@camstack/addon-post-analysis 1.2.640 → 1.2.642

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-C8xdbChV.js");
+const require_clip_model_registry = require("../clip-model-registry-Dj3lrvL2.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -757,6 +757,8 @@ var DEFAULT_ACTION_TTL_MS = 15 * 6e4;
 * notification that is not fresh.
 */
 var SNOOZE_ACTION_TTL_MS = 60 * 6e4;
+/** How long a Correct / Wrong button stays live: one day. */
+var VERDICT_ACTION_TTL_MS = 1440 * 6e4;
 /**
 * How long a DISARM button stays live: five minutes.
 *
@@ -784,6 +786,7 @@ function actionTtlMs(subject) {
 		case "sequence": return DEFAULT_ACTION_TTL_MS;
 		case "addon-update": return DEFAULT_ACTION_TTL_MS;
 		case "server-update": return DEFAULT_ACTION_TTL_MS;
+		case "detection-verdict": return VERDICT_ACTION_TTL_MS;
 	}
 }
 var NcActionTokenRegistry = class {
@@ -827,6 +830,30 @@ var NcActionTokenRegistry = class {
 			grant: found.grant
 		};
 	}
+	/**
+	* Read the grant without spending it. ONLY the confirm page of a link-only
+	* channel may call this: it exists so a link preview that opens the URL
+	* cannot spend the token, and it never runs anything.
+	*/
+	peek(id) {
+		const found = this.grants.get(id);
+		if (found === void 0) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (found.used) return {
+			ok: false,
+			reason: "already-used"
+		};
+		if (found.grant.expiresAt <= this.now()) return {
+			ok: false,
+			reason: "expired"
+		};
+		return {
+			ok: true,
+			grant: found.grant
+		};
+	}
 	/** Drop records that can no longer be claimed. Memory hygiene only — an
 	*  expired record is already refused by {@link claim}, so a sweep that never
 	*  ran would cost bytes, never safety. */
@@ -868,6 +895,7 @@ function describeGrant(grant) {
 			return grant.action === "disarm" ? "Alarm disarmed" : `Alarm armed${grant.mode !== void 0 ? ` (${grant.mode})` : ""}`;
 		case "addon-update": return `${grant.packages.length} addon update(s) on ${grant.nodeId}`;
 		case "server-update": return `Server update on ${grant.nodeId}`;
+		case "detection-verdict": return grant.verdict === "correct" ? "Marked correct — kept for retraining" : grant.suggestedClass === void 0 ? "Marked wrong — kept for retraining" : `Marked wrong, it was a ${grant.suggestedClass} — kept for retraining`;
 	}
 }
 /** The audit line's `meta`, per family. A snooze that logged a `sequence` it
@@ -921,6 +949,15 @@ function grantMeta(grant) {
 			...common,
 			nodeId: grant.nodeId
 		};
+		case "detection-verdict": return {
+			...common,
+			ruleId: grant.ruleId,
+			rule: grant.ruleName,
+			userId: grant.userId,
+			trackId: grant.trackId,
+			verdict: grant.verdict,
+			suggestedClass: grant.suggestedClass ?? null
+		};
 	}
 }
 /** What the human standing in front of the page is told. */
@@ -929,6 +966,11 @@ var FAILURE_COPY = {
 	expired: "This button has expired. Open CamStack to do it there.",
 	"already-used": "Already done — this button had been used."
 };
+/** The question a link-only channel lands on, answered by a POST form. */
+function confirmPage(url, grant) {
+	const action = `${url.pathname}?exp=${encodeURIComponent(url.searchParams.get("exp") ?? "")}&amp;sig=${encodeURIComponent(url.searchParams.get("sig") ?? "")}&amp;confirm=1`;
+	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirm</title><style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#111;color:#eee}main{max-width:24rem;padding:2rem;text-align:center}h1{font-size:1.25rem;margin:0 0 1rem}button{font:inherit;padding:.6rem 1.4rem;border-radius:.5rem;border:0;background:#3b82f6;color:#fff}</style><main><h1>Confirm</h1><p>${grant.verdict === "correct" ? "Mark this detection as correct?" : grant.suggestedClass === void 0 ? "Mark this detection as wrong?" : `Mark this detection as wrong, it was a ${grant.suggestedClass}?`}</p><form method="post" action="${action}"><button type="submit">Confirm</button></form></main>`;
+}
 function page(title, detail) {
 	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#111;color:#eee}main{max-width:24rem;padding:2rem;text-align:center}h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:0;color:#aaa}</style><main><h1>${title}</h1><p>${detail}</p></main>`;
 }
@@ -942,7 +984,8 @@ var NcActionPlane = class {
 	handler = async (req, res) => {
 		const url = new URL(req.url ?? "/", "http://placeholder");
 		const id = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
-		const background = (req.method ?? "GET").toUpperCase() === "POST";
+		const posted = (req.method ?? "GET").toUpperCase() === "POST";
+		const background = posted && url.searchParams.get("confirm") !== "1";
 		if (!verifyActionSignature({
 			secret: this.deps.secret,
 			id,
@@ -954,6 +997,13 @@ var NcActionPlane = class {
 			this.reply(res, background, 404, "Not found", "This link is not valid.");
 			return;
 		}
+		if (!posted) {
+			const peeked = this.deps.registry.peek(id);
+			if (peeked.ok && peeked.grant.kind === "detection-verdict" && peeked.grant.viaLink === true) {
+				this.sendBody(res, 200, "text/html; charset=utf-8", confirmPage(url, peeked.grant));
+				return;
+			}
+		}
 		const claim = this.deps.registry.claim(id);
 		if (!claim.ok) {
 			this.deps.logger.info("nc action callback not claimable", { meta: {
@@ -1099,6 +1149,7 @@ var ncDurableRecordKinds = require_clip_model_registry.defineRecordKinds({
 	"state-summary-stamps": ledger("digest delivery stamps per rule kind"),
 	meta: ledger("outbox boot-reconcile watermark and other single-key meta rows", "settings", { none: "one fixed key (watermark), overwritten in place, never deleted" }),
 	snoozes: ledger("operator opens or closes a snooze window (write-through)"),
+	"detection-verdicts": ledger("operator taps Correct or Wrong on a detection notification; one row per track"),
 	"snooze-suppressed": {
 		...QUERIED,
 		class: "ledger",
@@ -9234,6 +9285,9 @@ var en_default = {
 	"action.addon-update.uptodate": "Already up to date on {{nodeId}} — nothing to do",
 	"action.addon-update.unknown": "Could not read what needs updating on {{nodeId}} — nothing was changed. Open CamStack.",
 	"button.server-update.apply": "Update server on {{nodeId}}",
+	"button.verdict.correct": "Correct",
+	"button.verdict.wrong": "Wrong",
+	"button.verdict.wrongAs": "Wrong: it is {{class}}",
 	"action.server-update.title": "Server update",
 	"action.server-update.started": "Updating server on {{nodeId}}…",
 	"action.server-update.restarting": "Server update staged on {{nodeId}} — the node is restarting. You will hear when it comes back.",
@@ -9387,7 +9441,7 @@ var it_default = {
 	"occupancy.op.free": "libera",
 	"system.device-online.title": "Di nuovo online — {{deviceName}}",
 	"system.device-online.body": "Il dispositivo {{deviceName}} è di nuovo online",
-	"system.device-offline.title": "Offline — {{deviceName}}",
+	"system.device-offline.title": "Non raggiungibile — {{deviceName}}",
 	"system.device-offline.body": "Il dispositivo {{deviceName}} è offline",
 	"system.device-disabled.title": "Spento — {{deviceName}}",
 	"system.device-disabled.body": "Il dispositivo {{deviceName}} è stato spento",
@@ -9403,7 +9457,7 @@ var it_default = {
 	"system.stream-online.title": "Stream di nuovo online — {{deviceName}}",
 	"system.stream-online.body": "Lo stream della camera {{deviceName}} è di nuovo online",
 	"system.stream-online.body.profiled": "Lo stream {{profile}} della camera {{deviceName}} è di nuovo online",
-	"system.stream-offline.title": "Stream offline — {{deviceName}}",
+	"system.stream-offline.title": "Flusso interrotto — {{deviceName}}",
 	"system.stream-offline.body": "Lo stream della camera {{deviceName}} è offline",
 	"system.stream-offline.body.profiled": "Lo stream {{profile}} della camera {{deviceName}} è offline",
 	"system.node-online.title": "Nodo di nuovo online — {{nodeName}}",
@@ -9434,7 +9488,7 @@ var it_default = {
 	"system.storage-location-low.body": "La location {{locationName}} è al {{freePercent}}% libero ({{reason}})",
 	"system.storage-location-critical.title": "Storage critico — {{locationName}}",
 	"system.storage-location-critical.body": "La location {{locationName}} è critica: {{reason}}",
-	"system.storage-location-ok.title": "Storage ok — {{locationName}}",
+	"system.storage-location-ok.title": "Archivio a posto — {{locationName}}",
 	"system.storage-location-ok.body": "La location {{locationName}} ha recuperato spazio libero",
 	"system.detection-blind.title": "Senza detection — {{deviceName}}",
 	"system.detection-blind.body": {
@@ -9515,8 +9569,8 @@ var it_default = {
 	"system.camera-disabled.body": "Il dispositivo {{deviceName}} è stato spento",
 	"system.camera-enabled.title": "Dispositivo riacceso",
 	"system.camera-enabled.body": "Il dispositivo {{deviceName}} è stato riacceso",
-	"test.prefix": "[TEST] {{body}}",
-	"timelapse.title": "Timelapse — {{camera}}",
+	"test.prefix": "[PROVA] {{body}}",
+	"timelapse.title": "Sequenza — {{camera}}",
 	"timelapse.body.window": "{{rule}} — {{from}}→{{to}}",
 	"timelapse.body.tooManyEvents": "troppi eventi per il campionamento denso: video a cadenza uniforme",
 	"timelapse.body.denseRanges": {
@@ -9635,6 +9689,9 @@ var it_default = {
 	"action.addon-update.uptodate": "Già aggiornato su {{nodeId}} — niente da fare",
 	"action.addon-update.unknown": "Non è stato possibile leggere cosa aggiornare su {{nodeId}} — non è stato cambiato nulla. Apri CamStack.",
 	"button.server-update.apply": "Aggiorna server su {{nodeId}}",
+	"button.verdict.correct": "Corretto",
+	"button.verdict.wrong": "Sbagliato",
+	"button.verdict.wrongAs": "Sbagliato: è {{class}}",
 	"action.server-update.title": "Aggiornamento server",
 	"action.server-update.started": "Aggiornamento server su {{nodeId}}…",
 	"action.server-update.restarting": "Aggiornamento server predisposto su {{nodeId}} — il nodo si riavvia. Ti avviseremo quando torna.",
@@ -9678,7 +9735,7 @@ var it_default = {
 	"summary.line.node-inference-unavailable": "{{nodeId}} — non può eseguire l'inferenza (da {{since}})",
 	"summary.line.addon-crash-loop": "{{nodeId}} — {{addons}} fermati dopo crash ripetuti (da {{since}})",
 	"summary.line.update": "{{packageName}} {{currentVersion}} → {{latestVersion}}",
-	"summary.line.wrapper-update": "Container {{currentVersion}} → {{latestVersion}}",
+	"summary.line.wrapper-update": "Contenitore {{currentVersion}} → {{latestVersion}}",
 	"summary.line.consumable.part": "{{item}} {{percentage}}%",
 	"summary.line.consumable.part.unmeasured": "{{item}} da sostituire",
 	"summary.line.consumable.tank": "{{item}} quasi vuota",
@@ -59797,6 +59854,25 @@ var TrackAlreadyTrainedError = class extends Error {
 	}
 };
 /**
+* Classify a failed `setTrackFlags` as one of the lifecycle's DELIBERATE
+* refusals, or `null` when it is a failure of the call itself.
+*
+* Needed because the caller that matters (a notification button) reaches the
+* method over `ctx.api`, where the error class does not survive the hop and
+* only the message does. The class check comes first; the message check is the
+* transported form, and `track-flags.spec.ts` pins it against the real
+* messages so a reworded refusal cannot silently turn into a generic failure.
+*/
+function retrainRefusalReason(err) {
+	if (err instanceof TrackAlreadyTrainedError) return "trained";
+	if (err instanceof StagingBudgetExceededError) return "budget";
+	const message = err instanceof Error ? err.message : "";
+	if (message.includes("is already trained")) return "trained";
+	if (message.includes("in retrain staging")) return "budget";
+	if (message.includes("unknown track")) return "unknown-track";
+	return null;
+}
+/**
 * The `debugNote` half of the patch — `{}` when nothing should be written.
 *
 * The note is not an independent column: it is the operator's sentence about
@@ -81938,6 +82014,10 @@ var NC_DEVICE_ROW_KINDS = [
 	{
 		key: "nc-artifacts",
 		kind: ncDurableRecordKinds.artifacts
+	},
+	{
+		key: "nc-detection-verdicts",
+		kind: ncDurableRecordKinds["detection-verdicts"]
 	}
 ];
 /**
@@ -82357,6 +82437,82 @@ var NcSequenceStore = class NcSequenceStore {
 	}
 };
 //#endregion
+//#region src/notification-center/detection-verdict-ledger.ts
+/**
+* @durable class=ledger owner=notification-center
+*   write="the operator taps Correct / Wrong on a detection notification; one row per track, the latest answer replaces the earlier one"
+*   retention="none — bounded by the tracks a rule asked about; deleted with the camera by the device-removal hook"
+*/
+var NC_DETECTION_VERDICTS_COLLECTION = "notification-center:detection-verdicts";
+var NC_DETECTION_VERDICTS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "ruleId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL row (Zod-validated on read). */
+	{
+		name: "row",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NcDetectionVerdictRecordSchema = require_clip_model_registry.object({
+	trackId: require_clip_model_registry.string().min(1),
+	deviceId: require_clip_model_registry.number().int(),
+	verdict: require_clip_model_registry._enum(["correct", "wrong"]),
+	/** The class the operator said it really was. Only with `wrong`. */
+	suggestedClass: require_clip_model_registry.string().min(1).optional(),
+	/** Whose notification it was (the token's frozen owner), NOT who tapped. */
+	userId: require_clip_model_registry.string().min(1),
+	ruleId: require_clip_model_registry.string().min(1),
+	ruleName: require_clip_model_registry.string(),
+	at: require_clip_model_registry.number()
+});
+var NC_DETECTION_VERDICTS_SPEC = {
+	collection: NC_DETECTION_VERDICTS_COLLECTION,
+	columns: [...NC_DETECTION_VERDICTS_COLUMNS],
+	writeMode: "write-through",
+	keyOf: (row) => row.trackId,
+	toValue: (row) => ({
+		ruleId: row.ruleId,
+		at: row.at,
+		row
+	}),
+	fromRecord: (_key, data) => {
+		const parsed = NcDetectionVerdictRecordSchema.safeParse(data["row"]);
+		return parsed.success ? parsed.data : null;
+	},
+	deviceIdOf: (row) => row.deviceId,
+	loadLimit: 1e4
+};
+var NcDetectionVerdictLedger = class {
+	ledger;
+	constructor(deps) {
+		this.ledger = new DurableLedger({
+			spec: NC_DETECTION_VERDICTS_SPEC,
+			kind: deps.records.kind(ncDurableRecordKinds["detection-verdicts"]),
+			logger: deps.logger
+		});
+	}
+	/** Write-through; throws on a failed write so the tap reports it. */
+	async record(row) {
+		await this.ledger.put(NcDetectionVerdictRecordSchema.parse(row));
+	}
+};
+//#endregion
 //#region src/notification-center/device-prune.ts
 function judgeList(list, isDead) {
 	const dead = list.filter(isDead);
@@ -83311,6 +83467,64 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/detection-verdict-buttons.ts
+var VERDICT_CORRECT_ID = "detection-verdict-correct";
+var VERDICT_WRONG_ID = "detection-verdict-wrong";
+/** `detection-verdict-wrong:<class>` — Wrong, and what it really was. */
+var VERDICT_WRONG_AS_PREFIX = "detection-verdict-wrong:";
+/** The macro classes offered as "it was really…". Short on purpose. */
+var VERDICT_CLASS_CHOICES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/** At most this many class buttons, and only when the channel has room. */
+var VERDICT_MAX_CLASS_CHOICES = 2;
+function verdictButtonRefusal(subject) {
+	if (!subject.askVerdict) return "rule-off";
+	if (subject.trackId === void 0) return "no-track";
+	if (subject.ownerUserId === void 0) return "unowned-target";
+	return null;
+}
+/** The classes worth offering for a subject of `className`. */
+function verdictClassChoices(className) {
+	return VERDICT_CLASS_CHOICES.filter((c) => c !== className).slice(0, VERDICT_MAX_CLASS_CHOICES);
+}
+/**
+* Which buttons a channel with `maxActions` slots gets. `maxActions` absent
+* (the kind catalog did not answer) is treated as the common floor of three:
+* the two plain choices, never the class ones. The class choices appear only
+* when the channel declared room for a fourth button.
+*/
+function verdictButtonSpecs(input) {
+	const base = [{
+		actionId: VERDICT_CORRECT_ID,
+		verdict: "correct"
+	}, {
+		actionId: VERDICT_WRONG_ID,
+		verdict: "wrong"
+	}];
+	if (input.maxActions === void 0 || input.maxActions <= 3) return base;
+	const room = input.maxActions - base.length;
+	const extra = verdictClassChoices(input.className).slice(0, room).map((suggestedClass) => ({
+		actionId: `${VERDICT_WRONG_AS_PREFIX}${suggestedClass}`,
+		verdict: "wrong",
+		suggestedClass
+	}));
+	return [...base, ...extra];
+}
+/** Is this one of our buttons (so a link-only channel can lift it into the body)? */
+function isVerdictAction(action) {
+	return action.id === VERDICT_CORRECT_ID || action.id.startsWith(VERDICT_WRONG_ID);
+}
+/**
+* The body lines that carry the verdict choices on a channel with no buttons.
+* A bare URL per line: every chat and mail client linkifies it.
+*/
+function verdictLinkLines(actions) {
+	return actions.filter(isVerdictAction).map((a) => `${a.label}: ${a.url ?? ""}`).join("\n");
+}
+//#endregion
 //#region src/notification-center/state-summary/state-model.ts
 /**
 * The STATE SUMMARY's vocabulary (D647): its sections, and what one reported
@@ -84032,6 +84246,53 @@ function withTimeout$3(promise, ms) {
 }
 //#endregion
 //#region src/notification-center/summary/mosaic-renderer.ts
+/**
+* The mosaic: N stored best-shots laid out as one image.
+*
+* ## The mosaic is ALWAYS CLEAN
+*
+* No detection boxes. Not "boxes off by default" — the media ladder in
+* `summary-selection.ts` refuses `fullFrameBoxed` outright and nothing here
+* draws a rectangle. The operator asked for it in those words, and there are
+* two further reasons worth writing down so nobody adds them back as a
+* convenience:
+*
+*  - a burnt-in box is permanent. A tile is a durable artefact and a mosaic is
+*    a thing an operator re-reads days later; a box drawn from a detection that
+*    was wrong cannot be un-drawn;
+*  - for P2 it is an attack surface. Anything rendered INTO the pixels is text
+*    the model reads as scene content, and D121 is this repo's record of a
+*    model treating in-frame text as instruction. Boxes stay DATA — the
+*    artefact can carry them, the picture never does.
+*
+* ## …and by default it carries NO TEXT EITHER
+*
+* {@link mosaicTextPlan} is the ONE place that decides whether a word is drawn,
+* and with no `captions` on the rule the answer is "none": tile labels off,
+* title band off. Same argument as the boxes, one step further — the operator
+* asked for a wall of pictures, a burnt-in caption cannot be un-drawn, and the
+* label strip covers 14% of every tile with the part of the frame nearest the
+* ground, which is where feet, wheels and parcels are.
+*
+* Nothing is lost by it. The AI pass never sees this image:
+* `summary-producer.ts#analyse` hands the model the RAW per-track JPEGs and
+* `summary-ai.ts#buildSummaryAiPrompt` supplies camera name, class and time as
+* PROMPT TEXT. The tile rectangles stay exported (see {@link mosaicLayout}) so
+* a viewer can still say what a tile is without a word being burnt into it.
+*
+* ## sharp, and never ffmpeg `drawtext`
+*
+* Labels, WHEN ASKED FOR, are composited as SVG through sharp. D118 forbids `drawtext` because
+* the hub carries two ffmpeg builds that disagree about libfreetype, so a
+* caption would appear or vanish depending on which node rendered it. sharp is
+* a direct dependency of this addon and its text path is librsvg, which is the
+* same one the timelapse preview already uses.
+*
+* The geometry helpers are pure and exported: {@link mosaicGrid} and
+* {@link mosaicLayout} answer the tile rectangles WITHOUT touching a pixel,
+* which is what lets the layout be tested and what a future clickable-tile
+* viewer will read.
+*/
 /** Widest mosaic produced. 1920 keeps a 3×3 grid at 640 px a tile — readable
 *  on a phone, and a ~200 KB JPEG that every notifier accepts. */
 var MOSAIC_MAX_WIDTH = 1920;
@@ -84225,6 +84486,13 @@ function fitLine(text, usablePx, basePx, minPx) {
 		fontPx
 	};
 }
+/**
+* The words drawn on a summary tile: camera, clock, and the class vocabulary
+* in the hub language. A class the vocabulary does not know stays the wire id.
+*/
+function summaryTileCaption(camera, clock, className, locale) {
+	return `${camera} · ${clock} · ${require_clip_model_registry.eventKindLabel(className, locale)}`;
+}
 /** The label strip drawn across the bottom of one tile. */
 function tileLabelSvg(width, height, label) {
 	const bandHeight = Math.max(18, Math.round(height * LABEL_BAND_FRACTION));
@@ -85299,8 +85567,9 @@ function selectTriggerZoneCandidates(input) {
 *
 *  - `scene-boxes` — the whole scene; the subject outlined THICK in the accent
 *    colour, every OTHER track visible at that instant outlined THIN, each
-*    captioned with class and confidence ("dog 87%") on a dark plate that
-*    reads on any background. Boxes are the tracks' normalised trail boxes AT
+*    captioned with the class vocabulary in the hub language ("Cane 87%") on a
+*    dark plate that reads on any background. Boxes are the tracks' trail
+*    boxes AT
 *    the source frame's timestamp — never the track envelope — scaled to the
 *    JPEG.
 *  - `crop`  — the subject cut out of the clean frame around its box at that
@@ -85321,10 +85590,11 @@ function selectTriggerZoneCandidates(input) {
 * ## Once per record
 *
 * N targets and every outbox retry resolve the same row; the render is
-* memoised per record + subject + mode + zone flag + camera for
-* {@link NC_IMAGE_MEMO_TTL_MS}, so a 4K decode happens once, not once per
-* phone. It runs in the process that hosts the Notification Center (the
-* pipeline-analytics runner), which already carries `sharp`.
+* memoised per record + subject + mode + zone flag + camera + hub language
+* for {@link NC_IMAGE_MEMO_TTL_MS}, so a 4K decode happens once, not once per
+* phone. The hub has one notification language, so every recipient of a row
+* shares that picture. It runs in the process that hosts the Notification
+* Center (the pipeline-analytics runner), which already carries `sharp`.
 */
 /** How long a rendered picture is reused for the same record (N targets, retries). */
 var NC_IMAGE_MEMO_TTL_MS = 15 * 6e4;
@@ -85356,12 +85626,37 @@ var SAME_SUBJECT_IOU = .8;
 */
 var NC_IMAGE_SAME_CLASS_SUBJECT_IOU = .5;
 var JPEG_QUALITY = 85;
-/** The caption of a box: class (or label) and confidence — "dog 87%". Language-free. */
+/** The caption of a box: a name and confidence — "Cane 87%". The name is already chosen. */
 function imageLabelText(name, confidence) {
 	if (confidence === void 0 || !Number.isFinite(confidence)) return name;
 	const pct = Math.round(Math.min(1, Math.max(0, confidence)) * 100);
 	return `${name} ${String(pct)}%`;
 }
+/**
+* The name drawn on a box, in the hub language.
+*
+* A class id — the coarse class, or a finer one riding `label` — is
+* {@link eventKindLabel}. An identity or a plate stays the word the
+* recogniser produced. A class the vocabulary does not know stays the wire
+* id, which is what `eventKindLabel` already returns.
+*/
+function imageBoxName(input, locale) {
+	if (input.labelKind === "identity" || input.labelKind === "plate") {
+		const written = input.label?.trim();
+		if (written !== void 0 && written.length > 0) return written;
+	}
+	const label = input.label?.trim();
+	if (label !== void 0 && label.length > 0) {
+		const key = label.toLowerCase();
+		if (require_clip_model_registry.isEventKindLabelKey(key)) return require_clip_model_registry.eventKindLabel(key, locale);
+		if (key !== input.className.trim().toLowerCase()) return label;
+	}
+	return require_clip_model_registry.eventKindLabel(input.className, locale);
+}
+/** Class vocabulary in `locale`, plus confidence — the string the overlay draws. */
+function imageBoxCaption(input, locale) {
+	return imageLabelText(imageBoxName(input, locale), input.confidence);
+}
 /** Stroke widths for an output of this size: the subject's is the thick one. */
 function overlayStrokes(width, height) {
 	const subject = Math.max(4, Math.round(Math.min(width, height) / 110));
@@ -85660,8 +85955,8 @@ var NcNotificationImageStage = class {
 	}
 	/**
 	* The picture for this row from this source, rendered once per record +
-	* subject + mode + zone flag + camera and reused for every target and retry.
-	* Null when the row ships no still.
+	* subject + mode + zone flag + camera + language and reused for every
+	* target and retry. Null when the row ships no still.
 	*/
 	async notificationImage(input) {
 		const payload = input.entry.payload;
@@ -85669,13 +85964,15 @@ var NcNotificationImageStage = class {
 		if (mode === "none") return null;
 		const zoneIds = input.withSubject ? payloadZoneOverlayIds(payload) : [];
 		const withPath = input.withSubject && payloadShowsSubjectPath(payload);
+		const locale = input.locale ?? "en";
 		const key = [
 			input.entry.recordId,
 			payload.subject.trackId ?? "",
 			mode,
 			zoneIds.length > 0 ? "z" : "-",
 			withPath ? "p" : "-",
-			String(input.camera)
+			String(input.camera),
+			locale
 		].join("|");
 		const now = this.deps.now();
 		const hit = this.memo.get(key);
@@ -85713,9 +86010,15 @@ var NcNotificationImageStage = class {
 		const trail = hasTrackedSubject(subjectTrackId) ? await this.subjectTrail(camera, subjectTrackId) : [];
 		const subjectBox = trailAt(trail, source.timestamp, NC_IMAGE_BOX_MATCH_MAX_MS)?.bbox ?? null;
 		const path = withPath ? this.subjectPath(input, trail) : [];
+		const locale = input.locale ?? "en";
 		const subject = subjectBox !== null ? {
 			...subjectBox,
-			label: imageLabelText(payload.subject.label ?? payload.subject.className, payload.subject.confidence),
+			label: imageBoxCaption({
+				className: payload.subject.className,
+				...payload.subject.label !== void 0 ? { label: payload.subject.label } : {},
+				...payload.subject.labelKind !== void 0 ? { labelKind: payload.subject.labelKind } : {},
+				...payload.subject.confidence !== void 0 ? { confidence: payload.subject.confidence } : {}
+			}, locale),
 			className: payload.subject.className
 		} : null;
 		const othersDrawn = mode === "scene-boxes" ? otherTracks(await this.tracksAt(camera, source.timestamp), subjectTrackId, subjectBox, payload.subject.className) : [];
@@ -85730,7 +86033,11 @@ var NcNotificationImageStage = class {
 		});
 		const others = mode === "scene-boxes" ? othersDrawn.map((t) => ({
 			...t.bbox,
-			label: imageLabelText(t.label ?? t.className, t.confidence),
+			label: imageBoxCaption({
+				className: t.className,
+				...t.label !== void 0 ? { label: t.label } : {},
+				...t.confidence !== void 0 ? { confidence: t.confidence } : {}
+			}, locale),
 			className: t.className,
 			...t.confidence !== void 0 ? { confidence: t.confidence } : {}
 		})) : [];
@@ -86926,6 +87233,8 @@ var NcDispatcher = class {
 				targetId: target.id,
 				...target.ownerUserId !== void 0 ? { ownerUserId: target.ownerUserId } : {},
 				...entry.payload.subject.className !== void 0 ? { className: entry.payload.subject.className } : {},
+				...entry.payload.subject.trackId !== void 0 ? { trackId: entry.payload.subject.trackId } : {},
+				...target.maxActions !== void 0 ? { maxActions: target.maxActions } : {},
 				...entry.payload.subject.systemEvent !== void 0 ? { systemEvent: entry.payload.subject.systemEvent } : {}
 			});
 		} catch (err) {
@@ -87021,9 +87330,13 @@ var NcDispatcher = class {
 				...summarySectionOf(systemEvent.data)
 			} } : {}
 		}) : null;
-		const actions = await this.mintActions(entry, target);
+		const minted = await this.mintActions(entry, target);
+		const linkOnly = target.maxActions === 0;
+		const verdictLinks = linkOnly ? verdictLinkLines(minted) : "";
+		const actions = linkOnly ? minted.filter((a) => !isVerdictAction(a)) : minted;
+		const withLinks = (text) => verdictLinks === "" ? text : `${text}\n\n${verdictLinks}`;
 		const notification = {
-			body,
+			body: withLinks(body),
 			title,
 			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
 			...params,
@@ -87045,7 +87358,7 @@ var NcDispatcher = class {
 			grouped: resolved.grouped,
 			withAiText: (aiText) => ({
 				...notification,
-				body: renderBody(aiText)
+				body: withLinks(renderBody(aiText))
 			})
 		};
 	}
@@ -87240,7 +87553,8 @@ var NcDispatcher = class {
 					annotated: isAnnotatedSceneKind(file.kind)
 				},
 				camera: cameraId,
-				withSubject: false
+				withSubject: false,
+				locale: this.texts.language
 			});
 			if (image === null) continue;
 			out.push({
@@ -88029,7 +88343,8 @@ var NcDispatcher = class {
 						annotated: isAnnotatedSceneKind(file.kind)
 					},
 					camera: primaryImageCamera(entry.payload),
-					withSubject: true
+					withSubject: true,
+					locale: this.texts.language
 				});
 				if (image === null) return null;
 				return {
@@ -94749,7 +95064,7 @@ var NcSummaryProducer = class {
 				purpose: "summary",
 				tiles: tiles.map(({ candidate, jpeg }) => ({
 					jpeg,
-					...plan.tileLabels ? { label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf$2(candidate.firstSeen)} · ${candidate.className}` } : {},
+					...plan.tileLabels ? { label: summaryTileCaption(names.get(candidate.deviceId) ?? String(candidate.deviceId), clockOf$2(candidate.firstSeen), candidate.className, this.texts.language) } : {},
 					deviceId: candidate.deviceId,
 					sourceId: candidate.trackId
 				})),
@@ -99656,6 +99971,55 @@ async function mintButtons(host, input) {
 	const announcement = stored === null && input.ruleId === NC_ALARM_ANNOUNCE_RULE_ID;
 	if (stored === null && !announcement) return [];
 	const drafts = [];
+	const verdictRefusal = verdictButtonRefusal({
+		askVerdict: stored?.askVerdict === true,
+		...input.trackId !== void 0 ? { trackId: input.trackId } : {},
+		...input.ownerUserId !== void 0 ? { ownerUserId: input.ownerUserId } : {}
+	});
+	if (stored?.askVerdict === true && verdictRefusal !== null) host.logger.info("detection notification carries no verdict buttons", {
+		tags: { deviceId: input.deviceId },
+		meta: {
+			ruleId: input.ruleId,
+			reason: verdictRefusal,
+			targetId: input.targetId
+		}
+	});
+	const verdictTrackId = input.trackId;
+	const verdictOwner = input.ownerUserId;
+	const verdictButtons = verdictRefusal !== null || verdictTrackId === void 0 || verdictOwner === void 0 ? [] : verdictButtonSpecs({
+		className: input.className,
+		maxActions: input.maxActions
+	}).map((spec) => {
+		const id = (0, node_crypto.randomUUID)();
+		drafts.push({
+			id,
+			ttlMs: actionTtlMs({ kind: "detection-verdict" }),
+			grant: (expiresAt) => ({
+				kind: "detection-verdict",
+				id,
+				verdict: spec.verdict,
+				trackId: verdictTrackId,
+				ruleId: input.ruleId,
+				ruleName: input.ruleName,
+				userId: verdictOwner,
+				...spec.suggestedClass !== void 0 ? { suggestedClass: spec.suggestedClass } : {},
+				...input.maxActions === 0 ? { viaLink: true } : {},
+				deviceId: input.deviceId,
+				actionId: spec.actionId,
+				targetId: input.targetId,
+				expiresAt
+			})
+		});
+		return {
+			id: spec.actionId,
+			label: spec.suggestedClass === void 0 ? host.texts.text({ key: spec.verdict === "correct" ? "button.verdict.correct" : "button.verdict.wrong" }) : host.texts.text({
+				key: "button.verdict.wrongAs",
+				vars: { class: spec.suggestedClass }
+			}),
+			url: id,
+			mode: "background"
+		};
+	});
 	const sequenceButtons = host.actionRunner === null || stored === null ? [] : buildActionButtons({
 		actions: stored.actions,
 		knownSequenceIds: host.sequences.knownIds(),
@@ -99868,6 +100232,7 @@ async function mintButtons(host, input) {
 		}
 	});
 	const out = [
+		...verdictButtons,
 		...sequenceButtons,
 		...snoozeButtons,
 		...alarmButtons,
@@ -100091,7 +100456,52 @@ async function runGrantedAction(host, grant) {
 		case "sequence": return host.runGrantedSequence(grant);
 		case "addon-update": return host.applyGrantedAddonUpdate(grant);
 		case "server-update": return host.applyGrantedServerUpdate(grant);
+		case "detection-verdict": return host.applyGrantedDetectionVerdict(grant);
+	}
+}
+/** What a person is told when the retrain lifecycle refuses the mark. */
+var VERDICT_REFUSAL_COPY = {
+	trained: "This track was already used for training — nothing was changed",
+	budget: "This camera already holds as many tracks for retraining as it may — nothing was changed",
+	"unknown-track": "This track is no longer available — nothing was changed"
+};
+/**
+* Mark the track one notification reported for retraining, and record who was
+* asked and when.
+*
+* Order matters. The MARK goes first and is the authority: a refusal ("already
+* trained", "budget full") means the operator's answer changed nothing, so no
+* ledger row is written for an answer that was not applied. The token is
+* already spent (D47) — the refusal is shown as the reason, not a retry.
+*/
+async function applyGrantedDetectionVerdict(host, grant) {
+	const mark = host.deps.markTrackForRetrain;
+	if (mark === void 0) throw new Error("no retrain mark is wired on this node");
+	const outcome = await mark({
+		deviceId: grant.deviceId,
+		trackId: grant.trackId
+	});
+	if (!outcome.ok) {
+		host.logger.info("detection verdict changed nothing — the retrain flow refused the mark", {
+			tags: { deviceId: grant.deviceId },
+			meta: {
+				trackId: grant.trackId,
+				reason: outcome.reason,
+				verdict: grant.verdict
+			}
+		});
+		throw new NcActionRefusedError(VERDICT_REFUSAL_COPY[outcome.reason]);
 	}
+	await host.verdicts.record({
+		trackId: grant.trackId,
+		deviceId: grant.deviceId,
+		verdict: grant.verdict,
+		...grant.suggestedClass !== void 0 ? { suggestedClass: grant.suggestedClass } : {},
+		userId: grant.userId,
+		ruleId: grant.ruleId,
+		ruleName: grant.ruleName,
+		at: host.now()
+	});
 }
 /**
 * Apply the addon updates one notification was about.
@@ -105269,6 +105679,7 @@ var NotificationCenter = class {
 	* evaluating one.
 	*/
 	pruneLedger;
+	verdicts;
 	/** D905: which rules cannot work, announced once per distinct reason. */
 	ruleHealth = new NcRuleHealthMonitor();
 	/** The prune itself — see `device-prune-runner.ts`. */
@@ -105497,6 +105908,11 @@ var NotificationCenter = class {
 			applyGrantedArmAnyway: (panel, grant) => self.applyGrantedArmAnyway(panel, grant),
 			applyGrantedBypassInput: (panel, grant) => self.applyGrantedBypassInput(panel, grant),
 			applyGrantedServerUpdate: (grant) => self.applyGrantedServerUpdate(grant),
+			applyGrantedDetectionVerdict: (grant) => self.applyGrantedDetectionVerdict(grant),
+			now: self.now,
+			get verdicts() {
+				return self.verdicts;
+			},
 			applyGrantedSnooze: (grant) => self.applyGrantedSnooze(grant),
 			get deps() {
 				return self.deps;
@@ -105547,6 +105963,9 @@ var NotificationCenter = class {
 	async applyGrantedAddonUpdate(grant) {
 		return applyGrantedAddonUpdate(this.grantedActionsHost(), grant);
 	}
+	async applyGrantedDetectionVerdict(grant) {
+		return applyGrantedDetectionVerdict(this.grantedActionsHost(), grant);
+	}
 	async applyGrantedServerUpdate(grant) {
 		return applyGrantedServerUpdate(this.grantedActionsHost(), grant);
 	}
@@ -105786,6 +106205,10 @@ var NotificationCenter = class {
 		}
 		this.summaryRules = NcSummaryStore.of(deps.records, this.logger.child("summary"), deps.now);
 		this.calendarEventsRules = NcCalendarEventsStore.of(deps.records, this.logger.child("calendar-events"), deps.now);
+		this.verdicts = new NcDetectionVerdictLedger({
+			...durableStore,
+			logger: this.logger.child("detection-verdicts")
+		});
 		this.pruneLedger = new NcPruneLedger({
 			...durableStore,
 			logger: this.logger.child("device-prune")
@@ -108393,6 +108816,23 @@ var BuildNotificationCenter = class extends BuildNotificationCenterBase {
 					};
 				}
 			},
+			markTrackForRetrain: async ({ deviceId, trackId }) => {
+				try {
+					await this.ctx.api.pipelineAnalytics.setTrackFlags.mutate({
+						deviceId,
+						trackId,
+						flags: { markForTrain: true }
+					});
+					return { ok: true };
+				} catch (err) {
+					const reason = retrainRefusalReason(err);
+					if (reason === null) throw err;
+					return {
+						ok: false,
+						reason
+					};
+				}
+			},
 			readDeviceStates: async (ids) => {
 				const out = /* @__PURE__ */ new Map();
 				for (const id of ids) try {
@@ -108464,9 +108904,11 @@ var BuildNotificationCenter = class extends BuildNotificationCenterBase {
 					const targets = await api.notificationOutput.listTargets.query({});
 					const kinds = await api.notificationOutput.listTargetKinds.query({}).catch(() => []);
 					const bodyMaxLenByKind = new Map(kinds.map((k) => [k.kind, k.caps.bodyMaxLen]));
+					const maxActionsByKind = new Map(kinds.map((k) => [k.kind, k.caps.actions]));
 					return targets.map((t) => {
 						const owner = t.config["ownerUserId"];
 						const bodyMaxLen = bodyMaxLenByKind.get(t.kind);
+						const maxActions = maxActionsByKind.get(t.kind);
 						return {
 							id: t.id,
 							addonId: t.addonId,
@@ -108474,7 +108916,8 @@ var BuildNotificationCenter = class extends BuildNotificationCenterBase {
 							kind: t.kind,
 							enabled: t.enabled,
 							...typeof owner === "string" && owner.length > 0 ? { ownerUserId: owner } : {},
-							...typeof bodyMaxLen === "number" ? { bodyMaxLen } : {}
+							...typeof bodyMaxLen === "number" ? { bodyMaxLen } : {},
+							...typeof maxActions === "number" ? { maxActions } : {}
 						};
 					});
 				},