@camstack/addon-post-analysis 1.2.369 → 1.2.370

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-E4CGZ8NR.js");
+const require_clip_model_registry = require("../clip-model-registry-C3AUTkBR.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -45959,6 +45959,22 @@ var MediaStore = class MediaStore {
 	* happens HERE and nowhere else.
 	*/
 	async getById(mediaId) {
+		const found = await this.getBytesById(mediaId);
+		if (found === null) return null;
+		const { bytes, ...rest } = found;
+		return {
+			...rest,
+			base64: bytes.toString("base64")
+		};
+	}
+	/**
+	* {@link getById} WITHOUT the base64 round trip: the blob as the storage
+	* engine read it. Every in-process reader (key-frame derive, retrain and
+	* export readers, face re-embed) used to take `base64` and decode it straight
+	* back — a 0.4–0.8 MB string plus a second buffer per read (D867). `getById`
+	* stays for the callers that cross a wire.
+	*/
+	async getBytesById(mediaId) {
 		const row = await this.store.get.query({
 			collection: MEDIA_COLLECTION,
 			key: String(mediaId)
@@ -45973,10 +45989,10 @@ var MediaStore = class MediaStore {
 			return {
 				mediaId,
 				kind,
-				base64: (await this.storage.read({
+				bytes: await this.storage.read({
 					location: mediaRowLocation(data),
 					relativePath: path
-				})).toString("base64"),
+				}),
 				sizeBytes,
 				timestamp,
 				deviceId: Number(data["deviceId"])
@@ -47709,7 +47725,7 @@ function previewBlurSigma(frameWidth) {
 }
 /** Break a word too long for one line into line-width pieces. Without this a
 *  single 200-character token wraps to nothing and overflows both edges. */
-function chunk(word, size) {
+function chunk$1(word, size) {
 	const pieces = [];
 	for (let i = 0; i < word.length; i += size) pieces.push(word.slice(i, i + size));
 	return pieces;
@@ -47717,7 +47733,7 @@ function chunk(word, size) {
 /** Greedy word wrap at a character budget — the only measurement available,
 *  since librsvg lays the text out long after this string is written. */
 function wrapLines(text, maxChars) {
-	return text.split(" ").filter((w) => w.length > 0).reduce((lines, word) => (word.length > maxChars ? chunk(word, maxChars) : [word]).reduce((acc, piece) => {
+	return text.split(" ").filter((w) => w.length > 0).reduce((lines, word) => (word.length > maxChars ? chunk$1(word, maxChars) : [word]).reduce((acc, piece) => {
 		const last = acc.at(-1);
 		if (last === void 0) return [piece];
 		const merged = `${last} ${piece}`;
@@ -52583,6 +52599,17 @@ function choosePhotoFace(input) {
 //#endregion
 //#region src/pipeline-analytics/pipeline/face-matcher.ts
 /**
+* The scoring view of a sample's vector. A `Float32Array` is returned as is —
+* no per-probe, per-sample allocation (~3200 x 2 KB = 6.5 MB per probe on the
+* live gallery); a plain array is wrapped, exactly as before. The scores are
+* bit-identical either way: wrapping a `number[]` and storing a `Float32Array`
+* produce the same floats.
+*/
+function galleryVector(sample) {
+	const e = sample.embedding;
+	return e instanceof Float32Array ? e : new Float32Array(e);
+}
+/**
 * Count enrolled samples per identity for probes of a matching model+dimension.
 * Only identities meeting `minIdentitySamples` are eligible auto-match targets.
 */
@@ -52616,7 +52643,7 @@ function rankIdentities(probe, gallery, minIdentitySamples) {
 	for (const s of gallery) {
 		if (s.modelId !== probe.modelId) continue;
 		if (s.embedding.length !== probe.embedding.length) continue;
-		const score = require_clip_model_registry.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		const score = require_clip_model_registry.cosineSimilarity(probeVec, galleryVector(s));
 		const prev = bestByIdentity.get(s.identityId);
 		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
 		countByIdentity.set(s.identityId, (countByIdentity.get(s.identityId) ?? 0) + 1);
@@ -52685,7 +52712,7 @@ function enrollmentPromiscuity(embedding, modelId, targetIdentityId, gallery, bo
 		if (s.identityId === targetIdentityId) continue;
 		if (s.modelId !== modelId) continue;
 		if (s.embedding.length !== embedding.length) continue;
-		const cosine = require_clip_model_registry.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		const cosine = require_clip_model_registry.cosineSimilarity(probeVec, galleryVector(s));
 		if (cosine >= bound && (worst === null || cosine > worst.cosine)) worst = {
 			identityId: s.identityId,
 			cosine
@@ -52703,7 +52730,7 @@ function assignUniquePerFrame(candidates, gallery, opts) {
 			if (s.modelId !== c.modelId) continue;
 			if (s.embedding.length !== c.embedding.length) continue;
 			if (!eligible.has(s.identityId)) continue;
-			const score = require_clip_model_registry.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+			const score = require_clip_model_registry.cosineSimilarity(probeVec, galleryVector(s));
 			const prev = bestByIdentity.get(s.identityId);
 			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
 		}
@@ -54933,6 +54960,20 @@ var EmbeddingVectorIndex = class {
 	* carries no stamp, which no current writer produces.
 	*/
 	async loadStamped(ids) {
+		const f32 = await this.loadStampedFloat32(ids);
+		return new Map([...f32].map(([id, row]) => [id, {
+			embedding: Array.from(row.embedding),
+			modelId: row.modelId
+		}]));
+	}
+	/**
+	* {@link loadStamped} without widening to `number[]`: the vector as the
+	* `Float32Array` it was stored as, in a buffer of its own (a view over the
+	* base64 decode would pin a pooled slab). For the matching gallery, which is
+	* scored against on every probe and used to be re-wrapped per sample per
+	* probe (D867). Same read-failure contract as {@link loadStamped}.
+	*/
+	async loadStampedFloat32(ids) {
 		const out = /* @__PURE__ */ new Map();
 		if (ids.length === 0) return out;
 		try {
@@ -54946,7 +54987,7 @@ var EmbeddingVectorIndex = class {
 				const view = new Float32Array(buf.buffer, buf.byteOffset, buf.byteLength / 4);
 				const modelId = item.metadata["modelId"];
 				out.set(item.id, {
-					embedding: Array.from(view),
+					embedding: new Float32Array(view),
 					modelId: typeof modelId === "string" && modelId.length > 0 ? modelId : null
 				});
 			}
@@ -55493,6 +55534,15 @@ function rowToFace(id, raw) {
 		sourceFrameLandmarks: data.sourceFrameLandmarks ?? void 0
 	};
 }
+/** The columns a whole-archive rescore reads per face (no vector, no crop). */
+var RESCORE_COLUMNS = [
+	"deviceId",
+	"assigned",
+	"recognizedIdentityId",
+	"embeddingModelId",
+	"suggestedIdentityId",
+	"suggestedMatchScore"
+];
 var FaceStore = class {
 	store;
 	vectors;
@@ -56311,6 +56361,107 @@ var FaceStore = class {
 		return out;
 	}
 	/**
+	* The ids a whole-archive rescore will visit, SNAPSHOT at the start of the
+	* run — the same population as {@link listPendingFaces} (unassigned AND
+	* carrying no identity), so the two never disagree about "pending". Ids only:
+	* the job pages the rows themselves ({@link loadRescoreBatch}) so the
+	* settings thread never serves one big read of vectors.
+	*/
+	async listPendingFaceIds() {
+		return (await this.listPendingFaces()).map((r) => r.faceId);
+	}
+	/**
+	* One page of a whole-archive rescore: the rows of `ids` that are STILL
+	* pending (the operator may have assigned one since the snapshot), each with
+	* its vector. Ids whose vector is in neither home are counted, not dropped
+	* silently — "no vector" must not read as "scored, no match".
+	*/
+	async loadRescoreBatch(ids) {
+		if (ids.length === 0) return {
+			rows: [],
+			noVector: 0,
+			gone: 0
+		};
+		const records = await this.store.query.query({
+			collection: FACES_COLLECTION,
+			columns: RESCORE_COLUMNS,
+			filter: {
+				whereIn: { id: [...ids] },
+				limit: ids.length
+			}
+		});
+		const stillPending = records.filter((r) => !r.data["assigned"] && (r.data["recognizedIdentityId"] ?? null) === null);
+		const vectors = await this.loadEmbeddings(stillPending.map((r) => r.id));
+		const rows = [];
+		let noVector = 0;
+		for (const r of stillPending) {
+			const embedding = vectors.get(r.id);
+			if (embedding === void 0 || embedding.length === 0) {
+				noVector += 1;
+				continue;
+			}
+			const suggestedIdentityId = r.data["suggestedIdentityId"];
+			const suggestedMatchScore = r.data["suggestedMatchScore"];
+			const embeddingModelId = r.data["embeddingModelId"];
+			rows.push({
+				id: r.id,
+				deviceId: Number(r.data["deviceId"] ?? -1),
+				embedding,
+				modelId: typeof embeddingModelId === "string" ? embeddingModelId : LEGACY_FACE_MODEL_ID,
+				...typeof suggestedIdentityId === "string" ? { suggestedIdentityId } : {},
+				...typeof suggestedMatchScore === "number" ? { suggestedMatchScore } : {}
+			});
+		}
+		return {
+			rows,
+			noVector,
+			gone: ids.length - records.length
+		};
+	}
+	/**
+	* Write a batch of suggestion changes in ONE transaction (`transact`, all or
+	* nothing). THROWS: a batch that did not land must not be counted as
+	* applied. Touches only the two suggestion columns — never an assignment.
+	*/
+	async applySuggestionBatch(updates) {
+		if (updates.length === 0) return;
+		await this.store.transact.mutate({ ops: updates.map((u) => ({
+			op: "update",
+			collection: FACES_COLLECTION,
+			id: u.faceId,
+			data: u.suggestion === null ? {
+				suggestedIdentityId: null,
+				suggestedMatchScore: null
+			} : {
+				suggestedIdentityId: u.suggestion.identityId,
+				suggestedMatchScore: u.suggestion.score
+			}
+		})) });
+	}
+	/**
+	* The unassigned-face set marker for change detection: how many unassigned
+	* rows exist and the newest one's timestamp. ONE `COUNT(*)`+`MAX` statement
+	* over `assigned = 0`, answered from `idx_faces_assigned_ts (assigned,
+	* timestamp)` alone — covering, no table row fetched (proved by EXPLAIN in
+	* `face-rescore-marker-plan-over-real-sqlite.spec.ts`, D447). A face
+	* arriving moves the max, a face leaving or being assigned moves the count.
+	*/
+	async pendingMarker() {
+		const result = await this.store.aggregate.query({
+			collection: FACES_COLLECTION,
+			fields: [{
+				as: "maxTimestamp",
+				field: "timestamp",
+				op: "max"
+			}],
+			filter: { where: { assigned: false } }
+		});
+		return {
+			count: result.count,
+			maxTimestamp: result.values["maxTimestamp"] ?? null
+		};
+	}
+	/**
 	* A face's enrolled sample is going away (D643 prune, or the operator's
 	* Remove): forget the sample, and the crop too when it is the blob leaving
 	* with it. The face itself — and who it was assigned to — stays. THROWS on
@@ -57258,10 +57409,15 @@ var FaceGalleryProvider = class {
 * real workflow is the exact case this breaks: assign ten faces to build a
 * person up, then open an older unassigned track and ask "does it match NOW?"
 * — and read a number that was decided before any of those ten existed. There
-* is no background job that refreshes it and there should not be one (the
+* is no refresh on every assign, and there should not be one (the
 * gallery changes on every assign; re-scoring every buffered face each time is
-* work nobody asked for). The honest fix is to make the question askable on
-* demand. That is this module, and that is the button.
+* work nobody asked for). Two answers exist instead. On demand: this module,
+* the single-face button, and the whole-archive button (`face-rescore-job.ts`).
+* And D866 added a SLOW, change-gated job (`face-rescore-scheduler.ts`): hourly
+* by default, and only when a fingerprint of the gallery and of the unassigned
+* faces differs from the last completed run's — so an idle archive costs two
+* narrow reads, not a rescore. That supersedes this header's earlier "there is
+* no background job" statement; the objection to per-assign refresh stands.
 *
 * ## What it does NOT do
 *
@@ -57415,6 +57571,47 @@ async function persistRescoreResult(faceId, report, ports) {
 	return candidate !== null ? "written" : "cleared";
 }
 //#endregion
+//#region src/pipeline-analytics/face-rescore-job-status.ts
+/**
+* The wire/storage shape of a whole-archive face rescore job (D866) — one Zod
+* schema for the action output, the persisted last report and the in-process
+* status, so the three cannot drift.
+*/
+var FaceRescoreJobStateSchema = require_clip_model_registry._enum([
+	"idle",
+	"running",
+	"completed",
+	"failed"
+]);
+var FaceRescoreJobStatusSchema = require_clip_model_registry.object({
+	/** `null` while nothing ever ran in this process. */
+	jobId: require_clip_model_registry.string().nullable(),
+	state: FaceRescoreJobStateSchema,
+	/** Faces visited so far (rescored or deliberately skipped). */
+	scanned: require_clip_model_registry.number().int(),
+	/** Faces in the snapshot taken at the start; 0 until it is taken. */
+	total: require_clip_model_registry.number().int(),
+	/** newlySuggested + raised + lowered + cleared — rows actually written. */
+	changed: require_clip_model_registry.number().int(),
+	newlySuggested: require_clip_model_registry.number().int(),
+	raised: require_clip_model_registry.number().int(),
+	lowered: require_clip_model_registry.number().int(),
+	cleared: require_clip_model_registry.number().int(),
+	/** Faces in an old feature space: skipped, their suggestion untouched. */
+	modelMismatch: require_clip_model_registry.number().int(),
+	/** Faces with no vector in either home: skipped, counted. */
+	noVector: require_clip_model_registry.number().int(),
+	batches: require_clip_model_registry.number().int(),
+	/** Slowest single batch's STORE time (read + transaction), ms. */
+	maxBatchStoreMs: require_clip_model_registry.number(),
+	durationMs: require_clip_model_registry.number(),
+	galleryFingerprint: require_clip_model_registry.string(),
+	/** Combined fingerprint taken at the start; what the scheduler persists. */
+	fingerprint: require_clip_model_registry.string(),
+	startedAt: require_clip_model_registry.number().nullable(),
+	error: require_clip_model_registry.string().optional()
+});
+//#endregion
 //#region src/pipeline-analytics/face-rescore-actions.ts
 /**
 * face-rescore-actions — "score this face against the gallery AS IT IS NOW".
@@ -57532,19 +57729,516 @@ var FaceRescoreResultSchema = require_clip_model_registry.object({
 	reembedAvailable: require_clip_model_registry.boolean(),
 	reembed: FaceReembedReportSchema
 });
-var faceRescoreActions = require_clip_model_registry.defineCustomActions({ 
+var faceRescoreActions = require_clip_model_registry.defineCustomActions({
+	/**
+	* Persists its own result onto the SUGGESTED tier (`suggestedIdentityId` /
+	* `suggestedMatchScore`) — never an assignment, never automatic; see
+	* `rescoreFaceForTrack` in `pipeline-analytics/index.ts` and
+	* `persistRescoreResult` in `face-rescore.ts`. `admin` because the report
+	* also names every enrolled person and how well an arbitrary face matches
+	* them — the gallery's shape, which is not a viewer-level fact.
+	*/
+	"face.rescoreTrack": require_clip_model_registry.customAction(FaceRescoreInputSchema, FaceRescoreResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	/**
+	* Whole-archive rescore (D866): EVERY unassigned face against ONE gallery
+	* snapshot, as a paced single-flight job. Returns at once with the running
+	* job's status (a second call while one runs returns THAT job); poll
+	* `face.rescoreStatus` for progress and the final report. Same persistence
+	* rules as `face.rescoreTrack` — suggestions only, never an assignment, never
+	* a `model-mismatch` write — and a weaker or vanished match LOWERS or CLEARS
+	* the stored suggestion (see `face-rescore-job.ts`).
+	*/
+	"face.rescoreAll": require_clip_model_registry.customAction(require_clip_model_registry.object({}), FaceRescoreJobStatusSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	/** Progress of the running whole-archive rescore, else the last report. */
+	"face.rescoreStatus": require_clip_model_registry.customAction(require_clip_model_registry.object({}), FaceRescoreJobStatusSchema, {
+		kind: "query",
+		auth: "admin"
+	})
+});
+//#endregion
+//#region src/pipeline-analytics/face-rescore-job.ts
+/** Faces per batch: ~200 narrow updates in one transaction is tens of ms. */
+var RESCORE_BATCH_SIZE = 200;
+/** Pause after a batch = this × the batch's store time, clamped below. */
+var RESCORE_PAUSE_FACTOR = 2;
+var RESCORE_PAUSE_MIN_MS = 25;
+var RESCORE_PAUSE_MAX_MS = 500;
+/** Two scores closer than this are the same score (REAL round trip). */
+var SCORE_EPSILON = 1e-6;
 /**
-* Persists its own result onto the SUGGESTED tier (`suggestedIdentityId` /
-* `suggestedMatchScore`) — never an assignment, never automatic; see
-* `rescoreFaceForTrack` in `pipeline-analytics/index.ts` and
-* `persistRescoreResult` in `face-rescore.ts`. `admin` because the report
-* also names every enrolled person and how well an arbitrary face matches
-* them — the gallery's shape, which is not a viewer-level fact.
+* How the fresh answer relates to what the row holds. A switch to another
+* identity counts by its score: higher ⇒ raised, otherwise lowered (a tie with
+* a different person is `raised` — it is a change and must be written).
 */
-"face.rescoreTrack": require_clip_model_registry.customAction(FaceRescoreInputSchema, FaceRescoreResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}) });
+function classifyRescoreChange(stored, next) {
+	if (stored === null && next === null) return "unchanged";
+	if (stored === null) return "new";
+	if (next === null) return "cleared";
+	const delta = next.score - stored.score;
+	if (next.identityId === stored.identityId && Math.abs(delta) <= SCORE_EPSILON) return "unchanged";
+	return delta >= 0 ? "raised" : "lowered";
+}
+function storedSuggestion(row) {
+	return row.suggestedIdentityId === void 0 ? null : {
+		identityId: row.suggestedIdentityId,
+		score: row.suggestedMatchScore ?? 0
+	};
+}
+function sha(parts) {
+	return (0, node_crypto.createHash)("sha256").update(parts.join("\n")).digest("hex").slice(0, 16);
+}
+/**
+* Pure. The gallery part changes when a sample is added, removed or restamped
+* to another model, or the cluster model flips; the pending part when a face
+* arrives, leaves or is assigned. Sorted, so read order cannot move it.
+*/
+function computeRescoreFingerprint(input) {
+	const lines = input.manifest.map((m) => `${m.sampleId}|${m.identityId}|${m.modelId}`).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+	const gallery = sha([`cluster:${input.clusterModelId}`, ...lines]);
+	const pending = `${String(input.marker.count)}@${String(input.marker.maxTimestamp ?? "none")}`;
+	return {
+		gallery,
+		pending,
+		combined: sha([gallery, pending])
+	};
+}
+var IDLE_STATUS = {
+	jobId: null,
+	state: "idle",
+	scanned: 0,
+	total: 0,
+	changed: 0,
+	newlySuggested: 0,
+	raised: 0,
+	lowered: 0,
+	cleared: 0,
+	modelMismatch: 0,
+	noVector: 0,
+	batches: 0,
+	maxBatchStoreMs: 0,
+	durationMs: 0,
+	galleryFingerprint: "",
+	fingerprint: "",
+	startedAt: null
+};
+/** The fingerprint of NOW, plus the cluster model it was taken under. */
+async function readRescoreFingerprint(ports) {
+	const clusterModelId = await ports.resolveClusterModelId();
+	if (clusterModelId === null) return null;
+	const [manifest, marker] = await Promise.all([ports.galleryManifest(), ports.pendingMarker()]);
+	return {
+		fingerprint: computeRescoreFingerprint({
+			manifest,
+			marker,
+			clusterModelId
+		}),
+		clusterModelId
+	};
+}
+function chunk(items, size) {
+	const out = [];
+	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+	return out;
+}
+function pauseFor(storeMs) {
+	return Math.min(RESCORE_PAUSE_MAX_MS, Math.max(RESCORE_PAUSE_MIN_MS, Math.round(storeMs * RESCORE_PAUSE_FACTOR)));
+}
+var FaceRescoreJob = class {
+	ports;
+	current = IDLE_STATUS;
+	running = null;
+	stopped = false;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/** Progress of the running job, else the last finished one, else idle. */
+	status() {
+		return this.current;
+	}
+	isRunning() {
+		return this.running !== null;
+	}
+	/** Resolves when no job is running. Never rejects: failure is in `status()`. */
+	async whenSettled() {
+		await this.running;
+	}
+	/** Ask a running job to stop after its current batch (addon shutdown). */
+	stop() {
+		this.stopped = true;
+	}
+	/**
+	* Start a job — or return the one already running (single-flight). The
+	* returned status is a snapshot; poll {@link status} for progress.
+	*/
+	start() {
+		if (this.running !== null) return this.current;
+		this.stopped = false;
+		const startedAt = this.ports.now();
+		this.current = {
+			...IDLE_STATUS,
+			jobId: this.ports.newJobId(),
+			state: "running",
+			startedAt
+		};
+		this.running = this.run(startedAt).finally(() => {
+			this.running = null;
+		});
+		return this.current;
+	}
+	patch(change) {
+		this.current = {
+			...this.current,
+			...change
+		};
+	}
+	async run(startedAt) {
+		try {
+			await this.runBatches(startedAt);
+			this.patch({
+				state: "completed",
+				durationMs: this.ports.now() - startedAt
+			});
+			this.logSummary("face rescore job finished");
+			await this.recordCompletion();
+		} catch (err) {
+			const error = err instanceof Error ? err.message : String(err);
+			this.patch({
+				state: "failed",
+				error,
+				durationMs: this.ports.now() - startedAt
+			});
+			this.ports.logger.warn("face rescore job FAILED — rows written so far stay written", { meta: {
+				...this.summaryMeta(),
+				error
+			} });
+		}
+	}
+	async recordCompletion() {
+		try {
+			await this.ports.recordCompletion(this.current);
+		} catch (err) {
+			this.ports.logger.warn("face rescore result could not be recorded — the next tick may rerun", { meta: {
+				jobId: this.current.jobId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+	summaryMeta() {
+		const s = this.current;
+		return {
+			jobId: s.jobId,
+			scanned: s.scanned,
+			total: s.total,
+			changed: s.changed,
+			newlySuggested: s.newlySuggested,
+			raised: s.raised,
+			lowered: s.lowered,
+			cleared: s.cleared,
+			modelMismatch: s.modelMismatch,
+			noVector: s.noVector,
+			batches: s.batches,
+			maxBatchStoreMs: s.maxBatchStoreMs,
+			durationMs: s.durationMs,
+			galleryFingerprint: s.galleryFingerprint
+		};
+	}
+	logSummary(message) {
+		this.ports.logger.info(message, { meta: this.summaryMeta() });
+	}
+	async runBatches(startedAt) {
+		const observed = await readRescoreFingerprint(this.ports);
+		if (observed === null) throw new Error("the cluster face-embedding model could not be resolved");
+		const { clusterModelId, fingerprint } = observed;
+		const [gallery, identityNames] = await Promise.all([this.ports.loadGallery(), this.ports.identityNames()]);
+		const ids = await this.ports.listPendingFaceIds();
+		this.patch({
+			total: ids.length,
+			galleryFingerprint: fingerprint.gallery,
+			fingerprint: fingerprint.combined
+		});
+		const paramsByDevice = /* @__PURE__ */ new Map();
+		for (const batchIds of chunk(ids, RESCORE_BATCH_SIZE)) {
+			if (this.stopped) throw new Error("stopped before completion");
+			const storeStart = this.ports.now();
+			const batch = await this.ports.loadRescoreBatch(batchIds);
+			const readMs = this.ports.now() - storeStart;
+			const outcome = await this.scoreBatch(batch.rows, {
+				gallery,
+				identityNames,
+				clusterModelId,
+				paramsByDevice
+			});
+			const writeStart = this.ports.now();
+			await this.ports.applySuggestionBatch(outcome.updates);
+			const storeMs = readMs + (this.ports.now() - writeStart);
+			const s = this.current;
+			this.patch({
+				scanned: s.scanned + batchIds.length,
+				changed: s.changed + outcome.updates.length,
+				newlySuggested: s.newlySuggested + outcome.tally.new,
+				raised: s.raised + outcome.tally.raised,
+				lowered: s.lowered + outcome.tally.lowered,
+				cleared: s.cleared + outcome.tally.cleared,
+				modelMismatch: s.modelMismatch + outcome.modelMismatch,
+				noVector: s.noVector + batch.noVector,
+				batches: s.batches + 1,
+				maxBatchStoreMs: Math.max(s.maxBatchStoreMs, storeMs),
+				durationMs: this.ports.now() - startedAt
+			});
+			this.ports.logger.debug("face rescore batch", { meta: {
+				jobId: s.jobId,
+				size: batchIds.length,
+				written: outcome.updates.length,
+				storeMs
+			} });
+			await this.ports.pause(pauseFor(storeMs));
+		}
+	}
+	async scoreBatch(rows, ctx) {
+		const updates = [];
+		const tally = {
+			new: 0,
+			raised: 0,
+			lowered: 0,
+			cleared: 0
+		};
+		let modelMismatch = 0;
+		for (const row of rows) {
+			let params = ctx.paramsByDevice.get(row.deviceId);
+			if (params === void 0) {
+				params = await this.ports.paramsForDevice(row.deviceId);
+				ctx.paramsByDevice.set(row.deviceId, params);
+			}
+			const report = buildFaceRescoreReport({
+				probe: {
+					embedding: row.embedding,
+					modelId: row.modelId
+				},
+				gallery: ctx.gallery,
+				identityNames: ctx.identityNames,
+				clusterModelId: ctx.clusterModelId,
+				params
+			});
+			const captured = { value: null };
+			if (await persistRescoreResult(row.id, report, { setSuggestion: (_id, suggestion) => {
+				captured.value = suggestion;
+				return Promise.resolve();
+			} }) === "not-comparable") {
+				modelMismatch += 1;
+				continue;
+			}
+			const change = classifyRescoreChange(storedSuggestion(row), captured.value);
+			if (change === "unchanged") continue;
+			tally[change] += 1;
+			updates.push({
+				faceId: row.id,
+				suggestion: captured.value
+			});
+			this.ports.logger.debug("face rescore changed a suggestion", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					faceId: row.id,
+					change,
+					from: row.suggestedIdentityId ?? null,
+					fromScore: row.suggestedMatchScore ?? null,
+					to: decideRescorePersistence(report)?.identityId ?? null
+				}
+			});
+		}
+		return {
+			updates,
+			tally,
+			modelMismatch
+		};
+	}
+};
+//#endregion
+//#region src/pipeline-analytics/face-rescore-scheduler.ts
+var FACE_RESCORE_TICK_MS = 6e4;
+var FaceRescoreScheduler = class {
+	deps;
+	lastCheckAt;
+	ticking = false;
+	constructor(deps, startedAt) {
+		this.deps = deps;
+		this.lastCheckAt = startedAt;
+	}
+	async tick() {
+		if (this.ticking) return "busy";
+		this.ticking = true;
+		try {
+			return await this.decideAndRun();
+		} finally {
+			this.ticking = false;
+		}
+	}
+	async decideAndRun() {
+		const minutes = await this.readInterval();
+		if (minutes === null) return "setting-unreadable";
+		if (minutes === 0) return "disabled";
+		const now = this.deps.now();
+		if (now - this.lastCheckAt < minutes * 6e4) return "not-due";
+		this.lastCheckAt = now;
+		if (this.deps.job.isRunning()) return "busy";
+		const observed = await this.observe();
+		if (observed === null) return "unreadable";
+		const previous = await this.deps.state.load();
+		if (previous !== null && previous.fingerprint === observed) {
+			this.deps.logger.info("face rescore skipped, unchanged", { meta: {
+				fingerprint: observed,
+				lastRunAt: previous.finishedAt
+			} });
+			return "unchanged";
+		}
+		this.deps.job.start();
+		await this.deps.job.whenSettled();
+		return this.deps.job.status().state === "completed" ? "ran" : "failed";
+	}
+	async readInterval() {
+		try {
+			return await this.deps.readIntervalMinutes();
+		} catch (err) {
+			this.deps.logger.warn("face rescore interval unreadable — tick skipped", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
+		}
+	}
+	async observe() {
+		try {
+			const seen = await readRescoreFingerprint(this.deps.fingerprintPorts);
+			if (seen === null) {
+				this.deps.logger.warn("face rescore tick skipped — cluster face model unresolved");
+				return null;
+			}
+			return seen.fingerprint.combined;
+		} catch (err) {
+			this.deps.logger.warn("face rescore fingerprint unreadable — tick skipped", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
+		}
+	}
+};
+//#endregion
+//#region src/pipeline-analytics/face-rescore-wiring.ts
+/**
+* face-rescore-wiring — binds the whole-archive rescore job (D866) to the real
+* stores, the cluster model pin and the orchestrator's interval setting.
+*
+* Kept out of `index.ts` (20 000 lines): the addon holds the returned runtime
+* and forwards three things to it — the two actions, the timer tick, stop.
+*/
+function buildFaceRescoreRuntime(deps, startedAt) {
+	const { faceStore, identityStore, logger } = deps;
+	const resolveClusterModelId = () => require_clip_model_registry.resolveClusterModelPin(deps.api, require_clip_model_registry.FACE_EMBEDDING_STEP_ID, { warn: (m, e) => logger.warn(m, e) });
+	const galleryManifest = () => identityStore.galleryManifest();
+	const pendingMarker = () => faceStore.pendingMarker();
+	const job = new FaceRescoreJob({
+		resolveClusterModelId,
+		galleryManifest,
+		pendingMarker,
+		loadGallery: () => identityStore.loadGallery(),
+		identityNames: async () => new Map((await identityStore.listIdentities()).map((i) => [i.id, i.name])),
+		paramsForDevice: deps.paramsForDevice,
+		listPendingFaceIds: () => faceStore.listPendingFaceIds(),
+		loadRescoreBatch: (ids) => faceStore.loadRescoreBatch(ids),
+		applySuggestionBatch: (updates) => faceStore.applySuggestionBatch(updates),
+		recordCompletion: (status) => deps.state.save({
+			fingerprint: status.fingerprint,
+			finishedAt: Date.now(),
+			report: status
+		}),
+		pause: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		now: () => Date.now(),
+		newJobId: () => (0, node_crypto.randomUUID)(),
+		logger
+	});
+	return {
+		job,
+		scheduler: new FaceRescoreScheduler({
+			readIntervalMinutes: async () => require_clip_model_registry.pickFaceRescoreIntervalMinutes(await deps.api.addonSettings.getGlobalSettings.query({ addonId: require_clip_model_registry.CLUSTER_MODEL_OWNER_ADDON_ID })),
+			job,
+			fingerprintPorts: {
+				resolveClusterModelId,
+				galleryManifest,
+				pendingMarker
+			},
+			state: deps.state,
+			now: () => Date.now(),
+			logger
+		}, startedAt)
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/store/face-rescore-state-store.ts
+/**
+* @durable class=config owner=pipeline-analytics
+*   write="one row, rewritten when a whole-archive face rescore completes"
+*   loss="the next scheduler tick reruns the rescore once — idempotent over an
+*     unchanged gallery"
+*   retention="never pruned: one row"
+*/
+var FACE_RESCORE_STATE_COLLECTION = "pipeline-analytics:face-rescore-state";
+var STATE_KEY = "last-run";
+var FaceRescoreStateStore = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: FACE_RESCORE_STATE_COLLECTION,
+			columns: [{
+				name: "data",
+				type: "TEXT",
+				notNull: true
+			}]
+		});
+	}
+	/** `null` on no row OR an unreadable one: either way the next tick reruns. */
+	load = async () => {
+		try {
+			return decodeRunState(await this.deps.store.get.query({
+				collection: FACE_RESCORE_STATE_COLLECTION,
+				key: STATE_KEY
+			}) ?? null);
+		} catch (err) {
+			this.deps.logger.warn("face rescore state unreadable — treating as never run", { meta: { error: String(err) } });
+			return null;
+		}
+	};
+	/** THROWS: a state that did not land must be visible to the caller. */
+	save = async (state) => {
+		await this.deps.store.set.mutate({
+			collection: FACE_RESCORE_STATE_COLLECTION,
+			key: STATE_KEY,
+			value: {
+				fingerprint: state.fingerprint,
+				finishedAt: state.finishedAt,
+				report: state.report
+			}
+		});
+	};
+};
+/** Narrow a stored row; anything malformed is "no previous run". */
+function decodeRunState(value) {
+	if (value === null || typeof value !== "object") return null;
+	const row = { ...value };
+	const fingerprint = row["fingerprint"];
+	const finishedAt = row["finishedAt"];
+	const report = row["report"];
+	if (typeof fingerprint !== "string" || fingerprint === "") return null;
+	if (typeof finishedAt !== "number") return null;
+	const parsed = FaceRescoreJobStatusSchema.safeParse(report);
+	return parsed.success ? {
+		fingerprint,
+		finishedAt,
+		report: parsed.data
+	} : null;
+}
 //#endregion
 //#region src/pipeline-analytics/face-sample-reembed.ts
 /** Pacing between samples — off hub-main's thread, not a throttle. */
@@ -76612,6 +77306,39 @@ function clampBox(b, frameWidth, frameHeight) {
 		h: Math.max(1, Math.min(Math.round(b.h), frameHeight - y))
 	};
 }
+/** The SVG overlay: one `<rect>` per box plus an optional caption. */
+function buildBoxOverlaySvg(boxes, frameWidth, frameHeight) {
+	const fontSize = Math.max(12, Math.round(frameHeight / 30));
+	return `<svg xmlns="http://www.w3.org/2000/svg" width="${frameWidth}" height="${frameHeight}">${boxes.map((b) => {
+		const c = clampBox(b, frameWidth, frameHeight);
+		const color = b.color ?? DEFAULT_COLOR;
+		const rect = `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${c.h}" fill="none" stroke="${color}" stroke-width="${STROKE_WIDTH}"/>`;
+		if (!b.label) return rect;
+		const ty = Math.max(fontSize, c.y - 4);
+		return rect + `<text x="${c.x}" y="${ty}" font-family="sans-serif" font-size="${fontSize}" fill="${color}" stroke="black" stroke-width="0.5">${escapeXml(b.label)}</text>`;
+	}).join("")}</svg>`;
+}
+/**
+* Draw bounding boxes over a frame that is still a JPEG and re-encode it in ONE
+* libvips pipeline (decode, composite, encode). The raw RGB surface never
+* exists in the JS process: {@link drawBoxedFrame} needs it handed in, which for
+* a consumer that only re-encodes meant a 1-6 MB V8-external buffer per tile
+* (D867). Same overlay and quality contract; no `maxWidth` — the caller asked
+* the owning runner for the size it wants.
+*/
+async function drawBoxedJpeg(jpeg, frameWidth, frameHeight, boxes, opts = {}) {
+	const quality = opts.quality ?? DEFAULT_QUALITY;
+	let pipeline = (0, sharp.default)(jpeg);
+	if (boxes.length > 0) {
+		const svg = buildBoxOverlaySvg(boxes, frameWidth, frameHeight);
+		pipeline = pipeline.composite([{
+			input: Buffer.from(svg),
+			top: 0,
+			left: 0
+		}]);
+	}
+	return pipeline.jpeg({ quality }).toBuffer();
+}
 /**
 * Draw bounding boxes over a raw RGB frame and JPEG-encode it.
 *
@@ -76625,15 +77352,7 @@ async function drawBoxedFrame(frameData, frameWidth, frameHeight, boxes, opts =
 	let base = frameData;
 	let baseIsRaw = true;
 	if (boxes.length > 0) {
-		const fontSize = Math.max(12, Math.round(frameHeight / 30));
-		const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${frameWidth}" height="${frameHeight}">${boxes.map((b) => {
-			const c = clampBox(b, frameWidth, frameHeight);
-			const color = b.color ?? DEFAULT_COLOR;
-			const rect = `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${c.h}" fill="none" stroke="${color}" stroke-width="${STROKE_WIDTH}"/>`;
-			if (!b.label) return rect;
-			const ty = Math.max(fontSize, c.y - 4);
-			return rect + `<text x="${c.x}" y="${ty}" font-family="sans-serif" font-size="${fontSize}" fill="${color}" stroke="black" stroke-width="0.5">${escapeXml(b.label)}</text>`;
-		}).join("")}</svg>`;
+		const svg = buildBoxOverlaySvg(boxes, frameWidth, frameHeight);
 		base = await (0, sharp.default)(frameData, { raw: {
 			width: frameWidth,
 			height: frameHeight,
@@ -77207,7 +77926,7 @@ function createDebugCropCapture(deps) {
 * `extractCrop` (which crops a FULL frame) so the native path never re-crops.
 */
 async function encodeRgbCropToJpeg(bytes, width, height) {
-	return (0, sharp.default)(Buffer.from(bytes), { raw: {
+	return (0, sharp.default)(bytes, { raw: {
 		width,
 		height,
 		channels: 3
@@ -77226,7 +77945,7 @@ async function encodeRgbCropToJpeg(bytes, width, height) {
 * what lets the caller stop base64-ing purely to be understood.
 */
 async function decodeJpegToRgb(jpeg) {
-	const { data, info } = await (0, sharp.default)(typeof jpeg === "string" ? Buffer.from(jpeg, "base64") : Buffer.from(jpeg)).raw().toBuffer({ resolveWithObject: true });
+	const { data, info } = await (0, sharp.default)(typeof jpeg === "string" ? Buffer.from(jpeg, "base64") : jpeg).raw().toBuffer({ resolveWithObject: true });
 	return {
 		bytes: data,
 		width: info.width,
@@ -77871,13 +78590,14 @@ var AnalyticsQueryFacade = class {
 			cutoffMs: Number.MAX_SAFE_INTEGER
 		});
 		const total = counts.motion + counts.object + counts.audio;
+		const byRemoval = input.reason !== void 0;
 		await this.deps.opsLog()?.append({
-			op: "manual-delete",
-			reason: "manual",
+			op: byRemoval ? "prune" : "manual-delete",
+			reason: input.reason ?? "manual",
 			deviceId: input.deviceId,
 			itemsAffected: total,
 			bytesReclaimed: 0,
-			detail: "deleted all events for device"
+			detail: byRemoval ? "the device was deleted — its events were removed with it" : "deleted all events for device"
 		});
 		return counts;
 	}
@@ -79949,6 +80669,53 @@ var DeviceAlertSettingsSchema = require_clip_model_registry.object({
 /** The shipped defaults, for the settings-schema form and for tests. */
 var DEVICE_ALERT_DEFAULTS = DeviceAlertSettingsSchema.parse({});
 //#endregion
+//#region src/pipeline-analytics/device-removal-hook.ts
+function createAnalyticsRemovalHook(deps) {
+	return {
+		onDeviceRemoved: async (input) => {
+			const { deviceId } = input;
+			const events = await deps.deleteDeviceEvents({
+				deviceId,
+				reason: "orphaned-device"
+			});
+			const tracks = await deps.wipeAllAnalytics({ deviceId });
+			const sensor = await deps.evictSensorEvents(deviceId, Number.MAX_SAFE_INTEGER);
+			const counts = {
+				events: events.motion + events.object + events.audio,
+				tracks: tracks.tracks,
+				"track-events": tracks.events,
+				media: tracks.media,
+				faces: tracks.faces,
+				plates: tracks.plates,
+				embeddings: tracks.embeddings,
+				"sensor-events": sensor
+			};
+			if (Object.values(counts).reduce((sum, n) => sum + n, 0) > 0) deps.logger.info("pipeline-analytics: removed the data of a deleted device", {
+				tags: { deviceId },
+				meta: {
+					counts,
+					deletedAt: input.deletedAt
+				}
+			});
+			return { counts };
+		},
+		listDeviceData: async () => {
+			const out = [];
+			for (const [deviceId, count] of await deps.eventCountsByDevice()) if (count > 0 && Number.isInteger(deviceId) && deviceId > 0) out.push({
+				store: "events",
+				deviceId,
+				count
+			});
+			for (const deviceId of await deps.trackDeviceIds()) if (Number.isInteger(deviceId) && deviceId > 0) out.push({
+				store: "tracks",
+				deviceId,
+				count: 1
+			});
+			return out;
+		}
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/device-settings-cache.ts
 /**
 * TTL cache for ONE settings kind, keyed by deviceId. Obtain instances via
@@ -89434,7 +90201,7 @@ function createKeyFrameCrop(deps) {
 			return null;
 		}
 		try {
-			const rgb = await deps.decodeJpegToRgb(media.base64);
+			const rgb = await deps.decodeJpegToRgb(media.bytes);
 			if (rgb.width <= 0 || rgb.height <= 0) return null;
 			const norm = padBbox({
 				x: input.bbox.x / input.frameWidth,
@@ -89442,7 +90209,7 @@ function createKeyFrameCrop(deps) {
 				w: input.bbox.w / input.frameWidth,
 				h: input.bbox.h / input.frameHeight
 			}, input.padding);
-			const jpeg = await deps.cropRegionToJpeg(Buffer.from(rgb.bytes), rgb.width, rgb.height, norm);
+			const jpeg = await deps.cropRegionToJpeg(rgb.bytes, rgb.width, rgb.height, norm);
 			return verdict.kind === "agrees" ? {
 				jpeg,
 				skewMs,
@@ -97746,6 +98513,29 @@ var IdentityStore = class {
 			};
 		});
 	}
+	/**
+	* The gallery's IDENTITY of the moment — sample id, owner and model of every
+	* sample, no vectors. What the rescore change detector hashes; projected so a
+	* periodic look costs a few narrow columns, not the gallery's floats.
+	*/
+	async galleryManifest() {
+		const rows = await this.store.query.query({
+			collection: IDENTITY_SAMPLES_COLLECTION,
+			columns: ["identityId", "modelId"],
+			filter: {}
+		});
+		const out = [];
+		for (const r of rows) {
+			const identityId = r.data["identityId"];
+			const modelId = r.data["modelId"];
+			if (typeof identityId === "string" && typeof modelId === "string") out.push({
+				sampleId: r.id,
+				identityId,
+				modelId
+			});
+		}
+		return out;
+	}
 	async addSample(input) {
 		const sample = {
 			id: (0, node_crypto.randomUUID)(),
@@ -98044,7 +98834,7 @@ var IdentityStore = class {
 			const d = r.data;
 			if (typeof d.modelId === "string" && typeof d.identityId === "string") wanted.push(r.id);
 		}
-		const vectors = await this.vectors.loadStamped(wanted);
+		const vectors = await this.vectors.loadStampedFloat32(wanted);
 		const gallery = [];
 		let fromLegacyColumn = 0;
 		let missing = 0;
@@ -98074,7 +98864,7 @@ var IdentityStore = class {
 				fromLegacyColumn += 1;
 				gallery.push({
 					identityId: d.identityId,
-					embedding: legacy,
+					embedding: new Float32Array(legacy),
 					modelId: d.modelId
 				});
 				continue;
@@ -101998,6 +102788,7 @@ function createNativeFrameTransport(deps) {
 	};
 	const getRemoteFrame = async (handle) => closeWindowAfter(requestNativeCrop(handle, FULL_FRAME_BBOX, handle.width, replyToFullFrame));
 	const getNativeFullFrameRgb = async (handle, maxWidth) => closeWindowAfter(requestNativeCrop(handle, FULL_FRAME_BBOX, maxWidth, replyToFullFrame));
+	const getNativeFullFrameJpeg = async (handle, maxWidth) => closeWindowAfter(requestNativeCrop(handle, FULL_FRAME_BBOX, maxWidth, cropReplyToJpeg));
 	const fetchNativeFullFrameTiered = async (handle, maxWidth) => closeWindowAfter(requestNativeCrop(handle, FULL_FRAME_BBOX, maxWidth, replyToTieredFullFrame));
 	const cropMetricLogger = logger.child("NativeCrop");
 	let nativeHits = 0;
@@ -102106,6 +102897,7 @@ function createNativeFrameTransport(deps) {
 	return {
 		getRemoteFrame,
 		getNativeFullFrameRgb,
+		getNativeFullFrameJpeg,
 		getNativeCropJpeg,
 		captureCrop: createCaptureCrop({
 			tryNativeCrop,
@@ -103924,6 +104716,9 @@ var EventMediaDispatcher = class {
 	* {@link SNAPSHOT_MAX_WIDTH} here (the only dispatcher use of the fetch).
 	*/
 	sharedNativeFullFrame;
+	/** The JPEG twin of {@link sharedNativeFullFrame} — the boxed tiles' source
+	*  (a few tens of kB held instead of a 1.5 MB RGB surface). */
+	sharedNativeFullJpeg;
 	/** Once-per-owner (`${eventId}:${kind}`) memo for the DISPLAY-crop fallback
 	*  info log — see {@link logDisplayFallbackOnce}. */
 	loggedDisplayFallbacks = /* @__PURE__ */ new Set();
@@ -103932,11 +104727,12 @@ var EventMediaDispatcher = class {
 	constructor(deps) {
 		this.deps = deps;
 		this.sharedNativeFullFrame = createSharedFrameResolver((handle) => this.deps.getNativeFullFrameRgb(handle, SNAPSHOT_MAX_WIDTH));
+		this.sharedNativeFullJpeg = createSharedFrameResolver(async (handle) => this.deps.getNativeFullFrameJpeg ? this.deps.getNativeFullFrameJpeg(handle, SNAPSHOT_MAX_WIDTH) : null);
 	}
 	/**
 	* Resolve the ≤640 detection frame by handle NOW — in the caller's LIVE frame
-	* window — and COPY its pixel data (`Buffer.from`) so ring recycling can never
-	* touch it. This is the seam the per-frame batch dispatch uses to pin the
+	* window — and hold the privately owned pixel buffer the fetch returned (no
+	* copy — D867), so ring recycling can never touch it. This is the seam the per-frame batch dispatch uses to pin the
 	* frame BEFORE queueing on the CaptureScheduler: since S3 the batch is one
 	* scheduler request against a 3-slot device lane and can start seconds late,
 	* by which time the handle's ring slot is usually recycled and the by-handle
@@ -103964,10 +104760,7 @@ var EventMediaDispatcher = class {
 				this.warnPinnedFrameMiss(deviceId, frameHandle, "recycled-before-pin");
 				return null;
 			}
-			return {
-				...decoded,
-				data: Buffer.from(decoded.data)
-			};
+			return decoded;
 		} catch (err) {
 			this.warnPinnedFrameMiss(deviceId, frameHandle, "threw", String(err));
 			return null;
@@ -104040,7 +104833,7 @@ var EventMediaDispatcher = class {
 			this.warnBatchLost("resolved frame is not RGB", input, { format: decoded.format });
 			return empty;
 		}
-		const frameData = input.pinnedFrame !== void 0 ? decoded.data : Buffer.from(decoded.data);
+		const frameData = decoded.data;
 		const fw = decoded.width;
 		const fh = decoded.height;
 		if (isUniformRgbFrame(frameData, fw, fh)) {
@@ -104368,9 +105161,11 @@ var EventMediaDispatcher = class {
 	*/
 	async boxedTimelineFrame(deviceId, frameHandle, frameData, fw, fh, ownerId, bbox, label) {
 		let nf = null;
+		let nfJpeg = null;
 		let fetchThrew = false;
 		try {
-			nf = await this.sharedNativeFullFrame(frameHandle);
+			if (this.deps.getNativeFullFrameJpeg) nfJpeg = await this.sharedNativeFullJpeg(frameHandle);
+			else nf = await this.sharedNativeFullFrame(frameHandle);
 		} catch (err) {
 			fetchThrew = true;
 			this.deps.logger.warn("native full frame fetch threw — 640 boxed fallback", {
@@ -104383,6 +105178,15 @@ var EventMediaDispatcher = class {
 			});
 		}
 		try {
+			if (nfJpeg && nfJpeg.width > 0 && nfJpeg.height > 0) {
+				const box = scaleBox(bbox, fw, fh, nfJpeg.width, nfJpeg.height, label);
+				const opts = { quality: MEDIA_QUALITY };
+				const [boxed, clean] = await Promise.all([drawBoxedJpeg(nfJpeg.jpeg, nfJpeg.width, nfJpeg.height, [box], opts), drawBoxedJpeg(nfJpeg.jpeg, nfJpeg.width, nfJpeg.height, [], opts)]);
+				return {
+					boxed,
+					clean
+				};
+			}
 			if (nf && nf.format === "rgb" && nf.width > 0 && nf.height > 0) {
 				const box = scaleBox(bbox, fw, fh, nf.width, nf.height, label);
 				const opts = { quality: MEDIA_QUALITY };
@@ -104831,6 +105635,17 @@ Object.freeze({
 		"page": 1,
 		"pageSize": 50
 	} },
+	"device-credentials": { "listDeviceCredentials": { "includeRevoked": false } },
+	"device-history": {
+		"query": {
+			"resolution": "auto",
+			"maxPoints": 1e3
+		},
+		"queryNode": {
+			"resolution": "auto",
+			"maxPoints": 1e3
+		}
+	},
 	"device-manager": { "adoptionListCandidates": {
 		"page": 1,
 		"pageSize": 50
@@ -105083,6 +105898,7 @@ Object.freeze({
 	"device-export": ["listExposedDevices", "listSupportedDeviceKinds"],
 	"device-extension": ["listSlots", "listSources"],
 	"device-provider": ["discoverDevices", "getDevices"],
+	"device-removal-hook": ["listDeviceData"],
 	"failure-contribution": ["list"],
 	"llm": [
 		"getDefaults",
@@ -111655,6 +112471,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 	*/
 	faceAlignmentJobs = null;
 	faceGalleryPruneTimer = null;
+	/** D866: the whole-archive rescore job + its change-gated hourly scheduler. */
+	faceRescoreRuntime = null;
+	faceRescoreState = null;
+	faceRescoreTimer = null;
 	/**
 	* Analysed photographs waiting to be named, held between `photo.analyze` and
 	* `photo.enroll`. Bounded and expiring — the value held is a whole
@@ -112596,13 +113416,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		if (!this._keyFrameThumbnailDerive) {
 			const deriveKeyFrameThumbnailJpeg = createKeyFrameCrop({
 				getMedia: async (mediaKey) => {
-					const m = await this.mediaStore?.getById(mediaKey);
+					const m = await this.mediaStore?.getBytesById(mediaKey);
 					return m ? {
-						base64: m.base64,
+						bytes: m.bytes,
 						timestamp: m.timestamp
 					} : null;
 				},
-				decodeJpegToRgb: (base64) => decodeJpegToRgb(base64),
+				decodeJpegToRgb: (jpeg) => decodeJpegToRgb(jpeg),
 				cropRegionToJpeg: (bytes, w, h, norm) => cropWideCentralSquareFromRgb(bytes, w, h, norm),
 				maxSkewMs: KEYFRAME_CROP_MAX_SKEW_MS,
 				minSubjectIou: KEYFRAME_CROP_MIN_SUBJECT_IOU,
@@ -113295,6 +114115,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			getRemoteFrame: transport.getRemoteFrame,
 			getNativeCropJpeg: transport.getNativeCropJpeg,
 			getNativeFullFrameRgb: transport.getNativeFullFrameRgb,
+			getNativeFullFrameJpeg: transport.getNativeFullFrameJpeg,
 			getParkedSubjectSlab: (deviceId, trackId) => this.fetchParkedSubjectSlab(deviceId, trackId),
 			mediaStore: stores.mediaStore,
 			logger: logger.child("EventMediaDispatcher"),
@@ -113622,8 +114443,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			NotificationCenter.declare(api.settingsStore),
 			ViewerSettingsSnapshotStore.declare(api.settingsStore),
 			declareMigrationMarkers(api.settingsStore),
-			SweepCursorStore.declare(api.settingsStore)
+			SweepCursorStore.declare(api.settingsStore),
+			FaceRescoreStateStore.declare(api.settingsStore)
 		]);
+		this.faceRescoreState = new FaceRescoreStateStore({
+			store: api.settingsStore,
+			logger: this.ctx.logger.child("FaceRescoreState")
+		});
 		this.sweepCursors = new SweepCursorStore({
 			store: api.settingsStore,
 			logger: this.ctx.logger.child("SweepCursors")
@@ -113856,8 +114682,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			writeGate: this.mediaWriteGate,
 			measureChroma: (bytes) => chromaSpread(bytes),
 			readSource: async (mediaKey) => {
-				const file = await mediaStore.getById(mediaKey);
-				return file === null ? null : Buffer.from(file.base64, "base64");
+				const file = await mediaStore.getBytesById(mediaKey);
+				return file === null ? null : file.bytes;
 			}
 		});
 		const retrainAnnotations = new RetrainAnnotationStore({
@@ -113886,8 +114712,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			media: {
 				listTrackMedia: (trackId) => mediaStore.listInfoByOwner("track", trackId),
 				readBlob: async (mediaKey) => {
-					const file = await mediaStore.getById(mediaKey);
-					return file === null ? null : Buffer.from(file.base64, "base64");
+					const file = await mediaStore.getBytesById(mediaKey);
+					return file === null ? null : file.bytes;
 				}
 			},
 			frames: retrainFrames,
@@ -114226,13 +115052,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		const plateMediaStore = stores.mediaStore;
 		const deriveCropFromKeyFrame = createKeyFrameCrop({
 			getMedia: async (mediaKey) => {
-				const m = await plateMediaStore.getById(mediaKey);
+				const m = await plateMediaStore.getBytesById(mediaKey);
 				return m ? {
-					base64: m.base64,
+					bytes: m.bytes,
 					timestamp: m.timestamp
 				} : null;
 			},
-			decodeJpegToRgb: (base64) => decodeJpegToRgb(base64),
+			decodeJpegToRgb: (jpeg) => decodeJpegToRgb(jpeg),
 			cropRegionToJpeg: async (bytes, w, h, norm) => (await extractCrop(bytes, w, h, norm)).crop,
 			maxSkewMs: KEYFRAME_CROP_MAX_SKEW_MS,
 			minSubjectIou: KEYFRAME_CROP_MIN_SUBJECT_IOU,
@@ -114775,9 +115601,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				}));
 			},
 			readMedia: async (mediaId) => {
-				const file = await stores.mediaStore.getById(mediaId);
+				const file = await stores.mediaStore.getBytesById(mediaId);
 				if (file === null) return null;
-				return Buffer.from(file.base64, "base64");
+				return file.bytes;
 			},
 			locationDescriptions: async () => {
 				const rows = await api.deviceManager.listLocationDescriptions.query();
@@ -115030,8 +115856,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			const handler = createTrainingExportHandler({
 				buildPlan: (deviceIds) => this.buildTrainingExportPlan(deviceIds),
 				readBlob: async (mediaId) => {
-					const file = await (this.mediaStore?.getById(mediaId) ?? Promise.resolve(null));
-					return file === null ? null : Buffer.from(file.base64, "base64");
+					const file = await (this.mediaStore?.getBytesById(mediaId) ?? Promise.resolve(null));
+					return file === null ? null : file.bytes;
 				},
 				logger: this.ctx.logger,
 				now: () => Date.now()
@@ -115501,8 +116327,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			const handler = createDebugExportHandler({
 				buildPlan: (deviceIds) => buildDebugBundlePlan(this.buildDebugServiceDeps(), deviceIds),
 				readMedia: async (key) => {
-					const file = await this.mediaStore?.getById(key);
-					return file === null || file === void 0 ? null : Buffer.from(file.base64, "base64");
+					const file = await this.mediaStore?.getBytesById(key);
+					return file === null || file === void 0 ? null : file.bytes;
 				},
 				logger: this.ctx.logger.child("debug-export"),
 				now: () => Date.now()
@@ -115897,7 +116723,18 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				trackId: o.trackId,
 				deviceId: o.deviceId
 			})),
-			externalNonBufferMb: Math.max(0, Math.round((mem.external - mem.arrayBuffers) / 1048576))
+			externalNonBufferMb: Math.max(0, Math.round((mem.external - mem.arrayBuffers) / 1048576)),
+			mapSizes: {
+				processors: this.processors.size,
+				processorInputs: this.processorInputs.size,
+				lastActiveTrackIds: this.lastActiveTrackIds.size,
+				shortMotionlessCells: this.shortMotionlessCells.size,
+				proxies: this.proxies.size,
+				lastRunnerNodeByDevice: this.lastRunnerNodeByDevice.size,
+				pendingConfirmationLooks: this.pendingConfirmationLooks.size,
+				audioEpisodeTracks: this.audioEpisodeTracks.size,
+				detailStepsByDevice: this.detailStepsByDevice.size
+			}
 		} });
 	}
 	/** Residents neither active in the TrackStore nor carried by the tracker
@@ -115920,6 +116757,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		this.faceReembedAutoTimer = setInterval(() => {
 			this.maybeAutoReembedFaces().then(() => this.faceAlignmentJobs?.maybeAutoRunPhotoPass());
 		}, FACE_REEMBED_AUTO_CHECK_MS);
+		this.faceRescoreTimer = setInterval(() => {
+			this.faceRescoreRuntimeOrNull()?.scheduler.tick().catch((err) => {
+				this.ctx.logger.warn("face rescore tick failed", { meta: { error: String(err) } });
+			});
+		}, FACE_RESCORE_TICK_MS);
 		this.faceGalleryPruneTimer = setInterval(() => {
 			this.faceAlignmentJobs?.prune();
 		}, FACE_GALLERY_PRUNE_INTERVAL_MS);
@@ -116332,9 +117174,35 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			...this.sceneProvider !== null ? [{
 				capability: require_clip_model_registry.sceneMonitorCapability,
 				provider: this.sceneProvider
-			}] : []
+			}] : [],
+			{
+				capability: require_clip_model_registry.deviceRemovalHookCapability,
+				provider: this.removalHook
+			}
 		];
 	}
+	/** The `device-removal-hook` provider (D865): told by device-manager, caught up from its tombstones. */
+	get removalHook() {
+		this.removalHookImpl ??= createAnalyticsRemovalHook({
+			logger: this.ctx.logger,
+			deleteDeviceEvents: (input) => this.deleteDeviceEvents(input),
+			wipeAllAnalytics: (input) => this.wipeAllAnalytics(input),
+			evictSensorEvents: async (deviceId, cutoffMs) => await this.sensorEventStore?.evictBefore(deviceId, cutoffMs) ?? 0,
+			eventCountsByDevice: async () => await this.eventStore?.countByDevice() ?? /* @__PURE__ */ new Map(),
+			trackDeviceIds: async () => await this.trackStore?.listDeviceIds() ?? []
+		});
+		return this.removalHookImpl;
+	}
+	removalHookImpl = null;
+	/** Catch up on deletions missed while this addon was down (D865) — tombstones only. */
+	async onHubReachable() {
+		await super.onHubReachable();
+		this.ctx.addDisposer(require_clip_model_registry.armRemovalReconcile({
+			api: this.ctx.api,
+			logger: this.ctx.logger,
+			remove: (input) => this.removalHook.onDeviceRemoved(input)
+		}));
+	}
 	/**
 	* `BaseAddon.updateGlobalSettings` calls this after the write lands —
 	* gated to the LOCAL node's own write (a sibling-node write returns before
@@ -116396,6 +117264,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			clearInterval(this.faceGalleryPruneTimer);
 			this.faceGalleryPruneTimer = null;
 		}
+		if (this.faceRescoreTimer) {
+			clearInterval(this.faceRescoreTimer);
+			this.faceRescoreTimer = null;
+		}
+		this.faceRescoreRuntime?.job.stop();
 		if (this.orphanAuditTimer) {
 			clearInterval(this.orphanAuditTimer);
 			this.orphanAuditTimer = null;
@@ -122341,8 +123214,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				loadAlignedCrop: async (sample) => {
 					if (sample.mediaId === void 0) return null;
 					try {
-						const file = await mediaStore.getById(sample.mediaId);
-						return file === null ? null : Buffer.from(file.base64, "base64");
+						const file = await mediaStore.getBytesById(sample.mediaId);
+						return file === null ? null : file.bytes;
 					} catch (err) {
 						this.ctx.logger.warn("face re-embed: aligned crop read threw", { meta: {
 							sampleId: sample.sampleId,
@@ -122406,8 +123279,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				loadAlignedCrop: async (sample) => {
 					if (sample.mediaId === void 0) return null;
 					try {
-						const file = await mediaStore.getById(sample.mediaId);
-						return file === null ? null : Buffer.from(file.base64, "base64");
+						const file = await mediaStore.getBytesById(sample.mediaId);
+						return file === null ? null : file.bytes;
 					} catch (err) {
 						this.ctx.logger.warn("face sample re-embed: aligned crop read threw", { meta: {
 							sampleId: sample.sampleId,
@@ -122467,8 +123340,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			loadAlignedCrop: async (sample) => {
 				if (sample.mediaId === void 0) return null;
 				try {
-					const file = await mediaStore.getById(sample.mediaId);
-					return file === null ? null : Buffer.from(file.base64, "base64");
+					const file = await mediaStore.getBytesById(sample.mediaId);
+					return file === null ? null : file.bytes;
 				} catch (err) {
 					this.ctx.logger.warn("face embedding audit: aligned crop read threw", { meta: {
 						sampleId: sample.sampleId,
@@ -122614,9 +123487,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		};
 		if (!api || !faceStore || !mediaStore) return refuse("failed", "the addon API or the face/media stores are not ready");
 		if (face.mediaId === void 0) return refuse("no-pixels", "this face kept no crop — there is nothing to re-embed from");
-		const file = await mediaStore.getById(face.mediaId);
+		const file = await mediaStore.getBytesById(face.mediaId);
 		if (file === null) return refuse("no-pixels", `the crop blob ${face.mediaId} is gone`);
-		const raster = await decodeJpegToRgb(file.base64);
+		const raster = await decodeJpegToRgb(file.bytes);
 		const templatePx = PipelineAnalyticsAddon.ARCFACE_TEMPLATE_PX;
 		if (raster.width !== templatePx || raster.height !== templatePx) return refuse("not-a-template", `the stored crop is ${raster.width}×${raster.height}, not the ${templatePx}² aligned template — this face was captured without landmarks, so re-embedding it would produce a plausible and meaningless vector`);
 		const outcome = await new FaceReembedEmbedder({
@@ -122629,7 +123502,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			modelId: face.embeddingModelId ?? LEGACY_MODEL_ID,
 			dim: face.embedding.length,
 			mediaId: face.mediaId
-		}, Buffer.from(file.base64, "base64"));
+		}, file.bytes);
 		if (outcome.kind === "no-capable-node") return refuse("no-capable-node", outcome.reason);
 		if (outcome.kind === "failed") return refuse("failed", outcome.reason);
 		if (!await faceStore.restampEmbedding({
@@ -122771,7 +123644,34 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		};
 	}
 	buildFaceRescoreActionHandlers() {
-		return { "face.rescoreTrack": (input) => this.rescoreFaceForTrack(input) };
+		return {
+			"face.rescoreTrack": (input) => this.rescoreFaceForTrack(input),
+			"face.rescoreAll": () => Promise.resolve(this.requireFaceRescoreRuntime("face.rescoreAll").job.start()),
+			"face.rescoreStatus": () => Promise.resolve(this.requireFaceRescoreRuntime("face.rescoreStatus").job.status())
+		};
+	}
+	/** The whole-archive rescore runtime, built once the stores exist; else null. */
+	faceRescoreRuntimeOrNull() {
+		if (this.faceRescoreRuntime) return this.faceRescoreRuntime;
+		const api = this.ctx.api;
+		const faceStore = this.faceStore;
+		const identityStore = this.identityStore;
+		const state = this.faceRescoreState;
+		if (!api || !faceStore || !identityStore || !state) return null;
+		this.faceRescoreRuntime = buildFaceRescoreRuntime({
+			api,
+			faceStore,
+			identityStore,
+			state,
+			logger: this.ctx.logger.child("FaceRescore"),
+			paramsForDevice: async (deviceId) => this.faceRescoreParams(await this.resolveDeviceFaceSettings(deviceId))
+		}, Date.now());
+		return this.faceRescoreRuntime;
+	}
+	requireFaceRescoreRuntime(action) {
+		const runtime = this.faceRescoreRuntimeOrNull();
+		if (!runtime) throw new Error(`${action}: the face stores are not ready`);
+		return runtime;
 	}
 	buildStillnessCalibrationActionHandlers() {
 		return { "stillness.calibrate": (input) => this.calibrateStillnessForDevice(input) };
@@ -124390,10 +125290,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		return this.applyThumbVariant(base, variant);
 	}
 	async readMediaById(mediaId) {
-		const file = await (this.mediaStore?.getById(mediaId) ?? Promise.resolve(null));
+		const file = await (this.mediaStore?.getBytesById(mediaId) ?? Promise.resolve(null));
 		if (!file) return null;
 		return {
-			bytes: Buffer.from(file.base64, "base64"),
+			bytes: file.bytes,
 			mediaId: file.mediaId,
 			kind: file.kind,
 			deviceId: file.deviceId
@@ -124448,9 +125348,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		const listInfo = (ownerKind, id, deviceId) => this.mediaStore?.listInfoByOwner(ownerKind, id, deviceId) ?? Promise.resolve([]);
 		const getTrackIdForEvent = (eventId) => require_clip_model_registry.isEventOwnerType(ownerType) ? this.eventStore?.getTrackIdForEvent(eventId, ownerType) ?? Promise.resolve(null) : Promise.resolve(null);
 		const readBlob = async (mediaId) => {
-			const file = await (this.mediaStore?.getById(mediaId) ?? Promise.resolve(null));
+			const file = await (this.mediaStore?.getBytesById(mediaId) ?? Promise.resolve(null));
 			return file === null ? null : {
-				bytes: Buffer.from(file.base64, "base64"),
+				bytes: file.bytes,
 				mediaId: file.mediaId,
 				kind: file.kind,
 				deviceId: file.deviceId