@camstack/addon-post-analysis 1.2.316 → 1.2.320

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-D-zzCBKK.js");
+const require_clip_model_registry = require("../clip-model-registry-C_aKxHpy.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -604,7 +604,19 @@ var ARM_ANYWAY_TTL_MS = 5 * 6e4;
 var NcAlarmOpenDeviceSchema = require_clip_model_registry.object({
 	deviceId: require_clip_model_registry.number().int(),
 	name: require_clip_model_registry.string(),
-	state: require_clip_model_registry.string()
+	state: require_clip_model_registry.string(),
+	/**
+	* Cover / lock / switch — default false so an older bridge answer still
+	* parses as a contact-style opening.
+	*/
+	controllable: require_clip_model_registry.boolean().default(false),
+	/** Opening cap that produced the reading; used to actuate secure-on-arm. */
+	cap: require_clip_model_registry._enum([
+		"contact",
+		"cover",
+		"lock-control",
+		"switch"
+	]).optional()
 }).readonly();
 /** Why an Arm anyway was not honoured — see `NcAlarmPanelDevice.armAnyway`. */
 var NcAlarmArmAnywayRejectionSchema = require_clip_model_registry._enum([
@@ -669,23 +681,22 @@ function alarmCoveredDevices(rules, panelDeviceId, mode) {
 /**
 * Refuse or arm — the whole decision, as one partition of the open devices.
 *
-* A device may be open at arm time for exactly two reasons: the mode TOLERATES
-* it (its non-blocking list), or the operator was shown it in a refusal and
-* pressed that refusal's Arm anyway (`acknowledged`). Anything else open
-* refuses — including a device that opened AFTER the refusal the operator is
-* confirming: they were never shown it, and excluding it would arm the alarm
-* around an opening nobody agreed to.
+* A device may be open at arm time when:
+*  - the mode TOLERATES it (`nonBlocking` for contacts),
+*  - it is controllable and NOT on the mode's `blocking` list (default),
+*  - or the operator confirmed it with Arm anyway (`acknowledged`).
 *
-* There is no memory here. A plain arm pressed twice is the same question
-* twice and gets the same answer; the only way past a refusal is the explicit
-* Arm anyway, whose lifecycle (one-shot, stale, expired) the panel owns.
+* Anything else open refuses — including a device that opened AFTER the refusal
+* the operator is confirming.
 *
 * Excluded is EVERY open device — tolerated and acknowledged alike — and the
 * exclusion is two-phase (`alarm-exclusions.ts`): each one is watched again
 * once it has closed and opened.
 */
 function decideArm(input) {
+	const forceBlock = new Set(input.blocking ?? []);
 	const tolerated = new Set([...input.nonBlocking, ...input.acknowledged ?? []]);
+	for (const d of input.open) if (d.controllable && !forceBlock.has(d.deviceId)) tolerated.add(d.deviceId);
 	const blocking = input.open.filter((d) => !tolerated.has(d.deviceId));
 	if (blocking.length > 0) return {
 		kind: "refused",
@@ -1073,39 +1084,24 @@ var NcActionPlane = class {
 * and never open):
 *
 *  - `not-opening` — no opening slice at all: a camera named by an intrusion
-*    rule, a switch. It takes no part in the arm decision.
+*    rule. It takes no part in the arm decision.
 *  - `unknown` — an opening cap's slice IS there, but its field is missing or
 *    is not a word that cap defines, or the slice is a provider's PLACEHOLDER
-*    (`lastChangedAt === 0`: written by a constructor before anybody read the
-*    device — an HA lock's `unlocked`, an HA cover's `closed`, a binary
-*    sensor's `entryOpen: false`). It carries the cap and the raw value (for a
-*    placeholder, the whole slice) so the caller's log line can say what it
-*    saw. It never blocks and is never armed as secure on a guess — and a
-*    placeholder is never taken for a state, so neither the reconcile tick,
-*    the arm check nor an exclusion lift acts on one.
-*  - `reading` — open or secure, with the state word a person will read.
-*    ANY non-zero `lastChangedAt` is a reading, however old — including `1`,
-*    the stamp a provider writes on a value it REPLAYED after a respawn with
-*    no upstream change time (Homematic `HM_SEEDED_CHANGED_AT`): the value is
-*    known, only its change time is not. The transition gate
-*    (`sensor-transition-gate.ts`, "A placeholder slice is not a state") reads
-*    the same stamp as "not a fresh event"; `0` alone means "not read yet".
+*    (`lastChangedAt === 0`). It never blocks and is never armed as secure on a
+*    guess.
+*  - `reading` — open or secure, with the state word a person will read and the
+*    cap that produced it (so secure-on-arm knows what to actuate).
 *
 * A read that FAILED never reaches {@link alarmOpeningFrom}: the caller leaves
 * that id out of its answer (see {@link readAlarmOpenings}).
 *
 * Anything short of fully secure is open: a cover stopped half-way, a lock that
-* jammed, a cover still closing when the arm is decided.
+* jammed, a cover still closing when the arm is decided, a switch that is on.
 *
 * PRECEDENCE, when one device carries more than one opening slice: `contact`
-* first, then `cover`, then `lock-control`. The contact is the physical truth
-* about the opening — a reed switch on the frame says the window is open even
-* when the motor's last reported word says `closed`. A slice that cannot be
-* read falls through to the next; only when none of them reads is the device
-* `unknown`, naming the first unreadable cap.
-*
-* The vocabulary of each word is its cap's own schema (`CoverStateSchema`,
-* `LockStateSchema`) — a word the cap does not define is not guessed at.
+* first, then `cover`, then `lock-control`, then `switch`. The contact is the
+* physical truth about the opening — a reed switch on the frame says the window
+* is open even when the motor's last reported word says `closed`.
 */
 /** The one state word, per cap, that counts as secure. Everything else is open. */
 var COVER_SECURE = "closed";
@@ -1124,11 +1120,12 @@ function fieldOf(slice, field) {
 function isPlaceholder(slice) {
 	return fieldOf(slice, "lastChangedAt") === 0;
 }
-function reading(word, secure) {
+function reading(word, secure, cap) {
 	return {
 		kind: "reading",
 		reading: word === secure ? "secure" : "open",
-		state: word
+		state: word,
+		cap
 	};
 }
 function readContact(runtime) {
@@ -1148,11 +1145,13 @@ function readContact(runtime) {
 	return raw ? {
 		kind: "reading",
 		reading: "open",
-		state: "open"
+		state: "open",
+		cap: "contact"
 	} : {
 		kind: "reading",
 		reading: "secure",
-		state: "closed"
+		state: "closed",
+		cap: "contact"
 	};
 }
 function readCover(runtime) {
@@ -1165,7 +1164,7 @@ function readCover(runtime) {
 	};
 	const raw = fieldOf(slice, "state");
 	const parsed = require_clip_model_registry.CoverStateSchema.safeParse(raw);
-	return parsed.success ? reading(parsed.data, COVER_SECURE) : {
+	return parsed.success ? reading(parsed.data, COVER_SECURE, "cover") : {
 		kind: "unknown",
 		cap: "cover",
 		raw
@@ -1181,19 +1180,46 @@ function readLock(runtime) {
 	};
 	const raw = fieldOf(slice, "state");
 	const parsed = require_clip_model_registry.LockStateSchema.safeParse(raw);
-	return parsed.success ? reading(parsed.data, LOCK_SECURE) : {
+	return parsed.success ? reading(parsed.data, LOCK_SECURE, "lock-control") : {
 		kind: "unknown",
 		cap: "lock-control",
 		raw
 	};
 }
+function readSwitch(runtime) {
+	const slice = sliceOf(runtime, "switch");
+	if (slice === void 0) return { kind: "absent" };
+	if (isPlaceholder(slice)) return {
+		kind: "unknown",
+		cap: "switch",
+		raw: slice
+	};
+	const raw = fieldOf(slice, "on");
+	if (typeof raw !== "boolean") return {
+		kind: "unknown",
+		cap: "switch",
+		raw
+	};
+	return raw ? {
+		kind: "reading",
+		reading: "open",
+		state: "on",
+		cap: "switch"
+	} : {
+		kind: "reading",
+		reading: "secure",
+		state: "off",
+		cap: "switch"
+	};
+}
 /** D630's table over one device's runtime slices — see the header for the three answers. */
 function alarmOpeningFrom(runtime) {
 	let firstUnknown = null;
 	for (const read of [
 		readContact(runtime),
 		readCover(runtime),
-		readLock(runtime)
+		readLock(runtime),
+		readSwitch(runtime)
 	]) {
 		if (read.kind === "reading") return read;
 		if (read.kind === "unknown" && firstUnknown === null) firstUnknown = read;
@@ -1208,13 +1234,14 @@ function alarmOpeningFrom(runtime) {
 var OPENING_CAP_BY_EVENT_KIND = {
 	contact: "contact",
 	cover: "cover",
-	lock: "lock-control"
+	lock: "lock-control",
+	switch: "switch"
 };
 /**
 * The same table, read off one sensor-event row: its `value` IS the slice of
 * the cap its `kind` names, so the event path and the reconcile read answer in
 * one vocabulary — a cover is secure only when `closed`, a lock only when
-* `locked`, whichever path saw it.
+* `locked`, a switch only when off, whichever path saw it.
 */
 function alarmOpeningFromSensorEvent(kind, value) {
 	const cap = OPENING_CAP_BY_EVENT_KIND[kind];
@@ -1235,7 +1262,9 @@ function classifyCoveredOpening(opening) {
 	if (opening.kind === "not-opening" || opening.reading !== "open") return { kind: "skip" };
 	return {
 		kind: "open",
-		state: opening.state
+		state: opening.state,
+		controllable: require_clip_model_registry.isAlarmControllableCap(opening.cap),
+		cap: opening.cap
 	};
 }
 /**
@@ -1892,6 +1921,22 @@ var ncAlarmPanelSchema = require_clip_model_registry.object({
 		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
 	})).default([]),
 	/**
+	* Controllable openings that DO block when open (opt-in). Loose + guarded like
+	* {@link nonBlocking}.
+	*/
+	blocking: require_clip_model_registry.array(require_clip_model_registry.object({
+		mode: require_clip_model_registry.string(),
+		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
+	})).default([]),
+	/**
+	* Controllable openings that must NOT secure on arm (opt-out). Loose + guarded
+	* like {@link nonBlocking}.
+	*/
+	secureOnArmOff: require_clip_model_registry.array(require_clip_model_registry.object({
+		mode: require_clip_model_registry.string(),
+		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
+	})).default([]),
+	/**
 	* Per arm mode, the delays that override the global ones (D697). Loose on purpose — `mode` is
 	* a string and the numbers are unbounded here — and read back through
 	* {@link modeDelaysFromPersisted}, never a cast: an entry this release cannot trust is dropped
@@ -1910,7 +1955,7 @@ var ncAlarmPanelSchema = require_clip_model_registry.object({
 * per mode kept — the same "at most one list per mode" the settings schema
 * enforces at the boundary. A type guard (`safeParse`), never a cast.
 */
-function nonBlockingFromPersisted(raw) {
+function modeDeviceListFromPersisted(raw) {
 	const seen = /* @__PURE__ */ new Set();
 	const lists = [];
 	for (const entry of raw) {
@@ -2015,7 +2060,9 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			...this.readDelays(),
 			announceArm: this.config.get("announceArm"),
 			announceTargets: [...this.config.get("announceTargets")],
-			nonBlocking: nonBlockingFromPersisted(this.config.get("nonBlocking")),
+			nonBlocking: modeDeviceListFromPersisted(this.config.get("nonBlocking")),
+			blocking: modeDeviceListFromPersisted(this.config.get("blocking")),
+			secureOnArmOff: modeDeviceListFromPersisted(this.config.get("secureOnArmOff")),
 			modeDelays: modeDelaysFromPersisted(this.config.get("modeDelays")).entries
 		};
 	}
@@ -2042,30 +2089,73 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	async applySettings(patch) {
 		const edits = patch.modeDelays ?? [];
 		const membership = patch.nonBlockingEdit;
+		const blockingEdit = patch.blockingEdit;
+		const secureEdit = patch.secureOnArmEdit;
 		for (const edit of edits) this.refuseUnofferedMode(edit.mode);
 		if (membership !== void 0) {
 			this.refuseUnofferedMode(membership.mode, membership.deviceId);
-			const verdict = require_clip_model_registry.applyNonBlockingEdit(patch.nonBlocking !== void 0 ? patch.nonBlocking : nonBlockingFromPersisted(this.config.get("nonBlocking")), membership);
+			const verdict = require_clip_model_registry.applyNonBlockingEdit(patch.nonBlocking !== void 0 ? patch.nonBlocking : modeDeviceListFromPersisted(this.config.get("nonBlocking")), membership);
 			if (verdict.kind === "refused") {
 				this.ctx.logger.info("alarm settings refused", {
 					tags: { deviceId: membership.deviceId },
 					meta: {
 						panelId: this.id,
 						reason: "list-full",
-						mode: verdict.mode
+						mode: verdict.mode,
+						list: "nonBlocking"
 					}
 				});
 				throw new Error(`the ${verdict.mode} non-blocking list already holds ${verdict.max} devices — remove one first`);
 			}
 		}
+		if (blockingEdit !== void 0) {
+			this.refuseUnofferedMode(blockingEdit.mode, blockingEdit.deviceId);
+			const verdict = require_clip_model_registry.applyBlockingEdit(patch.blocking !== void 0 ? patch.blocking : modeDeviceListFromPersisted(this.config.get("blocking")), blockingEdit);
+			if (verdict.kind === "refused") {
+				this.ctx.logger.info("alarm settings refused", {
+					tags: { deviceId: blockingEdit.deviceId },
+					meta: {
+						panelId: this.id,
+						reason: "list-full",
+						mode: verdict.mode,
+						list: "blocking"
+					}
+				});
+				throw new Error(`the ${verdict.mode} blocking list already holds ${verdict.max} devices — remove one first`);
+			}
+		}
+		if (secureEdit !== void 0) {
+			this.refuseUnofferedMode(secureEdit.mode, secureEdit.deviceId);
+			const verdict = require_clip_model_registry.applySecureOnArmEdit(patch.secureOnArmOff !== void 0 ? patch.secureOnArmOff : modeDeviceListFromPersisted(this.config.get("secureOnArmOff")), secureEdit);
+			if (verdict.kind === "refused") {
+				this.ctx.logger.info("alarm settings refused", {
+					tags: { deviceId: secureEdit.deviceId },
+					meta: {
+						panelId: this.id,
+						reason: "list-full",
+						mode: verdict.mode,
+						list: "secureOnArmOff"
+					}
+				});
+				throw new Error(`the ${verdict.mode} secure-on-arm-off list already holds ${verdict.max} devices — remove one first`);
+			}
+		}
 		const listWrites = [];
 		if (patch.nonBlocking !== void 0) listWrites.push(this.config.set("nonBlocking", patch.nonBlocking.map((l) => ({
 			mode: l.mode,
 			deviceIds: [...l.deviceIds]
 		}))));
+		if (patch.blocking !== void 0) listWrites.push(this.config.set("blocking", patch.blocking.map((l) => ({
+			mode: l.mode,
+			deviceIds: [...l.deviceIds]
+		}))));
+		if (patch.secureOnArmOff !== void 0) listWrites.push(this.config.set("secureOnArmOff", patch.secureOnArmOff.map((l) => ({
+			mode: l.mode,
+			deviceIds: [...l.deviceIds]
+		}))));
 		let membershipChanged = null;
 		if (membership !== void 0) {
-			const result = require_clip_model_registry.applyNonBlockingEdit(nonBlockingFromPersisted(this.config.get("nonBlocking")), membership);
+			const result = require_clip_model_registry.applyNonBlockingEdit(modeDeviceListFromPersisted(this.config.get("nonBlocking")), membership);
 			if (result.kind === "applied") {
 				membershipChanged = result.changed;
 				if (result.changed) listWrites.push(this.config.set("nonBlocking", result.lists.map((l) => ({
@@ -2074,6 +2164,26 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 				}))));
 			}
 		}
+		if (blockingEdit !== void 0) {
+			const result = require_clip_model_registry.applyBlockingEdit(modeDeviceListFromPersisted(this.config.get("blocking")), blockingEdit);
+			if (result.kind === "applied" && result.changed) {
+				membershipChanged = true;
+				listWrites.push(this.config.set("blocking", result.lists.map((l) => ({
+					mode: l.mode,
+					deviceIds: [...l.deviceIds]
+				}))));
+			}
+		}
+		if (secureEdit !== void 0) {
+			const result = require_clip_model_registry.applySecureOnArmEdit(modeDeviceListFromPersisted(this.config.get("secureOnArmOff")), secureEdit);
+			if (result.kind === "applied" && result.changed) {
+				membershipChanged = true;
+				listWrites.push(this.config.set("secureOnArmOff", result.lists.map((l) => ({
+					mode: l.mode,
+					deviceIds: [...l.deviceIds]
+				}))));
+			}
+		}
 		const persistedDelays = modeDelaysFromPersisted(this.config.get("modeDelays"));
 		const beforeDelays = persistedDelays.entries;
 		const afterDelays = edits.length > 0 ? require_clip_model_registry.applyModeDelaysEdits(beforeDelays, edits) : beforeDelays;
@@ -2212,7 +2322,7 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 		if (read.verdict.kind === "refused") return this.refuse(mode, read.verdict.blocking, now);
 		return this.settleArm(mode, read.verdict.excluded.map((device) => ({
 			device,
-			why: "non-blocking"
+			why: this.exclusionWhyFor(mode, device)
 		})), now);
 	}
 	/**
@@ -2261,12 +2371,14 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			return outcome;
 		}
 		const tolerated = this.nonBlockingFor(held.mode);
+		const forceBlock = this.blockingFor(held.mode);
 		const unknown = new Set(read.openings.unknown);
 		if (read.verdict.kind === "refused") {
 			const plain = decideArm({
 				mode: held.mode,
 				open: read.openings.open,
-				nonBlocking: tolerated
+				nonBlocking: tolerated,
+				blocking: forceBlock
 			});
 			const blockingNow = plain.kind === "refused" ? plain.blocking : read.verdict.blocking;
 			const shownIds = new Set(blockingNow.map((d) => d.deviceId));
@@ -2396,10 +2508,17 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 				error: String(err)
 			};
 		}
+		const toSecure = openings.open.filter((d) => require_clip_model_registry.alarmDeviceSecureOnArm({
+			controllable: d.controllable,
+			deviceId: d.deviceId,
+			secureOnArmOff: this.secureOnArmOffFor(mode)
+		}));
+		if (toSecure.length > 0) this.armGuard?.secureOnArm(toSecure);
 		const verdict = decideArm({
 			mode,
 			open: openings.open,
 			nonBlocking: this.nonBlockingFor(mode),
+			blocking: this.blockingFor(mode),
 			...acknowledged !== void 0 ? { acknowledged } : {}
 		});
 		return {
@@ -2424,7 +2543,28 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	}
 	/** This mode's non-blocking ids, from the persisted lists. */
 	nonBlockingFor(mode) {
-		return nonBlockingFromPersisted(this.config.get("nonBlocking")).find((l) => l.mode === mode)?.deviceIds ?? [];
+		return this.modeListIds("nonBlocking", mode);
+	}
+	/** Controllable openings that force-block when open. */
+	blockingFor(mode) {
+		return this.modeListIds("blocking", mode);
+	}
+	/** Controllable openings that opt out of secure-on-arm. */
+	secureOnArmOffFor(mode) {
+		return this.modeListIds("secureOnArmOff", mode);
+	}
+	modeListIds(key, mode) {
+		return modeDeviceListFromPersisted(this.config.get(key)).find((l) => l.mode === mode)?.deviceIds ?? [];
+	}
+	/** Why an open device was armed around on a plain (non–Arm-anyway) arm. */
+	exclusionWhyFor(mode, device) {
+		if (this.nonBlockingFor(mode).includes(device.deviceId)) return "non-blocking";
+		if (require_clip_model_registry.alarmDeviceSecureOnArm({
+			controllable: device.controllable,
+			deviceId: device.deviceId,
+			secureOnArmOff: this.secureOnArmOffFor(mode)
+		})) return "secure-on-arm";
+		return "non-blocking";
 	}
 	/**
 	* Arm, with these exclusions.
@@ -8618,6 +8758,7 @@ function sameWord(a, b) {
 * therefore moves the table with the arm.
 */
 function alarmSensorStateOf(deviceId, opening, online) {
+	const controllable = opening?.kind === "reading" ? require_clip_model_registry.isAlarmControllableCap(opening.cap) : false;
 	const verdict = classifyCoveredOpening(opening);
 	switch (verdict.kind) {
 		case "unknown": return {
@@ -8625,27 +8766,31 @@ function alarmSensorStateOf(deviceId, opening, online) {
 			reading: "unknown",
 			state: null,
 			unknownWhy: verdict.why,
-			online
+			online,
+			controllable
 		};
 		case "open": return {
 			deviceId,
 			reading: "open",
 			state: verdict.state,
 			unknownWhy: null,
-			online
+			online,
+			controllable: verdict.controllable
 		};
 		case "skip": return opening?.kind === "reading" ? {
 			deviceId,
 			reading: "closed",
 			state: opening.state,
 			unknownWhy: null,
-			online
+			online,
+			controllable
 		} : {
 			deviceId,
 			reading: "not-opening",
 			state: null,
 			unknownWhy: null,
-			online
+			online,
+			controllable: false
 		};
 	}
 }
@@ -20009,19 +20154,39 @@ function planSummaryDevices(rule, isDead, guard) {
 		notes: notes.notes
 	};
 }
+function stripDeadFromLists(lists, isDead) {
+	const dead = lists.flatMap((list) => list.deviceIds.filter(isDead));
+	if (dead.length === 0) return {
+		next: lists,
+		dead
+	};
+	return {
+		dead,
+		next: lists.map((list) => ({
+			...list,
+			deviceIds: list.deviceIds.filter((id) => !isDead(id))
+		}))
+	};
+}
 function planAlarmDevices(alarm, isDead) {
 	if (alarm === null) return null;
-	const nonBlockingDead = alarm.nonBlocking.flatMap((list) => list.deviceIds.filter(isDead));
-	const touched = nonBlockingDead.length > 0;
+	const nonBlocking = stripDeadFromLists(alarm.nonBlocking, isDead);
+	const blocking = stripDeadFromLists(alarm.blocking, isDead);
+	const secureOnArmOff = stripDeadFromLists(alarm.secureOnArmOff, isDead);
 	const forgetExcluded = alarm.excluded.filter(isDead);
-	if (!touched && forgetExcluded.length === 0) return null;
+	const deadIds = [
+		...nonBlocking.dead,
+		...blocking.dead,
+		...secureOnArmOff.dead,
+		...forgetExcluded
+	];
+	if (deadIds.length === 0) return null;
 	return {
-		dropped: deviceSubjects([...new Set([...nonBlockingDead, ...forgetExcluded])]),
+		dropped: deviceSubjects([...new Set(deadIds)]),
 		droppedKind: "device",
-		...touched ? { nonBlocking: alarm.nonBlocking.map((list) => ({
-			...list,
-			deviceIds: list.deviceIds.filter((id) => !isDead(id))
-		})) } : {},
+		...nonBlocking.dead.length > 0 ? { nonBlocking: nonBlocking.next } : {},
+		...blocking.dead.length > 0 ? { blocking: blocking.next } : {},
+		...secureOnArmOff.dead.length > 0 ? { secureOnArmOff: secureOnArmOff.next } : {},
 		forgetExcluded
 	};
 }
@@ -20063,6 +20228,8 @@ function referencedDeviceIds(snapshot) {
 	for (const rule of snapshot.timelapse) add(rule.deviceIds);
 	for (const rule of snapshot.summary) add(rule.deviceIds);
 	for (const list of snapshot.alarm?.nonBlocking ?? []) add(list.deviceIds);
+	for (const list of snapshot.alarm?.blocking ?? []) add(list.deviceIds);
+	for (const list of snapshot.alarm?.secureOnArmOff ?? []) add(list.deviceIds);
 	add(snapshot.alarm?.excluded);
 	add(snapshot.mutedDeviceIds);
 	return ids;
@@ -20407,6 +20574,8 @@ var NcDeletedSubjectPruner = class {
 			summary: this.writable("summary", this.deps.summary.list()),
 			alarm: panel !== null && settings !== void 0 ? {
 				nonBlocking: settings.nonBlocking,
+				blocking: settings.blocking,
+				secureOnArmOff: settings.secureOnArmOff,
 				announceTargets: settings.announceTargets,
 				excluded: panel.excludedDevices()
 			} : null,
@@ -20563,6 +20732,8 @@ var NcDeletedSubjectPruner = class {
 			...NO_SNAPSHOT,
 			alarm: {
 				nonBlocking: settings.nonBlocking,
+				blocking: settings.blocking,
+				secureOnArmOff: settings.secureOnArmOff,
 				announceTargets: settings.announceTargets,
 				excluded: panel.excludedDevices()
 			}
@@ -20571,6 +20742,8 @@ var NcDeletedSubjectPruner = class {
 		try {
 			const patch = {
 				...edit.nonBlocking !== void 0 ? { nonBlocking: edit.nonBlocking } : {},
+				...edit.blocking !== void 0 ? { blocking: edit.blocking } : {},
+				...edit.secureOnArmOff !== void 0 ? { secureOnArmOff: edit.secureOnArmOff } : {},
 				...edit.announceTargets !== void 0 ? { announceTargets: [...edit.announceTargets] } : {}
 			};
 			if (Object.keys(patch).length > 0) await panel.applySettings(patch);
@@ -35573,6 +35746,8 @@ var NC_ALARM_SETTINGS_FALLBACK = {
 	...DEFAULT_DELAYS,
 	announceTargets: [],
 	nonBlocking: [],
+	blocking: [],
+	secureOnArmOff: [],
 	modeDelays: []
 };
 /**
@@ -38577,6 +38752,9 @@ var NotificationCenter = class {
 	alarmArmGuard() {
 		return {
 			openings: (mode) => this.alarmOpenings(mode),
+			secureOnArm: (devices) => {
+				this.secureDevicesOnArm(devices);
+			},
 			announceRefusal: (input) => this.announceArmRefused(input),
 			announceCheckFailed: (input) => this.announceArmCheckFailed(input)
 		};
@@ -38643,7 +38821,9 @@ var NotificationCenter = class {
 			if (verdict.kind === "open") open.push({
 				deviceId,
 				name: name(deviceId),
-				state: verdict.state
+				state: verdict.state,
+				controllable: verdict.controllable,
+				cap: verdict.cap
 			});
 		}
 		this.logger.info("alarm arm check", {
@@ -38662,6 +38842,47 @@ var NotificationCenter = class {
 		};
 	}
 	/**
+	* Fire-and-forget secure actuation for controllable openings on arm.
+	* Failures are WARN per device — they never refuse the arm.
+	*/
+	async secureDevicesOnArm(devices) {
+		for (const device of devices) {
+			const actuation = device.cap !== void 0 ? require_clip_model_registry.secureActuationFor(device.cap) : null;
+			if (actuation === null) continue;
+			try {
+				await this.actuateWithAttribution({
+					deviceId: device.deviceId,
+					cap: actuation.cap,
+					method: actuation.method,
+					args: {
+						deviceId: device.deviceId,
+						...actuation.args
+					}
+				});
+				this.logger.info("alarm secure-on-arm actuated", {
+					tags: { deviceId: device.deviceId },
+					meta: {
+						name: device.name,
+						state: device.state,
+						cap: actuation.cap,
+						method: actuation.method
+					}
+				});
+			} catch (err) {
+				this.logger.warn("alarm secure-on-arm actuation failed — arm continues", {
+					tags: { deviceId: device.deviceId },
+					meta: {
+						name: device.name,
+						state: device.state,
+						cap: actuation.cap,
+						method: actuation.method,
+						error: String(err)
+					}
+				});
+			}
+		}
+	}
+	/**
 	* The refusal, as an ordinary notification.
 	*
 	* Same path every alarm announcement takes (D126: the alarm speaks through
@@ -51362,6 +51583,11 @@ var MEDIA_ID_SEGMENT = "m";
 /** Path segment that introduces an OWNER question ("best media of"). */
 var MEDIA_OWNER_SEGMENT = "o";
 /**
+* Path segment that introduces an event-owner GENERATION (D694) —
+* `/g/<deviceId>/<recordAt>` after the owner id.
+*/
+var MEDIA_GENERATION_SEGMENT = "g";
+/**
 * The plane path for one media row.
 *
 * `prefix` is `/addon/<addonId>/event-media` — a pure function of the addon
@@ -51378,6 +51604,23 @@ function mediaFileUrl(prefix, mediaId) {
 	return `${prefix}/${MEDIA_ID_SEGMENT}/${mediaId}`;
 }
 /**
+* The plane path for "whatever media best represents this owner".
+*
+* The owner id IS encoded: a trackId is a UUID today but an owner id is an
+* arbitrary row key (the summary mosaic's is `summary-<ruleId>-<windowEndMs>`),
+* and one slash in it would silently re-cut the path.
+*
+* When `generation` is set and `ownerType` is an event table, the path carries
+* `/g/<deviceId>/<recordAt>` so a reused rowid cannot resolve another record's
+* crop. Generation is ignored (and not minted) for non-event owners — a track
+* id is random and needs none.
+*/
+function mediaOwnerUrl(prefix, ownerType, ownerId, generation) {
+	const base = `${prefix}/${MEDIA_OWNER_SEGMENT}/${ownerType}/${encodeURIComponent(ownerId)}`;
+	if (generation === void 0 || !require_clip_model_registry.isEventOwnerType(ownerType)) return base;
+	return `${base}/${MEDIA_GENERATION_SEGMENT}/${generation.deviceId}/${generation.recordAt}`;
+}
+/**
 * A stored row as the wire sees it: the ref, the address, and — transitionally
 * — the bytes.
 *
@@ -59230,6 +59473,12 @@ function openGzipStream(out) {
 		onceDrain: (listener) => {
 			gzip.once("drain", listener);
 		},
+		flush: () => new Promise((resolve, reject) => {
+			gzip.flush((err) => {
+				if (err !== null && err !== void 0) reject(err);
+				else resolve();
+			});
+		}),
 		finish: async () => {
 			gzip.end();
 			await closed;
@@ -59325,6 +59574,25 @@ var TapeSegmentWriter = class {
 		});
 	}
 	/**
+	* Push the sink's pending gzip output to disk without ending the segment.
+	* A quiet / silent camera otherwise keeps its tail only in the zlib
+	* buffer until the next rotation (D681 follow-up). Never throws into the
+	* caller's frame path: a flush fault is logged and swallowed here.
+	*/
+	async flushToDisk() {
+		try {
+			await this.deps.sink.flush();
+		} catch (err) {
+			this.deps.logger.warn("tracking tape segment flush failed", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					segmentOriginMs: this.deps.segmentOriginMs,
+					error: require_clip_model_registry.errMsg(err)
+				}
+			});
+		}
+	}
+	/**
 	* Always ends the segment's records (queue flush, lost-span gap, `end`
 	* record) before touching the sink, so a sink that cannot finish still
 	* leaves a decodable body behind it. `sink.finish()`'s rejection is caught
@@ -59651,6 +59919,21 @@ var TapeRecorder = class {
 		if (cam !== void 0) await this.closeSegment(deviceId, cam, "segment-end");
 	}
 	/**
+	* Push every open segment's pending gzip output to disk without rotating
+	* (D681 follow-up). A silent / quiet camera otherwise keeps its tail only
+	* in the zlib buffer until the next frame or the 10-minute cut — a crash
+	* loses it, and `bytesLastHour` lags behind what was already recorded.
+	* Never throws: a per-camera flush fault is logged inside the writer.
+	*/
+	async flushOpenSegments() {
+		const pending = [];
+		for (const cam of this.cameras.values()) {
+			const writer = cam.segment?.writer;
+			if (writer !== void 0 && writer !== null) pending.push(writer.flushToDisk());
+		}
+		await Promise.all(pending);
+	}
+	/**
 	* Close the camera's open segment only if it holds time at or before
 	* `atMs` — what a promotion of a window ending at `atMs` needs on disk
 	* (Task 12 fix round, H1). A window wholly before the open segment leaves
@@ -60150,6 +60433,29 @@ var TapeShelf = class {
 		};
 	}
 };
+/**
+* Log every refusal the sweep already measured (D391 / D681 follow-up).
+* `sweep()` itself never throws for `rootUnreadable` / per-camera `failed`:
+* those land on the report, and a caller that only `.catch`es would drop them
+* silently even when the shelf already warned at the `readdir` site. One
+* tagged line per refusal at the sweep boundary closes that gap.
+*/
+function logTapeSweepReport(report, logger) {
+	if (report.rootUnreadable !== null) logger.warn("tracking tape sweep refused", { meta: {
+		reason: report.rootUnreadable,
+		scope: "root"
+	} });
+	for (const [deviceId, outcome] of report.perDevice) {
+		if (!("failed" in outcome) || outcome.failed !== true) continue;
+		logger.warn("tracking tape sweep refused", {
+			tags: { deviceId },
+			meta: {
+				reason: outcome.reason,
+				scope: "camera"
+			}
+		});
+	}
+}
 //#endregion
 //#region src/pipeline-analytics/tracking-bench/recorder/tape-operation-queue.ts
 /** Generous: a promotion reads its window's segments and walks back through
@@ -61203,6 +61509,17 @@ function shelfFigures(listing, now) {
 		...last !== void 0 ? { heldToMs: last.originMs } : {}
 	};
 }
+/**
+* Default `debug.tape.status` (no `deviceIds`): drop the noise. An Off camera
+* with a measured empty shelf is not a cost row and is not promotable; keep
+* everything else — Recording / Refused / Failing / Unknown, Off with held
+* segments (still promotable after the switch went off), and Off whose shelf
+* could not be read (D393: never silently hide an unreadable camera). Explicit
+* `deviceIds` still return every asked-about camera, Off included (D62).
+*/
+function defaultTapeStatusCameras(rows) {
+	return rows.filter((row) => row.state !== "off" || row.segmentsHeld === null || row.segmentsHeld > 0);
+}
 function describeTapeStatus(input) {
 	return input.deviceIds.map((deviceId) => {
 		const shelf = {
@@ -73112,7 +73429,7 @@ var AnalyticsQueryFacade = class {
 	async getMotionEvents(input) {
 		const events = await (this.deps.eventStore()?.queryMotion(input) ?? Promise.resolve([]));
 		if (input.projection !== "slim" || this.deps.eventMediaBaseUrl() === null) return events;
-		return this.withMediaUrl(events);
+		return this.withMediaUrl(events, "motion");
 	}
 	async getEventDensity(input) {
 		return this.deps.eventStore()?.densityByKind(input) ?? [];
@@ -73169,12 +73486,12 @@ var AnalyticsQueryFacade = class {
 	async getObjectEvents(input) {
 		const events = await (this.deps.eventStore()?.queryObject(input) ?? Promise.resolve([]));
 		if (input.projection !== "slim" || this.deps.eventMediaBaseUrl() === null) return events;
-		return this.withMediaUrl(events);
+		return this.withMediaUrl(events, "object");
 	}
 	async getAudioEvents(input) {
 		const events = await (this.deps.eventStore()?.queryAudio(input) ?? Promise.resolve([]));
 		if (input.projection !== "slim" || this.deps.eventMediaBaseUrl() === null) return events;
-		return this.withMediaUrl(events);
+		return this.withMediaUrl(events, "audio");
 	}
 	async getEventMedia(input) {
 		const store = this.deps.mediaStore();
@@ -73441,13 +73758,20 @@ var AnalyticsQueryFacade = class {
 	*
 	* Only called when `eventMediaBaseUrl()` is non-null (guard sits in
 	* the callers), so the template literal is safe.
+	*
+	* The URL names the owner TABLE and the event's GENERATION (D482 + D694):
+	* a bare `${base}/${id}` was both ambiguous across tables and unable to
+	* survive a reused rowid. New stamps always carry `/o/<type>/<id>/g/…`.
 	*/
-	withMediaUrl(events) {
+	withMediaUrl(events, ownerType) {
 		const base = this.deps.eventMediaBaseUrl();
 		if (base === null) return events;
 		return events.map((e) => ({
 			...e,
-			mediaUrl: `${base}/${e.id}`
+			mediaUrl: mediaOwnerUrl(base, ownerType, String(e.id), {
+				deviceId: e.deviceId,
+				recordAt: e.timestamp
+			})
 		}));
 	}
 };
@@ -76279,18 +76603,26 @@ function eventMediaEtag(media) {
 }
 /** Digits only — `Number('')` is 0 and `Number(' ')` is 0, so neither is used. */
 var DIGITS = /^\d+$/;
+/** One run of digits, for composing the event-owner remainder pattern. */
+var DIGIT_RUN = "\\d+";
+/**
+* Event-owner remainder with an optional generation suffix (D694):
+* `<ownerId>` or `<ownerId>/g/<deviceId>/<recordAt>`. Owner ids for event
+* tables are decimal rowids; the generation segment is the literal `g`.
+*/
+var EVENT_OWNER_REMAINDER = new RegExp(`^(${DIGIT_RUN})(?:/${MEDIA_GENERATION_SEGMENT}/(${DIGIT_RUN})/(${DIGIT_RUN}))?$`);
 /**
 * Read a plane path. `null` for anything that is not one of the two forms —
 * including the BARE id the plane used to accept, which is gone: a bare number
 * could be a media id or an event id, and after D474 an event id could be one
 * of three rows. Ambiguity at the door is what this record removes.
 *
-* The owner id is taken as the whole remainder rather than one segment: the
-* hub's wildcard param is percent-decoded by find-my-way before the sub-path
-* is proxied, so a `%2F` an owner id carried would arrive here as a real
-* slash, and re-cutting on it would silently address a different owner. It is
-* only ever a DB query VALUE (`where: { ownerId }`) — never a filesystem path,
-* which the row itself supplies.
+* For non-event owners the id is the whole remainder rather than one segment:
+* the hub's wildcard param is percent-decoded by find-my-way before the
+* sub-path is proxied, so a `%2F` an owner id carried would arrive here as a
+* real slash, and re-cutting on it would silently address a different owner.
+* Event owners (decimal rowids) may end with `/g/<deviceId>/<recordAt>` —
+* that suffix is the generation, not part of the id (D694).
 */
 function parseMediaAddress(rawPath) {
 	const path = rawPath.replace(/^\/+/, "");
@@ -76310,13 +76642,35 @@ function parseMediaAddress(rawPath) {
 	const typeSlash = rest.indexOf("/");
 	if (typeSlash <= 0) return null;
 	const ownerType = rest.slice(0, typeSlash);
-	const ownerId = rest.slice(typeSlash + 1);
-	if (ownerId.length === 0) return null;
+	const remainder = rest.slice(typeSlash + 1);
+	if (remainder.length === 0) return null;
 	if (!require_clip_model_registry.isMediaOwnerType(ownerType)) return null;
+	if (require_clip_model_registry.isEventOwnerType(ownerType)) {
+		const match = EVENT_OWNER_REMAINDER.exec(remainder);
+		if (match === null) return null;
+		const ownerId = match[1];
+		const deviceIdRaw = match[2];
+		const recordAtRaw = match[3];
+		if (ownerId === void 0) return null;
+		if (deviceIdRaw !== void 0 && recordAtRaw !== void 0) return {
+			kind: "owner",
+			ownerType,
+			ownerId,
+			generation: {
+				deviceId: Number(deviceIdRaw),
+				recordAt: Number(recordAtRaw)
+			}
+		};
+		return {
+			kind: "owner",
+			ownerType,
+			ownerId
+		};
+	}
 	return {
 		kind: "owner",
 		ownerType,
-		ownerId
+		ownerId: remainder
 	};
 }
 /** Set by the HUB for a `csv_*` share token admitted on this plane; never by a client. */
@@ -78993,6 +79347,218 @@ function createRetrainExportHandler(deps) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/retrain/retrain-collection-store.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per named training collection the operator creates. Names are
+*     unique on nameKey (lower(trim)); empty names never become rows."
+*   retention="none — operator-owned corpus metadata. Rows leave only when an
+*     explicit delete API lands (not V1)."
+*/
+var RETRAIN_COLLECTIONS_COLLECTION = "pipeline-analytics:retrain-collections";
+var RETRAIN_COLLECTION_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "nameKey",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var RETRAIN_COLLECTION_INDEXES = [{
+	name: "idx_retrain_collections_name_key",
+	columns: ["nameKey"],
+	unique: true
+}, {
+	name: "idx_retrain_collections_created",
+	columns: ["createdAt"]
+}];
+function normalizeCollectionName(raw) {
+	const name = raw.trim();
+	if (name.length === 0) return null;
+	return {
+		name,
+		nameKey: name.toLowerCase()
+	};
+}
+var RetrainCollectionStore = class {
+	store;
+	logger;
+	now;
+	newId;
+	countFrames;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now;
+		this.newId = deps.newId;
+		this.countFrames = deps.countFrames;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: RETRAIN_COLLECTIONS_COLLECTION,
+			columns: [...RETRAIN_COLLECTION_COLUMNS],
+			indexes: [...RETRAIN_COLLECTION_INDEXES]
+		});
+	}
+	async create(input) {
+		const normalized = normalizeCollectionName(input.name);
+		if (normalized === null) return {
+			kind: "refused",
+			reason: "empty-name"
+		};
+		if (await this.findByNameKey(normalized.nameKey) !== null) return {
+			kind: "refused",
+			reason: "duplicate-name"
+		};
+		const createdAt = this.now();
+		const id = this.newId();
+		await this.store.set.mutate({
+			collection: RETRAIN_COLLECTIONS_COLLECTION,
+			key: id,
+			value: {
+				name: normalized.name,
+				nameKey: normalized.nameKey,
+				createdAt,
+				updatedAt: createdAt
+			}
+		});
+		return {
+			kind: "created",
+			collection: {
+				id,
+				name: normalized.name,
+				createdAt,
+				frameCount: 0
+			}
+		};
+	}
+	async list() {
+		let rows;
+		try {
+			rows = await this.store.query.query({
+				collection: RETRAIN_COLLECTIONS_COLLECTION,
+				filter: { orderBy: {
+					field: "createdAt",
+					direction: "desc"
+				} }
+			});
+		} catch (err) {
+			this.logger.warn("retrain collections list failed", { meta: { error: String(err) } });
+			return [];
+		}
+		const out = [];
+		for (const row of rows) {
+			const name = typeof row.data["name"] === "string" ? row.data["name"] : "";
+			const createdAt = Number(row.data["createdAt"] ?? 0);
+			const frameCount = this.countFrames !== void 0 ? await this.countFrames(row.id) : 0;
+			out.push({
+				id: row.id,
+				name,
+				createdAt,
+				frameCount
+			});
+		}
+		return out;
+	}
+	async getById(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: RETRAIN_COLLECTIONS_COLLECTION,
+				key: id
+			});
+			if (row === null || row === void 0) return null;
+			const data = row;
+			return {
+				id,
+				name: typeof data["name"] === "string" ? data["name"] : "",
+				createdAt: Number(data["createdAt"] ?? 0),
+				frameCount: this.countFrames !== void 0 ? await this.countFrames(id) : 0
+			};
+		} catch (err) {
+			this.logger.warn("retrain collection get failed", { meta: {
+				collectionId: id,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+	/**
+	* Stub until still ingest lands. Validates the collection exists, then
+	* refuses with a named reason so callers can wire UI against a stable shape.
+	*/
+	async addRetrainFrameFromRecording(input) {
+		if (await this.getById(input.collectionId) === null) {
+			this.logger.info("retrain collection addFrame refused: unknown-collection", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					collectionId: input.collectionId,
+					epochMs: input.epochMs
+				}
+			});
+			return {
+				kind: "refused",
+				reason: "unknown-collection"
+			};
+		}
+		this.logger.info("retrain collection addFrame stub: still-capture-unimplemented", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				collectionId: input.collectionId,
+				epochMs: input.epochMs
+			}
+		});
+		return {
+			kind: "refused",
+			reason: "still-capture-unimplemented",
+			detail: "Still ingest lands in plan Task 3"
+		};
+	}
+	async findByNameKey(nameKey) {
+		try {
+			const row = (await this.store.query.query({
+				collection: RETRAIN_COLLECTIONS_COLLECTION,
+				filter: {
+					where: { nameKey },
+					limit: 1
+				}
+			}))[0];
+			if (row === void 0) return null;
+			return {
+				id: row.id,
+				name: typeof row.data["name"] === "string" ? row.data["name"] : "",
+				createdAt: Number(row.data["createdAt"] ?? 0),
+				frameCount: 0
+			};
+		} catch (err) {
+			this.logger.warn("retrain collection findByNameKey failed", { meta: {
+				nameKey,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/retrain/retrain-assist.ts
 /** The whole frame, as a normalised rectangle. */
 var WHOLE_FRAME = {
@@ -82402,7 +82968,8 @@ async function rankKeyEvents(candidates, options, peakLookup) {
 			...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
 			...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 			...t.debug !== void 0 ? { debug: t.debug } : {},
-			...t.favourited !== void 0 ? { favourited: t.favourited } : {}
+			...t.favourited !== void 0 ? { favourited: t.favourited } : {},
+			...t.audioLabels !== void 0 && t.audioLabels.length > 0 ? { audioLabels: t.audioLabels } : {}
 		});
 	}
 	scored.sort((a, b) => b.importance - a.importance);
@@ -82829,16 +83396,19 @@ var MotionOnsetRegistry = class {
 *  - `resolveSearchThumbnailUrl` — the search-hit thumbnail resolver. It points
 *    a hit at the CLIP embedding row's OWN crop (the crop captured on the
 *    embedding's peak frame → the hit thumbnail IS the embedded crop), and only
-*    falls back to the representative event's crop when the embedding row has no
-*    crop yet, so a hit never renders blank.
+*    falls back to the representative event's owner ladder when the embedding
+*    row has no crop yet, so a hit never renders blank.
 */
 function isClipObjectEmbedding(t, registry = require_clip_model_registry.BUILTIN_CLIP_MODELS) {
 	return Array.isArray(t.embedding) && t.embedding.length > 0 && typeof t.embeddingModelId === "string" && registry.resolve(t.embeddingModelId) !== null;
 }
 function resolveSearchThumbnailUrl(input) {
 	if (input.baseUrl === null) return void 0;
-	const id = input.embeddingMediaKey ?? input.eventId;
-	return `${input.baseUrl}/${encodeURIComponent(id)}`;
+	if (input.embeddingMediaId !== void 0) return mediaFileUrl(input.baseUrl, input.embeddingMediaId);
+	return mediaOwnerUrl(input.baseUrl, "object", input.eventId, {
+		deviceId: input.deviceId,
+		recordAt: input.recordAt
+	});
 }
 //#endregion
 //#region src/pipeline-analytics/pipeline/onboard-birth-authority.ts
@@ -100998,7 +101568,10 @@ function ofGeneration(files, scope) {
 function makeNcOwnerMediaReader(deps) {
 	return async (ownerKind, ownerId, eventScope) => {
 		if (ownerKind === "track") return deps.media.listByOwner("track", await deps.resolveTrackOwnerId(ownerId));
-		if (eventScope === void 0) return deps.media.listByOwner("object", ownerId);
+		if (eventScope === void 0) {
+			deps.logger.error("object media read refused — NcEventMediaScope required", { meta: { ownerId } });
+			return [];
+		}
 		const onCamera = await deps.media.listByOwner("object", ownerId, eventScope.deviceId);
 		const kept = ofGeneration(onCamera, eventScope);
 		if (kept.length < onCamera.length) deps.logger.warn("event media of another record on a reused event id — not used", {
@@ -102091,6 +102664,10 @@ var NC_ARTIFACT_PRUNE_INTERVAL_MS = 36e5;
 *  (every camera switched off): the bound is 24 h, not "24 h after the next
 *  close" (D681). */
 var TAPE_SWEEP_INTERVAL_MS = 36e5;
+/** How often open tape segments push their pending gzip output to disk
+*  without rotating (D681 follow-up): a silent camera otherwise keeps its
+*  tail only in the zlib buffer until the next frame or the 10-minute cut. */
+var TAPE_FLUSH_INTERVAL_MS = 6e4;
 /** What a publish answers on a node whose artifact plane never came up: no
 *  link, no index row — and, exactly as before, bytes-only delivery. */
 var NO_PUBLICATION = {
@@ -102624,6 +103201,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 	ncArtifactReadDataPlane = null;
 	ncArtifactPruneTimer = null;
 	tapeSweepTimer = null;
+	tapeFlushTimer = null;
 	/** Why `startTrackingTapes` threw on a node that was allowed to record —
 	*  reported `failing` per switched-on camera, never as `recording`. */
 	tapeStartFailure = null;
@@ -104428,6 +105006,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			StationaryObjectRegistry.declare(api.settingsStore),
 			RetrainFrameStore.declare(api.settingsStore),
 			RetrainAnnotationStore.declare(api.settingsStore),
+			RetrainCollectionStore.declare(api.settingsStore),
 			OpsLogStore.declare(api.settingsStore),
 			DebugNoteArchiveStore.declare(api.settingsStore),
 			TrackingTapeIndexStore.declare(api.settingsStore),
@@ -106876,6 +107455,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			clearInterval(this.tapeSweepTimer);
 			this.tapeSweepTimer = null;
 		}
+		if (this.tapeFlushTimer !== null) {
+			clearInterval(this.tapeFlushTimer);
+			this.tapeFlushTimer = null;
+		}
 		if (this.ncArtifactPruneTimer !== null) {
 			clearInterval(this.ncArtifactPruneTimer);
 			this.ncArtifactPruneTimer = null;
@@ -113649,10 +114232,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		});
 		const scored = [];
 		for (const { event, score } of bestEventByTrackId.values()) {
+			const embeddingMediaId = event.trackId !== void 0 ? embeddingMediaIdByTrackId.get(event.trackId) : void 0;
 			const mediaUrl = resolveSearchThumbnailUrl({
 				baseUrl: this.eventMediaBaseUrl,
 				eventId: String(event.id),
-				...event.trackId !== void 0 && embeddingMediaIdByTrackId.has(event.trackId) ? { embeddingMediaId: embeddingMediaIdByTrackId.get(event.trackId) } : {}
+				deviceId: event.deviceId,
+				recordAt: event.timestamp,
+				...embeddingMediaId !== void 0 ? { embeddingMediaId } : {}
 			});
 			const keyFrameMediaId = event.trackId !== void 0 ? keyFrameMediaIdByTrackId.get(event.trackId) : void 0;
 			scored.push({
@@ -114039,7 +114625,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				logger
 			});
 			const sweep = (deviceId) => {
-				shelf.sweep().catch((err) => {
+				shelf.sweep().then((report) => {
+					logTapeSweepReport(report, logger);
+				}).catch((err) => {
 					logger.warn("tracking tape sweep failed", {
 						...deviceId !== null ? { tags: { deviceId } } : {},
 						meta: { error: require_clip_model_registry.errMsg(err) }
@@ -114071,6 +114659,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			sweep(null);
 			this.tapeSweepTimer = setInterval(() => sweep(null), TAPE_SWEEP_INTERVAL_MS);
 			this.tapeSweepTimer.unref?.();
+			this.tapeFlushTimer = setInterval(() => {
+				this.tapeRecorder?.flushOpenSegments();
+			}, TAPE_FLUSH_INTERVAL_MS);
+			this.tapeFlushTimer.unref?.();
 			this.ctx.logger.info("tracking tapes ready", { meta: { seededProcessors: this.processorInputs.size } });
 		} catch (err) {
 			this.tapeStartFailure = require_clip_model_registry.errMsg(err);
@@ -114263,7 +114855,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 					segments.set(deviceId, await this.tapeListingOf(shelf, deviceId));
 				}
 				const recorder = this.tapeRecorder;
-				return { cameras: describeTapeStatus({
+				const cameras = describeTapeStatus({
 					deviceIds,
 					switchOn,
 					switchUnreadable,
@@ -114272,7 +114864,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 					startFailure: this.tapeStartFailure,
 					segments,
 					now: Date.now()
-				}) };
+				});
+				return { cameras: input.deviceIds === void 0 ? defaultTapeStatusCameras(cameras) : cameras };
 			},
 			"debug.tape.promote": async (input) => {
 				const deps = this.tapePromotionDeps();
@@ -114721,7 +115314,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 	* owner table, so the motion/object coin-flip is gone from here too.
 	*/
 	async readMediaByAddress(address, variant, preferKind) {
-		const base = address.kind === "row" ? await this.readMediaById(address.mediaId) : await this.readOwnerThumbnail(address.ownerType, address.ownerId, preferKind);
+		const base = address.kind === "row" ? await this.readMediaById(address.mediaId) : await this.readOwnerThumbnail(address.ownerType, address.ownerId, preferKind, address.generation);
 		if (base === null || variant === void 0) return base;
 		return this.applyThumbVariant(base, variant);
 	}
@@ -114779,7 +115372,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 	* ~144 MB and allocated ~190 MB of base64 to deliver ~1.2 MB, all of it on
 	* the single-threaded post-analysis runner.
 	*/
-	async readOwnerThumbnail(ownerType, rawOwnerId, preferKind) {
+	async readOwnerThumbnail(ownerType, rawOwnerId, preferKind, addressGeneration) {
 		const ownerId = ownerType === "track" ? await resolveMediaOwnerId(ownerType, rawOwnerId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "readOwnerThumbnail") : rawOwnerId;
 		const listInfo = (ownerKind, id, deviceId) => this.mediaStore?.listInfoByOwner(ownerKind, id, deviceId) ?? Promise.resolve([]);
 		const getTrackIdForEvent = (eventId) => require_clip_model_registry.isEventOwnerType(ownerType) ? this.eventStore?.getTrackIdForEvent(eventId, ownerType) ?? Promise.resolve(null) : Promise.resolve(null);
@@ -114793,8 +115386,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			};
 		};
 		let ownFiles = await listInfo(ownerType, ownerId);
-		if (require_clip_model_registry.isEventOwnerType(ownerType) && this.eventStore !== null) {
-			const gen = await this.eventStore.eventGenerationOf(ownerType, ownerId);
+		if (require_clip_model_registry.isEventOwnerType(ownerType)) {
+			const gen = addressGeneration !== void 0 ? {
+				deviceId: addressGeneration.deviceId,
+				timestamp: addressGeneration.recordAt
+			} : this.eventStore !== null ? await this.eventStore.eventGenerationOf(ownerType, ownerId) : null;
 			if (gen !== null) {
 				const onCamera = await listInfo(ownerType, ownerId, gen.deviceId);
 				const kept = onCamera.filter((f) => f.timestamp === gen.timestamp);
@@ -114806,7 +115402,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						recordAt: gen.timestamp,
 						refused: onCamera.length - kept.length,
 						kept: kept.length,
-						via: "readOwnerThumbnail"
+						via: "readOwnerThumbnail",
+						scopedBy: addressGeneration !== void 0 ? "url" : "live-row"
 					}
 				});
 				ownFiles = kept;