@camstack/addon-post-analysis 1.2.48 → 1.2.50

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as object, B as errMsg, C as buildEventKindDescriptor, E as defineCustomActions, F as readDeviceStateFrom, G as isDeviceScopedCap, H as DeviceType, I as subKindsOf, J as _enum, K as nodePin, L as vectorDimFromBase64, M as notificationRulesCapability, N as pipelineAnalyticsCapability, O as encodeVectorBase64, P as plateGalleryCapability, Q as number, R as videoclipsCapability, S as audioMetricsCapability, T as customAction, U as createEvent, V as BaseAddon, W as hydrateSchema, X as boolean, Y as array, Z as literal, _ as TimelapseRuleInputSchema, a as MACRO_LABELS, b as addonWidgetsSourceCapability, c as NcConditionDescriptorSchema, d as NcRuleSchema, et as record, f as NcSnoozeInputSchema, g as OpsLogEntrySchema, h as NcTaxonomySchema, i as EVENT_PAD_MS, j as kebabToCamel, k as faceGalleryCapability, l as NcRuleInputSchema, m as NcSnoozeSuppressedSchema, n as DEFAULT_EVENT_COLOR, nt as unknown, o as NC_CONDITION_CATALOG, p as NcSnoozeSchema, q as sleep, r as EVENT_KIND_BY_CAP, rt as EventCategory, s as NC_TAXONOMY, t as BaseDevice, tt as string, u as NcRulePatchSchema, v as TimelapseRuleSchema, w as cosineSimilarity, x as alarmPanelCapability, y as TrackSourceSchema, z as zoneAnalyticsCapability } from "../dist-4NhN1aPx.mjs";
+import { $ as literal, A as faceGalleryCapability, B as videoclipsCapability, C as audioMetricsCapability, D as defineCustomActions, E as customAction, F as pipelineAnalyticsCapability, G as createEvent, H as errMsg, I as plateGalleryCapability, J as nodePin, K as hydrateSchema, L as readDeviceStateFrom, M as isScheduleActive, N as kebabToCamel, P as notificationRulesCapability, Q as boolean, R as subKindsOf, S as alarmPanelCapability, T as cosineSimilarity, U as BaseAddon, V as zoneAnalyticsCapability, W as DeviceType, X as _enum, Y as sleep, Z as array, _ as RetrainStatusSchema, a as MACRO_LABELS, at as EventCategory, b as TrackSourceSchema, c as NcConditionDescriptorSchema, d as NcRuleSchema, et as number, f as NcSnoozeInputSchema, g as OpsLogEntrySchema, h as NcTaxonomySchema, i as EVENT_PAD_MS, it as unknown, k as encodeVectorBase64, l as NcRuleInputSchema, m as NcSnoozeSuppressedSchema, n as DEFAULT_EVENT_COLOR, nt as record, o as NC_CONDITION_CATALOG, p as NcSnoozeSchema, q as isDeviceScopedCap, r as EVENT_KIND_BY_CAP, rt as string, s as NC_TAXONOMY, t as BaseDevice, tt as object, u as NcRulePatchSchema, v as TimelapseRuleInputSchema, w as buildEventKindDescriptor, x as addonWidgetsSourceCapability, y as TimelapseRuleSchema, z as vectorDimFromBase64 } from "../dist-BhadCxSQ.mjs";
 import { promises } from "node:fs";
 import path from "node:path";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1583,66 +1583,6 @@ function evaluateRule(rule, subject, deviceState) {
 		matchedOn: presentConditionIds(c)
 	};
 }
-var WEEKDAY_TO_DAY = {
-	Sun: 0,
-	Mon: 1,
-	Tue: 2,
-	Wed: 3,
-	Thu: 4,
-	Fri: 5,
-	Sat: 6
-};
-/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
-*  An invalid/unknown IANA name falls back to the host timezone. */
-function localDayMinute(atMs, timezone) {
-	const d = new Date(atMs);
-	if (timezone !== void 0) try {
-		const parts = new Intl.DateTimeFormat("en-US", {
-			timeZone: timezone,
-			weekday: "short",
-			hour: "numeric",
-			minute: "numeric",
-			hourCycle: "h23"
-		}).formatToParts(d);
-		let weekday;
-		let hour;
-		let minute;
-		for (const p of parts) if (p.type === "weekday") weekday = p.value;
-		else if (p.type === "hour") hour = Number(p.value);
-		else if (p.type === "minute") minute = Number(p.value);
-		const day = weekday !== void 0 ? WEEKDAY_TO_DAY[weekday] : void 0;
-		if (day !== void 0 && hour !== void 0 && minute !== void 0) return {
-			day,
-			minute: hour * 60 + minute
-		};
-	} catch {}
-	return {
-		day: d.getDay(),
-		minute: d.getHours() * 60 + d.getMinutes()
-	};
-}
-/**
-* Is the schedule active at `atMs`? No schedule = always active. Windows
-* are OR'd; a window with `startMinute > endMinute` crosses midnight (it
-* starts on a listed day and spills into the next). `invert` flips the
-* result (active OUTSIDE the windows).
-*/
-function isScheduleActive(schedule, atMs) {
-	if (schedule === void 0) return true;
-	const { day, minute } = localDayMinute(atMs, schedule.timezone);
-	const prevDay = (day + 6) % 7;
-	let inside = false;
-	for (const w of schedule.windows) if (w.startMinute <= w.endMinute) {
-		if (w.days.includes(day) && minute >= w.startMinute && minute < w.endMinute) {
-			inside = true;
-			break;
-		}
-	} else if (w.days.includes(day) && minute >= w.startMinute || w.days.includes(prevDay) && minute < w.endMinute) {
-		inside = true;
-		break;
-	}
-	return schedule.invert === true ? !inside : inside;
-}
 /** Normalize a plate string: uppercase, alphanumeric only. */
 function normalizePlate$1(value) {
 	return value.toUpperCase().replace(/[^A-Z0-9]/g, "");
@@ -6806,6 +6746,34 @@ function isEdgeAwareNewBest(current, candidate, hysteresis) {
 //#endregion
 //#region src/pipeline-analytics/pipeline/label-utils.ts
 /**
+* Every macro class the pipeline can carry on a detection. A `label` exists to
+* say something FINER than the class — a species, a vehicle type, a plate read,
+* an identity — so a value drawn from this set is by definition not a label,
+* whatever produced it.
+*
+* Typed against the macro unions so a new macro class is a compile error here
+* rather than a silent hole. `package` is a first-level macro of the default
+* detector that predates `FirstLevelMacro`, hence the explicit member.
+*/
+var MACRO_CLASSES = new Set([
+	"person",
+	"vehicle",
+	"animal",
+	"package",
+	"face",
+	"plate",
+	"audio"
+]);
+/**
+* Whether a class token is a macro class. EXACT match, no case folding: plate
+* OCR text is upper-case and identities are capitalised, so `PLATE` (a real
+* read) and `Person` (a real name) must survive while `plate` / `person` (the
+* taxonomy tokens) must not.
+*/
+function isMacroClass(value) {
+	return MACRO_CLASSES.has(value);
+}
+/**
 * Opaque internal label markers that carry no human-readable meaning and must
 * never surface on an event/track. The face-embedding (arcface) step pushes a
 * `embedding:<dim>d` marker (score 1.0) onto the parent's labels — it is a
@@ -6836,12 +6804,26 @@ function pickTopLabel(labels, excludeClass) {
 /**
 * Resolve the label to stamp on an ObjectEvent / track: an enrichment label
 * (identity, plate text) takes precedence; otherwise the raw detector class
-* (`originalClass`) when it differs from the macro class; otherwise nothing.
+* (`originalClass`) when it is genuinely FINER than the macro class; otherwise
+* nothing.
+*
+* "Finer" is load-bearing, and `originalClass !== className` alone does not
+* establish it. The two fields come from different time bases — `className` is
+* the tracker's confidence-weighted LIFETIME class vote, `originalClass` is the
+* class of the detection matched into the track THIS frame — and outside
+* `verbosity === 'full'` the runner ships no `debug.originalClass` at all, so
+* the FrameProcessor substitutes `det.macroClass`. A person track that a single
+* animal detection matched into therefore arrived here as
+* `{ className: 'person', originalClass: 'animal' }` and got `label: 'animal'`
+* written on it: a COARSE class in the slot reserved for finer information.
+* A macro class is never an answer, so it is never a label.
 */
 function resolveDetectionLabel(input) {
 	const top = pickTopLabel(input.labels, input.className);
 	if (top) return top;
-	return input.originalClass && input.originalClass !== input.className ? input.originalClass : void 0;
+	const raw = input.originalClass;
+	if (raw === void 0 || raw === input.className || isMacroClass(raw)) return void 0;
+	return raw;
 }
 var DEFAULT_ZONE_TRANSITION_CONFIG = {
 	enterFrames: 2,
@@ -11834,9 +11816,24 @@ var TrackDetailDispatcher = class {
 		dev.scheduler.onResult(req.trackId, req.stepId, topScore, Date.now());
 	}
 	/**
-	* Run the request once via the frameHandle, and — on a miss (null OR throw)
-	* — retry ONCE with a `cropJpeg` fallback when one can be captured. Returns
-	* the detail list, or `null` when both attempts fail to produce a result.
+	* Walk the crop-source ladder for one request, stopping at the first rung that
+	* produces a result. Returns the detail list, or `null` when every rung failed.
+	*
+	* 1. `frameHandle` — cheapest when it hits: no payload moves and the runner's
+	*    leaf children re-cut their ROI at native resolution. Tried first, always.
+	* 2. `frameJpeg` — the freshest frame's FULL raster, fetched from the node that
+	*    owns the handle and handed to the runner UNCUT, so the rectangle still
+	*    comes from the single derivation (D52). This rung exists because rung 1 is
+	*    structurally unreachable for most dispatches: the decode worker's native
+	*    lease is 1.2 s and a tick + inference routinely lands outside it, while
+	*    the retained store holds the frame for 3 s.
+	* 3. `cropJpeg` — the pre-cut tile. Last, because the caller decided its
+	*    rectangle and because in practice the same native miss that emptied rung 1
+	*    empties this one too.
+	*
+	* On D9/D18: the payload that crosses in rung 2 is a COMPRESSED JPEG fetched on
+	* demand, per TRACK per dispatch (≤2 in flight per device, ~1 Hz) and only after
+	* rung 1 missed — never a frame-rate stream, and never raw pixels.
 	*/
 	async runOnce(deviceId, dev, req, frame) {
 		const parent = {
@@ -11853,7 +11850,39 @@ var TrackDetailDispatcher = class {
 			}, frame.nodeId);
 			if (primary !== null) return primary.details;
 		} catch (err) {
-			this.deps.logger.debug("detail primary call failed — trying crop fallback", {
+			this.deps.logger.debug("detail primary call failed — trying frame fallback", {
+				tags: { deviceId },
+				meta: {
+					trackId: req.trackId,
+					stepId: req.stepId,
+					error: String(err)
+				}
+			});
+		}
+		if (this.deps.captureFullFrameBase64 !== void 0 && frame.frameHandle !== void 0) try {
+			const full = await this.deps.captureFullFrameBase64(frame);
+			if (full !== null) if (full.width !== frame.frameWidth || full.height !== frame.frameHeight) this.deps.logger.warn("detail full-frame fallback refused — frame is not the bbox scale", {
+				tags: { deviceId },
+				meta: {
+					trackId: req.trackId,
+					stepId: req.stepId,
+					frameWidth: full.width,
+					frameHeight: full.height,
+					bboxFrameWidth: frame.frameWidth,
+					bboxFrameHeight: frame.frameHeight
+				}
+			});
+			else {
+				const derived = await this.deps.runDetailSubtree({
+					deviceId,
+					frameJpeg: full.base64,
+					parent,
+					steps
+				}, frame.nodeId);
+				if (derived !== null) return derived.details;
+			}
+		} catch (err) {
+			this.deps.logger.debug("detail full-frame fallback call failed", {
 				tags: { deviceId },
 				meta: {
 					trackId: req.trackId,
@@ -11890,12 +11919,14 @@ var TrackDetailDispatcher = class {
 		const now = Date.now();
 		if (now - dev.lastFailWarnAt < FAIL_WARN_THROTTLE_MS) return;
 		dev.lastFailWarnAt = now;
-		this.deps.logger.warn("runDetailSubtree produced no result (frame + crop both missed)", {
+		this.deps.logger.warn("runDetailSubtree produced no result (every crop source missed)", {
 			tags: { deviceId },
 			meta: {
 				trackId: req.trackId,
 				stepId: req.stepId,
-				reason: req.reason
+				reason: req.reason,
+				triedFullFrame: this.deps.captureFullFrameBase64 !== void 0,
+				triedCropJpeg: this.deps.captureCropBase64 !== void 0
 			}
 		});
 	}
@@ -13418,6 +13449,27 @@ var StoragePressureTracker = class {
 };
 //#endregion
 //#region src/pipeline-analytics/store/media-store.ts
+var OWNER_KINDS = [
+	"event",
+	"track",
+	"face",
+	"identity",
+	"plate",
+	"vehicle"
+];
+/**
+* Narrow an arbitrary string to an `OwnerKind`.
+*
+* Exists so a caller that builds owner scopes from data (the training-export
+* plan walks `track` / `face` / `plate` / `event` as strings) can reach the
+* store without a cast. The list is derived from `OWNER_KINDS`, so a new owner
+* kind is admitted here the moment it is declared there — a hand-written value
+* list would silently reject it, which is the failure `TrackSourceSchema` was
+* already bitten by on the track row.
+*/
+function isMediaOwnerKind(value) {
+	return OWNER_KINDS.some((kind) => kind === value);
+}
 var MEDIA_COLLECTION = "pipeline-analytics:media";
 /** Owner-id prefix for a track's buffered FACE crop. Invariant established by
 *  the face recognizer (`face-recognizer.ts`): `faceId === 'face-' + trackId`
@@ -14641,6 +14693,7 @@ async function rankKeyEvents(candidates, options, peakLookup) {
 			bestEventId: bestEventId ?? t.trackId,
 			windowMs: t.lastSeen - t.firstSeen,
 			...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
+			...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 			...t.debug !== void 0 ? { debug: t.debug } : {}
 		});
 	}
@@ -15876,8 +15929,35 @@ function classifyTrackAppearance(input) {
 	if (input.inPrevActive) return "continuing";
 	return input.positionsCount > 1 ? "resurrection" : "birth";
 }
-//#endregion
-//#region src/pipeline-analytics/pipeline/track-flags.ts
+/** Thrown when the device is already holding its full staging budget. Distinct
+*  type so a surface can tell "you are out of room" from "that track is gone". */
+var StagingBudgetExceededError = class extends Error {
+	deviceId;
+	staging;
+	constructor(deviceId, staging) {
+		super(`setTrackFlags: device ${deviceId} already has ${staging} tracks in retrain staging (limit 500). Un-mark some tracks before marking more.`);
+		this.deviceId = deviceId;
+		this.staging = staging;
+		this.name = "StagingBudgetExceededError";
+	}
+};
+/**
+* Thrown when a `markForTrain` write — in EITHER direction — targets a track
+* that has already been trained.
+*
+* Its own error type, next to the budget's, because the two refusals need
+* different sentences on the surface: one says "make room", the other says "this
+* track is already in the dataset". Collapsing them into a generic failure is
+* how a toggle ends up flipping back with nothing to explain it.
+*/
+var TrackAlreadyTrainedError = class extends Error {
+	trackId;
+	constructor(trackId) {
+		super(`setTrackFlags: track ${trackId} is already trained — its frames are copies in the retrain dataset. Re-staging it is an action of the retrain page, not this toggle.`);
+		this.trackId = trackId;
+		this.name = "TrackAlreadyTrainedError";
+	}
+};
 /**
 * Apply a partial flag patch and report the RESOLVED state of both flags.
 *
@@ -15890,19 +15970,63 @@ function classifyTrackAppearance(input) {
 * An empty patch is a pure read, not an error: the three calling surfaces build
 * the patch from their own toggle, and "nothing changed" is a legitimate outcome
 * that must not surface as a failure.
-*/
-async function applyTrackFlags(store, input) {
+*
+* **`trained` is TERMINAL for this toggle, in both directions.** A trained
+* track's chosen frames are already copies inside the retrain dataset; staging
+* it again from a generic checkbox is how the same material gets annotated twice
+* under two different ground truths, and un-marking it would claim to undo a
+* training pass it cannot undo. The deliberate return to staging belongs to the
+* retrain page, which is also the only thing that produces `trained`. A `debug`
+* patch on a trained track is untouched by this — `debug` is not the lifecycle.
+*
+* **The budget is checked only when STAGING is being entered.** Un-marking is
+* always allowed and so is a `debug` patch — a limit that blocked the way OUT of
+* the limit would be a trap, and a device at its ceiling would become unable to
+* release the very storage the ceiling exists to protect. Re-marking a track
+* that is already staging is not a new hold either, so it does not consume
+* budget and cannot be refused by it.
+*/
+async function applyTrackFlags(deps, input) {
+	const { store, logger } = deps;
 	const current = await store.readFlags(input.trackId);
 	if (current === null) throw new Error(`setTrackFlags: unknown track ${input.trackId}`);
+	if (input.flags.markForTrain !== void 0 && current.retrainStatus === "trained") {
+		logger.warn("setTrackFlags refused — track already trained", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				deviceId: input.deviceId,
+				trackId: input.trackId,
+				requested: input.flags.markForTrain
+			}
+		});
+		throw new TrackAlreadyTrainedError(input.trackId);
+	}
+	if (input.flags.markForTrain === true && current.retrainStatus !== "staging") {
+		const staging = await store.countStaging({ deviceId: input.deviceId });
+		if (staging >= 500) {
+			logger.warn("setTrackFlags refused — device staging budget full", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					deviceId: input.deviceId,
+					trackId: input.trackId,
+					staging,
+					limit: 500
+				}
+			});
+			throw new StagingBudgetExceededError(input.deviceId, staging);
+		}
+	}
 	const patch = {
 		...input.flags.markForTrain !== void 0 ? { markForTrain: input.flags.markForTrain } : {},
 		...input.flags.debug !== void 0 ? { debug: input.flags.debug } : {}
 	};
 	if (Object.keys(patch).length > 0) await store.setFlags(input.trackId, patch);
+	const retrainStatus = patch.markForTrain === void 0 ? current.retrainStatus : patch.markForTrain ? "staging" : "none";
 	return {
 		trackId: input.trackId,
-		markForTrain: patch.markForTrain ?? current.markForTrain,
-		debug: patch.debug ?? current.debug
+		markForTrain: retrainStatus === "staging",
+		debug: patch.debug ?? current.debug,
+		retrainStatus
 	};
 }
 //#endregion
@@ -18619,6 +18743,20 @@ function rowToSensorEvent(id, data) {
 function isRecord(x) {
 	return x !== null && typeof x === "object" && !Array.isArray(x);
 }
+/**
+* May the interval this attempt consumed be given back?
+*
+* Pure, and deliberately takes the CURRENT clock as well as the mark: a rollback
+* is only correct while this attempt is still the one the gate is standing on. A
+* later frame's pending mark, or a snapshot that landed in between, has already
+* moved the reference forward and restoring an older one would re-open a window
+* that is legitimately closed.
+*/
+function canRollbackSnapshot(mark, currentLastSnapshotAt) {
+	if (mark === void 0) return false;
+	if (mark.at !== currentLastSnapshotAt) return false;
+	return mark.priorRollbacks < 3;
+}
 //#endregion
 //#region src/pipeline-analytics/store/recent-cursor.ts
 function encodeRecentCursor(cursor) {
@@ -18779,8 +18917,10 @@ var TRACKS_COLUMNS = [
 		type: "JSON"
 	},
 	{
-		name: "markForTrain",
-		type: "BOOLEAN"
+		name: "retrainStatus",
+		type: "TEXT",
+		notNull: true,
+		defaultValue: "none"
 	},
 	{
 		name: "debug",
@@ -18857,7 +18997,10 @@ function cloneTrack(t) {
 		...t.bestEventId !== void 0 ? { bestEventId: t.bestEventId } : {},
 		...t.importanceReason !== void 0 ? { importanceReason: t.importanceReason } : {},
 		...t.audioLabels !== void 0 && t.audioLabels.size > 0 ? { audioLabels: audioLabelsToArray(t.audioLabels) } : {},
-		...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
+		...t.retrainStatus !== void 0 ? {
+			retrainStatus: t.retrainStatus,
+			markForTrain: t.retrainStatus === "staging"
+		} : {},
 		...t.debug !== void 0 ? { debug: t.debug } : {}
 	};
 }
@@ -18952,6 +19095,8 @@ var TrackStore = class {
 		t.snapshots.push(snapshot);
 		t.lastSnapshotAt = snapshot.timestamp;
 		t.lastSnapshotBbox = { ...snapshot.position.bbox };
+		delete t.snapshotPending;
+		t.snapshotRollbacks = 0;
 	}
 	/**
 	* Synchronously advance the periodic-snapshot gate reference (clock + bbox) at
@@ -18963,18 +19108,57 @@ var TrackStore = class {
 	* snapshots. Mirrors the synchronous `lastFrameAtByTrack` advance for the
 	* rolling `lastFrame`.
 	*
-	* No rollback: if the write later fails the slot is simply lost (a rare dropped
-	* snapshot is preferable to a burst). `addSnapshot` re-stamps the same
-	* clock/bbox when the real snapshot lands, so the two stay consistent. No-op for
-	* an unknown/expired track (the active entry is dropped on expiry, so there is
-	* no separate map to leak).
+	* The advance is REVERSIBLE. It used to be permanent — this docblock said
+	* "if the write later fails the slot is simply lost" — which made `snapshot`
+	* the only media kind with no retry of any shape while every sibling advanced
+	* its bookkeeping from the ids that actually persisted. See
+	* {@link rollbackSnapshotPending} and `pipeline/snapshot-retry.ts`.
+	*
+	* `addSnapshot` re-stamps the same clock/bbox when the real snapshot lands, so
+	* the two stay consistent. No-op for an unknown/expired track (the active entry
+	* is dropped on expiry, so there is no separate map to leak).
 	*/
 	markSnapshotPending(trackId, timestamp, bbox) {
 		const t = this.active.get(trackId);
 		if (!t) return;
+		t.snapshotPending = {
+			at: timestamp,
+			previous: {
+				at: t.lastSnapshotAt,
+				bbox: t.lastSnapshotBbox ? { ...t.lastSnapshotBbox } : void 0
+			},
+			priorRollbacks: t.snapshotRollbacks ?? 0
+		};
 		t.lastSnapshotAt = timestamp;
 		t.lastSnapshotBbox = { ...bbox };
 	}
+	/**
+	* The capture decided at `timestamp` did NOT land: restore the gate reference
+	* it displaced so the next frame re-evaluates instead of waiting out an
+	* interval that was never used. Returns whether the slot was given back.
+	*
+	* Refused — deliberately — when the attempt is no longer the one the gate
+	* stands on (a snapshot landed, or a newer frame already marked its own
+	* pending), and once the bounded run of non-landings is spent
+	* ({@link SNAPSHOT_MAX_ROLLBACKS}): a camera whose frames are permanently
+	* unresolvable must not re-decide a snapshot on every frame forever.
+	*/
+	rollbackSnapshotPending(trackId, timestamp) {
+		const t = this.active.get(trackId);
+		if (!t) return false;
+		const mark = t.snapshotPending;
+		if (mark?.at !== timestamp) return false;
+		if (!canRollbackSnapshot(mark, t.lastSnapshotAt)) {
+			delete t.snapshotPending;
+			return false;
+		}
+		t.lastSnapshotAt = mark.previous.at;
+		if (mark.previous.bbox) t.lastSnapshotBbox = { ...mark.previous.bbox };
+		else delete t.lastSnapshotBbox;
+		t.snapshotRollbacks = mark.priorRollbacks + 1;
+		delete t.snapshotPending;
+		return true;
+	}
 	lastSnapshotAt(trackId) {
 		return this.active.get(trackId)?.lastSnapshotAt ?? 0;
 	}
@@ -19098,24 +19282,30 @@ var TrackStore = class {
 		}
 	}
 	/**
-	* Apply a PARTIAL patch of the per-track operator flags (`markForTrain`,
+	* Apply a PARTIAL patch of the per-track operator state (`markForTrain`,
 	* `debug`). Mirrors `setLabel`'s dual write — in-RAM active entry AND the
-	* persisted row — so a flag set on a LIVE track is carried into
+	* persisted row — so a mark set on a LIVE track is carried into
 	* `persistCompleted` at expiry instead of evaporating with the RAM state.
 	*
+	* `markForTrain` is a LIFECYCLE move, not a boolean write: `true` is
+	* `→ staging`, `false` is `→ none`. This method does not police the move —
+	* the `trained` refusal lives in `applyTrackFlags`, the single cap-level write
+	* surface, which is the only caller that has already read the current state.
+	*
 	* An omitted key is left untouched; `false` is WRITTEN, not dropped, so an
-	* explicitly un-flagged track stays distinguishable from one never touched.
+	* explicitly un-marked track stays distinguishable from one never touched.
 	* An empty patch is a no-op (an update with no columns is not a useful
 	* statement, and the store would reject or silently ignore it).
 	*/
 	async setFlags(trackId, patch) {
 		const data = {};
-		if (patch.markForTrain !== void 0) data["markForTrain"] = patch.markForTrain;
+		const nextStatus = patch.markForTrain === void 0 ? void 0 : patch.markForTrain ? "staging" : "none";
+		if (nextStatus !== void 0) data["retrainStatus"] = nextStatus;
 		if (patch.debug !== void 0) data["debug"] = patch.debug;
 		if (Object.keys(data).length === 0) return;
 		const active = this.active.get(trackId);
 		if (active) {
-			if (patch.markForTrain !== void 0) active.markForTrain = patch.markForTrain;
+			if (nextStatus !== void 0) active.retrainStatus = nextStatus;
 			if (patch.debug !== void 0) active.debug = patch.debug;
 		}
 		try {
@@ -19132,20 +19322,25 @@ var TrackStore = class {
 		}
 	}
 	/**
-	* Resolved flag state for a track — active entry first, then the persisted
-	* row. Absent collapses to `false`, which is what the cap returns to a caller
-	* driving a toggle. `null` when the track is unknown to both.
+	* Resolved operator state for a track — active entry first, then the
+	* persisted row. `null` when the track is unknown to both.
+	*
+	* Reports the LIFECYCLE STATUS, not the derived boolean, because the one
+	* caller that matters decides on it: `applyTrackFlags` must tell `trained`
+	* (refuse the write) from `none` (accept it), and both report
+	* `markForTrain: false`. Absent collapses to `'none'` / `false` — the
+	* "never touched" tri-state exists only in RAM and carries no decision.
 	*/
 	async readFlags(trackId) {
 		const active = this.active.get(trackId);
 		if (active) return {
-			markForTrain: active.markForTrain === true,
+			retrainStatus: active.retrainStatus ?? "none",
 			debug: active.debug === true
 		};
 		const persisted = await this.getPersistedByTrackId(trackId);
 		if (!persisted) return null;
 		return {
-			markForTrain: persisted.markForTrain === true,
+			retrainStatus: persisted.retrainStatus ?? "none",
 			debug: persisted.debug === true
 		};
 	}
@@ -19210,10 +19405,11 @@ var TrackStore = class {
 	* `offset` by the number of rows a page did NOT remove, which terminates
 	* because the offset only grows and the result set is finite.
 	*
-	* This is the seam a retention PIN needs. Pinning is now one exemption on one
-	* query — this one — instead of four exemptions across four sweeps, and the
-	* drain no longer breaks when it meets a row it must skip. The pin itself is
-	* deliberately NOT implemented here (D61).
+	* This is the seam the retention PIN lands on, and it lands here ONLY: after
+	* D61 the track row is the single cascading root, so one exemption on this one
+	* query holds the track's events, crops, keyframes and CLIP vector with it —
+	* where D59 had to plan for four exemptions across four disagreeing sweeps.
+	* The pin is `whereIn: { retrainStatus: ['none','trained'] }` below (D81).
 	*
 	* Filter shape mirrors `EventStore.pruneBefore`: inclusive `[0, cutoffMs - 1]`
 	* → strictly `< cutoffMs`. Best-effort — a query failure yields [].
@@ -19224,6 +19420,7 @@ var TrackStore = class {
 				collection: TRACKS_COLLECTION,
 				filter: {
 					where: { deviceId },
+					whereIn: { retrainStatus: ["none", "trained"] },
 					whereBetween: { lastSeen: [0, cutoffMs - 1] },
 					orderBy: {
 						field: "lastSeen",
@@ -19247,6 +19444,87 @@ var TrackStore = class {
 		}
 	}
 	/**
+	* The device's STAGING tracks, newest first — the training-export selection.
+	*
+	* `retrainStatus = 'staging'` is exactly the complement of the sweep's
+	* `whereIn ['none','trained']` (all three safe against NULL because the column
+	* is NOT NULL DEFAULT 'none') — the load-bearing part: this is the set
+	* retention has promised to still be there. `trained` is deliberately NOT in
+	* it: the sweep is free to delete a trained track mid-pass, and exporting one
+	* is how a manifest ends up describing files the archive does not contain.
+	*
+	* `projection: 'slim'` because an export enumerates media; it has no use for
+	* the per-frame trajectory JSON, which is the heaviest column on the row.
+	*/
+	async listStaging(deviceId, limit) {
+		try {
+			return (await this.store.query.query({
+				collection: TRACKS_COLLECTION,
+				filter: {
+					where: {
+						deviceId,
+						retrainStatus: "staging"
+					},
+					orderBy: {
+						field: "lastSeen",
+						direction: "desc"
+					},
+					limit
+				}
+			})).filter((r) => typeof r.id === "string").map((r) => this.rowToTrack(r.id, r.data, "slim"));
+		} catch (err) {
+			this.logger.warn("TrackStore.listStaging failed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					limit,
+					error: String(err)
+				}
+			});
+			return [];
+		}
+	}
+	/**
+	* How many of this device's tracks are STAGING — optionally only those older
+	* than a cutoff, i.e. exactly the rows a sweep just declined to touch.
+	*
+	* Two callers, one query. The sweep uses `olderThanMs` for its report; the
+	* `setTrackFlags` body uses the unbounded form to enforce the per-device
+	* staging budget, because staging is unbounded in TIME by construction and
+	* something has to bound it in COUNT (D81, and D59 asked for exactly this).
+	* `trained` tracks are NOT counted — they are evictable again, so they cost
+	* the budget nothing.
+	*
+	* Best-effort — a failure reports 0 rather than disturbing the caller. The
+	* budget check reads that as "there is room", which is the safe direction: a
+	* failed count must not stop an operator marking a track.
+	*/
+	async countStaging(query) {
+		const { deviceId, olderThanMs } = query;
+		try {
+			return await this.store.count.query({
+				collection: TRACKS_COLLECTION,
+				filter: {
+					where: {
+						deviceId,
+						retrainStatus: "staging"
+					},
+					...olderThanMs !== void 0 ? { whereBetween: { lastSeen: [0, olderThanMs - 1] } } : {}
+				}
+			});
+		} catch (err) {
+			this.logger.warn("TrackStore.countStaging failed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					olderThanMs,
+					error: String(err)
+				}
+			});
+			return 0;
+		}
+	}
+	/**
 	* The SUBSET of `trackIds` that still have a persisted row — the orphan
 	* audit's liveness probe.
 	*
@@ -19586,7 +19864,7 @@ var TrackStore = class {
 				...t.bestEventId !== void 0 ? { bestEventId: t.bestEventId } : {},
 				...t.importanceReason !== void 0 ? { importanceReason: t.importanceReason } : {},
 				...t.audioLabels !== void 0 ? { audioLabels: [...t.audioLabels] } : {},
-				...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
+				...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 				...t.debug !== void 0 ? { debug: t.debug } : {},
 				...envelope !== null && dims !== void 0 ? {
 					envMinX: envelope.minX,
@@ -19620,7 +19898,7 @@ var TrackStore = class {
 		const bestEventId = data["bestEventId"];
 		const importanceReason = data["importanceReason"];
 		const audioLabels = data["audioLabels"];
-		const markForTrain = data["markForTrain"];
+		const retrainParsed = RetrainStatusSchema.safeParse(data["retrainStatus"]);
 		const debug = data["debug"];
 		const envMinX = data["envMinX"];
 		const envMinY = data["envMinY"];
@@ -19652,7 +19930,10 @@ var TrackStore = class {
 			...typeof bestEventId === "string" ? { bestEventId } : {},
 			...typeof importanceReason === "string" ? { importanceReason } : {},
 			...Array.isArray(audioLabels) && audioLabels.length > 0 ? { audioLabels } : {},
-			...typeof markForTrain === "boolean" ? { markForTrain } : {},
+			...retrainParsed.success ? {
+				retrainStatus: retrainParsed.data,
+				markForTrain: retrainParsed.data === "staging"
+			} : {},
 			...typeof debug === "boolean" ? { debug } : {},
 			...envelope !== null ? { envelope } : {}
 		};
@@ -21095,6 +21376,35 @@ function createNativeFrameTransport(deps) {
 		};
 	};
 	const getNativeFullFrameRgb = async (handle, maxWidth) => (await fetchNativeFullFrameTiered(handle, maxWidth))?.frame ?? null;
+	const getFullFrameJpegBase64 = async (handle, maxWidth) => {
+		if (!pipelineRunnerApi?.getNativeCrop) return null;
+		try {
+			const full = await pipelineRunnerApi.getNativeCrop.query({
+				handle,
+				bbox: {
+					x: 0,
+					y: 0,
+					w: 1,
+					h: 1
+				},
+				maxWidth,
+				encodeJpeg: true
+			}, nodePin(handle.nodeId));
+			if (!full?.jpeg || full.width <= 0 || full.height <= 0) return null;
+			return {
+				base64: full.jpeg,
+				width: full.width,
+				height: full.height,
+				tier: full.tier === "ram-fullframe" ? "ram-fullframe" : "native"
+			};
+		} catch (err) {
+			logger.debug("full-frame jpeg fetch failed", { meta: {
+				nodeId: handle.nodeId,
+				error: errMsg(err)
+			} });
+			return null;
+		}
+	};
 	const cropMetricLogger = logger.child("NativeCrop");
 	let nativeHits = 0;
 	let nativeFallbacks = 0;
@@ -21145,6 +21455,7 @@ function createNativeFrameTransport(deps) {
 		getRemoteFrame,
 		getNativeFullFrameRgb,
 		getNativeKeyFrameRgb: fetchNativeFullFrameTiered,
+		getFullFrameJpegBase64,
 		getNativeCropJpeg,
 		captureCrop: createCaptureCrop({
 			tryNativeCrop,
@@ -21501,69 +21812,389 @@ function wireSubscriptions(deps) {
 	}));
 	return unsubs;
 }
-//#endregion
-//#region src/pipeline-analytics/services/event-kinds.ts
 /**
-* Extensible per-device event kinds (Part B).
-*
-* `composeEventKinds` builds the `listEventKinds` payload for a camera:
-*   (a) built-ins — motion + audio, always present;
-*   (b) detection classes actually OBSERVED on the device (track history);
-*   (c) sensor kinds contributed by LINKED devices (device-manager
-*       `getLinkedDevices`), one descriptor per bound sensor cap present in
-*       the static `EVENT_KIND_BY_CAP` map. Binding-driven per linked device
-*       (`getBindings`) — never a global cap enumeration (D12).
-*
-* `LinkedCamerasCache` is the ingest-side reverse index (sensor device →
-* linked camera ids) with a TTL, so the `DeviceStateChanged` handler stays
-* cheap at bus rate.
+* A baseline whose last sample is older than `baselineMs × this` no longer
+* describes the camera — an on-motion camera detaches for hours and comes
+* back to a different scene. Decaying it forward would make the first frame
+* back either a guaranteed marker (mean still holds the old quiet) or a
+* guaranteed miss; discarding it is the honest option and costs one warm-up.
 */
+var STALE_BASELINE_FACTOR = 5;
 /**
-* Full event-kind taxonomy a camera CAN emit (config-derived):
-*   (a) motion built-in — always;
-*   (b) each enabled detection macro + its taxonomy subs (reverse COCO);
-*   (c) audio macro + its subs when the classifier is enabled;
-*   (d) package kinds when a package zone rule is enabled;
-*   (e) sensor/control kinds from LINKED devices (binding-driven), deduped
-*       per (kind, source deviceId).
-* Every descriptor carries parentKind/level/iconId/labelKey via the single
-* taxonomy dictionary — no color/icon is declared here.
+* Floor on the MAD used as the deviation unit, in dB. A perfectly flat signal
+* has MAD 0 and would make every deviation infinite. 1 dB is below the
+* quantisation of any real level meter, so it only ever binds on a synthetic
+* or a genuinely dead-steady signal — where bar 2 is what should decide.
 */
+var MIN_MAD_DB = 1;
+function emptyAudioBaseline() {
+	return {
+		count: 0,
+		mean: 0,
+		mad: 0,
+		firstMs: 0,
+		lastMs: 0
+	};
+}
+/** Seed a fresh baseline from one sample (first ever, or after a stale gap). */
+function seed(sample) {
+	return {
+		count: 1,
+		mean: sample.dbfs,
+		mad: 0,
+		firstMs: sample.timestampMs,
+		lastMs: sample.timestampMs
+	};
+}
 /**
-* Run one lookup, reporting a failure instead of propagating it.
+* Fold `sample` into `state` and decide whether it is a marker candidate.
 *
-* `undefined` means "this one did not answer" — the caller degrades that part
-* of the taxonomy and keeps the rest. That is the pre-existing contract (each
-* section had its own try/catch); it is factored out here only because the
-* sections now run concurrently, and a rejected promise nobody has awaited yet
-* is an unhandled rejection.
+* The verdict is measured against the PRIOR baseline (this frame excluded) so
+* a lone spike is not diluted by itself — the same reasoning
+* `audio-level-detector` uses for its `priorMean`. The state returned always
+* includes the sample, whatever the verdict.
 */
-async function attempt(deps, scope, run) {
-	try {
-		return await run();
-	} catch (err) {
-		deps.onError?.(scope, err);
-		return;
-	}
-}
-async function composeEventKinds(deps, deviceId) {
-	const out = [];
-	const cameraSource = {
-		capName: "pipeline-analytics",
-		deviceId
+function observeAudioAnomaly(state, sample, cfg) {
+	const isFirst = state.count === 0;
+	const gapMs = sample.timestampMs - state.lastMs;
+	const isStale = !isFirst && gapMs > cfg.baselineMs * STALE_BASELINE_FACTOR;
+	if (isFirst || isStale) return {
+		verdict: { kind: "warmup" },
+		nextState: seed(sample)
 	};
-	const pushKind = (kind, source = cameraSource) => {
-		const d = buildEventKindDescriptor(kind, source);
-		if (d !== null) out.push(d);
+	const alpha = 1 - Math.exp(-Math.max(0, gapMs) / cfg.baselineMs);
+	const priorMean = state.mean;
+	const priorMad = state.mad;
+	const nextState = {
+		count: state.count + 1,
+		mean: priorMean + alpha * (sample.dbfs - priorMean),
+		mad: priorMad + alpha * (Math.abs(sample.dbfs - priorMean) - priorMad),
+		firstMs: state.firstMs,
+		lastMs: sample.timestampMs
 	};
-	const macrosP = attempt(deps, "enabledMacroClasses", () => deps.enabledMacroClasses(deviceId));
-	const audioP = attempt(deps, "audioEnabled", () => deps.audioEnabled(deviceId));
-	const packageP = attempt(deps, "packageZonesEnabled", async () => deps.packageZonesEnabled ? deps.packageZonesEnabled(deviceId) : false);
-	const linkedP = attempt(deps, "getLinkedDevices", () => deps.linkedDevices.getLinkedDevices({ deviceId }));
-	pushKind("motion");
-	for (const macro of await macrosP ?? []) {
-		pushKind(macro);
-		for (const sub of subKindsOf(macro)) pushKind(sub.kind);
+	if (sample.dbfs <= cfg.silenceFloorDbfs) return {
+		verdict: { kind: "silent" },
+		nextState
+	};
+	if (!(nextState.count >= 30 && sample.timestampMs - state.firstMs >= cfg.baselineMs)) return {
+		verdict: { kind: "warmup" },
+		nextState
+	};
+	if (sample.dbfs < cfg.minDbfs) return {
+		verdict: {
+			kind: "not-loud",
+			dbfs: sample.dbfs
+		},
+		nextState
+	};
+	const deviationDb = sample.dbfs - priorMean;
+	const deviations = deviationDb / Math.max(priorMad, MIN_MAD_DB);
+	const measured = {
+		dbfs: sample.dbfs,
+		mean: priorMean,
+		deviationDb,
+		deviations
+	};
+	return {
+		verdict: deviationDb >= cfg.minDeviationDb && deviations >= cfg.minDeviations ? {
+			kind: "anomalous",
+			...measured
+		} : {
+			kind: "not-anomalous",
+			...measured
+		},
+		nextState
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/services/audio-marker-projector.ts
+/** One info line per camera per minute, and only when something qualified. */
+var METRICS_WINDOW_MS = 6e4;
+var HOUR_MS = 60 * 6e4;
+var DAY_MS = 24 * HOUR_MS;
+function emptyCounters(atMs) {
+	return {
+		windowStartMs: atMs,
+		enabled: false,
+		observed: 0,
+		notLoud: 0,
+		notAnomalous: 0,
+		candidates: 0,
+		suppressedMotion: 0,
+		suppressedCooldown: 0,
+		suppressedHourly: 0,
+		suppressedDaily: 0,
+		suppressedInFlight: 0,
+		wouldFire: 0,
+		materialized: 0,
+		materializeFailed: 0
+	};
+}
+var AudioMarkerProjector = class {
+	deps;
+	baselines = /* @__PURE__ */ new Map();
+	rates = /* @__PURE__ */ new Map();
+	counters = /* @__PURE__ */ new Map();
+	inFlight = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Feed ONE audio frame. Synchronous by construction: at ~30 Hz per camera
+	* the common path must not allocate a promise, so the decision is taken
+	* inline and only an actual marker goes async (fire-and-forget, bounded by
+	* the in-flight guard and the rate ceilings).
+	*
+	* Call this BEFORE the classification/level route split so the baseline
+	* sees every frame. A baseline fed only by the level route is blind to
+	* exactly the loud, confidently-classified frames a marker is for.
+	*/
+	observe(input, cfg) {
+		const { deviceId, timestampMs } = input;
+		const counters = this.countersFor(deviceId, timestampMs);
+		counters.observed += 1;
+		counters.enabled = cfg.enabled;
+		const res = observeAudioAnomaly(this.baselines.get(deviceId) ?? emptyAudioBaseline(), {
+			timestampMs,
+			dbfs: input.dbfs
+		}, cfg);
+		this.baselines.set(deviceId, res.nextState);
+		this.maybeFlush(deviceId, timestampMs);
+		switch (res.verdict.kind) {
+			case "silent":
+			case "warmup": return;
+			case "not-loud":
+				counters.notLoud += 1;
+				return;
+			case "not-anomalous":
+				counters.notAnomalous += 1;
+				return;
+			case "anomalous": break;
+		}
+		counters.candidates += 1;
+		if (this.deps.isMotionActive(deviceId, timestampMs, cfg.motionQuietMs)) {
+			counters.suppressedMotion += 1;
+			return;
+		}
+		const fired = this.rates.get(deviceId)?.firedAtMs ?? [];
+		const last = fired.length > 0 ? fired[fired.length - 1] : void 0;
+		if (last !== void 0 && timestampMs - last < cfg.cooldownMs) {
+			counters.suppressedCooldown += 1;
+			return;
+		}
+		const recent = fired.filter((t) => timestampMs - t < DAY_MS);
+		if (recent.filter((t) => timestampMs - t < HOUR_MS).length >= cfg.maxPerHour) {
+			counters.suppressedHourly += 1;
+			this.rates.set(deviceId, { firedAtMs: recent });
+			return;
+		}
+		if (recent.length >= cfg.maxPerDay) {
+			counters.suppressedDaily += 1;
+			this.rates.set(deviceId, { firedAtMs: recent });
+			return;
+		}
+		if (!cfg.enabled) {
+			counters.wouldFire += 1;
+			return;
+		}
+		if (this.inFlight.has(deviceId)) {
+			counters.suppressedInFlight += 1;
+			return;
+		}
+		this.rates.set(deviceId, { firedAtMs: [...recent, timestampMs] });
+		counters.materialized += 1;
+		this.inFlight.add(deviceId);
+		this.materialize(input, counters);
+	}
+	/**
+	* Emit and reset a camera's window if it has anything to say. Exposed so a
+	* shutdown (or a test) can force the tally out rather than losing it.
+	*/
+	flush(nowMs) {
+		for (const deviceId of this.counters.keys()) this.emitWindow(deviceId, nowMs, true);
+	}
+	/** Drop all per-camera state for a device (unbind / device removal). */
+	forgetDevice(deviceId) {
+		this.baselines.delete(deviceId);
+		this.rates.delete(deviceId);
+		this.counters.delete(deviceId);
+		this.inFlight.delete(deviceId);
+	}
+	async materialize(input, counters) {
+		const { deviceId, timestampMs } = input;
+		try {
+			const audioLabels = buildAudioLabels(input);
+			await this.deps.sink.materialize({
+				cameraId: deviceId,
+				sourceDeviceId: deviceId,
+				source: "audio",
+				kind: "audio",
+				timestamp: timestampMs,
+				...audioLabels !== void 0 ? { audioLabels } : {}
+			});
+		} catch (err) {
+			counters.materialized -= 1;
+			counters.materializeFailed += 1;
+			this.deps.onError?.("materializeAudioMarker", err);
+			this.deps.logger.warn("audio marker materialize failed", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		} finally {
+			this.inFlight.delete(deviceId);
+		}
+	}
+	countersFor(deviceId, atMs) {
+		const existing = this.counters.get(deviceId);
+		if (existing !== void 0) return existing;
+		const fresh = emptyCounters(atMs);
+		this.counters.set(deviceId, fresh);
+		return fresh;
+	}
+	maybeFlush(deviceId, nowMs) {
+		const c = this.counters.get(deviceId);
+		if (c === void 0 || nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
+		this.emitWindow(deviceId, nowMs, false);
+	}
+	/**
+	* One line per camera per window — but ONLY when a frame reached the
+	* candidate gate. A camera that heard nothing extraordinary has nothing to
+	* report, and a line per camera per minute forever would bury the ones that
+	* do. `force` still honours that: it flushes the window, it does not invent
+	* a reason to speak.
+	*/
+	emitWindow(deviceId, nowMs, force) {
+		const c = this.counters.get(deviceId);
+		if (c === void 0) return;
+		if (!force && nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
+		if (c.candidates > 0 || c.materializeFailed > 0) this.deps.logger.info("audio anomaly gate (window)", {
+			tags: { deviceId },
+			meta: {
+				enabled: c.enabled,
+				windowMs: nowMs - c.windowStartMs,
+				observed: c.observed,
+				notLoud: c.notLoud,
+				notAnomalous: c.notAnomalous,
+				candidates: c.candidates,
+				suppressedMotion: c.suppressedMotion,
+				suppressedCooldown: c.suppressedCooldown,
+				suppressedHourly: c.suppressedHourly,
+				suppressedDaily: c.suppressedDaily,
+				suppressedInFlight: c.suppressedInFlight,
+				wouldFire: c.wouldFire,
+				materialized: c.materialized,
+				materializeFailed: c.materializeFailed
+			}
+		});
+		this.counters.set(deviceId, emptyCounters(nowMs));
+	}
+};
+/**
+* The class heard on the anomalous frame, in the shape `Track.audioLabels`
+* already defines. Using that field is what lets a marker label itself
+* ("dog", "glass_breaking") without inventing an event-taxonomy sub-class —
+* the audio macro vocabulary collides with existing subs (`dog` is a COCO
+* animal, `siren` is a control), so a sub per audio class would put a barking
+* dog in the ANIMAL lane.
+*/
+function buildAudioLabels(input) {
+	if (input.className === void 0) return void 0;
+	return [{
+		label: input.className,
+		peakScore: input.score ?? 0,
+		count: 1,
+		firstAt: input.timestampMs,
+		lastAt: input.timestampMs
+	}];
+}
+//#endregion
+//#region src/pipeline-analytics/services/event-kinds.ts
+/**
+* Extensible per-device event kinds (Part B).
+*
+* `composeEventKinds` builds the `listEventKinds` payload for a camera:
+*   (a) built-ins — motion + audio, always present;
+*   (b) detection classes actually OBSERVED on the device (track history);
+*   (c) sensor kinds contributed by the camera's OWN bindings and by its
+*       LINKED devices (device-manager `getLinkedDevices`), one descriptor per
+*       bound sensor cap present in the static `EVENT_KIND_BY_CAP` map.
+*       Binding-driven per device (`getBindings`) — never a global cap
+*       enumeration (D12).
+*
+* `LinkedCamerasCache` is the ingest-side reverse index (sensor device →
+* linked camera ids, plus the camera id set) with a TTL, so the
+* `DeviceStateChanged` handler stays cheap at bus rate.
+*/
+/**
+* Mapped sensor/control caps that a CAMERA must NOT contribute for ITSELF.
+*
+* A sensor cap bound on a camera makes the camera both the source and the
+* subject — a doorbell wrapper on camera 615, a native Reolink doorbell, a
+* camera-side button. Those have no other route into the per-camera event
+* substrate, so the camera includes itself.
+*
+* `motion` is the exception, and today the ONLY one: camera motion already
+* has a dedicated camera-native path (`MotionAnalysis` /
+* `MotionOnMotionChanged` → `MotionEvent` rows under the built-in `motion`
+* taxonomy lane). Every real camera provider registers a native `motion` cap
+* on the camera device, so self-inclusion would mint a SECOND, differently
+* named copy (`motion-sensor`) of every motion transition, at motion rate.
+*
+* Add a cap here only when the camera already emits that event through
+* another ingest path — never to reduce noise.
+*/
+var SELF_CAMERA_EXCLUDED_CAPS = new Set(["motion"]);
+/** True when a camera may contribute `capName` for itself. */
+function selfCameraMayEmit(capName) {
+	return !SELF_CAMERA_EXCLUDED_CAPS.has(capName);
+}
+/**
+* Full event-kind taxonomy a camera CAN emit (config-derived):
+*   (a) motion built-in — always;
+*   (b) each enabled detection macro + its taxonomy subs (reverse COCO);
+*   (c) audio macro + its subs when the classifier is enabled;
+*   (d) package kinds when a package zone rule is enabled;
+*   (e) sensor/control kinds from the CAMERA'S OWN bindings and from its
+*       LINKED devices (binding-driven), deduped per (kind, source deviceId).
+* Every descriptor carries parentKind/level/iconId/labelKey via the single
+* taxonomy dictionary — no color/icon is declared here.
+*/
+/**
+* Run one lookup, reporting a failure instead of propagating it.
+*
+* `undefined` means "this one did not answer" — the caller degrades that part
+* of the taxonomy and keeps the rest. That is the pre-existing contract (each
+* section had its own try/catch); it is factored out here only because the
+* sections now run concurrently, and a rejected promise nobody has awaited yet
+* is an unhandled rejection.
+*/
+async function attempt(deps, scope, run) {
+	try {
+		return await run();
+	} catch (err) {
+		deps.onError?.(scope, err);
+		return;
+	}
+}
+async function composeEventKinds(deps, deviceId) {
+	const out = [];
+	const cameraSource = {
+		capName: "pipeline-analytics",
+		deviceId
+	};
+	const pushKind = (kind, source = cameraSource) => {
+		const d = buildEventKindDescriptor(kind, source);
+		if (d !== null) out.push(d);
+	};
+	const macrosP = attempt(deps, "enabledMacroClasses", () => deps.enabledMacroClasses(deviceId));
+	const audioP = attempt(deps, "audioEnabled", () => deps.audioEnabled(deviceId));
+	const packageP = attempt(deps, "packageZonesEnabled", async () => deps.packageZonesEnabled ? deps.packageZonesEnabled(deviceId) : false);
+	const linkedP = attempt(deps, "getLinkedDevices", () => deps.linkedDevices.getLinkedDevices({ deviceId }));
+	const selfBindingsP = attempt(deps, "getBindings", () => deps.bindings.getBindings({ deviceId }));
+	pushKind("motion");
+	for (const macro of await macrosP ?? []) {
+		pushKind(macro);
+		for (const sub of subKindsOf(macro)) pushKind(sub.kind);
 	}
 	if (await audioP === true) {
 		pushKind("audio");
@@ -21576,26 +22207,30 @@ async function composeEventKinds(deps, deviceId) {
 	const devices = (await linkedP)?.devices ?? [];
 	const bindingsPerDevice = await Promise.all(devices.map((linked) => attempt(deps, "getBindings", () => deps.bindings.getBindings({ deviceId: linked.deviceId }))));
 	const seen = /* @__PURE__ */ new Set();
-	for (const [index, linked] of devices.entries()) {
-		const entries = bindingsPerDevice[index]?.entries;
-		if (entries === void 0) continue;
+	const pushSensorKinds = (sourceDeviceId, entries, isSelf) => {
+		if (entries === void 0) return;
 		for (const { capName } of entries) {
+			if (isSelf && !selfCameraMayEmit(capName)) continue;
 			const descriptor = EVENT_KIND_BY_CAP[capName];
 			if (descriptor === void 0) continue;
-			const dedupeKey = `${descriptor.kind}:${linked.deviceId}`;
+			const dedupeKey = `${descriptor.kind}:${sourceDeviceId}`;
 			if (seen.has(dedupeKey)) continue;
 			seen.add(dedupeKey);
 			pushKind(descriptor.kind, {
 				capName,
-				deviceId: linked.deviceId
+				deviceId: sourceDeviceId
 			});
 		}
-	}
+	};
+	pushSensorKinds(deviceId, (await selfBindingsP)?.entries, true);
+	for (const [index, linked] of devices.entries()) pushSensorKinds(linked.deviceId, bindingsPerDevice[index]?.entries, false);
 	return out;
 }
 var DEFAULT_CACHE_TTL_MS = 6e4;
 /**
-* TTL-cached reverse index: source deviceId → camera ids it is linked to.
+* TTL-cached reverse index: source deviceId → camera ids it is linked to,
+* plus the camera id SET the index was built from (so the ingest can ask
+* "is this device itself a camera" without a second enumeration).
 * Rebuilds lazily (single-flight) when stale, so the `DeviceStateChanged`
 * handler pays one map lookup per event in the common case.
 */
@@ -21603,6 +22238,8 @@ var LinkedCamerasCache = class {
 	deps;
 	ttlMs;
 	index = /* @__PURE__ */ new Map();
+	/** Every camera id seen by the last successful build. */
+	cameras = /* @__PURE__ */ new Set();
 	/** Ms timestamp of the last build; null = never built / invalidated. */
 	builtAt = null;
 	building = null;
@@ -21612,23 +22249,37 @@ var LinkedCamerasCache = class {
 	}
 	/** Camera ids linked to `sourceDeviceId` ([] when none). */
 	async camerasFor(sourceDeviceId, nowMs = Date.now()) {
-		if (this.builtAt === null || nowMs - this.builtAt >= this.ttlMs) {
-			this.building ??= this.rebuild(nowMs).finally(() => {
-				this.building = null;
-			});
-			await this.building;
-		}
+		await this.ensureFresh(nowMs);
 		return this.index.get(sourceDeviceId) ?? [];
 	}
+	/**
+	* True when `deviceId` is ITSELF a camera. Answered off the same build as
+	* {@link camerasFor} — a sensor cap bound on a camera needs both facts in
+	* the same event, and a second enumeration would double the cost of the
+	* ingest path for nothing.
+	*/
+	async isCamera(deviceId, nowMs = Date.now()) {
+		await this.ensureFresh(nowMs);
+		return this.cameras.has(deviceId);
+	}
 	/** Drop the cached index (e.g. on link-topology change events). */
 	invalidate() {
 		this.builtAt = null;
 	}
 	/** Test/maintenance hook: replace the index directly. */
-	seed(index, builtAt) {
+	seed(index, builtAt, cameraIds = []) {
 		this.index = new Map(index);
+		this.cameras = new Set(cameraIds);
 		this.builtAt = builtAt;
 	}
+	/** Rebuild (single-flight) when never built or past the TTL. */
+	async ensureFresh(nowMs) {
+		if (this.builtAt !== null && nowMs - this.builtAt < this.ttlMs) return;
+		this.building ??= this.rebuild(nowMs).finally(() => {
+			this.building = null;
+		});
+		await this.building;
+	}
 	async rebuild(nowMs) {
 		try {
 			const cameraIds = await this.deps.cameras.listCameraIds();
@@ -21645,6 +22296,7 @@ var LinkedCamerasCache = class {
 				this.deps.onError?.("getLinkedDevices", err);
 			}
 			this.index = next;
+			this.cameras = new Set(cameraIds);
 			this.builtAt = nowMs;
 		} catch (err) {
 			this.deps.onError?.("listCameraIds", err);
@@ -21653,16 +22305,25 @@ var LinkedCamerasCache = class {
 	}
 };
 /**
-* One `DeviceStateChanged` → N history rows (one per linked camera). The
-* EVENT_KIND_BY_CAP gate exits first so non-sensor cap churn costs one map
-* lookup. Returns the number of rows inserted (0 when unmapped/unlinked).
+* One `DeviceStateChanged` → N history rows, one per camera the event belongs
+* to: the emitting device's LINKED cameras, plus the emitting device ITSELF
+* when it is a camera carrying the sensor cap (a doorbell wrapper bound on
+* camera 615 — see `SELF_CAMERA_EXCLUDED_CAPS` for the one cap that is not
+* self-ingested). The EVENT_KIND_BY_CAP gate exits first so non-sensor cap
+* churn costs one map lookup. Returns the number of rows inserted (0 when
+* unmapped, or when the device belongs to no camera at all).
 * Telemetry-lossy by design (D8) — inserts are best-effort.
 */
 async function ingestSensorStateChange(deps, data, timestamp) {
 	const descriptor = EVENT_KIND_BY_CAP[data.capName];
 	if (descriptor === void 0) return 0;
-	const cameraIds = await deps.cache.camerasFor(data.deviceId);
-	if (cameraIds.length === 0) return 0;
+	const linkedCameraIds = await deps.cache.camerasFor(data.deviceId);
+	const isCamera = await deps.cache.isCamera(data.deviceId);
+	const cameraIds = isCamera && selfCameraMayEmit(data.capName) && !linkedCameraIds.includes(data.deviceId) ? [data.deviceId, ...linkedCameraIds] : linkedCameraIds;
+	if (cameraIds.length === 0) {
+		deps.onDropped?.(isCamera ? "camera-native-cap" : "no-camera", descriptor.kind);
+		return 0;
+	}
 	const slice = data.slice;
 	const value = slice !== null && slice !== void 0 && typeof slice === "object" && !Array.isArray(slice) ? slice : null;
 	const makeId = deps.makeId ?? (() => `pa-sensor-${randomUUID()}`);
@@ -21798,6 +22459,8 @@ var SNAPSHOT_MAX_WIDTH = 960;
 /** Bound the once-per-owner display-fallback memo so a long-lived process never
 *  leaks it. */
 var MAX_LOGGED_DISPLAY_FALLBACKS = 5e3;
+/** One `pinned-frame resolve missed` line per device per minute. */
+var PINNED_MISS_WARN_THROTTLE_MS = 6e4;
 /**
 * Map a detection-frame pixel box (`fromW`×`fromH`, the ≤640 raster the tracker
 * ran on) onto the native full frame (`toW`×`toH`, the 960-downscaled native
@@ -21883,6 +22546,8 @@ var EventMediaDispatcher = class {
 	/** Once-per-owner (`${eventId}:${kind}`) memo for the DISPLAY-crop fallback
 	*  info log — see {@link logDisplayFallbackOnce}. */
 	loggedDisplayFallbacks = /* @__PURE__ */ new Set();
+	/** Per-device throttle for {@link warnPinnedFrameMiss}. */
+	lastPinnedMissWarnAt = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 		this.sharedNativeFullFrame = createSharedFrameResolver((handle) => this.deps.getNativeFullFrameRgb(handle, SNAPSHOT_MAX_WIDTH));
@@ -21896,30 +22561,48 @@ var EventMediaDispatcher = class {
 	* by which time the handle's ring slot is usually recycled and the by-handle
 	* resolve in {@link captureForFrame} finds nothing (the 2026-07-23 boxed-tile
 	* regression). ~0.7MB per pinned frame, freed with the batch — bounded by the
-	* lane. Returns `null` on a genuine live-window miss (logged at debug — the
-	* caller then omits `pinnedFrame` and captureForFrame's by-handle resolve,
-	* WARN-logged on failure, remains the fallback).
+	* lane. Returns `null` on a genuine live-window miss.
+	*
+	* Both miss paths are WARN, throttled to one line per device per minute. They
+	* are the FIRST half of a pair whose second half (`capture batch lost`) has
+	* always been a warn: a batch that lost its frame is reported with
+	* `pinned: false`, and until 2026-08-07 the reason the pin itself failed was
+	* either at debug (the throw) or nowhere at all (the null return). 383 batch
+	* losses in 3 h had `pinned: false` on 100% of them and nothing said why.
 	*/
 	async resolvePinnedFrame(deviceId, frameHandle) {
 		try {
 			const decoded = await resolveFrame(frameHandle, { getRemoteFrame: this.deps.getRemoteFrame });
-			if (!decoded) return null;
+			if (!decoded) {
+				this.warnPinnedFrameMiss(deviceId, frameHandle, "recycled-before-pin");
+				return null;
+			}
 			return {
 				...decoded,
 				data: Buffer.from(decoded.data)
 			};
 		} catch (err) {
-			this.deps.logger.debug("event media: pinned-frame resolve threw (live window)", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					shmId: frameHandle.shmId,
-					error: String(err)
-				}
-			});
+			this.warnPinnedFrameMiss(deviceId, frameHandle, "threw", String(err));
 			return null;
 		}
 	}
+	/** One `pinned-frame resolve missed` line per device per minute. Throttled
+	*  because it fires per capture batch, and the batch's own loss line is not. */
+	warnPinnedFrameMiss(deviceId, frameHandle, reason, error) {
+		const now = Date.now();
+		if (now - (this.lastPinnedMissWarnAt.get(deviceId) ?? 0) < PINNED_MISS_WARN_THROTTLE_MS) return;
+		this.lastPinnedMissWarnAt.set(deviceId, now);
+		this.deps.logger.warn("event media: pinned-frame resolve missed (live window)", {
+			tags: { deviceId },
+			meta: {
+				reason,
+				shmId: frameHandle.shmId,
+				handle: `${frameHandle.shmId}#${frameHandle.slot}#${frameHandle.seq}`,
+				handleNodeId: frameHandle.nodeId,
+				...error !== void 0 ? { error } : {}
+			}
+		});
+	}
 	/**
 	* WARN-log a whole-batch capture abort: every early return in
 	* {@link captureForFrame} loses ALL of the frame's targets at once —
@@ -22371,307 +23054,12 @@ var EventMediaDispatcher = class {
 					deviceId,
 					trackId: tf.trackId,
 					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-			return false;
-		}
-	}
-};
-/**
-* A baseline whose last sample is older than `baselineMs × this` no longer
-* describes the camera — an on-motion camera detaches for hours and comes
-* back to a different scene. Decaying it forward would make the first frame
-* back either a guaranteed marker (mean still holds the old quiet) or a
-* guaranteed miss; discarding it is the honest option and costs one warm-up.
-*/
-var STALE_BASELINE_FACTOR = 5;
-/**
-* Floor on the MAD used as the deviation unit, in dB. A perfectly flat signal
-* has MAD 0 and would make every deviation infinite. 1 dB is below the
-* quantisation of any real level meter, so it only ever binds on a synthetic
-* or a genuinely dead-steady signal — where bar 2 is what should decide.
-*/
-var MIN_MAD_DB = 1;
-function emptyAudioBaseline() {
-	return {
-		count: 0,
-		mean: 0,
-		mad: 0,
-		firstMs: 0,
-		lastMs: 0
-	};
-}
-/** Seed a fresh baseline from one sample (first ever, or after a stale gap). */
-function seed(sample) {
-	return {
-		count: 1,
-		mean: sample.dbfs,
-		mad: 0,
-		firstMs: sample.timestampMs,
-		lastMs: sample.timestampMs
-	};
-}
-/**
-* Fold `sample` into `state` and decide whether it is a marker candidate.
-*
-* The verdict is measured against the PRIOR baseline (this frame excluded) so
-* a lone spike is not diluted by itself — the same reasoning
-* `audio-level-detector` uses for its `priorMean`. The state returned always
-* includes the sample, whatever the verdict.
-*/
-function observeAudioAnomaly(state, sample, cfg) {
-	const isFirst = state.count === 0;
-	const gapMs = sample.timestampMs - state.lastMs;
-	const isStale = !isFirst && gapMs > cfg.baselineMs * STALE_BASELINE_FACTOR;
-	if (isFirst || isStale) return {
-		verdict: { kind: "warmup" },
-		nextState: seed(sample)
-	};
-	const alpha = 1 - Math.exp(-Math.max(0, gapMs) / cfg.baselineMs);
-	const priorMean = state.mean;
-	const priorMad = state.mad;
-	const nextState = {
-		count: state.count + 1,
-		mean: priorMean + alpha * (sample.dbfs - priorMean),
-		mad: priorMad + alpha * (Math.abs(sample.dbfs - priorMean) - priorMad),
-		firstMs: state.firstMs,
-		lastMs: sample.timestampMs
-	};
-	if (sample.dbfs <= cfg.silenceFloorDbfs) return {
-		verdict: { kind: "silent" },
-		nextState
-	};
-	if (!(nextState.count >= 30 && sample.timestampMs - state.firstMs >= cfg.baselineMs)) return {
-		verdict: { kind: "warmup" },
-		nextState
-	};
-	if (sample.dbfs < cfg.minDbfs) return {
-		verdict: {
-			kind: "not-loud",
-			dbfs: sample.dbfs
-		},
-		nextState
-	};
-	const deviationDb = sample.dbfs - priorMean;
-	const deviations = deviationDb / Math.max(priorMad, MIN_MAD_DB);
-	const measured = {
-		dbfs: sample.dbfs,
-		mean: priorMean,
-		deviationDb,
-		deviations
-	};
-	return {
-		verdict: deviationDb >= cfg.minDeviationDb && deviations >= cfg.minDeviations ? {
-			kind: "anomalous",
-			...measured
-		} : {
-			kind: "not-anomalous",
-			...measured
-		},
-		nextState
-	};
-}
-//#endregion
-//#region src/pipeline-analytics/services/audio-marker-projector.ts
-/** One info line per camera per minute, and only when something qualified. */
-var METRICS_WINDOW_MS = 6e4;
-var HOUR_MS = 60 * 6e4;
-var DAY_MS = 24 * HOUR_MS;
-function emptyCounters(atMs) {
-	return {
-		windowStartMs: atMs,
-		enabled: false,
-		observed: 0,
-		notLoud: 0,
-		notAnomalous: 0,
-		candidates: 0,
-		suppressedMotion: 0,
-		suppressedCooldown: 0,
-		suppressedHourly: 0,
-		suppressedDaily: 0,
-		suppressedInFlight: 0,
-		wouldFire: 0,
-		materialized: 0,
-		materializeFailed: 0
-	};
-}
-var AudioMarkerProjector = class {
-	deps;
-	baselines = /* @__PURE__ */ new Map();
-	rates = /* @__PURE__ */ new Map();
-	counters = /* @__PURE__ */ new Map();
-	inFlight = /* @__PURE__ */ new Set();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Feed ONE audio frame. Synchronous by construction: at ~30 Hz per camera
-	* the common path must not allocate a promise, so the decision is taken
-	* inline and only an actual marker goes async (fire-and-forget, bounded by
-	* the in-flight guard and the rate ceilings).
-	*
-	* Call this BEFORE the classification/level route split so the baseline
-	* sees every frame. A baseline fed only by the level route is blind to
-	* exactly the loud, confidently-classified frames a marker is for.
-	*/
-	observe(input, cfg) {
-		const { deviceId, timestampMs } = input;
-		const counters = this.countersFor(deviceId, timestampMs);
-		counters.observed += 1;
-		counters.enabled = cfg.enabled;
-		const res = observeAudioAnomaly(this.baselines.get(deviceId) ?? emptyAudioBaseline(), {
-			timestampMs,
-			dbfs: input.dbfs
-		}, cfg);
-		this.baselines.set(deviceId, res.nextState);
-		this.maybeFlush(deviceId, timestampMs);
-		switch (res.verdict.kind) {
-			case "silent":
-			case "warmup": return;
-			case "not-loud":
-				counters.notLoud += 1;
-				return;
-			case "not-anomalous":
-				counters.notAnomalous += 1;
-				return;
-			case "anomalous": break;
-		}
-		counters.candidates += 1;
-		if (this.deps.isMotionActive(deviceId, timestampMs, cfg.motionQuietMs)) {
-			counters.suppressedMotion += 1;
-			return;
-		}
-		const fired = this.rates.get(deviceId)?.firedAtMs ?? [];
-		const last = fired.length > 0 ? fired[fired.length - 1] : void 0;
-		if (last !== void 0 && timestampMs - last < cfg.cooldownMs) {
-			counters.suppressedCooldown += 1;
-			return;
-		}
-		const recent = fired.filter((t) => timestampMs - t < DAY_MS);
-		if (recent.filter((t) => timestampMs - t < HOUR_MS).length >= cfg.maxPerHour) {
-			counters.suppressedHourly += 1;
-			this.rates.set(deviceId, { firedAtMs: recent });
-			return;
-		}
-		if (recent.length >= cfg.maxPerDay) {
-			counters.suppressedDaily += 1;
-			this.rates.set(deviceId, { firedAtMs: recent });
-			return;
-		}
-		if (!cfg.enabled) {
-			counters.wouldFire += 1;
-			return;
-		}
-		if (this.inFlight.has(deviceId)) {
-			counters.suppressedInFlight += 1;
-			return;
-		}
-		this.rates.set(deviceId, { firedAtMs: [...recent, timestampMs] });
-		counters.materialized += 1;
-		this.inFlight.add(deviceId);
-		this.materialize(input, counters);
-	}
-	/**
-	* Emit and reset a camera's window if it has anything to say. Exposed so a
-	* shutdown (or a test) can force the tally out rather than losing it.
-	*/
-	flush(nowMs) {
-		for (const deviceId of this.counters.keys()) this.emitWindow(deviceId, nowMs, true);
-	}
-	/** Drop all per-camera state for a device (unbind / device removal). */
-	forgetDevice(deviceId) {
-		this.baselines.delete(deviceId);
-		this.rates.delete(deviceId);
-		this.counters.delete(deviceId);
-		this.inFlight.delete(deviceId);
-	}
-	async materialize(input, counters) {
-		const { deviceId, timestampMs } = input;
-		try {
-			const audioLabels = buildAudioLabels(input);
-			await this.deps.sink.materialize({
-				cameraId: deviceId,
-				sourceDeviceId: deviceId,
-				source: "audio",
-				kind: "audio",
-				timestamp: timestampMs,
-				...audioLabels !== void 0 ? { audioLabels } : {}
-			});
-		} catch (err) {
-			counters.materialized -= 1;
-			counters.materializeFailed += 1;
-			this.deps.onError?.("materializeAudioMarker", err);
-			this.deps.logger.warn("audio marker materialize failed", {
-				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
+				}
 			});
-		} finally {
-			this.inFlight.delete(deviceId);
+			return false;
 		}
 	}
-	countersFor(deviceId, atMs) {
-		const existing = this.counters.get(deviceId);
-		if (existing !== void 0) return existing;
-		const fresh = emptyCounters(atMs);
-		this.counters.set(deviceId, fresh);
-		return fresh;
-	}
-	maybeFlush(deviceId, nowMs) {
-		const c = this.counters.get(deviceId);
-		if (c === void 0 || nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
-		this.emitWindow(deviceId, nowMs, false);
-	}
-	/**
-	* One line per camera per window — but ONLY when a frame reached the
-	* candidate gate. A camera that heard nothing extraordinary has nothing to
-	* report, and a line per camera per minute forever would bury the ones that
-	* do. `force` still honours that: it flushes the window, it does not invent
-	* a reason to speak.
-	*/
-	emitWindow(deviceId, nowMs, force) {
-		const c = this.counters.get(deviceId);
-		if (c === void 0) return;
-		if (!force && nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
-		if (c.candidates > 0 || c.materializeFailed > 0) this.deps.logger.info("audio anomaly gate (window)", {
-			tags: { deviceId },
-			meta: {
-				enabled: c.enabled,
-				windowMs: nowMs - c.windowStartMs,
-				observed: c.observed,
-				notLoud: c.notLoud,
-				notAnomalous: c.notAnomalous,
-				candidates: c.candidates,
-				suppressedMotion: c.suppressedMotion,
-				suppressedCooldown: c.suppressedCooldown,
-				suppressedHourly: c.suppressedHourly,
-				suppressedDaily: c.suppressedDaily,
-				suppressedInFlight: c.suppressedInFlight,
-				wouldFire: c.wouldFire,
-				materialized: c.materialized,
-				materializeFailed: c.materializeFailed
-			}
-		});
-		this.counters.set(deviceId, emptyCounters(nowMs));
-	}
 };
-/**
-* The class heard on the anomalous frame, in the shape `Track.audioLabels`
-* already defines. Using that field is what lets a marker label itself
-* ("dog", "glass_breaking") without inventing an event-taxonomy sub-class —
-* the audio macro vocabulary collides with existing subs (`dog` is a COCO
-* animal, `siren` is a control), so a sub per audio class would put a barking
-* dog in the ANIMAL lane.
-*/
-function buildAudioLabels(input) {
-	if (input.className === void 0) return void 0;
-	return [{
-		label: input.className,
-		peakScore: input.score ?? 0,
-		count: 1,
-		firstAt: input.timestampMs,
-		lastAt: input.timestampMs
-	}];
-}
 /** JPEG quality for the downscaled full frame — matches the crop path. */
 var FULL_FRAME_QUALITY = 80;
 /**
@@ -22772,13 +23160,19 @@ var SyntheticTrackMaterializer = class {
 	* Fetch the linked camera's snapshot under a bounded timeout. A hanging
 	* snapshot cap is skipped (returns null + warns) so the track still lands;
 	* a null / failed fetch is likewise reported and skipped.
+	*
+	* Deliberately NOT `force`. `snapshot.cap.ts` defines `force` as the
+	* operator's refresh button — *"On battery cams this WILL wake the camera —
+	* accept the cost only when the user explicitly asks for it"* — and a
+	* synthetic track is materialised from an EVENT, with nobody asking. Forcing
+	* here walked straight past the snapshot addon's sleep gate and woke a
+	* sleeping battery camera per event (roadmap 4f). Without it the cache
+	* answers: ≤10 s old on a mains camera, and on a battery camera the
+	* intentionally stale-but-honest frame that costs no wake.
 	*/
 	async fetchSnapshot(cameraId) {
 		try {
-			const snap = await withTimeout(this.deps.snapshot.getSnapshot({
-				deviceId: cameraId,
-				force: true
-			}), this.snapshotTimeoutMs);
+			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), this.snapshotTimeoutMs);
 			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"));
 			return snap;
 		} catch (err) {
@@ -24678,6 +25072,478 @@ async function sweepTrackRetention(deps) {
 	return totalTracks;
 }
 //#endregion
+//#region src/pipeline-analytics/training-export/dataset-plan.ts
+var FACE_OWNER_PREFIX = "face-";
+var PLATE_OWNER_PREFIX = "plate-";
+/**
+* Tracks one export pass will carry.
+*
+* It is the per-device pin budget (500) times the four cameras a homelab hub
+* plausibly runs, rounded — i.e. "every track that can be marked", not a
+* throttle the operator has to think about. The ceiling exists so a fleet-wide
+* export cannot become an unbounded walk if the pin budget is ever raised, and
+* `truncated` in the summary says when it bit rather than quietly shipping a
+* partial dataset as if it were the whole one.
+*/
+var TRAINING_EXPORT_MAX_TRACKS = 2e3;
+/**
+* Archive path for one media file.
+*
+* The scope segment is not decoration: a track and its best object event can
+* both own a `crop` at the same millisecond, and without the segment the second
+* one would overwrite the first inside the archive — a silent loss that only
+* shows up as a dataset that is smaller than the manifest says.
+*/
+function archivePathFor(params) {
+	const leaf = params.singleInstance ? `${params.kind}.jpg` : `${params.kind}-${params.timestamp}.jpg`;
+	const dir = params.scope === "" ? "" : `${params.scope}/`;
+	return `tracks/${params.deviceId}/${params.trackId}/${dir}${leaf}`;
+}
+/**
+* A media key ends in `:<timestamp>` for the accumulating kinds and stops at the
+* kind for the single-instance ones. Reading it off the key rather than
+* re-deriving the kind set keeps this from drifting when a kind changes sides.
+*/
+function isSingleInstanceKey(key, kind) {
+	return key.endsWith(`:${kind}`);
+}
+/**
+* Build the plan. Index reads only — the returned plan holds no image bytes and
+* is safe to send over tRPC.
+*/
+async function buildTrainingExportPlan(readers, input) {
+	const tracks = [];
+	const skippedPaths = [];
+	let truncated = false;
+	let remaining = input.maxTracks;
+	for (const deviceId of input.deviceIds) {
+		if (remaining <= 0) break;
+		const marked = await readers.listMarkedTracks(deviceId, remaining + 1);
+		if (marked.length > remaining) truncated = true;
+		const take = marked.slice(0, remaining);
+		remaining -= take.length;
+		if (take.length === 0) continue;
+		const eventLinks = await readers.listEventIdsForTracks(take.map((t) => t.trackId));
+		const eventsByTrack = /* @__PURE__ */ new Map();
+		for (const link of eventLinks) {
+			const list = eventsByTrack.get(link.trackId);
+			if (list) list.push(link.eventId);
+			else eventsByTrack.set(link.trackId, [link.eventId]);
+		}
+		for (const track of take) {
+			const files = [];
+			const owners = [
+				{
+					ownerKind: "track",
+					ownerId: track.trackId,
+					scope: ""
+				},
+				{
+					ownerKind: "face",
+					ownerId: `${FACE_OWNER_PREFIX}${track.trackId}`,
+					scope: "face"
+				},
+				{
+					ownerKind: "plate",
+					ownerId: `${PLATE_OWNER_PREFIX}${track.trackId}`,
+					scope: "plate"
+				},
+				...(eventsByTrack.get(track.trackId) ?? []).map((eventId) => ({
+					ownerKind: "event",
+					ownerId: eventId,
+					scope: `events/${eventId}`
+				}))
+			];
+			for (const owner of owners) {
+				const infos = await readers.listMediaInfo(owner.ownerKind, owner.ownerId);
+				for (const info of infos) {
+					const archivePath = archivePathFor({
+						deviceId: track.deviceId,
+						trackId: track.trackId,
+						scope: owner.scope,
+						kind: info.kind,
+						timestamp: info.timestamp,
+						singleInstance: isSingleInstanceKey(info.key, info.kind)
+					});
+					files.push({
+						archivePath,
+						mediaKey: info.key,
+						kind: info.kind,
+						sizeBytes: info.sizeBytes,
+						timestamp: info.timestamp
+					});
+				}
+			}
+			tracks.push({
+				trackId: track.trackId,
+				deviceId: track.deviceId,
+				className: track.className,
+				...track.label !== void 0 ? { label: track.label } : {},
+				firstSeen: track.firstSeen,
+				lastSeen: track.lastSeen,
+				classes: track.classes ?? [],
+				zonesVisited: track.zonesVisited,
+				...track.importance !== void 0 ? { importance: track.importance } : {},
+				files
+			});
+		}
+	}
+	const perDevice = /* @__PURE__ */ new Map();
+	let fileCount = 0;
+	let byteCount = 0;
+	for (const track of tracks) {
+		const agg = perDevice.get(track.deviceId) ?? {
+			tracks: 0,
+			files: 0,
+			bytes: 0
+		};
+		agg.tracks += 1;
+		for (const file of track.files) {
+			agg.files += 1;
+			agg.bytes += file.sizeBytes;
+			fileCount += 1;
+			byteCount += file.sizeBytes;
+		}
+		perDevice.set(track.deviceId, agg);
+	}
+	return {
+		generatedAt: readers.now(),
+		tracks,
+		totals: [...perDevice.entries()].map(([deviceId, agg]) => ({
+			deviceId,
+			...agg
+		})),
+		trackCount: tracks.length,
+		fileCount,
+		byteCount,
+		truncated,
+		skippedPaths
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/training-export/tar-stream.ts
+/**
+* A minimal POSIX ustar writer — enough to emit a dataset archive entry by
+* entry, without ever holding the archive in memory.
+*
+* ## Why hand-rolled rather than the `tar` package
+*
+* `tar` is in the workspace and is the right tool for what it does: archive a
+* set of paths under one `cwd`. This is a different job. A track's media lives
+* across several storage LOCATION roots (`eventMedia` and whatever else the
+* operator relocated to), under paths that encode nothing a training set wants —
+* `615/events/track/<uuid>/keyFrame.jpg` — and every entry has to be RENAMED on
+* the way in, to `tracks/615/<trackId>/keyFrame.jpg`. `tar.create` takes a list
+* of paths relative to a single cwd and gives no rename hook, so using it would
+* mean staging a whole shadow tree on disk first: a full second copy of the
+* dataset, written and then deleted, to avoid writing 100 lines.
+*
+* So: ustar, which is a 512-byte header and a 512-byte-padded body per entry,
+* fully specified, and asserted against the system `tar` binary in the spec next
+* door rather than against my reading of the format.
+*
+* ## What this deliberately does NOT do
+*
+* No gzip — the payload is JPEG, already compressed; a gzip pass would burn CPU
+* on the hub for a percent or two. No long-name (GNU/PAX) extension: ustar
+* splits a path across a 155-byte prefix and a 100-byte name, and
+* {@link tarNameTooLong} reports a path that will not fit so the caller can skip
+* it and SAY it skipped it, rather than emitting a silently truncated entry.
+*/
+var BLOCK_SIZE = 512;
+var NAME_MAX = 100;
+var PREFIX_MAX = 155;
+/**
+* Split a path into the ustar `prefix` + `name` pair, or `null` when it cannot
+* be represented. The split must land on a `/`, and each half has its own cap.
+*/
+function splitUstarName(name) {
+	if (Buffer.byteLength(name) <= NAME_MAX) return {
+		prefix: "",
+		name
+	};
+	for (let i = name.length - 1; i >= 0; i--) {
+		if (name[i] !== "/") continue;
+		const head = name.slice(0, i);
+		const tail = name.slice(i + 1);
+		if (Buffer.byteLength(tail) > NAME_MAX) break;
+		if (Buffer.byteLength(head) <= PREFIX_MAX) return {
+			prefix: head,
+			name: tail
+		};
+	}
+	return null;
+}
+/** True when a path cannot be represented as a ustar entry name. */
+function tarNameTooLong(name) {
+	return splitUstarName(name) === null;
+}
+function writeString(block, value, offset, length) {
+	block.write(value.slice(0, length - 1), offset, length - 1, "utf8");
+}
+/** ustar numeric field: zero-padded octal, NUL-terminated. */
+function writeOctal(block, value, offset, length) {
+	const text = Math.floor(value).toString(8).padStart(length - 1, "0");
+	block.write(text.slice(-(length - 1)), offset, length - 1, "ascii");
+}
+/**
+* The 512-byte header for one regular file.
+*
+* The checksum is computed with the checksum field itself read as eight spaces —
+* that is the format's rule, and getting it wrong produces an archive that looks
+* fine until something tries to read it.
+*/
+function tarHeader(entry) {
+	const split = splitUstarName(entry.name);
+	if (split === null) throw new Error(`tar: entry name too long for ustar: ${entry.name}`);
+	const block = Buffer.alloc(BLOCK_SIZE);
+	writeString(block, split.name, 0, NAME_MAX);
+	writeOctal(block, 420, 100, 8);
+	writeOctal(block, 0, 108, 8);
+	writeOctal(block, 0, 116, 8);
+	writeOctal(block, entry.body.length, 124, 12);
+	writeOctal(block, Math.floor(entry.mtimeMs / 1e3), 136, 12);
+	block.write("        ", 148, 8, "ascii");
+	block.write("0", 156, 1, "ascii");
+	block.write("ustar\0", 257, 6, "ascii");
+	block.write("00", 263, 2, "ascii");
+	writeString(block, split.prefix, 345, PREFIX_MAX);
+	let sum = 0;
+	for (const byte of block) sum += byte;
+	writeOctal(block, sum, 148, 7);
+	block.write("\0", 154, 1, "ascii");
+	block.write(" ", 155, 1, "ascii");
+	return block;
+}
+/** Zero padding that rounds a body up to the 512-byte block. */
+function tarPadding(size) {
+	const remainder = size % BLOCK_SIZE;
+	return remainder === 0 ? Buffer.alloc(0) : Buffer.alloc(BLOCK_SIZE - remainder);
+}
+/** Header + body + padding for one entry, ready to write. */
+function tarBlocks(entry) {
+	return [
+		tarHeader(entry),
+		entry.body,
+		tarPadding(entry.body.length)
+	];
+}
+/** The two zero blocks that terminate an archive. */
+function tarTrailer() {
+	return Buffer.alloc(BLOCK_SIZE * 2);
+}
+//#endregion
+//#region src/pipeline-analytics/training-export/training-export-stream.ts
+var MANIFEST_ENTRY_NAME = "manifest.json";
+function manifestTrack(track) {
+	return {
+		trackId: track.trackId,
+		deviceId: track.deviceId,
+		className: track.className,
+		...track.label !== void 0 ? { label: track.label } : {},
+		firstSeen: track.firstSeen,
+		lastSeen: track.lastSeen,
+		classes: track.classes,
+		zonesVisited: track.zonesVisited,
+		...track.importance !== void 0 ? { importance: track.importance } : {},
+		files: track.files.map((f) => ({
+			path: f.archivePath,
+			kind: f.kind,
+			timestamp: f.timestamp,
+			sizeBytes: f.sizeBytes
+		}))
+	};
+}
+/**
+* The manifest body.
+*
+* `mediaKey` is deliberately NOT in it. The archive is a dataset handed to a
+* training pipeline, and a store-internal key is meaningless outside the hub
+* that issued it — worse, it invites a consumer to believe it can fetch by that
+* key later, on media the retention pin does not guarantee is still there once
+* the mark is removed. The archive path is the identity inside the archive.
+*/
+function buildManifest(plan) {
+	const body = {
+		format: "camstack-training-export",
+		version: 1,
+		generatedAt: plan.generatedAt,
+		selection: "tracks in retrain staging (retrainStatus: 'staging')",
+		trackCount: plan.trackCount,
+		fileCount: plan.fileCount,
+		byteCount: plan.byteCount,
+		truncated: plan.truncated,
+		devices: plan.totals,
+		tracks: plan.tracks.map(manifestTrack)
+	};
+	return Buffer.from(JSON.stringify(body, null, 2), "utf8");
+}
+/** Write the whole archive to the sink. */
+async function streamDataset(deps) {
+	const { plan, sink, readBlob, logger, now, pace } = deps;
+	const pacingMs = deps.pacingMs ?? 25;
+	const mtimeMs = now();
+	for (const block of tarBlocks({
+		name: MANIFEST_ENTRY_NAME,
+		body: buildManifest(plan),
+		mtimeMs
+	})) await sink.write(block);
+	let filesWritten = 0;
+	let bytesWritten = 0;
+	let filesMissing = 0;
+	let aborted = false;
+	for (const track of plan.tracks) {
+		for (const file of track.files) {
+			if (deps.aborted?.() === true) {
+				aborted = true;
+				break;
+			}
+			if (tarNameTooLong(file.archivePath)) {
+				filesMissing += 1;
+				logger.warn("training export skipped a file — path too long for the archive", {
+					tags: { deviceId: track.deviceId },
+					meta: {
+						deviceId: track.deviceId,
+						trackId: track.trackId,
+						path: file.archivePath
+					}
+				});
+				continue;
+			}
+			const bytes = await readBlob(file.mediaKey);
+			if (bytes === null) {
+				filesMissing += 1;
+				logger.warn("training export skipped a file — media unreadable", {
+					tags: { deviceId: track.deviceId },
+					meta: {
+						deviceId: track.deviceId,
+						trackId: track.trackId,
+						mediaKey: file.mediaKey
+					}
+				});
+				continue;
+			}
+			for (const block of tarBlocks({
+				name: file.archivePath,
+				body: bytes,
+				mtimeMs
+			})) await sink.write(block);
+			filesWritten += 1;
+			bytesWritten += bytes.length;
+			if (pacingMs > 0) await pace(pacingMs);
+		}
+		if (aborted) break;
+	}
+	await sink.write(tarTrailer());
+	await sink.end();
+	logger.info("training export complete", { meta: {
+		tracks: plan.trackCount,
+		filesWritten,
+		filesMissing,
+		bytesWritten,
+		truncated: plan.truncated,
+		aborted
+	} });
+	return {
+		filesWritten,
+		bytesWritten,
+		filesMissing,
+		aborted
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/training-export/training-export-handler.ts
+var TRAINING_EXPORT_PREFIX = "training-export";
+/**
+* Parse `?deviceIds=615,617` into a device list. An absent or unparseable value
+* yields `[]`, which the caller reads as "every device with marked tracks" —
+* stated here rather than left to the reader because the empty array is doing
+* two jobs and only one of them is obvious.
+*/
+function parseDeviceIds(url) {
+	const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+	const raw = new URLSearchParams(query).get("deviceIds");
+	if (raw === null || raw.trim() === "") return [];
+	const out = [];
+	for (const part of raw.split(",")) {
+		const n = Number.parseInt(part.trim(), 10);
+		if (Number.isInteger(n) && n > 0 && !out.includes(n)) out.push(n);
+	}
+	return out;
+}
+/** Archive filename. Sanitised the same way the backup download is — a header
+*  value carrying a CR or a quote is a response-splitting bug, not a filename. */
+function archiveFilename(nowMs) {
+	return `camstack-training-${new Date(nowMs).toISOString().replace(/[:.]/g, "-")}.tar`.replace(/[\r\n"]/g, "");
+}
+/** Adapt a `ServerResponse` to the sink, honouring backpressure. */
+function responseSink(res) {
+	return {
+		write: (chunk) => new Promise((resolve, reject) => {
+			const ok = res.write(chunk, (err) => {
+				if (err) reject(err);
+				else if (ok) resolve();
+			});
+			if (!ok) res.once("drain", resolve);
+		}),
+		end: () => new Promise((resolve) => {
+			res.end(resolve);
+		})
+	};
+}
+function createTrainingExportHandler(deps) {
+	return async (req, res) => {
+		const method = req.method ?? "GET";
+		if (method !== "GET" && method !== "HEAD") {
+			res.writeHead(405, { allow: "GET, HEAD" });
+			res.end();
+			return;
+		}
+		const deviceIds = parseDeviceIds(req.url ?? "");
+		let plan;
+		try {
+			plan = await deps.buildPlan(deviceIds);
+		} catch (err) {
+			deps.logger.warn("training export plan failed", { meta: { error: String(err) } });
+			res.writeHead(500, { "content-type": "text/plain" });
+			res.end("training export plan failed");
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": "application/x-tar",
+			"content-disposition": `attachment; filename="${archiveFilename(deps.now())}"`,
+			"cache-control": "no-store",
+			"x-camstack-export-tracks": String(plan.trackCount),
+			"x-camstack-export-files": String(plan.fileCount)
+		});
+		if (method === "HEAD") {
+			res.end();
+			return;
+		}
+		let clientGone = false;
+		res.once("close", () => {
+			clientGone = res.writableEnded === false;
+		});
+		try {
+			await streamDataset({
+				plan,
+				sink: responseSink(res),
+				readBlob: deps.readBlob,
+				logger: deps.logger,
+				now: deps.now,
+				pace: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+				aborted: () => clientGone
+			});
+		} catch (err) {
+			deps.logger.warn("training export stream failed mid-archive", { meta: {
+				error: String(err),
+				tracks: plan.trackCount
+			} });
+			res.destroy();
+		}
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/zone-analytics-provider.ts
 var HISTORY_WINDOW_MS = 3600 * 1e3;
 /** Cap name for the runtime-state mirror — matches the cap's declared
@@ -25310,6 +26176,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	retentionSweepTimer = null;
 	/** Handle for the event-media data-plane listener (dispose on shutdown). */
 	eventMediaDataPlane = null;
+	/** Handle for the training-export data-plane listener (dispose on shutdown). */
+	trainingExportDataPlane = null;
 	/** The NC artifact plane (signed public links for notification media) and its
 	*  data-plane handle. Null until served / when the facility is absent. */
 	ncArtifactPlane = null;
@@ -25760,7 +26628,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			logger: logger.child("EventMediaDispatcher")
 		});
 		this.buildRecognizers(api, logger, stores, transport);
-		this.buildDetailDispatcher(api, logger);
+		this.buildDetailDispatcher(api, logger, transport);
 		const capProviders = this.buildAnalyticsProviders(api, logger);
 		await this.buildNotificationCenter(api, logger, stores);
 		await this.serveEventMediaDataPlane();
@@ -25943,7 +26811,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		let storage = this.ctx.kernel.storage;
 		const mediaRoot = process.env.CAMSTACK_MEDIA_ROOT?.trim();
 		if (mediaRoot) {
-			const { FilesystemStorageProvider } = await import("../node-Bjc_xs4R.mjs");
+			const { FilesystemStorageProvider } = await import("../node-Co0YpEFr.mjs");
 			storage = new FilesystemStorageProvider(mediaRoot, { eventMedia: mediaRoot });
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
@@ -26208,7 +27076,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  demand via `pipelineRunner.runDetailSubtree`. The dispatcher owns the
 	*  per-device schedulers, concurrency cap, and 1 s tick; result routing +
 	*  the pinned call + crop fallback are injected here. */
-	buildDetailDispatcher(api, logger) {
+	buildDetailDispatcher(api, logger, transport) {
 		const runnerApi = api.pipelineRunner;
 		this.detailDispatcher = new TrackDetailDispatcher({
 			logger: logger.child("DetailDispatcher"),
@@ -26218,6 +27086,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				return runnerApi.runDetailSubtree.mutate(input);
 			},
 			routeResults: (deviceId, trackId, details, frame) => this.routeDetailResults(deviceId, trackId, details, frame),
+			captureFullFrameBase64: async (frame) => {
+				if (frame.frameHandle === void 0) return null;
+				const full = await transport.getFullFrameJpegBase64(frame.frameHandle, frame.frameWidth);
+				return full === null ? null : {
+					base64: full.base64,
+					width: full.width,
+					height: full.height
+				};
+			},
 			captureCropBase64: async (frame) => {
 				if (frame.frameHandle === void 0 || !this.captureCrop) return null;
 				const buf = await this.captureCrop(frame.frameHandle, { ...frame.bbox }, frame.frameWidth, frame.frameHeight, DETAIL_FALLBACK_CROP_PADDING);
@@ -26443,11 +27320,99 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			}) ?? null;
 			this.eventMediaBaseUrl = this.eventMediaDataPlane !== null ? `/addon/${this.ctx.id}/event-media` : null;
 			await this.serveNcArtifactPlane();
+			await this.serveTrainingExportPlane();
 			this.ctx.logger.info("event-media data-plane served", { meta: { baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)" } });
 		} catch (err) {
 			this.ctx.logger.warn("event-media data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
 	}
+	/**
+	* The training-export data plane. Separate listener, `access: 'admin'` —
+	* marking a track is a viewer-level curation act (D81), but walking off with
+	* every stored frame behind the marked set is not.
+	*/
+	async serveTrainingExportPlane() {
+		try {
+			const handler = createTrainingExportHandler({
+				buildPlan: (deviceIds) => this.buildTrainingExportPlan(deviceIds),
+				readBlob: async (mediaKey) => {
+					const file = await (this.mediaStore?.getByKey(mediaKey) ?? Promise.resolve(null));
+					return file === null ? null : Buffer.from(file.base64, "base64");
+				},
+				logger: this.ctx.logger,
+				now: () => Date.now()
+			});
+			this.trainingExportDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: "training-export",
+				access: "admin",
+				handler
+			}) ?? null;
+		} catch (err) {
+			this.ctx.logger.warn("training-export data-plane failed to serve", { meta: { error: errMsg(err) } });
+		}
+	}
+	/**
+	* Plan the training export — INDEX READS ONLY. No blob is touched here, which
+	* is what lets `getTrainingExportSummary` answer "how big is this" for the
+	* cost of a few KB per track instead of the gigabytes the answer is about.
+	*
+	* An empty `deviceIds` means every device that has tracks, resolved from the
+	* track store rather than from the device manager: a camera that was removed
+	* can still own marked tracks, and refusing to export them because the device
+	* is gone would lose exactly the material an operator kept on purpose.
+	*/
+	async buildTrainingExportPlan(deviceIds) {
+		const trackStore = this.trackStore;
+		const mediaStore = this.mediaStore;
+		const eventStore = this.eventStore;
+		if (!trackStore || !mediaStore) throw new Error("training export: analytics stores unavailable");
+		return buildTrainingExportPlan({
+			listMarkedTracks: (deviceId, limit) => trackStore.listStaging(deviceId, limit),
+			listMediaInfo: async (ownerKind, ownerId) => {
+				if (!isMediaOwnerKind(ownerKind)) return [];
+				return mediaStore.listInfoByOwner(ownerKind, ownerId);
+			},
+			listEventIdsForTracks: async (trackIds) => {
+				if (!eventStore || trackIds.length === 0) return [];
+				return (await eventStore.queryObjectByTrackIds(trackIds)).flatMap((e) => e.trackId === void 0 ? [] : [{
+					eventId: e.id,
+					trackId: e.trackId
+				}]);
+			},
+			now: () => Date.now()
+		}, {
+			deviceIds: deviceIds.length > 0 ? deviceIds : await trackStore.listDeviceIds(),
+			maxTracks: TRAINING_EXPORT_MAX_TRACKS
+		});
+	}
+	/**
+	* Estimate the training export without producing it — the cheap question
+	* (D56's discipline, applied to a pass that runs no inference at all).
+	*/
+	async getTrainingExportSummary(input) {
+		const plan = await this.buildTrainingExportPlan(input.deviceIds ?? []);
+		this.ctx.logger.info("training export summary", { meta: {
+			tracks: plan.trackCount,
+			files: plan.fileCount,
+			bytes: plan.byteCount,
+			truncated: plan.truncated
+		} });
+		return {
+			generatedAt: plan.generatedAt,
+			trackCount: plan.trackCount,
+			fileCount: plan.fileCount,
+			byteCount: plan.byteCount,
+			truncated: plan.truncated,
+			devices: plan.totals
+		};
+	}
+	/** Where to stream the dataset from. The bytes never come through the cap. */
+	async getTrainingExportUrl(input) {
+		if (this.trainingExportDataPlane === null) throw new Error("training export: data plane unavailable on this node");
+		const ids = input.deviceIds ?? [];
+		const query = ids.length > 0 ? `?deviceIds=${ids.join(",")}` : "";
+		return { url: `/addon/${this.ctx.id}/${TRAINING_EXPORT_PREFIX}${query}` };
+	}
 	/** Object/face embedding dispatcher — migrated from the retired
 	*  enrichment-engine addon. It subscribes to DetectionResult, resolves the
 	*  frame via the runner transport, crops each qualifying detection, and
@@ -26698,6 +27663,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.eventMediaDataPlane = null;
 		this.eventMediaBaseUrl = null;
 		this.eventMediaDispatcher = null;
+		await this.trainingExportDataPlane?.dispose();
+		this.trainingExportDataPlane = null;
 	}
 	async handleInferenceResult(data) {
 		if (this.shuttingDown) return;
@@ -26842,12 +27809,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				inPrevActive: false,
 				positionsCount: positionsCountById.get(id) ?? 1
 			}) === "resurrection") {
-				log.info("track resumed", { meta: {
-					trackId: id,
-					className: t.className,
-					source,
-					resurrected: true
-				} });
+				log.info("track resumed", {
+					tags: { deviceId },
+					meta: {
+						trackId: id,
+						className: t.className,
+						source,
+						resurrected: true
+					}
+				});
 				if (this.eventMediaDispatcher) {
 					this.residents.setLastFrameAt(deviceId, id, result.timestamp);
 					if (!this.residents.isFirstFrameLanded(id) && !this.residents.isFirstFramePending(id)) this.residents.markFirstFramePending(deviceId, id);
@@ -26982,10 +27952,13 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		let lostTrackCount = 0;
 		for (const id of prevIds) if (!currentTrackIds.has(id)) {
 			lostTrackCount += 1;
-			log.info("track lost", { meta: {
-				trackId: id,
-				source
-			} });
+			log.info("track lost", {
+				tags: { deviceId },
+				meta: {
+					trackId: id,
+					source
+				}
+			});
 		}
 		this.suppressedBirths.retain(key, currentTrackIds);
 		this.deferredBirths.retain(key, currentTrackIds);
@@ -27222,6 +28195,19 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 							this.residents.markFirstFrameLanded(deviceId, trackId);
 						}
 						for (const trackId of res.lastFrameTrackIds) this.residents.setLastFrameAt(deviceId, trackId, dispatchTimestamp);
+						const landedSnapshots = new Set(res.storedSnapshots.map((s) => s.trackId));
+						for (const target of snapshotTargets) {
+							if (!target.appendSnapshot || landedSnapshots.has(target.trackId)) continue;
+							const gaveBack = this.trackStore?.rollbackSnapshotPending(target.trackId, target.timestamp);
+							log.warn("snapshot capture did not land", {
+								tags: { deviceId },
+								meta: {
+									trackId: target.trackId,
+									timestamp: target.timestamp,
+									intervalReturned: gaveBack === true
+								}
+							});
+						}
 					})
 				}).catch(() => {});
 			}
@@ -29020,8 +30006,16 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	}
 	/**
 	* Sensor-event ingest handler — `DeviceStateChanged` of a device exposing a
-	* mapped sensor cap. Resolves the linked-camera set through the TTL cache
-	* and inserts ONE row per linked camera. Best-effort (telemetry-lossy).
+	* mapped sensor cap. Resolves the camera set through the TTL cache (the
+	* device's LINKED cameras, plus the device itself when it is a camera
+	* carrying the cap) and inserts ONE row per camera. Best-effort
+	* (telemetry-lossy).
+	*
+	* D8/D11 boundary, stated plainly: the ride here is the LOSSY
+	* `DeviceStateChanged` bus, and there is no reconcile that replays a missed
+	* press from the durable `doorbell.getStatus.lastPressedAt`. A dropped bus
+	* event is a missing history row and a missing notification — never wrong
+	* durable state.
 	*/
 	async handleSensorStateChanged(data, timestamp) {
 		const store = this.sensorEventStore;
@@ -29031,7 +30025,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			await ingestSensorStateChange({
 				sink: store,
 				cache,
-				onPersisted: (ev) => this.notificationCenter?.onSensorEventPersisted(ev)
+				onPersisted: (ev) => this.notificationCenter?.onSensorEventPersisted(ev),
+				onDropped: (reason, kind) => this.logSensorIngestDrop(data, reason, kind)
 			}, data, timestamp);
 		} catch (err) {
 			this.ctx.logger.warn("sensor-event ingest failed", {
@@ -29047,7 +30042,16 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		if (materializer === null || descriptor === void 0) return;
 		try {
 			const cameraIds = await cache.camerasFor(data.deviceId);
-			if (cameraIds.length === 0) return;
+			if (cameraIds.length === 0) {
+				this.ctx.logger.debug("sensor synthetic-track projection skipped — no linked camera", {
+					tags: { deviceId: data.deviceId },
+					meta: {
+						capName: data.capName,
+						kind: descriptor.kind
+					}
+				});
+				return;
+			}
 			const producingDeviceName = await this.resolveProducingDeviceName(data.deviceId);
 			for (const cameraId of cameraIds) await materializer.materialize({
 				cameraId,
@@ -29068,6 +30072,35 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		}
 	}
 	/**
+	* Say out loud that a MAPPED sensor cap ingested nothing, and why.
+	*
+	* BOTH branches are `debug`, deliberately. After the self-camera fix neither
+	* is a surprise any more — they are the two designed steady states, and both
+	* ride at bus rate:
+	*
+	*  - `camera-native-cap` is EVERY camera's `motion` slice. Every provider
+	*    binds a native `motion` cap on the camera device and motion churns
+	*    continuously (camera 590 flaps at ~2 Hz), so an `info` here would be a
+	*    log flood measured in millions of lines a day — its own outage.
+	*  - `no-camera` is every sensor in the fleet that no camera links.
+	*
+	* What must never happen again is the branch being INVISIBLE: a doorbell
+	* press that ingested nothing produced not one line for months. A debug line
+	* carrying `deviceId`, `capName`, `kind` and `reason` answers "why is 615
+	* dark" the moment anyone asks it.
+	*/
+	logSensorIngestDrop(data, reason, kind) {
+		const message = reason === "camera-native-cap" ? "sensor-event ingest produced NO row — the camera already emits this cap through its own path" : "sensor-event ingest produced NO row — the device is not a camera and is linked to none";
+		this.ctx.logger.debug(message, {
+			tags: { deviceId: data.deviceId },
+			meta: {
+				capName: data.capName,
+				kind,
+				reason
+			}
+		});
+	}
+	/**
 	* Resolve the NAME of a device (the linked sensor/control that produced a
 	* synthetic event) via the device-manager cap. Best-effort — returns
 	* undefined on any lookup failure or an unknown device so the synthetic
@@ -29784,15 +30817,22 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	}
 	/**
 	* Set the per-track operator flags (`markForTrain`, `debug`). Partial patch —
-	* see `applyTrackFlags`. The flags carry no behaviour yet; this is the write
-	* surface the three UI toggles share.
+	* see `applyTrackFlags`. `markForTrain` moves the retrain LIFECYCLE
+	* (`none ↔ staging`, D81), and `staging` is what PINS the track against the
+	* retention sweep — which is why the body enforces a per-device staging budget
+	* and refuses any move on an already-`trained` track. `debug` is attention
+	* only. This is the write surface the three UI toggles share.
 	*/
 	async setTrackFlags(input) {
 		const trackStore = this.trackStore;
 		if (!trackStore) throw new Error("setTrackFlags: track store unavailable");
 		const out = await applyTrackFlags({
-			readFlags: (trackId) => trackStore.readFlags(trackId),
-			setFlags: (trackId, patch) => trackStore.setFlags(trackId, patch)
+			store: {
+				readFlags: (trackId) => trackStore.readFlags(trackId),
+				setFlags: (trackId, patch) => trackStore.setFlags(trackId, patch),
+				countStaging: (query) => trackStore.countStaging(query)
+			},
+			logger: this.ctx.logger
 		}, input);
 		this.ctx.logger.info("track operator flags set", {
 			tags: { deviceId: input.deviceId },
@@ -29800,6 +30840,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				deviceId: input.deviceId,
 				trackId: input.trackId,
 				markForTrain: out.markForTrain,
+				retrainStatus: out.retrainStatus,
 				debug: out.debug
 			}
 		});
@@ -29923,6 +30964,19 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						deviceId,
 						cutoffMs
 					});
+					const staging = await this.trackStore?.countStaging({
+						deviceId,
+						olderThanMs: cutoffMs
+					});
+					if (staging !== void 0 && staging > 0) this.ctx.logger.info("track retention held staging tracks (retrainStatus)", {
+						tags: { deviceId },
+						meta: {
+							deviceId,
+							staging,
+							cutoffMs,
+							deleted: counts.tracks
+						}
+					});
 					if (counts.tracks > 0) this.eventsOpsLog?.append({
 						op: "prune",
 						reason: "retention",