - The COLD-SLICE family. `HaBinarySensorDevice`'s constructor writes
+*    `{ entryOpen: false, lastChangedAt: 0 }` on every device rebuild; the
+*    real state lands seconds later with a `lastChangedAt` hours old. Two
+*    emissions, no transition.
+*
+* ## Why the predicate is imported and not written here
+*
+* `evaluateSensorEdge` (`@camstack/types`) is already THE edge predicate: the
+* virtual doorbell feeds it (`builtins/doorbell/trigger-engine.ts`) and so does
+* the recorder's sensor trigger (`addon-pipeline` `recorder/sensor-trigger.ts`).
+* Post-analysis was the third consumer of the same bus event and the only one
+* that did not. A second predicate here would diverge on the first cap added —
+* the exact failure [D62](../../../../../docs/decisions/adr-0062.md) names.
+*
+* ## Where it deliberately differs from the other two
+*
+* The doorbell and the recorder want the RISING edge only. A timeline marker
+* is not a doorbell: a door CLOSING is an event an operator wants to see, and
+* the taxonomy has one `contact` kind for both directions. So this gate accepts
+* `edge: 'rising'` **and** the `falling-edge` verdict, and rejects only the
+* verdicts that mean "nothing moved" — which is precisely the 30.
+*
+* ## Caps with no boolean level pass through untouched
+*
+* `EVENT_KIND_BY_CAP` covers sixteen caps; `SOURCE_CAP_ACTIVE_FIELD` covers the
+* ten that have a boolean whose edge means something. `doorbell`, `button`,
+* `lock-control`, `presence`, `enum-sensor` and `event-emitter` are NOT levels
+* — their ARRIVAL is the event, and three presses in a row are three markers.
+* Gating them would re-ship the failure of 2026-08-08, when camera 615's press
+* produced a row, a ring, a matched rule and no marker.
+*
+* ## A cover is a level whose level is a WORD
+*
+* `cover` is the sixteenth cap, and it is neither of the above. Its level is
+* the `state` word (`open`, `opening`, `closing`, `closed`, `stopped`), and its
+* slice also carries `position`, which ticks all the way through a travel and
+* is republished unchanged by providers that poll. Passed through, every tick
+* and every republish would write a sensor-event row per linked camera and an
+* NC evaluation — so it transitions on the WORD only (`WORD_LEVEL_FIELD`):
+* `closed → opening → open` is two events, a position tick or a same-word
+* republish is a `no-change` drop.
+*
+* Its FIRST sighting follows the booleans' rule (`evaluateSensorEdge`), with
+* `closed` as the inactive word: `closed` seeds the baseline and is dropped
+* (`baseline-seeded-inactive`); any other word is an EVENT when the slice's
+* `lastChangedAt` clears the same floor, `max(startedAt, now - freshness)`,
+* and is otherwise seeded and dropped (`baseline-seeded-stale-active`). It has
+* to emit: after a runner respawn the memory is empty and the next slice is
+* usually the next REAL change, and on a two-word cover (Velux, most HA
+* covers: `closed`/`open` only) seeding it would lose the whole opening.
+*
+* Residual edges, both erring towards silence on the ambiguous case like the
+* booleans do: a cover that was already open and whose `lastChangedAt` is
+* older than the floor is not reported (a respawn cannot tell it from a
+* hydration); and a first sighting whose `lastChangedAt` is fresh only
+* because a POSITION tick moved it (the slice timestamp is not the word's)
+* is reported once as if the word had just changed. The alarm needs covers
+* to be eventful to see one open (D630).
+*
+* ## Nothing here logs, and no drop is silent
+*
+* The gate is pure towards the world (no bus, no logger, no clock of its own —
+* the caller brings `now`), like the recorder's router. But it sits on a path
+* that carries every camera's native `motion` slice at motion rate — ~0.6/s
+* fleet-wide — so a line per drop would be its own outage. It accumulates
+* instead, per `(deviceId, capName, reason)`, and the caller drains one summary
+* per window. A `debug` at 3.3/s that nobody read is how a 100 %-rejection
+* regime survived three months here.
+*/
+/**
+* Caps whose level is a string word rather than a boolean: cap → slice field.
+* See "A cover is a level whose level is a WORD" above.
+*/
+var WORD_LEVEL_FIELD = { cover: "state" };
+/** The word a word-level cap rests in — its `false`, for the first-sighting rule. */
+var WORD_LEVEL_INACTIVE = { cover: "closed" };
 var SensorTransitionGate = class {
 	/** Last observed boolean, keyed by `${deviceId}:${capName}`. */
 	lastValues = /* @__PURE__ */ new Map();
+	/** Last observed word of a word-level cap, keyed by `${deviceId}:${capName}`. */
+	lastWords = /* @__PURE__ */ new Map();
 	/** Drops since the window opened, keyed by `${deviceId}:${capName}:${reason}`. */
 	drops = /* @__PURE__ */ new Map();
 	windowStartedAt;
@@ -71723,10 +72005,13 @@ var SensorTransitionGate = class {
 	/**
 	* Feed one `DeviceStateChanged` slice for a cap `EVENT_KIND_BY_CAP` maps.
 	*
-	* A cap with no boolean level passes through unconditionally. A cap that HAS
-	* one passes only when its boolean moved — in either direction.
+	* A cap with no level passes through unconditionally. A cap that HAS one
+	* passes only when its level moved — a boolean in either direction, or a
+	* word-level cap's word changing.
 	*/
 	observe(deviceId, capName, slice) {
+		const wordField = WORD_LEVEL_FIELD[capName];
+		if (wordField !== void 0) return this.observeWord(deviceId, capName, slice, wordField);
 		if (!require_dist.isSourceCap(capName)) return { changed: true };
 		const key = `${deviceId}:${capName}`;
 		const verdict = require_dist.evaluateSensorEdge({
@@ -71764,6 +72049,40 @@ var SensorTransitionGate = class {
 		this.drops.clear();
 		return out;
 	}
+	/**
+	* A word-level cap: a transition is the word changing. The memory is
+	* written only when the slice CARRIED a word, for the same reason as the
+	* booleans — a malformed slice must not become a baseline.
+	*/
+	observeWord(deviceId, capName, slice, wordField) {
+		const raw = slice[wordField];
+		if (typeof raw !== "string" || raw.length === 0) return this.drop(deviceId, capName, "non-word-value");
+		const key = `${deviceId}:${capName}`;
+		const prior = this.lastWords.get(key);
+		this.lastWords.set(key, raw);
+		if (prior === void 0) return this.firstWordSighting(deviceId, capName, slice, raw);
+		if (prior === raw) return this.drop(deviceId, capName, "no-change");
+		return { changed: true };
+	}
+	/**
+	* The booleans' first-sighting rule, on a word: the resting word seeds; any
+	* other word is an event only when the slice's own `lastChangedAt` clears
+	* the SAME floor `evaluateSensorEdge` uses, from the same two knobs.
+	*/
+	firstWordSighting(deviceId, capName, slice, word) {
+		if (word === WORD_LEVEL_INACTIVE[capName]) return this.drop(deviceId, capName, "baseline-seeded-inactive");
+		const changedAt = slice["lastChangedAt"];
+		const floor = Math.max(this.startedAtMs, this.now() - this.freshnessMs);
+		if (!(typeof changedAt === "number" && Number.isFinite(changedAt) && changedAt > 0 && changedAt >= floor)) return this.drop(deviceId, capName, "baseline-seeded-stale-active");
+		return { changed: true };
+	}
+	drop(deviceId, capName, reason) {
+		this.noteDrop(deviceId, capName, reason);
+		return {
+			changed: false,
+			reason
+		};
+	}
 	noteDrop(deviceId, capName, reason) {
 		const key = `${deviceId}:${capName}:${reason}`;
 		const prior = this.drops.get(key);
@@ -78342,7 +78661,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) }),
 			timelapse: {
 				store: center.timelapseStore,
-				getRecordingConfig: (deviceId) => api.recording.getDeviceConfig.query({ deviceId }).catch(() => null),
+				getRecordingConfig: (deviceId) => api.recordingArchive.getDeviceConfig.query({ deviceId }).catch(() => null),
 				runNow: (input) => center.runTimelapseNow(input)
 			},
 			summary: {
@@ -78350,6 +78669,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				runNow: (input) => center.runSummaryNow(input)
 			},
 			texts: center.textCatalogEditor,
+			previewTexts: center.textCatalog,
 			...this.ncArtifactIndex !== null ? { artifacts: this.ncArtifactIndex } : {},
 			artifactShelf: { remove: async (id) => await this.ncArtifactStore?.remove(id) ?? false },
 			ruleStatus: {
@@ -79435,7 +79755,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					logger: logger.child("RecordedClip"),
 					now: () => Date.now(),
 					sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-					getAvailability: (input) => api.recording.getAvailability.query(input),
+					getAvailability: (input) => ourRecordingAvailability(api, input),
 					createExport: (input) => api.recordingExport.createExport.mutate({ ...input }),
 					getExport: (input) => api.recordingExport.getExport.query(input),
 					readExportBytes: (input) => api.recordingExport.readExportBytes.query(input),
@@ -79689,7 +80009,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	buildTimelapsePorts(api, stores) {
 		return {
 			getAvailability: async ({ deviceId, fromMs, toMs, profile }) => {
-				const availability = await api.recording.getAvailability.query({
+				const availability = await ourRecordingAvailability(api, {
 					deviceId,
 					fromMs,
 					toMs,
@@ -83880,7 +84200,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		if (cached && Date.now() - cached.at < 10 * 6e4) return cached.value;
 		let value = null;
 		try {
-			const res = await this.ctx.api.recording.getAvailability.query({
+			const res = await ourRecordingAvailability(this.ctx.api, {
 				deviceId,
 				fromMs: 0,
 				toMs: Date.now()
@@ -85189,7 +85509,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* A cap with no boolean level (`doorbell`, `button`, `lock-control`,
 	* `presence`, `enum-sensor`, `event-emitter`) always passes — its ARRIVAL is
 	* the event, and gating it would re-ship the silence of 2026-08-08. A cap
-	* that HAS one passes only when the boolean moved, in either direction.
+	* that HAS one passes only when the boolean moved, in either direction — or,
+	* for `cover`, whose level is its `state` word, only when the word changed
+	* (a position tick or a same-word republish is a drop).
 	*
 	* A slice that is not an object at all is refused rather than defaulted to
 	* `{}`: `evaluateSensorEdge` would read `non-boolean-value` from an empty
@@ -85926,7 +86248,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		} });
 		const deviceIds = input.deviceId !== void 0 ? [input.deviceId] : await trackStore.listDeviceIds();
 		const recordedStills = new RecordedStillService(buildRecordedStillPorts({
-			api: this.ctx.api.recording,
+			api: this.ctx.api.recordingArchive,
 			logger: this.ctx.logger
 		}));
 		const deps = {