@camstack/addon-post-analysis 1.2.279 → 1.2.281

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BUtk8EU2.js");
+const require_dist = require("../dist-BtqlSCQT.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -5620,8 +5620,8 @@ async function raceTimeout(call, timeoutMs) {
 * detail the encoder can see.
 */
 async function downscaleJpeg(bytes, maxPx) {
-	const { default: sharp$17 } = await import("sharp");
-	const out = await sharp$17(Buffer.from(bytes)).resize({
+	const { default: sharp$18 } = await import("sharp");
+	const out = await sharp$18(Buffer.from(bytes)).resize({
 		width: maxPx,
 		height: maxPx,
 		fit: "inside",
@@ -9547,15 +9547,20 @@ function readSensorEventType(value) {
 	const eventType = last["eventType"];
 	return typeof eventType === "string" && eventType.length > 0 ? eventType : void 0;
 }
+/** A LINKED SET subject (ADR 0632) — see {@link NcRuleSubject.linkedSensorId}. */
+function isLinkedSetSubject(subject) {
+	return subject.linkedSensorId !== void 0;
+}
 /**
 * Build the subject for a `device-event` evaluation (a persisted SensorEvent —
-* one row per linked camera; `deviceId` is the CAMERA).
+* one row per linked camera; `deviceId` is the CAMERA), or, with `linked`, the
+* ONE sensor-level evaluation of a linked set.
 *
 * BOTH ids ride along. The camera is what the notification shows; the sensor is
 * what the operator named in the rule. Carrying only the camera is what made a
 * sensor-scoped rule unmatched — see {@link NcRuleSubject.sourceDeviceId}.
 */
-function subjectFromSensorEvent(ev, markerTrackId) {
+function subjectFromSensorEvent(ev, markerTrackId, linked) {
 	const eventType = readSensorEventType(ev.value);
 	const sensorEdge = sensorEdgeOf(ev.kind, ev.value);
 	return {
@@ -9570,7 +9575,14 @@ function subjectFromSensorEvent(ev, markerTrackId) {
 		source: "sensor",
 		sensorKind: ev.kind,
 		...eventType !== void 0 ? { eventType } : {},
-		...sensorEdge !== void 0 ? { sensorEdge } : {}
+		...sensorEdge !== void 0 ? { sensorEdge } : {},
+		...linked !== void 0 ? {
+			linkedSensorId: ev.sourceDeviceId,
+			linkedCameraIds: [...linked.linkedCameraIds],
+			rowCameraIds: [...linked.rowCameraIds],
+			mutedRowCameraIds: [...linked.mutedRowCameraIds]
+		} : {},
+		...linked?.linkedStills !== void 0 ? { linkedStills: linked.linkedStills } : {}
 	};
 }
 /**
@@ -9892,6 +9904,21 @@ function zonesVisitedBy(subject) {
 	if (subject.crossing !== void 0) visited.add(subject.crossing.zoneId);
 	return visited;
 }
+/**
+* Could this `device-event` rule fire on a sensor change of `sensorKind`?
+* The SAME two refusals {@link evaluateRule} makes before anything else a
+* sensor subject is judged on — an `occupancy` condition (such a rule targets
+* only occupancy edges, which ride the same delivery) and a `sensorKinds` list
+* that excludes the kind — for a caller that must decide from the rules alone,
+* before the subject exists (the linked-camera capture gate). Coarse in one
+* direction only: `true` may still fail later; `false` never would have fired.
+*/
+function deviceEventRuleMayFireOnKind(rule, sensorKind) {
+	const c = rule.conditions;
+	if (c.occupancy !== void 0) return false;
+	if (c.sensorKinds === void 0 || c.sensorKinds.length === 0) return true;
+	return toLowerSet(c.sensorKinds).has(sensorKind.trim().toLowerCase());
+}
 function toLowerSet(values) {
 	return new Set(values.map((v) => v.trim().toLowerCase()));
 }
@@ -10292,13 +10319,17 @@ function systemEventCooldownScope(systemEvent) {
 *    the operator actually cares about and the one they pick in the Devices
 *    tab. Before this, that rule matched nothing, ever, silently.
 *
-* Consequence worth knowing: a sensor linked to N cameras persists N rows, so
-* a SENSOR-scoped rule is evaluated N times for one door opening. The rule's
-* own throttle is what collapses that — `scope: 'rule'` gives one
-* notification, `scope: 'device'` gives one per camera, which is the right
-* choice when each carries its own picture.
+* A sensor linked to MORE than one camera is evaluated once, at the sensor
+* level (ADR 0632), with `deviceId` = the primary camera. That evaluation
+* matches the SENSOR and the cameras that took a timeline row for it
+* (`rowCameraIds`) — exactly the rules the per-camera rows would have matched
+* (D630 §6). The primary is only the camera the notification leads with: one
+* that links the sensor without opting it in keeps its rules silent, and an
+* opted-in camera that is not the primary still fires its own. The other
+* linked cameras ride `linkedCameraIds` for the MEDIA only.
 */
 function matchesDeviceScope(scope, subject) {
+	if (subject.linkedSensorId !== void 0) return scope.includes(subject.linkedSensorId) || (subject.rowCameraIds ?? []).some((cameraId) => scope.includes(cameraId));
 	if (scope.includes(subject.deviceId)) return true;
 	return subject.sourceDeviceId !== void 0 && scope.includes(subject.sourceDeviceId);
 }
@@ -10521,23 +10552,34 @@ function incomingFromTrack(track, info) {
 	};
 }
 /**
-* Sensor-event persist (one row per linked camera).
+* Sensor-event persist (one row per linked camera), or — with `linked` — the
+* ONE sensor-level evaluation of a sensor linked to several cameras (ADR 0632),
+* whose `event.deviceId` is the primary camera.
 *
 * `markerTrackId` is the synthetic marker track the same state change
 * projected onto this camera — the notification's media owner, and the only
 * frame a device event has. Absent when no marker landed.
+*
+* A sensor-level evaluation is a per-EVENT line, so it is tagged with the
+* SENSOR; the primary camera rides in the meta. `mutedCameraIds` are the
+* linked cameras the centre left out (D62) — for the line's counts only.
 */
-function incomingFromSensorEvent(event, markerTrackId) {
+function incomingFromSensorEvent(event, markerTrackId, linked, mutedCameraIds = []) {
 	return {
-		subject: subjectFromSensorEvent(event, markerTrackId),
+		subject: subjectFromSensorEvent(event, markerTrackId, linked),
 		kind: "device-event",
 		origin: "sensor",
 		log: () => ({
-			tags: { deviceId: event.deviceId },
+			tags: { deviceId: linked !== void 0 ? event.sourceDeviceId : event.deviceId },
 			meta: {
 				sensorEventId: event.id,
 				kind: event.kind,
-				...markerTrackId !== void 0 ? { trackId: markerTrackId } : {}
+				...markerTrackId !== void 0 ? { trackId: markerTrackId } : {},
+				...linked !== void 0 ? {
+					...event.deviceId !== event.sourceDeviceId ? { primaryCameraId: event.deviceId } : {},
+					linkedCameras: linked.linkedCameraIds.length + mutedCameraIds.length,
+					mutedCameras: mutedCameraIds.length
+				} : {}
 			}
 		})
 	};
@@ -13108,6 +13150,141 @@ function pickTrackNarrationFrames(rows, max) {
 	return picked;
 }
 //#endregion
+//#region src/notification-center/rule-family-guard.ts
+/**
+* The hub's half of D637: a NEW or UPDATED system-event rule answers ONE family
+* (device events, system, alarm) and carries only that family's filters.
+*
+* THE authority for the invariant. The cap-provider route
+* (`notificationRules.createRule/updateRule`, index.ts) and the rule bridge
+* (`nc.createRule/updateRule`, nc-actions.ts) both call it through
+* `guardRuleFamily` (create) and `guardPatchFamily` (update), so the two save
+* paths cannot drift. This is the same
+* arrangement as `assertRuleHasAddressee`.
+*
+* Not in Zod: a cross-field refine on `NcConditionsSchema` would also reject the
+* STORED mixed rules at load (NcRuleSchema.parse in the store), and those must
+* keep firing until the operator recreates them. The engine is untouched, and
+* so is the device-prune runner: removing a deleted device id from a stored
+* rule is not authoring.
+*/
+var NcRuleFamilyRefusal = class extends Error {
+	problems;
+	/** The rule that was judged: the input on a create, the MERGED rule on an update. */
+	rule;
+	constructor(problems, rule) {
+		super(`system-event rule refused: ${problems.map(require_dist.describeSystemEventFamilyProblem).join("; ")}`);
+		this.name = "NcRuleFamilyRefusal";
+		this.problems = problems;
+		this.rule = rule;
+	}
+};
+function assertRuleFamily(rule) {
+	if (!require_dist.isSystemDelivery(rule.delivery)) return;
+	const problems = require_dist.systemEventFamilyProblems(rule.conditions.systemEvent);
+	if (problems.length > 0) throw new NcRuleFamilyRefusal(problems, rule);
+}
+var byValue = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var byNumber = (a, b) => a - b;
+/**
+* A system-event condition with every list sorted. The engine reads `kinds` and
+* the id-list filters as SETS (membership only), so an editor that re-sorts
+* them — the admin's `toggleSystemEventKind` puts kinds in option order — has
+* not changed the rule. Copies; the input is never touched.
+*/
+function sortedSystemEvent(condition) {
+	const { kinds, deviceIds, excludeDeviceIds, deviceTypes, nodeIds, packageNames } = condition;
+	return {
+		...condition,
+		kinds: kinds.toSorted(byValue),
+		...deviceIds !== void 0 ? { deviceIds: deviceIds.toSorted(byNumber) } : {},
+		...excludeDeviceIds !== void 0 ? { excludeDeviceIds: excludeDeviceIds.toSorted(byNumber) } : {},
+		...deviceTypes !== void 0 ? { deviceTypes: deviceTypes.toSorted(byValue) } : {},
+		...nodeIds !== void 0 ? { nodeIds: nodeIds.toSorted(byValue) } : {},
+		...packageNames !== void 0 ? { packageNames: packageNames.toSorted(byValue) } : {}
+	};
+}
+/** The canonical form two conditions are compared in. */
+function conditionsFingerprint(conditions) {
+	const { systemEvent } = conditions;
+	return require_dist.canonicalHash(systemEvent === void 0 ? conditions : {
+		...conditions,
+		systemEvent: sortedSystemEvent(systemEvent)
+	});
+}
+/**
+* Do two conditions say the same thing? Both go through `NcConditionsSchema`
+* (the normalisation the store applies on every write) and are compared
+* canonically: key order is irrelevant, an `undefined` key equals an absent
+* one, and the system-event `kinds` and id-list filters are compared as SETS.
+* Every other array keeps its order. A side that does not parse is treated as
+* a change, so it is judged rather than waved through.
+*/
+function sameConditions(a, b) {
+	const left = require_dist.NcConditionsSchema.safeParse(a);
+	const right = require_dist.NcConditionsSchema.safeParse(b);
+	if (!left.success || !right.success) return false;
+	return conditionsFingerprint(left.data) === conditionsFingerprint(right.data);
+}
+/**
+* The rule a patch WOULD produce, as far as the family is concerned — merged
+* the way the store merges it: `delivery` and `conditions` replace whole.
+*
+* `null` when the patch CHANGES neither. Both editors send the whole rule on
+* every save, so "the patch carries `conditions`" is not "the patch changes
+* them": an unchanged full-form save of a stored mixed rule (a rename, a
+* retarget) must pass, and only a save that alters the delivery or the
+* conditions is judged.
+*/
+function mergedFamilySubject(existing, patch) {
+	const deliveryChanged = patch.delivery !== void 0 && patch.delivery !== existing.delivery;
+	const conditionsChanged = patch.conditions !== void 0 && !sameConditions(patch.conditions, existing.conditions);
+	if (!deliveryChanged && !conditionsChanged) return null;
+	return {
+		delivery: patch.delivery ?? existing.delivery,
+		conditions: patch.conditions ?? existing.conditions
+	};
+}
+/**
+* On update, the MERGED rule is judged. A patch that changes neither `delivery`
+* nor `conditions` (absent, or equal to what is stored) leaves the kinds as
+* they are, so a stored mixed rule can still be switched off, renamed or
+* retargeted before the operator recreates it.
+*/
+function assertPatchKeepsFamily(existing, patch) {
+	if (existing === null) return;
+	const merged = mergedFamilySubject(existing, patch);
+	if (merged !== null) assertRuleFamily(merged);
+}
+/**
+* Run a family check and LOG a refusal: who tried to save, the rule that was
+* judged (its delivery and kinds) and every problem in words (the families,
+* the offending kind or filter). Then rethrow. A refused save is dropped work,
+* and dropped work is never silent. Any other error passes through unlogged.
+*/
+function logRefusal(check, ctx) {
+	try {
+		check();
+	} catch (err) {
+		if (err instanceof NcRuleFamilyRefusal) ctx.logger.warn("nc rule refused: outside one family", { meta: {
+			...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+			by: ctx.by,
+			delivery: err.rule.delivery,
+			kinds: err.rule.conditions.systemEvent?.kinds ?? [],
+			problems: err.problems.map(require_dist.describeSystemEventFamilyProblem)
+		} });
+		throw err;
+	}
+}
+/** {@link assertRuleFamily}, logged. The create path of both routes. */
+function guardRuleFamily(rule, ctx) {
+	logRefusal(() => assertRuleFamily(rule), ctx);
+}
+/** {@link assertPatchKeepsFamily}, logged. The update path of both routes. */
+function guardPatchFamily(existing, patch, ctx) {
+	logRefusal(() => assertPatchKeepsFamily(existing, patch), ctx);
+}
+//#endregion
 //#region src/notification-center/occupancy-watcher.ts
 /** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
 var FRAME_SCOPE = "@frame";
@@ -14774,8 +14951,8 @@ async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
 	];
 	if (bbox === void 0) return files;
 	try {
-		const { default: sharp$16 } = await import("sharp");
-		const meta = await sharp$16(Buffer.from(jpeg)).metadata();
+		const { default: sharp$17 } = await import("sharp");
+		const meta = await sharp$17(Buffer.from(jpeg)).metadata();
 		const W = meta.width ?? 0;
 		const H = meta.height ?? 0;
 		if (W === 0 || H === 0) return files;
@@ -14783,7 +14960,7 @@ async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
 		const top = Math.max(0, Math.min(H - 1, Math.floor(bbox.y * H)));
 		const width = Math.max(1, Math.min(W - left, Math.ceil(bbox.w * W)));
 		const height = Math.max(1, Math.min(H - top, Math.ceil(bbox.h * H)));
-		const cropBuf = await sharp$16(Buffer.from(jpeg)).extract({
+		const cropBuf = await sharp$17(Buffer.from(jpeg)).extract({
 			left,
 			top,
 			width,
@@ -14805,7 +14982,7 @@ async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
 		});
 		const stroke = Math.max(2, Math.round(Math.min(W, H) / 240));
 		const overlay = Buffer.from(`<svg width="${W}" height="${H}"><rect x="${left}" y="${top}" width="${width}" height="${height}" fill="none" stroke="#22d3ee" stroke-width="${stroke}"/></svg>`);
-		const boxedBuf = await sharp$16(Buffer.from(jpeg)).composite([{
+		const boxedBuf = await sharp$17(Buffer.from(jpeg)).composite([{
 			input: overlay,
 			top: 0,
 			left: 0
@@ -15823,6 +16000,10 @@ function makeNcActionHandlers(deps) {
 			const parsed = require_dist.NcRuleInputSchema.parse(input.rule);
 			assertAdminOnlyFields(parsed, [], c);
 			assertRuleHasAddressee(parsed.targets, parsed.targetUsers);
+			guardRuleFamily(parsed, {
+				logger: deps.logger,
+				by: c.userId
+			});
 			await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
 			const rule = await deps.ruleStore.create({
 				...parsed,
@@ -15841,6 +16022,11 @@ function makeNcActionHandlers(deps) {
 			const clear = input.clear ?? [];
 			assertAdminOnlyFields(patch, clear, c, existing);
 			assertPatchKeepsAddressee(existing, patch, clear);
+			guardPatchFamily(existing, patch, {
+				logger: deps.logger,
+				by: c.userId,
+				ruleId: input.ruleId
+			});
 			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
 			const { ownerUserId: _owner, disabledTargetIds: _optOut, ...safe } = patch;
 			const rule = await deps.ruleStore.update(input.ruleId, safe, clear);
@@ -17004,7 +17190,8 @@ var NcDispatcher = class {
 		const analyse = this.deps.ruleAi;
 		const policy = entry.payload.ai;
 		if (analyse === void 0 || policy === void 0) return null;
-		const frames = policy.shape === "detection-track" ? await this.trackNarrationFrames(entry) : shippedFrames(built.notification);
+		const tiles = policy.shape === "detection-track" ? [] : await this.linkedAnalysisFrames(entry);
+		const frames = policy.shape === "detection-track" ? await this.trackNarrationFrames(entry) : tiles.length > 0 ? tiles : shippedFrames(built.notification);
 		if (frames.length === 0) {
 			this.deps.logger.debug("notification AI skipped — no picture to describe", {
 				tags: { deviceId: entry.deviceId },
@@ -17045,6 +17232,43 @@ var NcDispatcher = class {
 			return null;
 		}
 	}
+	/** A linked set's raw per-camera tiles (`subject.analysisTiles`), in
+	*  camera order — one frame per camera whose picture landed. Best-effort: an
+	*  owner that answers nothing or throws is left out (a blank frame is never
+	*  handed to a model), and no owners at all is `[]`. */
+	async linkedAnalysisFrames(entry) {
+		const tiles = entry.payload.subject.analysisTiles ?? [];
+		const frames = [];
+		for (const { ownerId, cameraId } of tiles) {
+			const file = await this.linkedStillFile(entry, ownerId, cameraId);
+			const bytes = file === void 0 ? null : decodeStillBytes(file.base64);
+			if (bytes !== null) frames.push({
+				bytes,
+				mime: "image/jpeg"
+			});
+		}
+		return frames;
+	}
+	/** One linked-camera shelf owner's still — `keyFrameSmall`, else whatever it
+	*  holds. `undefined` when it holds nothing or the read throws (said at DEBUG
+	*  on `cameraId`, the camera the picture is of: the caller decides whether
+	*  the absence is worth a line of its own). */
+	async linkedStillFile(entry, ownerId, cameraId) {
+		try {
+			const files = await this.deps.getMediaForOwner("track", ownerId);
+			return files.find((f) => f.kind === "keyFrameSmall") ?? files[0];
+		} catch (err) {
+			this.deps.logger.debug("linked camera picture read failed", {
+				tags: { deviceId: cameraId },
+				meta: {
+					recordId: entry.recordId,
+					ownerId,
+					error: String(err)
+				}
+			});
+			return;
+		}
+	}
 	/** The whole-scene frames spanning a CLOSED track, oldest first. Best-effort
 	*  in every direction: no track id, a throwing read or an empty store all
 	*  leave the pass with nothing, which skips it. */
@@ -17053,11 +17277,8 @@ var NcDispatcher = class {
 		if (trackId === void 0) return [];
 		try {
 			return pickTrackNarrationFrames(await this.deps.getMediaForOwner("track", trackId), 3).flatMap((file) => {
-				const raw = Buffer.from(file.base64, "base64");
-				if (raw.byteLength === 0) return [];
-				const bytes = new Uint8Array(raw.byteLength);
-				bytes.set(raw);
-				return [{
+				const bytes = decodeStillBytes(file.base64);
+				return bytes === null ? [] : [{
 					bytes,
 					mime: "image/jpeg",
 					atMs: file.timestamp
@@ -17505,7 +17726,7 @@ var NcDispatcher = class {
 		const deviceId = entry.payload.subject.deviceId;
 		const common = {
 			deviceId: deviceId > 0 ? deviceId : null,
-			deviceIds: deviceId > 0 ? [deviceId] : [],
+			deviceIds: entry.payload.subject.linkedCameraIds !== void 0 ? [...entry.payload.subject.linkedCameraIds] : deviceId > 0 ? [deviceId] : [],
 			capturedAt: entry.payload.subject.timestamp,
 			ruleId: entry.ruleId,
 			ruleName: entry.payload.ruleName
@@ -17553,6 +17774,7 @@ var NcDispatcher = class {
 		const footagePending = this.renderFootage(entry);
 		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : await this.waitForStill(entry, stillOverride);
 		const footage = await footagePending;
+		const extras = await this.linkedExtraStills(entry);
 		if (still !== null) {
 			const zoneIds = zoneIdsWanted;
 			if (zoneIds !== void 0 && zoneIds.length > 0) {
@@ -17570,7 +17792,17 @@ var NcDispatcher = class {
 					name: "group.jpg"
 				} : still);
 			}
-		} else if (entry.payload.media !== "none") this.deps.logger.info("no still could be resolved — this notification ships text-only", {
+		} else if (entry.payload.media !== "none" && extras.length > 0) this.deps.logger.info("no still of the primary camera could be resolved — the other linked cameras' stills ship without it", {
+			tags: { deviceId: entry.payload.subject.deviceId },
+			meta: {
+				recordKind: entry.recordKind,
+				recordId: entry.recordId,
+				policy: entry.payload.media,
+				...entry.payload.subject.trackId !== void 0 ? { owner: `track:${entry.payload.subject.trackId}` } : {},
+				otherCameras: extras.length
+			}
+		});
+		else if (entry.payload.media !== "none") this.deps.logger.info("no still could be resolved — this notification ships text-only", {
 			tags: { deviceId: entry.payload.subject.deviceId },
 			meta: {
 				recordKind: entry.recordKind,
@@ -17581,6 +17813,43 @@ var NcDispatcher = class {
 			}
 		});
 		out.push(...footage.attachments);
+		out.push(...extras);
+		return out;
+	}
+	/**
+	* `each` (ADR 0632): the OTHER linked cameras' stills, in camera order —
+	* AFTER the primary still and the primary's footage, so a target with little
+	* room keeps both and the other cameras fill only what is left (the degrade
+	* engine drops by position). A camera whose picture never landed is skipped
+	* and named ON THAT CAMERA: a blank attachment would read as a broken camera.
+	* The camera is the one the row CARRIES with each still (the one the shelf
+	* photographed) — never inferred from a position in `linkedCameraIds`, which
+	* a mute between capture and evaluation shifts. Named `camera-<id>.jpg`.
+	*/
+	async linkedExtraStills(entry) {
+		const subject = entry.payload.subject;
+		const out = [];
+		for (const { ownerId, cameraId } of subject.extraStills ?? []) {
+			const file = await this.linkedStillFile(entry, ownerId, cameraId);
+			const bytes = file === void 0 ? null : decodeStillBytes(file.base64);
+			if (bytes === null) {
+				this.deps.logger.info("linked camera picture missing at send — skipped", {
+					tags: { deviceId: cameraId },
+					meta: {
+						recordId: entry.recordId,
+						ruleId: entry.ruleId,
+						ownerId
+					}
+				});
+				continue;
+			}
+			out.push({
+				mediaType: "image",
+				bytes,
+				mime: "image/jpeg",
+				name: `camera-${String(cameraId)}.jpg`
+			});
+		}
 		return out;
 	}
 	/**
@@ -17857,8 +18126,8 @@ var NcDispatcher = class {
 		try {
 			const points = (await this.deps.getZonePolygons?.(deviceId, zoneIds) ?? []).flat();
 			if (points.length === 0) return null;
-			const { default: sharp$15 } = await import("sharp");
-			const img = sharp$15(Buffer.from(jpeg));
+			const { default: sharp$16 } = await import("sharp");
+			const img = sharp$16(Buffer.from(jpeg));
 			const meta = await img.metadata();
 			const W = meta.width ?? 0;
 			const H = meta.height ?? 0;
@@ -18059,10 +18328,8 @@ var NcDispatcher = class {
 			const shortlist = await this.narrowToTriggerZone(entry, inBand, freshness);
 			if (shortlist.length === 0) continue;
 			for (const file of shortlist) {
-				const raw = Buffer.from(file.base64, "base64");
-				if (raw.byteLength === 0) continue;
-				const bytes = new Uint8Array(raw.byteLength);
-				bytes.set(raw);
+				const bytes = decodeStillBytes(file.base64);
+				if (bytes === null) continue;
 				return {
 					mediaType: "image",
 					bytes,
@@ -18295,6 +18562,18 @@ function copyBytes(bytes) {
 	out.set(bytes);
 	return out;
 }
+/**
+* A stored file's base64 as bytes backed by their OWN `ArrayBuffer`, or `null`
+* when it decodes to nothing (a blank picture is never a picture).
+*
+* The copy is the point: a pooled `Buffer` view throws `Trying to deserialize
+* unknown typed array` on the far side of a transport, and the attachment and
+* frame types both demand `Uint8Array<ArrayBuffer>`.
+*/
+function decodeStillBytes(base64) {
+	const raw = Buffer.from(base64, "base64");
+	return raw.byteLength === 0 ? null : copyBytes(raw);
+}
 /** Does this rule ever cut footage from the broker's clip ring? */
 function wantsFootage(rule) {
 	return rule.media.gif === true || rule.media.clip === true;
@@ -20131,6 +20410,916 @@ var DeviceLivenessHoldoff = class {
 	}
 };
 //#endregion
+//#region src/notification-center/linked-camera-media.ts
+/** ADR 0632: absent = mosaic, applied HERE and never as a Zod default. */
+function linkedCameraMode(media) {
+	return media.linkedCameras ?? "mosaic";
+}
+/** Which shelf owners one RULE's row names. The model always gets the raw tiles
+*  (like the digest, D154) — a composite is a worse input than its parts. */
+function linkedMediaOwners(stills, mode) {
+	const tiles = stills.cameraOwnerIds.flatMap((ownerId, i) => {
+		const cameraId = stills.cameraIds[i];
+		return cameraId === void 0 ? [] : [{
+			ownerId,
+			cameraId
+		}];
+	});
+	const [primary] = stills.cameraOwnerIds;
+	if (mode === "each" && primary !== void 0) return {
+		trackId: primary,
+		extraStills: tiles.slice(1),
+		analysisTiles: tiles
+	};
+	return {
+		trackId: stills.mosaicOwnerId,
+		extraStills: [],
+		analysisTiles: tiles
+	};
+}
+/** JPEG quality for the downscaled full frame — matches the crop path. */
+var FULL_FRAME_QUALITY = 80;
+/**
+* Downscale an already-encoded JPEG full frame to FIT WITHIN
+* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
+* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
+* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
+* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
+* at night) is never stored or served — the privacy fix moved to CAPTURE time.
+*/
+async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
+	return (0, sharp.default)(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
+		fit: "inside",
+		withoutEnlargement: true
+	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
+}
+//#endregion
+//#region src/notification-center/still-shelf.ts
+/**
+* The still shelf — the PHOTOGRAPH a notification carries when nothing it can
+* name owns a frame.
+*
+* ## Why a trigger needs one at all
+*
+* The attachment ladder resolves media by OWNER, and most triggers have one: an
+* object or package event owns its crops, a closed track owns its best shot, a
+* doorbell press owns the marker track the same press projected
+* (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
+* counted (`chooseOccupancyMediaOwner`). Two triggers own nothing, and for the
+* same reason in both cases — the subject is an ABSENCE:
+*
+*  - an **audio** match: nothing was boxed, nothing was tracked, and —
+*    deliberately — nothing is persisted at all. A confirmed window is a claim
+*    about sound that has already stopped, and `event-intake.ts` states why
+*    replaying it later would be wrong.
+*  - an **occupancy** edge whose scope is EMPTY — "posto libero". The vehicle
+*    whose departure IS the news has left, so `chooseOccupancyMediaOwner` names
+*    nobody and the ladder logs `no still could be resolved … owners=[]`.
+*
+* So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
+* of the trigger. Not of the sound, not of the object that left — of what the
+* camera can see now that it happened. For a freed parking space that is
+* exactly the answer the operator wants: the space, empty.
+*
+* **One shelf, not two.** The mechanism is identical down to the reuse window,
+* and the only thing that differs between the two triggers is the GATE deciding
+* that a photograph is owed at all — which belongs at the trigger site, where
+* the rules are, and not here. A twin module would be a second derivation of
+* one thing. The trigger rides along as {@link NcStillTrigger} only so the logs
+* can say which absence they are about.
+*
+* ## Three properties, and each one is a decision
+*
+* **It is not a record.** The bytes live here, in RAM, under an owner id and a
+* TTL that covers the outbox's whole retry horizon — and nowhere else. The
+* alternative was the doorbell's: materialise a synthetic marker track through
+* `SyntheticTrackMaterializer` and let the notification name it. That would put
+* a durable Track on the camera's timeline for every confirmed window and every
+* emptied zone, feeding the digest's `listTracks`, retention, and the audio-
+* marker feature's own operator ceilings (`audio-marker-projector.ts` exists
+* precisely to bound how many audio markers a camera may emit). A notification
+* must not manufacture timeline history as a side effect of wanting a picture.
+*
+* **The capture STARTS immediately and is never awaited.** The subject is
+* transient — a scream is over before a snapshot round-trip completes, and a
+* freed space is about to be taken by the next car — so the fetch is kicked off
+* at the trigger, before the rule evaluation runs, and the owner id is minted
+* synchronously so the outbox row can name it. The bytes land while the row
+* waits in the queue, and the dispatcher's existing bounded still-wait (or the
+* pause its own footage render already costs) picks them up. A camera that
+* never answers costs the picture and never the notification.
+*
+* **Two triggers seconds apart share ONE capture.** A barking dog confirms
+* repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
+* rule's cooldown is its only brake, and the cooldown is applied AFTER this.
+* Without a reuse window this would photograph a camera at whatever rate the
+* sound happens to occur. Each trigger still gets its OWN owner id, so two
+* outbox rows are never mistaken for one subject; they merely point at the same
+* frame, which is the truth — the scene did not change in ten seconds. The
+* window is per CAMERA and trigger-agnostic for the same reason: a sound and an
+* emptied zone ten seconds apart are two claims about one scene.
+*
+* Nothing here is silent: a capture that lands and a camera that refuses each
+* emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
+* and 615 not" is the only form that question is ever asked in.
+*/
+/**
+* The owner-id namespace. It is what routes a lookup here instead of to the
+* media store, and it is the reason the dispatcher needs no audio or occupancy
+* branch — `getMediaForOwner` answers for all of them under one signature.
+*/
+var NC_STILL_SHELF_PREFIX = "nc-still:";
+/** True for an owner id this shelf minted. */
+function isStillShelfId(id) {
+	return id.startsWith(NC_STILL_SHELF_PREFIX);
+}
+/**
+* How long the bytes are held.
+*
+* The outbox retries 8 times with a 5 s → 300 s backoff, which tops out around
+* ten minutes; fifteen covers that with room for a slow drain. Past it the row
+* ships text-only, which is the correct degradation for a photograph of a scene
+* that is a quarter of an hour stale anyway.
+*/
+var NC_STILL_SHELF_TTL_MS = 15 * 6e4;
+/** A hanging snapshot cap must not pin a capture slot forever. */
+var SNAPSHOT_TIMEOUT_MS = 8e3;
+/**
+* Hard bound on held captures. Reached only if every camera on the hub triggers
+* one inside a single TTL; the oldest is dropped first, which costs a
+* fifteen-minute-old picture nobody is waiting for.
+*/
+var MAX_CAPTURES = 64;
+var NcStillShelf = class {
+	deps;
+	/** captureId → the photograph. */
+	captures = /* @__PURE__ */ new Map();
+	/** ownerId → captureId. Several owners may name one capture (the reuse window). */
+	owners = /* @__PURE__ */ new Map();
+	/** deviceId → its newest capture, for the reuse window. */
+	newest = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Photograph `deviceId` for a trigger at `atMs`, and return the owner id the
+	* subject should name. SYNCHRONOUS by contract: the caller is on the trigger
+	* path and the outbox row is built from what this returns.
+	*/
+	capture(deviceId, atMs, trigger) {
+		const now = this.deps.now();
+		this.prune(now);
+		const ownerId = `${NC_STILL_SHELF_PREFIX}${(0, node_crypto.randomUUID)()}`;
+		const recent = this.newest.get(deviceId);
+		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
+			this.owners.set(ownerId, recent.captureId);
+			return ownerId;
+		}
+		const captureId = (0, node_crypto.randomUUID)();
+		this.captures.set(captureId, {
+			deviceId,
+			trigger,
+			startedAt: now,
+			expiresAt: now + NC_STILL_SHELF_TTL_MS,
+			files: []
+		});
+		this.newest.set(deviceId, {
+			captureId,
+			at: now
+		});
+		this.owners.set(ownerId, captureId);
+		this.fetch(captureId, deviceId, atMs, trigger);
+		return ownerId;
+	}
+	/**
+	* The media an owner id holds, or `undefined` when this shelf never minted
+	* it. An EMPTY array is a different answer: the capture exists and has not
+	* landed (or never will), which is exactly the case the dispatcher's bounded
+	* wait and its `no still could be resolved` line are for.
+	*/
+	get(ownerId) {
+		const captureId = this.owners.get(ownerId);
+		if (captureId === void 0) return void 0;
+		return this.captures.get(captureId)?.files ?? [];
+	}
+	/** Drop expired captures and the owners that named them. */
+	prune(now) {
+		for (const [captureId, held] of this.captures) {
+			if (held.expiresAt > now) continue;
+			this.captures.delete(captureId);
+			if (this.newest.get(held.deviceId)?.captureId === captureId) this.newest.delete(held.deviceId);
+		}
+		while (this.captures.size > MAX_CAPTURES) {
+			const oldest = this.captures.keys().next();
+			if (oldest.done === true) break;
+			const held = this.captures.get(oldest.value);
+			this.captures.delete(oldest.value);
+			if (held !== void 0 && this.newest.get(held.deviceId)?.captureId === oldest.value) this.newest.delete(held.deviceId);
+		}
+		for (const [ownerId, captureId] of this.owners) if (!this.captures.has(captureId)) this.owners.delete(ownerId);
+	}
+	/** Drop everything (shutdown). */
+	clear() {
+		this.captures.clear();
+		this.owners.clear();
+		this.newest.clear();
+	}
+	async fetch(captureId, deviceId, atMs, trigger) {
+		try {
+			const shot = await withTimeout$4(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
+			if (shot === null || shot.base64.length === 0) {
+				this.reportMiss(deviceId, trigger, "the camera returned no snapshot");
+				return;
+			}
+			const raw = Buffer.from(shot.base64, "base64");
+			let data = raw;
+			try {
+				data = await downscaleFullFrameJpeg(raw, 960, 540);
+			} catch {}
+			const held = this.captures.get(captureId);
+			if (held === void 0) return;
+			this.captures.set(captureId, {
+				...held,
+				files: stillShelfMedia(data, atMs)
+			});
+			this.deps.logger.info(`${trigger} still captured`, {
+				tags: { deviceId },
+				meta: {
+					trigger,
+					bytes: data.byteLength,
+					tookMs: this.deps.now() - held.startedAt
+				}
+			});
+		} catch (err) {
+			this.reportMiss(deviceId, trigger, err instanceof Error ? err.message : String(err));
+		}
+	}
+	/**
+	* A branch that drops work says so. This one costs the operator the picture
+	* on a notification they DID receive, so it is a warn and it carries the
+	* camera — the only key the question is ever asked with.
+	*/
+	reportMiss(deviceId, trigger, reason) {
+		this.deps.logger.warn(`the camera did not answer the ${trigger} still — this notification ships text-only`, {
+			tags: { deviceId },
+			meta: {
+				trigger,
+				reason
+			}
+		});
+	}
+};
+/**
+* The photograph, in the three kinds the CLEAN-SCENE ladders ask for.
+*
+* `keyFrameSmall` leads because it is the first rung of both `attach: 'best'`
+* and `attach: 'keyFrame'` on a track owner; `keyFrame` and `fullFrame` answer
+* `frame: 'full'` and `frame: 'boxed'`'s honest degrade. There is deliberately
+* no `crop` / `thumbnail`: nothing was boxed, so `frame: 'cropped'` resolves
+* NOTHING and the notification ships text-only with the ordinary line saying
+* so. Inventing a centre crop would answer a different question from the one
+* the operator asked.
+*/
+function stillShelfMedia(data, timestamp) {
+	const base64 = data.toString("base64");
+	const file = (kind) => ({
+		mediaId: nextUnstoredMediaId(),
+		kind,
+		base64,
+		sizeBytes: data.byteLength,
+		timestamp
+	});
+	return [
+		file("keyFrameSmall"),
+		file("keyFrame"),
+		file("fullFrame")
+	];
+}
+/** Reject if `promise` does not settle within `ms`. */
+function withTimeout$4(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`snapshot cap timed out after ${String(ms)}ms`));
+		}, ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+/** The canvas behind a tile whose aspect does not fill its cell. */
+var MOSAIC_BACKGROUND = {
+	r: 17,
+	g: 17,
+	b: 17
+};
+/** Tile aspect — cameras are 16:9 and a square cell would letterbox every one. */
+var TILE_ASPECT = 9 / 16;
+/** Height of the per-tile label strip, as a fraction of the tile height. */
+var LABEL_BAND_FRACTION = .14;
+var LABEL_MIN_PX = 11;
+/** Height of the mosaic's own title band, as a fraction of a tile's height. */
+var TITLE_BAND_FRACTION = .22;
+var TITLE_MIN_PX = 16;
+/**
+* Average glyph width as a fraction of the font size, for bold sans-serif.
+*
+* An ESTIMATE, and it has to be: librsvg lays the text out long after this
+* string is written, so there are no metrics to measure against. The same
+* number and the same reasoning as `preview-frame.ts#fitTitle` — deliberately
+* GENEROUS, because a label that shrank slightly more than it had to is
+* invisible and one that overflowed runs into the tile beside it. The first
+* live mosaic did exactly that: `Videocamera cortile · 07:49 · animal` was cut
+* to `…· anima` at the tile edge, mid-word.
+*/
+var GLYPH_ADVANCE = .56;
+/** Fraction of the band a label may occupy, leaving the padding either side. */
+var LABEL_USABLE_FRACTION = .94;
+/** `<`, `>`, `&`, `'`, `"` in a camera name or an operator caption would each
+*  turn the overlay into a document librsvg refuses. */
+function escapeXml$1(s) {
+	return s.replace(/[<>&'"]/g, (ch) => {
+		switch (ch) {
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			case "&": return "&amp;";
+			case "'": return "&apos;";
+			default: return "&quot;";
+		}
+	});
+}
+/**
+* The single decision about drawn text — and the home of the DEFAULT.
+*
+* `undefined` means `none`, not `all`: a rule stored before this option existed
+* has no `captions` key, and the operator's request is that such a rule deliver
+* pictures. The schema materialises the same default on read
+* (`NcSummaryRuleInputSchema`), so this arm only fires for a caller that never
+* had a rule — the test bridge and the spec. Both agreeing is the point.
+*/
+function mosaicTextPlan(captions) {
+	if (captions === "all") return {
+		tileLabels: true,
+		titleBand: true
+	};
+	if (captions === "tiles") return {
+		tileLabels: true,
+		titleBand: false
+	};
+	return {
+		tileLabels: false,
+		titleBand: false
+	};
+}
+/** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
+*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip.
+*
+*  `rows` is the load-bearing half — it is how many rows {@link mosaicRowCounts}
+*  distributes into. `cols` describes the WIDEST row, and is no longer a cell
+*  count: see {@link mosaicRowCounts} for why a `cols × rows` grid was the bug. */
+function mosaicGrid(n) {
+	const count = Math.max(1, Math.floor(n));
+	const cols = Math.ceil(Math.sqrt(count));
+	return {
+		cols,
+		rows: Math.ceil(count / cols)
+	};
+}
+/**
+* How many tiles each ROW carries, top to bottom — and the reason the mosaic
+* can no longer have a hole in it.
+*
+* The layout used to be a `cols × rows` GRID, and a grid holds more cells than
+* tiles for every count that is not a perfect fit: 3 into a 2×2, 5 into a 3×2,
+* 7 and 8 into a 3×3. The composite only ever wrote the tiles, so the spare
+* cells stayed the canvas — `MOSAIC_BACKGROUND`, rgb 17 — and the operator's
+* three-tile digest was a quarter black. Measured on the shipped renderer:
+* 24.8% of a three-tile mosaic was background. His words: *"se ci sono 3
+* elementi non dovrebbe renderizzare buchi neri"*.
+*
+* Counting ROWS instead removes the failure by construction rather than by
+* patching it. Every row spans the full width and divides it among the tiles it
+* actually has, so a row is full whatever the remainder and there is no such
+* thing as a spare cell. The shapes fall out of it, and they are the ones asked
+* for: 1 ⇒ full frame, 2 ⇒ side by side, 3 ⇒ one big over two small, 4 ⇒ 2×2.
+*
+* **The fewer-tiled row comes FIRST.** Tiles arrive in the selection's order,
+* so row 0 is the head of the ranking; putting the remainder at the top would
+* make the WORST tile the big one.
+*
+* Every cell keeps {@link TILE_ASPECT}, so rows differ in height — which is
+* also what stops the letterbox: a full-width hero tile is 16:9 exactly, not a
+* 16:9 picture centred in a double-height cell with bars over and under it.
+*/
+function mosaicRowCounts(n) {
+	const count = Math.max(1, Math.floor(n));
+	const { rows } = mosaicGrid(count);
+	const base = Math.floor(count / rows);
+	const remainder = count % rows;
+	const counts = [];
+	for (let row = 0; row < rows; row += 1) counts.push(row < rows - remainder ? base : base + 1);
+	return counts;
+}
+/**
+* Where every tile lands. Pure — no bytes, no sharp, no clock.
+*
+* Exported because the rectangles are DATA the artefact should carry: a viewer
+* that wants a tappable mosaic reads these rather than re-deriving a layout
+* that could drift from the one actually rendered.
+*
+* The rectangles COVER the picture area exactly — that is the property the
+* spec asserts, and it is the one the old grid broke.
+*/
+function mosaicLayout(input) {
+	const rowCounts = mosaicRowCounts(input.tileCount);
+	const width = Math.max(1, Math.floor(input.maxWidth ?? 1920));
+	const firstRowCount = rowCounts[0] ?? 1;
+	const tileWidth = Math.floor(width / firstRowCount);
+	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
+	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
+	const tiles = [];
+	let y = titleHeight;
+	let index = 0;
+	for (const count of rowCounts) {
+		const nominalWidth = Math.floor(width / count);
+		const rowHeight = Math.round(nominalWidth * TILE_ASPECT);
+		let x = 0;
+		for (let inRow = 0; inRow < count; inRow += 1) {
+			const w = inRow === count - 1 ? width - x : nominalWidth;
+			tiles.push({
+				index,
+				x,
+				y,
+				w,
+				h: rowHeight
+			});
+			x += w;
+			index += 1;
+		}
+		y += rowHeight;
+	}
+	return {
+		width,
+		height: y,
+		cols: Math.max(...rowCounts),
+		rows: rowCounts.length,
+		rowCounts,
+		tileWidth,
+		tileHeight,
+		titleHeight,
+		tiles
+	};
+}
+/**
+* Shrink, then ELIDE, until the line fits `usablePx`.
+*
+* Shrinking is tried first because a slightly smaller label still says
+* everything; only past `minPx` is the tail cut, and then with an ellipsis so
+* the reader can SEE that something was cut. The failure this replaces was
+* silent: SVG simply clips at the viewport, so an overlong label lost its last
+* word mid-glyph and looked like a rendering bug rather than a truncation.
+*
+* Pure and exported so the arithmetic is testable without rendering a pixel.
+*/
+function fitLine(text, usablePx, basePx, minPx) {
+	const flat = text.trim().replace(/\s+/g, " ");
+	const fits = (s, fontPx) => s.length * fontPx * GLYPH_ADVANCE <= usablePx;
+	let fontPx = Math.max(minPx, Math.round(basePx));
+	while (fontPx > minPx && !fits(flat, fontPx)) fontPx = Math.max(minPx, fontPx - 1);
+	if (fits(flat, fontPx)) return {
+		text: flat,
+		fontPx
+	};
+	const budget = Math.max(1, Math.floor(usablePx / (fontPx * GLYPH_ADVANCE)));
+	return {
+		text: `${flat.slice(0, Math.max(1, budget - 1)).trimEnd()}…`,
+		fontPx
+	};
+}
+/** The label strip drawn across the bottom of one tile. */
+function tileLabelSvg(width, height, label) {
+	const bandHeight = Math.max(18, Math.round(height * LABEL_BAND_FRACTION));
+	const basePx = Math.round(bandHeight * .62);
+	const padding = Math.round(basePx * .6);
+	const fitted = fitLine(label, width * LABEL_USABLE_FRACTION - padding, basePx, LABEL_MIN_PX);
+	const baseline = height - Math.round((bandHeight - fitted.fontPx) / 2) - Math.round(fitted.fontPx * .18);
+	return Buffer.from(`<svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
+  <rect x="0" y="${height - bandHeight}" width="${width}" height="${bandHeight}" fill="black" fill-opacity="0.55"/>
+  <text x="${padding}" y="${baseline}" font-size="${fitted.fontPx}" font-family="sans-serif" font-weight="bold" fill="white">${escapeXml$1(fitted.text)}</text>
+</svg>`);
+}
+/** The mosaic's own title band. */
+function titleSvg(width, height, caption) {
+	const fitted = fitLine(caption, width * LABEL_USABLE_FRACTION, Math.round(height * .5), TITLE_MIN_PX);
+	const baseline = Math.round(height / 2 + fitted.fontPx * .36);
+	return Buffer.from(`<svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
+  <rect x="0" y="0" width="${width}" height="${height}" fill="#111111"/>
+  <text x="${Math.round(width / 2)}" y="${baseline}" font-size="${fitted.fontPx}" font-family="sans-serif" font-weight="bold" text-anchor="middle" fill="white">${escapeXml$1(fitted.text)}</text>
+</svg>`);
+}
+/**
+* Compose the mosaic.
+*
+* Every tile is fitted with `contain` onto the cell background rather than
+* cropped: a `cover` fit would silently cut the subject out of a portrait crop,
+* and a tile that does not show what it is about is worse than a letterboxed
+* one.
+*
+* A tile sharp cannot read is DROPPED and counted, never composited as a blank
+* cell — a black square in a digest reads as "the camera saw nothing", which is
+* the opposite of what happened. The layout is computed from the SURVIVORS, and
+* because {@link mosaicRowCounts} counts rows rather than grid cells there is no
+* remainder to leave empty either.
+*
+* @throws when every tile was dropped, and when sharp cannot produce the final
+*         canvas at all; the caller treats both as "no mosaic" and still
+*         delivers the counts.
+*/
+async function renderMosaic(request, logger) {
+	const plan = mosaicTextPlan(request.captions);
+	const usable = [];
+	for (const tile of request.tiles) try {
+		await (0, sharp.default)(tile.jpeg).metadata();
+		usable.push(tile);
+	} catch (err) {
+		logger.warn(`${request.purpose} mosaic: a tile could not be decoded and was dropped`, {
+			tags: { deviceId: tile.deviceId },
+			meta: {
+				...request.purpose === "summary" ? { trackId: tile.sourceId } : { sourceId: tile.sourceId },
+				error: String(err)
+			}
+		});
+	}
+	const droppedTiles = request.tiles.length - usable.length;
+	if (usable.length === 0) throw new Error(`${request.purpose} mosaic: no tile could be decoded (${request.tiles.length} offered)`);
+	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
+	const layout = mosaicLayout({
+		tileCount: usable.length,
+		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
+		withTitle: caption.length > 0
+	});
+	const composites = await Promise.all(usable.map(async (tile, index) => {
+		const rect = layout.tiles[index];
+		if (rect === void 0) throw new Error(`${request.purpose} mosaic: layout lost a tile`);
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = (0, sharp.default)(tile.jpeg).resize({
+			width: rect.w,
+			height: rect.h,
+			fit: "contain",
+			background: MOSAIC_BACKGROUND
+		});
+		return {
+			input: await (label.length === 0 ? fitted : fitted.composite([{
+				input: tileLabelSvg(rect.w, rect.h, label),
+				top: 0,
+				left: 0
+			}])).jpeg({ quality: 82 }).toBuffer(),
+			top: rect.y,
+			left: rect.x
+		};
+	}));
+	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
+		input: titleSvg(layout.width, layout.titleHeight, caption),
+		top: 0,
+		left: 0
+	});
+	return {
+		jpeg: await (0, sharp.default)({ create: {
+			width: layout.width,
+			height: layout.height,
+			channels: 3,
+			background: MOSAIC_BACKGROUND
+		} }).composite(composites).jpeg({ quality: 82 }).toBuffer(),
+		layout,
+		droppedTiles
+	};
+}
+//#endregion
+//#region src/notification-center/linked-stills.ts
+/**
+* The linked-camera shelf — the photographs a SENSOR notification carries of
+* every camera that links the sensor (ADR 0632).
+*
+* Same three properties as the still shelf (`still-shelf.ts`), for the same
+* reasons: not a record (RAM, TTL, no timeline track), the capture starts at the
+* trigger and is never awaited (owner ids minted synchronously), and nothing is
+* silent (one line per camera with its outcome, one per event on the sensor).
+* A separate module because the unit is a SET: exclusion, freshness and the
+* one composition are decisions about the set, and none of them belongs in a
+* shelf that photographs one camera for an absence.
+*
+* Two reads can only ever ADD a camera back, never take one away on their own
+* failure (D49): a wrapper-state read (run in parallel with the capture) that
+* misses or throws keeps the tile, and a freshness read that misses or throws
+* keeps every tile. Only a read that ANSWERED
+* `sleeping` / `disabled` / … or a capture time older than
+* {@link SENSOR_LINKED_MAX_FRAME_AGE_MS} removes a tile — and says so, on that
+* camera.
+*/
+var NC_LINKED_MOSAIC_PREFIX = "nc-mosaic:";
+var NC_LINKED_CAMERA_PREFIX = "nc-linked:";
+function isLinkedStillId(id) {
+	return id.startsWith("nc-mosaic:") || id.startsWith("nc-linked:");
+}
+/** Per camera — the marker's own bound (`SENSOR_MARKER_SNAPSHOT_TIMEOUT_MS`). */
+var SENSOR_LINKED_CAPTURE_TIMEOUT_MS = 2500;
+/** The capture-free wrapper-state read, per camera. It runs IN PARALLEL with
+*  the capture and under the capture's own bound, so it costs no extra time and
+*  a slow-but-honest answer is still heard: a blocking reason EXCLUDES the tile
+*  even when the capture returned bytes (they are a state card, not a
+*  photograph). A read that misses the bound or fails is UNKNOWN and keeps the
+*  tile (D49). */
+var SENSOR_LINKED_STATE_READ_TIMEOUT_MS = SENSOR_LINKED_CAPTURE_TIMEOUT_MS;
+Math.max(SENSOR_LINKED_STATE_READ_TIMEOUT_MS, SENSOR_LINKED_CAPTURE_TIMEOUT_MS) + 400;
+/** Hard bound on sets held at once, on top of the TTL. */
+var MAX_SETS = 32;
+function isLandedTile(r) {
+	return r.outcome === "landed" && r.jpeg !== void 0;
+}
+var LinkedReadTimeout = class extends Error {
+	constructor(what, ms) {
+		super(`${what} timed out after ${String(ms)}ms`);
+		this.name = "LinkedReadTimeout";
+	}
+};
+var NcLinkedStillShelf = class {
+	deps;
+	sets = /* @__PURE__ */ new Map();
+	owners = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** SYNCHRONOUS: the evaluation that follows names these owners. */
+	captureSet(sensorId, cameraIds, atMs) {
+		const now = this.deps.now();
+		this.prune(now);
+		const setId = (0, node_crypto.randomUUID)();
+		const stills = {
+			sensorId,
+			cameraIds: [...cameraIds],
+			mosaicOwnerId: `${NC_LINKED_MOSAIC_PREFIX}${(0, node_crypto.randomUUID)()}`,
+			cameraOwnerIds: cameraIds.map(() => `${NC_LINKED_CAMERA_PREFIX}${(0, node_crypto.randomUUID)()}`)
+		};
+		this.sets.set(setId, {
+			stills,
+			expiresAt: now + NC_STILL_SHELF_TTL_MS,
+			atMs,
+			tiles: /* @__PURE__ */ new Map(),
+			mosaic: []
+		});
+		this.owners.set(stills.mosaicOwnerId, {
+			setId,
+			camera: "mosaic"
+		});
+		stills.cameraOwnerIds.forEach((ownerId, i) => {
+			const cameraId = cameraIds[i];
+			if (cameraId !== void 0) this.owners.set(ownerId, {
+				setId,
+				camera: cameraId
+			});
+		});
+		this.run(setId, stills, atMs, now).catch((err) => {
+			this.deps.logger.warn("sensor notification pictures failed — it ships text-only", {
+				tags: { deviceId: sensorId },
+				meta: { error: String(err) }
+			});
+		});
+		return stills;
+	}
+	/** `undefined` = not an owner this shelf minted (or pruned); `[]` = nothing (yet). */
+	get(ownerId) {
+		const ref = this.owners.get(ownerId);
+		if (ref === void 0) return void 0;
+		const held = this.sets.get(ref.setId);
+		if (held === void 0) return [];
+		if (ref.camera === "mosaic") return held.mosaic;
+		return held.tiles.get(ref.camera) ?? [];
+	}
+	prune(now) {
+		for (const [setId, held] of this.sets) if (held.expiresAt <= now) this.sets.delete(setId);
+		while (this.sets.size > MAX_SETS) {
+			const oldest = this.sets.keys().next();
+			if (oldest.done === true) break;
+			this.sets.delete(oldest.value);
+		}
+		for (const [ownerId, ref] of this.owners) if (!this.sets.has(ref.setId)) this.owners.delete(ownerId);
+	}
+	clear() {
+		this.sets.clear();
+		this.owners.clear();
+	}
+	async run(setId, stills, atMs, startedAt) {
+		const results = await Promise.all(stills.cameraIds.map((id) => this.captureOne(id, startedAt)));
+		const judged = await this.judgeFreshness(stills.sensorId, results, atMs);
+		for (const r of judged) this.logTile(stills.sensorId, r);
+		const landed = judged.filter(isLandedTile);
+		const composed = await this.compose(stills.sensorId, landed, atMs);
+		const undrawable = landed.length - composed.drawn;
+		this.deps.logger.info(composed.mosaic.length === 0 ? "sensor notification has no linked picture — it ships text-only" : "sensor notification pictures ready", {
+			tags: { deviceId: stills.sensorId },
+			meta: {
+				cameras: stills.cameraIds.length,
+				landed: composed.drawn,
+				...undrawable > 0 ? { undrawable } : {},
+				dropped: Object.fromEntries(judged.filter((r) => r.outcome !== "landed").map((r) => [String(r.cameraId), r.outcome])),
+				tookMs: this.deps.now() - startedAt
+			}
+		});
+		const held = this.sets.get(setId);
+		if (held === void 0) return;
+		this.sets.set(setId, {
+			...held,
+			tiles: new Map(composed.servable.map((r) => [r.cameraId, stillShelfMedia(r.jpeg, atMs)])),
+			mosaic: composed.mosaic
+		});
+	}
+	async captureOne(cameraId, startedAt) {
+		const took = () => this.deps.now() - startedAt;
+		if (this.deps.isOnline(cameraId) === false) return {
+			cameraId,
+			outcome: "excluded",
+			reason: "offline",
+			tookMs: took()
+		};
+		const [verdict, capture] = await Promise.all([this.wrapperVerdict(cameraId), this.captureStill(cameraId)]);
+		if (verdict.reason !== null) return {
+			cameraId,
+			outcome: "excluded",
+			reason: verdict.reason,
+			tookMs: took()
+		};
+		return {
+			cameraId,
+			...capture,
+			...verdict.unknown !== null ? { stateUnknown: verdict.unknown } : {},
+			tookMs: took()
+		};
+	}
+	async captureStill(cameraId) {
+		try {
+			const shot = await withTimeout$3(this.deps.getSnapshot(cameraId), SENSOR_LINKED_CAPTURE_TIMEOUT_MS, "snapshot cap");
+			if (shot === null || shot.base64.length === 0) return { outcome: "empty" };
+			const jpeg = await this.decodableStill(Buffer.from(shot.base64, "base64"));
+			if (jpeg === null) return {
+				outcome: "error",
+				reason: "undecodable"
+			};
+			return {
+				outcome: "landed",
+				jpeg
+			};
+		} catch (err) {
+			return {
+				outcome: err instanceof LinkedReadTimeout ? "timeout" : "error",
+				reason: String(err)
+			};
+		}
+	}
+	/**
+	* The downscaled still, or null when the bytes are not a picture. A resize
+	* that fails on bytes sharp can still READ keeps them raw (a worse picture,
+	* never a missing one); bytes it cannot read never ship — a decode failure is
+	* a fact about the bytes, not a failed read.
+	*/
+	async decodableStill(raw) {
+		try {
+			return await downscaleFullFrameJpeg(raw, 960, 540);
+		} catch {
+			try {
+				await (0, sharp.default)(raw).metadata();
+				return raw;
+			} catch {
+				return null;
+			}
+		}
+	}
+	/** A failed, slow or empty read is UNKNOWN and never excludes (D49); the
+	*  camera's own outcome line then carries `stateUnknown` with the cause. */
+	async wrapperVerdict(cameraId) {
+		const read = this.deps.getSnapshotState;
+		if (read === void 0) return {
+			reason: null,
+			unknown: null
+		};
+		try {
+			const state = await withTimeout$3(read(cameraId), SENSOR_LINKED_STATE_READ_TIMEOUT_MS, "snapshot state read");
+			return state === void 0 ? {
+				reason: null,
+				unknown: "empty"
+			} : {
+				reason: state.reason,
+				unknown: null
+			};
+		} catch (err) {
+			return {
+				reason: null,
+				unknown: err instanceof LinkedReadTimeout ? "timeout" : "error"
+			};
+		}
+	}
+	async judgeFreshness(sensorId, results, atMs) {
+		const read = this.deps.getFrameCapturedAt;
+		const landedIds = results.filter((r) => r.outcome === "landed").map((r) => r.cameraId);
+		if (read === void 0 || landedIds.length === 0) return results;
+		let capturedAt;
+		try {
+			capturedAt = await withTimeout$3(read(landedIds), 400, "frame freshness read");
+		} catch (err) {
+			this.deps.logger.warn("linked pictures freshness unverified — keeping every tile", {
+				tags: { deviceId: sensorId },
+				meta: { error: String(err) }
+			});
+			return results;
+		}
+		return results.map((r) => {
+			if (r.outcome !== "landed") return r;
+			const at = capturedAt.get(r.cameraId);
+			if (at === void 0 || at === null) return r;
+			if (at >= atMs - 1e4) return r;
+			return {
+				cameraId: r.cameraId,
+				outcome: "stale",
+				reason: `frame ${String(atMs - at)} ms older than the event`,
+				tookMs: r.tookMs
+			};
+		});
+	}
+	async compose(sensorId, landed, atMs) {
+		const first = landed[0];
+		if (first === void 0) return {
+			mosaic: [],
+			servable: [],
+			drawn: 0
+		};
+		if (landed.length === 1) return {
+			mosaic: stillShelfMedia(first.jpeg, atMs),
+			servable: landed,
+			drawn: 1
+		};
+		try {
+			const { jpeg, droppedTiles } = await renderMosaic({
+				purpose: "sensor",
+				tiles: landed.map((r) => ({
+					jpeg: r.jpeg,
+					deviceId: r.cameraId,
+					sourceId: String(r.cameraId)
+				}))
+			}, this.deps.logger);
+			return {
+				mosaic: stillShelfMedia(jpeg, atMs),
+				servable: landed,
+				drawn: landed.length - droppedTiles
+			};
+		} catch (err) {
+			this.deps.logger.warn("sensor mosaic could not be composed — shipping the first camera", {
+				tags: { deviceId: sensorId },
+				meta: {
+					error: String(err),
+					offered: landed.length,
+					shipped: first.cameraId
+				}
+			});
+			return {
+				mosaic: stillShelfMedia(first.jpeg, atMs),
+				servable: landed,
+				drawn: 1
+			};
+		}
+	}
+	logTile(sensorId, r) {
+		const extras = {
+			tags: { deviceId: r.cameraId },
+			meta: {
+				sensorId,
+				outcome: r.outcome,
+				tookMs: r.tookMs,
+				...r.reason !== void 0 ? { reason: r.reason } : {},
+				...r.stateUnknown !== void 0 ? { stateUnknown: r.stateUnknown } : {}
+			}
+		};
+		if (r.outcome === "excluded") this.deps.logger.info("linked camera excluded from the sensor notification", extras);
+		else if (r.outcome === "landed" && r.stateUnknown !== void 0) this.deps.logger.info("linked camera photographed for the sensor notification — state unknown, tile kept", extras);
+		else if (r.outcome === "landed") this.deps.logger.debug("linked camera photographed for the sensor notification", extras);
+		else this.deps.logger.warn("linked camera gave no usable picture for the sensor notification", extras);
+	}
+};
+/** Reject with {@link LinkedReadTimeout} if `promise` does not settle within `ms`. */
+function withTimeout$3(promise, ms, what) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(new LinkedReadTimeout(what, ms)), ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+//#endregion
 //#region src/notification-center/liveness-ledger.ts
 /**
 * @durable class=ledger owner=notification-center
@@ -22970,279 +24159,6 @@ var NcSnoozeStore = class {
 		return parsed.success ? parsed.data : null;
 	}
 };
-/** JPEG quality for the downscaled full frame — matches the crop path. */
-var FULL_FRAME_QUALITY = 80;
-/**
-* Downscale an already-encoded JPEG full frame to FIT WITHIN
-* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
-* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
-* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
-* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
-* at night) is never stored or served — the privacy fix moved to CAPTURE time.
-*/
-async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
-	return (0, sharp.default)(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
-		fit: "inside",
-		withoutEnlargement: true
-	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
-}
-//#endregion
-//#region src/notification-center/still-shelf.ts
-/**
-* The still shelf — the PHOTOGRAPH a notification carries when nothing it can
-* name owns a frame.
-*
-* ## Why a trigger needs one at all
-*
-* The attachment ladder resolves media by OWNER, and most triggers have one: an
-* object or package event owns its crops, a closed track owns its best shot, a
-* doorbell press owns the marker track the same press projected
-* (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
-* counted (`chooseOccupancyMediaOwner`). Two triggers own nothing, and for the
-* same reason in both cases — the subject is an ABSENCE:
-*
-*  - an **audio** match: nothing was boxed, nothing was tracked, and —
-*    deliberately — nothing is persisted at all. A confirmed window is a claim
-*    about sound that has already stopped, and `event-intake.ts` states why
-*    replaying it later would be wrong.
-*  - an **occupancy** edge whose scope is EMPTY — "posto libero". The vehicle
-*    whose departure IS the news has left, so `chooseOccupancyMediaOwner` names
-*    nobody and the ladder logs `no still could be resolved … owners=[]`.
-*
-* So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
-* of the trigger. Not of the sound, not of the object that left — of what the
-* camera can see now that it happened. For a freed parking space that is
-* exactly the answer the operator wants: the space, empty.
-*
-* **One shelf, not two.** The mechanism is identical down to the reuse window,
-* and the only thing that differs between the two triggers is the GATE deciding
-* that a photograph is owed at all — which belongs at the trigger site, where
-* the rules are, and not here. A twin module would be a second derivation of
-* one thing. The trigger rides along as {@link NcStillTrigger} only so the logs
-* can say which absence they are about.
-*
-* ## Three properties, and each one is a decision
-*
-* **It is not a record.** The bytes live here, in RAM, under an owner id and a
-* TTL that covers the outbox's whole retry horizon — and nowhere else. The
-* alternative was the doorbell's: materialise a synthetic marker track through
-* `SyntheticTrackMaterializer` and let the notification name it. That would put
-* a durable Track on the camera's timeline for every confirmed window and every
-* emptied zone, feeding the digest's `listTracks`, retention, and the audio-
-* marker feature's own operator ceilings (`audio-marker-projector.ts` exists
-* precisely to bound how many audio markers a camera may emit). A notification
-* must not manufacture timeline history as a side effect of wanting a picture.
-*
-* **The capture STARTS immediately and is never awaited.** The subject is
-* transient — a scream is over before a snapshot round-trip completes, and a
-* freed space is about to be taken by the next car — so the fetch is kicked off
-* at the trigger, before the rule evaluation runs, and the owner id is minted
-* synchronously so the outbox row can name it. The bytes land while the row
-* waits in the queue, and the dispatcher's existing bounded still-wait (or the
-* pause its own footage render already costs) picks them up. A camera that
-* never answers costs the picture and never the notification.
-*
-* **Two triggers seconds apart share ONE capture.** A barking dog confirms
-* repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
-* rule's cooldown is its only brake, and the cooldown is applied AFTER this.
-* Without a reuse window this would photograph a camera at whatever rate the
-* sound happens to occur. Each trigger still gets its OWN owner id, so two
-* outbox rows are never mistaken for one subject; they merely point at the same
-* frame, which is the truth — the scene did not change in ten seconds. The
-* window is per CAMERA and trigger-agnostic for the same reason: a sound and an
-* emptied zone ten seconds apart are two claims about one scene.
-*
-* Nothing here is silent: a capture that lands and a camera that refuses each
-* emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
-* and 615 not" is the only form that question is ever asked in.
-*/
-/**
-* The owner-id namespace. It is what routes a lookup here instead of to the
-* media store, and it is the reason the dispatcher needs no audio or occupancy
-* branch — `getMediaForOwner` answers for all of them under one signature.
-*/
-var NC_STILL_SHELF_PREFIX = "nc-still:";
-/** True for an owner id this shelf minted. */
-function isStillShelfId(id) {
-	return id.startsWith(NC_STILL_SHELF_PREFIX);
-}
-/**
-* How long the bytes are held.
-*
-* The outbox retries 8 times with a 5 s → 300 s backoff, which tops out around
-* ten minutes; fifteen covers that with room for a slow drain. Past it the row
-* ships text-only, which is the correct degradation for a photograph of a scene
-* that is a quarter of an hour stale anyway.
-*/
-var NC_STILL_SHELF_TTL_MS = 15 * 6e4;
-/** A hanging snapshot cap must not pin a capture slot forever. */
-var SNAPSHOT_TIMEOUT_MS = 8e3;
-/**
-* Hard bound on held captures. Reached only if every camera on the hub triggers
-* one inside a single TTL; the oldest is dropped first, which costs a
-* fifteen-minute-old picture nobody is waiting for.
-*/
-var MAX_CAPTURES = 64;
-var NcStillShelf = class {
-	deps;
-	/** captureId → the photograph. */
-	captures = /* @__PURE__ */ new Map();
-	/** ownerId → captureId. Several owners may name one capture (the reuse window). */
-	owners = /* @__PURE__ */ new Map();
-	/** deviceId → its newest capture, for the reuse window. */
-	newest = /* @__PURE__ */ new Map();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Photograph `deviceId` for a trigger at `atMs`, and return the owner id the
-	* subject should name. SYNCHRONOUS by contract: the caller is on the trigger
-	* path and the outbox row is built from what this returns.
-	*/
-	capture(deviceId, atMs, trigger) {
-		const now = this.deps.now();
-		this.prune(now);
-		const ownerId = `${NC_STILL_SHELF_PREFIX}${(0, node_crypto.randomUUID)()}`;
-		const recent = this.newest.get(deviceId);
-		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
-			this.owners.set(ownerId, recent.captureId);
-			return ownerId;
-		}
-		const captureId = (0, node_crypto.randomUUID)();
-		this.captures.set(captureId, {
-			deviceId,
-			trigger,
-			startedAt: now,
-			expiresAt: now + NC_STILL_SHELF_TTL_MS,
-			files: []
-		});
-		this.newest.set(deviceId, {
-			captureId,
-			at: now
-		});
-		this.owners.set(ownerId, captureId);
-		this.fetch(captureId, deviceId, atMs, trigger);
-		return ownerId;
-	}
-	/**
-	* The media an owner id holds, or `undefined` when this shelf never minted
-	* it. An EMPTY array is a different answer: the capture exists and has not
-	* landed (or never will), which is exactly the case the dispatcher's bounded
-	* wait and its `no still could be resolved` line are for.
-	*/
-	get(ownerId) {
-		const captureId = this.owners.get(ownerId);
-		if (captureId === void 0) return void 0;
-		return this.captures.get(captureId)?.files ?? [];
-	}
-	/** Drop expired captures and the owners that named them. */
-	prune(now) {
-		for (const [captureId, held] of this.captures) {
-			if (held.expiresAt > now) continue;
-			this.captures.delete(captureId);
-			if (this.newest.get(held.deviceId)?.captureId === captureId) this.newest.delete(held.deviceId);
-		}
-		while (this.captures.size > MAX_CAPTURES) {
-			const oldest = this.captures.keys().next();
-			if (oldest.done === true) break;
-			const held = this.captures.get(oldest.value);
-			this.captures.delete(oldest.value);
-			if (held !== void 0 && this.newest.get(held.deviceId)?.captureId === oldest.value) this.newest.delete(held.deviceId);
-		}
-		for (const [ownerId, captureId] of this.owners) if (!this.captures.has(captureId)) this.owners.delete(ownerId);
-	}
-	/** Drop everything (shutdown). */
-	clear() {
-		this.captures.clear();
-		this.owners.clear();
-		this.newest.clear();
-	}
-	async fetch(captureId, deviceId, atMs, trigger) {
-		try {
-			const shot = await withTimeout$3(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
-			if (shot === null || shot.base64.length === 0) {
-				this.reportMiss(deviceId, trigger, "the camera returned no snapshot");
-				return;
-			}
-			const raw = Buffer.from(shot.base64, "base64");
-			let data = raw;
-			try {
-				data = await downscaleFullFrameJpeg(raw, 960, 540);
-			} catch {}
-			const held = this.captures.get(captureId);
-			if (held === void 0) return;
-			this.captures.set(captureId, {
-				...held,
-				files: stillShelfMedia(data, atMs)
-			});
-			this.deps.logger.info(`${trigger} still captured`, {
-				tags: { deviceId },
-				meta: {
-					trigger,
-					bytes: data.byteLength,
-					tookMs: this.deps.now() - held.startedAt
-				}
-			});
-		} catch (err) {
-			this.reportMiss(deviceId, trigger, err instanceof Error ? err.message : String(err));
-		}
-	}
-	/**
-	* A branch that drops work says so. This one costs the operator the picture
-	* on a notification they DID receive, so it is a warn and it carries the
-	* camera — the only key the question is ever asked with.
-	*/
-	reportMiss(deviceId, trigger, reason) {
-		this.deps.logger.warn(`the camera did not answer the ${trigger} still — this notification ships text-only`, {
-			tags: { deviceId },
-			meta: {
-				trigger,
-				reason
-			}
-		});
-	}
-};
-/**
-* The photograph, in the three kinds the CLEAN-SCENE ladders ask for.
-*
-* `keyFrameSmall` leads because it is the first rung of both `attach: 'best'`
-* and `attach: 'keyFrame'` on a track owner; `keyFrame` and `fullFrame` answer
-* `frame: 'full'` and `frame: 'boxed'`'s honest degrade. There is deliberately
-* no `crop` / `thumbnail`: nothing was boxed, so `frame: 'cropped'` resolves
-* NOTHING and the notification ships text-only with the ordinary line saying
-* so. Inventing a centre crop would answer a different question from the one
-* the operator asked.
-*/
-function stillShelfMedia(data, timestamp) {
-	const base64 = data.toString("base64");
-	const file = (kind) => ({
-		mediaId: nextUnstoredMediaId(),
-		kind,
-		base64,
-		sizeBytes: data.byteLength,
-		timestamp
-	});
-	return [
-		file("keyFrameSmall"),
-		file("keyFrame"),
-		file("fullFrame")
-	];
-}
-/** Reject if `promise` does not settle within `ms`. */
-function withTimeout$3(promise, ms) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => {
-			reject(/* @__PURE__ */ new Error(`snapshot cap timed out after ${String(ms)}ms`));
-		}, ms);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
 //#endregion
 //#region src/notification-center/summary/summary-ai.ts
 /**
@@ -23734,293 +24650,6 @@ function findNextWindowOpen(input) {
 		endMs: null
 	};
 }
-/** The canvas behind a tile whose aspect does not fill its cell. */
-var MOSAIC_BACKGROUND = {
-	r: 17,
-	g: 17,
-	b: 17
-};
-/** Tile aspect — cameras are 16:9 and a square cell would letterbox every one. */
-var TILE_ASPECT = 9 / 16;
-/** Height of the per-tile label strip, as a fraction of the tile height. */
-var LABEL_BAND_FRACTION = .14;
-var LABEL_MIN_PX = 11;
-/** Height of the mosaic's own title band, as a fraction of a tile's height. */
-var TITLE_BAND_FRACTION = .22;
-var TITLE_MIN_PX = 16;
-/**
-* Average glyph width as a fraction of the font size, for bold sans-serif.
-*
-* An ESTIMATE, and it has to be: librsvg lays the text out long after this
-* string is written, so there are no metrics to measure against. The same
-* number and the same reasoning as `preview-frame.ts#fitTitle` — deliberately
-* GENEROUS, because a label that shrank slightly more than it had to is
-* invisible and one that overflowed runs into the tile beside it. The first
-* live mosaic did exactly that: `Videocamera cortile · 07:49 · animal` was cut
-* to `…· anima` at the tile edge, mid-word.
-*/
-var GLYPH_ADVANCE = .56;
-/** Fraction of the band a label may occupy, leaving the padding either side. */
-var LABEL_USABLE_FRACTION = .94;
-/** `<`, `>`, `&`, `'`, `"` in a camera name or an operator caption would each
-*  turn the overlay into a document librsvg refuses. */
-function escapeXml$1(s) {
-	return s.replace(/[<>&'"]/g, (ch) => {
-		switch (ch) {
-			case "<": return "&lt;";
-			case ">": return "&gt;";
-			case "&": return "&amp;";
-			case "'": return "&apos;";
-			default: return "&quot;";
-		}
-	});
-}
-/**
-* The single decision about drawn text — and the home of the DEFAULT.
-*
-* `undefined` means `none`, not `all`: a rule stored before this option existed
-* has no `captions` key, and the operator's request is that such a rule deliver
-* pictures. The schema materialises the same default on read
-* (`NcSummaryRuleInputSchema`), so this arm only fires for a caller that never
-* had a rule — the test bridge and the spec. Both agreeing is the point.
-*/
-function mosaicTextPlan(captions) {
-	if (captions === "all") return {
-		tileLabels: true,
-		titleBand: true
-	};
-	if (captions === "tiles") return {
-		tileLabels: true,
-		titleBand: false
-	};
-	return {
-		tileLabels: false,
-		titleBand: false
-	};
-}
-/** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
-*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip.
-*
-*  `rows` is the load-bearing half — it is how many rows {@link mosaicRowCounts}
-*  distributes into. `cols` describes the WIDEST row, and is no longer a cell
-*  count: see {@link mosaicRowCounts} for why a `cols × rows` grid was the bug. */
-function mosaicGrid(n) {
-	const count = Math.max(1, Math.floor(n));
-	const cols = Math.ceil(Math.sqrt(count));
-	return {
-		cols,
-		rows: Math.ceil(count / cols)
-	};
-}
-/**
-* How many tiles each ROW carries, top to bottom — and the reason the mosaic
-* can no longer have a hole in it.
-*
-* The layout used to be a `cols × rows` GRID, and a grid holds more cells than
-* tiles for every count that is not a perfect fit: 3 into a 2×2, 5 into a 3×2,
-* 7 and 8 into a 3×3. The composite only ever wrote the tiles, so the spare
-* cells stayed the canvas — `MOSAIC_BACKGROUND`, rgb 17 — and the operator's
-* three-tile digest was a quarter black. Measured on the shipped renderer:
-* 24.8% of a three-tile mosaic was background. His words: *"se ci sono 3
-* elementi non dovrebbe renderizzare buchi neri"*.
-*
-* Counting ROWS instead removes the failure by construction rather than by
-* patching it. Every row spans the full width and divides it among the tiles it
-* actually has, so a row is full whatever the remainder and there is no such
-* thing as a spare cell. The shapes fall out of it, and they are the ones asked
-* for: 1 ⇒ full frame, 2 ⇒ side by side, 3 ⇒ one big over two small, 4 ⇒ 2×2.
-*
-* **The fewer-tiled row comes FIRST.** Tiles arrive in the selection's order,
-* so row 0 is the head of the ranking; putting the remainder at the top would
-* make the WORST tile the big one.
-*
-* Every cell keeps {@link TILE_ASPECT}, so rows differ in height — which is
-* also what stops the letterbox: a full-width hero tile is 16:9 exactly, not a
-* 16:9 picture centred in a double-height cell with bars over and under it.
-*/
-function mosaicRowCounts(n) {
-	const count = Math.max(1, Math.floor(n));
-	const { rows } = mosaicGrid(count);
-	const base = Math.floor(count / rows);
-	const remainder = count % rows;
-	const counts = [];
-	for (let row = 0; row < rows; row += 1) counts.push(row < rows - remainder ? base : base + 1);
-	return counts;
-}
-/**
-* Where every tile lands. Pure — no bytes, no sharp, no clock.
-*
-* Exported because the rectangles are DATA the artefact should carry: a viewer
-* that wants a tappable mosaic reads these rather than re-deriving a layout
-* that could drift from the one actually rendered.
-*
-* The rectangles COVER the picture area exactly — that is the property the
-* spec asserts, and it is the one the old grid broke.
-*/
-function mosaicLayout(input) {
-	const rowCounts = mosaicRowCounts(input.tileCount);
-	const width = Math.max(1, Math.floor(input.maxWidth ?? 1920));
-	const firstRowCount = rowCounts[0] ?? 1;
-	const tileWidth = Math.floor(width / firstRowCount);
-	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
-	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
-	const tiles = [];
-	let y = titleHeight;
-	let index = 0;
-	for (const count of rowCounts) {
-		const nominalWidth = Math.floor(width / count);
-		const rowHeight = Math.round(nominalWidth * TILE_ASPECT);
-		let x = 0;
-		for (let inRow = 0; inRow < count; inRow += 1) {
-			const w = inRow === count - 1 ? width - x : nominalWidth;
-			tiles.push({
-				index,
-				x,
-				y,
-				w,
-				h: rowHeight
-			});
-			x += w;
-			index += 1;
-		}
-		y += rowHeight;
-	}
-	return {
-		width,
-		height: y,
-		cols: Math.max(...rowCounts),
-		rows: rowCounts.length,
-		rowCounts,
-		tileWidth,
-		tileHeight,
-		titleHeight,
-		tiles
-	};
-}
-/**
-* Shrink, then ELIDE, until the line fits `usablePx`.
-*
-* Shrinking is tried first because a slightly smaller label still says
-* everything; only past `minPx` is the tail cut, and then with an ellipsis so
-* the reader can SEE that something was cut. The failure this replaces was
-* silent: SVG simply clips at the viewport, so an overlong label lost its last
-* word mid-glyph and looked like a rendering bug rather than a truncation.
-*
-* Pure and exported so the arithmetic is testable without rendering a pixel.
-*/
-function fitLine(text, usablePx, basePx, minPx) {
-	const flat = text.trim().replace(/\s+/g, " ");
-	const fits = (s, fontPx) => s.length * fontPx * GLYPH_ADVANCE <= usablePx;
-	let fontPx = Math.max(minPx, Math.round(basePx));
-	while (fontPx > minPx && !fits(flat, fontPx)) fontPx = Math.max(minPx, fontPx - 1);
-	if (fits(flat, fontPx)) return {
-		text: flat,
-		fontPx
-	};
-	const budget = Math.max(1, Math.floor(usablePx / (fontPx * GLYPH_ADVANCE)));
-	return {
-		text: `${flat.slice(0, Math.max(1, budget - 1)).trimEnd()}…`,
-		fontPx
-	};
-}
-/** The label strip drawn across the bottom of one tile. */
-function tileLabelSvg(width, height, label) {
-	const bandHeight = Math.max(18, Math.round(height * LABEL_BAND_FRACTION));
-	const basePx = Math.round(bandHeight * .62);
-	const padding = Math.round(basePx * .6);
-	const fitted = fitLine(label, width * LABEL_USABLE_FRACTION - padding, basePx, LABEL_MIN_PX);
-	const baseline = height - Math.round((bandHeight - fitted.fontPx) / 2) - Math.round(fitted.fontPx * .18);
-	return Buffer.from(`<svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
-  <rect x="0" y="${height - bandHeight}" width="${width}" height="${bandHeight}" fill="black" fill-opacity="0.55"/>
-  <text x="${padding}" y="${baseline}" font-size="${fitted.fontPx}" font-family="sans-serif" font-weight="bold" fill="white">${escapeXml$1(fitted.text)}</text>
-</svg>`);
-}
-/** The mosaic's own title band. */
-function titleSvg(width, height, caption) {
-	const fitted = fitLine(caption, width * LABEL_USABLE_FRACTION, Math.round(height * .5), TITLE_MIN_PX);
-	const baseline = Math.round(height / 2 + fitted.fontPx * .36);
-	return Buffer.from(`<svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
-  <rect x="0" y="0" width="${width}" height="${height}" fill="#111111"/>
-  <text x="${Math.round(width / 2)}" y="${baseline}" font-size="${fitted.fontPx}" font-family="sans-serif" font-weight="bold" text-anchor="middle" fill="white">${escapeXml$1(fitted.text)}</text>
-</svg>`);
-}
-/**
-* Compose the mosaic.
-*
-* Every tile is fitted with `contain` onto the cell background rather than
-* cropped: a `cover` fit would silently cut the subject out of a portrait crop,
-* and a tile that does not show what it is about is worse than a letterboxed
-* one.
-*
-* A tile sharp cannot read is DROPPED and counted, never composited as a blank
-* cell — a black square in a digest reads as "the camera saw nothing", which is
-* the opposite of what happened. The layout is computed from the SURVIVORS, and
-* because {@link mosaicRowCounts} counts rows rather than grid cells there is no
-* remainder to leave empty either.
-*
-* @throws when every tile was dropped, and when sharp cannot produce the final
-*         canvas at all; the caller treats both as "no mosaic" and still
-*         delivers the counts.
-*/
-async function renderMosaic(request, logger) {
-	const plan = mosaicTextPlan(request.captions);
-	const usable = [];
-	for (const tile of request.tiles) try {
-		await (0, sharp.default)(tile.jpeg).metadata();
-		usable.push(tile);
-	} catch (err) {
-		logger.warn("summary mosaic: a tile could not be decoded and was dropped", {
-			tags: { deviceId: tile.deviceId },
-			meta: {
-				trackId: tile.trackId,
-				error: String(err)
-			}
-		});
-	}
-	const droppedTiles = request.tiles.length - usable.length;
-	if (usable.length === 0) throw new Error(`summary mosaic: no tile could be decoded (${request.tiles.length} offered)`);
-	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
-	const layout = mosaicLayout({
-		tileCount: usable.length,
-		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
-		withTitle: caption.length > 0
-	});
-	const composites = await Promise.all(usable.map(async (tile, index) => {
-		const rect = layout.tiles[index];
-		if (rect === void 0) throw new Error("summary mosaic: layout lost a tile");
-		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
-		const fitted = (0, sharp.default)(tile.jpeg).resize({
-			width: rect.w,
-			height: rect.h,
-			fit: "contain",
-			background: MOSAIC_BACKGROUND
-		});
-		return {
-			input: await (label.length === 0 ? fitted : fitted.composite([{
-				input: tileLabelSvg(rect.w, rect.h, label),
-				top: 0,
-				left: 0
-			}])).jpeg({ quality: 82 }).toBuffer(),
-			top: rect.y,
-			left: rect.x
-		};
-	}));
-	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
-		input: titleSvg(layout.width, layout.titleHeight, caption),
-		top: 0,
-		left: 0
-	});
-	return {
-		jpeg: await (0, sharp.default)({ create: {
-			width: layout.width,
-			height: layout.height,
-			channels: 3,
-			background: MOSAIC_BACKGROUND
-		} }).composite(composites).jpeg({ quality: 82 }).toBuffer(),
-		layout,
-		droppedTiles
-	};
-}
 //#endregion
 //#region src/notification-center/summary/summary-ai-subject-view.ts
 /**
@@ -25344,11 +25973,12 @@ var NcSummaryProducer = class {
 		try {
 			const plan = mosaicTextPlan(rule.captions);
 			rendered = await renderMosaic({
+				purpose: "summary",
 				tiles: tiles.map(({ candidate, jpeg }) => ({
 					jpeg,
 					...plan.tileLabels ? { label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf$1(candidate.firstSeen)} · ${candidate.className}` } : {},
 					deviceId: candidate.deviceId,
-					trackId: candidate.trackId
+					sourceId: candidate.trackId
 				})),
 				captions: rule.captions,
 				...plan.titleBand ? { caption: summaryCaptionText({
@@ -27711,6 +28341,12 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	stills;
 	/**
+	* The photographs a SENSOR notification carries of every camera linking the
+	* sensor (`linked-stills.ts`, ADR 0632). Null when this wiring has no
+	* snapshot cap — such a notification then ships text-only.
+	*/
+	linkedStills;
+	/**
 	* Rate limit for the "matched NO rule" report — see `reportNoMatch`. Keyed by
 	* {@link noMatchReportKey} (device + subject kind + class set), NOT by device:
 	* a person's verdict must never consume the window a cat's verdict needed on
@@ -27721,6 +28357,10 @@ var NotificationCenter = class NotificationCenter {
 	/** Same rate-limit pair, same key, for the per-camera mute drop — see `reportMutedDrop`. */
 	lastMutedReportAt = /* @__PURE__ */ new Map();
 	mutedSuppressed = /* @__PURE__ */ new Map();
+	/** Same pair, keyed by CAMERA, for a muted camera left out of a linked set —
+	*  see `reportLinkedCameraMuted`. */
+	lastLinkedMutedReportAt = /* @__PURE__ */ new Map();
+	linkedMutedSuppressed = /* @__PURE__ */ new Map();
 	/**
 	* RAM-only same-edge dedup for the families the durable ledger does NOT
 	* govern — stream health and the operator's disable switch. Both are already
@@ -28371,6 +29011,14 @@ var NotificationCenter = class NotificationCenter {
 			logger: this.logger.child("still-shelf"),
 			now: this.now
 		}) : null;
+		this.linkedStills = getSnapshot !== void 0 ? new NcLinkedStillShelf({
+			getSnapshot,
+			...deps.getSnapshotState !== void 0 ? { getSnapshotState: deps.getSnapshotState } : {},
+			...deps.getFrameCapturedAt !== void 0 ? { getFrameCapturedAt: deps.getFrameCapturedAt } : {},
+			isOnline: (id) => this.deviceDirectory.get(id)?.online,
+			logger: this.logger.child("linked-stills"),
+			now: this.now
+		}) : null;
 		this.rules = new NcRuleStore({
 			store: deps.store,
 			logger: this.logger.child("rules"),
@@ -28488,6 +29136,8 @@ var NotificationCenter = class NotificationCenter {
 				if (held !== void 0) return held.files;
 				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
 				if (shelved !== void 0) return shelved;
+				const linked = isLinkedStillId(ownerId) ? this.linkedStills?.get(ownerId) : void 0;
+				if (linked !== void 0) return linked;
 				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
 			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
@@ -28886,6 +29536,7 @@ var NotificationCenter = class NotificationCenter {
 		this.timelapseScheduler?.stop();
 		this.summaryProducer?.stop();
 		this.stills?.clear();
+		this.linkedStills?.clear();
 		this.addonUpdates.dispose();
 		this.livenessHoldoff.dispose();
 		this.evaluationActive = false;
@@ -29214,6 +29865,110 @@ var NotificationCenter = class NotificationCenter {
 		this.consumeEvent(incomingFromUnownedSensorEvent(event, linkedCameraIds));
 	}
 	/**
+	* Start photographing every camera that links `sensorId`, and return the
+	* owners the sensor-level evaluation names — or `undefined` when there is no
+	* set (≤1 linked camera: today's marker is the picture), nothing to show
+	* (every linked camera muted), the event will be dropped as muted (the
+	* SENSOR is muted, or there were row cameras and every one is muted — see
+	* the evaluation's mute gate), or no enabled device-event rule that could
+	* fire on this sensor KIND wants a picture (the gate is the RULE's media
+	* policy, scope and kind conditions, read from the in-memory mirror — D49,
+	* as `audioStillOwner`; an occupancy rule, which rides the same delivery,
+	* never fires on a sensor). Coarse on purpose, in one direction only: a
+	* capture for a rule whose other conditions then fail is one wasted
+	* snapshot, a missing capture is a notification without its picture. The
+	* kind check is what keeps a chatty multi-linked motion sensor from
+	* composing a mosaic on every edge for a doorbell rule.
+	*
+	* A MUTED camera (D62) is never dialled: its tile is left out, said on that
+	* camera (once per window), and the primary is the first linked camera that
+	* is not muted — the same derivation {@link onSensorEvent} makes.
+	*
+	* `cameraIds` is every linking camera, UNFILTERED; `rowCameraIds` the ones
+	* that take a timeline row for the change — with the sensor, the device
+	* scope the evaluation will match on (`matchesDeviceScope`).
+	*/
+	beginLinkedStills(request) {
+		const { sensorId, sensorKind, cameraIds, atMs, rowCameraIds } = request;
+		const shelf = this.linkedStills;
+		if (shelf === null || !this.evaluationActive || cameraIds.length < 2) return void 0;
+		if (this.deviceMutes.isMuted(sensorId)) return void 0;
+		const rowShown = this.unmutedCameras(rowCameraIds);
+		if (rowCameraIds.length > 0 && rowShown.length === 0) return void 0;
+		const shown = this.unmutedCameras(cameraIds);
+		const involved = [sensorId, ...rowShown];
+		if (!this.rules.listEnabled("device-event").some((rule) => {
+			if (rule.media.attach === "none") return false;
+			if (!deviceEventRuleMayFireOnKind(rule, sensorKind)) return false;
+			const devices = rule.conditions.devices;
+			return devices === void 0 || devices.length === 0 || devices.some((id) => involved.includes(id));
+		})) return void 0;
+		for (const cameraId of cameraIds) if (!shown.includes(cameraId)) this.reportLinkedCameraMuted(cameraId, sensorId);
+		return shown.length > 0 ? shelf.captureSet(sensorId, shown, atMs) : void 0;
+	}
+	/**
+	* A muted camera left out of a linked set — one INFO line per camera per
+	* window, the suppressed count folded into the next one. A chatty contact
+	* linked to a muted camera must not write a line on every change.
+	*/
+	reportLinkedCameraMuted(cameraId, sensorId) {
+		const now = this.now();
+		const last = this.lastLinkedMutedReportAt.get(cameraId);
+		const suppressed = this.linkedMutedSuppressed.get(cameraId) ?? 0;
+		if (last !== void 0 && now - last < NO_MATCH_REPORT_INTERVAL_MS) {
+			this.linkedMutedSuppressed.set(cameraId, suppressed + 1);
+			return;
+		}
+		this.lastLinkedMutedReportAt.set(cameraId, now);
+		this.linkedMutedSuppressed.set(cameraId, 0);
+		this.logger.info("linked camera muted — left out of the sensor notification", {
+			tags: { deviceId: cameraId },
+			meta: {
+				sensorId,
+				reason: "muted",
+				...suppressed > 0 ? { alsoLeftOutSinceLastReport: suppressed } : {}
+			}
+		});
+	}
+	/**
+	* ONE evaluation for one sensor state change (ADR 0632) — replaces the
+	* per-camera fan-out when the sensor is linked to more than one camera.
+	*
+	* The linked cameras widen the MEDIA only — which cameras' stills ship —
+	* never which rules fire. Matching is on the SENSOR and the cameras that
+	* took a timeline row (`rowCameraIds`, not muted) — D630 §6, whatever the
+	* number of linked cameras. The primary is only the camera the notification
+	* leads with.
+	*
+	* The primary is re-derived here as the first linked camera that is NOT
+	* muted (D62): a camera's mute drops only its own tile, and its marker is
+	* then not the picture. Every linked camera muted ⇒ the sensor is its own
+	* device and the notification is text-only. The MUTE of the event itself is
+	* judged on the sensor ({@link NcRuleSubject.linkedSensorId}). A
+	* `rule-device` cooldown is keyed by the primary. Same lossy boundary as
+	* {@link onSensorEventPersisted}.
+	*/
+	onSensorEvent(input) {
+		this.observeOpeningEvent(input.event);
+		const shown = this.unmutedCameras(input.linkedCameraIds);
+		const muted = input.linkedCameraIds.filter((id) => !shown.includes(id));
+		const primary = shown[0] ?? input.event.sourceDeviceId;
+		const marker = primary === input.event.deviceId ? input.markerTrackId : void 0;
+		this.consumeEvent(incomingFromSensorEvent({
+			...input.event,
+			deviceId: primary
+		}, marker, {
+			linkedCameraIds: shown,
+			rowCameraIds: this.unmutedCameras(input.rowCameraIds),
+			mutedRowCameraIds: input.rowCameraIds.filter((id) => this.deviceMutes.isMuted(id)),
+			...input.linkedStills !== void 0 ? { linkedStills: input.linkedStills } : {}
+		}, muted));
+	}
+	/** The linked cameras a sensor notification may show — not muted (D62), in order. */
+	unmutedCameras(cameraIds) {
+		return cameraIds.filter((id) => !this.deviceMutes.isMuted(id));
+	}
+	/**
 	* The opening reading a sensor row carries — a contact, a cover or a lock,
 	* read with D630's table (`alarmOpeningFromSensorEvent`) — handed to the
 	* panel. A row that is not an opening, or whose word is unknown, hands over
@@ -29499,6 +30254,10 @@ var NotificationCenter = class NotificationCenter {
 			getRule: async ({ ruleId }) => ({ rule: this.rules.get(ruleId) }),
 			createRule: async ({ rule, caller }) => {
 				assertRuleHasAddressee(rule.targets, rule.targetUsers);
+				guardRuleFamily(rule, {
+					logger: this.logger,
+					by: caller.userId
+				});
 				await this.validateTargetRefs(rule.targets.map((t) => t.targetId));
 				const created = await this.rules.create(rule, caller.userId);
 				this.logger.info("notification rule created", { meta: {
@@ -29510,7 +30269,13 @@ var NotificationCenter = class NotificationCenter {
 			},
 			updateRule: async ({ ruleId, patch, clear, caller }) => {
 				if (patch.targets !== void 0) await this.validateTargetRefs(patch.targets.map((t) => t.targetId));
-				assertPatchKeepsAddressee(this.rules.get(ruleId), patch, clear ?? []);
+				const existing = this.rules.get(ruleId);
+				assertPatchKeepsAddressee(existing, patch, clear ?? []);
+				guardPatchFamily(existing, patch, {
+					logger: this.logger,
+					by: caller.userId,
+					ruleId
+				});
 				const { disabledTargetIds: _optOut, ...safePatch } = patch;
 				const updated = await this.rules.update(ruleId, safePatch, clear ?? []);
 				this.logger.info("notification rule updated", { meta: {
@@ -30340,8 +31105,9 @@ var NotificationCenter = class NotificationCenter {
 			outcomes,
 			...extra
 		});
-		if (this.deviceMutes.isMuted(subject.deviceId) && controls.bypassMute !== true) {
-			this.reportMutedDrop(subject, kind, this.now());
+		const muteDeviceId = this.mutedAuthority(subject);
+		if (muteDeviceId !== void 0 && controls.bypassMute !== true) {
+			this.reportMutedDrop(subject, muteDeviceId, kind, this.now());
 			return report({ droppedBy: "muted" });
 		}
 		const delivery = deliveryForKind(kind);
@@ -30512,7 +31278,7 @@ var NotificationCenter = class NotificationCenter {
 					buttons: unresolvable.join(", ")
 				}
 			});
-			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && rule.media.attach !== "none") {
+			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && subject.linkedStills === void 0 && rule.media.attach !== "none") {
 				noOwnerReported = true;
 				const linked = subject.linkedCameraIds;
 				const meta = {
@@ -30521,7 +31287,19 @@ var NotificationCenter = class NotificationCenter {
 					ruleId: rule.id,
 					rule: rule.name
 				};
-				if (linked !== void 0) this.logger.debug(linked.length === 0 ? "device event from a sensor linked to no camera — this notification ships text-only" : `device event from a sensor linked to ${linked.length} camera(s), none opted into tracked events — this notification ships text-only`, {
+				if (linked !== void 0 && linked.length === 0 && isLinkedSetSubject(subject)) this.logger.info("every linked camera is muted — this sensor notification ships text-only", {
+					tags: { deviceId: subject.linkedSensorId ?? subject.deviceId },
+					meta
+				});
+				else if (linked !== void 0 && isLinkedSetSubject(subject)) this.logger.warn("sensor event has no linked-camera pictures and no marker — this notification ships text-only", {
+					tags: { deviceId: subject.sourceDeviceId ?? subject.deviceId },
+					meta: {
+						...meta,
+						linkedCameraIds: [...linked],
+						snapshotWired: this.linkedStills !== null
+					}
+				});
+				else if (linked !== void 0) this.logger.debug(linked.length === 0 ? "device event from a sensor linked to no camera — this notification ships text-only" : `device event from a sensor linked to ${linked.length} camera(s), none opted into tracked events — this notification ships text-only`, {
 					tags: { deviceId: subject.deviceId },
 					meta: {
 						...meta,
@@ -30778,14 +31556,26 @@ var NotificationCenter = class NotificationCenter {
 		});
 	}
 	/**
+	* The muted device that drops this subject, or `undefined` when none does.
+	* A per-camera subject: its camera. A linked set: the sensor; else, when
+	* the change took rows and every row camera is muted, the sensor too — the
+	* line names the muted row cameras.
+	*/
+	mutedAuthority(subject) {
+		const sensorId = subject.linkedSensorId;
+		if (sensorId === void 0) return this.deviceMutes.isMuted(subject.deviceId) ? subject.deviceId : void 0;
+		if (this.deviceMutes.isMuted(sensorId)) return sensorId;
+		return (subject.rowCameraIds ?? []).length === 0 && (subject.mutedRowCameraIds ?? []).length > 0 ? sensorId : void 0;
+	}
+	/**
 	* One INFO line when a MUTED camera's event is dropped, bounded to one per
 	* camera per window with the suppressed count folded into the next report —
 	* identical shape to `reportNoMatch`, because the question an operator asks
 	* is identical: "why did this camera not notify me?".
 	*/
-	reportMutedDrop(subject, kind, now) {
+	reportMutedDrop(subject, mutedDeviceId, kind, now) {
 		const bucket = noMatchReportKey({
-			deviceId: subject.deviceId,
+			deviceId: mutedDeviceId,
 			kind,
 			classNames: subject.classNames
 		});
@@ -30797,10 +31587,12 @@ var NotificationCenter = class NotificationCenter {
 		}
 		this.lastMutedReportAt.set(bucket, now);
 		this.mutedSuppressed.set(bucket, 0);
-		this.logger.info("notifications muted for this camera — event dropped before rule evaluation", {
-			tags: { deviceId: subject.deviceId },
+		const rowsMuted = subject.linkedSensorId !== void 0 && !this.deviceMutes.isMuted(subject.linkedSensorId);
+		this.logger.info(subject.linkedSensorId === void 0 ? "notifications muted for this camera — event dropped before rule evaluation" : rowsMuted ? "every camera that took its row is muted — sensor event dropped before rule evaluation" : "notifications muted for this sensor — event dropped before rule evaluation", {
+			tags: { deviceId: mutedDeviceId },
 			meta: {
 				kind,
+				...rowsMuted ? { mutedRowCameraIds: [...subject.mutedRowCameraIds ?? []] } : {},
 				classes: subject.classNames,
 				eventId: subject.recordId,
 				...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
@@ -30851,6 +31643,7 @@ var NotificationCenter = class NotificationCenter {
 		const confirm = frozenConfirmPolicy(rule, isSystemEvent);
 		const cropZoneIds = rule.conditions.zones !== void 0 ? rule.conditions.zones.ids : rule.conditions.occupancy?.zoneId !== void 0 ? [rule.conditions.occupancy.zoneId] : void 0;
 		const allTargets = [...rule.targets, ...userTargets.filter((t) => !direct.has(t.targetId))];
+		const linkedOwners = !noMedia && subject.linkedStills !== void 0 ? linkedMediaOwners(subject.linkedStills, linkedCameraMode(mediaRule.media)) : void 0;
 		return (upgrade !== void 0 ? allTargets.filter((t) => upgrade.targetIds.includes(t.targetId)) : allTargets).filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
 			const base = {
 				ruleName: rule.name,
@@ -30881,7 +31674,12 @@ var NotificationCenter = class NotificationCenter {
 				...target.params !== void 0 ? { params: target.params } : {},
 				subject: {
 					deviceId: subject.deviceId,
-					...alarmSource?.trackId !== void 0 ? { trackId: alarmSource.trackId } : subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
+					...alarmSource?.trackId !== void 0 ? { trackId: alarmSource.trackId } : linkedOwners !== void 0 ? {
+						trackId: linkedOwners.trackId,
+						...linkedOwners.extraStills.length > 0 ? { extraStills: linkedOwners.extraStills.map((x) => ({ ...x })) } : {},
+						analysisTiles: linkedOwners.analysisTiles.map((x) => ({ ...x }))
+					} : subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
+					...subject.linkedCameraIds !== void 0 && subject.linkedCameraIds.length > 1 && isLinkedSetSubject(subject) ? { linkedCameraIds: [...subject.linkedCameraIds] } : {},
 					...alarmSource?.eventId !== void 0 ? { eventId: alarmSource.eventId } : hasEventMedia ? { eventId: subject.recordId } : {},
 					className: subject.classNames[0] ?? subject.sensorKind ?? "event",
 					...subject.label !== void 0 ? { label: subject.label } : {},
@@ -72260,6 +73058,20 @@ function hasWrappedDetection(entries) {
 	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
 }
 //#endregion
+//#region src/pipeline-analytics/runtime/linked-snapshot-reads.ts
+function buildLinkedSnapshotReads(snapshot) {
+	return {
+		getSnapshotState: async (deviceId) => {
+			return { reason: (await snapshot.getDebugState.query({ deviceId })).state.reason };
+		},
+		getFrameCapturedAt: async (deviceIds) => {
+			if (deviceIds.length === 0) return /* @__PURE__ */ new Map();
+			const rows = await snapshot.getSnapshotOverview.query({ deviceIds: [...deviceIds] });
+			return new Map(rows.map((r) => [r.deviceId, r.lastCapturedAt]));
+		}
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/runtime/native-crop-dedupe.ts
 var NativeCropDedupe = class {
 	config;
@@ -73868,6 +74680,59 @@ async function resolveSensorEventCameras(cache, data) {
 	};
 }
 /**
+* The cameras a NOTIFICATION about this sensor shows — the emitting device
+* itself when it is a camera that may self-emit this cap, then every camera
+* that links it, opt-in or not (ADR 0632). The order is the mosaic's tile order
+* and names the PRIMARY camera (the first). Deliberately a sibling of
+* resolveSensorEventCameras rather than a flag on it: that one decides which
+* timeline rows exist and must keep honouring the opt-in.
+*
+* `[]` is NOT knowledge. It answers both "no camera links this sensor" and
+* "the camera index has not answered yet" (cold start, no camera list read —
+* this function does not consult `answered()`). A caller must read `[]` (and a
+* single camera) as "no mosaic this time, fall back to the plain path", never
+* as a durable "linked to nothing" that drops or deletes work (D49).
+*/
+async function resolveLinkedMediaCameras(cache, data) {
+	const linked = await cache.allCamerasFor(data.deviceId);
+	return [...await cache.isCamera(data.deviceId) && selfCameraMayEmit(data.capName) ? [data.deviceId] : [], ...linked.filter((id) => id !== data.deviceId)];
+}
+var NO_SENSOR_NOTIFICATION_CAMERAS = {
+	mediaCameraIds: [],
+	rowCameraIds: []
+};
+/**
+* Which cameras a notification about this change shows, known BEFORE the
+* ingest runs, so the capture can start at the trigger.
+*
+* Only a change the ingest EVALUATES has any: a mapped cap that takes rows
+* (`dropReason` null) or an unowned sensor (`no-camera`, D630 §6). A camera's
+* own `motion` no camera opted in (`camera-native-cap`) and a cold index
+* (`camera-index-unknown`) are drops today, and a camera merely LINKING the
+* device must not turn a drop into a notification. Asks the SAME resolution
+* the ingest asks (`resolveSensorEventCameras`), off the same cache.
+*/
+async function resolveSensorNotificationCameras(cache, data) {
+	if (require_dist.EVENT_KIND_BY_CAP[data.capName] === void 0) return NO_SENSOR_NOTIFICATION_CAMERAS;
+	const rows = await resolveSensorEventCameras(cache, data);
+	if (rows.dropReason !== null && rows.dropReason !== "no-camera") return NO_SENSOR_NOTIFICATION_CAMERAS;
+	return {
+		mediaCameraIds: await resolveLinkedMediaCameras(cache, data),
+		rowCameraIds: rows.cameraIds
+	};
+}
+/**
+* A sensor slice as a row's `value`: the object it is, or `null` for anything
+* else (absent, a primitive, an array) — one narrowing for every sensor event
+* built from a `DeviceStateChanged`.
+*/
+function sensorSliceRecord(slice) {
+	return isSliceRecord(slice) ? slice : null;
+}
+function isSliceRecord(slice) {
+	return typeof slice === "object" && slice !== null && !Array.isArray(slice);
+}
+/**
 * One `DeviceStateChanged` → N history rows, one per camera the event belongs
 * to: the emitting device's LINKED cameras, plus the emitting device ITSELF
 * when it is a camera carrying the sensor cap (a doorbell wrapper bound on
@@ -73883,8 +74748,7 @@ async function ingestSensorStateChange(deps, data, timestamp) {
 	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
 	if (descriptor === void 0) return 0;
 	const { cameraIds, dropReason, linkedCameraIds } = await resolveSensorEventCameras(deps.cache, data);
-	const slice = data.slice;
-	const value = slice !== null && slice !== void 0 && typeof slice === "object" && !Array.isArray(slice) ? slice : null;
+	const value = sensorSliceRecord(data.slice);
 	const makeId = deps.makeId ?? (() => `pa-sensor-${(0, node_crypto.randomUUID)()}`);
 	if (dropReason === "no-camera" && deps.onUnowned !== void 0) {
 		const ev = {
@@ -74863,8 +75727,14 @@ var MotionEventSnapshotCapturer = class {
 /**
 * Project one `DeviceStateChanged` of a mapped sensor/control cap into a
 * synthetic track per camera the event belongs to. Returns the number of
-* markers that landed. Best-effort (telemetry, D8) — a materializer that
-* throws propagates to the caller, which logs it.
+* markers that landed. Best-effort (telemetry, D8).
+*
+* Every camera is materialized CONCURRENTLY — the notification about this
+* event waits for the markers, so N cameras cost one snapshot bound, not N —
+* and reported afterwards in camera order. A materializer that throws for one
+* camera no longer propagates to the caller (where it was logged against the
+* SENSOR): it is reported as `not-materialized` on ITS camera, carrying the
+* rejection's message in `error`, and the other cameras still land.
 */
 async function projectSensorMarkers(deps, data, timestamp) {
 	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
@@ -74890,26 +75760,30 @@ async function projectSensorMarkers(deps, data, timestamp) {
 		return 0;
 	}
 	const producingDeviceName = await deps.producingDeviceName(data.deviceId);
+	const settled = await Promise.allSettled(cameraIds.map((cameraId) => deps.markers.materialize({
+		cameraId,
+		sourceDeviceId: data.deviceId,
+		source: "sensor",
+		kind: descriptor.kind,
+		timestamp,
+		snapshotTimeoutMs: deps.snapshotTimeoutMs ?? 2500,
+		...producingDeviceName !== void 0 ? { producingDeviceName } : {}
+	})));
 	let landed = 0;
-	for (const cameraId of cameraIds) {
-		const track = await deps.markers.materialize({
-			cameraId,
-			sourceDeviceId: data.deviceId,
-			source: "sensor",
-			kind: descriptor.kind,
-			timestamp,
-			snapshotTimeoutMs: deps.snapshotTimeoutMs ?? 2500,
-			...producingDeviceName !== void 0 ? { producingDeviceName } : {}
-		});
+	settled.forEach((outcome, i) => {
+		const cameraId = cameraIds[i];
+		if (cameraId === void 0) return;
+		const track = outcome.status === "fulfilled" ? outcome.value : null;
 		if (track === null) {
 			deps.onSkipped({
 				cameraId,
 				sourceDeviceId: data.deviceId,
 				capName: data.capName,
 				kind: descriptor.kind,
-				reason: "not-materialized"
+				reason: "not-materialized",
+				...outcome.status === "rejected" ? { error: require_dist.errMsg(outcome.reason) } : {}
 			});
-			continue;
+			return;
 		}
 		landed++;
 		deps.onProjected({
@@ -74921,7 +75795,7 @@ async function projectSensorMarkers(deps, data, timestamp) {
 			selfCamera: cameraId === data.deviceId,
 			hasMedia: track.snapshots.length > 0
 		});
-	}
+	});
 	return landed;
 }
 //#endregion
@@ -80070,6 +80944,14 @@ var RETRAIN_EXPORT_MAX = 2e4;
 * surface to turn the refinement pipeline on/off for a camera.
 */
 var TTL_SWEEP_INTERVAL_MS = 5e3;
+/**
+* How long shutdown waits for the sensor handlers already running. Just above
+* the marker's bounded snapshot fetch (`SENSOR_MARKER_SNAPSHOT_TIMEOUT_MS`,
+* 2.5 s), the one long await a handler makes, and BELOW the kernel's SIGKILL
+* fallback (process-service.ts: 3 s after SIGTERM on the stop-all path, 5 s on
+* the others) — a longer drain would be killed mid-way and log nothing.
+*/
+var SENSOR_HANDLER_DRAIN_MS = 2700;
 /** Throttle for the group-shot gate's window line (D470). */
 var GROUP_SHOT_METRIC_INTERVAL_MS = 3e4;
 /**
@@ -81140,6 +82022,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	getNativeKeyFrameRgb = null;
 	shuttingDown = false;
 	/**
+	* Sensor handlers the bus dispatched under `void` that have not finished.
+	* `onShutdown` DRAINS them before it tears anything down: a handler awaits a
+	* snapshot for its marker before its last context read, and one left running
+	* across the teardown threw "ctx accessed before initialize()" as an
+	* unhandled rejection with no device on it.
+	*/
+	sensorHandlersInFlight = /* @__PURE__ */ new Set();
+	/**
 	* Per-device delivery-lag windows, folded at `handleInferenceResult` entry.
 	* The instrument that tells a late DELIVERY (starved) apart from a slow
 	* `processFrame` (waiting) — see `frame-lag-observer.ts`. Costs one map read
@@ -81686,7 +82576,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			onMotionAnalysis: (deviceId, data, timestampMs) => this.handleMotionAnalysis(deviceId, data, timestampMs),
 			onOnboardMotion: (deviceId, data, timestampMs) => this.handleOnboardMotion(deviceId, data, timestampMs),
 			onBatterySample: (deviceId, percentage, at) => this.lts?.note("battery", deviceId, percentage, at),
-			onSensorStateChanged: (data, timestampMs) => this.handleSensorStateChanged(data, timestampMs),
+			onSensorStateChanged: (data, timestampMs) => this.dispatchSensorStateChanged(data, timestampMs),
 			onBindingsChanged: (data) => this.handleBindingsChangedEvent(data),
 			onDeviceUnregistered: (deviceId) => this.handleDeviceUnregisteredEvent(deviceId),
 			onClusterTopology: (nodes) => this.nodeLiveness.applySnapshot(nodes, Date.now()),
@@ -82376,10 +83266,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			snapshot: { getSnapshot: (i) => api.snapshot.getSnapshot.query(i) },
 			media: mediaStore,
 			tracks: trackStore,
-			onError: (scope, err) => logger.warn("synthetic track error", { meta: {
-				scope,
-				error: require_dist.errMsg(err)
-			} })
+			onError: (scope, err, deviceId) => logger.warn("synthetic track error", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					scope,
+					error: require_dist.errMsg(err)
+				}
+			})
 		});
 		this.syntheticTracks = syntheticTracks;
 		this.motionEventSnapshots = new MotionEventSnapshotCapturer({
@@ -82686,6 +83579,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			},
 			isDeviceDeleted: async (deviceId) => await api.deviceManager.getDevice.query({ deviceId }) === null,
 			getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }),
+			...buildLinkedSnapshotReads(api.snapshot),
 			identityIdsByName: async () => {
 				const byName = /* @__PURE__ */ new Map();
 				const identities = await stores.identityStore.listIdentities();
@@ -84221,7 +85115,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.alarmPanelConvergence = null;
 		for (const unsub of this.subscriptionUnsubs) unsub();
 		this.subscriptionUnsubs = [];
-		await this.motionEpisodes?.closeAll("addon-shutdown");
+		await Promise.all([this.drainSensorHandlers(), this.motionEpisodes?.closeAll("addon-shutdown")]);
 		await this.embeddingDispatcher?.stop();
 		this.embeddingDispatcher = null;
 		await this.notificationCenter?.stop();
@@ -88531,11 +89425,118 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		return this.queryFacade.getSensorEvents(input);
 	}
 	/**
+	* Start the linked set's capture (ADR 0632) with the UNFILTERED camera list:
+	* the centre applies the mute itself and says so per camera.
+	*/
+	startLinkedStills(data, timestamp, cameras) {
+		const sensorKind = require_dist.EVENT_KIND_BY_CAP[data.capName]?.kind;
+		if (sensorKind === void 0) return void 0;
+		try {
+			return this.notificationCenter?.beginLinkedStills({
+				sensorId: data.deviceId,
+				sensorKind,
+				cameraIds: cameras.mediaCameraIds,
+				rowCameraIds: cameras.rowCameraIds,
+				atMs: timestamp
+			});
+		} catch (err) {
+			this.ctx.logger.warn("linked-camera capture could not start — the notification ships without it", {
+				tags: { deviceId: data.deviceId },
+				meta: {
+					capName: data.capName,
+					cameraIds: [...cameras.mediaCameraIds],
+					error: require_dist.errMsg(err)
+				}
+			});
+			return;
+		}
+	}
+	/**
+	* The ONE sensor-level evaluation of a linked set (ADR 0632). Its record is
+	* the primary camera's row when that camera has one, else another camera's
+	* row, else a camera-attributed event that is NOT a timeline row (no linking
+	* camera opted the sensor in). The cameras that took a row travel as
+	* `rowCameraIds`: with the sensor, what a camera-scoped rule matches on
+	* (D630 §6).
+	*/
+	handOffLinkedSensorEvent(input) {
+		const { data, timestamp, persisted } = input;
+		const primary = input.mediaCameraIds[0];
+		if (primary === void 0) return;
+		const event = persisted.find((ev) => ev.deviceId === primary) ?? persisted[0] ?? {
+			id: `pa-sensor-${(0, node_crypto.randomUUID)()}`,
+			deviceId: primary,
+			sourceDeviceId: data.deviceId,
+			kind: require_dist.EVENT_KIND_BY_CAP[data.capName]?.kind ?? data.capName,
+			value: sensorSliceRecord(data.slice),
+			timestamp
+		};
+		const markerTrackId = input.markerByCamera.get(primary)?.trackId;
+		try {
+			this.notificationCenter?.onSensorEvent({
+				event: {
+					...event,
+					deviceId: primary
+				},
+				linkedCameraIds: input.mediaCameraIds,
+				rowCameraIds: persisted.map((ev) => ev.deviceId),
+				...markerTrackId !== void 0 ? { markerTrackId } : {},
+				...input.linkedStills !== void 0 ? { linkedStills: input.linkedStills } : {}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("sensor event hand-off to the notification centre failed", {
+				tags: { deviceId: data.deviceId },
+				meta: {
+					kind: event.kind,
+					linkedCameraIds: [...input.mediaCameraIds],
+					error: require_dist.errMsg(err)
+				}
+			});
+		}
+	}
+	/**
+	* The bus's door into {@link handleSensorStateChanged}: tracked, so shutdown
+	* can drain it, and caught, so a throw is a tagged line instead of an
+	* unhandled rejection. Refused once shutdown began.
+	*/
+	dispatchSensorStateChanged(data, timestampMs) {
+		if (this.shuttingDown) return Promise.resolve();
+		const run = this.handleSensorStateChanged(data, timestampMs).catch((err) => {
+			this.ctxIfReady?.logger.warn("sensor state change handler failed", {
+				tags: { deviceId: data.deviceId },
+				meta: {
+					capName: data.capName,
+					error: require_dist.errMsg(err)
+				}
+			});
+		});
+		this.sensorHandlersInFlight.add(run);
+		run.finally(() => this.sensorHandlersInFlight.delete(run));
+		return run;
+	}
+	/** Wait for the in-flight sensor handlers, bounded — see {@link sensorHandlersInFlight}. */
+	async drainSensorHandlers() {
+		const inFlight = [...this.sensorHandlersInFlight];
+		if (inFlight.length === 0) return;
+		let timer;
+		const bound = new Promise((resolve) => {
+			timer = setTimeout(() => resolve("bound"), SENSOR_HANDLER_DRAIN_MS);
+		});
+		const outcome = await Promise.race([Promise.all(inFlight).then(() => "drained"), bound]);
+		clearTimeout(timer);
+		if (outcome === "bound") this.ctx.logger.warn("shutdown: sensor handlers still running past the drain bound", { meta: {
+			inFlight: this.sensorHandlersInFlight.size,
+			boundMs: SENSOR_HANDLER_DRAIN_MS
+		} });
+	}
+	/**
 	* Sensor-event ingest handler — `DeviceStateChanged` of a device exposing a
 	* mapped sensor cap. Resolves the camera set through the TTL cache (the
 	* device's LINKED cameras, plus the device itself when it is a camera
 	* carrying the cap) and inserts ONE row per camera. Best-effort
-	* (telemetry-lossy).
+	* (telemetry-lossy). The NOTIFICATION is not per row when more than one
+	* camera links the sensor (ADR 0632): the linked cameras are photographed at
+	* the trigger and the change is evaluated ONCE, at the sensor level.
 	*
 	* D8/D11 boundary, stated plainly: the ride here is the LOSSY
 	* `DeviceStateChanged` bus, and there is no reconcile that replays a missed
@@ -88556,6 +89557,18 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const cache = this.linkedCamerasCache;
 		if (store === null || cache === null) return;
 		if (!this.sensorSliceCarriedATransition(data)) return;
+		const cameras = await resolveSensorNotificationCameras(cache, data).catch((err) => {
+			this.ctx.logger.debug("linked-camera resolution failed — evaluated per row", {
+				tags: { deviceId: data.deviceId },
+				meta: {
+					capName: data.capName,
+					error: require_dist.errMsg(err)
+				}
+			});
+			return NO_SENSOR_NOTIFICATION_CAMERAS;
+		});
+		const linkedSet = cameras.mediaCameraIds.length > 1;
+		const linkedStills = linkedSet ? this.startLinkedStills(data, timestamp, cameras) : void 0;
 		const persisted = [];
 		const unowned = [];
 		try {
@@ -88600,18 +89613,33 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 						}
 					});
 				},
-				onSkipped: (r) => this.ctx.logger.debug("synthetic sensor-track NOT projected", {
-					tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
-					meta: {
-						capName: r.capName,
-						kind: r.kind,
-						reason: r.reason,
-						sourceDeviceId: r.sourceDeviceId
+				onSkipped: (r) => {
+					if (r.error !== void 0) {
+						this.ctx.logger.warn("synthetic sensor-track materialize rejected", {
+							tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
+							meta: {
+								capName: r.capName,
+								kind: r.kind,
+								reason: r.reason,
+								sourceDeviceId: r.sourceDeviceId,
+								error: r.error
+							}
+						});
+						return;
 					}
-				})
+					this.ctx.logger.debug("synthetic sensor-track NOT projected", {
+						tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
+						meta: {
+							capName: r.capName,
+							kind: r.kind,
+							reason: r.reason,
+							sourceDeviceId: r.sourceDeviceId
+						}
+					});
+				}
 			}, data, timestamp);
 		} catch (err) {
-			this.ctx.logger.warn("synthetic sensor-track materialize failed", {
+			this.ctx.logger.warn("synthetic sensor-track camera resolution / producing-device name read failed", {
 				tags: { deviceId: data.deviceId },
 				meta: {
 					capName: data.capName,
@@ -88619,6 +89647,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				}
 			});
 		}
+		if (linkedSet) {
+			this.handOffLinkedSensorEvent({
+				data,
+				timestamp,
+				mediaCameraIds: cameras.mediaCameraIds,
+				persisted,
+				markerByCamera,
+				...linkedStills !== void 0 ? { linkedStills } : {}
+			});
+			return;
+		}
 		for (const ev of persisted) try {
 			this.notificationCenter?.onSensorEventPersisted(ev, markerByCamera.get(ev.deviceId)?.trackId);
 		} catch (err) {