@camstack/addon-post-analysis 1.2.67 → 1.2.68

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as BaseAddon, A as assertTimelapseCadences, C as TIMELAPSE_DENSE_FLOOR_SEC, D as TrackSourceSchema, E as TimelapseRuleSchema, F as defineCustomActions, G as plateGalleryCapability, H as kebabToCamel, I as deriveRecordingMode, J as subKindsOf, K as readDeviceStateFrom, M as buildEventKindDescriptor, N as cosineSimilarity, O as addonWidgetsSourceCapability, P as customAction, Q as errMsg, R as encodeVectorBase64, S as RetrainStatusSchema, T as TimelapseRulePatchSchema, U as notificationRulesCapability, V as isScheduleActive, W as pipelineAnalyticsCapability, X as videoclipsCapability, Y as vectorDimFromBase64, Z as zoneAnalyticsCapability, _ as NcSnoozeSchema, a as DeclaredDevices, at as sleep, b as OpsLogEntrySchema, c as LabelAttributionSchema, ct as boolean, d as NC_TAXONOMY, dt as object, et as DeviceType, f as NcConditionDescriptorSchema, ft as partialRecord, g as NcSnoozeInputSchema, gt as EventCategory, h as NcRuleSchema, ht as unknown, it as nodePin, j as audioMetricsCapability, k as alarmPanelCapability, l as MACRO_LABELS, lt as literal, m as NcRulePatchSchema, mt as string, n as DEFAULT_EVENT_COLOR, nt as hydrateSchema, o as EVENT_KIND_BY_CAP, ot as _enum, p as NcRuleInputSchema, pt as record, q as readTimelapseGeneratedAt, rt as isDeviceScopedCap, s as EVENT_PAD_MS, st as array, t as BaseDevice, tt as createEvent, u as NC_CONDITION_CATALOG, ut as number, v as NcSnoozeSuppressedSchema, w as TimelapseRuleInputSchema, x as RECORDING_EXPORT_MAX_READ_BYTES, y as NcTaxonomySchema, z as faceGalleryCapability } from "../dist-DJC4JrMD.mjs";
+import { $ as zoneAnalyticsCapability, A as addonWidgetsSourceCapability, B as encodeVectorBase64, C as RECORDING_EXPORT_MAX_READ_BYTES, D as TimelapseRulePatchSchema, E as TimelapseRuleInputSchema, F as cosineSimilarity, G as notificationRulesCapability, I as customAction, J as readDeviceStateFrom, K as pipelineAnalyticsCapability, L as defineCustomActions, M as assertTimelapseCadences, N as audioMetricsCapability, O as TimelapseRuleSchema, P as buildEventKindDescriptor, Q as videoclipsCapability, R as deriveRecordingMode, S as OpsLogEntrySchema, T as TIMELAPSE_DENSE_FLOOR_SEC, U as isScheduleActive, V as faceGalleryCapability, W as kebabToCamel, X as subKindsOf, Y as readTimelapseGeneratedAt, Z as vectorDimFromBase64, _ as NcScheduleSchema, _t as string, a as DeclaredDevices, at as isDeviceScopedCap, b as NcSnoozeSuppressedSchema, c as LabelAttributionSchema, ct as _enum, d as NC_TAXONOMY, dt as discriminatedUnion, et as errMsg, f as NcConditionDescriptorSchema, ft as literal, g as NcRuleTargetSchema, gt as record, h as NcRuleSchema, ht as partialRecord, it as hydrateSchema, j as alarmPanelCapability, k as TrackSourceSchema, l as MACRO_LABELS, lt as array, m as NcRulePatchSchema, mt as object, n as DEFAULT_EVENT_COLOR, nt as DeviceType, o as EVENT_KIND_BY_CAP, ot as nodePin, p as NcRuleInputSchema, pt as number, q as plateGalleryCapability, rt as createEvent, s as EVENT_PAD_MS, st as sleep, t as BaseDevice, tt as BaseAddon, u as NC_CONDITION_CATALOG, ut as boolean, v as NcSnoozeInputSchema, vt as unknown, w as RetrainStatusSchema, x as NcTaxonomySchema, y as NcSnoozeSchema, yt as EventCategory } from "../dist-rpHe5qpB.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -7,8 +7,8 @@ import path from "node:path";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFile } from "node:child_process";
 import os from "node:os";
-import { Buffer as Buffer$1 } from "node:buffer";
 import sharp from "sharp";
+import { Buffer as Buffer$1 } from "node:buffer";
 //#region src/notification-center/action-token.ts
 /**
 * The authority behind a notification button.
@@ -2712,25 +2712,18 @@ function scopeZoneIdsToDevice(ids, deviceId, owner) {
 /**
 * The rule-level entry point: scope this rule's zones to this camera.
 *
-* ── Why an UNSCOPED rule keeps the flat behaviour ──────────────────────────
+* ── One semantic for scoped AND unscoped rules (operator, 2026-08-13) ───────
 *
-* Widening is not free. On a rule that names its cameras, treating the other
-* named cameras as whole-frame restores what the operator asked for: they put
-* that camera in the rule and then got nothing from it. On a rule that names NO
-* camera ("all devices") the same move would arm every camera on the hub —
-* including sixteen the operator never mentioned — and turn "notify me when
-* someone is in the driveway" into "notify me when someone is anywhere". That
-* is a notification flood, and floods are how a household turns notifications
-* off entirely.
-*
-* The rule editor takes zone ids as free text (`zoneIdList` / `zoneSelection`
-* tag inputs, no per-camera picker), so an all-devices rule carrying one
-* camera's zone ids is fully authorable and exists in the wild. Its zones stay
-* flat: the rule remains, as today, effectively about the camera that owns
-* those zones. Naming the cameras is the operator's way of asking for more.
+* "No zones set on a camera means everywhere." A zone in the list narrows ONLY
+* the camera that owns it; every other camera the rule reaches — named or
+* reached because the rule names no camera at all — matches whole-frame. The
+* first cut kept unscoped rules flat to avoid widening "notify me when someone
+* is in the driveway" into an all-camera rule; the operator overruled it: an
+* unscoped rule already IS an all-camera rule, and the zone is a per-camera
+* narrowing, not a rule-wide one. Scoping a rule to cameras remains the way to
+* limit where it fires.
 */
 function scopeZoneIdsForRule(input, owner) {
-	if (input.deviceScope === void 0 || input.deviceScope.length === 0) return UNCHANGED;
 	return scopeZoneIdsToDevice(input.ids, input.deviceId, owner);
 }
 //#endregion
@@ -3516,7 +3509,6 @@ var en_default = {
 		"other": "{{events}} stretches filmed at a dense cadence"
 	},
 	"timelapse.body.detections": "{{detectionSummary}}",
-	"timelapse.body.coverageWarning": "WARNING: recording available for only {{coverage}}% of the window",
 	"snooze.digest.title": {
 		"one": "Snooze ended — {{total}} notification hidden",
 		"other": "Snooze ended — {{total}} notifications hidden"
@@ -3548,7 +3540,20 @@ var en_default = {
 	"system.alarm-disarmed.body": "The alarm was disarmed",
 	"system.alarm-triggered.title": "ALARM",
 	"system.alarm-triggered.body": "The alarm was triggered",
-	"system.alarm-triggered.body.rule": "The alarm was triggered by {{rule}} on {{deviceName}}"
+	"system.alarm-triggered.body.rule": "The alarm was triggered by {{rule}} on {{deviceName}}",
+	"summary.title": "Summary — {{rule}}",
+	"summary.body.window": "{{from}}→{{to}}",
+	"summary.body.events": {
+		"one": "{{events}} event",
+		"other": "{{events}} events"
+	},
+	"summary.body.cameras": {
+		"one": "{{cameras}} camera",
+		"other": "{{cameras}} cameras"
+	},
+	"summary.body.detections": "{{detectionSummary}}",
+	"summary.body.truncated": "showing the {{shown}} most relevant of {{total}}",
+	"summary.body.empty": "nothing was seen in this window"
 };
 //#endregion
 //#region src/notification-center/texts/it.json
@@ -3645,7 +3650,6 @@ var it_default = {
 		"other": "{{events}} intervalli ripresi a cadenza fitta"
 	},
 	"timelapse.body.detections": "{{detectionSummary}}",
-	"timelapse.body.coverageWarning": "ATTENZIONE: registrazione disponibile solo per il {{coverage}}% della finestra",
 	"snooze.digest.title": {
 		"one": "Pausa terminata — {{total}} notifica nascosta",
 		"other": "Pausa terminata — {{total}} notifiche nascoste"
@@ -3677,7 +3681,20 @@ var it_default = {
 	"system.alarm-disarmed.body": "L'allarme è stato disattivato",
 	"system.alarm-triggered.title": "ALLARME",
 	"system.alarm-triggered.body": "L'allarme è scattato",
-	"system.alarm-triggered.body.rule": "L'allarme è scattato per {{rule}} su {{deviceName}}"
+	"system.alarm-triggered.body.rule": "L'allarme è scattato per {{rule}} su {{deviceName}}",
+	"summary.title": "Riepilogo — {{rule}}",
+	"summary.body.window": "{{from}}→{{to}}",
+	"summary.body.events": {
+		"one": "{{events}} evento",
+		"other": "{{events}} eventi"
+	},
+	"summary.body.cameras": {
+		"one": "{{cameras}} camera",
+		"other": "{{cameras}} camere"
+	},
+	"summary.body.detections": "{{detectionSummary}}",
+	"summary.body.truncated": "mostrati i {{shown}} più rilevanti su {{total}}",
+	"summary.body.empty": "nessun evento in questa finestra"
 };
 //#endregion
 //#region src/notification-center/text-catalog.ts
@@ -5752,7 +5769,7 @@ var NC_OCCUPANCY_INDEXES = [{
 }];
 /** Query cap — a per-(device, zone, class) key set is small; this is a
 *  generous ceiling that still bounds a pathological read. */
-var LOAD_LIMIT$1 = 1e5;
+var LOAD_LIMIT$2 = 1e5;
 var OccupancyStore = class {
 	cache = /* @__PURE__ */ new Map();
 	store;
@@ -5779,7 +5796,7 @@ var OccupancyStore = class {
 		try {
 			const records = await this.store.query.query({
 				collection: NC_OCCUPANCY_COLLECTION,
-				filter: { limit: LOAD_LIMIT$1 }
+				filter: { limit: LOAD_LIMIT$2 }
 			});
 			this.cache.clear();
 			let skipped = 0;
@@ -6370,6 +6387,18 @@ function entryToRow(entry) {
 		payload: entry.payload
 	};
 }
+/**
+* Every kind a persisted row may carry, for the READ path.
+*
+* This must list the WHOLE union. A kind missing here makes `rowToEntry` answer
+* `null`, and a `null` row is invisible three ways at once: it is not
+* re-hydrated as pending at boot (so a row still queued when the process
+* restarted is dropped on the floor), it never appears in `queryHistory`, and
+* it never appears in the recent-rows scan. `'timelapse'` was missing from this
+* set from the day it shipped — the live deliveries hid it, because an enqueue
+* hands the entry straight to the drain from memory and only a RESTART goes
+* through this function.
+*/
 var OUTBOX_RECORD_KINDS = new Set([
 	"object-event",
 	"track-end",
@@ -6377,7 +6406,9 @@ var OUTBOX_RECORD_KINDS = new Set([
 	"package-event",
 	"audio-event",
 	"audio-window",
-	"system-event"
+	"system-event",
+	"timelapse",
+	"ai-summary"
 ]);
 function isOutboxRecordKind(x) {
 	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
@@ -7978,10 +8009,18 @@ function clampToFloor(everyMs) {
 *
 * Pure — no clock, no I/O, no store. The scheduler hands over the tracks the
 * window actually contained (`pipelineAnalytics.listTracks`, which carry
-* `firstSeen`/`lastSeen`) and gets back ranges expressed as SECONDS FROM THE
-* WINDOW START, which is exactly the coordinate system
+* `firstSeen`/`lastSeen`) and gets back ranges expressed as WALL-CLOCK SECONDS
+* FROM THE WINDOW START, which is exactly the coordinate system
 * `ExportTimelapseSchema.dense.ranges` speaks.
 *
+* WALL clock is the load-bearing word. It is NOT ffmpeg's `t`: `t` runs over
+* the concatenation of the segments that exist, so every recording gap is
+* missing from it. The recorder translates one into the other at render time
+* (`export-dense-map.ts` in addon-pipeline), because only the side that builds
+* the source playlist knows where the gaps are. Handing `t` seconds from here
+* is impossible — a track knows when it happened, not how much footage
+* preceded it.
+*
 * Why post-hoc and not a live sampler: the footage already exists, the tracks
 * already exist, and the recorder already knows how to render a range. A live
 * sampler would hold a frame ring open for eight hours per camera to
@@ -8130,27 +8169,6 @@ function detectionTemplateVars(texts, counts) {
 * short video gets skipped too.
 */
 var COVERAGE_COMPLETE_SLACK_MS = 3e4;
-/**
-* Is this coverage worth a sentence in the notification body?
-*
-* TWO conditions, and the second one is the whole point: the shortfall must be
-* past the slack AND the figure the sentence would PRINT must itself be short.
-*
-* They came apart live on 2026-08-12. A 10 h window on device 615 was covered
-* to 35,858,961 / 36,000,000 ms — 2m21s missing, so `complete` was false — and
-* `percent` was `Math.round(99.608) = 100`. The body read *"ATTENZIONE:
-* registrazione disponibile solo per il 100% della finestra"*: a warning about
-* a complete window, which is worse than no warning at all. The operator
-* learns to skip that line, and the night the video really IS a quarter of the
-* window gets skipped with it.
-*
-* So the gate is tied to the number the reader sees. Reporting is the only
-* consumer of this predicate — {@link FootageCoverage.complete} still states
-* the physical fact for anything that needs it.
-*/
-function coverageWorthReporting(coverage) {
-	return !coverage.complete && coverage.percent < 100;
-}
 /** Merge + clamp + sum. */
 function footageCoverage(ranges, windowStartMs, windowEndMs) {
 	const windowMs = Math.max(0, windowEndMs - windowStartMs);
@@ -8222,7 +8240,7 @@ function pickProfile(ranges, window) {
 	return best;
 }
 /** `HH:MM`, for the export title an operator sees in the exports list. */
-function clockOf$1(atMs) {
+function clockOf$3(atMs) {
 	const d = new Date(atMs);
 	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
@@ -8315,7 +8333,7 @@ var TimelapseRenderer = class {
 				includeAudio: false,
 				maxLifeMs: TIMELAPSE_EXPORT_LIFE_MS,
 				deleteAfterDownload: false,
-				title: `${request.ruleName} ${clockOf$1(window.startMs)}→${clockOf$1(window.endMs)}`,
+				title: `${request.ruleName} ${clockOf$3(window.startMs)}→${clockOf$3(window.endMs)}`,
 				timelapse: {
 					everyMs,
 					outputFps: request.framerate,
@@ -8433,7 +8451,7 @@ var TimelapseRenderer = class {
 //#region src/notification-center/timelapse/timelapse-delivery.ts
 /** What a caller that counted nothing looks like — so `{{detections}}` renders
 *  `0` and `{{detectionSummary}}` renders empty, never the literal braces. */
-var NO_DETECTIONS = {
+var NO_DETECTIONS$1 = {
 	total: 0,
 	byClass: {},
 	classes: []
@@ -8445,41 +8463,40 @@ var NO_DETECTIONS = {
 * prose. A translator has nothing to say about it, and every key the guard has
 * to check is a key somebody can get wrong.
 */
-var BODY_SEPARATOR = " · ";
+var BODY_SEPARATOR$1 = " · ";
 /** `HH:MM` in the host timezone — the two numbers a body actually needs. */
-function clockOf(atMs) {
+function clockOf$2(atMs) {
 	const d = new Date(atMs);
 	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
 /** Template vocabulary. Deliberately the same NAMES the rule templates use
 *  (`camera`, `rule`, `time`) plus the timelapse-only ones. */
-function templateVars(input) {
+function templateVars$1(input) {
 	return {
 		camera: input.deviceName ?? `camera ${input.deviceId}`,
 		rule: input.ruleName,
-		from: clockOf(input.window.startMs),
-		to: clockOf(input.window.endMs),
-		time: clockOf(input.generatedAt),
+		from: clockOf$2(input.window.startMs),
+		to: clockOf$2(input.window.endMs),
+		time: clockOf$2(input.generatedAt),
 		coverage: String(input.coverage.percent),
 		events: String(input.denseRanges),
-		...detectionTemplateVars(input.texts, input.detections ?? NO_DETECTIONS)
+		...detectionTemplateVars(input.texts, input.detections ?? NO_DETECTIONS$1)
 	};
 }
 /**
 * The body an operator reads when he did not author one.
 *
-* The COVERAGE sentence is the load-bearing part and only appears when it
-* carries information: a video assembled from two of the eight hours it claims
-* to show is visually indistinguishable from a very quiet night, and shipping
-* it silently is how a three-hour recorder outage looks like nothing happened.
-* A complete window says nothing — a line every night is a line nobody reads.
-*
-* "Carries information" is {@link coverageWorthReporting} and not
-* `!coverage.complete`: the two disagree exactly when the printed percent
-* rounds up to 100, which is how this body once warned that the recording was
-* "available for only 100% of the window".
-*/
-function derivedBody(input, vars) {
+* **No coverage sentence.** It used to end with one whenever the window was
+* short, and it was removed on the operator's instruction: the clause fired on
+* every night the recorder had stumbled at all — including once at a printed
+* *100%* (2026-08-12, device 615: 141 s missing out of 10 h, so the window was
+* incomplete while the rounded figure was 100) — and a line that cries wolf is
+* a line the reader skips, which costs the clauses beside it too. The figure
+* is not lost: it rides the `timelapse produced` log line as `coveragePct`,
+* which is where a short video is diagnosed, and `{{coverage}}` still resolves
+* for an operator who puts it in a body HE wrote.
+*/
+function derivedBody$1(input, vars) {
 	const texts = input.texts;
 	const parts = [texts.text({
 		key: "timelapse.body.window",
@@ -8494,18 +8511,14 @@ function derivedBody(input, vars) {
 		count: input.denseRanges,
 		vars
 	}));
-	if ((input.detections ?? NO_DETECTIONS).total > 0) parts.push(texts.text({
+	if ((input.detections ?? NO_DETECTIONS$1).total > 0) parts.push(texts.text({
 		key: "timelapse.body.detections",
 		vars
 	}));
-	if (coverageWorthReporting(input.coverage)) parts.push(texts.text({
-		key: "timelapse.body.coverageWarning",
-		vars
-	}));
-	return parts.filter((part) => part.length > 0).join(BODY_SEPARATOR);
+	return parts.filter((part) => part.length > 0).join(BODY_SEPARATOR$1);
 }
 /** Per-target params with the derived `clickUrl` filled in where absent. */
-function paramsFor(target, clickUrl) {
+function paramsFor$1(target, clickUrl) {
 	if (clickUrl === void 0) return target.params;
 	if (target.params === void 0) return { clickUrl };
 	if (typeof target.params["clickUrl"] === "string") return target.params;
@@ -8529,8 +8542,8 @@ function timelapsePreviewText(input) {
 		camera: input.deviceName ?? `camera ${input.deviceId}`,
 		...input.ruleName !== void 0 ? { rule: input.ruleName } : {},
 		...input.window !== void 0 ? {
-			from: clockOf(input.window.startMs),
-			to: clockOf(input.window.endMs)
+			from: clockOf$2(input.window.startMs),
+			to: clockOf$2(input.window.endMs)
 		} : {}
 	};
 	return renderTemplate(input.text ?? "Timelapse {{camera}}", vars) ?? "";
@@ -8545,13 +8558,13 @@ function timelapseRecordId(deviceId, windowEndMs) {
 * @returns rows ready for `NcOutbox.enqueue` — never sent from here.
 */
 function buildTimelapseOutboxInputs(input) {
-	const vars = templateVars(input);
+	const vars = templateVars$1(input);
 	const optedOut = new Set(input.disabledTargetIds ?? []);
 	const title = renderTemplate(input.template?.title, vars) ?? input.texts.text({
 		key: "timelapse.title",
 		vars
 	});
-	const body = renderTemplate(input.template?.body, vars) ?? derivedBody(input, vars);
+	const body = renderTemplate(input.template?.body, vars) ?? derivedBody$1(input, vars);
 	const recordId = timelapseRecordId(input.deviceId, input.window.endMs);
 	const artifacts = [...input.preview !== void 0 ? [{
 		mediaType: "image",
@@ -8571,7 +8584,7 @@ function buildTimelapseOutboxInputs(input) {
 			},
 			media: "none",
 			...artifacts.length > 0 ? { artifacts } : {},
-			...paramsFor(target, input.clickUrl) !== void 0 ? { params: paramsFor(target, input.clickUrl) } : {},
+			...paramsFor$1(target, input.clickUrl) !== void 0 ? { params: paramsFor$1(target, input.clickUrl) } : {},
 			subject: {
 				deviceId: input.deviceId,
 				className: "timelapse",
@@ -8898,7 +8911,1784 @@ var NC_TIMELAPSE_RULES_COLUMNS = [
 		notNull: true
 	},
 	(
-	/** The FULL rule object (Zod-validated on read) — scalars above are
+	/** The FULL rule object (Zod-validated on read) — scalars above are
+	*  indexed projections only. */
+	{
+		name: "rule",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NC_TIMELAPSE_RULES_INDEXES = [{
+	name: "idx_nc_timelapse_rules_enabled",
+	columns: ["enabled"]
+}];
+/** Query cap — the rule set is operator-authored and tiny; a generous ceiling. */
+var LOAD_LIMIT$1 = 1e4;
+/**
+* Resolve the three-way `template` patch signal onto a merged rule, immutably:
+* `undefined` (key absent) leaves it as-is, `null` DROPS the key, an object
+* replaces it. Keeping `null` out of the persisted rule is what lets
+* `TimelapseRuleSchema` stay a plain `.optional()`.
+*/
+function applyTemplatePatch$1(merged, template) {
+	if (template === void 0) return merged;
+	if (template !== null) return {
+		...merged,
+		template
+	};
+	const { template: _cleared, ...withoutTemplate } = merged;
+	return withoutTemplate;
+}
+/** Narrowing guard — the persisted `rule` column is `unknown` until parsed. */
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var TimelapseStore = class {
+	byId = /* @__PURE__ */ new Map();
+	/**
+	* Birth stamps synthesised for LEGACY rows (see {@link withCreatedAt}), kept
+	* so a repeated `load()` re-uses the FIRST one. Without it the synthesised
+	* `createdAt` would advance to "now" on every refresh, and the scheduler's
+	* eligibility floor — which is `max(stamp, createdAt)` — would creep past
+	* every window such a rule was ever offered, silently producing nothing.
+	*/
+	synthesisedCreatedAt = /* @__PURE__ */ new Map();
+	store;
+	logger;
+	now;
+	newId;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.newId = deps.newId ?? (() => randomUUID());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_TIMELAPSE_RULES_COLLECTION,
+			columns: [...NC_TIMELAPSE_RULES_COLUMNS],
+			indexes: [...NC_TIMELAPSE_RULES_INDEXES]
+		});
+	}
+	/**
+	* (Re)hydrate the FULL rule set from the store — called at boot and on the
+	* periodic refresh tick. Replaces the cache wholesale; a row whose JSON no
+	* longer validates is skipped with a warning (a degraded rule must never
+	* crash the scheduler).
+	*/
+	async load() {
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_TIMELAPSE_RULES_COLLECTION,
+				filter: { limit: LOAD_LIMIT$1 }
+			});
+			this.byId.clear();
+			let skipped = 0;
+			let synthesised = 0;
+			for (const row of rows) {
+				const raw = this.withCreatedAt(row.id, row.data["rule"]);
+				if (raw !== row.data["rule"]) synthesised += 1;
+				const parsed = TimelapseRuleSchema.safeParse(raw);
+				if (!parsed.success) {
+					skipped += 1;
+					continue;
+				}
+				this.byId.set(parsed.data.id, parsed.data);
+			}
+			this.logger.debug("timelapse rules loaded", { meta: {
+				rules: this.byId.size,
+				...skipped > 0 ? { skippedInvalid: skipped } : {},
+				...synthesised > 0 ? { synthesisedCreatedAt: synthesised } : {}
+			} });
+		} catch (err) {
+			this.logger.warn("timelapse rules load failed", { meta: { error: String(err) } });
+		}
+	}
+	/**
+	* Give a persisted blob a `createdAt` if it has none, WITHOUT persisting
+	* anything: the rule reads as born at this load.
+	*
+	* `createdAt` has always been required by `TimelapseRuleSchema`, so a row
+	* without one is a pre-schema artefact — and before this it was dropped
+	* outright at load (a silently vanished rule). Reading it as "born now" is
+	* the conservative choice in BOTH directions that matter: the rule survives,
+	* and the scheduler's eligibility floor stops it back-filling a window that
+	* closed years before anyone looked at it. The cost is one skipped window if
+	* a legacy rule is loaded between a close and its settle — a bounded miss,
+	* against an unbounded retry of a window no footage can satisfy.
+	*
+	* The synthesised value is remembered per rule id so a later refresh does not
+	* move the floor, and the first `update`/`markGenerated` writes it through —
+	* after which the row is no longer legacy.
+	*/
+	withCreatedAt(rowId, raw) {
+		if (!isRecord$1(raw)) return raw;
+		if (typeof raw["createdAt"] === "number") return raw;
+		const stamped = this.synthesisedCreatedAt.get(rowId) ?? this.now();
+		this.synthesisedCreatedAt.set(rowId, stamped);
+		return {
+			...raw,
+			createdAt: stamped
+		};
+	}
+	/** Every rule, newest-first (admin path). */
+	list() {
+		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
+	}
+	/** The scheduler's read: only rules that should be ticked. */
+	listEnabled() {
+		return this.list().filter((r) => r.enabled);
+	}
+	get(ruleId) {
+		return this.byId.get(ruleId) ?? null;
+	}
+	/**
+	* Rules visible to `userId`: their OWN personal rules (`ownerUserId ===
+	* userId`) plus every admin/global rule (`ownerUserId` absent). Never another
+	* user's personal rows. Newest-first (inherits {@link list}).
+	*
+	* The caller identity is server-derived; an absent/undefined caller must be
+	* resolved to a fail-closed value by the bridge action BEFORE calling here —
+	* this store never treats a missing caller as admin/global.
+	*/
+	listForOwner(userId) {
+		return this.list().filter((r) => r.ownerUserId === void 0 || r.ownerUserId === userId);
+	}
+	/**
+	* Mutation gate for a NON-admin caller: true only for a PERSONAL rule this
+	* user owns. A global rule (no `ownerUserId`) returns false — global rules
+	* are admin-only, and the bridge action grants admins the mutation without
+	* consulting this check. An unknown rule id is false (fail-closed).
+	*/
+	isOwnedBy(ruleId, userId) {
+		const rule = this.byId.get(ruleId);
+		return rule?.ownerUserId !== void 0 && rule.ownerUserId === userId;
+	}
+	/**
+	* Create a rule. `createdBy` is the SERVER-injected caller userId;
+	* `ownerUserId` is the server-derived owner (omit for an admin/global rule).
+	* Neither is ever read from `input`.
+	*
+	* The input is re-parsed through {@link TimelapseRuleInputSchema} BEFORE the
+	* spread — that schema carries no ownership/provenance keys, so it strips any
+	* that rode in on the blob. Without it, an `ownerUserId` on `input` would
+	* survive whenever the `ownerUserId` ARGUMENT is omitted (the admin/global
+	* path): a `TimelapseRule` is structurally assignable to `TimelapseRuleInput`,
+	* so a future "duplicate rule" action (`create(existingRule, caller)`) would
+	* compile cleanly and silently clone the ORIGINAL owner.
+	*/
+	async create(input, createdBy, ownerUserId) {
+		const now = this.now();
+		const rule = TimelapseRuleSchema.parse({
+			...TimelapseRuleInputSchema.parse(input),
+			id: this.newId(),
+			...ownerUserId !== void 0 ? { ownerUserId } : {},
+			createdBy,
+			createdAt: now,
+			updatedAt: now
+		});
+		await this.persist(rule);
+		this.byId.set(rule.id, rule);
+		return rule;
+	}
+	/**
+	* Apply a partial patch. Immutable: returns the NEW rule object. Identity,
+	* ownership and generation state are re-pinned from the existing rule AFTER
+	* the spread — the patch schema carries none of them, and this makes a
+	* hand-built (unparsed) patch object equally unable to re-own a rule.
+	*
+	* `template` is the one clearable field: an absent key leaves it unchanged,
+	* an explicit `null` CLEARS it (the persisted rule loses the key — `null`
+	* never reaches {@link TimelapseRuleSchema}). See the patch schema's wire
+	* note.
+	*/
+	async update(ruleId, patch) {
+		const existing = this.byId.get(ruleId);
+		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
+		const { template, ...rest } = patch;
+		const merged = {
+			...existing,
+			...rest,
+			id: existing.id,
+			ownerUserId: existing.ownerUserId,
+			lastGeneratedAt: existing.lastGeneratedAt,
+			generatedByDevice: existing.generatedByDevice,
+			createdBy: existing.createdBy,
+			createdAt: existing.createdAt,
+			updatedAt: this.now()
+		};
+		return this.write(applyTemplatePatch$1(merged, template));
+	}
+	async setEnabled(ruleId, enabled) {
+		return this.update(ruleId, { enabled });
+	}
+	/**
+	* Record a successful generation for ONE camera of the rule. `at` is the
+	* generation epoch-ms — the durable state behind the re-generation guard.
+	* Does NOT bump `updatedAt` (a generation is not an edit of the rule).
+	*
+	* PER-DEVICE, and that is the whole point: a rule covering three cameras
+	* renders three videos, and stamping the rule when the first one succeeds
+	* tells the other two they are already done. Their night is then gone for
+	* good — a closed window does not come back. Call this ONLY after the export
+	* reached `ready` and the notification was enqueued; a failed render must
+	* leave the pair unstamped so the next tick can retry it.
+	*
+	* The rule-wide `lastGeneratedAt` is kept as the NEWEST of the stamps (what
+	* a UI shows) and never regresses when an older device generation lands.
+	*
+	* A rule that still carries only the LEGACY rule-wide stamp has its map
+	* SEEDED from it for every camera the rule covers, before the new stamp is
+	* applied — writing `{ [deviceId]: at }` alone would drop the other cameras
+	* to "never generated" and re-render them once.
+	*/
+	async markGenerated(ruleId, deviceId, at) {
+		const existing = this.byId.get(ruleId);
+		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
+		const seeded = {};
+		if (existing.generatedByDevice === void 0 && existing.lastGeneratedAt !== void 0) for (const id of existing.deviceIds) seeded[String(id)] = existing.lastGeneratedAt;
+		const generatedByDevice = {
+			...seeded,
+			...existing.generatedByDevice,
+			[String(deviceId)]: at
+		};
+		return this.write({
+			...existing,
+			generatedByDevice,
+			lastGeneratedAt: Math.max(existing.lastGeneratedAt ?? 0, at)
+		});
+	}
+	/** Idempotent delete — unknown ids are a no-op. */
+	async delete(ruleId) {
+		this.byId.delete(ruleId);
+		try {
+			await this.store.delete.mutate({
+				collection: NC_TIMELAPSE_RULES_COLLECTION,
+				key: ruleId
+			});
+		} catch (err) {
+			this.logger.warn("timelapse rule delete failed", { meta: {
+				ruleId,
+				error: String(err)
+			} });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	/**
+	* Re-validate a merged candidate, persist it, then cache it. Re-validating
+	* means a patch can never persist a rule that would be skipped at the next
+	* `load()`; provenance/ownership survive because they are spread from the
+	* existing rule and never present on a patch.
+	*/
+	async write(candidate) {
+		const rule = TimelapseRuleSchema.parse(candidate);
+		await this.persist(rule);
+		this.byId.set(rule.id, rule);
+		return rule;
+	}
+	async persist(rule) {
+		await this.store.set.mutate({
+			collection: NC_TIMELAPSE_RULES_COLLECTION,
+			key: rule.id,
+			value: {
+				name: rule.name,
+				enabled: rule.enabled,
+				updatedAt: rule.updatedAt,
+				rule
+			}
+		});
+	}
+};
+var NcSummaryCollector = class {
+	openTracks = /* @__PURE__ */ new Map();
+	/** First+last motion per camera SINCE that camera's last window close. The
+	*  union across a rule's cameras is what opens and keeps a window alive. */
+	motionByDevice = /* @__PURE__ */ new Map();
+	/** Per-rule motion window. Absent = no window open for that rule. */
+	motionByRule = /* @__PURE__ */ new Map();
+	/**
+	* Motion was observed on a camera. Called once per persisted object event —
+	* the cheapest true signal of "something is happening" this process has.
+	*
+	* `trackId` is optional because the slim event projection omits it; an event
+	* without one still counts as motion, it simply contributes no barrier entry.
+	*/
+	observeMotion(input) {
+		const previous = this.motionByDevice.get(input.deviceId);
+		this.motionByDevice.set(input.deviceId, previous === void 0 ? {
+			firstMotionMs: input.atMs,
+			lastMotionMs: input.atMs
+		} : {
+			firstMotionMs: Math.min(previous.firstMotionMs, input.atMs),
+			lastMotionMs: Math.max(previous.lastMotionMs, input.atMs)
+		});
+		if (input.trackId === void 0) return;
+		if (this.openTracks.has(input.trackId)) return;
+		if (this.openTracks.size >= 5e3) this.evictOldest();
+		this.openTracks.set(input.trackId, {
+			deviceId: input.deviceId,
+			openedAtMs: input.atMs
+		});
+	}
+	/** A track closed — the tracker's own single close point. */
+	observeTrackClosed(trackId) {
+		this.openTracks.delete(trackId);
+	}
+	/**
+	* The span of motion across these cameras since their last window close, or
+	* null when none of them has seen any.
+	*/
+	motionAcross(deviceIds) {
+		let first = Number.MAX_SAFE_INTEGER;
+		let last = 0;
+		for (const deviceId of deviceIds) {
+			const seen = this.motionByDevice.get(deviceId);
+			if (seen === void 0) continue;
+			if (seen.firstMotionMs < first) first = seen.firstMotionMs;
+			if (seen.lastMotionMs > last) last = seen.lastMotionMs;
+		}
+		return last === 0 ? null : {
+			firstMotionMs: first,
+			lastMotionMs: last
+		};
+	}
+	/**
+	* How many of this rule's cameras still have a track open that STARTED inside
+	* the window — the barrier's count.
+	*
+	* The `openedAtMs >= sinceMs` test is what stops a track that began hours
+	* before the window from holding it: that track is not part of this digest,
+	* and waiting for it would make a rule with one resident object undeliverable.
+	*/
+	openTrackCount(deviceIds, sinceMs) {
+		const wanted = new Set(deviceIds);
+		let count = 0;
+		for (const open of this.openTracks.values()) if (wanted.has(open.deviceId) && open.openedAtMs >= sinceMs) count += 1;
+		return count;
+	}
+	/** The ids behind {@link openTrackCount} — for the log line when the barrier
+	*  is broken, because "2 tracks" is not diagnosable and two ids are. */
+	openTrackIds(deviceIds, sinceMs) {
+		const wanted = new Set(deviceIds);
+		const out = [];
+		for (const [trackId, open] of this.openTracks) if (wanted.has(open.deviceId) && open.openedAtMs >= sinceMs) out.push(trackId);
+		return out;
+	}
+	/** The rule's currently open motion window, or null. */
+	motionWindow(ruleId) {
+		return this.motionByRule.get(ruleId) ?? null;
+	}
+	/**
+	* Bring a rule's motion window up to date against the observed motion.
+	*
+	* Opening and extending are the SAME operation seen from two states, so they
+	* are one function: a rule with no window that sees motion opens one at that
+	* instant; a rule with a window that sees newer motion extends it. Motion
+	* older than the window's own `lastMotionMs` changes nothing, which makes
+	* this idempotent and safe to call on every tick.
+	*/
+	refreshMotionWindow(ruleId, deviceIds) {
+		const motion = this.motionAcross(deviceIds);
+		if (motion === null) return this.motionByRule.get(ruleId) ?? null;
+		const existing = this.motionByRule.get(ruleId);
+		if (existing === void 0) {
+			const opened = {
+				openedAtMs: motion.firstMotionMs,
+				lastMotionMs: motion.lastMotionMs
+			};
+			this.motionByRule.set(ruleId, opened);
+			return opened;
+		}
+		if (motion.lastMotionMs <= existing.lastMotionMs) return existing;
+		const extended = {
+			...existing,
+			lastMotionMs: motion.lastMotionMs
+		};
+		this.motionByRule.set(ruleId, extended);
+		return extended;
+	}
+	/**
+	* Forget a rule's window — called once it has been produced (or abandoned).
+	*
+	* A camera whose last motion is at or before the close is cleared outright:
+	* it is quiet, and the next window should wait for it to move again. A camera
+	* still busy keeps its mark, and its `firstMotionMs` is CLAMPED to the close
+	* — which is what makes back-to-back windows on a permanently busy camera
+	* contiguous instead of overlapping. Without the clamp the next window would
+	* re-open at the original first motion and re-deliver the same passage.
+	*/
+	closeMotionWindow(ruleId, atMs) {
+		this.motionByRule.delete(ruleId);
+		for (const [deviceId, seen] of this.motionByDevice) {
+			if (seen.lastMotionMs <= atMs) {
+				this.motionByDevice.delete(deviceId);
+				continue;
+			}
+			if (seen.firstMotionMs < atMs) this.motionByDevice.set(deviceId, {
+				...seen,
+				firstMotionMs: atMs
+			});
+		}
+	}
+	/** Drop rules that no longer exist, so a deleted rule cannot leak a window. */
+	retainRules(ruleIds) {
+		const alive = new Set(ruleIds);
+		for (const ruleId of Array.from(this.motionByRule.keys())) if (!alive.has(ruleId)) this.motionByRule.delete(ruleId);
+	}
+	/**
+	* Drop tracks that were never closed. @returns how many were abandoned — a
+	* number that belongs on a log line, because a non-zero one means the close
+	* hook is missing closes and every barrier is silently degraded.
+	*/
+	sweep(nowMs) {
+		let dropped = 0;
+		for (const [trackId, open] of this.openTracks) if (nowMs - open.openedAtMs > 216e5) {
+			this.openTracks.delete(trackId);
+			dropped += 1;
+		}
+		return dropped;
+	}
+	/** Observability — the producer puts this on its tick line. */
+	stats() {
+		return {
+			openTracks: this.openTracks.size,
+			cameras: this.motionByDevice.size,
+			windows: this.motionByRule.size
+		};
+	}
+	evictOldest() {
+		let oldestId = null;
+		let oldestAt = Number.MAX_SAFE_INTEGER;
+		for (const [trackId, open] of this.openTracks) if (open.openedAtMs < oldestAt) {
+			oldestAt = open.openedAtMs;
+			oldestId = trackId;
+		}
+		if (oldestId !== null) this.openTracks.delete(oldestId);
+	}
+};
+/** The canvas behind a tile whose aspect does not fill its cell. */
+var MOSAIC_BACKGROUND = {
+	r: 17,
+	g: 17,
+	b: 17
+};
+/** Tile aspect — cameras are 16:9 and a square cell would letterbox every one. */
+var TILE_ASPECT = 9 / 16;
+/** Height of the per-tile label strip, as a fraction of the tile height. */
+var LABEL_BAND_FRACTION = .14;
+var LABEL_MIN_PX = 11;
+/** Height of the mosaic's own title band, as a fraction of a tile's height. */
+var TITLE_BAND_FRACTION = .22;
+var TITLE_MIN_PX = 16;
+/**
+* Average glyph width as a fraction of the font size, for bold sans-serif.
+*
+* An ESTIMATE, and it has to be: librsvg lays the text out long after this
+* string is written, so there are no metrics to measure against. The same
+* number and the same reasoning as `preview-frame.ts#fitTitle` — deliberately
+* GENEROUS, because a label that shrank slightly more than it had to is
+* invisible and one that overflowed runs into the tile beside it. The first
+* live mosaic did exactly that: `Videocamera cortile · 07:49 · animal` was cut
+* to `…· anima` at the tile edge, mid-word.
+*/
+var GLYPH_ADVANCE = .56;
+/** Fraction of the band a label may occupy, leaving the padding either side. */
+var LABEL_USABLE_FRACTION = .94;
+/** `<`, `>`, `&`, `'`, `"` in a camera name or an operator caption would each
+*  turn the overlay into a document librsvg refuses. */
+function escapeXml$2(s) {
+	return s.replace(/[<>&'"]/g, (ch) => {
+		switch (ch) {
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			case "&": return "&amp;";
+			case "'": return "&apos;";
+			default: return "&quot;";
+		}
+	});
+}
+/** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
+*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
+function mosaicGrid(n) {
+	const count = Math.max(1, Math.floor(n));
+	const cols = Math.ceil(Math.sqrt(count));
+	return {
+		cols,
+		rows: Math.ceil(count / cols)
+	};
+}
+/**
+* Where every tile lands. Pure — no bytes, no sharp, no clock.
+*
+* Exported because the rectangles are DATA the artefact should carry: a viewer
+* that wants a tappable mosaic reads these rather than re-deriving a layout
+* that could drift from the one actually rendered.
+*/
+function mosaicLayout(input) {
+	const { cols, rows } = mosaicGrid(input.tileCount);
+	const maxWidth = input.maxWidth ?? 1920;
+	const tileWidth = Math.max(160, Math.floor(maxWidth / cols));
+	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
+	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
+	const tiles = [];
+	for (let index = 0; index < Math.max(1, input.tileCount); index += 1) tiles.push({
+		index,
+		x: index % cols * tileWidth,
+		y: titleHeight + Math.floor(index / cols) * tileHeight,
+		w: tileWidth,
+		h: tileHeight
+	});
+	return {
+		width: cols * tileWidth,
+		height: titleHeight + rows * tileHeight,
+		cols,
+		rows,
+		tileWidth,
+		tileHeight,
+		titleHeight,
+		tiles
+	};
+}
+/**
+* Shrink, then ELIDE, until the line fits `usablePx`.
+*
+* Shrinking is tried first because a slightly smaller label still says
+* everything; only past `minPx` is the tail cut, and then with an ellipsis so
+* the reader can SEE that something was cut. The failure this replaces was
+* silent: SVG simply clips at the viewport, so an overlong label lost its last
+* word mid-glyph and looked like a rendering bug rather than a truncation.
+*
+* Pure and exported so the arithmetic is testable without rendering a pixel.
+*/
+function fitLine(text, usablePx, basePx, minPx) {
+	const flat = text.trim().replace(/\s+/g, " ");
+	const fits = (s, fontPx) => s.length * fontPx * GLYPH_ADVANCE <= usablePx;
+	let fontPx = Math.max(minPx, Math.round(basePx));
+	while (fontPx > minPx && !fits(flat, fontPx)) fontPx = Math.max(minPx, fontPx - 1);
+	if (fits(flat, fontPx)) return {
+		text: flat,
+		fontPx
+	};
+	const budget = Math.max(1, Math.floor(usablePx / (fontPx * GLYPH_ADVANCE)));
+	return {
+		text: `${flat.slice(0, Math.max(1, budget - 1)).trimEnd()}…`,
+		fontPx
+	};
+}
+/** The label strip drawn across the bottom of one tile. */
+function tileLabelSvg(width, height, label) {
+	const bandHeight = Math.max(18, Math.round(height * LABEL_BAND_FRACTION));
+	const basePx = Math.round(bandHeight * .62);
+	const padding = Math.round(basePx * .6);
+	const fitted = fitLine(label, width * LABEL_USABLE_FRACTION - padding, basePx, LABEL_MIN_PX);
+	const baseline = height - Math.round((bandHeight - fitted.fontPx) / 2) - Math.round(fitted.fontPx * .18);
+	return Buffer.from(`<svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
+  <rect x="0" y="${height - bandHeight}" width="${width}" height="${bandHeight}" fill="black" fill-opacity="0.55"/>
+  <text x="${padding}" y="${baseline}" font-size="${fitted.fontPx}" font-family="sans-serif" font-weight="bold" fill="white">${escapeXml$2(fitted.text)}</text>
+</svg>`);
+}
+/** The mosaic's own title band. */
+function titleSvg(width, height, caption) {
+	const fitted = fitLine(caption, width * LABEL_USABLE_FRACTION, Math.round(height * .5), TITLE_MIN_PX);
+	const baseline = Math.round(height / 2 + fitted.fontPx * .36);
+	return Buffer.from(`<svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
+  <rect x="0" y="0" width="${width}" height="${height}" fill="#111111"/>
+  <text x="${Math.round(width / 2)}" y="${baseline}" font-size="${fitted.fontPx}" font-family="sans-serif" font-weight="bold" text-anchor="middle" fill="white">${escapeXml$2(fitted.text)}</text>
+</svg>`);
+}
+/**
+* Compose the mosaic.
+*
+* Every tile is fitted with `contain` onto the cell background rather than
+* cropped: a `cover` fit would silently cut the subject out of a portrait crop,
+* and a tile that does not show what it is about is worse than a letterboxed
+* one.
+*
+* A tile sharp cannot read is DROPPED and counted, never composited as a blank
+* cell — a black square in a digest reads as "the camera saw nothing", which is
+* the opposite of what happened. The grid is recomputed from the survivors so
+* the mosaic has no hole.
+*
+* @throws only if sharp cannot produce the final canvas at all; the caller
+*         treats that as "no mosaic" and still delivers the counts.
+*/
+async function renderMosaic(request, logger) {
+	const decoded = [];
+	const probeLayout = mosaicLayout({
+		tileCount: Math.max(1, request.tiles.length),
+		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
+	});
+	for (const tile of request.tiles) try {
+		const resized = await sharp(tile.jpeg).resize({
+			width: probeLayout.tileWidth,
+			height: probeLayout.tileHeight,
+			fit: "contain",
+			background: MOSAIC_BACKGROUND
+		}).composite([{
+			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, tile.label),
+			top: 0,
+			left: 0
+		}]).jpeg({ quality: 82 }).toBuffer();
+		decoded.push({
+			tile,
+			resized
+		});
+	} catch (err) {
+		logger.warn("summary mosaic: a tile could not be decoded and was dropped", {
+			tags: { deviceId: tile.deviceId },
+			meta: {
+				trackId: tile.trackId,
+				error: String(err)
+			}
+		});
+	}
+	const droppedTiles = request.tiles.length - decoded.length;
+	const caption = request.caption?.trim() ?? "";
+	const layout = mosaicLayout({
+		tileCount: Math.max(1, decoded.length),
+		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
+		withTitle: caption.length > 0
+	});
+	const composites = await Promise.all(decoded.map(async ({ resized }, index) => ({
+		input: layout.tileWidth === probeLayout.tileWidth && layout.tileHeight === probeLayout.tileHeight ? resized : await sharp(resized).resize({
+			width: layout.tileWidth,
+			height: layout.tileHeight,
+			fit: "contain",
+			background: MOSAIC_BACKGROUND
+		}).jpeg({ quality: 82 }).toBuffer(),
+		top: layout.tiles[index]?.y ?? 0,
+		left: layout.tiles[index]?.x ?? 0
+	})));
+	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
+		input: titleSvg(layout.width, layout.titleHeight, caption),
+		top: 0,
+		left: 0
+	});
+	return {
+		jpeg: await sharp({ create: {
+			width: layout.width,
+			height: layout.height,
+			channels: 3,
+			background: MOSAIC_BACKGROUND
+		} }).composite(composites).jpeg({ quality: 82 }).toBuffer(),
+		layout,
+		droppedTiles
+	};
+}
+//#endregion
+//#region src/notification-center/summary/summary-delivery.ts
+var NO_DETECTIONS = {
+	total: 0,
+	byClass: {},
+	classes: []
+};
+/** Punctuation, not prose — a module constant rather than a catalog key,
+*  because a translator has nothing to say about it and every key the guard
+*  has to check is a key somebody can get wrong. */
+var BODY_SEPARATOR = " · ";
+/** `HH:MM` in the host timezone. */
+function clockOf$1(atMs) {
+	const d = new Date(atMs);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+/** Template vocabulary. Deliberately the SAME names the detection and timelapse
+*  bodies use (`rule`, `from`, `to`, `time`) plus the digest-only ones. */
+function templateVars(input) {
+	return {
+		rule: input.ruleName,
+		from: clockOf$1(input.window.startMs),
+		to: clockOf$1(input.window.endMs),
+		time: clockOf$1(input.generatedAt),
+		events: String(input.tileCount),
+		cameras: String(input.cameraCount),
+		matched: String(input.matchedCount),
+		shown: String(input.tileCount),
+		total: String(input.matchedCount),
+		...detectionTemplateVars(input.texts, input.detections ?? NO_DETECTIONS)
+	};
+}
+/**
+* The body an operator reads when he did not write one.
+*
+* Every clause is a catalog key with real CLDR plurals rather than a template
+* string, for the reason the timelapse learned: a hand-rolled `n === 1` shipped
+* "1 intervalli ripresi" to a live phone.
+*/
+function derivedBody(input, vars) {
+	const texts = input.texts;
+	const parts = [texts.text({
+		key: "summary.body.window",
+		vars
+	})];
+	if (input.tileCount === 0) {
+		parts.push(texts.text({
+			key: "summary.body.empty",
+			vars
+		}));
+		return parts.filter((p) => p.length > 0).join(BODY_SEPARATOR);
+	}
+	parts.push(texts.text({
+		key: "summary.body.events",
+		count: input.tileCount,
+		vars
+	}));
+	parts.push(texts.text({
+		key: "summary.body.cameras",
+		count: input.cameraCount,
+		vars
+	}));
+	if ((input.detections ?? NO_DETECTIONS).total > 0) parts.push(texts.text({
+		key: "summary.body.detections",
+		vars
+	}));
+	if (input.matchedCount > input.tileCount) parts.push(texts.text({
+		key: "summary.body.truncated",
+		vars
+	}));
+	return parts.filter((p) => p.length > 0).join(BODY_SEPARATOR);
+}
+/** Per-target params with the derived `clickUrl` filled in where absent. A
+*  value the operator set on the target WINS — he chose it. */
+function paramsFor(target, clickUrl) {
+	if (clickUrl === void 0) return target.params;
+	if (target.params === void 0) return { clickUrl };
+	if (typeof target.params["clickUrl"] === "string") return target.params;
+	return {
+		...target.params,
+		clickUrl
+	};
+}
+/** Stable, retry-safe outbox record id for one closed window of one rule. */
+function summaryRecordId(ruleId, windowEndMs) {
+	return `summary:${ruleId}:${windowEndMs}`;
+}
+/** The caption burned onto the mosaic's title band, with the same `{{var}}`
+*  vocabulary the title and body use. `''` is a real answer ("no caption"). */
+function summaryCaptionText(input) {
+	if (input.captionText === void 0) return `${input.ruleName} — ${clockOf$1(input.window.startMs)}→${clockOf$1(input.window.endMs)}`;
+	return renderTemplate(input.captionText, {
+		rule: input.ruleName,
+		from: clockOf$1(input.window.startMs),
+		to: clockOf$1(input.window.endMs)
+	}) ?? "";
+}
+/**
+* One outbox row per (still-enabled) target.
+*
+* @returns rows ready for `NcOutbox.enqueue` — never sent from here.
+*/
+function buildSummaryOutboxInputs(input) {
+	const vars = templateVars(input);
+	const optedOut = new Set(input.disabledTargetIds ?? []);
+	const title = renderTemplate(input.template?.title, vars) ?? input.texts.text({
+		key: "summary.title",
+		vars
+	});
+	const body = renderTemplate(input.template?.body, vars) ?? derivedBody(input, vars);
+	const recordId = summaryRecordId(input.ruleId, input.window.endMs);
+	const artifacts = input.mosaic !== void 0 ? [{
+		mediaType: "image",
+		...input.mosaic
+	}] : [];
+	return input.targets.filter((t) => !optedOut.has(t.targetId)).map((target) => {
+		const payload = {
+			ruleName: input.ruleName,
+			delivery: "ai-summary",
+			priority: input.priority,
+			template: {
+				title,
+				body
+			},
+			media: "none",
+			...artifacts.length > 0 ? { artifacts } : {},
+			...paramsFor(target, input.clickUrl) !== void 0 ? { params: paramsFor(target, input.clickUrl) } : {},
+			subject: {
+				deviceId: input.primaryDeviceId,
+				className: "summary",
+				zones: [],
+				timestamp: input.window.endMs
+			}
+		};
+		return {
+			ruleId: input.ruleId,
+			targetId: target.targetId,
+			deviceId: input.primaryDeviceId,
+			recordKind: "ai-summary",
+			recordId,
+			payload
+		};
+	});
+}
+//#endregion
+//#region src/notification-center/summary/summary-selection.ts
+/**
+* Which tracks become tiles — filter, rank, and the per-camera quota.
+*
+* Pure. No clock, no store, no I/O: a window's whole selection is a function of
+* the candidate list and the rule, which is what makes the quota provable
+* rather than plausible.
+*
+* ## The quota, and what it is protecting
+*
+* A multi-camera digest in which two of six cameras never appear is not a
+* multi-camera digest — it is a busy camera's digest with five names on it. The
+* driveway that sees forty passes a night would take every tile of a 3×3 grid
+* by pure ranking, every single night, and the operator would conclude the
+* other cameras were broken.
+*
+* So the first pass gives EVERY contributing camera its single best track,
+* cheapest-first in the rule's own rank order, and only the remaining slots go
+* to the global ranking. When there are more contributing cameras than tiles
+* the quota degrades honestly: the best cameras get their one tile, the rest
+* are counted as dropped and the count rides the log line — never silently.
+*
+* ## Zones are scoped PER CAMERA
+*
+* `filters.zones` is a flat id list on a rule that spans cameras, and zone ids
+* are unique per camera. Evaluated flatly, picking a zone on camera A mutes
+* camera B forever: B's tracks can never visit A's polygon. `zone-ownership.ts`
+* is the one place that turns "the rule's ids" into "the ids that apply to THIS
+* camera", and it is reused here rather than re-derived — including its
+* fail-closed posture, where an ownership lookup that could not answer leaves
+* the flat behaviour untouched instead of widening the rule.
+*/
+function classesOf(candidate) {
+	const extra = candidate.classes ?? [];
+	return extra.includes(candidate.className) ? extra : [candidate.className, ...extra];
+}
+function dwellSeconds(candidate) {
+	return Math.max(0, candidate.lastSeen - candidate.firstSeen) / 1e3;
+}
+/**
+* Apply the rule's filters. Counting every drop reason is not decoration: the
+* question an operator asks about a digest is always "why is it empty", and a
+* branch that discards work silently reads as "it never happened".
+*/
+function filterSummaryCandidates(candidates, filters, zoneOwner) {
+	if (filters === void 0) return {
+		kept: [...candidates],
+		droppedByClass: 0,
+		droppedByZone: 0,
+		droppedByImportance: 0,
+		droppedByDwell: 0
+	};
+	const include = filters.classes;
+	const exclude = new Set(filters.classesExclude ?? []);
+	const kept = [];
+	let droppedByClass = 0;
+	let droppedByZone = 0;
+	let droppedByImportance = 0;
+	let droppedByDwell = 0;
+	for (const candidate of candidates) {
+		const own = classesOf(candidate);
+		if (own.some((c) => exclude.has(c))) {
+			droppedByClass += 1;
+			continue;
+		}
+		if (include !== void 0 && include.length > 0 && !own.some((c) => include.includes(c))) {
+			droppedByClass += 1;
+			continue;
+		}
+		const wantedZones = filters.zones;
+		if (wantedZones !== void 0 && wantedZones.length > 0) {
+			const scope = scopeZoneIdsToDevice(wantedZones, candidate.deviceId, zoneOwner);
+			if (scope.kind !== "inert") {
+				const ids = scope.kind === "scoped" ? scope.ids : wantedZones;
+				if (!candidate.zones.some((z) => ids.includes(z))) {
+					droppedByZone += 1;
+					continue;
+				}
+			}
+		}
+		if (filters.minImportance !== void 0 && (candidate.importance ?? 0) < filters.minImportance) {
+			droppedByImportance += 1;
+			continue;
+		}
+		if (filters.minDwellSeconds !== void 0 && dwellSeconds(candidate) < filters.minDwellSeconds) {
+			droppedByDwell += 1;
+			continue;
+		}
+		kept.push(candidate);
+	}
+	return {
+		kept,
+		droppedByClass,
+		droppedByZone,
+		droppedByImportance,
+		droppedByDwell
+	};
+}
+/**
+* The rank value, higher is better. Ties break on `trackId` so a selection is
+* REPRODUCIBLE — two runs over the same window must produce the same mosaic,
+* or a retry after a failed publish silently changes what was delivered.
+*/
+function rankValue(candidate, rank) {
+	switch (rank) {
+		case "importance": return candidate.importance ?? 0;
+		case "recency": return candidate.lastSeen;
+		case "dwell": return candidate.lastSeen - candidate.firstSeen;
+	}
+}
+function byRankDesc(rank) {
+	return (a, b) => {
+		const delta = rankValue(b, rank) - rankValue(a, rank);
+		return delta !== 0 ? delta : a.trackId.localeCompare(b.trackId);
+	};
+}
+/**
+* Choose the tiles: one guaranteed slot per contributing camera first, then the
+* global ranking for what remains.
+*/
+function selectSummaryTiles(candidates, opts) {
+	const sorted = candidates.toSorted(byRankDesc(opts.rank));
+	const byDevice = /* @__PURE__ */ new Map();
+	for (const candidate of sorted) {
+		const bucket = byDevice.get(candidate.deviceId);
+		if (bucket === void 0) byDevice.set(candidate.deviceId, [candidate]);
+		else bucket.push(candidate);
+	}
+	const chosen = [];
+	const taken = /* @__PURE__ */ new Set();
+	const servedDevices = /* @__PURE__ */ new Set();
+	for (const candidate of sorted) {
+		if (chosen.length >= opts.maxTiles) break;
+		if (servedDevices.has(candidate.deviceId)) continue;
+		servedDevices.add(candidate.deviceId);
+		taken.add(candidate.trackId);
+		chosen.push(candidate);
+	}
+	for (const candidate of sorted) {
+		if (chosen.length >= opts.maxTiles) break;
+		if (taken.has(candidate.trackId)) continue;
+		taken.add(candidate.trackId);
+		chosen.push(candidate);
+	}
+	const tiles = chosen.toSorted((a, b) => a.firstSeen !== b.firstSeen ? a.firstSeen - b.firstSeen : a.trackId.localeCompare(b.trackId));
+	return {
+		tiles,
+		camerasContributing: byDevice.size,
+		camerasDropped: byDevice.size - servedDevices.size,
+		overflow: Math.max(0, candidates.length - tiles.length)
+	};
+}
+/**
+* The media a tile is drawn from, best first.
+*
+* `keyFrameSmall` heads the ladder because it is the CLEAN best-shot frame at
+* 960 px — the whole scene, legible on a phone, cheap. `fullFrameBoxed` and
+* `firstFrame` are deliberately absent: a drawn rectangle is a permanent lie in
+* a digest tile, the operator asked for a mosaic that is ALWAYS CLEAN, and (for
+* P2) a box burnt into a pixel is text inside an image — an injection channel
+* and a source of hallucination. Boxes stay data.
+*/
+var SUMMARY_MEDIA_LADDER = [
+	"keyFrameSmall",
+	"keyFrame",
+	"snapshot",
+	"fullFrame",
+	"thumbnailSmall",
+	"thumbnail"
+];
+/**
+* Pick ONE media row for a track — the cheap question first (index rows only),
+* so exactly one blob is ever read.
+*
+* Within a rung the row CLOSEST to the track's peak is chosen; `snapshot` is a
+* filmstrip and its rows accumulate, so "the first one" would systematically
+* pick the moment the subject entered rather than the moment it was best seen.
+*/
+function pickSummaryMedia(rows, aroundMs) {
+	for (const rung of SUMMARY_MEDIA_LADDER) {
+		const matches = rows.filter((row) => row.kind === rung);
+		if (matches.length === 0) continue;
+		return matches.reduce((best, row) => Math.abs(row.timestamp - aroundMs) < Math.abs(best.timestamp - aroundMs) ? row : best);
+	}
+	return null;
+}
+//#endregion
+//#region src/notification-center/summary/summary-window.ts
+/**
+* The instant an open motion window closes — computable BEFORE it happens,
+* which is what makes the barrier deadline derivable rather than stateful.
+*
+* `min(quiet, ceiling)`: whichever bound arrives first wins, and the ceiling is
+* the one that guarantees termination.
+*/
+function motionWindowCloseAt(open, bounds) {
+	const quietCloseAt = open.lastMotionMs + bounds.quietMs;
+	const hardCloseAt = open.openedAtMs + bounds.maxWindowMs;
+	return hardCloseAt <= quietCloseAt ? {
+		closeAtMs: hardCloseAt,
+		cappedByCeiling: true
+	} : {
+		closeAtMs: quietCloseAt,
+		cappedByCeiling: false
+	};
+}
+/**
+* The one decision, shared by both window kinds.
+*
+* A `schedule` rule passes the schedule's close as `closeAtMs`; a `motion` rule
+* passes {@link motionWindowCloseAt}. From there the barrier logic is
+* identical, which is the point: the operator asked for the barrier on the
+* digest, not on one flavour of it.
+*/
+function decideSummaryWindow(input) {
+	if (input.nowMs < input.closeAtMs) return { kind: "collecting" };
+	const deadlineMs = input.closeAtMs + input.barrierMs;
+	if (input.openTracks > 0 && input.nowMs < deadlineMs) return {
+		kind: "barrier",
+		openTracks: input.openTracks,
+		deadlineMs
+	};
+	return {
+		kind: "ready",
+		window: {
+			startMs: input.openedAtMs,
+			endMs: input.closeAtMs
+		},
+		barrierBroken: input.openTracks,
+		cappedByCeiling: input.cappedByCeiling === true
+	};
+}
+/**
+* How many tracks ONE window may read, per camera.
+*
+* `queryHistorical` defaults to `limit ?? 50`, and at that default a busy night
+* would have planned the digest from the fifty most recent tracks and reported
+* "50" for a night that held four hundred. The timelapse hit exactly this.
+*/
+var SUMMARY_TRACK_QUERY_LIMIT = 2e3;
+/** The mosaic's owner id in the media store — see {@link NcSummaryPorts.storeMosaic}. */
+function summaryMediaOwnerId(ruleId, windowEndMs) {
+	return `summary-${ruleId}-${windowEndMs}`;
+}
+var EMPTY_REPORT = {
+	produced: 0,
+	collecting: 0,
+	barrier: 0,
+	beforeFloor: 0,
+	failed: 0,
+	idle: 0,
+	empty: 0
+};
+/**
+* The earliest window CLOSE a rule may ever be offered.
+*
+* RULE-level, because a digest's output is rule-level: unlike the timelapse
+* there is no per-camera artefact a shared stamp could destroy.
+*/
+function summaryEligibilityFloor(rule) {
+	return Math.max(rule.generatedAt ?? 0, rule.createdAt);
+}
+var NcSummaryProducer = class {
+	deps;
+	timer = null;
+	tickInFlight = false;
+	settleMs;
+	lookbackMs;
+	tickMs;
+	texts;
+	constructor(deps) {
+		this.deps = deps;
+		this.settleMs = deps.settleMs ?? 3e5;
+		this.lookbackMs = deps.lookbackMs ?? 6912e5;
+		this.tickMs = deps.tickMs ?? 6e4;
+		this.texts = deps.texts ?? new NcTextCatalog();
+	}
+	async start() {
+		await this.tick();
+		this.timer = setInterval(() => {
+			this.tick();
+		}, this.tickMs);
+	}
+	stop() {
+		if (this.timer !== null) {
+			clearInterval(this.timer);
+			this.timer = null;
+		}
+	}
+	/**
+	* One pass over every enabled rule. SINGLE-FLIGHT, and that is the only thing
+	* bounding concurrency on this path: ten rules whose windows close together
+	* must not open ten simultaneous render/publish sequences.
+	*/
+	async tick() {
+		if (this.tickInFlight) return EMPTY_REPORT;
+		this.tickInFlight = true;
+		const report = { ...EMPTY_REPORT };
+		try {
+			const now = this.deps.now();
+			const rules = this.deps.store.listEnabled();
+			this.deps.collector.retainRules(rules.map((r) => r.id));
+			const abandoned = this.deps.collector.sweep(now);
+			if (abandoned > 0) this.deps.logger.warn("summary collector abandoned tracks that never closed", { meta: {
+				abandoned,
+				...this.deps.collector.stats()
+			} });
+			for (const rule of rules) await this.tickRule(rule, now, report);
+		} finally {
+			this.tickInFlight = false;
+		}
+		return report;
+	}
+	/**
+	* The operator's Test button: produce the given window right now, ignoring
+	* the settle, the barrier and the floor.
+	*
+	* It DELIVERS — same as `nc.injectTestEvent` and `nc.testTimelapseRule`, for
+	* the same reason: a test that stops short of the notifier does not test the
+	* thing that breaks. It deliberately does NOT stamp, so pressing Test at noon
+	* cannot cancel tonight's scheduled run.
+	*/
+	async runNow(input) {
+		const rule = this.deps.store.get(input.ruleId);
+		if (rule === null) throw new Error(`summary rule not found: ${input.ruleId}`);
+		const window = input.window ?? this.lastClosedWindow(rule, this.deps.now());
+		if (window === null) return {
+			produced: 0,
+			window: null,
+			error: "no window has closed recently for this rule"
+		};
+		return this.produce(rule, window, {
+			stamp: false,
+			deliverEmpty: true
+		});
+	}
+	async tickRule(rule, now, report) {
+		const decision = this.decide(rule, now);
+		if (decision === null) {
+			report.idle += 1;
+			return;
+		}
+		if (decision.kind === "collecting") {
+			report.collecting += 1;
+			return;
+		}
+		if (decision.kind === "barrier") {
+			report.barrier += 1;
+			this.deps.logger.debug("summary window waiting for its tracks to close", { meta: {
+				ruleId: rule.id,
+				openTracks: decision.openTracks,
+				deadlineMs: decision.deadlineMs,
+				trackIds: this.deps.collector.openTrackIds(rule.deviceIds, decision.deadlineMs - rule.barrierSeconds * 1e3).join(",")
+			} });
+			return;
+		}
+		if (summaryEligibilityFloor(rule) >= decision.window.endMs) {
+			report.beforeFloor += 1;
+			this.deps.logger.debug("summary window predates the rule — not attempted", { meta: {
+				ruleId: rule.id,
+				windowStart: decision.window.startMs,
+				windowEnd: decision.window.endMs,
+				createdAt: rule.createdAt
+			} });
+			if (rule.window.kind === "motion") this.deps.collector.closeMotionWindow(rule.id, decision.window.endMs);
+			return;
+		}
+		if (decision.barrierBroken > 0) this.deps.logger.warn("summary barrier expired with tracks still open", { meta: {
+			ruleId: rule.id,
+			stillOpen: decision.barrierBroken,
+			windowEnd: decision.window.endMs,
+			barrierSeconds: rule.barrierSeconds
+		} });
+		const outcome = await this.produce(rule, decision.window, {
+			stamp: true,
+			deliverEmpty: rule.deliverEmpty
+		});
+		if (rule.window.kind === "motion") this.deps.collector.closeMotionWindow(rule.id, decision.window.endMs);
+		if (outcome.error !== void 0) report.failed += 1;
+		else if (outcome.produced > 0) report.produced += 1;
+		else report.empty += 1;
+	}
+	/** Which window (if any) this rule is standing at, and whether it may run. */
+	decide(rule, now) {
+		const barrierMs = rule.barrierSeconds * 1e3;
+		if (rule.window.kind === "schedule") {
+			const window = findLastClosedWindow({
+				schedule: rule.window.schedule,
+				nowMs: now,
+				lookbackMs: this.lookbackMs
+			});
+			if (window === null) return null;
+			return decideSummaryWindow({
+				openedAtMs: window.startMs,
+				closeAtMs: window.endMs,
+				openTracks: this.deps.collector.openTrackCount(rule.deviceIds, window.startMs),
+				barrierMs,
+				nowMs: now - this.settleMs
+			});
+		}
+		const open = this.deps.collector.refreshMotionWindow(rule.id, rule.deviceIds);
+		if (open === null) return null;
+		const close = motionWindowCloseAt(open, {
+			quietMs: rule.window.quietSeconds * 1e3,
+			maxWindowMs: rule.window.maxWindowSeconds * 1e3
+		});
+		return decideSummaryWindow({
+			openedAtMs: open.openedAtMs,
+			closeAtMs: close.closeAtMs,
+			openTracks: this.deps.collector.openTrackCount(rule.deviceIds, open.openedAtMs),
+			barrierMs,
+			nowMs: now,
+			cappedByCeiling: close.cappedByCeiling
+		});
+	}
+	lastClosedWindow(rule, now) {
+		if (rule.window.kind === "schedule") return findLastClosedWindow({
+			schedule: rule.window.schedule,
+			nowMs: now,
+			lookbackMs: this.lookbackMs
+		});
+		const open = this.deps.collector.motionWindow(rule.id);
+		if (open !== null) return {
+			startMs: open.openedAtMs,
+			endMs: now
+		};
+		return {
+			startMs: now - rule.window.maxWindowSeconds * 1e3,
+			endMs: now
+		};
+	}
+	/**
+	* Collect → select → read → render → publish → enqueue → (optionally) stamp.
+	* Never throws.
+	*/
+	async produce(rule, window, opts) {
+		const meta = {
+			ruleId: rule.id,
+			deviceIds: rule.deviceIds.join(","),
+			windowStart: window.startMs,
+			windowEnd: window.endMs
+		};
+		try {
+			const candidates = await this.collectCandidates(rule, window);
+			const filtered = filterSummaryCandidates(candidates, rule.filters, this.deps.zoneOwner);
+			const selection = selectSummaryTiles(filtered.kept, {
+				maxTiles: rule.maxTiles,
+				rank: rule.rank
+			});
+			if (selection.tiles.length === 0 && !opts.deliverEmpty) {
+				this.deps.logger.info("summary window held nothing — not delivered", { meta: {
+					...meta,
+					scanned: candidates.length,
+					droppedByClass: filtered.droppedByClass,
+					droppedByZone: filtered.droppedByZone,
+					droppedByImportance: filtered.droppedByImportance,
+					droppedByDwell: filtered.droppedByDwell
+				} });
+				if (opts.stamp) await this.deps.store.markGenerated(rule.id, window.endMs);
+				return {
+					produced: 0,
+					window,
+					tiles: 0,
+					cameras: 0,
+					matched: 0
+				};
+			}
+			const loaded = await this.loadTiles(rule, selection.tiles);
+			const detections = countDetections({ tracks: selection.tiles.map((t) => ({
+				firstSeen: t.firstSeen,
+				lastSeen: t.lastSeen,
+				className: t.className
+			})) });
+			const mosaic = await this.renderAndPublish(rule, window, loaded);
+			const rows = buildSummaryOutboxInputs({
+				texts: this.texts,
+				ruleId: rule.id,
+				ruleName: rule.name,
+				window,
+				deviceIds: rule.deviceIds,
+				primaryDeviceId: rule.deviceIds[0] ?? 0,
+				targets: rule.targets,
+				...this.deps.disabledTargetIds !== void 0 ? { disabledTargetIds: this.deps.disabledTargetIds(rule.id) } : {},
+				priority: rule.priority,
+				tileCount: loaded.length,
+				cameraCount: new Set(loaded.map((t) => t.candidate.deviceId)).size,
+				matchedCount: filtered.kept.length,
+				detections,
+				...mosaic.ref !== null ? { mosaic: mosaic.ref } : {},
+				generatedAt: this.deps.now(),
+				...rule.template !== void 0 ? { template: rule.template } : {}
+			});
+			const enqueued = await this.deps.enqueue(rows);
+			if (opts.stamp) await this.deps.store.markGenerated(rule.id, window.endMs);
+			this.deps.logger.info("summary produced", { meta: {
+				...meta,
+				scanned: candidates.length,
+				matched: filtered.kept.length,
+				tiles: loaded.length,
+				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
+				camerasDropped: selection.camerasDropped,
+				droppedNoMedia: selection.tiles.length - loaded.length,
+				mosaicBytes: mosaic.bytes,
+				mosaicPublished: mosaic.ref !== null,
+				enqueued,
+				stamped: opts.stamp
+			} });
+			return {
+				produced: 1,
+				window,
+				tiles: loaded.length,
+				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
+				matched: filtered.kept.length,
+				enqueued,
+				...mosaic.bytes > 0 ? { mosaicBytes: mosaic.bytes } : {},
+				...mosaic.ref !== null ? { mosaicUrl: mosaic.ref.url } : {}
+			};
+		} catch (err) {
+			this.deps.logger.warn("summary not produced — the window stays eligible", { meta: {
+				...meta,
+				error: String(err)
+			} });
+			return {
+				produced: 0,
+				window,
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
+	/** Every camera's tracks in the window, capped per camera and counted. */
+	async collectCandidates(rule, window) {
+		const all = [];
+		for (const deviceId of rule.deviceIds) try {
+			const rows = await this.deps.listTracks({
+				deviceId,
+				sinceMs: window.startMs,
+				untilMs: window.endMs,
+				limit: SUMMARY_TRACK_QUERY_LIMIT
+			});
+			if (rows.length >= 2e3) this.deps.logger.warn("summary track scan hit the per-camera ceiling", {
+				tags: { deviceId },
+				meta: {
+					ruleId: rule.id,
+					limit: SUMMARY_TRACK_QUERY_LIMIT
+				}
+			});
+			all.push(...rows);
+		} catch (err) {
+			this.deps.logger.warn("summary could not read a camera for this window", {
+				tags: { deviceId },
+				meta: {
+					ruleId: rule.id,
+					error: String(err)
+				}
+			});
+		}
+		return all;
+	}
+	/** One blob per tile — the cheap question (index rows) always first. */
+	async loadTiles(rule, tiles) {
+		const out = [];
+		for (const candidate of tiles) {
+			const tags = { deviceId: candidate.deviceId };
+			try {
+				const rows = await this.deps.listMediaInfo(candidate.trackId);
+				const picked = pickSummaryMedia(rows, (candidate.firstSeen + candidate.lastSeen) / 2);
+				if (picked === null) {
+					this.deps.logger.debug("summary tile dropped: the track carries no clean media", {
+						tags,
+						meta: {
+							ruleId: rule.id,
+							trackId: candidate.trackId,
+							mediaRows: rows.length
+						}
+					});
+					continue;
+				}
+				const jpeg = await this.deps.readMedia(picked.key);
+				if (jpeg === null || jpeg.byteLength === 0) {
+					this.deps.logger.debug("summary tile dropped: the media blob could not be read", {
+						tags,
+						meta: {
+							ruleId: rule.id,
+							trackId: candidate.trackId,
+							mediaKey: picked.key
+						}
+					});
+					continue;
+				}
+				out.push({
+					candidate,
+					jpeg
+				});
+			} catch (err) {
+				this.deps.logger.warn("summary tile dropped: reading its media threw", {
+					tags,
+					meta: {
+						ruleId: rule.id,
+						trackId: candidate.trackId,
+						error: String(err)
+					}
+				});
+			}
+		}
+		return out;
+	}
+	/**
+	* Render the mosaic, file it where event media lives, and mint the public
+	* link the notifier BACKEND will fetch.
+	*
+	* Every step is best-effort in the delivery direction: a mosaic that could
+	* not be rendered, filed or published still leaves a digest with correct
+	* counts, and that is worth more than silence.
+	*/
+	async renderAndPublish(rule, window, tiles) {
+		if (tiles.length === 0) return {
+			ref: null,
+			bytes: 0
+		};
+		const names = /* @__PURE__ */ new Map();
+		for (const { candidate } of tiles) {
+			if (names.has(candidate.deviceId)) continue;
+			const name = await this.resolveDeviceName(candidate.deviceId);
+			names.set(candidate.deviceId, name ?? `camera ${candidate.deviceId}`);
+		}
+		let rendered;
+		try {
+			rendered = await renderMosaic({
+				tiles: tiles.map(({ candidate, jpeg }) => ({
+					jpeg,
+					label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf(candidate.firstSeen)} · ${candidate.className}`,
+					deviceId: candidate.deviceId,
+					trackId: candidate.trackId
+				})),
+				caption: summaryCaptionText({
+					...rule.captionText !== void 0 ? { captionText: rule.captionText } : {},
+					ruleName: rule.name,
+					window
+				})
+			}, this.deps.logger);
+		} catch (err) {
+			this.deps.logger.warn("summary mosaic could not be composed — delivering the counts alone", { meta: {
+				ruleId: rule.id,
+				tiles: tiles.length,
+				error: String(err)
+			} });
+			return {
+				ref: null,
+				bytes: 0
+			};
+		}
+		const file = this.deps.storeMosaic;
+		if (file !== void 0) try {
+			await file({
+				deviceId: rule.deviceIds[0] ?? 0,
+				ownerId: summaryMediaOwnerId(rule.id, window.endMs),
+				timestamp: window.endMs,
+				jpeg: rendered.jpeg
+			});
+		} catch (err) {
+			this.deps.logger.warn("summary mosaic was not filed — the notification still ships", { meta: {
+				ruleId: rule.id,
+				error: String(err)
+			} });
+		}
+		const bytes = new Uint8Array(rendered.jpeg.byteLength);
+		bytes.set(rendered.jpeg);
+		const url = await this.deps.publish(bytes, "image/jpeg");
+		if (url === null) {
+			this.deps.logger.warn("summary mosaic not published: no reachable public endpoint", { meta: { ruleId: rule.id } });
+			return {
+				ref: null,
+				bytes: bytes.byteLength
+			};
+		}
+		return {
+			ref: {
+				url,
+				mime: "image/jpeg",
+				name: "summary.jpg"
+			},
+			bytes: bytes.byteLength
+		};
+	}
+	async resolveDeviceName(deviceId) {
+		const get = this.deps.getDeviceName;
+		if (get === void 0) return null;
+		return get(deviceId).catch(() => null);
+	}
+};
+/** `HH:MM` in the host timezone — the two numbers a tile label needs. */
+function clockOf(atMs) {
+	const d = new Date(atMs);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+//#endregion
+//#region src/notification-center/summary/summary-rule.ts
+/**
+* NcSummaryRule — the MULTI-CAMERA digest rule.
+*
+* One rule, N cameras, ONE artefact per window: a clean mosaic of the best shot
+* of every track the window contained, delivered through the ordinary outbox.
+* That is the whole of P1. The `ai` section below is declared and persisted but
+* NOTHING reads it yet — P2 wires the joint vision call behind it, and because
+* the section is `.optional()` a rule authored today keeps delivering
+* byte-for-byte identically when it lands.
+*
+* ## Why this schema lives in the ADDON and not in `packages/types`
+*
+* `@camstack/types` is `external` in every mode of the build preset, so the
+* addon resolves it at runtime from the `@camstack/server` closure. A field
+* added there is not live until a framework train is published AND installed —
+* and worse, a NEW field on a cap-validated shape is *silently stripped* at save
+* until that train lands. The timelapse rule paid that price with three cascaded
+* bugs in one day.
+*
+* This rule rides no `NcDelivery` member, no cap method and no codegen. It
+* reaches the outside world through the `nc.*SummaryRule*` bridge actions
+* (`addons.custom`), exactly like `NcTestEventInputSchema` does — so a field
+* added here is live on the next `camstack deploy packages/addon-post-analysis`.
+* Promotion into `packages/types` later is additive and needs no migration.
+*
+* ## The `.partial()` trap this file exists to avoid
+*
+* Commit `e0921ac6e`, found in production 2026-08-12: `NcRulePatchSchema` was
+* `NcRuleInputSchema.partial()`, and Zod 4 `.partial()` KEEPS the inner
+* `.default()`. Parsing `{ name: 'x' }` therefore materialised every defaulted
+* key, and `{ ...existing, ...patch }` wrote them over the rule — a camera- and
+* zone-scoped rule silently became a rule that matched everything.
+*
+* So: every constraint is declared ONCE below; `.default()` appears ONLY in the
+* Input schema and `.optional()` ONLY in the hand-written Patch. `summary-rule.spec.ts`
+* asserts the two key sets stay identical AND that a one-key patch parses to
+* exactly one key.
+*/
+/** `{{var}}` templating — the same vocabulary the timelapse and rule bodies use. */
+var NcSummaryTemplateSchema = object({
+	title: string().max(500).optional(),
+	body: string().max(2e3).optional()
+});
+var NameField = string().min(1).max(200);
+/** MULTI-CAMERA is the point of the feature — a one-camera digest is a
+*  timelapse with extra steps, but it is allowed and it is cheap. */
+var DeviceIdsField = array(number()).min(1).max(64);
+var TargetsField = array(NcRuleTargetSchema).min(1);
+var PriorityField = number().int().min(1).max(5);
+var MaxTilesField = number().int().min(1).max(24);
+var MaxAiImagesField = number().int().min(1).max(8);
+/**
+* The MOTION window's quiet period, seconds.
+*
+* The window opens on the first motion seen on ANY of the rule's cameras and
+* stays open while motion keeps arriving. `quietSeconds` with nothing new on
+* any of them is what closes it — the operator's "windows driven by MOTION of
+* the selected cameras".
+*/
+var QuietSecondsField = number().int().min(30).max(3600);
+/**
+* The hard ceiling on ONE motion window, seconds.
+*
+* The operator's "max-wait bounded by the camera with the widest window": a
+* continuously busy driveway would otherwise keep a window open forever and the
+* digest would never be delivered. When this bites, the window closes with
+* whatever it holds and SAYS so on the log line.
+*/
+var MaxWindowSecondsField = number().int().min(60).max(86400);
+/**
+* How long the producer waits for the window's own tracks to CLOSE before it
+* analyses anything — the operator's track-close barrier, in seconds.
+*
+* A track's best shot (`keyFrameSmall` / `thumbnail`) is written when the track
+* CLOSES. Rendering the instant the window ends therefore renders exactly the
+* subjects that were still moving — the ones the digest is most about — with no
+* picture at all. The barrier waits for every track the window opened to close,
+* and is itself bounded: at the bound the window renders with the tracks it has
+* and logs the ones it gave up on.
+*/
+var BarrierSecondsField = number().int().min(0).max(3600);
+/**
+* How the window is defined. A discriminated union, because two optional
+* fields would make "neither" and "both" representable and both would have to
+* be refused by hand.
+*/
+var NcSummaryWindowSchema = discriminatedUnion("kind", [object({
+	kind: literal("schedule"),
+	schedule: NcScheduleSchema
+}), object({
+	kind: literal("motion"),
+	quietSeconds: QuietSecondsField,
+	maxWindowSeconds: MaxWindowSecondsField
+})]);
+/**
+* What enters the window. Evaluated on TRACKS, never on object events: one
+* track is one passage is one tile, and `importance` / dwell only exist at
+* track level (the same reason `NcRule` offers them only on `track-end`).
+*
+* `zones` is a FLAT id list and is scoped PER CAMERA by
+* `zone-ownership.ts#scopeZoneIdsToDevice` — picking a zone on camera A must
+* not silently mute camera B, which is the defect that helper exists for.
+*/
+var NcSummaryFiltersSchema = object({
+	classes: array(string().min(1).max(40)).max(20).optional(),
+	classesExclude: array(string().min(1).max(40)).max(20).optional(),
+	zones: array(string()).max(40).optional(),
+	minImportance: number().min(0).max(1).optional(),
+	minDwellSeconds: number().min(0).max(3600).optional()
+});
+/**
+* How tiles are chosen when the window holds more tracks than the budget.
+*
+* `importance` is the pipeline's own deterministic score and the default. The
+* per-camera quota that guarantees every contributing camera at least one tile
+* is NOT a rank — it applies to all of them, because a multi-camera digest in
+* which two of six cameras never appear is not multi-camera.
+*/
+var NcSummaryRankSchema = _enum([
+	"importance",
+	"recency",
+	"dwell"
+]);
+/**
+* The AI section — DECLARED IN P1, WIRED IN P2.
+*
+* Nothing in this addon reads it today. It is here so the rule shape does not
+* change under an operator who already authored rules, and `.optional()` so an
+* absent section is the ordinary case rather than a migration.
+*
+* No `.default()` anywhere inside it, for the reason in the module docblock.
+*/
+var NcSummaryAiSchema = object({
+	enabled: boolean(),
+	profileId: string().optional(),
+	/** The operator's own question. NEVER composed with text READ FROM A FRAME —
+	*  D121: a model reads OSD, plates and signs as instructions. */
+	prompt: string().max(2e3).optional(),
+	language: _enum(["en", "it"]).optional(),
+	maxImagePx: number().int().min(64).max(2048).optional(),
+	/** An EXTERNAL race, not the HTTP timeout — that one is `profile.timeoutMs`
+	*  and this can never lengthen it. */
+	timeoutMs: number().int().min(1e4).max(6e5).optional(),
+	onFailure: _enum(["deliver-without-text", "skip"]).optional()
+});
+var NcSummaryRuleInputSchema = object({
+	name: NameField,
+	enabled: boolean().default(true),
+	deviceIds: DeviceIdsField,
+	window: NcSummaryWindowSchema,
+	filters: NcSummaryFiltersSchema.optional(),
+	maxTiles: MaxTilesField.default(9),
+	maxAiImages: MaxAiImagesField.default(6),
+	rank: NcSummaryRankSchema.default("importance"),
+	barrierSeconds: BarrierSecondsField.default(120),
+	targets: TargetsField,
+	template: NcSummaryTemplateSchema.optional(),
+	/** Burned onto the mosaic's title band. `''` is reachable and means "no
+	*  caption" — which is why this is not `.min(1)`. */
+	captionText: string().max(200).optional(),
+	/** Deliver a window that matched NOTHING? Default no: a nightly "0 events"
+	*  is a line nobody reads, and it costs the lines beside it their reader. */
+	deliverEmpty: boolean().default(false),
+	priority: PriorityField.default(3),
+	ai: NcSummaryAiSchema.optional()
+});
+/**
+* The partial update. NOT `Input.partial()` (see the module docblock).
+*
+* `template` and `ai` are the two CLEARABLE fields: an absent key leaves them
+* alone, an explicit `null` removes them, an object replaces them. Keeping
+* `null` out of the persisted rule is what lets the persisted schema stay a
+* plain `.optional()`.
+*/
+var NcSummaryRulePatchSchema = object({
+	name: NameField.optional(),
+	enabled: boolean().optional(),
+	deviceIds: DeviceIdsField.optional(),
+	window: NcSummaryWindowSchema.optional(),
+	filters: NcSummaryFiltersSchema.nullable().optional(),
+	maxTiles: MaxTilesField.optional(),
+	maxAiImages: MaxAiImagesField.optional(),
+	rank: NcSummaryRankSchema.optional(),
+	barrierSeconds: BarrierSecondsField.optional(),
+	targets: TargetsField.optional(),
+	template: NcSummaryTemplateSchema.nullable().optional(),
+	captionText: string().max(200).optional(),
+	deliverEmpty: boolean().optional(),
+	priority: PriorityField.optional(),
+	ai: NcSummaryAiSchema.nullable().optional()
+});
+/**
+* The stored rule. Identity, ownership, provenance and the generation stamp are
+* SERVER-STAMPED and appear on neither Input nor Patch, so a forged blob can
+* never claim or re-own a rule (Zod strips unknown keys).
+*
+* `generatedAt` is PER-RULE and not per-camera — unlike the timelapse. One
+* window produces exactly ONE artefact spanning every camera, so there is no
+* per-camera output a shared stamp could destroy.
+*/
+var NcSummaryRuleSchema = NcSummaryRuleInputSchema.extend({
+	id: string(),
+	ownerUserId: string().optional(),
+	/** Epoch-ms of the END of the last window successfully delivered. */
+	generatedAt: number().optional(),
+	createdBy: string(),
+	createdAt: number(),
+	updatedAt: number()
+});
+/**
+* The one cross-field invariant, checked on the MERGED rule at upsert (never on
+* the patch alone — lowering `maxTiles` by itself can invalidate a `maxAiImages`
+* set weeks earlier, and checking the patch in isolation persists that pair).
+*
+* Failing at SAVE time is the whole point: the alternative is discovering it at
+* 07:05 when the window has already closed and cannot come back.
+*/
+function assertSummaryBudget(rule) {
+	if (rule.maxAiImages > rule.maxTiles) throw new Error(`maxAiImages (${rule.maxAiImages}) cannot exceed maxTiles (${rule.maxTiles}) — the model cannot judge frames the mosaic does not contain`);
+}
+//#endregion
+//#region src/notification-center/summary/summary-store.ts
+/**
+* NcSummaryStore — the durable multi-camera digest rule set.
+*
+* A deliberate copy of `TimelapseStore`'s shape, because that shape encodes
+* things this repo learned the hard way and a second opinion would lose:
+*
+*  - a DECLARED SQLite collection mirrored into RAM, written through (a failed
+*    persist never leaves a phantom in-RAM rule);
+*  - ownership is an ARGUMENT, never read from the blob — and `create`
+*    re-parses the input through the Input schema BEFORE stamping, so a future
+*    "duplicate rule" (`create(existingRule, caller)`) cannot clone the
+*    original owner (a `NcSummaryRule` is structurally assignable to
+*    `NcSummaryRuleInput`, so it would compile clean);
+*  - identity/ownership/provenance/`generatedAt` are re-pinned AFTER the spread
+*    in `update`, which makes a hand-built (unparsed) patch equally unable to
+*    re-own a rule;
+*  - the merged candidate is re-validated before it is persisted, so a patch
+*    can never write a rule that the next `load()` would skip.
+*
+* The one structural difference from the timelapse: `generatedAt` is PER-RULE.
+* A window produces ONE artefact across every camera, so there is no per-camera
+* output that a shared stamp could silently destroy — which is exactly why the
+* timelapse needed a per-device map and this does not.
+*/
+var NC_SUMMARY_RULES_COLLECTION = "notification-center:summary-rules";
+var NC_SUMMARY_RULES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "enabled",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL rule object (Zod-validated on read); the scalars above are
 	*  indexed projections only. */
 	{
 		name: "rule",
@@ -8906,17 +10696,20 @@ var NC_TIMELAPSE_RULES_COLUMNS = [
 		notNull: true
 	})
 ];
-var NC_TIMELAPSE_RULES_INDEXES = [{
-	name: "idx_nc_timelapse_rules_enabled",
+var NC_SUMMARY_RULES_INDEXES = [{
+	name: "idx_nc_summary_rules_enabled",
 	columns: ["enabled"]
 }];
-/** Query cap — the rule set is operator-authored and tiny; a generous ceiling. */
+/** The rule set is operator-authored and tiny; a generous ceiling. */
 var LOAD_LIMIT = 1e4;
 /**
-* Resolve the three-way `template` patch signal onto a merged rule, immutably:
-* `undefined` (key absent) leaves it as-is, `null` DROPS the key, an object
-* replaces it. Keeping `null` out of the persisted rule is what lets
-* `TimelapseRuleSchema` stay a plain `.optional()`.
+* The three-way CLEARABLE patch signal, one function per field: `undefined`
+* leaves the key alone, `null` DROPS it, a value replaces it.
+*
+* Written out three times rather than generically, deliberately: a generic
+* "delete key K" cannot be expressed over an object type without a cast, and a
+* cast here would be a cast on the exact path that decides whether a persisted
+* rule keeps a field. Three literal destructurings are three provable ones.
 */
 function applyTemplatePatch(merged, template) {
 	if (template === void 0) return merged;
@@ -8924,23 +10717,29 @@ function applyTemplatePatch(merged, template) {
 		...merged,
 		template
 	};
-	const { template: _cleared, ...withoutTemplate } = merged;
-	return withoutTemplate;
+	const { template: _cleared, ...rest } = merged;
+	return rest;
 }
-/** Narrowing guard — the persisted `rule` column is `unknown` until parsed. */
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function applyFiltersPatch(merged, filters) {
+	if (filters === void 0) return merged;
+	if (filters !== null) return {
+		...merged,
+		filters
+	};
+	const { filters: _cleared, ...rest } = merged;
+	return rest;
 }
-var TimelapseStore = class {
+function applyAiPatch(merged, ai) {
+	if (ai === void 0) return merged;
+	if (ai !== null) return {
+		...merged,
+		ai
+	};
+	const { ai: _cleared, ...rest } = merged;
+	return rest;
+}
+var NcSummaryStore = class {
 	byId = /* @__PURE__ */ new Map();
-	/**
-	* Birth stamps synthesised for LEGACY rows (see {@link withCreatedAt}), kept
-	* so a repeated `load()` re-uses the FIRST one. Without it the synthesised
-	* `createdAt` would advance to "now" on every refresh, and the scheduler's
-	* eligibility floor — which is `max(stamp, createdAt)` — would creep past
-	* every window such a rule was ever offered, silently producing nothing.
-	*/
-	synthesisedCreatedAt = /* @__PURE__ */ new Map();
 	store;
 	logger;
 	now;
@@ -8953,77 +10752,45 @@ var TimelapseStore = class {
 	}
 	static async declare(store) {
 		await store.declareCollection.mutate({
-			collection: NC_TIMELAPSE_RULES_COLLECTION,
-			columns: [...NC_TIMELAPSE_RULES_COLUMNS],
-			indexes: [...NC_TIMELAPSE_RULES_INDEXES]
+			collection: NC_SUMMARY_RULES_COLLECTION,
+			columns: [...NC_SUMMARY_RULES_COLUMNS],
+			indexes: [...NC_SUMMARY_RULES_INDEXES]
 		});
 	}
 	/**
-	* (Re)hydrate the FULL rule set from the store — called at boot and on the
-	* periodic refresh tick. Replaces the cache wholesale; a row whose JSON no
-	* longer validates is skipped with a warning (a degraded rule must never
-	* crash the scheduler).
+	* (Re)hydrate the FULL rule set — boot and the periodic refresh tick.
+	* A row whose JSON no longer validates is SKIPPED with a count, never
+	* allowed to crash the producer.
 	*/
 	async load() {
 		try {
 			const rows = await this.store.query.query({
-				collection: NC_TIMELAPSE_RULES_COLLECTION,
+				collection: NC_SUMMARY_RULES_COLLECTION,
 				filter: { limit: LOAD_LIMIT }
 			});
 			this.byId.clear();
 			let skipped = 0;
-			let synthesised = 0;
 			for (const row of rows) {
-				const raw = this.withCreatedAt(row.id, row.data["rule"]);
-				if (raw !== row.data["rule"]) synthesised += 1;
-				const parsed = TimelapseRuleSchema.safeParse(raw);
+				const parsed = NcSummaryRuleSchema.safeParse(row.data["rule"]);
 				if (!parsed.success) {
 					skipped += 1;
 					continue;
 				}
 				this.byId.set(parsed.data.id, parsed.data);
 			}
-			this.logger.debug("timelapse rules loaded", { meta: {
+			this.logger.debug("summary rules loaded", { meta: {
 				rules: this.byId.size,
-				...skipped > 0 ? { skippedInvalid: skipped } : {},
-				...synthesised > 0 ? { synthesisedCreatedAt: synthesised } : {}
+				...skipped > 0 ? { skippedInvalid: skipped } : {}
 			} });
 		} catch (err) {
-			this.logger.warn("timelapse rules load failed", { meta: { error: String(err) } });
+			this.logger.warn("summary rules load failed", { meta: { error: String(err) } });
 		}
 	}
-	/**
-	* Give a persisted blob a `createdAt` if it has none, WITHOUT persisting
-	* anything: the rule reads as born at this load.
-	*
-	* `createdAt` has always been required by `TimelapseRuleSchema`, so a row
-	* without one is a pre-schema artefact — and before this it was dropped
-	* outright at load (a silently vanished rule). Reading it as "born now" is
-	* the conservative choice in BOTH directions that matter: the rule survives,
-	* and the scheduler's eligibility floor stops it back-filling a window that
-	* closed years before anyone looked at it. The cost is one skipped window if
-	* a legacy rule is loaded between a close and its settle — a bounded miss,
-	* against an unbounded retry of a window no footage can satisfy.
-	*
-	* The synthesised value is remembered per rule id so a later refresh does not
-	* move the floor, and the first `update`/`markGenerated` writes it through —
-	* after which the row is no longer legacy.
-	*/
-	withCreatedAt(rowId, raw) {
-		if (!isRecord$1(raw)) return raw;
-		if (typeof raw["createdAt"] === "number") return raw;
-		const stamped = this.synthesisedCreatedAt.get(rowId) ?? this.now();
-		this.synthesisedCreatedAt.set(rowId, stamped);
-		return {
-			...raw,
-			createdAt: stamped
-		};
-	}
-	/** Every rule, newest-first (admin path). */
+	/** Every rule, newest-first. */
 	list() {
-		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
+		return [...this.byId.values()].toSorted((a, b) => b.updatedAt - a.updatedAt);
 	}
-	/** The scheduler's read: only rules that should be ticked. */
+	/** The producer's read: only rules that should be ticked. */
 	listEnabled() {
 		return this.list().filter((r) => r.enabled);
 	}
@@ -9031,44 +10798,22 @@ var TimelapseStore = class {
 		return this.byId.get(ruleId) ?? null;
 	}
 	/**
-	* Rules visible to `userId`: their OWN personal rules (`ownerUserId ===
-	* userId`) plus every admin/global rule (`ownerUserId` absent). Never another
-	* user's personal rows. Newest-first (inherits {@link list}).
-	*
-	* The caller identity is server-derived; an absent/undefined caller must be
-	* resolved to a fail-closed value by the bridge action BEFORE calling here —
-	* this store never treats a missing caller as admin/global.
+	* Rules visible to `userId`: their own personal rules plus every
+	* admin/global one. Never another user's personal row. The caller identity is
+	* server-derived — this store never treats a missing caller as admin.
 	*/
 	listForOwner(userId) {
 		return this.list().filter((r) => r.ownerUserId === void 0 || r.ownerUserId === userId);
 	}
 	/**
-	* Mutation gate for a NON-admin caller: true only for a PERSONAL rule this
-	* user owns. A global rule (no `ownerUserId`) returns false — global rules
-	* are admin-only, and the bridge action grants admins the mutation without
-	* consulting this check. An unknown rule id is false (fail-closed).
-	*/
-	isOwnedBy(ruleId, userId) {
-		const rule = this.byId.get(ruleId);
-		return rule?.ownerUserId !== void 0 && rule.ownerUserId === userId;
-	}
-	/**
-	* Create a rule. `createdBy` is the SERVER-injected caller userId;
-	* `ownerUserId` is the server-derived owner (omit for an admin/global rule).
-	* Neither is ever read from `input`.
-	*
-	* The input is re-parsed through {@link TimelapseRuleInputSchema} BEFORE the
-	* spread — that schema carries no ownership/provenance keys, so it strips any
-	* that rode in on the blob. Without it, an `ownerUserId` on `input` would
-	* survive whenever the `ownerUserId` ARGUMENT is omitted (the admin/global
-	* path): a `TimelapseRule` is structurally assignable to `TimelapseRuleInput`,
-	* so a future "duplicate rule" action (`create(existingRule, caller)`) would
-	* compile cleanly and silently clone the ORIGINAL owner.
+	* Create. `createdBy` is the server-injected caller; `ownerUserId` is the
+	* server-derived owner (omit for an admin/global rule). Neither is ever read
+	* from `input` — see the module docblock for what the re-parse prevents.
 	*/
 	async create(input, createdBy, ownerUserId) {
 		const now = this.now();
-		const rule = TimelapseRuleSchema.parse({
-			...TimelapseRuleInputSchema.parse(input),
+		const rule = NcSummaryRuleSchema.parse({
+			...NcSummaryRuleInputSchema.parse(input),
 			id: this.newId(),
 			...ownerUserId !== void 0 ? { ownerUserId } : {},
 			createdBy,
@@ -9080,103 +10825,70 @@ var TimelapseStore = class {
 		return rule;
 	}
 	/**
-	* Apply a partial patch. Immutable: returns the NEW rule object. Identity,
-	* ownership and generation state are re-pinned from the existing rule AFTER
-	* the spread — the patch schema carries none of them, and this makes a
-	* hand-built (unparsed) patch object equally unable to re-own a rule.
-	*
-	* `template` is the one clearable field: an absent key leaves it unchanged,
-	* an explicit `null` CLEARS it (the persisted rule loses the key — `null`
-	* never reaches {@link TimelapseRuleSchema}). See the patch schema's wire
-	* note.
+	* Apply a partial patch. Immutable — returns the NEW rule object. Identity,
+	* ownership, provenance and `generatedAt` are re-pinned from the existing
+	* rule AFTER the spread.
 	*/
 	async update(ruleId, patch) {
 		const existing = this.byId.get(ruleId);
-		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
-		const { template, ...rest } = patch;
+		if (!existing) throw new Error(`summary rule not found: ${ruleId}`);
+		const { template, filters, ai, ...rest } = patch;
 		const merged = {
 			...existing,
 			...rest,
 			id: existing.id,
-			ownerUserId: existing.ownerUserId,
-			lastGeneratedAt: existing.lastGeneratedAt,
-			generatedByDevice: existing.generatedByDevice,
+			...existing.ownerUserId !== void 0 ? { ownerUserId: existing.ownerUserId } : {},
+			...existing.generatedAt !== void 0 ? { generatedAt: existing.generatedAt } : {},
 			createdBy: existing.createdBy,
 			createdAt: existing.createdAt,
 			updatedAt: this.now()
 		};
-		return this.write(applyTemplatePatch(merged, template));
+		return this.write(applyAiPatch(applyFiltersPatch(applyTemplatePatch(merged, template), filters), ai));
 	}
 	async setEnabled(ruleId, enabled) {
 		return this.update(ruleId, { enabled });
 	}
 	/**
-	* Record a successful generation for ONE camera of the rule. `at` is the
-	* generation epoch-ms — the durable state behind the re-generation guard.
-	* Does NOT bump `updatedAt` (a generation is not an edit of the rule).
+	* Record a delivered window. `at` is the window's END, not the wall clock:
+	* the eligibility floor compares against a window close, so stamping "now"
+	* would make a late delivery skip the next window too.
 	*
-	* PER-DEVICE, and that is the whole point: a rule covering three cameras
-	* renders three videos, and stamping the rule when the first one succeeds
-	* tells the other two they are already done. Their night is then gone for
-	* good — a closed window does not come back. Call this ONLY after the export
-	* reached `ready` and the notification was enqueued; a failed render must
-	* leave the pair unstamped so the next tick can retry it.
-	*
-	* The rule-wide `lastGeneratedAt` is kept as the NEWEST of the stamps (what
-	* a UI shows) and never regresses when an older device generation lands.
-	*
-	* A rule that still carries only the LEGACY rule-wide stamp has its map
-	* SEEDED from it for every camera the rule covers, before the new stamp is
-	* applied — writing `{ [deviceId]: at }` alone would drop the other cameras
-	* to "never generated" and re-render them once.
+	* Call this ONLY after the enqueue succeeded — the stamp is the LAST thing a
+	* production does, because a closed window does not come back.
 	*/
-	async markGenerated(ruleId, deviceId, at) {
+	async markGenerated(ruleId, windowEndMs) {
 		const existing = this.byId.get(ruleId);
-		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
-		const seeded = {};
-		if (existing.generatedByDevice === void 0 && existing.lastGeneratedAt !== void 0) for (const id of existing.deviceIds) seeded[String(id)] = existing.lastGeneratedAt;
-		const generatedByDevice = {
-			...seeded,
-			...existing.generatedByDevice,
-			[String(deviceId)]: at
-		};
+		if (!existing) throw new Error(`summary rule not found: ${ruleId}`);
 		return this.write({
 			...existing,
-			generatedByDevice,
-			lastGeneratedAt: Math.max(existing.lastGeneratedAt ?? 0, at)
+			generatedAt: Math.max(existing.generatedAt ?? 0, windowEndMs)
 		});
 	}
-	/** Idempotent delete — unknown ids are a no-op. */
+	/** Idempotent delete — unknown ids are a no-op in RAM, still attempted on disk. */
 	async delete(ruleId) {
 		this.byId.delete(ruleId);
 		try {
 			await this.store.delete.mutate({
-				collection: NC_TIMELAPSE_RULES_COLLECTION,
+				collection: NC_SUMMARY_RULES_COLLECTION,
 				key: ruleId
 			});
 		} catch (err) {
-			this.logger.warn("timelapse rule delete failed", { meta: {
+			this.logger.warn("summary rule delete failed", { meta: {
 				ruleId,
 				error: String(err)
 			} });
 			throw err instanceof Error ? err : new Error(String(err));
 		}
 	}
-	/**
-	* Re-validate a merged candidate, persist it, then cache it. Re-validating
-	* means a patch can never persist a rule that would be skipped at the next
-	* `load()`; provenance/ownership survive because they are spread from the
-	* existing rule and never present on a patch.
-	*/
 	async write(candidate) {
-		const rule = TimelapseRuleSchema.parse(candidate);
+		const rule = NcSummaryRuleSchema.parse(candidate);
 		await this.persist(rule);
 		this.byId.set(rule.id, rule);
 		return rule;
 	}
 	async persist(rule) {
 		await this.store.set.mutate({
-			collection: NC_TIMELAPSE_RULES_COLLECTION,
+			collection: NC_SUMMARY_RULES_COLLECTION,
 			key: rule.id,
 			value: {
 				name: rule.name,
@@ -9398,7 +11110,7 @@ function packagePhaseOf(ev) {
 */
 function historyRecordKind(kind) {
 	if (kind === "audio-event" || kind === "audio-window") return "object-event";
-	if (kind === "timelapse") return "system-event";
+	if (kind === "timelapse" || kind === "ai-summary") return "system-event";
 	return kind;
 }
 /**
@@ -9434,7 +11146,7 @@ function outboxEntryToHistory(texts, entry) {
 		id: entry.id,
 		ruleId: entry.ruleId,
 		ruleName: entry.payload.ruleName,
-		delivery: entry.payload.delivery === "timelapse" ? "system-event" : entry.payload.delivery,
+		delivery: entry.payload.delivery === "timelapse" || entry.payload.delivery === "ai-summary" ? "system-event" : entry.payload.delivery,
 		targetId: entry.targetId,
 		deviceId: entry.deviceId,
 		recordKind: historyRecordKind(entry.recordKind),
@@ -9522,6 +11234,23 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	timelapseRules;
 	timelapseScheduler = null;
+	/**
+	* The multi-camera digest rule set, and the producer that runs it. Held on
+	* EVERY node for the same reason as {@link timelapseRules}: the bridge
+	* actions serve CRUD from wherever they are asked. Only the hub, with
+	* `deps.summary` wired, gets a producer.
+	*/
+	summaryRules;
+	summaryProducer = null;
+	/**
+	* What the cameras are doing right now, for the digest windows.
+	*
+	* Constructed unconditionally and fed from the intake hooks even on a node
+	* with no producer: the two `observe*` calls are a map write each, and a
+	* collector that only started observing when a producer existed would give
+	* the first window after a wiring change an empty barrier.
+	*/
+	summaryCollector = new NcSummaryCollector();
 	/** True when ≥1 enabled `device-event` rule declares an occupancy condition —
 	*  the watcher is idle (zero per-frame cost) otherwise. */
 	occupancyEnabled = false;
@@ -9774,6 +11503,23 @@ var NotificationCenter = class NotificationCenter {
 				getDeviceName: (deviceId) => deps.dispatcher.getDeviceName(deviceId)
 			});
 		}
+		this.summaryRules = new NcSummaryStore({
+			store: deps.store,
+			logger: this.logger.child("summary"),
+			...deps.now !== void 0 ? { now: deps.now } : {}
+		});
+		const summaryPorts = deps.summary;
+		if (summaryPorts !== void 0) this.summaryProducer = new NcSummaryProducer({
+			...summaryPorts,
+			logger: this.logger.child("summary"),
+			now: this.now,
+			texts: this.texts,
+			store: this.summaryRules,
+			collector: this.summaryCollector,
+			enqueue: (rows) => this.outbox.enqueue(rows),
+			getDeviceName: (deviceId) => deps.dispatcher.getDeviceName(deviceId),
+			zoneOwner: this.zoneOwners.lookup()
+		});
 	}
 	/**
 	* The durable timelapse rule set — exposed for the `nc.*Timelapse*` bridge
@@ -9782,6 +11528,22 @@ var NotificationCenter = class NotificationCenter {
 	get timelapseStore() {
 		return this.timelapseRules;
 	}
+	/** The durable digest rule set — exposed for the `nc.*Summary*` bridge
+	*  actions, on the same reasoning as {@link timelapseStore}. */
+	get summaryStore() {
+		return this.summaryRules;
+	}
+	/**
+	* Produce one digest window for one rule, right now.
+	*
+	* Throws when this node hosts no producer — an honest refusal beats a
+	* `produced: 0` an operator reads as "there was nothing to make".
+	*/
+	async runSummaryNow(input) {
+		const producer = this.summaryProducer;
+		if (producer === null) throw new Error("this node does not host the summary producer — produce it on the hub");
+		return producer.runNow(input);
+	}
 	/**
 	* The text catalog's edit surface — exposed for the `nc.getTexts` /
 	* `nc.setLanguage` / `nc.setTextOverrides` bridge actions, on the same
@@ -9827,6 +11589,7 @@ var NotificationCenter = class NotificationCenter {
 		await NcSnoozeStore.declare(store);
 		await NcDeviceMuteStore.declare(store);
 		await TimelapseStore.declare(store);
+		await NcSummaryStore.declare(store);
 		await NcTextCatalogStore.declare(store);
 	}
 	/**
@@ -9841,6 +11604,7 @@ var NotificationCenter = class NotificationCenter {
 		await this.snoozes.load();
 		await this.deviceMutes.load();
 		await this.timelapseRules.load();
+		await this.summaryRules.load();
 		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
 		await this.deviceStates.refresh();
@@ -9861,11 +11625,16 @@ var NotificationCenter = class NotificationCenter {
 		if (this.timelapseScheduler !== null) await this.timelapseScheduler.start().catch((err) => {
 			this.logger.warn("timelapse producer did not start", { meta: { error: String(err) } });
 		});
+		if (this.summaryProducer !== null) await this.summaryProducer.start().catch((err) => {
+			this.logger.warn("summary producer did not start", { meta: { error: String(err) } });
+		});
 		this.logger.info("notification center started", { meta: {
 			rules: this.rules.list().length,
 			pendingOutbox: this.outbox.pendingCount(),
 			timelapseRules: this.timelapseRules.list().length,
-			timelapseProducer: this.timelapseScheduler !== null
+			timelapseProducer: this.timelapseScheduler !== null,
+			summaryRules: this.summaryRules.list().length,
+			summaryProducer: this.summaryProducer !== null
 		} });
 	}
 	async stop() {
@@ -9878,6 +11647,7 @@ var NotificationCenter = class NotificationCenter {
 			this.reloadTimer = null;
 		}
 		this.timelapseScheduler?.stop();
+		this.summaryProducer?.stop();
 		this.evaluationActive = false;
 	}
 	/**
@@ -10031,6 +11801,11 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	onObjectEventPersisted(event, _track) {
 		if (packagePhaseOf(event) !== null) return;
+		this.summaryCollector.observeMotion({
+			deviceId: event.deviceId,
+			atMs: event.timestamp,
+			...event.trackId !== void 0 ? { trackId: event.trackId } : {}
+		});
 		this.consumeEvent(incomingFromObjectEvent(event));
 	}
 	/**
@@ -10040,6 +11815,7 @@ var NotificationCenter = class NotificationCenter {
 	* post-close promotions are picked up).
 	*/
 	onTrackClosed(track, _ownedMedia, info) {
+		this.summaryCollector.observeTrackClosed(track.trackId);
 		this.consumeEvent(incomingFromTrack(track, info));
 	}
 	/**
@@ -11005,6 +12781,7 @@ var NotificationCenter = class NotificationCenter {
 	async reloadRules() {
 		await this.rules.load();
 		await this.timelapseRules.load();
+		await this.summaryRules.load();
 		await this.reloadTexts();
 		this.refreshOccupancyWatch();
 		if (!this.evaluationActive) return;
@@ -11366,6 +13143,8 @@ var NotificationCenter = class NotificationCenter {
 var NcViewerRuleSchema = NcRuleSchema.extend({ readOnly: boolean() });
 /** Same verdict, for a timelapse rule. */
 var NcViewerTimelapseRuleSchema = TimelapseRuleSchema.extend({ readOnly: boolean() });
+/** Same verdict, for a multi-camera digest rule. */
+var NcViewerSummaryRuleSchema = NcSummaryRuleSchema.extend({ readOnly: boolean() });
 /**
 * The action catalog — the tRPC contract Group B (the viewer client) consumes
 * against `addonId: 'pipeline-analytics'`. Every entry that depends on the
@@ -11482,6 +13261,66 @@ var ncActions = defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
+	"nc.listSummaryRules": customAction(object({}), object({ rules: array(NcViewerSummaryRuleSchema) }), { caller: "required" }),
+	/**
+	* ONE action for create AND update, like `nc.upsertTimelapseRule`: a digest
+	* rule is authored as a whole (cameras + window + filters + targets) and the
+	* guards a create must pass are the guards a patch that widens it must pass
+	* too. Two entry points would be two places to forget one.
+	*
+	* `ruleId` absent ⇒ create from `rule`; present ⇒ patch.
+	*
+	* `auth: 'admin'` in v1 (operator decision): a digest spans cameras and, once
+	* P2 lands, consumes the local vision model. A personal rule that fans vision
+	* calls across other people's cameras is a decision to take after the real
+	* cost has been watched for a few weeks, not before.
+	*/
+	"nc.upsertSummaryRule": customAction(object({
+		ruleId: string().optional(),
+		rule: NcSummaryRuleInputSchema.optional(),
+		patch: NcSummaryRulePatchSchema.optional()
+	}), object({ rule: NcSummaryRuleSchema }), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	"nc.deleteSummaryRule": customAction(object({ ruleId: string() }), object({ success: literal(true) }), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	/**
+	* Produce one digest window RIGHT NOW — the operator's Test button.
+	*
+	* `auth: 'admin'` for the same reason as `nc.injectTestEvent` and
+	* `nc.testTimelapseRule`: it DELIVERS, to every target the rule addresses, on
+	* other people's phones. It does not consume the schedule guard — pressing
+	* Test at noon must not cancel tonight's run.
+	*
+	* `windowStartMs`/`windowEndMs` are optional and are the whole point of the
+	* action for a live check: they let an operator aim it at a range he KNOWS
+	* held traffic, instead of waiting for one to close.
+	*/
+	"nc.testSummaryRule": customAction(object({
+		ruleId: string(),
+		windowStartMs: number().optional(),
+		windowEndMs: number().optional()
+	}), object({
+		produced: number().int(),
+		tiles: number().int().optional(),
+		cameras: number().int().optional(),
+		matched: number().int().optional(),
+		enqueued: number().int().optional(),
+		mosaicBytes: number().int().optional(),
+		mosaicUrl: string().optional(),
+		windowStartMs: number().optional(),
+		windowEndMs: number().optional(),
+		error: string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
 	/**
 	* The whole catalog for ONE language, each key carrying which layer answered
 	* it. `language` defaults to the hub's own; passing another one inspects (and
@@ -11549,6 +13388,12 @@ function makeNcActionHandlers(deps) {
 		if (tl === void 0) throw new Error("this node does not host the timelapse producer — use the hub");
 		return tl;
 	};
+	/** The digest producer half, or an honest refusal. */
+	const requireSummary = () => {
+		const sum = deps.summary;
+		if (sum === void 0) throw new Error("this node does not host the summary producer — use the hub");
+		return sum;
+	};
 	/** The text catalog editor, or an honest refusal. */
 	const requireTexts = () => {
 		const editor = deps.texts;
@@ -11768,6 +13613,93 @@ function makeNcActionHandlers(deps) {
 			await deps.ruleStore.setRuleTargetEnabled(input.ruleId, input.targetId, input.enabled);
 			return { success: true };
 		},
+		"nc.listSummaryRules": async (_input, caller) => {
+			const c = requireCaller(caller);
+			const sum = requireSummary();
+			return { rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
+				...r,
+				readOnly: !c.isAdmin
+			})) };
+		},
+		"nc.upsertSummaryRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to author a summary rule");
+			const sum = requireSummary();
+			if (input.ruleId === void 0) {
+				if (input.rule === void 0) throw new Error("upsertSummaryRule: rule or ruleId required");
+				const parsed = NcSummaryRuleInputSchema.parse(input.rule);
+				assertSummaryBudget(parsed);
+				await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
+				const rule = await sum.store.create(parsed, c.userId);
+				deps.logger.info("summary rule created", { meta: {
+					ruleId: rule.id,
+					owner: c.userId,
+					devices: rule.deviceIds.join(",")
+				} });
+				return { rule };
+			}
+			const existing = sum.store.get(input.ruleId);
+			if (existing === null) throw new Error(`forbidden: summary rule not found: ${input.ruleId}`);
+			if (input.patch === void 0) throw new Error("upsertSummaryRule: patch required");
+			const patch = NcSummaryRulePatchSchema.parse(input.patch);
+			assertSummaryBudget({
+				maxTiles: patch.maxTiles ?? existing.maxTiles,
+				maxAiImages: patch.maxAiImages ?? existing.maxAiImages
+			});
+			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
+			const rule = await sum.store.update(input.ruleId, patch);
+			deps.logger.info("summary rule updated", { meta: {
+				ruleId: rule.id,
+				owner: c.userId
+			} });
+			return { rule };
+		},
+		"nc.deleteSummaryRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to delete a summary rule");
+			await requireSummary().store.delete(input.ruleId);
+			deps.logger.info("summary rule deleted", { meta: {
+				ruleId: input.ruleId,
+				owner: c.userId
+			} });
+			return { success: true };
+		},
+		"nc.testSummaryRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to produce a test summary");
+			const sum = requireSummary();
+			const startMs = input.windowStartMs;
+			const endMs = input.windowEndMs;
+			if (startMs === void 0 !== (endMs === void 0)) throw new Error("testSummaryRule: pass BOTH windowStartMs and windowEndMs, or neither");
+			if (startMs !== void 0 && endMs !== void 0 && endMs <= startMs) throw new Error("testSummaryRule: windowEndMs must be after windowStartMs");
+			deps.logger.info("summary test requested", { meta: {
+				by: c.userId,
+				ruleId: input.ruleId,
+				windowStartMs: startMs,
+				windowEndMs: endMs
+			} });
+			const out = await sum.runNow({
+				ruleId: input.ruleId,
+				...startMs !== void 0 && endMs !== void 0 ? { window: {
+					startMs,
+					endMs
+				} } : {}
+			});
+			return {
+				produced: out.produced,
+				...out.tiles !== void 0 ? { tiles: out.tiles } : {},
+				...out.cameras !== void 0 ? { cameras: out.cameras } : {},
+				...out.matched !== void 0 ? { matched: out.matched } : {},
+				...out.enqueued !== void 0 ? { enqueued: out.enqueued } : {},
+				...out.mosaicBytes !== void 0 ? { mosaicBytes: out.mosaicBytes } : {},
+				...out.mosaicUrl !== void 0 ? { mosaicUrl: out.mosaicUrl } : {},
+				...out.window !== null ? {
+					windowStartMs: out.window.startMs,
+					windowEndMs: out.window.endMs
+				} : {},
+				...out.error !== void 0 ? { error: out.error } : {}
+			};
+		},
 		"nc.getTexts": async (input) => {
 			const texts = requireTexts();
 			return input.language === void 0 ? texts.view() : texts.view(input.language);
@@ -12166,7 +14098,7 @@ async function drawPreviewTitle(jpeg, text, logger, tags) {
 }
 /** Widest stdout one preview may produce. A 960 px JPEG is ~200 KB; this is
 *  headroom, not a budget. */
-var RUN_MAX_BUFFER = 16 * 1024 * 1024;
+var RUN_MAX_BUFFER$1 = 16 * 1024 * 1024;
 /**
 * The production {@link RunCommand}: `execFile`, bounded, stdout as bytes.
 *
@@ -12177,7 +14109,7 @@ var RUN_MAX_BUFFER = 16 * 1024 * 1024;
 var execFileCapturingStdout = async (cmd, args) => new Promise((resolve) => {
 	execFile(cmd, [...args], {
 		encoding: "buffer",
-		maxBuffer: RUN_MAX_BUFFER,
+		maxBuffer: RUN_MAX_BUFFER$1,
 		timeout: PREVIEW_FRAME_TIMEOUT_MS
 	}, (err, stdout) => resolve(err !== null ? null : stdout));
 });
@@ -20080,6 +22012,7 @@ async function rebuildObjectEmbeddings(deps, options = {}) {
 	const pacingMs = options.pacingMs ?? 50;
 	let rebuilt = 0;
 	let missingKeyFrame = 0;
+	let recoveredKeyFrame = 0;
 	let missingEvent = 0;
 	let missingBbox = 0;
 	let notRunnable = 0;
@@ -20118,15 +22051,25 @@ async function rebuildObjectEmbeddings(deps, options = {}) {
 						missingEvent += 1;
 						return;
 					}
-					if (source.keyFrame === null) {
+					let keyFrame = source.keyFrame;
+					let recovered = false;
+					if (keyFrame === null && deps.recoverKeyFrame) {
+						keyFrame = await deps.recoverKeyFrame(source);
+						recovered = keyFrame !== null;
+					}
+					if (keyFrame === null) {
 						missingKeyFrame += 1;
 						return;
 					}
+					if (recovered) recoveredKeyFrame += 1;
 					if (source.bbox === null || source.bbox.w <= 0 || source.bbox.h <= 0) {
 						missingBbox += 1;
 						return;
 					}
-					const outcome = await deps.embed(source);
+					const outcome = await deps.embed(recovered ? {
+						...source,
+						keyFrame
+					} : source);
 					if (outcome.kind === "no-capable-node") {
 						noCapableNode += 1;
 						abandoned = outcome.reason;
@@ -20187,6 +22130,7 @@ async function rebuildObjectEmbeddings(deps, options = {}) {
 				scanned,
 				rebuilt,
 				missingKeyFrame,
+				recoveredKeyFrame,
 				missingEvent,
 				missingBbox,
 				notRunnable,
@@ -20208,6 +22152,7 @@ async function rebuildObjectEmbeddings(deps, options = {}) {
 		scanned,
 		rebuilt,
 		missingKeyFrame,
+		recoveredKeyFrame,
 		missingEvent,
 		missingBbox,
 		notRunnable,
@@ -20220,6 +22165,7 @@ async function rebuildObjectEmbeddings(deps, options = {}) {
 		scanned,
 		rebuilt,
 		missingKeyFrame,
+		recoveredKeyFrame,
 		missingEvent,
 		missingBbox,
 		notRunnable,
@@ -26408,6 +28354,248 @@ var RebuildStepDispatcher = class {
 		});
 	}
 };
+/**
+* Where inside its GOP the wanted frame sits, in seconds.
+*
+* Clamped into the fragment: a request whose instant lands outside the GOP the
+* recorder returned takes the nearest edge rather than seeking past the end and
+* getting nothing. The clamp is honest because the caller is told
+* {@link RecoveredStill.gopStartMs} and can see the offset it actually got.
+*/
+function stillSeekSec(epochMs, gop) {
+	const offsetMs = epochMs - gop.gopStartMs;
+	const maxMs = Math.max(0, gop.gopDurMs - 1);
+	return Math.min(Math.max(0, offsetMs), maxMs) / 1e3;
+}
+/**
+* ffmpeg argv for "one JPEG at `atSec` from this fMP4 fragment, on stdout".
+*
+* `-ss` goes AFTER `-i` on purpose — the inverse of the timelapse preview's
+* choice, and for the inverse reason. The input is a PIPE (the fragment never
+* touches disk: it is ~200 KB and staging it would add an fs round trip to a
+* path that already has a deadline), and an input seek on a non-seekable pipe
+* is unreliable. The fragment is ONE GOP, so an output seek decodes at most a
+* keyframe interval — the thing that makes an output seek expensive on a whole
+* file does not apply here.
+*/
+function buildRecordedStillArgs(atSec, maxWidth) {
+	return [
+		"-hide_banner",
+		"-loglevel",
+		"error",
+		"-nostdin",
+		"-i",
+		"pipe:0",
+		"-ss",
+		String(Math.max(0, atSec)),
+		"-frames:v",
+		"1",
+		"-vf",
+		`scale='min(${maxWidth},iw)':-2`,
+		"-f",
+		"image2",
+		"-vcodec",
+		"mjpeg",
+		"pipe:1"
+	];
+}
+/**
+* Recover the native frame nearest `epochMs` for `deviceId`.
+*
+* Never throws: every failure is an outcome, because the caller's next move
+* differs by outcome and an exception would collapse four of them into one.
+* The cheap questions come first — profile, then coverage, then bytes, then the
+* decode — so a camera that was not recording costs a settings read and not a
+* disk read (the same ordering rule `runStatelessStep` follows for stored
+* media, [D56](../../../../docs/decisions/adr-0056.md)).
+*/
+var RecordedStillService = class {
+	ports;
+	maxConcurrent;
+	inFlight = 0;
+	constructor(ports, maxConcurrent = 2) {
+		this.ports = ports;
+		this.maxConcurrent = maxConcurrent;
+	}
+	/** Decodes currently running (tests / metrics). */
+	get running() {
+		return this.inFlight;
+	}
+	async recover(deviceId, epochMs, maxWidth) {
+		const tags = { deviceId };
+		if (this.inFlight >= this.maxConcurrent) {
+			this.ports.logger.debug("recorded still refused: node already at its decode bound", {
+				tags,
+				meta: {
+					epochMs,
+					inFlight: this.inFlight
+				}
+			});
+			return { outcome: "busy" };
+		}
+		this.inFlight += 1;
+		try {
+			const profile = await this.ports.resolveProfile(deviceId);
+			if (profile === null) {
+				this.ports.logger.debug("recorded still unavailable: camera is not recording", {
+					tags,
+					meta: { epochMs }
+				});
+				return { outcome: "no-recording" };
+			}
+			const located = await this.ports.locate(deviceId, profile, epochMs);
+			if (located === null) {
+				this.ports.logger.debug("recorded still unavailable: no footage covers that instant", {
+					tags,
+					meta: {
+						epochMs,
+						profile
+					}
+				});
+				return { outcome: "no-footage" };
+			}
+			const gop = await this.ports.readGop(deviceId, profile, located.startMs, epochMs);
+			if (gop === null || gop.data.byteLength === 0) {
+				this.ports.logger.warn("recorded still: the GOP read produced no bytes", {
+					tags,
+					meta: {
+						epochMs,
+						profile,
+						startMs: located.startMs
+					}
+				});
+				return { outcome: "no-footage" };
+			}
+			const jpeg = await this.ports.decodeStill(gop.data, stillSeekSec(epochMs, gop), maxWidth);
+			if (jpeg === null || jpeg.byteLength === 0) {
+				this.ports.logger.warn("recorded still: GOP located but the decode produced nothing", {
+					tags,
+					meta: {
+						epochMs,
+						profile,
+						gopStartMs: gop.gopStartMs,
+						bytes: gop.data.byteLength
+					}
+				});
+				return { outcome: "decode-failed" };
+			}
+			return {
+				outcome: "ok",
+				jpeg,
+				gopStartMs: gop.gopStartMs
+			};
+		} catch (err) {
+			this.ports.logger.warn("recorded still failed", {
+				tags,
+				meta: {
+					epochMs,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return { outcome: "decode-failed" };
+		} finally {
+			this.inFlight -= 1;
+		}
+	}
+};
+//#endregion
+//#region src/pipeline-analytics/recorded-still-ports.ts
+/**
+* The production wiring for {@link RecordedStillService} — the recorder's READ
+* surface plus one bounded ffmpeg.
+*
+* Kept apart from `recorded-still.ts` so the policy (what counts as a refusal,
+* what the concurrency bound is, where the seek lands) stays testable with no
+* cap client, no recorder and no ffmpeg on the machine running the suite. This
+* file is the only place that knows the cap method names.
+*
+* **Read-side only.** `getDeviceConfig`, `locateSegment` and `readGopBytes` —
+* nothing here writes, evicts, prunes or relocates. That is deliberate and it
+* is a boundary, not an accident: the recorder's write path is the one thing a
+* background maintenance pass must never be able to perturb.
+*/
+/**
+* Hard bound on one still decode. Generous because the work is background and a
+* stuck ffmpeg costs a slot rather than a delivery; tight enough that two stuck
+* ones cannot wedge the service for a whole pass.
+*/
+var RECORDED_STILL_TIMEOUT_MS = 15e3;
+/** A native JPEG is worth having at full size; this is headroom, not a budget. */
+var RUN_MAX_BUFFER = 32 * 1024 * 1024;
+/**
+* The profile a recovered still is read from.
+*
+* `high` and not the low rendition, because the whole reason to re-decode is
+* that the model wants NATIVE pixels — a still cut from the scrub-grade copy
+* would be a worse version of the ≤640 fallback the design already has.
+*/
+var RECORDED_STILL_PROFILE = "high";
+/**
+* Width cap for a recovered key frame.
+*
+* The same 1920 the live native `keyFrame` capture uses, so a vector rebuilt
+* from recovered pixels and one rebuilt from a captured key frame are cut from
+* rasters of the same scale. Different scales would not be wrong — the runner
+* derives the rectangle from normalised coordinates either way — but they would
+* make two populations in one index differ by resampling, and this index has
+* already had two feature spaces in it once ([D52](../../../../docs/decisions/adr-0052.md)).
+*/
+var RECOVERED_KEY_FRAME_MAX_WIDTH = 1920;
+/**
+* Build the production ports.
+*
+* Every port swallows its own failure into the `null` the policy expects: a
+* maintenance pass that walks thousands of tracks must not end because one
+* device's config read timed out, and the outcome the caller reports is already
+* the honest one.
+*/
+function buildRecordedStillPorts(input) {
+	const ffmpeg = input.ffmpegPath ?? "ffmpeg";
+	return {
+		logger: input.logger,
+		resolveProfile: async (deviceId) => {
+			try {
+				return (await input.api.getDeviceConfig.query({ deviceId })).enabled === false ? null : RECORDED_STILL_PROFILE;
+			} catch {
+				return null;
+			}
+		},
+		locate: async (deviceId, profile, epochMs) => {
+			try {
+				const located = await input.api.locateSegment.query({
+					deviceId,
+					profile,
+					epochMs
+				});
+				if (located.kind !== "segment" || typeof located.startMs !== "number") return null;
+				return { startMs: located.startMs };
+			} catch {
+				return null;
+			}
+		},
+		readGop: async (deviceId, profile, startMs, epochMs) => {
+			try {
+				return await input.api.readGopBytes.query({
+					deviceId,
+					profile,
+					startMs,
+					epochMs
+				});
+			} catch {
+				return null;
+			}
+		},
+		decodeStill: (gop, atSec, maxWidth) => new Promise((resolve) => {
+			const child = execFile(ffmpeg, [...buildRecordedStillArgs(atSec, maxWidth)], {
+				encoding: "buffer",
+				maxBuffer: RUN_MAX_BUFFER,
+				timeout: RECORDED_STILL_TIMEOUT_MS
+			}, (err, stdout) => resolve(err !== null ? null : stdout));
+			child.stdin?.on("error", () => void 0);
+			child.stdin?.end(Buffer.from(gop));
+		})
+	};
+}
 //#endregion
 //#region src/pipeline-analytics/store/tiered-label-columns.ts
 /**
@@ -37387,6 +39575,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				getRecordingConfig: (deviceId) => api.recording.getDeviceConfig.query({ deviceId }).catch(() => null),
 				runNow: (input) => center.runTimelapseNow(input)
 			},
+			summary: {
+				store: center.summaryStore,
+				runNow: (input) => center.runSummaryNow(input)
+			},
 			texts: center.textCatalogEditor
 		});
 	}
@@ -38078,13 +40270,75 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					projection: "slim"
 				})).tracks;
 			},
-			...this.isPostProcessingNode ? { timelapse: this.buildTimelapsePorts(api, stores) } : {}
+			...this.isPostProcessingNode ? { timelapse: this.buildTimelapsePorts(api, stores) } : {},
+			...this.isPostProcessingNode ? { summary: this.buildSummaryPorts(stores) } : {}
 		});
 		this.wireAlarmPanel(this.notificationCenter);
 		await this.serveNcActionPlane(this.notificationCenter);
 		await this.notificationCenter.start({ evaluation: this.isPostProcessingNode });
 	}
 	/**
+	* The multi-camera digest producer's ports.
+	*
+	* Every one reads something this process already owns: the LOCAL track store
+	* for the window (no self-cap call, `projection: 'slim'` because the selector
+	* reads timestamps, class, zones and importance and nothing else), the LOCAL
+	* media store for the index rows and the one blob per tile, and the NC
+	* artifact plane for the public link.
+	*
+	* The mosaic is filed through the SAME `mediaStore` every event thumbnail
+	* goes through — the operator's directive, verbatim: same data structure,
+	* same storage location, no second retained store. It is written under
+	* `ownerKind: 'event'` with the window's own owner id, so it lands beside the
+	* cameras' event media (`<deviceId>/events/event/<ownerId>/…`) and is swept
+	* by the same machinery. It is deliberately NOT owned by a track: a track's
+	* media list is a LIVE viewer surface, and a cross-camera mosaic appearing in
+	* one track's tiles would be a picture that lies about what it is of.
+	*/
+	buildSummaryPorts(stores) {
+		return {
+			listTracks: async ({ deviceId, sinceMs, untilMs, limit }) => {
+				return (await stores.trackStore.queryHistorical({
+					deviceId,
+					since: sinceMs,
+					until: untilMs,
+					projection: "slim",
+					limit
+				})).map((t) => ({
+					trackId: t.trackId,
+					deviceId: t.deviceId,
+					className: t.className,
+					firstSeen: t.firstSeen,
+					lastSeen: t.lastSeen,
+					...t.importance !== void 0 ? { importance: t.importance } : {},
+					zones: [...t.zonesVisited],
+					...t.classes !== void 0 ? { classes: [...t.classes] } : {}
+				}));
+			},
+			listMediaInfo: async (trackId) => {
+				return (await stores.mediaStore.listInfoByOwner("track", trackId)).map((r) => ({
+					key: r.key,
+					kind: r.kind,
+					timestamp: r.timestamp
+				}));
+			},
+			readMedia: async (key) => {
+				const file = await stores.mediaStore.getByKey(key);
+				if (file === null) return null;
+				return Buffer.from(file.base64, "base64");
+			},
+			storeMosaic: async ({ deviceId, ownerId, timestamp, jpeg }) => stores.mediaStore.put({
+				deviceId,
+				ownerKind: "event",
+				ownerId,
+				kind: "fullFrame",
+				timestamp,
+				data: jpeg
+			}),
+			publish: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null
+		};
+	}
+	/**
 	* The scheduled-timelapse producer's ports.
 	*
 	* Every one of them is something that already exists: `recording` for the
@@ -41670,6 +43924,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			pacingMs: input.pacingMs ?? 50
 		} });
 		const deviceIds = input.deviceId !== void 0 ? [input.deviceId] : await trackStore.listDeviceIds();
+		const recordedStills = new RecordedStillService(buildRecordedStillPorts({
+			api: this.ctx.api.recording,
+			logger: this.ctx.logger
+		}));
 		const deps = {
 			listTrackIdPage: async (cursor) => {
 				const page = await trackStore.queryRecent({
@@ -41688,6 +43946,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				media: mediaStore,
 				events: eventStore
 			}, trackId),
+			recoverKeyFrame: async (source) => {
+				const recovered = await recordedStills.recover(source.deviceId, source.timestamp, RECOVERED_KEY_FRAME_MAX_WIDTH);
+				return recovered.outcome === "ok" ? recovered.jpeg ?? null : null;
+			},
 			canDispatch: () => dispatcher.canDispatch,
 			pause: (ms) => sleep(ms),
 			embed: (source) => dispatcher.embed(source),
@@ -41715,6 +43977,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				scanned: 0,
 				rebuilt: 0,
 				missingKeyFrame: 0,
+				recoveredKeyFrame: 0,
 				missingEvent: 0,
 				missingBbox: 0,
 				notRunnable: 0,