@camstack/addon-post-analysis 1.2.305 → 1.2.306

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-t2ey3w0B.js");
+const require_clip_model_registry = require("../clip-model-registry-C67UM_q_.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -10652,21 +10652,49 @@ function matchesPlate(label, values, maxDistance) {
 	return false;
 }
 /**
+* Subject kinds whose `classNames` is a real, operator-meaningful detection
+* class — the ones the `classes` condition can actually scope a rule to.
+* `device-event` and `system-event` carry NO class live (`classNames: []`,
+* always — see `subjectFromSensorEvent`); their OUTBOX `className` is a
+* display placeholder instead (the sensor kind, or the literal `'event'`,
+* `className: subject.classNames[0] ?? subject.sensorKind ?? 'event'`), which
+* `cooldownSubjectFromOutbox` would otherwise reconstruct as if it were a real
+* class. Gating here, not on the reconstructed value, keeps the live path and
+* the boot reseed addressing the SAME key regardless of what a display label
+* happens to say (2026-10-01, caught by `system-event-cooldown-direction.spec.ts`
+* when the default below flipped).
+*/
+var CLASS_BEARING_SUBJECT_KINDS = new Set([
+	"object-event",
+	"track-end",
+	"package-event",
+	"occupancy-event",
+	"audio-event",
+	"audio-window"
+]);
+/**
 * Should this subject's class be part of the cooldown key?
 *
 * AUDIO is unconditional and predates the setting: a rule opted into several
 * audio classes (dog + scream) must not have a safety-relevant scream
 * swallowed by an unrelated bark's 60 s window.
 *
-* Every other subject gets the same treatment only when the rule ASKS for it
-* (`granularity: 'per-class'`) — cat→dog fires at once, cat→cat still waits.
-* Absent / `shared` reproduces the class-agnostic key byte for byte, because
-* changing how often an operator's existing rules fire is not a side effect
-* anyone asked for.
+* A `device-event` or `system-event` subject never reads a class — see
+* {@link CLASS_BEARING_SUBJECT_KINDS} — so the setting has nothing to key on
+* regardless of `granularity`.
+*
+* Every class-bearing subject gets the same treatment unless the rule
+* explicitly asks for `shared` — cat→dog fires at once, cat→cat still waits.
+* That is the operator's default since 2026-10-01 (D36's dated note): an
+* UNSET rule now reads exactly like an explicit `per-class` one, new rules and
+* existing rules alike. Only a `granularity: 'shared'` actually stored
+* reproduces the old class-agnostic key byte for byte — the one case where an
+* operator asked for one window across every class on purpose.
 */
 function keysPerClass(rule, subject) {
 	if (subject.kind === "audio-event" || subject.kind === "audio-window") return true;
-	return rule.throttle.granularity === "per-class";
+	if (!CLASS_BEARING_SUBJECT_KINDS.has(subject.kind)) return false;
+	return rule.throttle.granularity !== "shared";
 }
 /**
 * The cooldown scope of ONE system event — subject AND direction.
@@ -10751,6 +10779,42 @@ function isCoolingDown(rule, lastFiredAt, now) {
 	return now - lastFiredAt < rule.throttle.cooldownSec * 1e3;
 }
 /**
+* The media policy EVERY sensor rule attaches: one whole-scene photograph,
+* never a selector. `attach: 'keyFrame'` is the existing "clean full scene
+* frame" ladder (`attachmentKindPreference`) — the closest existing concept
+* to a plain snapshot, as opposed to `'best'`/`'best-matching'`, which chase a
+* SUBJECT crop a sensor subject (a doorbell press, a contact change) has
+* none of to chase. No zone crop, no gif, no clip, no profile — a sensor
+* subject has no zone condition to crop to and no reason to animate.
+*/
+var NC_SENSOR_MEDIA_POLICY = { attach: "keyFrame" };
+/**
+* The media policy actually used to build a delivery, for a rule of this
+* KIND. A sensor rule's STORED `media` is never read at evaluation — the
+* editor offers no media control for one any more, and `media.attach` /
+* `.gif` / `.clip` / `.profile` on an existing sensor rule (authored before
+* this ruling, from the viewer or the API) are IGNORED here, never refused at
+* load. See {@link mediaPolicyMatchesSensorDefault} for the sampled-log gate.
+*/
+function effectiveMediaPolicy(rule, kind) {
+	return kind === "sensor" ? NC_SENSOR_MEDIA_POLICY : rule.media;
+}
+/**
+* True when a stored media policy already reads as the sensor default — the
+* gate the boot/evaluation path uses to decide whether an existing sensor
+* rule's stored choice is being silently overridden (and so is worth a
+* sampled log line) or already matches and there is nothing to say.
+*/
+function mediaPolicyMatchesSensorDefault(media) {
+	return media.attach === NC_SENSOR_MEDIA_POLICY.attach && media.frame === void 0 && media.zoneCrop !== true && media.gif !== true && media.clip !== true && media.profile === void 0;
+}
+/** `effectiveMediaPolicy`, resolving the kind itself — the call-site shortcut
+*  every production caller uses; `effectiveMediaPolicy` stays the unit under
+*  test because `ruleKindOf` needs no fixture of its own there. */
+function effectiveMediaPolicyForRule(rule) {
+	return effectiveMediaPolicy(rule, require_clip_model_registry.ruleKindOf(rule));
+}
+/**
 * Ordered media-kind preference for one attachment, per policy and owner.
 * `best` favours the tight subject crop; `keyFrame` the clean scene frame
 * (small variant first — the degrade engine enforces per-backend byte
@@ -14332,11 +14396,11 @@ function logRefusal$3(check, ctx) {
 	try {
 		check();
 	} catch (err) {
-		if (err instanceof NcDevicesExcludeRefusal) warnRefusal$2(ctx.logger, err, ctx);
+		if (err instanceof NcDevicesExcludeRefusal) warnRefusal$3(ctx.logger, err, ctx);
 		throw err;
 	}
 }
-function warnRefusal$2(logger, err, ctx) {
+function warnRefusal$3(logger, err, ctx) {
 	logger.warn("nc rule refused: devicesExclude on a system rule", { meta: {
 		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
 		by: ctx.by,
@@ -14359,6 +14423,184 @@ function guardPatchDevicesExclude(existing, patch, ctx) {
 	logRefusal$3(() => assertDevicesExcludeDelivery(merged), ctx);
 }
 //#endregion
+//#region src/notification-center/device-compat-guard.ts
+/**
+* A NEW or UPDATED rule's `conditions.devices` (the "Only these" INCLUDE list)
+* names only devices that can actually produce this rule's KIND of subject —
+* operator ruling, 2026-10-01: "the DEVICE picker of a rule must offer only
+* devices compatible with the rule type … the server should also refuse a
+* save whose deviceIds include an incompatible device".
+*
+* THE authority, same arrangement as `device-scope-guard.ts` beside it: the
+* cap-provider route (`notificationRules.createRule/updateRule`, index.ts)
+* and the rule bridge (`nc.createRule/updateRule`, nc-actions.ts) both call
+* `guardRuleDeviceCompat` / `guardPatchDeviceCompat`. Which devices a kind
+* may scope is `ruleDeviceCompatCapQueries` (`@camstack/types`) — the SAME
+* table the admin's Devices tab narrows by, so a save can never refuse a
+* device its own picker just offered. A `sensor` rule's set includes every
+* camera: a camera-scoped sensor rule is legitimate (D630 §6).
+*
+* ASYNC, unlike its sibling guards: it has to ask `deviceManager` which
+* devices carry the caps. `listDeviceIdsByCaps` is therefore OPTIONAL on the
+* context — absent on an older wiring, if the cross-addon call throws, or if
+* it answers EMPTY (the registry not yet warm at boot: `getAllBindings`
+* answers `[]` with only a warning, which is not a measurement — D315/D393),
+* the guard FAILS OPEN (never refuses) rather than blocking every save on a
+* read it cannot make (D49). It is never SILENT about it: an unjudged scoped
+* save logs a sampled WARN naming the rule and the reason, so a dropped wiring
+* is visible in production rather than a guard that quietly stopped existing.
+*
+* ON UPDATE only the ids the patch ADDS are judged. A device already stored on
+* the rule is never re-judged: the answer is not stable (switching detection
+* off on a camera removes its `detection-pipeline` binding, D62; an agent
+* camera's native caps are missing during the handshake), and re-judging
+* would make every rule naming that camera un-editable until the operator
+* removed it — losing a scope a later switch-on would not give back.
+*
+* NEVER called at LOAD. `NcRuleSchema.parse` and the store's own read path are
+* untouched — a rule saved before this ruling, or saved while the capability
+* read was unavailable, keeps loading and keeps firing exactly as it does
+* today; only a NEW save attempt is judged.
+*
+* `devicesExclude` is NOT checked: this guard judges what the rule actually
+* MATCHES ON (the include scope), not what it widens away from, and an
+* operator excluding an incompatible device from an "all except" rule is not
+* the mistake this exists to catch.
+*/
+/** How long one rule's "accepted unchecked" WARN stays quiet after it fired. */
+var UNCHECKED_WARN_WINDOW_MS = 10 * 6e4;
+/** Bound on remembered rule keys — cleared whole when exceeded. */
+var UNCHECKED_WARN_MEMO_MAX = 256;
+/**
+* Samples the "accepted unchecked" WARN per rule: an editor that autosaves, or
+* a script, must not turn one unreachable read into a log flood, but the first
+* save of every rule in a window is always reported.
+*/
+var NcDeviceCompatWarnSampler = class {
+	lastWarnedAt = /* @__PURE__ */ new Map();
+	shouldWarn(key, now) {
+		const last = this.lastWarnedAt.get(key);
+		if (last !== void 0 && now - last < UNCHECKED_WARN_WINDOW_MS) return false;
+		if (this.lastWarnedAt.size >= UNCHECKED_WARN_MEMO_MAX) this.lastWarnedAt.clear();
+		this.lastWarnedAt.set(key, now);
+		return true;
+	}
+};
+var NcDeviceCompatRefusal = class extends Error {
+	kind;
+	incompatibleIds;
+	constructor(kind, incompatibleIds) {
+		super(`rule refused: device(s) ${incompatibleIds.join(", ")} cannot produce a '${kind}' rule's subject`);
+		this.name = "NcDeviceCompatRefusal";
+		this.kind = kind;
+		this.incompatibleIds = incompatibleIds;
+	}
+};
+/** The union of every compat query's answer, or why there is none. */
+async function readCompatibleIds(queries, listDeviceIdsByCaps) {
+	try {
+		const answers = await Promise.all(queries.map((capNames) => listDeviceIdsByCaps(capNames)));
+		return {
+			ok: true,
+			ids: new Set(answers.flat())
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: String(err)
+		};
+	}
+}
+/**
+* The check. `judged` is the ids to judge — the whole include list on a
+* create, only the ADDED ids on an update (see the file header).
+*
+* Resolves `not-judged` when the kind has no capability filter
+* (`ruleDeviceCompatCapQueries` is `null`) or there is nothing to judge —
+* "every device" is never refused here. Resolves `unchecked` (fail open) when
+* the read is not wired, throws, or answers nothing at all. Throws
+* {@link NcDeviceCompatRefusal} naming every incompatible id, never only the
+* first — an operator fixing the list needs the whole picture in one pass.
+*/
+async function assertRuleDeviceCompat(rule, listDeviceIdsByCaps, judged = rule.conditions.devices ?? []) {
+	const kind = require_clip_model_registry.ruleKindOf(rule);
+	const queries = require_clip_model_registry.ruleDeviceCompatCapQueries(kind);
+	if (queries === null || judged.length === 0) return { outcome: "not-judged" };
+	if (listDeviceIdsByCaps === void 0) return {
+		outcome: "unchecked",
+		reason: "unwired",
+		ids: judged
+	};
+	const read = await readCompatibleIds(queries, listDeviceIdsByCaps);
+	if (!read.ok) return {
+		outcome: "unchecked",
+		reason: "read-failed",
+		ids: judged,
+		error: read.error
+	};
+	if (read.ids.size === 0) return {
+		outcome: "unchecked",
+		reason: "answered-empty",
+		ids: judged
+	};
+	const incompatible = judged.filter((id) => !read.ids.has(id));
+	if (incompatible.length > 0) throw new NcDeviceCompatRefusal(kind, incompatible);
+	return { outcome: "compatible" };
+}
+/**
+* Run the check and report what it could not do: a refusal is dropped work, so
+* it is logged before it is rethrown; an unchecked acceptance is a guard that
+* did not run, so it is logged (sampled) too.
+*/
+async function runAndReport(rule, judged, ctx) {
+	let verdict;
+	try {
+		verdict = await assertRuleDeviceCompat(rule, ctx.listDeviceIdsByCaps, judged);
+	} catch (err) {
+		if (err instanceof NcDeviceCompatRefusal) warnRefusal$2(ctx.logger, err, ctx);
+		throw err;
+	}
+	if (verdict.outcome === "unchecked") warnUnchecked(require_clip_model_registry.ruleKindOf(rule), verdict, ctx);
+}
+function warnRefusal$2(logger, err, ctx) {
+	logger.warn("nc rule refused: device(s) incompatible with the rule kind", { meta: {
+		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+		by: ctx.by,
+		kind: err.kind,
+		incompatibleIds: [...err.incompatibleIds]
+	} });
+}
+function warnUnchecked(kind, verdict, ctx) {
+	const now = (ctx.now ?? Date.now)();
+	const key = `${ctx.ruleId ?? `new:${ctx.by}`}:${verdict.reason}`;
+	if (ctx.sampler !== void 0 && !ctx.sampler.shouldWarn(key, now)) return;
+	ctx.logger.warn("nc rule saved WITHOUT the device-compatibility check — accepted unchecked", { meta: {
+		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+		by: ctx.by,
+		kind,
+		reason: verdict.reason,
+		uncheckedIds: [...verdict.ids],
+		...verdict.error !== void 0 ? { error: verdict.error } : {}
+	} });
+}
+/** The create path: the whole include list is judged. */
+async function guardRuleDeviceCompat(rule, ctx) {
+	await runAndReport(rule, rule.conditions.devices ?? [], ctx);
+}
+/**
+* The update path: the MERGED rule decides the kind, but only the ids the
+* patch ADDS to `conditions.devices` are judged — a stored id is never
+* re-judged (see the file header). A patch that adds nothing never pays for a
+* capability read.
+*/
+async function guardPatchDeviceCompat(existing, patch, ctx) {
+	if (existing === null) return;
+	const merged = mergedFamilySubject(existing, patch);
+	if (merged === null) return;
+	const stored = new Set(existing.conditions.devices ?? []);
+	await runAndReport(merged, (merged.conditions.devices ?? []).filter((id) => !stored.has(id)), ctx);
+}
+//#endregion
 //#region src/notification-center/rule-summary-guard.ts
 /**
 * The hub's half of D647: `systemEventDelivery: { mode: 'summary' }` belongs to
@@ -17218,6 +17460,8 @@ function requireAdmin(caller) {
 	return c;
 }
 function makeNcActionHandlers(deps) {
+	/** One sampler per handler set: an unchecked save warns once per rule per window. */
+	const deviceCompatWarnSampler = new NcDeviceCompatWarnSampler();
 	/** The alarm half, or a refusal by name — never a made-up "disarmed". */
 	const requireAlarm = (action) => {
 		if (deps.alarm === void 0) throw new Error(`${action}: the alarm is not wired on this node`);
@@ -17375,6 +17619,12 @@ function makeNcActionHandlers(deps) {
 				logger: deps.logger,
 				by: c.userId
 			});
+			await guardRuleDeviceCompat(parsed, {
+				logger: deps.logger,
+				by: c.userId,
+				listDeviceIdsByCaps: deps.listDeviceIdsByCaps,
+				sampler: deviceCompatWarnSampler
+			});
 			guardRuleSystemEventDelivery(parsed, {
 				logger: deps.logger,
 				by: c.userId
@@ -17417,6 +17667,13 @@ function makeNcActionHandlers(deps) {
 				by: c.userId,
 				ruleId: input.ruleId
 			});
+			await guardPatchDeviceCompat(existing, patch, {
+				logger: deps.logger,
+				by: c.userId,
+				ruleId: input.ruleId,
+				listDeviceIdsByCaps: deps.listDeviceIdsByCaps,
+				sampler: deviceCompatWarnSampler
+			});
 			guardPatchSystemEventDelivery(existing, patch, clear, {
 				logger: deps.logger,
 				by: c.userId,
@@ -17918,9 +18175,9 @@ function makeNcActionHandlers(deps) {
 * reproduce.
 */
 var NC_CLIP_DISPATCH_MARGIN_SEC = 10;
-/** Does this rule ever cut footage from the broker's clip ring? */
-function wantsFootage(rule) {
-	return rule.media.gif === true || rule.media.clip === true;
+/** Does this media policy ever cut footage from the broker's clip ring? */
+function wantsFootage(media) {
+	return media.gif === true || media.clip === true;
 }
 /** The ask ONE rule makes, or `null` when it needs no retained footage. */
 function askSecondsFor(rule) {
@@ -17929,9 +18186,10 @@ function askSecondsFor(rule) {
 		seconds: require_clip_model_registry.NC_CLIP_RETENTION_MAX_SEC,
 		reason: "occupancy"
 	};
-	if (!wantsFootage(rule)) return null;
-	const pre = rule.media.clipPreRollSec ?? require_clip_model_registry.NC_CLIP_PRE_ROLL_DEFAULT_SEC;
-	const post = rule.media.clipPostRollSec ?? require_clip_model_registry.NC_CLIP_POST_ROLL_DEFAULT_SEC;
+	const media = effectiveMediaPolicyForRule(rule);
+	if (!wantsFootage(media)) return null;
+	const pre = media.clipPreRollSec ?? require_clip_model_registry.NC_CLIP_PRE_ROLL_DEFAULT_SEC;
+	const post = media.clipPostRollSec ?? require_clip_model_registry.NC_CLIP_POST_ROLL_DEFAULT_SEC;
 	return {
 		seconds: Math.min(pre + post + NC_CLIP_DISPATCH_MARGIN_SEC, require_clip_model_registry.NC_CLIP_RETENTION_MAX_SEC),
 		reason: "window"
@@ -17950,12 +18208,13 @@ function deriveClipRetentionAsks(rules) {
 	for (const rule of rules) {
 		const ask = askSecondsFor(rule);
 		if (ask === null) continue;
+		const profile = effectiveMediaPolicyForRule(rule).profile;
 		const base = {
 			seconds: ask.seconds,
 			reason: ask.reason,
 			ruleId: rule.id,
 			ruleName: rule.name,
-			...rule.media.profile !== void 0 ? { profile: rule.media.profile } : {}
+			...profile !== void 0 ? { profile } : {}
 		};
 		const devices = rule.conditions.devices;
 		if (devices === void 0 || devices.length === 0) {
@@ -31569,9 +31828,15 @@ var NC_ALARM_ANNOUNCE_RULE_ID = "nc-alarm-announce";
 * A rule's media policy, as the fields a row freezes — ONE derivation, used by
 * every row a rule addresses AND by the alarm's own announcement row when it is
 * the COMBINED siren (the triggering rule's pictures on the alarm's words).
+*
+* `effectiveMediaPolicyForRule` is what actually resolves it: a SENSOR rule's
+* stored `media` is ignored here, in favour of the one-snapshot default
+* (operator ruling, 2026-10-01) — the rule still LOADS with whatever it has
+* stored, and `buildEntries` is where the sampled log fires when that stored
+* choice is about to be overridden.
 */
 function mediaPolicyFields(mediaRule, cropZoneIds) {
-	const media = mediaRule.media;
+	const media = effectiveMediaPolicyForRule(mediaRule);
 	return {
 		media: media.attach,
 		...media.zoneCrop === true && cropZoneIds !== void 0 ? { mediaZoneIds: [...cropZoneIds] } : {},
@@ -31865,13 +32130,14 @@ function cooldownSubjectKind(kind) {
 * the same builder the live path does, so the two can never address different
 * windows. Only the four fields the key is a function of are reconstructed —
 * the class (for `per-class` and audio), the subject kind (which decides
-* whether audio is keyed per class at all), the system event (subject +
+* whether the class is keyed at all — audio always, occupancy and detections
+* unless `shared`), the system event (subject +
 * direction) and the device.
 */
 function cooldownSubjectFromOutbox(entry) {
 	const subject = entry.payload.subject;
 	return {
-		kind: cooldownSubjectKind(entry.recordKind),
+		kind: entry.recordKind === "device-event" && subject.occupancy !== void 0 ? "occupancy-event" : cooldownSubjectKind(entry.recordKind),
 		recordId: entry.recordId,
 		deviceId: entry.deviceId,
 		timestamp: subject.timestamp,
@@ -31950,6 +32216,9 @@ function renderAudioScope(devices, excluded) {
 	if (devices.length === 0) return excluded.length === 0 ? "@all" : `@all-except:${excluded.join("+")}`;
 	return devices.filter((id) => !excluded.includes(id)).join("+");
 }
+/** {@link NotificationCenter.reportedSensorMediaIgnored} cap, same shape as
+*  the dispatcher's own annotated-fallback memo. */
+var NC_SENSOR_MEDIA_IGNORED_MEMO_MAX = 5e3;
 var NotificationCenter = class NotificationCenter {
 	logger;
 	rules;
@@ -31957,6 +32226,11 @@ var NotificationCenter = class NotificationCenter {
 	dispatcher;
 	deps;
 	now;
+	/** Rule ids whose stored (non-default) media policy has already been
+	*  reported as ignored at evaluation — ONE line per rule, not per fire. */
+	reportedSensorMediaIgnored = /* @__PURE__ */ new Set();
+	/** Samples the device-compat guard's "accepted unchecked" WARN per rule. */
+	deviceCompatWarnSampler = new NcDeviceCompatWarnSampler();
 	/**
 	* Every word this centre can print, in the hub's language.
 	*
@@ -33737,7 +34011,7 @@ var NotificationCenter = class NotificationCenter {
 		const shown = this.unmutedCameras(cameraIds);
 		const involved = [sensorId, ...rowShown];
 		if (!this.rules.listEnabled("device-event").some((rule) => {
-			if (rule.media.attach === "none") return false;
+			if (effectiveMediaPolicyForRule(rule).attach === "none") return false;
 			if (!deviceEventRuleMayFireOnKind(rule, sensorKind, sensorRaised)) return false;
 			const excluded = rule.conditions.devicesExclude;
 			if (excluded !== void 0 && deviceScopeExcludes(excluded, {
@@ -34034,7 +34308,7 @@ var NotificationCenter = class NotificationCenter {
 	ruleWantsOccupancyStill(edge) {
 		const subject = occupancySubjectFromEdge(edge);
 		for (const rule of this.rules.listEnabled("device-event")) {
-			if (rule.media.attach === "none") continue;
+			if (effectiveMediaPolicyForRule(rule).attach === "none") continue;
 			const occ = rule.conditions.occupancy;
 			if (occ === void 0 || !matchesOccupancy(occ, subject)) continue;
 			const devices = rule.conditions.devices;
@@ -34301,6 +34575,12 @@ var NotificationCenter = class NotificationCenter {
 					logger: this.logger,
 					by: caller.userId
 				});
+				await guardRuleDeviceCompat(rule, {
+					logger: this.logger,
+					by: caller.userId,
+					listDeviceIdsByCaps: this.deps.listDeviceIdsByCaps,
+					sampler: this.deviceCompatWarnSampler
+				});
 				guardRuleSystemEventDelivery(rule, {
 					logger: this.logger,
 					by: caller.userId
@@ -34338,6 +34618,13 @@ var NotificationCenter = class NotificationCenter {
 					by: caller.userId,
 					ruleId
 				});
+				await guardPatchDeviceCompat(existing, patch, {
+					logger: this.logger,
+					by: caller.userId,
+					ruleId,
+					listDeviceIdsByCaps: this.deps.listDeviceIdsByCaps,
+					sampler: this.deviceCompatWarnSampler
+				});
 				guardPatchSystemEventDelivery(existing, patch, clear ?? [], {
 					logger: this.logger,
 					by: caller.userId,
@@ -35385,7 +35672,7 @@ var NotificationCenter = class NotificationCenter {
 					buttons: unresolvable.join(", ")
 				}
 			});
-			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && subject.linkedStills === void 0 && rule.media.attach !== "none") {
+			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && subject.linkedStills === void 0 && effectiveMediaPolicyForRule(rule).attach !== "none") {
 				noOwnerReported = true;
 				const linked = subject.linkedCameraIds;
 				const meta = {
@@ -35763,6 +36050,24 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
+	/**
+	* ONE line per rule id, the first time a SENSOR rule's stored media policy
+	* is about to be overridden by {@link effectiveMediaPolicyForRule}'s
+	* one-snapshot default (operator ruling, 2026-10-01). Never refuses the
+	* rule — it still loads and still fires — this only says the stored choice
+	* is not the one being used.
+	*/
+	warnSensorMediaIgnoredOnce(rule) {
+		if (mediaPolicyMatchesSensorDefault(rule.media)) return;
+		if (this.reportedSensorMediaIgnored.has(rule.id)) return;
+		if (this.reportedSensorMediaIgnored.size >= NC_SENSOR_MEDIA_IGNORED_MEMO_MAX) this.reportedSensorMediaIgnored.clear();
+		this.reportedSensorMediaIgnored.add(rule.id);
+		this.logger.info("sensor rule carries a media choice — ignored at evaluation, one snapshot is always attached", { meta: {
+			ruleId: rule.id,
+			rule: rule.name,
+			storedMedia: rule.media
+		} });
+	}
 	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline", cooldown, upgrade, group) {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
@@ -35770,6 +36075,7 @@ var NotificationCenter = class NotificationCenter {
 		const alarmSource = subject.systemEvent?.alarmSource;
 		const mediaRule = alarmSource !== void 0 ? this.rules.get(alarmSource.ruleId) ?? rule : rule;
 		const noMedia = isSystemEvent && alarmSource === void 0;
+		if (require_clip_model_registry.ruleKindOf(mediaRule) === "sensor") this.warnSensorMediaIgnoredOnce(mediaRule);
 		const direct = new Set(rule.targets.map((t) => t.targetId));
 		const renderedZones = notificationZones(rule, subject);
 		const confirm = frozenConfirmPolicy(rule, isSystemEvent);
@@ -98994,6 +99300,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			listCallerTargetIds: async (userId) => {
 				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
 			},
+			listDeviceIdsByCaps: (capNames) => api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...capNames] }),
 			dropRuleMosaics: async (ruleId) => {
 				const mediaStore = this.mediaStore;
 				if (mediaStore === null) return;
@@ -99910,6 +100217,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 					addonId: device.addonId
 				};
 			},
+			listDeviceIdsByCaps: (capNames) => api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...capNames] }),
 			isDeviceDeleted: async (deviceId) => await api.deviceManager.getDevice.query({ deviceId }) === null,
 			readNodeDirectory: () => api.nodes.directory.query(),
 			getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }),