@camstack/addon-post-analysis 1.2.51 → 1.2.53

package/dist/pipeline-analytics/index.js

@@ -2,12 +2,11 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CnSzKo7x.js");
+const require_dist = require("../dist-DGdY1GSf.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_crypto = require("node:crypto");
-let node_child_process = require("node:child_process");
 let sharp = require("sharp");
 sharp = require_dist.__toESM(sharp);
 //#region src/notification-center/action-token.ts
@@ -699,77 +698,34 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	}
 };
 //#endregion
-//#region src/notification-center/alarm/ensure-alarm-panel.ts
+//#region src/notification-center/alarm/alarm-panel-declaration.ts
 /**
-* Bring the Notification Center's alarm panel into existence, once.
+* The Notification Center's alarm panel, as a DECLARATION.
 *
-* Two idempotent steps — a fixed integration to hang from, and one device under
-* it. Both are `get-or-create`, because this runs on every boot and an operator
-* must never end up with a second panel after a restart.
+* There is no `ensureAlarmPanel` any more. The get-or-create, the `fixed`
+* re-assertion, the adopt-don't-skip rule and the hub-ownership gate all moved
+* to `DeclaredDevices` in `@camstack/types` — the one primitive for a device an
+* addon declares. What is left here is the *declaration*: the stable id, the
+* seed name, the type and the class. Data, not procedure.
 *
-* The integration is FIXED: it exists because the addon says so, not because an
-* operator added it, and there is no add/delete flow for it. That is the whole
-* meaning of "a system integration" here — the same `integrations` row every
-* provider uses, created by its owner instead of by a form.
+* The bug the hand-rolled version carried died in that move: it read the device
+* index once, so a transiently empty answer took the create branch and
+* re-stamped `Alarm` over the operator's rename. `DeclaredDevices` requires a
+* second read to agree before it does anything destructive (D49).
 */
 /** Stable id of the one panel. Never derived from a name — a rename must not
 *  mint a second device. */
 var NC_ALARM_STABLE_ID = "nc-alarm-panel";
+/** Seeded ONCE, at create. A later boot never re-stamps it. */
 var NC_ALARM_DEVICE_NAME = "Alarm";
-/**
-* Idempotent. Returns the ids either way so the caller can hold onto the panel.
-*
-* Failures are the CALLER's to handle: a hub whose alarm could not be created
-* should say so loudly and keep notifying, not fail to boot — but that decision
-* does not belong in here.
-*/
-async function ensureAlarmPanel(deps) {
-	const existingIntegration = await deps.getIntegration(deps.addonId);
-	if (existingIntegration !== null && !existingIntegration.fixed) {
-		await deps.markFixed(existingIntegration.id);
-		deps.logger.info("marked the notification-center integration as fixed", { meta: { integrationId: existingIntegration.id } });
-	}
-	const integration = existingIntegration ?? await deps.createIntegration({
-		addonId: deps.addonId,
-		name: deps.integrationName,
-		info: { fixed: true }
-	});
-	if (await deps.findDeviceByStableId("nc-alarm-panel") !== null) {
-		const adopted = await deps.adoptDevice({ stableId: NC_ALARM_STABLE_ID });
-		deps.logger.info("alarm panel adopted", {
-			tags: { deviceId: adopted.id },
-			meta: {
-				integrationId: integration.id,
-				stableId: NC_ALARM_STABLE_ID
-			}
-		});
-		return {
-			integrationId: integration.id,
-			deviceId: adopted.id,
-			created: false
-		};
-	}
-	const device = await deps.createDevice({
-		stableId: NC_ALARM_STABLE_ID,
-		integrationId: integration.id,
-		name: NC_ALARM_DEVICE_NAME
-	});
-	deps.logger.info("alarm panel created", {
-		tags: { deviceId: device.id },
-		meta: {
-			integrationId: integration.id,
-			stableId: NC_ALARM_STABLE_ID
-		}
-	});
-	return {
-		integrationId: integration.id,
-		deviceId: device.id,
-		created: true
-	};
-}
-/** The device class + type the caller passes to `kernel.devices.create`. */
-var NC_ALARM_DEVICE_CLASS = NcAlarmPanelDevice;
-var NC_ALARM_DEVICE_TYPE = require_dist.DeviceType.AlarmPanel;
+/** Display name of the FIXED integration the panel hangs from. */
+var NC_INTEGRATION_NAME = "Notification Center";
+var NC_ALARM_DECLARATION = {
+	stableId: NC_ALARM_STABLE_ID,
+	name: NC_ALARM_DEVICE_NAME,
+	type: require_dist.DeviceType.AlarmPanel,
+	DeviceClass: NcAlarmPanelDevice
+};
 //#endregion
 //#region src/notification-center/artifact-url.ts
 /**
@@ -1109,556 +1065,219 @@ function mimeFromExtension(file) {
 	return "application/octet-stream";
 }
 //#endregion
-//#region src/notification-center/fmp4-clip/clip-assembler.ts
-/**
-* Drain a subscription into one mp4.
-*
-* The subscription is ALWAYS released before this settles, on every path. It
-* holds an ffmpeg's fragments in a bounded queue; leaking one keeps a camera's
-* child alive for a notification that was sent minutes ago.
-*/
-async function assembleFmp4Clip(input) {
-	const now = input.now ?? Date.now;
-	const schedule = input.setTimeoutFn ?? setTimeout;
-	const parts = [];
-	let initBytes = 0;
-	let fragments = 0;
-	let totalBytes = 0;
-	let firstFragmentAt = null;
-	let lastFragmentAt = null;
-	let stop = null;
-	const iterator = input.subscription.packets()[Symbol.asyncIterator]();
-	try {
-		for (;;) {
-			const remaining = input.deadlineMs - now();
-			if (remaining <= 0) {
-				stop = "deadline";
-				break;
-			}
-			const packet = await nextWithin(iterator, remaining, schedule);
-			if (packet === TIMED_OUT) {
-				stop = "deadline";
-				break;
-			}
-			if (packet === null) {
-				stop = input.subscription.closedReason === "slow-consumer" ? "slow-consumer" : "producer-ended";
-				break;
-			}
-			if (packet.kind === "init") {
-				if (initBytes > 0) {
-					stop = "producer-ended";
-					break;
-				}
-				initBytes = packet.data.length;
-				totalBytes += packet.data.length;
-				parts.push(packet.data);
-				continue;
-			}
-			if (initBytes === 0) return {
-				ok: false,
-				refusal: "no-init"
-			};
-			const arrivedAt = now();
-			if (totalBytes + packet.data.length > input.maxBytes) {
-				stop = "byte-cap";
-				break;
-			}
-			parts.push(packet.data);
-			totalBytes += packet.data.length;
-			fragments += 1;
-			if (firstFragmentAt === null) firstFragmentAt = arrivedAt;
-			lastFragmentAt = arrivedAt;
-			if (packet.isLast) {
-				stop = "producer-ended";
-				break;
-			}
-			if (arrivedAt >= input.collectUntilMs) {
-				stop = "window";
-				break;
-			}
-		}
-	} finally {
-		input.subscription.release();
-	}
-	if (initBytes === 0) return {
-		ok: false,
-		refusal: "no-init"
-	};
-	if (fragments === 0) return {
-		ok: false,
-		refusal: "no-fragments"
-	};
-	const stoppedBecause = stop ?? "producer-ended";
-	return {
-		ok: true,
-		clip: {
-			bytes: concat(parts, totalBytes),
-			initBytes,
-			fragments,
-			arrivalSpanMs: firstFragmentAt === null || lastFragmentAt === null ? 0 : lastFragmentAt - firstFragmentAt,
-			stoppedBecause,
-			truncated: stoppedBecause !== "window"
-		}
-	};
-}
-/** One line for the log — a refused clip that says nothing reads as a bug. */
-function clipAssemblyRefusalReason(refusal) {
-	switch (refusal) {
-		case "no-init": return "the first packet was a fragment, not an initialisation segment — the bytes would not decode";
-		case "no-fragments": return "the initialisation segment arrived but no media fragment did";
-	}
+//#region src/notification-center/action-buttons.ts
+/** Sequence names the rule actually declares. A button may only name one. */
+function declaredSequences(actions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const sequence of actions.onTrigger ?? []) names.add(sequence.name);
+	return names;
 }
-var TIMED_OUT = Symbol("fmp4-clip-timeout");
-/** `setTimeout`'s 32-bit ceiling. Above it Node fires after 1 ms. */
-var MAX_TIMER_MS = 2 ** 31 - 1;
 /**
-* The next packet, `null` when the stream completed, or {@link TIMED_OUT}.
+* Build the notification's buttons.
 *
-* The plane's generator parks on a promise that only a publish resolves, so a
-* camera that goes silent mid-clip parks it forever. Racing a timer is the only
-* way out — and the abandoned `next()` is harmless because the caller releases
-* the subscription immediately afterwards.
+* Returns an empty array rather than `undefined` — the caller decides whether
+* to set the field, and an empty array is the honest answer to "which buttons
+* survived", which `undefined` would conflate with "the rule declared none".
 */
-async function nextWithin(iterator, withinMs, schedule) {
-	let timer = null;
-	const timeout = new Promise((resolve) => {
-		timer = schedule(() => resolve(TIMED_OUT), Math.min(withinMs, MAX_TIMER_MS));
-		timer.unref?.();
-	});
-	try {
-		return await Promise.race([iterator.next().then((r) => r.done === true ? null : r.value), timeout]);
-	} finally {
-		if (timer !== null) clearTimeout(timer);
-	}
-}
-function concat(parts, total) {
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const part of parts) {
-		out.set(part, offset);
-		offset += part.length;
+function buildActionButtons(input) {
+	const actions = input.actions;
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const button of buttons) {
+		if (!known.has(button.sequence)) continue;
+		if (seen.has(button.id)) continue;
+		seen.add(button.id);
+		out.push({
+			id: button.id,
+			label: button.label,
+			url: input.mintUrl({
+				sequence: button.sequence,
+				actionId: button.id
+			}),
+			...button.icon !== void 0 ? { icon: button.icon } : {},
+			...button.destructive !== void 0 ? { destructive: button.destructive } : {}
+		});
 	}
 	return out;
 }
-//#endregion
-//#region src/notification-center/fmp4-clip/clip-source-pick.ts
-/**
-* The tallest frame a notification clip is cut from.
-*
-* 1080 rather than 720: the attachment is native-resolution H.264 that nothing
-* re-encodes, and the operator asked for a real clip. A 4-second 1080p copy
-* fragment measured ~500 KB on this fleet against ~6.35 MB at 4K, which is the
-* difference between "every backend takes it" and "pushover drops it".
-*/
-var CLIP_MAX_HEIGHT = 1080;
-/** The seam copies; it never transcodes. That means H.264 and only H.264. */
-var COPYABLE_CODEC = "h264";
-function pickClipSource(entries) {
-	const enabled = entries.filter((e) => e.enabled);
-	if (enabled.length === 0) return {
-		ok: false,
-		refusal: "no-enabled-stream"
-	};
-	const copyable = enabled.filter((e) => normaliseCodec(e.codec) === COPYABLE_CODEC);
-	if (copyable.length === 0) return {
-		ok: false,
-		refusal: "no-h264-stream"
-	};
-	const sized = copyable.filter(hasUsableResolution);
-	if (sized.length === 0) return {
-		ok: false,
-		refusal: "no-resolution"
-	};
-	const withinCeiling = sized.filter((e) => e.resolution.height <= CLIP_MAX_HEIGHT);
-	const best = [...withinCeiling.length > 0 ? withinCeiling : sized].sort((a, b) => withinCeiling.length > 0 ? b.resolution.height - a.resolution.height : a.resolution.height - b.resolution.height)[0];
-	if (best === void 0) return {
-		ok: false,
-		refusal: "no-resolution"
-	};
-	return {
-		ok: true,
-		source: {
-			brokerId: best.brokerId,
-			profile: best.profile ?? best.brokerId,
-			url: best.url,
-			width: best.resolution.width,
-			height: best.resolution.height
-		}
-	};
-}
-/** One line for the log — a withheld clip that says nothing reads as a bug. */
-function clipRefusalReason(refusal) {
-	switch (refusal) {
-		case "no-enabled-stream": return "the camera has no enabled profile slot to dial";
-		case "no-h264-stream": return "every enabled profile is H.265 — the seam copies and never transcodes, so the clip ring serves this camera";
-		case "no-resolution": return "no enabled profile declares a resolution, so no slot could be sized";
-	}
-}
-function hasUsableResolution(entry) {
-	const r = entry.resolution;
-	return r !== void 0 && r.width > 0 && r.height > 0;
-}
-/** Publishers spell H.265 four ways; the same normalisation the broker uses. */
-function normaliseCodec(codec) {
-	return (codec ?? "").toLowerCase().replace(/[.\s-]/g, "");
+/**
+* Which of a rule's buttons name a sequence it does not have.
+*
+* Exported so the caller can LOG the drop. A button silently missing from a
+* notification is the exact shape of failure this repo keeps paying for — the
+* operator authored it, it never appeared, and nothing said why.
+*/
+function unresolvableButtons(actions) {
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	return buttons.filter((b) => !known.has(b.sequence)).map((b) => `${b.id}→${b.sequence}`);
 }
 //#endregion
-//#region src/notification-center/fmp4-clip/fmp4-clip-service.ts
-/**
-* Cut a notification clip from the LIVE fMP4 fragment seam — roadmap 4b, the
-* second consumer [D80](../../../../../../docs/decisions/adr-0080.md) named and
-* deliberately did not build.
-*
-* ## What changes for the operator
-*
-* The clip ring path (`streamBroker.renderPreBufferClip`, D32) re-encodes to
-* 480 px wide, 5 fps, 2× speed, `-an`. That is a thumbnail with motion. This
-* one is `-c:v copy`: the camera's own H.264 at its own resolution and frame
-* rate, real time, with in-band AAC — a clip you can actually watch.
-*
-* ## Where the consumer lives, and why it is HERE
-*
-* [D84](../../../../../../docs/decisions/adr-0084.md) established the answer
-* the hard way: a `Fmp4FragmentPlane` is a live object, so it cannot cross a
-* process boundary and no capability can carry one. The first consumer — the
-* HKSV delegate — is `hub-only` in its own runner and therefore spawns its OWN
-* child against the broker's restream, taking the transport from
-* `@camstack/types/node`. The notification centre is in yet another runner
-* (`addon-post-analysis`), so it does exactly the same thing. The alternative,
-* a `streamBroker.renderFragmentClip` cap method, is a `*.cap.ts` change plus
-* codegen plus a `@camstack/system` train to move bytes that are already
-* reachable over RTSP.
-*
-* ## ON-DEMAND, and what that costs — read this before "fixing" the pre-roll
-*
-* HKSV's prebuffer exists because its ffmpeg never stops. That is affordable
-* (measured: 0.7 % of a core, 30 MB RSS on the copy branch) but it is still a
-* PERMANENT child per camera, and a notification clip does not justify one on
-* every camera that has a rule. So this child is spawned at the event and
-* killed when the clip is assembled.
-*
-* **This path has NO pre-roll, and the guess that it might have had one was
-* wrong.** `RtspRestreamer` bursts the current GOP to a joining session, so it
-* looked as though the first fragment would open before we asked for it.
-* Measured against 615's 720p slot from outside the hub — the exact argv, the
-* real child, the real plane:
-*
-* | dial → init | fragments | media duration | wall clock | bytes |
-* | --- | --- | --- | --- | --- |
-* | 4479 ms | 3 × ~141 KB | 12.03 s | 12.42 s | 425 KB |
-*
-* Media duration and wall clock differ by 387 ms — the dial. Nothing from
-* before the spawn survives into the file: ffmpeg discards up to the first key
-* frame it can open on, which is also why the first fragment costs one full
-* key-frame interval. So `preRollSec` is NOT honoured here; the fallback's is.
-*
-* A real pre-roll needs a plane that was already running. The seam is ready for
-* one — the assembler takes any `Fmp4Subscription`, including a prebuffered one
-* — and it is queued rather than built, because a warm child per
-* camera-with-a-clip-rule is a new permanent cost and that is an operator
-* decision, not an implementation one.
-*
-* ## Fail-closed, and always with the reason
-*
-* Every refusal returns a code AND a sentence, and the caller falls back to the
-* clip ring. An H.265 camera, a broker on another node, an ffmpeg that will not
-* start: each is a `debug`/`warn` line carrying `tags: { deviceId }`, because a
-* clip that silently changed shape per camera is exactly the thing nobody can
-* diagnose from an attachment.
-*/
-/**
-* The fragment length asked of the muxer.
-*
-* Deliberately SHORT. `-min_frag_duration` can only ever DELAY a cut past a key
-* frame (D80), so asking for 1 s against a 4 s key-frame grid yields exactly the
-* source cadence — the finest granularity the stream can give. Asking for the
-* grid's own length is the D84 bug: the deadline lands on the same instant as
-* the key frame, loses, and DOUBLES every fragment.
-*/
-var CLIP_FRAGMENT_MS = 1e3;
-/**
-* How long the child may produce nothing before it is declared dead.
-*
-* Shorter than the transport's 12 s default on purpose: this runs inside the
-* notification drain, and the commonest cause of a stall here is a restream url
-* that is not reachable from THIS runner (the broker for that camera lives on
-* another node and its url is loopback). Paying 12 s per notification for that
-* is worse than falling back sooner.
-*
-* NOT shorter than 9 s, and that bound is measured rather than chosen: the init
-* segment cannot be written before ffmpeg has a key frame to open on, and 615
-* took **4479 ms** over the LAN on a 4.0 s grid. A camera on an 8 s grid needs
-* roughly twice that, so anything under ~9 s would declare healthy cameras dead
-* and cool them down for ten minutes.
-*/
-var CLIP_FIRST_UNIT_TIMEOUT_MS = 9e3;
-/** Slack past the requested window for one more key-frame interval to land. */
-var CLIP_CADENCE_SLACK_MS = 1e4;
-/** The whole attempt, spawn included. A notification is not worth more. */
-var CLIP_TOTAL_BUDGET_MS = 25e3;
-/**
-* Ceiling on the assembled file.
-*
-* The degrade engine DROPS an over-`maxBytes` attachment rather than degrading
-* it to a link, and the SMALLEST cap declared today is pushover's 5 MiB. So the
-* cap is that, not something roomier: a clip truncated to four seconds and
-* delivered beats a whole one the engine throws away, and the truncation is
-* marked either way. A 1080p copy clip of a few seconds is 1-2 MB, so this only
-* ever bites a 4K-only camera.
-*/
-var CLIP_MAX_BYTES = 5 * 1024 * 1024;
-/**
-* How long a camera is left alone after the seam failed to start on it.
-*
-* Without this, a camera whose broker is on another node pays
-* {@link CLIP_FIRST_UNIT_TIMEOUT_MS} on EVERY notification, forever. The
-* cooldown is announced once and the suppressed attempts are counted into the
-* next line, the same shape the NC's own rate-limited lines use.
-*/
-var CLIP_FAILURE_COOLDOWN_MS = 10 * 6e4;
-/** ffmpeg on `PATH`, as every other spawn in this repo resolves it. */
-var FFMPEG_BINARY = "ffmpeg";
-var Fmp4ClipService = class {
-	deps;
-	cooldowns = /* @__PURE__ */ new Map();
-	inFlight = /* @__PURE__ */ new Set();
-	transport = null;
-	transportProbed = false;
+//#region src/notification-center/device-mute-store.ts
+var NC_DEVICE_MUTES_COLLECTION = "notification-center:device-mutes";
+var NC_DEVICE_MUTES_COLUMNS = [
+	(
+	/** `String(deviceId)` — one row per muted camera; unmute DELETES the row. */
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** When an admin muted it — the only thing an audit ever wants to know. */
+	{
+		name: "mutedAt",
+		type: "INTEGER",
+		notNull: true
+	})
+];
+/**
+* Absence of a row is "not muted"; there is no `muted: false` row. That keeps
+* the table proportional to what the operator actually silenced, and makes the
+* hot-path read a `Set.has`.
+*/
+var NcDeviceMuteStore = class {
+	muted = /* @__PURE__ */ new Set();
+	store;
+	logger;
+	now;
 	constructor(deps) {
-		this.deps = deps;
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
 	}
-	/**
-	* Cut one clip. Never throws — every failure is a `{ ok: false }` with a
-	* code and a sentence, because the caller's only correct response is to fall
-	* back to the clip ring.
-	*
-	* The DECLINE IS LOGGED HERE and not at the call site, so there is exactly one
-	* place that can forget to. Two cameras silently attaching two different kinds
-	* of clip is precisely what an operator cannot diagnose from a phone, and the
-	* question is always per-camera — hence `tags: { deviceId }` on every line.
-	*/
-	async renderClip(request) {
-		const result = await this.attempt(request);
-		if (!result.ok) this.deps.logger.debug("nc clip: the fMP4 seam declined — the clip ring serves this one", {
-			tags: { deviceId: request.deviceId },
-			meta: {
-				code: result.code,
-				reason: result.reason
-			}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_DEVICE_MUTES_COLLECTION,
+			columns: [...NC_DEVICE_MUTES_COLUMNS]
 		});
-		return result;
 	}
-	async attempt(request) {
-		const now = this.deps.now ?? Date.now;
-		const log = this.deps.logger;
-		const deviceId = request.deviceId;
-		const cooling = this.cooldowns.get(deviceId);
-		if (cooling !== void 0 && cooling.until > now()) {
-			cooling.suppressed += 1;
-			return {
-				ok: false,
-				code: "cooldown",
-				reason: `the seam failed to start on this camera and is suppressed for another ${Math.round((cooling.until - now()) / 1e3)}s`
-			};
-		}
-		if (this.inFlight.has(deviceId)) return {
-			ok: false,
-			code: "busy",
-			reason: "a seam clip for this camera is already being cut"
-		};
-		const transport = await this.loadTransport();
-		if (transport === null) return {
-			ok: false,
-			code: "transport-missing",
-			reason: "this host has no fMP4 fragment transport — @camstack/types predates it"
-		};
-		const entries = await this.readEntries(deviceId);
-		if (entries === null || entries.length === 0) return {
-			ok: false,
-			code: "no-entries",
-			reason: "the camera reported no profile RTSP entries"
-		};
-		const choice = pickClipSource(entries);
-		if (!choice.ok) return {
-			ok: false,
-			code: choice.refusal,
-			reason: clipRefusalReason(choice.refusal)
-		};
-		const source = choice.source;
-		this.inFlight.add(deviceId);
-		const plane = new transport.Fmp4FragmentPlane(log.child("nc-clip-plane"));
-		const child = new transport.Fmp4FragmentChild({
-			logger: log.child("nc-clip-fmp4"),
-			ffmpegBinaryPath: this.deps.ffmpegBinaryPath ?? FFMPEG_BINARY,
-			spawnFn: this.deps.spawnFn ?? node_child_process.spawn,
-			firstUnitTimeoutMs: CLIP_FIRST_UNIT_TIMEOUT_MS
-		}, {
-			sourceId: `nc-clip/${deviceId}`,
-			deviceId,
-			fragmentMs: CLIP_FRAGMENT_MS,
-			invocation: buildClipInvocation(source.url),
-			plane
-		});
-		const startedAt = now();
+	/**
+	* (Re)hydrate. A failed load KEEPS what is already in memory rather than
+	* clearing it: dropping every mute on a transient store error would start
+	* notifying for a camera the operator silenced, without them asking — the
+	* same reasoning as `NcSnoozeStore.load`.
+	*/
+	async load() {
 		try {
-			await child.start();
+			const rows = await this.store.query.query({
+				collection: NC_DEVICE_MUTES_COLLECTION,
+				filter: { limit: 1e4 }
+			});
+			const next = /* @__PURE__ */ new Set();
+			let skipped = 0;
+			for (const row of rows) {
+				const raw = row.data["deviceId"];
+				if (typeof raw !== "number" || !Number.isInteger(raw)) {
+					skipped += 1;
+					continue;
+				}
+				next.add(raw);
+			}
+			this.muted.clear();
+			for (const id of next) this.muted.add(id);
+			if (skipped > 0) this.logger.warn("device-mute rows skipped as malformed — they silence NOTHING", { meta: { skipped } });
 		} catch (err) {
-			this.noteStartFailure(deviceId, err);
-			await child.stop().catch(() => void 0);
-			plane.dispose();
-			this.inFlight.delete(deviceId);
-			return {
-				ok: false,
-				code: "child-failed",
-				reason: `ffmpeg produced no fMP4 initialisation segment: ${errText(err)}`
-			};
+			this.logger.warn("device-mute load failed — keeping the mutes already in memory", { meta: {
+				error: String(err),
+				muted: this.muted.size
+			} });
 		}
-		this.clearCooldown(deviceId);
-		const subscribedAt = now();
-		const postRollMs = Math.max(0, request.postRollSec) * 1e3;
-		const collectUntilMs = Math.max(request.aroundMs, subscribedAt) + postRollMs;
-		const budgetEnd = startedAt + CLIP_TOTAL_BUDGET_MS;
-		const deadlineMs = Math.min(collectUntilMs + CLIP_CADENCE_SLACK_MS, budgetEnd);
-		try {
-			const outcome = await assembleFmp4Clip({
-				subscription: plane.subscribe({ tag: `nc-clip/${deviceId}` }),
-				collectUntilMs,
-				deadlineMs,
-				maxBytes: CLIP_MAX_BYTES,
-				...this.deps.now !== void 0 ? { now: this.deps.now } : {},
-				...this.deps.setTimeoutFn !== void 0 ? { setTimeoutFn: this.deps.setTimeoutFn } : {}
-			});
-			if (!outcome.ok) {
-				log.warn("nc clip: the fragment seam produced nothing usable — falling back to the clip ring", {
-					tags: { deviceId },
-					meta: {
-						refusal: outcome.refusal,
-						reason: clipAssemblyRefusalReason(outcome.refusal),
-						brokerId: source.brokerId
-					}
-				});
-				return {
-					ok: false,
-					code: outcome.refusal,
-					reason: clipAssemblyRefusalReason(outcome.refusal)
-				};
-			}
-			const clip = outcome.clip;
-			log.info("nc clip: cut from the fMP4 seam", {
-				tags: { deviceId },
-				meta: {
-					brokerId: source.brokerId,
-					profile: source.profile,
-					resolution: `${source.width}x${source.height}`,
-					fragments: clip.fragments,
-					bytes: clip.bytes.length,
-					arrivalSpanMs: clip.arrivalSpanMs,
-					truncated: clip.truncated,
-					stoppedBecause: clip.stoppedBecause,
-					dialLatencyMs: subscribedAt - startedAt,
-					eventToDialMs: subscribedAt - request.aroundMs
+	}
+	/** Hot-path read, called once per evaluated subject. */
+	isMuted(deviceId) {
+		return this.muted.has(deviceId);
+	}
+	/** Every muted camera, ascending — a stable order so two callers agree. */
+	listMuted() {
+		return [...this.muted].toSorted((a, b) => a - b);
+	}
+	/**
+	* Mute or unmute. Idempotent in both directions; the in-memory set is
+	* updated only after the write lands, so a failed write cannot leave the
+	* hot path believing a camera is silenced when the next boot will not.
+	*/
+	async setMuted(deviceId, muted) {
+		const id = String(deviceId);
+		if (muted) {
+			await this.store.set.mutate({
+				collection: NC_DEVICE_MUTES_COLLECTION,
+				key: id,
+				value: {
+					id,
+					deviceId,
+					mutedAt: this.now()
 				}
 			});
-			return {
-				ok: true,
-				clip,
-				source
-			};
-		} finally {
-			await child.stop().catch(() => void 0);
-			plane.dispose();
-			this.inFlight.delete(deviceId);
+			this.muted.add(deviceId);
+		} else {
+			await this.store.delete.mutate({
+				collection: NC_DEVICE_MUTES_COLLECTION,
+				key: id
+			});
+			this.muted.delete(deviceId);
 		}
 	}
-	async loadTransport() {
-		if (this.transportProbed) return this.transport;
-		this.transportProbed = true;
-		const load = this.deps.loadTransport ?? defaultLoadTransport;
-		try {
-			this.transport = await load();
-		} catch (err) {
-			this.transport = null;
-			this.deps.logger.warn("nc clip: this host carries no fMP4 fragment transport — every clip falls back to the ring", { meta: { error: errText(err) } });
-		}
-		return this.transport;
+};
+var NcDeviceStateCache = class {
+	deps;
+	states = /* @__PURE__ */ new Map();
+	lastOkAt = 0;
+	ids = [];
+	now;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? (() => Date.now());
 	}
-	async readEntries(deviceId) {
+	/**
+	* The device ids worth reading — recomputed from the rule set, so a cluster
+	* with no gated rule does no work at all.
+	*/
+	setWatched(ids) {
+		this.ids = [...new Set(ids)].sort((a, b) => a - b);
+	}
+	watched() {
+		return this.ids;
+	}
+	/** Hot-path read. No I/O, no await — this is called per event. */
+	get(deviceId) {
+		if (this.now() - this.lastOkAt > 3e5) return void 0;
+		return this.states.get(deviceId);
+	}
+	/**
+	* Re-read every watched state. Never throws: a gate that could fail the
+	* evaluation tick would take the notification pipeline with it.
+	*/
+	async refresh() {
+		if (this.ids.length === 0) {
+			this.states = /* @__PURE__ */ new Map();
+			return;
+		}
 		try {
-			return await this.deps.listProfileEntries(deviceId);
+			const next = await this.deps.readStates(this.ids);
+			this.states = new Map(next);
+			this.lastOkAt = this.now();
+			for (const id of this.ids) if (!next.has(id)) this.deps.logger.info("device-state gate: no state for a watched device", { tags: { deviceId: id } });
 		} catch (err) {
-			this.deps.logger.debug("nc clip: could not read the camera profile entries", {
-				tags: { deviceId },
-				meta: { error: errText(err) }
-			});
-			return null;
+			this.deps.logger.warn("device-state refresh failed — keeping the previous states until they age out", { meta: {
+				watched: this.ids.length,
+				error: String(err)
+			} });
 		}
 	}
-	noteStartFailure(deviceId, err) {
-		const now = this.deps.now ?? Date.now;
-		this.cooldowns.set(deviceId, {
-			until: now() + CLIP_FAILURE_COOLDOWN_MS,
-			suppressed: 0
-		});
-		this.deps.logger.warn("nc clip: the fMP4 child would not start — this camera falls back to the clip ring for now", {
-			tags: { deviceId },
-			meta: {
-				error: errText(err),
-				cooldownMs: CLIP_FAILURE_COOLDOWN_MS
-			}
-		});
-	}
-	clearCooldown(deviceId) {
-		const previous = this.cooldowns.get(deviceId);
-		if (previous === void 0) return;
-		this.cooldowns.delete(deviceId);
-		this.deps.logger.info("nc clip: the fMP4 seam recovered on this camera", {
-			tags: { deviceId },
-			meta: { suppressedAttempts: previous.suppressed }
-		});
-	}
 };
-/**
-* The invocation, minus the sink the child owns.
-*
-* `copy` is the entire point (see the class docblock) and the audio IS encoded,
-* because camera microphones are G.711/PCM and an mp4 attachment has to carry
-* AAC to play anywhere. `-c:a aac` with no audio stream in the source is a
-* no-op in ffmpeg's default stream selection, so a silent camera needs no
-* second branch.
-*/
-function buildClipInvocation(url) {
-	return {
-		logLevel: "error",
-		decodeHwAccel: null,
-		input: {
-			url,
-			rtspTransport: "tcp",
-			analyzeDurationUs: 1e6,
-			probeSizeBytes: 1e6
-		},
-		video: { kind: "copy" },
-		audio: {
-			kind: "encode",
-			codec: "aac",
-			bitrateKbps: 64,
-			sampleRateHz: 24e3,
-			channels: 1
-		},
-		threadCount: 0,
-		outputArgs: []
-	};
-}
-async function defaultLoadTransport() {
-	const mod = await Promise.resolve().then(() => require("../node-CnEKzHgS.js"));
-	if (typeof mod.Fmp4FragmentChild !== "function" || typeof mod.Fmp4FragmentPlane !== "function") return null;
-	return {
-		Fmp4FragmentChild: mod.Fmp4FragmentChild,
-		Fmp4FragmentPlane: mod.Fmp4FragmentPlane
-	};
-}
-function errText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 //#endregion
 //#region src/pipeline-analytics/pipeline/label-utils.ts
 /**
@@ -2072,12 +1691,13 @@ function readSensorEventType(value) {
 * what the operator named in the rule. Carrying only the camera is what made a
 * sensor-scoped rule unmatched — see {@link NcRuleSubject.sourceDeviceId}.
 */
-function subjectFromSensorEvent(ev) {
+function subjectFromSensorEvent(ev, markerTrackId) {
 	const eventType = readSensorEventType(ev.value);
 	return {
 		kind: "device-event",
 		recordId: ev.id,
 		deviceId: ev.deviceId,
+		...markerTrackId !== void 0 ? { trackId: markerTrackId } : {},
 		...ev.sourceDeviceId !== ev.deviceId ? { sourceDeviceId: ev.sourceDeviceId } : {},
 		timestamp: ev.timestamp,
 		classNames: [],
@@ -2562,20 +2182,6 @@ function bestMatchingKindPreference(signal, ownerKind) {
 //#endregion
 //#region src/notification-center/dispatcher.ts
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
-/** GIF and MP4 are the same cut in two containers — one render request each. */
-var FOOTAGE_FORMATS = [{
-	flag: "mediaGif",
-	format: "gif",
-	mediaType: "gif",
-	mime: "image/gif",
-	name: "event.gif"
-}, {
-	flag: "mediaClip",
-	format: "mp4",
-	mediaType: "video",
-	mime: "video/mp4",
-	name: "event.mp4"
-}];
 var NcDispatcher = class {
 	deps;
 	targetCache = null;
@@ -2958,32 +2564,43 @@ var NcDispatcher = class {
 					name: "zone.jpg"
 				} : still);
 			} else out.push(still);
-		}
-		for (const want of FOOTAGE_FORMATS) {
-			if (entry.payload[want.flag] !== true || !this.deps.renderFootage) continue;
-			try {
-				const rendered = await this.deps.renderFootage({
-					deviceId: entry.payload.subject.deviceId,
-					aroundMs: entry.payload.subject.timestamp,
-					format: want.format,
-					...entry.payload.mediaClipPreRollSec !== void 0 ? { preRollSec: entry.payload.mediaClipPreRollSec } : {},
-					...entry.payload.mediaClipPostRollSec !== void 0 ? { postRollSec: entry.payload.mediaClipPostRollSec } : {},
-					...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {},
-					...entry.payload.mediaClipSpeed !== void 0 ? { speed: entry.payload.mediaClipSpeed } : {}
-				});
-				if (rendered !== null && rendered.byteLength > 0) {
-					const bytes = new Uint8Array(rendered.byteLength);
-					bytes.set(rendered);
-					out.push({
-						mediaType: want.mediaType,
-						bytes,
-						mime: want.mime,
-						name: want.name
-					});
-				}
-			} catch (err) {
-				this.notePendingFootage(entry, err, want.format === "gif" ? "gif" : "clip");
-			}
+		} else if (entry.payload.media !== "none") this.deps.logger.info("no still could be resolved — this notification ships text-only", {
+			tags: { deviceId: entry.payload.subject.deviceId },
+			meta: {
+				recordKind: entry.recordKind,
+				recordId: entry.recordId,
+				policy: entry.payload.media,
+				...entry.payload.mediaFrame !== void 0 ? { frame: entry.payload.mediaFrame } : {},
+				owners: [...entry.payload.subject.eventId !== void 0 ? [`event:${entry.payload.subject.eventId}`] : [], ...entry.payload.subject.trackId !== void 0 ? [`track:${entry.payload.subject.trackId}`] : []]
+			}
+		});
+		const wantGif = entry.payload.mediaGif === true;
+		const wantMp4 = entry.payload.mediaClip === true;
+		if ((wantGif || wantMp4) && this.deps.renderEventMedia !== void 0) try {
+			const media = await this.deps.renderEventMedia({
+				deviceId: entry.payload.subject.deviceId,
+				aroundMs: entry.payload.subject.timestamp,
+				wantGif,
+				wantMp4,
+				preRollSec: entry.payload.mediaClipPreRollSec ?? 4,
+				postRollSec: entry.payload.mediaClipPostRollSec ?? 6,
+				...entry.payload.mediaProfile !== void 0 ? { profile: entry.payload.mediaProfile } : {},
+				...entry.payload.mediaClipSpeed !== void 0 ? { speed: entry.payload.mediaClipSpeed } : {}
+			});
+			if (media.gif !== null && media.gif.byteLength > 0) out.push({
+				mediaType: "gif",
+				bytes: copyBytes(media.gif),
+				mime: "image/gif",
+				name: "event.gif"
+			});
+			if (media.mp4 !== null && media.mp4.byteLength > 0) out.push({
+				mediaType: "video",
+				bytes: copyBytes(media.mp4),
+				mime: "video/mp4",
+				name: "event.mp4"
+			});
+		} catch (err) {
+			this.notePendingFootage(entry, err, wantMp4 ? "clip" : "gif");
 		}
 		return out;
 	}
@@ -2994,8 +2611,8 @@ var NcDispatcher = class {
 		try {
 			const points = (await this.deps.getZonePolygons?.(deviceId, zoneIds) ?? []).flat();
 			if (points.length === 0) return null;
-			const { default: sharp$7 } = await import("sharp");
-			const img = sharp$7(Buffer.from(jpeg));
+			const { default: sharp$8 } = await import("sharp");
+			const img = sharp$8(Buffer.from(jpeg));
 			const meta = await img.metadata();
 			const W = meta.width ?? 0;
 			const H = meta.height ?? 0;
@@ -3152,6 +2769,135 @@ function paramNumber(params, key) {
 function clampPriority(priority) {
 	return Math.max(1, Math.min(5, Math.round(priority)));
 }
+/**
+* A copy backed by its own `ArrayBuffer`.
+*
+* The attachment types demand `Uint8Array<ArrayBuffer>`, and a view handed over
+* by an assembler may sit on a shared buffer. Copying is cheap next to the
+* encode that produced it and removes a whole class of aliasing question.
+*/
+function copyBytes(bytes) {
+	const out = new Uint8Array(bytes.byteLength);
+	out.set(bytes);
+	return out;
+}
+//#endregion
+//#region src/notification-center/event-intake.ts
+/** Object-event insert (movement-state transitions + zone crossings). */
+function incomingFromObjectEvent(event) {
+	return {
+		subject: subjectFromObjectEvent(event),
+		kind: "object-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: { eventId: event.id }
+		})
+	};
+}
+/** `TrackCloser.closeExpired` — the ONE close point. */
+function incomingFromTrack(track, info) {
+	return {
+		subject: subjectFromTrack(track, info),
+		kind: "track-end",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: track.deviceId },
+			meta: { trackId: track.trackId }
+		})
+	};
+}
+/**
+* Sensor-event persist (one row per linked camera).
+*
+* `markerTrackId` is the synthetic marker track the same state change
+* projected onto this camera — the notification's media owner, and the only
+* frame a device event has. Absent when no marker landed.
+*/
+function incomingFromSensorEvent(event, markerTrackId) {
+	return {
+		subject: subjectFromSensorEvent(event, markerTrackId),
+		kind: "device-event",
+		origin: "sensor",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				sensorEventId: event.id,
+				kind: event.kind,
+				...markerTrackId !== void 0 ? { trackId: markerTrackId } : {}
+			}
+		})
+	};
+}
+/** Audio-event persist (classified episode). */
+function incomingFromAudioEvent(event) {
+	return {
+		subject: subjectFromAudioEvent(event),
+		kind: "audio-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				audioEventId: event.id,
+				class: event.classification?.className
+			}
+		})
+	};
+}
+/** Package object-event persist (delivered / picked-up). */
+function incomingFromPackageEvent(event, phase) {
+	return {
+		subject: subjectFromPackageEvent(event, phase),
+		kind: "package-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				eventId: event.id,
+				phase
+			}
+		})
+	};
+}
+/** A committed ZoneAnalytics occupancy edge. */
+function incomingFromOccupancyEdge(edge) {
+	return {
+		subject: subjectFromOccupancyEvent(edge),
+		kind: "occupancy-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: edge.deviceId },
+			meta: {
+				zoneId: edge.zoneId ?? "@frame",
+				className: edge.className ?? "@all",
+				count: edge.count,
+				threshold: edge.threshold,
+				occupied: edge.occupied
+			}
+		})
+	};
+}
+/** Re-stamp a live-producer envelope as a boot-reconcile replay of the same
+*  record — same subject, honest origin in the log. */
+function asReconcile(event) {
+	return {
+		...event,
+		origin: "reconcile"
+	};
+}
+/**
+* The delivery an intake kind rides. `object-event` and `audio-event` both ride
+* `immediate` (classified audio has no delivery of its own — it is gated by the
+* audio-class opt-in instead); `occupancy-event` rides `device-event`.
+*
+* Extracted from the centre so the tester can tell an operator which rules a
+* given simulated trigger will even be considered against, without evaluating.
+*/
+function deliveryForKind(kind) {
+	if (kind === "object-event" || kind === "audio-event") return "immediate";
+	if (kind === "occupancy-event") return "device-event";
+	return kind;
+}
 //#endregion
 //#region src/notification-center/occupancy-watcher.ts
 /** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
@@ -4008,60 +3754,6 @@ function rowToEntry$1(id, data) {
 	};
 }
 //#endregion
-//#region src/notification-center/action-buttons.ts
-/** Sequence names the rule actually declares. A button may only name one. */
-function declaredSequences(actions) {
-	const names = /* @__PURE__ */ new Set();
-	for (const sequence of actions.onTrigger ?? []) names.add(sequence.name);
-	return names;
-}
-/**
-* Build the notification's buttons.
-*
-* Returns an empty array rather than `undefined` — the caller decides whether
-* to set the field, and an empty array is the honest answer to "which buttons
-* survived", which `undefined` would conflate with "the rule declared none".
-*/
-function buildActionButtons(input) {
-	const actions = input.actions;
-	if (actions === void 0) return [];
-	const buttons = actions.buttons ?? [];
-	if (buttons.length === 0) return [];
-	const known = declaredSequences(actions);
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const button of buttons) {
-		if (!known.has(button.sequence)) continue;
-		if (seen.has(button.id)) continue;
-		seen.add(button.id);
-		out.push({
-			id: button.id,
-			label: button.label,
-			url: input.mintUrl({
-				sequence: button.sequence,
-				actionId: button.id
-			}),
-			...button.icon !== void 0 ? { icon: button.icon } : {},
-			...button.destructive !== void 0 ? { destructive: button.destructive } : {}
-		});
-	}
-	return out;
-}
-/**
-* Which of a rule's buttons name a sequence it does not have.
-*
-* Exported so the caller can LOG the drop. A button silently missing from a
-* notification is the exact shape of failure this repo keeps paying for — the
-* operator authored it, it never appeared, and nothing said why.
-*/
-function unresolvableButtons(actions) {
-	if (actions === void 0) return [];
-	const buttons = actions.buttons ?? [];
-	if (buttons.length === 0) return [];
-	const known = declaredSequences(actions);
-	return buttons.filter((b) => !known.has(b.sequence)).map((b) => `${b.id}→${b.sequence}`);
-}
-//#endregion
 //#region src/notification-center/rule-actions.ts
 var NcRuleActionRunner = class {
 	deps;
@@ -4374,53 +4066,6 @@ var NcRuleStore = class {
 		});
 	}
 };
-var NcDeviceStateCache = class {
-	deps;
-	states = /* @__PURE__ */ new Map();
-	lastOkAt = 0;
-	ids = [];
-	now;
-	constructor(deps) {
-		this.deps = deps;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	/**
-	* The device ids worth reading — recomputed from the rule set, so a cluster
-	* with no gated rule does no work at all.
-	*/
-	setWatched(ids) {
-		this.ids = [...new Set(ids)].sort((a, b) => a - b);
-	}
-	watched() {
-		return this.ids;
-	}
-	/** Hot-path read. No I/O, no await — this is called per event. */
-	get(deviceId) {
-		if (this.now() - this.lastOkAt > 3e5) return void 0;
-		return this.states.get(deviceId);
-	}
-	/**
-	* Re-read every watched state. Never throws: a gate that could fail the
-	* evaluation tick would take the notification pipeline with it.
-	*/
-	async refresh() {
-		if (this.ids.length === 0) {
-			this.states = /* @__PURE__ */ new Map();
-			return;
-		}
-		try {
-			const next = await this.deps.readStates(this.ids);
-			this.states = new Map(next);
-			this.lastOkAt = this.now();
-			for (const id of this.ids) if (!next.has(id)) this.deps.logger.info("device-state gate: no state for a watched device", { tags: { deviceId: id } });
-		} catch (err) {
-			this.deps.logger.warn("device-state refresh failed — keeping the previous states until they age out", { meta: {
-				watched: this.ids.length,
-				error: String(err)
-			} });
-		}
-	}
-};
 //#endregion
 //#region src/notification-center/snooze-digest.ts
 /** `14:03` in the node's local zone — a digest is read by a person, at home. */
@@ -4537,119 +4182,6 @@ function dueSummaries(entries, nowMs, alreadySent) {
 	return entries.filter((e) => e.summary && nowMs >= e.expiresAt && !alreadySent.has(e.id));
 }
 //#endregion
-//#region src/notification-center/device-mute-store.ts
-var NC_DEVICE_MUTES_COLLECTION = "notification-center:device-mutes";
-var NC_DEVICE_MUTES_COLUMNS = [
-	(
-	/** `String(deviceId)` — one row per muted camera; unmute DELETES the row. */
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	}),
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	(
-	/** When an admin muted it — the only thing an audit ever wants to know. */
-	{
-		name: "mutedAt",
-		type: "INTEGER",
-		notNull: true
-	})
-];
-/**
-* Absence of a row is "not muted"; there is no `muted: false` row. That keeps
-* the table proportional to what the operator actually silenced, and makes the
-* hot-path read a `Set.has`.
-*/
-var NcDeviceMuteStore = class {
-	muted = /* @__PURE__ */ new Set();
-	store;
-	logger;
-	now;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: NC_DEVICE_MUTES_COLLECTION,
-			columns: [...NC_DEVICE_MUTES_COLUMNS]
-		});
-	}
-	/**
-	* (Re)hydrate. A failed load KEEPS what is already in memory rather than
-	* clearing it: dropping every mute on a transient store error would start
-	* notifying for a camera the operator silenced, without them asking — the
-	* same reasoning as `NcSnoozeStore.load`.
-	*/
-	async load() {
-		try {
-			const rows = await this.store.query.query({
-				collection: NC_DEVICE_MUTES_COLLECTION,
-				filter: { limit: 1e4 }
-			});
-			const next = /* @__PURE__ */ new Set();
-			let skipped = 0;
-			for (const row of rows) {
-				const raw = row.data["deviceId"];
-				if (typeof raw !== "number" || !Number.isInteger(raw)) {
-					skipped += 1;
-					continue;
-				}
-				next.add(raw);
-			}
-			this.muted.clear();
-			for (const id of next) this.muted.add(id);
-			if (skipped > 0) this.logger.warn("device-mute rows skipped as malformed — they silence NOTHING", { meta: { skipped } });
-		} catch (err) {
-			this.logger.warn("device-mute load failed — keeping the mutes already in memory", { meta: {
-				error: String(err),
-				muted: this.muted.size
-			} });
-		}
-	}
-	/** Hot-path read, called once per evaluated subject. */
-	isMuted(deviceId) {
-		return this.muted.has(deviceId);
-	}
-	/** Every muted camera, ascending — a stable order so two callers agree. */
-	listMuted() {
-		return [...this.muted].toSorted((a, b) => a - b);
-	}
-	/**
-	* Mute or unmute. Idempotent in both directions; the in-memory set is
-	* updated only after the write lands, so a failed write cannot leave the
-	* hot path believing a camera is silenced when the next boot will not.
-	*/
-	async setMuted(deviceId, muted) {
-		const id = String(deviceId);
-		if (muted) {
-			await this.store.set.mutate({
-				collection: NC_DEVICE_MUTES_COLLECTION,
-				key: id,
-				value: {
-					id,
-					deviceId,
-					mutedAt: this.now()
-				}
-			});
-			this.muted.add(deviceId);
-		} else {
-			await this.store.delete.mutate({
-				collection: NC_DEVICE_MUTES_COLLECTION,
-				key: id
-			});
-			this.muted.delete(deviceId);
-		}
-	}
-};
-//#endregion
 //#region src/notification-center/snooze-store.ts
 /**
 * NcSnoozeStore — the durable half of snooze.
@@ -5003,6 +4535,314 @@ var NcSnoozeStore = class {
 	}
 };
 //#endregion
+//#region src/notification-center/test-event.ts
+/** Normalized 0..1 rectangle, top-left origin — the subject bbox space. */
+var BboxSchema = require_dist.object({
+	x: require_dist.number().min(0).max(1),
+	y: require_dist.number().min(0).max(1),
+	w: require_dist.number().min(0).max(1),
+	h: require_dist.number().min(0).max(1)
+});
+/**
+* Which trigger to simulate. One value per {@link NcSubjectKind}, because the
+* kind is what decides the delivery a rule must declare to be a candidate at
+* all — picking the wrong one is the single most common reason an operator's
+* rule "does not fire", and making it an explicit choice is half the point of
+* the tester.
+*/
+var TriggerSchema = require_dist._enum([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event",
+	"audio-event",
+	"occupancy-event"
+]);
+/**
+* What the operator typed. Every field maps onto exactly one field of
+* {@link NcRuleSubject} — there is no test-only condition input, because a
+* condition the tester could set and a real record could not is a condition the
+* test result would lie about.
+*/
+var NcTestEventInputSchema = require_dist.object({
+	trigger: TriggerSchema,
+	/** The CAMERA the event is attributed to (what a notification shows). */
+	deviceId: require_dist.number().int(),
+	/** DEVICE-EVENT: the linked device whose state changed — the contact, the
+	*  button, the doorbell — when that is not the camera. */
+	sourceDeviceId: require_dist.number().int().optional(),
+	/** Detection class ids, from the NC taxonomy (`person`, `car`, `audio-…`). */
+	classNames: require_dist.array(require_dist.string()).default([]),
+	/** Collapsed display label — an identity name, a plate, a subclass. */
+	label: require_dist.string().optional(),
+	/** Detection confidence [0,1]. ABSENT is meaningful: a `minConfidence`
+	*  condition FAILS on an absent confidence, and the tester must be able to
+	*  reproduce that. */
+	confidence: require_dist.number().min(0).max(1).optional(),
+	/** Identity/plate MATCH confidence — distinct from `confidence`. */
+	labelConfidence: require_dist.number().min(0).max(1).optional(),
+	/** Key-event importance [0,1] (track-end only, in practice). */
+	importance: require_dist.number().min(0).max(1).optional(),
+	/** Track lifespan in seconds (track-end only). */
+	dwellSeconds: require_dist.number().min(0).optional(),
+	/** Admin zone ids the subject is in (object) / visited (track). */
+	zones: require_dist.array(require_dist.string()).default([]),
+	/** OBJECT-EVENT: simulate a confirmed zone crossing. */
+	crossing: require_dist.object({
+		zoneId: require_dist.string(),
+		direction: require_dist._enum(["enter", "exit"])
+	}).optional(),
+	/** DEVICE-EVENT: the taxonomy kind id (`doorbell`, `contact`, `button`, …). */
+	sensorKind: require_dist.string().optional(),
+	/** DEVICE-EVENT: the raw device event-type token, when the source is an
+	*  event-emitter slice. */
+	eventType: require_dist.string().optional(),
+	/** PACKAGE-EVENT: which lifecycle phase. */
+	packagePhase: require_dist._enum(["delivered", "picked-up"]).optional(),
+	/** Detection provenance. Absent = `pipeline` (what a record with no stamped
+	*  source reads as). */
+	source: require_dist._enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"audio"
+	]).optional(),
+	/** Normalized bbox — feeds `customZones`, AND is what lets the still be
+	*  cropped / boxed the way the rule's media policy asks. */
+	bbox: BboxSchema.optional(),
+	/** OCCUPANCY-EVENT: the committed count edge. */
+	occupancy: require_dist.object({
+		zoneId: require_dist.string().optional(),
+		zoneName: require_dist.string().optional(),
+		className: require_dist.string().optional(),
+		count: require_dist.number().int().min(0),
+		previousCount: require_dist.number().int().min(0).default(0),
+		occupied: require_dist.boolean(),
+		threshold: require_dist.number().int().min(1)
+	}).optional(),
+	/** The instant the event happened. Absent = now. Set it to test a schedule
+	*  condition without waiting for the hour. */
+	timestamp: require_dist.number().int().optional(),
+	/** Evaluate only this rule (what the per-rule Test button sends). */
+	onlyRuleId: require_dist.string().optional(),
+	bypassCooldown: require_dist.boolean().default(false),
+	bypassMute: require_dist.boolean().default(false),
+	/** Run the matched rule's `onTrigger` sequences. OFF by default: a test must
+	*  not open a gate the operator did not ask to open. */
+	runActions: require_dist.boolean().default(false),
+	/** Where the still comes from. `live` takes a snapshot of the camera NOW;
+	*  `none` sends the notification without one. */
+	still: require_dist._enum(["live", "none"]).default("live")
+});
+/** Per-rule verdict, as the tester reports it. */
+var NcTestEventRuleOutcomeSchema = require_dist.object({
+	ruleId: require_dist.string(),
+	ruleName: require_dist.string(),
+	matched: require_dist.boolean(),
+	failedCondition: require_dist.string().optional(),
+	matchedOn: require_dist.array(require_dist.string()).optional(),
+	cooldown: require_dist._enum([
+		"n/a",
+		"clear",
+		"suppressed",
+		"bypassed"
+	]),
+	enqueued: require_dist.number().int(),
+	targetIds: require_dist.array(require_dist.string())
+});
+var NcTestEventResultSchema = require_dist.object({
+	/** The synthetic record id. It is `synthetic:<uuid>` and it is what to grep
+	*  for in the logs, in the outbox and in the delivery history. */
+	recordId: require_dist.string(),
+	/** Always `synthetic` — the marker the whole path carried. */
+	origin: require_dist.literal("synthetic"),
+	/** The delivery the chosen trigger rides. A rule declaring anything else was
+	*  never a candidate, which is the answer to most "it did not fire". */
+	delivery: require_dist.string(),
+	candidates: require_dist.number().int(),
+	outcomes: require_dist.array(NcTestEventRuleOutcomeSchema),
+	/** What the still ended up being. `unattachable` means the chosen TRIGGER
+	*  cannot carry one at all — an audio episode and an occupancy edge freeze no
+	*  media owner, so those notifications ship text-only in production too, and
+	*  that is a property of production, not of the test. A DEVICE event is no
+	*  longer one of them: its press projects a marker track that owns the frame. */
+	still: require_dist._enum([
+		"live",
+		"none",
+		"unavailable",
+		"unattachable"
+	]),
+	/** Everything the operator has to know to read the result honestly. */
+	notes: require_dist.array(require_dist.string()),
+	droppedBy: require_dist.string().optional()
+});
+/** The id shape every synthetic record carries. One prefix, everywhere. */
+var SYNTHETIC_ID_PREFIX = "synthetic:";
+/** True for a record id this module minted. Used by the media shim. */
+function isSyntheticId(id) {
+	return id.startsWith(SYNTHETIC_ID_PREFIX);
+}
+/**
+* Whether a subject of this kind can carry a still AT ALL, in production.
+*
+* The attachment ladder resolves media by OWNER, and `buildEntries` freezes an
+* owner onto the payload only for the kinds that have one:
+*
+*  - an `eventId` for object and package events;
+*  - a `trackId` for track-scoped ones — and, since 2026-08-08, for a
+*    DEVICE event too: the same state change projects a synthetic marker track
+*    carrying the camera's frame (`sensor-marker-projector.ts`), and the
+*    notification names it as its owner.
+*
+* An audio episode and an occupancy edge still freeze neither. Audio HAS a
+* marker projection, but its id does not reach the notification subject yet;
+* occupancy has no projection at all. Those two therefore remain honestly
+* unattachable — a tester that invented a picture for them would be advertising
+* a feature that does not exist.
+*/
+function triggerCanCarryStill(kind) {
+	return kind === "object-event" || kind === "package-event" || kind === "track-end" || kind === "device-event";
+}
+/**
+* Build the synthetic envelope. Pure: same input + same id + same clock ⇒ same
+* event, so the red-green test can assert that this subject and a
+* producer-built one are indistinguishable.
+*/
+function buildSyntheticEvent(input, recordId, now) {
+	const kind = input.trigger;
+	const timestamp = input.timestamp ?? now;
+	const carriesTrackId = kind === "object-event" || kind === "track-end" || kind === "device-event";
+	return {
+		subject: {
+			kind,
+			recordId,
+			deviceId: input.deviceId,
+			...input.sourceDeviceId !== void 0 && input.sourceDeviceId !== input.deviceId ? { sourceDeviceId: input.sourceDeviceId } : {},
+			timestamp,
+			classNames: input.classNames,
+			...input.label !== void 0 ? { label: input.label } : {},
+			...input.confidence !== void 0 ? { confidence: input.confidence } : {},
+			zones: input.zones,
+			...carriesTrackId ? { trackId: recordId } : {},
+			source: input.source ?? (kind === "device-event" ? "sensor" : "pipeline"),
+			...input.importance !== void 0 ? { importance: input.importance } : {},
+			...input.dwellSeconds !== void 0 ? { dwellSeconds: input.dwellSeconds } : {},
+			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
+			...input.sensorKind !== void 0 ? { sensorKind: input.sensorKind } : {},
+			...input.eventType !== void 0 ? { eventType: input.eventType } : {},
+			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
+			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
+			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
+			...input.occupancy !== void 0 ? { occupancy: {
+				...input.occupancy.zoneId !== void 0 ? { zoneId: input.occupancy.zoneId } : {},
+				...input.occupancy.zoneName !== void 0 ? { zoneName: input.occupancy.zoneName } : {},
+				...input.occupancy.className !== void 0 ? { className: input.occupancy.className } : {},
+				count: input.occupancy.count,
+				previousCount: input.occupancy.previousCount,
+				occupied: input.occupancy.occupied,
+				threshold: input.occupancy.threshold
+			} } : {}
+		},
+		kind,
+		origin: "synthetic",
+		controls: {
+			...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {},
+			bypassCooldown: input.bypassCooldown,
+			bypassMute: input.bypassMute,
+			runActions: input.runActions
+		},
+		log: () => ({
+			tags: { deviceId: input.deviceId },
+			meta: {
+				eventId: recordId,
+				synthetic: true,
+				trigger: input.trigger,
+				...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {}
+			}
+		})
+	};
+}
+/**
+* Turn one live JPEG into the media set the dispatcher's ladders look for.
+*
+* Every entry is the SAME photograph, differing only in how it was cut — which
+* is exactly what the ladders mean by their kind names, so nothing here claims
+* a frame it does not have:
+*
+*   - `fullFrame` / `keyFrame` / `firstFrame` — the clean scene, verbatim.
+*   - `fullFrameBoxed` — the clean scene with the operator's bbox drawn on it.
+*   - `crop` / `thumbnail` — that bbox, cut out.
+*
+* With NO bbox only the clean-scene kinds are produced, so a rule asking for
+* `frame: 'cropped'` correctly finds nothing rather than being handed a whole
+* scene it did not ask for. sharp failures degrade the same way: the clean
+* scene always survives.
+*/
+async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
+	const base64 = Buffer.from(jpeg).toString("base64");
+	const clean = (kind) => ({
+		key: `${SYNTHETIC_ID_PREFIX}${kind}`,
+		kind,
+		base64,
+		sizeBytes: jpeg.byteLength,
+		timestamp
+	});
+	const files = [
+		clean("fullFrame"),
+		clean("keyFrame"),
+		clean("firstFrame")
+	];
+	if (bbox === void 0) return files;
+	try {
+		const { default: sharp$7 } = await import("sharp");
+		const meta = await sharp$7(Buffer.from(jpeg)).metadata();
+		const W = meta.width ?? 0;
+		const H = meta.height ?? 0;
+		if (W === 0 || H === 0) return files;
+		const left = Math.max(0, Math.min(W - 1, Math.floor(bbox.x * W)));
+		const top = Math.max(0, Math.min(H - 1, Math.floor(bbox.y * H)));
+		const width = Math.max(1, Math.min(W - left, Math.ceil(bbox.w * W)));
+		const height = Math.max(1, Math.min(H - top, Math.ceil(bbox.h * H)));
+		const cropBuf = await sharp$7(Buffer.from(jpeg)).extract({
+			left,
+			top,
+			width,
+			height
+		}).jpeg({ quality: 85 }).toBuffer();
+		const cropB64 = cropBuf.toString("base64");
+		files.push({
+			key: `${SYNTHETIC_ID_PREFIX}crop`,
+			kind: "crop",
+			base64: cropB64,
+			sizeBytes: cropBuf.byteLength,
+			timestamp
+		}, {
+			key: `${SYNTHETIC_ID_PREFIX}thumbnail`,
+			kind: "thumbnail",
+			base64: cropB64,
+			sizeBytes: cropBuf.byteLength,
+			timestamp
+		});
+		const stroke = Math.max(2, Math.round(Math.min(W, H) / 240));
+		const overlay = Buffer.from(`<svg width="${W}" height="${H}"><rect x="${left}" y="${top}" width="${width}" height="${height}" fill="none" stroke="#22d3ee" stroke-width="${stroke}"/></svg>`);
+		const boxedBuf = await sharp$7(Buffer.from(jpeg)).composite([{
+			input: overlay,
+			top: 0,
+			left: 0
+		}]).jpeg({ quality: 85 }).toBuffer();
+		files.push({
+			key: `${SYNTHETIC_ID_PREFIX}fullFrameBoxed`,
+			kind: "fullFrameBoxed",
+			base64: boxedBuf.toString("base64"),
+			sizeBytes: boxedBuf.byteLength,
+			timestamp
+		});
+	} catch {
+		return files;
+	}
+	return files;
+}
+//#endregion
 //#region src/notification-center/timelapse/timelapse-store.ts
 var NC_TIMELAPSE_RULES_COLLECTION = "notification-center:timelapse-rules";
 var NC_TIMELAPSE_RULES_COLUMNS = [
@@ -5309,6 +5149,16 @@ var WATERMARK_EVERY_TICKS = 15;
 var OUTBOX_RETENTION_MS = 168 * 36e5;
 var TEST_RULE_MAX_RESULTS = 200;
 /**
+* How long a synthetic injection's live snapshot stays in RAM.
+*
+* Long enough to cover the drain tick plus the first handful of outbox
+* backoffs (5 s doubling to a 300 s cap), short enough that a forgotten test
+* cannot hold a JPEG for the life of the process. A row still retrying after
+* this loses its picture and ships text-only — the same degradation a real
+* event gets when its media never landed.
+*/
+var SYNTHETIC_MEDIA_TTL_MS = 10 * 6e4;
+/**
 * The className every durable package event carries (mirrors
 * `PackageDropDetector.PACKAGE_EVENT_CLASS` — declared locally so the NC module
 * stays free of a cross-module import into the pipeline). Delivery events use
@@ -5422,6 +5272,13 @@ var NotificationCenter = class NotificationCenter {
 	alarmPanel = null;
 	/** In-memory cooldown map — seeded from persisted outbox rows on start. */
 	lastFiredAt = /* @__PURE__ */ new Map();
+	/**
+	* The live snapshot a synthetic injection took, held for as long as the
+	* outbox may still be retrying its rows. In RAM and only in RAM: a test that
+	* left a media blob behind would be a test that persisted something, which
+	* is the one thing the synthetic producer promises not to do.
+	*/
+	syntheticMedia = /* @__PURE__ */ new Map();
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
 	lastNoMatchReportAt = /* @__PURE__ */ new Map();
 	noMatchSuppressed = /* @__PURE__ */ new Map();
@@ -5579,6 +5436,11 @@ var NotificationCenter = class NotificationCenter {
 		this.dispatcher = new NcDispatcher({
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
+			getMediaForOwner: async (ownerKind, ownerId) => {
+				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
+				if (held !== void 0) return held.files;
+				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
+			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
 			isRuleTargetDisabled: (ruleId, targetId) => this.rules.isRuleTargetDisabled(ruleId, targetId),
 			snoozeGate: (input) => this.snoozeGate(input)
@@ -5657,19 +5519,157 @@ var NotificationCenter = class NotificationCenter {
 		this.evaluationActive = false;
 	}
 	/**
+	* Consume ONE event. THE entry point of the notification path — every
+	* producer arrives here and nothing else does.
+	*
+	* Fire-and-forget: the frame path must never await a notification. The
+	* evaluation is appended to the serialized chain, so consumption order is
+	* persist order (see {@link evalChain}).
+	*
+	* It persists nothing about the event itself. Whether a durable row exists is
+	* the PRODUCER's business — the tracker writes its tracks, the sensor ingest
+	* its rows, the synthetic tester nothing at all — and the only thing written
+	* from here on is the outbox row, which is the notification's own delivery
+	* queue and not a record of the event.
+	*/
+	consumeEvent(event) {
+		if (!this.evaluationActive) return;
+		this.scheduleEvaluation(event);
+	}
+	/**
+	* The same consumption, awaited, with the verdict returned. Identical code
+	* path — {@link consumeEvent} is this function with the report discarded — so
+	* a producer that reads the report is testing what the live producers do, not
+	* a parallel implementation of it.
+	*/
+	async consumeEventAndReport(event) {
+		if (!this.evaluationActive) return {
+			recordId: event.subject.recordId,
+			kind: event.kind,
+			delivery: deliveryForKind(event.kind),
+			origin: event.origin,
+			candidates: 0,
+			outcomes: [],
+			droppedBy: "evaluation-inactive"
+		};
+		const result = this.evalChain.then(() => this.evaluateAndEnqueue(event));
+		this.evalChain = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	/**
+	* The SYNTHETIC producer — an operator-driven event, through the whole path.
+	*
+	* It builds an envelope and calls {@link consumeEventAndReport}. That is the
+	* entire integration: no bypass, no second matcher, no shortcut into the
+	* dispatcher. What the operator receives on their phone was matched by
+	* `evaluateRule`, enqueued into the durable outbox, drained by the ordinary
+	* tick, given media by the ordinary ladders, degraded by the ordinary engine
+	* and delivered by the ordinary notifier.
+	*
+	* What it does NOT do is persist the event. No track row, no object-event
+	* row, no sensor row, no media blob — {@link syntheticMedia} is RAM with an
+	* expiry. The outbox row is the exception that proves the rule: it is the
+	* notification's delivery queue, not a record of the event, and it carries
+	* `synthetic: true` so it can never be mistaken for one.
+	*/
+	async injectTestEvent(input, deps = {}) {
+		const now = this.now();
+		this.pruneSyntheticMedia(now);
+		const recordId = `${SYNTHETIC_ID_PREFIX}${(0, node_crypto.randomUUID)()}`;
+		const event = buildSyntheticEvent(input, recordId, now);
+		const notes = [];
+		let still = "none";
+		if (!triggerCanCarryStill(event.kind)) {
+			still = "unattachable";
+			notes.push(`a ${event.kind} notification carries no still in production either — the payload freezes no media owner for this trigger, so nothing to attach is the honest result, not a limitation of the test`);
+		} else if (input.still === "live") {
+			const jpeg = await this.captureLiveStill(input.deviceId, deps);
+			if (jpeg === null) {
+				still = "unavailable";
+				notes.push("the camera returned no snapshot — the notification ships without a still");
+			} else {
+				const files = await deriveSyntheticMedia(jpeg, input.bbox, now);
+				this.syntheticMedia.set(recordId, {
+					files,
+					expiresAt: now + SYNTHETIC_MEDIA_TTL_MS
+				});
+				still = "live";
+				if (input.bbox === void 0) notes.push("no bbox was given, so only the clean scene exists — a rule asking for the subject crop finds nothing, exactly as it would for a real event with no crop stored");
+			}
+		}
+		if (input.bypassCooldown) notes.push("cooldown bypassed, and NOT consumed");
+		if (input.bypassMute) notes.push("per-camera notification mute bypassed");
+		if (!input.runActions) notes.push("the rule’s onTrigger sequences were NOT run (nothing was actuated)");
+		this.logger.info("synthetic event injected", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				eventId: recordId,
+				synthetic: true,
+				trigger: input.trigger,
+				classes: input.classNames,
+				zones: input.zones,
+				still,
+				...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {}
+			}
+		});
+		const report = await this.consumeEventAndReport(event);
+		if (report.droppedBy === "no-candidate-rule") notes.push(input.onlyRuleId !== void 0 ? "that rule is not enabled, or its delivery does not match this trigger" : `no enabled rule declares delivery "${report.delivery}"`);
+		if (report.droppedBy === "muted") notes.push("this camera is muted — nothing was evaluated. Re-run with the mute bypass to see the rule verdicts");
+		if (report.droppedBy === "evaluation-inactive") notes.push("this node does not run rule evaluation — inject on the post-processing node");
+		if (report.outcomes.every((o) => o.enqueued === 0) && report.outcomes.some((o) => o.matched)) notes.push("the rule matched but no row was enqueued — every target is opted out of this rule, or the rule addresses none");
+		return {
+			recordId,
+			origin: "synthetic",
+			delivery: report.delivery,
+			candidates: report.candidates,
+			outcomes: report.outcomes.map((o) => ({
+				ruleId: o.ruleId,
+				ruleName: o.ruleName,
+				matched: o.matched,
+				...o.failedCondition !== void 0 ? { failedCondition: o.failedCondition } : {},
+				...o.matchedOn !== void 0 ? { matchedOn: [...o.matchedOn] } : {},
+				cooldown: o.cooldown,
+				enqueued: o.enqueued,
+				targetIds: [...o.targetIds]
+			})),
+			still,
+			notes,
+			...report.droppedBy !== void 0 ? { droppedBy: report.droppedBy } : {}
+		};
+	}
+	/** One live frame, or null. Never throws into an injection. */
+	async captureLiveStill(deviceId, deps) {
+		const capture = deps.getSnapshot;
+		if (capture === void 0) return null;
+		try {
+			const shot = await capture(deviceId);
+			if (shot === null || shot.base64.length === 0) return null;
+			const buf = Buffer.from(shot.base64, "base64");
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.logger.warn("synthetic injection could not photograph the camera", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+			return null;
+		}
+	}
+	/** Drop expired synthetic stills. Called on every injection — there is no
+	*  timer, because the map is empty except while a test is in flight. */
+	pruneSyntheticMedia(now) {
+		for (const [id, held] of this.syntheticMedia) if (held.expiresAt <= now) this.syntheticMedia.delete(id);
+	}
+	/**
 	* Called at the object-event persist site, in the SAME moment as the
 	* durable insert. Fire-and-forget from the frame path (never blocks the
 	* pipeline); the boot reconcile covers a crash between persist and
 	* outbox insert.
 	*/
 	onObjectEventPersisted(event, _track) {
-		if (!this.evaluationActive) return;
 		if (packagePhaseOf(event) !== null) return;
-		const subject = subjectFromObjectEvent(event);
-		this.scheduleEvaluation(subject, "object-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: { eventId: event.id }
-		}));
+		this.consumeEvent(incomingFromObjectEvent(event));
 	}
 	/**
 	* Called from `TrackCloser.closeExpired` (the ONE close point, D-3) via
@@ -5678,18 +5678,19 @@ var NotificationCenter = class NotificationCenter {
 	* post-close promotions are picked up).
 	*/
 	onTrackClosed(track, _ownedMedia, info) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromTrack(track, info);
-		this.scheduleEvaluation(subject, "track-end", () => ({
-			tags: { deviceId: track.deviceId },
-			meta: { trackId: track.trackId }
-		}));
+		this.consumeEvent(incomingFromTrack(track, info));
 	}
 	/**
-	* Called at the SensorEvent persist site (`ingestSensorStateChange` — one row
-	* per linked camera), in the SAME moment as the durable insert. Feeds the
-	* `device-event` trigger (doorbell press / sensor state change). Fire-and-
-	* forget from the ingest loop; the outbox owns delivery from here.
+	* Called for each SensorEvent row (`ingestSensorStateChange` — one per linked
+	* camera), once the same state change has had its chance to project a marker
+	* track. Feeds the `device-event` trigger (doorbell press / sensor state
+	* change). Fire-and-forget from the ingest loop; the outbox owns delivery.
+	*
+	* `markerTrackId` is that marker — the synthetic track carrying the camera's
+	* frame — and it is what gives this notification a picture: the payload
+	* freezes it as the media owner and the dispatcher resolves it through the
+	* ladder every other attachment uses. Absent means no marker landed, and the
+	* notification is text-only; that is logged, per camera, at the enqueue.
 	*
 	* Delivery-grade boundary (honest): the SensorEventStore is itself fed from
 	* the LOSSY `DeviceStateChanged` telemetry bus, and there is no NC crash-gap
@@ -5698,16 +5699,8 @@ var NotificationCenter = class NotificationCenter {
 	* device-event notification — the durable guarantee begins at this hook, not
 	* before it.
 	*/
-	onSensorEventPersisted(event) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromSensorEvent(event);
-		this.scheduleEvaluation(subject, "device-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				sensorEventId: event.id,
-				kind: event.kind
-			}
-		}));
+	onSensorEventPersisted(event, markerTrackId) {
+		this.consumeEvent(incomingFromSensorEvent(event, markerTrackId));
 	}
 	/**
 	* Called at the AUDIO-event persist site (`eventStore.insertAudio`), in the
@@ -5722,15 +5715,7 @@ var NotificationCenter = class NotificationCenter {
 	* durable guarantee begins at this hook, matching the device-event boundary.
 	*/
 	onAudioEventPersisted(event) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromAudioEvent(event);
-		this.scheduleEvaluation(subject, "audio-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				audioEventId: event.id,
-				class: event.classification?.className
-			}
-		}));
+		this.consumeEvent(incomingFromAudioEvent(event));
 	}
 	/**
 	* Called at the package object-event persist site (`PackageDropDetector` —
@@ -5739,15 +5724,7 @@ var NotificationCenter = class NotificationCenter {
 	* crash-gap reconcile re-covers them (routed by className in {@link reconcile}).
 	*/
 	onPackageEventPersisted(event, phase) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromPackageEvent(event, phase);
-		this.scheduleEvaluation(subject, "package-event", () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				eventId: event.id,
-				phase
-			}
-		}));
+		this.consumeEvent(incomingFromPackageEvent(event, phase));
 	}
 	/**
 	* Feed one ZoneAnalytics occupancy snapshot into the debounced watcher
@@ -5783,18 +5760,7 @@ var NotificationCenter = class NotificationCenter {
 	* Public so a test / a future out-of-band edge source can drive it directly.
 	*/
 	onOccupancyEdge(edge) {
-		if (!this.evaluationActive) return;
-		const subject = subjectFromOccupancyEvent(edge);
-		this.scheduleEvaluation(subject, "occupancy-event", () => ({
-			tags: { deviceId: edge.deviceId },
-			meta: {
-				zoneId: edge.zoneId ?? "@frame",
-				className: edge.className ?? "@all",
-				count: edge.count,
-				threshold: edge.threshold,
-				occupied: edge.occupied
-			}
-		}));
+		this.consumeEvent(incomingFromOccupancyEdge(edge));
 	}
 	buildProvider() {
 		return {
@@ -5891,7 +5857,7 @@ var NotificationCenter = class NotificationCenter {
 	}
 	/**
 	* Adopt the panel this node owns. Called once by the addon after
-	* `ensureAlarmPanel`; a node without one never calls it and the cap then
+	* `declareAlarmPanel`; a node without one never calls it and the cap then
 	* answers `deviceId: null`.
 	*/
 	setAlarmPanel(panel) {
@@ -5969,48 +5935,74 @@ var NotificationCenter = class NotificationCenter {
 		});
 	}
 	/** Append one evaluation to the serialized chain (see {@link evalChain}). */
-	scheduleEvaluation(subject, kind, logContext) {
+	scheduleEvaluation(event) {
 		this.evalChain = this.evalChain.then(async () => {
 			try {
-				await this.evaluateAndEnqueue(subject, kind);
+				await this.evaluateAndEnqueue(event);
 			} catch (err) {
-				const ctx = logContext();
+				const ctx = event.log();
 				this.logger.warn("rule evaluation failed", {
 					tags: ctx.tags,
 					meta: {
 						...ctx.meta,
-						kind,
+						kind: event.kind,
+						origin: event.origin,
 						error: String(err)
 					}
 				});
 			}
 		});
 	}
-	async evaluateAndEnqueue(subject, kind) {
-		if (this.deviceMutes.isMuted(subject.deviceId)) {
+	async evaluateAndEnqueue(event) {
+		const { subject, kind, origin } = event;
+		const controls = event.controls ?? {};
+		const outcomes = [];
+		const report = (extra = {}) => ({
+			recordId: subject.recordId,
+			kind,
+			delivery: deliveryForKind(kind),
+			origin,
+			candidates: 0,
+			outcomes,
+			...extra
+		});
+		if (this.deviceMutes.isMuted(subject.deviceId) && controls.bypassMute !== true) {
 			this.reportMutedDrop(subject, kind, this.now());
-			return;
+			return report({ droppedBy: "muted" });
 		}
-		const delivery = kind === "object-event" || kind === "audio-event" ? "immediate" : kind === "occupancy-event" ? "device-event" : kind;
-		const candidates = this.rules.listEnabled(delivery);
+		const delivery = deliveryForKind(kind);
+		const enabled = this.rules.listEnabled(delivery);
+		const candidates = controls.onlyRuleId !== void 0 ? enabled.filter((r) => r.id === controls.onlyRuleId) : enabled;
 		if (candidates.length === 0) {
 			this.logger.debug("no enabled rule for this trigger", {
 				tags: { deviceId: subject.deviceId },
 				meta: {
 					delivery,
 					kind,
+					origin,
 					rulesLoaded: this.rules.list().length
 				}
 			});
-			return;
+			return report({ droppedBy: "no-candidate-rule" });
 		}
 		const now = this.now();
 		let anyMatched = false;
+		/** One "no media owner" line per EVENT, not per matching rule. */
+		let noOwnerReported = false;
 		const rejections = [];
 		for (const rule of candidates) {
 			const evaluation = evaluateRule(rule, subject, (id) => this.deviceStates.get(id));
 			if (!evaluation.matched) {
 				rejections.push(`${rule.name}:${evaluation.failedCondition ?? "unknown"}`);
+				outcomes.push({
+					ruleId: rule.id,
+					ruleName: rule.name,
+					matched: false,
+					...evaluation.failedCondition !== void 0 ? { failedCondition: evaluation.failedCondition } : {},
+					cooldown: "n/a",
+					enqueued: 0,
+					targetIds: []
+				});
 				this.logger.debug("rule did not match", {
 					tags: { deviceId: subject.deviceId },
 					meta: {
@@ -6026,7 +6018,8 @@ var NotificationCenter = class NotificationCenter {
 				continue;
 			}
 			const key = cooldownKey(rule, subject);
-			if (isCoolingDown(rule, this.lastFiredAt.get(key), now)) {
+			const cooling = isCoolingDown(rule, this.lastFiredAt.get(key), now);
+			if (cooling && controls.bypassCooldown !== true) {
 				this.logger.debug("rule matched but is cooling down", {
 					tags: { deviceId: subject.deviceId },
 					meta: {
@@ -6037,6 +6030,15 @@ var NotificationCenter = class NotificationCenter {
 						...subject.trackId !== void 0 ? { trackId: subject.trackId } : {}
 					}
 				});
+				outcomes.push({
+					ruleId: rule.id,
+					ruleName: rule.name,
+					matched: true,
+					...evaluation.matchedOn !== void 0 ? { matchedOn: [...evaluation.matchedOn] } : {},
+					cooldown: "suppressed",
+					enqueued: 0,
+					targetIds: []
+				});
 				continue;
 			}
 			this.logger.info("rule matched — enqueueing", {
@@ -6045,6 +6047,7 @@ var NotificationCenter = class NotificationCenter {
 					ruleId: rule.id,
 					rule: rule.name,
 					kind,
+					origin,
 					targets: rule.targets.length,
 					eventId: subject.recordId,
 					...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
@@ -6053,7 +6056,7 @@ var NotificationCenter = class NotificationCenter {
 				}
 			});
 			const sequences = rule.actions?.onTrigger;
-			if (sequences !== void 0 && sequences.length > 0 && this.actionRunner !== null) this.actionRunner.run({
+			if (sequences !== void 0 && sequences.length > 0 && this.actionRunner !== null && controls.runActions !== false) this.actionRunner.run({
 				ruleId: rule.id,
 				ruleName: rule.name,
 				deviceId: subject.deviceId,
@@ -6068,11 +6071,35 @@ var NotificationCenter = class NotificationCenter {
 					buttons: unresolvable.join(", ")
 				}
 			});
+			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && rule.media.attach !== "none") {
+				noOwnerReported = true;
+				this.logger.warn("device event has no marker track — this notification ships text-only", {
+					tags: { deviceId: subject.deviceId },
+					meta: {
+						recordId: subject.recordId,
+						...subject.sensorKind !== void 0 ? { sensorKind: subject.sensorKind } : {},
+						ruleId: rule.id,
+						rule: rule.name
+					}
+				});
+			}
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
-			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets)) > 0) this.lastFiredAt.set(key, now);
+			const entries = this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets, origin);
+			const inserted = await this.outbox.enqueue(entries);
+			if (inserted > 0 && controls.bypassCooldown !== true) this.lastFiredAt.set(key, now);
+			outcomes.push({
+				ruleId: rule.id,
+				ruleName: rule.name,
+				matched: true,
+				...evaluation.matchedOn !== void 0 ? { matchedOn: [...evaluation.matchedOn] } : {},
+				cooldown: cooling ? "bypassed" : "clear",
+				enqueued: inserted,
+				targetIds: entries.map((e) => e.targetId)
+			});
 			anyMatched = true;
 		}
 		if (!anyMatched && rejections.length > 0) this.reportNoMatch(subject, kind, rejections, now);
+		return report({ candidates: candidates.length });
 	}
 	/**
 	* One INFO line when a MUTED camera's event is dropped, bounded to one per
@@ -6124,7 +6151,7 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
-	buildEntries(rule, subject, kind, matchedOn, userTargets = []) {
+	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline") {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
 		const direct = new Set(rule.targets.map((t) => t.targetId));
@@ -6132,6 +6159,7 @@ var NotificationCenter = class NotificationCenter {
 			const payload = {
 				ruleName: rule.name,
 				delivery: rule.delivery,
+				...origin === "synthetic" ? { synthetic: true } : {},
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: rule.media.attach,
@@ -6315,21 +6343,7 @@ var NotificationCenter = class NotificationCenter {
 			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].sort((a, b) => a.timestamp - b.timestamp);
 			for (const event of ordered) {
 				const phase = packagePhaseOf(event);
-				if (phase !== null) this.scheduleEvaluation(subjectFromPackageEvent(event, phase), "package-event", () => ({
-					tags: { deviceId: event.deviceId },
-					meta: {
-						eventId: event.id,
-						phase,
-						reconcile: true
-					}
-				}));
-				else this.scheduleEvaluation(subjectFromObjectEvent(event), "object-event", () => ({
-					tags: { deviceId: event.deviceId },
-					meta: {
-						eventId: event.id,
-						reconcile: true
-					}
-				}));
+				this.consumeEvent(asReconcile(phase !== null ? incomingFromPackageEvent(event, phase) : incomingFromObjectEvent(event)));
 			}
 			await this.evalChain;
 			if (ordered.length > 0) this.logger.info("notification reconcile scanned missed events", { meta: {
@@ -6497,7 +6511,7 @@ var NotificationCenter = class NotificationCenter {
 			}
 		} else if (rule.delivery === "track-end") {
 			const tracks = await this.deps.listRecentTracks(since, TEST_RULE_MAX_RESULTS);
-			for (const track of tracks) subjects.push(subjectFromTrack(track));
+			for (const track of tracks) subjects.push(incomingFromTrack(track).subject);
 		}
 		let lookup = (id) => this.deviceStates.get(id);
 		const gated = rule.conditions.deviceState;
@@ -6600,6 +6614,24 @@ var ncActions = require_dist.defineCustomActions({
 	"nc.cancelSnooze": require_dist.customAction(require_dist.object({ snoozeId: require_dist.string() }), require_dist.object({ success: require_dist.literal(true) }), {
 		kind: "mutation",
 		caller: "required"
+	}),
+	/**
+	* Inject a SYNTHETIC event through the whole notification path — match,
+	* media, delivery — without producing a track, an event row or anything else
+	* durable. See `test-event.ts` for what it does and does not do.
+	*
+	* A bridge action rather than a cap method, deliberately: it needs no
+	* codegen, no `@camstack/system` republish and no place on a release train,
+	* so the tester can ship and change at the speed of the addon it tests.
+	*
+	* `auth: 'admin'` because an injection DELIVERS: it reaches every target the
+	* matched rule addresses, on other people's phones. `caller: 'required'` so
+	* the log line names who pressed it.
+	*/
+	"nc.injectTestEvent": require_dist.customAction(NcTestEventInputSchema, NcTestEventResultSchema, {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
 	})
 });
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
@@ -6714,6 +6746,22 @@ function makeNcActionHandlers(deps) {
 			await deps.snooze.cancel(input.snoozeId, c);
 			return { success: true };
 		},
+		"nc.injectTestEvent": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to inject a test event");
+			const inject = deps.injectTestEvent;
+			if (inject === void 0) throw new Error("this node does not host the notification centre — inject on the hub");
+			const parsed = NcTestEventInputSchema.parse(input);
+			deps.logger.info("synthetic notification test requested", {
+				tags: { deviceId: parsed.deviceId },
+				meta: {
+					by: c.userId,
+					trigger: parsed.trigger,
+					...parsed.onlyRuleId !== void 0 ? { ruleId: parsed.onlyRuleId } : {}
+				}
+			});
+			return inject(parsed);
+		},
 		"nc.setRuleTargetEnabled": async (input, caller) => {
 			const c = requireCaller(caller);
 			assertRuleVisible(input.ruleId, c);
@@ -6723,6 +6771,844 @@ function makeNcActionHandlers(deps) {
 		}
 	};
 }
+var MAX_EXPORT_BYTES = 256 * 1024 * 1024;
+var DebugFindingSchema = require_dist.object({
+	code: require_dist.string(),
+	severity: require_dist._enum([
+		"error",
+		"warn",
+		"info"
+	]),
+	detail: require_dist.string()
+});
+var DebugTrackListItemSchema = require_dist.object({
+	trackId: require_dist.string(),
+	deviceId: require_dist.number(),
+	className: require_dist.string(),
+	label: require_dist.string().optional(),
+	firstSeen: require_dist.number(),
+	lastSeen: require_dist.number(),
+	durationMs: require_dist.number(),
+	active: require_dist.boolean()
+});
+var DebugTrackReportSchema = require_dist.object({
+	trackId: require_dist.string(),
+	deviceId: require_dist.number(),
+	className: require_dist.string(),
+	label: require_dist.string().optional(),
+	firstSeen: require_dist.number(),
+	lastSeen: require_dist.number(),
+	durationMs: require_dist.number(),
+	active: require_dist.boolean(),
+	mediaCount: require_dist.number(),
+	mediaKinds: require_dist.array(require_dist.string()).readonly(),
+	eventCount: require_dist.number(),
+	positionCount: require_dist.number(),
+	findings: require_dist.array(DebugFindingSchema).readonly()
+});
+var ListTracksInputSchema = require_dist.object({
+	/** Empty or absent means every camera that has tracks. */
+	deviceIds: require_dist.array(require_dist.number()).optional(),
+	limit: require_dist.number().int().positive().max(200).optional()
+});
+var ListTracksOutputSchema = require_dist.object({
+	tracks: require_dist.array(DebugTrackListItemSchema).readonly(),
+	/**
+	* True when a camera hit `limit`. Said rather than implied: a silently capped
+	* list is how an operator concludes a mark did not take.
+	*/
+	truncated: require_dist.boolean()
+});
+var AnalyzeInputSchema = require_dist.object({ trackIds: require_dist.array(require_dist.string()).min(1).max(200) });
+var AnalyzeOutputSchema = require_dist.object({
+	reports: require_dist.array(DebugTrackReportSchema).readonly(),
+	/**
+	* Ids that were asked for and no longer exist. Per D81 a `debug` mark does NOT
+	* pin retention, so a marked track can be evicted between the list and the
+	* analysis — reported as a number the tab can show rather than as silence.
+	*/
+	vanished: require_dist.array(require_dist.string()).readonly()
+});
+var debugActions = require_dist.defineCustomActions({
+	"debug.listTracks": require_dist.customAction(ListTracksInputSchema, ListTracksOutputSchema, { auth: "admin" }),
+	"debug.analyze": require_dist.customAction(AnalyzeInputSchema, AnalyzeOutputSchema, { auth: "admin" })
+});
+//#endregion
+//#region src/pipeline-analytics/debug/zip-stream.ts
+/**
+* A minimal STORE-only ZIP writer — enough to emit a debug bundle entry by
+* entry, without ever holding the archive in memory.
+*
+* ## Why hand-rolled, and why ZIP rather than the tar next door
+*
+* The archive the operator asked for is a ZIP, because it is the format that
+* opens with a double click on every desktop they use; the training exports use
+* ustar and that stays as it is. Both are hand-written here for the same two
+* reasons the {@link ../training-export/tar-stream.js tar writer} records:
+*
+*  1. **A dependency would not arrive.** A hub addon is deployed as its built
+*     `dist/` and carries ZERO `node_modules` of its own — adding `yazl` or
+*     `archiver` to `package.json` gets a module that is missing at runtime on
+*     the node that actually runs the code. The only libraries an addon can rely
+*     on are Node's builtins and what its bundler inlines.
+*  2. **Nothing to compress.** Every payload is JPEG or MP4, already compressed.
+*     STORE (method 0) spends no CPU on the hub's one thread for a percent or
+*     two, and — unlike DEFLATE — the entry's size and CRC are known before the
+*     header is written, so no data descriptors and no seeking back: the writer
+*     is append-only and therefore streamable.
+*
+* So: STORE-only ZIP, which is a 30-byte local header + verbatim body per entry
+* plus a central directory at the end, fully specified (APPNOTE 6.3.x), and
+* asserted against the system `unzip` binary in the spec next door rather than
+* against my reading of the format.
+*
+* ## What this deliberately does NOT do
+*
+* No ZIP64. The classic record set addresses 4 GiB and 65 535 entries, and this
+* archive is a hand-marked debug set — tens of tracks, not a dataset.
+* {@link ZipStreamWriter.fits} reports an entry that would cross either ceiling
+* so the caller can skip it and SAY it skipped it, rather than emitting an
+* archive with a wrapped offset that reads as corrupt.
+*
+* ## Entry names are ASCII, by construction
+*
+* The writer sets the UTF-8 name flag (bit 11) because that is what the format
+* says, but **it cannot be relied on**: the `unzip` shipped on macOS is Info-ZIP
+* 6.00, which ignores the flag and re-encodes the name from CP437 — `persona-è`
+* comes out of it as `persona-+¿`, and on a case where the mangled bytes are not
+* valid for the filesystem it refuses to extract the entry at all. Measured, not
+* assumed; the spec next door pins it.
+*
+* So {@link toAsciiZipName} is applied to every path, and — more importantly —
+* no free text goes into a path in the first place: an entry is addressed by
+* `deviceId` and `trackId`, and the camera name lives INSIDE `track.json` where
+* its encoding is JSON's problem and not the archive's.
+*/
+var LOCAL_SIG = 67324752;
+var CENTRAL_SIG = 33639248;
+var EOCD_SIG = 101010256;
+/** Bit 11 — the entry name is UTF-8. */
+var FLAG_UTF8 = 2048;
+/** STORE. */
+var METHOD_STORE = 0;
+/** PKZIP 2.0, the floor for STORE + UTF-8 names. */
+var VERSION = 20;
+/** The classic (non-ZIP64) ceilings. Crossing either needs ZIP64; we refuse. */
+var ZIP_MAX_BYTES = 4294967295;
+var CRC_TABLE = (() => {
+	const table = new Array(256);
+	for (let i = 0; i < 256; i++) {
+		let c = i;
+		for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+		table[i] = c >>> 0;
+	}
+	return table;
+})();
+/**
+* Reduce a path to the ASCII set every ZIP reader agrees on.
+*
+* Anything outside `[A-Za-z0-9._-]` (and the `/` separator) becomes `_`. Not a
+* transliteration: a name that survives Info-ZIP's CP437 pass unchanged is the
+* only name this archive can promise, and a lossy-but-stable mapping is better
+* than a pretty one that a reader mangles differently from the manifest.
+*/
+function toAsciiZipName(name) {
+	return name.replace(/[^A-Za-z0-9._/-]/g, "_");
+}
+/** CRC-32 (IEEE 802.3), the checksum every ZIP entry header carries. */
+function crc32(buf) {
+	let c = 4294967295;
+	for (const byte of buf) c = CRC_TABLE[(c ^ byte) & 255] ^ c >>> 8;
+	return (c ^ 4294967295) >>> 0;
+}
+/**
+* MS-DOS date/time, the only timestamp a classic ZIP record carries.
+*
+* Two-second resolution and an epoch of 1980 — a date before that is clamped
+* rather than allowed to write a negative year field, which some readers show as
+* 2107 and others reject outright.
+*/
+function dosDateTime(mtimeMs) {
+	const d = new Date(mtimeMs);
+	const year = Math.max(1980, d.getFullYear());
+	return {
+		time: d.getHours() << 11 | d.getMinutes() << 5 | d.getSeconds() >> 1,
+		date: year - 1980 << 9 | d.getMonth() + 1 << 5 | d.getDate()
+	};
+}
+/**
+* The 30-byte local header + name for one stored file.
+*
+* Sizes and CRC are written into the header itself (never a trailing data
+* descriptor) — STORE knows both before the body moves, and a header that tells
+* the truth is what lets a reader index the archive without scanning it.
+*/
+function zipLocalHeader(entry, crc, nameBytes) {
+	const head = Buffer.alloc(30);
+	const { time, date } = dosDateTime(entry.mtimeMs);
+	head.writeUInt32LE(LOCAL_SIG, 0);
+	head.writeUInt16LE(VERSION, 4);
+	head.writeUInt16LE(FLAG_UTF8, 6);
+	head.writeUInt16LE(METHOD_STORE, 8);
+	head.writeUInt16LE(time, 10);
+	head.writeUInt16LE(date, 12);
+	head.writeUInt32LE(crc, 14);
+	head.writeUInt32LE(entry.body.length, 18);
+	head.writeUInt32LE(entry.body.length, 22);
+	head.writeUInt16LE(nameBytes.length, 26);
+	head.writeUInt16LE(0, 28);
+	return Buffer.concat([head, nameBytes]);
+}
+function centralHeader(entry) {
+	const head = Buffer.alloc(46);
+	head.writeUInt32LE(CENTRAL_SIG, 0);
+	head.writeUInt16LE(VERSION, 4);
+	head.writeUInt16LE(VERSION, 6);
+	head.writeUInt16LE(FLAG_UTF8, 8);
+	head.writeUInt16LE(METHOD_STORE, 10);
+	head.writeUInt16LE(entry.dosTime, 12);
+	head.writeUInt16LE(entry.dosDate, 14);
+	head.writeUInt32LE(entry.crc, 16);
+	head.writeUInt32LE(entry.size, 20);
+	head.writeUInt32LE(entry.size, 24);
+	head.writeUInt16LE(entry.nameBytes.length, 28);
+	head.writeUInt16LE(0, 30);
+	head.writeUInt16LE(0, 32);
+	head.writeUInt16LE(0, 34);
+	head.writeUInt16LE(0, 36);
+	head.writeUInt32LE(0, 38);
+	head.writeUInt32LE(entry.offset, 42);
+	return Buffer.concat([head, entry.nameBytes]);
+}
+function endOfCentralDirectory(count, size, offset) {
+	const eocd = Buffer.alloc(22);
+	eocd.writeUInt32LE(EOCD_SIG, 0);
+	eocd.writeUInt16LE(0, 4);
+	eocd.writeUInt16LE(0, 6);
+	eocd.writeUInt16LE(count, 8);
+	eocd.writeUInt16LE(count, 10);
+	eocd.writeUInt32LE(size, 12);
+	eocd.writeUInt32LE(offset, 16);
+	eocd.writeUInt16LE(0, 20);
+	return eocd;
+}
+/**
+* True when one more entry still fits inside the classic (non-ZIP64) ceilings.
+*
+* Pure, and asked with a length rather than a Buffer, so the 4 GiB boundary can
+* be tested without allocating 4 GiB — the guard whose failure mode (a wrapped
+* 32-bit offset, producing an archive that looks complete and unpacks as
+* garbage) is precisely the one a test must be able to reach.
+*/
+function zipEntryFits(query) {
+	if (query.entryIndex >= 65535) return false;
+	const nameLen = toAsciiZipName(query.name).length;
+	return query.offset + 30 + nameLen + query.bodyLength <= ZIP_MAX_BYTES;
+}
+/**
+* An append-only ZIP writer.
+*
+* The caller supplies `write` — the real `res.write`, awaited, so backpressure
+* is the socket's. The writer holds only the central directory (one small record
+* per entry), never a body: {@link add} takes one file at a time and forgets it.
+*/
+var ZipStreamWriter = class {
+	write;
+	entries = [];
+	offset = 0;
+	constructor(write) {
+		this.write = write;
+	}
+	/** Entries accepted so far — what the manifest should claim, not what was asked. */
+	get entryCount() {
+		return this.entries.length;
+	}
+	/** Bytes emitted so far, central directory excluded. */
+	get bytesWritten() {
+		return this.offset;
+	}
+	/**
+	* True when this entry still fits inside the classic ZIP ceilings.
+	*
+	* Checked BEFORE the header goes out, because a 32-bit offset that wraps
+	* produces an archive that looks complete and unpacks as garbage — the failure
+	* this writer most needs to make impossible.
+	*/
+	fits(entry) {
+		return zipEntryFits({
+			offset: this.offset,
+			entryIndex: this.entries.length,
+			name: entry.name,
+			bodyLength: entry.body.length
+		});
+	}
+	/** Append one stored file. Returns false (and writes nothing) when it does not fit. */
+	async add(entry) {
+		if (!this.fits(entry)) return false;
+		const nameBytes = Buffer.from(toAsciiZipName(entry.name), "ascii");
+		const crc = crc32(entry.body);
+		const { time, date } = dosDateTime(entry.mtimeMs);
+		const header = zipLocalHeader(entry, crc, nameBytes);
+		this.entries.push({
+			nameBytes,
+			crc,
+			size: entry.body.length,
+			offset: this.offset,
+			dosTime: time,
+			dosDate: date
+		});
+		await this.write(header);
+		await this.write(entry.body);
+		this.offset += header.length + entry.body.length;
+		return true;
+	}
+	/** Write the central directory + EOCD. The archive is unreadable without it. */
+	async finish() {
+		const start = this.offset;
+		let size = 0;
+		for (const entry of this.entries) {
+			const block = centralHeader(entry);
+			await this.write(block);
+			size += block.length;
+		}
+		await this.write(endOfCentralDirectory(this.entries.length, size, start));
+		this.offset = start + size + 22;
+	}
+};
+var DEBUG_MANIFEST_ENTRY = "manifest.json";
+var DEBUG_TRACK_ENTRY = "track.json";
+var DEBUG_ANALYSIS_ENTRY = "analysis.json";
+var DEBUG_EVENTS_ENTRY = "events.json";
+/** `tracks/<deviceId>/<trackId>` — ASCII by construction, both parts are ids. */
+function debugTrackDir(deviceId, trackId) {
+	return toAsciiZipName(`tracks/${String(deviceId)}/${trackId}`);
+}
+/**
+* Resolve every media row of one track to an archive-relative name.
+*
+* Deterministic: the input order (the store returns `timestamp asc`) fully
+* determines the output, so re-exporting an unchanged track produces the same
+* names. A kind that occurs once is bare (`keyFrame.jpg`); a kind that repeats
+* carries its timestamp; a genuine duplicate of both gets `-2`, `-3`, …
+*/
+function planTrackMediaNames(media) {
+	const occurrences = /* @__PURE__ */ new Map();
+	for (const m of media) occurrences.set(m.kind, (occurrences.get(m.kind) ?? 0) + 1);
+	const used = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const m of media) {
+		const base = (occurrences.get(m.kind) ?? 0) > 1 ? `${m.kind}-${String(m.timestamp)}` : m.kind;
+		let name = `media/${base}.jpg`;
+		for (let n = 2; used.has(name); n++) name = `media/${base}-${String(n)}.jpg`;
+		used.add(name);
+		out.push({
+			key: m.key,
+			name: toAsciiZipName(name),
+			kind: m.kind,
+			timestamp: m.timestamp,
+			sizeBytes: m.sizeBytes
+		});
+	}
+	return out;
+}
+var DEBUG_RETENTION_NOTE = "A `debug` mark does not pin retention (D81). A track with no media here may have been evicted rather than never captured.";
+/** The archive filename, stamped so two downloads never collide in ~/Downloads. */
+function debugArchiveFilename(nowMs) {
+	return `camstack-debug-${new Date(nowMs).toISOString().replace(/[:.]/g, "-")}.zip`.replace(/[\r\n"]/g, "");
+}
+/** Parse `?deviceIds=615,617` — empty means every camera. */
+function parseDebugDeviceIds(url) {
+	const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+	const raw = new URLSearchParams(query).get("deviceIds");
+	if (raw === null || raw.trim() === "") return [];
+	const out = [];
+	for (const part of raw.split(",")) {
+		const n = Number.parseInt(part.trim(), 10);
+		if (Number.isInteger(n) && n > 0 && !out.includes(n)) out.push(n);
+	}
+	return out;
+}
+//#endregion
+//#region src/pipeline-analytics/data-plane-access.ts
+/**
+* Prefix literals for the export planes, mirrored here so the policy reads as
+* a table without importing three handler modules into the addon's boot path.
+* `data-plane-access.spec.ts` asserts they still match the constants their
+* handlers register with — a mirror nothing checks is a lie waiting to happen.
+*/
+var TRAINING_EXPORT_PREFIX_REF = "training-export";
+var RETRAIN_EXPORT_PREFIX_REF = "retrain-export";
+var DEBUG_EXPORT_PREFIX_REF = "debug-export";
+/**
+* Every data plane this addon serves, and the level the HUB enforces before it
+* proxies. Exhaustive by test: a new plane that forgets to appear here fails
+* `data-plane-access.spec.ts`.
+*/
+var PIPELINE_ANALYTICS_PLANE_ACCESS = {
+	/** One stored crop/thumbnail by an unguessable id the caller already holds. */
+	"event-media": "authenticated",
+	/** Self-authenticating single-use action token (D47). */
+	"nc-action": "public",
+	/** Self-authenticating single-use artifact token (D47). */
+	"nc-artifact": "public",
+	/** Every frame behind a marked selection — a corpus, not an item. */
+	[TRAINING_EXPORT_PREFIX_REF]: "admin",
+	[RETRAIN_EXPORT_PREFIX_REF]: "admin",
+	/** Diagnostic bundle: logs, config and frames. */
+	[DEBUG_EXPORT_PREFIX_REF]: "admin"
+};
+/** The declared level for a plane prefix. Typed, so a prefix with no declared
+*  policy is a compile error rather than a silent default. */
+function planeAccess(prefix) {
+	return PIPELINE_ANALYTICS_PLANE_ACCESS[prefix];
+}
+//#endregion
+//#region src/pipeline-analytics/debug/debug-export-handler.ts
+/**
+* Pacing. The export is a BACKGROUND job sharing a thread with live decode, so
+* it yields twice: between tracks, and between individual media files.
+*
+* The per-file yield is the one that matters. A track can own twenty blobs, and
+* reading them back to back — each a base64 decode of a few hundred KB —
+* occupies the loop for long enough that snapshot resizes start timing out. One
+* file at a time, with a gap, keeps the export off the critical path; it is slow
+* on purpose.
+*/
+var TRACK_PACING_MS = 25;
+var MEDIA_PACING_MS = 15;
+function json(value) {
+	return Buffer.from(JSON.stringify(value, null, 2), "utf8");
+}
+/** Total media rows the plan hopes to ship — the number HEAD reports. */
+function plannedMediaCount(plan) {
+	let total = 0;
+	for (const t of plan.tracks) total += t.media.length;
+	return total;
+}
+function createDebugExportHandler(deps) {
+	return async (req, res) => {
+		const method = req.method ?? "GET";
+		if (method !== "GET" && method !== "HEAD") {
+			res.writeHead(405, { allow: "GET, HEAD" });
+			res.end();
+			return;
+		}
+		const deviceIds = parseDebugDeviceIds(req.url ?? "");
+		let plan;
+		try {
+			plan = await deps.buildPlan(deviceIds);
+		} catch (err) {
+			deps.logger.warn("debug export plan failed", { meta: { error: String(err) } });
+			res.writeHead(500, { "content-type": "text/plain" });
+			res.end("debug export plan failed");
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": "application/zip",
+			"content-disposition": `attachment; filename="${debugArchiveFilename(deps.now())}"`,
+			"cache-control": "no-store",
+			"x-camstack-debug-tracks": String(plan.tracks.length),
+			"x-camstack-debug-media": String(plannedMediaCount(plan))
+		});
+		if (method === "HEAD") {
+			res.end();
+			return;
+		}
+		const write = (chunk) => new Promise((resolve, reject) => {
+			if (!res.write(chunk, (err) => {
+				if (err) reject(err);
+				else resolve();
+			})) res.once("drain", resolve);
+		});
+		const zip = new ZipStreamWriter(write);
+		const mtimeMs = deps.now();
+		const startedAt = deps.now();
+		const manifestTracks = [];
+		let included = 0;
+		let missing = 0;
+		let stoppedBecause = plan.capped ? "track-cap" : null;
+		for (const entry of plan.tracks) {
+			if (zip.bytesWritten >= 268435456) {
+				stoppedBecause ??= "byte-budget";
+				deps.logger.warn("debug export stopped — byte budget reached", { meta: {
+					budget: MAX_EXPORT_BYTES,
+					written: zip.bytesWritten
+				} });
+				break;
+			}
+			const dir = debugTrackDir(entry.report.deviceId, entry.report.trackId);
+			const deviceId = entry.report.deviceId;
+			for (const [name, body] of [
+				[DEBUG_TRACK_ENTRY, json(entry.track)],
+				[DEBUG_ANALYSIS_ENTRY, json(entry.report)],
+				[DEBUG_EVENTS_ENTRY, json(entry.events)]
+			]) if (!await zip.add({
+				name: `${dir}/${name}`,
+				body,
+				mtimeMs
+			})) stoppedBecause ??= "zip-ceiling";
+			const mediaIncluded = [];
+			const mediaMissing = [];
+			for (const media of entry.media) {
+				const bytes = await deps.readMedia(media.key);
+				if (bytes === null) {
+					missing += 1;
+					mediaMissing.push(media.key);
+					deps.logger.warn("debug export skipped a media file — the blob is unreadable", {
+						tags: { deviceId },
+						meta: {
+							trackId: entry.report.trackId,
+							mediaKey: media.key,
+							kind: media.kind
+						}
+					});
+					continue;
+				}
+				if (!await zip.add({
+					name: `${dir}/${media.name}`,
+					body: bytes,
+					mtimeMs
+				})) {
+					stoppedBecause ??= "zip-ceiling";
+					missing += 1;
+					mediaMissing.push(media.key);
+					deps.logger.warn("debug export skipped a media file — the archive is full", {
+						tags: { deviceId },
+						meta: {
+							trackId: entry.report.trackId,
+							mediaKey: media.key,
+							kind: media.kind
+						}
+					});
+					continue;
+				}
+				included += 1;
+				mediaIncluded.push(media.name);
+				await new Promise((resolve) => setTimeout(resolve, MEDIA_PACING_MS));
+			}
+			manifestTracks.push({
+				trackId: entry.report.trackId,
+				deviceId,
+				dir,
+				className: entry.report.className,
+				...entry.report.label === void 0 ? {} : { label: entry.report.label },
+				firstSeen: entry.report.firstSeen,
+				lastSeen: entry.report.lastSeen,
+				durationMs: entry.report.durationMs,
+				eventCount: entry.report.eventCount,
+				findings: entry.report.findings.map((f) => f.code),
+				mediaIncluded,
+				mediaMissing
+			});
+			await new Promise((resolve) => setTimeout(resolve, TRACK_PACING_MS));
+		}
+		const manifest = {
+			generatedAt: plan.generatedAt,
+			deviceIds: plan.deviceIds,
+			trackCount: manifestTracks.length,
+			mediaIncluded: included,
+			mediaMissing: missing,
+			truncated: stoppedBecause !== null,
+			stoppedBecause,
+			retentionNote: DEBUG_RETENTION_NOTE,
+			tracks: manifestTracks
+		};
+		await zip.add({
+			name: DEBUG_MANIFEST_ENTRY,
+			body: json(manifest),
+			mtimeMs
+		});
+		await zip.finish();
+		await new Promise((resolve) => {
+			res.end(resolve);
+		});
+		deps.logger.info("debug export complete", { meta: {
+			tracks: manifestTracks.length,
+			mediaIncluded: included,
+			mediaMissing: missing,
+			stoppedBecause,
+			bytes: zip.bytesWritten,
+			elapsedMs: deps.now() - startedAt
+		} });
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/debug/debug-track-analysis.ts
+/** A track is "short" below this — the pipeline rarely produces a full media set. */
+var SHORT_TRACK_MS = 2e3;
+/** Below this, the label the track settled on is weak enough to be worth saying. */
+var LOW_BEST_SCORE = .5;
+/** Duration in ms. Never negative — a clock that went backwards reads as 0. */
+function trackDurationMs(facts) {
+	return Math.max(0, facts.lastSeen - facts.firstSeen);
+}
+function hasKind(media, kind) {
+	return media.some((m) => m.kind === kind);
+}
+function latestMediaAt(media) {
+	let latest = null;
+	for (const m of media) if (latest === null || m.timestamp > latest) latest = m.timestamp;
+	return latest;
+}
+function finding(code, severity, detail) {
+	return {
+		code,
+		severity,
+		detail
+	};
+}
+/**
+* Analyse one track. Pure — same inventory in, same findings out.
+*
+* Order is stable and roughly "worst first": the media the whole rest of the
+* system reads, then the track's own substance, then the softer signals.
+*/
+function analyseDebugTrack(inventory) {
+	const { facts, media, eventCount } = inventory;
+	const durationMs = trackDurationMs(facts);
+	const closed = !facts.active;
+	const out = [];
+	if (media.length === 0) out.push(finding("MEDIA_EVICTED_OR_NEVER", "error", "No media at all — either nothing was captured, or it was evicted (a debug mark does not pin retention)."));
+	else if (closed) {
+		if (!hasKind(media, "keyFrame")) out.push(finding("MISSING_KEYFRAME", "error", "No keyFrame — the best-shot frame is absent."));
+		if (!hasKind(media, "firstFrame")) out.push(finding("MISSING_FIRSTFRAME", "warn", "No firstFrame for a closed track."));
+		if (!hasKind(media, "lastFrame")) out.push(finding("MISSING_LASTFRAME", "warn", "No lastFrame for a closed track."));
+		if (!hasKind(media, "thumbnail")) out.push(finding("MISSING_THUMBNAIL", "warn", "No thumbnail — every list surface renders blank."));
+		if (!hasKind(media, "crop") && !hasKind(media, "faceCrop") && !hasKind(media, "plateCrop")) out.push(finding("MISSING_BEST_CROP", "warn", "No crop of any kind — nothing was cut for a subject."));
+	}
+	if (durationMs < 2e3) out.push(finding("SHORT_TRACK", "warn", `Track lasted ${String(durationMs)} ms, under the ${String(SHORT_TRACK_MS)} ms floor — likely a fragment.`));
+	if (eventCount === 0) out.push(finding("ZERO_EVENTS", "error", "No object events — the track exists but recorded nothing."));
+	if (facts.positionCount === 0) out.push(finding("ZERO_POSITIONS", "error", "No positions — there is no trajectory to reconstruct."));
+	if (durationMs >= 1e4 && facts.snapshotCount === 0 && !hasKind(media, "snapshot")) out.push(finding("NO_PERIODIC_SNAPSHOTS", "warn", `No periodic snapshot over ${String(durationMs)} ms — the movement gate never opened.`));
+	if (closed && hasKind(media, "lastFrame")) {
+		const lastFrameAt = media.filter((m) => m.kind === "lastFrame").reduce((max, m) => Math.max(max, m.timestamp), 0);
+		const lag = facts.lastSeen - lastFrameAt;
+		if (lag > 2e3) out.push(finding("LASTFRAME_STALE", "warn", `lastFrame is ${String(lag)} ms older than the track's end.`));
+	}
+	if (closed && durationMs >= 1e4 && media.length > 0) {
+		const latest = latestMediaAt(media);
+		if (latest !== null) {
+			const covered = (latest - facts.firstSeen) / durationMs;
+			if (covered < .5) out.push(finding("MEDIA_STOPPED_EARLY", "warn", `Media stops at ${String(Math.round(covered * 100))}% of the track's span.`));
+		}
+	}
+	if (closed && facts.bestEventId === void 0) out.push(finding("NO_BEST_EVENT", "info", "No representative event was chosen for this track."));
+	if (facts.labelScore !== void 0 && facts.labelScore < .5) out.push(finding("LOW_BEST_SCORE", "info", `Best label score ${facts.labelScore.toFixed(2)} is under ${String(LOW_BEST_SCORE)}.`));
+	return out;
+}
+/** Fold an inventory into the report shape, findings included. */
+function buildDebugTrackReport(inventory) {
+	const { facts, media, eventCount } = inventory;
+	const kinds = [...new Set(media.map((m) => m.kind))].toSorted();
+	return {
+		trackId: facts.trackId,
+		deviceId: facts.deviceId,
+		className: facts.className,
+		...facts.label === void 0 ? {} : { label: facts.label },
+		firstSeen: facts.firstSeen,
+		lastSeen: facts.lastSeen,
+		durationMs: trackDurationMs(facts),
+		active: facts.active,
+		mediaCount: media.length,
+		mediaKinds: kinds,
+		eventCount,
+		positionCount: facts.positionCount,
+		findings: analyseDebugTrack(inventory)
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/debug/debug-service.ts
+/**
+* The three media owners one track's files hang off.
+*
+* A track's face and plate crops are NOT owned by `track:<trackId>` — they live
+* under `face-<trackId>` and `plate-<trackId>`. An inventory that reads only the
+* first owner reports MISSING_BEST_CROP on every track that produced a face,
+* which is the opposite of the truth.
+*/
+var MEDIA_OWNERS = [
+	{
+		kind: "track",
+		prefix: ""
+	},
+	{
+		kind: "face",
+		prefix: "face-"
+	},
+	{
+		kind: "plate",
+		prefix: "plate-"
+	}
+];
+function toFacts(track) {
+	return {
+		trackId: track.trackId,
+		deviceId: track.deviceId,
+		className: track.className,
+		...track.label === void 0 ? {} : { label: track.label },
+		...track.labelScore === void 0 ? {} : { labelScore: track.labelScore },
+		firstSeen: track.firstSeen,
+		lastSeen: track.lastSeen,
+		active: track.active,
+		positionCount: track.positions.length,
+		snapshotCount: track.snapshots.length,
+		...track.importance === void 0 ? {} : { importance: track.importance },
+		...track.bestEventId === void 0 ? {} : { bestEventId: track.bestEventId }
+	};
+}
+function toListItem(track) {
+	return {
+		trackId: track.trackId,
+		deviceId: track.deviceId,
+		className: track.className,
+		...track.label === void 0 ? {} : { label: track.label },
+		firstSeen: track.firstSeen,
+		lastSeen: track.lastSeen,
+		durationMs: trackDurationMs(toFacts(track)),
+		active: track.active
+	};
+}
+/** Which cameras to sweep — the caller's list, else every camera with tracks. */
+async function resolveDeviceIds(deps, requested) {
+	if (requested !== void 0 && requested.length > 0) return requested;
+	return deps.listDeviceIds();
+}
+/**
+* The marked set, newest first per camera.
+*
+* One indexed query per camera and nothing else — no media, no events, and no
+* trajectory: `listDebug` reads `slim` rows, so nothing here parses the
+* `positions` JSON. The counts an operator wants (media, events, positions) come
+* from `debug.analyze`, per track, by id.
+*
+* A camera that hits `limit` sets `truncated`, because a list that silently
+* stops at 200 is how an operator concludes a mark did not take.
+*/
+async function listDebugTracks(deps, input) {
+	const limit = input.limit ?? 200;
+	const deviceIds = await resolveDeviceIds(deps, input.deviceIds);
+	const tracks = [];
+	let truncated = false;
+	for (const deviceId of deviceIds) {
+		const rows = await deps.listDebugTracks(deviceId, limit);
+		if (rows.length >= limit) {
+			truncated = true;
+			deps.logger.warn("debug listTracks hit the per-camera cap", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					limit
+				}
+			});
+		}
+		for (const row of rows) tracks.push(toListItem(row));
+	}
+	return {
+		tracks: tracks.toSorted((a, b) => b.lastSeen - a.lastSeen),
+		truncated
+	};
+}
+/**
+* Gather one track's whole inventory: three media queries plus its events.
+*
+* The events are RETURNED as well as counted — the bundle writes them to
+* `events.json`, and fetching them a second time there would double the query
+* count of an export for a number the caller already holds.
+*/
+async function gatherTrack(deps, track) {
+	const media = [];
+	for (const owner of MEDIA_OWNERS) media.push(...await deps.listMediaInfo(owner.kind, `${owner.prefix}${track.trackId}`));
+	const events = await deps.listEvents(track.trackId);
+	return {
+		inventory: {
+			facts: toFacts(track),
+			media,
+			eventCount: events.length
+		},
+		events
+	};
+}
+/**
+* Analyse the named tracks.
+*
+* An id that no longer resolves is reported in `vanished` rather than dropped: a
+* `debug` mark does not pin retention (D81), so a track CAN disappear between
+* the list and the analysis, and the tab has to be able to say so instead of
+* quietly showing fewer rows than it listed.
+*/
+async function analyzeDebugTracks(deps, input) {
+	const reports = [];
+	const vanished = [];
+	for (const trackId of input.trackIds) {
+		const track = await deps.getTrack(trackId);
+		if (track === null) {
+			vanished.push(trackId);
+			deps.logger.info("debug analyze — track no longer exists", { meta: { trackId } });
+			continue;
+		}
+		const gathered = await gatherTrack(deps, track);
+		reports.push(buildDebugTrackReport(gathered.inventory));
+	}
+	return {
+		reports,
+		vanished
+	};
+}
+/**
+* Plan the bundle — INDEX READS ONLY, no blob touched.
+*
+* The plan is what the manifest is built from and what the handler streams
+* against, so it must be produced in one pass: a plan that re-queried while
+* streaming could describe a set the archive does not contain.
+*
+* **Bounded at {@link MAX_EXPORT_TRACKS}, far below the list cap.** Listing is
+* index rows; exporting is every blob those rows point at, base64-decoded and
+* pushed through the hub's one thread. An unbounded "export all" is a
+* self-inflicted outage on a busy hub, so the plan stops and SAYS it stopped
+* rather than quietly shipping less than the button offered.
+*
+* Each row is re-read at full projection: `listDebugTracks` deliberately returns
+* `slim` rows, and a bundle built from those would report ZERO_POSITIONS on
+* every track and write an empty `positions` array into `track.json`.
+*/
+async function buildDebugBundlePlan(deps, requestedDeviceIds) {
+	const deviceIds = await resolveDeviceIds(deps, requestedDeviceIds);
+	const tracks = [];
+	const covered = [];
+	let capped = false;
+	for (const deviceId of deviceIds) {
+		if (tracks.length >= 25) {
+			capped = true;
+			break;
+		}
+		const rows = await deps.listDebugTracks(deviceId, 200);
+		if (rows.length > 0) covered.push(deviceId);
+		for (const row of rows) {
+			if (tracks.length >= 25) {
+				capped = true;
+				break;
+			}
+			const full = await deps.getTrack(row.trackId) ?? row;
+			const { inventory, events } = await gatherTrack(deps, full);
+			tracks.push({
+				report: buildDebugTrackReport(inventory),
+				track: full,
+				events,
+				media: planTrackMediaNames(inventory.media)
+			});
+		}
+	}
+	if (capped) deps.logger.warn("debug export capped — more marked tracks than one bundle may carry", { meta: {
+		limit: 25,
+		deviceIds: covered
+	} });
+	return {
+		generatedAt: deps.now(),
+		deviceIds: covered,
+		tracks,
+		capped
+	};
+}
 //#endregion
 //#region src/pipeline-analytics/embedding-actions.ts
 /**
@@ -10969,6 +11855,13 @@ function eventsToClips(events, pad) {
 		...events.audio.map((e) => make(e, "audio"))
 	].toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
 }
+/** Keep only clips whose window overlaps at least one recorded range — a clip
+*  is a window over footage, so a window with nothing behind it is unplayable
+*  and must not be listed (a camera that never recorded showed 15 dead audio
+*  "clips" in the viewer ribbon, every tap a 500). Pure. */
+function filterClipsByFootage(clips, ranges) {
+	return clips.filter((c) => ranges.some((r) => c.timeRange.startMs < r.endMs && c.timeRange.endMs > r.startMs));
+}
 function createVideoclipsProvider(deps) {
 	return {
 		listClips: async ({ deviceId, since, until, limit }) => {
@@ -10978,7 +11871,20 @@ function createVideoclipsProvider(deps) {
 				until,
 				limit
 			}), deps.defaultPad);
-			return limit != null ? clips.slice(0, limit) : clips;
+			let filtered = clips;
+			if (deps.fetchAvailability) try {
+				filtered = filterClipsByFootage(clips, await deps.fetchAvailability({
+					deviceId,
+					since,
+					until
+				}));
+			} catch (err) {
+				deps.logWarn?.("videoclips: availability read failed — listing unfiltered", {
+					deviceId,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+			return limit != null ? filtered.slice(0, limit) : filtered;
 		},
 		getClipPlayback: async ({ deviceId, clipId }) => {
 			const parsed = parseClipId(clipId);
@@ -10991,6 +11897,230 @@ function createVideoclipsProvider(deps) {
 		}
 	};
 }
+/**
+* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
+*
+* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
+* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
+* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
+* one encode per event over a ~12 s window, not a permanent transcode child
+* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
+* it was measured on a real 615 720p cut before being chosen: **0.23 s of
+* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
+* The re-encode is smaller than what it replaces.
+*
+* So both attachments now agree on the timeline as well as on the window: one
+* clip, one rate, two containers.
+*/
+var DEFAULT_SPEED = 4;
+/** The fallback mp4's requested width — the cap's own ceiling, so a rendition
+*  at or below 1080p is an identity scale and the broker copies it. */
+var RING_MP4_MAX_WIDTH = 1920;
+/** MP4 keeps the source cadence; this only bounds the muxer. The cap caps at 15. */
+var RING_MP4_FPS = 15;
+var NO_MEDIA = {
+	mp4: null,
+	gif: null,
+	source: "none",
+	startOffsetMs: null,
+	endOffsetMs: null,
+	profile: null,
+	video: null
+};
+var EventMediaService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Cut this event. Never throws — a notification that lost its media is still
+	* a notification, and every branch that drops it logs why.
+	*/
+	async cut(request) {
+		if (!request.wantMp4 && !request.wantGif) return NO_MEDIA;
+		const produced = await this.produce(request);
+		if (produced !== null) return produced;
+		return this.fallbackToRing(request);
+	}
+	async produce(request) {
+		const deviceId = request.deviceId;
+		const log = this.deps.logger;
+		const kinds = [];
+		if (request.wantMp4) kinds.push("mp4");
+		if (request.wantGif) kinds.push("gif");
+		let production;
+		try {
+			production = await this.deps.produce({
+				deviceId,
+				aroundMs: request.aroundMs,
+				preSeconds: request.preRollSec,
+				postSeconds: request.postRollSec,
+				kinds,
+				gifMaxWidth: 640,
+				gifFps: 12,
+				gifSpeed: 4,
+				speed: request.speed ?? DEFAULT_SPEED,
+				...request.profile !== void 0 ? { profile: request.profile } : {}
+			});
+		} catch (err) {
+			log.warn("nc media: the broker could not produce this event — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return null;
+		}
+		const mp4 = await this.redeem(deviceId, production.media, "mp4");
+		const gif = await this.redeem(deviceId, production.media, "gif");
+		if (mp4 === null && gif === null) {
+			log.warn("nc media: the production carried no artifact — falling back to the clip ring", {
+				tags: { deviceId },
+				meta: {
+					kinds: kinds.join(","),
+					profile: production.profile
+				}
+			});
+			return null;
+		}
+		const startOffsetMs = production.coverage.fromTs - request.aroundMs;
+		const endOffsetMs = production.coverage.toTs - request.aroundMs;
+		log.info("nc media: one production, every attachment", {
+			tags: { deviceId },
+			meta: {
+				profile: production.profile,
+				video: production.video,
+				mp4Bytes: mp4?.byteLength ?? null,
+				gifBytes: gif?.byteLength ?? null,
+				startOffsetMs,
+				endOffsetMs,
+				sharedWindow: true
+			}
+		});
+		return {
+			mp4,
+			gif,
+			source: "produced",
+			startOffsetMs,
+			endOffsetMs,
+			profile: production.profile,
+			video: production.video
+		};
+	}
+	/**
+	* Redeem one artifact handle at the node that produced it.
+	*
+	* `null` is not an error here — a production simply may not carry the kind
+	* (a gif whose derive failed says so on the broker's own log line). A handle
+	* that FAILS to redeem is different and is logged, because it means the bytes
+	* existed and did not arrive.
+	*/
+	async redeem(deviceId, media, kind) {
+		const artifact = media.find((m) => m.kind === kind);
+		if (artifact === void 0) return null;
+		try {
+			const res = await this.deps.fetch(artifact.handle, artifact.nodeId);
+			if (res === null) {
+				this.deps.logger.warn("nc media: an artifact handle expired before it could be fetched", {
+					tags: { deviceId },
+					meta: {
+						kind,
+						handle: artifact.handle,
+						nodeId: artifact.nodeId
+					}
+				});
+				return null;
+			}
+			const buf = Buffer.from(res.base64, "base64");
+			if (buf.byteLength === 0) return null;
+			const bytes = new Uint8Array(buf.byteLength);
+			bytes.set(buf);
+			return bytes;
+		} catch (err) {
+			this.deps.logger.warn("nc media: fetching an artifact failed — that attachment is dropped", {
+				tags: { deviceId },
+				meta: {
+					kind,
+					handle: artifact.handle,
+					nodeId: artifact.nodeId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* The pre-`produceEventMedia` path: `renderPreBufferClip`, once per container.
+	*
+	* Weaker than a production and deliberately so — the coherence here rests on
+	* the two calls being given IDENTICAL parameters rather than on there being
+	* one render. That is defensible because the ring only ever grows forward and
+	* `windowAround` selects by wall clock around the same instant, so two calls
+	* seconds apart choose the same packets; the one thing that could differ is
+	* the rendition, so the profile is pinned to whatever the FIRST call actually
+	* used and handed to the second.
+	*
+	* It exists for one reason: a hub whose `@camstack/server` predates the
+	* production method must not stop attaching footage, and three of the four
+	* live rules on this install ask for a gif and nothing else.
+	*/
+	async fallbackToRing(request) {
+		const deviceId = request.deviceId;
+		const speed = request.speed ?? DEFAULT_SPEED;
+		const window = {
+			deviceId,
+			aroundMs: request.aroundMs,
+			preRollSec: request.preRollSec,
+			postRollSec: request.postRollSec,
+			speed,
+			...request.profile !== void 0 ? { profile: request.profile } : {}
+		};
+		try {
+			const mp4 = request.wantMp4 ? await this.deps.renderRingClip({
+				...window,
+				format: "mp4",
+				maxWidth: RING_MP4_MAX_WIDTH,
+				fps: RING_MP4_FPS
+			}) : null;
+			const gif = request.wantGif ? await this.deps.renderRingClip({
+				...window,
+				format: "gif",
+				maxWidth: 640,
+				fps: 12 / 4,
+				speed: 4
+			}) : null;
+			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
+				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
+					tags: { deviceId },
+					meta: { aroundMs: request.aroundMs }
+				});
+				return NO_MEDIA;
+			}
+			this.deps.logger.info("nc media: served by the clip-ring FALLBACK", {
+				tags: { deviceId },
+				meta: {
+					mp4Bytes: mp4?.byteLength ?? null,
+					gifBytes: gif?.byteLength ?? null,
+					profile: request.profile ?? null,
+					sharedWindow: "by-parameters"
+				}
+			});
+			return {
+				mp4: mp4 !== null && mp4.byteLength > 0 ? mp4 : null,
+				gif: gif !== null && gif.byteLength > 0 ? gif : null,
+				source: "ring-fallback",
+				startOffsetMs: -Math.max(0, request.preRollSec) * 1e3,
+				endOffsetMs: Math.max(0, request.postRollSec) * 1e3,
+				profile: request.profile ?? null,
+				video: null
+			};
+		} catch (err) {
+			this.deps.logger.warn("nc media: the clip ring failed too — this event ships no footage", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			return NO_MEDIA;
+		}
+	}
+};
 //#endregion
 //#region src/shared/frame/crop-extractor.ts
 /**
@@ -21879,6 +23009,10 @@ var TRACKS_COLUMNS = [
 		name: "debug",
 		type: "BOOLEAN"
 	},
+	{
+		name: "hasFace",
+		type: "BOOLEAN"
+	},
 	{
 		name: "envMinX",
 		type: "REAL"
@@ -21959,7 +23093,8 @@ function cloneTrack(t) {
 			retrainStatus: t.retrainStatus,
 			markForTrain: t.retrainStatus === "staging"
 		} : {},
-		...t.debug !== void 0 ? { debug: t.debug } : {}
+		...t.debug !== void 0 ? { debug: t.debug } : {},
+		...t.hasFace !== void 0 ? { hasFace: t.hasFace } : {}
 	};
 }
 var TrackStore = class {
@@ -22322,6 +23457,49 @@ var TrackStore = class {
 		}
 	}
 	/**
+	* Record that a face DETECTOR found a face on this track. Set-once, never
+	* cleared, and deliberately NOT part of {@link setFlags}: that method is the
+	* operator's write surface and this is the pipeline's.
+	*
+	* **The signal is detection, not recognition.** The caller is the detail-route
+	* fan-out, keyed on the detail's own `className === 'face'` — BEFORE the
+	* `minFacePx` gate, before the recognizer is consulted, and regardless of
+	* whether face recognition is enabled at all. That is the whole point: the
+	* viewer's "face present, identity unknown" badge is `hasFace && !subLabel`,
+	* and a flag that only fired when the recognizer answered would be true
+	* exactly when the badge must not show.
+	*
+	* **Idempotent, and it does not write per detail.** A face detail lands many
+	* times over a track's life. While the track is LIVE the flag is set in RAM
+	* only and rides `persistCompleted` at expiry — one row write, not one per
+	* frame. Once the flag is set, every later call returns immediately.
+	*
+	* The persisted patch is for the LATE detail: enrichment answers routinely
+	* arrive after the track has expired, when there is no RAM entry left and the
+	* row is the only thing to correct. Best-effort — a failed patch costs a badge,
+	* never a track.
+	*/
+	async markFaceDetected(trackId) {
+		const active = this.active.get(trackId);
+		if (active) {
+			if (active.hasFace === true) return;
+			active.hasFace = true;
+			return;
+		}
+		try {
+			await this.store.update.mutate({
+				collection: TRACKS_COLLECTION,
+				id: trackId,
+				data: { hasFace: true }
+			});
+		} catch (err) {
+			this.logger.warn("markFaceDetected persist failed", { meta: {
+				trackId,
+				error: String(err)
+			} });
+		}
+	}
+	/**
 	* Write the retrain LIFECYCLE state directly — the move `setFlags` cannot
 	* express.
 	*
@@ -22535,6 +23713,71 @@ var TrackStore = class {
 		}
 	}
 	/**
+	* The device's DEBUG-marked tracks, newest first — the Events → Debug tab.
+	*
+	* Two things about this query are load-bearing.
+	*
+	* **`where: { debug: true }` matches only the explicit `true`.** The column is
+	* nullable with no default (unlike `retrainStatus`), so a row that was never
+	* marked holds NULL and positive equality skips it — which is exactly the set
+	* wanted here, and the reason the column was left nullable in the first place.
+	*
+	* **The result is re-checked in memory.** `compileFilter` DROPS a predicate
+	* whose column does not exist in SQLite — an older hub whose `declareCollection`
+	* fingerprint never re-ran would answer this query with EVERY track on the
+	* camera, silently, and the tab would present the whole history as
+	* operator-marked. A skipped predicate is indistinguishable from a matching one
+	* at the wire, so the guard is the only thing that can tell them apart.
+	*
+	* **`projection: 'slim'`, and this is the expensive detail.** `positions` is a
+	* JSON column averaging ~10 KB a row, and `'full'` parses it for every row
+	* returned. That is affordable for a handful of marked tracks and ruinous in
+	* the case this method already defends against: if the predicate is dropped,
+	* the store hands back `limit` rows PER CAMERA and the trajectory of the
+	* camera's whole recent history is parsed before the guard below throws it
+	* away. The cheap question comes first (D56) — the list carries no trajectory,
+	* and the per-track analysis reads the one row it needs through
+	* `getPersistedByTrackId`.
+	*/
+	async listDebug(deviceId, limit) {
+		try {
+			const tracks = (await this.store.query.query({
+				collection: TRACKS_COLLECTION,
+				filter: {
+					where: {
+						deviceId,
+						debug: true
+					},
+					orderBy: {
+						field: "lastSeen",
+						direction: "desc"
+					},
+					limit
+				}
+			})).filter((r) => typeof r.id === "string").map((r) => this.rowToTrack(r.id, r.data, "slim"));
+			const marked = tracks.filter((t) => t.debug === true);
+			if (marked.length !== tracks.length) this.logger.warn("TrackStore.listDebug — the store returned unmarked rows; the `debug` predicate was not applied", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					returned: tracks.length,
+					marked: marked.length
+				}
+			});
+			return marked;
+		} catch (err) {
+			this.logger.warn("TrackStore.listDebug failed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					limit,
+					error: String(err)
+				}
+			});
+			return [];
+		}
+	}
+	/**
 	* How many of this device's tracks are STAGING — optionally only those older
 	* than a cutoff, i.e. exactly the rows a sweep just declined to touch.
 	*
@@ -22941,6 +24184,7 @@ var TrackStore = class {
 				...t.audioLabels !== void 0 ? { audioLabels: [...t.audioLabels] } : {},
 				...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 				...t.debug !== void 0 ? { debug: t.debug } : {},
+				...t.hasFace !== void 0 ? { hasFace: t.hasFace } : {},
 				...envelope !== null && dims !== void 0 ? {
 					envMinX: envelope.minX,
 					envMinY: envelope.minY,
@@ -22975,6 +24219,7 @@ var TrackStore = class {
 		const audioLabels = data["audioLabels"];
 		const retrainParsed = require_dist.RetrainStatusSchema.safeParse(data["retrainStatus"]);
 		const debug = data["debug"];
+		const hasFace = data["hasFace"];
 		const envMinX = data["envMinX"];
 		const envMinY = data["envMinY"];
 		const envMaxX = data["envMaxX"];
@@ -23010,6 +24255,7 @@ var TrackStore = class {
 				markForTrain: retrainParsed.data === "staging"
 			} : {},
 			...typeof debug === "boolean" ? { debug } : {},
+			...typeof hasFace === "boolean" ? { hasFace } : {},
 			...envelope !== null ? { envelope } : {}
 		};
 	}
@@ -25380,6 +26626,31 @@ var LinkedCamerasCache = class {
 	}
 };
 /**
+* THE camera-set derivation for a sensor-cap state change — one function, so
+* every consumer of a device-event attributes it to the same cameras.
+*
+* It is shared on purpose. The self-camera half (a doorbell wrapper bound on
+* camera 615 makes 615 both source and subject) was added to the history-row
+* ingest on 2026-08-07 and NOT to the synthetic-track projection beside it,
+* which kept resolving `camerasFor` alone. The result: camera 615's real
+* doorbell press on 2026-08-08 06:59Z produced a `SensorEvent` row and no
+* timeline marker, for weeks, with the divergence invisible in both codepaths.
+* Two derivations of "which cameras" is one too many.
+*/
+async function resolveSensorEventCameras(cache, data) {
+	const linkedCameraIds = await cache.camerasFor(data.deviceId);
+	const isCamera = await cache.isCamera(data.deviceId);
+	const cameraIds = isCamera && selfCameraMayEmit(data.capName) && !linkedCameraIds.includes(data.deviceId) ? [data.deviceId, ...linkedCameraIds] : linkedCameraIds;
+	if (cameraIds.length === 0) return {
+		cameraIds,
+		dropReason: isCamera ? "camera-native-cap" : "no-camera"
+	};
+	return {
+		cameraIds,
+		dropReason: null
+	};
+}
+/**
 * One `DeviceStateChanged` → N history rows, one per camera the event belongs
 * to: the emitting device's LINKED cameras, plus the emitting device ITSELF
 * when it is a camera carrying the sensor cap (a doorbell wrapper bound on
@@ -25392,11 +26663,9 @@ var LinkedCamerasCache = class {
 async function ingestSensorStateChange(deps, data, timestamp) {
 	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
 	if (descriptor === void 0) return 0;
-	const linkedCameraIds = await deps.cache.camerasFor(data.deviceId);
-	const isCamera = await deps.cache.isCamera(data.deviceId);
-	const cameraIds = isCamera && selfCameraMayEmit(data.capName) && !linkedCameraIds.includes(data.deviceId) ? [data.deviceId, ...linkedCameraIds] : linkedCameraIds;
-	if (cameraIds.length === 0) {
-		deps.onDropped?.(isCamera ? "camera-native-cap" : "no-camera", descriptor.kind);
+	const { cameraIds, dropReason } = await resolveSensorEventCameras(deps.cache, data);
+	if (dropReason !== null) {
+		deps.onDropped?.(dropReason, descriptor.kind);
 		return 0;
 	}
 	const slice = data.slice;
@@ -26135,6 +27404,70 @@ var EventMediaDispatcher = class {
 		}
 	}
 };
+/**
+* Project one `DeviceStateChanged` of a mapped sensor/control cap into a
+* synthetic track per camera the event belongs to. Returns the number of
+* markers that landed. Best-effort (telemetry, D8) — a materializer that
+* throws propagates to the caller, which logs it.
+*/
+async function projectSensorMarkers(deps, data, timestamp) {
+	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
+	if (descriptor === void 0) {
+		deps.onSkipped({
+			cameraId: null,
+			sourceDeviceId: data.deviceId,
+			capName: data.capName,
+			kind: null,
+			reason: "unmapped-cap"
+		});
+		return 0;
+	}
+	const { cameraIds, dropReason } = await resolveSensorEventCameras(deps.cache, data);
+	if (dropReason !== null) {
+		deps.onSkipped({
+			cameraId: null,
+			sourceDeviceId: data.deviceId,
+			capName: data.capName,
+			kind: descriptor.kind,
+			reason: dropReason
+		});
+		return 0;
+	}
+	const producingDeviceName = await deps.producingDeviceName(data.deviceId);
+	let landed = 0;
+	for (const cameraId of cameraIds) {
+		const track = await deps.markers.materialize({
+			cameraId,
+			sourceDeviceId: data.deviceId,
+			source: "sensor",
+			kind: descriptor.kind,
+			timestamp,
+			snapshotTimeoutMs: deps.snapshotTimeoutMs ?? 2500,
+			...producingDeviceName !== void 0 ? { producingDeviceName } : {}
+		});
+		if (track === null) {
+			deps.onSkipped({
+				cameraId,
+				sourceDeviceId: data.deviceId,
+				capName: data.capName,
+				kind: descriptor.kind,
+				reason: "not-materialized"
+			});
+			continue;
+		}
+		landed++;
+		deps.onProjected({
+			cameraId,
+			sourceDeviceId: data.deviceId,
+			capName: data.capName,
+			kind: descriptor.kind,
+			trackId: track.trackId,
+			selfCamera: cameraId === data.deviceId,
+			hasMedia: track.snapshots.length > 0
+		});
+	}
+	return landed;
+}
 /** JPEG quality for the downscaled full frame — matches the crop path. */
 var FULL_FRAME_QUALITY = 80;
 /**
@@ -26245,13 +27578,13 @@ var SyntheticTrackMaterializer = class {
 	* answers: ≤10 s old on a mains camera, and on a battery camera the
 	* intentionally stale-but-honest frame that costs no wake.
 	*/
-	async fetchSnapshot(cameraId) {
+	async fetchSnapshot(cameraId, timeoutMs) {
 		try {
-			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), this.snapshotTimeoutMs);
-			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"));
+			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), timeoutMs);
+			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"), cameraId);
 			return snap;
 		} catch (err) {
-			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotMedia", err);
+			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotMedia", err, cameraId);
 			return null;
 		}
 	}
@@ -26268,14 +27601,14 @@ var SyntheticTrackMaterializer = class {
 		const trackId = this.makeId();
 		const ts = input.timestamp;
 		let mediaKey = null;
-		const snap = await this.fetchSnapshot(input.cameraId);
+		const snap = await this.fetchSnapshot(input.cameraId, input.snapshotTimeoutMs ?? this.snapshotTimeoutMs);
 		if (snap !== null) try {
 			const raw = Buffer.from(snap.base64, "base64");
 			let data = raw;
 			try {
 				data = await downscaleFullFrameJpeg(raw, 960, 540);
 			} catch (err) {
-				this.deps.onError?.("downscaleSnapshot", err);
+				this.deps.onError?.("downscaleSnapshot", err, input.cameraId);
 			}
 			mediaKey = await this.deps.media.put({
 				deviceId: input.cameraId,
@@ -26286,7 +27619,7 @@ var SyntheticTrackMaterializer = class {
 				data
 			});
 		} catch (err) {
-			this.deps.onError?.("snapshotMedia", err);
+			this.deps.onError?.("snapshotMedia", err, input.cameraId);
 		}
 		const track = {
 			trackId,
@@ -26311,7 +27644,7 @@ var SyntheticTrackMaterializer = class {
 		try {
 			await this.deps.tracks.persistSyntheticTrack(track);
 		} catch (err) {
-			this.deps.onError?.("persistSyntheticTrack", err);
+			this.deps.onError?.("persistSyntheticTrack", err, input.cameraId);
 			return null;
 		}
 		return track;
@@ -29011,8 +30344,6 @@ var REBUILD_PAGE_SIZE = 200;
 */
 var REBUILD_FALLBACK_NODE_ID = "hub";
 var PIPELINE_ANALYTICS_ADDON_ID = "pipeline-analytics";
-/** Operator-visible name of the fixed integration. */
-var NC_INTEGRATION_NAME = "Notification Center";
 /**
 * The FULL action catalog for this addon.
 *
@@ -29023,7 +30354,8 @@ var NC_INTEGRATION_NAME = "Notification Center";
 */
 var customActions = {
 	...ncActions,
-	...embeddingActions
+	...embeddingActions,
+	...debugActions
 };
 /**
 * Assist threshold when the caller does not pin one. Packages have their own
@@ -29106,15 +30438,6 @@ var KEY_EVENT_DEFAULT_LIMIT = 50;
 *  Absent / empty / non-string all fall back to the hub default — the exact
 *  narrowing the old raw read applied inline. */
 var PostProcessingNodeIdSchema = require_dist.string().min(1);
-/**
-* Footage-attachment window + geometry, used when the rule states none. The
-* window is CENTRED on the event, so the recipient sees the approach and what
-* followed rather than one side of it.
-*/
-var NC_FOOTAGE_PRE_ROLL_SEC = 3;
-var NC_FOOTAGE_POST_ROLL_SEC = 5;
-var NC_FOOTAGE_MAX_WIDTH = 480;
-var NC_FOOTAGE_FPS = 5;
 /** Per-install HMAC secret behind the signed artifact links (minted once). */
 var NcArtifactSecretSchema = require_dist.string();
 var EmbeddingEnabledSchema = require_dist.boolean();
@@ -29279,6 +30602,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	trainingExportDataPlane = null;
 	/** Handle for the retrain-export data-plane listener (dispose on shutdown). */
 	retrainExportDataPlane = null;
+	/** Handle for the debug-export data-plane listener (dispose on shutdown). */
+	debugExportDataPlane = null;
 	/** The retrain curation surface — see `retrain/retrain-service.ts`. Null
 	*  until the stores are built. */
 	retrain = null;
@@ -29288,38 +30613,83 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  data-plane handle. Null until served / when the facility is absent. */
 	ncArtifactPlane = null;
 	ncArtifactDataPlane = null;
-	/** Roadmap 4b: notification clips cut from the live fMP4 fragment seam.
-	*  Built on first use — a hub whose rules never ask for an mp4 never
-	*  constructs it, and constructing it costs nothing until `renderClip`. */
-	ncSeamClips = null;
 	/**
-	* One attempt at the fMP4 seam. `null` means "the ring serves this one", and
-	* the REASON is always logged with `tags: { deviceId }`.
+	* Roadmap 4b: ONE cut of an event, in every container the rule asked for.
 	*
-	* That log line is the whole point of the fallback being explicit rather than
-	* a try/catch: two cameras silently attaching two different kinds of clip is
-	* precisely the thing an operator cannot diagnose from a phone.
+	* Built on first use — a hub whose rules never attach footage never
+	* constructs it, and constructing it costs nothing until `cut`.
 	*/
-	async renderSeamClip(req) {
-		const log = this.ctx.logger;
+	ncEventMedia = null;
+	/**
+	* The dispatcher's single media dep.
+	*
+	* ONE call for the gif and the mp4, deliberately: rendering them separately
+	* is what produced a gif around the event and a video seven seconds after it
+	* (D85's `eventToDialMs=7054`). The service picks the camera's best H.264
+	* slot, asks the broker's own prebuffer ring for the window at that slot's
+	* own width in real time — which is what makes the broker COPY rather than
+	* re-encode — and derives the gif from those same bytes.
+	*/
+	async renderEventMedia(req) {
 		const api = this.ctx.api;
-		this.ncSeamClips ??= new Fmp4ClipService({
-			logger: log.child("nc-seam-clip"),
-			listProfileEntries: (deviceId) => api.cameraStreams.getProfileRtspEntries.query({ deviceId })
+		this.ncEventMedia ??= new EventMediaService({
+			logger: this.ctx.logger.child("nc-event-media"),
+			produce: (input) => api.streamBroker.produceEventMedia.mutate({
+				deviceId: input.deviceId,
+				aroundMs: input.aroundMs,
+				preSeconds: input.preSeconds,
+				postSeconds: input.postSeconds,
+				kinds: [...input.kinds],
+				gifMaxWidth: input.gifMaxWidth,
+				gifFps: input.gifFps,
+				gifSpeed: input.gifSpeed,
+				speed: input.speed,
+				...input.profile === "high" || input.profile === "mid" || input.profile === "low" ? { profile: input.profile } : {}
+			}),
+			fetch: (handle, nodeId) => api.streamBroker.fetchEventMedia.mutate({ handle }, nodeId.length > 0 ? require_dist.nodePin(nodeId) : void 0),
+			renderRingClip: async (input) => {
+				const res = await api.streamBroker.renderPreBufferClip.mutate({
+					deviceId: input.deviceId,
+					aroundMs: input.aroundMs,
+					format: input.format,
+					preRollSec: input.preRollSec,
+					postRollSec: input.postRollSec,
+					maxWidth: input.maxWidth,
+					fps: input.fps,
+					speed: input.speed,
+					...input.profile === "high" || input.profile === "mid" || input.profile === "low" ? { profile: input.profile } : {}
+				});
+				const buf = Buffer.from(res.base64, "base64");
+				if (buf.byteLength === 0) return null;
+				const bytes = new Uint8Array(buf.byteLength);
+				bytes.set(buf);
+				return bytes;
+			}
 		});
 		try {
-			const result = await this.ncSeamClips.renderClip({
+			const media = await this.ncEventMedia.cut({
 				deviceId: req.deviceId,
 				aroundMs: req.aroundMs,
-				postRollSec: req.postRollSec ?? NC_FOOTAGE_POST_ROLL_SEC
+				wantMp4: req.wantMp4,
+				wantGif: req.wantGif,
+				preRollSec: req.preRollSec,
+				postRollSec: req.postRollSec,
+				...req.profile !== void 0 ? { profile: req.profile } : {},
+				...req.speed !== void 0 ? { speed: req.speed } : {}
 			});
-			return result.ok ? result.clip.bytes : null;
+			return {
+				mp4: media.mp4,
+				gif: media.gif
+			};
 		} catch (err) {
-			log.warn("nc clip: the fMP4 seam threw — falling back to the clip ring", {
+			this.ctx.logger.warn("nc media: the cut threw — this notification ships without footage", {
 				tags: { deviceId: req.deviceId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
-			return null;
+			return {
+				mp4: null,
+				gif: null
+			};
 		}
 	}
 	/** The operator's marked notification endpoint, or null (AUTO / unavailable). */
@@ -29397,7 +30767,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			});
 			const served = await this.ctx.dataPlane?.serve({
 				prefix: "nc-action",
-				access: "public",
+				access: planeAccess("nc-action"),
 				handler: plane.handler
 			}) ?? null;
 			this.ncActionMintUrl = served === null ? null : async ({ id, expMs }) => {
@@ -29451,7 +30821,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			});
 			this.ncArtifactDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "nc-artifact",
-				access: "public",
+				access: planeAccess("nc-artifact"),
 				handler: plane.handler
 			}) ?? null;
 			this.ncArtifactPlane = this.ncArtifactDataPlane !== null ? plane : null;
@@ -29734,7 +31104,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		const api = this.ctx.api;
 		if (!api) throw new Error("pipeline-analytics requires ctx.api (device-manager + settings-store)");
 		await this.declareCollections(api);
-		await this.ensureAlarmPanel(api);
+		await this.declareAlarmPanel(api);
 		const logger = this.ctx.logger;
 		const storage = await this.resolveMediaStorage(logger);
 		const stores = await this.buildStores(api, logger, storage);
@@ -29796,11 +31166,13 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			...isHub && ncHandlers !== void 0 ? {
 				customActions: {
 					...ncActions,
-					...embeddingActions
+					...embeddingActions,
+					...debugActions
 				},
 				actionHandlers: {
 					...ncHandlers,
-					...this.buildEmbeddingActionHandlers()
+					...this.buildEmbeddingActionHandlers(),
+					...this.buildDebugActionHandlers()
 				}
 			} : {}
 		};
@@ -29824,70 +31196,45 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			},
 			listCallerTargetIds: async (userId) => {
 				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
-			}
+			},
+			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) })
 		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
 	*  a CREATE TABLE. Idempotent. */
 	/**
-	* Bring the Notification Center's alarm panel into existence, once.
+	* DECLARE the Notification Center's alarm panel.
 	*
-	* Both steps are get-or-create, because this runs on every boot and an
-	* operator must never end up with a second panel after a restart. The
-	* integration is FIXED: it exists because this addon says so, not because
-	* anybody added it, and there is no add/delete flow for it.
-	*/
-	async ensureAlarmPanel(api) {
-		const devices = this.ctx.kernel.devices;
-		const rawNodeId = this.ctx.kernel.localNodeId ?? "hub";
-		const nodeId = rawNodeId.includes("/") ? rawNodeId.split("/")[0] ?? "hub" : rawNodeId;
-		if (nodeId !== "hub") {
-			this.ctx.logger.info("alarm panel is hub-owned — skipping on this node", { meta: {
-				nodeId,
-				rawNodeId
-			} });
-			return;
-		}
+	* The procedure is not here any more — `DeclaredDevices` owns the
+	* get-or-create, the FIXED integration and its every-pass `fixed`
+	* re-assertion, the adopt-don't-skip rule, the hub-ownership gate and the D49
+	* second read that stops a transiently empty index re-stamping the declared
+	* name over the operator's rename. What is left is the declaration and the
+	* ports.
+	*/
+	async declareAlarmPanel(api) {
+		const declared = new require_dist.DeclaredDevices({
+			logger: this.ctx.logger.child("alarm"),
+			addonId: PIPELINE_ANALYTICS_ADDON_ID,
+			devices: this.ctx.kernel.devices,
+			localNodeId: this.ctx.kernel.localNodeId,
+			getIntegration: async (addonId) => api.integrations.getByAddonId.query({ addonId }),
+			createIntegration: async (input) => api.integrations.create.mutate(input),
+			updateIntegration: async ({ id, info }) => {
+				await api.integrations.update.mutate({
+					id,
+					info,
+					skipRestart: true
+				});
+			},
+			listOwnDevices: async () => api.deviceManager.listAll.query({ addonId: PIPELINE_ANALYTICS_ADDON_ID })
+		});
 		try {
-			const result = await ensureAlarmPanel({
-				logger: this.ctx.logger.child("alarm"),
-				addonId: PIPELINE_ANALYTICS_ADDON_ID,
+			const result = await declared.reconcile({
 				integrationName: NC_INTEGRATION_NAME,
-				getIntegration: async (addonId) => {
-					const found = await api.integrations.getByAddonId.query({ addonId });
-					return found === null ? null : {
-						id: found.id,
-						fixed: found.info?.["fixed"] === true
-					};
-				},
-				markFixed: async (integrationId) => {
-					await api.integrations.update.mutate({
-						id: integrationId,
-						info: { fixed: true },
-						skipRestart: true
-					});
-				},
-				createIntegration: async (input) => api.integrations.create.mutate(input),
-				findDeviceByStableId: async (stableId) => {
-					const found = (await api.deviceManager.listAll.query({ addonId: PIPELINE_ANALYTICS_ADDON_ID })).find((d) => d.stableId === stableId);
-					return found === void 0 ? null : { id: found.id };
-				},
-				createDevice: async ({ stableId, integrationId, name }) => {
-					const device = await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, {
-						type: NC_ALARM_DEVICE_TYPE,
-						name,
-						integrationId
-					});
-					this.holdAlarmPanel(device);
-					return { id: device.id };
-				},
-				adoptDevice: async ({ stableId }) => {
-					const device = await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, void 0);
-					this.holdAlarmPanel(device);
-					return { id: device.id };
-				}
+				devices: [NC_ALARM_DECLARATION]
 			});
-			if (result.created) this.ctx.logger.info("notification-center alarm panel ready", { tags: { deviceId: result.deviceId } });
+			for (const outcome of result.devices) this.holdAlarmPanel(outcome.device);
 		} catch (err) {
 			this.ctx.logger.warn("alarm panel could not be ensured — rules still notify", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
@@ -29910,7 +31257,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	/**
 	* Join the panel and the Notification Center, once both exist.
 	*
-	* They are built in that order (`ensureAlarmPanel` runs before the centre is
+	* They are built in that order (`declareAlarmPanel` runs before the centre is
 	* constructed) and neither can reach the other on its own, so the join is
 	* here. A node with no panel simply never calls it, and the cap answers
 	* `deviceId: null` — which is what an agent node should say.
@@ -29958,7 +31305,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		let storage = this.ctx.kernel.storage;
 		const mediaRoot = process.env.CAMSTACK_MEDIA_ROOT?.trim();
 		if (mediaRoot) {
-			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-CnEKzHgS.js"));
+			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-CpXZkQ6V.js"));
 			storage = new FilesystemStorageProvider(mediaRoot, { eventMedia: mediaRoot });
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
@@ -30416,28 +31763,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 						y: pt.y
 					})));
 				},
-				renderFootage: async (req) => {
-					if (req.format === "mp4") {
-						const seam = await this.renderSeamClip(req);
-						if (seam !== null) return seam;
-					}
-					const res = await api.streamBroker.renderPreBufferClip.mutate({
-						deviceId: req.deviceId,
-						aroundMs: req.aroundMs,
-						format: req.format,
-						preRollSec: req.preRollSec ?? NC_FOOTAGE_PRE_ROLL_SEC,
-						postRollSec: req.postRollSec ?? NC_FOOTAGE_POST_ROLL_SEC,
-						maxWidth: NC_FOOTAGE_MAX_WIDTH,
-						fps: NC_FOOTAGE_FPS,
-						...req.speed !== void 0 ? { speed: req.speed } : {},
-						...req.profile === "high" || req.profile === "mid" || req.profile === "low" ? { profile: req.profile } : {}
-					});
-					const buf = Buffer.from(res.base64, "base64");
-					if (buf.byteLength === 0) return null;
-					const bytes = new Uint8Array(buf.byteLength);
-					bytes.set(buf);
-					return bytes;
-				},
+				renderEventMedia: (req) => this.renderEventMedia(req),
 				publishArtifact: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
 				listTargets: async () => {
 					return (await api.notificationOutput.listTargets.query({})).map((t) => {
@@ -30488,7 +31814,12 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	}
 	/** Event-media data-plane: serve thumbnail JPEGs at
 	*  `/addon/<addonId>/event-media/<eventId>` through the hub's port.
-	*  Mirror the recorder playback pattern: try/warn, store handle for dispose. */
+	*  Mirror the recorder playback pattern: try/warn, store handle for dispose.
+	*
+	*  `authenticated`, not `admin` — see `data-plane-access.ts` for the rule and
+	*  the reason it changed: `getTrackMedia` / `getEventMedia` are declared
+	*  `access: 'view'` and return the SAME stored blob base64 over tRPC, so the
+	*  admin gate protected nothing and cost every non-admin session its tiles. */
 	async serveEventMediaDataPlane() {
 		try {
 			const handler = createEventMediaHandler({ getMedia: async (id, variant, preferKind) => {
@@ -30504,22 +31835,27 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			} });
 			this.eventMediaDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "event-media",
-				access: "admin",
+				access: planeAccess("event-media"),
 				handler
 			}) ?? null;
 			this.eventMediaBaseUrl = this.eventMediaDataPlane !== null ? `/addon/${this.ctx.id}/event-media` : null;
 			await this.serveNcArtifactPlane();
 			await this.serveTrainingExportPlane();
 			await this.serveRetrainExportPlane();
-			this.ctx.logger.info("event-media data-plane served", { meta: { baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)" } });
+			await this.serveDebugExportPlane();
+			this.ctx.logger.info("event-media data-plane served", { meta: {
+				baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)",
+				access: planeAccess("event-media")
+			} });
 		} catch (err) {
 			this.ctx.logger.warn("event-media data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
 		}
 	}
 	/**
-	* The training-export data plane. Separate listener, `access: 'admin'` —
-	* marking a track is a viewer-level curation act (D81), but walking off with
-	* every stored frame behind the marked set is not.
+	* The training-export data plane. Separate listener, admin-only (the level
+	* is declared in `data-plane-access.ts`) — marking a track is a viewer-level
+	* curation act (D81), but walking off with every stored frame behind the
+	* marked set is not.
 	*/
 	async serveTrainingExportPlane() {
 		try {
@@ -30534,7 +31870,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			});
 			this.trainingExportDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "training-export",
-				access: "admin",
+				access: planeAccess("training-export"),
 				handler
 			}) ?? null;
 		} catch (err) {
@@ -30663,6 +31999,60 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		return { url: `/addon/${this.ctx.id}/${RETRAIN_EXPORT_PREFIX}${query}` };
 	}
 	/**
+	* The store seam the `debug.*` actions and the debug bundle both read through.
+	*
+	* INDEX READS ONLY — three media-inventory queries and an event query per
+	* track, no blob. The bytes are fetched one at a time, by key, by the export
+	* handler, so a bundle of a hundred tracks never holds more than one file.
+	*/
+	buildDebugServiceDeps() {
+		const trackStore = this.trackStore;
+		const mediaStore = this.mediaStore;
+		const eventStore = this.eventStore;
+		if (trackStore === null || mediaStore === null || eventStore === null) throw new Error("debug: analytics stores unavailable");
+		return {
+			listDeviceIds: () => trackStore.listDeviceIds(),
+			listDebugTracks: (deviceId, limit) => trackStore.listDebug(deviceId, limit),
+			getTrack: (trackId) => trackStore.getPersistedByTrackId(trackId),
+			listMediaInfo: (ownerKind, ownerId) => mediaStore.listInfoByOwner(ownerKind, ownerId),
+			listEvents: (trackId) => eventStore.queryObjectByTrackIds([trackId]),
+			logger: this.ctx.logger.child("debug"),
+			now: () => Date.now()
+		};
+	}
+	/** The `debug.*` bridge handlers — hub-only, like `nc.*` and `embedding.*`. */
+	buildDebugActionHandlers() {
+		return {
+			"debug.listTracks": async (input) => listDebugTracks(this.buildDebugServiceDeps(), input),
+			"debug.analyze": async (input) => analyzeDebugTracks(this.buildDebugServiceDeps(), input)
+		};
+	}
+	/**
+	* The debug-export data plane. Its own listener, for the same reason the
+	* retrain export has one: a client asking for the debug bundle must never be
+	* able to receive the annotated dataset by changing a query parameter.
+	*/
+	async serveDebugExportPlane() {
+		try {
+			const handler = createDebugExportHandler({
+				buildPlan: (deviceIds) => buildDebugBundlePlan(this.buildDebugServiceDeps(), deviceIds),
+				readMedia: async (key) => {
+					const file = await this.mediaStore?.getByKey(key);
+					return file === null || file === void 0 ? null : Buffer.from(file.base64, "base64");
+				},
+				logger: this.ctx.logger.child("debug-export"),
+				now: () => Date.now()
+			});
+			this.debugExportDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: "debug-export",
+				access: planeAccess("debug-export"),
+				handler
+			}) ?? null;
+		} catch (err) {
+			this.ctx.logger.warn("debug-export data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
+	/**
 	* The retrain-export data plane. Separate listener from the training export
 	* next door: different archive, different contents, and a client asking for
 	* one must never be able to receive the other by changing a query parameter.
@@ -30684,7 +32074,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			});
 			this.retrainExportDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "retrain-export",
-				access: "admin",
+				access: planeAccess("retrain-export"),
 				handler
 			}) ?? null;
 		} catch (err) {
@@ -30894,6 +32284,17 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					audio
 				};
 			},
+			fetchAvailability: async ({ deviceId, since, until }) => {
+				return (await api.recording.getAvailability.query({
+					deviceId,
+					fromMs: since,
+					toMs: until
+				})).ranges;
+			},
+			logWarn: (message, meta) => this.ctx.logger.warn(message, {
+				tags: { deviceId: Number(meta["deviceId"]) },
+				meta
+			}),
 			resolvePlayback: async ({ deviceId, startMs, endMs }) => {
 				const manifest = await api.recording.getPlaybackManifest.query({
 					deviceId,
@@ -31015,6 +32416,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		this.trainingExportDataPlane = null;
 		await this.retrainExportDataPlane?.dispose();
 		this.retrainExportDataPlane = null;
+		await this.debugExportDataPlane?.dispose();
+		this.debugExportDataPlane = null;
 	}
 	async handleInferenceResult(data) {
 		if (this.shuttingDown) return;
@@ -31943,6 +33346,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	async routeDetailResults(deviceId, trackId, details, frame) {
 		for (const d of details) try {
 			const isFaceDetail = d.className === "face";
+			if (isFaceDetail) await this.trackStore?.markFaceDetected(trackId);
 			if (isFaceDetail && d.bbox !== void 0) this.overlayState.noteFaceDetail(deviceId, trackId, {
 				x: d.bbox.x,
 				y: d.bbox.y,
@@ -33365,11 +34769,12 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		const store = this.sensorEventStore;
 		const cache = this.linkedCamerasCache;
 		if (store === null || cache === null) return;
+		const persisted = [];
 		try {
 			await ingestSensorStateChange({
 				sink: store,
 				cache,
-				onPersisted: (ev) => this.notificationCenter?.onSensorEventPersisted(ev),
+				onPersisted: (ev) => persisted.push(ev),
 				onDropped: (reason, kind) => this.logSensorIngestDrop(data, reason, kind)
 			}, data, timestamp);
 		} catch (err) {
@@ -33381,30 +34786,40 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				}
 			});
 		}
+		const markerByCamera = /* @__PURE__ */ new Map();
 		const materializer = this.syntheticTracks;
-		const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
-		if (materializer === null || descriptor === void 0) return;
-		try {
-			const cameraIds = await cache.camerasFor(data.deviceId);
-			if (cameraIds.length === 0) {
-				this.ctx.logger.debug("sensor synthetic-track projection skipped — no linked camera", {
-					tags: { deviceId: data.deviceId },
+		if (materializer !== null) try {
+			await projectSensorMarkers({
+				cache,
+				markers: materializer,
+				producingDeviceName: (deviceId) => this.resolveProducingDeviceName(deviceId),
+				onProjected: (r) => {
+					markerByCamera.set(r.cameraId, {
+						trackId: r.trackId,
+						hasMedia: r.hasMedia
+					});
+					this.ctx.logger.info("synthetic sensor-track projected", {
+						tags: { deviceId: r.cameraId },
+						meta: {
+							capName: r.capName,
+							kind: r.kind,
+							trackId: r.trackId,
+							sourceDeviceId: r.sourceDeviceId,
+							selfCamera: r.selfCamera,
+							hasMedia: r.hasMedia
+						}
+					});
+				},
+				onSkipped: (r) => this.ctx.logger.debug("synthetic sensor-track NOT projected", {
+					tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
 					meta: {
-						capName: data.capName,
-						kind: descriptor.kind
+						capName: r.capName,
+						kind: r.kind,
+						reason: r.reason,
+						sourceDeviceId: r.sourceDeviceId
 					}
-				});
-				return;
-			}
-			const producingDeviceName = await this.resolveProducingDeviceName(data.deviceId);
-			for (const cameraId of cameraIds) await materializer.materialize({
-				cameraId,
-				sourceDeviceId: data.deviceId,
-				source: "sensor",
-				kind: descriptor.kind,
-				timestamp,
-				...producingDeviceName !== void 0 ? { producingDeviceName } : {}
-			});
+				})
+			}, data, timestamp);
 		} catch (err) {
 			this.ctx.logger.warn("synthetic sensor-track materialize failed", {
 				tags: { deviceId: data.deviceId },
@@ -33414,6 +34829,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				}
 			});
 		}
+		for (const ev of persisted) this.notificationCenter?.onSensorEventPersisted(ev, markerByCamera.get(ev.deviceId)?.trackId);
 	}
 	/**
 	* Say out loud that a MAPPED sensor cap ingested nothing, and why.