@camstack/addon-post-analysis 1.2.641 → 1.2.643

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-Qr0XipkX.js");
+const require_clip_model_registry = require("../clip-model-registry-lKeBMKlT.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -757,6 +757,8 @@ var DEFAULT_ACTION_TTL_MS = 15 * 6e4;
 * notification that is not fresh.
 */
 var SNOOZE_ACTION_TTL_MS = 60 * 6e4;
+/** How long a Correct / Wrong button stays live: one day. */
+var VERDICT_ACTION_TTL_MS = 1440 * 6e4;
 /**
 * How long a DISARM button stays live: five minutes.
 *
@@ -784,6 +786,7 @@ function actionTtlMs(subject) {
 		case "sequence": return DEFAULT_ACTION_TTL_MS;
 		case "addon-update": return DEFAULT_ACTION_TTL_MS;
 		case "server-update": return DEFAULT_ACTION_TTL_MS;
+		case "detection-verdict": return VERDICT_ACTION_TTL_MS;
 	}
 }
 var NcActionTokenRegistry = class {
@@ -827,6 +830,30 @@ var NcActionTokenRegistry = class {
 			grant: found.grant
 		};
 	}
+	/**
+	* Read the grant without spending it. ONLY the confirm page of a link-only
+	* channel may call this: it exists so a link preview that opens the URL
+	* cannot spend the token, and it never runs anything.
+	*/
+	peek(id) {
+		const found = this.grants.get(id);
+		if (found === void 0) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (found.used) return {
+			ok: false,
+			reason: "already-used"
+		};
+		if (found.grant.expiresAt <= this.now()) return {
+			ok: false,
+			reason: "expired"
+		};
+		return {
+			ok: true,
+			grant: found.grant
+		};
+	}
 	/** Drop records that can no longer be claimed. Memory hygiene only — an
 	*  expired record is already refused by {@link claim}, so a sweep that never
 	*  ran would cost bytes, never safety. */
@@ -868,6 +895,7 @@ function describeGrant(grant) {
 			return grant.action === "disarm" ? "Alarm disarmed" : `Alarm armed${grant.mode !== void 0 ? ` (${grant.mode})` : ""}`;
 		case "addon-update": return `${grant.packages.length} addon update(s) on ${grant.nodeId}`;
 		case "server-update": return `Server update on ${grant.nodeId}`;
+		case "detection-verdict": return grant.verdict === "correct" ? "Marked correct — kept for retraining" : grant.suggestedClass === void 0 ? "Marked wrong — kept for retraining" : `Marked wrong, it was a ${grant.suggestedClass} — kept for retraining`;
 	}
 }
 /** The audit line's `meta`, per family. A snooze that logged a `sequence` it
@@ -921,6 +949,15 @@ function grantMeta(grant) {
 			...common,
 			nodeId: grant.nodeId
 		};
+		case "detection-verdict": return {
+			...common,
+			ruleId: grant.ruleId,
+			rule: grant.ruleName,
+			userId: grant.userId,
+			trackId: grant.trackId,
+			verdict: grant.verdict,
+			suggestedClass: grant.suggestedClass ?? null
+		};
 	}
 }
 /** What the human standing in front of the page is told. */
@@ -929,6 +966,11 @@ var FAILURE_COPY = {
 	expired: "This button has expired. Open CamStack to do it there.",
 	"already-used": "Already done — this button had been used."
 };
+/** The question a link-only channel lands on, answered by a POST form. */
+function confirmPage(url, grant) {
+	const action = `${url.pathname}?exp=${encodeURIComponent(url.searchParams.get("exp") ?? "")}&amp;sig=${encodeURIComponent(url.searchParams.get("sig") ?? "")}&amp;confirm=1`;
+	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirm</title><style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#111;color:#eee}main{max-width:24rem;padding:2rem;text-align:center}h1{font-size:1.25rem;margin:0 0 1rem}button{font:inherit;padding:.6rem 1.4rem;border-radius:.5rem;border:0;background:#3b82f6;color:#fff}</style><main><h1>Confirm</h1><p>${grant.verdict === "correct" ? "Mark this detection as correct?" : grant.suggestedClass === void 0 ? "Mark this detection as wrong?" : `Mark this detection as wrong, it was a ${grant.suggestedClass}?`}</p><form method="post" action="${action}"><button type="submit">Confirm</button></form></main>`;
+}
 function page(title, detail) {
 	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#111;color:#eee}main{max-width:24rem;padding:2rem;text-align:center}h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:0;color:#aaa}</style><main><h1>${title}</h1><p>${detail}</p></main>`;
 }
@@ -942,7 +984,8 @@ var NcActionPlane = class {
 	handler = async (req, res) => {
 		const url = new URL(req.url ?? "/", "http://placeholder");
 		const id = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
-		const background = (req.method ?? "GET").toUpperCase() === "POST";
+		const posted = (req.method ?? "GET").toUpperCase() === "POST";
+		const background = posted && url.searchParams.get("confirm") !== "1";
 		if (!verifyActionSignature({
 			secret: this.deps.secret,
 			id,
@@ -954,6 +997,13 @@ var NcActionPlane = class {
 			this.reply(res, background, 404, "Not found", "This link is not valid.");
 			return;
 		}
+		if (!posted) {
+			const peeked = this.deps.registry.peek(id);
+			if (peeked.ok && peeked.grant.kind === "detection-verdict" && peeked.grant.viaLink === true) {
+				this.sendBody(res, 200, "text/html; charset=utf-8", confirmPage(url, peeked.grant));
+				return;
+			}
+		}
 		const claim = this.deps.registry.claim(id);
 		if (!claim.ok) {
 			this.deps.logger.info("nc action callback not claimable", { meta: {
@@ -1099,6 +1149,7 @@ var ncDurableRecordKinds = require_clip_model_registry.defineRecordKinds({
 	"state-summary-stamps": ledger("digest delivery stamps per rule kind"),
 	meta: ledger("outbox boot-reconcile watermark and other single-key meta rows", "settings", { none: "one fixed key (watermark), overwritten in place, never deleted" }),
 	snoozes: ledger("operator opens or closes a snooze window (write-through)"),
+	"detection-verdicts": ledger("operator taps Correct or Wrong on a detection notification; one row per track"),
 	"snooze-suppressed": {
 		...QUERIED,
 		class: "ledger",
@@ -9234,6 +9285,9 @@ var en_default = {
 	"action.addon-update.uptodate": "Already up to date on {{nodeId}} — nothing to do",
 	"action.addon-update.unknown": "Could not read what needs updating on {{nodeId}} — nothing was changed. Open CamStack.",
 	"button.server-update.apply": "Update server on {{nodeId}}",
+	"button.verdict.correct": "Correct",
+	"button.verdict.wrong": "Wrong",
+	"button.verdict.wrongAs": "Wrong: it is {{class}}",
 	"action.server-update.title": "Server update",
 	"action.server-update.started": "Updating server on {{nodeId}}…",
 	"action.server-update.restarting": "Server update staged on {{nodeId}} — the node is restarting. You will hear when it comes back.",
@@ -9635,6 +9689,9 @@ var it_default = {
 	"action.addon-update.uptodate": "Già aggiornato su {{nodeId}} — niente da fare",
 	"action.addon-update.unknown": "Non è stato possibile leggere cosa aggiornare su {{nodeId}} — non è stato cambiato nulla. Apri CamStack.",
 	"button.server-update.apply": "Aggiorna server su {{nodeId}}",
+	"button.verdict.correct": "Corretto",
+	"button.verdict.wrong": "Sbagliato",
+	"button.verdict.wrongAs": "Sbagliato: è {{class}}",
 	"action.server-update.title": "Aggiornamento server",
 	"action.server-update.started": "Aggiornamento server su {{nodeId}}…",
 	"action.server-update.restarting": "Aggiornamento server predisposto su {{nodeId}} — il nodo si riavvia. Ti avviseremo quando torna.",
@@ -53130,6 +53187,15 @@ var SESSION_STILLNESS_MIN_POINTS = 4;
 *  long (object removed while unobserved, or a long occlusion) → retire it. */
 var ENTRY_TTL_MS = 5 * 6e4;
 /**
+* The most one gap between two consecutive processed frames counts toward an
+* entry's WATCHED unconfirmed time. Frames inside a motion session arrive every
+* 0.2-2 s; the silence between on-motion sessions is tens of seconds to hours.
+* 10 s sits above any real in-session cadence (a slower frame still counts
+* nearly in full) and far below a session gap, so a gap contributes at most
+* one bound, never its length. Under-counting only delays a retirement.
+*/
+var WATCHED_GAP_CAP_MS = 1e4;
+/**
 * How far apart the two reads of a departure must be before the second one
 * counts as CONFIRMING the first.
 *
@@ -59797,6 +59863,25 @@ var TrackAlreadyTrainedError = class extends Error {
 	}
 };
 /**
+* Classify a failed `setTrackFlags` as one of the lifecycle's DELIBERATE
+* refusals, or `null` when it is a failure of the call itself.
+*
+* Needed because the caller that matters (a notification button) reaches the
+* method over `ctx.api`, where the error class does not survive the hop and
+* only the message does. The class check comes first; the message check is the
+* transported form, and `track-flags.spec.ts` pins it against the real
+* messages so a reworded refusal cannot silently turn into a generic failure.
+*/
+function retrainRefusalReason(err) {
+	if (err instanceof TrackAlreadyTrainedError) return "trained";
+	if (err instanceof StagingBudgetExceededError) return "budget";
+	const message = err instanceof Error ? err.message : "";
+	if (message.includes("is already trained")) return "trained";
+	if (message.includes("in retrain staging")) return "budget";
+	if (message.includes("unknown track")) return "unknown-track";
+	return null;
+}
+/**
 * The `debugNote` half of the patch — `{}` when nothing should be written.
 *
 * The note is not an independent column: it is the operator's sentence about
@@ -62360,6 +62445,19 @@ var StationaryObjectRegistry = class {
 	*  so quiet minutes must not age the entries (see {@link sweep}). */
 	lastFrameAtByDevice = /* @__PURE__ */ new Map();
 	/**
+	* WATCHED time each entry has gone unconfirmed, in ms. Entry expiry is judged
+	* on this, never on the span between two frame timestamps: a session-dispatch
+	* camera's silence between motion sessions would otherwise be counted in full
+	* the moment the next session's first frame arrives (measured: a car parked
+	* 3.3 h was retired after seconds of watching, 316 s after its last
+	* confirmation). Each frame adds its delta from the previous one, capped at
+	* {@link WATCHED_GAP_CAP_MS}; a confirmation resets it. `confirmedAt` is the
+	* `lastConfirmedAt` the counter was last reset for, so a changed value (any of
+	* the places that confirm an entry) restarts the count without a hook at each.
+	* An entry that was just hydrated has no record here and starts at zero.
+	*/
+	unconfirmedWatched = /* @__PURE__ */ new Map();
+	/**
 	* Entries carrying ONE unconfirmed departure read, per device (D49, D174,
 	* D279).
 	*
@@ -62473,7 +62571,27 @@ var StationaryObjectRegistry = class {
 	/** Record that a frame was processed for a device — advances the OBSERVED
 	*  clock that drives entry expiry in {@link sweep}. */
 	noteFrame(deviceId, timestamp) {
-		if (timestamp > (this.lastFrameAtByDevice.get(deviceId) ?? 0)) this.lastFrameAtByDevice.set(deviceId, timestamp);
+		const known = this.lastFrameAtByDevice.get(deviceId);
+		if (timestamp <= (known ?? 0)) return;
+		this.lastFrameAtByDevice.set(deviceId, timestamp);
+		const ids = this.idsByDevice.get(deviceId);
+		if (!ids) return;
+		const delta = known === void 0 ? 0 : Math.min(timestamp - known, WATCHED_GAP_CAP_MS);
+		for (const id of ids) {
+			const e = this.ledger.get(id);
+			if (!e) continue;
+			const rec = this.unconfirmedWatched.get(id);
+			if (!rec || rec.confirmedAt !== e.lastConfirmedAt) this.unconfirmedWatched.set(id, {
+				confirmedAt: e.lastConfirmedAt,
+				ms: 0
+			});
+			else rec.ms += delta;
+		}
+	}
+	/** Watched ms an entry has gone unconfirmed (0 when not yet tracked). */
+	watchedUnconfirmedMs(e) {
+		const rec = this.unconfirmedWatched.get(e.id);
+		return rec && rec.confirmedAt === e.lastConfirmedAt ? rec.ms : 0;
 	}
 	/**
 	* Per-frame gate: partition this frame's detections against the device's
@@ -62718,12 +62836,14 @@ var StationaryObjectRegistry = class {
 	* logged by `MacMiniAgent.localdomain` and by `agent-a`, the same
 	* rows, seven seconds apart.
 	*
-	* Expiry is measured against the device's latest processed-frame timestamp
-	* ({@link noteFrame}), NOT the wall clock: a session-dispatch camera emits
-	* no frames between motion sessions, and that silence says nothing about
-	* the object. Only when the camera has actually been WATCHING for `ttl`
+	* Expiry is measured in WATCHED time ({@link noteFrame}): the sum of the
+	* gaps between consecutive processed frames, each capped at
+	* {@link WATCHED_GAP_CAP_MS}, since the entry's last confirmation. Neither the
+	* wall clock nor the span between frame timestamps: a session-dispatch
+	* camera emits no frames between motion sessions, and a silent gap must not
+	* age the object. Only when the camera has actually been WATCHING for `ttl`
 	* beyond the last confirmation (frames flowed, object never matched) is the
-	* object considered removed. A device with no recorded frame yet never
+	* object considered removed. A freshly hydrated entry starts at zero. A device with no recorded frame yet never
 	* expires its entries. `now` only stamps the departed telemetry.
 	*/
 	async sweep(now) {
@@ -62742,9 +62862,10 @@ var StationaryObjectRegistry = class {
 					ids.delete(id);
 					continue;
 				}
-				const overdue = observedAt - e.lastConfirmedAt > ttl;
+				const watchedMs = this.watchedUnconfirmedMs(e);
+				const overdue = watchedMs > ttl;
 				const proven = this.detectorProvedItself(e);
-				const unprovenBackstop = observedAt - e.lastConfirmedAt > ttl * 12;
+				const unprovenBackstop = watchedMs > ttl * 12;
 				if (overdue && !proven && !unprovenBackstop) {
 					this.bumpStrikeCounters(deviceId, { ttlHeldUnproven: 1 });
 					continue;
@@ -62760,7 +62881,8 @@ var StationaryObjectRegistry = class {
 							className: e.className,
 							reason: proven ? "ttl" : "ttl-unproven",
 							ttlMs: ttl,
-							unconfirmedForMs: observedAt - e.lastConfirmedAt,
+							unconfirmedForMs: watchedMs,
+							wallGapMs: observedAt - e.lastConfirmedAt,
 							parkedForMs: observedAt - e.becameStationaryAt
 						}
 					});
@@ -62844,6 +62966,7 @@ var StationaryObjectRegistry = class {
 		for (const id of ids) {
 			this.dirty.delete(id);
 			this.weakRuns.delete(id);
+			this.unconfirmedWatched.delete(id);
 			this.ledger.evict(id);
 		}
 		this.idsByDevice.delete(deviceId);
@@ -63031,6 +63154,7 @@ var StationaryObjectRegistry = class {
 		return at !== void 0 && at > entry.lastConfirmedAt;
 	}
 	dropEntry(deviceId, id) {
+		this.unconfirmedWatched.delete(id);
 		const dropped = this.ledger.get(id);
 		this.idsByDevice.get(deviceId)?.delete(id);
 		this.dirty.delete(id);
@@ -81938,6 +82062,10 @@ var NC_DEVICE_ROW_KINDS = [
 	{
 		key: "nc-artifacts",
 		kind: ncDurableRecordKinds.artifacts
+	},
+	{
+		key: "nc-detection-verdicts",
+		kind: ncDurableRecordKinds["detection-verdicts"]
 	}
 ];
 /**
@@ -82357,6 +82485,82 @@ var NcSequenceStore = class NcSequenceStore {
 	}
 };
 //#endregion
+//#region src/notification-center/detection-verdict-ledger.ts
+/**
+* @durable class=ledger owner=notification-center
+*   write="the operator taps Correct / Wrong on a detection notification; one row per track, the latest answer replaces the earlier one"
+*   retention="none — bounded by the tracks a rule asked about; deleted with the camera by the device-removal hook"
+*/
+var NC_DETECTION_VERDICTS_COLLECTION = "notification-center:detection-verdicts";
+var NC_DETECTION_VERDICTS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "ruleId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL row (Zod-validated on read). */
+	{
+		name: "row",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NcDetectionVerdictRecordSchema = require_clip_model_registry.object({
+	trackId: require_clip_model_registry.string().min(1),
+	deviceId: require_clip_model_registry.number().int(),
+	verdict: require_clip_model_registry._enum(["correct", "wrong"]),
+	/** The class the operator said it really was. Only with `wrong`. */
+	suggestedClass: require_clip_model_registry.string().min(1).optional(),
+	/** Whose notification it was (the token's frozen owner), NOT who tapped. */
+	userId: require_clip_model_registry.string().min(1),
+	ruleId: require_clip_model_registry.string().min(1),
+	ruleName: require_clip_model_registry.string(),
+	at: require_clip_model_registry.number()
+});
+var NC_DETECTION_VERDICTS_SPEC = {
+	collection: NC_DETECTION_VERDICTS_COLLECTION,
+	columns: [...NC_DETECTION_VERDICTS_COLUMNS],
+	writeMode: "write-through",
+	keyOf: (row) => row.trackId,
+	toValue: (row) => ({
+		ruleId: row.ruleId,
+		at: row.at,
+		row
+	}),
+	fromRecord: (_key, data) => {
+		const parsed = NcDetectionVerdictRecordSchema.safeParse(data["row"]);
+		return parsed.success ? parsed.data : null;
+	},
+	deviceIdOf: (row) => row.deviceId,
+	loadLimit: 1e4
+};
+var NcDetectionVerdictLedger = class {
+	ledger;
+	constructor(deps) {
+		this.ledger = new DurableLedger({
+			spec: NC_DETECTION_VERDICTS_SPEC,
+			kind: deps.records.kind(ncDurableRecordKinds["detection-verdicts"]),
+			logger: deps.logger
+		});
+	}
+	/** Write-through; throws on a failed write so the tap reports it. */
+	async record(row) {
+		await this.ledger.put(NcDetectionVerdictRecordSchema.parse(row));
+	}
+};
+//#endregion
 //#region src/notification-center/device-prune.ts
 function judgeList(list, isDead) {
 	const dead = list.filter(isDead);
@@ -83311,6 +83515,64 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/detection-verdict-buttons.ts
+var VERDICT_CORRECT_ID = "detection-verdict-correct";
+var VERDICT_WRONG_ID = "detection-verdict-wrong";
+/** `detection-verdict-wrong:<class>` — Wrong, and what it really was. */
+var VERDICT_WRONG_AS_PREFIX = "detection-verdict-wrong:";
+/** The macro classes offered as "it was really…". Short on purpose. */
+var VERDICT_CLASS_CHOICES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/** At most this many class buttons, and only when the channel has room. */
+var VERDICT_MAX_CLASS_CHOICES = 2;
+function verdictButtonRefusal(subject) {
+	if (!subject.askVerdict) return "rule-off";
+	if (subject.trackId === void 0) return "no-track";
+	if (subject.ownerUserId === void 0) return "unowned-target";
+	return null;
+}
+/** The classes worth offering for a subject of `className`. */
+function verdictClassChoices(className) {
+	return VERDICT_CLASS_CHOICES.filter((c) => c !== className).slice(0, VERDICT_MAX_CLASS_CHOICES);
+}
+/**
+* Which buttons a channel with `maxActions` slots gets. `maxActions` absent
+* (the kind catalog did not answer) is treated as the common floor of three:
+* the two plain choices, never the class ones. The class choices appear only
+* when the channel declared room for a fourth button.
+*/
+function verdictButtonSpecs(input) {
+	const base = [{
+		actionId: VERDICT_CORRECT_ID,
+		verdict: "correct"
+	}, {
+		actionId: VERDICT_WRONG_ID,
+		verdict: "wrong"
+	}];
+	if (input.maxActions === void 0 || input.maxActions <= 3) return base;
+	const room = input.maxActions - base.length;
+	const extra = verdictClassChoices(input.className).slice(0, room).map((suggestedClass) => ({
+		actionId: `${VERDICT_WRONG_AS_PREFIX}${suggestedClass}`,
+		verdict: "wrong",
+		suggestedClass
+	}));
+	return [...base, ...extra];
+}
+/** Is this one of our buttons (so a link-only channel can lift it into the body)? */
+function isVerdictAction(action) {
+	return action.id === VERDICT_CORRECT_ID || action.id.startsWith(VERDICT_WRONG_ID);
+}
+/**
+* The body lines that carry the verdict choices on a channel with no buttons.
+* A bare URL per line: every chat and mail client linkifies it.
+*/
+function verdictLinkLines(actions) {
+	return actions.filter(isVerdictAction).map((a) => `${a.label}: ${a.url ?? ""}`).join("\n");
+}
+//#endregion
 //#region src/notification-center/state-summary/state-model.ts
 /**
 * The STATE SUMMARY's vocabulary (D647): its sections, and what one reported
@@ -87019,6 +87281,8 @@ var NcDispatcher = class {
 				targetId: target.id,
 				...target.ownerUserId !== void 0 ? { ownerUserId: target.ownerUserId } : {},
 				...entry.payload.subject.className !== void 0 ? { className: entry.payload.subject.className } : {},
+				...entry.payload.subject.trackId !== void 0 ? { trackId: entry.payload.subject.trackId } : {},
+				...target.maxActions !== void 0 ? { maxActions: target.maxActions } : {},
 				...entry.payload.subject.systemEvent !== void 0 ? { systemEvent: entry.payload.subject.systemEvent } : {}
 			});
 		} catch (err) {
@@ -87114,9 +87378,13 @@ var NcDispatcher = class {
 				...summarySectionOf(systemEvent.data)
 			} } : {}
 		}) : null;
-		const actions = await this.mintActions(entry, target);
+		const minted = await this.mintActions(entry, target);
+		const linkOnly = target.maxActions === 0;
+		const verdictLinks = linkOnly ? verdictLinkLines(minted) : "";
+		const actions = linkOnly ? minted.filter((a) => !isVerdictAction(a)) : minted;
+		const withLinks = (text) => verdictLinks === "" ? text : `${text}\n\n${verdictLinks}`;
 		const notification = {
-			body,
+			body: withLinks(body),
 			title,
 			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
 			...params,
@@ -87138,7 +87406,7 @@ var NcDispatcher = class {
 			grouped: resolved.grouped,
 			withAiText: (aiText) => ({
 				...notification,
-				body: renderBody(aiText)
+				body: withLinks(renderBody(aiText))
 			})
 		};
 	}
@@ -99751,6 +100019,55 @@ async function mintButtons(host, input) {
 	const announcement = stored === null && input.ruleId === NC_ALARM_ANNOUNCE_RULE_ID;
 	if (stored === null && !announcement) return [];
 	const drafts = [];
+	const verdictRefusal = verdictButtonRefusal({
+		askVerdict: stored?.askVerdict === true,
+		...input.trackId !== void 0 ? { trackId: input.trackId } : {},
+		...input.ownerUserId !== void 0 ? { ownerUserId: input.ownerUserId } : {}
+	});
+	if (stored?.askVerdict === true && verdictRefusal !== null) host.logger.info("detection notification carries no verdict buttons", {
+		tags: { deviceId: input.deviceId },
+		meta: {
+			ruleId: input.ruleId,
+			reason: verdictRefusal,
+			targetId: input.targetId
+		}
+	});
+	const verdictTrackId = input.trackId;
+	const verdictOwner = input.ownerUserId;
+	const verdictButtons = verdictRefusal !== null || verdictTrackId === void 0 || verdictOwner === void 0 ? [] : verdictButtonSpecs({
+		className: input.className,
+		maxActions: input.maxActions
+	}).map((spec) => {
+		const id = (0, node_crypto.randomUUID)();
+		drafts.push({
+			id,
+			ttlMs: actionTtlMs({ kind: "detection-verdict" }),
+			grant: (expiresAt) => ({
+				kind: "detection-verdict",
+				id,
+				verdict: spec.verdict,
+				trackId: verdictTrackId,
+				ruleId: input.ruleId,
+				ruleName: input.ruleName,
+				userId: verdictOwner,
+				...spec.suggestedClass !== void 0 ? { suggestedClass: spec.suggestedClass } : {},
+				...input.maxActions === 0 ? { viaLink: true } : {},
+				deviceId: input.deviceId,
+				actionId: spec.actionId,
+				targetId: input.targetId,
+				expiresAt
+			})
+		});
+		return {
+			id: spec.actionId,
+			label: spec.suggestedClass === void 0 ? host.texts.text({ key: spec.verdict === "correct" ? "button.verdict.correct" : "button.verdict.wrong" }) : host.texts.text({
+				key: "button.verdict.wrongAs",
+				vars: { class: spec.suggestedClass }
+			}),
+			url: id,
+			mode: "background"
+		};
+	});
 	const sequenceButtons = host.actionRunner === null || stored === null ? [] : buildActionButtons({
 		actions: stored.actions,
 		knownSequenceIds: host.sequences.knownIds(),
@@ -99963,6 +100280,7 @@ async function mintButtons(host, input) {
 		}
 	});
 	const out = [
+		...verdictButtons,
 		...sequenceButtons,
 		...snoozeButtons,
 		...alarmButtons,
@@ -100186,7 +100504,52 @@ async function runGrantedAction(host, grant) {
 		case "sequence": return host.runGrantedSequence(grant);
 		case "addon-update": return host.applyGrantedAddonUpdate(grant);
 		case "server-update": return host.applyGrantedServerUpdate(grant);
+		case "detection-verdict": return host.applyGrantedDetectionVerdict(grant);
+	}
+}
+/** What a person is told when the retrain lifecycle refuses the mark. */
+var VERDICT_REFUSAL_COPY = {
+	trained: "This track was already used for training — nothing was changed",
+	budget: "This camera already holds as many tracks for retraining as it may — nothing was changed",
+	"unknown-track": "This track is no longer available — nothing was changed"
+};
+/**
+* Mark the track one notification reported for retraining, and record who was
+* asked and when.
+*
+* Order matters. The MARK goes first and is the authority: a refusal ("already
+* trained", "budget full") means the operator's answer changed nothing, so no
+* ledger row is written for an answer that was not applied. The token is
+* already spent (D47) — the refusal is shown as the reason, not a retry.
+*/
+async function applyGrantedDetectionVerdict(host, grant) {
+	const mark = host.deps.markTrackForRetrain;
+	if (mark === void 0) throw new Error("no retrain mark is wired on this node");
+	const outcome = await mark({
+		deviceId: grant.deviceId,
+		trackId: grant.trackId
+	});
+	if (!outcome.ok) {
+		host.logger.info("detection verdict changed nothing — the retrain flow refused the mark", {
+			tags: { deviceId: grant.deviceId },
+			meta: {
+				trackId: grant.trackId,
+				reason: outcome.reason,
+				verdict: grant.verdict
+			}
+		});
+		throw new NcActionRefusedError(VERDICT_REFUSAL_COPY[outcome.reason]);
 	}
+	await host.verdicts.record({
+		trackId: grant.trackId,
+		deviceId: grant.deviceId,
+		verdict: grant.verdict,
+		...grant.suggestedClass !== void 0 ? { suggestedClass: grant.suggestedClass } : {},
+		userId: grant.userId,
+		ruleId: grant.ruleId,
+		ruleName: grant.ruleName,
+		at: host.now()
+	});
 }
 /**
 * Apply the addon updates one notification was about.
@@ -105364,6 +105727,7 @@ var NotificationCenter = class {
 	* evaluating one.
 	*/
 	pruneLedger;
+	verdicts;
 	/** D905: which rules cannot work, announced once per distinct reason. */
 	ruleHealth = new NcRuleHealthMonitor();
 	/** The prune itself — see `device-prune-runner.ts`. */
@@ -105592,6 +105956,11 @@ var NotificationCenter = class {
 			applyGrantedArmAnyway: (panel, grant) => self.applyGrantedArmAnyway(panel, grant),
 			applyGrantedBypassInput: (panel, grant) => self.applyGrantedBypassInput(panel, grant),
 			applyGrantedServerUpdate: (grant) => self.applyGrantedServerUpdate(grant),
+			applyGrantedDetectionVerdict: (grant) => self.applyGrantedDetectionVerdict(grant),
+			now: self.now,
+			get verdicts() {
+				return self.verdicts;
+			},
 			applyGrantedSnooze: (grant) => self.applyGrantedSnooze(grant),
 			get deps() {
 				return self.deps;
@@ -105642,6 +106011,9 @@ var NotificationCenter = class {
 	async applyGrantedAddonUpdate(grant) {
 		return applyGrantedAddonUpdate(this.grantedActionsHost(), grant);
 	}
+	async applyGrantedDetectionVerdict(grant) {
+		return applyGrantedDetectionVerdict(this.grantedActionsHost(), grant);
+	}
 	async applyGrantedServerUpdate(grant) {
 		return applyGrantedServerUpdate(this.grantedActionsHost(), grant);
 	}
@@ -105881,6 +106253,10 @@ var NotificationCenter = class {
 		}
 		this.summaryRules = NcSummaryStore.of(deps.records, this.logger.child("summary"), deps.now);
 		this.calendarEventsRules = NcCalendarEventsStore.of(deps.records, this.logger.child("calendar-events"), deps.now);
+		this.verdicts = new NcDetectionVerdictLedger({
+			...durableStore,
+			logger: this.logger.child("detection-verdicts")
+		});
 		this.pruneLedger = new NcPruneLedger({
 			...durableStore,
 			logger: this.logger.child("device-prune")
@@ -108488,6 +108864,23 @@ var BuildNotificationCenter = class extends BuildNotificationCenterBase {
 					};
 				}
 			},
+			markTrackForRetrain: async ({ deviceId, trackId }) => {
+				try {
+					await this.ctx.api.pipelineAnalytics.setTrackFlags.mutate({
+						deviceId,
+						trackId,
+						flags: { markForTrain: true }
+					});
+					return { ok: true };
+				} catch (err) {
+					const reason = retrainRefusalReason(err);
+					if (reason === null) throw err;
+					return {
+						ok: false,
+						reason
+					};
+				}
+			},
 			readDeviceStates: async (ids) => {
 				const out = /* @__PURE__ */ new Map();
 				for (const id of ids) try {
@@ -108559,9 +108952,11 @@ var BuildNotificationCenter = class extends BuildNotificationCenterBase {
 					const targets = await api.notificationOutput.listTargets.query({});
 					const kinds = await api.notificationOutput.listTargetKinds.query({}).catch(() => []);
 					const bodyMaxLenByKind = new Map(kinds.map((k) => [k.kind, k.caps.bodyMaxLen]));
+					const maxActionsByKind = new Map(kinds.map((k) => [k.kind, k.caps.actions]));
 					return targets.map((t) => {
 						const owner = t.config["ownerUserId"];
 						const bodyMaxLen = bodyMaxLenByKind.get(t.kind);
+						const maxActions = maxActionsByKind.get(t.kind);
 						return {
 							id: t.id,
 							addonId: t.addonId,
@@ -108569,7 +108964,8 @@ var BuildNotificationCenter = class extends BuildNotificationCenterBase {
 							kind: t.kind,
 							enabled: t.enabled,
 							...typeof owner === "string" && owner.length > 0 ? { ownerUserId: owner } : {},
-							...typeof bodyMaxLen === "number" ? { bodyMaxLen } : {}
+							...typeof bodyMaxLen === "number" ? { bodyMaxLen } : {},
+							...typeof maxActions === "number" ? { maxActions } : {}
 						};
 					});
 				},