@camstack/addon-post-analysis 1.2.52 → 1.2.54

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as boolean, A as encodeVectorBase64, B as vectorDimFromBase64, C as alarmPanelCapability, D as customAction, E as cosineSimilarity, F as notificationRulesCapability, G as DeviceType, H as zoneAnalyticsCapability, I as pipelineAnalyticsCapability, J as isDeviceScopedCap, K as createEvent, L as plateGalleryCapability, N as isScheduleActive, O as defineCustomActions, P as kebabToCamel, Q as array, R as readDeviceStateFrom, S as addonWidgetsSourceCapability, T as buildEventKindDescriptor, U as errMsg, V as videoclipsCapability, W as BaseAddon, X as sleep, Y as nodePin, Z as _enum, _ as OpsLogEntrySchema, a as LabelAttributionSchema, at as unknown, b as TimelapseRuleSchema, c as NC_TAXONOMY, d as NcRulePatchSchema, et as literal, f as NcRuleSchema, g as NcTaxonomySchema, h as NcSnoozeSuppressedSchema, i as EVENT_PAD_MS, it as string, j as faceGalleryCapability, l as NcConditionDescriptorSchema, m as NcSnoozeSchema, n as DEFAULT_EVENT_COLOR, nt as object, o as MACRO_LABELS, ot as EventCategory, p as NcSnoozeInputSchema, q as hydrateSchema, r as EVENT_KIND_BY_CAP, rt as record, s as NC_CONDITION_CATALOG, t as BaseDevice, tt as number, u as NcRuleInputSchema, v as RetrainStatusSchema, w as audioMetricsCapability, x as TrackSourceSchema, y as TimelapseRuleInputSchema, z as subKindsOf } from "../dist-CDLLzMJw.mjs";
+import { $ as array, B as subKindsOf, C as addonWidgetsSourceCapability, D as cosineSimilarity, E as buildEventKindDescriptor, F as kebabToCamel, G as BaseAddon, H as videoclipsCapability, I as notificationRulesCapability, J as hydrateSchema, K as DeviceType, L as pipelineAnalyticsCapability, M as faceGalleryCapability, O as customAction, P as isScheduleActive, Q as _enum, R as plateGalleryCapability, S as TrackSourceSchema, T as audioMetricsCapability, U as zoneAnalyticsCapability, V as vectorDimFromBase64, W as errMsg, X as nodePin, Y as isDeviceScopedCap, Z as sleep, _ as NcTaxonomySchema, a as EVENT_PAD_MS, at as string, b as TimelapseRuleInputSchema, c as NC_CONDITION_CATALOG, d as NcRuleInputSchema, et as boolean, f as NcRulePatchSchema, g as NcSnoozeSuppressedSchema, h as NcSnoozeSchema, i as EVENT_KIND_BY_CAP, it as record, j as encodeVectorBase64, k as defineCustomActions, l as NC_TAXONOMY, m as NcSnoozeInputSchema, n as DEFAULT_EVENT_COLOR, nt as number, o as LabelAttributionSchema, ot as unknown, p as NcRuleSchema, q as createEvent, r as DeclaredDevices, rt as object, s as MACRO_LABELS, st as EventCategory, t as BaseDevice, tt as literal, u as NcConditionDescriptorSchema, v as OpsLogEntrySchema, w as alarmPanelCapability, x as TimelapseRuleSchema, y as RetrainStatusSchema, z as readDeviceStateFrom } from "../dist-BVOgkikr.mjs";
 import { promises } from "node:fs";
 import path from "node:path";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
@@ -692,77 +692,34 @@ var NcAlarmPanelDevice = class extends BaseDevice {
 	}
 };
 //#endregion
-//#region src/notification-center/alarm/ensure-alarm-panel.ts
+//#region src/notification-center/alarm/alarm-panel-declaration.ts
 /**
-* Bring the Notification Center's alarm panel into existence, once.
+* The Notification Center's alarm panel, as a DECLARATION.
 *
-* Two idempotent steps — a fixed integration to hang from, and one device under
-* it. Both are `get-or-create`, because this runs on every boot and an operator
-* must never end up with a second panel after a restart.
+* There is no `ensureAlarmPanel` any more. The get-or-create, the `fixed`
+* re-assertion, the adopt-don't-skip rule and the hub-ownership gate all moved
+* to `DeclaredDevices` in `@camstack/types` — the one primitive for a device an
+* addon declares. What is left here is the *declaration*: the stable id, the
+* seed name, the type and the class. Data, not procedure.
 *
-* The integration is FIXED: it exists because the addon says so, not because an
-* operator added it, and there is no add/delete flow for it. That is the whole
-* meaning of "a system integration" here — the same `integrations` row every
-* provider uses, created by its owner instead of by a form.
+* The bug the hand-rolled version carried died in that move: it read the device
+* index once, so a transiently empty answer took the create branch and
+* re-stamped `Alarm` over the operator's rename. `DeclaredDevices` requires a
+* second read to agree before it does anything destructive (D49).
 */
 /** Stable id of the one panel. Never derived from a name — a rename must not
 *  mint a second device. */
 var NC_ALARM_STABLE_ID = "nc-alarm-panel";
+/** Seeded ONCE, at create. A later boot never re-stamps it. */
 var NC_ALARM_DEVICE_NAME = "Alarm";
-/**
-* Idempotent. Returns the ids either way so the caller can hold onto the panel.
-*
-* Failures are the CALLER's to handle: a hub whose alarm could not be created
-* should say so loudly and keep notifying, not fail to boot — but that decision
-* does not belong in here.
-*/
-async function ensureAlarmPanel(deps) {
-	const existingIntegration = await deps.getIntegration(deps.addonId);
-	if (existingIntegration !== null && !existingIntegration.fixed) {
-		await deps.markFixed(existingIntegration.id);
-		deps.logger.info("marked the notification-center integration as fixed", { meta: { integrationId: existingIntegration.id } });
-	}
-	const integration = existingIntegration ?? await deps.createIntegration({
-		addonId: deps.addonId,
-		name: deps.integrationName,
-		info: { fixed: true }
-	});
-	if (await deps.findDeviceByStableId("nc-alarm-panel") !== null) {
-		const adopted = await deps.adoptDevice({ stableId: NC_ALARM_STABLE_ID });
-		deps.logger.info("alarm panel adopted", {
-			tags: { deviceId: adopted.id },
-			meta: {
-				integrationId: integration.id,
-				stableId: NC_ALARM_STABLE_ID
-			}
-		});
-		return {
-			integrationId: integration.id,
-			deviceId: adopted.id,
-			created: false
-		};
-	}
-	const device = await deps.createDevice({
-		stableId: NC_ALARM_STABLE_ID,
-		integrationId: integration.id,
-		name: NC_ALARM_DEVICE_NAME
-	});
-	deps.logger.info("alarm panel created", {
-		tags: { deviceId: device.id },
-		meta: {
-			integrationId: integration.id,
-			stableId: NC_ALARM_STABLE_ID
-		}
-	});
-	return {
-		integrationId: integration.id,
-		deviceId: device.id,
-		created: true
-	};
-}
-/** The device class + type the caller passes to `kernel.devices.create`. */
-var NC_ALARM_DEVICE_CLASS = NcAlarmPanelDevice;
-var NC_ALARM_DEVICE_TYPE = DeviceType.AlarmPanel;
+/** Display name of the FIXED integration the panel hangs from. */
+var NC_INTEGRATION_NAME = "Notification Center";
+var NC_ALARM_DECLARATION = {
+	stableId: NC_ALARM_STABLE_ID,
+	name: NC_ALARM_DEVICE_NAME,
+	type: DeviceType.AlarmPanel,
+	DeviceClass: NcAlarmPanelDevice
+};
 //#endregion
 //#region src/notification-center/artifact-url.ts
 /**
@@ -1102,6 +1059,220 @@ function mimeFromExtension(file) {
 	return "application/octet-stream";
 }
 //#endregion
+//#region src/notification-center/action-buttons.ts
+/** Sequence names the rule actually declares. A button may only name one. */
+function declaredSequences(actions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const sequence of actions.onTrigger ?? []) names.add(sequence.name);
+	return names;
+}
+/**
+* Build the notification's buttons.
+*
+* Returns an empty array rather than `undefined` — the caller decides whether
+* to set the field, and an empty array is the honest answer to "which buttons
+* survived", which `undefined` would conflate with "the rule declared none".
+*/
+function buildActionButtons(input) {
+	const actions = input.actions;
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const button of buttons) {
+		if (!known.has(button.sequence)) continue;
+		if (seen.has(button.id)) continue;
+		seen.add(button.id);
+		out.push({
+			id: button.id,
+			label: button.label,
+			url: input.mintUrl({
+				sequence: button.sequence,
+				actionId: button.id
+			}),
+			...button.icon !== void 0 ? { icon: button.icon } : {},
+			...button.destructive !== void 0 ? { destructive: button.destructive } : {}
+		});
+	}
+	return out;
+}
+/**
+* Which of a rule's buttons name a sequence it does not have.
+*
+* Exported so the caller can LOG the drop. A button silently missing from a
+* notification is the exact shape of failure this repo keeps paying for — the
+* operator authored it, it never appeared, and nothing said why.
+*/
+function unresolvableButtons(actions) {
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	return buttons.filter((b) => !known.has(b.sequence)).map((b) => `${b.id}→${b.sequence}`);
+}
+//#endregion
+//#region src/notification-center/device-mute-store.ts
+var NC_DEVICE_MUTES_COLLECTION = "notification-center:device-mutes";
+var NC_DEVICE_MUTES_COLUMNS = [
+	(
+	/** `String(deviceId)` — one row per muted camera; unmute DELETES the row. */
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** When an admin muted it — the only thing an audit ever wants to know. */
+	{
+		name: "mutedAt",
+		type: "INTEGER",
+		notNull: true
+	})
+];
+/**
+* Absence of a row is "not muted"; there is no `muted: false` row. That keeps
+* the table proportional to what the operator actually silenced, and makes the
+* hot-path read a `Set.has`.
+*/
+var NcDeviceMuteStore = class {
+	muted = /* @__PURE__ */ new Set();
+	store;
+	logger;
+	now;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_DEVICE_MUTES_COLLECTION,
+			columns: [...NC_DEVICE_MUTES_COLUMNS]
+		});
+	}
+	/**
+	* (Re)hydrate. A failed load KEEPS what is already in memory rather than
+	* clearing it: dropping every mute on a transient store error would start
+	* notifying for a camera the operator silenced, without them asking — the
+	* same reasoning as `NcSnoozeStore.load`.
+	*/
+	async load() {
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_DEVICE_MUTES_COLLECTION,
+				filter: { limit: 1e4 }
+			});
+			const next = /* @__PURE__ */ new Set();
+			let skipped = 0;
+			for (const row of rows) {
+				const raw = row.data["deviceId"];
+				if (typeof raw !== "number" || !Number.isInteger(raw)) {
+					skipped += 1;
+					continue;
+				}
+				next.add(raw);
+			}
+			this.muted.clear();
+			for (const id of next) this.muted.add(id);
+			if (skipped > 0) this.logger.warn("device-mute rows skipped as malformed — they silence NOTHING", { meta: { skipped } });
+		} catch (err) {
+			this.logger.warn("device-mute load failed — keeping the mutes already in memory", { meta: {
+				error: String(err),
+				muted: this.muted.size
+			} });
+		}
+	}
+	/** Hot-path read, called once per evaluated subject. */
+	isMuted(deviceId) {
+		return this.muted.has(deviceId);
+	}
+	/** Every muted camera, ascending — a stable order so two callers agree. */
+	listMuted() {
+		return [...this.muted].toSorted((a, b) => a - b);
+	}
+	/**
+	* Mute or unmute. Idempotent in both directions; the in-memory set is
+	* updated only after the write lands, so a failed write cannot leave the
+	* hot path believing a camera is silenced when the next boot will not.
+	*/
+	async setMuted(deviceId, muted) {
+		const id = String(deviceId);
+		if (muted) {
+			await this.store.set.mutate({
+				collection: NC_DEVICE_MUTES_COLLECTION,
+				key: id,
+				value: {
+					id,
+					deviceId,
+					mutedAt: this.now()
+				}
+			});
+			this.muted.add(deviceId);
+		} else {
+			await this.store.delete.mutate({
+				collection: NC_DEVICE_MUTES_COLLECTION,
+				key: id
+			});
+			this.muted.delete(deviceId);
+		}
+	}
+};
+var NcDeviceStateCache = class {
+	deps;
+	states = /* @__PURE__ */ new Map();
+	lastOkAt = 0;
+	ids = [];
+	now;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	/**
+	* The device ids worth reading — recomputed from the rule set, so a cluster
+	* with no gated rule does no work at all.
+	*/
+	setWatched(ids) {
+		this.ids = [...new Set(ids)].sort((a, b) => a - b);
+	}
+	watched() {
+		return this.ids;
+	}
+	/** Hot-path read. No I/O, no await — this is called per event. */
+	get(deviceId) {
+		if (this.now() - this.lastOkAt > 3e5) return void 0;
+		return this.states.get(deviceId);
+	}
+	/**
+	* Re-read every watched state. Never throws: a gate that could fail the
+	* evaluation tick would take the notification pipeline with it.
+	*/
+	async refresh() {
+		if (this.ids.length === 0) {
+			this.states = /* @__PURE__ */ new Map();
+			return;
+		}
+		try {
+			const next = await this.deps.readStates(this.ids);
+			this.states = new Map(next);
+			this.lastOkAt = this.now();
+			for (const id of this.ids) if (!next.has(id)) this.deps.logger.info("device-state gate: no state for a watched device", { tags: { deviceId: id } });
+		} catch (err) {
+			this.deps.logger.warn("device-state refresh failed — keeping the previous states until they age out", { meta: {
+				watched: this.ids.length,
+				error: String(err)
+			} });
+		}
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/label-utils.ts
 /**
 * Every macro class the pipeline can carry on a detection. A `label` exists to
@@ -1514,12 +1685,13 @@ function readSensorEventType(value) {
 * what the operator named in the rule. Carrying only the camera is what made a
 * sensor-scoped rule unmatched — see {@link NcRuleSubject.sourceDeviceId}.
 */
-function subjectFromSensorEvent(ev) {
+function subjectFromSensorEvent(ev, markerTrackId) {
 	const eventType = readSensorEventType(ev.value);
 	return {
 		kind: "device-event",
 		recordId: ev.id,
 		deviceId: ev.deviceId,
+		...markerTrackId !== void 0 ? { trackId: markerTrackId } : {},
 		...ev.sourceDeviceId !== ev.deviceId ? { sourceDeviceId: ev.sourceDeviceId } : {},
 		timestamp: ev.timestamp,
 		classNames: [],
@@ -2386,7 +2558,16 @@ var NcDispatcher = class {
 					name: "zone.jpg"
 				} : still);
 			} else out.push(still);
-		}
+		} else if (entry.payload.media !== "none") this.deps.logger.info("no still could be resolved — this notification ships text-only", {
+			tags: { deviceId: entry.payload.subject.deviceId },
+			meta: {
+				recordKind: entry.recordKind,
+				recordId: entry.recordId,
+				policy: entry.payload.media,
+				...entry.payload.mediaFrame !== void 0 ? { frame: entry.payload.mediaFrame } : {},
+				owners: [...entry.payload.subject.eventId !== void 0 ? [`event:${entry.payload.subject.eventId}`] : [], ...entry.payload.subject.trackId !== void 0 ? [`track:${entry.payload.subject.trackId}`] : []]
+			}
+		});
 		const wantGif = entry.payload.mediaGif === true;
 		const wantMp4 = entry.payload.mediaClip === true;
 		if ((wantGif || wantMp4) && this.deps.renderEventMedia !== void 0) try {
@@ -2595,6 +2776,123 @@ function copyBytes(bytes) {
 	return out;
 }
 //#endregion
+//#region src/notification-center/event-intake.ts
+/** Object-event insert (movement-state transitions + zone crossings). */
+function incomingFromObjectEvent(event) {
+	return {
+		subject: subjectFromObjectEvent(event),
+		kind: "object-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: { eventId: event.id }
+		})
+	};
+}
+/** `TrackCloser.closeExpired` — the ONE close point. */
+function incomingFromTrack(track, info) {
+	return {
+		subject: subjectFromTrack(track, info),
+		kind: "track-end",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: track.deviceId },
+			meta: { trackId: track.trackId }
+		})
+	};
+}
+/**
+* Sensor-event persist (one row per linked camera).
+*
+* `markerTrackId` is the synthetic marker track the same state change
+* projected onto this camera — the notification's media owner, and the only
+* frame a device event has. Absent when no marker landed.
+*/
+function incomingFromSensorEvent(event, markerTrackId) {
+	return {
+		subject: subjectFromSensorEvent(event, markerTrackId),
+		kind: "device-event",
+		origin: "sensor",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				sensorEventId: event.id,
+				kind: event.kind,
+				...markerTrackId !== void 0 ? { trackId: markerTrackId } : {}
+			}
+		})
+	};
+}
+/** Audio-event persist (classified episode). */
+function incomingFromAudioEvent(event) {
+	return {
+		subject: subjectFromAudioEvent(event),
+		kind: "audio-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				audioEventId: event.id,
+				class: event.classification?.className
+			}
+		})
+	};
+}
+/** Package object-event persist (delivered / picked-up). */
+function incomingFromPackageEvent(event, phase) {
+	return {
+		subject: subjectFromPackageEvent(event, phase),
+		kind: "package-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				eventId: event.id,
+				phase
+			}
+		})
+	};
+}
+/** A committed ZoneAnalytics occupancy edge. */
+function incomingFromOccupancyEdge(edge) {
+	return {
+		subject: subjectFromOccupancyEvent(edge),
+		kind: "occupancy-event",
+		origin: "pipeline",
+		log: () => ({
+			tags: { deviceId: edge.deviceId },
+			meta: {
+				zoneId: edge.zoneId ?? "@frame",
+				className: edge.className ?? "@all",
+				count: edge.count,
+				threshold: edge.threshold,
+				occupied: edge.occupied
+			}
+		})
+	};
+}
+/** Re-stamp a live-producer envelope as a boot-reconcile replay of the same
+*  record — same subject, honest origin in the log. */
+function asReconcile(event) {
+	return {
+		...event,
+		origin: "reconcile"
+	};
+}
+/**
+* The delivery an intake kind rides. `object-event` and `audio-event` both ride
+* `immediate` (classified audio has no delivery of its own — it is gated by the
+* audio-class opt-in instead); `occupancy-event` rides `device-event`.
+*
+* Extracted from the centre so the tester can tell an operator which rules a
+* given simulated trigger will even be considered against, without evaluating.
+*/
+function deliveryForKind(kind) {
+	if (kind === "object-event" || kind === "audio-event") return "immediate";
+	if (kind === "occupancy-event") return "device-event";
+	return kind;
+}
+//#endregion
 //#region src/notification-center/occupancy-watcher.ts
 /** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
 var FRAME_SCOPE = "@frame";
@@ -3450,460 +3748,6 @@ function rowToEntry$1(id, data) {
 	};
 }
 //#endregion
-//#region src/notification-center/event-intake.ts
-/** Object-event insert (movement-state transitions + zone crossings). */
-function incomingFromObjectEvent(event) {
-	return {
-		subject: subjectFromObjectEvent(event),
-		kind: "object-event",
-		origin: "pipeline",
-		log: () => ({
-			tags: { deviceId: event.deviceId },
-			meta: { eventId: event.id }
-		})
-	};
-}
-/** `TrackCloser.closeExpired` — the ONE close point. */
-function incomingFromTrack(track, info) {
-	return {
-		subject: subjectFromTrack(track, info),
-		kind: "track-end",
-		origin: "pipeline",
-		log: () => ({
-			tags: { deviceId: track.deviceId },
-			meta: { trackId: track.trackId }
-		})
-	};
-}
-/** Sensor-event persist (one row per linked camera). */
-function incomingFromSensorEvent(event) {
-	return {
-		subject: subjectFromSensorEvent(event),
-		kind: "device-event",
-		origin: "sensor",
-		log: () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				sensorEventId: event.id,
-				kind: event.kind
-			}
-		})
-	};
-}
-/** Audio-event persist (classified episode). */
-function incomingFromAudioEvent(event) {
-	return {
-		subject: subjectFromAudioEvent(event),
-		kind: "audio-event",
-		origin: "pipeline",
-		log: () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				audioEventId: event.id,
-				class: event.classification?.className
-			}
-		})
-	};
-}
-/** Package object-event persist (delivered / picked-up). */
-function incomingFromPackageEvent(event, phase) {
-	return {
-		subject: subjectFromPackageEvent(event, phase),
-		kind: "package-event",
-		origin: "pipeline",
-		log: () => ({
-			tags: { deviceId: event.deviceId },
-			meta: {
-				eventId: event.id,
-				phase
-			}
-		})
-	};
-}
-/** A committed ZoneAnalytics occupancy edge. */
-function incomingFromOccupancyEdge(edge) {
-	return {
-		subject: subjectFromOccupancyEvent(edge),
-		kind: "occupancy-event",
-		origin: "pipeline",
-		log: () => ({
-			tags: { deviceId: edge.deviceId },
-			meta: {
-				zoneId: edge.zoneId ?? "@frame",
-				className: edge.className ?? "@all",
-				count: edge.count,
-				threshold: edge.threshold,
-				occupied: edge.occupied
-			}
-		})
-	};
-}
-/** Re-stamp a live-producer envelope as a boot-reconcile replay of the same
-*  record — same subject, honest origin in the log. */
-function asReconcile(event) {
-	return {
-		...event,
-		origin: "reconcile"
-	};
-}
-/**
-* The delivery an intake kind rides. `object-event` and `audio-event` both ride
-* `immediate` (classified audio has no delivery of its own — it is gated by the
-* audio-class opt-in instead); `occupancy-event` rides `device-event`.
-*
-* Extracted from the centre so the tester can tell an operator which rules a
-* given simulated trigger will even be considered against, without evaluating.
-*/
-function deliveryForKind(kind) {
-	if (kind === "object-event" || kind === "audio-event") return "immediate";
-	if (kind === "occupancy-event") return "device-event";
-	return kind;
-}
-//#endregion
-//#region src/notification-center/test-event.ts
-/** Normalized 0..1 rectangle, top-left origin — the subject bbox space. */
-var BboxSchema = object({
-	x: number().min(0).max(1),
-	y: number().min(0).max(1),
-	w: number().min(0).max(1),
-	h: number().min(0).max(1)
-});
-/**
-* What the operator typed. Every field maps onto exactly one field of
-* {@link NcRuleSubject} — there is no test-only condition input, because a
-* condition the tester could set and a real record could not is a condition the
-* test result would lie about.
-*/
-var NcTestEventInputSchema = object({
-	trigger: _enum([
-		"object-event",
-		"track-end",
-		"device-event",
-		"package-event",
-		"audio-event",
-		"occupancy-event"
-	]),
-	/** The CAMERA the event is attributed to (what a notification shows). */
-	deviceId: number().int(),
-	/** DEVICE-EVENT: the linked device whose state changed — the contact, the
-	*  button, the doorbell — when that is not the camera. */
-	sourceDeviceId: number().int().optional(),
-	/** Detection class ids, from the NC taxonomy (`person`, `car`, `audio-…`). */
-	classNames: array(string()).default([]),
-	/** Collapsed display label — an identity name, a plate, a subclass. */
-	label: string().optional(),
-	/** Detection confidence [0,1]. ABSENT is meaningful: a `minConfidence`
-	*  condition FAILS on an absent confidence, and the tester must be able to
-	*  reproduce that. */
-	confidence: number().min(0).max(1).optional(),
-	/** Identity/plate MATCH confidence — distinct from `confidence`. */
-	labelConfidence: number().min(0).max(1).optional(),
-	/** Key-event importance [0,1] (track-end only, in practice). */
-	importance: number().min(0).max(1).optional(),
-	/** Track lifespan in seconds (track-end only). */
-	dwellSeconds: number().min(0).optional(),
-	/** Admin zone ids the subject is in (object) / visited (track). */
-	zones: array(string()).default([]),
-	/** OBJECT-EVENT: simulate a confirmed zone crossing. */
-	crossing: object({
-		zoneId: string(),
-		direction: _enum(["enter", "exit"])
-	}).optional(),
-	/** DEVICE-EVENT: the taxonomy kind id (`doorbell`, `contact`, `button`, …). */
-	sensorKind: string().optional(),
-	/** DEVICE-EVENT: the raw device event-type token, when the source is an
-	*  event-emitter slice. */
-	eventType: string().optional(),
-	/** PACKAGE-EVENT: which lifecycle phase. */
-	packagePhase: _enum(["delivered", "picked-up"]).optional(),
-	/** Detection provenance. Absent = `pipeline` (what a record with no stamped
-	*  source reads as). */
-	source: _enum([
-		"pipeline",
-		"onboard",
-		"sensor",
-		"audio"
-	]).optional(),
-	/** Normalized bbox — feeds `customZones`, AND is what lets the still be
-	*  cropped / boxed the way the rule's media policy asks. */
-	bbox: BboxSchema.optional(),
-	/** OCCUPANCY-EVENT: the committed count edge. */
-	occupancy: object({
-		zoneId: string().optional(),
-		zoneName: string().optional(),
-		className: string().optional(),
-		count: number().int().min(0),
-		previousCount: number().int().min(0).default(0),
-		occupied: boolean(),
-		threshold: number().int().min(1)
-	}).optional(),
-	/** The instant the event happened. Absent = now. Set it to test a schedule
-	*  condition without waiting for the hour. */
-	timestamp: number().int().optional(),
-	/** Evaluate only this rule (what the per-rule Test button sends). */
-	onlyRuleId: string().optional(),
-	bypassCooldown: boolean().default(false),
-	bypassMute: boolean().default(false),
-	/** Run the matched rule's `onTrigger` sequences. OFF by default: a test must
-	*  not open a gate the operator did not ask to open. */
-	runActions: boolean().default(false),
-	/** Where the still comes from. `live` takes a snapshot of the camera NOW;
-	*  `none` sends the notification without one. */
-	still: _enum(["live", "none"]).default("live")
-});
-/** Per-rule verdict, as the tester reports it. */
-var NcTestEventRuleOutcomeSchema = object({
-	ruleId: string(),
-	ruleName: string(),
-	matched: boolean(),
-	failedCondition: string().optional(),
-	matchedOn: array(string()).optional(),
-	cooldown: _enum([
-		"n/a",
-		"clear",
-		"suppressed",
-		"bypassed"
-	]),
-	enqueued: number().int(),
-	targetIds: array(string())
-});
-var NcTestEventResultSchema = object({
-	/** The synthetic record id. It is `synthetic:<uuid>` and it is what to grep
-	*  for in the logs, in the outbox and in the delivery history. */
-	recordId: string(),
-	/** Always `synthetic` — the marker the whole path carried. */
-	origin: literal("synthetic"),
-	/** The delivery the chosen trigger rides. A rule declaring anything else was
-	*  never a candidate, which is the answer to most "it did not fire". */
-	delivery: string(),
-	candidates: number().int(),
-	outcomes: array(NcTestEventRuleOutcomeSchema),
-	/** What the still ended up being. `unattachable` means the chosen TRIGGER
-	*  cannot carry one at all — a device-event notification has no media owner,
-	*  live or synthetic — and that is a property of production, not of the test. */
-	still: _enum([
-		"live",
-		"none",
-		"unavailable",
-		"unattachable"
-	]),
-	/** Everything the operator has to know to read the result honestly. */
-	notes: array(string()),
-	droppedBy: string().optional()
-});
-/** The id shape every synthetic record carries. One prefix, everywhere. */
-var SYNTHETIC_ID_PREFIX = "synthetic:";
-/** True for a record id this module minted. Used by the media shim. */
-function isSyntheticId(id) {
-	return id.startsWith(SYNTHETIC_ID_PREFIX);
-}
-/**
-* Whether a subject of this kind can carry a still AT ALL, in production.
-*
-* The attachment ladder resolves media by OWNER, and `buildEntries` freezes an
-* owner onto the payload only for the kinds that have one: an `eventId` for
-* object/package events, a `trackId` for track-scoped ones. A device-event, an
-* audio episode and an occupancy edge freeze neither — so those notifications
-* ship text-only today, and a tester that attached an image to them would be
-* advertising a feature that does not exist.
-*/
-function triggerCanCarryStill(kind) {
-	return kind === "object-event" || kind === "package-event" || kind === "track-end";
-}
-/**
-* Build the synthetic envelope. Pure: same input + same id + same clock ⇒ same
-* event, so the red-green test can assert that this subject and a
-* producer-built one are indistinguishable.
-*/
-function buildSyntheticEvent(input, recordId, now) {
-	const kind = input.trigger;
-	const timestamp = input.timestamp ?? now;
-	const trackScoped = kind === "object-event" || kind === "track-end";
-	return {
-		subject: {
-			kind,
-			recordId,
-			deviceId: input.deviceId,
-			...input.sourceDeviceId !== void 0 && input.sourceDeviceId !== input.deviceId ? { sourceDeviceId: input.sourceDeviceId } : {},
-			timestamp,
-			classNames: input.classNames,
-			...input.label !== void 0 ? { label: input.label } : {},
-			...input.confidence !== void 0 ? { confidence: input.confidence } : {},
-			zones: input.zones,
-			...trackScoped ? { trackId: recordId } : {},
-			source: input.source ?? (kind === "device-event" ? "sensor" : "pipeline"),
-			...input.importance !== void 0 ? { importance: input.importance } : {},
-			...input.dwellSeconds !== void 0 ? { dwellSeconds: input.dwellSeconds } : {},
-			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
-			...input.sensorKind !== void 0 ? { sensorKind: input.sensorKind } : {},
-			...input.eventType !== void 0 ? { eventType: input.eventType } : {},
-			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
-			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
-			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
-			...input.occupancy !== void 0 ? { occupancy: {
-				...input.occupancy.zoneId !== void 0 ? { zoneId: input.occupancy.zoneId } : {},
-				...input.occupancy.zoneName !== void 0 ? { zoneName: input.occupancy.zoneName } : {},
-				...input.occupancy.className !== void 0 ? { className: input.occupancy.className } : {},
-				count: input.occupancy.count,
-				previousCount: input.occupancy.previousCount,
-				occupied: input.occupancy.occupied,
-				threshold: input.occupancy.threshold
-			} } : {}
-		},
-		kind,
-		origin: "synthetic",
-		controls: {
-			...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {},
-			bypassCooldown: input.bypassCooldown,
-			bypassMute: input.bypassMute,
-			runActions: input.runActions
-		},
-		log: () => ({
-			tags: { deviceId: input.deviceId },
-			meta: {
-				eventId: recordId,
-				synthetic: true,
-				trigger: input.trigger,
-				...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {}
-			}
-		})
-	};
-}
-/**
-* Turn one live JPEG into the media set the dispatcher's ladders look for.
-*
-* Every entry is the SAME photograph, differing only in how it was cut — which
-* is exactly what the ladders mean by their kind names, so nothing here claims
-* a frame it does not have:
-*
-*   - `fullFrame` / `keyFrame` / `firstFrame` — the clean scene, verbatim.
-*   - `fullFrameBoxed` — the clean scene with the operator's bbox drawn on it.
-*   - `crop` / `thumbnail` — that bbox, cut out.
-*
-* With NO bbox only the clean-scene kinds are produced, so a rule asking for
-* `frame: 'cropped'` correctly finds nothing rather than being handed a whole
-* scene it did not ask for. sharp failures degrade the same way: the clean
-* scene always survives.
-*/
-async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
-	const base64 = Buffer.from(jpeg).toString("base64");
-	const clean = (kind) => ({
-		key: `${SYNTHETIC_ID_PREFIX}${kind}`,
-		kind,
-		base64,
-		sizeBytes: jpeg.byteLength,
-		timestamp
-	});
-	const files = [
-		clean("fullFrame"),
-		clean("keyFrame"),
-		clean("firstFrame")
-	];
-	if (bbox === void 0) return files;
-	try {
-		const { default: sharp } = await import("sharp");
-		const meta = await sharp(Buffer.from(jpeg)).metadata();
-		const W = meta.width ?? 0;
-		const H = meta.height ?? 0;
-		if (W === 0 || H === 0) return files;
-		const left = Math.max(0, Math.min(W - 1, Math.floor(bbox.x * W)));
-		const top = Math.max(0, Math.min(H - 1, Math.floor(bbox.y * H)));
-		const width = Math.max(1, Math.min(W - left, Math.ceil(bbox.w * W)));
-		const height = Math.max(1, Math.min(H - top, Math.ceil(bbox.h * H)));
-		const cropBuf = await sharp(Buffer.from(jpeg)).extract({
-			left,
-			top,
-			width,
-			height
-		}).jpeg({ quality: 85 }).toBuffer();
-		const cropB64 = cropBuf.toString("base64");
-		files.push({
-			key: `${SYNTHETIC_ID_PREFIX}crop`,
-			kind: "crop",
-			base64: cropB64,
-			sizeBytes: cropBuf.byteLength,
-			timestamp
-		}, {
-			key: `${SYNTHETIC_ID_PREFIX}thumbnail`,
-			kind: "thumbnail",
-			base64: cropB64,
-			sizeBytes: cropBuf.byteLength,
-			timestamp
-		});
-		const stroke = Math.max(2, Math.round(Math.min(W, H) / 240));
-		const overlay = Buffer.from(`<svg width="${W}" height="${H}"><rect x="${left}" y="${top}" width="${width}" height="${height}" fill="none" stroke="#22d3ee" stroke-width="${stroke}"/></svg>`);
-		const boxedBuf = await sharp(Buffer.from(jpeg)).composite([{
-			input: overlay,
-			top: 0,
-			left: 0
-		}]).jpeg({ quality: 85 }).toBuffer();
-		files.push({
-			key: `${SYNTHETIC_ID_PREFIX}fullFrameBoxed`,
-			kind: "fullFrameBoxed",
-			base64: boxedBuf.toString("base64"),
-			sizeBytes: boxedBuf.byteLength,
-			timestamp
-		});
-	} catch {
-		return files;
-	}
-	return files;
-}
-//#endregion
-//#region src/notification-center/action-buttons.ts
-/** Sequence names the rule actually declares. A button may only name one. */
-function declaredSequences(actions) {
-	const names = /* @__PURE__ */ new Set();
-	for (const sequence of actions.onTrigger ?? []) names.add(sequence.name);
-	return names;
-}
-/**
-* Build the notification's buttons.
-*
-* Returns an empty array rather than `undefined` — the caller decides whether
-* to set the field, and an empty array is the honest answer to "which buttons
-* survived", which `undefined` would conflate with "the rule declared none".
-*/
-function buildActionButtons(input) {
-	const actions = input.actions;
-	if (actions === void 0) return [];
-	const buttons = actions.buttons ?? [];
-	if (buttons.length === 0) return [];
-	const known = declaredSequences(actions);
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const button of buttons) {
-		if (!known.has(button.sequence)) continue;
-		if (seen.has(button.id)) continue;
-		seen.add(button.id);
-		out.push({
-			id: button.id,
-			label: button.label,
-			url: input.mintUrl({
-				sequence: button.sequence,
-				actionId: button.id
-			}),
-			...button.icon !== void 0 ? { icon: button.icon } : {},
-			...button.destructive !== void 0 ? { destructive: button.destructive } : {}
-		});
-	}
-	return out;
-}
-/**
-* Which of a rule's buttons name a sequence it does not have.
-*
-* Exported so the caller can LOG the drop. A button silently missing from a
-* notification is the exact shape of failure this repo keeps paying for — the
-* operator authored it, it never appeared, and nothing said why.
-*/
-function unresolvableButtons(actions) {
-	if (actions === void 0) return [];
-	const buttons = actions.buttons ?? [];
-	if (buttons.length === 0) return [];
-	const known = declaredSequences(actions);
-	return buttons.filter((b) => !known.has(b.sequence)).map((b) => `${b.id}→${b.sequence}`);
-}
-//#endregion
 //#region src/notification-center/rule-actions.ts
 var NcRuleActionRunner = class {
 	deps;
@@ -4216,53 +4060,6 @@ var NcRuleStore = class {
 		});
 	}
 };
-var NcDeviceStateCache = class {
-	deps;
-	states = /* @__PURE__ */ new Map();
-	lastOkAt = 0;
-	ids = [];
-	now;
-	constructor(deps) {
-		this.deps = deps;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	/**
-	* The device ids worth reading — recomputed from the rule set, so a cluster
-	* with no gated rule does no work at all.
-	*/
-	setWatched(ids) {
-		this.ids = [...new Set(ids)].sort((a, b) => a - b);
-	}
-	watched() {
-		return this.ids;
-	}
-	/** Hot-path read. No I/O, no await — this is called per event. */
-	get(deviceId) {
-		if (this.now() - this.lastOkAt > 3e5) return void 0;
-		return this.states.get(deviceId);
-	}
-	/**
-	* Re-read every watched state. Never throws: a gate that could fail the
-	* evaluation tick would take the notification pipeline with it.
-	*/
-	async refresh() {
-		if (this.ids.length === 0) {
-			this.states = /* @__PURE__ */ new Map();
-			return;
-		}
-		try {
-			const next = await this.deps.readStates(this.ids);
-			this.states = new Map(next);
-			this.lastOkAt = this.now();
-			for (const id of this.ids) if (!next.has(id)) this.deps.logger.info("device-state gate: no state for a watched device", { tags: { deviceId: id } });
-		} catch (err) {
-			this.deps.logger.warn("device-state refresh failed — keeping the previous states until they age out", { meta: {
-				watched: this.ids.length,
-				error: String(err)
-			} });
-		}
-	}
-};
 //#endregion
 //#region src/notification-center/snooze-digest.ts
 /** `14:03` in the node's local zone — a digest is read by a person, at home. */
@@ -4379,119 +4176,6 @@ function dueSummaries(entries, nowMs, alreadySent) {
 	return entries.filter((e) => e.summary && nowMs >= e.expiresAt && !alreadySent.has(e.id));
 }
 //#endregion
-//#region src/notification-center/device-mute-store.ts
-var NC_DEVICE_MUTES_COLLECTION = "notification-center:device-mutes";
-var NC_DEVICE_MUTES_COLUMNS = [
-	(
-	/** `String(deviceId)` — one row per muted camera; unmute DELETES the row. */
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	}),
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	(
-	/** When an admin muted it — the only thing an audit ever wants to know. */
-	{
-		name: "mutedAt",
-		type: "INTEGER",
-		notNull: true
-	})
-];
-/**
-* Absence of a row is "not muted"; there is no `muted: false` row. That keeps
-* the table proportional to what the operator actually silenced, and makes the
-* hot-path read a `Set.has`.
-*/
-var NcDeviceMuteStore = class {
-	muted = /* @__PURE__ */ new Set();
-	store;
-	logger;
-	now;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: NC_DEVICE_MUTES_COLLECTION,
-			columns: [...NC_DEVICE_MUTES_COLUMNS]
-		});
-	}
-	/**
-	* (Re)hydrate. A failed load KEEPS what is already in memory rather than
-	* clearing it: dropping every mute on a transient store error would start
-	* notifying for a camera the operator silenced, without them asking — the
-	* same reasoning as `NcSnoozeStore.load`.
-	*/
-	async load() {
-		try {
-			const rows = await this.store.query.query({
-				collection: NC_DEVICE_MUTES_COLLECTION,
-				filter: { limit: 1e4 }
-			});
-			const next = /* @__PURE__ */ new Set();
-			let skipped = 0;
-			for (const row of rows) {
-				const raw = row.data["deviceId"];
-				if (typeof raw !== "number" || !Number.isInteger(raw)) {
-					skipped += 1;
-					continue;
-				}
-				next.add(raw);
-			}
-			this.muted.clear();
-			for (const id of next) this.muted.add(id);
-			if (skipped > 0) this.logger.warn("device-mute rows skipped as malformed — they silence NOTHING", { meta: { skipped } });
-		} catch (err) {
-			this.logger.warn("device-mute load failed — keeping the mutes already in memory", { meta: {
-				error: String(err),
-				muted: this.muted.size
-			} });
-		}
-	}
-	/** Hot-path read, called once per evaluated subject. */
-	isMuted(deviceId) {
-		return this.muted.has(deviceId);
-	}
-	/** Every muted camera, ascending — a stable order so two callers agree. */
-	listMuted() {
-		return [...this.muted].toSorted((a, b) => a - b);
-	}
-	/**
-	* Mute or unmute. Idempotent in both directions; the in-memory set is
-	* updated only after the write lands, so a failed write cannot leave the
-	* hot path believing a camera is silenced when the next boot will not.
-	*/
-	async setMuted(deviceId, muted) {
-		const id = String(deviceId);
-		if (muted) {
-			await this.store.set.mutate({
-				collection: NC_DEVICE_MUTES_COLLECTION,
-				key: id,
-				value: {
-					id,
-					deviceId,
-					mutedAt: this.now()
-				}
-			});
-			this.muted.add(deviceId);
-		} else {
-			await this.store.delete.mutate({
-				collection: NC_DEVICE_MUTES_COLLECTION,
-				key: id
-			});
-			this.muted.delete(deviceId);
-		}
-	}
-};
-//#endregion
 //#region src/notification-center/snooze-store.ts
 /**
 * NcSnoozeStore — the durable half of snooze.
@@ -4845,6 +4529,306 @@ var NcSnoozeStore = class {
 	}
 };
 //#endregion
+//#region src/notification-center/test-event.ts
+/** Normalized 0..1 rectangle, top-left origin — the subject bbox space. */
+var BboxSchema = object({
+	x: number().min(0).max(1),
+	y: number().min(0).max(1),
+	w: number().min(0).max(1),
+	h: number().min(0).max(1)
+});
+/**
+* What the operator typed. Every field maps onto exactly one field of
+* {@link NcRuleSubject} — there is no test-only condition input, because a
+* condition the tester could set and a real record could not is a condition the
+* test result would lie about.
+*/
+var NcTestEventInputSchema = object({
+	trigger: _enum([
+		"object-event",
+		"track-end",
+		"device-event",
+		"package-event",
+		"audio-event",
+		"occupancy-event"
+	]),
+	/** The CAMERA the event is attributed to (what a notification shows). */
+	deviceId: number().int(),
+	/** DEVICE-EVENT: the linked device whose state changed — the contact, the
+	*  button, the doorbell — when that is not the camera. */
+	sourceDeviceId: number().int().optional(),
+	/** Detection class ids, from the NC taxonomy (`person`, `car`, `audio-…`). */
+	classNames: array(string()).default([]),
+	/** Collapsed display label — an identity name, a plate, a subclass. */
+	label: string().optional(),
+	/** Detection confidence [0,1]. ABSENT is meaningful: a `minConfidence`
+	*  condition FAILS on an absent confidence, and the tester must be able to
+	*  reproduce that. */
+	confidence: number().min(0).max(1).optional(),
+	/** Identity/plate MATCH confidence — distinct from `confidence`. */
+	labelConfidence: number().min(0).max(1).optional(),
+	/** Key-event importance [0,1] (track-end only, in practice). */
+	importance: number().min(0).max(1).optional(),
+	/** Track lifespan in seconds (track-end only). */
+	dwellSeconds: number().min(0).optional(),
+	/** Admin zone ids the subject is in (object) / visited (track). */
+	zones: array(string()).default([]),
+	/** OBJECT-EVENT: simulate a confirmed zone crossing. */
+	crossing: object({
+		zoneId: string(),
+		direction: _enum(["enter", "exit"])
+	}).optional(),
+	/** DEVICE-EVENT: the taxonomy kind id (`doorbell`, `contact`, `button`, …). */
+	sensorKind: string().optional(),
+	/** DEVICE-EVENT: the raw device event-type token, when the source is an
+	*  event-emitter slice. */
+	eventType: string().optional(),
+	/** PACKAGE-EVENT: which lifecycle phase. */
+	packagePhase: _enum(["delivered", "picked-up"]).optional(),
+	/** Detection provenance. Absent = `pipeline` (what a record with no stamped
+	*  source reads as). */
+	source: _enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"audio"
+	]).optional(),
+	/** Normalized bbox — feeds `customZones`, AND is what lets the still be
+	*  cropped / boxed the way the rule's media policy asks. */
+	bbox: BboxSchema.optional(),
+	/** OCCUPANCY-EVENT: the committed count edge. */
+	occupancy: object({
+		zoneId: string().optional(),
+		zoneName: string().optional(),
+		className: string().optional(),
+		count: number().int().min(0),
+		previousCount: number().int().min(0).default(0),
+		occupied: boolean(),
+		threshold: number().int().min(1)
+	}).optional(),
+	/** The instant the event happened. Absent = now. Set it to test a schedule
+	*  condition without waiting for the hour. */
+	timestamp: number().int().optional(),
+	/** Evaluate only this rule (what the per-rule Test button sends). */
+	onlyRuleId: string().optional(),
+	bypassCooldown: boolean().default(false),
+	bypassMute: boolean().default(false),
+	/** Run the matched rule's `onTrigger` sequences. OFF by default: a test must
+	*  not open a gate the operator did not ask to open. */
+	runActions: boolean().default(false),
+	/** Where the still comes from. `live` takes a snapshot of the camera NOW;
+	*  `none` sends the notification without one. */
+	still: _enum(["live", "none"]).default("live")
+});
+/** Per-rule verdict, as the tester reports it. */
+var NcTestEventRuleOutcomeSchema = object({
+	ruleId: string(),
+	ruleName: string(),
+	matched: boolean(),
+	failedCondition: string().optional(),
+	matchedOn: array(string()).optional(),
+	cooldown: _enum([
+		"n/a",
+		"clear",
+		"suppressed",
+		"bypassed"
+	]),
+	enqueued: number().int(),
+	targetIds: array(string())
+});
+var NcTestEventResultSchema = object({
+	/** The synthetic record id. It is `synthetic:<uuid>` and it is what to grep
+	*  for in the logs, in the outbox and in the delivery history. */
+	recordId: string(),
+	/** Always `synthetic` — the marker the whole path carried. */
+	origin: literal("synthetic"),
+	/** The delivery the chosen trigger rides. A rule declaring anything else was
+	*  never a candidate, which is the answer to most "it did not fire". */
+	delivery: string(),
+	candidates: number().int(),
+	outcomes: array(NcTestEventRuleOutcomeSchema),
+	/** What the still ended up being. `unattachable` means the chosen TRIGGER
+	*  cannot carry one at all — an audio episode and an occupancy edge freeze no
+	*  media owner, so those notifications ship text-only in production too, and
+	*  that is a property of production, not of the test. A DEVICE event is no
+	*  longer one of them: its press projects a marker track that owns the frame. */
+	still: _enum([
+		"live",
+		"none",
+		"unavailable",
+		"unattachable"
+	]),
+	/** Everything the operator has to know to read the result honestly. */
+	notes: array(string()),
+	droppedBy: string().optional()
+});
+/** The id shape every synthetic record carries. One prefix, everywhere. */
+var SYNTHETIC_ID_PREFIX = "synthetic:";
+/** True for a record id this module minted. Used by the media shim. */
+function isSyntheticId(id) {
+	return id.startsWith(SYNTHETIC_ID_PREFIX);
+}
+/**
+* Whether a subject of this kind can carry a still AT ALL, in production.
+*
+* The attachment ladder resolves media by OWNER, and `buildEntries` freezes an
+* owner onto the payload only for the kinds that have one:
+*
+*  - an `eventId` for object and package events;
+*  - a `trackId` for track-scoped ones — and, since 2026-08-08, for a
+*    DEVICE event too: the same state change projects a synthetic marker track
+*    carrying the camera's frame (`sensor-marker-projector.ts`), and the
+*    notification names it as its owner.
+*
+* An audio episode and an occupancy edge still freeze neither. Audio HAS a
+* marker projection, but its id does not reach the notification subject yet;
+* occupancy has no projection at all. Those two therefore remain honestly
+* unattachable — a tester that invented a picture for them would be advertising
+* a feature that does not exist.
+*/
+function triggerCanCarryStill(kind) {
+	return kind === "object-event" || kind === "package-event" || kind === "track-end" || kind === "device-event";
+}
+/**
+* Build the synthetic envelope. Pure: same input + same id + same clock ⇒ same
+* event, so the red-green test can assert that this subject and a
+* producer-built one are indistinguishable.
+*/
+function buildSyntheticEvent(input, recordId, now) {
+	const kind = input.trigger;
+	const timestamp = input.timestamp ?? now;
+	const carriesTrackId = kind === "object-event" || kind === "track-end" || kind === "device-event";
+	return {
+		subject: {
+			kind,
+			recordId,
+			deviceId: input.deviceId,
+			...input.sourceDeviceId !== void 0 && input.sourceDeviceId !== input.deviceId ? { sourceDeviceId: input.sourceDeviceId } : {},
+			timestamp,
+			classNames: input.classNames,
+			...input.label !== void 0 ? { label: input.label } : {},
+			...input.confidence !== void 0 ? { confidence: input.confidence } : {},
+			zones: input.zones,
+			...carriesTrackId ? { trackId: recordId } : {},
+			source: input.source ?? (kind === "device-event" ? "sensor" : "pipeline"),
+			...input.importance !== void 0 ? { importance: input.importance } : {},
+			...input.dwellSeconds !== void 0 ? { dwellSeconds: input.dwellSeconds } : {},
+			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
+			...input.sensorKind !== void 0 ? { sensorKind: input.sensorKind } : {},
+			...input.eventType !== void 0 ? { eventType: input.eventType } : {},
+			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
+			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
+			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
+			...input.occupancy !== void 0 ? { occupancy: {
+				...input.occupancy.zoneId !== void 0 ? { zoneId: input.occupancy.zoneId } : {},
+				...input.occupancy.zoneName !== void 0 ? { zoneName: input.occupancy.zoneName } : {},
+				...input.occupancy.className !== void 0 ? { className: input.occupancy.className } : {},
+				count: input.occupancy.count,
+				previousCount: input.occupancy.previousCount,
+				occupied: input.occupancy.occupied,
+				threshold: input.occupancy.threshold
+			} } : {}
+		},
+		kind,
+		origin: "synthetic",
+		controls: {
+			...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {},
+			bypassCooldown: input.bypassCooldown,
+			bypassMute: input.bypassMute,
+			runActions: input.runActions
+		},
+		log: () => ({
+			tags: { deviceId: input.deviceId },
+			meta: {
+				eventId: recordId,
+				synthetic: true,
+				trigger: input.trigger,
+				...input.onlyRuleId !== void 0 ? { onlyRuleId: input.onlyRuleId } : {}
+			}
+		})
+	};
+}
+/**
+* Turn one live JPEG into the media set the dispatcher's ladders look for.
+*
+* Every entry is the SAME photograph, differing only in how it was cut — which
+* is exactly what the ladders mean by their kind names, so nothing here claims
+* a frame it does not have:
+*
+*   - `fullFrame` / `keyFrame` / `firstFrame` — the clean scene, verbatim.
+*   - `fullFrameBoxed` — the clean scene with the operator's bbox drawn on it.
+*   - `crop` / `thumbnail` — that bbox, cut out.
+*
+* With NO bbox only the clean-scene kinds are produced, so a rule asking for
+* `frame: 'cropped'` correctly finds nothing rather than being handed a whole
+* scene it did not ask for. sharp failures degrade the same way: the clean
+* scene always survives.
+*/
+async function deriveSyntheticMedia(jpeg, bbox, timestamp) {
+	const base64 = Buffer.from(jpeg).toString("base64");
+	const clean = (kind) => ({
+		key: `${SYNTHETIC_ID_PREFIX}${kind}`,
+		kind,
+		base64,
+		sizeBytes: jpeg.byteLength,
+		timestamp
+	});
+	const files = [
+		clean("fullFrame"),
+		clean("keyFrame"),
+		clean("firstFrame")
+	];
+	if (bbox === void 0) return files;
+	try {
+		const { default: sharp } = await import("sharp");
+		const meta = await sharp(Buffer.from(jpeg)).metadata();
+		const W = meta.width ?? 0;
+		const H = meta.height ?? 0;
+		if (W === 0 || H === 0) return files;
+		const left = Math.max(0, Math.min(W - 1, Math.floor(bbox.x * W)));
+		const top = Math.max(0, Math.min(H - 1, Math.floor(bbox.y * H)));
+		const width = Math.max(1, Math.min(W - left, Math.ceil(bbox.w * W)));
+		const height = Math.max(1, Math.min(H - top, Math.ceil(bbox.h * H)));
+		const cropBuf = await sharp(Buffer.from(jpeg)).extract({
+			left,
+			top,
+			width,
+			height
+		}).jpeg({ quality: 85 }).toBuffer();
+		const cropB64 = cropBuf.toString("base64");
+		files.push({
+			key: `${SYNTHETIC_ID_PREFIX}crop`,
+			kind: "crop",
+			base64: cropB64,
+			sizeBytes: cropBuf.byteLength,
+			timestamp
+		}, {
+			key: `${SYNTHETIC_ID_PREFIX}thumbnail`,
+			kind: "thumbnail",
+			base64: cropB64,
+			sizeBytes: cropBuf.byteLength,
+			timestamp
+		});
+		const stroke = Math.max(2, Math.round(Math.min(W, H) / 240));
+		const overlay = Buffer.from(`<svg width="${W}" height="${H}"><rect x="${left}" y="${top}" width="${width}" height="${height}" fill="none" stroke="#22d3ee" stroke-width="${stroke}"/></svg>`);
+		const boxedBuf = await sharp(Buffer.from(jpeg)).composite([{
+			input: overlay,
+			top: 0,
+			left: 0
+		}]).jpeg({ quality: 85 }).toBuffer();
+		files.push({
+			key: `${SYNTHETIC_ID_PREFIX}fullFrameBoxed`,
+			kind: "fullFrameBoxed",
+			base64: boxedBuf.toString("base64"),
+			sizeBytes: boxedBuf.byteLength,
+			timestamp
+		});
+	} catch {
+		return files;
+	}
+	return files;
+}
+//#endregion
 //#region src/notification-center/timelapse/timelapse-store.ts
 var NC_TIMELAPSE_RULES_COLLECTION = "notification-center:timelapse-rules";
 var NC_TIMELAPSE_RULES_COLUMNS = [
@@ -5683,10 +5667,16 @@ var NotificationCenter = class NotificationCenter {
 		this.consumeEvent(incomingFromTrack(track, info));
 	}
 	/**
-	* Called at the SensorEvent persist site (`ingestSensorStateChange` — one row
-	* per linked camera), in the SAME moment as the durable insert. Feeds the
-	* `device-event` trigger (doorbell press / sensor state change). Fire-and-
-	* forget from the ingest loop; the outbox owns delivery from here.
+	* Called for each SensorEvent row (`ingestSensorStateChange` — one per linked
+	* camera), once the same state change has had its chance to project a marker
+	* track. Feeds the `device-event` trigger (doorbell press / sensor state
+	* change). Fire-and-forget from the ingest loop; the outbox owns delivery.
+	*
+	* `markerTrackId` is that marker — the synthetic track carrying the camera's
+	* frame — and it is what gives this notification a picture: the payload
+	* freezes it as the media owner and the dispatcher resolves it through the
+	* ladder every other attachment uses. Absent means no marker landed, and the
+	* notification is text-only; that is logged, per camera, at the enqueue.
 	*
 	* Delivery-grade boundary (honest): the SensorEventStore is itself fed from
 	* the LOSSY `DeviceStateChanged` telemetry bus, and there is no NC crash-gap
@@ -5695,8 +5685,8 @@ var NotificationCenter = class NotificationCenter {
 	* device-event notification — the durable guarantee begins at this hook, not
 	* before it.
 	*/
-	onSensorEventPersisted(event) {
-		this.consumeEvent(incomingFromSensorEvent(event));
+	onSensorEventPersisted(event, markerTrackId) {
+		this.consumeEvent(incomingFromSensorEvent(event, markerTrackId));
 	}
 	/**
 	* Called at the AUDIO-event persist site (`eventStore.insertAudio`), in the
@@ -5853,7 +5843,7 @@ var NotificationCenter = class NotificationCenter {
 	}
 	/**
 	* Adopt the panel this node owns. Called once by the addon after
-	* `ensureAlarmPanel`; a node without one never calls it and the cap then
+	* `declareAlarmPanel`; a node without one never calls it and the cap then
 	* answers `deviceId: null`.
 	*/
 	setAlarmPanel(panel) {
@@ -5983,6 +5973,8 @@ var NotificationCenter = class NotificationCenter {
 		}
 		const now = this.now();
 		let anyMatched = false;
+		/** One "no media owner" line per EVENT, not per matching rule. */
+		let noOwnerReported = false;
 		const rejections = [];
 		for (const rule of candidates) {
 			const evaluation = evaluateRule(rule, subject, (id) => this.deviceStates.get(id));
@@ -6065,6 +6057,18 @@ var NotificationCenter = class NotificationCenter {
 					buttons: unresolvable.join(", ")
 				}
 			});
+			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && rule.media.attach !== "none") {
+				noOwnerReported = true;
+				this.logger.warn("device event has no marker track — this notification ships text-only", {
+					tags: { deviceId: subject.deviceId },
+					meta: {
+						recordId: subject.recordId,
+						...subject.sensorKind !== void 0 ? { sensorKind: subject.sensorKind } : {},
+						ruleId: rule.id,
+						rule: rule.name
+					}
+				});
+			}
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
 			const entries = this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets, origin);
 			const inserted = await this.outbox.enqueue(entries);
@@ -6754,6 +6758,844 @@ function makeNcActionHandlers(deps) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/data-plane-access.ts
+/**
+* Prefix literals for the export planes, mirrored here so the policy reads as
+* a table without importing three handler modules into the addon's boot path.
+* `data-plane-access.spec.ts` asserts they still match the constants their
+* handlers register with — a mirror nothing checks is a lie waiting to happen.
+*/
+var TRAINING_EXPORT_PREFIX_REF = "training-export";
+var RETRAIN_EXPORT_PREFIX_REF = "retrain-export";
+var DEBUG_EXPORT_PREFIX_REF = "debug-export";
+/**
+* Every data plane this addon serves, and the level the HUB enforces before it
+* proxies. Exhaustive by test: a new plane that forgets to appear here fails
+* `data-plane-access.spec.ts`.
+*/
+var PIPELINE_ANALYTICS_PLANE_ACCESS = {
+	/** One stored crop/thumbnail by an unguessable id the caller already holds. */
+	"event-media": "authenticated",
+	/** Self-authenticating single-use action token (D47). */
+	"nc-action": "public",
+	/** Self-authenticating single-use artifact token (D47). */
+	"nc-artifact": "public",
+	/** Every frame behind a marked selection — a corpus, not an item. */
+	[TRAINING_EXPORT_PREFIX_REF]: "admin",
+	[RETRAIN_EXPORT_PREFIX_REF]: "admin",
+	/** Diagnostic bundle: logs, config and frames. */
+	[DEBUG_EXPORT_PREFIX_REF]: "admin"
+};
+/** The declared level for a plane prefix. Typed, so a prefix with no declared
+*  policy is a compile error rather than a silent default. */
+function planeAccess(prefix) {
+	return PIPELINE_ANALYTICS_PLANE_ACCESS[prefix];
+}
+var MAX_EXPORT_BYTES = 256 * 1024 * 1024;
+var DebugFindingSchema = object({
+	code: string(),
+	severity: _enum([
+		"error",
+		"warn",
+		"info"
+	]),
+	detail: string()
+});
+var DebugTrackListItemSchema = object({
+	trackId: string(),
+	deviceId: number(),
+	className: string(),
+	label: string().optional(),
+	firstSeen: number(),
+	lastSeen: number(),
+	durationMs: number(),
+	active: boolean()
+});
+var DebugTrackReportSchema = object({
+	trackId: string(),
+	deviceId: number(),
+	className: string(),
+	label: string().optional(),
+	firstSeen: number(),
+	lastSeen: number(),
+	durationMs: number(),
+	active: boolean(),
+	mediaCount: number(),
+	mediaKinds: array(string()).readonly(),
+	eventCount: number(),
+	positionCount: number(),
+	findings: array(DebugFindingSchema).readonly()
+});
+var ListTracksInputSchema = object({
+	/** Empty or absent means every camera that has tracks. */
+	deviceIds: array(number()).optional(),
+	limit: number().int().positive().max(200).optional()
+});
+var ListTracksOutputSchema = object({
+	tracks: array(DebugTrackListItemSchema).readonly(),
+	/**
+	* True when a camera hit `limit`. Said rather than implied: a silently capped
+	* list is how an operator concludes a mark did not take.
+	*/
+	truncated: boolean()
+});
+var AnalyzeInputSchema = object({ trackIds: array(string()).min(1).max(200) });
+var AnalyzeOutputSchema = object({
+	reports: array(DebugTrackReportSchema).readonly(),
+	/**
+	* Ids that were asked for and no longer exist. Per D81 a `debug` mark does NOT
+	* pin retention, so a marked track can be evicted between the list and the
+	* analysis — reported as a number the tab can show rather than as silence.
+	*/
+	vanished: array(string()).readonly()
+});
+var debugActions = defineCustomActions({
+	"debug.listTracks": customAction(ListTracksInputSchema, ListTracksOutputSchema, { auth: "admin" }),
+	"debug.analyze": customAction(AnalyzeInputSchema, AnalyzeOutputSchema, { auth: "admin" })
+});
+//#endregion
+//#region src/pipeline-analytics/debug/zip-stream.ts
+/**
+* A minimal STORE-only ZIP writer — enough to emit a debug bundle entry by
+* entry, without ever holding the archive in memory.
+*
+* ## Why hand-rolled, and why ZIP rather than the tar next door
+*
+* The archive the operator asked for is a ZIP, because it is the format that
+* opens with a double click on every desktop they use; the training exports use
+* ustar and that stays as it is. Both are hand-written here for the same two
+* reasons the {@link ../training-export/tar-stream.js tar writer} records:
+*
+*  1. **A dependency would not arrive.** A hub addon is deployed as its built
+*     `dist/` and carries ZERO `node_modules` of its own — adding `yazl` or
+*     `archiver` to `package.json` gets a module that is missing at runtime on
+*     the node that actually runs the code. The only libraries an addon can rely
+*     on are Node's builtins and what its bundler inlines.
+*  2. **Nothing to compress.** Every payload is JPEG or MP4, already compressed.
+*     STORE (method 0) spends no CPU on the hub's one thread for a percent or
+*     two, and — unlike DEFLATE — the entry's size and CRC are known before the
+*     header is written, so no data descriptors and no seeking back: the writer
+*     is append-only and therefore streamable.
+*
+* So: STORE-only ZIP, which is a 30-byte local header + verbatim body per entry
+* plus a central directory at the end, fully specified (APPNOTE 6.3.x), and
+* asserted against the system `unzip` binary in the spec next door rather than
+* against my reading of the format.
+*
+* ## What this deliberately does NOT do
+*
+* No ZIP64. The classic record set addresses 4 GiB and 65 535 entries, and this
+* archive is a hand-marked debug set — tens of tracks, not a dataset.
+* {@link ZipStreamWriter.fits} reports an entry that would cross either ceiling
+* so the caller can skip it and SAY it skipped it, rather than emitting an
+* archive with a wrapped offset that reads as corrupt.
+*
+* ## Entry names are ASCII, by construction
+*
+* The writer sets the UTF-8 name flag (bit 11) because that is what the format
+* says, but **it cannot be relied on**: the `unzip` shipped on macOS is Info-ZIP
+* 6.00, which ignores the flag and re-encodes the name from CP437 — `persona-è`
+* comes out of it as `persona-+¿`, and on a case where the mangled bytes are not
+* valid for the filesystem it refuses to extract the entry at all. Measured, not
+* assumed; the spec next door pins it.
+*
+* So {@link toAsciiZipName} is applied to every path, and — more importantly —
+* no free text goes into a path in the first place: an entry is addressed by
+* `deviceId` and `trackId`, and the camera name lives INSIDE `track.json` where
+* its encoding is JSON's problem and not the archive's.
+*/
+var LOCAL_SIG = 67324752;
+var CENTRAL_SIG = 33639248;
+var EOCD_SIG = 101010256;
+/** Bit 11 — the entry name is UTF-8. */
+var FLAG_UTF8 = 2048;
+/** STORE. */
+var METHOD_STORE = 0;
+/** PKZIP 2.0, the floor for STORE + UTF-8 names. */
+var VERSION = 20;
+/** The classic (non-ZIP64) ceilings. Crossing either needs ZIP64; we refuse. */
+var ZIP_MAX_BYTES = 4294967295;
+var CRC_TABLE = (() => {
+	const table = new Array(256);
+	for (let i = 0; i < 256; i++) {
+		let c = i;
+		for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+		table[i] = c >>> 0;
+	}
+	return table;
+})();
+/**
+* Reduce a path to the ASCII set every ZIP reader agrees on.
+*
+* Anything outside `[A-Za-z0-9._-]` (and the `/` separator) becomes `_`. Not a
+* transliteration: a name that survives Info-ZIP's CP437 pass unchanged is the
+* only name this archive can promise, and a lossy-but-stable mapping is better
+* than a pretty one that a reader mangles differently from the manifest.
+*/
+function toAsciiZipName(name) {
+	return name.replace(/[^A-Za-z0-9._/-]/g, "_");
+}
+/** CRC-32 (IEEE 802.3), the checksum every ZIP entry header carries. */
+function crc32(buf) {
+	let c = 4294967295;
+	for (const byte of buf) c = CRC_TABLE[(c ^ byte) & 255] ^ c >>> 8;
+	return (c ^ 4294967295) >>> 0;
+}
+/**
+* MS-DOS date/time, the only timestamp a classic ZIP record carries.
+*
+* Two-second resolution and an epoch of 1980 — a date before that is clamped
+* rather than allowed to write a negative year field, which some readers show as
+* 2107 and others reject outright.
+*/
+function dosDateTime(mtimeMs) {
+	const d = new Date(mtimeMs);
+	const year = Math.max(1980, d.getFullYear());
+	return {
+		time: d.getHours() << 11 | d.getMinutes() << 5 | d.getSeconds() >> 1,
+		date: year - 1980 << 9 | d.getMonth() + 1 << 5 | d.getDate()
+	};
+}
+/**
+* The 30-byte local header + name for one stored file.
+*
+* Sizes and CRC are written into the header itself (never a trailing data
+* descriptor) — STORE knows both before the body moves, and a header that tells
+* the truth is what lets a reader index the archive without scanning it.
+*/
+function zipLocalHeader(entry, crc, nameBytes) {
+	const head = Buffer.alloc(30);
+	const { time, date } = dosDateTime(entry.mtimeMs);
+	head.writeUInt32LE(LOCAL_SIG, 0);
+	head.writeUInt16LE(VERSION, 4);
+	head.writeUInt16LE(FLAG_UTF8, 6);
+	head.writeUInt16LE(METHOD_STORE, 8);
+	head.writeUInt16LE(time, 10);
+	head.writeUInt16LE(date, 12);
+	head.writeUInt32LE(crc, 14);
+	head.writeUInt32LE(entry.body.length, 18);
+	head.writeUInt32LE(entry.body.length, 22);
+	head.writeUInt16LE(nameBytes.length, 26);
+	head.writeUInt16LE(0, 28);
+	return Buffer.concat([head, nameBytes]);
+}
+function centralHeader(entry) {
+	const head = Buffer.alloc(46);
+	head.writeUInt32LE(CENTRAL_SIG, 0);
+	head.writeUInt16LE(VERSION, 4);
+	head.writeUInt16LE(VERSION, 6);
+	head.writeUInt16LE(FLAG_UTF8, 8);
+	head.writeUInt16LE(METHOD_STORE, 10);
+	head.writeUInt16LE(entry.dosTime, 12);
+	head.writeUInt16LE(entry.dosDate, 14);
+	head.writeUInt32LE(entry.crc, 16);
+	head.writeUInt32LE(entry.size, 20);
+	head.writeUInt32LE(entry.size, 24);
+	head.writeUInt16LE(entry.nameBytes.length, 28);
+	head.writeUInt16LE(0, 30);
+	head.writeUInt16LE(0, 32);
+	head.writeUInt16LE(0, 34);
+	head.writeUInt16LE(0, 36);
+	head.writeUInt32LE(0, 38);
+	head.writeUInt32LE(entry.offset, 42);
+	return Buffer.concat([head, entry.nameBytes]);
+}
+function endOfCentralDirectory(count, size, offset) {
+	const eocd = Buffer.alloc(22);
+	eocd.writeUInt32LE(EOCD_SIG, 0);
+	eocd.writeUInt16LE(0, 4);
+	eocd.writeUInt16LE(0, 6);
+	eocd.writeUInt16LE(count, 8);
+	eocd.writeUInt16LE(count, 10);
+	eocd.writeUInt32LE(size, 12);
+	eocd.writeUInt32LE(offset, 16);
+	eocd.writeUInt16LE(0, 20);
+	return eocd;
+}
+/**
+* True when one more entry still fits inside the classic (non-ZIP64) ceilings.
+*
+* Pure, and asked with a length rather than a Buffer, so the 4 GiB boundary can
+* be tested without allocating 4 GiB — the guard whose failure mode (a wrapped
+* 32-bit offset, producing an archive that looks complete and unpacks as
+* garbage) is precisely the one a test must be able to reach.
+*/
+function zipEntryFits(query) {
+	if (query.entryIndex >= 65535) return false;
+	const nameLen = toAsciiZipName(query.name).length;
+	return query.offset + 30 + nameLen + query.bodyLength <= ZIP_MAX_BYTES;
+}
+/**
+* An append-only ZIP writer.
+*
+* The caller supplies `write` — the real `res.write`, awaited, so backpressure
+* is the socket's. The writer holds only the central directory (one small record
+* per entry), never a body: {@link add} takes one file at a time and forgets it.
+*/
+var ZipStreamWriter = class {
+	write;
+	entries = [];
+	offset = 0;
+	constructor(write) {
+		this.write = write;
+	}
+	/** Entries accepted so far — what the manifest should claim, not what was asked. */
+	get entryCount() {
+		return this.entries.length;
+	}
+	/** Bytes emitted so far, central directory excluded. */
+	get bytesWritten() {
+		return this.offset;
+	}
+	/**
+	* True when this entry still fits inside the classic ZIP ceilings.
+	*
+	* Checked BEFORE the header goes out, because a 32-bit offset that wraps
+	* produces an archive that looks complete and unpacks as garbage — the failure
+	* this writer most needs to make impossible.
+	*/
+	fits(entry) {
+		return zipEntryFits({
+			offset: this.offset,
+			entryIndex: this.entries.length,
+			name: entry.name,
+			bodyLength: entry.body.length
+		});
+	}
+	/** Append one stored file. Returns false (and writes nothing) when it does not fit. */
+	async add(entry) {
+		if (!this.fits(entry)) return false;
+		const nameBytes = Buffer.from(toAsciiZipName(entry.name), "ascii");
+		const crc = crc32(entry.body);
+		const { time, date } = dosDateTime(entry.mtimeMs);
+		const header = zipLocalHeader(entry, crc, nameBytes);
+		this.entries.push({
+			nameBytes,
+			crc,
+			size: entry.body.length,
+			offset: this.offset,
+			dosTime: time,
+			dosDate: date
+		});
+		await this.write(header);
+		await this.write(entry.body);
+		this.offset += header.length + entry.body.length;
+		return true;
+	}
+	/** Write the central directory + EOCD. The archive is unreadable without it. */
+	async finish() {
+		const start = this.offset;
+		let size = 0;
+		for (const entry of this.entries) {
+			const block = centralHeader(entry);
+			await this.write(block);
+			size += block.length;
+		}
+		await this.write(endOfCentralDirectory(this.entries.length, size, start));
+		this.offset = start + size + 22;
+	}
+};
+var DEBUG_MANIFEST_ENTRY = "manifest.json";
+var DEBUG_TRACK_ENTRY = "track.json";
+var DEBUG_ANALYSIS_ENTRY = "analysis.json";
+var DEBUG_EVENTS_ENTRY = "events.json";
+/** `tracks/<deviceId>/<trackId>` — ASCII by construction, both parts are ids. */
+function debugTrackDir(deviceId, trackId) {
+	return toAsciiZipName(`tracks/${String(deviceId)}/${trackId}`);
+}
+/**
+* Resolve every media row of one track to an archive-relative name.
+*
+* Deterministic: the input order (the store returns `timestamp asc`) fully
+* determines the output, so re-exporting an unchanged track produces the same
+* names. A kind that occurs once is bare (`keyFrame.jpg`); a kind that repeats
+* carries its timestamp; a genuine duplicate of both gets `-2`, `-3`, …
+*/
+function planTrackMediaNames(media) {
+	const occurrences = /* @__PURE__ */ new Map();
+	for (const m of media) occurrences.set(m.kind, (occurrences.get(m.kind) ?? 0) + 1);
+	const used = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const m of media) {
+		const base = (occurrences.get(m.kind) ?? 0) > 1 ? `${m.kind}-${String(m.timestamp)}` : m.kind;
+		let name = `media/${base}.jpg`;
+		for (let n = 2; used.has(name); n++) name = `media/${base}-${String(n)}.jpg`;
+		used.add(name);
+		out.push({
+			key: m.key,
+			name: toAsciiZipName(name),
+			kind: m.kind,
+			timestamp: m.timestamp,
+			sizeBytes: m.sizeBytes
+		});
+	}
+	return out;
+}
+var DEBUG_RETENTION_NOTE = "A `debug` mark does not pin retention (D81). A track with no media here may have been evicted rather than never captured.";
+/** The archive filename, stamped so two downloads never collide in ~/Downloads. */
+function debugArchiveFilename(nowMs) {
+	return `camstack-debug-${new Date(nowMs).toISOString().replace(/[:.]/g, "-")}.zip`.replace(/[\r\n"]/g, "");
+}
+/** Parse `?deviceIds=615,617` — empty means every camera. */
+function parseDebugDeviceIds(url) {
+	const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+	const raw = new URLSearchParams(query).get("deviceIds");
+	if (raw === null || raw.trim() === "") return [];
+	const out = [];
+	for (const part of raw.split(",")) {
+		const n = Number.parseInt(part.trim(), 10);
+		if (Number.isInteger(n) && n > 0 && !out.includes(n)) out.push(n);
+	}
+	return out;
+}
+//#endregion
+//#region src/pipeline-analytics/debug/debug-export-handler.ts
+/**
+* Pacing. The export is a BACKGROUND job sharing a thread with live decode, so
+* it yields twice: between tracks, and between individual media files.
+*
+* The per-file yield is the one that matters. A track can own twenty blobs, and
+* reading them back to back — each a base64 decode of a few hundred KB —
+* occupies the loop for long enough that snapshot resizes start timing out. One
+* file at a time, with a gap, keeps the export off the critical path; it is slow
+* on purpose.
+*/
+var TRACK_PACING_MS = 25;
+var MEDIA_PACING_MS = 15;
+function json(value) {
+	return Buffer.from(JSON.stringify(value, null, 2), "utf8");
+}
+/** Total media rows the plan hopes to ship — the number HEAD reports. */
+function plannedMediaCount(plan) {
+	let total = 0;
+	for (const t of plan.tracks) total += t.media.length;
+	return total;
+}
+function createDebugExportHandler(deps) {
+	return async (req, res) => {
+		const method = req.method ?? "GET";
+		if (method !== "GET" && method !== "HEAD") {
+			res.writeHead(405, { allow: "GET, HEAD" });
+			res.end();
+			return;
+		}
+		const deviceIds = parseDebugDeviceIds(req.url ?? "");
+		let plan;
+		try {
+			plan = await deps.buildPlan(deviceIds);
+		} catch (err) {
+			deps.logger.warn("debug export plan failed", { meta: { error: String(err) } });
+			res.writeHead(500, { "content-type": "text/plain" });
+			res.end("debug export plan failed");
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": "application/zip",
+			"content-disposition": `attachment; filename="${debugArchiveFilename(deps.now())}"`,
+			"cache-control": "no-store",
+			"x-camstack-debug-tracks": String(plan.tracks.length),
+			"x-camstack-debug-media": String(plannedMediaCount(plan))
+		});
+		if (method === "HEAD") {
+			res.end();
+			return;
+		}
+		const write = (chunk) => new Promise((resolve, reject) => {
+			if (!res.write(chunk, (err) => {
+				if (err) reject(err);
+				else resolve();
+			})) res.once("drain", resolve);
+		});
+		const zip = new ZipStreamWriter(write);
+		const mtimeMs = deps.now();
+		const startedAt = deps.now();
+		const manifestTracks = [];
+		let included = 0;
+		let missing = 0;
+		let stoppedBecause = plan.capped ? "track-cap" : null;
+		for (const entry of plan.tracks) {
+			if (zip.bytesWritten >= 268435456) {
+				stoppedBecause ??= "byte-budget";
+				deps.logger.warn("debug export stopped — byte budget reached", { meta: {
+					budget: MAX_EXPORT_BYTES,
+					written: zip.bytesWritten
+				} });
+				break;
+			}
+			const dir = debugTrackDir(entry.report.deviceId, entry.report.trackId);
+			const deviceId = entry.report.deviceId;
+			for (const [name, body] of [
+				[DEBUG_TRACK_ENTRY, json(entry.track)],
+				[DEBUG_ANALYSIS_ENTRY, json(entry.report)],
+				[DEBUG_EVENTS_ENTRY, json(entry.events)]
+			]) if (!await zip.add({
+				name: `${dir}/${name}`,
+				body,
+				mtimeMs
+			})) stoppedBecause ??= "zip-ceiling";
+			const mediaIncluded = [];
+			const mediaMissing = [];
+			for (const media of entry.media) {
+				const bytes = await deps.readMedia(media.key);
+				if (bytes === null) {
+					missing += 1;
+					mediaMissing.push(media.key);
+					deps.logger.warn("debug export skipped a media file — the blob is unreadable", {
+						tags: { deviceId },
+						meta: {
+							trackId: entry.report.trackId,
+							mediaKey: media.key,
+							kind: media.kind
+						}
+					});
+					continue;
+				}
+				if (!await zip.add({
+					name: `${dir}/${media.name}`,
+					body: bytes,
+					mtimeMs
+				})) {
+					stoppedBecause ??= "zip-ceiling";
+					missing += 1;
+					mediaMissing.push(media.key);
+					deps.logger.warn("debug export skipped a media file — the archive is full", {
+						tags: { deviceId },
+						meta: {
+							trackId: entry.report.trackId,
+							mediaKey: media.key,
+							kind: media.kind
+						}
+					});
+					continue;
+				}
+				included += 1;
+				mediaIncluded.push(media.name);
+				await new Promise((resolve) => setTimeout(resolve, MEDIA_PACING_MS));
+			}
+			manifestTracks.push({
+				trackId: entry.report.trackId,
+				deviceId,
+				dir,
+				className: entry.report.className,
+				...entry.report.label === void 0 ? {} : { label: entry.report.label },
+				firstSeen: entry.report.firstSeen,
+				lastSeen: entry.report.lastSeen,
+				durationMs: entry.report.durationMs,
+				eventCount: entry.report.eventCount,
+				findings: entry.report.findings.map((f) => f.code),
+				mediaIncluded,
+				mediaMissing
+			});
+			await new Promise((resolve) => setTimeout(resolve, TRACK_PACING_MS));
+		}
+		const manifest = {
+			generatedAt: plan.generatedAt,
+			deviceIds: plan.deviceIds,
+			trackCount: manifestTracks.length,
+			mediaIncluded: included,
+			mediaMissing: missing,
+			truncated: stoppedBecause !== null,
+			stoppedBecause,
+			retentionNote: DEBUG_RETENTION_NOTE,
+			tracks: manifestTracks
+		};
+		await zip.add({
+			name: DEBUG_MANIFEST_ENTRY,
+			body: json(manifest),
+			mtimeMs
+		});
+		await zip.finish();
+		await new Promise((resolve) => {
+			res.end(resolve);
+		});
+		deps.logger.info("debug export complete", { meta: {
+			tracks: manifestTracks.length,
+			mediaIncluded: included,
+			mediaMissing: missing,
+			stoppedBecause,
+			bytes: zip.bytesWritten,
+			elapsedMs: deps.now() - startedAt
+		} });
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/debug/debug-track-analysis.ts
+/** A track is "short" below this — the pipeline rarely produces a full media set. */
+var SHORT_TRACK_MS = 2e3;
+/** Below this, the label the track settled on is weak enough to be worth saying. */
+var LOW_BEST_SCORE = .5;
+/** Duration in ms. Never negative — a clock that went backwards reads as 0. */
+function trackDurationMs(facts) {
+	return Math.max(0, facts.lastSeen - facts.firstSeen);
+}
+function hasKind(media, kind) {
+	return media.some((m) => m.kind === kind);
+}
+function latestMediaAt(media) {
+	let latest = null;
+	for (const m of media) if (latest === null || m.timestamp > latest) latest = m.timestamp;
+	return latest;
+}
+function finding(code, severity, detail) {
+	return {
+		code,
+		severity,
+		detail
+	};
+}
+/**
+* Analyse one track. Pure — same inventory in, same findings out.
+*
+* Order is stable and roughly "worst first": the media the whole rest of the
+* system reads, then the track's own substance, then the softer signals.
+*/
+function analyseDebugTrack(inventory) {
+	const { facts, media, eventCount } = inventory;
+	const durationMs = trackDurationMs(facts);
+	const closed = !facts.active;
+	const out = [];
+	if (media.length === 0) out.push(finding("MEDIA_EVICTED_OR_NEVER", "error", "No media at all — either nothing was captured, or it was evicted (a debug mark does not pin retention)."));
+	else if (closed) {
+		if (!hasKind(media, "keyFrame")) out.push(finding("MISSING_KEYFRAME", "error", "No keyFrame — the best-shot frame is absent."));
+		if (!hasKind(media, "firstFrame")) out.push(finding("MISSING_FIRSTFRAME", "warn", "No firstFrame for a closed track."));
+		if (!hasKind(media, "lastFrame")) out.push(finding("MISSING_LASTFRAME", "warn", "No lastFrame for a closed track."));
+		if (!hasKind(media, "thumbnail")) out.push(finding("MISSING_THUMBNAIL", "warn", "No thumbnail — every list surface renders blank."));
+		if (!hasKind(media, "crop") && !hasKind(media, "faceCrop") && !hasKind(media, "plateCrop")) out.push(finding("MISSING_BEST_CROP", "warn", "No crop of any kind — nothing was cut for a subject."));
+	}
+	if (durationMs < 2e3) out.push(finding("SHORT_TRACK", "warn", `Track lasted ${String(durationMs)} ms, under the ${String(SHORT_TRACK_MS)} ms floor — likely a fragment.`));
+	if (eventCount === 0) out.push(finding("ZERO_EVENTS", "error", "No object events — the track exists but recorded nothing."));
+	if (facts.positionCount === 0) out.push(finding("ZERO_POSITIONS", "error", "No positions — there is no trajectory to reconstruct."));
+	if (durationMs >= 1e4 && facts.snapshotCount === 0 && !hasKind(media, "snapshot")) out.push(finding("NO_PERIODIC_SNAPSHOTS", "warn", `No periodic snapshot over ${String(durationMs)} ms — the movement gate never opened.`));
+	if (closed && hasKind(media, "lastFrame")) {
+		const lastFrameAt = media.filter((m) => m.kind === "lastFrame").reduce((max, m) => Math.max(max, m.timestamp), 0);
+		const lag = facts.lastSeen - lastFrameAt;
+		if (lag > 2e3) out.push(finding("LASTFRAME_STALE", "warn", `lastFrame is ${String(lag)} ms older than the track's end.`));
+	}
+	if (closed && durationMs >= 1e4 && media.length > 0) {
+		const latest = latestMediaAt(media);
+		if (latest !== null) {
+			const covered = (latest - facts.firstSeen) / durationMs;
+			if (covered < .5) out.push(finding("MEDIA_STOPPED_EARLY", "warn", `Media stops at ${String(Math.round(covered * 100))}% of the track's span.`));
+		}
+	}
+	if (closed && facts.bestEventId === void 0) out.push(finding("NO_BEST_EVENT", "info", "No representative event was chosen for this track."));
+	if (facts.labelScore !== void 0 && facts.labelScore < .5) out.push(finding("LOW_BEST_SCORE", "info", `Best label score ${facts.labelScore.toFixed(2)} is under ${String(LOW_BEST_SCORE)}.`));
+	return out;
+}
+/** Fold an inventory into the report shape, findings included. */
+function buildDebugTrackReport(inventory) {
+	const { facts, media, eventCount } = inventory;
+	const kinds = [...new Set(media.map((m) => m.kind))].toSorted();
+	return {
+		trackId: facts.trackId,
+		deviceId: facts.deviceId,
+		className: facts.className,
+		...facts.label === void 0 ? {} : { label: facts.label },
+		firstSeen: facts.firstSeen,
+		lastSeen: facts.lastSeen,
+		durationMs: trackDurationMs(facts),
+		active: facts.active,
+		mediaCount: media.length,
+		mediaKinds: kinds,
+		eventCount,
+		positionCount: facts.positionCount,
+		findings: analyseDebugTrack(inventory)
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/debug/debug-service.ts
+/**
+* The three media owners one track's files hang off.
+*
+* A track's face and plate crops are NOT owned by `track:<trackId>` — they live
+* under `face-<trackId>` and `plate-<trackId>`. An inventory that reads only the
+* first owner reports MISSING_BEST_CROP on every track that produced a face,
+* which is the opposite of the truth.
+*/
+var MEDIA_OWNERS = [
+	{
+		kind: "track",
+		prefix: ""
+	},
+	{
+		kind: "face",
+		prefix: "face-"
+	},
+	{
+		kind: "plate",
+		prefix: "plate-"
+	}
+];
+function toFacts(track) {
+	return {
+		trackId: track.trackId,
+		deviceId: track.deviceId,
+		className: track.className,
+		...track.label === void 0 ? {} : { label: track.label },
+		...track.labelScore === void 0 ? {} : { labelScore: track.labelScore },
+		firstSeen: track.firstSeen,
+		lastSeen: track.lastSeen,
+		active: track.active,
+		positionCount: track.positions.length,
+		snapshotCount: track.snapshots.length,
+		...track.importance === void 0 ? {} : { importance: track.importance },
+		...track.bestEventId === void 0 ? {} : { bestEventId: track.bestEventId }
+	};
+}
+function toListItem(track) {
+	return {
+		trackId: track.trackId,
+		deviceId: track.deviceId,
+		className: track.className,
+		...track.label === void 0 ? {} : { label: track.label },
+		firstSeen: track.firstSeen,
+		lastSeen: track.lastSeen,
+		durationMs: trackDurationMs(toFacts(track)),
+		active: track.active
+	};
+}
+/** Which cameras to sweep — the caller's list, else every camera with tracks. */
+async function resolveDeviceIds(deps, requested) {
+	if (requested !== void 0 && requested.length > 0) return requested;
+	return deps.listDeviceIds();
+}
+/**
+* The marked set, newest first per camera.
+*
+* One indexed query per camera and nothing else — no media, no events, and no
+* trajectory: `listDebug` reads `slim` rows, so nothing here parses the
+* `positions` JSON. The counts an operator wants (media, events, positions) come
+* from `debug.analyze`, per track, by id.
+*
+* A camera that hits `limit` sets `truncated`, because a list that silently
+* stops at 200 is how an operator concludes a mark did not take.
+*/
+async function listDebugTracks(deps, input) {
+	const limit = input.limit ?? 200;
+	const deviceIds = await resolveDeviceIds(deps, input.deviceIds);
+	const tracks = [];
+	let truncated = false;
+	for (const deviceId of deviceIds) {
+		const rows = await deps.listDebugTracks(deviceId, limit);
+		if (rows.length >= limit) {
+			truncated = true;
+			deps.logger.warn("debug listTracks hit the per-camera cap", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					limit
+				}
+			});
+		}
+		for (const row of rows) tracks.push(toListItem(row));
+	}
+	return {
+		tracks: tracks.toSorted((a, b) => b.lastSeen - a.lastSeen),
+		truncated
+	};
+}
+/**
+* Gather one track's whole inventory: three media queries plus its events.
+*
+* The events are RETURNED as well as counted — the bundle writes them to
+* `events.json`, and fetching them a second time there would double the query
+* count of an export for a number the caller already holds.
+*/
+async function gatherTrack(deps, track) {
+	const media = [];
+	for (const owner of MEDIA_OWNERS) media.push(...await deps.listMediaInfo(owner.kind, `${owner.prefix}${track.trackId}`));
+	const events = await deps.listEvents(track.trackId);
+	return {
+		inventory: {
+			facts: toFacts(track),
+			media,
+			eventCount: events.length
+		},
+		events
+	};
+}
+/**
+* Analyse the named tracks.
+*
+* An id that no longer resolves is reported in `vanished` rather than dropped: a
+* `debug` mark does not pin retention (D81), so a track CAN disappear between
+* the list and the analysis, and the tab has to be able to say so instead of
+* quietly showing fewer rows than it listed.
+*/
+async function analyzeDebugTracks(deps, input) {
+	const reports = [];
+	const vanished = [];
+	for (const trackId of input.trackIds) {
+		const track = await deps.getTrack(trackId);
+		if (track === null) {
+			vanished.push(trackId);
+			deps.logger.info("debug analyze — track no longer exists", { meta: { trackId } });
+			continue;
+		}
+		const gathered = await gatherTrack(deps, track);
+		reports.push(buildDebugTrackReport(gathered.inventory));
+	}
+	return {
+		reports,
+		vanished
+	};
+}
+/**
+* Plan the bundle — INDEX READS ONLY, no blob touched.
+*
+* The plan is what the manifest is built from and what the handler streams
+* against, so it must be produced in one pass: a plan that re-queried while
+* streaming could describe a set the archive does not contain.
+*
+* **Bounded at {@link MAX_EXPORT_TRACKS}, far below the list cap.** Listing is
+* index rows; exporting is every blob those rows point at, base64-decoded and
+* pushed through the hub's one thread. An unbounded "export all" is a
+* self-inflicted outage on a busy hub, so the plan stops and SAYS it stopped
+* rather than quietly shipping less than the button offered.
+*
+* Each row is re-read at full projection: `listDebugTracks` deliberately returns
+* `slim` rows, and a bundle built from those would report ZERO_POSITIONS on
+* every track and write an empty `positions` array into `track.json`.
+*/
+async function buildDebugBundlePlan(deps, requestedDeviceIds) {
+	const deviceIds = await resolveDeviceIds(deps, requestedDeviceIds);
+	const tracks = [];
+	const covered = [];
+	let capped = false;
+	for (const deviceId of deviceIds) {
+		if (tracks.length >= 25) {
+			capped = true;
+			break;
+		}
+		const rows = await deps.listDebugTracks(deviceId, 200);
+		if (rows.length > 0) covered.push(deviceId);
+		for (const row of rows) {
+			if (tracks.length >= 25) {
+				capped = true;
+				break;
+			}
+			const full = await deps.getTrack(row.trackId) ?? row;
+			const { inventory, events } = await gatherTrack(deps, full);
+			tracks.push({
+				report: buildDebugTrackReport(inventory),
+				track: full,
+				events,
+				media: planTrackMediaNames(inventory.media)
+			});
+		}
+	}
+	if (capped) deps.logger.warn("debug export capped — more marked tracks than one bundle may carry", { meta: {
+		limit: 25,
+		deviceIds: covered
+	} });
+	return {
+		generatedAt: deps.now(),
+		deviceIds: covered,
+		tracks,
+		capped
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/embedding-actions.ts
 /**
 * embedding-actions — operator buttons for the CLIP semantic-search index.
@@ -6833,6 +7675,25 @@ var embeddingActions = defineCustomActions({
 	"embedding.wipe": customAction(NoInputSchema, WipeResultSchema, { auth: "admin" })
 });
 //#endregion
+//#region src/pipeline-analytics/map-with-concurrency.ts
+/**
+* Apply `mapper` to every item with at most `limit` in flight at once.
+*
+* A rejecting mapper rejects the whole call (same contract as `Promise.all`);
+* callers that must not fail a page for one bad row catch inside the mapper.
+*/
+async function mapWithConcurrency(items, limit, mapper) {
+	const results = new Array(items.length);
+	if (items.length === 0) return results;
+	const effectiveLimit = Math.max(1, Math.min(Math.trunc(limit), items.length));
+	const entries = items.entries();
+	const worker = async () => {
+		for (const [index, item] of entries) results[index] = await mapper(item, index);
+	};
+	await Promise.all(Array.from({ length: effectiveLimit }, () => worker()));
+	return results;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/key-event-scoring.ts
 /**
 * key-event-scoring — the SINGLE deterministic "importance" scorer for a
@@ -7104,6 +7965,16 @@ function clusterByEmbedding(items, threshold = .5) {
 var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
 /** Embedding model id used when enrolling face crops as identity samples. */
 var MODEL_ID = "arcface-r100";
+/**
+* How many face crops `listRecentFaces` resolves at once.
+*
+* Each crop costs a store round-trip plus a disk read, so the page is I/O-bound
+* and the serial form dominated the operator's assign latency. 16 recovers
+* nearly all of the win while leaving the UDS channel — shared with the live
+* detection path — far from saturated; unbounded would trade a slow page for a
+* stalled pipeline.
+*/
+var FACE_CROP_FETCH_CONCURRENCY = 16;
 var FaceGalleryProvider = class {
 	identityStore;
 	faceStore;
@@ -7112,6 +7983,7 @@ var FaceGalleryProvider = class {
 	eventStore;
 	logger;
 	refreshGallery;
+	eventMediaBaseUrl;
 	emitFaceGalleryChanged;
 	constructor(deps) {
 		this.identityStore = deps.identityStore;
@@ -7121,6 +7993,7 @@ var FaceGalleryProvider = class {
 		this.eventStore = deps.eventStore;
 		this.logger = deps.logger;
 		this.refreshGallery = deps.refreshGallery;
+		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
 		this.emitFaceGalleryChanged = deps.emitFaceGalleryChanged;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
@@ -7212,6 +8085,21 @@ var FaceGalleryProvider = class {
 		const media = await this.mediaStore.listByOwner("face", face.id);
 		return media.length > 0 ? media[0].base64 : void 0;
 	}
+	/**
+	* The crop as a data-plane URL, or undefined when there is no stored key or
+	* no plane to serve it.
+	*
+	* The `event-media` plane resolves a raw MediaStore key (any id containing
+	* `:` goes to `getByKey`), so a face crop needs NO new plane and no new
+	* access decision — the same `authenticated` level already serves the track
+	* thumbnails the same operator is looking at.
+	*/
+	cropUrlFor(face) {
+		if (face.mediaKey === void 0 || face.mediaKey === "") return void 0;
+		const base = this.eventMediaBaseUrl();
+		if (base === null) return void 0;
+		return `${base}/${encodeURIComponent(face.mediaKey)}`;
+	}
 	async listRecentFaces(input) {
 		const faces = await this.faceStore.listAllRecentFaces({
 			limit: input?.limit,
@@ -7219,11 +8107,12 @@ var FaceGalleryProvider = class {
 		});
 		const identities = await this.identityStore.listIdentities();
 		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
-		const result = [];
-		for (const face of faces) {
-			const base64 = await this.faceCropBase64(face);
+		const includeCrops = input?.includeCrops ?? true;
+		return mapWithConcurrency(faces, FACE_CROP_FETCH_CONCURRENCY, async (face) => {
+			const base64 = includeCrops ? await this.faceCropBase64(face) : void 0;
+			const cropUrl = this.cropUrlFor(face);
 			const identityName = face.recognizedIdentityId ? nameMap.get(face.recognizedIdentityId) : void 0;
-			result.push({
+			return {
 				faceId: face.id,
 				deviceId: face.deviceId,
 				trackId: face.trackId,
@@ -7232,15 +8121,15 @@ var FaceGalleryProvider = class {
 				...identityName !== void 0 ? { identityName } : {},
 				assigned: face.assigned,
 				...base64 !== void 0 ? { base64 } : {},
+				...cropUrl !== void 0 ? { cropUrl } : {},
 				...face.faceBbox !== void 0 ? { faceBbox: face.faceBbox } : {},
 				...face.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: face.keyFrameMediaKey } : {},
 				...face.bestMatchScore != null ? { bestMatchScore: face.bestMatchScore } : {},
 				...face.nativeFaceShortSidePx != null ? { nativeFaceShortSidePx: face.nativeFaceShortSidePx } : {},
 				...face.suggestedIdentityId != null ? { suggestedIdentityId: face.suggestedIdentityId } : {},
 				...face.suggestedMatchScore != null ? { suggestedMatchScore: face.suggestedMatchScore } : {}
-			});
-		}
-		return result;
+			};
+		});
 	}
 	/**
 	* Get a face by deviceId + trackId. Returns null if not found or if
@@ -10999,6 +11888,13 @@ function eventsToClips(events, pad) {
 		...events.audio.map((e) => make(e, "audio"))
 	].toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
 }
+/** Keep only clips whose window overlaps at least one recorded range — a clip
+*  is a window over footage, so a window with nothing behind it is unplayable
+*  and must not be listed (a camera that never recorded showed 15 dead audio
+*  "clips" in the viewer ribbon, every tap a 500). Pure. */
+function filterClipsByFootage(clips, ranges) {
+	return clips.filter((c) => ranges.some((r) => c.timeRange.startMs < r.endMs && c.timeRange.endMs > r.startMs));
+}
 function createVideoclipsProvider(deps) {
 	return {
 		listClips: async ({ deviceId, since, until, limit }) => {
@@ -11008,7 +11904,20 @@ function createVideoclipsProvider(deps) {
 				until,
 				limit
 			}), deps.defaultPad);
-			return limit != null ? clips.slice(0, limit) : clips;
+			let filtered = clips;
+			if (deps.fetchAvailability) try {
+				filtered = filterClipsByFootage(clips, await deps.fetchAvailability({
+					deviceId,
+					since,
+					until
+				}));
+			} catch (err) {
+				deps.logWarn?.("videoclips: availability read failed — listing unfiltered", {
+					deviceId,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+			return limit != null ? filtered.slice(0, limit) : filtered;
 		},
 		getClipPlayback: async ({ deviceId, clipId }) => {
 			const parsed = parseClipId(clipId);
@@ -11021,8 +11930,22 @@ function createVideoclipsProvider(deps) {
 		}
 	};
 }
-/** Real time. See {@link EventMediaRequest.speed}. */
-var DEFAULT_SPEED = 1;
+/**
+* The VIDEO's playback rate — 4×, the same as {@link NC_GIF_SPEED}.
+*
+* This was 1, and the reasoning for 1 was sound as far as it went: `speed !== 1`
+* fails `clipCanCopy`, so a sped-up video cannot be the camera's own H.264
+* copied — it is a `libx264` burst. The OPERATOR priced that and took it. It is
+* one encode per event over a ~12 s window, not a permanent transcode child
+* ([D84](../../../../../../docs/decisions/adr-0084.md) is about the latter), and
+* it was measured on a real 615 720p cut before being chosen: **0.23 s of
+* encode, 254 KB out**, against the 922 KB the copy of the same window carried.
+* The re-encode is smaller than what it replaces.
+*
+* So both attachments now agree on the timeline as well as on the window: one
+* clip, one rate, two containers.
+*/
+var DEFAULT_SPEED = 4;
 /** The fallback mp4's requested width — the cap's own ceiling, so a rendition
 *  at or below 1080p is an identity scale and the broker copies it. */
 var RING_MP4_MAX_WIDTH = 1920;
@@ -11067,7 +11990,8 @@ var EventMediaService = class {
 				postSeconds: request.postRollSec,
 				kinds,
 				gifMaxWidth: 640,
-				gifFps: 8,
+				gifFps: 12,
+				gifSpeed: 4,
 				speed: request.speed ?? DEFAULT_SPEED,
 				...request.profile !== void 0 ? { profile: request.profile } : {}
 			});
@@ -11193,7 +12117,8 @@ var EventMediaService = class {
 				...window,
 				format: "gif",
 				maxWidth: 640,
-				fps: 8
+				fps: 12 / 4,
+				speed: 4
 			}) : null;
 			if ((mp4 === null || mp4.byteLength === 0) && (gif === null || gif.byteLength === 0)) {
 				this.deps.logger.warn("nc media: the clip ring covered nothing — no footage attached", {
@@ -19232,6 +20157,21 @@ var PlateRecognizer = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/read-slice.ts
+/**
+* The loaded slice, or `undefined` when it has never loaded and the one
+* permitted refresh also failed to produce it.
+*
+* A failing refresh is swallowed deliberately: every caller degrades to "no
+* zones / no rules", and a zone read must never take down the frame that asked.
+*/
+async function readSliceOnce(handle) {
+	const loaded = handle.value;
+	if (loaded !== void 0) return loaded;
+	await handle.refresh().catch(() => void 0);
+	return handle.value;
+}
+//#endregion
 //#region src/pipeline-analytics/rebuild-detail-request.ts
 /** The one step a rebuild runs. */
 var REBUILD_DETAIL_STEP_ID = "clip-embedding";
@@ -22117,6 +23057,10 @@ var TRACKS_COLUMNS = [
 		name: "debug",
 		type: "BOOLEAN"
 	},
+	{
+		name: "hasFace",
+		type: "BOOLEAN"
+	},
 	{
 		name: "envMinX",
 		type: "REAL"
@@ -22197,7 +23141,8 @@ function cloneTrack(t) {
 			retrainStatus: t.retrainStatus,
 			markForTrain: t.retrainStatus === "staging"
 		} : {},
-		...t.debug !== void 0 ? { debug: t.debug } : {}
+		...t.debug !== void 0 ? { debug: t.debug } : {},
+		...t.hasFace !== void 0 ? { hasFace: t.hasFace } : {}
 	};
 }
 var TrackStore = class {
@@ -22560,6 +23505,49 @@ var TrackStore = class {
 		}
 	}
 	/**
+	* Record that a face DETECTOR found a face on this track. Set-once, never
+	* cleared, and deliberately NOT part of {@link setFlags}: that method is the
+	* operator's write surface and this is the pipeline's.
+	*
+	* **The signal is detection, not recognition.** The caller is the detail-route
+	* fan-out, keyed on the detail's own `className === 'face'` — BEFORE the
+	* `minFacePx` gate, before the recognizer is consulted, and regardless of
+	* whether face recognition is enabled at all. That is the whole point: the
+	* viewer's "face present, identity unknown" badge is `hasFace && !subLabel`,
+	* and a flag that only fired when the recognizer answered would be true
+	* exactly when the badge must not show.
+	*
+	* **Idempotent, and it does not write per detail.** A face detail lands many
+	* times over a track's life. While the track is LIVE the flag is set in RAM
+	* only and rides `persistCompleted` at expiry — one row write, not one per
+	* frame. Once the flag is set, every later call returns immediately.
+	*
+	* The persisted patch is for the LATE detail: enrichment answers routinely
+	* arrive after the track has expired, when there is no RAM entry left and the
+	* row is the only thing to correct. Best-effort — a failed patch costs a badge,
+	* never a track.
+	*/
+	async markFaceDetected(trackId) {
+		const active = this.active.get(trackId);
+		if (active) {
+			if (active.hasFace === true) return;
+			active.hasFace = true;
+			return;
+		}
+		try {
+			await this.store.update.mutate({
+				collection: TRACKS_COLLECTION,
+				id: trackId,
+				data: { hasFace: true }
+			});
+		} catch (err) {
+			this.logger.warn("markFaceDetected persist failed", { meta: {
+				trackId,
+				error: String(err)
+			} });
+		}
+	}
+	/**
 	* Write the retrain LIFECYCLE state directly — the move `setFlags` cannot
 	* express.
 	*
@@ -22773,6 +23761,71 @@ var TrackStore = class {
 		}
 	}
 	/**
+	* The device's DEBUG-marked tracks, newest first — the Events → Debug tab.
+	*
+	* Two things about this query are load-bearing.
+	*
+	* **`where: { debug: true }` matches only the explicit `true`.** The column is
+	* nullable with no default (unlike `retrainStatus`), so a row that was never
+	* marked holds NULL and positive equality skips it — which is exactly the set
+	* wanted here, and the reason the column was left nullable in the first place.
+	*
+	* **The result is re-checked in memory.** `compileFilter` DROPS a predicate
+	* whose column does not exist in SQLite — an older hub whose `declareCollection`
+	* fingerprint never re-ran would answer this query with EVERY track on the
+	* camera, silently, and the tab would present the whole history as
+	* operator-marked. A skipped predicate is indistinguishable from a matching one
+	* at the wire, so the guard is the only thing that can tell them apart.
+	*
+	* **`projection: 'slim'`, and this is the expensive detail.** `positions` is a
+	* JSON column averaging ~10 KB a row, and `'full'` parses it for every row
+	* returned. That is affordable for a handful of marked tracks and ruinous in
+	* the case this method already defends against: if the predicate is dropped,
+	* the store hands back `limit` rows PER CAMERA and the trajectory of the
+	* camera's whole recent history is parsed before the guard below throws it
+	* away. The cheap question comes first (D56) — the list carries no trajectory,
+	* and the per-track analysis reads the one row it needs through
+	* `getPersistedByTrackId`.
+	*/
+	async listDebug(deviceId, limit) {
+		try {
+			const tracks = (await this.store.query.query({
+				collection: TRACKS_COLLECTION,
+				filter: {
+					where: {
+						deviceId,
+						debug: true
+					},
+					orderBy: {
+						field: "lastSeen",
+						direction: "desc"
+					},
+					limit
+				}
+			})).filter((r) => typeof r.id === "string").map((r) => this.rowToTrack(r.id, r.data, "slim"));
+			const marked = tracks.filter((t) => t.debug === true);
+			if (marked.length !== tracks.length) this.logger.warn("TrackStore.listDebug — the store returned unmarked rows; the `debug` predicate was not applied", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					returned: tracks.length,
+					marked: marked.length
+				}
+			});
+			return marked;
+		} catch (err) {
+			this.logger.warn("TrackStore.listDebug failed", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					limit,
+					error: String(err)
+				}
+			});
+			return [];
+		}
+	}
+	/**
 	* How many of this device's tracks are STAGING — optionally only those older
 	* than a cutoff, i.e. exactly the rows a sweep just declined to touch.
 	*
@@ -23179,6 +24232,7 @@ var TrackStore = class {
 				...t.audioLabels !== void 0 ? { audioLabels: [...t.audioLabels] } : {},
 				...t.retrainStatus !== void 0 ? { retrainStatus: t.retrainStatus } : {},
 				...t.debug !== void 0 ? { debug: t.debug } : {},
+				...t.hasFace !== void 0 ? { hasFace: t.hasFace } : {},
 				...envelope !== null && dims !== void 0 ? {
 					envMinX: envelope.minX,
 					envMinY: envelope.minY,
@@ -23213,6 +24267,7 @@ var TrackStore = class {
 		const audioLabels = data["audioLabels"];
 		const retrainParsed = RetrainStatusSchema.safeParse(data["retrainStatus"]);
 		const debug = data["debug"];
+		const hasFace = data["hasFace"];
 		const envMinX = data["envMinX"];
 		const envMinY = data["envMinY"];
 		const envMaxX = data["envMaxX"];
@@ -23248,6 +24303,7 @@ var TrackStore = class {
 				markForTrain: retrainParsed.data === "staging"
 			} : {},
 			...typeof debug === "boolean" ? { debug } : {},
+			...typeof hasFace === "boolean" ? { hasFace } : {},
 			...envelope !== null ? { envelope } : {}
 		};
 	}
@@ -26396,41 +27452,6 @@ var EventMediaDispatcher = class {
 		}
 	}
 };
-//#endregion
-//#region src/pipeline-analytics/services/sensor-marker-projector.ts
-/**
-* Sensor markers — the gate between "a mapped sensor/control cap changed
-* state" and "a synthetic track exists on the camera's timeline"
-* (event-kinds-taxonomy §8).
-*
-* It is the sibling of {@link ../services/audio-marker-projector.ts} and it
-* exists for the same reason: the projection has gates, and a gate that drops
-* work without saying so is indistinguishable from a feature that was never
-* wired.
-*
-* **What this fixes.** The projection used to resolve its cameras with
-* `camerasFor` alone — LINKED cameras only — while the history-row ingest
-* beside it had gained the self-camera half on 2026-08-07. A doorbell wrapper
-* is bound on the CAMERA (the virtual-doorbell builtin writes the `doorbell`
-* slice onto camera 615 itself), so `camerasFor(615)` answered `[]` and the
-* projection returned on a `debug` line nobody runs at. Camera 615's real
-* press at 2026-08-08 06:59Z therefore produced a `SensorEvent` row, a HomeKit
-* ring, an Alexa post and a matched notification rule — and no track. Both
-* halves now derive their cameras from {@link resolveSensorEventCameras}.
-*
-* **The asymmetry that used to be here was defended by a wrong premise.** The
-* old comment argued a self-projected track would feed the NC `track-end`
-* trigger and make every press evaluate the camera's object rules. It does
-* not: `persistSyntheticTrack` writes the row directly and the NC track-end
-* hook lives in the LIVE tracker's closer, which no synthetic track ever
-* enters. A linked contact sensor has been projecting onto its camera all
-* along under exactly the same mechanism.
-*
-* **Nothing here is silent.** A marker that lands emits one `info` line; every
-* branch that lands none emits one line carrying the reason. Both carry
-* `tags: { deviceId }` with the CAMERA id, because the question always arrives
-* as "why did 617 get a marker and 615 not".
-*/
 /**
 * Project one `DeviceStateChanged` of a mapped sensor/control cap into a
 * synthetic track per camera the event belongs to. Returns the number of
@@ -26469,6 +27490,7 @@ async function projectSensorMarkers(deps, data, timestamp) {
 			source: "sensor",
 			kind: descriptor.kind,
 			timestamp,
+			snapshotTimeoutMs: deps.snapshotTimeoutMs ?? 2500,
 			...producingDeviceName !== void 0 ? { producingDeviceName } : {}
 		});
 		if (track === null) {
@@ -26488,7 +27510,8 @@ async function projectSensorMarkers(deps, data, timestamp) {
 			capName: data.capName,
 			kind: descriptor.kind,
 			trackId: track.trackId,
-			selfCamera: cameraId === data.deviceId
+			selfCamera: cameraId === data.deviceId,
+			hasMedia: track.snapshots.length > 0
 		});
 	}
 	return landed;
@@ -26603,13 +27626,13 @@ var SyntheticTrackMaterializer = class {
 	* answers: ≤10 s old on a mains camera, and on a battery camera the
 	* intentionally stale-but-honest frame that costs no wake.
 	*/
-	async fetchSnapshot(cameraId) {
+	async fetchSnapshot(cameraId, timeoutMs) {
 		try {
-			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), this.snapshotTimeoutMs);
-			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"));
+			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), timeoutMs);
+			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"), cameraId);
 			return snap;
 		} catch (err) {
-			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotMedia", err);
+			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotMedia", err, cameraId);
 			return null;
 		}
 	}
@@ -26626,14 +27649,14 @@ var SyntheticTrackMaterializer = class {
 		const trackId = this.makeId();
 		const ts = input.timestamp;
 		let mediaKey = null;
-		const snap = await this.fetchSnapshot(input.cameraId);
+		const snap = await this.fetchSnapshot(input.cameraId, input.snapshotTimeoutMs ?? this.snapshotTimeoutMs);
 		if (snap !== null) try {
 			const raw = Buffer.from(snap.base64, "base64");
 			let data = raw;
 			try {
 				data = await downscaleFullFrameJpeg(raw, 960, 540);
 			} catch (err) {
-				this.deps.onError?.("downscaleSnapshot", err);
+				this.deps.onError?.("downscaleSnapshot", err, input.cameraId);
 			}
 			mediaKey = await this.deps.media.put({
 				deviceId: input.cameraId,
@@ -26644,7 +27667,7 @@ var SyntheticTrackMaterializer = class {
 				data
 			});
 		} catch (err) {
-			this.deps.onError?.("snapshotMedia", err);
+			this.deps.onError?.("snapshotMedia", err, input.cameraId);
 		}
 		const track = {
 			trackId,
@@ -26669,7 +27692,7 @@ var SyntheticTrackMaterializer = class {
 		try {
 			await this.deps.tracks.persistSyntheticTrack(track);
 		} catch (err) {
-			this.deps.onError?.("persistSyntheticTrack", err);
+			this.deps.onError?.("persistSyntheticTrack", err, input.cameraId);
 			return null;
 		}
 		return track;
@@ -29369,8 +30392,6 @@ var REBUILD_PAGE_SIZE = 200;
 */
 var REBUILD_FALLBACK_NODE_ID = "hub";
 var PIPELINE_ANALYTICS_ADDON_ID = "pipeline-analytics";
-/** Operator-visible name of the fixed integration. */
-var NC_INTEGRATION_NAME = "Notification Center";
 /**
 * The FULL action catalog for this addon.
 *
@@ -29381,7 +30402,8 @@ var NC_INTEGRATION_NAME = "Notification Center";
 */
 var customActions = {
 	...ncActions,
-	...embeddingActions
+	...embeddingActions,
+	...debugActions
 };
 /**
 * Assist threshold when the caller does not pin one. Packages have their own
@@ -29628,6 +30650,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	trainingExportDataPlane = null;
 	/** Handle for the retrain-export data-plane listener (dispose on shutdown). */
 	retrainExportDataPlane = null;
+	/** Handle for the debug-export data-plane listener (dispose on shutdown). */
+	debugExportDataPlane = null;
 	/** The retrain curation surface — see `retrain/retrain-service.ts`. Null
 	*  until the stores are built. */
 	retrain = null;
@@ -29666,6 +30690,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				kinds: [...input.kinds],
 				gifMaxWidth: input.gifMaxWidth,
 				gifFps: input.gifFps,
+				gifSpeed: input.gifSpeed,
 				speed: input.speed,
 				...input.profile === "high" || input.profile === "mid" || input.profile === "low" ? { profile: input.profile } : {}
 			}),
@@ -29790,7 +30815,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			});
 			const served = await this.ctx.dataPlane?.serve({
 				prefix: "nc-action",
-				access: "public",
+				access: planeAccess("nc-action"),
 				handler: plane.handler
 			}) ?? null;
 			this.ncActionMintUrl = served === null ? null : async ({ id, expMs }) => {
@@ -29844,7 +30869,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			});
 			this.ncArtifactDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "nc-artifact",
-				access: "public",
+				access: planeAccess("nc-artifact"),
 				handler: plane.handler
 			}) ?? null;
 			this.ncArtifactPlane = this.ncArtifactDataPlane !== null ? plane : null;
@@ -30127,7 +31152,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		const api = this.ctx.api;
 		if (!api) throw new Error("pipeline-analytics requires ctx.api (device-manager + settings-store)");
 		await this.declareCollections(api);
-		await this.ensureAlarmPanel(api);
+		await this.declareAlarmPanel(api);
 		const logger = this.ctx.logger;
 		const storage = await this.resolveMediaStorage(logger);
 		const stores = await this.buildStores(api, logger, storage);
@@ -30189,11 +31214,13 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			...isHub && ncHandlers !== void 0 ? {
 				customActions: {
 					...ncActions,
-					...embeddingActions
+					...embeddingActions,
+					...debugActions
 				},
 				actionHandlers: {
 					...ncHandlers,
-					...this.buildEmbeddingActionHandlers()
+					...this.buildEmbeddingActionHandlers(),
+					...this.buildDebugActionHandlers()
 				}
 			} : {}
 		};
@@ -30224,64 +31251,38 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	/** Declare typed collections up-front so the first insert doesn't race with
 	*  a CREATE TABLE. Idempotent. */
 	/**
-	* Bring the Notification Center's alarm panel into existence, once.
+	* DECLARE the Notification Center's alarm panel.
 	*
-	* Both steps are get-or-create, because this runs on every boot and an
-	* operator must never end up with a second panel after a restart. The
-	* integration is FIXED: it exists because this addon says so, not because
-	* anybody added it, and there is no add/delete flow for it.
-	*/
-	async ensureAlarmPanel(api) {
-		const devices = this.ctx.kernel.devices;
-		const rawNodeId = this.ctx.kernel.localNodeId ?? "hub";
-		const nodeId = rawNodeId.includes("/") ? rawNodeId.split("/")[0] ?? "hub" : rawNodeId;
-		if (nodeId !== "hub") {
-			this.ctx.logger.info("alarm panel is hub-owned — skipping on this node", { meta: {
-				nodeId,
-				rawNodeId
-			} });
-			return;
-		}
+	* The procedure is not here any more — `DeclaredDevices` owns the
+	* get-or-create, the FIXED integration and its every-pass `fixed`
+	* re-assertion, the adopt-don't-skip rule, the hub-ownership gate and the D49
+	* second read that stops a transiently empty index re-stamping the declared
+	* name over the operator's rename. What is left is the declaration and the
+	* ports.
+	*/
+	async declareAlarmPanel(api) {
+		const declared = new DeclaredDevices({
+			logger: this.ctx.logger.child("alarm"),
+			addonId: PIPELINE_ANALYTICS_ADDON_ID,
+			devices: this.ctx.kernel.devices,
+			localNodeId: this.ctx.kernel.localNodeId,
+			getIntegration: async (addonId) => api.integrations.getByAddonId.query({ addonId }),
+			createIntegration: async (input) => api.integrations.create.mutate(input),
+			updateIntegration: async ({ id, info }) => {
+				await api.integrations.update.mutate({
+					id,
+					info,
+					skipRestart: true
+				});
+			},
+			listOwnDevices: async () => api.deviceManager.listAll.query({ addonId: PIPELINE_ANALYTICS_ADDON_ID })
+		});
 		try {
-			const result = await ensureAlarmPanel({
-				logger: this.ctx.logger.child("alarm"),
-				addonId: PIPELINE_ANALYTICS_ADDON_ID,
+			const result = await declared.reconcile({
 				integrationName: NC_INTEGRATION_NAME,
-				getIntegration: async (addonId) => {
-					const found = await api.integrations.getByAddonId.query({ addonId });
-					return found === null ? null : {
-						id: found.id,
-						fixed: found.info?.["fixed"] === true
-					};
-				},
-				markFixed: async (integrationId) => {
-					await api.integrations.update.mutate({
-						id: integrationId,
-						info: { fixed: true },
-						skipRestart: true
-					});
-				},
-				createIntegration: async (input) => api.integrations.create.mutate(input),
-				findDeviceByStableId: async (stableId) => {
-					const found = (await api.deviceManager.listAll.query({ addonId: PIPELINE_ANALYTICS_ADDON_ID })).find((d) => d.stableId === stableId);
-					return found === void 0 ? null : { id: found.id };
-				},
-				createDevice: async ({ stableId, integrationId, name }) => {
-					const device = await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, {
-						type: NC_ALARM_DEVICE_TYPE,
-						name,
-						integrationId
-					});
-					this.holdAlarmPanel(device);
-					return { id: device.id };
-				},
-				adoptDevice: async ({ stableId }) => {
-					const device = await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, void 0);
-					this.holdAlarmPanel(device);
-					return { id: device.id };
-				}
+				devices: [NC_ALARM_DECLARATION]
 			});
-			if (result.created) this.ctx.logger.info("notification-center alarm panel ready", { tags: { deviceId: result.deviceId } });
+			for (const outcome of result.devices) this.holdAlarmPanel(outcome.device);
 		} catch (err) {
 			this.ctx.logger.warn("alarm panel could not be ensured — rules still notify", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
@@ -30304,7 +31305,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	/**
 	* Join the panel and the Notification Center, once both exist.
 	*
-	* They are built in that order (`ensureAlarmPanel` runs before the centre is
+	* They are built in that order (`declareAlarmPanel` runs before the centre is
 	* constructed) and neither can reach the other on its own, so the join is
 	* here. A node with no panel simply never calls it, and the cap answers
 	* `deviceId: null` — which is what an agent node should say.
@@ -30861,7 +31862,12 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	}
 	/** Event-media data-plane: serve thumbnail JPEGs at
 	*  `/addon/<addonId>/event-media/<eventId>` through the hub's port.
-	*  Mirror the recorder playback pattern: try/warn, store handle for dispose. */
+	*  Mirror the recorder playback pattern: try/warn, store handle for dispose.
+	*
+	*  `authenticated`, not `admin` — see `data-plane-access.ts` for the rule and
+	*  the reason it changed: `getTrackMedia` / `getEventMedia` are declared
+	*  `access: 'view'` and return the SAME stored blob base64 over tRPC, so the
+	*  admin gate protected nothing and cost every non-admin session its tiles. */
 	async serveEventMediaDataPlane() {
 		try {
 			const handler = createEventMediaHandler({ getMedia: async (id, variant, preferKind) => {
@@ -30877,22 +31883,27 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			} });
 			this.eventMediaDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "event-media",
-				access: "admin",
+				access: planeAccess("event-media"),
 				handler
 			}) ?? null;
 			this.eventMediaBaseUrl = this.eventMediaDataPlane !== null ? `/addon/${this.ctx.id}/event-media` : null;
 			await this.serveNcArtifactPlane();
 			await this.serveTrainingExportPlane();
 			await this.serveRetrainExportPlane();
-			this.ctx.logger.info("event-media data-plane served", { meta: { baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)" } });
+			await this.serveDebugExportPlane();
+			this.ctx.logger.info("event-media data-plane served", { meta: {
+				baseUrl: this.eventMediaBaseUrl ?? "(no dataPlane facility)",
+				access: planeAccess("event-media")
+			} });
 		} catch (err) {
 			this.ctx.logger.warn("event-media data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
 	}
 	/**
-	* The training-export data plane. Separate listener, `access: 'admin'` —
-	* marking a track is a viewer-level curation act (D81), but walking off with
-	* every stored frame behind the marked set is not.
+	* The training-export data plane. Separate listener, admin-only (the level
+	* is declared in `data-plane-access.ts`) — marking a track is a viewer-level
+	* curation act (D81), but walking off with every stored frame behind the
+	* marked set is not.
 	*/
 	async serveTrainingExportPlane() {
 		try {
@@ -30907,7 +31918,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			});
 			this.trainingExportDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "training-export",
-				access: "admin",
+				access: planeAccess("training-export"),
 				handler
 			}) ?? null;
 		} catch (err) {
@@ -31036,6 +32047,60 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		return { url: `/addon/${this.ctx.id}/${RETRAIN_EXPORT_PREFIX}${query}` };
 	}
 	/**
+	* The store seam the `debug.*` actions and the debug bundle both read through.
+	*
+	* INDEX READS ONLY — three media-inventory queries and an event query per
+	* track, no blob. The bytes are fetched one at a time, by key, by the export
+	* handler, so a bundle of a hundred tracks never holds more than one file.
+	*/
+	buildDebugServiceDeps() {
+		const trackStore = this.trackStore;
+		const mediaStore = this.mediaStore;
+		const eventStore = this.eventStore;
+		if (trackStore === null || mediaStore === null || eventStore === null) throw new Error("debug: analytics stores unavailable");
+		return {
+			listDeviceIds: () => trackStore.listDeviceIds(),
+			listDebugTracks: (deviceId, limit) => trackStore.listDebug(deviceId, limit),
+			getTrack: (trackId) => trackStore.getPersistedByTrackId(trackId),
+			listMediaInfo: (ownerKind, ownerId) => mediaStore.listInfoByOwner(ownerKind, ownerId),
+			listEvents: (trackId) => eventStore.queryObjectByTrackIds([trackId]),
+			logger: this.ctx.logger.child("debug"),
+			now: () => Date.now()
+		};
+	}
+	/** The `debug.*` bridge handlers — hub-only, like `nc.*` and `embedding.*`. */
+	buildDebugActionHandlers() {
+		return {
+			"debug.listTracks": async (input) => listDebugTracks(this.buildDebugServiceDeps(), input),
+			"debug.analyze": async (input) => analyzeDebugTracks(this.buildDebugServiceDeps(), input)
+		};
+	}
+	/**
+	* The debug-export data plane. Its own listener, for the same reason the
+	* retrain export has one: a client asking for the debug bundle must never be
+	* able to receive the annotated dataset by changing a query parameter.
+	*/
+	async serveDebugExportPlane() {
+		try {
+			const handler = createDebugExportHandler({
+				buildPlan: (deviceIds) => buildDebugBundlePlan(this.buildDebugServiceDeps(), deviceIds),
+				readMedia: async (key) => {
+					const file = await this.mediaStore?.getByKey(key);
+					return file === null || file === void 0 ? null : Buffer.from(file.base64, "base64");
+				},
+				logger: this.ctx.logger.child("debug-export"),
+				now: () => Date.now()
+			});
+			this.debugExportDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: "debug-export",
+				access: planeAccess("debug-export"),
+				handler
+			}) ?? null;
+		} catch (err) {
+			this.ctx.logger.warn("debug-export data-plane failed to serve", { meta: { error: errMsg(err) } });
+		}
+	}
+	/**
 	* The retrain-export data plane. Separate listener from the training export
 	* next door: different archive, different contents, and a client asking for
 	* one must never be able to receive the other by changing a query parameter.
@@ -31057,7 +32122,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			});
 			this.retrainExportDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "retrain-export",
-				access: "admin",
+				access: planeAccess("retrain-export"),
 				handler
 			}) ?? null;
 		} catch (err) {
@@ -31267,6 +32332,17 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					audio
 				};
 			},
+			fetchAvailability: async ({ deviceId, since, until }) => {
+				return (await api.recording.getAvailability.query({
+					deviceId,
+					fromMs: since,
+					toMs: until
+				})).ranges;
+			},
+			logWarn: (message, meta) => this.ctx.logger.warn(message, {
+				tags: { deviceId: Number(meta["deviceId"]) },
+				meta
+			}),
 			resolvePlayback: async ({ deviceId, startMs, endMs }) => {
 				const manifest = await api.recording.getPlaybackManifest.query({
 					deviceId,
@@ -31288,6 +32364,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			eventStore: stores.eventStore,
 			logger: this.ctx.logger,
 			refreshGallery: () => this.faceRecognizer?.refreshGallery(),
+			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
 			emitFaceGalleryChanged: (payload) => this.emitFaceGalleryChanged(payload)
 		});
 		const plateGallery = new PlateGalleryProvider({
@@ -31388,6 +32465,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.trainingExportDataPlane = null;
 		await this.retrainExportDataPlane?.dispose();
 		this.retrainExportDataPlane = null;
+		await this.debugExportDataPlane?.dispose();
+		this.debugExportDataPlane = null;
 	}
 	async handleInferenceResult(data) {
 		if (this.shuttingDown) return;
@@ -32297,10 +33376,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	async resolveDevicePackageRules(deviceId) {
 		const proxy = await this.ensureProxy(deviceId);
 		if (!proxy) return [];
-		const cached = proxy.state.zoneRules.value?.package;
-		if (cached && cached.length > 0) return cached;
-		await proxy.state.zoneRules.refresh().catch(() => void 0);
-		return proxy.state.zoneRules.value?.package ?? [];
+		return (await readSliceOnce(proxy.state.zoneRules))?.package ?? [];
 	}
 	/**
 	* Route one track's `runDetailSubtree` results (two-plane detail dispatch)
@@ -32316,6 +33392,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	async routeDetailResults(deviceId, trackId, details, frame) {
 		for (const d of details) try {
 			const isFaceDetail = d.className === "face";
+			if (isFaceDetail) await this.trackStore?.markFaceDetected(trackId);
 			if (isFaceDetail && d.bbox !== void 0) this.overlayState.noteFaceDetail(deviceId, trackId, {
 				x: d.bbox.x,
 				y: d.bbox.y,
@@ -33607,10 +34684,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	async resolveDeviceZones(deviceId) {
 		const proxy = await this.ensureProxy(deviceId);
 		if (!proxy) return [];
-		const cached = proxy.state.zones.value?.zones;
-		if (cached && cached.length > 0) return cached;
-		await proxy.state.zones.refresh().catch(() => void 0);
-		return proxy.state.zones.value?.zones ?? [];
+		return (await readSliceOnce(proxy.state.zones))?.zones ?? [];
 	}
 	releaseProxy(deviceId) {
 		const unsubs = this.proxyUnsubs.get(deviceId);
@@ -33738,11 +34812,12 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		const store = this.sensorEventStore;
 		const cache = this.linkedCamerasCache;
 		if (store === null || cache === null) return;
+		const persisted = [];
 		try {
 			await ingestSensorStateChange({
 				sink: store,
 				cache,
-				onPersisted: (ev) => this.notificationCenter?.onSensorEventPersisted(ev),
+				onPersisted: (ev) => persisted.push(ev),
 				onDropped: (reason, kind) => this.logSensorIngestDrop(data, reason, kind)
 			}, data, timestamp);
 		} catch (err) {
@@ -33754,23 +34829,30 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				}
 			});
 		}
+		const markerByCamera = /* @__PURE__ */ new Map();
 		const materializer = this.syntheticTracks;
-		if (materializer === null) return;
-		try {
+		if (materializer !== null) try {
 			await projectSensorMarkers({
 				cache,
 				markers: materializer,
 				producingDeviceName: (deviceId) => this.resolveProducingDeviceName(deviceId),
-				onProjected: (r) => this.ctx.logger.info("synthetic sensor-track projected", {
-					tags: { deviceId: r.cameraId },
-					meta: {
-						capName: r.capName,
-						kind: r.kind,
+				onProjected: (r) => {
+					markerByCamera.set(r.cameraId, {
 						trackId: r.trackId,
-						sourceDeviceId: r.sourceDeviceId,
-						selfCamera: r.selfCamera
-					}
-				}),
+						hasMedia: r.hasMedia
+					});
+					this.ctx.logger.info("synthetic sensor-track projected", {
+						tags: { deviceId: r.cameraId },
+						meta: {
+							capName: r.capName,
+							kind: r.kind,
+							trackId: r.trackId,
+							sourceDeviceId: r.sourceDeviceId,
+							selfCamera: r.selfCamera,
+							hasMedia: r.hasMedia
+						}
+					});
+				},
 				onSkipped: (r) => this.ctx.logger.debug("synthetic sensor-track NOT projected", {
 					tags: { deviceId: r.cameraId ?? r.sourceDeviceId },
 					meta: {
@@ -33790,6 +34872,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				}
 			});
 		}
+		for (const ev of persisted) this.notificationCenter?.onSensorEventPersisted(ev, markerByCamera.get(ev.deviceId)?.trackId);
 	}
 	/**
 	* Say out loud that a MAPPED sensor cap ingested nothing, and why.