@camstack/addon-post-analysis 1.2.49 → 1.2.50

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as object, B as errMsg, C as buildEventKindDescriptor, E as defineCustomActions, F as readDeviceStateFrom, G as isDeviceScopedCap, H as DeviceType, I as subKindsOf, J as _enum, K as nodePin, L as vectorDimFromBase64, M as notificationRulesCapability, N as pipelineAnalyticsCapability, O as encodeVectorBase64, P as plateGalleryCapability, Q as number, R as videoclipsCapability, S as audioMetricsCapability, T as customAction, U as createEvent, V as BaseAddon, W as hydrateSchema, X as boolean, Y as array, Z as literal, _ as TimelapseRuleInputSchema, a as MACRO_LABELS, b as addonWidgetsSourceCapability, c as NcConditionDescriptorSchema, d as NcRuleSchema, et as record, f as NcSnoozeInputSchema, g as OpsLogEntrySchema, h as NcTaxonomySchema, i as EVENT_PAD_MS, j as kebabToCamel, k as faceGalleryCapability, l as NcRuleInputSchema, m as NcSnoozeSuppressedSchema, n as DEFAULT_EVENT_COLOR, nt as unknown, o as NC_CONDITION_CATALOG, p as NcSnoozeSchema, q as sleep, r as EVENT_KIND_BY_CAP, rt as EventCategory, s as NC_TAXONOMY, t as BaseDevice, tt as string, u as NcRulePatchSchema, v as TimelapseRuleSchema, w as cosineSimilarity, x as alarmPanelCapability, y as TrackSourceSchema, z as zoneAnalyticsCapability } from "../dist-DYOxxL_e.mjs";
+import { $ as literal, A as faceGalleryCapability, B as videoclipsCapability, C as audioMetricsCapability, D as defineCustomActions, E as customAction, F as pipelineAnalyticsCapability, G as createEvent, H as errMsg, I as plateGalleryCapability, J as nodePin, K as hydrateSchema, L as readDeviceStateFrom, M as isScheduleActive, N as kebabToCamel, P as notificationRulesCapability, Q as boolean, R as subKindsOf, S as alarmPanelCapability, T as cosineSimilarity, U as BaseAddon, V as zoneAnalyticsCapability, W as DeviceType, X as _enum, Y as sleep, Z as array, _ as RetrainStatusSchema, a as MACRO_LABELS, at as EventCategory, b as TrackSourceSchema, c as NcConditionDescriptorSchema, d as NcRuleSchema, et as number, f as NcSnoozeInputSchema, g as OpsLogEntrySchema, h as NcTaxonomySchema, i as EVENT_PAD_MS, it as unknown, k as encodeVectorBase64, l as NcRuleInputSchema, m as NcSnoozeSuppressedSchema, n as DEFAULT_EVENT_COLOR, nt as record, o as NC_CONDITION_CATALOG, p as NcSnoozeSchema, q as isDeviceScopedCap, r as EVENT_KIND_BY_CAP, rt as string, s as NC_TAXONOMY, t as BaseDevice, tt as object, u as NcRulePatchSchema, v as TimelapseRuleInputSchema, w as buildEventKindDescriptor, x as addonWidgetsSourceCapability, y as TimelapseRuleSchema, z as vectorDimFromBase64 } from "../dist-BhadCxSQ.mjs";
 import { promises } from "node:fs";
 import path from "node:path";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1583,66 +1583,6 @@ function evaluateRule(rule, subject, deviceState) {
 		matchedOn: presentConditionIds(c)
 	};
 }
-var WEEKDAY_TO_DAY = {
-	Sun: 0,
-	Mon: 1,
-	Tue: 2,
-	Wed: 3,
-	Thu: 4,
-	Fri: 5,
-	Sat: 6
-};
-/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
-*  An invalid/unknown IANA name falls back to the host timezone. */
-function localDayMinute(atMs, timezone) {
-	const d = new Date(atMs);
-	if (timezone !== void 0) try {
-		const parts = new Intl.DateTimeFormat("en-US", {
-			timeZone: timezone,
-			weekday: "short",
-			hour: "numeric",
-			minute: "numeric",
-			hourCycle: "h23"
-		}).formatToParts(d);
-		let weekday;
-		let hour;
-		let minute;
-		for (const p of parts) if (p.type === "weekday") weekday = p.value;
-		else if (p.type === "hour") hour = Number(p.value);
-		else if (p.type === "minute") minute = Number(p.value);
-		const day = weekday !== void 0 ? WEEKDAY_TO_DAY[weekday] : void 0;
-		if (day !== void 0 && hour !== void 0 && minute !== void 0) return {
-			day,
-			minute: hour * 60 + minute
-		};
-	} catch {}
-	return {
-		day: d.getDay(),
-		minute: d.getHours() * 60 + d.getMinutes()
-	};
-}
-/**
-* Is the schedule active at `atMs`? No schedule = always active. Windows
-* are OR'd; a window with `startMinute > endMinute` crosses midnight (it
-* starts on a listed day and spills into the next). `invert` flips the
-* result (active OUTSIDE the windows).
-*/
-function isScheduleActive(schedule, atMs) {
-	if (schedule === void 0) return true;
-	const { day, minute } = localDayMinute(atMs, schedule.timezone);
-	const prevDay = (day + 6) % 7;
-	let inside = false;
-	for (const w of schedule.windows) if (w.startMinute <= w.endMinute) {
-		if (w.days.includes(day) && minute >= w.startMinute && minute < w.endMinute) {
-			inside = true;
-			break;
-		}
-	} else if (w.days.includes(day) && minute >= w.startMinute || w.days.includes(prevDay) && minute < w.endMinute) {
-		inside = true;
-		break;
-	}
-	return schedule.invert === true ? !inside : inside;
-}
 /** Normalize a plate string: uppercase, alphanumeric only. */
 function normalizePlate$1(value) {
 	return value.toUpperCase().replace(/[^A-Z0-9]/g, "");
@@ -13509,6 +13449,27 @@ var StoragePressureTracker = class {
 };
 //#endregion
 //#region src/pipeline-analytics/store/media-store.ts
+var OWNER_KINDS = [
+	"event",
+	"track",
+	"face",
+	"identity",
+	"plate",
+	"vehicle"
+];
+/**
+* Narrow an arbitrary string to an `OwnerKind`.
+*
+* Exists so a caller that builds owner scopes from data (the training-export
+* plan walks `track` / `face` / `plate` / `event` as strings) can reach the
+* store without a cast. The list is derived from `OWNER_KINDS`, so a new owner
+* kind is admitted here the moment it is declared there — a hand-written value
+* list would silently reject it, which is the failure `TrackSourceSchema` was
+* already bitten by on the track row.
+*/
+function isMediaOwnerKind(value) {
+	return OWNER_KINDS.some((kind) => kind === value);
+}
 var MEDIA_COLLECTION = "pipeline-analytics:media";
 /** Owner-id prefix for a track's buffered FACE crop. Invariant established by
 *  the face recognizer (`face-recognizer.ts`): `faceId === 'face-' + trackId`
@@ -14732,6 +14693,7 @@ async function rankKeyEvents(candidates, options, peakLookup) {
 			bestEventId: bestEventId ?? t.trackId,
 			windowMs: t.lastSeen - t.firstSeen,
 			...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
+			...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 			...t.debug !== void 0 ? { debug: t.debug } : {}
 		});
 	}
@@ -15967,8 +15929,35 @@ function classifyTrackAppearance(input) {
 	if (input.inPrevActive) return "continuing";
 	return input.positionsCount > 1 ? "resurrection" : "birth";
 }
-//#endregion
-//#region src/pipeline-analytics/pipeline/track-flags.ts
+/** Thrown when the device is already holding its full staging budget. Distinct
+*  type so a surface can tell "you are out of room" from "that track is gone". */
+var StagingBudgetExceededError = class extends Error {
+	deviceId;
+	staging;
+	constructor(deviceId, staging) {
+		super(`setTrackFlags: device ${deviceId} already has ${staging} tracks in retrain staging (limit 500). Un-mark some tracks before marking more.`);
+		this.deviceId = deviceId;
+		this.staging = staging;
+		this.name = "StagingBudgetExceededError";
+	}
+};
+/**
+* Thrown when a `markForTrain` write — in EITHER direction — targets a track
+* that has already been trained.
+*
+* Its own error type, next to the budget's, because the two refusals need
+* different sentences on the surface: one says "make room", the other says "this
+* track is already in the dataset". Collapsing them into a generic failure is
+* how a toggle ends up flipping back with nothing to explain it.
+*/
+var TrackAlreadyTrainedError = class extends Error {
+	trackId;
+	constructor(trackId) {
+		super(`setTrackFlags: track ${trackId} is already trained — its frames are copies in the retrain dataset. Re-staging it is an action of the retrain page, not this toggle.`);
+		this.trackId = trackId;
+		this.name = "TrackAlreadyTrainedError";
+	}
+};
 /**
 * Apply a partial flag patch and report the RESOLVED state of both flags.
 *
@@ -15981,19 +15970,63 @@ function classifyTrackAppearance(input) {
 * An empty patch is a pure read, not an error: the three calling surfaces build
 * the patch from their own toggle, and "nothing changed" is a legitimate outcome
 * that must not surface as a failure.
-*/
-async function applyTrackFlags(store, input) {
+*
+* **`trained` is TERMINAL for this toggle, in both directions.** A trained
+* track's chosen frames are already copies inside the retrain dataset; staging
+* it again from a generic checkbox is how the same material gets annotated twice
+* under two different ground truths, and un-marking it would claim to undo a
+* training pass it cannot undo. The deliberate return to staging belongs to the
+* retrain page, which is also the only thing that produces `trained`. A `debug`
+* patch on a trained track is untouched by this — `debug` is not the lifecycle.
+*
+* **The budget is checked only when STAGING is being entered.** Un-marking is
+* always allowed and so is a `debug` patch — a limit that blocked the way OUT of
+* the limit would be a trap, and a device at its ceiling would become unable to
+* release the very storage the ceiling exists to protect. Re-marking a track
+* that is already staging is not a new hold either, so it does not consume
+* budget and cannot be refused by it.
+*/
+async function applyTrackFlags(deps, input) {
+	const { store, logger } = deps;
 	const current = await store.readFlags(input.trackId);
 	if (current === null) throw new Error(`setTrackFlags: unknown track ${input.trackId}`);
+	if (input.flags.markForTrain !== void 0 && current.retrainStatus === "trained") {
+		logger.warn("setTrackFlags refused — track already trained", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				deviceId: input.deviceId,
+				trackId: input.trackId,
+				requested: input.flags.markForTrain
+			}
+		});
+		throw new TrackAlreadyTrainedError(input.trackId);
+	}
+	if (input.flags.markForTrain === true && current.retrainStatus !== "staging") {
+		const staging = await store.countStaging({ deviceId: input.deviceId });
+		if (staging >= 500) {
+			logger.warn("setTrackFlags refused — device staging budget full", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					deviceId: input.deviceId,
+					trackId: input.trackId,
+					staging,
+					limit: 500
+				}
+			});
+			throw new StagingBudgetExceededError(input.deviceId, staging);
+		}
+	}
 	const patch = {
 		...input.flags.markForTrain !== void 0 ? { markForTrain: input.flags.markForTrain } : {},
 		...input.flags.debug !== void 0 ? { debug: input.flags.debug } : {}
 	};
 	if (Object.keys(patch).length > 0) await store.setFlags(input.trackId, patch);
+	const retrainStatus = patch.markForTrain === void 0 ? current.retrainStatus : patch.markForTrain ? "staging" : "none";
 	return {
 		trackId: input.trackId,
-		markForTrain: patch.markForTrain ?? current.markForTrain,
-		debug: patch.debug ?? current.debug
+		markForTrain: retrainStatus === "staging",
+		debug: patch.debug ?? current.debug,
+		retrainStatus
 	};
 }
 //#endregion
@@ -18884,8 +18917,10 @@ var TRACKS_COLUMNS = [
 		type: "JSON"
 	},
 	{
-		name: "markForTrain",
-		type: "BOOLEAN"
+		name: "retrainStatus",
+		type: "TEXT",
+		notNull: true,
+		defaultValue: "none"
 	},
 	{
 		name: "debug",
@@ -18962,7 +18997,10 @@ function cloneTrack(t) {
 		...t.bestEventId !== void 0 ? { bestEventId: t.bestEventId } : {},
 		...t.importanceReason !== void 0 ? { importanceReason: t.importanceReason } : {},
 		...t.audioLabels !== void 0 && t.audioLabels.size > 0 ? { audioLabels: audioLabelsToArray(t.audioLabels) } : {},
-		...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
+		...t.retrainStatus !== void 0 ? {
+			retrainStatus: t.retrainStatus,
+			markForTrain: t.retrainStatus === "staging"
+		} : {},
 		...t.debug !== void 0 ? { debug: t.debug } : {}
 	};
 }
@@ -19244,24 +19282,30 @@ var TrackStore = class {
 		}
 	}
 	/**
-	* Apply a PARTIAL patch of the per-track operator flags (`markForTrain`,
+	* Apply a PARTIAL patch of the per-track operator state (`markForTrain`,
 	* `debug`). Mirrors `setLabel`'s dual write — in-RAM active entry AND the
-	* persisted row — so a flag set on a LIVE track is carried into
+	* persisted row — so a mark set on a LIVE track is carried into
 	* `persistCompleted` at expiry instead of evaporating with the RAM state.
 	*
+	* `markForTrain` is a LIFECYCLE move, not a boolean write: `true` is
+	* `→ staging`, `false` is `→ none`. This method does not police the move —
+	* the `trained` refusal lives in `applyTrackFlags`, the single cap-level write
+	* surface, which is the only caller that has already read the current state.
+	*
 	* An omitted key is left untouched; `false` is WRITTEN, not dropped, so an
-	* explicitly un-flagged track stays distinguishable from one never touched.
+	* explicitly un-marked track stays distinguishable from one never touched.
 	* An empty patch is a no-op (an update with no columns is not a useful
 	* statement, and the store would reject or silently ignore it).
 	*/
 	async setFlags(trackId, patch) {
 		const data = {};
-		if (patch.markForTrain !== void 0) data["markForTrain"] = patch.markForTrain;
+		const nextStatus = patch.markForTrain === void 0 ? void 0 : patch.markForTrain ? "staging" : "none";
+		if (nextStatus !== void 0) data["retrainStatus"] = nextStatus;
 		if (patch.debug !== void 0) data["debug"] = patch.debug;
 		if (Object.keys(data).length === 0) return;
 		const active = this.active.get(trackId);
 		if (active) {
-			if (patch.markForTrain !== void 0) active.markForTrain = patch.markForTrain;
+			if (nextStatus !== void 0) active.retrainStatus = nextStatus;
 			if (patch.debug !== void 0) active.debug = patch.debug;
 		}
 		try {
@@ -19278,20 +19322,25 @@ var TrackStore = class {
 		}
 	}
 	/**
-	* Resolved flag state for a track — active entry first, then the persisted
-	* row. Absent collapses to `false`, which is what the cap returns to a caller
-	* driving a toggle. `null` when the track is unknown to both.
+	* Resolved operator state for a track — active entry first, then the
+	* persisted row. `null` when the track is unknown to both.
+	*
+	* Reports the LIFECYCLE STATUS, not the derived boolean, because the one
+	* caller that matters decides on it: `applyTrackFlags` must tell `trained`
+	* (refuse the write) from `none` (accept it), and both report
+	* `markForTrain: false`. Absent collapses to `'none'` / `false` — the
+	* "never touched" tri-state exists only in RAM and carries no decision.
 	*/
 	async readFlags(trackId) {
 		const active = this.active.get(trackId);
 		if (active) return {
-			markForTrain: active.markForTrain === true,
+			retrainStatus: active.retrainStatus ?? "none",
 			debug: active.debug === true
 		};
 		const persisted = await this.getPersistedByTrackId(trackId);
 		if (!persisted) return null;
 		return {
-			markForTrain: persisted.markForTrain === true,
+			retrainStatus: persisted.retrainStatus ?? "none",
 			debug: persisted.debug === true
 		};
 	}
@@ -19356,10 +19405,11 @@ var TrackStore = class {
 	* `offset` by the number of rows a page did NOT remove, which terminates
 	* because the offset only grows and the result set is finite.
 	*
-	* This is the seam a retention PIN needs. Pinning is now one exemption on one
-	* query — this one — instead of four exemptions across four sweeps, and the
-	* drain no longer breaks when it meets a row it must skip. The pin itself is
-	* deliberately NOT implemented here (D61).
+	* This is the seam the retention PIN lands on, and it lands here ONLY: after
+	* D61 the track row is the single cascading root, so one exemption on this one
+	* query holds the track's events, crops, keyframes and CLIP vector with it —
+	* where D59 had to plan for four exemptions across four disagreeing sweeps.
+	* The pin is `whereIn: { retrainStatus: ['none','trained'] }` below (D81).
 	*
 	* Filter shape mirrors `EventStore.pruneBefore`: inclusive `[0, cutoffMs - 1]`
 	* → strictly `< cutoffMs`. Best-effort — a query failure yields [].
@@ -19370,6 +19420,7 @@ var TrackStore = class {
 				collection: TRACKS_COLLECTION,
 				filter: {
 					where: { deviceId },
+					whereIn: { retrainStatus: ["none", "trained"] },
 					whereBetween: { lastSeen: [0, cutoffMs - 1] },
 					orderBy: {
 						field: "lastSeen",
@@ -19393,6 +19444,87 @@ var TrackStore = class {
 		}
 	}
 	/**
+	* The device's STAGING tracks, newest first — the training-export selection.
+	*
+	* `retrainStatus = 'staging'` is exactly the complement of the sweep's
+	* `whereIn ['none','trained']` (all three safe against NULL because the column
+	* is NOT NULL DEFAULT 'none') — the load-bearing part: this is the set
+	* retention has promised to still be there. `trained` is deliberately NOT in
+	* it: the sweep is free to delete a trained track mid-pass, and exporting one
+	* is how a manifest ends up describing files the archive does not contain.
+	*
+	* `projection: 'slim'` because an export enumerates media; it has no use for
+	* the per-frame trajectory JSON, which is the heaviest column on the row.
+	*/
+	async listStaging(deviceId, limit) {
+		try {
+			return (await this.store.query.query({
+				collection: TRACKS_COLLECTION,
+				filter: {
+					where: {
+						deviceId,
+						retrainStatus: "staging"
+					},
+					orderBy: {
+						field: "lastSeen",
+						direction: "desc"
+					},
+					limit
+				}
+			})).filter((r) => typeof r.id === "string").map((r) => this.rowToTrack(r.id, r.data, "slim"));
+		} catch (err) {
+			this.logger.warn("TrackStore.listStaging failed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					limit,
+					error: String(err)
+				}
+			});
+			return [];
+		}
+	}
+	/**
+	* How many of this device's tracks are STAGING — optionally only those older
+	* than a cutoff, i.e. exactly the rows a sweep just declined to touch.
+	*
+	* Two callers, one query. The sweep uses `olderThanMs` for its report; the
+	* `setTrackFlags` body uses the unbounded form to enforce the per-device
+	* staging budget, because staging is unbounded in TIME by construction and
+	* something has to bound it in COUNT (D81, and D59 asked for exactly this).
+	* `trained` tracks are NOT counted — they are evictable again, so they cost
+	* the budget nothing.
+	*
+	* Best-effort — a failure reports 0 rather than disturbing the caller. The
+	* budget check reads that as "there is room", which is the safe direction: a
+	* failed count must not stop an operator marking a track.
+	*/
+	async countStaging(query) {
+		const { deviceId, olderThanMs } = query;
+		try {
+			return await this.store.count.query({
+				collection: TRACKS_COLLECTION,
+				filter: {
+					where: {
+						deviceId,
+						retrainStatus: "staging"
+					},
+					...olderThanMs !== void 0 ? { whereBetween: { lastSeen: [0, olderThanMs - 1] } } : {}
+				}
+			});
+		} catch (err) {
+			this.logger.warn("TrackStore.countStaging failed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					olderThanMs,
+					error: String(err)
+				}
+			});
+			return 0;
+		}
+	}
+	/**
 	* The SUBSET of `trackIds` that still have a persisted row — the orphan
 	* audit's liveness probe.
 	*
@@ -19732,7 +19864,7 @@ var TrackStore = class {
 				...t.bestEventId !== void 0 ? { bestEventId: t.bestEventId } : {},
 				...t.importanceReason !== void 0 ? { importanceReason: t.importanceReason } : {},
 				...t.audioLabels !== void 0 ? { audioLabels: [...t.audioLabels] } : {},
-				...t.markForTrain !== void 0 ? { markForTrain: t.markForTrain } : {},
+				...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 				...t.debug !== void 0 ? { debug: t.debug } : {},
 				...envelope !== null && dims !== void 0 ? {
 					envMinX: envelope.minX,
@@ -19766,7 +19898,7 @@ var TrackStore = class {
 		const bestEventId = data["bestEventId"];
 		const importanceReason = data["importanceReason"];
 		const audioLabels = data["audioLabels"];
-		const markForTrain = data["markForTrain"];
+		const retrainParsed = RetrainStatusSchema.safeParse(data["retrainStatus"]);
 		const debug = data["debug"];
 		const envMinX = data["envMinX"];
 		const envMinY = data["envMinY"];
@@ -19798,7 +19930,10 @@ var TrackStore = class {
 			...typeof bestEventId === "string" ? { bestEventId } : {},
 			...typeof importanceReason === "string" ? { importanceReason } : {},
 			...Array.isArray(audioLabels) && audioLabels.length > 0 ? { audioLabels } : {},
-			...typeof markForTrain === "boolean" ? { markForTrain } : {},
+			...retrainParsed.success ? {
+				retrainStatus: retrainParsed.data,
+				markForTrain: retrainParsed.data === "staging"
+			} : {},
 			...typeof debug === "boolean" ? { debug } : {},
 			...envelope !== null ? { envelope } : {}
 		};
@@ -21677,120 +21812,415 @@ function wireSubscriptions(deps) {
 	}));
 	return unsubs;
 }
-//#endregion
-//#region src/pipeline-analytics/services/event-kinds.ts
 /**
-* Extensible per-device event kinds (Part B).
-*
-* `composeEventKinds` builds the `listEventKinds` payload for a camera:
-*   (a) built-ins — motion + audio, always present;
-*   (b) detection classes actually OBSERVED on the device (track history);
-*   (c) sensor kinds contributed by the camera's OWN bindings and by its
-*       LINKED devices (device-manager `getLinkedDevices`), one descriptor per
-*       bound sensor cap present in the static `EVENT_KIND_BY_CAP` map.
-*       Binding-driven per device (`getBindings`) — never a global cap
-*       enumeration (D12).
-*
-* `LinkedCamerasCache` is the ingest-side reverse index (sensor device →
-* linked camera ids, plus the camera id set) with a TTL, so the
-* `DeviceStateChanged` handler stays cheap at bus rate.
+* A baseline whose last sample is older than `baselineMs × this` no longer
+* describes the camera — an on-motion camera detaches for hours and comes
+* back to a different scene. Decaying it forward would make the first frame
+* back either a guaranteed marker (mean still holds the old quiet) or a
+* guaranteed miss; discarding it is the honest option and costs one warm-up.
 */
+var STALE_BASELINE_FACTOR = 5;
 /**
-* Mapped sensor/control caps that a CAMERA must NOT contribute for ITSELF.
-*
-* A sensor cap bound on a camera makes the camera both the source and the
-* subject — a doorbell wrapper on camera 615, a native Reolink doorbell, a
-* camera-side button. Those have no other route into the per-camera event
-* substrate, so the camera includes itself.
-*
-* `motion` is the exception, and today the ONLY one: camera motion already
-* has a dedicated camera-native path (`MotionAnalysis` /
-* `MotionOnMotionChanged` → `MotionEvent` rows under the built-in `motion`
-* taxonomy lane). Every real camera provider registers a native `motion` cap
-* on the camera device, so self-inclusion would mint a SECOND, differently
-* named copy (`motion-sensor`) of every motion transition, at motion rate.
-*
-* Add a cap here only when the camera already emits that event through
-* another ingest path — never to reduce noise.
+* Floor on the MAD used as the deviation unit, in dB. A perfectly flat signal
+* has MAD 0 and would make every deviation infinite. 1 dB is below the
+* quantisation of any real level meter, so it only ever binds on a synthetic
+* or a genuinely dead-steady signal — where bar 2 is what should decide.
 */
-var SELF_CAMERA_EXCLUDED_CAPS = new Set(["motion"]);
-/** True when a camera may contribute `capName` for itself. */
-function selfCameraMayEmit(capName) {
-	return !SELF_CAMERA_EXCLUDED_CAPS.has(capName);
+var MIN_MAD_DB = 1;
+function emptyAudioBaseline() {
+	return {
+		count: 0,
+		mean: 0,
+		mad: 0,
+		firstMs: 0,
+		lastMs: 0
+	};
+}
+/** Seed a fresh baseline from one sample (first ever, or after a stale gap). */
+function seed(sample) {
+	return {
+		count: 1,
+		mean: sample.dbfs,
+		mad: 0,
+		firstMs: sample.timestampMs,
+		lastMs: sample.timestampMs
+	};
 }
 /**
-* Full event-kind taxonomy a camera CAN emit (config-derived):
-*   (a) motion built-in — always;
-*   (b) each enabled detection macro + its taxonomy subs (reverse COCO);
-*   (c) audio macro + its subs when the classifier is enabled;
-*   (d) package kinds when a package zone rule is enabled;
-*   (e) sensor/control kinds from the CAMERA'S OWN bindings and from its
-*       LINKED devices (binding-driven), deduped per (kind, source deviceId).
-* Every descriptor carries parentKind/level/iconId/labelKey via the single
-* taxonomy dictionary — no color/icon is declared here.
-*/
-/**
-* Run one lookup, reporting a failure instead of propagating it.
+* Fold `sample` into `state` and decide whether it is a marker candidate.
 *
-* `undefined` means "this one did not answer" — the caller degrades that part
-* of the taxonomy and keeps the rest. That is the pre-existing contract (each
-* section had its own try/catch); it is factored out here only because the
-* sections now run concurrently, and a rejected promise nobody has awaited yet
-* is an unhandled rejection.
+* The verdict is measured against the PRIOR baseline (this frame excluded) so
+* a lone spike is not diluted by itself — the same reasoning
+* `audio-level-detector` uses for its `priorMean`. The state returned always
+* includes the sample, whatever the verdict.
 */
-async function attempt(deps, scope, run) {
-	try {
-		return await run();
-	} catch (err) {
-		deps.onError?.(scope, err);
-		return;
-	}
-}
-async function composeEventKinds(deps, deviceId) {
-	const out = [];
-	const cameraSource = {
-		capName: "pipeline-analytics",
-		deviceId
+function observeAudioAnomaly(state, sample, cfg) {
+	const isFirst = state.count === 0;
+	const gapMs = sample.timestampMs - state.lastMs;
+	const isStale = !isFirst && gapMs > cfg.baselineMs * STALE_BASELINE_FACTOR;
+	if (isFirst || isStale) return {
+		verdict: { kind: "warmup" },
+		nextState: seed(sample)
 	};
-	const pushKind = (kind, source = cameraSource) => {
-		const d = buildEventKindDescriptor(kind, source);
-		if (d !== null) out.push(d);
+	const alpha = 1 - Math.exp(-Math.max(0, gapMs) / cfg.baselineMs);
+	const priorMean = state.mean;
+	const priorMad = state.mad;
+	const nextState = {
+		count: state.count + 1,
+		mean: priorMean + alpha * (sample.dbfs - priorMean),
+		mad: priorMad + alpha * (Math.abs(sample.dbfs - priorMean) - priorMad),
+		firstMs: state.firstMs,
+		lastMs: sample.timestampMs
 	};
-	const macrosP = attempt(deps, "enabledMacroClasses", () => deps.enabledMacroClasses(deviceId));
-	const audioP = attempt(deps, "audioEnabled", () => deps.audioEnabled(deviceId));
-	const packageP = attempt(deps, "packageZonesEnabled", async () => deps.packageZonesEnabled ? deps.packageZonesEnabled(deviceId) : false);
-	const linkedP = attempt(deps, "getLinkedDevices", () => deps.linkedDevices.getLinkedDevices({ deviceId }));
-	const selfBindingsP = attempt(deps, "getBindings", () => deps.bindings.getBindings({ deviceId }));
-	pushKind("motion");
-	for (const macro of await macrosP ?? []) {
-		pushKind(macro);
-		for (const sub of subKindsOf(macro)) pushKind(sub.kind);
-	}
-	if (await audioP === true) {
-		pushKind("audio");
-		for (const sub of subKindsOf("audio")) pushKind(sub.kind);
-	}
-	if (await packageP === true) {
-		pushKind("package");
-		for (const sub of subKindsOf("package")) pushKind(sub.kind);
-	}
-	const devices = (await linkedP)?.devices ?? [];
-	const bindingsPerDevice = await Promise.all(devices.map((linked) => attempt(deps, "getBindings", () => deps.bindings.getBindings({ deviceId: linked.deviceId }))));
-	const seen = /* @__PURE__ */ new Set();
-	const pushSensorKinds = (sourceDeviceId, entries, isSelf) => {
-		if (entries === void 0) return;
-		for (const { capName } of entries) {
-			if (isSelf && !selfCameraMayEmit(capName)) continue;
-			const descriptor = EVENT_KIND_BY_CAP[capName];
-			if (descriptor === void 0) continue;
-			const dedupeKey = `${descriptor.kind}:${sourceDeviceId}`;
-			if (seen.has(dedupeKey)) continue;
-			seen.add(dedupeKey);
-			pushKind(descriptor.kind, {
-				capName,
-				deviceId: sourceDeviceId
-			});
-		}
+	if (sample.dbfs <= cfg.silenceFloorDbfs) return {
+		verdict: { kind: "silent" },
+		nextState
+	};
+	if (!(nextState.count >= 30 && sample.timestampMs - state.firstMs >= cfg.baselineMs)) return {
+		verdict: { kind: "warmup" },
+		nextState
+	};
+	if (sample.dbfs < cfg.minDbfs) return {
+		verdict: {
+			kind: "not-loud",
+			dbfs: sample.dbfs
+		},
+		nextState
+	};
+	const deviationDb = sample.dbfs - priorMean;
+	const deviations = deviationDb / Math.max(priorMad, MIN_MAD_DB);
+	const measured = {
+		dbfs: sample.dbfs,
+		mean: priorMean,
+		deviationDb,
+		deviations
+	};
+	return {
+		verdict: deviationDb >= cfg.minDeviationDb && deviations >= cfg.minDeviations ? {
+			kind: "anomalous",
+			...measured
+		} : {
+			kind: "not-anomalous",
+			...measured
+		},
+		nextState
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/services/audio-marker-projector.ts
+/** One info line per camera per minute, and only when something qualified. */
+var METRICS_WINDOW_MS = 6e4;
+var HOUR_MS = 60 * 6e4;
+var DAY_MS = 24 * HOUR_MS;
+function emptyCounters(atMs) {
+	return {
+		windowStartMs: atMs,
+		enabled: false,
+		observed: 0,
+		notLoud: 0,
+		notAnomalous: 0,
+		candidates: 0,
+		suppressedMotion: 0,
+		suppressedCooldown: 0,
+		suppressedHourly: 0,
+		suppressedDaily: 0,
+		suppressedInFlight: 0,
+		wouldFire: 0,
+		materialized: 0,
+		materializeFailed: 0
+	};
+}
+var AudioMarkerProjector = class {
+	deps;
+	baselines = /* @__PURE__ */ new Map();
+	rates = /* @__PURE__ */ new Map();
+	counters = /* @__PURE__ */ new Map();
+	inFlight = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Feed ONE audio frame. Synchronous by construction: at ~30 Hz per camera
+	* the common path must not allocate a promise, so the decision is taken
+	* inline and only an actual marker goes async (fire-and-forget, bounded by
+	* the in-flight guard and the rate ceilings).
+	*
+	* Call this BEFORE the classification/level route split so the baseline
+	* sees every frame. A baseline fed only by the level route is blind to
+	* exactly the loud, confidently-classified frames a marker is for.
+	*/
+	observe(input, cfg) {
+		const { deviceId, timestampMs } = input;
+		const counters = this.countersFor(deviceId, timestampMs);
+		counters.observed += 1;
+		counters.enabled = cfg.enabled;
+		const res = observeAudioAnomaly(this.baselines.get(deviceId) ?? emptyAudioBaseline(), {
+			timestampMs,
+			dbfs: input.dbfs
+		}, cfg);
+		this.baselines.set(deviceId, res.nextState);
+		this.maybeFlush(deviceId, timestampMs);
+		switch (res.verdict.kind) {
+			case "silent":
+			case "warmup": return;
+			case "not-loud":
+				counters.notLoud += 1;
+				return;
+			case "not-anomalous":
+				counters.notAnomalous += 1;
+				return;
+			case "anomalous": break;
+		}
+		counters.candidates += 1;
+		if (this.deps.isMotionActive(deviceId, timestampMs, cfg.motionQuietMs)) {
+			counters.suppressedMotion += 1;
+			return;
+		}
+		const fired = this.rates.get(deviceId)?.firedAtMs ?? [];
+		const last = fired.length > 0 ? fired[fired.length - 1] : void 0;
+		if (last !== void 0 && timestampMs - last < cfg.cooldownMs) {
+			counters.suppressedCooldown += 1;
+			return;
+		}
+		const recent = fired.filter((t) => timestampMs - t < DAY_MS);
+		if (recent.filter((t) => timestampMs - t < HOUR_MS).length >= cfg.maxPerHour) {
+			counters.suppressedHourly += 1;
+			this.rates.set(deviceId, { firedAtMs: recent });
+			return;
+		}
+		if (recent.length >= cfg.maxPerDay) {
+			counters.suppressedDaily += 1;
+			this.rates.set(deviceId, { firedAtMs: recent });
+			return;
+		}
+		if (!cfg.enabled) {
+			counters.wouldFire += 1;
+			return;
+		}
+		if (this.inFlight.has(deviceId)) {
+			counters.suppressedInFlight += 1;
+			return;
+		}
+		this.rates.set(deviceId, { firedAtMs: [...recent, timestampMs] });
+		counters.materialized += 1;
+		this.inFlight.add(deviceId);
+		this.materialize(input, counters);
+	}
+	/**
+	* Emit and reset a camera's window if it has anything to say. Exposed so a
+	* shutdown (or a test) can force the tally out rather than losing it.
+	*/
+	flush(nowMs) {
+		for (const deviceId of this.counters.keys()) this.emitWindow(deviceId, nowMs, true);
+	}
+	/** Drop all per-camera state for a device (unbind / device removal). */
+	forgetDevice(deviceId) {
+		this.baselines.delete(deviceId);
+		this.rates.delete(deviceId);
+		this.counters.delete(deviceId);
+		this.inFlight.delete(deviceId);
+	}
+	async materialize(input, counters) {
+		const { deviceId, timestampMs } = input;
+		try {
+			const audioLabels = buildAudioLabels(input);
+			await this.deps.sink.materialize({
+				cameraId: deviceId,
+				sourceDeviceId: deviceId,
+				source: "audio",
+				kind: "audio",
+				timestamp: timestampMs,
+				...audioLabels !== void 0 ? { audioLabels } : {}
+			});
+		} catch (err) {
+			counters.materialized -= 1;
+			counters.materializeFailed += 1;
+			this.deps.onError?.("materializeAudioMarker", err);
+			this.deps.logger.warn("audio marker materialize failed", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		} finally {
+			this.inFlight.delete(deviceId);
+		}
+	}
+	countersFor(deviceId, atMs) {
+		const existing = this.counters.get(deviceId);
+		if (existing !== void 0) return existing;
+		const fresh = emptyCounters(atMs);
+		this.counters.set(deviceId, fresh);
+		return fresh;
+	}
+	maybeFlush(deviceId, nowMs) {
+		const c = this.counters.get(deviceId);
+		if (c === void 0 || nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
+		this.emitWindow(deviceId, nowMs, false);
+	}
+	/**
+	* One line per camera per window — but ONLY when a frame reached the
+	* candidate gate. A camera that heard nothing extraordinary has nothing to
+	* report, and a line per camera per minute forever would bury the ones that
+	* do. `force` still honours that: it flushes the window, it does not invent
+	* a reason to speak.
+	*/
+	emitWindow(deviceId, nowMs, force) {
+		const c = this.counters.get(deviceId);
+		if (c === void 0) return;
+		if (!force && nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
+		if (c.candidates > 0 || c.materializeFailed > 0) this.deps.logger.info("audio anomaly gate (window)", {
+			tags: { deviceId },
+			meta: {
+				enabled: c.enabled,
+				windowMs: nowMs - c.windowStartMs,
+				observed: c.observed,
+				notLoud: c.notLoud,
+				notAnomalous: c.notAnomalous,
+				candidates: c.candidates,
+				suppressedMotion: c.suppressedMotion,
+				suppressedCooldown: c.suppressedCooldown,
+				suppressedHourly: c.suppressedHourly,
+				suppressedDaily: c.suppressedDaily,
+				suppressedInFlight: c.suppressedInFlight,
+				wouldFire: c.wouldFire,
+				materialized: c.materialized,
+				materializeFailed: c.materializeFailed
+			}
+		});
+		this.counters.set(deviceId, emptyCounters(nowMs));
+	}
+};
+/**
+* The class heard on the anomalous frame, in the shape `Track.audioLabels`
+* already defines. Using that field is what lets a marker label itself
+* ("dog", "glass_breaking") without inventing an event-taxonomy sub-class —
+* the audio macro vocabulary collides with existing subs (`dog` is a COCO
+* animal, `siren` is a control), so a sub per audio class would put a barking
+* dog in the ANIMAL lane.
+*/
+function buildAudioLabels(input) {
+	if (input.className === void 0) return void 0;
+	return [{
+		label: input.className,
+		peakScore: input.score ?? 0,
+		count: 1,
+		firstAt: input.timestampMs,
+		lastAt: input.timestampMs
+	}];
+}
+//#endregion
+//#region src/pipeline-analytics/services/event-kinds.ts
+/**
+* Extensible per-device event kinds (Part B).
+*
+* `composeEventKinds` builds the `listEventKinds` payload for a camera:
+*   (a) built-ins — motion + audio, always present;
+*   (b) detection classes actually OBSERVED on the device (track history);
+*   (c) sensor kinds contributed by the camera's OWN bindings and by its
+*       LINKED devices (device-manager `getLinkedDevices`), one descriptor per
+*       bound sensor cap present in the static `EVENT_KIND_BY_CAP` map.
+*       Binding-driven per device (`getBindings`) — never a global cap
+*       enumeration (D12).
+*
+* `LinkedCamerasCache` is the ingest-side reverse index (sensor device →
+* linked camera ids, plus the camera id set) with a TTL, so the
+* `DeviceStateChanged` handler stays cheap at bus rate.
+*/
+/**
+* Mapped sensor/control caps that a CAMERA must NOT contribute for ITSELF.
+*
+* A sensor cap bound on a camera makes the camera both the source and the
+* subject — a doorbell wrapper on camera 615, a native Reolink doorbell, a
+* camera-side button. Those have no other route into the per-camera event
+* substrate, so the camera includes itself.
+*
+* `motion` is the exception, and today the ONLY one: camera motion already
+* has a dedicated camera-native path (`MotionAnalysis` /
+* `MotionOnMotionChanged` → `MotionEvent` rows under the built-in `motion`
+* taxonomy lane). Every real camera provider registers a native `motion` cap
+* on the camera device, so self-inclusion would mint a SECOND, differently
+* named copy (`motion-sensor`) of every motion transition, at motion rate.
+*
+* Add a cap here only when the camera already emits that event through
+* another ingest path — never to reduce noise.
+*/
+var SELF_CAMERA_EXCLUDED_CAPS = new Set(["motion"]);
+/** True when a camera may contribute `capName` for itself. */
+function selfCameraMayEmit(capName) {
+	return !SELF_CAMERA_EXCLUDED_CAPS.has(capName);
+}
+/**
+* Full event-kind taxonomy a camera CAN emit (config-derived):
+*   (a) motion built-in — always;
+*   (b) each enabled detection macro + its taxonomy subs (reverse COCO);
+*   (c) audio macro + its subs when the classifier is enabled;
+*   (d) package kinds when a package zone rule is enabled;
+*   (e) sensor/control kinds from the CAMERA'S OWN bindings and from its
+*       LINKED devices (binding-driven), deduped per (kind, source deviceId).
+* Every descriptor carries parentKind/level/iconId/labelKey via the single
+* taxonomy dictionary — no color/icon is declared here.
+*/
+/**
+* Run one lookup, reporting a failure instead of propagating it.
+*
+* `undefined` means "this one did not answer" — the caller degrades that part
+* of the taxonomy and keeps the rest. That is the pre-existing contract (each
+* section had its own try/catch); it is factored out here only because the
+* sections now run concurrently, and a rejected promise nobody has awaited yet
+* is an unhandled rejection.
+*/
+async function attempt(deps, scope, run) {
+	try {
+		return await run();
+	} catch (err) {
+		deps.onError?.(scope, err);
+		return;
+	}
+}
+async function composeEventKinds(deps, deviceId) {
+	const out = [];
+	const cameraSource = {
+		capName: "pipeline-analytics",
+		deviceId
+	};
+	const pushKind = (kind, source = cameraSource) => {
+		const d = buildEventKindDescriptor(kind, source);
+		if (d !== null) out.push(d);
+	};
+	const macrosP = attempt(deps, "enabledMacroClasses", () => deps.enabledMacroClasses(deviceId));
+	const audioP = attempt(deps, "audioEnabled", () => deps.audioEnabled(deviceId));
+	const packageP = attempt(deps, "packageZonesEnabled", async () => deps.packageZonesEnabled ? deps.packageZonesEnabled(deviceId) : false);
+	const linkedP = attempt(deps, "getLinkedDevices", () => deps.linkedDevices.getLinkedDevices({ deviceId }));
+	const selfBindingsP = attempt(deps, "getBindings", () => deps.bindings.getBindings({ deviceId }));
+	pushKind("motion");
+	for (const macro of await macrosP ?? []) {
+		pushKind(macro);
+		for (const sub of subKindsOf(macro)) pushKind(sub.kind);
+	}
+	if (await audioP === true) {
+		pushKind("audio");
+		for (const sub of subKindsOf("audio")) pushKind(sub.kind);
+	}
+	if (await packageP === true) {
+		pushKind("package");
+		for (const sub of subKindsOf("package")) pushKind(sub.kind);
+	}
+	const devices = (await linkedP)?.devices ?? [];
+	const bindingsPerDevice = await Promise.all(devices.map((linked) => attempt(deps, "getBindings", () => deps.bindings.getBindings({ deviceId: linked.deviceId }))));
+	const seen = /* @__PURE__ */ new Set();
+	const pushSensorKinds = (sourceDeviceId, entries, isSelf) => {
+		if (entries === void 0) return;
+		for (const { capName } of entries) {
+			if (isSelf && !selfCameraMayEmit(capName)) continue;
+			const descriptor = EVENT_KIND_BY_CAP[capName];
+			if (descriptor === void 0) continue;
+			const dedupeKey = `${descriptor.kind}:${sourceDeviceId}`;
+			if (seen.has(dedupeKey)) continue;
+			seen.add(dedupeKey);
+			pushKind(descriptor.kind, {
+				capName,
+				deviceId: sourceDeviceId
+			});
+		}
 	};
 	pushSensorKinds(deviceId, (await selfBindingsP)?.entries, true);
 	for (const [index, linked] of devices.entries()) pushSensorKinds(linked.deviceId, bindingsPerDevice[index]?.entries, false);
@@ -22597,334 +23027,39 @@ var EventMediaDispatcher = class {
 			this.deps.logger.warn(`event media: ${child.kind} failed`, {
 				tags: { deviceId },
 				meta: {
-					deviceId,
-					eventId: ev.eventId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-		}
-	}
-	async writeTrackFrame(deviceId, frameHandle, frameData, fw, fh, tf) {
-		const boxed = await this.boxedTimelineFrame(deviceId, frameHandle, frameData, fw, fh, tf.trackId, tf.bbox, tf.label);
-		if (!boxed) return false;
-		try {
-			await this.deps.mediaStore.put({
-				deviceId,
-				ownerKind: "track",
-				ownerId: tf.trackId,
-				kind: "firstFrame",
-				timestamp: tf.timestamp,
-				data: boxed
-			});
-			return true;
-		} catch (err) {
-			this.deps.logger.warn("event media: track frame failed", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					trackId: tf.trackId,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-			return false;
-		}
-	}
-};
-/**
-* A baseline whose last sample is older than `baselineMs × this` no longer
-* describes the camera — an on-motion camera detaches for hours and comes
-* back to a different scene. Decaying it forward would make the first frame
-* back either a guaranteed marker (mean still holds the old quiet) or a
-* guaranteed miss; discarding it is the honest option and costs one warm-up.
-*/
-var STALE_BASELINE_FACTOR = 5;
-/**
-* Floor on the MAD used as the deviation unit, in dB. A perfectly flat signal
-* has MAD 0 and would make every deviation infinite. 1 dB is below the
-* quantisation of any real level meter, so it only ever binds on a synthetic
-* or a genuinely dead-steady signal — where bar 2 is what should decide.
-*/
-var MIN_MAD_DB = 1;
-function emptyAudioBaseline() {
-	return {
-		count: 0,
-		mean: 0,
-		mad: 0,
-		firstMs: 0,
-		lastMs: 0
-	};
-}
-/** Seed a fresh baseline from one sample (first ever, or after a stale gap). */
-function seed(sample) {
-	return {
-		count: 1,
-		mean: sample.dbfs,
-		mad: 0,
-		firstMs: sample.timestampMs,
-		lastMs: sample.timestampMs
-	};
-}
-/**
-* Fold `sample` into `state` and decide whether it is a marker candidate.
-*
-* The verdict is measured against the PRIOR baseline (this frame excluded) so
-* a lone spike is not diluted by itself — the same reasoning
-* `audio-level-detector` uses for its `priorMean`. The state returned always
-* includes the sample, whatever the verdict.
-*/
-function observeAudioAnomaly(state, sample, cfg) {
-	const isFirst = state.count === 0;
-	const gapMs = sample.timestampMs - state.lastMs;
-	const isStale = !isFirst && gapMs > cfg.baselineMs * STALE_BASELINE_FACTOR;
-	if (isFirst || isStale) return {
-		verdict: { kind: "warmup" },
-		nextState: seed(sample)
-	};
-	const alpha = 1 - Math.exp(-Math.max(0, gapMs) / cfg.baselineMs);
-	const priorMean = state.mean;
-	const priorMad = state.mad;
-	const nextState = {
-		count: state.count + 1,
-		mean: priorMean + alpha * (sample.dbfs - priorMean),
-		mad: priorMad + alpha * (Math.abs(sample.dbfs - priorMean) - priorMad),
-		firstMs: state.firstMs,
-		lastMs: sample.timestampMs
-	};
-	if (sample.dbfs <= cfg.silenceFloorDbfs) return {
-		verdict: { kind: "silent" },
-		nextState
-	};
-	if (!(nextState.count >= 30 && sample.timestampMs - state.firstMs >= cfg.baselineMs)) return {
-		verdict: { kind: "warmup" },
-		nextState
-	};
-	if (sample.dbfs < cfg.minDbfs) return {
-		verdict: {
-			kind: "not-loud",
-			dbfs: sample.dbfs
-		},
-		nextState
-	};
-	const deviationDb = sample.dbfs - priorMean;
-	const deviations = deviationDb / Math.max(priorMad, MIN_MAD_DB);
-	const measured = {
-		dbfs: sample.dbfs,
-		mean: priorMean,
-		deviationDb,
-		deviations
-	};
-	return {
-		verdict: deviationDb >= cfg.minDeviationDb && deviations >= cfg.minDeviations ? {
-			kind: "anomalous",
-			...measured
-		} : {
-			kind: "not-anomalous",
-			...measured
-		},
-		nextState
-	};
-}
-//#endregion
-//#region src/pipeline-analytics/services/audio-marker-projector.ts
-/** One info line per camera per minute, and only when something qualified. */
-var METRICS_WINDOW_MS = 6e4;
-var HOUR_MS = 60 * 6e4;
-var DAY_MS = 24 * HOUR_MS;
-function emptyCounters(atMs) {
-	return {
-		windowStartMs: atMs,
-		enabled: false,
-		observed: 0,
-		notLoud: 0,
-		notAnomalous: 0,
-		candidates: 0,
-		suppressedMotion: 0,
-		suppressedCooldown: 0,
-		suppressedHourly: 0,
-		suppressedDaily: 0,
-		suppressedInFlight: 0,
-		wouldFire: 0,
-		materialized: 0,
-		materializeFailed: 0
-	};
-}
-var AudioMarkerProjector = class {
-	deps;
-	baselines = /* @__PURE__ */ new Map();
-	rates = /* @__PURE__ */ new Map();
-	counters = /* @__PURE__ */ new Map();
-	inFlight = /* @__PURE__ */ new Set();
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Feed ONE audio frame. Synchronous by construction: at ~30 Hz per camera
-	* the common path must not allocate a promise, so the decision is taken
-	* inline and only an actual marker goes async (fire-and-forget, bounded by
-	* the in-flight guard and the rate ceilings).
-	*
-	* Call this BEFORE the classification/level route split so the baseline
-	* sees every frame. A baseline fed only by the level route is blind to
-	* exactly the loud, confidently-classified frames a marker is for.
-	*/
-	observe(input, cfg) {
-		const { deviceId, timestampMs } = input;
-		const counters = this.countersFor(deviceId, timestampMs);
-		counters.observed += 1;
-		counters.enabled = cfg.enabled;
-		const res = observeAudioAnomaly(this.baselines.get(deviceId) ?? emptyAudioBaseline(), {
-			timestampMs,
-			dbfs: input.dbfs
-		}, cfg);
-		this.baselines.set(deviceId, res.nextState);
-		this.maybeFlush(deviceId, timestampMs);
-		switch (res.verdict.kind) {
-			case "silent":
-			case "warmup": return;
-			case "not-loud":
-				counters.notLoud += 1;
-				return;
-			case "not-anomalous":
-				counters.notAnomalous += 1;
-				return;
-			case "anomalous": break;
-		}
-		counters.candidates += 1;
-		if (this.deps.isMotionActive(deviceId, timestampMs, cfg.motionQuietMs)) {
-			counters.suppressedMotion += 1;
-			return;
-		}
-		const fired = this.rates.get(deviceId)?.firedAtMs ?? [];
-		const last = fired.length > 0 ? fired[fired.length - 1] : void 0;
-		if (last !== void 0 && timestampMs - last < cfg.cooldownMs) {
-			counters.suppressedCooldown += 1;
-			return;
-		}
-		const recent = fired.filter((t) => timestampMs - t < DAY_MS);
-		if (recent.filter((t) => timestampMs - t < HOUR_MS).length >= cfg.maxPerHour) {
-			counters.suppressedHourly += 1;
-			this.rates.set(deviceId, { firedAtMs: recent });
-			return;
-		}
-		if (recent.length >= cfg.maxPerDay) {
-			counters.suppressedDaily += 1;
-			this.rates.set(deviceId, { firedAtMs: recent });
-			return;
-		}
-		if (!cfg.enabled) {
-			counters.wouldFire += 1;
-			return;
-		}
-		if (this.inFlight.has(deviceId)) {
-			counters.suppressedInFlight += 1;
-			return;
-		}
-		this.rates.set(deviceId, { firedAtMs: [...recent, timestampMs] });
-		counters.materialized += 1;
-		this.inFlight.add(deviceId);
-		this.materialize(input, counters);
-	}
-	/**
-	* Emit and reset a camera's window if it has anything to say. Exposed so a
-	* shutdown (or a test) can force the tally out rather than losing it.
-	*/
-	flush(nowMs) {
-		for (const deviceId of this.counters.keys()) this.emitWindow(deviceId, nowMs, true);
-	}
-	/** Drop all per-camera state for a device (unbind / device removal). */
-	forgetDevice(deviceId) {
-		this.baselines.delete(deviceId);
-		this.rates.delete(deviceId);
-		this.counters.delete(deviceId);
-		this.inFlight.delete(deviceId);
+					deviceId,
+					eventId: ev.eventId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
 	}
-	async materialize(input, counters) {
-		const { deviceId, timestampMs } = input;
+	async writeTrackFrame(deviceId, frameHandle, frameData, fw, fh, tf) {
+		const boxed = await this.boxedTimelineFrame(deviceId, frameHandle, frameData, fw, fh, tf.trackId, tf.bbox, tf.label);
+		if (!boxed) return false;
 		try {
-			const audioLabels = buildAudioLabels(input);
-			await this.deps.sink.materialize({
-				cameraId: deviceId,
-				sourceDeviceId: deviceId,
-				source: "audio",
-				kind: "audio",
-				timestamp: timestampMs,
-				...audioLabels !== void 0 ? { audioLabels } : {}
+			await this.deps.mediaStore.put({
+				deviceId,
+				ownerKind: "track",
+				ownerId: tf.trackId,
+				kind: "firstFrame",
+				timestamp: tf.timestamp,
+				data: boxed
 			});
+			return true;
 		} catch (err) {
-			counters.materialized -= 1;
-			counters.materializeFailed += 1;
-			this.deps.onError?.("materializeAudioMarker", err);
-			this.deps.logger.warn("audio marker materialize failed", {
+			this.deps.logger.warn("event media: track frame failed", {
 				tags: { deviceId },
-				meta: { error: err instanceof Error ? err.message : String(err) }
+				meta: {
+					deviceId,
+					trackId: tf.trackId,
+					error: err instanceof Error ? err.message : String(err)
+				}
 			});
-		} finally {
-			this.inFlight.delete(deviceId);
+			return false;
 		}
 	}
-	countersFor(deviceId, atMs) {
-		const existing = this.counters.get(deviceId);
-		if (existing !== void 0) return existing;
-		const fresh = emptyCounters(atMs);
-		this.counters.set(deviceId, fresh);
-		return fresh;
-	}
-	maybeFlush(deviceId, nowMs) {
-		const c = this.counters.get(deviceId);
-		if (c === void 0 || nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
-		this.emitWindow(deviceId, nowMs, false);
-	}
-	/**
-	* One line per camera per window — but ONLY when a frame reached the
-	* candidate gate. A camera that heard nothing extraordinary has nothing to
-	* report, and a line per camera per minute forever would bury the ones that
-	* do. `force` still honours that: it flushes the window, it does not invent
-	* a reason to speak.
-	*/
-	emitWindow(deviceId, nowMs, force) {
-		const c = this.counters.get(deviceId);
-		if (c === void 0) return;
-		if (!force && nowMs - c.windowStartMs < METRICS_WINDOW_MS) return;
-		if (c.candidates > 0 || c.materializeFailed > 0) this.deps.logger.info("audio anomaly gate (window)", {
-			tags: { deviceId },
-			meta: {
-				enabled: c.enabled,
-				windowMs: nowMs - c.windowStartMs,
-				observed: c.observed,
-				notLoud: c.notLoud,
-				notAnomalous: c.notAnomalous,
-				candidates: c.candidates,
-				suppressedMotion: c.suppressedMotion,
-				suppressedCooldown: c.suppressedCooldown,
-				suppressedHourly: c.suppressedHourly,
-				suppressedDaily: c.suppressedDaily,
-				suppressedInFlight: c.suppressedInFlight,
-				wouldFire: c.wouldFire,
-				materialized: c.materialized,
-				materializeFailed: c.materializeFailed
-			}
-		});
-		this.counters.set(deviceId, emptyCounters(nowMs));
-	}
 };
-/**
-* The class heard on the anomalous frame, in the shape `Track.audioLabels`
-* already defines. Using that field is what lets a marker label itself
-* ("dog", "glass_breaking") without inventing an event-taxonomy sub-class —
-* the audio macro vocabulary collides with existing subs (`dog` is a COCO
-* animal, `siren` is a control), so a sub per audio class would put a barking
-* dog in the ANIMAL lane.
-*/
-function buildAudioLabels(input) {
-	if (input.className === void 0) return void 0;
-	return [{
-		label: input.className,
-		peakScore: input.score ?? 0,
-		count: 1,
-		firstAt: input.timestampMs,
-		lastAt: input.timestampMs
-	}];
-}
 /** JPEG quality for the downscaled full frame — matches the crop path. */
 var FULL_FRAME_QUALITY = 80;
 /**
@@ -24937,6 +25072,478 @@ async function sweepTrackRetention(deps) {
 	return totalTracks;
 }
 //#endregion
+//#region src/pipeline-analytics/training-export/dataset-plan.ts
+var FACE_OWNER_PREFIX = "face-";
+var PLATE_OWNER_PREFIX = "plate-";
+/**
+* Tracks one export pass will carry.
+*
+* It is the per-device pin budget (500) times the four cameras a homelab hub
+* plausibly runs, rounded — i.e. "every track that can be marked", not a
+* throttle the operator has to think about. The ceiling exists so a fleet-wide
+* export cannot become an unbounded walk if the pin budget is ever raised, and
+* `truncated` in the summary says when it bit rather than quietly shipping a
+* partial dataset as if it were the whole one.
+*/
+var TRAINING_EXPORT_MAX_TRACKS = 2e3;
+/**
+* Archive path for one media file.
+*
+* The scope segment is not decoration: a track and its best object event can
+* both own a `crop` at the same millisecond, and without the segment the second
+* one would overwrite the first inside the archive — a silent loss that only
+* shows up as a dataset that is smaller than the manifest says.
+*/
+function archivePathFor(params) {
+	const leaf = params.singleInstance ? `${params.kind}.jpg` : `${params.kind}-${params.timestamp}.jpg`;
+	const dir = params.scope === "" ? "" : `${params.scope}/`;
+	return `tracks/${params.deviceId}/${params.trackId}/${dir}${leaf}`;
+}
+/**
+* A media key ends in `:<timestamp>` for the accumulating kinds and stops at the
+* kind for the single-instance ones. Reading it off the key rather than
+* re-deriving the kind set keeps this from drifting when a kind changes sides.
+*/
+function isSingleInstanceKey(key, kind) {
+	return key.endsWith(`:${kind}`);
+}
+/**
+* Build the plan. Index reads only — the returned plan holds no image bytes and
+* is safe to send over tRPC.
+*/
+async function buildTrainingExportPlan(readers, input) {
+	const tracks = [];
+	const skippedPaths = [];
+	let truncated = false;
+	let remaining = input.maxTracks;
+	for (const deviceId of input.deviceIds) {
+		if (remaining <= 0) break;
+		const marked = await readers.listMarkedTracks(deviceId, remaining + 1);
+		if (marked.length > remaining) truncated = true;
+		const take = marked.slice(0, remaining);
+		remaining -= take.length;
+		if (take.length === 0) continue;
+		const eventLinks = await readers.listEventIdsForTracks(take.map((t) => t.trackId));
+		const eventsByTrack = /* @__PURE__ */ new Map();
+		for (const link of eventLinks) {
+			const list = eventsByTrack.get(link.trackId);
+			if (list) list.push(link.eventId);
+			else eventsByTrack.set(link.trackId, [link.eventId]);
+		}
+		for (const track of take) {
+			const files = [];
+			const owners = [
+				{
+					ownerKind: "track",
+					ownerId: track.trackId,
+					scope: ""
+				},
+				{
+					ownerKind: "face",
+					ownerId: `${FACE_OWNER_PREFIX}${track.trackId}`,
+					scope: "face"
+				},
+				{
+					ownerKind: "plate",
+					ownerId: `${PLATE_OWNER_PREFIX}${track.trackId}`,
+					scope: "plate"
+				},
+				...(eventsByTrack.get(track.trackId) ?? []).map((eventId) => ({
+					ownerKind: "event",
+					ownerId: eventId,
+					scope: `events/${eventId}`
+				}))
+			];
+			for (const owner of owners) {
+				const infos = await readers.listMediaInfo(owner.ownerKind, owner.ownerId);
+				for (const info of infos) {
+					const archivePath = archivePathFor({
+						deviceId: track.deviceId,
+						trackId: track.trackId,
+						scope: owner.scope,
+						kind: info.kind,
+						timestamp: info.timestamp,
+						singleInstance: isSingleInstanceKey(info.key, info.kind)
+					});
+					files.push({
+						archivePath,
+						mediaKey: info.key,
+						kind: info.kind,
+						sizeBytes: info.sizeBytes,
+						timestamp: info.timestamp
+					});
+				}
+			}
+			tracks.push({
+				trackId: track.trackId,
+				deviceId: track.deviceId,
+				className: track.className,
+				...track.label !== void 0 ? { label: track.label } : {},
+				firstSeen: track.firstSeen,
+				lastSeen: track.lastSeen,
+				classes: track.classes ?? [],
+				zonesVisited: track.zonesVisited,
+				...track.importance !== void 0 ? { importance: track.importance } : {},
+				files
+			});
+		}
+	}
+	const perDevice = /* @__PURE__ */ new Map();
+	let fileCount = 0;
+	let byteCount = 0;
+	for (const track of tracks) {
+		const agg = perDevice.get(track.deviceId) ?? {
+			tracks: 0,
+			files: 0,
+			bytes: 0
+		};
+		agg.tracks += 1;
+		for (const file of track.files) {
+			agg.files += 1;
+			agg.bytes += file.sizeBytes;
+			fileCount += 1;
+			byteCount += file.sizeBytes;
+		}
+		perDevice.set(track.deviceId, agg);
+	}
+	return {
+		generatedAt: readers.now(),
+		tracks,
+		totals: [...perDevice.entries()].map(([deviceId, agg]) => ({
+			deviceId,
+			...agg
+		})),
+		trackCount: tracks.length,
+		fileCount,
+		byteCount,
+		truncated,
+		skippedPaths
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/training-export/tar-stream.ts
+/**
+* A minimal POSIX ustar writer — enough to emit a dataset archive entry by
+* entry, without ever holding the archive in memory.
+*
+* ## Why hand-rolled rather than the `tar` package
+*
+* `tar` is in the workspace and is the right tool for what it does: archive a
+* set of paths under one `cwd`. This is a different job. A track's media lives
+* across several storage LOCATION roots (`eventMedia` and whatever else the
+* operator relocated to), under paths that encode nothing a training set wants —
+* `615/events/track/<uuid>/keyFrame.jpg` — and every entry has to be RENAMED on
+* the way in, to `tracks/615/<trackId>/keyFrame.jpg`. `tar.create` takes a list
+* of paths relative to a single cwd and gives no rename hook, so using it would
+* mean staging a whole shadow tree on disk first: a full second copy of the
+* dataset, written and then deleted, to avoid writing 100 lines.
+*
+* So: ustar, which is a 512-byte header and a 512-byte-padded body per entry,
+* fully specified, and asserted against the system `tar` binary in the spec next
+* door rather than against my reading of the format.
+*
+* ## What this deliberately does NOT do
+*
+* No gzip — the payload is JPEG, already compressed; a gzip pass would burn CPU
+* on the hub for a percent or two. No long-name (GNU/PAX) extension: ustar
+* splits a path across a 155-byte prefix and a 100-byte name, and
+* {@link tarNameTooLong} reports a path that will not fit so the caller can skip
+* it and SAY it skipped it, rather than emitting a silently truncated entry.
+*/
+var BLOCK_SIZE = 512;
+var NAME_MAX = 100;
+var PREFIX_MAX = 155;
+/**
+* Split a path into the ustar `prefix` + `name` pair, or `null` when it cannot
+* be represented. The split must land on a `/`, and each half has its own cap.
+*/
+function splitUstarName(name) {
+	if (Buffer.byteLength(name) <= NAME_MAX) return {
+		prefix: "",
+		name
+	};
+	for (let i = name.length - 1; i >= 0; i--) {
+		if (name[i] !== "/") continue;
+		const head = name.slice(0, i);
+		const tail = name.slice(i + 1);
+		if (Buffer.byteLength(tail) > NAME_MAX) break;
+		if (Buffer.byteLength(head) <= PREFIX_MAX) return {
+			prefix: head,
+			name: tail
+		};
+	}
+	return null;
+}
+/** True when a path cannot be represented as a ustar entry name. */
+function tarNameTooLong(name) {
+	return splitUstarName(name) === null;
+}
+function writeString(block, value, offset, length) {
+	block.write(value.slice(0, length - 1), offset, length - 1, "utf8");
+}
+/** ustar numeric field: zero-padded octal, NUL-terminated. */
+function writeOctal(block, value, offset, length) {
+	const text = Math.floor(value).toString(8).padStart(length - 1, "0");
+	block.write(text.slice(-(length - 1)), offset, length - 1, "ascii");
+}
+/**
+* The 512-byte header for one regular file.
+*
+* The checksum is computed with the checksum field itself read as eight spaces —
+* that is the format's rule, and getting it wrong produces an archive that looks
+* fine until something tries to read it.
+*/
+function tarHeader(entry) {
+	const split = splitUstarName(entry.name);
+	if (split === null) throw new Error(`tar: entry name too long for ustar: ${entry.name}`);
+	const block = Buffer.alloc(BLOCK_SIZE);
+	writeString(block, split.name, 0, NAME_MAX);
+	writeOctal(block, 420, 100, 8);
+	writeOctal(block, 0, 108, 8);
+	writeOctal(block, 0, 116, 8);
+	writeOctal(block, entry.body.length, 124, 12);
+	writeOctal(block, Math.floor(entry.mtimeMs / 1e3), 136, 12);
+	block.write("        ", 148, 8, "ascii");
+	block.write("0", 156, 1, "ascii");
+	block.write("ustar\0", 257, 6, "ascii");
+	block.write("00", 263, 2, "ascii");
+	writeString(block, split.prefix, 345, PREFIX_MAX);
+	let sum = 0;
+	for (const byte of block) sum += byte;
+	writeOctal(block, sum, 148, 7);
+	block.write("\0", 154, 1, "ascii");
+	block.write(" ", 155, 1, "ascii");
+	return block;
+}
+/** Zero padding that rounds a body up to the 512-byte block. */
+function tarPadding(size) {
+	const remainder = size % BLOCK_SIZE;
+	return remainder === 0 ? Buffer.alloc(0) : Buffer.alloc(BLOCK_SIZE - remainder);
+}
+/** Header + body + padding for one entry, ready to write. */
+function tarBlocks(entry) {
+	return [
+		tarHeader(entry),
+		entry.body,
+		tarPadding(entry.body.length)
+	];
+}
+/** The two zero blocks that terminate an archive. */
+function tarTrailer() {
+	return Buffer.alloc(BLOCK_SIZE * 2);
+}
+//#endregion
+//#region src/pipeline-analytics/training-export/training-export-stream.ts
+var MANIFEST_ENTRY_NAME = "manifest.json";
+function manifestTrack(track) {
+	return {
+		trackId: track.trackId,
+		deviceId: track.deviceId,
+		className: track.className,
+		...track.label !== void 0 ? { label: track.label } : {},
+		firstSeen: track.firstSeen,
+		lastSeen: track.lastSeen,
+		classes: track.classes,
+		zonesVisited: track.zonesVisited,
+		...track.importance !== void 0 ? { importance: track.importance } : {},
+		files: track.files.map((f) => ({
+			path: f.archivePath,
+			kind: f.kind,
+			timestamp: f.timestamp,
+			sizeBytes: f.sizeBytes
+		}))
+	};
+}
+/**
+* The manifest body.
+*
+* `mediaKey` is deliberately NOT in it. The archive is a dataset handed to a
+* training pipeline, and a store-internal key is meaningless outside the hub
+* that issued it — worse, it invites a consumer to believe it can fetch by that
+* key later, on media the retention pin does not guarantee is still there once
+* the mark is removed. The archive path is the identity inside the archive.
+*/
+function buildManifest(plan) {
+	const body = {
+		format: "camstack-training-export",
+		version: 1,
+		generatedAt: plan.generatedAt,
+		selection: "tracks in retrain staging (retrainStatus: 'staging')",
+		trackCount: plan.trackCount,
+		fileCount: plan.fileCount,
+		byteCount: plan.byteCount,
+		truncated: plan.truncated,
+		devices: plan.totals,
+		tracks: plan.tracks.map(manifestTrack)
+	};
+	return Buffer.from(JSON.stringify(body, null, 2), "utf8");
+}
+/** Write the whole archive to the sink. */
+async function streamDataset(deps) {
+	const { plan, sink, readBlob, logger, now, pace } = deps;
+	const pacingMs = deps.pacingMs ?? 25;
+	const mtimeMs = now();
+	for (const block of tarBlocks({
+		name: MANIFEST_ENTRY_NAME,
+		body: buildManifest(plan),
+		mtimeMs
+	})) await sink.write(block);
+	let filesWritten = 0;
+	let bytesWritten = 0;
+	let filesMissing = 0;
+	let aborted = false;
+	for (const track of plan.tracks) {
+		for (const file of track.files) {
+			if (deps.aborted?.() === true) {
+				aborted = true;
+				break;
+			}
+			if (tarNameTooLong(file.archivePath)) {
+				filesMissing += 1;
+				logger.warn("training export skipped a file — path too long for the archive", {
+					tags: { deviceId: track.deviceId },
+					meta: {
+						deviceId: track.deviceId,
+						trackId: track.trackId,
+						path: file.archivePath
+					}
+				});
+				continue;
+			}
+			const bytes = await readBlob(file.mediaKey);
+			if (bytes === null) {
+				filesMissing += 1;
+				logger.warn("training export skipped a file — media unreadable", {
+					tags: { deviceId: track.deviceId },
+					meta: {
+						deviceId: track.deviceId,
+						trackId: track.trackId,
+						mediaKey: file.mediaKey
+					}
+				});
+				continue;
+			}
+			for (const block of tarBlocks({
+				name: file.archivePath,
+				body: bytes,
+				mtimeMs
+			})) await sink.write(block);
+			filesWritten += 1;
+			bytesWritten += bytes.length;
+			if (pacingMs > 0) await pace(pacingMs);
+		}
+		if (aborted) break;
+	}
+	await sink.write(tarTrailer());
+	await sink.end();
+	logger.info("training export complete", { meta: {
+		tracks: plan.trackCount,
+		filesWritten,
+		filesMissing,
+		bytesWritten,
+		truncated: plan.truncated,
+		aborted
+	} });
+	return {
+		filesWritten,
+		bytesWritten,
+		filesMissing,
+		aborted
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/training-export/training-export-handler.ts
+var TRAINING_EXPORT_PREFIX = "training-export";
+/**
+* Parse `?deviceIds=615,617` into a device list. An absent or unparseable value
+* yields `[]`, which the caller reads as "every device with marked tracks" —
+* stated here rather than left to the reader because the empty array is doing
+* two jobs and only one of them is obvious.
+*/
+function parseDeviceIds(url) {
+	const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+	const raw = new URLSearchParams(query).get("deviceIds");
+	if (raw === null || raw.trim() === "") return [];
+	const out = [];
+	for (const part of raw.split(",")) {
+		const n = Number.parseInt(part.trim(), 10);
+		if (Number.isInteger(n) && n > 0 && !out.includes(n)) out.push(n);
+	}
+	return out;
+}
+/** Archive filename. Sanitised the same way the backup download is — a header
+*  value carrying a CR or a quote is a response-splitting bug, not a filename. */
+function archiveFilename(nowMs) {
+	return `camstack-training-${new Date(nowMs).toISOString().replace(/[:.]/g, "-")}.tar`.replace(/[\r\n"]/g, "");
+}
+/** Adapt a `ServerResponse` to the sink, honouring backpressure. */
+function responseSink(res) {
+	return {
+		write: (chunk) => new Promise((resolve, reject) => {
+			const ok = res.write(chunk, (err) => {
+				if (err) reject(err);
+				else if (ok) resolve();
+			});
+			if (!ok) res.once("drain", resolve);
+		}),
+		end: () => new Promise((resolve) => {
+			res.end(resolve);
+		})
+	};
+}
+function createTrainingExportHandler(deps) {
+	return async (req, res) => {
+		const method = req.method ?? "GET";
+		if (method !== "GET" && method !== "HEAD") {
+			res.writeHead(405, { allow: "GET, HEAD" });
+			res.end();
+			return;
+		}
+		const deviceIds = parseDeviceIds(req.url ?? "");
+		let plan;
+		try {
+			plan = await deps.buildPlan(deviceIds);
+		} catch (err) {
+			deps.logger.warn("training export plan failed", { meta: { error: String(err) } });
+			res.writeHead(500, { "content-type": "text/plain" });
+			res.end("training export plan failed");
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": "application/x-tar",
+			"content-disposition": `attachment; filename="${archiveFilename(deps.now())}"`,
+			"cache-control": "no-store",
+			"x-camstack-export-tracks": String(plan.trackCount),
+			"x-camstack-export-files": String(plan.fileCount)
+		});
+		if (method === "HEAD") {
+			res.end();
+			return;
+		}
+		let clientGone = false;
+		res.once("close", () => {
+			clientGone = res.writableEnded === false;
+		});
+		try {
+			await streamDataset({
+				plan,
+				sink: responseSink(res),
+				readBlob: deps.readBlob,
+				logger: deps.logger,
+				now: deps.now,
+				pace: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+				aborted: () => clientGone
+			});
+		} catch (err) {
+			deps.logger.warn("training export stream failed mid-archive", { meta: {
+				error: String(err),
+				tracks: plan.trackCount
+			} });
+			res.destroy();
+		}
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/zone-analytics-provider.ts
 var HISTORY_WINDOW_MS = 3600 * 1e3;
 /** Cap name for the runtime-state mirror — matches the cap's declared
@@ -25569,6 +26176,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	retentionSweepTimer = null;
 	/** Handle for the event-media data-plane listener (dispose on shutdown). */
 	eventMediaDataPlane = null;
+	/** Handle for the training-export data-plane listener (dispose on shutdown). */
+	trainingExportDataPlane = null;
 	/** The NC artifact plane (signed public links for notification media) and its
 	*  data-plane handle. Null until served / when the facility is absent. */
 	ncArtifactPlane = null;
@@ -26202,7 +26811,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		let storage = this.ctx.kernel.storage;
 		const mediaRoot = process.env.CAMSTACK_MEDIA_ROOT?.trim();
 		if (mediaRoot) {
-			const { FilesystemStorageProvider } = await import("../node-Bjc_xs4R.mjs");
+			const { FilesystemStorageProvider } = await import("../node-Co0YpEFr.mjs");
 			storage = new FilesystemStorageProvider(mediaRoot, { eventMedia: mediaRoot });
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
@@ -26711,11 +27320,99 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			}) ?? null;
 			this.eventMediaBaseUrl = this.eventMediaDataPlane !== null ? `/addon/${this.ctx.id}/event-media` : null;
 			await this.serveNcArtifactPlane();
+			await this.serveTrainingExportPlane();
 			this.ctx.logger.info("event-media data-plane served", { meta: { baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)" } });
 		} catch (err) {
 			this.ctx.logger.warn("event-media data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
 	}
+	/**
+	* The training-export data plane. Separate listener, `access: 'admin'` —
+	* marking a track is a viewer-level curation act (D81), but walking off with
+	* every stored frame behind the marked set is not.
+	*/
+	async serveTrainingExportPlane() {
+		try {
+			const handler = createTrainingExportHandler({
+				buildPlan: (deviceIds) => this.buildTrainingExportPlan(deviceIds),
+				readBlob: async (mediaKey) => {
+					const file = await (this.mediaStore?.getByKey(mediaKey) ?? Promise.resolve(null));
+					return file === null ? null : Buffer.from(file.base64, "base64");
+				},
+				logger: this.ctx.logger,
+				now: () => Date.now()
+			});
+			this.trainingExportDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: "training-export",
+				access: "admin",
+				handler
+			}) ?? null;
+		} catch (err) {
+			this.ctx.logger.warn("training-export data-plane failed to serve", { meta: { error: errMsg(err) } });
+		}
+	}
+	/**
+	* Plan the training export — INDEX READS ONLY. No blob is touched here, which
+	* is what lets `getTrainingExportSummary` answer "how big is this" for the
+	* cost of a few KB per track instead of the gigabytes the answer is about.
+	*
+	* An empty `deviceIds` means every device that has tracks, resolved from the
+	* track store rather than from the device manager: a camera that was removed
+	* can still own marked tracks, and refusing to export them because the device
+	* is gone would lose exactly the material an operator kept on purpose.
+	*/
+	async buildTrainingExportPlan(deviceIds) {
+		const trackStore = this.trackStore;
+		const mediaStore = this.mediaStore;
+		const eventStore = this.eventStore;
+		if (!trackStore || !mediaStore) throw new Error("training export: analytics stores unavailable");
+		return buildTrainingExportPlan({
+			listMarkedTracks: (deviceId, limit) => trackStore.listStaging(deviceId, limit),
+			listMediaInfo: async (ownerKind, ownerId) => {
+				if (!isMediaOwnerKind(ownerKind)) return [];
+				return mediaStore.listInfoByOwner(ownerKind, ownerId);
+			},
+			listEventIdsForTracks: async (trackIds) => {
+				if (!eventStore || trackIds.length === 0) return [];
+				return (await eventStore.queryObjectByTrackIds(trackIds)).flatMap((e) => e.trackId === void 0 ? [] : [{
+					eventId: e.id,
+					trackId: e.trackId
+				}]);
+			},
+			now: () => Date.now()
+		}, {
+			deviceIds: deviceIds.length > 0 ? deviceIds : await trackStore.listDeviceIds(),
+			maxTracks: TRAINING_EXPORT_MAX_TRACKS
+		});
+	}
+	/**
+	* Estimate the training export without producing it — the cheap question
+	* (D56's discipline, applied to a pass that runs no inference at all).
+	*/
+	async getTrainingExportSummary(input) {
+		const plan = await this.buildTrainingExportPlan(input.deviceIds ?? []);
+		this.ctx.logger.info("training export summary", { meta: {
+			tracks: plan.trackCount,
+			files: plan.fileCount,
+			bytes: plan.byteCount,
+			truncated: plan.truncated
+		} });
+		return {
+			generatedAt: plan.generatedAt,
+			trackCount: plan.trackCount,
+			fileCount: plan.fileCount,
+			byteCount: plan.byteCount,
+			truncated: plan.truncated,
+			devices: plan.totals
+		};
+	}
+	/** Where to stream the dataset from. The bytes never come through the cap. */
+	async getTrainingExportUrl(input) {
+		if (this.trainingExportDataPlane === null) throw new Error("training export: data plane unavailable on this node");
+		const ids = input.deviceIds ?? [];
+		const query = ids.length > 0 ? `?deviceIds=${ids.join(",")}` : "";
+		return { url: `/addon/${this.ctx.id}/${TRAINING_EXPORT_PREFIX}${query}` };
+	}
 	/** Object/face embedding dispatcher — migrated from the retired
 	*  enrichment-engine addon. It subscribes to DetectionResult, resolves the
 	*  frame via the runner transport, crops each qualifying detection, and
@@ -26966,6 +27663,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.eventMediaDataPlane = null;
 		this.eventMediaBaseUrl = null;
 		this.eventMediaDispatcher = null;
+		await this.trainingExportDataPlane?.dispose();
+		this.trainingExportDataPlane = null;
 	}
 	async handleInferenceResult(data) {
 		if (this.shuttingDown) return;
@@ -30118,15 +30817,22 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	}
 	/**
 	* Set the per-track operator flags (`markForTrain`, `debug`). Partial patch —
-	* see `applyTrackFlags`. The flags carry no behaviour yet; this is the write
-	* surface the three UI toggles share.
+	* see `applyTrackFlags`. `markForTrain` moves the retrain LIFECYCLE
+	* (`none ↔ staging`, D81), and `staging` is what PINS the track against the
+	* retention sweep — which is why the body enforces a per-device staging budget
+	* and refuses any move on an already-`trained` track. `debug` is attention
+	* only. This is the write surface the three UI toggles share.
 	*/
 	async setTrackFlags(input) {
 		const trackStore = this.trackStore;
 		if (!trackStore) throw new Error("setTrackFlags: track store unavailable");
 		const out = await applyTrackFlags({
-			readFlags: (trackId) => trackStore.readFlags(trackId),
-			setFlags: (trackId, patch) => trackStore.setFlags(trackId, patch)
+			store: {
+				readFlags: (trackId) => trackStore.readFlags(trackId),
+				setFlags: (trackId, patch) => trackStore.setFlags(trackId, patch),
+				countStaging: (query) => trackStore.countStaging(query)
+			},
+			logger: this.ctx.logger
 		}, input);
 		this.ctx.logger.info("track operator flags set", {
 			tags: { deviceId: input.deviceId },
@@ -30134,6 +30840,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				deviceId: input.deviceId,
 				trackId: input.trackId,
 				markForTrain: out.markForTrain,
+				retrainStatus: out.retrainStatus,
 				debug: out.debug
 			}
 		});
@@ -30257,6 +30964,19 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						deviceId,
 						cutoffMs
 					});
+					const staging = await this.trackStore?.countStaging({
+						deviceId,
+						olderThanMs: cutoffMs
+					});
+					if (staging !== void 0 && staging > 0) this.ctx.logger.info("track retention held staging tracks (retrainStatus)", {
+						tags: { deviceId },
+						meta: {
+							deviceId,
+							staging,
+							cutoffMs,
+							deleted: counts.tracks
+						}
+					});
 					if (counts.tracks > 0) this.eventsOpsLog?.append({
 						op: "prune",
 						reason: "retention",