@camstack/addon-post-analysis 1.2.51 → 1.2.52

package/dist/pipeline-analytics/index.js

@@ -2,12 +2,11 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CnSzKo7x.js");
+const require_dist = require("../dist-k21GqaWS.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_crypto = require("node:crypto");
-let node_child_process = require("node:child_process");
 let sharp = require("sharp");
 sharp = require_dist.__toESM(sharp);
 //#region src/notification-center/action-token.ts
@@ -1109,557 +1108,6 @@ function mimeFromExtension(file) {
 	return "application/octet-stream";
 }
 //#endregion
-//#region src/notification-center/fmp4-clip/clip-assembler.ts
-/**
-* Drain a subscription into one mp4.
-*
-* The subscription is ALWAYS released before this settles, on every path. It
-* holds an ffmpeg's fragments in a bounded queue; leaking one keeps a camera's
-* child alive for a notification that was sent minutes ago.
-*/
-async function assembleFmp4Clip(input) {
-	const now = input.now ?? Date.now;
-	const schedule = input.setTimeoutFn ?? setTimeout;
-	const parts = [];
-	let initBytes = 0;
-	let fragments = 0;
-	let totalBytes = 0;
-	let firstFragmentAt = null;
-	let lastFragmentAt = null;
-	let stop = null;
-	const iterator = input.subscription.packets()[Symbol.asyncIterator]();
-	try {
-		for (;;) {
-			const remaining = input.deadlineMs - now();
-			if (remaining <= 0) {
-				stop = "deadline";
-				break;
-			}
-			const packet = await nextWithin(iterator, remaining, schedule);
-			if (packet === TIMED_OUT) {
-				stop = "deadline";
-				break;
-			}
-			if (packet === null) {
-				stop = input.subscription.closedReason === "slow-consumer" ? "slow-consumer" : "producer-ended";
-				break;
-			}
-			if (packet.kind === "init") {
-				if (initBytes > 0) {
-					stop = "producer-ended";
-					break;
-				}
-				initBytes = packet.data.length;
-				totalBytes += packet.data.length;
-				parts.push(packet.data);
-				continue;
-			}
-			if (initBytes === 0) return {
-				ok: false,
-				refusal: "no-init"
-			};
-			const arrivedAt = now();
-			if (totalBytes + packet.data.length > input.maxBytes) {
-				stop = "byte-cap";
-				break;
-			}
-			parts.push(packet.data);
-			totalBytes += packet.data.length;
-			fragments += 1;
-			if (firstFragmentAt === null) firstFragmentAt = arrivedAt;
-			lastFragmentAt = arrivedAt;
-			if (packet.isLast) {
-				stop = "producer-ended";
-				break;
-			}
-			if (arrivedAt >= input.collectUntilMs) {
-				stop = "window";
-				break;
-			}
-		}
-	} finally {
-		input.subscription.release();
-	}
-	if (initBytes === 0) return {
-		ok: false,
-		refusal: "no-init"
-	};
-	if (fragments === 0) return {
-		ok: false,
-		refusal: "no-fragments"
-	};
-	const stoppedBecause = stop ?? "producer-ended";
-	return {
-		ok: true,
-		clip: {
-			bytes: concat(parts, totalBytes),
-			initBytes,
-			fragments,
-			arrivalSpanMs: firstFragmentAt === null || lastFragmentAt === null ? 0 : lastFragmentAt - firstFragmentAt,
-			stoppedBecause,
-			truncated: stoppedBecause !== "window"
-		}
-	};
-}
-/** One line for the log — a refused clip that says nothing reads as a bug. */
-function clipAssemblyRefusalReason(refusal) {
-	switch (refusal) {
-		case "no-init": return "the first packet was a fragment, not an initialisation segment — the bytes would not decode";
-		case "no-fragments": return "the initialisation segment arrived but no media fragment did";
-	}
-}
-var TIMED_OUT = Symbol("fmp4-clip-timeout");
-/** `setTimeout`'s 32-bit ceiling. Above it Node fires after 1 ms. */
-var MAX_TIMER_MS = 2 ** 31 - 1;
-/**
-* The next packet, `null` when the stream completed, or {@link TIMED_OUT}.
-*
-* The plane's generator parks on a promise that only a publish resolves, so a
-* camera that goes silent mid-clip parks it forever. Racing a timer is the only
-* way out — and the abandoned `next()` is harmless because the caller releases
-* the subscription immediately afterwards.
-*/
-async function nextWithin(iterator, withinMs, schedule) {
-	let timer = null;
-	const timeout = new Promise((resolve) => {
-		timer = schedule(() => resolve(TIMED_OUT), Math.min(withinMs, MAX_TIMER_MS));
-		timer.unref?.();
-	});
-	try {
-		return await Promise.race([iterator.next().then((r) => r.done === true ? null : r.value), timeout]);
-	} finally {
-		if (timer !== null) clearTimeout(timer);
-	}
-}
-function concat(parts, total) {
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const part of parts) {
-		out.set(part, offset);
-		offset += part.length;
-	}
-	return out;
-}
-//#endregion
-//#region src/notification-center/fmp4-clip/clip-source-pick.ts
-/**
-* The tallest frame a notification clip is cut from.
-*
-* 1080 rather than 720: the attachment is native-resolution H.264 that nothing
-* re-encodes, and the operator asked for a real clip. A 4-second 1080p copy
-* fragment measured ~500 KB on this fleet against ~6.35 MB at 4K, which is the
-* difference between "every backend takes it" and "pushover drops it".
-*/
-var CLIP_MAX_HEIGHT = 1080;
-/** The seam copies; it never transcodes. That means H.264 and only H.264. */
-var COPYABLE_CODEC = "h264";
-function pickClipSource(entries) {
-	const enabled = entries.filter((e) => e.enabled);
-	if (enabled.length === 0) return {
-		ok: false,
-		refusal: "no-enabled-stream"
-	};
-	const copyable = enabled.filter((e) => normaliseCodec(e.codec) === COPYABLE_CODEC);
-	if (copyable.length === 0) return {
-		ok: false,
-		refusal: "no-h264-stream"
-	};
-	const sized = copyable.filter(hasUsableResolution);
-	if (sized.length === 0) return {
-		ok: false,
-		refusal: "no-resolution"
-	};
-	const withinCeiling = sized.filter((e) => e.resolution.height <= CLIP_MAX_HEIGHT);
-	const best = [...withinCeiling.length > 0 ? withinCeiling : sized].sort((a, b) => withinCeiling.length > 0 ? b.resolution.height - a.resolution.height : a.resolution.height - b.resolution.height)[0];
-	if (best === void 0) return {
-		ok: false,
-		refusal: "no-resolution"
-	};
-	return {
-		ok: true,
-		source: {
-			brokerId: best.brokerId,
-			profile: best.profile ?? best.brokerId,
-			url: best.url,
-			width: best.resolution.width,
-			height: best.resolution.height
-		}
-	};
-}
-/** One line for the log — a withheld clip that says nothing reads as a bug. */
-function clipRefusalReason(refusal) {
-	switch (refusal) {
-		case "no-enabled-stream": return "the camera has no enabled profile slot to dial";
-		case "no-h264-stream": return "every enabled profile is H.265 — the seam copies and never transcodes, so the clip ring serves this camera";
-		case "no-resolution": return "no enabled profile declares a resolution, so no slot could be sized";
-	}
-}
-function hasUsableResolution(entry) {
-	const r = entry.resolution;
-	return r !== void 0 && r.width > 0 && r.height > 0;
-}
-/** Publishers spell H.265 four ways; the same normalisation the broker uses. */
-function normaliseCodec(codec) {
-	return (codec ?? "").toLowerCase().replace(/[.\s-]/g, "");
-}
-//#endregion
-//#region src/notification-center/fmp4-clip/fmp4-clip-service.ts
-/**
-* Cut a notification clip from the LIVE fMP4 fragment seam — roadmap 4b, the
-* second consumer [D80](../../../../../../docs/decisions/adr-0080.md) named and
-* deliberately did not build.
-*
-* ## What changes for the operator
-*
-* The clip ring path (`streamBroker.renderPreBufferClip`, D32) re-encodes to
-* 480 px wide, 5 fps, 2× speed, `-an`. That is a thumbnail with motion. This
-* one is `-c:v copy`: the camera's own H.264 at its own resolution and frame
-* rate, real time, with in-band AAC — a clip you can actually watch.
-*
-* ## Where the consumer lives, and why it is HERE
-*
-* [D84](../../../../../../docs/decisions/adr-0084.md) established the answer
-* the hard way: a `Fmp4FragmentPlane` is a live object, so it cannot cross a
-* process boundary and no capability can carry one. The first consumer — the
-* HKSV delegate — is `hub-only` in its own runner and therefore spawns its OWN
-* child against the broker's restream, taking the transport from
-* `@camstack/types/node`. The notification centre is in yet another runner
-* (`addon-post-analysis`), so it does exactly the same thing. The alternative,
-* a `streamBroker.renderFragmentClip` cap method, is a `*.cap.ts` change plus
-* codegen plus a `@camstack/system` train to move bytes that are already
-* reachable over RTSP.
-*
-* ## ON-DEMAND, and what that costs — read this before "fixing" the pre-roll
-*
-* HKSV's prebuffer exists because its ffmpeg never stops. That is affordable
-* (measured: 0.7 % of a core, 30 MB RSS on the copy branch) but it is still a
-* PERMANENT child per camera, and a notification clip does not justify one on
-* every camera that has a rule. So this child is spawned at the event and
-* killed when the clip is assembled.
-*
-* **This path has NO pre-roll, and the guess that it might have had one was
-* wrong.** `RtspRestreamer` bursts the current GOP to a joining session, so it
-* looked as though the first fragment would open before we asked for it.
-* Measured against 615's 720p slot from outside the hub — the exact argv, the
-* real child, the real plane:
-*
-* | dial → init | fragments | media duration | wall clock | bytes |
-* | --- | --- | --- | --- | --- |
-* | 4479 ms | 3 × ~141 KB | 12.03 s | 12.42 s | 425 KB |
-*
-* Media duration and wall clock differ by 387 ms — the dial. Nothing from
-* before the spawn survives into the file: ffmpeg discards up to the first key
-* frame it can open on, which is also why the first fragment costs one full
-* key-frame interval. So `preRollSec` is NOT honoured here; the fallback's is.
-*
-* A real pre-roll needs a plane that was already running. The seam is ready for
-* one — the assembler takes any `Fmp4Subscription`, including a prebuffered one
-* — and it is queued rather than built, because a warm child per
-* camera-with-a-clip-rule is a new permanent cost and that is an operator
-* decision, not an implementation one.
-*
-* ## Fail-closed, and always with the reason
-*
-* Every refusal returns a code AND a sentence, and the caller falls back to the
-* clip ring. An H.265 camera, a broker on another node, an ffmpeg that will not
-* start: each is a `debug`/`warn` line carrying `tags: { deviceId }`, because a
-* clip that silently changed shape per camera is exactly the thing nobody can
-* diagnose from an attachment.
-*/
-/**
-* The fragment length asked of the muxer.
-*
-* Deliberately SHORT. `-min_frag_duration` can only ever DELAY a cut past a key
-* frame (D80), so asking for 1 s against a 4 s key-frame grid yields exactly the
-* source cadence — the finest granularity the stream can give. Asking for the
-* grid's own length is the D84 bug: the deadline lands on the same instant as
-* the key frame, loses, and DOUBLES every fragment.
-*/
-var CLIP_FRAGMENT_MS = 1e3;
-/**
-* How long the child may produce nothing before it is declared dead.
-*
-* Shorter than the transport's 12 s default on purpose: this runs inside the
-* notification drain, and the commonest cause of a stall here is a restream url
-* that is not reachable from THIS runner (the broker for that camera lives on
-* another node and its url is loopback). Paying 12 s per notification for that
-* is worse than falling back sooner.
-*
-* NOT shorter than 9 s, and that bound is measured rather than chosen: the init
-* segment cannot be written before ffmpeg has a key frame to open on, and 615
-* took **4479 ms** over the LAN on a 4.0 s grid. A camera on an 8 s grid needs
-* roughly twice that, so anything under ~9 s would declare healthy cameras dead
-* and cool them down for ten minutes.
-*/
-var CLIP_FIRST_UNIT_TIMEOUT_MS = 9e3;
-/** Slack past the requested window for one more key-frame interval to land. */
-var CLIP_CADENCE_SLACK_MS = 1e4;
-/** The whole attempt, spawn included. A notification is not worth more. */
-var CLIP_TOTAL_BUDGET_MS = 25e3;
-/**
-* Ceiling on the assembled file.
-*
-* The degrade engine DROPS an over-`maxBytes` attachment rather than degrading
-* it to a link, and the SMALLEST cap declared today is pushover's 5 MiB. So the
-* cap is that, not something roomier: a clip truncated to four seconds and
-* delivered beats a whole one the engine throws away, and the truncation is
-* marked either way. A 1080p copy clip of a few seconds is 1-2 MB, so this only
-* ever bites a 4K-only camera.
-*/
-var CLIP_MAX_BYTES = 5 * 1024 * 1024;
-/**
-* How long a camera is left alone after the seam failed to start on it.
-*
-* Without this, a camera whose broker is on another node pays
-* {@link CLIP_FIRST_UNIT_TIMEOUT_MS} on EVERY notification, forever. The
-* cooldown is announced once and the suppressed attempts are counted into the
-* next line, the same shape the NC's own rate-limited lines use.
-*/
-var CLIP_FAILURE_COOLDOWN_MS = 10 * 6e4;
-/** ffmpeg on `PATH`, as every other spawn in this repo resolves it. */
-var FFMPEG_BINARY = "ffmpeg";
-var Fmp4ClipService = class {
-	deps;
-	cooldowns = /* @__PURE__ */ new Map();
-	inFlight = /* @__PURE__ */ new Set();
-	transport = null;
-	transportProbed = false;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	/**
-	* Cut one clip. Never throws — every failure is a `{ ok: false }` with a
-	* code and a sentence, because the caller's only correct response is to fall
-	* back to the clip ring.
-	*
-	* The DECLINE IS LOGGED HERE and not at the call site, so there is exactly one
-	* place that can forget to. Two cameras silently attaching two different kinds
-	* of clip is precisely what an operator cannot diagnose from a phone, and the
-	* question is always per-camera — hence `tags: { deviceId }` on every line.
-	*/
-	async renderClip(request) {
-		const result = await this.attempt(request);
-		if (!result.ok) this.deps.logger.debug("nc clip: the fMP4 seam declined — the clip ring serves this one", {
-			tags: { deviceId: request.deviceId },
-			meta: {
-				code: result.code,
-				reason: result.reason
-			}
-		});
-		return result;
-	}
-	async attempt(request) {
-		const now = this.deps.now ?? Date.now;
-		const log = this.deps.logger;
-		const deviceId = request.deviceId;
-		const cooling = this.cooldowns.get(deviceId);
-		if (cooling !== void 0 && cooling.until > now()) {
-			cooling.suppressed += 1;
-			return {
-				ok: false,
-				code: "cooldown",
-				reason: `the seam failed to start on this camera and is suppressed for another ${Math.round((cooling.until - now()) / 1e3)}s`
-			};
-		}
-		if (this.inFlight.has(deviceId)) return {
-			ok: false,
-			code: "busy",
-			reason: "a seam clip for this camera is already being cut"
-		};
-		const transport = await this.loadTransport();
-		if (transport === null) return {
-			ok: false,
-			code: "transport-missing",
-			reason: "this host has no fMP4 fragment transport — @camstack/types predates it"
-		};
-		const entries = await this.readEntries(deviceId);
-		if (entries === null || entries.length === 0) return {
-			ok: false,
-			code: "no-entries",
-			reason: "the camera reported no profile RTSP entries"
-		};
-		const choice = pickClipSource(entries);
-		if (!choice.ok) return {
-			ok: false,
-			code: choice.refusal,
-			reason: clipRefusalReason(choice.refusal)
-		};
-		const source = choice.source;
-		this.inFlight.add(deviceId);
-		const plane = new transport.Fmp4FragmentPlane(log.child("nc-clip-plane"));
-		const child = new transport.Fmp4FragmentChild({
-			logger: log.child("nc-clip-fmp4"),
-			ffmpegBinaryPath: this.deps.ffmpegBinaryPath ?? FFMPEG_BINARY,
-			spawnFn: this.deps.spawnFn ?? node_child_process.spawn,
-			firstUnitTimeoutMs: CLIP_FIRST_UNIT_TIMEOUT_MS
-		}, {
-			sourceId: `nc-clip/${deviceId}`,
-			deviceId,
-			fragmentMs: CLIP_FRAGMENT_MS,
-			invocation: buildClipInvocation(source.url),
-			plane
-		});
-		const startedAt = now();
-		try {
-			await child.start();
-		} catch (err) {
-			this.noteStartFailure(deviceId, err);
-			await child.stop().catch(() => void 0);
-			plane.dispose();
-			this.inFlight.delete(deviceId);
-			return {
-				ok: false,
-				code: "child-failed",
-				reason: `ffmpeg produced no fMP4 initialisation segment: ${errText(err)}`
-			};
-		}
-		this.clearCooldown(deviceId);
-		const subscribedAt = now();
-		const postRollMs = Math.max(0, request.postRollSec) * 1e3;
-		const collectUntilMs = Math.max(request.aroundMs, subscribedAt) + postRollMs;
-		const budgetEnd = startedAt + CLIP_TOTAL_BUDGET_MS;
-		const deadlineMs = Math.min(collectUntilMs + CLIP_CADENCE_SLACK_MS, budgetEnd);
-		try {
-			const outcome = await assembleFmp4Clip({
-				subscription: plane.subscribe({ tag: `nc-clip/${deviceId}` }),
-				collectUntilMs,
-				deadlineMs,
-				maxBytes: CLIP_MAX_BYTES,
-				...this.deps.now !== void 0 ? { now: this.deps.now } : {},
-				...this.deps.setTimeoutFn !== void 0 ? { setTimeoutFn: this.deps.setTimeoutFn } : {}
-			});
-			if (!outcome.ok) {
-				log.warn("nc clip: the fragment seam produced nothing usable — falling back to the clip ring", {
-					tags: { deviceId },
-					meta: {
-						refusal: outcome.refusal,
-						reason: clipAssemblyRefusalReason(outcome.refusal),
-						brokerId: source.brokerId
-					}
-				});
-				return {
-					ok: false,
-					code: outcome.refusal,
-					reason: clipAssemblyRefusalReason(outcome.refusal)
-				};
-			}
-			const clip = outcome.clip;
-			log.info("nc clip: cut from the fMP4 seam", {
-				tags: { deviceId },
-				meta: {
-					brokerId: source.brokerId,
-					profile: source.profile,
-					resolution: `${source.width}x${source.height}`,
-					fragments: clip.fragments,
-					bytes: clip.bytes.length,
-					arrivalSpanMs: clip.arrivalSpanMs,
-					truncated: clip.truncated,
-					stoppedBecause: clip.stoppedBecause,
-					dialLatencyMs: subscribedAt - startedAt,
-					eventToDialMs: subscribedAt - request.aroundMs
-				}
-			});
-			return {
-				ok: true,
-				clip,
-				source
-			};
-		} finally {
-			await child.stop().catch(() => void 0);
-			plane.dispose();
-			this.inFlight.delete(deviceId);
-		}
-	}
-	async loadTransport() {
-		if (this.transportProbed) return this.transport;
-		this.transportProbed = true;
-		const load = this.deps.loadTransport ?? defaultLoadTransport;
-		try {
-			this.transport = await load();
-		} catch (err) {
-			this.transport = null;
-			this.deps.logger.warn("nc clip: this host carries no fMP4 fragment transport — every clip falls back to the ring", { meta: { error: errText(err) } });
-		}
-		return this.transport;
-	}
-	async readEntries(deviceId) {
-		try {
-			return await this.deps.listProfileEntries(deviceId);
-		} catch (err) {
-			this.deps.logger.debug("nc clip: could not read the camera profile entries", {
-				tags: { deviceId },
-				meta: { error: errText(err) }
-			});
-			return null;
-		}
-	}
-	noteStartFailure(deviceId, err) {
-		const now = this.deps.now ?? Date.now;
-		this.cooldowns.set(deviceId, {
-			until: now() + CLIP_FAILURE_COOLDOWN_MS,
-			suppressed: 0
-		});
-		this.deps.logger.warn("nc clip: the fMP4 child would not start — this camera falls back to the clip ring for now", {
-			tags: { deviceId },
-			meta: {
-				error: errText(err),
-				cooldownMs: CLIP_FAILURE_COOLDOWN_MS
-			}
-		});
-	}
-	clearCooldown(deviceId) {
-		const previous = this.cooldowns.get(deviceId);
-		if (previous === void 0) return;
-		this.cooldowns.delete(deviceId);
-		this.deps.logger.info("nc clip: the fMP4 seam recovered on this camera", {
-			tags: { deviceId },
-			meta: { suppressedAttempts: previous.suppressed }
-		});
-	}
-};
-/**
-* The invocation, minus the sink the child owns.
-*
-* `copy` is the entire point (see the class docblock) and the audio IS encoded,
-* because camera microphones are G.711/PCM and an mp4 attachment has to carry
-* AAC to play anywhere. `-c:a aac` with no audio stream in the source is a
-* no-op in ffmpeg's default stream selection, so a silent camera needs no
-* second branch.
-*/
-function buildClipInvocation(url) {
-	return {
-		logLevel: "error",
-		decodeHwAccel: null,
-		input: {
-			url,
-			rtspTransport: "tcp",
-			analyzeDurationUs: 1e6,
-			probeSizeBytes: 1e6
-		},
-		video: { kind: "copy" },
-		audio: {
-			kind: "encode",
-			codec: "aac",
-			bitrateKbps: 64,
-			sampleRateHz: 24e3,
-			channels: 1
-		},
-		threadCount: 0,
-		outputArgs: []
-	};
-}
-async function defaultLoadTransport() {
-	const mod = await Promise.resolve().then(() => require("../node-CnEKzHgS.js"));
-	if (typeof mod.Fmp4FragmentChild !== "function" || typeof mod.Fmp4FragmentPlane !== "function") return null;
-	return {
-		Fmp4FragmentChild: mod.Fmp4FragmentChild,
-		Fmp4FragmentPlane: mod.Fmp4FragmentPlane
-	};
-}
-function errText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/label-utils.ts
 /**
 * Every macro class the pipeline can carry on a detection. A `label` exists to
@@ -2562,20 +2010,6 @@ function bestMatchingKindPreference(signal, ownerKind) {
 //#endregion
 //#region src/notification-center/dispatcher.ts
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
-/** GIF and MP4 are the same cut in two containers — one render request each. */
-var FOOTAGE_FORMATS = [{
-	flag: "mediaGif",
-	format: "gif",
-	mediaType: "gif",
-	mime: "image/gif",
-	name: "event.gif"
-}, {
-	flag: "mediaClip",
-	format: "mp4",
-	mediaType: "video",
-	mime: "video/mp4",
-	name: "event.mp4"
-}];
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -2959,31 +2393,33 @@ var NcDispatcher = class {
 				} : still);
 			} else out.push(still);
 		}
-		for (const want of FOOTAGE_FORMATS) {
-			if (entry.payload[want.flag] !== true || !this.deps.renderFootage) continue;
-			try {
-				const rendered = await this.deps.renderFootage({
-					deviceId: entry.payload.subject.deviceId,
-					aroundMs: entry.payload.subject.timestamp,
-					format: want.format,
-					...entry.payload.mediaClipPreRollSec !== void 0 ? { preRollSec: entry.payload.mediaClipPreRollSec } : {},
-					...entry.payload.mediaClipPostRollSec !== void 0 ? { postRollSec: entry.payload.mediaClipPostRollSec } : {},
-					...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {},
-					...entry.payload.mediaClipSpeed !== void 0 ? { speed: entry.payload.mediaClipSpeed } : {}
-				});
-				if (rendered !== null && rendered.byteLength > 0) {
-					const bytes = new Uint8Array(rendered.byteLength);
-					bytes.set(rendered);
-					out.push({
-						mediaType: want.mediaType,
-						bytes,
-						mime: want.mime,
-						name: want.name
-					});
-				}
-			} catch (err) {
-				this.notePendingFootage(entry, err, want.format === "gif" ? "gif" : "clip");
-			}
+		const wantGif = entry.payload.mediaGif === true;
+		const wantMp4 = entry.payload.mediaClip === true;
+		if ((wantGif || wantMp4) && this.deps.renderEventMedia !== void 0) try {
+			const media = await this.deps.renderEventMedia({
+				deviceId: entry.payload.subject.deviceId,
+				aroundMs: entry.payload.subject.timestamp,
+				wantGif,
+				wantMp4,
+				preRollSec: entry.payload.mediaClipPreRollSec ?? 4,
+				postRollSec: entry.payload.mediaClipPostRollSec ?? 6,
+				...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {},
+				...entry.payload.mediaClipSpeed !== void 0 ? { speed: entry.payload.mediaClipSpeed } : {}
+			});
+			if (media.gif !== null && media.gif.byteLength > 0) out.push({
+				mediaType: "gif",
+				bytes: copyBytes(media.gif),
+				mime: "image/gif",
+				name: "event.gif"
+			});
+			if (media.mp4 !== null && media.mp4.byteLength > 0) out.push({
+				mediaType: "video",
+				bytes: copyBytes(media.mp4),
+				mime: "video/mp4",
+				name: "event.mp4"
+			});
+		} catch (err) {
+			this.notePendingFootage(entry, err, wantMp4 ? "clip" : "gif");
 		}
 		return out;
 	}
@@ -2994,8 +2430,8 @@ var NcDispatcher = class {
 		try {
 			const points = (await this.deps.getZonePolygons?.(deviceId, zoneIds) ?? []).flat();
 			if (points.length === 0) return null;
-			const { default: sharp$7 } = await import("sharp");
-			const img = sharp$7(Buffer.from(jpeg));
+			const { default: sharp$8 } = await import("sharp");
+			const img = sharp$8(Buffer.from(jpeg));
 			const meta = await img.metadata();
 			const W = meta.width ?? 0;
 			const H = meta.height ?? 0;
@@ -3152,6 +2588,18 @@ function paramNumber(params, key) {
 function clampPriority(priority) {
 	return Math.max(1, Math.min(5, Math.round(priority)));
 }
+/**
+* A copy backed by its own `ArrayBuffer`.
+*
+* The attachment types demand `Uint8Array<ArrayBuffer>`, and a view handed over
+* by an assembler may sit on a shared buffer. Copying is cheap next to the
+* encode that produced it and removes a whole class of aliasing question.
+*/
+function copyBytes(bytes) {
+	const out = new Uint8Array(bytes.byteLength);
+	out.set(bytes);
+	return out;
+}
 //#endregion
 //#region src/notification-center/occupancy-watcher.ts
 /** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
@@ -4008,6 +3456,414 @@ function rowToEntry$1(id, data) {
 	};
 }
 //#endregion
+//#region src/notification-center/event-intake.ts
+/** Object-event insert (movement-state transitions + zone crossings). */
+function incomingFromObjectEvent(event) {
+	return {
+		subject: subjectFromObjectEvent(event),
+		kind: "object-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: { eventId: event.id }
+		})
+	};
+}
+/** `TrackCloser.closeExpired` — the ONE close point. */
+function incomingFromTrack(track, info) {
+	return {
+		subject: subjectFromTrack(track, info),
+		kind: "track-end",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: track.deviceId },
+			meta: { trackId: track.trackId }
+		})
+	};
+}
+/** Sensor-event persist (one row per linked camera). */
+function incomingFromSensorEvent(event) {
+	return {
+		subject: subjectFromSensorEvent(event),
+		kind: "device-event",
+		origin: "sensor",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				sensorEventId: event.id,
+				kind: event.kind
+			}
+		})
+	};
+}
+/** Audio-event persist (classified episode). */
+function incomingFromAudioEvent(event) {
+	return {
+		subject: subjectFromAudioEvent(event),
+		kind: "audio-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				audioEventId: event.id,
+				class: event.classification?.className
+			}
+		})
+	};
+}
+/** Package object-event persist (delivered / picked-up). */
+function incomingFromPackageEvent(event, phase) {
+	return {
+		subject: subjectFromPackageEvent(event, phase),
+		kind: "package-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				eventId: event.id,
+				phase
+			}
+		})
+	};
+}
+/** A committed ZoneAnalytics occupancy edge. */
+function incomingFromOccupancyEdge(edge) {
+	return {
+		subject: subjectFromOccupancyEvent(edge),
+		kind: "occupancy-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: edge.deviceId },
+			meta: {
+				zoneId: edge.zoneId ?? "@frame",
+				className: edge.className ?? "@all",
+				count: edge.count,
+				threshold: edge.threshold,
+				occupied: edge.occupied
+			}
+		})
+	};
+}
+/** Re-stamp a live-producer envelope as a boot-reconcile replay of the same
+*  record — same subject, honest origin in the log. */
+function asReconcile(event) {
+	return {
+		...event,
+		origin: "reconcile"
+	};
+}
+/**
+* The delivery an intake kind rides. `object-event` and `audio-event` both ride
+* `immediate` (classified audio has no delivery of its own — it is gated by the
+* audio-class opt-in instead); `occupancy-event` rides `device-event`.
+*
+* Extracted from the centre so the tester can tell an operator which rules a
+* given simulated trigger will even be considered against, without evaluating.
+*/
+function deliveryForKind(kind) {
+	if (kind === "object-event" || kind === "audio-event") return "immediate";
+	if (kind === "occupancy-event") return "device-event";
+	return kind;
+}
+//#endregion
+//#region src/notification-center/test-event.ts
+/** Normalized 0..1 rectangle, top-left origin — the subject bbox space. */
+var BboxSchema = require_dist.object({
+	x: require_dist.number().min(0).max(1),
+	y: require_dist.number().min(0).max(1),
+	w: require_dist.number().min(0).max(1),
+	h: require_dist.number().min(0).max(1)
+});
+/**
+* Which trigger to simulate. One value per {@link NcSubjectKind}, because the
+* kind is what decides the delivery a rule must declare to be a candidate at
+* all — picking the wrong one is the single most common reason an operator's
+* rule "does not fire", and making it an explicit choice is half the point of
+* the tester.
+*/
+var TriggerSchema = require_dist._enum([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event",
+	"audio-event",
+	"occupancy-event"
+]);
+/**
+* What the operator typed. Every field maps onto exactly one field of
+* {@link NcRuleSubject} — there is no test-only condition input, because a
+* condition the tester could set and a real record could not is a condition the
+* test result would lie about.
+*/
+var NcTestEventInputSchema = require_dist.object({
+	trigger: TriggerSchema,
+	/** The CAMERA the event is attributed to (what a notification shows). */
+	deviceId: require_dist.number().int(),
+	/** DEVICE-EVENT: the linked device whose state changed — the contact, the
+	*  button, the doorbell — when that is not the camera. */
+	sourceDeviceId: require_dist.number().int().optional(),
+	/** Detection class ids, from the NC taxonomy (`person`, `car`, `audio-…`). */
+	classNames: require_dist.array(require_dist.string()).default([]),
+	/** Collapsed display label — an identity name, a plate, a subclass. */
+	label: require_dist.string().optional(),
+	/** Detection confidence [0,1]. ABSENT is meaningful: a `minConfidence`
+	*  condition FAILS on an absent confidence, and the tester must be able to
+	*  reproduce that. */
+	confidence: require_dist.number().min(0).max(1).optional(),
+	/** Identity/plate MATCH confidence — distinct from `confidence`. */
+	labelConfidence: require_dist.number().min(0).max(1).optional(),
+	/** Key-event importance [0,1] (track-end only, in practice). */
+	importance: require_dist.number().min(0).max(1).optional(),
+	/** Track lifespan in seconds (track-end only). */
+	dwellSeconds: require_dist.number().min(0).optional(),
+	/** Admin zone ids the subject is in (object) / visited (track). */
+	zones: require_dist.array(require_dist.string()).default([]),
+	/** OBJECT-EVENT: simulate a confirmed zone crossing. */
+	crossing: require_dist.object({
+		zoneId: require_dist.string(),
+		direction: require_dist._enum(["enter", "exit"])
+	}).optional(),
+	/** DEVICE-EVENT: the taxonomy kind id (`doorbell`, `contact`, `button`, …). */
+	sensorKind: require_dist.string().optional(),
+	/** DEVICE-EVENT: the raw device event-type token, when the source is an
+	*  event-emitter slice. */
+	eventType: require_dist.string().optional(),
+	/** PACKAGE-EVENT: which lifecycle phase. */
+	packagePhase: require_dist._enum(["delivered", "picked-up"]).optional(),
+	/** Detection provenance. Absent = `pipeline` (what a record with no stamped
+	*  source reads as). */
+	source: require_dist._enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"audio"
+	]).optional(),
+	/** Normalized bbox — feeds `customZones`, AND is what lets the still be
+	*  cropped / boxed the way the rule's media policy asks. */
+	bbox: BboxSchema.optional(),
+	/** OCCUPANCY-EVENT: the committed count edge. */
+	occupancy: require_dist.object({
+		zoneId: require_dist.string().optional(),
+		zoneName: require_dist.string().optional(),
+		className: require_dist.string().optional(),
+		count: require_dist.number().int().min(0),
+		previousCount: require_dist.number().int().min(0).default(0),
+		occupied: require_dist.boolean(),
+		threshold: require_dist.number().int().min(1)
+	}).optional(),
+	/** The instant the event happened. Absent = now. Set it to test a schedule
+	*  condition without waiting for the hour. */
+	timestamp: require_dist.number().int().optional(),
+	/** Evaluate only this rule (what the per-rule Test button sends). */
+	onlyRuleId: require_dist.string().optional(),
+	bypassCooldown: require_dist.boolean().default(false),
+	bypassMute: require_dist.boolean().default(false),
+	/** Run the matched rule's `onTrigger` sequences. OFF by default: a test must
+	*  not open a gate the operator did not ask to open. */
+	runActions: require_dist.boolean().default(false),
+	/** Where the still comes from. `live` takes a snapshot of the camera NOW;
+	*  `none` sends the notification without one. */
+	still: require_dist._enum(["live", "none"]).default("live")
+});
+/** Per-rule verdict, as the tester reports it. */
+var NcTestEventRuleOutcomeSchema = require_dist.object({
+	ruleId: require_dist.string(),
+	ruleName: require_dist.string(),
+	matched: require_dist.boolean(),
+	failedCondition: require_dist.string().optional(),
+	matchedOn: require_dist.array(require_dist.string()).optional(),
+	cooldown: require_dist._enum([
+		"n/a",
+		"clear",
+		"suppressed",
+		"bypassed"
+	]),
+	enqueued: require_dist.number().int(),
+	targetIds: require_dist.array(require_dist.string())
+});
+var NcTestEventResultSchema = require_dist.object({
+	/** The synthetic record id. It is `synthetic:<uuid>` and it is what to grep
+	*  for in the logs, in the outbox and in the delivery history. */
+	recordId: require_dist.string(),
+	/** Always `synthetic` — the marker the whole path carried. */
+	origin: require_dist.literal("synthetic"),
+	/** The delivery the chosen trigger rides. A rule declaring anything else was
+	*  never a candidate, which is the answer to most "it did not fire". */
+	delivery: require_dist.string(),
+	candidates: require_dist.number().int(),
+	outcomes: require_dist.array(NcTestEventRuleOutcomeSchema),
+	/** What the still ended up being. `unattachable` means the chosen TRIGGER
+	*  cannot carry one at all — a device-event notification has no media owner,
+	*  live or synthetic — and that is a property of production, not of the test. */
+	still: require_dist._enum([
+		"live",
+		"none",
+		"unavailable",
+		"unattachable"
+	]),
+	/** Everything the operator has to know to read the result honestly. */
+	notes: require_dist.array(require_dist.string()),
+	droppedBy: require_dist.string().optional()
+});
+/** The id shape every synthetic record carries. One prefix, everywhere. */
+var SYNTHETIC_ID_PREFIX = "synthetic:";
+/** True for a record id this module minted. Used by the media shim. */
+function isSyntheticId(id) {
+	return id.startsWith(SYNTHETIC_ID_PREFIX);
+}
+/**
+* Whether a subject of this kind can carry a still AT ALL, in production.
+*
+* The attachment ladder resolves media by OWNER, and `buildEntries` freezes an
+* owner onto the payload only for the kinds that have one: an `eventId` for
+* object/package events, a `trackId` for track-scoped ones. A device-event, an
+* audio episode and an occupancy edge freeze neither — so those notifications
+* ship text-only today, and a tester that attached an image to them would be
+* advertising a feature that does not exist.
+*/
+function triggerCanCarryStill(kind) {
+	return kind === "object-event" || kind === "package-event" || kind === "track-end";
+}
+/**
+* Build the synthetic envelope. Pure: same input + same id + same clock ⇒ same
+* event, so the red-green test can assert that this subject and a
+* producer-built one are indistinguishable.
+*/
+function buildSyntheticEvent(input, recordId, now) {
+	const kind = input.trigger;
+	const timestamp = input.timestamp ?? now;
+	const trackScoped = kind === "object-event" || kind === "track-end";
+	return {
+		subject: {
+			kind,
+			recordId,
+			deviceId: input.deviceId,
+			...input.sourceDeviceId !== void 0 && input.sourceDeviceId !== input.deviceId ? { sourceDeviceId: input.sourceDeviceId } : {},
+			timestamp,
+			classNames: input.classNames,
+			...input.label !== void 0 ? { label: input.label } : {},
+			...input.confidence !== void 0 ? { confidence: input.confidence } : {},
+			zones: input.zones,
+			...trackScoped ? { trackId: recordId } : {},
+			source: input.source ?? (kind === "device-event" ? "sensor" : "pipeline"),
+			...input.importance !== void 0 ? { importance: input.importance } : {},
+			...input.dwellSeconds !== void 0 ? { dwellSeconds: input.dwellSeconds } : {},
+			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
+			...input.sensorKind !== void 0 ? { sensorKind: input.sensorKind } : {},
+			...input.eventType !== void 0 ? { eventType: input.eventType } : {},
+			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
+			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
+			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
+			...input.occupancy !== void 0 ? { occupancy: {
+				...input.occupancy.zoneId !== void 0 ? { zoneId: input.occupancy.zoneId } : {},
+				...input.occupancy.zoneName !== void 0 ? { zoneName: input.occupancy.zoneName } : {},
+				...input.occupancy.className !== void 0 ? { className: input.occupancy.className } : {},
+				count: input.occupancy.count,
+				previousCount: input.occupancy.previousCount,
+				occupied: input.occupancy.occupied,
+				threshold: input.occupancy.threshold
+			} } : {}
+		},
+		kind,
+		origin: "synthetic",
+		controls: {
+			...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {},
+			bypassCooldown: input.bypassCooldown,
+			bypassMute: input.bypassMute,
+			runActions: input.runActions
+		},
+		log: () => ({
+			tags: { deviceId: input.deviceId },
+			meta: {
+				eventId: recordId,
+				synthetic: true,
+				trigger: input.trigger,
+				...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {}
+			}
+		})
+	};
+}
+/**
+* Turn one live JPEG into the media set the dispatcher's ladders look for.
+*
+* Every entry is the SAME photograph, differing only in how it was cut — which
+* is exactly what the ladders mean by their kind names, so nothing here claims
+* a frame it does not have:
+*
+*   - `fullFrame` / `keyFrame` / `firstFrame` — the clean scene, verbatim.
+*   - `fullFrameBoxed` — the clean scene with the operator's bbox drawn on it.
+*   - `crop` / `thumbnail` — that bbox, cut out.
+*
+* With NO bbox only the clean-scene kinds are produced, so a rule asking for
+* `frame: 'cropped'` correctly finds nothing rather than being handed a whole
+* scene it did not ask for. sharp failures degrade the same way: the clean
+* scene always survives.
+*/
+async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
+	const base64 = Buffer.from(jpeg).toString("base64");
+	const clean = (kind) => ({
+		key: `${SYNTHETIC_ID_PREFIX}${kind}`,
+		kind,
+		base64,
+		sizeBytes: jpeg.byteLength,
+		timestamp
+	});
+	const files = [
+		clean("fullFrame"),
+		clean("keyFrame"),
+		clean("firstFrame")
+	];
+	if (bbox === void 0) return files;
+	try {
+		const { default: sharp$7 } = await import("sharp");
+		const meta = await sharp$7(Buffer.from(jpeg)).metadata();
+		const W = meta.width ?? 0;
+		const H = meta.height ?? 0;
+		if (W === 0 || H === 0) return files;
+		const left = Math.max(0, Math.min(W - 1, Math.floor(bbox.x * W)));
+		const top = Math.max(0, Math.min(H - 1, Math.floor(bbox.y * H)));
+		const width = Math.max(1, Math.min(W - left, Math.ceil(bbox.w * W)));
+		const height = Math.max(1, Math.min(H - top, Math.ceil(bbox.h * H)));
+		const cropBuf = await sharp$7(Buffer.from(jpeg)).extract({
+			left,
+			top,
+			width,
+			height
+		}).jpeg({ quality: 85 }).toBuffer();
+		const cropB64 = cropBuf.toString("base64");
+		files.push({
+			key: `${SYNTHETIC_ID_PREFIX}crop`,
+			kind: "crop",
+			base64: cropB64,
+			sizeBytes: cropBuf.byteLength,
+			timestamp
+		}, {
+			key: `${SYNTHETIC_ID_PREFIX}thumbnail`,
+			kind: "thumbnail",
+			base64: cropB64,
+			sizeBytes: cropBuf.byteLength,
+			timestamp
+		});
+		const stroke = Math.max(2, Math.round(Math.min(W, H) / 240));
+		const overlay = Buffer.from(`<svg width="${W}" height="${H}"><rect x="${left}" y="${top}" width="${width}" height="${height}" fill="none" stroke="#22d3ee" stroke-width="${stroke}"/></svg>`);
+		const boxedBuf = await sharp$7(Buffer.from(jpeg)).composite([{
+			input: overlay,
+			top: 0,
+			left: 0
+		}]).jpeg({ quality: 85 }).toBuffer();
+		files.push({
+			key: `${SYNTHETIC_ID_PREFIX}fullFrameBoxed`,
+			kind: "fullFrameBoxed",
+			base64: boxedBuf.toString("base64"),
+			sizeBytes: boxedBuf.byteLength,
+			timestamp
+		});
+	} catch {
+		return files;
+	}
+	return files;
+}
+//#endregion
 //#region src/notification-center/action-buttons.ts
 /** Sequence names the rule actually declares. A button may only name one. */
 function declaredSequences(actions) {
@@ -5309,6 +5165,16 @@ var WATERMARK_EVERY_TICKS = 15;
 var OUTBOX_RETENTION_MS = 168 * 36e5;
 var TEST_RULE_MAX_RESULTS = 200;
 /**
+* How long a synthetic injection's live snapshot stays in RAM.
+*
+* Long enough to cover the drain tick plus the first handful of outbox
+* backoffs (5 s doubling to a 300 s cap), short enough that a forgotten test
+* cannot hold a JPEG for the life of the process. A row still retrying after
+* this loses its picture and ships text-only — the same degradation a real
+* event gets when its media never landed.
+*/
+var SYNTHETIC_MEDIA_TTL_MS = 10 * 6e4;
+/**
 * The className every durable package event carries (mirrors
 * `PackageDropDetector.PACKAGE_EVENT_CLASS` — declared locally so the NC module
 * stays free of a cross-module import into the pipeline). Delivery events use
@@ -5422,6 +5288,13 @@ var NotificationCenter = class NotificationCenter {
 	alarmPanel = null;
 	/** In-memory cooldown map — seeded from persisted outbox rows on start. */
 	lastFiredAt = /* @__PURE__ */ new Map();
+	/**
+	* The live snapshot a synthetic injection took, held for as long as the
+	* outbox may still be retrying its rows. In RAM and only in RAM: a test that
+	* left a media blob behind would be a test that persisted something, which
+	* is the one thing the synthetic producer promises not to do.
+	*/
+	syntheticMedia = /* @__PURE__ */ new Map();
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
 	lastNoMatchReportAt = /* @__PURE__ */ new Map();
 	noMatchSuppressed = /* @__PURE__ */ new Map();
@@ -5579,6 +5452,11 @@ var NotificationCenter = class NotificationCenter {
 		this.dispatcher = new NcDispatcher({
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
+			getMediaForOwner: async (ownerKind, ownerId) => {
+				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
+				if (held !== void 0) return held.files;
+				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
+			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
 			isRuleTargetDisabled: (ruleId, targetId) => this.rules.isRuleTargetDisabled(ruleId, targetId),
 			snoozeGate: (input) => this.snoozeGate(input)
@@ -5657,19 +5535,157 @@ var NotificationCenter = class NotificationCenter {
 		this.evaluationActive = false;
 	}
 	/**
+	* Consume ONE event. THE entry point of the notification path — every
+	* producer arrives here and nothing else does.
+	*
+	* Fire-and-forget: the frame path must never await a notification. The
+	* evaluation is appended to the serialized chain, so consumption order is
+	* persist order (see {@link evalChain}).
+	*
+	* It persists nothing about the event itself. Whether a durable row exists is
+	* the PRODUCER's business — the tracker writes its tracks, the sensor ingest
+	* its rows, the synthetic tester nothing at all — and the only thing written
+	* from here on is the outbox row, which is the notification's own delivery
+	* queue and not a record of the event.
+	*/
+	consumeEvent(event) {
+		if (!this.evaluationActive) return;
+		this.scheduleEvaluation(event);
+	}
+	/**
+	* The same consumption, awaited, with the verdict returned. Identical code
+	* path — {@link consumeEvent} is this function with the report discarded — so
+	* a producer that reads the report is testing what the live producers do, not
+	* a parallel implementation of it.
+	*/
+	async consumeEventAndReport(event) {
+		if (!this.evaluationActive) return {
+			recordId: event.subject.recordId,
+			kind: event.kind,
+			delivery: deliveryForKind(event.kind),
+			origin: event.origin,
+			candidates: 0,
+			outcomes: [],
+			droppedBy: "evaluation-inactive"
+		};
+		const result = this.evalChain.then(() => this.evaluateAndEnqueue(event));
+		this.evalChain = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	/**
+	* The SYNTHETIC producer — an operator-driven event, through the whole path.
+	*
+	* It builds an envelope and calls {@link consumeEventAndReport}. That is the
+	* entire integration: no bypass, no second matcher, no shortcut into the
+	* dispatcher. What the operator receives on their phone was matched by
+	* `evaluateRule`, enqueued into the durable outbox, drained by the ordinary
+	* tick, given media by the ordinary ladders, degraded by the ordinary engine
+	* and delivered by the ordinary notifier.
+	*
+	* What it does NOT do is persist the event. No track row, no object-event
+	* row, no sensor row, no media blob — {@link syntheticMedia} is RAM with an
+	* expiry. The outbox row is the exception that proves the rule: it is the
+	* notification's delivery queue, not a record of the event, and it carries
+	* `synthetic: true` so it can never be mistaken for one.
+	*/
+	async injectTestEvent(input, deps = {}) {
+		const now = this.now();
+		this.pruneSyntheticMedia(now);
+		const recordId = `${SYNTHETIC_ID_PREFIX}${(0, node_crypto.randomUUID)()}`;
+		const event = buildSyntheticEvent(input, recordId, now);
+		const notes = [];
+		let still = "none";
+		if (!triggerCanCarryStill(event.kind)) {
+			still = "unattachable";
+			notes.push(`a ${event.kind} notification carries no still in production either — the payload freezes no media owner for this trigger, so nothing to attach is the honest result, not a limitation of the test`);
+		} else if (input.still === "live") {
+			const jpeg = await this.captureLiveStill(input.deviceId, deps);
+			if (jpeg === null) {
+				still = "unavailable";
+				notes.push("the camera returned no snapshot — the notification ships without a still");
+			} else {
+				const files = await deriveSyntheticMedia(jpeg, input.bbox, now);
+				this.syntheticMedia.set(recordId, {
+					files,
+					expiresAt: now + SYNTHETIC_MEDIA_TTL_MS
+				});
+				still = "live";
+				if (input.bbox === void 0) notes.push("no bbox was given, so only the clean scene exists — a rule asking for the subject crop finds nothing, exactly as it would for a real event with no crop stored");
+			}
+		}
+		if (input.bypassCooldown) notes.push("cooldown bypassed, and NOT consumed");
+		if (input.bypassMute) notes.push("per-camera notification mute bypassed");
+		if (!input.runActions) notes.push("the rule’s onTrigger sequences were NOT run (nothing was actuated)");
+		this.logger.info("synthetic event injected", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				eventId: recordId,
+				synthetic: true,
+				trigger: input.trigger,
+				classes: input.classNames,
+				zones: input.zones,
+				still,
+				...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {}
+			}
+		});
+		const report = await this.consumeEventAndReport(event);
+		if (report.droppedBy === "no-candidate-rule") notes.push(input.onlyRuleId !== void 0 ? "that rule is not enabled, or its delivery does not match this trigger" : `no enabled rule declares delivery "${report.delivery}"`);
+		if (report.droppedBy === "muted") notes.push("this camera is muted — nothing was evaluated. Re-run with the mute bypass to see the rule verdicts");
+		if (report.droppedBy === "evaluation-inactive") notes.push("this node does not run rule evaluation — inject on the post-processing node");
+		if (report.outcomes.every((o) => o.enqueued === 0) && report.outcomes.some((o) => o.matched)) notes.push("the rule matched but no row was enqueued — every target is opted out of this rule, or the rule addresses none");
+		return {
+			recordId,
+			origin: "synthetic",
+			delivery: report.delivery,
+			candidates: report.candidates,
+			outcomes: report.outcomes.map((o) => ({
+				ruleId: o.ruleId,
+				ruleName: o.ruleName,
+				matched: o.matched,
+				...o.failedCondition !== void 0 ? { failedCondition: o.failedCondition } : {},
+				...o.matchedOn !== void 0 ? { matchedOn: [...o.matchedOn] } : {},
+				cooldown: o.cooldown,
+				enqueued: o.enqueued,
+				targetIds: [...o.targetIds]
+			})),
+			still,
+			notes,
+			...report.droppedBy !== void 0 ? { droppedBy: report.droppedBy } : {}
+		};
+	}
+	/** One live frame, or null. Never throws into an injection. */
+	async captureLiveStill(deviceId, deps) {
+		const capture = deps.getSnapshot;
+		if (capture === void 0) return null;
+		try {
+			const shot = await capture(deviceId);
+			if (shot === null || shot.base64.length === 0) return null;
+			const buf = Buffer.from(shot.base64, "base64");
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.logger.warn("synthetic injection could not photograph the camera", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+			return null;
+		}
+	}
+	/** Drop expired synthetic stills. Called on every injection — there is no
+	*  timer, because the map is empty except while a test is in flight. */
+	pruneSyntheticMedia(now) {
+		for (const [id, held] of this.syntheticMedia) if (held.expiresAt <= now) this.syntheticMedia.delete(id);
+	}
+	/**
 	* Called at the object-event persist site, in the SAME moment as the
 	* durable insert. Fire-and-forget from the frame path (never blocks the
 	* pipeline); the boot reconcile covers a crash between persist and
 	* outbox insert.
 	*/
 	onObjectEventPersisted(event, _track) {
-		if (!this.evaluationActive) return;
 		if (packagePhaseOf(event) !== null) return;
-		const subject = subjectFromObjectEvent(event);
-		this.scheduleEvaluation(subject, "object-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: { eventId: event.id }
-		}));
+		this.consumeEvent(incomingFromObjectEvent(event));
 	}
 	/**
 	* Called from `TrackCloser.closeExpired` (the ONE close point, D-3) via
@@ -5678,12 +5694,7 @@ var NotificationCenter = class NotificationCenter {
 	* post-close promotions are picked up).
 	*/
 	onTrackClosed(track, _ownedMedia, info) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromTrack(track, info);
-		this.scheduleEvaluation(subject, "track-end", () => ({
-			tags: { deviceId: track.deviceId },
-			meta: { trackId: track.trackId }
-		}));
+		this.consumeEvent(incomingFromTrack(track, info));
 	}
 	/**
 	* Called at the SensorEvent persist site (`ingestSensorStateChange` — one row
@@ -5699,15 +5710,7 @@ var NotificationCenter = class NotificationCenter {
 	* before it.
 	*/
 	onSensorEventPersisted(event) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromSensorEvent(event);
-		this.scheduleEvaluation(subject, "device-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				sensorEventId: event.id,
-				kind: event.kind
-			}
-		}));
+		this.consumeEvent(incomingFromSensorEvent(event));
 	}
 	/**
 	* Called at the AUDIO-event persist site (`eventStore.insertAudio`), in the
@@ -5722,15 +5725,7 @@ var NotificationCenter = class NotificationCenter {
 	* durable guarantee begins at this hook, matching the device-event boundary.
 	*/
 	onAudioEventPersisted(event) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromAudioEvent(event);
-		this.scheduleEvaluation(subject, "audio-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				audioEventId: event.id,
-				class: event.classification?.className
-			}
-		}));
+		this.consumeEvent(incomingFromAudioEvent(event));
 	}
 	/**
 	* Called at the package object-event persist site (`PackageDropDetector` —
@@ -5739,15 +5734,7 @@ var NotificationCenter = class NotificationCenter {
 	* crash-gap reconcile re-covers them (routed by className in {@link reconcile}).
 	*/
 	onPackageEventPersisted(event, phase) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromPackageEvent(event, phase);
-		this.scheduleEvaluation(subject, "package-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				eventId: event.id,
-				phase
-			}
-		}));
+		this.consumeEvent(incomingFromPackageEvent(event, phase));
 	}
 	/**
 	* Feed one ZoneAnalytics occupancy snapshot into the debounced watcher
@@ -5783,18 +5770,7 @@ var NotificationCenter = class NotificationCenter {
 	* Public so a test / a future out-of-band edge source can drive it directly.
 	*/
 	onOccupancyEdge(edge) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromOccupancyEvent(edge);
-		this.scheduleEvaluation(subject, "occupancy-event", () => ({
-			tags: { deviceId: edge.deviceId },
-			meta: {
-				zoneId: edge.zoneId ?? "@frame",
-				className: edge.className ?? "@all",
-				count: edge.count,
-				threshold: edge.threshold,
-				occupied: edge.occupied
-			}
-		}));
+		this.consumeEvent(incomingFromOccupancyEdge(edge));
 	}
 	buildProvider() {
 		return {
@@ -5969,40 +5945,55 @@ var NotificationCenter = class NotificationCenter {
 		});
 	}
 	/** Append one evaluation to the serialized chain (see {@link evalChain}). */
-	scheduleEvaluation(subject, kind, logContext) {
+	scheduleEvaluation(event) {
 		this.evalChain = this.evalChain.then(async () => {
 			try {
-				await this.evaluateAndEnqueue(subject, kind);
+				await this.evaluateAndEnqueue(event);
 			} catch (err) {
-				const ctx = logContext();
+				const ctx = event.log();
 				this.logger.warn("rule evaluation failed", {
 					tags: ctx.tags,
 					meta: {
 						...ctx.meta,
-						kind,
+						kind: event.kind,
+						origin: event.origin,
 						error: String(err)
 					}
 				});
 			}
 		});
 	}
-	async evaluateAndEnqueue(subject, kind) {
-		if (this.deviceMutes.isMuted(subject.deviceId)) {
+	async evaluateAndEnqueue(event) {
+		const { subject, kind, origin } = event;
+		const controls = event.controls ?? {};
+		const outcomes = [];
+		const report = (extra = {}) => ({
+			recordId: subject.recordId,
+			kind,
+			delivery: deliveryForKind(kind),
+			origin,
+			candidates: 0,
+			outcomes,
+			...extra
+		});
+		if (this.deviceMutes.isMuted(subject.deviceId) && controls.bypassMute !== true) {
 			this.reportMutedDrop(subject, kind, this.now());
-			return;
+			return report({ droppedBy: "muted" });
 		}
-		const delivery = kind === "object-event" || kind === "audio-event" ? "immediate" : kind === "occupancy-event" ? "device-event" : kind;
-		const candidates = this.rules.listEnabled(delivery);
+		const delivery = deliveryForKind(kind);
+		const enabled = this.rules.listEnabled(delivery);
+		const candidates = controls.onlyRuleId !== void 0 ? enabled.filter((r) => r.id === controls.onlyRuleId) : enabled;
 		if (candidates.length === 0) {
 			this.logger.debug("no enabled rule for this trigger", {
 				tags: { deviceId: subject.deviceId },
 				meta: {
 					delivery,
 					kind,
+					origin,
 					rulesLoaded: this.rules.list().length
 				}
 			});
-			return;
+			return report({ droppedBy: "no-candidate-rule" });
 		}
 		const now = this.now();
 		let anyMatched = false;
@@ -6011,6 +6002,15 @@ var NotificationCenter = class NotificationCenter {
 			const evaluation = evaluateRule(rule, subject, (id) => this.deviceStates.get(id));
 			if (!evaluation.matched) {
 				rejections.push(`${rule.name}:${evaluation.failedCondition ?? "unknown"}`);
+				outcomes.push({
+					ruleId: rule.id,
+					ruleName: rule.name,
+					matched: false,
+					...evaluation.failedCondition !== void 0 ? { failedCondition: evaluation.failedCondition } : {},
+					cooldown: "n/a",
+					enqueued: 0,
+					targetIds: []
+				});
 				this.logger.debug("rule did not match", {
 					tags: { deviceId: subject.deviceId },
 					meta: {
@@ -6026,7 +6026,8 @@ var NotificationCenter = class NotificationCenter {
 				continue;
 			}
 			const key = cooldownKey(rule, subject);
-			if (isCoolingDown(rule, this.lastFiredAt.get(key), now)) {
+			const cooling = isCoolingDown(rule, this.lastFiredAt.get(key), now);
+			if (cooling && controls.bypassCooldown !== true) {
 				this.logger.debug("rule matched but is cooling down", {
 					tags: { deviceId: subject.deviceId },
 					meta: {
@@ -6037,6 +6038,15 @@ var NotificationCenter = class NotificationCenter {
 						...subject.trackId !== void 0 ? { trackId: subject.trackId } : {}
 					}
 				});
+				outcomes.push({
+					ruleId: rule.id,
+					ruleName: rule.name,
+					matched: true,
+					...evaluation.matchedOn !== void 0 ? { matchedOn: [...evaluation.matchedOn] } : {},
+					cooldown: "suppressed",
+					enqueued: 0,
+					targetIds: []
+				});
 				continue;
 			}
 			this.logger.info("rule matched — enqueueing", {
@@ -6045,6 +6055,7 @@ var NotificationCenter = class NotificationCenter {
 					ruleId: rule.id,
 					rule: rule.name,
 					kind,
+					origin,
 					targets: rule.targets.length,
 					eventId: subject.recordId,
 					...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
@@ -6053,7 +6064,7 @@ var NotificationCenter = class NotificationCenter {
 				}
 			});
 			const sequences = rule.actions?.onTrigger;
-			if (sequences !== void 0 && sequences.length > 0 && this.actionRunner !== null) this.actionRunner.run({
+			if (sequences !== void 0 && sequences.length > 0 && this.actionRunner !== null && controls.runActions !== false) this.actionRunner.run({
 				ruleId: rule.id,
 				ruleName: rule.name,
 				deviceId: subject.deviceId,
@@ -6069,10 +6080,22 @@ var NotificationCenter = class NotificationCenter {
 				}
 			});
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
-			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets)) > 0) this.lastFiredAt.set(key, now);
+			const entries = this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets, origin);
+			const inserted = await this.outbox.enqueue(entries);
+			if (inserted > 0 && controls.bypassCooldown !== true) this.lastFiredAt.set(key, now);
+			outcomes.push({
+				ruleId: rule.id,
+				ruleName: rule.name,
+				matched: true,
+				...evaluation.matchedOn !== void 0 ? { matchedOn: [...evaluation.matchedOn] } : {},
+				cooldown: cooling ? "bypassed" : "clear",
+				enqueued: inserted,
+				targetIds: entries.map((e) => e.targetId)
+			});
 			anyMatched = true;
 		}
 		if (!anyMatched && rejections.length > 0) this.reportNoMatch(subject, kind, rejections, now);
+		return report({ candidates: candidates.length });
 	}
 	/**
 	* One INFO line when a MUTED camera's event is dropped, bounded to one per
@@ -6124,7 +6147,7 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
-	buildEntries(rule, subject, kind, matchedOn, userTargets = []) {
+	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline") {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
 		const direct = new Set(rule.targets.map((t) => t.targetId));
@@ -6132,6 +6155,7 @@ var NotificationCenter = class NotificationCenter {
 			const payload = {
 				ruleName: rule.name,
 				delivery: rule.delivery,
+				...origin === "synthetic" ? { synthetic: true } : {},
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: rule.media.attach,
@@ -6315,21 +6339,7 @@ var NotificationCenter = class NotificationCenter {
 			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].sort((a, b) => a.timestamp - b.timestamp);
 			for (const event of ordered) {
 				const phase = packagePhaseOf(event);
-				if (phase !== null) this.scheduleEvaluation(subjectFromPackageEvent(event, phase), "package-event", () => ({
-					tags: { deviceId: event.deviceId },
-					meta: {
-						eventId: event.id,
-						phase,
-						reconcile: true
-					}
-				}));
-				else this.scheduleEvaluation(subjectFromObjectEvent(event), "object-event", () => ({
-					tags: { deviceId: event.deviceId },
-					meta: {
-						eventId: event.id,
-						reconcile: true
-					}
-				}));
+				this.consumeEvent(asReconcile(phase !== null ? incomingFromPackageEvent(event, phase) : incomingFromObjectEvent(event)));
 			}
 			await this.evalChain;
 			if (ordered.length > 0) this.logger.info("notification reconcile scanned missed events", { meta: {
@@ -6497,7 +6507,7 @@ var NotificationCenter = class NotificationCenter {
 			}
 		} else if (rule.delivery === "track-end") {
 			const tracks = await this.deps.listRecentTracks(since, TEST_RULE_MAX_RESULTS);
-			for (const track of tracks) subjects.push(subjectFromTrack(track));
+			for (const track of tracks) subjects.push(incomingFromTrack(track).subject);
 		}
 		let lookup = (id) => this.deviceStates.get(id);
 		const gated = rule.conditions.deviceState;
@@ -6600,6 +6610,24 @@ var ncActions = require_dist.defineCustomActions({
 	"nc.cancelSnooze": require_dist.customAction(require_dist.object({ snoozeId: require_dist.string() }), require_dist.object({ success: require_dist.literal(true) }), {
 		kind: "mutation",
 		caller: "required"
+	}),
+	/**
+	* Inject a SYNTHETIC event through the whole notification path — match,
+	* media, delivery — without producing a track, an event row or anything else
+	* durable. See `test-event.ts` for what it does and does not do.
+	*
+	* A bridge action rather than a cap method, deliberately: it needs no
+	* codegen, no `@camstack/system` republish and no place on a release train,
+	* so the tester can ship and change at the speed of the addon it tests.
+	*
+	* `auth: 'admin'` because an injection DELIVERS: it reaches every target the
+	* matched rule addresses, on other people's phones. `caller: 'required'` so
+	* the log line names who pressed it.
+	*/
+	"nc.injectTestEvent": require_dist.customAction(NcTestEventInputSchema, NcTestEventResultSchema, {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
 	})
 });
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
@@ -6714,6 +6742,22 @@ function makeNcActionHandlers(deps) {
 			await deps.snooze.cancel(input.snoozeId, c);
 			return { success: true };
 		},
+		"nc.injectTestEvent": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to inject a test event");
+			const inject = deps.injectTestEvent;
+			if (inject === void 0) throw new Error("this node does not host the notification centre — inject on the hub");
+			const parsed = NcTestEventInputSchema.parse(input);
+			deps.logger.info("synthetic notification test requested", {
+				tags: { deviceId: parsed.deviceId },
+				meta: {
+					by: c.userId,
+					trigger: parsed.trigger,
+					...parsed.onlyRuleId !== void 0 ? { ruleId: parsed.onlyRuleId } : {}
+				}
+			});
+			return inject(parsed);
+		},
 		"nc.setRuleTargetEnabled": async (input, caller) => {
 			const c = requireCaller(caller);
 			assertRuleVisible(input.ruleId, c);
@@ -10991,6 +11035,214 @@ function createVideoclipsProvider(deps) {
 		}
 	};
 }
+/** Real time. See {@link EventMediaRequest.speed}. */
+var DEFAULT_SPEED = 1;
+/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
+*  at or below 1080p is an identity scale and the broker copies it. */
+var RING_MP4_MAX_WIDTH = 1920;
+/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
+var RING_MP4_FPS = 15;
+var NO_MEDIA = {
+	mp4: null,
+	gif: null,
+	source: "none",
+	startOffsetMs: null,
+	endOffsetMs: null,
+	profile: null,
+	video: null
+};
+var EventMediaService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Cut this event. Never throws — a notification that lost its media is still
+	* a notification, and every branch that drops it logs why.
+	*/
+	async cut(request) {
+		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
+		const produced = await this.produce(request);
+		if (produced !== null) return produced;
+		return this.fallbackToRing(request);
+	}
+	async produce(request) {
+		const deviceId = request.deviceId;
+		const log = this.deps.logger;
+		const kinds = [];
+		if (request.wantMp4) kinds.push("mp4");
+		if (request.wantGif) kinds.push("gif");
+		let production;
+		try {
+			production = await this.deps.produce({
+				deviceId,
+				aroundMs: request.aroundMs,
+				preSeconds: request.preRollSec,
+				postSeconds: request.postRollSec,
+				kinds,
+				gifMaxWidth: 640,
+				gifFps: 8,
+				speed: request.speed ?? DEFAULT_SPEED,
+				...request.profile !== void 0 ? { profile: request.profile } : {}
+			});
+		} catch (err) {
+			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return null;
+		}
+		const mp4 = await this.redeem(deviceId, production.media, "mp4");
+		const gif = await this.redeem(deviceId, production.media, "gif");
+		if (mp4 === null && gif === null) {
+			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: {
+					kinds: kinds.join(","),
+					profile: production.profile
+				}
+			});
+			return null;
+		}
+		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
+		const endOffsetMs = production.coverage.toTs - request.aroundMs;
+		log.info("nc media: one production, every attachment", {
+			tags: { deviceId },
+			meta: {
+				profile: production.profile,
+				video: production.video,
+				mp4Bytes: mp4?.byteLength ?? null,
+				gifBytes: gif?.byteLength ?? null,
+				startOffsetMs,
+				endOffsetMs,
+				sharedWindow: true
+			}
+		});
+		return {
+			mp4,
+			gif,
+			source: "produced",
+			startOffsetMs,
+			endOffsetMs,
+			profile: production.profile,
+			video: production.video
+		};
+	}
+	/**
+	* Redeem one artifact handle at the node that produced it.
+	*
+	* `null` is not an error here — a production simply may not carry the kind
+	* (a gif whose derive failed says so on the broker's own log line). A handle
+	* that FAILS to redeem is different and is logged, because it means the bytes
+	* existed and did not arrive.
+	*/
+	async redeem(deviceId, media, kind) {
+		const artifact = media.find((m) => m.kind === kind);
+		if (artifact === void 0) return null;
+		try {
+			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
+			if (res === null) {
+				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
+					tags: { deviceId },
+					meta: {
+						kind,
+						handle: artifact.handle,
+						nodeId: artifact.nodeId
+					}
+				});
+				return null;
+			}
+			const buf = Buffer.from(res.base64, "base64");
+			if (buf.byteLength === 0) return null;
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
+				tags: { deviceId },
+				meta: {
+					kind,
+					handle: artifact.handle,
+					nodeId: artifact.nodeId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
+	*
+	* Weaker than a production and deliberately so — the coherence here rests on
+	* the two calls being given IDENTICAL parameters rather than on there being
+	* one render. That is defensible because the ring only ever grows forward and
+	* `windowAround` selects by wall clock around the same instant, so two calls
+	* seconds apart choose the same packets; the one thing that could differ is
+	* the rendition, so the profile is pinned to whatever the FIRST call actually
+	* used and handed to the second.
+	*
+	* It exists for one reason: a hub whose `@camstack/server` predates the
+	* production method must not stop attaching footage, and three of the four
+	* live rules on this install ask for a gif and nothing else.
+	*/
+	async fallbackToRing(request) {
+		const deviceId = request.deviceId;
+		const speed = request.speed ?? DEFAULT_SPEED;
+		const window = {
+			deviceId,
+			aroundMs: request.aroundMs,
+			preRollSec: request.preRollSec,
+			postRollSec: request.postRollSec,
+			speed,
+			...request.profile !== void 0 ? { profile: request.profile } : {}
+		};
+		try {
+			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
+				...window,
+				format: "mp4",
+				maxWidth: RING_MP4_MAX_WIDTH,
+				fps: RING_MP4_FPS
+			}) : null;
+			const gif = request.wantGif ? await this.deps.renderRingClip({
+				...window,
+				format: "gif",
+				maxWidth: 640,
+				fps: 8
+			}) : null;
+			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
+				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
+					tags: { deviceId },
+					meta: { aroundMs: request.aroundMs }
+				});
+				return NO_MEDIA;
+			}
+			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
+				tags: { deviceId },
+				meta: {
+					mp4Bytes: mp4?.byteLength ?? null,
+					gifBytes: gif?.byteLength ?? null,
+					profile: request.profile ?? null,
+					sharedWindow: "by-parameters"
+				}
+			});
+			return {
+				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
+				gif: gif !== null && gif.byteLength > 0 ? gif : null,
+				source: "ring-fallback",
+				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
+				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
+				profile: request.profile ?? null,
+				video: null
+			};
+		} catch (err) {
+			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return NO_MEDIA;
+		}
+	}
+};
 //#endregion
 //#region src/shared/frame/crop-extractor.ts
 /**
@@ -25380,6 +25632,31 @@ var LinkedCamerasCache = class {
 	}
 };
 /**
+* THE camera-set derivation for a sensor-cap state change — one function, so
+* every consumer of a device-event attributes it to the same cameras.
+*
+* It is shared on purpose. The self-camera half (a doorbell wrapper bound on
+* camera 615 makes 615 both source and subject) was added to the history-row
+* ingest on 2026-08-07 and NOT to the synthetic-track projection beside it,
+* which kept resolving `camerasFor` alone. The result: camera 615's real
+* doorbell press on 2026-08-08 06:59Z produced a `SensorEvent` row and no
+* timeline marker, for weeks, with the divergence invisible in both codepaths.
+* Two derivations of "which cameras" is one too many.
+*/
+async function resolveSensorEventCameras(cache, data) {
+	const linkedCameraIds = await cache.camerasFor(data.deviceId);
+	const isCamera = await cache.isCamera(data.deviceId);
+	const cameraIds = isCamera && selfCameraMayEmit(data.capName) && !linkedCameraIds.includes(data.deviceId) ? [data.deviceId, ...linkedCameraIds] : linkedCameraIds;
+	if (cameraIds.length === 0) return {
+		cameraIds,
+		dropReason: isCamera ? "camera-native-cap" : "no-camera"
+	};
+	return {
+		cameraIds,
+		dropReason: null
+	};
+}
+/**
 * One `DeviceStateChanged` → N history rows, one per camera the event belongs
 * to: the emitting device's LINKED cameras, plus the emitting device ITSELF
 * when it is a camera carrying the sensor cap (a doorbell wrapper bound on
@@ -25392,11 +25669,9 @@ var LinkedCamerasCache = class {
 async function ingestSensorStateChange(deps, data, timestamp) {
 	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
 	if (descriptor === void 0) return 0;
-	const linkedCameraIds = await deps.cache.camerasFor(data.deviceId);
-	const isCamera = await deps.cache.isCamera(data.deviceId);
-	const cameraIds = isCamera && selfCameraMayEmit(data.capName) && !linkedCameraIds.includes(data.deviceId) ? [data.deviceId, ...linkedCameraIds] : linkedCameraIds;
-	if (cameraIds.length === 0) {
-		deps.onDropped?.(isCamera ? "camera-native-cap" : "no-camera", descriptor.kind);
+	const { cameraIds, dropReason } = await resolveSensorEventCameras(deps.cache, data);
+	if (dropReason !== null) {
+		deps.onDropped?.(dropReason, descriptor.kind);
 		return 0;
 	}
 	const slice = data.slice;
@@ -26135,6 +26410,103 @@ var EventMediaDispatcher = class {
 		}
 	}
 };
+//#endregion
+//#region src/pipeline-analytics/services/sensor-marker-projector.ts
+/**
+* Sensor markers — the gate between "a mapped sensor/control cap changed
+* state" and "a synthetic track exists on the camera's timeline"
+* (event-kinds-taxonomy §8).
+*
+* It is the sibling of {@link ../services/audio-marker-projector.ts} and it
+* exists for the same reason: the projection has gates, and a gate that drops
+* work without saying so is indistinguishable from a feature that was never
+* wired.
+*
+* **What this fixes.** The projection used to resolve its cameras with
+* `camerasFor` alone — LINKED cameras only — while the history-row ingest
+* beside it had gained the self-camera half on 2026-08-07. A doorbell wrapper
+* is bound on the CAMERA (the virtual-doorbell builtin writes the `doorbell`
+* slice onto camera 615 itself), so `camerasFor(615)` answered `[]` and the
+* projection returned on a `debug` line nobody runs at. Camera 615's real
+* press at 2026-08-08 06:59Z therefore produced a `SensorEvent` row, a HomeKit
+* ring, an Alexa post and a matched notification rule — and no track. Both
+* halves now derive their cameras from {@link resolveSensorEventCameras}.
+*
+* **The asymmetry that used to be here was defended by a wrong premise.** The
+* old comment argued a self-projected track would feed the NC `track-end`
+* trigger and make every press evaluate the camera's object rules. It does
+* not: `persistSyntheticTrack` writes the row directly and the NC track-end
+* hook lives in the LIVE tracker's closer, which no synthetic track ever
+* enters. A linked contact sensor has been projecting onto its camera all
+* along under exactly the same mechanism.
+*
+* **Nothing here is silent.** A marker that lands emits one `info` line; every
+* branch that lands none emits one line carrying the reason. Both carry
+* `tags: { deviceId }` with the CAMERA id, because the question always arrives
+* as "why did 617 get a marker and 615 not".
+*/
+/**
+* Project one `DeviceStateChanged` of a mapped sensor/control cap into a
+* synthetic track per camera the event belongs to. Returns the number of
+* markers that landed. Best-effort (telemetry, D8) — a materializer that
+* throws propagates to the caller, which logs it.
+*/
+async function projectSensorMarkers(deps, data, timestamp) {
+	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
+	if (descriptor === void 0) {
+		deps.onSkipped({
+			cameraId: null,
+			sourceDeviceId: data.deviceId,
+			capName: data.capName,
+			kind: null,
+			reason: "unmapped-cap"
+		});
+		return 0;
+	}
+	const { cameraIds, dropReason } = await resolveSensorEventCameras(deps.cache, data);
+	if (dropReason !== null) {
+		deps.onSkipped({
+			cameraId: null,
+			sourceDeviceId: data.deviceId,
+			capName: data.capName,
+			kind: descriptor.kind,
+			reason: dropReason
+		});
+		return 0;
+	}
+	const producingDeviceName = await deps.producingDeviceName(data.deviceId);
+	let landed = 0;
+	for (const cameraId of cameraIds) {
+		const track = await deps.markers.materialize({
+			cameraId,
+			sourceDeviceId: data.deviceId,
+			source: "sensor",
+			kind: descriptor.kind,
+			timestamp,
+			...producingDeviceName !== void 0 ? { producingDeviceName } : {}
+		});
+		if (track === null) {
+			deps.onSkipped({
+				cameraId,
+				sourceDeviceId: data.deviceId,
+				capName: data.capName,
+				kind: descriptor.kind,
+				reason: "not-materialized"
+			});
+			continue;
+		}
+		landed++;
+		deps.onProjected({
+			cameraId,
+			sourceDeviceId: data.deviceId,
+			capName: data.capName,
+			kind: descriptor.kind,
+			trackId: track.trackId,
+			selfCamera: cameraId === data.deviceId
+		});
+	}
+	return landed;
+}
 /** JPEG quality for the downscaled full frame — matches the crop path. */
 var FULL_FRAME_QUALITY = 80;
 /**
@@ -29106,15 +29478,6 @@ var KEY_EVENT_DEFAULT_LIMIT = 50;
 *  Absent / empty / non-string all fall back to the hub default — the exact
 *  narrowing the old raw read applied inline. */
 var PostProcessingNodeIdSchema = require_dist.string().min(1);
-/**
-* Footage-attachment window + geometry, used when the rule states none. The
-* window is CENTRED on the event, so the recipient sees the approach and what
-* followed rather than one side of it.
-*/
-var NC_FOOTAGE_PRE_ROLL_SEC = 3;
-var NC_FOOTAGE_POST_ROLL_SEC = 5;
-var NC_FOOTAGE_MAX_WIDTH = 480;
-var NC_FOOTAGE_FPS = 5;
 /** Per-install HMAC secret behind the signed artifact links (minted once). */
 var NcArtifactSecretSchema = require_dist.string();
 var EmbeddingEnabledSchema = require_dist.boolean();
@@ -29288,38 +29651,82 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  data-plane handle. Null until served / when the facility is absent. */
 	ncArtifactPlane = null;
 	ncArtifactDataPlane = null;
-	/** Roadmap 4b: notification clips cut from the live fMP4 fragment seam.
-	*  Built on first use — a hub whose rules never ask for an mp4 never
-	*  constructs it, and constructing it costs nothing until `renderClip`. */
-	ncSeamClips = null;
 	/**
-	* One attempt at the fMP4 seam. `null` means "the ring serves this one", and
-	* the REASON is always logged with `tags: { deviceId }`.
+	* Roadmap 4b: ONE cut of an event, in every container the rule asked for.
 	*
-	* That log line is the whole point of the fallback being explicit rather than
-	* a try/catch: two cameras silently attaching two different kinds of clip is
-	* precisely the thing an operator cannot diagnose from a phone.
+	* Built on first use — a hub whose rules never attach footage never
+	* constructs it, and constructing it costs nothing until `cut`.
 	*/
-	async renderSeamClip(req) {
-		const log = this.ctx.logger;
+	ncEventMedia = null;
+	/**
+	* The dispatcher's single media dep.
+	*
+	* ONE call for the gif and the mp4, deliberately: rendering them separately
+	* is what produced a gif around the event and a video seven seconds after it
+	* (D85's `eventToDialMs=7054`). The service picks the camera's best H.264
+	* slot, asks the broker's own prebuffer ring for the window at that slot's
+	* own width in real time — which is what makes the broker COPY rather than
+	* re-encode — and derives the gif from those same bytes.
+	*/
+	async renderEventMedia(req) {
 		const api = this.ctx.api;
-		this.ncSeamClips ??= new Fmp4ClipService({
-			logger: log.child("nc-seam-clip"),
-			listProfileEntries: (deviceId) => api.cameraStreams.getProfileRtspEntries.query({ deviceId })
+		this.ncEventMedia ??= new EventMediaService({
+			logger: this.ctx.logger.child("nc-event-media"),
+			produce: (input) => api.streamBroker.produceEventMedia.mutate({
+				deviceId: input.deviceId,
+				aroundMs: input.aroundMs,
+				preSeconds: input.preSeconds,
+				postSeconds: input.postSeconds,
+				kinds: [...input.kinds],
+				gifMaxWidth: input.gifMaxWidth,
+				gifFps: input.gifFps,
+				speed: input.speed,
+				...input.profile === "high" || input.profile === "mid" || input.profile === "low" ? { profile: input.profile } : {}
+			}),
+			fetch: (handle, nodeId) => api.streamBroker.fetchEventMedia.mutate({ handle }, nodeId.length > 0 ? require_dist.nodePin(nodeId) : void 0),
+			renderRingClip: async (input) => {
+				const res = await api.streamBroker.renderPreBufferClip.mutate({
+					deviceId: input.deviceId,
+					aroundMs: input.aroundMs,
+					format: input.format,
+					preRollSec: input.preRollSec,
+					postRollSec: input.postRollSec,
+					maxWidth: input.maxWidth,
+					fps: input.fps,
+					speed: input.speed,
+					...input.profile === "high" || input.profile === "mid" || input.profile === "low" ? { profile: input.profile } : {}
+				});
+				const buf = Buffer.from(res.base64, "base64");
+				if (buf.byteLength === 0) return null;
+				const bytes = new Uint8Array(buf.byteLength);
+				bytes.set(buf);
+				return bytes;
+			}
 		});
 		try {
-			const result = await this.ncSeamClips.renderClip({
+			const media = await this.ncEventMedia.cut({
 				deviceId: req.deviceId,
 				aroundMs: req.aroundMs,
-				postRollSec: req.postRollSec ?? NC_FOOTAGE_POST_ROLL_SEC
+				wantMp4: req.wantMp4,
+				wantGif: req.wantGif,
+				preRollSec: req.preRollSec,
+				postRollSec: req.postRollSec,
+				...req.profile !== void 0 ? { profile: req.profile } : {},
+				...req.speed !== void 0 ? { speed: req.speed } : {}
 			});
-			return result.ok ? result.clip.bytes : null;
+			return {
+				mp4: media.mp4,
+				gif: media.gif
+			};
 		} catch (err) {
-			log.warn("nc clip: the fMP4 seam threw — falling back to the clip ring", {
+			this.ctx.logger.warn("nc media: the cut threw — this notification ships without footage", {
 				tags: { deviceId: req.deviceId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
-			return null;
+			return {
+				mp4: null,
+				gif: null
+			};
 		}
 	}
 	/** The operator's marked notification endpoint, or null (AUTO / unavailable). */
@@ -29824,7 +30231,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			},
 			listCallerTargetIds: async (userId) => {
 				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
-			}
+			},
+			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) })
 		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
@@ -29958,7 +30366,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		let storage = this.ctx.kernel.storage;
 		const mediaRoot = process.env.CAMSTACK_MEDIA_ROOT?.trim();
 		if (mediaRoot) {
-			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-CnEKzHgS.js"));
+			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-B5brepKo.js"));
 			storage = new FilesystemStorageProvider(mediaRoot, { eventMedia: mediaRoot });
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
@@ -30416,28 +30824,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 						y: pt.y
 					})));
 				},
-				renderFootage: async (req) => {
-					if (req.format === "mp4") {
-						const seam = await this.renderSeamClip(req);
-						if (seam !== null) return seam;
-					}
-					const res = await api.streamBroker.renderPreBufferClip.mutate({
-						deviceId: req.deviceId,
-						aroundMs: req.aroundMs,
-						format: req.format,
-						preRollSec: req.preRollSec ?? NC_FOOTAGE_PRE_ROLL_SEC,
-						postRollSec: req.postRollSec ?? NC_FOOTAGE_POST_ROLL_SEC,
-						maxWidth: NC_FOOTAGE_MAX_WIDTH,
-						fps: NC_FOOTAGE_FPS,
-						...req.speed !== void 0 ? { speed: req.speed } : {},
-						...req.profile === "high" || req.profile === "mid" || req.profile === "low" ? { profile: req.profile } : {}
-					});
-					const buf = Buffer.from(res.base64, "base64");
-					if (buf.byteLength === 0) return null;
-					const bytes = new Uint8Array(buf.byteLength);
-					bytes.set(buf);
-					return bytes;
-				},
+				renderEventMedia: (req) => this.renderEventMedia(req),
 				publishArtifact: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
 				listTargets: async () => {
 					return (await api.notificationOutput.listTargets.query({})).map((t) => {
@@ -33382,29 +33769,32 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			});
 		}
 		const materializer = this.syntheticTracks;
-		const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
-		if (materializer === null || descriptor === void 0) return;
+		if (materializer === null) return;
 		try {
-			const cameraIds = await cache.camerasFor(data.deviceId);
-			if (cameraIds.length === 0) {
-				this.ctx.logger.debug("sensor synthetic-track projection skipped — no linked camera", {
-					tags: { deviceId: data.deviceId },
+			await projectSensorMarkers({
+				cache,
+				markers: materializer,
+				producingDeviceName: (deviceId) => this.resolveProducingDeviceName(deviceId),
+				onProjected: (r) => this.ctx.logger.info("synthetic sensor-track projected", {
+					tags: { deviceId: r.cameraId },
 					meta: {
-						capName: data.capName,
-						kind: descriptor.kind
+						capName: r.capName,
+						kind: r.kind,
+						trackId: r.trackId,
+						sourceDeviceId: r.sourceDeviceId,
+						selfCamera: r.selfCamera
 					}
-				});
-				return;
-			}
-			const producingDeviceName = await this.resolveProducingDeviceName(data.deviceId);
-			for (const cameraId of cameraIds) await materializer.materialize({
-				cameraId,
-				sourceDeviceId: data.deviceId,
-				source: "sensor",
-				kind: descriptor.kind,
-				timestamp,
-				...producingDeviceName !== void 0 ? { producingDeviceName } : {}
-			});
+				}),
+				onSkipped: (r) => this.ctx.logger.debug("synthetic sensor-track NOT projected", {
+					tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
+					meta: {
+						capName: r.capName,
+						kind: r.kind,
+						reason: r.reason,
+						sourceDeviceId: r.sourceDeviceId
+					}
+				})
+			}, data, timestamp);
 		} catch (err) {
 			this.ctx.logger.warn("synthetic sensor-track materialize failed", {
 				tags: { deviceId: data.deviceId },