@camstack/addon-post-analysis 1.2.70 → 1.2.72

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as readDeviceStateFrom, A as TimelapseRuleInputSchema, B as customAction, C as NcSnoozeSchema, Ct as unknown, D as RECORDING_EXPORT_MAX_READ_BYTES, E as OpsLogEntrySchema, F as alarmPanelCapability, G as faceGalleryCapability, H as deriveRecordingMode, I as assertTimelapseCadences, J as isScheduleActive, L as audioMetricsCapability, M as TimelapseRuleSchema, N as TrackSourceSchema, O as RetrainStatusSchema, P as addonWidgetsSourceCapability, Q as plateGalleryCapability, R as buildEventKindDescriptor, S as NcSnoozeInputSchema, St as string, T as NcTaxonomySchema, V as defineCustomActions, W as encodeVectorBase64, X as notificationRulesCapability, Y as kebabToCamel, Z as pipelineAnalyticsCapability, _ as NcRuleInputSchema, _t as literal, at as errMsg, b as NcRuleTargetSchema, bt as partialRecord, c as EVENT_PAD_MS, ct as createEvent, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as nodePin, et as readTimelapseGeneratedAt, f as NC_CONDITION_CATALOG, ft as sleep, g as NcConditionDescriptorSchema, gt as discriminatedUnion, h as NC_TAXONOMY, ht as boolean, i as DETECTION_MACRO_CLASSES, it as zoneAnalyticsCapability, j as TimelapseRulePatchSchema, k as TIMELAPSE_DENSE_FLOOR_SEC, l as LabelAttributionSchema, lt as hydrateSchema, mt as array, n as DEFAULT_EVENT_COLOR, nt as vectorDimFromBase64, o as DeclaredDevices, ot as BaseAddon, p as NC_DEFAULT_SNOOZE_MINUTES, pt as _enum, q as isDetectionMacroClass, rt as videoclipsCapability, s as EVENT_KIND_BY_CAP, st as DeviceType, t as BaseDevice, tt as subKindsOf, u as MACRO_LABELS, ut as isDeviceScopedCap, v as NcRulePatchSchema, vt as number, w as NcSnoozeSuppressedSchema, wt as EventCategory, x as NcScheduleSchema, xt as record, y as NcRuleSchema, yt as object, z as cosineSimilarity } from "../dist-6T-F0YJO.mjs";
+import { $ as readDeviceStateFrom, A as TimelapseRuleInputSchema, B as customAction, C as NcSnoozeSchema, Ct as unknown, D as RECORDING_EXPORT_MAX_READ_BYTES, E as OpsLogEntrySchema, F as alarmPanelCapability, G as faceGalleryCapability, H as deriveRecordingMode, I as assertTimelapseCadences, J as isScheduleActive, L as audioMetricsCapability, M as TimelapseRuleSchema, N as TrackSourceSchema, O as RetrainStatusSchema, P as addonWidgetsSourceCapability, Q as plateGalleryCapability, R as buildEventKindDescriptor, S as NcSnoozeInputSchema, St as string, T as NcTaxonomySchema, V as defineCustomActions, W as encodeVectorBase64, X as notificationRulesCapability, Y as kebabToCamel, Z as pipelineAnalyticsCapability, _ as NcRuleInputSchema, _t as literal, at as errMsg, b as NcRuleTargetSchema, bt as partialRecord, c as EVENT_PAD_MS, ct as createEvent, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as nodePin, et as readTimelapseGeneratedAt, f as NC_CONDITION_CATALOG, ft as sleep, g as NcConditionDescriptorSchema, gt as discriminatedUnion, h as NC_TAXONOMY, ht as boolean, i as DETECTION_MACRO_CLASSES, it as zoneAnalyticsCapability, j as TimelapseRulePatchSchema, k as TIMELAPSE_DENSE_FLOOR_SEC, l as LabelAttributionSchema, lt as hydrateSchema, mt as array, n as DEFAULT_EVENT_COLOR, nt as vectorDimFromBase64, o as DeclaredDevices, ot as BaseAddon, p as NC_DEFAULT_SNOOZE_MINUTES, pt as _enum, q as isDetectionMacroClass, rt as videoclipsCapability, s as EVENT_KIND_BY_CAP, st as DeviceType, t as BaseDevice, tt as subKindsOf, u as MACRO_LABELS, ut as isDeviceScopedCap, v as NcRulePatchSchema, vt as number, w as NcSnoozeSuppressedSchema, wt as EventCategory, x as NcScheduleSchema, xt as record, y as NcRuleSchema, yt as object, z as cosineSimilarity } from "../dist-6te1200B.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -549,7 +549,14 @@ function alarmCoverageGap(coverage) {
 	return "all-skipped";
 }
 /**
-* "Away armed — 3 cameras: Front door, Garage, Gate."
+* "Attivi: Cancello, Garage — Esclusi: Porta retro."
+*
+* A LIST, not a sentence. The mode is in the title and the body is one
+* `Label: names` line per device group, because this is read on a lock screen
+* and the question is always "which one" — the prose version ("3 dispositivi
+* attivi: …. Esclusi: ….") made the operator parse a paragraph to find a
+* window. Each variant still owns its own catalog key, so the Texts tab can
+* re-word "nothing is armed" without touching "these are armed".
 *
 * Names, not ids: this is read by a person standing at a door. An id that has
 * no name falls back to a NAMED, translated placeholder rather than being
@@ -628,7 +635,7 @@ function buildArmAnnouncement(coverage, deviceName, bypassed = []) {
 	};
 }
 /**
-* "Home armed — with the veranda window open, excluded."
+* "Attivi: 2 — Bypassati: Finestra veranda."
 *
 * The bypassed sensors are named and the armed ones are COUNTED, not listed:
 * this sentence's subject is the exception, and burying it under thirteen
@@ -651,13 +658,13 @@ function armedWithBypass(coverage, bypassed, deviceName) {
 	};
 }
 /**
-* "The alarm was NOT armed: the veranda window is open."
+* "Aperti: Finestra veranda, Porta retro" + how to arm anyway.
 *
 * The one alarm sentence about something that did not happen, so it has to
 * carry both halves an operator needs to act: WHICH sensors are open, and that
 * pressing arm again arms without them. Naming them is the whole message — a
 * refusal that says only "cannot arm" is a panel the operator will conclude is
-* broken.
+* broken — so the names are the FIRST line and the retry hint is the second.
 */
 function buildArmRefusedAnnouncement(mode, names, retrySeconds) {
 	return {
@@ -672,7 +679,7 @@ function buildArmRefusedAnnouncement(mode, names, retrySeconds) {
 	};
 }
 /**
-* The same coverage, said 30 seconds earlier: "Armed in 30 seconds."
+* The EXCEPTIONS to the same coverage, said 30 seconds earlier.
 *
 * The exit-delay sentence is deliberately SHORTER than the arm one — it is read
 * on the way out of a door — and it carries exactly one thing the arm sentence
@@ -680,8 +687,15 @@ function buildArmRefusedAnnouncement(mode, names, retrySeconds) {
 * A mode that arms nothing is worth interrupting somebody for at second 0 and
 * merely worth recording at second 30.
 *
-* Pluralises on the SECONDS, not on the devices: this sentence's only number is
-* the countdown, and Italian needs "1 secondo" / "30 secondi".
+* **It never repeats the device list.** The countdown lives in the TITLE
+* (`system.alarm-arming.title.<mode>` renders `{{seconds}}`), and the armed
+* list arrives thirty seconds later in the arm announcement — printing it
+* twice is the verbosity that made the operator stop reading both. So the body
+* is what is WRONG: what was bypassed, what is excluded, or that nothing is.
+*
+* `seconds` stays in the params because the title asks for it, and `textCount`
+* stays with it: a row enqueued before this deploy still pluralises on the
+* countdown it was written for.
 */
 function buildArmingAnnouncement(coverage, seconds, deviceName, bypassed = []) {
 	const textParams = {
@@ -696,6 +710,7 @@ function buildArmingAnnouncement(coverage, seconds, deviceName, bypassed = []) {
 		},
 		textCount: seconds
 	};
+	const skippedNames = coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ");
 	const gap = alarmCoverageGap(coverage);
 	if (gap === "uncovered") return {
 		bodyKey: "alarm.arming.body.uncovered",
@@ -706,10 +721,18 @@ function buildArmingAnnouncement(coverage, seconds, deviceName, bypassed = []) {
 		bodyKey: "alarm.arming.body.allSkipped",
 		textParams: {
 			...textParams,
-			names: coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ")
+			names: skippedNames
 		},
 		textCount: seconds
 	};
+	if (coverage.skippedDevices.length > 0) return {
+		bodyKey: "alarm.arming.body.skipped",
+		textParams: {
+			...textParams,
+			names: skippedNames
+		},
+		textCount: coverage.skippedDevices.length
+	};
 	return {
 		bodyKey: "alarm.arming.body",
 		textParams,
@@ -1550,6 +1573,401 @@ var NC_ALARM_DECLARATION = {
 	DeviceClass: NcAlarmPanelDevice
 };
 //#endregion
+//#region src/notification-center/artifact-index.ts
+var NC_ARTIFACTS_COLLECTION = "notification-center:artifacts";
+var NcArtifactKindSchema = _enum([
+	"timelapse",
+	"timelapse-preview",
+	"summary-mosaic"
+]);
+/**
+* How the viewer should DRAW it. Derived from the mime once, here, so no client
+* has to carry a mime table — and so a GIF that degraded to a JPEG is drawn as
+* the JPEG it actually is.
+*/
+var NcArtifactMediaTypeSchema = _enum([
+	"image",
+	"gif",
+	"video"
+]);
+/** The relative hub path of the authenticated bytes route for an artefact id. */
+var NC_ARTIFACT_READ_PREFIX = "nc-artifact-read";
+var NcArtifactRecordSchema = object({
+	/** The `NcArtifactStore` id — the same id the bytes route resolves. */
+	id: string().min(1),
+	kind: NcArtifactKindSchema,
+	mediaType: NcArtifactMediaTypeSchema,
+	mime: string().min(1),
+	sizeBytes: number().int().nonnegative(),
+	/** When the artefact was PRODUCED. */
+	createdAt: number().int(),
+	/** What the content is ABOUT (window end / event time). The sort key: a
+	*  timelapse rendered at 06:05 is about the night before, and a list ordered
+	*  by production time puts it in the wrong morning. */
+	capturedAt: number().int(),
+	/** After this the bytes are gone. Derived from the retained shelf's own age
+	*  bound — never a second retention policy. */
+	expiresAt: number().int(),
+	/** The camera the artefact is FILED under. Null only if it belongs to none. */
+	deviceId: number().int().nullable(),
+	/** Every camera the artefact covers, for display. */
+	deviceIds: array(number().int()),
+	ruleId: string().optional(),
+	ruleName: string().optional(),
+	title: string().optional(),
+	/** A companion still for a video artefact (a timelapse's preview frame) —
+	*  what a list renders as the thumbnail. */
+	posterArtifactId: string().optional(),
+	/** RELATIVE hub path of the authenticated bytes route. Relative on purpose:
+	*  the viewer already holds the hub origin it is authenticated against, and
+	*  only the SIGNED plane needs to guess which host a stranger can reach. */
+	downloadPath: string().min(1)
+});
+var NcArtifactQuerySchema = object({
+	kinds: array(NcArtifactKindSchema).optional(),
+	deviceIds: array(number().int()).optional(),
+	ruleId: string().optional(),
+	/** Inclusive `capturedAt` window. */
+	fromMs: number().int().optional(),
+	toMs: number().int().optional(),
+	limit: number().int().min(1).max(200).default(50),
+	offset: number().int().min(0).default(0)
+});
+var NC_ARTIFACTS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "kind",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER"
+	},
+	{
+		name: "ruleId",
+		type: "TEXT"
+	},
+	(
+	/** `''` for a global artefact — see the header note on visibility. */
+	{
+		name: "ownerUserId",
+		type: "TEXT",
+		notNull: true
+	}),
+	{
+		name: "capturedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL record (Zod-validated on read) — the scalars above are indexed
+	*  projections only. */
+	{
+		name: "record",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NC_ARTIFACTS_INDEXES = [
+	{
+		name: "idx_nc_artifacts_captured",
+		columns: ["capturedAt"]
+	},
+	{
+		name: "idx_nc_artifacts_device",
+		columns: ["deviceId", "capturedAt"]
+	},
+	{
+		name: "idx_nc_artifacts_kind",
+		columns: ["kind", "capturedAt"]
+	},
+	{
+		name: "idx_nc_artifacts_expires",
+		columns: ["expiresAt"]
+	}
+];
+/** Upper bound for a half-open `whereBetween` — the store has no `>=`. */
+var TIME_MAX = 864e13;
+var TIME_MIN = -864e13;
+/** Prune scan ceiling — the index is bounded by the shelf it mirrors (2000
+*  entries by default), so this only has to be comfortably above it. */
+var NC_ARTIFACT_PRUNE_SCAN_LIMIT = 2e4;
+/** `image/gif` → `gif`. Keyed on what the bytes ARE, never on what was asked
+*  for: a GIF that degraded to a still must be drawn as a still. */
+function mediaTypeForMime(mime) {
+	if (mime === "image/gif") return "gif";
+	if (mime.startsWith("video/")) return "video";
+	return "image";
+}
+/** The relative hub path an authenticated client fetches the bytes from. */
+function artifactDownloadPath(addonId, artifactId) {
+	return `/addon/${addonId}/${NC_ARTIFACT_READ_PREFIX}/${artifactId}`;
+}
+var NcArtifactIndex = class {
+	store;
+	logger;
+	addonId;
+	retentionMs;
+	now;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.addonId = deps.addonId;
+		this.retentionMs = deps.retentionMs;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_ARTIFACTS_COLLECTION,
+			columns: [...NC_ARTIFACTS_COLUMNS],
+			indexes: [...NC_ARTIFACTS_INDEXES]
+		});
+	}
+	/**
+	* Record one retained artefact. Returns the row as the viewer will see it, or
+	* null when the write failed — and a failure is LOGGED, per camera: an
+	* artefact silently absent from the index reads to an operator as an artefact
+	* that was never produced.
+	*/
+	async record(input) {
+		const createdAt = this.now();
+		const record = NcArtifactRecordSchema.parse({
+			id: input.id,
+			kind: input.kind,
+			mediaType: mediaTypeForMime(input.mime),
+			mime: input.mime,
+			sizeBytes: input.sizeBytes,
+			createdAt,
+			capturedAt: input.capturedAt,
+			expiresAt: createdAt + this.retentionMs,
+			deviceId: input.deviceId,
+			deviceIds: [...input.deviceIds],
+			...input.ruleId !== void 0 ? { ruleId: input.ruleId } : {},
+			...input.ruleName !== void 0 ? { ruleName: input.ruleName } : {},
+			...input.title !== void 0 ? { title: input.title } : {},
+			...input.posterArtifactId !== void 0 ? { posterArtifactId: input.posterArtifactId } : {},
+			downloadPath: artifactDownloadPath(this.addonId, input.id)
+		});
+		try {
+			await this.store.set.mutate({
+				collection: NC_ARTIFACTS_COLLECTION,
+				key: record.id,
+				value: {
+					kind: record.kind,
+					deviceId: record.deviceId,
+					ruleId: record.ruleId ?? "",
+					ownerUserId: input.ownerUserId ?? "",
+					capturedAt: record.capturedAt,
+					expiresAt: record.expiresAt,
+					record
+				}
+			});
+			return record;
+		} catch (err) {
+			this.logger.warn("artifact not indexed — it will not appear in the viewer", {
+				...record.deviceId !== null ? { tags: { deviceId: record.deviceId } } : {},
+				meta: {
+					artifactId: record.id,
+					kind: record.kind,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* One page, newest `capturedAt` first.
+	*
+	* Expiry is a PREDICATE, not a post-filter: a row whose bytes the shelf has
+	* already swept must not consume a slot of the page the caller asked for.
+	*/
+	async list(query, viewer) {
+		const filter = this.buildFilter(query, viewer);
+		try {
+			const [rows, total] = await Promise.all([this.store.query.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter: {
+					...filter,
+					orderBy: {
+						field: "capturedAt",
+						direction: "desc"
+					},
+					limit: query.limit,
+					offset: query.offset
+				}
+			}), this.store.count.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter
+			})]);
+			const artifacts = this.parseRows(rows);
+			return {
+				artifacts,
+				total,
+				hasMore: query.offset + artifacts.length < total
+			};
+		} catch (err) {
+			this.logger.warn("artifact index query failed", { meta: { error: String(err) } });
+			return {
+				artifacts: [],
+				total: 0,
+				hasMore: false
+			};
+		}
+	}
+	/**
+	* One artefact by id, or null when it does not exist, has expired, or belongs
+	* to another user. All three answer the same way ON PURPOSE — a surface that
+	* distinguishes "not yours" from "not there" tells a caller what other people
+	* own.
+	*/
+	async get(artifactId, viewer) {
+		const row = await this.readRow(artifactId);
+		if (row === null) return null;
+		if (row.record.expiresAt <= this.now()) return null;
+		if (!viewer.isAdmin && row.ownerUserId !== "" && row.ownerUserId !== viewer.userId) return null;
+		return row.record;
+	}
+	/**
+	* Resolve an id for the BYTES route — visibility-free by design.
+	*
+	* The route is served `authenticated`, so the hub has already established a
+	* principal; what this answers is only "is this id an indexed artefact, and is
+	* it still meant to exist". Per-user artefact scoping on the byte route would
+	* be a second authorization model layered on an unguessable id, and this repo
+	* has one of those already (`data-plane-access.ts`): a plane serving ONE item
+	* the caller had to be told about is `authenticated`.
+	*/
+	async resolve(artifactId) {
+		return (await this.readRow(artifactId))?.record ?? null;
+	}
+	/** One row by primary key, parsed. Null when absent or no longer valid. */
+	async readRow(artifactId) {
+		let raw;
+		try {
+			raw = await this.store.get.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				key: artifactId
+			});
+		} catch (err) {
+			this.logger.warn("artifact index lookup failed", { meta: {
+				artifactId,
+				error: String(err)
+			} });
+			return null;
+		}
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+		const row = { ...raw };
+		const parsed = NcArtifactRecordSchema.safeParse(row["record"]);
+		if (!parsed.success) return null;
+		const owner = row["ownerUserId"];
+		return {
+			record: parsed.data,
+			ownerUserId: typeof owner === "string" ? owner : ""
+		};
+	}
+	/**
+	* Drop rows whose bytes are gone, in ONE `deleteWhere` rather than an N+1
+	* drain.
+	*
+	* TWO halves, and only one of them is safe everywhere:
+	*
+	* - **Expired rows** are time-based and node-independent. Always swept.
+	* - **Orphans** — rows whose file a byte/count bound took before the age bound
+	*   did — are found by reconciling against the shelf. That reconcile is only
+	*   valid for a caller whose shelf holds the bytes for the WHOLE index, and
+	*   the index is CENTRAL while the shelf is local: a second node running this
+	*   with its own (empty) shelf would read every row as an orphan and delete
+	*   the entire library. Hence `keptIds: null` — a caller that is not the
+	*   producing node states so, and the destructive half becomes unreachable
+	*   rather than merely un-called.
+	*
+	* @param keptIds the ids the caller's shelf holds, or `null` when this node is
+	*                not the one that produces artefacts.
+	*/
+	async prune(keptIds) {
+		let removed = 0;
+		try {
+			const expired = await this.store.deleteWhere.mutate({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter: { whereBetween: { expiresAt: [TIME_MIN, this.now() - 1] } }
+			});
+			removed += expired.deleted;
+			if (keptIds === null) {
+				if (removed > 0) this.logger.debug("artifact index pruned (expired only)", { meta: { removed } });
+				return removed;
+			}
+			const alive = new Set(keptIds);
+			const orphans = (await this.store.query.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter: { limit: NC_ARTIFACT_PRUNE_SCAN_LIMIT }
+			})).map((r) => r.id).filter((id) => !alive.has(id));
+			for (const id of orphans) {
+				await this.store.delete.mutate({
+					collection: NC_ARTIFACTS_COLLECTION,
+					key: id
+				});
+				removed += 1;
+			}
+			if (removed > 0) this.logger.debug("artifact index pruned", { meta: {
+				removed,
+				expired: expired.deleted,
+				orphaned: orphans.length
+			} });
+			return removed;
+		} catch (err) {
+			this.logger.warn("artifact index prune failed", { meta: { error: String(err) } });
+			return removed;
+		}
+	}
+	/** The visibility predicate: a caller sees global artefacts plus his own; an
+	*  admin sees every one. */
+	visibility(viewer) {
+		if (viewer.isAdmin) return {};
+		return { whereIn: { ownerUserId: ["", viewer.userId] } };
+	}
+	buildFilter(query, viewer) {
+		const whereIn = { ...this.visibility(viewer).whereIn };
+		if (query.kinds !== void 0 && query.kinds.length > 0) whereIn["kind"] = [...query.kinds];
+		if (query.deviceIds !== void 0 && query.deviceIds.length > 0) whereIn["deviceId"] = [...query.deviceIds];
+		const whereBetween = {
+			capturedAt: [query.fromMs ?? TIME_MIN, query.toMs ?? TIME_MAX],
+			expiresAt: [this.now(), TIME_MAX]
+		};
+		return {
+			...query.ruleId !== void 0 ? { where: { ruleId: query.ruleId } } : {},
+			...Object.keys(whereIn).length > 0 ? { whereIn } : {},
+			whereBetween
+		};
+	}
+	/** Parse the JSON column, skipping rows that no longer validate. A degraded
+	*  row must never cost the whole page. */
+	parseRows(rows) {
+		const out = [];
+		let skipped = 0;
+		for (const row of rows) {
+			const parsed = NcArtifactRecordSchema.safeParse(row.data["record"]);
+			if (!parsed.success) {
+				skipped += 1;
+				continue;
+			}
+			out.push(parsed.data);
+		}
+		if (skipped > 0) this.logger.warn("artifact index rows skipped as invalid", { meta: { skipped } });
+		return out;
+	}
+};
+//#endregion
 //#region ../types/dist/node.mjs
 var node_exports = /* @__PURE__ */ __exportAll({
 	FilesystemStorageProvider: () => FilesystemStorageProvider,
@@ -1940,6 +2358,61 @@ var NcArtifactPlane = class {
 		}
 	}
 	/**
+	* Publish bytes AND file them in the viewer's browsable index (task #36).
+	*
+	* Two differences from {@link publish}, both deliberate:
+	*
+	* 1. **The bytes are stored FIRST, and stored even when no public base URL
+	*    exists.** `publish` returns early on a loopback-only install because a
+	*    signed link nobody can open is worth nothing — but the VIEWER reaches
+	*    the hub directly over its own session, so an install with no tunnel
+	*    still gets a full artifact library. Making the index depend on a
+	*    reachable public address would have made the feature absent exactly on
+	*    the installs that are LAN-only.
+	* 2. **It answers the artefact id**, so a caller can link one artefact to
+	*    another — a timelapse's poster is its preview frame, and the video row
+	*    cannot name it without knowing the id the preview got.
+	*
+	* Never throws, for the same reason `publish` does not: an artefact library
+	* is an enhancement and must never cost a notification.
+	*/
+	async publishIndexed(bytes, mime, meta) {
+		let artifactId = null;
+		try {
+			const index = this.deps.index;
+			const stored = await this.deps.store.put(bytes, mime, { retain: index !== void 0 });
+			if (index !== void 0) artifactId = (await index.record({
+				...meta,
+				id: stored.id,
+				mime,
+				sizeBytes: stored.bytes
+			}))?.id ?? null;
+			const baseUrl = await this.resolveBaseUrl();
+			return {
+				url: baseUrl === null ? null : buildArtifactUrl({
+					baseUrl,
+					routePrefix: this.deps.routePrefix,
+					id: stored.id,
+					secret: this.deps.secret,
+					expMs: this.now() + (this.deps.ttlMs ?? DEFAULT_TTL_MS)
+				}),
+				artifactId
+			};
+		} catch (err) {
+			this.deps.logger.warn("indexed artifact publish failed — shipping bytes only", {
+				...meta.deviceId !== null ? { tags: { deviceId: meta.deviceId } } : {},
+				meta: {
+					kind: meta.kind,
+					error: String(err)
+				}
+			});
+			return {
+				url: null,
+				artifactId
+			};
+		}
+	}
+	/**
 	* Absolutize a path against the SAME base URL an artifact link would use.
 	*
 	* For links this plane does not host but a RECIPIENT still has to open — a
@@ -2005,6 +2478,124 @@ var NcArtifactPlane = class {
 	}
 };
 //#endregion
+//#region src/notification-center/artifact-read-plane.ts
+/**
+* Parse a single-range `Range` header against a known length.
+*
+* Returns `null` when there is nothing to honour (absent, malformed, multi-range
+* — all of which mean "send the whole thing"), and `'unsatisfiable'` when the
+* client asked for a range that cannot exist, which is a 416 and not a 200.
+*/
+function parseByteRange(header, length) {
+	if (header === void 0) return null;
+	const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+	if (match === null) return null;
+	const rawStart = match[1] ?? "";
+	const rawEnd = match[2] ?? "";
+	if (rawStart === "" && rawEnd === "") return null;
+	if (length === 0) return "unsatisfiable";
+	if (rawStart === "") {
+		const suffix = Number(rawEnd);
+		if (suffix === 0) return "unsatisfiable";
+		return {
+			start: Math.max(0, length - suffix),
+			end: length - 1
+		};
+	}
+	const start = Number(rawStart);
+	if (start >= length) return "unsatisfiable";
+	const end = rawEnd === "" ? length - 1 : Math.min(Number(rawEnd), length - 1);
+	if (end < start) return "unsatisfiable";
+	return {
+		start,
+		end
+	};
+}
+/** The last path segment, percent-decoded. */
+function artifactIdFrom(req) {
+	const url = new URL(req.url ?? "/", "http://placeholder");
+	try {
+		return decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
+	} catch {
+		return "";
+	}
+}
+var NcArtifactReadPlane = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	handler = async (req, res) => {
+		const artifactId = artifactIdFrom(req);
+		const record = await this.deps.index.resolve(artifactId);
+		if (record === null) {
+			this.refuse(res, 404, "not found");
+			return;
+		}
+		const found = await this.deps.store.read(artifactId);
+		if (found === null) {
+			this.deps.logger.warn("artifact bytes gone — index row outlived the shelf", {
+				...record.deviceId !== null ? { tags: { deviceId: record.deviceId } } : {},
+				meta: {
+					artifactId,
+					kind: record.kind,
+					expiresAt: record.expiresAt
+				}
+			});
+			this.refuse(res, 404, "not found");
+			return;
+		}
+		if (req.method === "HEAD") {
+			res.writeHead(200, this.baseHeaders(record, found.bytes.byteLength, found.mime));
+			res.end();
+			return;
+		}
+		const range = parseByteRange(headerOf(req, "range"), found.bytes.byteLength);
+		if (range === "unsatisfiable") {
+			res.writeHead(416, {
+				"content-range": `bytes */${found.bytes.byteLength}`,
+				"content-type": "text/plain"
+			});
+			res.end("range not satisfiable");
+			return;
+		}
+		if (range === null) {
+			res.writeHead(200, this.baseHeaders(record, found.bytes.byteLength, found.mime));
+			res.end(found.bytes);
+			return;
+		}
+		const slice = found.bytes.subarray(range.start, range.end + 1);
+		res.writeHead(206, {
+			...this.baseHeaders(record, slice.byteLength, found.mime),
+			"content-range": `bytes ${range.start}-${range.end}/${found.bytes.byteLength}`
+		});
+		res.end(slice);
+	};
+	baseHeaders(record, length, mime) {
+		return {
+			"content-type": mime,
+			"content-length": String(length),
+			"accept-ranges": "bytes",
+			"cache-control": "private, max-age=3600",
+			"content-disposition": `inline; filename="${filenameFor(record)}"`
+		};
+	}
+	refuse(res, status, body) {
+		res.writeHead(status, { "content-type": "text/plain" });
+		res.end(body);
+	}
+};
+/** A name a client will accept, from what the artefact IS. */
+function filenameFor(record) {
+	const ext = record.mime === "video/mp4" ? "mp4" : record.mime === "image/gif" ? "gif" : record.mime === "image/png" ? "png" : "jpg";
+	return `${record.kind}-${record.capturedAt}.${ext}`;
+}
+function headerOf(req, name) {
+	const value = req.headers[name];
+	if (Array.isArray(value)) return value[0];
+	return value;
+}
+//#endregion
 //#region src/notification-center/artifact-store.ts
 /**
 * NcArtifactStore — the bytes behind a signed notification-artifact URL.
@@ -2019,9 +2610,25 @@ var NcArtifactPlane = class {
 * bites first, the oldest artifacts go. A sweep on boot clears whatever a crash
 * left behind — the directory is disposable by construction, so a lost file is
 * a 404 on one link, never a corrupt state.
+*
+* ## The retained shelf (`kept/`)
+*
+* Task #36 gave the viewer a browsable artifact index, and an index whose bytes
+* evaporate in six hours is an index of 404s. So a `put` may ask to be RETAINED:
+* the bytes then land on a second shelf inside the same directory with its OWN
+* three bounds (age, count, and — because a timelapse mp4 is megabytes — total
+* BYTES). It is still a scratch, just a longer one: the index row carries an
+* `expiresAt` derived from the same age bound, so "gone" is a state the viewer
+* is told about rather than a surprise 404.
+*
+* The shelf is a subdirectory ON PURPOSE. The scratch's `list()` skips
+* non-files, so the two shelves cannot sweep each other, and neither bound had
+* to learn about the other's entries.
 */
 var DEFAULT_MAX_AGE_MS = 6 * 36e5;
 var DEFAULT_MAX_ENTRIES = 500;
+/** The retained shelf's subdirectory name, inside the scratch directory. */
+var KEPT_SUBDIR = "kept";
 /** `image/jpeg` → `jpg`, so a fetched link has a name a client will accept. */
 function extensionFor(mime) {
 	if (mime === "image/jpeg") return "jpg";
@@ -2035,6 +2642,10 @@ var NcArtifactStore = class {
 	now;
 	maxAgeMs;
 	maxEntries;
+	keptMaxAgeMs;
+	keptMaxEntries;
+	keptMaxBytes;
+	keptDir;
 	/** id → mime, so the route can answer with the right content-type without
 	*  re-deriving it from the extension on every request. */
 	mimeById = /* @__PURE__ */ new Map();
@@ -2043,17 +2654,32 @@ var NcArtifactStore = class {
 		this.now = options.now ?? (() => Date.now());
 		this.maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
 		this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+		this.keptMaxAgeMs = options.keptMaxAgeMs ?? 12096e5;
+		this.keptMaxEntries = options.keptMaxEntries ?? 2e3;
+		this.keptMaxBytes = options.keptMaxBytes ?? 2147483648;
+		this.keptDir = path.join(options.dir, KEPT_SUBDIR);
+	}
+	/** How long a retained artifact stays fetchable — the index's `expiresAt`
+	*  is derived from this, so the two can never disagree. */
+	get retentionMs() {
+		return this.keptMaxAgeMs;
 	}
 	/** Create the directory and sweep whatever a previous run left behind. */
 	async start() {
 		await promises.mkdir(this.options.dir, { recursive: true });
 		await this.sweep();
 	}
-	/** Persist bytes and return the artifact handle (never throws on sweep). */
-	async put(bytes, mime) {
+	/**
+	* Persist bytes and return the artifact handle (never throws on sweep).
+	*
+	* The retained shelf is created LAZILY: an install that never produces a
+	* browsable artifact keeps a directory that is empty when it is empty.
+	*/
+	async put(bytes, mime, options = {}) {
 		const id = `${this.now()}-${randomUUID()}`;
-		const file = path.join(this.options.dir, `${id}.${extensionFor(mime)}`);
-		await promises.mkdir(this.options.dir, { recursive: true });
+		const dir = options.retain === true ? this.keptDir : this.options.dir;
+		const file = path.join(dir, `${id}.${extensionFor(mime)}`);
+		await promises.mkdir(dir, { recursive: true });
 		await promises.writeFile(file, bytes);
 		this.mimeById.set(id, mime);
 		await this.sweep();
@@ -2066,7 +2692,7 @@ var NcArtifactStore = class {
 	/** Read an artifact's bytes + mime, or null when it is gone (expired/swept). */
 	async read(id) {
 		if (!/^[0-9]+-[0-9a-f-]{36}$/i.test(id)) return null;
-		const found = (await this.list()).find((e) => e.id === id);
+		const found = [...await this.list(this.options.dir), ...await this.list(this.keptDir)].find((e) => e.id === id);
 		if (!found) return null;
 		try {
 			return {
@@ -2077,6 +2703,10 @@ var NcArtifactStore = class {
 			return null;
 		}
 	}
+	/** The ids still on the retained shelf — what the index reconciles against. */
+	async keptIds() {
+		return (await this.list(this.keptDir)).map((e) => e.id);
+	}
 	/** Delete every artifact (operator cleanup / shutdown). */
 	async clear() {
 		await promises.rm(this.options.dir, {
@@ -2085,13 +2715,39 @@ var NcArtifactStore = class {
 		}).catch(() => {});
 		this.mimeById.clear();
 	}
-	/** Age- then count-bounded prune. Best-effort: a failed unlink is logged once. */
+	/** Prune both shelves under their own bounds. Best-effort: a failed unlink is
+	*  logged once and the rest of the sweep still runs. */
 	async sweep() {
-		const entries = await this.list();
-		const cutoff = this.now() - this.maxAgeMs;
+		await this.sweepShelf(await this.list(this.options.dir), {
+			maxAgeMs: this.maxAgeMs,
+			maxEntries: this.maxEntries
+		});
+		await this.sweepShelf(await this.list(this.keptDir), {
+			maxAgeMs: this.keptMaxAgeMs,
+			maxEntries: this.keptMaxEntries,
+			maxBytes: this.keptMaxBytes
+		});
+	}
+	/**
+	* Age first, then count, then total bytes — newest always survives.
+	*
+	* The newest entry is never swept by the byte bound even when it alone
+	* exceeds it: a shelf that deletes what it has just written can serve
+	* nothing, and the caller has already paid for the render.
+	*/
+	async sweepShelf(entries, bounds) {
+		const cutoff = this.now() - bounds.maxAgeMs;
 		const doomed = entries.filter((e) => e.mtimeMs < cutoff);
-		const survivors = entries.filter((e) => e.mtimeMs >= cutoff).toSorted((a, b) => b.mtimeMs - a.mtimeMs);
-		doomed.push(...survivors.slice(this.maxEntries));
+		const fresh = entries.filter((e) => e.mtimeMs >= cutoff).toSorted((a, b) => b.mtimeMs - a.mtimeMs);
+		doomed.push(...fresh.slice(bounds.maxEntries));
+		const maxBytes = bounds.maxBytes;
+		if (maxBytes !== void 0) {
+			let running = 0;
+			for (const [i, e] of fresh.slice(0, bounds.maxEntries).entries()) {
+				running += e.sizeBytes;
+				if (running > maxBytes && i > 0) doomed.push(e);
+			}
+		}
 		for (const e of doomed) try {
 			await promises.rm(e.file, { force: true });
 			this.mimeById.delete(e.id);
@@ -2102,23 +2758,24 @@ var NcArtifactStore = class {
 			} });
 		}
 	}
-	async list() {
+	async list(dir) {
 		let names;
 		try {
-			names = await promises.readdir(this.options.dir);
+			names = await promises.readdir(dir);
 		} catch {
 			return [];
 		}
 		const out = [];
 		for (const name of names) {
-			const file = path.join(this.options.dir, name);
+			const file = path.join(dir, name);
 			try {
 				const st = await promises.stat(file);
 				if (!st.isFile()) continue;
 				out.push({
 					id: name.slice(0, name.lastIndexOf(".")),
 					file,
-					mtimeMs: st.mtimeMs
+					mtimeMs: st.mtimeMs,
+					sizeBytes: st.size
 				});
 			} catch {}
 		}
@@ -4336,69 +4993,38 @@ var en_default = {
 	"snooze.scope.anyDevice": "A camera",
 	"snooze.scope.anyRule": "A rule",
 	"snooze.scope.rule": "“{{rule}}”",
-	"alarm.arm.body.allDevices": {
-		"one": "Every device is armed ({{rules}} rule).",
-		"other": "Every device is armed ({{rules}} rules)."
-	},
-	"alarm.arm.body.noDevices": {
-		"one": "{{rules}} rule, no device restriction.",
-		"other": "{{rules}} rules, no device restriction."
-	},
-	"alarm.arm.body.devices": {
-		"one": "{{devices}} device armed: {{names}}.",
-		"other": "{{devices}} devices armed: {{names}}."
-	},
-	"alarm.arm.body.devicesSkipped": {
-		"one": "{{devices}} device armed: {{names}}. Excluded: {{skippedNames}}.",
-		"other": "{{devices}} devices armed: {{names}}. Excluded: {{skippedNames}}."
-	},
-	"alarm.arm.body.uncovered": "Nothing is armed — no enabled rule is gated on this mode.",
-	"alarm.arm.body.allSkipped": {
-		"one": "Nothing is armed: the {{devices}} device this mode covers is excluded ({{names}}).",
-		"other": "Nothing is armed: all {{devices}} devices this mode covers are excluded ({{names}})."
-	},
-	"alarm.arming.body": {
-		"one": "Armed in {{seconds}} second.",
-		"other": "Armed in {{seconds}} seconds."
-	},
-	"alarm.arming.body.uncovered": {
-		"one": "Armed in {{seconds}} second — but no enabled rule is gated on this mode, so it will protect nothing.",
-		"other": "Armed in {{seconds}} seconds — but no enabled rule is gated on this mode, so it will protect nothing."
-	},
-	"alarm.arming.body.allSkipped": {
-		"one": "Armed in {{seconds}} second — but every device this mode covers is excluded ({{names}}), so it will protect nothing.",
-		"other": "Armed in {{seconds}} seconds — but every device this mode covers is excluded ({{names}}), so it will protect nothing."
-	},
-	"alarm.arm.body.bypassed": {
-		"one": "{{devices}} device armed — open and excluded: {{bypassedNames}}.",
-		"other": "{{devices}} devices armed — open and excluded: {{bypassedNames}}."
-	},
-	"alarm.arming.body.bypassed": {
-		"one": "Armed in {{seconds}} second, excluding what is open: {{bypassedNames}}.",
-		"other": "Armed in {{seconds}} seconds, excluding what is open: {{bypassedNames}}."
-	},
-	"alarm.armRefused.body": {
-		"one": "{{names}} is open. Press arm again within {{seconds}}s to arm without it.",
-		"other": "These are open: {{names}}. Press arm again within {{seconds}}s to arm without them."
-	},
+	"alarm.arm.body.allDevices": "Active: all devices",
+	"alarm.arm.body.noDevices": "Active: no device restriction",
+	"alarm.arm.body.devices": "Active: {{names}}",
+	"alarm.arm.body.devicesSkipped": "Active: {{names}}\nExcluded: {{skippedNames}}",
+	"alarm.arm.body.uncovered": "Active: none — no rule uses this mode",
+	"alarm.arm.body.allSkipped": "Active: none\nExcluded: {{names}}",
+	"alarm.arming.body": "No exclusions",
+	"alarm.arming.body.uncovered": "Active: none — no rule uses this mode",
+	"alarm.arming.body.allSkipped": "Active: none\nExcluded: {{names}}",
+	"alarm.arming.body.skipped": "Excluded: {{names}}",
+	"alarm.arm.body.bypassed": "Active: {{devices}}\nBypassed: {{bypassedNames}}",
+	"alarm.arming.body.bypassed": "Bypassed: {{bypassedNames}}",
+	"alarm.armRefused.body": "Open: {{names}}\nRepeat within {{seconds}}s to arm with bypass.",
 	"alarm.device.unnamed": "Device {{id}}",
-	"system.alarm-arm-refused.title.home": "Home NOT armed",
-	"system.alarm-arm-refused.title.away": "Away NOT armed",
-	"system.alarm-arm-refused.title.night": "Night NOT armed",
-	"system.alarm-arm-refused.body": "The alarm could not be armed — something it covers is open.",
-	"system.alarm-arming.title.home": "Arming home",
-	"system.alarm-arming.title.away": "Arming away",
-	"system.alarm-arming.title.night": "Arming night",
-	"system.alarm-arming.body": "The alarm is arming",
-	"system.alarm-armed.title.home": "Home armed",
-	"system.alarm-armed.title.away": "Away armed",
-	"system.alarm-armed.title.night": "Night armed",
-	"system.alarm-armed.body": "The alarm was armed",
-	"system.alarm-disarmed.title": "Alarm disarmed",
-	"system.alarm-disarmed.body": "The alarm was disarmed",
+	"alarm.combined.title": "Alarm: {{deviceName}}",
+	"system.alarm-arm-refused.title.home": "Arming home refused",
+	"system.alarm-arm-refused.title.away": "Arming away refused",
+	"system.alarm-arm-refused.title.night": "Arming night refused",
+	"system.alarm-arm-refused.body": "Arming refused",
+	"system.alarm-arming.title.home": "Arming home — {{seconds}}s",
+	"system.alarm-arming.title.away": "Arming away — {{seconds}}s",
+	"system.alarm-arming.title.night": "Arming night — {{seconds}}s",
+	"system.alarm-arming.body": "Arming",
+	"system.alarm-armed.title.home": "Armed: home",
+	"system.alarm-armed.title.away": "Armed: away",
+	"system.alarm-armed.title.night": "Armed: night",
+	"system.alarm-armed.body": "Alarm armed",
+	"system.alarm-disarmed.title": "Disarmed",
+	"system.alarm-disarmed.body": "Alarm disarmed",
 	"system.alarm-triggered.title": "ALARM",
-	"system.alarm-triggered.body": "The alarm was triggered",
-	"system.alarm-triggered.body.rule": "The alarm was triggered by {{rule}} on {{deviceName}}",
+	"system.alarm-triggered.body": "Alarm triggered",
+	"system.alarm-triggered.body.rule": "Triggered by {{rule}} on {{deviceName}}",
 	"button.snooze.minutes": "Snooze {{minutes}} min",
 	"button.snooze.hours": {
 		"one": "Snooze {{hours}} hour",
@@ -4530,69 +5156,38 @@ var it_default = {
 	"snooze.scope.anyDevice": "Una camera",
 	"snooze.scope.anyRule": "Una regola",
 	"snooze.scope.rule": "“{{rule}}”",
-	"alarm.arm.body.allDevices": {
-		"one": "Ogni dispositivo è attivo ({{rules}} regola).",
-		"other": "Ogni dispositivo è attivo ({{rules}} regole)."
-	},
-	"alarm.arm.body.noDevices": {
-		"one": "{{rules}} regola, nessuna restrizione sui dispositivi.",
-		"other": "{{rules}} regole, nessuna restrizione sui dispositivi."
-	},
-	"alarm.arm.body.devices": {
-		"one": "{{devices}} dispositivo attivo: {{names}}.",
-		"other": "{{devices}} dispositivi attivi: {{names}}."
-	},
-	"alarm.arm.body.devicesSkipped": {
-		"one": "{{devices}} dispositivo attivo: {{names}}. Esclusi: {{skippedNames}}.",
-		"other": "{{devices}} dispositivi attivi: {{names}}. Esclusi: {{skippedNames}}."
-	},
-	"alarm.arm.body.uncovered": "Non è attivo nulla — nessuna regola abilitata è legata a questa modalità.",
-	"alarm.arm.body.allSkipped": {
-		"one": "Non è attivo nulla: l'unico dispositivo ({{devices}}) coperto da questa modalità è escluso ({{names}}).",
-		"other": "Non è attivo nulla: tutti i {{devices}} dispositivi coperti da questa modalità sono esclusi ({{names}})."
-	},
-	"alarm.arming.body": {
-		"one": "Attivo tra {{seconds}} secondo.",
-		"other": "Attivo tra {{seconds}} secondi."
-	},
-	"alarm.arming.body.uncovered": {
-		"one": "Attivo tra {{seconds}} secondo — ma nessuna regola abilitata è legata a questa modalità: non proteggerà nulla.",
-		"other": "Attivo tra {{seconds}} secondi — ma nessuna regola abilitata è legata a questa modalità: non proteggerà nulla."
-	},
-	"alarm.arming.body.allSkipped": {
-		"one": "Attivo tra {{seconds}} secondo — ma ogni dispositivo coperto da questa modalità è escluso ({{names}}): non proteggerà nulla.",
-		"other": "Attivo tra {{seconds}} secondi — ma ogni dispositivo coperto da questa modalità è escluso ({{names}}): non proteggerà nulla."
-	},
-	"alarm.arm.body.bypassed": {
-		"one": "{{devices}} dispositivo attivo — aperto ed escluso: {{bypassedNames}}.",
-		"other": "{{devices}} dispositivi attivi — aperti ed esclusi: {{bypassedNames}}."
-	},
-	"alarm.arming.body.bypassed": {
-		"one": "Attivo tra {{seconds}} secondo, escludendo ciò che è aperto: {{bypassedNames}}.",
-		"other": "Attivo tra {{seconds}} secondi, escludendo ciò che è aperto: {{bypassedNames}}."
-	},
-	"alarm.armRefused.body": {
-		"one": "{{names}} è aperto. Premi di nuovo entro {{seconds}}s per inserire senza di esso.",
-		"other": "Sono aperti: {{names}}. Premi di nuovo entro {{seconds}}s per inserire senza di essi."
-	},
+	"alarm.arm.body.allDevices": "Attivi: tutti i dispositivi",
+	"alarm.arm.body.noDevices": "Attivi: nessuna restrizione",
+	"alarm.arm.body.devices": "Attivi: {{names}}",
+	"alarm.arm.body.devicesSkipped": "Attivi: {{names}}\nEsclusi: {{skippedNames}}",
+	"alarm.arm.body.uncovered": "Attivi: nessuno — nessuna regola usa questa modalità",
+	"alarm.arm.body.allSkipped": "Attivi: nessuno\nEsclusi: {{names}}",
+	"alarm.arming.body": "Nessuna esclusione",
+	"alarm.arming.body.uncovered": "Attivi: nessuno — nessuna regola usa questa modalità",
+	"alarm.arming.body.allSkipped": "Attivi: nessuno\nEsclusi: {{names}}",
+	"alarm.arming.body.skipped": "Esclusi: {{names}}",
+	"alarm.arm.body.bypassed": "Attivi: {{devices}}\nBypassati: {{bypassedNames}}",
+	"alarm.arming.body.bypassed": "Bypassati: {{bypassedNames}}",
+	"alarm.armRefused.body": "Aperti: {{names}}\nRipeti entro {{seconds}}s per inserire con bypass.",
 	"alarm.device.unnamed": "Dispositivo {{id}}",
+	"alarm.combined.title": "Allarme: {{deviceName}}",
 	"system.alarm-arm-refused.title.home": "Inserimento Casa rifiutato",
 	"system.alarm-arm-refused.title.away": "Inserimento Fuori rifiutato",
 	"system.alarm-arm-refused.title.night": "Inserimento Notte rifiutato",
-	"system.alarm-arm-refused.body": "L'allarme non è stato inserito — qualcosa che copre è aperto.",
-	"system.alarm-arming.title.home": "Inserimento Casa",
-	"system.alarm-arming.title.away": "Inserimento Fuori",
-	"system.alarm-arming.title.night": "Inserimento Notte",
-	"system.alarm-arming.body": "L'allarme si sta inserendo",
-	"system.alarm-armed.title.home": "Casa attivato",
-	"system.alarm-armed.title.away": "Fuori attivato",
-	"system.alarm-armed.title.night": "Notte attivato",
-	"system.alarm-armed.body": "L'allarme è stato inserito",
-	"system.alarm-disarmed.title": "Allarme disattivato",
-	"system.alarm-disarmed.body": "L'allarme è stato disattivato",
+	"system.alarm-arm-refused.body": "Inserimento rifiutato",
+	"system.alarm-arming.title.home": "Inserimento Casa — {{seconds}}s",
+	"system.alarm-arming.title.away": "Inserimento Fuori — {{seconds}}s",
+	"system.alarm-arming.title.night": "Inserimento Notte — {{seconds}}s",
+	"system.alarm-arming.body": "Inserimento in corso",
+	"system.alarm-armed.title.home": "Inserito: Casa",
+	"system.alarm-armed.title.away": "Inserito: Fuori",
+	"system.alarm-armed.title.night": "Inserito: Notte",
+	"system.alarm-armed.body": "Allarme inserito",
+	"system.alarm-disarmed.title": "Disinserito",
+	"system.alarm-disarmed.body": "Allarme disinserito",
 	"system.alarm-triggered.title": "ALLARME",
-	"system.alarm-triggered.body": "L'allarme è scattato",
-	"system.alarm-triggered.body.rule": "L'allarme è scattato per {{rule}} su {{deviceName}}",
+	"system.alarm-triggered.body": "Allarme scattato",
+	"system.alarm-triggered.body.rule": "Scattato da {{rule}} su {{deviceName}}",
 	"button.snooze.minutes": "Silenzia {{minutes}} min",
 	"button.snooze.hours": {
 		"one": "Silenzia {{hours}} ora",
@@ -5311,7 +5906,8 @@ var NcDispatcher = class {
 		const systemEvent = subject.systemEvent;
 		const displayDeviceId = systemEvent?.deviceId ?? subject.deviceId;
 		const deviceName = systemEvent !== void 0 && systemEvent.deviceId === void 0 ? "system" : await this.deps.getDeviceName(displayDeviceId).catch(() => null) ?? `camera ${displayDeviceId}`;
-		const zoneLabels = systemEvent !== void 0 ? [] : await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones);
+		const alarmSource = systemEvent?.alarmSource;
+		const zoneLabels = systemEvent === void 0 ? await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones) : alarmSource?.zones !== void 0 && alarmSource.zones.length > 0 ? await resolveZoneLabels(this.deps.getZoneNames, alarmSource.deviceId, alarmSource.zones) : [];
 		const vars = buildTemplateVars(this.texts, entry, deviceName, zoneLabels);
 		const systemCount = systemEvent?.textCount !== void 0 ? { count: systemEvent.textCount } : {};
 		const title = this.renderText({
@@ -5654,6 +6250,10 @@ async function resolveZoneLabels(getZoneNames, deviceId, zoneIds) {
 		return [...zoneIds];
 	}
 }
+/** `{{confidence}}` as a whole percent, or empty when nothing measured one. */
+function percentOf(confidence) {
+	return confidence !== void 0 ? `${Math.round(confidence * 100)}%` : "";
+}
 /**
 * The variable map ONE render pass sees: scalars, then the composites built
 * from them, then the params a system-event row froze at intake.
@@ -5669,19 +6269,23 @@ function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
 	const subject = entry.payload.subject;
 	const occupancy = subject.occupancy;
 	const systemEvent = subject.systemEvent;
+	const detection = systemEvent?.alarmSource?.className !== void 0 ? systemEvent.alarmSource : void 0;
 	return {
 		camera: deviceName,
-		class: subject.className,
-		label: subject.label ?? "",
+		class: detection?.className ?? subject.className,
+		label: detection?.label ?? subject.label ?? "",
 		zones: zoneLabels.join(", "),
-		subject: systemEvent?.subject ?? ncSubjectText(texts, {
+		subject: detection?.className !== void 0 ? ncSubjectText(texts, {
+			className: detection.className,
+			...detection.label !== void 0 ? { label: detection.label } : {}
+		}) : systemEvent?.subject ?? ncSubjectText(texts, {
 			className: subject.className,
 			...subject.label !== void 0 ? { label: subject.label } : {}
 		}),
 		inZones: ncInZonesText(texts, zoneLabels),
 		scope: occupancy?.zone ?? deviceName,
 		zone: occupancy?.zone ?? zoneLabels[0] ?? "",
-		confidence: subject.confidence !== void 0 ? `${Math.round(subject.confidence * 100)}%` : "",
+		confidence: percentOf(detection?.confidence ?? subject.confidence),
 		time: new Date(subject.timestamp).toLocaleTimeString(),
 		rule: entry.payload.ruleName,
 		count: occupancy !== void 0 ? `${occupancy.count}` : "",
@@ -6221,6 +6825,35 @@ function incomingFromSystemEvent(event, lookup) {
 	}
 }
 /**
+* The COMBINED row's two keys, or null when this transition is not one.
+*
+* A rule that trips the alarm produces ONE notification, and the operator has
+* to be able to read it: the title is the severity marker over the camera
+* (`alarm.combined.title`, shipped as `Alarm: {{deviceName}}` and re-wordable
+* per rule or in the Texts tab), and the body is `detection.body` — the exact
+* sentence that rule's ordinary notification would have carried, with its own
+* class, identity and zones.
+*
+* The alarm used to write its own prose here ("The alarm was triggered by
+* Person at gate on Ingresso"), which made the one notification that matters
+* the only one in the system that did not look like the rule's others: no
+* identity, no zone, a different subject. The prefix carries the severity; the
+* familiar line carries the meaning.
+*
+* **Gated on the detection vocabulary, not on the source.** `detection.body`
+* renders `{{subject}}`, and a fire ref with no class composes it from the
+* system event's dedup slot — "alarm:42 su Ingresso". A source without a class
+* therefore keeps the alarm's own sentence, which is also what every row
+* enqueued before this deploy carries.
+*/
+function combinedAlarmText(source) {
+	if (source?.className === void 0) return null;
+	return {
+		titleKey: "alarm.combined.title",
+		bodyKey: "detection.body"
+	};
+}
+/**
 * The panel's own transition, as a system-event subject.
 *
 * IN-PROCESS, not off the bus. The alarm and the Notification Center live in
@@ -6243,6 +6876,7 @@ function incomingFromAlarmTransition(input) {
 	const deviceId = source?.deviceId ?? panelDeviceId;
 	const identity = input.lookup(deviceId);
 	const kind = transition.kind;
+	const combined = combinedAlarmText(source);
 	return systemSubject({
 		facts: {
 			eventId: `alarm:${kind}:${String(transition.at)}`,
@@ -6258,12 +6892,13 @@ function incomingFromAlarmTransition(input) {
 		},
 		kind,
 		subject: `alarm:${String(panelDeviceId)}`,
-		titleKey: transition.mode !== void 0 ? `system.${kind}.title.${transition.mode}` : `system.${kind}.title`,
-		bodyKey: input.body?.bodyKey ?? (source !== void 0 ? `system.${kind}.body.rule` : `system.${kind}.body`),
+		titleKey: combined !== null ? combined.titleKey : transition.mode !== void 0 ? `system.${kind}.title.${transition.mode}` : `system.${kind}.title`,
+		bodyKey: combined?.bodyKey ?? input.body?.bodyKey ?? (source !== void 0 ? `system.${kind}.body.rule` : `system.${kind}.body`),
 		textParams: {
 			...deviceTextParams(deviceId, identity),
 			...transition.mode !== void 0 ? { mode: transition.mode } : {},
 			...source !== void 0 ? { rule: source.ruleName } : {},
+			...kind === "alarm-arming" ? { seconds: `${transition.seconds ?? 0}` } : {},
 			...input.body?.textParams
 		},
 		deviceId,
@@ -10004,7 +10639,15 @@ var NcSummaryProducer = class {
 		}
 		const bytes = new Uint8Array(rendered.jpeg.byteLength);
 		bytes.set(rendered.jpeg);
-		const url = await this.deps.publish(bytes, "image/jpeg");
+		const { url } = await this.deps.publish(bytes, "image/jpeg", {
+			kind: "summary-mosaic",
+			deviceId: rule.deviceIds[0] ?? null,
+			deviceIds: [...new Set(tiles.map((t) => t.candidate.deviceId))],
+			capturedAt: window.endMs,
+			ruleId: rule.id,
+			ruleName: rule.name,
+			...rule.ownerUserId !== void 0 ? { ownerUserId: rule.ownerUserId } : {}
+		});
 		if (url === null) {
 			this.deps.logger.warn("summary mosaic not published: no reachable public endpoint", { meta: { ruleId: rule.id } });
 			return {
@@ -10998,7 +11641,7 @@ function unknownNcTextKeys(keys, bundles = NC_TEXT_BUNDLES) {
 * durable document stays the sparse map its schema describes.
 */
 function applyNcTextOverridePatch(current, language, patch) {
-	const next = { ...current[language] ?? {} };
+	const next = { ...current[language] };
 	for (const [key, value] of Object.entries(patch)) {
 		if (value === null || value.trim().length === 0) {
 			delete next[key];
@@ -11566,7 +12209,7 @@ var TimelapseRenderer = class {
 			}
 		});
 		const finished = await this.awaitReady(queued, tags);
-		const published = await this.publish(finished.id, deviceId, tags, request.previewText, request.previewMode ?? "image");
+		const published = await this.publish(finished.id, request, tags);
 		const downloadUrl = await this.ports.resolveDownloadUrl?.({ exportId: finished.id }).catch(() => null);
 		return {
 			exportId: finished.id,
@@ -11618,7 +12261,9 @@ var TimelapseRenderer = class {
 	* notification, not a failed window — and failing here would leave the pair
 	* unstamped and re-render the same eight hours on the next tick.
 	*/
-	async publish(exportId, deviceId, tags, previewText, previewMode) {
+	async publish(exportId, request, tags) {
+		const { deviceId, previewText } = request;
+		const previewMode = request.previewMode ?? "image";
 		const publish = this.ports.publishArtifact;
 		const none = {
 			video: null,
@@ -11638,7 +12283,11 @@ var TimelapseRenderer = class {
 				...previewText !== void 0 ? {
 					previewText,
 					previewMode
-				} : {}
+				} : {},
+				capturedAt: request.window.endMs,
+				ruleId: request.ruleId,
+				ruleName: request.ruleName,
+				...request.ownerUserId !== void 0 ? { ownerUserId: request.ownerUserId } : {}
 			});
 			if (set.video === null) this.ports.logger.warn("timelapse artifact could not be published — link-less delivery", {
 				tags,
@@ -11994,7 +12643,8 @@ var TimelapseScheduler = class {
 					...rule.previewText !== void 0 ? { text: rule.previewText } : {}
 				}),
 				previewMode: rule.previewMode,
-				...rule.reportClasses !== void 0 ? { reportClasses: rule.reportClasses } : {}
+				...rule.reportClasses !== void 0 ? { reportClasses: rule.reportClasses } : {},
+				...rule.ownerUserId !== void 0 ? { ownerUserId: rule.ownerUserId } : {}
 			});
 			const rows = buildTimelapseOutboxInputs({
 				texts: this.texts,
@@ -12570,6 +13220,7 @@ function frozenOccupancy(rule, occ) {
 */
 function fireRefFor(rule, subject, kind) {
 	const hasEventMedia = kind === "object-event" || kind === "package-event";
+	const className = subject.classNames[0];
 	return {
 		ruleId: rule.id,
 		ruleName: rule.name,
@@ -12578,7 +13229,11 @@ function fireRefFor(rule, subject, kind) {
 		recordId: subject.recordId,
 		...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
 		...hasEventMedia ? { eventId: subject.recordId } : {},
-		timestamp: subject.timestamp
+		timestamp: subject.timestamp,
+		...className !== void 0 ? { className } : {},
+		...subject.label !== void 0 ? { label: subject.label } : {},
+		zones: notificationZones(rule, subject),
+		...subject.confidence !== void 0 ? { confidence: subject.confidence } : {}
 	};
 }
 function notificationZones(rule, subject) {
@@ -13305,6 +13960,7 @@ var NotificationCenter = class NotificationCenter {
 		await TimelapseStore.declare(store);
 		await NcSummaryStore.declare(store);
 		await NcTextCatalogStore.declare(store);
+		await NcArtifactIndex.declare(store);
 	}
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
@@ -15362,7 +16018,23 @@ var ncActions = defineCustomActions({
 	}), NcTextCatalogViewSchema, {
 		kind: "mutation",
 		auth: "admin"
-	})
+	}),
+	/**
+	* One page of artefacts, newest `capturedAt` first.
+	*
+	* `deviceIds` filters on the camera an artefact is FILED under. A digest
+	* spans cameras and is filed under its rule's first one (the same camera its
+	* outbox row uses); to ask "everything this digest produced" use `ruleId`.
+	*/
+	"nc.listArtifacts": customAction(NcArtifactQuerySchema, object({
+		artifacts: array(NcArtifactRecordSchema),
+		/** Rows matching the filter, not rows on this page. */
+		total: number().int().nonnegative(),
+		hasMore: boolean()
+	}), { caller: "required" }),
+	/** One artefact's metadata. `null` for unknown, expired AND not-yours alike —
+	*  a surface that distinguishes them reports what other people own. */
+	"nc.getArtifact": customAction(object({ artifactId: string().min(1) }), object({ artifact: NcArtifactRecordSchema.nullable() }), { caller: "required" })
 });
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
 function requireCaller(caller) {
@@ -15412,6 +16084,12 @@ function makeNcActionHandlers(deps) {
 		if (sum === void 0) throw new Error("this node does not host the summary producer — use the hub");
 		return sum;
 	};
+	/** The artefact index, or an honest refusal. */
+	const requireArtifacts = () => {
+		const index = deps.artifacts;
+		if (index === void 0) throw new Error("this node does not host the notification artifact index — use the hub");
+		return index;
+	};
 	/** The text catalog editor, or an honest refusal. */
 	const requireTexts = () => {
 		const editor = deps.texts;
@@ -15723,7 +16401,26 @@ function makeNcActionHandlers(deps) {
 			return input.language === void 0 ? texts.view() : texts.view(input.language);
 		},
 		"nc.setLanguage": async (input) => requireTexts().setLanguage(input.language),
-		"nc.setTextOverrides": async (input) => requireTexts().setOverrides(input.language, input.overrides)
+		"nc.setTextOverrides": async (input) => requireTexts().setOverrides(input.language, input.overrides),
+		"nc.listArtifacts": async (input, caller) => {
+			const c = requireCaller(caller);
+			const page = await requireArtifacts().list(input, {
+				userId: c.userId,
+				isAdmin: c.isAdmin
+			});
+			return {
+				artifacts: [...page.artifacts],
+				total: page.total,
+				hasMore: page.hasMore
+			};
+		},
+		"nc.getArtifact": async (input, caller) => {
+			const c = requireCaller(caller);
+			return { artifact: await requireArtifacts().get(input.artifactId, {
+				userId: c.userId,
+				isAdmin: c.isAdmin
+			}) };
+		}
 	};
 }
 //#endregion
@@ -15777,7 +16474,8 @@ var PREVIEW_FALLBACK_NAME = "timelapse-preview.jpg";
 *          member has a logged reason. It never rejects.
 */
 function buildTimelapseArtifactPublisher(ports) {
-	return async ({ exportId, deviceId, previewText, previewMode }) => {
+	return async (request) => {
+		const { exportId, deviceId, previewText, previewMode } = request;
 		const tags = { deviceId };
 		const none = {
 			video: null,
@@ -15808,15 +16506,32 @@ function buildTimelapseArtifactPublisher(ports) {
 			return none;
 		}
 		const mp4 = Buffer$1.from(read.base64, "base64");
+		const capturedAt = request.capturedAt ?? Date.now();
+		const common = {
+			deviceId,
+			deviceIds: [deviceId],
+			capturedAt,
+			...request.ruleId !== void 0 ? { ruleId: request.ruleId } : {},
+			...request.ruleName !== void 0 ? { ruleName: request.ruleName } : {},
+			...request.ownerUserId !== void 0 ? { ownerUserId: request.ownerUserId } : {}
+		};
 		const preview = await publishPreview(ports, {
 			mp4,
 			deviceId,
 			tags,
 			previewText,
-			previewMode: previewMode ?? "image"
+			previewMode: previewMode ?? "image",
+			meta: {
+				...common,
+				kind: "timelapse-preview"
+			}
 		});
 		try {
-			const url = await ports.publish(mp4, read.contentType);
+			const { url } = await ports.publish(mp4, read.contentType, {
+				...common,
+				kind: "timelapse",
+				...preview.artifactId !== null ? { posterArtifactId: preview.artifactId } : {}
+			});
 			if (url === null) {
 				ports.logger.warn("timelapse artifact not published: no reachable public endpoint", {
 					tags,
@@ -15824,7 +16539,7 @@ function buildTimelapseArtifactPublisher(ports) {
 				});
 				return {
 					video: null,
-					preview
+					preview: preview.ref
 				};
 			}
 			ports.logger.info("timelapse artifact published", {
@@ -15833,7 +16548,7 @@ function buildTimelapseArtifactPublisher(ports) {
 					exportId,
 					bytes: read.bytes,
 					name: read.name,
-					preview: preview !== null
+					preview: preview.ref !== null
 				}
 			});
 			return {
@@ -15842,7 +16557,7 @@ function buildTimelapseArtifactPublisher(ports) {
 					mime: read.contentType,
 					name: read.name
 				},
-				preview
+				preview: preview.ref
 			};
 		} catch (err) {
 			ports.logger.warn("timelapse artifact not published: artifact plane refused the bytes", {
@@ -15854,18 +16569,22 @@ function buildTimelapseArtifactPublisher(ports) {
 			});
 			return {
 				video: null,
-				preview
+				preview: preview.ref
 			};
 		}
 	};
 }
+var NO_PREVIEW = {
+	ref: null,
+	artifactId: null
+};
 /**
 * The preview half. Best-effort at every step and never throws: the picture is
 * an enhancement, the video is the notification.
 */
 async function publishPreview(ports, input) {
 	const render = ports.renderPreview;
-	if (render === void 0 || input.previewText === void 0) return null;
+	if (render === void 0 || input.previewText === void 0) return NO_PREVIEW;
 	try {
 		const rendered = await render({
 			mp4: input.mp4,
@@ -15873,23 +16592,29 @@ async function publishPreview(ports, input) {
 			deviceId: input.deviceId,
 			mode: input.previewMode
 		});
-		if (rendered === null) return null;
-		const url = await ports.publish(rendered.bytes, rendered.mime);
+		if (rendered === null) return NO_PREVIEW;
+		const { url, artifactId } = await ports.publish(rendered.bytes, rendered.mime, input.meta);
 		if (url === null) {
 			ports.logger.warn("timelapse preview not published: no reachable public endpoint", { tags: input.tags });
-			return null;
+			return {
+				ref: null,
+				artifactId
+			};
 		}
 		return {
-			url,
-			mime: rendered.mime,
-			name: PREVIEW_NAME_BY_MIME[rendered.mime] ?? PREVIEW_FALLBACK_NAME
+			ref: {
+				url,
+				mime: rendered.mime,
+				name: PREVIEW_NAME_BY_MIME[rendered.mime] ?? PREVIEW_FALLBACK_NAME
+			},
+			artifactId
 		};
 	} catch (err) {
 		ports.logger.warn("timelapse preview not published: publish threw", {
 			tags: input.tags,
 			meta: { error: String(err) }
 		});
-		return null;
+		return NO_PREVIEW;
 	}
 }
 /** Title size as a fraction of the frame WIDTH — so it reads the same on a
@@ -16376,6 +17101,10 @@ function startAlarmPanelConvergence(ports) {
 * `data-plane-access.spec.ts` asserts they still match the constants their
 * handlers register with — a mirror nothing checks is a lie waiting to happen.
 */
+/** The artefact read route's prefix, imported rather than mirrored: it is
+*  ALSO the prefix `artifactDownloadPath` writes into every index row, and two
+*  copies of that string is a 404 nobody would find. */
+var NC_ARTIFACT_READ_PREFIX_REF = NC_ARTIFACT_READ_PREFIX;
 var TRAINING_EXPORT_PREFIX_REF = "training-export";
 var RETRAIN_EXPORT_PREFIX_REF = "retrain-export";
 var DEBUG_EXPORT_PREFIX_REF = "debug-export";
@@ -16391,6 +17120,14 @@ var PIPELINE_ANALYTICS_PLANE_ACCESS = {
 	"nc-action": "public",
 	/** Self-authenticating single-use artifact token (D47). */
 	"nc-artifact": "public",
+	/**
+	* The VIEWER's read of the same bytes (task #36). One indexed artefact by an
+	* unguessable id the caller was handed by `nc.listArtifacts` — the rule above,
+	* applied unchanged. It is deliberately NOT the `public` signed plane: the
+	* viewer holds a session, and pre-minting a 24 h signed link for every
+	* artefact a user might scroll to is a link-leak surface for no gain.
+	*/
+	[NC_ARTIFACT_READ_PREFIX_REF]: "authenticated",
 	/** Every frame behind a marked selection — a corpus, not an item. */
 	[TRAINING_EXPORT_PREFIX_REF]: "admin",
 	[RETRAIN_EXPORT_PREFIX_REF]: "admin",
@@ -36056,6 +36793,138 @@ var BindingCache = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/runtime/detection-coverage-cache.ts
+/**
+* DetectionCoverageCache — fleet-seeded, event-invalidated mirror of WHICH
+* devices carry a WRAPPED `detection-pipeline` binding. This is the alarm's
+* coverage authority ("Away armed, 12 cameras" is false if three of them are
+* offline or no longer wrapped), read by the notification centre's device
+* directory (`listDeviceIdentities`).
+*
+* WHY a mirror, not a per-tick sweep. The directory refreshes on the NC's 30 s
+* rule-reload tick. Answering "who still has detection?" with a fleet-wide
+* `getAllBindings` on EVERY tick cost 903 ms / 373 KB / ~505 `getBindings:
+* default wrappers skipped` log lines on the live hub (524 devices), forever —
+* ~3% of hub-main's main thread plus a permanent log-spam baseline. Same defect
+* and fix as `SystemMirror.refreshBinding` (639073e8): ONE fleet read to warm,
+* then per-device updates driven by `DeviceBindingsChanged` events. A wrapper
+* toggle emits that event carrying the device's id and `capName`
+* (`detection-pipeline`), so a single `getBindings(deviceId)` — 21 ms / 613 B —
+* keeps the mirror current without ever touching the fleet again.
+*
+* ── Destructive-direction discipline (D49) ──────────────────────────────────
+*
+* `detectionActive: false` reports a camera as UNCOVERED / switched-off (D62) —
+* the destructive answer, and the one an operator reads as "my alarm is not
+* watching that door". A transient `getBindings` blip must never flip a
+* known-covered camera to uncovered:
+*   • a failed refresh KEEPS the previous value (a read that throws changes
+*     nothing), and
+*   • a single read that would flip a known `true → false` is confirmed by a
+*     concordant SECOND read before it lands — an empty binding list is not
+*     proof the wrapper is gone.
+* A COLD mirror (seed not yet landed, or a seed that failed) answers `undefined`
+* for every id — and unknown never reports a camera as excluded from coverage.
+*/
+var DetectionCoverageCache = class {
+	api;
+	logger;
+	/** deviceId → "has a WRAPPED detection-pipeline binding". Absent = unknown. */
+	state = /* @__PURE__ */ new Map();
+	warm = false;
+	seeding = null;
+	constructor(deps) {
+		this.api = deps.api;
+		this.logger = deps.logger;
+	}
+	/** Has the ONE fleet seed ever landed? A cold mirror knows nothing. */
+	isWarm() {
+		return this.warm;
+	}
+	/** Do we have an answer for this id at all? (`false` ⇒ absent ⇒ unknown.) */
+	has(deviceId) {
+		return this.state.has(deviceId);
+	}
+	/** The coverage answer, or `undefined` when this id is unknown. No I/O. */
+	get(deviceId) {
+		return this.state.get(deviceId);
+	}
+	/**
+	* Seed the whole fleet ONCE with a single `getAllBindings`. Idempotent: a
+	* warm cache is a no-op, and concurrent callers coalesce onto one read. A
+	* failed seed leaves the mirror COLD so the next tick retries — during that
+	* window every id answers unknown, which never reports a camera as excluded.
+	*/
+	async ensureWarm() {
+		if (this.warm) return;
+		if (this.seeding) return this.seeding;
+		this.seeding = this.seed();
+		try {
+			await this.seeding;
+		} finally {
+			this.seeding = null;
+		}
+	}
+	async seed() {
+		try {
+			const rows = await this.api.deviceManager.getAllBindings.query({});
+			for (const row of rows) {
+				if (this.state.has(row.deviceId)) continue;
+				this.state.set(row.deviceId, hasWrappedDetection(row.entries));
+			}
+			this.warm = true;
+			this.logger.info("detection-coverage mirror warm", { meta: { devices: this.state.size } });
+		} catch (err) {
+			this.logger.warn("detection-coverage seed failed — coverage unknown until it lands", { meta: { error: String(err) } });
+		}
+	}
+	/**
+	* A `DeviceBindingsChanged` for the detection cap re-reads THAT ONE device
+	* (never the fleet). Fire-and-forget from the synchronous event handler.
+	*/
+	onBindingsChanged(event) {
+		if (event.capName !== "detection-pipeline") return Promise.resolve();
+		return this.refreshDevice(event.deviceId);
+	}
+	/** Drop a device the fleet no longer has (`device.unregistered`). */
+	forget(deviceId) {
+		this.state.delete(deviceId);
+	}
+	/** Return to cold — used on addon shutdown. */
+	clearAll() {
+		this.state.clear();
+		this.warm = false;
+		this.seeding = null;
+	}
+	async refreshDevice(deviceId) {
+		try {
+			const active = await this.readWrappedDetection(deviceId);
+			const prev = this.state.get(deviceId);
+			if (!active && prev === true) {
+				if (await this.readWrappedDetection(deviceId)) {
+					this.state.set(deviceId, true);
+					return;
+				}
+			}
+			this.state.set(deviceId, active);
+		} catch (err) {
+			this.logger.debug("detection-coverage refresh failed — keeping the previous value", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+		}
+	}
+	async readWrappedDetection(deviceId) {
+		return hasWrappedDetection((await this.api.deviceManager.getBindings.query({ deviceId })).entries);
+	}
+};
+/** The one authority: a WRAPPED `detection-pipeline` binding is present. A
+*  native binding of the same cap is NOT coverage (D62: absence of the WRAPPED
+*  binding is how a deactivated wrapper is represented). */
+function hasWrappedDetection(entries) {
+	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
+}
+//#endregion
 //#region src/pipeline-analytics/runtime/capture-scheduler.ts
 /**
 * Kind-derived default priorities (0 = highest). Explicit `priority` wins.
@@ -41201,6 +42070,15 @@ var REBUILD_FALLBACK_NODE_ID = "hub";
 */
 var TIMELAPSE_TRACK_QUERY_LIMIT = 2e3;
 var PIPELINE_ANALYTICS_ADDON_ID = "pipeline-analytics";
+/** Artefact index ⇄ shelf reconcile cadence. Hourly: the two only drift on the
+*  bounds' own timescale (14 days / 2000 entries / 2 GiB). */
+var NC_ARTIFACT_PRUNE_INTERVAL_MS = 36e5;
+/** What a publish answers on a node whose artifact plane never came up: no
+*  link, no index row — and, exactly as before, bytes-only delivery. */
+var NO_PUBLICATION = {
+	url: null,
+	artifactId: null
+};
 /**
 * The FULL action catalog for this addon.
 *
@@ -41438,6 +42316,12 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  path). Null on non-post-processing nodes or when disabled. */
 	embeddingDispatcher = null;
 	bindingCache = null;
+	/** Alarm-coverage mirror the NC device directory reads — WHICH devices carry
+	*  a wrapped `detection-pipeline` binding. Fleet-seeded ONCE, then per-device
+	*  updates off `DeviceBindingsChanged`, so the 30 s rule-reload tick stops
+	*  sweeping `getAllBindings` over the whole fleet. See
+	*  `runtime/detection-coverage-cache.ts`. */
+	detectionCoverage = null;
 	/** Per-device throttle for the inactive-binding frame-drop warn (5 min). */
 	inactiveBindingDropWarnAt = /* @__PURE__ */ new Map();
 	zoneAnalytics = null;
@@ -41476,6 +42360,12 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  data-plane handle. Null until served / when the facility is absent. */
 	ncArtifactPlane = null;
 	ncArtifactDataPlane = null;
+	/** The viewer's artefact library (task #36): the index, its authenticated
+	*  bytes route, and the store the two share. Null until served. */
+	ncArtifactIndex = null;
+	ncArtifactStore = null;
+	ncArtifactReadDataPlane = null;
+	ncArtifactPruneTimer = null;
 	/**
 	* Roadmap 4b: ONE cut of an event, in every container the rule asked for.
 	*
@@ -41662,6 +42552,31 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* Best-effort at every step: no facility, no secret or no reachable base URL
 	* ⇒ no plane, and the dispatcher keeps shipping bytes exactly as before.
 	*/
+	/**
+	* Reconcile the artefact index against the shelf that holds the bytes.
+	*
+	* Hourly, because the two drift only on the bounds' timescale: a row expires
+	* on the shelf's own age bound (14 d) or its file is evicted by the count/byte
+	* bound. Without this, a list eventually serves rows whose bytes 404 — and a
+	* broken tile is the one failure an operator DOES report.
+	*/
+	startNcArtifactPrune() {
+		if (this.ncArtifactPruneTimer !== null) return;
+		const run = async () => {
+			const index = this.ncArtifactIndex;
+			const store = this.ncArtifactStore;
+			if (index === null || store === null) return;
+			try {
+				await store.sweep();
+				await index.prune(this.isPostProcessingNode ? await store.keptIds() : null);
+			} catch (err) {
+				this.ctx.logger.warn("nc artifact prune failed", { meta: { error: errMsg(err) } });
+			}
+		};
+		run();
+		this.ncArtifactPruneTimer = setInterval(() => void run(), NC_ARTIFACT_PRUNE_INTERVAL_MS);
+		this.ncArtifactPruneTimer.unref?.();
+	}
 	async serveNcArtifactPlane() {
 		try {
 			const secretState = this.state("ncArtifactSecret", NcArtifactSecretSchema, "");
@@ -41675,9 +42590,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				logger: this.ctx.logger.child("nc-artifacts")
 			});
 			await store.start();
+			this.ncArtifactStore = store;
+			const index = new NcArtifactIndex({
+				store: this.ctx.api.settingsStore,
+				logger: this.ctx.logger.child("nc-artifacts"),
+				addonId: this.ctx.id,
+				retentionMs: store.retentionMs
+			});
+			this.ncArtifactIndex = index;
 			const plane = new NcArtifactPlane({
 				store,
 				secret,
+				index,
 				logger: this.ctx.logger.child("nc-artifacts"),
 				routePrefix: `/addon/${this.ctx.id}/nc-artifact`,
 				listEndpoints: () => this.ncEndpoints()
@@ -41688,7 +42612,23 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				handler: plane.handler
 			}) ?? null;
 			this.ncArtifactPlane = this.ncArtifactDataPlane !== null ? plane : null;
-			this.ctx.logger.info("nc-artifact data-plane served", { meta: { served: this.ncArtifactPlane !== null } });
+			const readPlane = new NcArtifactReadPlane({
+				index,
+				store,
+				logger: this.ctx.logger.child("nc-artifacts")
+			});
+			this.ncArtifactReadDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: NC_ARTIFACT_READ_PREFIX_REF,
+				access: planeAccess(NC_ARTIFACT_READ_PREFIX_REF),
+				handler: readPlane.handler
+			}) ?? null;
+			this.startNcArtifactPrune();
+			this.ctx.logger.info("nc-artifact data-plane served", { meta: {
+				served: this.ncArtifactPlane !== null,
+				libraryServed: this.ncArtifactReadDataPlane !== null,
+				libraryAccess: planeAccess(NC_ARTIFACT_READ_PREFIX_REF),
+				retentionDays: Math.round(store.retentionMs / 864e5)
+			} });
 		} catch (err) {
 			this.ctx.logger.warn("nc-artifact data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
@@ -42136,7 +43076,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				store: center.summaryStore,
 				runNow: (input) => center.runSummaryNow(input)
 			},
-			texts: center.textCatalogEditor
+			texts: center.textCatalogEditor,
+			...this.ncArtifactIndex !== null ? { artifacts: this.ncArtifactIndex } : {}
 		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
@@ -42621,6 +43562,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			api,
 			logger: logger.child("BindingCache")
 		});
+		this.detectionCoverage = new DetectionCoverageCache({
+			api,
+			logger: logger.child("DetectionCoverage")
+		});
 		const zoneAnalytics = new ZoneAnalyticsProvider({
 			logger: logger.child("ZoneAnalytics"),
 			onOccupancySample: (deviceId, count, at, zoneId) => this.lts?.note("occupancy", deviceId, count, at, zoneId ?? ""),
@@ -42702,17 +43647,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			},
 			listDeviceIdentities: async () => {
 				const all = await api.deviceManager.listAll.query({ projection: "slim" });
-				const detection = await api.deviceManager.getAllBindings.query({}).then((rows) => new Map(rows.map((row) => [row.deviceId, row.entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped")]))).catch((err) => {
-					this.ctx.logger.debug("bindings read failed — alarm coverage cannot report skips", { meta: { error: String(err) } });
-					return /* @__PURE__ */ new Map();
-				});
+				const coverage = this.detectionCoverage;
+				if (coverage) await coverage.ensureWarm();
 				return all.map((d) => ({
 					deviceId: d.id,
 					type: d.type,
 					name: d.name,
 					isCamera: d.isCamera,
 					online: d.online && !d.disabled,
-					...detection.has(d.id) ? { detectionActive: detection.get(d.id) === true } : {}
+					...coverage?.has(d.id) ? { detectionActive: coverage.get(d.id) === true } : {}
 				}));
 			},
 			readDeviceZoneIds: async (ids) => {
@@ -42923,7 +43866,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				timestamp,
 				data: jpeg
 			}),
-			publish: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null
+			publish: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? NO_PUBLICATION
 		};
 	}
 	/**
@@ -42996,7 +43939,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			publishArtifact: buildTimelapseArtifactPublisher({
 				logger: this.ctx.logger.child("Timelapse"),
 				readExportBytes: ({ exportId }) => api.recordingExport.readExportBytes.query({ exportId }),
-				publish: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
+				publish: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? NO_PUBLICATION,
 				renderPreview: async ({ mode, ...input }) => {
 					const previewPorts = {
 						logger: this.ctx.logger.child("Timelapse"),
@@ -43420,6 +44363,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  `runtime/wire-subscriptions.ts`. */
 	handleBindingsChangedEvent(data) {
 		this.bindingCache?.onBindingsChanged(data);
+		this.detectionCoverage?.onBindingsChanged(data);
 		if (data.capName === "pipeline-analytics" && data.reason === "wrapper-deactivated") {
 			this.trackStore?.clearDevice(data.deviceId);
 			this.residents.closeDevice(data.deviceId);
@@ -43445,6 +44389,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.audioMarkers?.forgetDevice(deviceId);
 		this.settingsCaches.clearDevice(deviceId);
 		this.bindingCache?.invalidate(deviceId);
+		this.detectionCoverage?.forget(deviceId);
 		this.zoneAnalytics?.forgetDevice(deviceId);
 		this.audioMetrics?.forgetDevice(deviceId);
 		this.releaseProxy(deviceId);
@@ -43650,6 +44595,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.trackStore?.clearAll();
 		this.stationaryRegistry = null;
 		this.bindingCache?.clearAll();
+		this.detectionCoverage?.clearAll();
 		await this.eventMediaDataPlane?.dispose();
 		this.eventMediaDataPlane = null;
 		this.eventMediaBaseUrl = null;
@@ -43660,6 +44606,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.retrainExportDataPlane = null;
 		await this.debugExportDataPlane?.dispose();
 		this.debugExportDataPlane = null;
+		if (this.ncArtifactPruneTimer !== null) {
+			clearInterval(this.ncArtifactPruneTimer);
+			this.ncArtifactPruneTimer = null;
+		}
+		await this.ncArtifactReadDataPlane?.dispose();
+		this.ncArtifactReadDataPlane = null;
+		this.ncArtifactIndex = null;
+		this.ncArtifactStore = null;
 	}
 	async handleInferenceResult(data) {
 		if (this.shuttingDown) return;