@camstack/addon-post-analysis 1.2.305 → 1.2.307

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-t2ey3w0B.js");
+const require_clip_model_registry = require("../clip-model-registry-C67UM_q_.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -10652,21 +10652,49 @@ function matchesPlate(label, values, maxDistance) {
 	return false;
 }
 /**
+* Subject kinds whose `classNames` is a real, operator-meaningful detection
+* class — the ones the `classes` condition can actually scope a rule to.
+* `device-event` and `system-event` carry NO class live (`classNames: []`,
+* always — see `subjectFromSensorEvent`); their OUTBOX `className` is a
+* display placeholder instead (the sensor kind, or the literal `'event'`,
+* `className: subject.classNames[0] ?? subject.sensorKind ?? 'event'`), which
+* `cooldownSubjectFromOutbox` would otherwise reconstruct as if it were a real
+* class. Gating here, not on the reconstructed value, keeps the live path and
+* the boot reseed addressing the SAME key regardless of what a display label
+* happens to say (2026-10-01, caught by `system-event-cooldown-direction.spec.ts`
+* when the default below flipped).
+*/
+var CLASS_BEARING_SUBJECT_KINDS = new Set([
+	"object-event",
+	"track-end",
+	"package-event",
+	"occupancy-event",
+	"audio-event",
+	"audio-window"
+]);
+/**
 * Should this subject's class be part of the cooldown key?
 *
 * AUDIO is unconditional and predates the setting: a rule opted into several
 * audio classes (dog + scream) must not have a safety-relevant scream
 * swallowed by an unrelated bark's 60 s window.
 *
-* Every other subject gets the same treatment only when the rule ASKS for it
-* (`granularity: 'per-class'`) — cat→dog fires at once, cat→cat still waits.
-* Absent / `shared` reproduces the class-agnostic key byte for byte, because
-* changing how often an operator's existing rules fire is not a side effect
-* anyone asked for.
+* A `device-event` or `system-event` subject never reads a class — see
+* {@link CLASS_BEARING_SUBJECT_KINDS} — so the setting has nothing to key on
+* regardless of `granularity`.
+*
+* Every class-bearing subject gets the same treatment unless the rule
+* explicitly asks for `shared` — cat→dog fires at once, cat→cat still waits.
+* That is the operator's default since 2026-10-01 (D36's dated note): an
+* UNSET rule now reads exactly like an explicit `per-class` one, new rules and
+* existing rules alike. Only a `granularity: 'shared'` actually stored
+* reproduces the old class-agnostic key byte for byte — the one case where an
+* operator asked for one window across every class on purpose.
 */
 function keysPerClass(rule, subject) {
 	if (subject.kind === "audio-event" || subject.kind === "audio-window") return true;
-	return rule.throttle.granularity === "per-class";
+	if (!CLASS_BEARING_SUBJECT_KINDS.has(subject.kind)) return false;
+	return rule.throttle.granularity !== "shared";
 }
 /**
 * The cooldown scope of ONE system event — subject AND direction.
@@ -10751,6 +10779,42 @@ function isCoolingDown(rule, lastFiredAt, now) {
 	return now - lastFiredAt < rule.throttle.cooldownSec * 1e3;
 }
 /**
+* The media policy EVERY sensor rule attaches: one whole-scene photograph,
+* never a selector. `attach: 'keyFrame'` is the existing "clean full scene
+* frame" ladder (`attachmentKindPreference`) — the closest existing concept
+* to a plain snapshot, as opposed to `'best'`/`'best-matching'`, which chase a
+* SUBJECT crop a sensor subject (a doorbell press, a contact change) has
+* none of to chase. No zone crop, no gif, no clip, no profile — a sensor
+* subject has no zone condition to crop to and no reason to animate.
+*/
+var NC_SENSOR_MEDIA_POLICY = { attach: "keyFrame" };
+/**
+* The media policy actually used to build a delivery, for a rule of this
+* KIND. A sensor rule's STORED `media` is never read at evaluation — the
+* editor offers no media control for one any more, and `media.attach` /
+* `.gif` / `.clip` / `.profile` on an existing sensor rule (authored before
+* this ruling, from the viewer or the API) are IGNORED here, never refused at
+* load. See {@link mediaPolicyMatchesSensorDefault} for the sampled-log gate.
+*/
+function effectiveMediaPolicy(rule, kind) {
+	return kind === "sensor" ? NC_SENSOR_MEDIA_POLICY : rule.media;
+}
+/**
+* True when a stored media policy already reads as the sensor default — the
+* gate the boot/evaluation path uses to decide whether an existing sensor
+* rule's stored choice is being silently overridden (and so is worth a
+* sampled log line) or already matches and there is nothing to say.
+*/
+function mediaPolicyMatchesSensorDefault(media) {
+	return media.attach === NC_SENSOR_MEDIA_POLICY.attach && media.frame === void 0 && media.zoneCrop !== true && media.gif !== true && media.clip !== true && media.profile === void 0;
+}
+/** `effectiveMediaPolicy`, resolving the kind itself — the call-site shortcut
+*  every production caller uses; `effectiveMediaPolicy` stays the unit under
+*  test because `ruleKindOf` needs no fixture of its own there. */
+function effectiveMediaPolicyForRule(rule) {
+	return effectiveMediaPolicy(rule, require_clip_model_registry.ruleKindOf(rule));
+}
+/**
 * Ordered media-kind preference for one attachment, per policy and owner.
 * `best` favours the tight subject crop; `keyFrame` the clean scene frame
 * (small variant first — the degrade engine enforces per-backend byte
@@ -14332,11 +14396,11 @@ function logRefusal$3(check, ctx) {
 	try {
 		check();
 	} catch (err) {
-		if (err instanceof NcDevicesExcludeRefusal) warnRefusal$2(ctx.logger, err, ctx);
+		if (err instanceof NcDevicesExcludeRefusal) warnRefusal$3(ctx.logger, err, ctx);
 		throw err;
 	}
 }
-function warnRefusal$2(logger, err, ctx) {
+function warnRefusal$3(logger, err, ctx) {
 	logger.warn("nc rule refused: devicesExclude on a system rule", { meta: {
 		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
 		by: ctx.by,
@@ -14359,6 +14423,184 @@ function guardPatchDevicesExclude(existing, patch, ctx) {
 	logRefusal$3(() => assertDevicesExcludeDelivery(merged), ctx);
 }
 //#endregion
+//#region src/notification-center/device-compat-guard.ts
+/**
+* A NEW or UPDATED rule's `conditions.devices` (the "Only these" INCLUDE list)
+* names only devices that can actually produce this rule's KIND of subject —
+* operator ruling, 2026-10-01: "the DEVICE picker of a rule must offer only
+* devices compatible with the rule type … the server should also refuse a
+* save whose deviceIds include an incompatible device".
+*
+* THE authority, same arrangement as `device-scope-guard.ts` beside it: the
+* cap-provider route (`notificationRules.createRule/updateRule`, index.ts)
+* and the rule bridge (`nc.createRule/updateRule`, nc-actions.ts) both call
+* `guardRuleDeviceCompat` / `guardPatchDeviceCompat`. Which devices a kind
+* may scope is `ruleDeviceCompatCapQueries` (`@camstack/types`) — the SAME
+* table the admin's Devices tab narrows by, so a save can never refuse a
+* device its own picker just offered. A `sensor` rule's set includes every
+* camera: a camera-scoped sensor rule is legitimate (D630 §6).
+*
+* ASYNC, unlike its sibling guards: it has to ask `deviceManager` which
+* devices carry the caps. `listDeviceIdsByCaps` is therefore OPTIONAL on the
+* context — absent on an older wiring, if the cross-addon call throws, or if
+* it answers EMPTY (the registry not yet warm at boot: `getAllBindings`
+* answers `[]` with only a warning, which is not a measurement — D315/D393),
+* the guard FAILS OPEN (never refuses) rather than blocking every save on a
+* read it cannot make (D49). It is never SILENT about it: an unjudged scoped
+* save logs a sampled WARN naming the rule and the reason, so a dropped wiring
+* is visible in production rather than a guard that quietly stopped existing.
+*
+* ON UPDATE only the ids the patch ADDS are judged. A device already stored on
+* the rule is never re-judged: the answer is not stable (switching detection
+* off on a camera removes its `detection-pipeline` binding, D62; an agent
+* camera's native caps are missing during the handshake), and re-judging
+* would make every rule naming that camera un-editable until the operator
+* removed it — losing a scope a later switch-on would not give back.
+*
+* NEVER called at LOAD. `NcRuleSchema.parse` and the store's own read path are
+* untouched — a rule saved before this ruling, or saved while the capability
+* read was unavailable, keeps loading and keeps firing exactly as it does
+* today; only a NEW save attempt is judged.
+*
+* `devicesExclude` is NOT checked: this guard judges what the rule actually
+* MATCHES ON (the include scope), not what it widens away from, and an
+* operator excluding an incompatible device from an "all except" rule is not
+* the mistake this exists to catch.
+*/
+/** How long one rule's "accepted unchecked" WARN stays quiet after it fired. */
+var UNCHECKED_WARN_WINDOW_MS = 10 * 6e4;
+/** Bound on remembered rule keys — cleared whole when exceeded. */
+var UNCHECKED_WARN_MEMO_MAX = 256;
+/**
+* Samples the "accepted unchecked" WARN per rule: an editor that autosaves, or
+* a script, must not turn one unreachable read into a log flood, but the first
+* save of every rule in a window is always reported.
+*/
+var NcDeviceCompatWarnSampler = class {
+	lastWarnedAt = /* @__PURE__ */ new Map();
+	shouldWarn(key, now) {
+		const last = this.lastWarnedAt.get(key);
+		if (last !== void 0 && now - last < UNCHECKED_WARN_WINDOW_MS) return false;
+		if (this.lastWarnedAt.size >= UNCHECKED_WARN_MEMO_MAX) this.lastWarnedAt.clear();
+		this.lastWarnedAt.set(key, now);
+		return true;
+	}
+};
+var NcDeviceCompatRefusal = class extends Error {
+	kind;
+	incompatibleIds;
+	constructor(kind, incompatibleIds) {
+		super(`rule refused: device(s) ${incompatibleIds.join(", ")} cannot produce a '${kind}' rule's subject`);
+		this.name = "NcDeviceCompatRefusal";
+		this.kind = kind;
+		this.incompatibleIds = incompatibleIds;
+	}
+};
+/** The union of every compat query's answer, or why there is none. */
+async function readCompatibleIds(queries, listDeviceIdsByCaps) {
+	try {
+		const answers = await Promise.all(queries.map((capNames) => listDeviceIdsByCaps(capNames)));
+		return {
+			ok: true,
+			ids: new Set(answers.flat())
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: String(err)
+		};
+	}
+}
+/**
+* The check. `judged` is the ids to judge — the whole include list on a
+* create, only the ADDED ids on an update (see the file header).
+*
+* Resolves `not-judged` when the kind has no capability filter
+* (`ruleDeviceCompatCapQueries` is `null`) or there is nothing to judge —
+* "every device" is never refused here. Resolves `unchecked` (fail open) when
+* the read is not wired, throws, or answers nothing at all. Throws
+* {@link NcDeviceCompatRefusal} naming every incompatible id, never only the
+* first — an operator fixing the list needs the whole picture in one pass.
+*/
+async function assertRuleDeviceCompat(rule, listDeviceIdsByCaps, judged = rule.conditions.devices ?? []) {
+	const kind = require_clip_model_registry.ruleKindOf(rule);
+	const queries = require_clip_model_registry.ruleDeviceCompatCapQueries(kind);
+	if (queries === null || judged.length === 0) return { outcome: "not-judged" };
+	if (listDeviceIdsByCaps === void 0) return {
+		outcome: "unchecked",
+		reason: "unwired",
+		ids: judged
+	};
+	const read = await readCompatibleIds(queries, listDeviceIdsByCaps);
+	if (!read.ok) return {
+		outcome: "unchecked",
+		reason: "read-failed",
+		ids: judged,
+		error: read.error
+	};
+	if (read.ids.size === 0) return {
+		outcome: "unchecked",
+		reason: "answered-empty",
+		ids: judged
+	};
+	const incompatible = judged.filter((id) => !read.ids.has(id));
+	if (incompatible.length > 0) throw new NcDeviceCompatRefusal(kind, incompatible);
+	return { outcome: "compatible" };
+}
+/**
+* Run the check and report what it could not do: a refusal is dropped work, so
+* it is logged before it is rethrown; an unchecked acceptance is a guard that
+* did not run, so it is logged (sampled) too.
+*/
+async function runAndReport(rule, judged, ctx) {
+	let verdict;
+	try {
+		verdict = await assertRuleDeviceCompat(rule, ctx.listDeviceIdsByCaps, judged);
+	} catch (err) {
+		if (err instanceof NcDeviceCompatRefusal) warnRefusal$2(ctx.logger, err, ctx);
+		throw err;
+	}
+	if (verdict.outcome === "unchecked") warnUnchecked(require_clip_model_registry.ruleKindOf(rule), verdict, ctx);
+}
+function warnRefusal$2(logger, err, ctx) {
+	logger.warn("nc rule refused: device(s) incompatible with the rule kind", { meta: {
+		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+		by: ctx.by,
+		kind: err.kind,
+		incompatibleIds: [...err.incompatibleIds]
+	} });
+}
+function warnUnchecked(kind, verdict, ctx) {
+	const now = (ctx.now ?? Date.now)();
+	const key = `${ctx.ruleId ?? `new:${ctx.by}`}:${verdict.reason}`;
+	if (ctx.sampler !== void 0 && !ctx.sampler.shouldWarn(key, now)) return;
+	ctx.logger.warn("nc rule saved WITHOUT the device-compatibility check — accepted unchecked", { meta: {
+		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+		by: ctx.by,
+		kind,
+		reason: verdict.reason,
+		uncheckedIds: [...verdict.ids],
+		...verdict.error !== void 0 ? { error: verdict.error } : {}
+	} });
+}
+/** The create path: the whole include list is judged. */
+async function guardRuleDeviceCompat(rule, ctx) {
+	await runAndReport(rule, rule.conditions.devices ?? [], ctx);
+}
+/**
+* The update path: the MERGED rule decides the kind, but only the ids the
+* patch ADDS to `conditions.devices` are judged — a stored id is never
+* re-judged (see the file header). A patch that adds nothing never pays for a
+* capability read.
+*/
+async function guardPatchDeviceCompat(existing, patch, ctx) {
+	if (existing === null) return;
+	const merged = mergedFamilySubject(existing, patch);
+	if (merged === null) return;
+	const stored = new Set(existing.conditions.devices ?? []);
+	await runAndReport(merged, (merged.conditions.devices ?? []).filter((id) => !stored.has(id)), ctx);
+}
+//#endregion
 //#region src/notification-center/rule-summary-guard.ts
 /**
 * The hub's half of D647: `systemEventDelivery: { mode: 'summary' }` belongs to
@@ -17218,6 +17460,8 @@ function requireAdmin(caller) {
 	return c;
 }
 function makeNcActionHandlers(deps) {
+	/** One sampler per handler set: an unchecked save warns once per rule per window. */
+	const deviceCompatWarnSampler = new NcDeviceCompatWarnSampler();
 	/** The alarm half, or a refusal by name — never a made-up "disarmed". */
 	const requireAlarm = (action) => {
 		if (deps.alarm === void 0) throw new Error(`${action}: the alarm is not wired on this node`);
@@ -17375,6 +17619,12 @@ function makeNcActionHandlers(deps) {
 				logger: deps.logger,
 				by: c.userId
 			});
+			await guardRuleDeviceCompat(parsed, {
+				logger: deps.logger,
+				by: c.userId,
+				listDeviceIdsByCaps: deps.listDeviceIdsByCaps,
+				sampler: deviceCompatWarnSampler
+			});
 			guardRuleSystemEventDelivery(parsed, {
 				logger: deps.logger,
 				by: c.userId
@@ -17417,6 +17667,13 @@ function makeNcActionHandlers(deps) {
 				by: c.userId,
 				ruleId: input.ruleId
 			});
+			await guardPatchDeviceCompat(existing, patch, {
+				logger: deps.logger,
+				by: c.userId,
+				ruleId: input.ruleId,
+				listDeviceIdsByCaps: deps.listDeviceIdsByCaps,
+				sampler: deviceCompatWarnSampler
+			});
 			guardPatchSystemEventDelivery(existing, patch, clear, {
 				logger: deps.logger,
 				by: c.userId,
@@ -17918,9 +18175,9 @@ function makeNcActionHandlers(deps) {
 * reproduce.
 */
 var NC_CLIP_DISPATCH_MARGIN_SEC = 10;
-/** Does this rule ever cut footage from the broker's clip ring? */
-function wantsFootage(rule) {
-	return rule.media.gif === true || rule.media.clip === true;
+/** Does this media policy ever cut footage from the broker's clip ring? */
+function wantsFootage(media) {
+	return media.gif === true || media.clip === true;
 }
 /** The ask ONE rule makes, or `null` when it needs no retained footage. */
 function askSecondsFor(rule) {
@@ -17929,9 +18186,10 @@ function askSecondsFor(rule) {
 		seconds: require_clip_model_registry.NC_CLIP_RETENTION_MAX_SEC,
 		reason: "occupancy"
 	};
-	if (!wantsFootage(rule)) return null;
-	const pre = rule.media.clipPreRollSec ?? require_clip_model_registry.NC_CLIP_PRE_ROLL_DEFAULT_SEC;
-	const post = rule.media.clipPostRollSec ?? require_clip_model_registry.NC_CLIP_POST_ROLL_DEFAULT_SEC;
+	const media = effectiveMediaPolicyForRule(rule);
+	if (!wantsFootage(media)) return null;
+	const pre = media.clipPreRollSec ?? require_clip_model_registry.NC_CLIP_PRE_ROLL_DEFAULT_SEC;
+	const post = media.clipPostRollSec ?? require_clip_model_registry.NC_CLIP_POST_ROLL_DEFAULT_SEC;
 	return {
 		seconds: Math.min(pre + post + NC_CLIP_DISPATCH_MARGIN_SEC, require_clip_model_registry.NC_CLIP_RETENTION_MAX_SEC),
 		reason: "window"
@@ -17950,12 +18208,13 @@ function deriveClipRetentionAsks(rules) {
 	for (const rule of rules) {
 		const ask = askSecondsFor(rule);
 		if (ask === null) continue;
+		const profile = effectiveMediaPolicyForRule(rule).profile;
 		const base = {
 			seconds: ask.seconds,
 			reason: ask.reason,
 			ruleId: rule.id,
 			ruleName: rule.name,
-			...rule.media.profile !== void 0 ? { profile: rule.media.profile } : {}
+			...profile !== void 0 ? { profile } : {}
 		};
 		const devices = rule.conditions.devices;
 		if (devices === void 0 || devices.length === 0) {
@@ -19812,6 +20071,114 @@ function ncGroupSubjectText(texts, input) {
 	return texts.join([...names, ...others]);
 }
 //#endregion
+//#region src/notification-center/outbox-key.ts
+/**
+* The record kinds whose `recordId` is a per-table SQLite rowid (D474), and so
+* may be reused after a delete. `device-event` is NOT one: sensor events are
+* TEXT-keyed with a producer-minted id (`sensor-event-store.ts`).
+*/
+var ROWID_RECORD_KINDS = new Set([
+	"object-event",
+	"package-event",
+	"audio-event"
+]);
+/** Is this kind's record id a reusable rowid? See {@link ROWID_RECORD_KINDS}. */
+function isRowidRecordKind(kind) {
+	return ROWID_RECORD_KINDS.has(kind);
+}
+/** The record identity an outbox key input speaks for. */
+function outboxRecordIdentity(input) {
+	return {
+		recordId: input.recordId,
+		deviceId: input.deviceId,
+		recordAt: input.payload.subject.timestamp
+	};
+}
+/**
+* The record GENERATION ref — `<recordId>@<deviceId>:<recordAt>`. Exported for
+* the specs and for a caller that must name a rowid record outside the outbox
+* (none today); a key is always built through {@link outboxEntryId}.
+*/
+function recordGenerationRef(record) {
+	return `${record.recordId}@${String(record.deviceId)}:${String(record.recordAt)}`;
+}
+/**
+* The middle segment of the dedup id:
+*
+*  1. an explicit `dedupRef` (upgrade / burst revision);
+*  2. the track id — `maxPerTrack: 1` (a track id is random, never reused);
+*  3. for a rowid record, its generation ref;
+*  4. the record id as is (synthetic ids already carry device + instant).
+*/
+function outboxDedupRef(input) {
+	if (input.dedupRef !== void 0) return input.dedupRef;
+	if (input.trackId !== void 0) return input.trackId;
+	if (isRowidRecordKind(input.recordKind)) return recordGenerationRef(outboxRecordIdentity(input));
+	return input.recordId;
+}
+/** The outbox row id — the durable per-track / per-record fire guarantee. */
+function outboxEntryId(input) {
+	return `${input.ruleId}:${outboxDedupRef(input)}:${input.targetId}`;
+}
+/**
+* The id this input had BEFORE D694 — but only when it differs from today's,
+* i.e. for a rowid record keyed on its record id. `null` otherwise: there is no
+* older spelling to look for.
+*/
+function legacyOutboxEntryId(input) {
+	if (input.dedupRef !== void 0 || input.trackId !== void 0) return null;
+	if (!isRowidRecordKind(input.recordKind)) return null;
+	return `${input.ruleId}:${input.recordId}:${input.targetId}`;
+}
+/**
+* A STORED row's id as it would be built today, when the row was written under
+* the pre-D694 spelling; `null` when the stored id is already current (or was
+* built from an explicit dedup ref, which a row does not record and which never
+* involved the record id).
+*/
+function translatedLegacyEntryId(storedId, row) {
+	const legacy = legacyOutboxEntryId(row);
+	if (legacy === null || legacy !== storedId) return null;
+	return outboxEntryId(row);
+}
+/**
+* Does a STORED row's payload really carry its record timestamp?
+*
+* The type says it always does, but a stored payload is checked only as an
+* object on the way back from the store (`rowToEntry`), so a malformed or very
+* old row can lack `subject`. Every read of {@link outboxRecordIdentity} on a
+* STORED row is preceded by this check. Takes the payload as `unknown` on
+* purpose: the static type cannot answer the question.
+*/
+function hasRecordTimestamp(payload) {
+	if (typeof payload !== "object" || payload === null || !("subject" in payload)) return false;
+	const subject = payload.subject;
+	return typeof subject === "object" && subject !== null && "timestamp" in subject && typeof subject.timestamp === "number";
+}
+/** Do two rows speak for the same RECORD? Id, camera and record timestamp. */
+function isSameOutboxRecord(a, b) {
+	return a.recordId === b.recordId && a.deviceId === b.deviceId && a.recordAt === b.recordAt;
+}
+/**
+* The scope of the event a payload's `eventId` names.
+*
+* Usually the row's own subject. A COMBINED alarm row is the exception: its
+* subject is the alarm transition (its own instant), while its `eventId` is the
+* triggering rule's event — so the generation is the alarm SOURCE's camera and
+* timestamp (`NcRuleFireRef`), never the transition's.
+*/
+function eventMediaScopeOf(subject) {
+	const source = subject.systemEvent?.alarmSource;
+	if (source !== void 0) return {
+		deviceId: source.deviceId,
+		recordAt: source.timestamp
+	};
+	return {
+		deviceId: subject.deviceId,
+		recordAt: subject.timestamp
+	};
+}
+//#endregion
 //#region src/notification-center/footage-source.ts
 /**
 * Decide where this window must be cut from. Pure and total.
@@ -21777,7 +22144,7 @@ var NcDispatcher = class {
 		});
 		if (policy === "keyFrame" || frame === "full" || frame === "boxed") owners.reverse();
 		for (const owner of owners) try {
-			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
+			const files = owner.kind === "object" ? await this.deps.getMediaForOwner(owner.kind, owner.id, eventMediaScopeOf(subject)) : await this.deps.getMediaForOwner(owner.kind, owner.id);
 			if (files.length === 0) continue;
 			const preference = frame !== void 0 ? framePreference(frame, owner.kind) : policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
 			const ordered = [];
@@ -24062,11 +24429,6 @@ var DEFAULT_MAX_ATTEMPTS = 8;
 var DEFAULT_DRAIN_BATCH = 20;
 /** Dedup ids remembered at boot — bounded to recent rows (dedup horizon). */
 var DEDUP_HYDRATE_WINDOW_MS = 168 * 36e5;
-/** Stable dedup id — the durable per-track/per-record fire guarantee. */
-function outboxEntryId(input) {
-	const dedupRef = input.dedupRef ?? input.trackId ?? input.recordId;
-	return `${input.ruleId}:${dedupRef}:${input.targetId}`;
-}
 var NcOutbox = class {
 	pending = /* @__PURE__ */ new Map();
 	/** Every id ever enqueued within the dedup horizon (incl. sent/dead). */
@@ -24143,20 +24505,27 @@ var NcOutbox = class {
 				}
 			});
 			let superseded = 0;
+			let translated = 0;
 			for (const row of rows) {
-				if (this.knownIds.has(row.id)) {
+				const entry = rowToEntry$1(row.id, row.data);
+				const current = entry === null ? null : this.translateLegacy(row.id, entry);
+				if (this.knownIds.has(row.id) || current !== null && this.knownIds.has(current)) {
 					superseded += 1;
 					continue;
 				}
 				this.knownIds.add(row.id);
-				const entry = rowToEntry$1(row.id, row.data);
+				if (current !== null) {
+					this.knownIds.add(current);
+					translated += 1;
+				}
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
 			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
 				known: this.knownIds.size,
-				superseded
+				superseded,
+				translated
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
@@ -24180,7 +24549,7 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
-			if (!this.horizonLoaded && await this.rowExists(id)) {
+			if (!this.horizonLoaded && await this.alreadyStored(id, input)) {
 				this.knownIds.add(id);
 				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
 					tags: { deviceId: input.deviceId },
@@ -24397,7 +24766,7 @@ var NcOutbox = class {
 	*/
 	async supersede(input) {
 		const wanted = new Set(input.targetIds);
-		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && e.recordId === input.recordId && wanted.has(e.targetId));
+		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && wanted.has(e.targetId) && hasRecordTimestamp(e.payload) && isSameOutboxRecord(outboxRecordIdentity(e), input));
 		let dropped = 0;
 		for (const entry of victims) try {
 			await this.store.delete.mutate({
@@ -24513,6 +24882,81 @@ var NcOutbox = class {
 		await this.mutate(retry);
 	}
 	/**
+	* Cold-horizon dedup: is this intent already a row in the store?
+	*
+	* Today's id first. Then, for a rowid record, the pre-D694 spelling — which
+	* is accepted ONLY when the row found speaks for the SAME record (camera and
+	* record timestamp too). A legacy row of a different record that reused the
+	* rowid is exactly the collision D694 removes, and must not swallow this one.
+	*/
+	async alreadyStored(id, input) {
+		if (await this.rowExists(id)) return true;
+		const legacy = legacyOutboxEntryId(input);
+		if (legacy === null) return false;
+		const row = await this.readRow(legacy);
+		if (row === null) return false;
+		if (!hasRecordTimestamp(row.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — not used for dedup", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					id,
+					legacyId: legacy,
+					ruleId: input.ruleId
+				}
+			});
+			return false;
+		}
+		if (isSameOutboxRecord(outboxRecordIdentity(row), outboxRecordIdentity(input))) return true;
+		this.logger.info("outbox: a pre-D694 row shares this rowid but is a different record — not a duplicate", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				id,
+				legacyId: legacy,
+				legacyDeviceId: row.deviceId,
+				ruleId: input.ruleId
+			}
+		});
+		return false;
+	}
+	/**
+	* The id a stored pre-D694 row would have today, or `null`.
+	*
+	* Guarded per row: a stored payload is validated only as an object
+	* (`rowToEntry`), and a row with no `subject.timestamp` would otherwise throw
+	* inside {@link load} and leave the WHOLE dedup horizon cold. Such a row is
+	* still loaded under its stored id; it just gets no translated twin.
+	*/
+	translateLegacy(storedId, entry) {
+		if (legacyOutboxEntryId(entry) !== storedId) return null;
+		if (!hasRecordTimestamp(entry.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — loaded without translation", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					id: storedId,
+					ruleId: entry.ruleId
+				}
+			});
+			return null;
+		}
+		return translatedLegacyEntryId(storedId, entry);
+	}
+	/** One stored row by id, or `null` (absent, unreadable, or a failed read). */
+	async readRow(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return isStoredRow(row) ? rowToEntry$1(id, row) : null;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+	/**
 	* Does a row already exist under this dedup id?
 	*
 	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
@@ -24606,6 +25050,10 @@ var OUTBOX_RECORD_KINDS = new Set([
 function isOutboxRecordKind(x) {
 	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
 }
+/** `settingsStore.get` answers `unknown` — a guard, never a cast. */
+function isStoredRow(x) {
+	return typeof x === "object" && x !== null && !Array.isArray(x);
+}
 /** A stored row back to an entry — a guard, never a cast. Exported for the
 *  specs that read the store a centre wrote to. */
 function rowToEntry$1(id, data) {
@@ -31569,9 +32017,15 @@ var NC_ALARM_ANNOUNCE_RULE_ID = "nc-alarm-announce";
 * A rule's media policy, as the fields a row freezes — ONE derivation, used by
 * every row a rule addresses AND by the alarm's own announcement row when it is
 * the COMBINED siren (the triggering rule's pictures on the alarm's words).
+*
+* `effectiveMediaPolicyForRule` is what actually resolves it: a SENSOR rule's
+* stored `media` is ignored here, in favour of the one-snapshot default
+* (operator ruling, 2026-10-01) — the rule still LOADS with whatever it has
+* stored, and `buildEntries` is where the sampled log fires when that stored
+* choice is about to be overridden.
 */
 function mediaPolicyFields(mediaRule, cropZoneIds) {
-	const media = mediaRule.media;
+	const media = effectiveMediaPolicyForRule(mediaRule);
 	return {
 		media: media.attach,
 		...media.zoneCrop === true && cropZoneIds !== void 0 ? { mediaZoneIds: [...cropZoneIds] } : {},
@@ -31865,13 +32319,14 @@ function cooldownSubjectKind(kind) {
 * the same builder the live path does, so the two can never address different
 * windows. Only the four fields the key is a function of are reconstructed —
 * the class (for `per-class` and audio), the subject kind (which decides
-* whether audio is keyed per class at all), the system event (subject +
+* whether the class is keyed at all — audio always, occupancy and detections
+* unless `shared`), the system event (subject +
 * direction) and the device.
 */
 function cooldownSubjectFromOutbox(entry) {
 	const subject = entry.payload.subject;
 	return {
-		kind: cooldownSubjectKind(entry.recordKind),
+		kind: entry.recordKind === "device-event" && subject.occupancy !== void 0 ? "occupancy-event" : cooldownSubjectKind(entry.recordKind),
 		recordId: entry.recordId,
 		deviceId: entry.deviceId,
 		timestamp: subject.timestamp,
@@ -31950,6 +32405,9 @@ function renderAudioScope(devices, excluded) {
 	if (devices.length === 0) return excluded.length === 0 ? "@all" : `@all-except:${excluded.join("+")}`;
 	return devices.filter((id) => !excluded.includes(id)).join("+");
 }
+/** {@link NotificationCenter.reportedSensorMediaIgnored} cap, same shape as
+*  the dispatcher's own annotated-fallback memo. */
+var NC_SENSOR_MEDIA_IGNORED_MEMO_MAX = 5e3;
 var NotificationCenter = class NotificationCenter {
 	logger;
 	rules;
@@ -31957,6 +32415,11 @@ var NotificationCenter = class NotificationCenter {
 	dispatcher;
 	deps;
 	now;
+	/** Rule ids whose stored (non-default) media policy has already been
+	*  reported as ignored at evaluation — ONE line per rule, not per fire. */
+	reportedSensorMediaIgnored = /* @__PURE__ */ new Set();
+	/** Samples the device-compat guard's "accepted unchecked" WARN per rule. */
+	deviceCompatWarnSampler = new NcDeviceCompatWarnSampler();
 	/**
 	* Every word this centre can print, in the hub's language.
 	*
@@ -32957,7 +33420,7 @@ var NotificationCenter = class NotificationCenter {
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
 			texts: this.texts,
-			getMediaForOwner: async (ownerKind, ownerId) => {
+			getMediaForOwner: async (ownerKind, ownerId, eventScope) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
 				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
@@ -32966,7 +33429,7 @@ var NotificationCenter = class NotificationCenter {
 				if (linked !== void 0) return linked;
 				const departed = ownerKind === "track" && this.departureFallbacks.has(ownerId);
 				const owner = departed ? await this.resolveDepartedTrack(ownerId) : ownerId;
-				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner);
+				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner, eventScope);
 				if (files.length > 0 || !departed) return files;
 				return this.departureFallbackMedia(ownerId) ?? files;
 			},
@@ -33737,7 +34200,7 @@ var NotificationCenter = class NotificationCenter {
 		const shown = this.unmutedCameras(cameraIds);
 		const involved = [sensorId, ...rowShown];
 		if (!this.rules.listEnabled("device-event").some((rule) => {
-			if (rule.media.attach === "none") return false;
+			if (effectiveMediaPolicyForRule(rule).attach === "none") return false;
 			if (!deviceEventRuleMayFireOnKind(rule, sensorKind, sensorRaised)) return false;
 			const excluded = rule.conditions.devicesExclude;
 			if (excluded !== void 0 && deviceScopeExcludes(excluded, {
@@ -34034,7 +34497,7 @@ var NotificationCenter = class NotificationCenter {
 	ruleWantsOccupancyStill(edge) {
 		const subject = occupancySubjectFromEdge(edge);
 		for (const rule of this.rules.listEnabled("device-event")) {
-			if (rule.media.attach === "none") continue;
+			if (effectiveMediaPolicyForRule(rule).attach === "none") continue;
 			const occ = rule.conditions.occupancy;
 			if (occ === void 0 || !matchesOccupancy(occ, subject)) continue;
 			const devices = rule.conditions.devices;
@@ -34301,6 +34764,12 @@ var NotificationCenter = class NotificationCenter {
 					logger: this.logger,
 					by: caller.userId
 				});
+				await guardRuleDeviceCompat(rule, {
+					logger: this.logger,
+					by: caller.userId,
+					listDeviceIdsByCaps: this.deps.listDeviceIdsByCaps,
+					sampler: this.deviceCompatWarnSampler
+				});
 				guardRuleSystemEventDelivery(rule, {
 					logger: this.logger,
 					by: caller.userId
@@ -34338,6 +34807,13 @@ var NotificationCenter = class NotificationCenter {
 					by: caller.userId,
 					ruleId
 				});
+				await guardPatchDeviceCompat(existing, patch, {
+					logger: this.logger,
+					by: caller.userId,
+					ruleId,
+					listDeviceIdsByCaps: this.deps.listDeviceIdsByCaps,
+					sampler: this.deviceCompatWarnSampler
+				});
 				guardPatchSystemEventDelivery(existing, patch, clear ?? [], {
 					logger: this.logger,
 					by: caller.userId,
@@ -35100,6 +35576,8 @@ var NotificationCenter = class NotificationCenter {
 		const dropped = await this.outbox.supersede({
 			ruleId: source.ruleId,
 			recordId: source.recordId,
+			deviceId: source.deviceId,
+			recordAt: source.timestamp,
 			targetIds: [...combined]
 		});
 		this.logger.info("alarm notification combined with the rule that triggered it", {
@@ -35385,7 +35863,7 @@ var NotificationCenter = class NotificationCenter {
 					buttons: unresolvable.join(", ")
 				}
 			});
-			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && subject.linkedStills === void 0 && rule.media.attach !== "none") {
+			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && subject.linkedStills === void 0 && effectiveMediaPolicyForRule(rule).attach !== "none") {
 				noOwnerReported = true;
 				const linked = subject.linkedCameraIds;
 				const meta = {
@@ -35763,6 +36241,24 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
+	/**
+	* ONE line per rule id, the first time a SENSOR rule's stored media policy
+	* is about to be overridden by {@link effectiveMediaPolicyForRule}'s
+	* one-snapshot default (operator ruling, 2026-10-01). Never refuses the
+	* rule — it still loads and still fires — this only says the stored choice
+	* is not the one being used.
+	*/
+	warnSensorMediaIgnoredOnce(rule) {
+		if (mediaPolicyMatchesSensorDefault(rule.media)) return;
+		if (this.reportedSensorMediaIgnored.has(rule.id)) return;
+		if (this.reportedSensorMediaIgnored.size >= NC_SENSOR_MEDIA_IGNORED_MEMO_MAX) this.reportedSensorMediaIgnored.clear();
+		this.reportedSensorMediaIgnored.add(rule.id);
+		this.logger.info("sensor rule carries a media choice — ignored at evaluation, one snapshot is always attached", { meta: {
+			ruleId: rule.id,
+			rule: rule.name,
+			storedMedia: rule.media
+		} });
+	}
 	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline", cooldown, upgrade, group) {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
@@ -35770,6 +36266,7 @@ var NotificationCenter = class NotificationCenter {
 		const alarmSource = subject.systemEvent?.alarmSource;
 		const mediaRule = alarmSource !== void 0 ? this.rules.get(alarmSource.ruleId) ?? rule : rule;
 		const noMedia = isSystemEvent && alarmSource === void 0;
+		if (require_clip_model_registry.ruleKindOf(mediaRule) === "sensor") this.warnSensorMediaIgnoredOnce(mediaRule);
 		const direct = new Set(rule.targets.map((t) => t.targetId));
 		const renderedZones = notificationZones(rule, subject);
 		const confirm = frozenConfirmPolicy(rule, isSystemEvent);
@@ -95822,6 +96319,30 @@ async function encodeClipQuery(encode, text, modelId, warn) {
 	}
 }
 //#endregion
+//#region src/pipeline-analytics/nc-owner-media-reader.ts
+/** Keep only the rows written for THIS generation of the event id. */
+function ofGeneration(files, scope) {
+	return files.filter((f) => f.timestamp === scope.recordAt);
+}
+function makeNcOwnerMediaReader(deps) {
+	return async (ownerKind, ownerId, eventScope) => {
+		if (ownerKind === "track") return deps.media.listByOwner("track", await deps.resolveTrackOwnerId(ownerId));
+		if (eventScope === void 0) return deps.media.listByOwner("object", ownerId);
+		const onCamera = await deps.media.listByOwner("object", ownerId, eventScope.deviceId);
+		const kept = ofGeneration(onCamera, eventScope);
+		if (kept.length < onCamera.length) deps.logger.warn("event media of another record on a reused event id — not used", {
+			tags: { deviceId: eventScope.deviceId },
+			meta: {
+				ownerId,
+				recordAt: eventScope.recordAt,
+				refused: onCamera.length - kept.length,
+				kept: kept.length
+			}
+		});
+		return kept;
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/store/settings-raw-mirror.ts
 /** How long a mirrored entry is served before a refresh is started behind the
 *  next reader. See the module doc for why this matches the per-kind caches'
@@ -98994,6 +99515,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			listCallerTargetIds: async (userId) => {
 				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
 			},
+			listDeviceIdsByCaps: (capNames) => api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...capNames] }),
 			dropRuleMosaics: async (ruleId) => {
 				const mediaStore = this.mediaStore;
 				if (mediaStore === null) return;
@@ -99910,6 +100432,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 					addonId: device.addonId
 				};
 			},
+			listDeviceIdsByCaps: (capNames) => api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...capNames] }),
 			isDeviceDeleted: async (deviceId) => await api.deviceManager.getDevice.query({ deviceId }) === null,
 			readNodeDirectory: () => api.nodes.directory.query(),
 			getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }),
@@ -100144,7 +100667,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						}
 					});
 				},
-				getMediaForOwner: async (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, await resolveMediaOwnerId(ownerKind, ownerId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner")),
+				getMediaForOwner: makeNcOwnerMediaReader({
+					media: stores.mediaStore,
+					resolveTrackOwnerId: (trackId) => resolveMediaOwnerId("track", trackId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner"),
+					logger: this.ctx.logger.child("nc-media")
+				}),
 				getSubjectTrail: async (deviceId, trackId) => {
 					const dims = this.lastFrameDimsByDevice.get(deviceId);
 					if (dims === void 0 || dims.w <= 0 || dims.h <= 0) return [];