@camstack/addon-post-analysis 1.2.301 → 1.2.303

package/dist/pipeline-analytics/index.mjs

@@ -19644,6 +19644,101 @@ function footageSourceFor(input) {
 	return ageSec + preRollSec > ringRetentionSec ? "recordings" : "ring";
 }
 //#endregion
+//#region src/notification-center/recorded-cut-memo.ts
+/** How long the recorder is treated as busy after a cut timed out. */
+var NC_RECORDER_BUSY_MS = 6e4;
+/**
+* How long a cut is reused. The outbox retries at 5 s, 10 s, 20 s … so ten
+* minutes covers every retry that could still be about the same notification.
+*/
+var NC_RECORDED_CUT_MEMO_TTL_MS = 10 * 6e4;
+/** At most this many cuts are held (each is a ~10 s clip, a few hundred KB). */
+var NC_RECORDED_CUT_MEMO_MAX = 16;
+/**
+* Grace a joining row adds to the cut's own deadline: the recorder checks its
+* deadline between 1 s polls, so its `timed-out` lands up to ~1 s after it.
+*/
+var NC_RECORDED_CUT_JOIN_GRACE_MS = 2e3;
+/** The window a request describes — rows that agree on it share a cut. */
+function recordedCutKey(req) {
+	return [
+		req.deviceId,
+		req.recordId,
+		req.aroundMs,
+		req.preRollSec,
+		req.postRollSec,
+		req.speed ?? 1
+	].join(":");
+}
+var NcRecordedCutMemo = class {
+	cuts = /* @__PURE__ */ new Map();
+	busyUntil = 0;
+	/** When the busy window closes (0 when it never opened). */
+	busyUntilMs() {
+		return this.busyUntil;
+	}
+	/** Is the recorder inside its busy window? */
+	isBusy(now) {
+		return now < this.busyUntil;
+	}
+	/** A cut timed out: open the breaker. Returns when it closes. */
+	noteTimedOut(now) {
+		this.busyUntil = Math.max(this.busyUntil, now + NC_RECORDER_BUSY_MS);
+		return this.busyUntil;
+	}
+	/** The memoised cut for this window, if one is held. */
+	find(key, now) {
+		this.evictAged(now);
+		return this.cuts.get(key) ?? null;
+	}
+	/** Start (and hold) the cut for this window. */
+	start(key, now, deadlineMs, run) {
+		this.evict(now);
+		const cut = run().then((result) => result.ok ? {
+			kind: "cut",
+			mp4: result.mp4,
+			profile: result.profile
+		} : {
+			kind: "refused",
+			result
+		}, (err) => ({
+			kind: "threw",
+			error: String(err)
+		}));
+		const shared = {
+			key,
+			createdAt: now,
+			deadlineMs,
+			cut,
+			gif: null,
+			settled: false
+		};
+		cut.then(() => {
+			shared.settled = true;
+		});
+		this.cuts.set(key, shared);
+		return shared;
+	}
+	/** How many cuts are held — diagnostics and tests. */
+	size() {
+		return this.cuts.size;
+	}
+	/** Drop cuts past their TTL. Called on every use AND from the notification
+	*  centre's periodic drain tick, so bytes do not outlive the last row. */
+	evictAged(now) {
+		for (const [key, c] of this.cuts) if (now - c.createdAt > NC_RECORDED_CUT_MEMO_TTL_MS) this.cuts.delete(key);
+	}
+	/** Make room for one more: aged entries first, then the oldest. */
+	evict(now) {
+		this.evictAged(now);
+		while (this.cuts.size >= NC_RECORDED_CUT_MEMO_MAX) {
+			const oldest = this.cuts.keys().next();
+			if (oldest.done === true) break;
+			this.cuts.delete(oldest.value);
+		}
+	}
+};
+//#endregion
 //#region src/notification-center/media-anchor.ts
 /**
 * Decide the footage anchor for one subject. Pure, total, and the ONLY place
@@ -19793,6 +19888,20 @@ function composeRuleAiBody(input) {
 	if (input.templateNamesAi) return input.body;
 	return input.body.length === 0 ? input.aiText : `${input.body}\n${input.aiText}`;
 }
+/**
+* `work`, or `onTimeout` once `ms` has passed — whichever is first. `work` must
+* never reject. The hard edge of the recorded-footage wait: the recorder's own
+* `deadlineMs` is checked between polls, and an RPC in flight is not.
+*/
+function settleWithin(work, ms, onTimeout) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(() => resolve(onTimeout), ms);
+		work.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		});
+	});
+}
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
 /**
 * How long the broker retains the footage window a notification is cut from,
@@ -19811,6 +19920,27 @@ var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
 */
 var NC_CLIP_RING_RETENTION_SEC = 20;
 /**
+* How long a notification whose moment the ring has lost waits for its
+* RECORDED cut (and the gif derived from it) before it ships without (D686).
+*
+* The notification is HELD for this: a notifier is one-shot, so the footage
+* rides the single message or does not ride at all. Measured on the
+* 2026-09-30 pick-up on 615: export 1 s, derive 262 ms — so the bound is
+* almost never reached, and when it is the render is queued behind something
+* that holds the recorder's one ffmpeg lane for minutes (a timelapse), which
+* no wait worth holding a notification for would outlast.
+*
+* Why not longer: the outbox drains rows ONE AT A TIME, so this is also the
+* worst case by which every row queued behind this one is delayed. A ring cut
+* of a live moment already blocks the drain for its post-roll (6 s) plus the
+* render; 30 s is the ceiling on top of that, reached only when the recorder
+* is wedged. Why not shorter: a moment that reaches this path is already
+* older than the ring (≥ 20 s, a pick-up ≥ 5 min), so a few more seconds cost
+* the operator nothing, and a bound under ~10 s would drop the gif whenever
+* the recorder is merely busy.
+*/
+var NC_RECORDED_FOOTAGE_WAIT_MS = 3e4;
+/**
 * The bounded wait for a still when the rule asked for NO footage.
 *
 * Track media lands 1.5–5.5 s after the trigger (device 615, 2026-08-12), so a
@@ -19888,9 +20018,8 @@ var NcDispatcher = class {
 	*  {@link NC_ANNOTATED_FALLBACK_MEMO_MAX}. */
 	reportedAnnotatedFallbacks = /* @__PURE__ */ new Set();
 	texts;
-	/** Recorded-clip follow-ups still running, detached from their delivery.
-	*  Held only so {@link settleRecordedFootage} can await them in a test. */
-	recordedFootage = /* @__PURE__ */ new Set();
+	/** One recorded cut per moment, and the recorder-busy breaker (D686). */
+	recordedCuts = new NcRecordedCutMemo();
 	constructor(deps) {
 		this.deps = deps;
 		this.now = deps.now ?? (() => Date.now());
@@ -19898,6 +20027,18 @@ var NcDispatcher = class {
 		this.targetCacheTtlMs = deps.targetCacheTtlMs ?? DEFAULT_TARGET_CACHE_TTL_MS;
 		this.texts = deps.texts ?? new NcTextCatalog();
 	}
+	/**
+	* Drop held recorded cuts past their TTL (re-review R4). Driven by the
+	* notification centre's drain tick, so a clip's bytes do not stay resident
+	* after the last row that could use them.
+	*/
+	sweepRecordedCuts(now) {
+		this.recordedCuts.evictAged(now);
+	}
+	/** How many recorded cuts are held — diagnostics and tests. */
+	recordedCutsHeld() {
+		return this.recordedCuts.size();
+	}
 	/** The outbox `deliver` executor. */
 	async deliver(entry) {
 		if (this.deps.isRuleTargetDisabled !== void 0) {
@@ -20020,7 +20161,6 @@ var NcDispatcher = class {
 					...dropped.length > 0 ? { dropped } : {}
 				}
 			});
-			this.startRecordedFootage(entry, target, notification);
 			return {
 				ok: true,
 				...verdict !== null ? { confirm: verdict } : {},
@@ -20565,7 +20705,7 @@ var NcDispatcher = class {
 			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
 			...params,
 			...tapUrl !== null ? { clickUrl: tapUrl } : {},
-			tag: entry.payload.group?.key ?? entry.ruleId,
+			...entry.payload.group !== void 0 ? { tag: entry.payload.group.key } : {},
 			...systemEvent !== void 0 ? systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {} : { deviceId: subject.deviceId },
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
 			...systemEvent !== void 0 ? { metadata: {
@@ -20837,13 +20977,10 @@ var NcDispatcher = class {
 					preRollSec,
 					retentionSec: this.ringRetentionSec(entry.payload.subject.deviceId),
 					wanted: [...wantGif ? ["gif"] : [], ...wantMp4 ? ["video"] : []],
-					next: this.recordedFollowUp(entry).kinds.length > 0 ? "recorded-clip-follow-up" : "no-clip"
+					next: this.recordedFootagePlan(entry).kinds.length > 0 ? "recorded-cut" : "no-clip"
 				}
 			});
-			return {
-				attempted: false,
-				attachments: []
-			};
+			return this.cutRecordedFootage(entry, anchor, preRollSec);
 		}
 		const attachments = [];
 		try {
@@ -20878,176 +21015,238 @@ var NcDispatcher = class {
 		};
 	}
 	/**
-	* Order the RECORDED cut for a moment the ring could not serve — after the
-	* alert has already gone out.
-	*
-	* ## Why it is here and not in `renderFootage`
+	* Cut the footage from the RECORDINGS, for a moment the ring could not
+	* serve, and hand it to the ONE notification this row sends (D686).
 	*
-	* Cutting from the recordings queues an ffmpeg render on the recording node,
-	* behind whatever that engine is already doing (renders are serialised one at
-	* a time, and a scheduled timelapse holds the lane for minutes). Awaiting it
-	* inside the media resolve would move the alarm's latency from "as long as
-	* the post-roll" to "as long as the recorder's queue" — trading a punctual
-	* alert for a complete one, which is precisely the wrong trade for the
-	* notification that tells an operator someone is at the door.
+	* ## Why the notification waits for it
 	*
-	* A GIF rule is served here too (D682): a package pick-up is concluded five
-	* minutes after it happened, so a gif anchored on the pick-up is always
-	* outside the ring. The gif is derived from THIS cut's bytes
-	* (`deriveGifFromClip`) — one cut, never a second renderer — and a moment the
-	* recordings cannot serve ships NO gif, by named reason, rather than a gif of
-	* the wrong time.
+	* A notifier is one-shot. The earlier design (D682) sent the alert first and
+	* the recorded footage as a SECOND send with the same `tag`, on the promise
+	* that "a phone collapses the two" — Zentik honours no tag, so every such
+	* row reached the operator as two messages (615, 2026-09-30). A moment that
+	* reaches this path is already older than the ring (a pick-up is concluded
+	* minutes after it happened), so waiting a few more seconds costs nothing;
+	* a second message costs the operator a duplicate every time.
 	*
-	* So the alert's latency is UNCHANGED, and **the clip is attached later**, as
-	* a follow-up send to the same target carrying the same `tag` — a phone
-	* collapses the two, so what the operator sees is the notification gaining
-	* its video rather than a second alert. That is an explicit behaviour change
-	* and not a silent one: the log says `recorded-clip-follow-up` on the refusal
-	* line, and says so again when the follow-up lands.
+	* The wait is bounded by {@link NC_RECORDED_FOOTAGE_WAIT_MS} and the bound is
+	* handed to the recorder as `deadlineMs`, so a render nobody waits for any
+	* more is abandoned, not left running. A cut that fails, throws or is not
+	* ready in time costs the footage and never the notification — it ships
+	* with the still, and the reason is logged per camera.
 	*
-	* ## The choice is the same one, asked once more
+	* A GIF rule is served here too (D682): the gif is derived from THIS cut's
+	* bytes (`deriveGifFromClip`) — one cut, never a second renderer — and a
+	* moment the recordings cannot serve ships NO gif, by named reason, rather
+	* than a gif of the wrong time.
 	*
-	* `footageSourceFor` is the ONE rule, and both callers ask it rather than one
-	* of them remembering the other's answer. It is monotone in the clock, so the
-	* later ask here can only ever agree with, or become stricter than, the one
-	* `renderFootage` made — it can never decide "the ring" for a window the ring
-	* has already dropped. A second spelling of the arithmetic is what would be
-	* unsafe; a second CALL is not.
-	*
-	* Never throws, never rejects: this runs detached from a delivery that has
-	* already succeeded, and an unhandled rejection here would be a crash charged
-	* to a notification that arrived perfectly.
+	* `footageSourceFor` already said `recordings` for this row: the caller asks
+	* it once, and this runs only on that answer.
 	*/
-	startRecordedFootage(entry, target, notification) {
+	async cutRecordedFootage(entry, anchor, preRollSec) {
+		const plan = this.recordedFootagePlan(entry);
+		this.reportRecordedRefusals(entry, plan, anchor);
 		const cut = this.deps.cutRecordedClip;
-		const plan = this.recordedFollowUp(entry);
-		const wanted = plan.kinds;
-		if (cut === void 0 || wanted.length === 0 && plan.gifRefused === void 0 && plan.videoRefused === void 0) return;
-		const preRollSec = entry.payload.mediaClipPreRollSec ?? NC_CLIP_PRE_ROLL_DEFAULT_SEC;
-		const anchor = mediaAnchor(entry.payload.subject);
-		if (footageSourceFor({
-			anchorMs: anchor.atMs,
-			nowMs: this.now(),
+		if (cut === void 0 || plan.kinds.length === 0) return {
+			attempted: false,
+			attachments: []
+		};
+		const startedAt = this.now();
+		const videoSpeed = entry.payload.mediaClipSpeed;
+		const window = {
+			deviceId: entry.payload.subject.deviceId,
+			aroundMs: anchor.atMs,
 			preRollSec,
-			ringRetentionSec: this.ringRetentionSec(entry.payload.subject.deviceId)
-		}) !== "recordings") return;
-		const deviceId = entry.payload.subject.deviceId;
-		if (plan.gifRefused !== void 0) this.deps.logger.info("recorded gif follow-up: none — the gif is not cut from the recordings", {
-			tags: { deviceId },
-			meta: {
+			postRollSec: entry.payload.mediaClipPostRollSec ?? NC_CLIP_POST_ROLL_DEFAULT_SEC,
+			...videoSpeed !== void 0 ? { speed: videoSpeed } : {},
+			recordId: entry.recordId
+		};
+		const key = recordedCutKey(window);
+		let shared = this.recordedCuts.find(key, startedAt);
+		let boundMs = NC_RECORDED_FOOTAGE_WAIT_MS;
+		if (shared !== null && !shared.settled) {
+			if (this.recordedCuts.isBusy(startedAt)) {
+				const outcome = {
+					kind: "recorder-busy",
+					busyUntil: this.recordedCuts.busyUntilMs()
+				};
+				this.reportRecordedOutcome(entry, plan.kinds, anchor, outcome, startedAt);
+				return {
+					attempted: false,
+					attachments: []
+				};
+			}
+			boundMs = Math.min(NC_RECORDED_FOOTAGE_WAIT_MS, shared.deadlineMs + NC_RECORDED_CUT_JOIN_GRACE_MS - startedAt);
+			if (boundMs <= 0) {
+				this.reportRecordedOutcome(entry, plan.kinds, anchor, { kind: "timed-out" }, startedAt);
+				return {
+					attempted: false,
+					attachments: []
+				};
+			}
+		}
+		if (shared === null) {
+			if (this.recordedCuts.isBusy(startedAt)) {
+				const outcome = {
+					kind: "recorder-busy",
+					busyUntil: this.recordedCuts.busyUntilMs()
+				};
+				this.reportRecordedOutcome(entry, plan.kinds, anchor, outcome, startedAt);
+				return {
+					attempted: false,
+					attachments: []
+				};
+			}
+			const deadlineMs = startedAt + NC_RECORDED_FOOTAGE_WAIT_MS;
+			shared = this.recordedCuts.start(key, startedAt, deadlineMs, () => cut({
+				...window,
 				ruleId: entry.ruleId,
-				eventId: entry.recordId,
-				targetId: target.id,
-				reason: plan.gifRefused,
-				anchoredOn: anchor.source,
-				...anchor.fallback !== void 0 ? { anchorFallback: anchor.fallback } : {},
-				next: wanted
+				deadlineMs
+			}));
+		}
+		const outcome = await settleWithin(this.attachRecordedCut(entry, plan.kinds, shared), boundMs, { kind: "timed-out" });
+		if (outcome.kind === "timed-out") this.recordedCuts.noteTimedOut(this.now());
+		this.reportRecordedOutcome(entry, plan.kinds, anchor, outcome, startedAt);
+		return {
+			attempted: true,
+			attachments: outcome.kind === "attached" ? outcome.attachments : []
+		};
+	}
+	/** The shared cut, then this row's containers of it — never rejects. */
+	async attachRecordedCut(entry, wanted, shared) {
+		const result = await shared.cut;
+		if (result.kind === "threw") return {
+			kind: "threw",
+			error: result.error
+		};
+		if (result.kind === "refused") return {
+			kind: "cut-refused",
+			reason: result.result.reason
+		};
+		try {
+			const attachments = await this.recordedAttachments(entry, wanted, result.mp4, shared);
+			if (attachments.length === 0) return { kind: "no-gif" };
+			return {
+				kind: "attached",
+				attachments,
+				profile: result.profile,
+				bytes: result.mp4.byteLength
+			};
+		} catch (err) {
+			return {
+				kind: "threw",
+				error: String(err)
+			};
+		}
+	}
+	/**
+	* Why a kind the rule asked for is not cut from the recordings — said per
+	* camera, because "where is my gif" is always asked about a camera.
+	* `no-derive` included: a wiring seam, but a silent one is a dropped gif.
+	*/
+	reportRecordedRefusals(entry, plan, anchor) {
+		const common = {
+			ruleId: entry.ruleId,
+			eventId: entry.recordId,
+			targetId: entry.targetId,
+			anchoredOn: anchor.source,
+			...anchor.fallback !== void 0 ? { anchorFallback: anchor.fallback } : {},
+			next: plan.kinds
+		};
+		const tags = { deviceId: entry.payload.subject.deviceId };
+		if (plan.gifRefused !== void 0) this.deps.logger.info("recorded gif: none — the gif is not cut from the recordings", {
+			tags,
+			meta: {
+				...common,
+				reason: plan.gifRefused
 			}
 		});
-		if (plan.videoRefused !== void 0) this.deps.logger.info("recorded video follow-up: none — the video is not cut from the recordings", {
-			tags: { deviceId },
+		if (plan.videoRefused !== void 0) this.deps.logger.info("recorded video: none — the video is not cut from the recordings", {
+			tags,
 			meta: {
-				ruleId: entry.ruleId,
-				eventId: entry.recordId,
-				targetId: target.id,
-				reason: plan.videoRefused,
-				anchoredOn: anchor.source,
-				...anchor.fallback !== void 0 ? { anchorFallback: anchor.fallback } : {},
-				next: wanted
+				...common,
+				reason: plan.videoRefused
 			}
 		});
-		if (wanted.length === 0) return;
-		const videoSpeed = entry.payload.mediaClipSpeed;
-		const pending = (async () => {
-			const result = await cut({
-				deviceId,
-				aroundMs: anchor.atMs,
-				preRollSec,
-				postRollSec: entry.payload.mediaClipPostRollSec ?? NC_CLIP_POST_ROLL_DEFAULT_SEC,
-				...videoSpeed !== void 0 ? { speed: videoSpeed } : {},
-				ruleId: entry.ruleId,
-				recordId: entry.recordId
-			});
-			if (!result.ok) {
-				this.deps.logger.info("recorded footage follow-up: none — the recorded cut failed", {
-					tags: { deviceId },
+	}
+	/** One line per recorded cut, whatever became of it, tagged per camera. The
+	*  ring line said `next: recorded-cut`; this is where that story ends. */
+	reportRecordedOutcome(entry, wanted, anchor, outcome, startedAt) {
+		const tags = { deviceId: entry.payload.subject.deviceId };
+		const common = {
+			ruleId: entry.ruleId,
+			eventId: entry.recordId,
+			targetId: entry.targetId,
+			wanted,
+			anchoredOn: anchor.source
+		};
+		switch (outcome.kind) {
+			case "attached":
+				this.deps.logger.info("recorded footage attached", {
+					tags,
 					meta: {
-						ruleId: entry.ruleId,
-						eventId: entry.recordId,
-						targetId: target.id,
-						reason: result.reason,
-						wanted
+						...common,
+						profile: outcome.profile,
+						bytes: outcome.bytes,
+						attachments: outcome.attachments.map((a) => a.mediaType),
+						waitedMs: this.now() - startedAt
 					}
 				});
 				return;
-			}
-			const attachments = await this.recordedAttachments(entry, wanted, result.mp4);
-			if (attachments.length === 0) {
-				this.deps.logger.info("recorded clip follow-up: none — the gif could not be derived", {
-					tags: { deviceId },
+			case "cut-refused":
+				this.deps.logger.info("recorded footage: none — the recorded cut failed", {
+					tags,
 					meta: {
-						ruleId: entry.ruleId,
-						eventId: entry.recordId,
-						targetId: target.id,
-						reason: "gif-derive-failed",
-						wanted
+						...common,
+						reason: outcome.reason
 					}
 				});
 				return;
-			}
-			const withUrls = await this.withArtifactUrls(entry, attachments);
-			const sent = await this.deps.send({
-				addonId: target.addonId,
-				targetId: target.id,
-				notification: {
-					...notification,
-					attachments: withUrls.attachments
-				}
-			});
-			if (!sent.success) {
-				this.deps.logger.warn("recorded clip follow-up: the send failed", {
-					tags: { deviceId },
+			case "no-gif":
+				this.deps.logger.info("recorded footage: none — the gif could not be derived", {
+					tags,
 					meta: {
-						ruleId: entry.ruleId,
-						eventId: entry.recordId,
-						targetId: target.id,
-						error: sent.error ?? "send failed"
+						...common,
+						reason: "gif-derive-failed"
 					}
 				});
 				return;
-			}
-			this.deps.logger.info("recorded clip follow-up delivered", {
-				tags: { deviceId },
-				meta: {
-					ruleId: entry.ruleId,
-					eventId: entry.recordId,
-					target: target.name,
-					profile: result.profile,
-					bytes: result.mp4.byteLength,
-					attachments: attachments.map((a) => a.mediaType),
-					anchoredOn: anchor.source,
-					lagMs: this.now() - entry.updatedAt
-				}
-			});
-		})().catch((err) => {
-			this.deps.logger.warn("recorded clip follow-up threw", {
-				tags: { deviceId },
-				meta: {
-					ruleId: entry.ruleId,
-					eventId: entry.recordId,
-					error: String(err)
-				}
-			});
-		});
-		this.recordedFootage.add(pending);
-		pending.finally(() => {
-			this.recordedFootage.delete(pending);
-		});
+			case "threw":
+				this.deps.logger.warn("recorded footage: none — the recorded cut threw", {
+					tags,
+					meta: {
+						...common,
+						reason: "threw",
+						error: outcome.error
+					}
+				});
+				return;
+			case "timed-out":
+				this.deps.logger.warn("recorded footage: none — not ready inside the bound", {
+					tags,
+					meta: {
+						...common,
+						reason: "timed-out",
+						boundMs: NC_RECORDED_FOOTAGE_WAIT_MS,
+						busyForMs: NC_RECORDER_BUSY_MS
+					}
+				});
+				return;
+			case "recorder-busy":
+				this.deps.logger.info("recorded footage: none — the recorder is busy", {
+					tags,
+					meta: {
+						...common,
+						reason: "recorder-busy",
+						busyUntil: outcome.busyUntil
+					}
+				});
+				return;
+		}
 	}
 	/**
-	* What a recorded follow-up for this row would CARRY — the one answer both
-	* the refusal line (`next`) and the follow-up read, so the log cannot promise
-	* a follow-up the dispatcher will not send.
+	* What the recorded cut for this row would CARRY — the one answer both the
+	* ring line (`next`) and the cut read, so the log cannot promise a cut the
+	* dispatcher will not order.
 	*
 	* A video when the rule asked for one. A gif only for a package PICK-UP
 	* whose moment is KNOWN (D682): the gif is derived from the recorded cut's
@@ -21061,7 +21260,7 @@ var NcDispatcher = class {
 	* gif OR video — cutting the recordings there is exactly the doormat D682
 	* removed (see {@link NcRecordedGifRefusal}, {@link NcRecordedVideoRefusal}).
 	*/
-	recordedFollowUp(entry) {
+	recordedFootagePlan(entry) {
 		if (this.deps.cutRecordedClip === void 0) return { kinds: [] };
 		const gifRefused = this.recordedGifRefusal(entry);
 		const videoRefused = this.recordedVideoRefusal(entry);
@@ -21092,48 +21291,39 @@ var NcDispatcher = class {
 		if (anchorFellBack(mediaAnchor(subject), true)) return "moment-unknown";
 	}
 	/**
-	* The follow-up's attachments, gif first and video second — the order the
-	* ring path ships them in. A gif that could not be derived is left out (its
-	* reason already logged); the video, when asked for, still ships.
+	* The recorded attachments, gif first and video second — the order the ring
+	* path ships them in. A gif that could not be derived is left out (its
+	* reason already logged); the video, when asked for, still ships. A derive
+	* is not started once the bound has passed: nobody would wait for it.
 	*/
-	async recordedAttachments(entry, wanted, mp4) {
+	async recordedAttachments(entry, wanted, mp4, shared) {
 		const out = [];
 		const derive = this.deps.deriveGifFromClip;
 		if (wanted.includes("gif") && derive !== void 0) {
-			const gif = await derive({
+			if (shared.gif === null && this.now() < shared.deadlineMs) shared.gif = derive({
 				deviceId: entry.payload.subject.deviceId,
 				mp4,
 				...entry.payload.mediaClipSpeed !== void 0 ? { videoSpeed: entry.payload.mediaClipSpeed } : {},
 				ruleId: entry.ruleId,
 				recordId: entry.recordId
 			});
-			if (gif.ok) out.push({
+			const gif = shared.gif === null ? null : await shared.gif;
+			if (gif !== null && gif.ok) out.push({
 				mediaType: "gif",
-				bytes: gif.gif,
+				bytes: copyBytes(gif.gif),
 				mime: "image/gif",
 				name: "event.gif"
 			});
 		}
 		if (wanted.includes("video")) out.push({
 			mediaType: "video",
-			bytes: mp4,
+			bytes: copyBytes(mp4),
 			mime: "video/mp4",
 			name: "event.mp4"
 		});
 		return out;
 	}
 	/**
-	* Settle every recorded-clip follow-up this dispatcher has in flight.
-	*
-	* A TEST SEAM, and the honest kind: the follow-up is detached by design, so
-	* without this a test can only assert the absence of something that has not
-	* happened yet. Production never calls it — the outbox's `deliver` is done
-	* when the alert is out, which is the whole point.
-	*/
-	async settleRecordedFootage() {
-		while (this.recordedFootage.size > 0) await Promise.all([...this.recordedFootage]);
-	}
-	/**
 	* Poll the still ladder for {@link NC_STILL_WAIT_MS}, then give up.
 	*
 	* Runs for EVERY rule now, footage or not, and concurrently with the render:
@@ -35574,6 +35764,7 @@ var NotificationCenter = class NotificationCenter {
 	async drainTick() {
 		await this.snoozes.load();
 		this.sweepGroups(this.now());
+		this.dispatcher.sweepRecordedCuts(this.now());
 		await this.outbox.drainOnce();
 		await this.deliverDueDigests();
 		this.drainTicks += 1;
@@ -39666,6 +39857,13 @@ var TapeRecordSchema = discriminatedUnion("kind", [
 		h: number(),
 		rootModelId: string().optional(),
 		shed: literal(true).optional(),
+		/**
+		* The `package-detection` step RAN on this frame (`FrameResult.
+		* packageLooked`, D687) — what makes an empty doormat on a tape an absence
+		* rather than silence. Absent when it did not run. Added under v1: optional,
+		* and a tape written before it simply never attests a look.
+		*/
+		pl: literal(true).optional(),
 		dets: array(TapeDetectionSchema),
 		disc: array(TapeDiscardSchema),
 		inj: array(string()),
@@ -52584,6 +52782,7 @@ function buildFrameRecord(input) {
 		h: input.frame.height,
 		...input.frame.rootModelId !== void 0 ? { rootModelId: input.frame.rootModelId } : {},
 		...input.frame.shed === true ? { shed: true } : {},
+		...input.frame.packageLooked === true ? { pl: true } : {},
 		dets,
 		disc: tapeDiscards(input.frame.discarded),
 		inj,
@@ -64264,15 +64463,6 @@ var EventMediaService = class {
 /** How often the render is polled while it runs. */
 var NC_RECORDED_CLIP_POLL_MS = 1e3;
 /**
-* Hard bound on one notification clip render.
-*
-* Far below the timelapse renderer's 30 min, and deliberately: this is a
-* ten-second window, and a render that has not finished in two minutes is
-* queued behind something else entirely (renders are serialised one ffmpeg at
-* a time). Waiting longer would hold a follow-up nobody is still waiting for.
-*/
-var NC_RECORDED_CLIP_TIMEOUT_MS = 12e4;
-/**
 * How long the recorder keeps the file we are about to read and delete.
 *
 * `maxLifeMs` is `z.number().int().positive()` on the capability, so "do not
@@ -64337,6 +64527,20 @@ async function cutRecordedClip(ports, req) {
 			reason: "not-recorded"
 		};
 	}
+	if (ports.now() >= req.deadlineMs) {
+		ports.logger.info("recorded clip: the bound was spent before the render", {
+			tags,
+			meta: {
+				...common,
+				reason: "timed-out",
+				deadlineMs: req.deadlineMs
+			}
+		});
+		return {
+			ok: false,
+			reason: "timed-out"
+		};
+	}
 	const pick = pickProfile(availability.ranges, {
 		startMs: window.fromMs,
 		endMs: window.toMs
@@ -64387,27 +64591,25 @@ async function cutRecordedClip(ports, req) {
 		};
 	}
 	const pollMs = ports.pollMs ?? NC_RECORDED_CLIP_POLL_MS;
-	const timeoutMs = ports.timeoutMs ?? NC_RECORDED_CLIP_TIMEOUT_MS;
-	const deadline = ports.now() + timeoutMs;
 	let state = record.state;
 	let failure = record.error;
 	while (state === "queued" || state === "rendering") {
-		if (ports.now() >= deadline) {
+		if (ports.now() >= req.deadlineMs) {
 			ports.logger.warn("recorded clip: the render did not finish inside its bound", {
 				tags,
 				meta: {
 					...common,
-					cause: "render-timeout",
+					reason: "timed-out",
 					exportId: record.id,
 					profile: pick.profile,
-					timeoutMs,
+					deadlineMs: req.deadlineMs,
 					state
 				}
 			});
-			await discard(ports, record.id);
+			await abandon(ports, record.id);
 			return {
 				ok: false,
-				reason: "cut-failed"
+				reason: "timed-out"
 			};
 		}
 		await ports.sleep(pollMs);
@@ -64503,6 +64705,19 @@ async function cutRecordedClip(ports, req) {
 }
 /** Best-effort removal of the temporary file. Its `maxLifeMs` is the backstop,
 *  so a failure here costs disk for fifteen minutes and is worth one line. */
+/** A render nobody waits for any more: cancel it, then delete its row and file. */
+async function abandon(ports, exportId) {
+	const cancel = ports.cancelExport;
+	if (cancel !== void 0) try {
+		await cancel({ exportId });
+	} catch (err) {
+		ports.logger.debug("recorded clip: could not cancel the abandoned export", { meta: {
+			exportId,
+			error: String(err)
+		} });
+	}
+	await discard(ports, exportId);
+}
 async function discard(ports, exportId) {
 	const del = ports.deleteExport;
 	if (del === void 0) return;
@@ -64538,8 +64753,8 @@ function decodeBase64(base64) {
 * (`PACKAGE_STILLNESS_TTL_MS`). Once its footage is anchored on the pick-up
 * itself rather than on the conclusion (`media-anchor.ts`), the window is far
 * older than any clip ring (≤ 60 s, `NC_CLIP_RETENTION_MAX_SEC`), so the ring
-* refuses it. A gif-only rule then had NOTHING: the recorded follow-up served
-* only a rule that asked for a video. The honest fix for "the gif shows the
+* refuses it. A gif-only rule then had NOTHING: the recorded cut served only a
+* rule that asked for a video. The honest fix for "the gif shows the
 * empty doormat" is not "no gif" — it is the gif of the pick-up, from the
 * recordings.
 *
@@ -64610,7 +64825,7 @@ async function deriveRecordedGif(ports, req) {
 		}
 		const out = ran.ok ? ran.stdout : null;
 		if (out === null || out.byteLength === 0) {
-			ports.logger.warn("recorded gif: the derive failed — the follow-up carries no gif", {
+			ports.logger.warn("recorded gif: the derive failed — the notification carries no gif", {
 				tags,
 				meta: {
 					...common,
@@ -67013,6 +67228,22 @@ function messageOf(err) {
 function isDetailNotAttachedRefusal(err) {
 	return messageOf(err).includes(DETAIL_NOT_ATTACHED_MARKER);
 }
+/**
+* The runner's TYPED handle-expired refusal (D688): the frame handle a dispatch
+* named is past the native lease age bound, and the registry will refuse it on
+* every later ask. TWIN of `addon-pipeline/src/pipeline-runner/detail-park.ts`
+* `DETAIL_HANDLE_EXPIRED_MARKER` — keep the two identical.
+*
+* Why the dispatcher cares: unlike not-attached this is about ONE handle, not
+* the session — the parked frame still serves — but the handle itself is
+* finished. Naming it again (next tick, or through the native-strict crop rung)
+* can only be refused again; on the live fleet that was ~7 refusals per handle.
+*/
+var DETAIL_HANDLE_EXPIRED_MARKER = "runDetailSubtree-refused:handle-expired";
+/** Did this `runDetailSubtree` error carry the runner's handle-expired marker? */
+function isDetailHandleExpiredRefusal(err) {
+	return messageOf(err).includes(DETAIL_HANDLE_EXPIRED_MARKER);
+}
 //#endregion
 //#region src/pipeline-analytics/detail-scheduler.ts
 /** Default backoff/period when a step's cadence omits `minIntervalMs`. */
@@ -67469,6 +67700,7 @@ var TrackDetailDispatcher = class {
 			className: frame.className
 		};
 		const steps = composeDetailSteps(req, (trackId) => this.deps.hasTrackLabel?.(trackId) ?? false);
+		let handleRefused = false;
 		if (frame.frameHandle !== void 0) try {
 			const primary = await this.deps.runDetailSubtree({
 				deviceId,
@@ -67482,7 +67714,10 @@ var TrackDetailDispatcher = class {
 				this.warnNotAttachedThrottled(deviceId, dev, req);
 				return null;
 			}
-			this.deps.logger.debug("detail primary call failed — trying frame fallback", {
+			if (isDetailHandleExpiredRefusal(err)) {
+				handleRefused = true;
+				this.retireRefusedHandle(deviceId, dev, req, frame);
+			} else this.deps.logger.debug("detail primary call failed — trying frame fallback", {
 				tags: { deviceId },
 				meta: {
 					trackId: req.trackId,
@@ -67532,7 +67767,7 @@ var TrackDetailDispatcher = class {
 				}
 			});
 		}
-		if (this.deps.captureCropBase64 !== void 0) try {
+		if (this.deps.captureCropBase64 !== void 0 && frame.frameHandle !== void 0 && !handleRefused) try {
 			const cropJpeg = await this.deps.captureCropBase64(frame);
 			if (cropJpeg !== null) {
 				const retry = await this.deps.runDetailSubtree({
@@ -67561,6 +67796,35 @@ var TrackDetailDispatcher = class {
 		return null;
 	}
 	/**
+	* The runner refused `frame`'s handle as past the lease age bound (D688).
+	* That verdict is final for the handle, so the track's stored association
+	* loses it: later dispatches skip rung 1 and the native-strict crop rung
+	* (both would name the same handle and be refused again — ~7 times per
+	* handle on the live fleet) and go straight to the parked frame, until a
+	* newly OBSERVED frame brings a fresh handle via {@link onFrame}.
+	*
+	* Only the refused handle is dropped: if a newer frame replaced it while the
+	* dispatch was in flight, that one stands. The line is therefore emitted once
+	* per (track, handle) — a concurrent dispatch refused on the same handle
+	* finds it already gone and says nothing.
+	*/
+	retireRefusedHandle(deviceId, dev, req, frame) {
+		const current = dev.tracks.get(req.trackId);
+		if (current === void 0 || current.frameHandle !== frame.frameHandle) return;
+		const { frameHandle: refused, ...withoutHandle } = current;
+		dev.tracks.set(req.trackId, withoutHandle);
+		this.deps.logger.info("detail dispatch: frame handle refused as expired — retired for this track, parked frame only until a fresh observation", {
+			tags: { deviceId },
+			meta: {
+				trackId: req.trackId,
+				stepId: req.stepId,
+				reason: "handle-expired",
+				handle: refused === void 0 ? null : `${refused.shmId}#${refused.slot}#${refused.seq}`,
+				parkedFrameRung: this.deps.captureParkedFrame !== void 0
+			}
+		});
+	}
+	/**
 	* The typed refusal is EXPECTED for a track that outlives the runner's
 	* detail park grace (a closing track's last dispatches), so it logs its own
 	* line — the reason is knowable, unlike the every-rung-missed warn — and
@@ -73848,6 +74112,15 @@ var PackageDropSettingsSchema = object({
 	/** Emit `package-picked-up` when a delivered package's entry departs. */
 	packageDropPickupEnabled: boolean().default(true),
 	/**
+	* Conclude a pick-up EARLY on positive evidence (D687): three looks of the
+	* package step spanning ≥ 10 s that found the doormat empty and unoccluded,
+	* with somebody in the drop-off zone around the disappearance — instead of
+	* waiting out the 300 s TTL. OFF by default: the one pick-up the stored data
+	* could replay (615, 2026-09-30) is no sample to judge the false-departure
+	* risk by. Silence always keeps the TTL.
+	*/
+	packageDropEarlyPickupEnabled: boolean().default(false),
+	/**
 	* A parcel needs a deliverer: a stillness candidate only ever promotes to
 	* `delivered` if a non-package track (person/vehicle/animal) was active IN
 	* A CONFIGURED PACKAGE DROP-OFF ZONE within this many seconds BEFORE the
@@ -73886,6 +74159,7 @@ function resolvePackageDropSettings(raw) {
 		packageDropMinBboxAreaFrac: pick("packageDropMinBboxAreaFrac"),
 		packageDropMaxBboxAreaFrac: pick("packageDropMaxBboxAreaFrac"),
 		packageDropPickupEnabled: pick("packageDropPickupEnabled"),
+		packageDropEarlyPickupEnabled: pick("packageDropEarlyPickupEnabled"),
 		packageDropActivityWindowSec: pick("packageDropActivityWindowSec"),
 		packageDropClassFilter: pick("packageDropClassFilter")
 	};
@@ -76219,11 +76493,129 @@ function trackIsStill(input) {
 		spanFrac: metrics.pathSpanFrac
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/pipeline/package/package-stillness-tracker.ts
+/**
+* PackageStillnessTracker — the DEDICATED promotion path for packages.
+*
+* ## Why this exists (the arithmetic)
+*
+* The generic `StationaryObjectRegistry` used to promote a track that recorded
+* 4 positions inside a 30 s window — a criterion built for a car parking in
+* device 617's lot and observed on EVERY frame. (It has since moved to repeated
+* evidence across many sightings, `stationary-evidence.ts`; the impossibility
+* below is what forced this path to exist, and the class SKIP in the generic
+* loop is what keeps it separate now.)
+*
+* `package-detection` is not observed on every frame. It is a root step gated
+* by the `MotionSettleGovernor`, which runs it on a motion-settle edge or, in
+* the worst case, on a 45 s safety poll. Four positions in 30 s at one
+* position per 45 s is not a tuning problem, it is an impossibility — and it is
+* why `PackageDropDetector` never fired once in its life (0 `pa-pkg-*` rows on
+* every camera, ever, verified 2026-08-13).
+*
+* Measured on device 615 (the only camera that has ever produced a `package`
+* box): three separate tracks at 02:01:08, 02:03:14 and 02:05:29, each alive
+* for 4–5 s, each carrying TWO frames ~1.2 s apart, each on a NEW trackId. The
+* facts to accommodate are therefore:
+*
+*  - the track DIES between governor rounds → re-association is by POSITION
+*    (IoU), never by trackId;
+*  - a round can be minutes apart → there is NO look-back window, only a count
+*    of distinct FRAMES plus the operator's optional dwell;
+*  - a burst of frames inside one settle session COUNTS: three frames ~400 ms
+*    apart is three hits, which is enough to confirm the box is still there
+*    without waiting for a second governor round after the courier left.
+*    Device 615 2026-08-24 13:40: a real parcel expired at rounds=1 /
+*    dwell 1458 ms vs 15 s — the 5 s round-gap plus 15 s dwell were the miss.
+*
+* The generic registry is untouched: a parked car still promotes exactly as
+* before. `scripts/check-package-promotion-satisfiable.ts` fails the build if
+* anyone breaks the relation between these constants and the governor's poll.
+*
+* ## Contract
+*
+* Pure logic with an injected clock and id factory — `observe` takes the frame
+* timestamp and never reads `Date.now()`. It emits {@link StationaryEntry}
+* values in the exact shape `PackageDropDetector.onStationaryChange` already
+* consumes, so the detector is unchanged by this path: `promoted` feeds
+* `appeared`, `departed` feeds `departed`, and the entry id is stable across
+* both so a pick-up pairs to its delivery.
+*
+* Expiry is judged on the frame clock inside `observe`, which is called on
+* every pipeline frame (an empty `sightings` list when the package step did
+* not run or found nothing). A camera producing no frames concludes nothing
+* there — and that is load-bearing, not an accident: the FIRST frame after a
+* silence runs the governor's poll (it is always due after a TTL of silence)
+* and re-sights a parcel that is still there before the expiry is judged.
+*
+* `sweep` judges the same TTL off a timer, so a pick-up is not held until the
+* next frame happens to arrive (615, 2026-09-30: 29 s). It concludes ONLY a
+* promoted parcel with an ABSENCE READ since its last sighting — a frame on
+* which the package step LOOKED (`looked`) and found no box at that place,
+* with no person or vehicle box over it (`occluders`). A parcel nobody looked
+* for since is left for the next frame's look. Silence is not evidence.
+*/
+/**
+* Distinct FRAMES a box must be re-seen on before it is a parked package.
+* Three is the same bar as tracker `minHits`: one frame is a flicker, two
+* can still be a passer-by's bag in a single glance, three is "it stayed".
+* Counted per sighting, not per 5 s governor round — a settle burst of
+* three frames in ~1 s is a confirmation, not one collapsed round.
+*/
+var PACKAGE_STILLNESS_MIN_HITS = 3;
+/**
+* Minimum spacing between two observations for them to count as separate
+* pick-up-slack windows. Must be ≤ the governor's poll interval. No longer
+* used for promotion (hits count every frame).
+*/
+var PACKAGE_STILLNESS_ROUND_GAP_MS = 5e3;
+/**
+* How long a candidate survives without being re-associated, in OBSERVED time.
+* Must comfortably outlast several governor polls — the real inter-round gap
+* measured on 615 was ~2 minutes, not the nominal 45 s, because a
+* session-dispatch camera decodes nothing between motion sessions.
+*/
+var PACKAGE_STILLNESS_TTL_MS = 5 * 6e4;
+/**
+* Association floor. Deliberately looser than the registry's `SUPPRESS_IOU`
+* (0.6): a box re-detected minutes later by a fresh track jitters more than one
+* confirmed frame-to-frame. Measured jitter on 615's doormat across 4 minutes
+* was IoU ≈ 0.98, so 0.3 is generous without being meaningless.
+*/
+var PACKAGE_STILLNESS_ASSOC_IOU = .3;
+/**
+* Two absence reads closer than this are ONE look, not two. A settle burst
+* runs the package step 5 s apart and a poll 45 s apart, so a real second
+* look is always further away; two frames of one moment (a re-dispatch, a
+* recovery pass) must not count as agreement.
+*/
+var PACKAGE_ABSENCE_READ_MIN_GAP_MS = 2e3;
+/**
+* Early pick-up (D687, per-camera opt-in): absence reads a promoted parcel
+* needs before it may depart ahead of its TTL. Three is the same bar as
+* promotion — one empty look is a missed detection, two can be one wobble of
+* the detector, three agreeing is "it is gone" (D49: a read that destroys
+* work needs another to agree).
+*/
+var PACKAGE_EARLY_PICKUP_MIN_READS = 3;
+/**
+* …and the span those reads must cover, first to last. A settle burst looks
+* every 5 s, so 10 s is three burst runs: the parcel is still gone after the
+* collector has had time to put it back down.
+*/
+var PACKAGE_EARLY_PICKUP_MIN_SPAN_MS = 1e4;
+/**
+* Absence reads the frame-free SWEEP needs before it may conclude a TTL
+* (fix round 1, D49): one read can be stale by minutes, or a detector
+* wobble; a second must agree, and the most recent look must be one of them.
+*/
+var PACKAGE_SWEEP_MIN_READS = 2;
 var DEFAULT_PACKAGE_STILLNESS_CONFIG = {
-	minHits: 3,
-	roundGapMs: 5e3,
-	ttlMs: 5 * 6e4,
-	assocIou: .3
+	minHits: PACKAGE_STILLNESS_MIN_HITS,
+	roundGapMs: PACKAGE_STILLNESS_ROUND_GAP_MS,
+	ttlMs: PACKAGE_STILLNESS_TTL_MS,
+	assocIou: PACKAGE_STILLNESS_ASSOC_IOU
 };
 var PackageStillnessTracker = class {
 	config;
@@ -76266,37 +76658,117 @@ var PackageStillnessTracker = class {
 			next[index] = parked;
 			promoted.push(toEntry(parked));
 		}
+		const present = input.rawPackageBoxes !== void 0 ? withRawPresence(next, consumed, input.rawPackageBoxes, input.timestamp, this.config.assocIou) : next;
+		const looked = input.looked === true && input.rawPackageBoxes !== void 0 ? withLook(present, consumed, input, input.rawPackageBoxes, this.config.assocIou) : present;
+		const windowMs = input.activityWindowMs ?? 0;
+		const early = /* @__PURE__ */ new Set();
+		const unbacked = [];
+		const read = looked.map((c) => {
+			if (input.earlyPickup !== true || c.earlyUnbackedReported || !hasEarlyEvidence(c)) return c;
+			const reason = this.earlyUnbackedReason(c, windowMs, input.lastActivityAt);
+			if (reason === null) return c;
+			unbacked.push({
+				id: c.id,
+				reason
+			});
+			return {
+				...c,
+				earlyUnbackedReported: true
+			};
+		});
+		return {
+			promoted,
+			...this.expire({
+				deviceId: input.deviceId,
+				candidates: read,
+				isExpired: (c) => {
+					if (input.timestamp - c.lastSeenAt > this.config.ttlMs) return true;
+					if (input.earlyPickup !== true || !hasEarlyEvidence(c)) return false;
+					if (this.earlyUnbackedReason(c, windowMs, input.lastActivityAt) !== null) return false;
+					early.add(c.id);
+					return true;
+				},
+				activityWindowMs: windowMs,
+				...input.lastActivityAt !== void 0 ? { lastActivityAt: input.lastActivityAt } : {}
+			}),
+			earlyDepartureIds: [...early],
+			earlyEvidenceUnbacked: unbacked
+		};
+	}
+	/** Why complete early evidence may NOT conclude, or null when it may. */
+	earlyUnbackedReason(c, activityWindowMs, lastActivityAt) {
+		if (activityWindowMs <= 0) return "no-activity-window";
+		if (lastActivityAt === void 0 || lastActivityAt < c.lastSeenAt - this.config.roundGapMs) return "nobody-around";
+		return null;
+	}
+	/**
+	* Judge the TTL without a frame. Concludes only a PROMOTED parcel whose TTL
+	* ran out AND that carries at least one absence read since its last
+	* sighting; every other candidate is left for the next frame, whose look
+	* decides it. Never promotes. Immutable, never throws.
+	*/
+	sweep(input) {
+		const candidates = this.byDevice.get(input.deviceId) ?? [];
+		return {
+			promoted: [],
+			...this.expire({
+				deviceId: input.deviceId,
+				candidates,
+				isExpired: (c) => c.promotedAt !== null && c.absenceReads.length >= PACKAGE_SWEEP_MIN_READS && c.lastLook === "absent" && input.timestamp - c.lastSeenAt > this.config.ttlMs,
+				activityWindowMs: input.activityWindowMs ?? 0,
+				...input.lastActivityAt !== void 0 ? { lastActivityAt: input.lastActivityAt } : {}
+			}),
+			earlyDepartureIds: [],
+			earlyEvidenceUnbacked: []
+		};
+	}
+	/** The devices holding a candidate — what a sweep has to visit. */
+	devicesWithCandidates() {
+		return [...this.byDevice.keys()];
+	}
+	/**
+	* Expiry. A promoted candidate that ages out is a departure (it feeds the
+	* pick-up pairing) — but only a departure with somebody around the
+	* disappearance is a PICK-UP; an unwitnessed vanish is the detector losing
+	* the box. An unpromoted candidate that ages out is reported with its
+	* counters: it expired in silence once (2026-08-18 13:41, a true parcel)
+	* and that silence cost the diagnosis a day.
+	*/
+	expire(input) {
 		const departed = [];
 		const departedWithoutActivity = [];
 		const expired = [];
 		const kept = [];
-		const windowMs = input.activityWindowMs ?? 0;
-		for (const c of next) {
-			if (input.timestamp - c.lastSeenAt > this.config.ttlMs) {
-				if (c.promotedAt !== null) if (windowMs <= 0 || input.lastActivityAt !== void 0 && input.lastActivityAt >= c.lastSeenAt - this.config.roundGapMs) departed.push(toEntry(c));
-				else departedWithoutActivity.push(toEntry(c));
-				else expired.push({
-					id: c.id,
-					className: c.className,
-					bbox: { ...c.bbox },
-					hits: c.hits,
-					firstSeenAt: c.firstSeenAt,
-					lastSeenAt: c.lastSeenAt,
-					activityBackedAtOpen: c.activityBackedAtOpen
-				});
+		for (const c of input.candidates) {
+			if (!input.isExpired(c)) {
+				kept.push(c);
+				continue;
+			}
+			if (c.promotedAt === null) {
+				expired.push(expiredReport(c));
 				continue;
 			}
-			kept.push(c);
+			if (this.pickupBacked(c, input.activityWindowMs, input.lastActivityAt)) departed.push(toEntry(c));
+			else departedWithoutActivity.push(toEntry(c));
 		}
 		if (kept.length === 0) this.byDevice.delete(input.deviceId);
 		else this.byDevice.set(input.deviceId, kept);
 		return {
-			promoted,
 			departed,
 			departedWithoutActivity,
 			expired
 		};
 	}
+	/**
+	* A pick-up needs somebody around the DISAPPEARANCE: activity at or after
+	* the box's last sighting (one round-gap of slack — the taker is tracked in
+	* the same frames that stop showing the box). The DELIVERER's activity
+	* minutes earlier must not count, or every short-dwell vanish would read as
+	* a pick-up. A window of 0 disables the gate.
+	*/
+	pickupBacked(c, activityWindowMs, lastActivityAt) {
+		return activityWindowMs <= 0 || lastActivityAt !== void 0 && lastActivityAt >= c.lastSeenAt - this.config.roundGapMs;
+	}
 	/** Drop a device's candidates (unbind / step disabled). */
 	forgetDevice(deviceId) {
 		this.byDevice.delete(deviceId);
@@ -76339,6 +76811,9 @@ var PackageStillnessTracker = class {
 			lastSeenAt: input.timestamp,
 			hits: 1,
 			promotedAt: null,
+			absenceReads: [],
+			lastLook: null,
+			earlyUnbackedReported: false,
 			activityBackedAtOpen,
 			...s.trackId !== void 0 ? { sourceTrackId: s.trackId } : {},
 			...s.label !== void 0 ? { label: s.label } : {},
@@ -76357,12 +76832,91 @@ function confirm(prev, input, s) {
 		frameHeight: input.frameHeight,
 		lastSeenAt: input.timestamp,
 		hits: prev.hits + 1,
+		absenceReads: [],
+		lastLook: "present",
+		earlyUnbackedReported: false,
 		...s.trackId !== void 0 ? { sourceTrackId: s.trackId } : {},
 		...s.label !== void 0 ? { label: s.label } : {},
 		...s.confidence !== void 0 ? { confidence: s.confidence } : {},
 		...s.keyFrameMediaId !== void 0 ? { keyFrameMediaId: s.keyFrameMediaId } : {}
 	};
 }
+/**
+* A promoted parcel the tracker did not re-sight but the package step's RAW
+* output shows at its place (IoU ≥ the association floor): the detector saw
+* it, whatever the tracker did with the box. It is SEEN — `lastSeenAt` moves,
+* so the TTL ages from here and the pick-up instant is this last presence —
+* and every absence read so far is contradicted.
+*/
+function withRawPresence(candidates, sighted, raw, timestamp, assocIou) {
+	return candidates.map((c) => {
+		if (c.promotedAt === null || sighted.has(c.id)) return c;
+		if (!raw.some((b) => iou(b, c.bbox) >= assocIou)) return c;
+		return {
+			...c,
+			lastSeenAt: timestamp,
+			absenceReads: [],
+			lastLook: "present"
+		};
+	});
+}
+/**
+* Fold this frame's LOOK into every promoted candidate it did not re-sight.
+*
+* Judged against what the package step RETURNED (`raw`), never against the
+* tracker's sightings: a raw box at the place is a PRESENCE even when the
+* tracker dropped it, and it contradicts every absence read so far (D49). A
+* look whose view of the place was covered by a person or vehicle saw the
+* occluder, and says nothing — but it is the latest look, so the sweep waits
+* for a later one.
+*/
+function withLook(candidates, sighted, input, raw, assocIou) {
+	const occluders = input.occluders ?? [];
+	return candidates.map((c) => {
+		if (c.promotedAt === null || sighted.has(c.id)) return c;
+		if (raw.some((b) => iou(b, c.bbox) >= assocIou)) return {
+			...c,
+			absenceReads: [],
+			lastLook: "present"
+		};
+		if (occluders.some((o) => boxesOverlap(o, c.bbox))) return {
+			...c,
+			lastLook: "occluded"
+		};
+		const last = c.absenceReads[c.absenceReads.length - 1];
+		if (last !== void 0 && input.timestamp - last < PACKAGE_ABSENCE_READ_MIN_GAP_MS) return {
+			...c,
+			lastLook: "absent"
+		};
+		return {
+			...c,
+			absenceReads: [...c.absenceReads, input.timestamp],
+			lastLook: "absent"
+		};
+	});
+}
+/** Enough agreeing absence reads, over enough time, to call a parcel gone
+*  ahead of its TTL (D687). */
+function hasEarlyEvidence(c) {
+	if (c.promotedAt === null) return false;
+	const first = c.absenceReads[0];
+	const last = c.absenceReads[c.absenceReads.length - 1];
+	return c.absenceReads.length >= PACKAGE_EARLY_PICKUP_MIN_READS && first !== void 0 && last !== void 0 && last - first >= PACKAGE_EARLY_PICKUP_MIN_SPAN_MS;
+}
+function boxesOverlap(a, b) {
+	return Math.min(a.x + a.w, b.x + b.w) > Math.max(a.x, b.x) && Math.min(a.y + a.h, b.y + b.h) > Math.max(a.y, b.y);
+}
+function expiredReport(c) {
+	return {
+		id: c.id,
+		className: c.className,
+		bbox: { ...c.bbox },
+		hits: c.hits,
+		firstSeenAt: c.firstSeenAt,
+		lastSeenAt: c.lastSeenAt,
+		activityBackedAtOpen: c.activityBackedAtOpen
+	};
+}
 function toEntry(c) {
 	return {
 		id: c.id,
@@ -76381,6 +76935,60 @@ function toEntry(c) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/package/package-look-evidence.ts
+function packageLookEvidence(input) {
+	const raw = [];
+	for (const d of input.frame.detections) {
+		if (d.kind !== "first-level" || !input.packageClasses.has(d.macroClass)) continue;
+		raw.push({
+			x: d.bbox.x,
+			y: d.bbox.y,
+			w: d.bbox.width,
+			h: d.bbox.height
+		});
+	}
+	for (const d of input.frame.discarded ?? []) {
+		if (!input.packageClasses.has(d.macroClass)) continue;
+		const [x1, y1, x2, y2] = d.bbox;
+		raw.push({
+			x: x1,
+			y: y1,
+			w: x2 - x1,
+			h: y2 - y1
+		});
+	}
+	return {
+		looked: input.frame.packageLooked === true,
+		occluders: input.tracked.filter((t) => !input.packageClasses.has(t.className)).map((t) => ({
+			x: t.bbox.x,
+			y: t.bbox.y,
+			w: t.bbox.w,
+			h: t.bbox.h
+		})),
+		rawPackageBoxes: raw,
+		earlyPickup: input.earlyPickupEnabled
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/package/package-stillness-sweep.ts
+function sweepPackageStillness(deps) {
+	for (const deviceId of deps.tracker.devicesWithCandidates()) try {
+		sweepOne(deps, deviceId);
+	} catch (err) {
+		deps.onDeviceError(deviceId, err);
+	}
+}
+function sweepOne(deps, deviceId) {
+	const lastActivityAt = deps.lastActivityAtFor(deviceId);
+	const outcome = deps.tracker.sweep({
+		deviceId,
+		timestamp: deps.now,
+		activityWindowMs: deps.activityWindowMsFor(deviceId),
+		...lastActivityAt !== void 0 ? { lastActivityAt } : {}
+	});
+	if (outcome.departed.length > 0 || outcome.departedWithoutActivity.length > 0 || outcome.expired.length > 0) deps.onOutcome(deviceId, outcome, deps.now);
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-zones.ts
 /**
 * Zone ids whose 0–1 polygon contains the entry's normalised bbox centroid.
@@ -90428,6 +91036,13 @@ function buildGlobalSettingsSchema(cap) {
 					description: "Also emit a package-picked-up event when the delivered package leaves.",
 					default: PACKAGE_DROP_DEFAULTS.packageDropPickupEnabled
 				},
+				{
+					type: "boolean",
+					key: "packageDropEarlyPickupEnabled",
+					label: "Early pick-up",
+					description: "Report a pick-up as soon as the package detector has looked three times over at least 10 s, found the spot empty and unblocked, and somebody was in the drop-off zone — instead of after 5 minutes without a sighting. Off by default until it is measured on more pick-ups.",
+					default: PACKAGE_DROP_DEFAULTS.packageDropEarlyPickupEnabled
+				},
 				{
 					type: "slider",
 					key: "packageDropMinFrames",
@@ -96094,7 +96709,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 					createExport: (input) => api.recordingExport.createExport.mutate({ ...input }),
 					getExport: (input) => api.recordingExport.getExport.query(input),
 					readExportBytes: (input) => api.recordingExport.readExportBytes.query(input),
-					deleteExport: (input) => api.recordingExport.deleteExport.mutate(input)
+					deleteExport: (input) => api.recordingExport.deleteExport.mutate(input),
+					cancelExport: (input) => api.recordingExport.cancelExport.mutate(input)
 				}, req),
 				deriveGifFromClip: (req) => deriveRecordedGif(buildRecordedGifPorts({
 					logger: logger.child("RecordedGif"),
@@ -97101,6 +97717,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	startSweepTimers() {
 		this.ttlSweepTimer = setInterval(() => {
 			this.sweepExpiredTracks();
+			this.runPackageStillnessSweep(Date.now());
 		}, TTL_SWEEP_INTERVAL_MS);
 		this.faceReembedAutoTimer = setInterval(() => {
 			this.maybeAutoReembedFaces().then(() => this.faceAlignmentJobs?.maybeAutoRunPhotoPass());
@@ -98252,7 +98869,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			settings: packageSettings,
 			frameWidth: result.frameWidth,
 			frameHeight: result.frameHeight,
-			timestamp: result.timestamp
+			timestamp: result.timestamp,
+			frame
 		});
 		if (this.detailDispatcher && detailSteps && detailSteps.length > 0) {
 			const dispatcher = this.detailDispatcher;
@@ -101102,8 +101720,77 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			minHits: input.settings.packageDropMinFrames,
 			minDwellMs: input.settings.packageDropDwellSec * 1e3,
 			activityWindowMs: input.settings.packageDropActivityWindowSec * 1e3,
-			...lastActivityAt !== void 0 ? { lastActivityAt } : {}
+			...lastActivityAt !== void 0 ? { lastActivityAt } : {},
+			...packageLookEvidence({
+				frame: input.frame,
+				tracked: input.tracked,
+				packageClasses: input.packageClasses,
+				earlyPickupEnabled: input.settings.packageDropEarlyPickupEnabled
+			})
+		});
+		this.bridgePackageStillness({
+			deviceId: input.deviceId,
+			outcome,
+			timestamp: input.timestamp,
+			settings: input.settings,
+			...lastActivityAt !== void 0 ? { lastActivityAt } : {},
+			via: "frame"
+		});
+	}
+	/**
+	* Judge the package TTL without a frame (F4) — on the existing TTL sweep
+	* tick, for the devices holding a candidate. The tracker concludes only a
+	* parcel the step looked for and did not find; see
+	* `PackageStillnessTracker.sweep`.
+	*/
+	/**
+	* The tick's entry point: a throw here is an uncaught exception in a timer
+	* callback, so it is caught and named (review M3). Per-device throws are
+	* already caught inside the driver, so one camera cannot stop the others.
+	*/
+	runPackageStillnessSweep(now) {
+		try {
+			this.sweepPackageStillness(now);
+		} catch (err) {
+			this.ctx.logger.warn("package stillness sweep threw", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	sweepPackageStillness(now) {
+		if (this.packageDropDetector === null) return;
+		sweepPackageStillness({
+			tracker: this.packageStillness,
+			now,
+			activityWindowMsFor: (deviceId) => this.packageDropSettingsFromCache(deviceId).packageDropActivityWindowSec * 1e3,
+			lastActivityAtFor: (deviceId) => this.lastNonPackageActivityAt.get(deviceId),
+			onOutcome: (deviceId, outcome, at) => {
+				const lastActivityAt = this.lastNonPackageActivityAt.get(deviceId);
+				this.bridgePackageStillness({
+					deviceId,
+					outcome,
+					timestamp: at,
+					settings: this.packageDropSettingsFromCache(deviceId),
+					...lastActivityAt !== void 0 ? { lastActivityAt } : {},
+					via: "sweep"
+				});
+			},
+			onDeviceError: (deviceId, err) => {
+				this.ctx.logger.warn("package stillness sweep threw", {
+					tags: { deviceId },
+					meta: { error: err instanceof Error ? err.message : String(err) }
+				});
+			}
 		});
+	}
+	/**
+	* Bridge one stillness outcome into `PackageDropDetector` — the SAME
+	* `onStationaryChange` contract the generic registry uses. A frame's outcome
+	* and a sweep's take this one path, so a pick-up concluded without a frame
+	* is logged, paired and notified exactly like one concluded on a frame.
+	*/
+	bridgePackageStillness(input) {
+		if (this.packageDropDetector === null) return;
+		const tags = { deviceId: input.deviceId };
+		const { outcome, lastActivityAt } = input;
 		for (const entry of outcome.promoted) {
 			const centroid = {
 				x: entry.bbox.x + entry.bbox.w / 2,
@@ -101153,7 +101840,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				meta: {
 					entryId: entry.id,
 					className: entry.className,
-					unseenForMs: input.timestamp - entry.lastConfirmedAt
+					unseenForMs: input.timestamp - entry.lastConfirmedAt,
+					via: input.via,
+					rule: outcome.earlyDepartureIds.includes(entry.id) ? "early" : "ttl"
 				}
 			});
 			this.packageBackground?.noteRealPickup({
@@ -101195,7 +101884,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 					className: entry.className,
 					bbox: entry.bbox,
 					unseenForMs: input.timestamp - entry.lastConfirmedAt,
-					...lastActivityAt !== void 0 ? { lastActivityAt } : {}
+					...lastActivityAt !== void 0 ? { lastActivityAt } : {},
+					via: input.via
 				}
 			});
 			this.packageBackground?.noteGhostCycle({
@@ -101214,6 +101904,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				});
 			}).catch(() => void 0);
 		}
+		for (const u of outcome.earlyEvidenceUnbacked) this.ctx.logger.info("early pick-up evidence complete — nobody around, left to the TTL", {
+			tags,
+			meta: {
+				entryId: u.id,
+				reason: u.reason,
+				via: input.via
+			}
+		});
 		for (const ex of outcome.expired) {
 			const observedDwellMs = ex.lastSeenAt - ex.firstSeenAt;
 			const requiredDwellMs = input.settings.packageDropDwellSec * 1e3;