@camstack/addon-post-analysis 1.2.306 → 1.2.307

package/dist/pipeline-analytics/index.js

@@ -20071,6 +20071,114 @@ function ncGroupSubjectText(texts, input) {
 	return texts.join([...names, ...others]);
 }
 //#endregion
+//#region src/notification-center/outbox-key.ts
+/**
+* The record kinds whose `recordId` is a per-table SQLite rowid (D474), and so
+* may be reused after a delete. `device-event` is NOT one: sensor events are
+* TEXT-keyed with a producer-minted id (`sensor-event-store.ts`).
+*/
+var ROWID_RECORD_KINDS = new Set([
+	"object-event",
+	"package-event",
+	"audio-event"
+]);
+/** Is this kind's record id a reusable rowid? See {@link ROWID_RECORD_KINDS}. */
+function isRowidRecordKind(kind) {
+	return ROWID_RECORD_KINDS.has(kind);
+}
+/** The record identity an outbox key input speaks for. */
+function outboxRecordIdentity(input) {
+	return {
+		recordId: input.recordId,
+		deviceId: input.deviceId,
+		recordAt: input.payload.subject.timestamp
+	};
+}
+/**
+* The record GENERATION ref — `<recordId>@<deviceId>:<recordAt>`. Exported for
+* the specs and for a caller that must name a rowid record outside the outbox
+* (none today); a key is always built through {@link outboxEntryId}.
+*/
+function recordGenerationRef(record) {
+	return `${record.recordId}@${String(record.deviceId)}:${String(record.recordAt)}`;
+}
+/**
+* The middle segment of the dedup id:
+*
+*  1. an explicit `dedupRef` (upgrade / burst revision);
+*  2. the track id — `maxPerTrack: 1` (a track id is random, never reused);
+*  3. for a rowid record, its generation ref;
+*  4. the record id as is (synthetic ids already carry device + instant).
+*/
+function outboxDedupRef(input) {
+	if (input.dedupRef !== void 0) return input.dedupRef;
+	if (input.trackId !== void 0) return input.trackId;
+	if (isRowidRecordKind(input.recordKind)) return recordGenerationRef(outboxRecordIdentity(input));
+	return input.recordId;
+}
+/** The outbox row id — the durable per-track / per-record fire guarantee. */
+function outboxEntryId(input) {
+	return `${input.ruleId}:${outboxDedupRef(input)}:${input.targetId}`;
+}
+/**
+* The id this input had BEFORE D694 — but only when it differs from today's,
+* i.e. for a rowid record keyed on its record id. `null` otherwise: there is no
+* older spelling to look for.
+*/
+function legacyOutboxEntryId(input) {
+	if (input.dedupRef !== void 0 || input.trackId !== void 0) return null;
+	if (!isRowidRecordKind(input.recordKind)) return null;
+	return `${input.ruleId}:${input.recordId}:${input.targetId}`;
+}
+/**
+* A STORED row's id as it would be built today, when the row was written under
+* the pre-D694 spelling; `null` when the stored id is already current (or was
+* built from an explicit dedup ref, which a row does not record and which never
+* involved the record id).
+*/
+function translatedLegacyEntryId(storedId, row) {
+	const legacy = legacyOutboxEntryId(row);
+	if (legacy === null || legacy !== storedId) return null;
+	return outboxEntryId(row);
+}
+/**
+* Does a STORED row's payload really carry its record timestamp?
+*
+* The type says it always does, but a stored payload is checked only as an
+* object on the way back from the store (`rowToEntry`), so a malformed or very
+* old row can lack `subject`. Every read of {@link outboxRecordIdentity} on a
+* STORED row is preceded by this check. Takes the payload as `unknown` on
+* purpose: the static type cannot answer the question.
+*/
+function hasRecordTimestamp(payload) {
+	if (typeof payload !== "object" || payload === null || !("subject" in payload)) return false;
+	const subject = payload.subject;
+	return typeof subject === "object" && subject !== null && "timestamp" in subject && typeof subject.timestamp === "number";
+}
+/** Do two rows speak for the same RECORD? Id, camera and record timestamp. */
+function isSameOutboxRecord(a, b) {
+	return a.recordId === b.recordId && a.deviceId === b.deviceId && a.recordAt === b.recordAt;
+}
+/**
+* The scope of the event a payload's `eventId` names.
+*
+* Usually the row's own subject. A COMBINED alarm row is the exception: its
+* subject is the alarm transition (its own instant), while its `eventId` is the
+* triggering rule's event — so the generation is the alarm SOURCE's camera and
+* timestamp (`NcRuleFireRef`), never the transition's.
+*/
+function eventMediaScopeOf(subject) {
+	const source = subject.systemEvent?.alarmSource;
+	if (source !== void 0) return {
+		deviceId: source.deviceId,
+		recordAt: source.timestamp
+	};
+	return {
+		deviceId: subject.deviceId,
+		recordAt: subject.timestamp
+	};
+}
+//#endregion
 //#region src/notification-center/footage-source.ts
 /**
 * Decide where this window must be cut from. Pure and total.
@@ -22036,7 +22144,7 @@ var NcDispatcher = class {
 		});
 		if (policy === "keyFrame" || frame === "full" || frame === "boxed") owners.reverse();
 		for (const owner of owners) try {
-			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
+			const files = owner.kind === "object" ? await this.deps.getMediaForOwner(owner.kind, owner.id, eventMediaScopeOf(subject)) : await this.deps.getMediaForOwner(owner.kind, owner.id);
 			if (files.length === 0) continue;
 			const preference = frame !== void 0 ? framePreference(frame, owner.kind) : policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
 			const ordered = [];
@@ -24321,11 +24429,6 @@ var DEFAULT_MAX_ATTEMPTS = 8;
 var DEFAULT_DRAIN_BATCH = 20;
 /** Dedup ids remembered at boot — bounded to recent rows (dedup horizon). */
 var DEDUP_HYDRATE_WINDOW_MS = 168 * 36e5;
-/** Stable dedup id — the durable per-track/per-record fire guarantee. */
-function outboxEntryId(input) {
-	const dedupRef = input.dedupRef ?? input.trackId ?? input.recordId;
-	return `${input.ruleId}:${dedupRef}:${input.targetId}`;
-}
 var NcOutbox = class {
 	pending = /* @__PURE__ */ new Map();
 	/** Every id ever enqueued within the dedup horizon (incl. sent/dead). */
@@ -24402,20 +24505,27 @@ var NcOutbox = class {
 				}
 			});
 			let superseded = 0;
+			let translated = 0;
 			for (const row of rows) {
-				if (this.knownIds.has(row.id)) {
+				const entry = rowToEntry$1(row.id, row.data);
+				const current = entry === null ? null : this.translateLegacy(row.id, entry);
+				if (this.knownIds.has(row.id) || current !== null && this.knownIds.has(current)) {
 					superseded += 1;
 					continue;
 				}
 				this.knownIds.add(row.id);
-				const entry = rowToEntry$1(row.id, row.data);
+				if (current !== null) {
+					this.knownIds.add(current);
+					translated += 1;
+				}
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
 			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
 				known: this.knownIds.size,
-				superseded
+				superseded,
+				translated
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
@@ -24439,7 +24549,7 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
-			if (!this.horizonLoaded && await this.rowExists(id)) {
+			if (!this.horizonLoaded && await this.alreadyStored(id, input)) {
 				this.knownIds.add(id);
 				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
 					tags: { deviceId: input.deviceId },
@@ -24656,7 +24766,7 @@ var NcOutbox = class {
 	*/
 	async supersede(input) {
 		const wanted = new Set(input.targetIds);
-		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && e.recordId === input.recordId && wanted.has(e.targetId));
+		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && wanted.has(e.targetId) && hasRecordTimestamp(e.payload) && isSameOutboxRecord(outboxRecordIdentity(e), input));
 		let dropped = 0;
 		for (const entry of victims) try {
 			await this.store.delete.mutate({
@@ -24772,6 +24882,81 @@ var NcOutbox = class {
 		await this.mutate(retry);
 	}
 	/**
+	* Cold-horizon dedup: is this intent already a row in the store?
+	*
+	* Today's id first. Then, for a rowid record, the pre-D694 spelling — which
+	* is accepted ONLY when the row found speaks for the SAME record (camera and
+	* record timestamp too). A legacy row of a different record that reused the
+	* rowid is exactly the collision D694 removes, and must not swallow this one.
+	*/
+	async alreadyStored(id, input) {
+		if (await this.rowExists(id)) return true;
+		const legacy = legacyOutboxEntryId(input);
+		if (legacy === null) return false;
+		const row = await this.readRow(legacy);
+		if (row === null) return false;
+		if (!hasRecordTimestamp(row.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — not used for dedup", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					id,
+					legacyId: legacy,
+					ruleId: input.ruleId
+				}
+			});
+			return false;
+		}
+		if (isSameOutboxRecord(outboxRecordIdentity(row), outboxRecordIdentity(input))) return true;
+		this.logger.info("outbox: a pre-D694 row shares this rowid but is a different record — not a duplicate", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				id,
+				legacyId: legacy,
+				legacyDeviceId: row.deviceId,
+				ruleId: input.ruleId
+			}
+		});
+		return false;
+	}
+	/**
+	* The id a stored pre-D694 row would have today, or `null`.
+	*
+	* Guarded per row: a stored payload is validated only as an object
+	* (`rowToEntry`), and a row with no `subject.timestamp` would otherwise throw
+	* inside {@link load} and leave the WHOLE dedup horizon cold. Such a row is
+	* still loaded under its stored id; it just gets no translated twin.
+	*/
+	translateLegacy(storedId, entry) {
+		if (legacyOutboxEntryId(entry) !== storedId) return null;
+		if (!hasRecordTimestamp(entry.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — loaded without translation", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					id: storedId,
+					ruleId: entry.ruleId
+				}
+			});
+			return null;
+		}
+		return translatedLegacyEntryId(storedId, entry);
+	}
+	/** One stored row by id, or `null` (absent, unreadable, or a failed read). */
+	async readRow(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return isStoredRow(row) ? rowToEntry$1(id, row) : null;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+	/**
 	* Does a row already exist under this dedup id?
 	*
 	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
@@ -24865,6 +25050,10 @@ var OUTBOX_RECORD_KINDS = new Set([
 function isOutboxRecordKind(x) {
 	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
 }
+/** `settingsStore.get` answers `unknown` — a guard, never a cast. */
+function isStoredRow(x) {
+	return typeof x === "object" && x !== null && !Array.isArray(x);
+}
 /** A stored row back to an entry — a guard, never a cast. Exported for the
 *  specs that read the store a centre wrote to. */
 function rowToEntry$1(id, data) {
@@ -33231,7 +33420,7 @@ var NotificationCenter = class NotificationCenter {
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
 			texts: this.texts,
-			getMediaForOwner: async (ownerKind, ownerId) => {
+			getMediaForOwner: async (ownerKind, ownerId, eventScope) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
 				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
@@ -33240,7 +33429,7 @@ var NotificationCenter = class NotificationCenter {
 				if (linked !== void 0) return linked;
 				const departed = ownerKind === "track" && this.departureFallbacks.has(ownerId);
 				const owner = departed ? await this.resolveDepartedTrack(ownerId) : ownerId;
-				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner);
+				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner, eventScope);
 				if (files.length > 0 || !departed) return files;
 				return this.departureFallbackMedia(ownerId) ?? files;
 			},
@@ -35387,6 +35576,8 @@ var NotificationCenter = class NotificationCenter {
 		const dropped = await this.outbox.supersede({
 			ruleId: source.ruleId,
 			recordId: source.recordId,
+			deviceId: source.deviceId,
+			recordAt: source.timestamp,
 			targetIds: [...combined]
 		});
 		this.logger.info("alarm notification combined with the rule that triggered it", {
@@ -96128,6 +96319,30 @@ async function encodeClipQuery(encode, text, modelId, warn) {
 	}
 }
 //#endregion
+//#region src/pipeline-analytics/nc-owner-media-reader.ts
+/** Keep only the rows written for THIS generation of the event id. */
+function ofGeneration(files, scope) {
+	return files.filter((f) => f.timestamp === scope.recordAt);
+}
+function makeNcOwnerMediaReader(deps) {
+	return async (ownerKind, ownerId, eventScope) => {
+		if (ownerKind === "track") return deps.media.listByOwner("track", await deps.resolveTrackOwnerId(ownerId));
+		if (eventScope === void 0) return deps.media.listByOwner("object", ownerId);
+		const onCamera = await deps.media.listByOwner("object", ownerId, eventScope.deviceId);
+		const kept = ofGeneration(onCamera, eventScope);
+		if (kept.length < onCamera.length) deps.logger.warn("event media of another record on a reused event id — not used", {
+			tags: { deviceId: eventScope.deviceId },
+			meta: {
+				ownerId,
+				recordAt: eventScope.recordAt,
+				refused: onCamera.length - kept.length,
+				kept: kept.length
+			}
+		});
+		return kept;
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/store/settings-raw-mirror.ts
 /** How long a mirrored entry is served before a refresh is started behind the
 *  next reader. See the module doc for why this matches the per-kind caches'
@@ -100452,7 +100667,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						}
 					});
 				},
-				getMediaForOwner: async (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, await resolveMediaOwnerId(ownerKind, ownerId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner")),
+				getMediaForOwner: makeNcOwnerMediaReader({
+					media: stores.mediaStore,
+					resolveTrackOwnerId: (trackId) => resolveMediaOwnerId("track", trackId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner"),
+					logger: this.ctx.logger.child("nc-media")
+				}),
 				getSubjectTrail: async (deviceId, trackId) => {
 					const dims = this.lastFrameDimsByDevice.get(deviceId);
 					if (dims === void 0 || dims.w <= 0 || dims.h <= 0) return [];

package/dist/pipeline-analytics/index.mjs

@@ -20048,6 +20048,114 @@ function ncGroupSubjectText(texts, input) {
 	return texts.join([...names, ...others]);
 }
 //#endregion
+//#region src/notification-center/outbox-key.ts
+/**
+* The record kinds whose `recordId` is a per-table SQLite rowid (D474), and so
+* may be reused after a delete. `device-event` is NOT one: sensor events are
+* TEXT-keyed with a producer-minted id (`sensor-event-store.ts`).
+*/
+var ROWID_RECORD_KINDS = new Set([
+	"object-event",
+	"package-event",
+	"audio-event"
+]);
+/** Is this kind's record id a reusable rowid? See {@link ROWID_RECORD_KINDS}. */
+function isRowidRecordKind(kind) {
+	return ROWID_RECORD_KINDS.has(kind);
+}
+/** The record identity an outbox key input speaks for. */
+function outboxRecordIdentity(input) {
+	return {
+		recordId: input.recordId,
+		deviceId: input.deviceId,
+		recordAt: input.payload.subject.timestamp
+	};
+}
+/**
+* The record GENERATION ref — `<recordId>@<deviceId>:<recordAt>`. Exported for
+* the specs and for a caller that must name a rowid record outside the outbox
+* (none today); a key is always built through {@link outboxEntryId}.
+*/
+function recordGenerationRef(record) {
+	return `${record.recordId}@${String(record.deviceId)}:${String(record.recordAt)}`;
+}
+/**
+* The middle segment of the dedup id:
+*
+*  1. an explicit `dedupRef` (upgrade / burst revision);
+*  2. the track id — `maxPerTrack: 1` (a track id is random, never reused);
+*  3. for a rowid record, its generation ref;
+*  4. the record id as is (synthetic ids already carry device + instant).
+*/
+function outboxDedupRef(input) {
+	if (input.dedupRef !== void 0) return input.dedupRef;
+	if (input.trackId !== void 0) return input.trackId;
+	if (isRowidRecordKind(input.recordKind)) return recordGenerationRef(outboxRecordIdentity(input));
+	return input.recordId;
+}
+/** The outbox row id — the durable per-track / per-record fire guarantee. */
+function outboxEntryId(input) {
+	return `${input.ruleId}:${outboxDedupRef(input)}:${input.targetId}`;
+}
+/**
+* The id this input had BEFORE D694 — but only when it differs from today's,
+* i.e. for a rowid record keyed on its record id. `null` otherwise: there is no
+* older spelling to look for.
+*/
+function legacyOutboxEntryId(input) {
+	if (input.dedupRef !== void 0 || input.trackId !== void 0) return null;
+	if (!isRowidRecordKind(input.recordKind)) return null;
+	return `${input.ruleId}:${input.recordId}:${input.targetId}`;
+}
+/**
+* A STORED row's id as it would be built today, when the row was written under
+* the pre-D694 spelling; `null` when the stored id is already current (or was
+* built from an explicit dedup ref, which a row does not record and which never
+* involved the record id).
+*/
+function translatedLegacyEntryId(storedId, row) {
+	const legacy = legacyOutboxEntryId(row);
+	if (legacy === null || legacy !== storedId) return null;
+	return outboxEntryId(row);
+}
+/**
+* Does a STORED row's payload really carry its record timestamp?
+*
+* The type says it always does, but a stored payload is checked only as an
+* object on the way back from the store (`rowToEntry`), so a malformed or very
+* old row can lack `subject`. Every read of {@link outboxRecordIdentity} on a
+* STORED row is preceded by this check. Takes the payload as `unknown` on
+* purpose: the static type cannot answer the question.
+*/
+function hasRecordTimestamp(payload) {
+	if (typeof payload !== "object" || payload === null || !("subject" in payload)) return false;
+	const subject = payload.subject;
+	return typeof subject === "object" && subject !== null && "timestamp" in subject && typeof subject.timestamp === "number";
+}
+/** Do two rows speak for the same RECORD? Id, camera and record timestamp. */
+function isSameOutboxRecord(a, b) {
+	return a.recordId === b.recordId && a.deviceId === b.deviceId && a.recordAt === b.recordAt;
+}
+/**
+* The scope of the event a payload's `eventId` names.
+*
+* Usually the row's own subject. A COMBINED alarm row is the exception: its
+* subject is the alarm transition (its own instant), while its `eventId` is the
+* triggering rule's event — so the generation is the alarm SOURCE's camera and
+* timestamp (`NcRuleFireRef`), never the transition's.
+*/
+function eventMediaScopeOf(subject) {
+	const source = subject.systemEvent?.alarmSource;
+	if (source !== void 0) return {
+		deviceId: source.deviceId,
+		recordAt: source.timestamp
+	};
+	return {
+		deviceId: subject.deviceId,
+		recordAt: subject.timestamp
+	};
+}
+//#endregion
 //#region src/notification-center/footage-source.ts
 /**
 * Decide where this window must be cut from. Pure and total.
@@ -22013,7 +22121,7 @@ var NcDispatcher = class {
 		});
 		if (policy === "keyFrame" || frame === "full" || frame === "boxed") owners.reverse();
 		for (const owner of owners) try {
-			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
+			const files = owner.kind === "object" ? await this.deps.getMediaForOwner(owner.kind, owner.id, eventMediaScopeOf(subject)) : await this.deps.getMediaForOwner(owner.kind, owner.id);
 			if (files.length === 0) continue;
 			const preference = frame !== void 0 ? framePreference(frame, owner.kind) : policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
 			const ordered = [];
@@ -24298,11 +24406,6 @@ var DEFAULT_MAX_ATTEMPTS = 8;
 var DEFAULT_DRAIN_BATCH = 20;
 /** Dedup ids remembered at boot — bounded to recent rows (dedup horizon). */
 var DEDUP_HYDRATE_WINDOW_MS = 168 * 36e5;
-/** Stable dedup id — the durable per-track/per-record fire guarantee. */
-function outboxEntryId(input) {
-	const dedupRef = input.dedupRef ?? input.trackId ?? input.recordId;
-	return `${input.ruleId}:${dedupRef}:${input.targetId}`;
-}
 var NcOutbox = class {
 	pending = /* @__PURE__ */ new Map();
 	/** Every id ever enqueued within the dedup horizon (incl. sent/dead). */
@@ -24379,20 +24482,27 @@ var NcOutbox = class {
 				}
 			});
 			let superseded = 0;
+			let translated = 0;
 			for (const row of rows) {
-				if (this.knownIds.has(row.id)) {
+				const entry = rowToEntry$1(row.id, row.data);
+				const current = entry === null ? null : this.translateLegacy(row.id, entry);
+				if (this.knownIds.has(row.id) || current !== null && this.knownIds.has(current)) {
 					superseded += 1;
 					continue;
 				}
 				this.knownIds.add(row.id);
-				const entry = rowToEntry$1(row.id, row.data);
+				if (current !== null) {
+					this.knownIds.add(current);
+					translated += 1;
+				}
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
 			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
 				known: this.knownIds.size,
-				superseded
+				superseded,
+				translated
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
@@ -24416,7 +24526,7 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
-			if (!this.horizonLoaded && await this.rowExists(id)) {
+			if (!this.horizonLoaded && await this.alreadyStored(id, input)) {
 				this.knownIds.add(id);
 				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
 					tags: { deviceId: input.deviceId },
@@ -24633,7 +24743,7 @@ var NcOutbox = class {
 	*/
 	async supersede(input) {
 		const wanted = new Set(input.targetIds);
-		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && e.recordId === input.recordId && wanted.has(e.targetId));
+		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && wanted.has(e.targetId) && hasRecordTimestamp(e.payload) && isSameOutboxRecord(outboxRecordIdentity(e), input));
 		let dropped = 0;
 		for (const entry of victims) try {
 			await this.store.delete.mutate({
@@ -24749,6 +24859,81 @@ var NcOutbox = class {
 		await this.mutate(retry);
 	}
 	/**
+	* Cold-horizon dedup: is this intent already a row in the store?
+	*
+	* Today's id first. Then, for a rowid record, the pre-D694 spelling — which
+	* is accepted ONLY when the row found speaks for the SAME record (camera and
+	* record timestamp too). A legacy row of a different record that reused the
+	* rowid is exactly the collision D694 removes, and must not swallow this one.
+	*/
+	async alreadyStored(id, input) {
+		if (await this.rowExists(id)) return true;
+		const legacy = legacyOutboxEntryId(input);
+		if (legacy === null) return false;
+		const row = await this.readRow(legacy);
+		if (row === null) return false;
+		if (!hasRecordTimestamp(row.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — not used for dedup", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					id,
+					legacyId: legacy,
+					ruleId: input.ruleId
+				}
+			});
+			return false;
+		}
+		if (isSameOutboxRecord(outboxRecordIdentity(row), outboxRecordIdentity(input))) return true;
+		this.logger.info("outbox: a pre-D694 row shares this rowid but is a different record — not a duplicate", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				id,
+				legacyId: legacy,
+				legacyDeviceId: row.deviceId,
+				ruleId: input.ruleId
+			}
+		});
+		return false;
+	}
+	/**
+	* The id a stored pre-D694 row would have today, or `null`.
+	*
+	* Guarded per row: a stored payload is validated only as an object
+	* (`rowToEntry`), and a row with no `subject.timestamp` would otherwise throw
+	* inside {@link load} and leave the WHOLE dedup horizon cold. Such a row is
+	* still loaded under its stored id; it just gets no translated twin.
+	*/
+	translateLegacy(storedId, entry) {
+		if (legacyOutboxEntryId(entry) !== storedId) return null;
+		if (!hasRecordTimestamp(entry.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — loaded without translation", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					id: storedId,
+					ruleId: entry.ruleId
+				}
+			});
+			return null;
+		}
+		return translatedLegacyEntryId(storedId, entry);
+	}
+	/** One stored row by id, or `null` (absent, unreadable, or a failed read). */
+	async readRow(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return isStoredRow(row) ? rowToEntry$1(id, row) : null;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+	/**
 	* Does a row already exist under this dedup id?
 	*
 	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
@@ -24842,6 +25027,10 @@ var OUTBOX_RECORD_KINDS = new Set([
 function isOutboxRecordKind(x) {
 	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
 }
+/** `settingsStore.get` answers `unknown` — a guard, never a cast. */
+function isStoredRow(x) {
+	return typeof x === "object" && x !== null && !Array.isArray(x);
+}
 /** A stored row back to an entry — a guard, never a cast. Exported for the
 *  specs that read the store a centre wrote to. */
 function rowToEntry$1(id, data) {
@@ -33208,7 +33397,7 @@ var NotificationCenter = class NotificationCenter {
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
 			texts: this.texts,
-			getMediaForOwner: async (ownerKind, ownerId) => {
+			getMediaForOwner: async (ownerKind, ownerId, eventScope) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
 				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
@@ -33217,7 +33406,7 @@ var NotificationCenter = class NotificationCenter {
 				if (linked !== void 0) return linked;
 				const departed = ownerKind === "track" && this.departureFallbacks.has(ownerId);
 				const owner = departed ? await this.resolveDepartedTrack(ownerId) : ownerId;
-				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner);
+				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner, eventScope);
 				if (files.length > 0 || !departed) return files;
 				return this.departureFallbackMedia(ownerId) ?? files;
 			},
@@ -35364,6 +35553,8 @@ var NotificationCenter = class NotificationCenter {
 		const dropped = await this.outbox.supersede({
 			ruleId: source.ruleId,
 			recordId: source.recordId,
+			deviceId: source.deviceId,
+			recordAt: source.timestamp,
 			targetIds: [...combined]
 		});
 		this.logger.info("alarm notification combined with the rule that triggered it", {
@@ -96033,6 +96224,30 @@ async function encodeClipQuery(encode, text, modelId, warn) {
 	}
 }
 //#endregion
+//#region src/pipeline-analytics/nc-owner-media-reader.ts
+/** Keep only the rows written for THIS generation of the event id. */
+function ofGeneration(files, scope) {
+	return files.filter((f) => f.timestamp === scope.recordAt);
+}
+function makeNcOwnerMediaReader(deps) {
+	return async (ownerKind, ownerId, eventScope) => {
+		if (ownerKind === "track") return deps.media.listByOwner("track", await deps.resolveTrackOwnerId(ownerId));
+		if (eventScope === void 0) return deps.media.listByOwner("object", ownerId);
+		const onCamera = await deps.media.listByOwner("object", ownerId, eventScope.deviceId);
+		const kept = ofGeneration(onCamera, eventScope);
+		if (kept.length < onCamera.length) deps.logger.warn("event media of another record on a reused event id — not used", {
+			tags: { deviceId: eventScope.deviceId },
+			meta: {
+				ownerId,
+				recordAt: eventScope.recordAt,
+				refused: onCamera.length - kept.length,
+				kept: kept.length
+			}
+		});
+		return kept;
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/store/settings-raw-mirror.ts
 /** How long a mirrored entry is served before a refresh is started behind the
 *  next reader. See the module doc for why this matches the per-kind caches'
@@ -100357,7 +100572,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						}
 					});
 				},
-				getMediaForOwner: async (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, await resolveMediaOwnerId(ownerKind, ownerId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner")),
+				getMediaForOwner: makeNcOwnerMediaReader({
+					media: stores.mediaStore,
+					resolveTrackOwnerId: (trackId) => resolveMediaOwnerId("track", trackId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner"),
+					logger: this.ctx.logger.child("nc-media")
+				}),
 				getSubjectTrail: async (deviceId, trackId) => {
 					const dims = this.lastFrameDimsByDevice.get(deviceId);
 					if (dims === void 0 || dims.w <= 0 || dims.h <= 0) return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.306",
+  "version": "1.2.307",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",