@camstack/addon-post-analysis 1.2.7 → 1.2.8

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { A as object, C as BaseAddon, D as array, E as hydrateSchema, M as EventCategory, O as boolean, S as errMsg, T as createEvent, _ as pipelineAnalyticsCapability, a as NC_CONDITION_CATALOG, b as videoclipsCapability, c as addonWidgetsSourceCapability, d as cosineSimilarity, g as notificationRulesCapability, h as nodePin, i as MACRO_LABELS, j as string, k as number, l as audioMetricsCapability, n as EVENT_KIND_BY_CAP, o as NcRuleSchema, p as faceGalleryCapability, r as EVENT_PAD_MS, s as OpsLogEntrySchema, t as DEFAULT_EVENT_COLOR, u as buildEventKindDescriptor, v as plateGalleryCapability, w as DeviceType, x as zoneAnalyticsCapability, y as subKindsOf } from "../dist-D5fcvkof.mjs";
+import { A as BaseAddon, B as EventCategory, C as notificationRulesCapability, D as videoclipsCapability, E as subKindsOf, F as boolean, I as literal, L as number, M as createEvent, N as hydrateSchema, O as zoneAnalyticsCapability, P as array, R as object, S as nodePin, T as plateGalleryCapability, _ as customAction, a as NC_CONDITION_CATALOG, b as faceGalleryCapability, c as NcRuleInputSchema, d as NcTaxonomySchema, f as OpsLogEntrySchema, g as cosineSimilarity, h as buildEventKindDescriptor, i as MACRO_LABELS, j as DeviceType, k as errMsg, l as NcRulePatchSchema, m as audioMetricsCapability, n as EVENT_KIND_BY_CAP, o as NC_TAXONOMY, p as addonWidgetsSourceCapability, r as EVENT_PAD_MS, s as NcConditionDescriptorSchema, t as DEFAULT_EVENT_COLOR, u as NcRuleSchema, v as defineCustomActions, w as pipelineAnalyticsCapability, z as string } from "../dist-Dm1I_IVp.mjs";
 import { randomUUID } from "node:crypto";
 import sharp from "sharp";
 //#region src/pipeline-analytics/videoclips-provider.ts
@@ -395,7 +395,11 @@ var FaceGalleryProvider = class {
 				assigned: face.assigned,
 				...base64 !== void 0 ? { base64 } : {},
 				...face.faceBbox !== void 0 ? { faceBbox: face.faceBbox } : {},
-				...face.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: face.keyFrameMediaKey } : {}
+				...face.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: face.keyFrameMediaKey } : {},
+				...face.bestMatchScore != null ? { bestMatchScore: face.bestMatchScore } : {},
+				...face.nativeFaceShortSidePx != null ? { nativeFaceShortSidePx: face.nativeFaceShortSidePx } : {},
+				...face.suggestedIdentityId != null ? { suggestedIdentityId: face.suggestedIdentityId } : {},
+				...face.suggestedMatchScore != null ? { suggestedMatchScore: face.suggestedMatchScore } : {}
 			});
 		}
 		return result;
@@ -425,7 +429,11 @@ var FaceGalleryProvider = class {
 			assigned: face.assigned,
 			...base64 !== void 0 ? { base64 } : {},
 			...face.faceBbox !== void 0 ? { faceBbox: face.faceBbox } : {},
-			...face.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: face.keyFrameMediaKey } : {}
+			...face.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: face.keyFrameMediaKey } : {},
+			...face.bestMatchScore != null ? { bestMatchScore: face.bestMatchScore } : {},
+			...face.nativeFaceShortSidePx != null ? { nativeFaceShortSidePx: face.nativeFaceShortSidePx } : {},
+			...face.suggestedIdentityId != null ? { suggestedIdentityId: face.suggestedIdentityId } : {},
+			...face.suggestedMatchScore != null ? { suggestedMatchScore: face.suggestedMatchScore } : {}
 		};
 	}
 	/**
@@ -627,16 +635,25 @@ var FaceGalleryProvider = class {
 function normalizePlate$1(text) {
 	return text.toUpperCase().replace(/[^A-Z0-9]/g, "");
 }
+/** Raw-read glyphs a real plate can never contain: anything outside letters,
+*  digits, whitespace and the hyphen (display separator). The OCR charset
+*  includes bracket/punctuation glyphs, so a blurred crop can hallucinate
+*  reads like "[miv4o)" / "6ou.2" (live-observed 2026-07-22) that a
+*  length-only gate lets through. */
+var PLATE_SYMBOL_GLYPH = /[^A-Za-z0-9\s-]/;
 /**
 * Quality gate for a raw OCR plate read BEFORE it becomes a track label or a
 * gallery row. Distant/oblique parked plates produce junk reads ("N", "Idag",
 * "@em") that otherwise flood track labels (live-observed on the parking
 * camera, 2026-07-16). A plausible European plate is ≥{@link PLATE_MIN_LENGTH}
-* alphanumerics and mixes letters AND digits; anything else — or a read below
+* alphanumerics, mixes letters AND digits, and carries NO symbol glyph in the
+* RAW read (spaces/hyphens allowed — normalization would silently strip a
+* hallucinated "[" and launder the junk); anything else — or a read below
 * {@link PLATE_MIN_SCORE} — is discarded, not stored.
 */
 function isPlausiblePlateRead(text, score) {
 	if (score < .4) return false;
+	if (PLATE_SYMBOL_GLYPH.test(text)) return false;
 	const norm = normalizePlate$1(text);
 	if (norm.length < 4) return false;
 	return /[0-9]/.test(norm) && /[A-Z]/.test(norm);
@@ -2867,6 +2884,7 @@ var TrackResidentState = class {
 		const created = {
 			deviceId,
 			firstFramePending: false,
+			firstFrameLanded: false,
 			thumbnailLanded: false,
 			confirmed: false
 		};
@@ -2924,6 +2942,17 @@ var TrackResidentState = class {
 	bestFramePeak(trackId) {
 		return this.bestFrameTracker.peak(trackId);
 	}
+	/** #27-A: record the track's best-seen subject bbox. Called by the frame
+	*  loop on every ACCEPTED (new-best AND plausible-box) observe, so the value
+	*  always mirrors the frame the latest keyFrame re-shot was seeded from. */
+	recordBestSeenBbox(deviceId, trackId, bbox) {
+		this.ensure(deviceId, trackId).bestBbox = bbox;
+	}
+	/** The track's best-seen subject bbox (undefined until a plausible new-best
+	*  was observed). Backs the retry gate + the close-time keyFrame crop. */
+	bestSeenBbox(trackId) {
+		return this.residents.get(trackId)?.bestBbox;
+	}
 	/** Record a CLIP-object observation for the track's best-EMBEDDING ranking
 	*  (confidence-only policy). Returns true on a new best. */
 	observeObjectEmbeddingBest(deviceId, obs) {
@@ -2967,6 +2996,13 @@ var TrackResidentState = class {
 		const resident = this.residents.get(trackId);
 		if (resident) resident.firstFramePending = false;
 	}
+	/** A `firstFrame` write landed for this track (see {@link TrackResident.firstFrameLanded}). */
+	markFirstFrameLanded(deviceId, trackId) {
+		this.ensure(deviceId, trackId).firstFrameLanded = true;
+	}
+	isFirstFrameLanded(trackId) {
+		return this.residents.get(trackId)?.firstFrameLanded ?? false;
+	}
 	isThumbnailLanded(trackId) {
 		return this.residents.get(trackId)?.thumbnailLanded ?? false;
 	}
@@ -3001,81 +3037,131 @@ var TrackResidentState = class {
 		if (resident.rasterFallback === void 0) resident.rasterFallback = fallback;
 	}
 };
-var DEFAULT_ZERO_MEDIA_POLICY_CONFIG = {
-	suppressMaxDurationMs: 1e3,
-	nothingToShowMaxDurationMs: 1500
-};
-/**
-* Classify a closing track's persistence outcome. Pure — see the module header
-* for the full contract.
-*/
-function decideZeroMediaPolicy(input, config = DEFAULT_ZERO_MEDIA_POLICY_CONFIG) {
-	if (input.hasMedia) return "persist";
-	if (input.durationMs < config.suppressMaxDurationMs && !input.confirmed) return "suppress";
-	if (!input.hasRasterFallback && input.durationMs < config.nothingToShowMaxDurationMs) return "suppress";
-	return input.hasRasterFallback ? "raster-fallback" : "persist";
-}
 //#endregion
-//#region src/pipeline-analytics/pipeline/last-frame-promotion.ts
+//#region src/pipeline-analytics/store/zone-geometry.ts
 /**
-* Decide whether a closing track's newest `snapshot` should be promoted to be
-* its `lastFrame`. Pure — see the module header for the contract.
-*
-* Promote when there is at least one `snapshot` AND either there is no
-* `lastFrame` yet, or the newest snapshot is strictly newer than the held
-* `lastFrame`. Otherwise keep the current behaviour (no promotion).
+* Normalized min/max envelope over every position's bbox. Returns `null`
+* when the frame dimensions are unknown/degenerate or there are no
+* positions — the caller persists NULL envelope columns in that case.
 */
-function decideLastFramePromotion(media) {
-	let newestSnapshot;
-	let lastFrame;
-	for (const m of media) if (m.kind === "snapshot") {
-		if (newestSnapshot === void 0 || m.timestamp > newestSnapshot.timestamp) newestSnapshot = m;
-	} else if (m.kind === "lastFrame") {
-		if (lastFrame === void 0 || m.timestamp > lastFrame.timestamp) lastFrame = m;
+function computeTrackEnvelope(positions, frameWidth, frameHeight) {
+	if (frameWidth === void 0 || frameHeight === void 0 || !(frameWidth > 0) || !(frameHeight > 0) || positions.length === 0) return null;
+	let minX = Number.POSITIVE_INFINITY;
+	let minY = Number.POSITIVE_INFINITY;
+	let maxX = Number.NEGATIVE_INFINITY;
+	let maxY = Number.NEGATIVE_INFINITY;
+	for (const p of positions) {
+		const x0 = p.bbox.x / frameWidth;
+		const y0 = p.bbox.y / frameHeight;
+		const x1 = (p.bbox.x + p.bbox.w) / frameWidth;
+		const y1 = (p.bbox.y + p.bbox.h) / frameHeight;
+		if (x0 < minX) minX = x0;
+		if (y0 < minY) minY = y0;
+		if (x1 > maxX) maxX = x1;
+		if (y1 > maxY) maxY = y1;
 	}
-	if (newestSnapshot === void 0) return { promote: false };
-	if (lastFrame !== void 0 && newestSnapshot.timestamp <= lastFrame.timestamp) return { promote: false };
 	return {
-		promote: true,
-		snapshotKey: newestSnapshot.key,
-		snapshotTimestamp: newestSnapshot.timestamp
+		minX,
+		minY,
+		maxX,
+		maxY
 	};
 }
-//#endregion
-//#region src/pipeline-analytics/pipeline/static-track-gate.ts
 /**
-* Net displacement + path span for a track's centroid path, normalized to
-* `referenceDiagonalPx`. Returns undefined when there is nothing meaningful to
-* measure (fewer than two points, or a degenerate ≤0 reference) so the caller
-* leaves the importance score untouched.
+* Axis-aligned bounds of a zone filter (rect: itself; polygon: vertex
+* min/max). A degenerate polygon (< 3 points) yields the full frame so the
+* SQL prefilter never silently drops rows the precise test would keep.
 */
-function computeStaticTrackMetrics(centroids, referenceDiagonalPx) {
-	if (!(referenceDiagonalPx > 0) || centroids.length < 2) return void 0;
-	const first = centroids[0];
-	const last = centroids[centroids.length - 1];
-	const netDisplacementFrac = Math.hypot(last.x - first.x, last.y - first.y) / referenceDiagonalPx;
-	let minX = Infinity;
-	let minY = Infinity;
-	let maxX = -Infinity;
-	let maxY = -Infinity;
-	for (const c of centroids) {
-		if (c.x < minX) minX = c.x;
-		if (c.x > maxX) maxX = c.x;
-		if (c.y < minY) minY = c.y;
-		if (c.y > maxY) maxY = c.y;
+function zoneBounds(zone) {
+	if (zone.kind === "rect") return {
+		minX: zone.x,
+		minY: zone.y,
+		maxX: zone.x + zone.width,
+		maxY: zone.y + zone.height
+	};
+	if (zone.points.length < 3) return {
+		minX: 0,
+		minY: 0,
+		maxX: 1,
+		maxY: 1
+	};
+	let minX = Number.POSITIVE_INFINITY;
+	let minY = Number.POSITIVE_INFINITY;
+	let maxX = Number.NEGATIVE_INFINITY;
+	let maxY = Number.NEGATIVE_INFINITY;
+	for (const p of zone.points) {
+		if (p.x < minX) minX = p.x;
+		if (p.y < minY) minY = p.y;
+		if (p.x > maxX) maxX = p.x;
+		if (p.y > maxY) maxY = p.y;
 	}
 	return {
-		netDisplacementFrac,
-		pathSpanFrac: Math.hypot(maxX - minX, maxY - minY) / referenceDiagonalPx
+		minX,
+		minY,
+		maxX,
+		maxY
 	};
 }
-/** Average bbox diagonal (px) across a track's positions — the scale reference
-*  when frame dimensions aren't available. Returns 0 for an empty list. */
-function averageBboxDiagonal(boxes) {
-	if (boxes.length === 0) return 0;
-	let sum = 0;
-	for (const b of boxes) sum += Math.hypot(b.w, b.h);
-	return sum / boxes.length;
+/** Whether two axis-aligned envelopes overlap (touching edges count). */
+function envelopesOverlap(a, b) {
+	return a.minX <= b.maxX && a.maxX >= b.minX && a.minY <= b.maxY && a.maxY >= b.minY;
+}
+/**
+* Ray-casting point-in-polygon (even-odd rule). Points on an edge may
+* resolve either way — acceptable for zone filtering. A polygon with
+* fewer than 3 vertices contains nothing.
+*/
+function pointInPolygon(point, polygon) {
+	if (polygon.length < 3) return false;
+	let inside = false;
+	for (let i = 0, j = polygon.length - 1; i < polygon.length; j = i++) {
+		const a = polygon[i];
+		const b = polygon[j];
+		if (a.y > point.y !== b.y > point.y && point.x < (b.x - a.x) * (point.y - a.y) / (b.y - a.y) + a.x) inside = !inside;
+	}
+	return inside;
+}
+/**
+* Precise per-position zone test.
+*
+*   - rect zone     → any position bbox (normalized) intersects the rect.
+*   - polygon zone  → any position CENTER (normalized `x`/`y` — positions
+*                     store the bbox center) falls inside the polygon.
+*
+* Unknown/degenerate frame dims → `true` (the track cannot be tested, so it
+* PASSES — mirroring the NULL-envelope-matches rule).
+*/
+function positionsIntersectZone(positions, frameWidth, frameHeight, zone) {
+	if (frameWidth === void 0 || frameHeight === void 0 || !(frameWidth > 0) || !(frameHeight > 0)) return true;
+	if (zone.kind === "rect") {
+		const rect = zoneBounds(zone);
+		for (const p of positions) if (envelopesOverlap({
+			minX: p.bbox.x / frameWidth,
+			minY: p.bbox.y / frameHeight,
+			maxX: (p.bbox.x + p.bbox.w) / frameWidth,
+			maxY: (p.bbox.y + p.bbox.h) / frameHeight
+		}, rect)) return true;
+		return false;
+	}
+	for (const p of positions) if (pointInPolygon({
+		x: p.x / frameWidth,
+		y: p.y / frameHeight
+	}, zone.points)) return true;
+	return false;
+}
+var DEFAULT_ZERO_MEDIA_POLICY_CONFIG = {
+	suppressMaxDurationMs: 1e3,
+	nothingToShowMaxDurationMs: 1500
+};
+/**
+* Classify a closing track's persistence outcome. Pure — see the module header
+* for the full contract.
+*/
+function decideZeroMediaPolicy(input, config = DEFAULT_ZERO_MEDIA_POLICY_CONFIG) {
+	if (input.hasMedia) return "persist";
+	if (input.durationMs < config.suppressMaxDurationMs && !input.confirmed) return "suppress";
+	if (!input.hasRasterFallback && input.durationMs < config.nothingToShowMaxDurationMs) return "suppress";
+	return input.hasRasterFallback ? "raster-fallback" : "persist";
 }
 //#endregion
 //#region src/pipeline-analytics/pipeline/delete-track-cascade.ts
@@ -3140,6 +3226,83 @@ async function runTrackCascadeBatch(deps, trackIds) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/last-frame-promotion.ts
+/**
+* Decide whether a closing track's newest `snapshot` should be promoted to be
+* its `lastFrame`. Pure — see the module header for the contract.
+*
+* Promote (`mode:'move'`) when there is at least one `snapshot` AND either
+* there is no `lastFrame` yet, or the newest snapshot is strictly newer than
+* the held `lastFrame`. With NO snapshot AND NO lastFrame at all (a track that
+* died within one snapshot interval), fall back to `mode:'copy'` from the
+* newest `keyFrameSmall` so a short track still closes with a full-frame
+* "Ultimo" view. Otherwise no promotion.
+*/
+function decideLastFramePromotion(media) {
+	let newestSnapshot;
+	let lastFrame;
+	let newestKeyFrameSmall;
+	for (const m of media) if (m.kind === "snapshot") {
+		if (newestSnapshot === void 0 || m.timestamp > newestSnapshot.timestamp) newestSnapshot = m;
+	} else if (m.kind === "lastFrame") {
+		if (lastFrame === void 0 || m.timestamp > lastFrame.timestamp) lastFrame = m;
+	} else if (m.kind === "keyFrameSmall") {
+		if (newestKeyFrameSmall === void 0 || m.timestamp > newestKeyFrameSmall.timestamp) newestKeyFrameSmall = m;
+	}
+	if (newestSnapshot === void 0) {
+		if (lastFrame === void 0 && newestKeyFrameSmall !== void 0) return {
+			promote: true,
+			mode: "copy",
+			snapshotKey: newestKeyFrameSmall.key,
+			snapshotTimestamp: newestKeyFrameSmall.timestamp
+		};
+		return { promote: false };
+	}
+	if (lastFrame !== void 0 && newestSnapshot.timestamp <= lastFrame.timestamp) return { promote: false };
+	return {
+		promote: true,
+		mode: "move",
+		snapshotKey: newestSnapshot.key,
+		snapshotTimestamp: newestSnapshot.timestamp
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/static-track-gate.ts
+/**
+* Net displacement + path span for a track's centroid path, normalized to
+* `referenceDiagonalPx`. Returns undefined when there is nothing meaningful to
+* measure (fewer than two points, or a degenerate ≤0 reference) so the caller
+* leaves the importance score untouched.
+*/
+function computeStaticTrackMetrics(centroids, referenceDiagonalPx) {
+	if (!(referenceDiagonalPx > 0) || centroids.length < 2) return void 0;
+	const first = centroids[0];
+	const last = centroids[centroids.length - 1];
+	const netDisplacementFrac = Math.hypot(last.x - first.x, last.y - first.y) / referenceDiagonalPx;
+	let minX = Infinity;
+	let minY = Infinity;
+	let maxX = -Infinity;
+	let maxY = -Infinity;
+	for (const c of centroids) {
+		if (c.x < minX) minX = c.x;
+		if (c.x > maxX) maxX = c.x;
+		if (c.y < minY) minY = c.y;
+		if (c.y > maxY) maxY = c.y;
+	}
+	return {
+		netDisplacementFrac,
+		pathSpanFrac: Math.hypot(maxX - minX, maxY - minY) / referenceDiagonalPx
+	};
+}
+/** Average bbox diagonal (px) across a track's positions — the scale reference
+*  when frame dimensions aren't available. Returns 0 for an empty list. */
+function averageBboxDiagonal(boxes) {
+	if (boxes.length === 0) return 0;
+	let sum = 0;
+	for (const b of boxes) sum += Math.hypot(b.w, b.h);
+	return sum / boxes.length;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/track-close.ts
 var TrackCloser = class {
 	deps;
@@ -3210,6 +3373,7 @@ var TrackCloser = class {
 		}
 		if (outcome === "raster-fallback" && closure?.rasterFallback) await this.commitRasterFallback(t, closure.rasterFallback.jpeg, closure.rasterFallback.timestamp);
 		await this.maybePromoteLastFrame(t, ownedMedia);
+		await this.maybeDeriveThumbnailFromKeyFrame(t, ownedMedia);
 		this.deps.logger.info("track ended", {
 			tags: { deviceId: t.deviceId },
 			meta: {
@@ -3220,6 +3384,7 @@ var TrackCloser = class {
 			}
 		});
 		const keyFrameMediaKey = this.deps.residents.keyFrameKey(t.trackId);
+		const labelConfidence = this.bestLabelMatchConfidence(t.deviceId, t.trackId);
 		this.fireRecognizerEnds(t.deviceId, t.trackId);
 		const trackerPeak = this.deps.residents.bestFramePeak(t.trackId);
 		const importanceSummary = await this.scoreImportance(t, duration, trackerPeak?.confidence);
@@ -3228,7 +3393,23 @@ var TrackCloser = class {
 		this.deps.overlayState.onTrackEnded(t.deviceId, t.trackId);
 		this.flushCaptureWindowIfIdle(t.deviceId);
 		this.emitEndEvents(t, duration, trackerPeak?.confidence, keyFrameMediaKey, importanceSummary);
-		this.deps.onTrackClosed?.(t, ownedMedia, { ...trackerPeak?.confidence !== void 0 ? { bestConfidence: trackerPeak.confidence } : {} });
+		const dims = this.deps.frameDims(t.deviceId);
+		const envelope = computeTrackEnvelope(t.positions, dims?.w, dims?.h);
+		this.deps.onTrackClosed?.(t, ownedMedia, {
+			...trackerPeak?.confidence !== void 0 ? { bestConfidence: trackerPeak.confidence } : {},
+			...importanceSummary.importance !== void 0 ? { importance: importanceSummary.importance } : {},
+			...labelConfidence !== void 0 ? { labelConfidence } : {},
+			...envelope !== null ? { envelope } : {}
+		});
+	}
+	/** Max recognition match confidence over the face + plate recognizers for a
+	*  closing track (undefined when neither recognized a label). */
+	bestLabelMatchConfidence(_deviceId, trackId) {
+		const face = this.deps.faceRecognizer()?.bestLabelMatchConfidence?.(trackId);
+		const plate = this.deps.plateRecognizer()?.bestLabelMatchConfidence?.(trackId);
+		if (face === void 0) return plate;
+		if (plate === void 0) return face;
+		return Math.max(face, plate);
 	}
 	/**
 	* Undo a zero-media false-birth track (spec §"Zero-media track policy"): tear
@@ -3295,27 +3476,95 @@ var TrackCloser = class {
 		}
 	}
 	/**
-	* Genuinely-last view (operator, 2026-07-22): the rolling `lastFrame` never
-	* fires on a `snapshot` frame and rolls on its own cadence, so at close it
-	* can trail the newest appended snapshot by up to one interval. If a newer
-	* snapshot exists (or there is no lastFrame but ≥1 snapshot), PROMOTE it
-	* into the single lastFrame slot and drop the snapshot row — one
-	* genuinely-last view, no duplicate pair. Reuses the `ownedMedia` list
-	* already fetched by the caller (base64 present → no re-read).
+	* Close-time keyFrame-derived `thumbnail` fallback (#27-A part 3): when the
+	* closing track's owned media has NO `thumbnail` but HAS a native `keyFrame`,
+	* derive the thumbnail (+ `thumbnailSmall`) from the persisted keyFrame,
+	* cropping the BEST-seen subject bbox with the standard 16:9 central-square
+	* framing (the derive is injected — `createKeyFrameCrop` composed with the
+	* wide-central-square layout in the addon wiring). Best-effort with its own
+	* catch: any failure leaves the track as it was and never blocks the close.
 	*/
-	async maybePromoteLastFrame(t, ownedMedia) {
-		const promotion = decideLastFramePromotion(ownedMedia);
-		if (!promotion.promote) return;
-		const snapshot = ownedMedia.find((m) => m.key === promotion.snapshotKey);
-		if (!snapshot) return;
+	async maybeDeriveThumbnailFromKeyFrame(t, ownedMedia) {
+		const derive = this.deps.deriveThumbnailFromKeyFrame;
+		if (!derive) return;
+		if (ownedMedia.some((m) => m.kind === "thumbnail")) return;
+		const keyFrame = ownedMedia.find((m) => m.kind === "keyFrame");
+		if (!keyFrame) return;
+		const bestSeen = this.deps.residents.bestSeenBbox(t.trackId);
+		if (!bestSeen) return;
 		try {
-			await this.deps.mediaStore()?.promoteToLastFrame({
-				deviceId: t.deviceId,
-				trackId: t.trackId,
-				snapshot
+			const derived = await derive({
+				mediaKey: keyFrame.key,
+				bbox: {
+					x: bestSeen.x,
+					y: bestSeen.y,
+					w: bestSeen.w,
+					h: bestSeen.h
+				},
+				frameWidth: bestSeen.frameWidth,
+				frameHeight: bestSeen.frameHeight,
+				timestamp: bestSeen.timestamp
 			});
-		} catch (err) {
-			this.deps.logger.debug("lastFrame promotion failed", {
+			if (!derived) return;
+			const mediaStore = this.deps.mediaStore();
+			if (!mediaStore) return;
+			await mediaStore.put({
+				deviceId: t.deviceId,
+				ownerKind: "track",
+				ownerId: t.trackId,
+				kind: "thumbnail",
+				timestamp: bestSeen.timestamp,
+				data: derived.thumbnail
+			});
+			await mediaStore.put({
+				deviceId: t.deviceId,
+				ownerKind: "track",
+				ownerId: t.trackId,
+				kind: "thumbnailSmall",
+				timestamp: bestSeen.timestamp,
+				data: derived.thumbnailSmall
+			});
+			this.deps.logger.info("thumbnail derived from keyFrame at close (no live best-shot landed)", {
+				tags: { deviceId: t.deviceId },
+				meta: {
+					trackId: t.trackId,
+					keyFrameKey: keyFrame.key,
+					skewMs: derived.skewMs
+				}
+			});
+		} catch (err) {
+			this.deps.logger.debug("close-time keyFrame thumbnail derive failed", {
+				tags: { deviceId: t.deviceId },
+				meta: {
+					trackId: t.trackId,
+					error: String(err)
+				}
+			});
+		}
+	}
+	/**
+	* Genuinely-last view (operator, 2026-07-22): the rolling `lastFrame` never
+	* fires on a `snapshot` frame and rolls on its own cadence, so at close it
+	* can trail the newest appended snapshot by up to one interval. If a newer
+	* snapshot exists (or there is no lastFrame but ≥1 snapshot), PROMOTE it
+	* into the single lastFrame slot and drop the snapshot row — one
+	* genuinely-last view, no duplicate pair. Reuses the `ownedMedia` list
+	* already fetched by the caller (base64 present → no re-read).
+	*/
+	async maybePromoteLastFrame(t, ownedMedia) {
+		const promotion = decideLastFramePromotion(ownedMedia);
+		if (!promotion.promote) return;
+		const snapshot = ownedMedia.find((m) => m.key === promotion.snapshotKey);
+		if (!snapshot) return;
+		try {
+			await this.deps.mediaStore()?.promoteToLastFrame({
+				deviceId: t.deviceId,
+				trackId: t.trackId,
+				snapshot,
+				keepSource: promotion.mode === "copy"
+			});
+		} catch (err) {
+			this.deps.logger.debug("lastFrame promotion failed", {
 				tags: { deviceId: t.deviceId },
 				meta: {
 					trackId: t.trackId,
@@ -3416,6 +3665,23 @@ var TrackCloser = class {
 };
 //#endregion
 //#region src/notification-center/rule-engine.ts
+/**
+* Normalize a PIXEL-space detection bbox onto 0..1 using its detection-frame
+* dims. Returns `undefined` when the box or the dims are missing/degenerate
+* (dim ≤ 0) — the caller then omits the subject bbox and `customZones` fails
+* closed rather than testing pixel coords against a 0..1 polygon.
+*/
+function normalizeBbox(bbox, frameWidth, frameHeight) {
+	if (bbox === void 0) return void 0;
+	if (frameWidth === void 0 || frameHeight === void 0) return void 0;
+	if (frameWidth <= 0 || frameHeight <= 0) return void 0;
+	return {
+		x: bbox.x / frameWidth,
+		y: bbox.y / frameHeight,
+		w: bbox.w / frameWidth,
+		h: bbox.h / frameHeight
+	};
+}
 /** Build the subject for an `immediate` (object-event) evaluation. */
 function subjectFromObjectEvent(ev) {
 	return {
@@ -3427,7 +3693,132 @@ function subjectFromObjectEvent(ev) {
 		...ev.label !== void 0 ? { label: ev.label } : {},
 		...ev.confidence !== void 0 ? { confidence: ev.confidence } : {},
 		zones: ev.zones ?? [],
-		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {}
+		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {},
+		source: ev.source ?? "pipeline",
+		...ev.importance !== void 0 ? { importance: ev.importance } : {},
+		...bboxPatch(normalizeBbox(ev.bbox, ev.frameWidth, ev.frameHeight))
+	};
+}
+/** Spread an optional normalized bbox onto a subject (present only if set). */
+function bboxPatch(bbox) {
+	return bbox !== void 0 ? { bbox } : {};
+}
+/** Convert a normalized 0..1 track envelope (min/max) into the subject's
+*  top-left+size `BboxRect`. `undefined` in ⇒ `undefined` out (fail closed). */
+function envelopeToBbox(envelope) {
+	if (envelope === void 0) return void 0;
+	return {
+		x: envelope.minX,
+		y: envelope.minY,
+		w: envelope.maxX - envelope.minX,
+		h: envelope.maxY - envelope.minY
+	};
+}
+/**
+* Read the raw device event-type token off a persisted `SensorEvent.value`
+* slice. Only the event-emitter cap carries one (`EventEmitterStatus.lastEvent
+* .eventType`); doorbell-pulse / passive-sensor slices have none. Pure +
+* defensive over the untyped record snapshot.
+*/
+function readSensorEventType(value) {
+	if (value === null) return void 0;
+	const last = value["lastEvent"];
+	if (last === null || typeof last !== "object" || Array.isArray(last)) return void 0;
+	const eventType = last["eventType"];
+	return typeof eventType === "string" && eventType.length > 0 ? eventType : void 0;
+}
+/** Build the subject for a `device-event` evaluation (a persisted SensorEvent —
+*  one row per linked camera; `deviceId` is the CAMERA). */
+function subjectFromSensorEvent(ev) {
+	const eventType = readSensorEventType(ev.value);
+	return {
+		kind: "device-event",
+		recordId: ev.id,
+		deviceId: ev.deviceId,
+		timestamp: ev.timestamp,
+		classNames: [],
+		zones: [],
+		source: "sensor",
+		sensorKind: ev.kind,
+		...eventType !== void 0 ? { eventType } : {}
+	};
+}
+/**
+* Build the subject for an AUDIO evaluation. Audio classification events
+* (`eventStore.insertAudio`) persist on a SEPARATE path from object events and
+* never reach the object-event hook — this normalizes one onto the engine
+* subject so an `immediate` rule that OPTS IN to an `audio-*` class can fire on
+* it. The class id is the SAME namespaced `audio-<macroClass>` id the NC
+* taxonomy exposes (see `nc-taxonomy.ts` audioKinds), so a picker selection
+* matches exactly. `confidence` carries the classification score (so a
+* `minConfidence` condition composes naturally). A level-path audio event (no
+* `classification`) yields NO class ⇒ it can never satisfy the audio opt-in
+* gate, so only classified audio ever notifies (documented boundary). Audio has
+* no zones / bbox / label / track, so the object/track-specific conditions all
+* fail closed (see the {@link evaluateRule} audio gate + the matchers below).
+*/
+function subjectFromAudioEvent(ev) {
+	const macro = ev.classification?.className;
+	return {
+		kind: "audio-event",
+		recordId: ev.id,
+		deviceId: ev.deviceId,
+		timestamp: ev.timestamp,
+		classNames: macro !== void 0 ? [`audio-${macro}`] : [],
+		...ev.classification?.score !== void 0 ? { confidence: ev.classification.score } : {},
+		zones: [],
+		source: "pipeline"
+	};
+}
+/**
+* Build the subject for an OCCUPANCY evaluation. A committed `OccupancyEdge`
+* (ZoneAnalytics count crossing) rides the EXISTING `device-event` delivery via
+* this INTERNAL subject kind (the audio pattern with a device-event landing —
+* `device-event` is already a native `NcHistoryRecordKind`, so no history
+* downgrade is needed). The edge scope + count/threshold ride on `occupancy`;
+* the engine's occupancy branch matches the rule's `occupancy` condition against
+* it. Admin-zone provenance is NOT copied onto `zones` (kept empty) so the admin
+* `zones` condition FAILS CLOSED on occupancy — zone scoping is done inside the
+* occupancy condition (`occupancy.zoneId`). No detection confidence / label /
+* bbox / importance / sensorKind, so those conditions all fail closed too.
+*/
+function subjectFromOccupancyEvent(edge) {
+	return {
+		kind: "occupancy-event",
+		recordId: `occ:${edge.deviceId}:${edge.zoneId ?? "@frame"}:${edge.className ?? "@all"}:t${edge.threshold}:${edge.occupied ? "occ" : "free"}:${edge.timestamp}`,
+		deviceId: edge.deviceId,
+		timestamp: edge.timestamp,
+		classNames: [edge.className ?? "occupancy"],
+		zones: [],
+		source: "pipeline",
+		occupancy: {
+			...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
+			...edge.zoneName !== void 0 ? { zoneName: edge.zoneName } : {},
+			...edge.className !== void 0 ? { className: edge.className } : {},
+			count: edge.count,
+			previousCount: edge.previousCount,
+			occupied: edge.occupied,
+			threshold: edge.threshold
+		}
+	};
+}
+/** Build the subject for a `package-event` evaluation (a persisted `package`
+*  object-event; `phase` derives from the event `state` at the call site). */
+function subjectFromPackageEvent(ev, phase) {
+	return {
+		kind: "package-event",
+		recordId: ev.id,
+		deviceId: ev.deviceId,
+		timestamp: ev.timestamp,
+		classNames: [ev.className],
+		...ev.label !== void 0 ? { label: ev.label } : {},
+		...ev.confidence !== void 0 ? { confidence: ev.confidence } : {},
+		zones: ev.zones ?? [],
+		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {},
+		source: ev.source ?? "pipeline",
+		...ev.importance !== void 0 ? { importance: ev.importance } : {},
+		...bboxPatch(normalizeBbox(ev.bbox, ev.frameWidth, ev.frameHeight)),
+		packagePhase: phase
 	};
 }
 /** Build the subject for a `track-end` evaluation. */
@@ -3441,20 +3832,105 @@ function subjectFromTrack(track, info) {
 		...track.label !== void 0 ? { label: track.label } : {},
 		...info?.bestConfidence !== void 0 ? { confidence: info.bestConfidence } : {},
 		zones: track.zonesVisited,
-		trackId: track.trackId
+		trackId: track.trackId,
+		source: track.source ?? "pipeline",
+		...(info?.importance ?? track.importance) !== void 0 ? { importance: info?.importance ?? track.importance } : {},
+		dwellSeconds: (track.lastSeen - track.firstSeen) / 1e3,
+		...info?.labelConfidence !== void 0 ? { labelConfidence: info.labelConfidence } : {},
+		...bboxPatch(envelopeToBbox(info?.envelope ?? track.envelope))
 	};
 }
-var PASS = { matched: true };
 function fail(condition) {
 	return {
 		matched: false,
 		failedCondition: condition
 	};
 }
+/**
+* The condition ids PRESENT on a rule (an empty/absent group contributes
+* nothing). Order follows the catalog. On a matched rule every id returned
+* here passed, so the list is the rule's "matched on" summary.
+*/
+function presentConditionIds(c) {
+	const ids = [];
+	if (c.devices !== void 0 && c.devices.length > 0) ids.push("devices");
+	if (c.source !== void 0 && c.source !== "any") ids.push("source");
+	if (c.classes !== void 0 && c.classes.length > 0) ids.push("classes");
+	if (c.classesExclude !== void 0 && c.classesExclude.length > 0) ids.push("classesExclude");
+	if (c.minConfidence !== void 0) ids.push("minConfidence");
+	if (c.minImportance !== void 0) ids.push("minImportance");
+	if (c.minDwellSeconds !== void 0) ids.push("minDwellSeconds");
+	if (c.zones !== void 0) ids.push("zones");
+	if (c.zonesExclude !== void 0 && c.zonesExclude.length > 0) ids.push("zonesExclude");
+	if (c.labelEquals !== void 0 && c.labelEquals.length > 0) ids.push("labelEquals");
+	if (c.identities !== void 0 && c.identities.length > 0) ids.push("identities");
+	if (c.identitiesExclude !== void 0 && c.identitiesExclude.length > 0) ids.push("identitiesExclude");
+	if (c.minLabelConfidence !== void 0) ids.push("minLabelConfidence");
+	if (c.plates !== void 0) ids.push("plates");
+	if (c.sensorKinds !== void 0 && c.sensorKinds.length > 0) ids.push("sensorKinds");
+	if (c.eventTypeTokens !== void 0 && c.eventTypeTokens.length > 0) ids.push("eventTypeTokens");
+	if (c.packagePhase !== void 0 && c.packagePhase !== "both") ids.push("packagePhase");
+	if (c.customZones !== void 0 && c.customZones.length > 0) ids.push("customZones");
+	if (c.occupancy !== void 0) ids.push("occupancy");
+	return ids;
+}
+/**
+* Match a rule's occupancy condition against the subject's committed count-edge.
+* The scope (`zoneId`/`className`) must match EXACTLY (fail-closed), then the
+* `op` selects the edge polarity + threshold:
+*  - `became-occupied` / `>=` C → the occupied (false→true) edge of the key
+*    whose threshold is C.
+*  - `became-free` C            → the un-occupied (true→false) edge of key C.
+*  - `<=` C                     → the un-occupied edge of key C+1 (count dropped
+*    from >C to ≤C — the predicate `count ≥ C+1` went false).
+* Per-threshold keying guarantees the subject's `threshold` already equals the
+* key's, so a rule matches only its OWN edge — a ≥1 and a ≥3 rule never
+* cross-fire on a gradual accumulation.
+*/
+function matchesOccupancy(occ, s) {
+	if ((occ.zoneId ?? void 0) !== (s.zoneId ?? void 0)) return false;
+	if ((occ.className ?? void 0) !== (s.className ?? void 0)) return false;
+	switch (occ.op) {
+		case "became-occupied":
+		case ">=": return s.occupied === true && s.threshold === occ.count;
+		case "became-free": return s.occupied === false && s.threshold === occ.count;
+		case "<=": return s.occupied === false && s.threshold === occ.count + 1;
+	}
+}
 function toLowerSet(values) {
 	return new Set(values.map((v) => v.trim().toLowerCase()));
 }
 /**
+* Expand each selected class id to itself PLUS its taxonomy leaf subs, so a
+* MACRO selection (`vehicle`) matches its sub classNames (`car`/`truck`) — the
+* `EVENT_TAXONOMY` tree is the SINGLE source (mirrors the timeline/filter
+* grouping). A leaf id expands to just itself. Applies to the video class
+* matchers (`classes` / `classesExclude`); audio ids (`audio-*`) are leaves so
+* they expand to themselves. Lower-cased for the case-insensitive membership
+* test.
+*/
+function expandClassSelector(classes) {
+	const out = /* @__PURE__ */ new Set();
+	for (const raw of classes) {
+		const c = raw.trim().toLowerCase();
+		if (c.length === 0) continue;
+		out.add(c);
+		for (const subEntry of subKindsOf(c)) out.add(subEntry.kind.trim().toLowerCase());
+	}
+	return out;
+}
+/**
+* True when a rule's `classes` condition explicitly opts in to at least one
+* audio kind (`audio-*` id). The safety gate for audio subjects: an `immediate`
+* rule fires on an audio subject ONLY when it names an audio class — a rule with
+* no classes, or with only video classes, NEVER fires on audio (preserves
+* today's behavior, where classified audio never reached the engine at all).
+*/
+function referencesAudioClass(classes) {
+	if (classes === void 0) return false;
+	return classes.some((c) => c.trim().toLowerCase().startsWith("audio-"));
+}
+/**
 * Evaluate one rule against one subject. The rule's `delivery` must match
 * the subject kind (`immediate` ↔ `object-event`, `track-end` ↔
 * `track-end`) — a mismatch fails with `'delivery'`. Schedule is evaluated
@@ -3465,12 +3941,27 @@ function toLowerSet(values) {
 * is stateful; see {@link cooldownKey} / {@link isCoolingDown}.
 */
 function evaluateRule(rule, subject) {
-	if ((rule.delivery === "immediate" ? "object-event" : "track-end") !== subject.kind) return fail("delivery");
+	if (subject.kind === "occupancy-event") {
+		if (rule.delivery !== "device-event") return fail("delivery");
+		const occ = rule.conditions.occupancy;
+		if (occ === void 0) return fail("occupancy");
+		if (subject.occupancy === void 0 || !matchesOccupancy(occ, subject.occupancy)) return fail("occupancy");
+	} else if (subject.kind === "audio-event") {
+		if (rule.delivery !== "immediate") return fail("delivery");
+		if (!referencesAudioClass(rule.conditions.classes)) return fail("classes");
+		if (rule.conditions.occupancy !== void 0) return fail("occupancy");
+	} else {
+		if ((rule.delivery === "immediate" ? "object-event" : rule.delivery) !== subject.kind) return fail("delivery");
+		if (rule.conditions.occupancy !== void 0) return fail("occupancy");
+	}
 	const c = rule.conditions;
 	if (c.devices !== void 0 && c.devices.length > 0 && !c.devices.includes(subject.deviceId)) return fail("devices");
+	if (c.source !== void 0 && c.source !== "any") {
+		if ((subject.source ?? "pipeline") !== c.source) return fail("source");
+	}
 	const subjectClasses = toLowerSet(subject.classNames);
 	if (c.classes !== void 0 && c.classes.length > 0) {
-		const wanted = toLowerSet(c.classes);
+		const wanted = expandClassSelector(c.classes);
 		let overlap = false;
 		for (const cls of subjectClasses) if (wanted.has(cls)) {
 			overlap = true;
@@ -3479,12 +3970,18 @@ function evaluateRule(rule, subject) {
 		if (!overlap) return fail("classes");
 	}
 	if (c.classesExclude !== void 0 && c.classesExclude.length > 0) {
-		const vetoed = toLowerSet(c.classesExclude);
+		const vetoed = expandClassSelector(c.classesExclude);
 		for (const cls of subjectClasses) if (vetoed.has(cls)) return fail("classesExclude");
 	}
 	if (c.minConfidence !== void 0) {
 		if (subject.confidence === void 0 || subject.confidence < c.minConfidence) return fail("minConfidence");
 	}
+	if (c.minImportance !== void 0) {
+		if (subject.importance === void 0 || subject.importance < c.minImportance) return fail("minImportance");
+	}
+	if (c.minDwellSeconds !== void 0) {
+		if (subject.dwellSeconds === void 0 || subject.dwellSeconds < c.minDwellSeconds) return fail("minDwellSeconds");
+	}
 	if (c.zones !== void 0) {
 		const visited = new Set(subject.zones);
 		if (c.zones.match === "all") {
@@ -3495,6 +3992,10 @@ function evaluateRule(rule, subject) {
 		const visited = new Set(subject.zones);
 		if (c.zonesExclude.some((id) => visited.has(id))) return fail("zonesExclude");
 	}
+	if (c.customZones !== void 0 && c.customZones.length > 0) {
+		const bbox = subject.bbox;
+		if (!(bbox !== void 0 && c.customZones.some((poly) => bboxPolygonOverlap(bbox, poly.points) > 0))) return fail("customZones");
+	}
 	const label = subject.label?.trim().toLowerCase();
 	if (c.labelEquals !== void 0 && c.labelEquals.length > 0) {
 		if (label === void 0 || !toLowerSet(c.labelEquals).has(label)) return fail("labelEquals");
@@ -3502,11 +4003,29 @@ function evaluateRule(rule, subject) {
 	if (c.identities !== void 0 && c.identities.length > 0) {
 		if (label === void 0 || !toLowerSet(c.identities).has(label)) return fail("identities");
 	}
+	if (c.identitiesExclude !== void 0 && c.identitiesExclude.length > 0) {
+		if (label !== void 0 && toLowerSet(c.identitiesExclude).has(label)) return fail("identitiesExclude");
+	}
+	if (c.minLabelConfidence !== void 0) {
+		if (subject.labelConfidence === void 0 || subject.labelConfidence < c.minLabelConfidence) return fail("minLabelConfidence");
+	}
 	if (c.plates !== void 0) {
 		if (subject.label === void 0 || !matchesPlate(subject.label, c.plates.values, c.plates.maxDistance)) return fail("plates");
 	}
+	if (c.sensorKinds !== void 0 && c.sensorKinds.length > 0) {
+		if (subject.sensorKind === void 0 || !toLowerSet(c.sensorKinds).has(subject.sensorKind.trim().toLowerCase())) return fail("sensorKinds");
+	}
+	if (c.eventTypeTokens !== void 0 && c.eventTypeTokens.length > 0) {
+		if (subject.eventType === void 0 || !toLowerSet(c.eventTypeTokens).has(subject.eventType.trim().toLowerCase())) return fail("eventTypeTokens");
+	}
+	if (c.packagePhase !== void 0 && c.packagePhase !== "both") {
+		if (subject.packagePhase !== c.packagePhase) return fail("packagePhase");
+	}
 	if (!isScheduleActive(rule.schedule, subject.timestamp)) return fail("schedule");
-	return PASS;
+	return {
+		matched: true,
+		matchedOn: presentConditionIds(c)
+	};
 }
 var WEEKDAY_TO_DAY = {
 	Sun: 0,
@@ -3601,7 +4120,8 @@ function matchesPlate(label, values, maxDistance) {
 }
 /** Stable cooldown key per the rule's throttle scope. */
 function cooldownKey(rule, subject) {
-	return rule.throttle.scope === "rule" ? `r:${rule.id}` : `r:${rule.id}:d:${subject.deviceId}`;
+	const audioClass = subject.kind === "audio-event" && subject.classNames[0] !== void 0 ? `:c:${subject.classNames[0]}` : "";
+	return rule.throttle.scope === "rule" ? `r:${rule.id}${audioClass}` : `r:${rule.id}:d:${subject.deviceId}${audioClass}`;
 }
 /** True when the rule fired within its cooldown window before `now`. */
 function isCoolingDown(rule, lastFiredAt, now) {
@@ -3636,171 +4156,231 @@ function attachmentKindPreference(policy, ownerKind) {
 		"fullFrameBoxed"
 	];
 }
+/**
+* Derive the `best-matching` media signal from a matched rule's condition
+* summary ({@link NcEvaluation.matchedOn}). Identity takes priority over plate
+* (D-3 ordering: a face rule that ALSO plate-matched attaches the face crop).
+*/
+function matchSignal(matchedOn) {
+	if (matchedOn === void 0) return null;
+	if (matchedOn.includes("identities")) return "face";
+	if (matchedOn.includes("plates")) return "plate";
+	return null;
+}
+/**
+* Ordered media-kind preference for a `best-matching` attachment. The
+* signal-specific crop (`faceCrop` / `plateCrop`, both event-owned) leads;
+* then the plain `best` subject ladder, then the `keyFrame` clean-scene
+* ladder — so a missing specific crop degrades to best → keyFrame → none
+* (the dispatcher returns null when nothing resolves) without ever blocking
+* the send. A `null` signal is exactly the `best` ladder.
+*/
+function bestMatchingKindPreference(signal, ownerKind) {
+	return [
+		...signal === "face" ? ["faceCrop"] : signal === "plate" ? ["plateCrop"] : [],
+		...attachmentKindPreference("best", ownerKind),
+		...attachmentKindPreference("keyFrame", ownerKind)
+	];
+}
 //#endregion
-//#region src/notification-center/rule-store.ts
-var NC_RULES_COLLECTION = "notification-center:rules";
-var NC_RULES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "name",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "enabled",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "delivery",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	(
-	/** The FULL rule object (Zod-validated on read) — scalars above are
-	*  indexed projections only. */
-	{
-		name: "rule",
-		type: "JSON",
-		notNull: true
-	})
-];
-var NC_RULES_INDEXES = [{
-	name: "idx_nc_rules_enabled",
-	columns: ["enabled"]
-}];
-var NcRuleStore = class {
-	byId = /* @__PURE__ */ new Map();
-	store;
-	logger;
+//#region src/notification-center/dispatcher.ts
+var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
+var NcDispatcher = class {
+	deps;
+	targetCache = null;
+	targetCacheAt = 0;
 	now;
-	newId;
+	targetCacheTtlMs;
 	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
+		this.deps = deps;
 		this.now = deps.now ?? (() => Date.now());
-		this.newId = deps.newId ?? (() => randomUUID());
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: NC_RULES_COLLECTION,
-			columns: [...NC_RULES_COLUMNS],
-			indexes: [...NC_RULES_INDEXES]
-		});
+		this.targetCacheTtlMs = deps.targetCacheTtlMs ?? DEFAULT_TARGET_CACHE_TTL_MS;
 	}
-	/**
-	* (Re)hydrate the FULL rule set from the store — called at boot and on
-	* the periodic refresh tick (cross-node CRUD staleness bound). Replaces
-	* the cache wholesale; a row whose JSON no longer validates is skipped
-	* with a warning (a degraded rule must never crash evaluation).
-	*/
-	async load() {
+	/** The outbox `deliver` executor. */
+	async deliver(entry) {
+		if (this.deps.isRuleTargetDisabled !== void 0) {
+			if (await this.deps.isRuleTargetDisabled(entry.ruleId, entry.targetId)) {
+				this.deps.logger.debug("notification skipped: target opted out of rule", { meta: {
+					ruleId: entry.ruleId,
+					targetId: entry.targetId
+				} });
+				return { ok: true };
+			}
+		}
+		const target = await this.resolveTarget(entry.targetId);
+		if (target === null) return {
+			ok: false,
+			error: `target not found: ${entry.targetId}`,
+			permanent: true
+		};
+		if (!target.enabled) {
+			this.deps.logger.debug("notification skipped: target globally disabled", { meta: {
+				ruleId: entry.ruleId,
+				targetId: target.id,
+				target: target.name
+			} });
+			return { ok: true };
+		}
+		const notification = await this.buildNotification(entry);
 		try {
-			const rows = await this.store.query.query({
-				collection: NC_RULES_COLLECTION,
-				filter: { limit: 1e4 }
+			const result = await this.deps.send({
+				addonId: target.addonId,
+				targetId: target.id,
+				notification
 			});
-			this.byId.clear();
-			let skipped = 0;
-			for (const row of rows) {
-				const parsed = NcRuleSchema.safeParse(row.data["rule"]);
-				if (!parsed.success) {
-					skipped += 1;
-					continue;
+			if (!result.success) return {
+				ok: false,
+				error: result.error ?? "send failed",
+				permanent: false
+			};
+			this.deps.logger.info("notification delivered", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					ruleId: entry.ruleId,
+					target: target.name,
+					kind: target.kind,
+					recordKind: entry.recordKind
 				}
-				this.byId.set(parsed.data.id, parsed.data);
-			}
-			this.logger.debug("notification rules loaded", { meta: {
-				rules: this.byId.size,
-				...skipped > 0 ? { skippedInvalid: skipped } : {}
-			} });
+			});
+			return { ok: true };
 		} catch (err) {
-			this.logger.warn("notification rules load failed", { meta: { error: String(err) } });
+			return {
+				ok: false,
+				error: String(err),
+				permanent: false
+			};
 		}
 	}
-	list() {
-		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
-	}
-	listEnabled(delivery) {
-		return this.list().filter((r) => r.enabled && r.delivery === delivery);
-	}
-	get(ruleId) {
-		return this.byId.get(ruleId) ?? null;
+	async resolveTarget(targetId) {
+		const cached = this.cachedTarget(targetId);
+		if (cached !== null) return cached;
+		try {
+			const targets = await this.deps.listTargets();
+			this.targetCache = new Map(targets.map((t) => [t.id, t]));
+			this.targetCacheAt = this.now();
+		} catch (err) {
+			this.deps.logger.warn("target catalog refresh failed", { meta: { error: String(err) } });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+		return this.targetCache.get(targetId) ?? null;
 	}
-	/** Create a new rule. `createdBy` is the SERVER-injected caller userId. */
-	async create(input, createdBy) {
-		const now = this.now();
-		const rule = {
-			...input,
-			id: this.newId(),
-			createdBy,
-			createdAt: now,
-			updatedAt: now
-		};
-		await this.persist(rule);
-		this.byId.set(rule.id, rule);
-		return rule;
+	cachedTarget(targetId) {
+		if (this.targetCache === null) return null;
+		if (this.now() - this.targetCacheAt > this.targetCacheTtlMs) return null;
+		return this.targetCache.get(targetId) ?? null;
 	}
-	/** Apply a partial patch. Immutable: returns the NEW rule object. */
-	async update(ruleId, patch) {
-		const existing = this.byId.get(ruleId);
-		if (!existing) throw new Error(`notification rule not found: ${ruleId}`);
-		const candidate = {
-			...existing,
-			...patch,
-			id: existing.id,
-			createdBy: existing.createdBy,
-			createdAt: existing.createdAt,
-			updatedAt: this.now()
+	async buildNotification(entry) {
+		const subject = entry.payload.subject;
+		const deviceName = await this.deps.getDeviceName(subject.deviceId).catch(() => null) ?? `camera ${subject.deviceId}`;
+		const vars = buildTemplateVars(entry, deviceName);
+		const title = renderTemplate(entry.payload.template?.title, vars) ?? entry.payload.ruleName;
+		const body = renderTemplate(entry.payload.template?.body, vars) ?? defaultBody(entry, deviceName);
+		const attachment = await this.resolveAttachment(entry);
+		const params = pickParams(entry.payload.params);
+		return {
+			body,
+			title,
+			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
+			...params,
+			tag: entry.ruleId,
+			deviceId: subject.deviceId,
+			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
+			...attachment !== null ? { attachments: [attachment] } : {}
 		};
-		const updated = NcRuleSchema.parse(candidate);
-		await this.persist(updated);
-		this.byId.set(updated.id, updated);
-		return updated;
 	}
-	async setEnabled(ruleId, enabled) {
-		return this.update(ruleId, { enabled });
-	}
-	/** Idempotent delete — unknown ids are a no-op. */
-	async delete(ruleId) {
-		this.byId.delete(ruleId);
-		try {
-			await this.store.delete.mutate({
-				collection: NC_RULES_COLLECTION,
-				key: ruleId
-			});
+	/**
+	* Resolve ONE image attachment per the rule's media policy, best
+	* AVAILABLE at send time. Preference order comes from the pure
+	* {@link attachmentKindPreference} / {@link bestMatchingKindPreference};
+	* the event owner is tried first for `immediate` entries, falling back to
+	* the parent track's media set. `best-matching` leads with the crop that
+	* explains the fired condition (`faceCrop`/`plateCrop`, both event-owned)
+	* then degrades to the plain `best` → `keyFrame` ladders.
+	*/
+	async resolveAttachment(entry) {
+		const policy = entry.payload.media;
+		if (policy === "none") return null;
+		const subject = entry.payload.subject;
+		const signal = policy === "best-matching" ? matchSignal(entry.payload.matchedOn) : null;
+		const owners = [];
+		if (subject.eventId !== void 0) owners.push({
+			kind: "event",
+			id: subject.eventId
+		});
+		if (subject.trackId !== void 0) owners.push({
+			kind: "track",
+			id: subject.trackId
+		});
+		if (policy === "keyFrame") owners.reverse();
+		for (const owner of owners) try {
+			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
+			if (files.length === 0) continue;
+			const preference = policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
+			for (const kind of preference) {
+				const file = files.find((f) => f.kind === kind);
+				if (file === void 0) continue;
+				const raw = Buffer.from(file.base64, "base64");
+				if (raw.byteLength === 0) continue;
+				const bytes = new Uint8Array(raw.byteLength);
+				bytes.set(raw);
+				return {
+					mediaType: "image",
+					bytes,
+					mime: "image/jpeg",
+					name: `${file.kind}.jpg`
+				};
+			}
 		} catch (err) {
-			this.logger.warn("notification rule delete failed", { meta: {
-				ruleId,
+			this.deps.logger.debug("attachment media read failed", { meta: {
+				owner: owner.kind,
+				ownerId: owner.id,
 				error: String(err)
 			} });
-			throw err instanceof Error ? err : new Error(String(err));
 		}
-	}
-	async persist(rule) {
-		await this.store.set.mutate({
-			collection: NC_RULES_COLLECTION,
-			key: rule.id,
-			value: {
-				name: rule.name,
-				enabled: rule.enabled,
-				delivery: rule.delivery,
-				updatedAt: rule.updatedAt,
-				rule
-			}
-		});
+		return null;
 	}
 };
+function buildTemplateVars(entry, deviceName) {
+	const subject = entry.payload.subject;
+	return {
+		camera: deviceName,
+		class: subject.className,
+		label: subject.label ?? "",
+		zones: subject.zones.join(", "),
+		zone: subject.zones[0] ?? "",
+		confidence: subject.confidence !== void 0 ? `${Math.round(subject.confidence * 100)}%` : "",
+		time: new Date(subject.timestamp).toLocaleTimeString(),
+		rule: entry.payload.ruleName
+	};
+}
+/** `{{var}}` interpolation; missing vars render empty. Null template → null. */
+function renderTemplate(template, vars) {
+	if (template === void 0 || template.trim().length === 0) return null;
+	return template.replace(/\{\{\s*(\w+)\s*\}\}/g, (_m, name) => vars[name] ?? "");
+}
+function defaultBody(entry, deviceName) {
+	const subject = entry.payload.subject;
+	const label = subject.label !== void 0 ? ` (${subject.label})` : "";
+	const zones = subject.zones.length > 0 ? ` in ${subject.zones.join(", ")}` : "";
+	const suffix = entry.recordKind === "track-end" ? " — visit ended" : "";
+	return `${subject.className}${label} on ${deviceName}${zones}${suffix}`;
+}
+function pickParams(params) {
+	if (params === void 0) return {};
+	const out = {};
+	if (typeof params["level"] === "string") out.level = params["level"];
+	if (typeof params["sound"] === "string") out.sound = params["sound"];
+	if (typeof params["clickUrl"] === "string") out.clickUrl = params["clickUrl"];
+	if (typeof params["ttl"] === "number" && Number.isFinite(params["ttl"])) out.ttl = params["ttl"];
+	return out;
+}
+function paramNumber(params, key) {
+	const v = params?.[key];
+	return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function clampPriority(priority) {
+	return Math.max(1, Math.min(5, Math.round(priority)));
+}
 //#endregion
 //#region src/notification-center/outbox.ts
 var NC_OUTBOX_COLLECTION = "notification-center:outbox";
@@ -4046,6 +4626,48 @@ var NcOutbox = class {
 			return [];
 		}
 	}
+	/**
+	* Query persisted outbox rows as DELIVERY HISTORY — newest-first (by fire
+	* time `createdAt`), bounded by `limit`. History is a read-only VIEW over
+	* the outbox: the very rows the drain loop drives, in every lifecycle
+	* state (pending / sent / dead). There is no second write path, so a
+	* history row can never diverge from delivery state.
+	*
+	* Filters (`ruleId` / `deviceId` / `status` / `since`..`until`) are pushed
+	* to the store; the in-memory `pending` map is deliberately NOT consulted
+	* (terminal sent / dead rows live only in the store). Best-effort: a store
+	* error yields an empty page rather than throwing into the cap call.
+	*/
+	async queryHistory(query) {
+		const where = {};
+		if (query.ruleId !== void 0) where["ruleId"] = query.ruleId;
+		if (query.deviceId !== void 0) where["deviceId"] = query.deviceId;
+		if (query.status !== void 0) where["status"] = query.status;
+		const hasRange = query.since !== void 0 || query.until !== void 0;
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_OUTBOX_COLLECTION,
+				filter: {
+					...Object.keys(where).length > 0 ? { where } : {},
+					...hasRange ? { whereBetween: { createdAt: [query.since ?? 0, query.until ?? Number.MAX_SAFE_INTEGER] } } : {},
+					orderBy: {
+						field: "createdAt",
+						direction: "desc"
+					},
+					limit: query.limit
+				}
+			});
+			const out = [];
+			for (const row of rows) {
+				const entry = rowToEntry$1(row.id, row.data);
+				if (entry !== null) out.push(entry);
+			}
+			return out;
+		} catch (err) {
+			this.logger.debug("outbox history query failed", { meta: { error: String(err) } });
+			return [];
+		}
+	}
 	async getWatermark() {
 		try {
 			const row = await this.store.get.query({
@@ -4197,6 +4819,16 @@ function entryToRow(entry) {
 		payload: entry.payload
 	};
 }
+var OUTBOX_RECORD_KINDS = new Set([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event",
+	"audio-event"
+]);
+function isOutboxRecordKind(x) {
+	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
+}
 function rowToEntry$1(id, data) {
 	const ruleId = data["ruleId"];
 	const targetId = data["targetId"];
@@ -4205,7 +4837,7 @@ function rowToEntry$1(id, data) {
 	const recordId = data["recordId"];
 	const status = data["status"];
 	const payload = data["payload"];
-	if (typeof ruleId !== "string" || typeof targetId !== "string" || !Number.isFinite(deviceId) || recordKind !== "object-event" && recordKind !== "track-end" || typeof recordId !== "string" || status !== "pending" && status !== "sent" && status !== "dead" || payload === null || typeof payload !== "object") return null;
+	if (typeof ruleId !== "string" || typeof targetId !== "string" || !Number.isFinite(deviceId) || !isOutboxRecordKind(recordKind) || typeof recordId !== "string" || status !== "pending" && status !== "sent" && status !== "dead" || payload === null || typeof payload !== "object") return null;
 	const trackId = data["trackId"];
 	const lastError = data["lastError"];
 	return {
@@ -4226,189 +4858,587 @@ function rowToEntry$1(id, data) {
 	};
 }
 //#endregion
-//#region src/notification-center/dispatcher.ts
-var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
-var NcDispatcher = class {
-	deps;
-	targetCache = null;
-	targetCacheAt = 0;
-	now;
-	targetCacheTtlMs;
-	constructor(deps) {
-		this.deps = deps;
-		this.now = deps.now ?? (() => Date.now());
-		this.targetCacheTtlMs = deps.targetCacheTtlMs ?? DEFAULT_TARGET_CACHE_TTL_MS;
+//#region src/notification-center/occupancy-watcher.ts
+/** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
+var FRAME_SCOPE = "@frame";
+var ALL_CLASSES = "@all";
+/** Prefix marking the trailing threshold segment (`t<n>`) — makes the grammar
+*  self-describing so a legacy three-segment key can never be mis-parsed as a
+*  four-segment one (the last segment of a legacy key is a className, never a
+*  `t<digits>` token). */
+var THRESHOLD_PREFIX = "t";
+var THRESHOLD_SEGMENT = /^t(\d+)$/;
+function occupancyKey(deviceId, zoneId, className, threshold) {
+	return `${deviceId}|${zoneId ?? FRAME_SCOPE}|${className ?? ALL_CLASSES}|${THRESHOLD_PREFIX}${threshold}`;
+}
+/**
+* Inverse of {@link occupancyKey} — the ONE place the key grammar is decoded, so
+* the durable store (whose column schema drops the derivable
+* `zoneId`/`className`/`threshold`) can reconstruct the full scope on reseed.
+*
+* The four-segment grammar is asserted EXACTLY: at least four segments AND a
+* trailing `t<digits>` threshold marker. A legacy three-segment key (no marker)
+* is REJECTED (`null`) rather than positionally mis-parsed — the durable store
+* then SKIPS that row, so a pre-amendment persisted row cold-re-observes instead
+* of hydrating a corrupt scope (className←threshold, zoneId←class). `deviceId`
+* is the leading numeric segment, `threshold` the trailing `t<n>`, `className`
+* the segment before it, and the (possibly `|`-containing) `zoneId` everything
+* between. Exact per-segment count is impossible because a `zoneId` may itself
+* contain `|`; the trailing marker is the unambiguous grammar discriminator.
+*/
+function parseOccupancyKey(key) {
+	const parts = key.split("|");
+	if (parts.length < 4) return null;
+	const deviceId = Number(parts[0]);
+	if (!Number.isFinite(deviceId)) return null;
+	const thresholdMatch = THRESHOLD_SEGMENT.exec(parts[parts.length - 1] ?? "");
+	if (thresholdMatch === null) return null;
+	const threshold = Number(thresholdMatch[1]);
+	const className = parts[parts.length - 2] ?? ALL_CLASSES;
+	const zoneId = parts.slice(1, -2).join("|");
+	return {
+		deviceId,
+		...zoneId !== FRAME_SCOPE ? { zoneId } : {},
+		...className !== ALL_CLASSES ? { className } : {},
+		threshold
+	};
+}
+/** Device-agnostic partial key (`zone|class|t<threshold>`) — the merge/watch
+*  granularity. Distinct thresholds are distinct partial keys (per-threshold). */
+function partialKey(zoneId, className, threshold) {
+	return `${zoneId ?? FRAME_SCOPE}|${className ?? ALL_CLASSES}|${THRESHOLD_PREFIX}${threshold}`;
+}
+/** The device-agnostic partial key of a full state/edge key — everything after
+*  the leading `deviceId|` segment. */
+function partialKeyOf(key) {
+	const idx = key.indexOf("|");
+	return idx < 0 ? key : key.slice(idx + 1);
+}
+var OccupancyWatcher = class {
+	/** Watched specs, keyed by their device-agnostic partial key. */
+	watched = /* @__PURE__ */ new Map();
+	/** Confirmed + pending state, keyed by the full {@link OccupancyKey}. */
+	states = /* @__PURE__ */ new Map();
+	/**
+	* Replace the watched key set (rule-driven — recomputed on rule change).
+	* Each distinct `(zone, class, threshold)` is its OWN watched partial key
+	* (per-threshold edges — NO min-threshold merge). Specs that collide on the
+	* SAME `(zone, class, threshold)` merge to the MAX sustain (longest debounce),
+	* so one watcher serves those co-threshold rules. Confirmed state for a key
+	* that is no longer watched is DROPPED (bounds the RAM map + lets the caller
+	* prune the durable row to the active set); a still-watched key retains its
+	* level (re-evaluated on the next `observe`).
+	*/
+	setWatchedKeys(specs) {
+		this.watched.clear();
+		for (const spec of specs) {
+			const pk = partialKey(spec.zoneId, spec.className, spec.threshold);
+			const existing = this.watched.get(pk);
+			if (existing === void 0) {
+				this.watched.set(pk, {
+					...spec.zoneId !== void 0 ? { zoneId: spec.zoneId } : {},
+					...spec.className !== void 0 ? { className: spec.className } : {},
+					threshold: spec.threshold,
+					sustainSeconds: spec.sustainSeconds
+				});
+				continue;
+			}
+			this.watched.set(pk, {
+				...existing,
+				sustainSeconds: Math.max(existing.sustainSeconds, spec.sustainSeconds)
+			});
+		}
+		for (const key of [...this.states.keys()]) if (!this.watched.has(partialKeyOf(key))) this.states.delete(key);
 	}
-	/** The outbox `deliver` executor. */
-	async deliver(entry) {
-		const target = await this.resolveTarget(entry.targetId);
-		if (target === null) return {
-			ok: false,
-			error: `target not found: ${entry.targetId}`,
-			permanent: true
-		};
-		if (!target.enabled) return {
-			ok: false,
-			error: `target disabled: ${target.name}`,
-			permanent: true
-		};
-		const notification = await this.buildNotification(entry);
-		try {
-			const result = await this.deps.send({
-				addonId: target.addonId,
-				targetId: target.id,
-				notification
+	/**
+	* Feed one camera snapshot at time `now`, returning the edges that COMMIT on
+	* this tick (usually none). Every watched key is evaluated for `deviceId`;
+	* fail-closed keys (absent zone) are skipped and hold no state.
+	*/
+	observe(deviceId, snapshot, now) {
+		const edges = [];
+		for (const spec of this.watched.values()) {
+			const resolved = resolveScope(snapshot, spec);
+			if (resolved === null) continue;
+			const key = occupancyKey(deviceId, spec.zoneId, spec.className, spec.threshold);
+			const edge = step(this.stateFor(key, deviceId, spec, now), spec, resolved, now);
+			if (edge !== null) edges.push(edge);
+		}
+		return edges;
+	}
+	/** Reseed confirmed state from durable rows (boot). Only rows whose key is
+	*  currently WATCHED are restored — an orphaned durable row (its rule gone)
+	*  is dropped, keeping the RAM map bounded to the active set. Pending edges
+	*  are not restored (fail-closed — they re-open on the next snapshots). */
+	hydrate(rows) {
+		for (const row of rows) {
+			if (!this.watched.has(partialKeyOf(row.key))) continue;
+			this.states.set(row.key, {
+				deviceId: row.deviceId,
+				...row.zoneId !== void 0 ? { zoneId: row.zoneId } : {},
+				...row.className !== void 0 ? { className: row.className } : {},
+				threshold: row.threshold,
+				confirmedCount: row.confirmedCount,
+				occupied: row.occupied,
+				lastChangeAt: row.lastChangeAt
 			});
-			if (!result.success) return {
-				ok: false,
-				error: result.error ?? "send failed",
-				permanent: false
-			};
-			this.deps.logger.info("notification delivered", {
-				tags: { deviceId: entry.deviceId },
-				meta: {
-					ruleId: entry.ruleId,
-					target: target.name,
-					kind: target.kind,
-					recordKind: entry.recordKind
-				}
-			});
-			return { ok: true };
-		} catch (err) {
-			return {
-				ok: false,
-				error: String(err),
-				permanent: false
-			};
 		}
 	}
-	async resolveTarget(targetId) {
-		const cached = this.cachedTarget(targetId);
-		if (cached !== null) return cached;
+	/** Snapshot the CONFIRMED state for durable persistence (pending excluded). */
+	snapshotState() {
+		const rows = [];
+		for (const [key, state] of this.states) rows.push({
+			key,
+			deviceId: state.deviceId,
+			...state.zoneId !== void 0 ? { zoneId: state.zoneId } : {},
+			...state.className !== void 0 ? { className: state.className } : {},
+			threshold: state.threshold,
+			confirmedCount: state.confirmedCount,
+			occupied: state.occupied,
+			lastChangeAt: state.lastChangeAt,
+			updatedAt: state.lastChangeAt
+		});
+		return rows;
+	}
+	stateFor(key, deviceId, spec, now) {
+		const existing = this.states.get(key);
+		if (existing !== void 0) return existing;
+		const fresh = {
+			deviceId,
+			...spec.zoneId !== void 0 ? { zoneId: spec.zoneId } : {},
+			...spec.className !== void 0 ? { className: spec.className } : {},
+			threshold: spec.threshold,
+			confirmedCount: 0,
+			occupied: false,
+			lastChangeAt: now
+		};
+		this.states.set(key, fresh);
+		return fresh;
+	}
+};
+/** Read the count (+ zone name) for a spec, or `null` when fail-closed. */
+function resolveScope(snapshot, spec) {
+	if (spec.zoneId === void 0) return { count: spec.className === void 0 ? snapshot.frame.totalObjects : snapshot.frame.byClass[spec.className] ?? 0 };
+	const zone = snapshot.zones.find((z) => z.zoneId === spec.zoneId);
+	if (zone === void 0) return null;
+	return {
+		count: spec.className === void 0 ? zone.totalObjects : zone.byClass[spec.className] ?? 0,
+		zoneName: zone.zoneName
+	};
+}
+/**
+* Advance one key's state by one observation. Mutates `state` in place (the
+* watcher owns it) and returns a committed edge, or `null`.
+*/
+function step(state, spec, resolved, now) {
+	const rawOccupied = resolved.count >= spec.threshold;
+	const sustainMs = spec.sustainSeconds * 1e3;
+	if (rawOccupied === state.occupied) {
+		state.pendingTargetOccupied = void 0;
+		state.pendingSince = void 0;
+		return null;
+	}
+	if (state.pendingTargetOccupied !== rawOccupied) {
+		state.pendingTargetOccupied = rawOccupied;
+		state.pendingSince = now;
+	}
+	if (now - (state.pendingSince ?? now) < sustainMs) return null;
+	const previousCount = state.confirmedCount;
+	state.confirmedCount = resolved.count;
+	state.occupied = rawOccupied;
+	state.lastChangeAt = now;
+	state.pendingTargetOccupied = void 0;
+	state.pendingSince = void 0;
+	return {
+		deviceId: state.deviceId,
+		...spec.zoneId !== void 0 ? { zoneId: spec.zoneId } : {},
+		...resolved.zoneName !== void 0 ? { zoneName: resolved.zoneName } : {},
+		...spec.className !== void 0 ? { className: spec.className } : {},
+		count: resolved.count,
+		previousCount,
+		occupied: rawOccupied,
+		threshold: spec.threshold,
+		timestamp: now
+	};
+}
+//#endregion
+//#region src/notification-center/occupancy-store.ts
+var NC_OCCUPANCY_COLLECTION = "notification-center:occupancy";
+var NC_OCCUPANCY_COLUMNS = [
+	{
+		name: "key",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "confirmedCount",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "occupied",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "lastChangeAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var NC_OCCUPANCY_INDEXES = [{
+	name: "idx_nc_occupancy_device",
+	columns: ["deviceId"]
+}];
+/** Query cap — a per-(device, zone, class) key set is small; this is a
+*  generous ceiling that still bounds a pathological read. */
+var LOAD_LIMIT = 1e5;
+var OccupancyStore = class {
+	cache = /* @__PURE__ */ new Map();
+	store;
+	logger;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_OCCUPANCY_COLLECTION,
+			columns: [...NC_OCCUPANCY_COLUMNS],
+			indexes: [...NC_OCCUPANCY_INDEXES]
+		});
+	}
+	/**
+	* Reseed the confirmed edge-state from the store (boot) — replaces the cache
+	* wholesale and returns the rows for {@link OccupancyWatcher.hydrate}. A row
+	* whose scalars/key no longer parse is skipped with a warning (a degraded row
+	* must never crash the reseed). Best-effort: a store error yields `[]` and a
+	* cold watcher, never a throw into boot.
+	*/
+	async load() {
 		try {
-			const targets = await this.deps.listTargets();
-			this.targetCache = new Map(targets.map((t) => [t.id, t]));
-			this.targetCacheAt = this.now();
+			const records = await this.store.query.query({
+				collection: NC_OCCUPANCY_COLLECTION,
+				filter: { limit: LOAD_LIMIT }
+			});
+			this.cache.clear();
+			let skipped = 0;
+			for (const record of records) {
+				const row = recordToRow(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				this.cache.set(row.key, row);
+			}
+			this.logger.debug("occupancy state loaded", { meta: {
+				keys: this.cache.size,
+				...skipped > 0 ? { skippedInvalid: skipped } : {}
+			} });
+			return [...this.cache.values()];
 		} catch (err) {
-			this.deps.logger.warn("target catalog refresh failed", { meta: { error: String(err) } });
-			throw err instanceof Error ? err : new Error(String(err));
+			this.logger.warn("occupancy state load failed", { meta: { error: String(err) } });
+			return [];
 		}
-		return this.targetCache.get(targetId) ?? null;
-	}
-	cachedTarget(targetId) {
-		if (this.targetCache === null) return null;
-		if (this.now() - this.targetCacheAt > this.targetCacheTtlMs) return null;
-		return this.targetCache.get(targetId) ?? null;
 	}
-	async buildNotification(entry) {
-		const subject = entry.payload.subject;
-		const deviceName = await this.deps.getDeviceName(subject.deviceId).catch(() => null) ?? `camera ${subject.deviceId}`;
-		const vars = buildTemplateVars(entry, deviceName);
-		const title = renderTemplate(entry.payload.template?.title, vars) ?? entry.payload.ruleName;
-		const body = renderTemplate(entry.payload.template?.body, vars) ?? defaultBody(entry, deviceName);
-		const attachment = await this.resolveAttachment(entry);
-		const params = pickParams(entry.payload.params);
-		return {
-			body,
-			title,
-			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
-			...params,
-			tag: entry.ruleId,
-			deviceId: subject.deviceId,
-			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
-			...attachment !== null ? { attachments: [attachment] } : {}
-		};
+	/** The in-RAM confirmed-state mirror (post-{@link load}/{@link persist}). */
+	snapshot() {
+		return [...this.cache.values()];
 	}
 	/**
-	* Resolve ONE image attachment per the rule's media policy, best
-	* AVAILABLE at send time. Preference order comes from the pure
-	* {@link attachmentKindPreference}; the event owner is tried first for
-	* `immediate` entries, falling back to the parent track's media set.
+	* Durably upsert one confirmed edge-state row (write-through: the store FIRST,
+	* then the cache — a failed persist never leaves a phantom in-RAM level). The
+	* `key` is the PK, so re-persisting a key advances it in place.
 	*/
-	async resolveAttachment(entry) {
-		const policy = entry.payload.media;
-		if (policy === "none") return null;
-		const subject = entry.payload.subject;
-		const owners = [];
-		if (subject.eventId !== void 0) owners.push({
-			kind: "event",
-			id: subject.eventId
-		});
-		if (subject.trackId !== void 0) owners.push({
-			kind: "track",
-			id: subject.trackId
+	async persist(row) {
+		await this.store.set.mutate({
+			collection: NC_OCCUPANCY_COLLECTION,
+			key: row.key,
+			value: rowToValue(row)
 		});
-		if (policy === "keyFrame") owners.reverse();
-		for (const owner of owners) try {
-			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
-			if (files.length === 0) continue;
-			const preference = attachmentKindPreference(policy, owner.kind);
-			for (const kind of preference) {
-				const file = files.find((f) => f.kind === kind);
-				if (file === void 0) continue;
-				const raw = Buffer.from(file.base64, "base64");
-				if (raw.byteLength === 0) continue;
-				const bytes = new Uint8Array(raw.byteLength);
-				bytes.set(raw);
-				return {
-					mediaType: "image",
-					bytes,
-					mime: "image/jpeg",
-					name: `${file.kind}.jpg`
-				};
+		this.cache.set(row.key, row);
+	}
+	/**
+	* Prune every persisted key NOT in `activeKeys` (the currently watched set) —
+	* the bounded-row-count guarantee when rules stop watching a key. Returns the
+	* number of rows dropped. Best-effort per row: a failed delete is logged and
+	* the key retained (retried next prune) rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.cache.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: NC_OCCUPANCY_COLLECTION,
+					key
+				});
+				this.cache.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("occupancy prune delete failed", { meta: {
+					key,
+					error: String(err)
+				} });
 			}
-		} catch (err) {
-			this.deps.logger.debug("attachment media read failed", { meta: {
-				owner: owner.kind,
-				ownerId: owner.id,
-				error: String(err)
-			} });
 		}
-		return null;
+		return pruned;
 	}
 };
-function buildTemplateVars(entry, deviceName) {
-	const subject = entry.payload.subject;
+/** The persisted column map for a row (the `key` PK is passed separately). */
+function rowToValue(row) {
 	return {
-		camera: deviceName,
-		class: subject.className,
-		label: subject.label ?? "",
-		zones: subject.zones.join(", "),
-		zone: subject.zones[0] ?? "",
-		confidence: subject.confidence !== void 0 ? `${Math.round(subject.confidence * 100)}%` : "",
-		time: new Date(subject.timestamp).toLocaleTimeString(),
-		rule: entry.payload.ruleName
+		deviceId: row.deviceId,
+		confirmedCount: row.confirmedCount,
+		occupied: row.occupied,
+		lastChangeAt: row.lastChangeAt,
+		updatedAt: row.updatedAt
 	};
 }
-/** `{{var}}` interpolation; missing vars render empty. Null template → null. */
-function renderTemplate(template, vars) {
-	if (template === void 0 || template.trim().length === 0) return null;
-	return template.replace(/\{\{\s*(\w+)\s*\}\}/g, (_m, name) => vars[name] ?? "");
-}
-function defaultBody(entry, deviceName) {
-	const subject = entry.payload.subject;
-	const label = subject.label !== void 0 ? ` (${subject.label})` : "";
-	const zones = subject.zones.length > 0 ? ` in ${subject.zones.join(", ")}` : "";
-	const suffix = entry.recordKind === "track-end" ? " — visit ended" : "";
-	return `${subject.className}${label} on ${deviceName}${zones}${suffix}`;
-}
-function pickParams(params) {
-	if (params === void 0) return {};
-	const out = {};
-	if (typeof params["level"] === "string") out.level = params["level"];
-	if (typeof params["sound"] === "string") out.sound = params["sound"];
-	if (typeof params["clickUrl"] === "string") out.clickUrl = params["clickUrl"];
-	if (typeof params["ttl"] === "number" && Number.isFinite(params["ttl"])) out.ttl = params["ttl"];
-	return out;
-}
-function paramNumber(params, key) {
-	const v = params?.[key];
-	return typeof v === "number" && Number.isFinite(v) ? v : void 0;
-}
-function clampPriority(priority) {
-	return Math.max(1, Math.min(5, Math.round(priority)));
+/**
+* Structurally validate a persisted record and reconstruct the full
+* {@link OccupancyStateRow} (deriving `zoneId`/`className`/`threshold` from the
+* key). Returns `null` for any malformed row — including a legacy
+* three-segment key with no `t<n>` threshold marker, which
+* {@link parseOccupancyKey} rejects — so the caller skips it (cold re-observe)
+* rather than hydrating a mis-parsed scope.
+*/
+function recordToRow(key, data) {
+	const scope = parseOccupancyKey(key);
+	if (scope === null) return null;
+	const deviceId = Number(data["deviceId"]);
+	const confirmedCount = Number(data["confirmedCount"]);
+	const lastChangeAt = Number(data["lastChangeAt"]);
+	const updatedAt = Number(data["updatedAt"]);
+	if (!Number.isFinite(deviceId) || !Number.isFinite(confirmedCount) || !Number.isFinite(lastChangeAt) || !Number.isFinite(updatedAt)) return null;
+	const rawOccupied = data["occupied"];
+	const occupied = rawOccupied === true || rawOccupied === 1;
+	return {
+		key,
+		deviceId,
+		...scope.zoneId !== void 0 ? { zoneId: scope.zoneId } : {},
+		...scope.className !== void 0 ? { className: scope.className } : {},
+		threshold: scope.threshold,
+		confirmedCount,
+		occupied,
+		lastChangeAt,
+		updatedAt
+	};
 }
 //#endregion
+//#region src/notification-center/rule-store.ts
+var NC_RULES_COLLECTION = "notification-center:rules";
+var NC_RULES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "enabled",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "delivery",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL rule object (Zod-validated on read) — scalars above are
+	*  indexed projections only. */
+	{
+		name: "rule",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NC_RULES_INDEXES = [{
+	name: "idx_nc_rules_enabled",
+	columns: ["enabled"]
+}];
+var NcRuleStore = class {
+	byId = /* @__PURE__ */ new Map();
+	store;
+	logger;
+	now;
+	newId;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.newId = deps.newId ?? (() => randomUUID());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_RULES_COLLECTION,
+			columns: [...NC_RULES_COLUMNS],
+			indexes: [...NC_RULES_INDEXES]
+		});
+	}
+	/**
+	* (Re)hydrate the FULL rule set from the store — called at boot and on
+	* the periodic refresh tick (cross-node CRUD staleness bound). Replaces
+	* the cache wholesale; a row whose JSON no longer validates is skipped
+	* with a warning (a degraded rule must never crash evaluation).
+	*/
+	async load() {
+		try {
+			const rows = await this.store.query.query({
+				collection: NC_RULES_COLLECTION,
+				filter: { limit: 1e4 }
+			});
+			this.byId.clear();
+			let skipped = 0;
+			for (const row of rows) {
+				const parsed = NcRuleSchema.safeParse(row.data["rule"]);
+				if (!parsed.success) {
+					skipped += 1;
+					continue;
+				}
+				this.byId.set(parsed.data.id, parsed.data);
+			}
+			this.logger.debug("notification rules loaded", { meta: {
+				rules: this.byId.size,
+				...skipped > 0 ? { skippedInvalid: skipped } : {}
+			} });
+		} catch (err) {
+			this.logger.warn("notification rules load failed", { meta: { error: String(err) } });
+		}
+	}
+	list() {
+		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
+	}
+	listEnabled(delivery) {
+		return this.list().filter((r) => r.enabled && r.delivery === delivery);
+	}
+	get(ruleId) {
+		return this.byId.get(ruleId) ?? null;
+	}
+	/**
+	* Rules visible to `userId`: their OWN personal rules (`ownerUserId ===
+	* userId`) plus every admin/global rule (`ownerUserId` absent). Never
+	* another user's personal rows. Newest-first (inherits {@link list}).
+	*
+	* The caller identity is server-derived; an absent/undefined caller must be
+	* resolved to a fail-closed value by the bridge action BEFORE calling this —
+	* this store never treats a missing caller as admin/global.
+	*/
+	listForOwner(userId) {
+		return this.list().filter((r) => r.ownerUserId === void 0 || r.ownerUserId === userId);
+	}
+	/** Create a new rule. `createdBy` is the SERVER-injected caller userId. */
+	async create(input, createdBy) {
+		const now = this.now();
+		const rule = {
+			...input,
+			id: this.newId(),
+			createdBy,
+			createdAt: now,
+			updatedAt: now,
+			disabledTargetIds: []
+		};
+		await this.persist(rule);
+		this.byId.set(rule.id, rule);
+		return rule;
+	}
+	/** Apply a partial patch. Immutable: returns the NEW rule object. */
+	async update(ruleId, patch) {
+		const existing = this.byId.get(ruleId);
+		if (!existing) throw new Error(`notification rule not found: ${ruleId}`);
+		const candidate = {
+			...existing,
+			...patch,
+			id: existing.id,
+			createdBy: existing.createdBy,
+			createdAt: existing.createdAt,
+			updatedAt: this.now()
+		};
+		const updated = NcRuleSchema.parse(candidate);
+		await this.persist(updated);
+		this.byId.set(updated.id, updated);
+		return updated;
+	}
+	async setEnabled(ruleId, enabled) {
+		return this.update(ruleId, { enabled });
+	}
+	/**
+	* Per-target opt-out toggle for a rule. `enabled: false` suppresses the
+	* target for THIS rule at send time; `true` re-enables it. Idempotent per
+	* target (a `Set` dedups; removing an absent id is a no-op). Throws when the
+	* rule id is unknown.
+	*
+	* OWNERSHIP: this store applies the toggle unconditionally — the owner-only
+	* restriction ("only a target's owner may opt it out") is enforced by the
+	* `nc.setRuleTargetEnabled` bridge action, which resolves the fail-closed
+	* caller and validates target ownership before calling here.
+	*/
+	async setRuleTargetEnabled(ruleId, targetId, enabled) {
+		const existing = this.byId.get(ruleId);
+		if (!existing) throw new Error(`notification rule not found: ${ruleId}`);
+		const next = new Set(existing.disabledTargetIds);
+		if (enabled) next.delete(targetId);
+		else next.add(targetId);
+		return this.update(ruleId, { disabledTargetIds: [...next] });
+	}
+	/** Hot-path read for the dispatcher: is `targetId` opted out of `ruleId`? */
+	isRuleTargetDisabled(ruleId, targetId) {
+		const rule = this.byId.get(ruleId);
+		return rule ? rule.disabledTargetIds.includes(targetId) : false;
+	}
+	/** Idempotent delete — unknown ids are a no-op. */
+	async delete(ruleId) {
+		this.byId.delete(ruleId);
+		try {
+			await this.store.delete.mutate({
+				collection: NC_RULES_COLLECTION,
+				key: ruleId
+			});
+		} catch (err) {
+			this.logger.warn("notification rule delete failed", { meta: {
+				ruleId,
+				error: String(err)
+			} });
+			throw err instanceof Error ? err : new Error(String(err));
+		}
+	}
+	async persist(rule) {
+		await this.store.set.mutate({
+			collection: NC_RULES_COLLECTION,
+			key: rule.id,
+			value: {
+				name: rule.name,
+				enabled: rule.enabled,
+				delivery: rule.delivery,
+				updatedAt: rule.updatedAt,
+				rule
+			}
+		});
+	}
+};
+//#endregion
 //#region src/notification-center/index.ts
 var DEFAULT_DRAIN_INTERVAL_MS = 2e3;
 var DEFAULT_RULE_RELOAD_INTERVAL_MS = 3e4;
@@ -4421,6 +5451,69 @@ var WATERMARK_EVERY_TICKS = 15;
 /** Terminal outbox rows older than this are pruned at boot. */
 var OUTBOX_RETENTION_MS = 168 * 36e5;
 var TEST_RULE_MAX_RESULTS = 200;
+/**
+* The className every durable package event carries (mirrors
+* `PackageDropDetector.PACKAGE_EVENT_CLASS` — declared locally so the NC module
+* stays free of a cross-module import into the pipeline). Delivery events use
+* the `idle` state, pick-ups the `left` state.
+*/
+var PACKAGE_EVENT_CLASS$1 = "package";
+/**
+* Map an occupancy condition to the watcher key spec. Every op keys on its own
+* `count` EXCEPT `<=` C, which keys on threshold C+1 — the `count ≥ C+1`
+* predicate goes false exactly when the count drops to ≤C (mirrors the engine's
+* `matchesOccupancy`, so the watched key and the matched edge always agree).
+*/
+function occupancySpecFromCondition(occ) {
+	const threshold = occ.op === "<=" ? occ.count + 1 : occ.count;
+	return {
+		...occ.zoneId !== void 0 ? { zoneId: occ.zoneId } : {},
+		...occ.className !== void 0 ? { className: occ.className } : {},
+		threshold,
+		sustainSeconds: occ.sustainSeconds
+	};
+}
+/** Classify an object-event row as a package delivery / pick-up, or `null` when
+*  it is an ordinary detection. */
+function packagePhaseOf(ev) {
+	if (ev.className !== PACKAGE_EVENT_CLASS$1) return null;
+	if (ev.state === "left") return "picked-up";
+	if (ev.state === "idle") return "delivered";
+	return null;
+}
+/**
+* Project a durable outbox row onto a delivery-history entry (the cap
+* contract). History is a VIEW — this is the ONLY mapping; there is no
+* separate history collection to write, so a row and its history entry can
+* never disagree. `ruleName` + `subject` come from the intent snapshot
+* frozen at enqueue; `error` surfaces only on a dead row (`lastError`).
+*/
+function outboxEntryToHistory(entry) {
+	const s = entry.payload.subject;
+	return {
+		id: entry.id,
+		ruleId: entry.ruleId,
+		ruleName: entry.payload.ruleName,
+		delivery: entry.payload.delivery,
+		targetId: entry.targetId,
+		deviceId: entry.deviceId,
+		recordKind: entry.recordKind === "audio-event" ? "object-event" : entry.recordKind,
+		recordId: entry.recordId,
+		...entry.trackId !== void 0 ? { trackId: entry.trackId } : {},
+		status: entry.status,
+		attempts: entry.attempts,
+		createdAt: entry.createdAt,
+		updatedAt: entry.updatedAt,
+		...entry.lastError !== void 0 ? { error: entry.lastError } : {},
+		subject: {
+			className: s.className,
+			...s.label !== void 0 ? { label: s.label } : {},
+			...s.confidence !== void 0 ? { confidence: s.confidence } : {},
+			zones: [...s.zones],
+			timestamp: s.timestamp
+		}
+	};
+}
 var NotificationCenter = class {
 	logger;
 	rules;
@@ -4428,6 +5521,14 @@ var NotificationCenter = class {
 	dispatcher;
 	deps;
 	now;
+	/** Debounced occupancy edge state machine (pure) + its durable confirmed
+	*  state. Fed in-process by {@link observeOccupancy} from ZoneAnalytics
+	*  snapshots; watched keys are recomputed from the enabled occupancy rules. */
+	occupancyWatcher = new OccupancyWatcher();
+	occupancyStore;
+	/** True when ≥1 enabled `device-event` rule declares an occupancy condition —
+	*  the watcher is idle (zero per-frame cost) otherwise. */
+	occupancyEnabled = false;
 	/** In-memory cooldown map — seeded from persisted outbox rows on start. */
 	lastFiredAt = /* @__PURE__ */ new Map();
 	/**
@@ -4450,9 +5551,14 @@ var NotificationCenter = class {
 			store: deps.store,
 			logger: this.logger.child("rules")
 		});
+		this.occupancyStore = new OccupancyStore({
+			store: deps.store,
+			logger: this.logger.child("occupancy")
+		});
 		this.dispatcher = new NcDispatcher({
 			...deps.dispatcher,
-			logger: this.logger.child("dispatch")
+			logger: this.logger.child("dispatch"),
+			isRuleTargetDisabled: (ruleId, targetId) => this.rules.isRuleTargetDisabled(ruleId, targetId)
 		});
 		this.outbox = new NcOutbox({
 			store: deps.store,
@@ -4461,10 +5567,20 @@ var NotificationCenter = class {
 			...deps.now !== void 0 ? { now: deps.now } : {}
 		});
 	}
+	/**
+	* The durable rule store — exposed so the hub-only `nc.*` bridge actions
+	* (`nc-actions.ts`, addonId `pipeline-analytics`) can serve the viewer's
+	* ownership-scoped rule CRUD over `addons.custom`. Read/write goes through
+	* the same write-through cache the evaluation path reads.
+	*/
+	get ruleStore() {
+		return this.rules;
+	}
 	/** Declare every Notification Center collection (idempotent, boot-time). */
 	static async declare(store) {
 		await NcRuleStore.declare(store);
 		await NcOutbox.declare(store);
+		await OccupancyStore.declare(store);
 	}
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
@@ -4474,17 +5590,19 @@ var NotificationCenter = class {
 	*/
 	async start(opts) {
 		await this.rules.load();
+		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
 		this.evaluationActive = true;
 		await this.outbox.load();
 		await this.seedCooldowns();
 		await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
+		await this.hydrateOccupancy();
 		await this.reconcile();
 		this.drainTimer = setInterval(() => {
 			this.drainTick();
 		}, this.deps.drainIntervalMs ?? DEFAULT_DRAIN_INTERVAL_MS);
 		this.reloadTimer = setInterval(() => {
-			this.rules.load();
+			this.reloadRules();
 		}, this.deps.ruleReloadIntervalMs ?? DEFAULT_RULE_RELOAD_INTERVAL_MS);
 		this.logger.info("notification center started", { meta: {
 			rules: this.rules.list().length,
@@ -4510,6 +5628,7 @@ var NotificationCenter = class {
 	*/
 	onObjectEventPersisted(event, _track) {
 		if (!this.evaluationActive) return;
+		if (packagePhaseOf(event) !== null) return;
 		const subject = subjectFromObjectEvent(event);
 		this.scheduleEvaluation(subject, "object-event", () => ({
 			tags: { deviceId: event.deviceId },
@@ -4530,6 +5649,117 @@ var NotificationCenter = class {
 			meta: { trackId: track.trackId }
 		}));
 	}
+	/**
+	* Called at the SensorEvent persist site (`ingestSensorStateChange` — one row
+	* per linked camera), in the SAME moment as the durable insert. Feeds the
+	* `device-event` trigger (doorbell press / sensor state change). Fire-and-
+	* forget from the ingest loop; the outbox owns delivery from here.
+	*
+	* Delivery-grade boundary (honest): the SensorEventStore is itself fed from
+	* the LOSSY `DeviceStateChanged` telemetry bus, and there is no NC crash-gap
+	* reconcile for sensor rows in this slice (unlike object events). So a dropped
+	* upstream bus event, or a crash in the persist→outbox window, drops the
+	* device-event notification — the durable guarantee begins at this hook, not
+	* before it.
+	*/
+	onSensorEventPersisted(event) {
+		if (!this.evaluationActive) return;
+		const subject = subjectFromSensorEvent(event);
+		this.scheduleEvaluation(subject, "device-event", () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				sensorEventId: event.id,
+				kind: event.kind
+			}
+		}));
+	}
+	/**
+	* Called at the AUDIO-event persist site (`eventStore.insertAudio`), in the
+	* SAME moment as the durable insert. Feeds an `immediate` rule that OPTS IN
+	* to an `audio-*` class (the safety gate in `evaluateRule` — a rule without
+	* an audio class never fires here). Fire-and-forget; the outbox owns delivery.
+	*
+	* Delivery-grade boundary (honest): audio events persist on a SEPARATE store
+	* from object events, and there is no NC crash-gap reconcile for audio rows
+	* in this slice (unlike object events, which the boot reconcile re-scans). So
+	* a crash in the persist→outbox window drops the audio notification — the
+	* durable guarantee begins at this hook, matching the device-event boundary.
+	*/
+	onAudioEventPersisted(event) {
+		if (!this.evaluationActive) return;
+		const subject = subjectFromAudioEvent(event);
+		this.scheduleEvaluation(subject, "audio-event", () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				audioEventId: event.id,
+				class: event.classification?.className
+			}
+		}));
+	}
+	/**
+	* Called at the package object-event persist site (`PackageDropDetector` —
+	* delivered/picked-up), in the SAME moment as the durable insert. Feeds the
+	* `package-event` trigger. Package events ARE object-event rows, so the boot
+	* crash-gap reconcile re-covers them (routed by className in {@link reconcile}).
+	*/
+	onPackageEventPersisted(event, phase) {
+		if (!this.evaluationActive) return;
+		const subject = subjectFromPackageEvent(event, phase);
+		this.scheduleEvaluation(subject, "package-event", () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				eventId: event.id,
+				phase
+			}
+		}));
+	}
+	/**
+	* Feed one ZoneAnalytics occupancy snapshot into the debounced watcher
+	* (in-process, telemetry-loss-tolerant — a dropped snapshot just misses a
+	* sample; the durable confirmed edge-state is the recovery). Called per
+	* ≤1 Hz snapshot from `ZoneAnalyticsProvider` (live frames + the parked-object
+	* baseline sampler). Cheap no-op when no occupancy rule is enabled. Each
+	* COMMITTED edge is persisted (rare — only on a confirmed flip, never
+	* per-frame) and routed to {@link onOccupancyEdge}.
+	*/
+	observeOccupancy(deviceId, snapshot) {
+		if (!this.evaluationActive || !this.occupancyEnabled) return;
+		const now = this.now();
+		let edges;
+		try {
+			edges = this.occupancyWatcher.observe(deviceId, snapshot, now);
+		} catch (err) {
+			this.logger.debug("occupancy observe failed", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+			return;
+		}
+		for (const edge of edges) {
+			this.persistOccupancyEdge(edge, now);
+			this.onOccupancyEdge(edge);
+		}
+	}
+	/**
+	* Persist hook for a committed occupancy edge — mirrors the other persist
+	* hooks (serialized via {@link scheduleEvaluation}). The subject rides the
+	* EXISTING `device-event` delivery via the internal `occupancy-event` kind.
+	* Public so a test / a future out-of-band edge source can drive it directly.
+	*/
+	onOccupancyEdge(edge) {
+		if (!this.evaluationActive) return;
+		const subject = subjectFromOccupancyEvent(edge);
+		this.scheduleEvaluation(subject, "occupancy-event", () => ({
+			tags: { deviceId: edge.deviceId },
+			meta: {
+				zoneId: edge.zoneId ?? "@frame",
+				className: edge.className ?? "@all",
+				count: edge.count,
+				threshold: edge.threshold,
+				occupied: edge.occupied
+			}
+		}));
+	}
 	buildProvider() {
 		return {
 			listRules: async () => ({ rules: [...this.rules.list()] }),
@@ -4546,7 +5776,8 @@ var NotificationCenter = class {
 			},
 			updateRule: async ({ ruleId, patch, caller }) => {
 				if (patch.targets !== void 0) await this.validateTargetRefs(patch.targets.map((t) => t.targetId));
-				const updated = await this.rules.update(ruleId, patch);
+				const { disabledTargetIds: _optOut, ...safePatch } = patch;
+				const updated = await this.rules.update(ruleId, safePatch);
 				this.logger.info("notification rule updated", { meta: {
 					ruleId,
 					by: caller.userId
@@ -4562,7 +5793,24 @@ var NotificationCenter = class {
 				return { success: true };
 			},
 			testRule: async ({ rule, lookbackMinutes }) => ({ results: [...await this.dryRun(rule, lookbackMinutes)] }),
-			getConditionCatalog: async () => ({ catalog: [...NC_CONDITION_CATALOG] })
+			getConditionCatalog: async () => ({ catalog: [...NC_CONDITION_CATALOG] }),
+			getHistory: async ({ filter }) => {
+				const entries = await this.outbox.queryHistory({
+					...filter.ruleId !== void 0 ? { ruleId: filter.ruleId } : {},
+					...filter.deviceId !== void 0 ? { deviceId: filter.deviceId } : {},
+					...filter.status !== void 0 ? { status: filter.status } : {},
+					...filter.since !== void 0 ? { since: filter.since } : {},
+					...filter.until !== void 0 ? { until: filter.until } : {},
+					limit: filter.limit
+				});
+				const mapped = [];
+				for (const entry of entries) try {
+					mapped.push(outboxEntryToHistory(entry));
+				} catch {
+					this.logger.debug("getHistory: skipping malformed outbox row", { meta: { id: entry.id } });
+				}
+				return { entries: mapped };
+			}
 		};
 	}
 	/** Append one evaluation to the serialized chain (see {@link evalChain}). */
@@ -4584,31 +5832,35 @@ var NotificationCenter = class {
 		});
 	}
 	async evaluateAndEnqueue(subject, kind) {
-		const delivery = kind === "object-event" ? "immediate" : "track-end";
+		const delivery = kind === "object-event" || kind === "audio-event" ? "immediate" : kind === "occupancy-event" ? "device-event" : kind;
 		const candidates = this.rules.listEnabled(delivery);
 		if (candidates.length === 0) return;
 		const now = this.now();
 		for (const rule of candidates) {
-			if (!evaluateRule(rule, subject).matched) continue;
+			const evaluation = evaluateRule(rule, subject);
+			if (!evaluation.matched) continue;
 			const key = cooldownKey(rule, subject);
 			if (isCoolingDown(rule, this.lastFiredAt.get(key), now)) continue;
-			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind)) > 0) this.lastFiredAt.set(key, now);
+			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn)) > 0) this.lastFiredAt.set(key, now);
 		}
 	}
-	buildEntries(rule, subject, kind) {
-		return rule.targets.map((target) => {
+	buildEntries(rule, subject, kind, matchedOn) {
+		const hasEventMedia = kind === "object-event" || kind === "package-event";
+		const isTrackScoped = kind === "object-event" || kind === "track-end";
+		return rule.targets.filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
 			const payload = {
 				ruleName: rule.name,
 				delivery: rule.delivery,
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: rule.media.attach,
+				...matchedOn !== void 0 && matchedOn.length > 0 ? { matchedOn } : {},
 				...target.params !== void 0 ? { params: target.params } : {},
 				subject: {
 					deviceId: subject.deviceId,
 					...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
-					...kind === "object-event" ? { eventId: subject.recordId } : {},
-					className: subject.classNames[0] ?? "object",
+					...hasEventMedia ? { eventId: subject.recordId } : {},
+					className: subject.classNames[0] ?? subject.sensorKind ?? "event",
 					...subject.label !== void 0 ? { label: subject.label } : {},
 					...subject.confidence !== void 0 ? { confidence: subject.confidence } : {},
 					zones: subject.zones,
@@ -4619,9 +5871,9 @@ var NotificationCenter = class {
 				ruleId: rule.id,
 				targetId: target.targetId,
 				deviceId: subject.deviceId,
-				recordKind: kind,
+				recordKind: kind === "occupancy-event" ? "device-event" : kind,
 				recordId: subject.recordId,
-				...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
+				...isTrackScoped && subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
 				payload
 			};
 		});
@@ -4637,6 +5889,67 @@ var NotificationCenter = class {
 			if (entry.createdAt > prev) this.lastFiredAt.set(key, entry.createdAt);
 		}
 	}
+	/**
+	* Recompute the watcher's watched key set from the enabled occupancy rules
+	* (rule-driven — refreshed on boot + every reload tick). `setWatchedKeys`
+	* drops confirmed state for keys no longer watched; the caller then prunes the
+	* durable rows to the surviving set.
+	*/
+	refreshOccupancyWatch() {
+		const specs = [];
+		for (const rule of this.rules.listEnabled("device-event")) {
+			const occ = rule.conditions.occupancy;
+			if (occ === void 0) continue;
+			specs.push(occupancySpecFromCondition(occ));
+		}
+		this.occupancyWatcher.setWatchedKeys(specs);
+		this.occupancyEnabled = specs.length > 0;
+	}
+	/** Boot reseed of confirmed occupancy edge-state (durability, constraint 4) —
+	*  hydrate the watcher from the store, then prune orphaned durable rows to the
+	*  active watched set. Runs AFTER {@link refreshOccupancyWatch} so hydrate
+	*  restores only currently-watched keys. */
+	async hydrateOccupancy() {
+		const rows = await this.occupancyStore.load();
+		this.occupancyWatcher.hydrate(rows);
+		await this.occupancyStore.pruneExcept(this.activeOccupancyKeys());
+	}
+	/** Rule-reload tick: refresh the rule cache (cross-node CRUD staleness bound),
+	*  recompute the occupancy watched set + prune stale durable rows. */
+	async reloadRules() {
+		await this.rules.load();
+		this.refreshOccupancyWatch();
+		if (!this.evaluationActive) return;
+		await this.occupancyStore.pruneExcept(this.activeOccupancyKeys());
+	}
+	/** The full-key set the watcher currently tracks (post prune) — the bound for
+	*  {@link OccupancyStore.pruneExcept}. */
+	activeOccupancyKeys() {
+		return new Set(this.occupancyWatcher.snapshotState().map((r) => r.key));
+	}
+	/** Write-through the committed confirmed level for one edge (rare — only on a
+	*  boolean flip). Best-effort: a failed persist is logged, never thrown into
+	*  the frame path (the boot reseed + next edge recover). */
+	async persistOccupancyEdge(edge, now) {
+		try {
+			await this.occupancyStore.persist({
+				key: occupancyKey(edge.deviceId, edge.zoneId, edge.className, edge.threshold),
+				deviceId: edge.deviceId,
+				...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
+				...edge.className !== void 0 ? { className: edge.className } : {},
+				threshold: edge.threshold,
+				confirmedCount: edge.count,
+				occupied: edge.occupied,
+				lastChangeAt: edge.timestamp,
+				updatedAt: now
+			});
+		} catch (err) {
+			this.logger.debug("occupancy persist failed", {
+				tags: { deviceId: edge.deviceId },
+				meta: { error: String(err) }
+			});
+		}
+	}
 	/** Boot crash-gap reconcile — see the module docstring. */
 	async reconcile() {
 		const now = this.now();
@@ -4645,13 +5958,24 @@ var NotificationCenter = class {
 		const since = Math.max(windowStart, (watermark ?? 0) - RECONCILE_OVERLAP_MS);
 		try {
 			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].sort((a, b) => a.timestamp - b.timestamp);
-			for (const event of ordered) this.scheduleEvaluation(subjectFromObjectEvent(event), "object-event", () => ({
-				tags: { deviceId: event.deviceId },
-				meta: {
-					eventId: event.id,
-					reconcile: true
-				}
-			}));
+			for (const event of ordered) {
+				const phase = packagePhaseOf(event);
+				if (phase !== null) this.scheduleEvaluation(subjectFromPackageEvent(event, phase), "package-event", () => ({
+					tags: { deviceId: event.deviceId },
+					meta: {
+						eventId: event.id,
+						phase,
+						reconcile: true
+					}
+				}));
+				else this.scheduleEvaluation(subjectFromObjectEvent(event), "object-event", () => ({
+					tags: { deviceId: event.deviceId },
+					meta: {
+						eventId: event.id,
+						reconcile: true
+					}
+				}));
+			}
 			await this.evalChain;
 			if (ordered.length > 0) this.logger.info("notification reconcile scanned missed events", { meta: {
 				since,
@@ -4680,8 +6004,14 @@ var NotificationCenter = class {
 		const subjects = [];
 		if (rule.delivery === "immediate") {
 			const events = await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT);
-			for (const ev of events) subjects.push(subjectFromObjectEvent(ev));
-		} else {
+			for (const ev of events) if (packagePhaseOf(ev) === null) subjects.push(subjectFromObjectEvent(ev));
+		} else if (rule.delivery === "package-event") {
+			const events = await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT);
+			for (const ev of events) {
+				const phase = packagePhaseOf(ev);
+				if (phase !== null) subjects.push(subjectFromPackageEvent(ev, phase));
+			}
+		} else if (rule.delivery === "track-end") {
 			const tracks = await this.deps.listRecentTracks(since, TEST_RULE_MAX_RESULTS);
 			for (const track of tracks) subjects.push(subjectFromTrack(track));
 		}
@@ -4691,7 +6021,7 @@ var NotificationCenter = class {
 			const evaluation = evaluateRule(rule, subject);
 			results.push({
 				recordId: subject.recordId,
-				recordKind: subject.kind === "object-event" ? "object-event" : "track",
+				recordKind: subject.kind === "track-end" ? "track" : subject.kind === "audio-event" ? "object-event" : subject.kind === "occupancy-event" ? "device-event" : subject.kind,
 				deviceId: subject.deviceId,
 				timestamp: subject.timestamp,
 				wouldFire: evaluation.matched,
@@ -4704,6 +6034,156 @@ var NotificationCenter = class {
 	}
 };
 //#endregion
+//#region src/notification-center/nc-actions.ts
+/**
+* nc-actions — the `pipeline-analytics` rule-bridge action catalog.
+*
+* The Notification Center viewer NEVER adds a cap method: every rule read/write
+* rides the generic `addons.custom` bridge (`{ addonId, action, input }`) with a
+* per-action `nc.*` name, and THIS module enforces the per-action auth +
+* ownership server-side (spec C1/C2). The addon id is `'pipeline-analytics'`.
+*
+* Auth model (spec §3.1 / §5 — server-derived, never client-trusted):
+*  - `nc.listRules` / `nc.getConditionCatalog` — any authenticated caller;
+*    listRules is SCOPED (own personal + global rules only) and stamps a
+*    per-row `readOnly` verdict.
+*  - `nc.createRule` / `nc.updateRule` / `nc.deleteRule` — operate ONLY on
+*    caller-OWNED rules; `ownerUserId` is stamped from the caller and can
+*    never be re-owned through a patch.
+*  - `nc.setRuleTargetEnabled` — a user opting HIS OWN target out of a rule
+*    VISIBLE to him (his own personal rule OR a global/admin rule).
+*
+* Target-ownership limits (personal-rule delivery target list + the opt-out
+* target) are enforced against the notifiers target catalog; ADMINS bypass the
+* target-ownership limit (they may deliver to / opt any target) but NEVER the
+* fail-closed caller check — an absent caller (UDS version-skew can still
+* deliver `undefined`) is rejected before any ownership decision.
+*/
+/** A rule as served to the viewer — carries the server's `readOnly` verdict. */
+var NcViewerRuleSchema = NcRuleSchema.extend({ readOnly: boolean() });
+/**
+* The action catalog — the tRPC contract Group B (the viewer client) consumes
+* against `addonId: 'pipeline-analytics'`. Every entry that depends on the
+* caller identity is declared `caller: 'required'` so the dispatcher forwards
+* the server-derived `{ userId, isAdmin }` as the handler's second argument.
+*/
+var ncActions = defineCustomActions({
+	"nc.listRules": customAction(object({}), object({ rules: array(NcViewerRuleSchema) }), { caller: "required" }),
+	"nc.getConditionCatalog": customAction(object({}), object({
+		catalog: array(NcConditionDescriptorSchema),
+		taxonomy: NcTaxonomySchema
+	})),
+	"nc.createRule": customAction(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
+		kind: "mutation",
+		caller: "required"
+	}),
+	"nc.updateRule": customAction(object({
+		ruleId: string(),
+		patch: NcRulePatchSchema
+	}), object({ rule: NcRuleSchema }), {
+		kind: "mutation",
+		caller: "required"
+	}),
+	"nc.deleteRule": customAction(object({ ruleId: string() }), object({ success: literal(true) }), {
+		kind: "mutation",
+		caller: "required"
+	}),
+	"nc.setRuleTargetEnabled": customAction(object({
+		ruleId: string(),
+		targetId: string(),
+		enabled: boolean()
+	}), object({ success: literal(true) }), {
+		kind: "mutation",
+		caller: "required"
+	})
+});
+/** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
+function requireCaller(caller) {
+	if (!caller || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error("forbidden: authenticated caller required");
+	return caller;
+}
+function makeNcActionHandlers(deps) {
+	/** A rule the caller may EDIT — must exist and be owned by the caller. */
+	const assertOwnsRule = (ruleId) => {
+		const rule = deps.ruleStore.get(ruleId);
+		if (rule === null) throw new Error(`forbidden: rule not found: ${ruleId}`);
+		return rule;
+	};
+	const assertRuleOwned = (ruleId, userId) => {
+		const rule = assertOwnsRule(ruleId);
+		if (rule.ownerUserId !== userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
+		return rule;
+	};
+	/** A rule the caller may SEE — his own personal rule OR a global/admin rule. */
+	const assertRuleVisible = (ruleId, userId) => {
+		const rule = assertOwnsRule(ruleId);
+		if (rule.ownerUserId !== void 0 && rule.ownerUserId !== userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
+		return rule;
+	};
+	const assertTargetsOwned = async (targetIds, caller) => {
+		if (caller.isAdmin) return;
+		const owned = new Set(await deps.listCallerTargetIds(caller.userId));
+		for (const id of targetIds) if (!owned.has(id)) throw new Error(`forbidden: target not owned: ${id}`);
+	};
+	return {
+		"nc.listRules": async (_input, caller) => {
+			const c = requireCaller(caller);
+			return { rules: deps.ruleStore.listForOwner(c.userId).map((r) => ({
+				...r,
+				readOnly: r.ownerUserId !== c.userId
+			})) };
+		},
+		"nc.getConditionCatalog": async () => ({
+			catalog: [...NC_CONDITION_CATALOG],
+			taxonomy: NC_TAXONOMY
+		}),
+		"nc.createRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			const parsed = NcRuleInputSchema.parse(input.rule);
+			await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
+			const rule = await deps.ruleStore.create({
+				...parsed,
+				ownerUserId: c.userId
+			}, c.userId);
+			deps.logger.info("nc rule created", { meta: {
+				ruleId: rule.id,
+				owner: c.userId
+			} });
+			return { rule };
+		},
+		"nc.updateRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			assertRuleOwned(input.ruleId, c.userId);
+			const patch = NcRulePatchSchema.parse(input.patch);
+			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
+			const { ownerUserId: _owner, disabledTargetIds: _optOut, ...safe } = patch;
+			const rule = await deps.ruleStore.update(input.ruleId, safe);
+			deps.logger.info("nc rule updated", { meta: {
+				ruleId: rule.id,
+				owner: c.userId
+			} });
+			return { rule };
+		},
+		"nc.deleteRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			assertRuleOwned(input.ruleId, c.userId);
+			await deps.ruleStore.delete(input.ruleId);
+			deps.logger.info("nc rule deleted", { meta: {
+				ruleId: input.ruleId,
+				owner: c.userId
+			} });
+			return { success: true };
+		},
+		"nc.setRuleTargetEnabled": async (input, caller) => {
+			const c = requireCaller(caller);
+			assertRuleVisible(input.ruleId, c.userId);
+			await assertTargetsOwned([input.targetId], c);
+			await deps.ruleStore.setRuleTargetEnabled(input.ruleId, input.targetId, input.enabled);
+			return { success: true };
+		}
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/object-embedding-selection.ts
 function isClipObjectEmbedding(t) {
 	return Array.isArray(t.embedding) && t.embedding.length > 0 && typeof t.embeddingModelId === "string" && t.embeddingModelId.startsWith("mobileclip-");
@@ -4713,39 +6193,42 @@ function resolveSearchThumbnailUrl(input) {
 	const id = input.embeddingMediaKey ?? input.eventId;
 	return `${input.baseUrl}/${encodeURIComponent(id)}`;
 }
-//#endregion
-//#region src/pipeline-analytics/best-thumbnail-guard.ts
-/**
-* Void/envArea guard for best-`thumbnail` selection.
-*
-* ## Why this exists (the dawn/night "void" thumbnail)
-*
-* At dawn/night a moving subject's tracker box intermittently EXPLODES to
-* (near-)the whole frame — the "envelope exploded to full-frame" signature. If
-* that frame happens to win the best-detection race, the gallery/reel best
-* `thumbnail` becomes a useless full-scene tile (the subject crop is the entire
-* washed-out frame), not the subject. This guard rejects such a frame from the
-* best-`thumbnail` decision so the track keeps a real subject-centered tile.
-*
-* Conservative by design: it only rejects boxes covering ≥ {@link
-* NEAR_FULL_FRAME_AREA} of the frame — a genuine large close-up subject stays
-* well under this. Rejecting a frame does NOT land a thumbnail, so the #27-A
-* per-frame retry keeps trying until a plausible frame wins.
-*/
+function isPlausibleThumbnailBox(bbox, frameWidth, frameHeight, score) {
+	if (frameWidth <= 0 || frameHeight <= 0) return true;
+	if (score !== void 0 && score >= .5) return true;
+	if (bbox.w * bbox.h / (frameWidth * frameHeight) >= .85) return false;
+	if (bbox.h >= frameHeight * .95) return false;
+	if (bbox.w >= frameWidth * .95) return false;
+	return true;
+}
 /**
-* Area fraction at/above which a detection bbox is treated as an exploded
-* "envelope" (near-full-frame) box rather than a real subject. 0.85 keeps the
-* guard conservative — only boxes covering ≥85% of the frame are rejected.
+* Minimum fraction of the track's BEST-SEEN bbox area a retry frame's bbox must
+* still cover to be an acceptable best-`thumbnail` RETRY subject. 0.45 tolerates
+* normal breathing of the tracker box (~2/3 per side) while rejecting the
+* degenerate shrink (observed live 2026-07-22: a car born at 78px retried at
+* 26px once the native lease warmed — a ~0.11 area fraction — and the landed
+* "best" thumbnail was a sliver of a distant car).
 */
-var NEAR_FULL_FRAME_AREA = .85;
+var RETRY_MIN_FRACTION_OF_BEST = .45;
 /**
-* True when `bbox` is a plausible SUBJECT box for a best `thumbnail` — i.e. its
-* area is below the near-full-frame threshold. Degenerate frame dimensions
-* (≤0) are treated as plausible (no info to reject on).
+* RETRY-ONLY gate (#27-A degenerate-retry fix): on a cold on-motion session the
+* native lease misses the first seconds, so the large-subject captures return
+* null and the per-frame retry re-fires with the CURRENT frame's bbox. By the
+* time the lease warms the subject may have shrunk to a sliver; capturing THAT
+* frame lands a genuine-native-but-useless thumbnail and `thumbnailLanded`
+* stops all further retries. Reject a retry whose current bbox area has
+* collapsed below `minFractionOfBest` of the track's best-seen bbox area.
+*
+* Applies ONLY to the `!thumbnailLanded` retry path — a genuine new-best
+* capture is never routed through this gate (the caller bypasses it on
+* `isNewBest`). With no best-seen reference (or a degenerate one) there is no
+* info to reject on → plausible.
 */
-function isPlausibleThumbnailBox(bbox, frameWidth, frameHeight) {
-	if (frameWidth <= 0 || frameHeight <= 0) return true;
-	return bbox.w * bbox.h / (frameWidth * frameHeight) < NEAR_FULL_FRAME_AREA;
+function isPlausibleRetryBox(current, bestSeen, minFractionOfBest = RETRY_MIN_FRACTION_OF_BEST) {
+	if (bestSeen === null) return true;
+	const bestArea = bestSeen.w * bestSeen.h;
+	if (bestArea <= 0) return true;
+	return current.w * current.h >= minFractionOfBest * bestArea;
 }
 //#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-types.ts
@@ -5488,7 +6971,7 @@ var BindingCache = class {
 				this.state.set(deviceId, active);
 				return active;
 			} catch (err) {
-				this.logger.debug("BindingCache.isActive lookup failed", {
+				this.logger.warn("BindingCache.isActive lookup failed — frames will drop as inactive", {
 					tags: { deviceId },
 					meta: { error: String(err) }
 				});
@@ -5961,9 +7444,9 @@ var DISPLAY_FALLBACK_MAX_WIDTH = 1920;
 /** Throttle for the native-crop HIT/FALLBACK metric window line. */
 var NATIVE_CROP_METRIC_INTERVAL_MS = 3e4;
 function createNativeFrameTransport(deps) {
-	const { api, ownNodeId, logger } = deps;
+	const { api, logger } = deps;
 	const pipelineRunnerApi = api.pipelineRunner;
-	const isRemoteHandle = (handle) => handle.nodeId !== ownNodeId;
+	const wantJpeg = (_handle) => true;
 	const cropReplyToRgb = async (reply) => {
 		if (reply.jpeg !== void 0) {
 			const rgb = await decodeJpegToRgb(reply.jpeg);
@@ -5991,7 +7474,7 @@ function createNativeFrameTransport(deps) {
 				h: 1
 			},
 			maxWidth: handle.width,
-			encodeJpeg: isRemoteHandle(handle)
+			encodeJpeg: wantJpeg(handle)
 		}, nodePin(handle.nodeId));
 		if (!full || full.width <= 0 || full.height <= 0) return null;
 		const rgb = await cropReplyToRgb(full);
@@ -6015,7 +7498,7 @@ function createNativeFrameTransport(deps) {
 				h: 1
 			},
 			maxWidth,
-			encodeJpeg: isRemoteHandle(handle)
+			encodeJpeg: wantJpeg(handle)
 		}, nodePin(handle.nodeId));
 		if (!full || full.width <= 0 || full.height <= 0) return null;
 		const rgb = await cropReplyToRgb(full);
@@ -6055,7 +7538,7 @@ function createNativeFrameTransport(deps) {
 				handle: frameHandle,
 				bbox: paddedNorm,
 				...maxWidth !== void 0 ? { maxWidth } : {},
-				encodeJpeg: isRemoteHandle(frameHandle)
+				encodeJpeg: wantJpeg(frameHandle)
 			}, nodePin(frameHandle.nodeId));
 			if (!native || native.width <= 0 || native.height <= 0) return null;
 			return await cropReplyToRgb(native);
@@ -6352,153 +7835,41 @@ function createAnalyticsWidgetsProvider() {
 }
 //#endregion
 //#region src/pipeline-analytics/store/recent-cursor.ts
-function encodeRecentCursor(cursor) {
-	return Buffer.from(JSON.stringify({
-		l: cursor.lastSeen,
-		i: cursor.trackId
-	}), "utf8").toString("base64url");
-}
-/**
-* Decode + validate an opaque cursor. Fails fast with a clear error on any
-* malformed input (bad base64, bad JSON, wrong field types) — a garbage
-* cursor must never silently degrade into a full-history first page.
-*/
-function decodeRecentCursor(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
-	} catch {
-		throw new Error("listRecentTracks: malformed cursor");
-	}
-	if (parsed === null || typeof parsed !== "object" || !("l" in parsed) || !("i" in parsed) || typeof parsed.l !== "number" || !Number.isFinite(parsed.l) || typeof parsed.i !== "string" || parsed.i.length === 0) throw new Error("listRecentTracks: malformed cursor");
-	return {
-		lastSeen: parsed.l,
-		trackId: parsed.i
-	};
-}
-/** Comparator for the (lastSeen DESC, id DESC) total order. */
-function compareRecentDesc(a, b) {
-	if (a.lastSeen !== b.lastSeen) return b.lastSeen - a.lastSeen;
-	if (a.id === b.id) return 0;
-	return a.id < b.id ? 1 : -1;
-}
-/** True when `row` sits strictly AFTER the cursor position in DESC order
-*  (i.e. belongs to the next page). */
-function isAfterCursor(row, cursor) {
-	if (row.lastSeen < cursor.lastSeen) return true;
-	return row.lastSeen === cursor.lastSeen && row.id < cursor.trackId;
-}
-//#endregion
-//#region src/pipeline-analytics/store/zone-geometry.ts
-/**
-* Normalized min/max envelope over every position's bbox. Returns `null`
-* when the frame dimensions are unknown/degenerate or there are no
-* positions — the caller persists NULL envelope columns in that case.
-*/
-function computeTrackEnvelope(positions, frameWidth, frameHeight) {
-	if (frameWidth === void 0 || frameHeight === void 0 || !(frameWidth > 0) || !(frameHeight > 0) || positions.length === 0) return null;
-	let minX = Number.POSITIVE_INFINITY;
-	let minY = Number.POSITIVE_INFINITY;
-	let maxX = Number.NEGATIVE_INFINITY;
-	let maxY = Number.NEGATIVE_INFINITY;
-	for (const p of positions) {
-		const x0 = p.bbox.x / frameWidth;
-		const y0 = p.bbox.y / frameHeight;
-		const x1 = (p.bbox.x + p.bbox.w) / frameWidth;
-		const y1 = (p.bbox.y + p.bbox.h) / frameHeight;
-		if (x0 < minX) minX = x0;
-		if (y0 < minY) minY = y0;
-		if (x1 > maxX) maxX = x1;
-		if (y1 > maxY) maxY = y1;
-	}
-	return {
-		minX,
-		minY,
-		maxX,
-		maxY
-	};
-}
-/**
-* Axis-aligned bounds of a zone filter (rect: itself; polygon: vertex
-* min/max). A degenerate polygon (< 3 points) yields the full frame so the
-* SQL prefilter never silently drops rows the precise test would keep.
-*/
-function zoneBounds(zone) {
-	if (zone.kind === "rect") return {
-		minX: zone.x,
-		minY: zone.y,
-		maxX: zone.x + zone.width,
-		maxY: zone.y + zone.height
-	};
-	if (zone.points.length < 3) return {
-		minX: 0,
-		minY: 0,
-		maxX: 1,
-		maxY: 1
-	};
-	let minX = Number.POSITIVE_INFINITY;
-	let minY = Number.POSITIVE_INFINITY;
-	let maxX = Number.NEGATIVE_INFINITY;
-	let maxY = Number.NEGATIVE_INFINITY;
-	for (const p of zone.points) {
-		if (p.x < minX) minX = p.x;
-		if (p.y < minY) minY = p.y;
-		if (p.x > maxX) maxX = p.x;
-		if (p.y > maxY) maxY = p.y;
-	}
-	return {
-		minX,
-		minY,
-		maxX,
-		maxY
-	};
-}
-/** Whether two axis-aligned envelopes overlap (touching edges count). */
-function envelopesOverlap(a, b) {
-	return a.minX <= b.maxX && a.maxX >= b.minX && a.minY <= b.maxY && a.maxY >= b.minY;
+function encodeRecentCursor(cursor) {
+	return Buffer.from(JSON.stringify({
+		l: cursor.lastSeen,
+		i: cursor.trackId
+	}), "utf8").toString("base64url");
 }
 /**
-* Ray-casting point-in-polygon (even-odd rule). Points on an edge may
-* resolve either way — acceptable for zone filtering. A polygon with
-* fewer than 3 vertices contains nothing.
+* Decode + validate an opaque cursor. Fails fast with a clear error on any
+* malformed input (bad base64, bad JSON, wrong field types) — a garbage
+* cursor must never silently degrade into a full-history first page.
 */
-function pointInPolygon(point, polygon) {
-	if (polygon.length < 3) return false;
-	let inside = false;
-	for (let i = 0, j = polygon.length - 1; i < polygon.length; j = i++) {
-		const a = polygon[i];
-		const b = polygon[j];
-		if (a.y > point.y !== b.y > point.y && point.x < (b.x - a.x) * (point.y - a.y) / (b.y - a.y) + a.x) inside = !inside;
+function decodeRecentCursor(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+	} catch {
+		throw new Error("listRecentTracks: malformed cursor");
 	}
-	return inside;
+	if (parsed === null || typeof parsed !== "object" || !("l" in parsed) || !("i" in parsed) || typeof parsed.l !== "number" || !Number.isFinite(parsed.l) || typeof parsed.i !== "string" || parsed.i.length === 0) throw new Error("listRecentTracks: malformed cursor");
+	return {
+		lastSeen: parsed.l,
+		trackId: parsed.i
+	};
 }
-/**
-* Precise per-position zone test.
-*
-*   - rect zone     → any position bbox (normalized) intersects the rect.
-*   - polygon zone  → any position CENTER (normalized `x`/`y` — positions
-*                     store the bbox center) falls inside the polygon.
-*
-* Unknown/degenerate frame dims → `true` (the track cannot be tested, so it
-* PASSES — mirroring the NULL-envelope-matches rule).
-*/
-function positionsIntersectZone(positions, frameWidth, frameHeight, zone) {
-	if (frameWidth === void 0 || frameHeight === void 0 || !(frameWidth > 0) || !(frameHeight > 0)) return true;
-	if (zone.kind === "rect") {
-		const rect = zoneBounds(zone);
-		for (const p of positions) if (envelopesOverlap({
-			minX: p.bbox.x / frameWidth,
-			minY: p.bbox.y / frameHeight,
-			maxX: (p.bbox.x + p.bbox.w) / frameWidth,
-			maxY: (p.bbox.y + p.bbox.h) / frameHeight
-		}, rect)) return true;
-		return false;
-	}
-	for (const p of positions) if (pointInPolygon({
-		x: p.x / frameWidth,
-		y: p.y / frameHeight
-	}, zone.points)) return true;
-	return false;
+/** Comparator for the (lastSeen DESC, id DESC) total order. */
+function compareRecentDesc(a, b) {
+	if (a.lastSeen !== b.lastSeen) return b.lastSeen - a.lastSeen;
+	if (a.id === b.id) return 0;
+	return a.id < b.id ? 1 : -1;
+}
+/** True when `row` sits strictly AFTER the cursor position in DESC order
+*  (i.e. belongs to the next page). */
+function isAfterCursor(row, cursor) {
+	if (row.lastSeen < cursor.lastSeen) return true;
+	return row.lastSeen === cursor.lastSeen && row.id < cursor.trackId;
 }
 //#endregion
 //#region src/pipeline-analytics/store/track-store.ts
@@ -7590,6 +8961,11 @@ var MediaStore = class {
 	* and no duplicate snapshot/lastFrame pair. The `lastFrame` write lands BEFORE
 	* the snapshot delete, so the view is never momentarily absent. Returns the new
 	* `lastFrame` key.
+	*
+	* `keepSource: true` (short-track keyFrameSmall fallback, 2026-07-23): copy
+	* the bytes into the `lastFrame` slot WITHOUT deleting the source row — used
+	* when the source is the track's `keyFrameSmall`, which must keep serving its
+	* own kind.
 	*/
 	async promoteToLastFrame(input) {
 		const data = Buffer.from(input.snapshot.base64, "base64");
@@ -7601,7 +8977,7 @@ var MediaStore = class {
 			timestamp: input.snapshot.timestamp,
 			data
 		});
-		await this.deleteByKey(input.snapshot.key);
+		if (input.keepSource !== true) await this.deleteByKey(input.snapshot.key);
 		return newKey;
 	}
 	/**
@@ -9179,15 +10555,19 @@ async function ingestSensorStateChange(deps, data, timestamp) {
 	const makeId = deps.makeId ?? (() => `pa-sensor-${randomUUID()}`);
 	let inserted = 0;
 	for (const cameraId of cameraIds) {
-		await deps.sink.insert({
+		const ev = {
 			id: makeId(),
 			deviceId: cameraId,
 			sourceDeviceId: data.deviceId,
 			kind: descriptor.kind,
 			value,
 			timestamp
-		});
+		};
+		await deps.sink.insert(ev);
 		inserted++;
+		if (deps.onPersisted !== void 0) try {
+			deps.onPersisted(ev);
+		} catch {}
 	}
 	return inserted;
 }
@@ -9575,7 +10955,7 @@ async function composeWideCentralSquareThumbnail(slab, layout) {
 	const leftPad = Math.max(0, Math.round(layout.slabOffsetX * scale));
 	const rightPad = Math.max(0, canvasNativeW - nativeW - leftPad);
 	if (leftPad === 0 && rightPad === 0) return slab;
-	return sharp(await sharp(slab).resize(canvasNativeW, nativeH, { fit: "fill" }).blur(LETTERBOX_BLUR_SIGMA).modulate({ brightness: LETTERBOX_BLUR_BRIGHTNESS }).toBuffer()).composite([{
+	return sharp(await sharp(slab).resize(canvasNativeW, nativeH, { fit: "cover" }).blur(LETTERBOX_BLUR_SIGMA).modulate({ brightness: LETTERBOX_BLUR_BRIGHTNESS }).toBuffer()).composite([{
 		input: slab,
 		left: leftPad,
 		top: 0
@@ -9742,8 +11122,11 @@ function isUniformRgbFrame(data, width, height) {
 *
 * The detection frame is resolved ONCE per call (blank-frame guard); native full
 * frames + subject crops are fetched per target by handle. Frames recycle in
-* milliseconds, so the caller must invoke this immediately after producing the
-* events while the handle is still live.
+* milliseconds, so the caller either invokes this while the handle is still
+* live, or — when the call is queued behind a capture lane (the S3 batch
+* dispatch) — pre-resolves the ≤640 frame in the live window via
+* {@link resolvePinnedFrame} and passes it as `pinnedFrame`, which skips the
+* by-handle resolve for the ≤640 tier entirely.
 */
 var EventMediaDispatcher = class {
 	deps;
@@ -9763,6 +11146,61 @@ var EventMediaDispatcher = class {
 		this.deps = deps;
 		this.sharedNativeFullFrame = createSharedFrameResolver((handle) => this.deps.getNativeFullFrameRgb(handle, SNAPSHOT_MAX_WIDTH));
 	}
+	/**
+	* Resolve the ≤640 detection frame by handle NOW — in the caller's LIVE frame
+	* window — and COPY its pixel data (`Buffer.from`) so ring recycling can never
+	* touch it. This is the seam the per-frame batch dispatch uses to pin the
+	* frame BEFORE queueing on the CaptureScheduler: since S3 the batch is one
+	* scheduler request against a 3-slot device lane and can start seconds late,
+	* by which time the handle's ring slot is usually recycled and the by-handle
+	* resolve in {@link captureForFrame} finds nothing (the 2026-07-23 boxed-tile
+	* regression). ~0.7MB per pinned frame, freed with the batch — bounded by the
+	* lane. Returns `null` on a genuine live-window miss (logged at debug — the
+	* caller then omits `pinnedFrame` and captureForFrame's by-handle resolve,
+	* WARN-logged on failure, remains the fallback).
+	*/
+	async resolvePinnedFrame(deviceId, frameHandle) {
+		try {
+			const decoded = await resolveFrame(frameHandle, { getRemoteFrame: this.deps.getRemoteFrame });
+			if (!decoded) return null;
+			return {
+				...decoded,
+				data: Buffer.from(decoded.data)
+			};
+		} catch (err) {
+			this.deps.logger.debug("event media: pinned-frame resolve threw (live window)", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					shmId: frameHandle.shmId,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* WARN-log a whole-batch capture abort: every early return in
+	* {@link captureForFrame} loses ALL of the frame's targets at once —
+	* firstFrame + snapshot/lastFrame/thumbnail + event child crops — which
+	* previously died with DEBUG-only logs (invisible in production, the silent
+	* half of the boxed-tile regression). The per-kind lost-target counts make
+	* the blast radius visible.
+	*/
+	warnBatchLost(reason, input, extraMeta = {}) {
+		this.deps.logger.warn(`event media: capture batch lost — ${reason}`, {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				deviceId: input.deviceId,
+				shmId: input.frameHandle.shmId,
+				pinned: input.pinnedFrame !== void 0,
+				lostEventTargets: input.events.length,
+				lostFirstFrameTargets: input.trackFrames.length,
+				lostSnapshotTargets: input.snapshots?.length ?? 0,
+				...extraMeta
+			}
+		});
+	}
 	async captureForFrame(input) {
 		const { deviceId, frameHandle, events, trackFrames } = input;
 		const snapshots = input.snapshots ?? [];
@@ -9776,51 +11214,28 @@ var EventMediaDispatcher = class {
 		const extraCandidateCount = input.rasterFallbackCandidates?.length ?? 0;
 		if (events.length === 0 && trackFrames.length === 0 && snapshots.length === 0 && extraCandidateCount === 0) return empty;
 		let decoded;
-		try {
+		if (input.pinnedFrame !== void 0) decoded = input.pinnedFrame;
+		else try {
 			decoded = await resolveFrame(frameHandle, { getRemoteFrame: this.deps.getRemoteFrame });
 		} catch (err) {
-			this.deps.logger.debug("event media: resolveFrame threw", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					shmId: frameHandle.shmId,
-					error: String(err)
-				}
-			});
+			this.warnBatchLost("resolveFrame threw", input, { error: String(err) });
 			return empty;
 		}
 		if (!decoded) {
-			this.deps.logger.debug("event media: frame recycled before resolve", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					shmId: frameHandle.shmId
-				}
-			});
+			this.warnBatchLost("frame recycled before resolve", input);
 			return empty;
 		}
 		if (decoded.format !== "rgb") {
-			this.deps.logger.debug("event media: resolved frame is not RGB", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					format: decoded.format
-				}
-			});
+			this.warnBatchLost("resolved frame is not RGB", input, { format: decoded.format });
 			return empty;
 		}
-		const frameData = Buffer.from(decoded.data);
+		const frameData = input.pinnedFrame !== void 0 ? decoded.data : Buffer.from(decoded.data);
 		const fw = decoded.width;
 		const fh = decoded.height;
 		if (isUniformRgbFrame(frameData, fw, fh)) {
-			this.deps.logger.debug("event media: resolved frame uniform (blank/hwaccel) — skipping crop", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					shmId: frameHandle.shmId,
-					width: fw,
-					height: fh
-				}
+			this.warnBatchLost("resolved frame uniform (blank/hwaccel)", input, {
+				width: fw,
+				height: fh
 			});
 			return empty;
 		}
@@ -10633,6 +12048,7 @@ var ZoneAnalyticsProvider = class {
 		}
 		this.snapshots.set(input.deviceId, snapshot);
 		this.appendHistory(input.deviceId, snapshot);
+		this.emitSnapshot(input.deviceId, snapshot);
 		this.sliceThrottle.push(input.deviceId, snapshot);
 	}
 	/** Drop a device's snapshot + history. Called on device removal. */
@@ -10697,10 +12113,24 @@ var ZoneAnalyticsProvider = class {
 			});
 			if (snapshot) {
 				this.appendHistory(deviceId, snapshot);
+				this.emitSnapshot(deviceId, snapshot);
 				this.sliceThrottle.push(deviceId, snapshot);
 			}
 		}
 	}
+	/** Push one snapshot to the occupancy tap, isolating any consumer throw from
+	*  the frame path (occupancy notifications must never break analytics). */
+	emitSnapshot(deviceId, snapshot) {
+		if (!this.ctx.onSnapshot) return;
+		try {
+			this.ctx.onSnapshot(deviceId, snapshot);
+		} catch (err) {
+			this.ctx.logger.debug("zone-analytics occupancy tap failed", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	}
 	appendHistory(deviceId, snapshot) {
 		const ring = this.history.get(deviceId) ?? [];
 		const cutoff = snapshot.ts - HISTORY_WINDOW_MS;
@@ -11610,21 +13040,47 @@ var FaceSettingsSchema = object({
 	* stripped from the per-device schema).
 	*/
 	enabled: boolean().default(true),
-	/** Cosine similarity (on L2-normalized arcface vectors) required to match. */
-	similarityThreshold: number().min(0).max(1).default(.55),
-	/** Reject ambiguous matches: require best − secondBest ≥ margin. */
-	margin: number().min(0).max(1).default(.1),
+	/** Cosine similarity (on L2-normalized arcface vectors) required to match.
+	*  Raised 0.55→0.62 (2026-07-23 face-quality batch): 0.55 was implausibly
+	*  loose against thin/low-quality galleries and produced ~25-40% visually
+	*  wrong auto-assignments in the 12h audit. */
+	similarityThreshold: number().min(0).max(1).default(.62),
+	/** Reject ambiguous matches: require best − secondBest ≥ margin. Raised
+	*  0.10→0.15 (2026-07-23 face-quality batch) to widen the confusion gap. */
+	margin: number().min(0).max(1).default(.15),
 	/** Minimum face-detection confidence for a face to be considered. */
 	minFaceConfidence: number().min(0).max(1).default(.5),
 	/**
-	* Minimum face bbox size (px, shorter side of the face box in detection-frame
-	* space) for a face to be eligible for embedding-based auto-matching. Below
-	* this, ArcFace resolution is unreliable and auto-assignment produces the
-	* observed false positives (tiny/distant faces collapsing onto one identity).
-	* Such faces are dropped BEFORE matching/enrolment (#26.1).
+	* Minimum face bbox size (px, shorter side, NATIVE scale when the runner
+	* measured it, else detection-frame space) for a face to be DETECTED and
+	* COLLECTED into the recent-faces buffer. Below this the face is dropped
+	* BEFORE ingest/enrolment (#26.1). This is the DETECTION/collection floor —
+	* NOT the auto-assignment floor (see {@link recognitionMinFacePx}).
 	*/
 	minFacePx: number().min(0).default(30),
 	/**
+	* Minimum face short side (px, NATIVE scale when the runner measured it, else
+	* detection-frame space) for a collected face to be eligible for AUTO-MATCH
+	* (identity assignment). Separate from — and ≥ — {@link minFacePx}: faces
+	* between `minFacePx` and this floor are still detected, cropped, and stored
+	* in the buffer (available for MANUAL assignment), but are NEVER auto-assigned
+	* an identity. ArcFace embeddings below ~48px are unreliable and drove the
+	* observed false positives (2026-07-23 face-quality batch). A face below this
+	* floor keeps `recognizedIdentityId` UNSET (fail-safe).
+	*/
+	recognitionMinFacePx: number().min(0).default(48),
+	/**
+	* Lower cosine bound of the SUGGESTION band (2026-07-24). A face whose best
+	* gallery match MISSES auto-assignment but is still plausible surfaces as a
+	* SUGGESTION (persisted `suggestedIdentityId`/`suggestedMatchScore`, never an
+	* assignment) when EITHER: its match cosine is in [`suggestionMinCosine`,
+	* `similarityThreshold`) AND its face clears the recognition size floor; OR its
+	* cosine is ≥ `similarityThreshold` but the face is below the recognition floor
+	* (blocked ONLY by size). Below this cosine nothing is suggested. Operator-
+	* overridable per field, like the other face thresholds.
+	*/
+	suggestionMinCosine: number().min(0).max(1).default(.5),
+	/**
 	* Minimum enrolled-sample count an identity must have before it can be an
 	* AUTO-MATCH target. A single-sample identity is an unreliable sink (one noisy
 	* enrolment attracted 81% of matches); identities below this are excluded from
@@ -11652,6 +13108,8 @@ function resolveFaceSettings(raw) {
 		margin: pick("margin"),
 		minFaceConfidence: pick("minFaceConfidence"),
 		minFacePx: pick("minFacePx"),
+		recognitionMinFacePx: pick("recognitionMinFacePx"),
+		suggestionMinCosine: pick("suggestionMinCosine"),
 		minIdentitySamples: pick("minIdentitySamples"),
 		confirmFrames: pick("confirmFrames"),
 		bufferRetentionDays: pick("bufferRetentionDays"),
@@ -13062,13 +14520,33 @@ function buildGlobalSettingsSchema() {
 				{
 					type: "number",
 					key: "minFacePx",
-					label: "Min face size",
-					description: "Minimum face box size (shorter side, pixels) for a face to be eligible for auto-matching. Faces smaller than this are too low-resolution for reliable recognition and are ignored. Raise it to suppress false matches on tiny/distant faces.",
+					label: "Min face size (detect)",
+					description: "Minimum face box size (shorter side, pixels) for a face to be DETECTED and stored in the recent-faces buffer. Faces smaller than this are ignored entirely. This is the collection floor — auto-assignment uses the separate, higher recognition floor below.",
 					min: 0,
 					step: 1,
 					default: FACE_DEFAULTS.minFacePx,
 					unit: "px"
 				},
+				{
+					type: "number",
+					key: "recognitionMinFacePx",
+					label: "Min face size (recognize)",
+					description: "Minimum face size (shorter side, pixels) for a stored face to be AUTO-ASSIGNED an identity. Faces between the detection floor and this value are still stored and can be assigned MANUALLY, but are never auto-matched — ArcFace embeddings on small faces are unreliable and produce false identities. Raise to suppress wrong auto-assignments on distant faces.",
+					min: 0,
+					step: 1,
+					default: FACE_DEFAULTS.recognitionMinFacePx,
+					unit: "px"
+				},
+				{
+					type: "number",
+					key: "suggestionMinCosine",
+					label: "Suggestion threshold",
+					description: "Lower cosine bound (0–1) of the SUGGESTION band. A plausible match that misses auto-assignment — cosine between this value and the similarity threshold with a large-enough face, or above the similarity threshold but below the recognition size floor — is surfaced as a one-tap SUGGESTION instead of being assigned. The face stays unassigned. Below this cosine nothing is suggested.",
+					min: 0,
+					max: 1,
+					step: .05,
+					default: FACE_DEFAULTS.suggestionMinCosine
+				},
 				{
 					type: "number",
 					key: "minIdentitySamples",
@@ -13193,6 +14671,7 @@ var PackageDropDetector = class {
 			importance: PACKAGE_IMPORTANCE
 		};
 		await this.deps.events.insertObject(ev);
+		this.deps.onPersisted?.(ev, "delivered");
 		this.deps.emit.delivered({
 			deviceId: entry.deviceId,
 			entryId: entry.id,
@@ -13243,6 +14722,7 @@ var PackageDropDetector = class {
 			importance: PACKAGE_IMPORTANCE
 		};
 		await this.deps.events.insertObject(ev);
+		this.deps.onPersisted?.(ev, "picked-up");
 		this.deps.emit.pickedUp({
 			deviceId: entry.deviceId,
 			entryId: entry.id,
@@ -13728,6 +15208,22 @@ var FACE_COLUMNS = [
 	{
 		name: "faceBbox",
 		type: "JSON"
+	},
+	{
+		name: "bestMatchScore",
+		type: "REAL"
+	},
+	{
+		name: "nativeFaceShortSidePx",
+		type: "REAL"
+	},
+	{
+		name: "suggestedIdentityId",
+		type: "TEXT"
+	},
+	{
+		name: "suggestedMatchScore",
+		type: "REAL"
 	}
 ];
 var FACE_INDEXES = [{
@@ -13802,7 +15298,11 @@ var FaceStore = class {
 				recognizedIdentityId: data.recognizedIdentityId ?? void 0,
 				assignedSampleId: data.assignedSampleId ?? void 0,
 				keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
-				faceBbox: data.faceBbox ?? void 0
+				faceBbox: data.faceBbox ?? void 0,
+				bestMatchScore: data.bestMatchScore ?? void 0,
+				nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
+				suggestedIdentityId: data.suggestedIdentityId ?? void 0,
+				suggestedMatchScore: data.suggestedMatchScore ?? void 0
 			};
 		}).filter((f) => !f.assigned);
 	}
@@ -14002,7 +15502,11 @@ var FaceStore = class {
 			recognizedIdentityId: data.recognizedIdentityId ?? void 0,
 			assignedSampleId: data.assignedSampleId ?? void 0,
 			keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
-			faceBbox: data.faceBbox ?? void 0
+			faceBbox: data.faceBbox ?? void 0,
+			bestMatchScore: data.bestMatchScore ?? void 0,
+			nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
+			suggestedIdentityId: data.suggestedIdentityId ?? void 0,
+			suggestedMatchScore: data.suggestedMatchScore ?? void 0
 		};
 	}
 	/**
@@ -14048,7 +15552,11 @@ var FaceStore = class {
 				recognizedIdentityId: data.recognizedIdentityId ?? void 0,
 				assignedSampleId: data.assignedSampleId ?? void 0,
 				keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
-				faceBbox: data.faceBbox ?? void 0
+				faceBbox: data.faceBbox ?? void 0,
+				bestMatchScore: data.bestMatchScore ?? void 0,
+				nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
+				suggestedIdentityId: data.suggestedIdentityId ?? void 0,
+				suggestedMatchScore: data.suggestedMatchScore ?? void 0
 			};
 		});
 		const filterMode = input.filter ?? "all";
@@ -14280,6 +15788,40 @@ function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples)
 	return eligible;
 }
 /**
+* Match a probe embedding against the gallery. Only samples with the same
+* `modelId` AND the same dimension are compared (model-version safety). Returns
+* the best identity when its score ≥ threshold and it beats the best OTHER
+* identity by ≥ margin; otherwise null.
+*/
+function matchEmbedding(probe, gallery, opts) {
+	const probeVec = new Float32Array(probe.embedding);
+	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
+	const bestByIdentity = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probe.modelId) continue;
+		if (s.embedding.length !== probe.embedding.length) continue;
+		if (!eligible.has(s.identityId)) continue;
+		const score = cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		const prev = bestByIdentity.get(s.identityId);
+		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+	}
+	if (bestByIdentity.size === 0) return null;
+	let bestId = null;
+	let bestScore = -Infinity;
+	let secondScore = -Infinity;
+	for (const [id, score] of bestByIdentity) if (score > bestScore) {
+		secondScore = bestScore;
+		bestScore = score;
+		bestId = id;
+	} else if (score > secondScore) secondScore = score;
+	if (bestId === null || bestScore < opts.threshold) return null;
+	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
+	return {
+		identityId: bestId,
+		score: bestScore
+	};
+}
+/**
 * Assign at most one identity per track AND at most one track per identity for
 * a single frame. Greedy by score: compute every candidate's full ranked match
 * list, then repeatedly take the globally-highest (track, identity) pair whose
@@ -14386,6 +15928,24 @@ var FaceRecognizer = class {
 	names = /* @__PURE__ */ new Map();
 	aggregates = /* @__PURE__ */ new Map();
 	bestFace = /* @__PURE__ */ new Map();
+	/**
+	* Peak identity-MATCH cosine per track for the currently-assigned identity
+	* (NOT the detection confidence held in {@link bestFace}). Reset on an
+	* identity switch so a track carries the confidence of the label it ends up
+	* with. Read synchronously at close (NC `minLabelConfidence`) via
+	* {@link bestLabelMatchConfidence}, then dropped in {@link onTrackEnd}.
+	*/
+	bestMatchScore = /* @__PURE__ */ new Map();
+	/**
+	* Peak SUGGESTION (identity + cosine) per track: the best plausible-but-not-
+	* confident match that MISSED auto-assignment (cosine in the suggestion band
+	* with a large-enough face, OR ≥ threshold but below the recognition size
+	* floor). Accumulated across frames exactly like {@link bestMatchScore},
+	* read at close, then dropped in {@link onTrackEnd}. A track that is ever
+	* auto-assigned discards this at close (mutual exclusivity: assigned rows
+	* carry `recognizedIdentityId`, suggestion rows carry `suggested*`).
+	*/
+	bestSuggestion = /* @__PURE__ */ new Map();
 	/** Best-face-per-track ranking via the shared tracker primitive, constructed
 	*  WITH the DECLARED face policy (`BEST_FACE_POLICY` in
 	*  `best-selection-policies.ts`): confidence-only, no hysteresis, no rate
@@ -14455,7 +16015,9 @@ var FaceRecognizer = class {
 				gallerySize: this.gallery.length
 			}
 		});
-		const matches = this.gallery.length > 0 ? assignUniquePerFrame(candidates.map((c) => ({
+		const meetsRecognitionFloor = (t) => (t.nativeFaceShortSidePx ?? (t.faceBbox ? Math.min(t.faceBbox.w, t.faceBbox.h) : void 0) ?? Number.POSITIVE_INFINITY) >= settings.recognitionMinFacePx;
+		const matchCandidates = candidates.filter(meetsRecognitionFloor);
+		const matches = this.gallery.length > 0 && matchCandidates.length > 0 ? assignUniquePerFrame(matchCandidates.map((c) => ({
 			trackId: c.trackId,
 			embedding: c.embedding,
 			modelId: c.embeddingModelId
@@ -14464,16 +16026,42 @@ var FaceRecognizer = class {
 			margin: settings.margin,
 			minIdentitySamples: settings.minIdentitySamples
 		}) : /* @__PURE__ */ new Map();
+		if (this.gallery.length > 0) for (const c of candidates) {
+			const suggestion = matchEmbedding({
+				embedding: c.embedding,
+				modelId: c.embeddingModelId
+			}, this.gallery, {
+				threshold: settings.suggestionMinCosine,
+				margin: settings.margin,
+				minIdentitySamples: settings.minIdentitySamples
+			});
+			if (suggestion === null) continue;
+			const meetsRecognitionFloor = (c.nativeFaceShortSidePx ?? (c.faceBbox ? Math.min(c.faceBbox.w, c.faceBbox.h) : void 0) ?? Number.POSITIVE_INFINITY) >= settings.recognitionMinFacePx;
+			const inNearMissBand = meetsRecognitionFloor && suggestion.score < settings.similarityThreshold;
+			const inSizeBlockedBand = !meetsRecognitionFloor && suggestion.score >= settings.similarityThreshold;
+			if (!inNearMissBand && !inSizeBlockedBand) continue;
+			const prev = this.bestSuggestion.get(c.trackId);
+			if (prev === void 0 || suggestion.score > prev.score) this.bestSuggestion.set(c.trackId, {
+				identityId: suggestion.identityId,
+				score: suggestion.score
+			});
+		}
 		const labelWork = [];
 		for (const c of candidates) {
 			const match = matches.get(c.trackId) ?? null;
 			const { state, changed } = updateTrackAggregate(this.aggregates.get(c.trackId) ?? EMPTY_AGGREGATE, match, { confirmFrames: settings.confirmFrames });
 			this.aggregates.set(c.trackId, state);
-			if (changed && state.assignedIdentityId !== null) labelWork.push({
-				trackId: c.trackId,
-				assignedIdentityId: state.assignedIdentityId,
-				matchScore: match?.score ?? null
-			});
+			if (changed && state.assignedIdentityId !== null) {
+				labelWork.push({
+					trackId: c.trackId,
+					assignedIdentityId: state.assignedIdentityId,
+					matchScore: match?.score ?? null
+				});
+				if (match?.score !== void 0) this.bestMatchScore.set(c.trackId, match.score);
+			} else if (match !== null && state.assignedIdentityId !== null && match.identityId === state.assignedIdentityId) {
+				const prev = this.bestMatchScore.get(c.trackId);
+				if (prev === void 0 || match.score > prev) this.bestMatchScore.set(c.trackId, match.score);
+			}
 			const recognizedIdentityId = state.assignedIdentityId ?? match?.identityId ?? void 0;
 			const held = this.bestFace.get(c.trackId);
 			const isNewBest = this.bestTracker.observe(c.trackId, c.confidence, input.timestamp);
@@ -14502,7 +16090,8 @@ var FaceRecognizer = class {
 						bbox: cropBbox,
 						timestamp: input.timestamp,
 						...bestCrop !== void 0 ? { crop: bestCrop } : {},
-						...recognizedIdentityId !== void 0 ? { recognizedIdentityId } : {}
+						...recognizedIdentityId !== void 0 ? { recognizedIdentityId } : {},
+						...c.nativeFaceShortSidePx !== void 0 ? { nativeFaceShortSidePx: c.nativeFaceShortSidePx } : {}
 					});
 				} else if (crop !== void 0 && held !== void 0) this.bestFace.set(c.trackId, {
 					...held,
@@ -14579,11 +16168,23 @@ var FaceRecognizer = class {
 	* entry (crop -> MediaStore under ownerKind 'face'), then drop the track's
 	* in-memory state. Best-effort; a track with no held face is a no-op.
 	*/
+	/**
+	* Peak identity-match cosine for the track's assigned identity, or undefined
+	* when no identity was ever confirmed. Read at close BEFORE {@link onTrackEnd}
+	* drops the per-track state (the NC `minLabelConfidence` seam).
+	*/
+	bestLabelMatchConfidence(trackId) {
+		return this.bestMatchScore.get(trackId);
+	}
 	async onTrackEnd(deviceId, trackId) {
 		const held = this.bestFace.get(trackId);
+		const bestMatchScore = this.bestMatchScore.get(trackId);
+		const bestSuggestion = this.bestSuggestion.get(trackId);
 		this.aggregates.delete(trackId);
 		this.bestFace.delete(trackId);
 		this.bestTracker.delete(trackId);
+		this.bestMatchScore.delete(trackId);
+		this.bestSuggestion.delete(trackId);
 		if (held === void 0) {
 			this.deps.logger.debug("face: track ended without a held face", { tags: {
 				deviceId,
@@ -14647,7 +16248,13 @@ var FaceRecognizer = class {
 				...held.recognizedIdentityId !== void 0 ? { recognizedIdentityId: held.recognizedIdentityId } : {},
 				assigned: false,
 				faceBbox: held.bbox,
-				...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {}
+				...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {},
+				...bestMatchScore !== void 0 ? { bestMatchScore } : {},
+				...held.nativeFaceShortSidePx !== void 0 ? { nativeFaceShortSidePx: held.nativeFaceShortSidePx } : {},
+				...held.recognizedIdentityId === void 0 && bestSuggestion !== void 0 ? {
+					suggestedIdentityId: bestSuggestion.identityId,
+					suggestedMatchScore: bestSuggestion.score
+				} : {}
 			});
 			this.deps.logger.info("face: buffered to gallery", {
 				tags: {
@@ -15970,11 +17577,13 @@ var PlateRecognizer = class {
 		} : null;
 	}
 	/** Live label for a plate read: the recognized vehicle NAME when matched,
-	*  else the raw OCR text. Returns `null` for an implausible read (junk OCR
-	*  off a distant/oblique plate) — the caller must NOT stamp a label then. */
+	*  else the NORMALIZED (uppercase, alnum-only) OCR text — never the raw read,
+	*  so lowercase/separator residue can't reach track labels. Returns `null`
+	*  for an implausible read (junk OCR off a distant/oblique plate) — the
+	*  caller must NOT stamp a label then. */
 	resolveLabel(text, score) {
 		if (!isPlausiblePlateRead(text, score)) return null;
-		return this.matchVehicle(text, score)?.name ?? text;
+		return this.matchVehicle(text, score)?.name ?? normalizePlate$1(text);
 	}
 	async processFrame(input) {
 		const minConfidence = input.minConfidence ?? 0;
@@ -16035,6 +17644,15 @@ var PlateRecognizer = class {
 			...crop !== void 0 ? { crop } : {}
 		});
 	}
+	/**
+	* Best OCR read score for the track's held plate (`plateText.confidence`),
+	* or undefined when no plausible plate was read. Read at close BEFORE
+	* {@link onTrackEnd} drops the per-track state (the NC `minLabelConfidence`
+	* seam — mirrors the face recognizer's identity-match confidence).
+	*/
+	bestLabelMatchConfidence(trackId) {
+		return this.bestPlate.get(trackId)?.score;
+	}
 	/** Persist the held best plate for a finished track as one PlateStore row
 	*  (crop → MediaStore under ownerKind 'plate'), then drop in-memory state. */
 	async onTrackEnd(deviceId, trackId) {
@@ -16140,6 +17758,47 @@ var PlateRecognizer = class {
 	}
 };
 //#endregion
+//#region src/shared/frame/keyframe-wide-thumbnail.ts
+/**
+* 16:9 central-square subject crop out of a DECODED (raw RGB) full frame — the
+* close-time keyFrame→`thumbnail` derive (#27-A degenerate-retry fix, part 3).
+*
+* The live best-shot path fetches the 16:9 central-square WINDOW from the
+* runner's retained NATIVE surface ({@link wideCentralSquareLayout} +
+* {@link composeWideCentralSquareThumbnail} — see
+* `services/event-media-dispatcher.cropSubjectVariants`). At track close that
+* surface is long gone; the only durable full frame is the persisted native
+* `keyFrame` JPEG. This helper applies the SAME framing to that decoded frame:
+* normalized subject bbox → pixel bbox in the frame's OWN space → central-square
+* 16:9 layout → extract the in-frame slab → compose (lateral ambience fill for
+* any out-of-frame part). Same containment guarantee, same variants downstream
+* (`deriveThumbnailSmall` runs on the returned window).
+*
+* Shaped as a `cropRegionToJpeg` drop-in for {@link createKeyFrameCrop} (same
+* signature as the plain `extractCrop` composition used for plate crops), so
+* the close-time derive reuses the EXISTING keyframe-crop utility — media
+* fetch, temporal-skew guard and decode included — with only the framing
+* swapped.
+*/
+/**
+* Compose the 16:9 central-square `thumbnail` window for a normalized subject
+* region of a raw RGB frame. Returns the composed JPEG (never upscaled — the
+* window is at the frame's native scale).
+*/
+async function cropWideCentralSquareFromRgb(rgb, frameWidth, frameHeight, norm) {
+	const layout = wideCentralSquareLayout({
+		x: norm.x * frameWidth,
+		y: norm.y * frameHeight,
+		w: norm.w * frameWidth,
+		h: norm.h * frameHeight
+	}, {
+		W: frameWidth,
+		H: frameHeight
+	});
+	const { crop: slab } = await extractCrop(rgb, frameWidth, frameHeight, layout.fetch);
+	return composeWideCentralSquareThumbnail(slab, layout);
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/event-child-crops.ts
 /**
 * Compute Intersection-over-Union between two (x,y,w,h) bounding boxes.
@@ -16705,6 +18364,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  path). Null on non-post-processing nodes or when disabled. */
 	embeddingDispatcher = null;
 	bindingCache = null;
+	/** Per-device throttle for the inactive-binding frame-drop warn (5 min). */
+	inactiveBindingDropWarnAt = /* @__PURE__ */ new Map();
 	zoneAnalytics = null;
 	audioMetrics = null;
 	/**
@@ -16837,40 +18498,67 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		return this._captureScheduler;
 	}
 	get trackCloser() {
-		if (!this._trackCloser) this._trackCloser = new TrackCloser({
-			logger: this.ctx.logger,
-			residents: this.residents,
-			trackStore: () => this.trackStore,
-			mediaStore: () => this.mediaStore,
-			eventStore: () => this.eventStore,
-			faceRecognizer: () => this.faceRecognizer,
-			plateRecognizer: () => this.plateRecognizer,
-			detailDispatcher: () => this.detailDispatcher,
-			overlayState: this.overlayState,
-			mediaCaptureLog: this.mediaCaptureLog,
-			frameDims: (deviceId) => this.lastFrameDimsByDevice.get(deviceId),
-			isShuttingDown: () => this.shuttingDown,
-			emitTrackEnded: (data, timestampMs) => {
-				this.ctx.eventBus.emit({
-					id: `pa-end-${data.trackId}`,
-					timestamp: new Date(timestampMs),
-					source: {
-						type: "addon",
-						id: "pipeline-analytics",
-						addonId: "pipeline-analytics"
-					},
-					category: EventCategory.PipelineAnalyticsTrackEnded,
-					data: {
-						deviceId: data.deviceId,
-						trackId: data.trackId,
-						className: data.className,
-						durationMs: data.durationMs
-					}
-				});
-			},
-			emitTrackLifecycle: (payload, timestampMs) => this.emitTrackLifecycle(payload, timestampMs),
-			onTrackClosed: (track, ownedMedia, info) => this.notificationCenter?.onTrackClosed(track, ownedMedia, info)
-		});
+		if (!this._trackCloser) {
+			const deriveKeyFrameThumbnailJpeg = createKeyFrameCrop({
+				getMedia: async (mediaKey) => {
+					const m = await this.mediaStore?.getByKey(mediaKey);
+					return m ? {
+						base64: m.base64,
+						timestamp: m.timestamp
+					} : null;
+				},
+				decodeJpegToRgb: (base64) => decodeJpegToRgb(base64),
+				cropRegionToJpeg: (bytes, w, h, norm) => cropWideCentralSquareFromRgb(bytes, w, h, norm),
+				maxSkewMs: KEYFRAME_CROP_MAX_SKEW_MS,
+				logger: this.ctx.logger.child("CloseKeyFrameThumbnail")
+			});
+			this._trackCloser = new TrackCloser({
+				logger: this.ctx.logger,
+				residents: this.residents,
+				trackStore: () => this.trackStore,
+				mediaStore: () => this.mediaStore,
+				eventStore: () => this.eventStore,
+				faceRecognizer: () => this.faceRecognizer,
+				plateRecognizer: () => this.plateRecognizer,
+				detailDispatcher: () => this.detailDispatcher,
+				overlayState: this.overlayState,
+				mediaCaptureLog: this.mediaCaptureLog,
+				frameDims: (deviceId) => this.lastFrameDimsByDevice.get(deviceId),
+				isShuttingDown: () => this.shuttingDown,
+				emitTrackEnded: (data, timestampMs) => {
+					this.ctx.eventBus.emit({
+						id: `pa-end-${data.trackId}`,
+						timestamp: new Date(timestampMs),
+						source: {
+							type: "addon",
+							id: "pipeline-analytics",
+							addonId: "pipeline-analytics"
+						},
+						category: EventCategory.PipelineAnalyticsTrackEnded,
+						data: {
+							deviceId: data.deviceId,
+							trackId: data.trackId,
+							className: data.className,
+							durationMs: data.durationMs
+						}
+					});
+				},
+				emitTrackLifecycle: (payload, timestampMs) => this.emitTrackLifecycle(payload, timestampMs),
+				onTrackClosed: (track, ownedMedia, info) => this.notificationCenter?.onTrackClosed(track, ownedMedia, info),
+				deriveThumbnailFromKeyFrame: async (input) => {
+					const derived = await deriveKeyFrameThumbnailJpeg({
+						...input,
+						padding: 0
+					});
+					if (!derived) return null;
+					return {
+						thumbnail: derived.jpeg,
+						thumbnailSmall: await deriveThumbnailSmall(derived.jpeg),
+						skewMs: derived.skewMs
+					};
+				}
+			});
+		}
 		return this._trackCloser;
 	}
 	/** Master toggle for the migrated object/face EmbeddingDispatcher (default
@@ -16948,7 +18636,33 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		if (this.isPostProcessingNode) await this.startEmbeddingDispatcher(logger, transport);
 		this.startSweepTimers();
 		this.ctx.logger.info("pipeline-analytics subscribers installed");
-		return this.buildProviderRegistrations(api, stores, capProviders);
+		const providers = this.buildProviderRegistrations(api, stores, capProviders);
+		const isHub = ownNodeId === "hub";
+		const ncHandlers = isHub ? this.buildNcActionHandlers(api) : void 0;
+		return {
+			providers,
+			...isHub && ncHandlers !== void 0 ? {
+				customActions: ncActions,
+				actionHandlers: ncHandlers
+			} : {}
+		};
+	}
+	/**
+	* Build the `nc.*` bridge handlers over the rule store, resolving the
+	* caller-owned target set from the notifiers target catalog (a target is
+	* owned when its open `config.ownerUserId` blob matches the caller). Returns
+	* `undefined` when the Notification Center is absent (never built).
+	*/
+	buildNcActionHandlers(api) {
+		const center = this.notificationCenter;
+		if (center === null) return void 0;
+		return makeNcActionHandlers({
+			ruleStore: center.ruleStore,
+			logger: this.ctx.logger.child("nc-actions"),
+			listCallerTargetIds: async (userId) => {
+				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
+			}
+		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
 	*  a CREATE TABLE. Idempotent. */
@@ -17073,6 +18787,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			resolveZones: (deviceId) => this.resolveDeviceZones(deviceId),
 			resolvePackageRules: (deviceId) => this.resolveDevicePackageRules(deviceId),
 			resolveSettings: (deviceId) => this.resolveDevicePackageDropSettings(deviceId),
+			onPersisted: (ev, phase) => this.notificationCenter?.onPackageEventPersisted(ev, phase),
 			onError: (scope, err) => logger.warn("package-drop detector error", { meta: {
 				scope,
 				error: errMsg(err)
@@ -17231,7 +18946,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			fetchDevice: (deviceId) => this.ctx.fetchDevice(deviceId),
 			listStationaryObjects: (deviceId) => this.stationaryRegistry?.listViews(deviceId) ?? [],
 			listStationaryDeviceIds: () => this.stationaryRegistry?.deviceIds() ?? [],
-			resolveZones: (deviceId) => this.resolveDeviceZones(deviceId)
+			resolveZones: (deviceId) => this.resolveDeviceZones(deviceId),
+			onSnapshot: (deviceId, snapshot) => this.notificationCenter?.observeOccupancy(deviceId, snapshot)
 		});
 		this.zoneAnalytics = zoneAnalytics;
 		const audioMetrics = new AudioMetricsProvider({
@@ -17578,7 +19294,20 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*/
 	async processFrame(deviceId, frame, source, frameHandle, detailSteps) {
 		if (this.shuttingDown) return;
-		if (!await this.bindingCache.isActive(deviceId)) return;
+		if (!await this.bindingCache.isActive(deviceId)) {
+			const now = Date.now();
+			if (now - (this.inactiveBindingDropWarnAt.get(deviceId) ?? 0) >= 3e5) {
+				this.inactiveBindingDropWarnAt.set(deviceId, now);
+				this.ctx.logger.warn("inference frames dropped — pipeline-analytics binding inactive", {
+					tags: { deviceId },
+					meta: {
+						source,
+						detections: frame.detections.length
+					}
+				});
+			}
+			return;
+		}
 		const key = this.procKey(deviceId, source);
 		const trk = await this.resolveDeviceTrackingSettings(deviceId);
 		const activeCount = this.lastActiveTrackIds.get(key)?.size ?? 0;
@@ -17684,7 +19413,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					source,
 					resurrected: true
 				} });
-				if (this.eventMediaDispatcher) this.residents.setLastFrameAt(deviceId, id, result.timestamp);
+				if (this.eventMediaDispatcher) {
+					this.residents.setLastFrameAt(deviceId, id, result.timestamp);
+					if (!this.residents.isFirstFrameLanded(id) && !this.residents.isFirstFramePending(id)) this.residents.markFirstFramePending(deviceId, id);
+				}
 				continue;
 			}
 			bornCandidates.push({
@@ -17871,8 +19603,6 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			else plateCrops += 1;
 			const snapshotTargets = this.buildSnapshotTargets(deviceId, result.tracked, result.timestamp, mediaSettings, result.frameWidth, result.frameHeight);
 			for (const retry of this.collectFirstFrameRetries(deviceId, result.tracked, result.timestamp, firstFrameTargets)) firstFrameTargets.push(retry);
-			const keyFrameTrackIds = selectKeyFrameTrackIds(snapshotTargets);
-			if (keyFrameTrackIds.length > 0) this.persistKeyFrames(deviceId, result.timestamp, keyFrameTrackIds, frameHandle);
 			const targetedThisFrame = new Set([...firstFrameTargets.map((t) => t.trackId), ...snapshotTargets.map((s) => s.trackId)]);
 			const rasterFallbackCandidates = [];
 			const widenedRasterWantedIds = /* @__PURE__ */ new Set();
@@ -17918,6 +19648,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				for (const t of firstFrameTargets) if (!this.residents.closure(t.trackId)?.rasterFallback) rasterFallbackWantedTrackIds.add(t.trackId);
 				for (const s of snapshotTargets) if (!this.residents.closure(s.trackId)?.rasterFallback) rasterFallbackWantedTrackIds.add(s.trackId);
 				const dispatcher = this.eventMediaDispatcher;
+				const pinnedFramePromise = dispatcher.resolvePinnedFrame(deviceId, frameHandle);
 				this.captureScheduler.request({
 					deviceId,
 					kind: deriveFrameDispatchKind({
@@ -17927,7 +19658,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						hasSnapshot: snapshotTargets.some((t) => t.appendSnapshot)
 					}),
 					holdKeys: heldCaptureKeys,
-					exec: () => dispatcher.captureForFrame({
+					exec: () => pinnedFramePromise.then((pinnedFrame) => dispatcher.captureForFrame({
 						deviceId,
 						frameHandle,
 						events: eventTargets,
@@ -17935,8 +19666,9 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						snapshots: snapshotTargets,
 						cropPadding: mediaSettings.cropPadding,
 						rasterFallbackWantedTrackIds,
-						rasterFallbackCandidates
-					}).then((res) => {
+						rasterFallbackCandidates,
+						...pinnedFrame !== null ? { pinnedFrame } : {}
+					})).then((res) => {
 						for (const rf of res.rasterFallbacks) this.residents.retainRasterFallback(deviceId, rf.trackId, {
 							jpeg: rf.jpeg,
 							timestamp: rf.timestamp
@@ -17952,11 +19684,16 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 							mediaKey: s.mediaKey
 						});
 						for (const trackId of res.thumbnailTrackIds) this.residents.markThumbnailLanded(deviceId, trackId);
-						for (const trackId of res.firstFrameTrackIds) this.residents.clearFirstFramePending(trackId);
+						for (const trackId of res.firstFrameTrackIds) {
+							this.residents.clearFirstFramePending(trackId);
+							this.residents.markFirstFrameLanded(deviceId, trackId);
+						}
 						for (const trackId of res.lastFrameTrackIds) this.residents.setLastFrameAt(deviceId, trackId, dispatchTimestamp);
 					})
 				}).catch(() => {});
 			}
+			const keyFrameTrackIds = selectKeyFrameTrackIds(snapshotTargets);
+			if (keyFrameTrackIds.length > 0) this.persistKeyFrames(deviceId, result.timestamp, keyFrameTrackIds, frameHandle);
 		}
 		if (this.faceRecognizer && faceGloballyEnabled && faceSettings) this.faceRecognizer.processFrame({
 			deviceId,
@@ -18302,7 +20039,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		if (!await this.resolveGlobalFaceEnabled()) return;
 		const [settings, media] = await Promise.all([this.resolveDeviceFaceSettings(deviceId), this.resolveDeviceMediaSettings(deviceId)]);
 		const faceShortSidePx = detail.nativeFaceShortSidePx ?? (detail.bbox !== void 0 ? Math.min(detail.bbox.w, detail.bbox.h) : void 0);
-		if (faceShortSidePx !== void 0 && faceShortSidePx < settings.minFacePx) return;
+		if (faceShortSidePx !== void 0 && faceShortSidePx < settings.minFacePx) {
+			this.ctx.logger.debug("face detail below minFacePx — dropped", {
+				tags: { deviceId },
+				meta: {
+					trackId,
+					faceShortSidePx: Math.round(faceShortSidePx),
+					minFacePx: settings.minFacePx,
+					gatedOn: detail.nativeFaceShortSidePx !== void 0 ? "native" : "bbox"
+				}
+			});
+			return;
+		}
 		await this.faceRecognizer.ingestFaceDetail({
 			deviceId,
 			trackId,
@@ -18313,6 +20061,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			embedding: decodeEmbeddingBase64(detail.embedding),
 			parentBbox: { ...frame.bbox },
 			...detail.bbox !== void 0 ? { faceBbox: { ...detail.bbox } } : {},
+			...detail.nativeFaceShortSidePx !== void 0 ? { nativeFaceShortSidePx: detail.nativeFaceShortSidePx } : {},
 			...detail.alignedCropJpeg !== void 0 ? { alignedCropJpeg: detail.alignedCropJpeg } : {},
 			settings,
 			cropPadding: media.cropPadding,
@@ -18675,8 +20424,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			});
 			const rollingLastFrame = plan.rollingLastFrame && !this.captureScheduler.isKeyActive(captureCoalesceKey(deviceId, "lastFrame", t.trackId));
 			if (plan.appendSnapshot) this.trackStore.markSnapshotPending(t.trackId, timestamp, t.bbox);
-			const plausibleBox = isPlausibleThumbnailBox(t.bbox, frameWidth, frameHeight);
-			const bestThumbnail = plan.bestThumbnail && plausibleBox && !this.captureScheduler.isKeyActive(captureCoalesceKey(deviceId, "thumbnail", t.trackId));
+			const plausibleBox = isPlausibleThumbnailBox(t.bbox, frameWidth, frameHeight, t.confidence);
+			if (isNewBest && plausibleBox) this.residents.recordBestSeenBbox(deviceId, t.trackId, {
+				x: t.bbox.x,
+				y: t.bbox.y,
+				w: t.bbox.w,
+				h: t.bbox.h,
+				frameWidth,
+				frameHeight,
+				timestamp
+			});
+			const retryBoxPlausible = isNewBest || isPlausibleRetryBox(t.bbox, this.residents.bestSeenBbox(t.trackId) ?? null);
+			const bestThumbnail = plan.bestThumbnail && plausibleBox && retryBoxPlausible && !this.captureScheduler.isKeyActive(captureCoalesceKey(deviceId, "thumbnail", t.trackId));
 			const keyFrame = isNewBest && plausibleBox;
 			if (!plan.appendSnapshot && !rollingLastFrame && !bestThumbnail && !keyFrame) continue;
 			targets.push({
@@ -18743,6 +20502,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				atMs: timestamp
 			});
 			await this.eventStore.insertAudio(ev);
+			this.notificationCenter?.onAudioEventPersisted(ev);
 			this.trackStore?.addAudioLabelEpisode(deviceId, route.className, topClassification.score, timestamp);
 			this.ctx.eventBus.emit({
 				id: `pa-${ev.id}`,
@@ -19376,7 +21136,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		try {
 			await ingestSensorStateChange({
 				sink: store,
-				cache
+				cache,
+				onPersisted: (ev) => this.notificationCenter?.onSensorEventPersisted(ev)
 			}, data, timestamp);
 		} catch (err) {
 			this.ctx.logger.warn("sensor-event ingest failed", {
@@ -19895,4 +21656,4 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { DETECTION_PIPELINE_SECTION_IDS, PipelineAnalyticsAddon as default, pickCleanMedia, retagDetectionSections, stripGlobalOnlyFields, toAnalyticsDeviceSections };
+export { DETECTION_PIPELINE_SECTION_IDS, ncActions as customActions, ncActions, PipelineAnalyticsAddon as default, pickCleanMedia, retagDetectionSections, stripGlobalOnlyFields, toAnalyticsDeviceSections };