@camstack/addon-post-analysis 1.2.293 → 1.2.295

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as NcRuleSchema, $n as EventCategory, $t as isSourceCap, A as LabelAttributionSchema, An as DeviceType, At as audioMetricsCapability, B as NC_DEFAULT_SNOOZE_MINUTES, Bt as embeddingRefusalOf, C as EMBEDDING_REQUIREMENTS_FAILED, Cn as systemEventFilterApplies, Ct as TimelapseRuleInputSchema, D as FIRST_LEVEL_MACRO_CLASSES, Dn as vectorDimFromBase64, Dt as addonWidgetsSourceCapability, E as EVENT_OWNER_TYPES, En as templateVarsFor, Et as TrackSourceSchema, F as MOTION_CLOSE_AFTER_MS, Fn as customAction, Ft as deriveRecordingMode, G as NC_TAXONOMY, Gn as discriminatedUnion, Gt as evictionPolicyOfLocation, Hn as _enum, I as MediaFileKindEnum, In as defineCustomActions, It as describeSystemEventDeliveryProblem, J as NcAlarmSettingsPatchSchema, Jn as object, Jt as isDetectionMacroClass, K as NC_TEMPLATE_VARS, Kn as literal, Kt as faceGalleryCapability, L as NC_ALARM_SYSTEM_EVENT_KINDS, Ln as hydrateSchema, Lt as describeSystemEventFamilyProblem, M as MAX_ARCHIVED_DEBUG_NOTES, Mn as BaseAddon, Mt as buildEventKindDescriptor, N as MAX_BIRTH_DECISION_RECORDS, Nn as CamProfileSchema, Nt as consumableLowPercentOf, O as FULL_IMAGE_BBOX, On as zoneAnalyticsCapability, Ot as alarmPanelCapability, Pn as createEvent, Pt as cosineSimilarity$1, Q as NcRulePatchSchema, Qn as unknown, Qt as isScheduleActive, R as NC_CONDITION_CATALOG, Rn as isDeviceScopedCap, S as EMBEDDING_MODEL_FAILED, Sn as systemEventFamilyProblems, St as TIMELAPSE_DENSE_FLOOR_SEC, T as EVENT_KIND_BY_CAP, Tn as templateCarriesSummary, Tt as TimelapseRuleSchema, U as NC_SYSTEM_EVENT_KIND_GROUP_SPECS, Un as array, Ut as encodeVectorBase64, V as NC_SENSOR_TRANSITION_KINDS, Vn as sleep$1, W as NC_TANK_SYSTEM_EVENT_KINDS, Wn as boolean, Wt as evaluateSensorEdge, X as NcConditionsSchema, Xn as record, Xt as isKnownTemplateVar, Y as NcConditionDescriptorSchema, Yn as partialRecord, Yt as isEventOwnerType, Z as NcRuleInputSchema, Zn as string, Zt as isMediaOwnerType, _n as sensorRaisedOf, a as CLIP_EMBEDDING_STEP_ID, an as notificationRulesCapability, at as NcSnoozeSuppressedSchema, bn as subKindsOf, bt as SCENE_DIVERGED, c as resolveClusterModelPin, cn as pipelineAnalyticsCapability, ct as NcTemplatePreviewInputSchema, d as ArchivedDebugNoteSchema, dn as readTimelapseGeneratedAt, dt as OpsLogEntrySchema, en as isSystemDelivery, et as NcRuleTargetSchema, f as BaseDevice, fn as resolveClipSearchMinScore, g as DEFAULT_EVENT_COLOR, gn as sceneMonitorCapability, gt as RetrainStatusSchema, h as CoverStateSchema, hn as ruleBelongsToAlarm$1, ht as RebuildObjectEmbeddingsRefusalSchema, in as mayWriteToLocation, it as NcSnoozeSchema, j as LockStateSchema, jn as errMsg$1, jt as audioModeOf, k as FailureCounters, kn as canonicalHash, kt as assertTimelapseCadences, l as AUDIO_MACRO_LABELS, ln as plateGalleryCapability, lt as NcTemplatePreviewSchema, m as COCO_TO_MACRO, mt as RECORDING_SOURCE_CAMSTACK_ADDON, nn as isVectorIndexDimConflict, nt as NcScheduleSchema, o as FACE_EMBEDDING_STEP_ID, on as occupancyScope, ot as NcSystemEventKindSchema, p as BirthDecisionRecordSchema, pn as resolveLocationMode, pt as RECORDING_EXPORT_MAX_READ_BYTES, q as NcAlarmConfigSchema, qn as number, qt as failureContributionCapability, rn as kebabToCamel, rt as NcSnoozeInputSchema, s as readClusterModelPinStrict, st as NcTaxonomySchema, t as BUILTIN_CLIP_MODELS, tn as isSystemEventSummaryRule, tt as NcRuleUpdateInputSchema, u as AlarmArmModeSchema, un as readDeviceStateFrom, ut as NcTemplateVarDescriptorSchema, vn as servedTemplateVars, vt as SCENE_DEFAULT_ANCHOR_THRESHOLD, w as EMBEDDING_REQUIREMENTS_UNAVAILABLE, wn as systemEventSummaryScheduleOf, wt as TimelapseRulePatchSchema, x as DeclaredDevices, xn as systemEventDeliveryProblems, xt as SceneMonitorSchema, y as DETECTION_MACRO_CLASSES, yn as storageOccupancyCapability, yt as SCENE_DEFAULT_UNCOVERED_POLICY, z as NC_CONSUMABLE_SYSTEM_EVENT_KINDS, zn as nodePin } from "../clip-model-registry-D2zqXamW.mjs";
+import { $ as NcRuleTargetSchema, $n as EventCategory, $t as isVectorIndexDimConflict, A as LockStateSchema, An as DeviceType, At as audioModeOf, B as NC_SENSOR_TRANSITION_KINDS, C as EMBEDDING_REQUIREMENTS_UNAVAILABLE, Cn as templateVarsFor, Ct as TimelapseRulePatchSchema, D as FULL_IMAGE_BBOX, Dn as canonicalHash, Dt as alarmPanelCapability, E as FIRST_LEVEL_MACRO_CLASSES, Et as addonWidgetsSourceCapability, F as MediaFileKindEnum, Fn as customAction, Ft as describeSystemEventDeliveryProblem, G as NC_TEMPLATE_VARS, Gn as discriminatedUnion, Gt as failureContributionCapability, H as NC_SYSTEM_EVENT_KIND_GROUP_SPECS, Hn as _enum, Ht as encodeVectorBase64, I as NC_ALARM_SYSTEM_EVENT_KINDS, In as defineCustomActions, It as describeSystemEventFamilyProblem, J as NcConditionDescriptorSchema, Jn as object, Jt as isKnownTemplateVar, K as NcAlarmConfigSchema, Kn as literal, Kt as isDetectionMacroClass, L as NC_CONDITION_CATALOG, Ln as hydrateSchema, M as MAX_BIRTH_DECISION_RECORDS, Mn as BaseAddon, Mt as consumableLowPercentOf, Nn as CamProfileSchema, Nt as cosineSimilarity$1, O as FailureCounters, On as evaluateSensorEdge, Ot as assertTimelapseCadences, P as MOTION_CLOSE_AFTER_MS, Pn as createEvent, Pt as deriveRecordingMode, Q as NcRuleSchema, Qn as unknown, Qt as isSystemEventSummaryRule, R as NC_CONSUMABLE_SYSTEM_EVENT_KINDS, Rn as isDeviceScopedCap, S as EMBEDDING_REQUIREMENTS_FAILED, Sn as templateCarriesSummary, St as TimelapseRuleInputSchema, T as EVENT_OWNER_TYPES, Tn as zoneAnalyticsCapability, Tt as TrackSourceSchema, U as NC_TANK_SYSTEM_EVENT_KINDS, Un as array, Ut as evictionPolicyOfLocation, Vn as sleep$1, W as NC_TAXONOMY, Wn as boolean, Wt as faceGalleryCapability, X as NcRuleInputSchema, Xn as record, Xt as isScheduleActive, Y as NcConditionsSchema, Yn as partialRecord, Yt as isMediaOwnerType, Z as NcRulePatchSchema, Zn as string, Zt as isSystemDelivery, _n as subKindsOf, _t as SCENE_DEFAULT_ANCHOR_THRESHOLD, a as CLIP_EMBEDDING_STEP_ID, an as pipelineAnalyticsCapability, at as NcSystemEventKindSchema, b as DeclaredDevices, bn as systemEventFilterApplies, bt as SceneMonitorSchema, c as resolveClusterModelPin, cn as readTimelapseGeneratedAt, ct as NcTemplatePreviewSchema, d as ArchivedDebugNoteSchema, en as kebabToCamel, et as NcRuleUpdateInputSchema, f as BaseDevice, fn as ruleBelongsToAlarm$1, ft as RECORDING_EXPORT_MAX_READ_BYTES, g as DEFAULT_EVENT_COLOR, gn as storageOccupancyCapability, h as CoverStateSchema, hn as servedTemplateVars, ht as RetrainStatusSchema, it as NcSnoozeSuppressedSchema, j as MAX_ARCHIVED_DEBUG_NOTES, jn as errMsg$1, jt as buildEventKindDescriptor, k as LabelAttributionSchema, kn as isSourceCap, kt as audioMetricsCapability, l as AUDIO_MACRO_LABELS, ln as resolveClipSearchMinScore, lt as NcTemplateVarDescriptorSchema, m as COCO_TO_MACRO, mn as sensorRaisedOf, mt as RebuildObjectEmbeddingsRefusalSchema, nn as notificationRulesCapability, nt as NcSnoozeInputSchema, o as FACE_EMBEDDING_STEP_ID, on as plateGalleryCapability, ot as NcTaxonomySchema, p as BirthDecisionRecordSchema, pn as sceneMonitorCapability, pt as RECORDING_SOURCE_CAMSTACK_ADDON, q as NcAlarmSettingsPatchSchema, qn as number, qt as isEventOwnerType, rn as occupancyScope, rt as NcSnoozeSchema, s as readClusterModelPinStrict, sn as readDeviceStateFrom, st as NcTemplatePreviewInputSchema, t as BUILTIN_CLIP_MODELS, tn as mayWriteToLocation, tt as NcScheduleSchema, u as AlarmArmModeSchema, un as resolveLocationMode, ut as OpsLogEntrySchema, v as DETECTION_MACRO_CLASSES, vn as systemEventDeliveryProblems, vt as SCENE_DEFAULT_UNCOVERED_POLICY, w as EVENT_KIND_BY_CAP, wn as vectorDimFromBase64, wt as TimelapseRuleSchema, x as EMBEDDING_MODEL_FAILED, xn as systemEventSummaryScheduleOf, xt as TIMELAPSE_DENSE_FLOOR_SEC, yn as systemEventFamilyProblems, yt as SCENE_DIVERGED, z as NC_DEFAULT_SNOOZE_MINUTES, zn as nodePin, zt as embeddingRefusalOf } from "../clip-model-registry-BrHhUIfN.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -67511,15 +67511,17 @@ function resolveMediaSettings(raw) {
 * `recording` became a device collection on 2026-09-24 (D625): a camera may
 * have several sources of recorded coverage and every read names one. Every
 * read in this addon wants the same one — the footage OUR recorder wrote,
-* because everything downstream of it (a recorded clip cut, a timelapse, the
-* earliest-footage floor of a retention sweep) is about bytes we hold and can
-* export. A camera's own SD card is not an answer to any of those questions.
+* because everything downstream of it (a recorded clip cut, a timelapse) is
+* about bytes we hold and can export. The retention sweep's earliest-footage
+* floor is NOT asked here any more: it is one number the archive's ledger
+* already folds, and asking it as coverage from the epoch walked every hour
+* since 1970 (D674, `retention/archive-footage-floor.ts`). A camera's own SD card is not an answer to any of those questions.
 *
 * It also owns the `read: 'unreadable'` rule, in one place: a read that FAILED
 * throws here rather than arriving downstream as an empty range list. Every
 * caller of this module treats "no ranges" as "recording is off for this
-* camera" and acts on it — dropping the attachment, skipping the render,
-* lowering the sweep floor — so folding a failed read into that shape would
+* camera" and acts on it — dropping the attachment, skipping the render —
+* so folding a failed read into that shape would
 * make an unreachable recorder look exactly like a camera nobody records
 * (D393). The callers already handle a throw and log it as a read failure.
 */
@@ -67538,6 +67540,248 @@ async function ourRecordingAvailability(api, input) {
 		profilesWithFootage: answer.profilesWithFootage
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/retention-policy.ts
+/**
+* Analytics retention policy — **ONE window per device** (D62).
+*
+* A device has one retention window, and everything scoped to that device is
+* deleted on it: the track (which cascades to its object events, their child
+* crops, its media, its unassigned face/plate rows and crops, and its CLIP
+* vector) AND the trackless roots (motion, audio, sensor events). The only
+* thing outside it is the ops log, which is global and longer than any device
+* window because it records what retention did — including for devices that no
+* longer exist.
+*
+* Two modes:
+*
+*  - `follow-recordings` (the DEFAULT): the window is the instant of the oldest
+*    segment still on disk. That follows the recorder's age retention AND its
+*    disk-pressure eviction automatically, with no second policy to keep in
+*    sync. A camera with no footage at all (recording off / brand new) falls
+*    back to `trackRetentionDays`, so analytics stay bounded either way.
+*
+*  - `custom`: `trackRetentionDays`, and nothing else. `0` = keep forever, and
+*    that is the ONE way retention is off for a device.
+*
+* ## Why there is only one number here
+*
+* There used to be four: `trackRetentionDays` plus a day window per event
+* family (motion / object / audio). [D61](../../../../docs/decisions/adr-0061.md)
+* made object events, faces, plates, crops and vectors TRACK-OWNED — they leave
+* through the cascade and by no other path — which silently disconnected
+* `retentionObjectDays` from the thing it was named after. An operator could set
+* object retention to 30 days, the form would save it, and the events would die
+* with their track at 7. A knob that decides nothing is worse than a missing
+* one: it reads as a decision that was made.
+*
+* So the per-family windows are gone (D62), not merely ignored, and the
+* surviving surface is ENUMERATED in {@link RETENTION_SETTING_KEYS} so
+* `scripts/check-retention-settings-consumed.ts` can fail the build the next
+* time a knob and its reader come apart.
+*
+* Follow-mode floor: nothing younger than {@link FOLLOW_FLOOR_DAYS} is ever
+* pruned, even when footage is younger (a camera that STARTED recording
+* yesterday must not nuke its whole history back to the first segment).
+*/
+var DAY_MS$1 = 1440 * 60 * 1e3;
+/**
+* Per-device analytics retention settings as stored in the device blob.
+* `retentionMode` absent = follow-recordings (the default).
+*/
+var RetentionSettingsSchema = object({
+	retentionMode: _enum(["follow-recordings", "custom"]).default("follow-recordings"),
+	trackRetentionDays: number().min(0).default(7)
+});
+/** The default retention window, in days. The form's default reads from here so
+*  the schema is the single source. */
+var TRACK_RETENTION_DEFAULT_DAYS = RetentionSettingsSchema.parse({}).trackRetentionDays;
+/** Resolve the settings from a raw device-store blob — invalid or missing
+*  fields fall back to defaults, never throw. */
+function resolveRetentionSettings(raw) {
+	const parsed = RetentionSettingsSchema.safeParse(raw);
+	if (parsed.success) return parsed.data;
+	const shape = RetentionSettingsSchema.shape;
+	const defaults = RetentionSettingsSchema.parse({});
+	const mode = shape.retentionMode.safeParse(raw["retentionMode"]);
+	const days = shape.trackRetentionDays.safeParse(raw["trackRetentionDays"]);
+	return {
+		retentionMode: mode.success ? mode.data : defaults.retentionMode,
+		trackRetentionDays: days.success ? days.data : defaults.trackRetentionDays
+	};
+}
+/**
+* Follow-mode cutoff: the oldest retained footage instant, floored so anything
+* younger than {@link FOLLOW_FLOOR_DAYS} survives. `null` footage (none on
+* disk) → `null`, and the caller falls back to the custom window.
+*/
+function followCutoffMs(nowMs, earliestFootageMs) {
+	if (earliestFootageMs === null) return null;
+	return Math.min(earliestFootageMs, nowMs - 7 * DAY_MS$1);
+}
+/** Compute the effective cutoff for one device at `nowMs`. */
+function resolveRetentionCutoffs(settings, nowMs, earliestFootageMs) {
+	if (settings.retentionMode === "follow-recordings") {
+		const cutoff = followCutoffMs(nowMs, earliestFootageMs);
+		if (cutoff !== null) return {
+			cutoffMs: cutoff,
+			effectiveMode: "follow-recordings"
+		};
+	}
+	return {
+		cutoffMs: settings.trackRetentionDays <= 0 ? null : nowMs - settings.trackRetentionDays * DAY_MS$1,
+		effectiveMode: "custom"
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/retention/archive-footage-floor.ts
+/**
+* How long one archive answer serves every camera. The ledger's floor moves
+* only when retention deletes an hour (minutes-to-days granularity), and the
+* sweep it feeds runs every 5 min — the same 10 min the walk was cached for.
+*/
+var FOOTAGE_FLOOR_TTL_MS = 10 * 6e4;
+/**
+* How long a FAILED read is reused before it is asked again. Short, so the
+* first sweep after the recorder answers is a real one; long enough that one
+* pass over ~24 cameras is one failed call, not twenty-four.
+*/
+var FOOTAGE_FLOOR_RETRY_MS = 6e4;
+/** What a follow-recordings camera gets when its floor could not be read:
+*  retention OFF for this pass — nothing is deleted on a guess. */
+var UNREADABLE_FLOOR_CUTOFFS = {
+	cutoffMs: null,
+	effectiveMode: "follow-recordings",
+	floorUnreadable: true
+};
+var NO_FOOTAGE = {
+	kind: "read",
+	oldestMs: null
+};
+/**
+* Turn one `getStorageUsage` answer into per-camera floors — or say why it
+* cannot be.
+*
+*  - `devicesRead !== 'archive'`: the rows are UNKNOWN (`unavailable`: no
+*    ledger, a ledger not loaded yet, no location resolved) or come from a
+*    recorder predating D418, whose rows are RESIDENCY. No floor may be read.
+*  - `complete !== true`: the ledger load was cut at its row cap, or the
+*    recorder predates the field. A camera ABSENT from such an answer may hold
+*    footage, and a PRESENT row's `oldestMs` is the oldest of a fraction (the
+*    load keeps the newest hours) — too young, i.e. a delete. So the whole
+*    answer is unreadable, not only the absent cameras.
+*  - A row whose `oldestMs` is ABSENT comes from a recorder predating the
+*    field — unknown for that camera, never "no footage".
+*  - A camera with no row in a COMPLETE answer, or a row whose `oldestMs` is
+*    `null`: the archive holds no footage for it — the custom window applies.
+*/
+function footageFloorsOf(usage) {
+	if (usage.devicesRead !== "archive") return `recordingArchive.getStorageUsage answered devicesRead=${usage.devicesRead ?? "absent"} — the per-camera rows are not the archive`;
+	if (usage.complete !== true) return `recordingArchive.getStorageUsage answered complete=${String(usage.complete ?? "absent")} — the per-camera rows may be a fraction of the archive`;
+	const floors = /* @__PURE__ */ new Map();
+	for (const row of usage.devices) floors.set(row.deviceId, row.oldestMs === void 0 ? {
+		kind: "unreadable",
+		reason: "the recorder omitted oldestMs for this camera"
+	} : {
+		kind: "read",
+		oldestMs: row.oldestMs
+	});
+	return floors;
+}
+/**
+* Per-camera floors, one archive call per {@link FOOTAGE_FLOOR_TTL_MS} for the
+* whole fleet, single-flight.
+*/
+var ArchiveFootageFloors = class {
+	deps;
+	answer = null;
+	inFlight = null;
+	/** Cameras whose sweep is currently skipped — one line per episode, not per
+	*  pass: two sweeps × every camera × every 5 min would be a flood. */
+	skipped = /* @__PURE__ */ new Set();
+	/** Is the archive currently unreadable? The read-failure line is said once
+	*  per EPISODE (and its end once), not once per ~sweep per runner. */
+	readFailing = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	nowMs() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	async floorOf(deviceId) {
+		const answer = await this.current();
+		if ("unreadable" in answer) return {
+			kind: "unreadable",
+			reason: answer.unreadable
+		};
+		return answer.floors.get(deviceId) ?? NO_FOOTAGE;
+	}
+	/**
+	* The per-device effective cutoffs (mode + footage → numbers). A follow
+	* camera whose floor is unreadable is NOT swept this pass, and that is logged.
+	*/
+	async cutoffsFor(deviceId, settings, nowMs) {
+		if (settings.retentionMode !== "follow-recordings") return resolveRetentionCutoffs(settings, nowMs, null);
+		const floor = await this.floorOf(deviceId);
+		if (floor.kind === "unreadable") {
+			if (!this.skipped.has(deviceId)) {
+				this.skipped.add(deviceId);
+				this.deps.logger.warn("retention: follow-recordings floor unreadable — this camera is not swept until the archive answers", {
+					tags: { deviceId },
+					meta: { reason: floor.reason }
+				});
+			}
+			return UNREADABLE_FLOOR_CUTOFFS;
+		}
+		if (this.skipped.delete(deviceId)) this.deps.logger.info("retention: follow-recordings floor readable again — sweeping", {
+			tags: { deviceId },
+			meta: { oldestMs: floor.oldestMs }
+		});
+		return resolveRetentionCutoffs(settings, nowMs, floor.oldestMs);
+	}
+	async current() {
+		const held = this.answer;
+		const now = this.nowMs();
+		if (held !== null) {
+			const ttl = "unreadable" in held ? FOOTAGE_FLOOR_RETRY_MS : FOOTAGE_FLOOR_TTL_MS;
+			if (now - held.atMs < ttl) return held;
+		}
+		this.inFlight ??= this.read().finally(() => {
+			this.inFlight = null;
+		});
+		return this.inFlight;
+	}
+	async read() {
+		let answer;
+		try {
+			const floors = footageFloorsOf(await this.deps.api.recordingArchive.getStorageUsage.query({}));
+			answer = typeof floors === "string" ? {
+				atMs: this.nowMs(),
+				unreadable: floors
+			} : {
+				atMs: this.nowMs(),
+				floors
+			};
+		} catch (err) {
+			answer = {
+				atMs: this.nowMs(),
+				unreadable: `recordingArchive.getStorageUsage failed: ${err instanceof Error ? err.message : String(err)}`
+			};
+		}
+		if ("unreadable" in answer && !this.readFailing) {
+			this.readFailing = true;
+			this.deps.logger.warn("retention: the archive floor could not be read — follow-recordings cameras are not swept on a guess", { meta: {
+				reason: answer.unreadable,
+				retryMs: FOOTAGE_FLOOR_RETRY_MS
+			} });
+		} else if (!("unreadable" in answer) && this.readFailing) {
+			this.readFailing = false;
+			this.deps.logger.info("retention: the archive floor is readable again", { meta: { cameras: answer.floors.size } });
+		}
+		this.answer = answer;
+		return answer;
+	}
+};
 function toDetectionBbox(bbox) {
 	return {
 		x: bbox.x,
@@ -78966,7 +79210,7 @@ async function sweepTracklessRoots(deps) {
 			const cutoffs = await deps.resolveCutoffs(deviceId, deps.nowMs);
 			const cutoffMs = cutoffs.cutoffMs;
 			if (cutoffMs === null) {
-				deps.onRetentionDisabled(deviceId);
+				if (cutoffs.floorUnreadable !== true) deps.onRetentionDisabled(deviceId);
 				continue;
 			}
 			const events = await deps.evictTracklessEvents({
@@ -78988,99 +79232,6 @@ async function sweepTracklessRoots(deps) {
 	}
 }
 //#endregion
-//#region src/pipeline-analytics/retention-policy.ts
-/**
-* Analytics retention policy — **ONE window per device** (D62).
-*
-* A device has one retention window, and everything scoped to that device is
-* deleted on it: the track (which cascades to its object events, their child
-* crops, its media, its unassigned face/plate rows and crops, and its CLIP
-* vector) AND the trackless roots (motion, audio, sensor events). The only
-* thing outside it is the ops log, which is global and longer than any device
-* window because it records what retention did — including for devices that no
-* longer exist.
-*
-* Two modes:
-*
-*  - `follow-recordings` (the DEFAULT): the window is the instant of the oldest
-*    segment still on disk. That follows the recorder's age retention AND its
-*    disk-pressure eviction automatically, with no second policy to keep in
-*    sync. A camera with no footage at all (recording off / brand new) falls
-*    back to `trackRetentionDays`, so analytics stay bounded either way.
-*
-*  - `custom`: `trackRetentionDays`, and nothing else. `0` = keep forever, and
-*    that is the ONE way retention is off for a device.
-*
-* ## Why there is only one number here
-*
-* There used to be four: `trackRetentionDays` plus a day window per event
-* family (motion / object / audio). [D61](../../../../docs/decisions/adr-0061.md)
-* made object events, faces, plates, crops and vectors TRACK-OWNED — they leave
-* through the cascade and by no other path — which silently disconnected
-* `retentionObjectDays` from the thing it was named after. An operator could set
-* object retention to 30 days, the form would save it, and the events would die
-* with their track at 7. A knob that decides nothing is worse than a missing
-* one: it reads as a decision that was made.
-*
-* So the per-family windows are gone (D62), not merely ignored, and the
-* surviving surface is ENUMERATED in {@link RETENTION_SETTING_KEYS} so
-* `scripts/check-retention-settings-consumed.ts` can fail the build the next
-* time a knob and its reader come apart.
-*
-* Follow-mode floor: nothing younger than {@link FOLLOW_FLOOR_DAYS} is ever
-* pruned, even when footage is younger (a camera that STARTED recording
-* yesterday must not nuke its whole history back to the first segment).
-*/
-var DAY_MS$1 = 1440 * 60 * 1e3;
-/**
-* Per-device analytics retention settings as stored in the device blob.
-* `retentionMode` absent = follow-recordings (the default).
-*/
-var RetentionSettingsSchema = object({
-	retentionMode: _enum(["follow-recordings", "custom"]).default("follow-recordings"),
-	trackRetentionDays: number().min(0).default(7)
-});
-/** The default retention window, in days. The form's default reads from here so
-*  the schema is the single source. */
-var TRACK_RETENTION_DEFAULT_DAYS = RetentionSettingsSchema.parse({}).trackRetentionDays;
-/** Resolve the settings from a raw device-store blob — invalid or missing
-*  fields fall back to defaults, never throw. */
-function resolveRetentionSettings(raw) {
-	const parsed = RetentionSettingsSchema.safeParse(raw);
-	if (parsed.success) return parsed.data;
-	const shape = RetentionSettingsSchema.shape;
-	const defaults = RetentionSettingsSchema.parse({});
-	const mode = shape.retentionMode.safeParse(raw["retentionMode"]);
-	const days = shape.trackRetentionDays.safeParse(raw["trackRetentionDays"]);
-	return {
-		retentionMode: mode.success ? mode.data : defaults.retentionMode,
-		trackRetentionDays: days.success ? days.data : defaults.trackRetentionDays
-	};
-}
-/**
-* Follow-mode cutoff: the oldest retained footage instant, floored so anything
-* younger than {@link FOLLOW_FLOOR_DAYS} survives. `null` footage (none on
-* disk) → `null`, and the caller falls back to the custom window.
-*/
-function followCutoffMs(nowMs, earliestFootageMs) {
-	if (earliestFootageMs === null) return null;
-	return Math.min(earliestFootageMs, nowMs - 7 * DAY_MS$1);
-}
-/** Compute the effective cutoff for one device at `nowMs`. */
-function resolveRetentionCutoffs(settings, nowMs, earliestFootageMs) {
-	if (settings.retentionMode === "follow-recordings") {
-		const cutoff = followCutoffMs(nowMs, earliestFootageMs);
-		if (cutoff !== null) return {
-			cutoffMs: cutoff,
-			effectiveMode: "follow-recordings"
-		};
-	}
-	return {
-		cutoffMs: settings.trackRetentionDays <= 0 ? null : nowMs - settings.trackRetentionDays * DAY_MS$1,
-		effectiveMode: "custom"
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/runtime/binding-cache.ts
 var BindingCache = class {
 	api;
@@ -82466,7 +82617,7 @@ async function projectSensorMarkers(deps, data, timestamp) {
 		return 0;
 	}
 	const producingDeviceName = await deps.producingDeviceName(data.deviceId);
-	const settled = await Promise.allSettled(cameraIds.map((cameraId) => deps.markers.materialize({
+	const settled = await Promise.allSettled(cameraIds.map((cameraId) => deps.markers.materializeOrShare({
 		cameraId,
 		sourceDeviceId: data.deviceId,
 		source: "sensor",
@@ -82479,8 +82630,8 @@ async function projectSensorMarkers(deps, data, timestamp) {
 	settled.forEach((outcome, i) => {
 		const cameraId = cameraIds[i];
 		if (cameraId === void 0) return;
-		const track = outcome.status === "fulfilled" ? outcome.value : null;
-		if (track === null) {
+		const result = outcome.status === "fulfilled" ? outcome.value : null;
+		if (result === null || result.kind === "not-materialized") {
 			deps.onSkipped({
 				cameraId,
 				sourceDeviceId: data.deviceId,
@@ -82497,9 +82648,10 @@ async function projectSensorMarkers(deps, data, timestamp) {
 			sourceDeviceId: data.deviceId,
 			capName: data.capName,
 			kind: descriptor.kind,
-			trackId: track.trackId,
+			trackId: result.track.trackId,
 			selfCamera: cameraId === data.deviceId,
-			hasMedia: track.snapshots.length > 0
+			hasMedia: result.track.snapshots.length > 0,
+			via: result.kind
 		});
 	});
 	return landed;
@@ -82818,7 +82970,8 @@ var DEFAULT_DEBOUNCE_MS = 1e4;
 /**
 * What the debounce treats as "the same event happening again".
 *
-* `(camera, kind)` — plus, for an audio row, the class HEARD. Since D189 every
+* `(camera, kind)` — plus, for an audio row, the class HEARD, and for a sensor
+* row, the SENSOR. Since D189 every
 * audio row carries `kind: 'audio'` and puts the class on `audioLabels`, so
 * keying on `kind` alone would collapse this to one bucket per camera. The
 * episode hysteresis cools down PER CLASS, so a bark three seconds after speech
@@ -82830,7 +82983,8 @@ var DEFAULT_DEBOUNCE_MS = 1e4;
 */
 function debounceKey(input) {
 	const heard = input.audioLabels?.[0]?.label;
-	return heard === void 0 ? `${input.cameraId}:${input.kind}` : `${input.cameraId}:${input.kind}:${heard}`;
+	if (heard !== void 0) return `${input.cameraId}:${input.kind}:${heard}`;
+	return input.source === "sensor" ? `${input.cameraId}:${input.kind}:${input.sourceDeviceId}` : `${input.cameraId}:${input.kind}`;
 }
 /** A hanging snapshot cap must not stall the sensor state-change path. */
 var DEFAULT_SNAPSHOT_TIMEOUT_MS = 1e4;
@@ -82874,8 +83028,8 @@ var SyntheticTrackMaterializer = class {
 	snapshotTimeoutMs;
 	makeId;
 	now;
-	/** Last snapshot time per {@link debounceKey}. */
-	lastAt = /* @__PURE__ */ new Map();
+	/** The open window per {@link debounceKey}: its start and the marker it lands. */
+	windows = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 		this.debounceMs = deps.debounceMs ?? DEFAULT_DEBOUNCE_MS;
@@ -82907,16 +83061,50 @@ var SyntheticTrackMaterializer = class {
 			return null;
 		}
 	}
+	/** The window `input` falls in, or null when it opens a new one. */
+	openWindow(input) {
+		const window = this.windows.get(debounceKey(input));
+		return window !== void 0 && this.now() - window.at < this.debounceMs ? window : null;
+	}
+	startWindow(input) {
+		const landing = this.land(input);
+		this.windows.set(debounceKey(input), {
+			at: this.now(),
+			landing
+		});
+		return landing;
+	}
 	/**
 	* Materialize a synthetic track for a non-spatial event on `cameraId`.
 	* Returns the persisted track, or null when debounced. Snapshot failure
 	* still lands a track (with no media) — it never blocks the durable record.
+	*
+	* The AUDIO contract: a debounced call is a second episode that must not
+	* adopt the first one's row, so it answers null. A SENSOR projection wants
+	* the window's marker instead — {@link materializeOrShare}.
 	*/
 	async materialize(input) {
-		const key = debounceKey(input);
-		const last = this.lastAt.get(key);
-		if (last !== void 0 && this.now() - last < this.debounceMs) return null;
-		this.lastAt.set(key, this.now());
+		if (this.openWindow(input) !== null) return null;
+		return this.startWindow(input);
+	}
+	/**
+	* Like {@link materialize}, but a call inside an open window answers the
+	* window's OWN marker (awaiting it while it is still landing) with kind
+	* `debounced`. Two state changes of one doorbell press are one event: the
+	* second must name the same media owner, not none (2026-09-29, camera 615 —
+	* the notification that won the rule was the debounced one, and shipped
+	* without a still).
+	*/
+	async materializeOrShare(input) {
+		const window = this.openWindow(input);
+		const track = await (window === null ? this.startWindow(input) : window.landing);
+		if (track === null) return { kind: "not-materialized" };
+		return {
+			kind: window === null ? "materialized" : "debounced",
+			track
+		};
+	}
+	async land(input) {
 		const trackId = this.makeId();
 		const ts = input.timestamp;
 		let mediaId = null;
@@ -95334,37 +95522,26 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		await this.trackCloser.sweep();
 		await this.summarySealer?.sweep();
 	}
-	/** Unified retention (Phase 1): earliest retained footage per device — the
-	*  follow-recordings cutoff source. Cached 10 min: availability answers in
-	*  ~70 ms but the sweep asks once per device per pass. `null` = no footage
-	*  (or recorder unreachable) → the policy falls back to the custom windows. */
-	earliestFootageCache = /* @__PURE__ */ new Map();
-	async earliestFootageMs(deviceId) {
-		const cached = this.earliestFootageCache.get(deviceId);
-		if (cached && Date.now() - cached.at < 10 * 6e4) return cached.value;
-		let value = null;
-		try {
-			const res = await ourRecordingAvailability(this.ctx.api, {
-				deviceId,
-				fromMs: 0,
-				toMs: Date.now()
-			});
-			let min = Number.POSITIVE_INFINITY;
-			for (const r of res.ranges) if (r.startMs < min) min = r.startMs;
-			value = Number.isFinite(min) ? min : null;
-		} catch {
-			value = null;
-		}
-		this.earliestFootageCache.set(deviceId, {
-			at: Date.now(),
-			value
+	/**
+	* The follow-recordings floor per camera, read from the ARCHIVE's hour ledger
+	* (`recordingArchive.getStorageUsage`, one call for every camera) — never an
+	* availability walk from the epoch, which cost the recorder 2.2 GB and an OOM
+	* (D674). LAZY: `ctx` is not assigned when field initialisers run.
+	*/
+	footageFloorsInstance = null;
+	get footageFloors() {
+		this.footageFloorsInstance ??= new ArchiveFootageFloors({
+			api: this.ctx.api,
+			logger: this.ctx.logger
 		});
-		return value;
+		return this.footageFloorsInstance;
 	}
-	/** The per-device effective cutoffs (mode + footage → numbers). */
+	/** The per-device effective cutoffs (mode + footage → numbers). A
+	*  follow-recordings camera whose floor could not be read gets NO cutoff this
+	*  pass (logged in `ArchiveFootageFloors`), never the custom window. */
 	async deviceRetentionCutoffs(deviceId, nowMs) {
-		const settings = resolveRetentionSettings(await this.readDeviceBlob(deviceId));
-		return resolveRetentionCutoffs(settings, nowMs, settings.retentionMode === "follow-recordings" ? await this.earliestFootageMs(deviceId) : null);
+		const raw = await this.readDeviceBlob(deviceId);
+		return this.footageFloors.cutoffsFor(deviceId, resolveRetentionSettings(raw), nowMs);
 	}
 	/**
 	* The devices one retention pass covers — see `retention/retention-scope.ts`
@@ -96822,6 +96999,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 							capName: r.capName,
 							kind: r.kind,
 							trackId: r.trackId,
+							reason: r.via,
 							sourceDeviceId: r.sourceDeviceId,
 							selfCamera: r.selfCamera,
 							hasMedia: r.hasMedia
@@ -96842,6 +97020,18 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						});
 						return;
 					}
+					if (r.cameraId !== null && r.reason === "not-materialized") {
+						this.ctx.logger.warn("synthetic sensor-track NOT materialized", {
+							tags: { deviceId: r.cameraId },
+							meta: {
+								capName: r.capName,
+								kind: r.kind,
+								reason: r.reason,
+								sourceDeviceId: r.sourceDeviceId
+							}
+						});
+						return;
+					}
 					this.ctx.logger.debug("synthetic sensor-track NOT projected", {
 						tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
 						meta: {

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DW6-zerK.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-B28yTZRG.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.293",
+  "version": "1.2.295",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",
@@ -132,6 +132,7 @@
     "build:widgets": "vite build --config vite.widgets.pipeline-analytics.config.ts",
     "dev": "vite build --watch",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "publish:npm": "npm publish --access public"
   },
   "peerDependencies": {