@camstack/addon-post-analysis 1.2.71 → 1.2.73

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as readDeviceStateFrom, A as TimelapseRuleInputSchema, B as customAction, C as NcSnoozeSchema, Ct as unknown, D as RECORDING_EXPORT_MAX_READ_BYTES, E as OpsLogEntrySchema, F as alarmPanelCapability, G as faceGalleryCapability, H as deriveRecordingMode, I as assertTimelapseCadences, J as isScheduleActive, L as audioMetricsCapability, M as TimelapseRuleSchema, N as TrackSourceSchema, O as RetrainStatusSchema, P as addonWidgetsSourceCapability, Q as plateGalleryCapability, R as buildEventKindDescriptor, S as NcSnoozeInputSchema, St as string, T as NcTaxonomySchema, V as defineCustomActions, W as encodeVectorBase64, X as notificationRulesCapability, Y as kebabToCamel, Z as pipelineAnalyticsCapability, _ as NcRuleInputSchema, _t as literal, at as errMsg, b as NcRuleTargetSchema, bt as partialRecord, c as EVENT_PAD_MS, ct as createEvent, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as nodePin, et as readTimelapseGeneratedAt, f as NC_CONDITION_CATALOG, ft as sleep, g as NcConditionDescriptorSchema, gt as discriminatedUnion, h as NC_TAXONOMY, ht as boolean, i as DETECTION_MACRO_CLASSES, it as zoneAnalyticsCapability, j as TimelapseRulePatchSchema, k as TIMELAPSE_DENSE_FLOOR_SEC, l as LabelAttributionSchema, lt as hydrateSchema, mt as array, n as DEFAULT_EVENT_COLOR, nt as vectorDimFromBase64, o as DeclaredDevices, ot as BaseAddon, p as NC_DEFAULT_SNOOZE_MINUTES, pt as _enum, q as isDetectionMacroClass, rt as videoclipsCapability, s as EVENT_KIND_BY_CAP, st as DeviceType, t as BaseDevice, tt as subKindsOf, u as MACRO_LABELS, ut as isDeviceScopedCap, v as NcRulePatchSchema, vt as number, w as NcSnoozeSuppressedSchema, wt as EventCategory, x as NcScheduleSchema, xt as record, y as NcRuleSchema, yt as object, z as cosineSimilarity } from "../dist-B--dE3Ry.mjs";
+import { $ as plateGalleryCapability, A as TIMELAPSE_DENSE_FLOOR_SEC, B as cosineSimilarity, C as NcSnoozeSchema, Ct as string, D as OpsLogEntrySchema, E as NcTaxonomySchema, F as addonWidgetsSourceCapability, G as encodeVectorBase64, H as defineCustomActions, I as alarmPanelCapability, J as isDetectionMacroClass, K as faceGalleryCapability, L as assertTimelapseCadences, M as TimelapseRulePatchSchema, N as TimelapseRuleSchema, O as RECORDING_EXPORT_MAX_READ_BYTES, P as TrackSourceSchema, Q as pipelineAnalyticsCapability, R as audioMetricsCapability, S as NcSnoozeInputSchema, St as record, T as NcSystemEventKindSchema, Tt as EventCategory, U as deriveRecordingMode, V as customAction, X as kebabToCamel, Y as isScheduleActive, Z as notificationRulesCapability, _ as NcRuleInputSchema, _t as discriminatedUnion, at as zoneAnalyticsCapability, b as NcRuleTargetSchema, bt as object, c as EVENT_PAD_MS, ct as DeviceType, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as isDeviceScopedCap, et as readDeviceStateFrom, f as NC_CONDITION_CATALOG, ft as nodePin, g as NcConditionDescriptorSchema, gt as boolean, h as NC_TAXONOMY, ht as array, i as DETECTION_MACRO_CLASSES, it as videoclipsCapability, j as TimelapseRuleInputSchema, k as RetrainStatusSchema, l as LabelAttributionSchema, lt as createEvent, mt as _enum, n as DEFAULT_EVENT_COLOR, nt as subKindsOf, o as DeclaredDevices, ot as errMsg, p as NC_DEFAULT_SNOOZE_MINUTES, pt as sleep, rt as vectorDimFromBase64, s as EVENT_KIND_BY_CAP, st as BaseAddon, t as BaseDevice, tt as readTimelapseGeneratedAt, u as MACRO_LABELS, ut as hydrateSchema, v as NcRulePatchSchema, vt as literal, w as NcSnoozeSuppressedSchema, wt as unknown, x as NcScheduleSchema, xt as partialRecord, y as NcRuleSchema, yt as number, z as buildEventKindDescriptor } from "../dist-_D0jdUh4.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -1573,6 +1573,401 @@ var NC_ALARM_DECLARATION = {
 	DeviceClass: NcAlarmPanelDevice
 };
 //#endregion
+//#region src/notification-center/artifact-index.ts
+var NC_ARTIFACTS_COLLECTION = "notification-center:artifacts";
+var NcArtifactKindSchema = _enum([
+	"timelapse",
+	"timelapse-preview",
+	"summary-mosaic"
+]);
+/**
+* How the viewer should DRAW it. Derived from the mime once, here, so no client
+* has to carry a mime table — and so a GIF that degraded to a JPEG is drawn as
+* the JPEG it actually is.
+*/
+var NcArtifactMediaTypeSchema = _enum([
+	"image",
+	"gif",
+	"video"
+]);
+/** The relative hub path of the authenticated bytes route for an artefact id. */
+var NC_ARTIFACT_READ_PREFIX = "nc-artifact-read";
+var NcArtifactRecordSchema = object({
+	/** The `NcArtifactStore` id — the same id the bytes route resolves. */
+	id: string().min(1),
+	kind: NcArtifactKindSchema,
+	mediaType: NcArtifactMediaTypeSchema,
+	mime: string().min(1),
+	sizeBytes: number().int().nonnegative(),
+	/** When the artefact was PRODUCED. */
+	createdAt: number().int(),
+	/** What the content is ABOUT (window end / event time). The sort key: a
+	*  timelapse rendered at 06:05 is about the night before, and a list ordered
+	*  by production time puts it in the wrong morning. */
+	capturedAt: number().int(),
+	/** After this the bytes are gone. Derived from the retained shelf's own age
+	*  bound — never a second retention policy. */
+	expiresAt: number().int(),
+	/** The camera the artefact is FILED under. Null only if it belongs to none. */
+	deviceId: number().int().nullable(),
+	/** Every camera the artefact covers, for display. */
+	deviceIds: array(number().int()),
+	ruleId: string().optional(),
+	ruleName: string().optional(),
+	title: string().optional(),
+	/** A companion still for a video artefact (a timelapse's preview frame) —
+	*  what a list renders as the thumbnail. */
+	posterArtifactId: string().optional(),
+	/** RELATIVE hub path of the authenticated bytes route. Relative on purpose:
+	*  the viewer already holds the hub origin it is authenticated against, and
+	*  only the SIGNED plane needs to guess which host a stranger can reach. */
+	downloadPath: string().min(1)
+});
+var NcArtifactQuerySchema = object({
+	kinds: array(NcArtifactKindSchema).optional(),
+	deviceIds: array(number().int()).optional(),
+	ruleId: string().optional(),
+	/** Inclusive `capturedAt` window. */
+	fromMs: number().int().optional(),
+	toMs: number().int().optional(),
+	limit: number().int().min(1).max(200).default(50),
+	offset: number().int().min(0).default(0)
+});
+var NC_ARTIFACTS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "kind",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER"
+	},
+	{
+		name: "ruleId",
+		type: "TEXT"
+	},
+	(
+	/** `''` for a global artefact — see the header note on visibility. */
+	{
+		name: "ownerUserId",
+		type: "TEXT",
+		notNull: true
+	}),
+	{
+		name: "capturedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** The FULL record (Zod-validated on read) — the scalars above are indexed
+	*  projections only. */
+	{
+		name: "record",
+		type: "JSON",
+		notNull: true
+	})
+];
+var NC_ARTIFACTS_INDEXES = [
+	{
+		name: "idx_nc_artifacts_captured",
+		columns: ["capturedAt"]
+	},
+	{
+		name: "idx_nc_artifacts_device",
+		columns: ["deviceId", "capturedAt"]
+	},
+	{
+		name: "idx_nc_artifacts_kind",
+		columns: ["kind", "capturedAt"]
+	},
+	{
+		name: "idx_nc_artifacts_expires",
+		columns: ["expiresAt"]
+	}
+];
+/** Upper bound for a half-open `whereBetween` — the store has no `>=`. */
+var TIME_MAX = 864e13;
+var TIME_MIN = -864e13;
+/** Prune scan ceiling — the index is bounded by the shelf it mirrors (2000
+*  entries by default), so this only has to be comfortably above it. */
+var NC_ARTIFACT_PRUNE_SCAN_LIMIT = 2e4;
+/** `image/gif` → `gif`. Keyed on what the bytes ARE, never on what was asked
+*  for: a GIF that degraded to a still must be drawn as a still. */
+function mediaTypeForMime(mime) {
+	if (mime === "image/gif") return "gif";
+	if (mime.startsWith("video/")) return "video";
+	return "image";
+}
+/** The relative hub path an authenticated client fetches the bytes from. */
+function artifactDownloadPath(addonId, artifactId) {
+	return `/addon/${addonId}/${NC_ARTIFACT_READ_PREFIX}/${artifactId}`;
+}
+var NcArtifactIndex = class {
+	store;
+	logger;
+	addonId;
+	retentionMs;
+	now;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.addonId = deps.addonId;
+		this.retentionMs = deps.retentionMs;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: NC_ARTIFACTS_COLLECTION,
+			columns: [...NC_ARTIFACTS_COLUMNS],
+			indexes: [...NC_ARTIFACTS_INDEXES]
+		});
+	}
+	/**
+	* Record one retained artefact. Returns the row as the viewer will see it, or
+	* null when the write failed — and a failure is LOGGED, per camera: an
+	* artefact silently absent from the index reads to an operator as an artefact
+	* that was never produced.
+	*/
+	async record(input) {
+		const createdAt = this.now();
+		const record = NcArtifactRecordSchema.parse({
+			id: input.id,
+			kind: input.kind,
+			mediaType: mediaTypeForMime(input.mime),
+			mime: input.mime,
+			sizeBytes: input.sizeBytes,
+			createdAt,
+			capturedAt: input.capturedAt,
+			expiresAt: createdAt + this.retentionMs,
+			deviceId: input.deviceId,
+			deviceIds: [...input.deviceIds],
+			...input.ruleId !== void 0 ? { ruleId: input.ruleId } : {},
+			...input.ruleName !== void 0 ? { ruleName: input.ruleName } : {},
+			...input.title !== void 0 ? { title: input.title } : {},
+			...input.posterArtifactId !== void 0 ? { posterArtifactId: input.posterArtifactId } : {},
+			downloadPath: artifactDownloadPath(this.addonId, input.id)
+		});
+		try {
+			await this.store.set.mutate({
+				collection: NC_ARTIFACTS_COLLECTION,
+				key: record.id,
+				value: {
+					kind: record.kind,
+					deviceId: record.deviceId,
+					ruleId: record.ruleId ?? "",
+					ownerUserId: input.ownerUserId ?? "",
+					capturedAt: record.capturedAt,
+					expiresAt: record.expiresAt,
+					record
+				}
+			});
+			return record;
+		} catch (err) {
+			this.logger.warn("artifact not indexed — it will not appear in the viewer", {
+				...record.deviceId !== null ? { tags: { deviceId: record.deviceId } } : {},
+				meta: {
+					artifactId: record.id,
+					kind: record.kind,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+	}
+	/**
+	* One page, newest `capturedAt` first.
+	*
+	* Expiry is a PREDICATE, not a post-filter: a row whose bytes the shelf has
+	* already swept must not consume a slot of the page the caller asked for.
+	*/
+	async list(query, viewer) {
+		const filter = this.buildFilter(query, viewer);
+		try {
+			const [rows, total] = await Promise.all([this.store.query.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter: {
+					...filter,
+					orderBy: {
+						field: "capturedAt",
+						direction: "desc"
+					},
+					limit: query.limit,
+					offset: query.offset
+				}
+			}), this.store.count.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter
+			})]);
+			const artifacts = this.parseRows(rows);
+			return {
+				artifacts,
+				total,
+				hasMore: query.offset + artifacts.length < total
+			};
+		} catch (err) {
+			this.logger.warn("artifact index query failed", { meta: { error: String(err) } });
+			return {
+				artifacts: [],
+				total: 0,
+				hasMore: false
+			};
+		}
+	}
+	/**
+	* One artefact by id, or null when it does not exist, has expired, or belongs
+	* to another user. All three answer the same way ON PURPOSE — a surface that
+	* distinguishes "not yours" from "not there" tells a caller what other people
+	* own.
+	*/
+	async get(artifactId, viewer) {
+		const row = await this.readRow(artifactId);
+		if (row === null) return null;
+		if (row.record.expiresAt <= this.now()) return null;
+		if (!viewer.isAdmin && row.ownerUserId !== "" && row.ownerUserId !== viewer.userId) return null;
+		return row.record;
+	}
+	/**
+	* Resolve an id for the BYTES route — visibility-free by design.
+	*
+	* The route is served `authenticated`, so the hub has already established a
+	* principal; what this answers is only "is this id an indexed artefact, and is
+	* it still meant to exist". Per-user artefact scoping on the byte route would
+	* be a second authorization model layered on an unguessable id, and this repo
+	* has one of those already (`data-plane-access.ts`): a plane serving ONE item
+	* the caller had to be told about is `authenticated`.
+	*/
+	async resolve(artifactId) {
+		return (await this.readRow(artifactId))?.record ?? null;
+	}
+	/** One row by primary key, parsed. Null when absent or no longer valid. */
+	async readRow(artifactId) {
+		let raw;
+		try {
+			raw = await this.store.get.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				key: artifactId
+			});
+		} catch (err) {
+			this.logger.warn("artifact index lookup failed", { meta: {
+				artifactId,
+				error: String(err)
+			} });
+			return null;
+		}
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+		const row = { ...raw };
+		const parsed = NcArtifactRecordSchema.safeParse(row["record"]);
+		if (!parsed.success) return null;
+		const owner = row["ownerUserId"];
+		return {
+			record: parsed.data,
+			ownerUserId: typeof owner === "string" ? owner : ""
+		};
+	}
+	/**
+	* Drop rows whose bytes are gone, in ONE `deleteWhere` rather than an N+1
+	* drain.
+	*
+	* TWO halves, and only one of them is safe everywhere:
+	*
+	* - **Expired rows** are time-based and node-independent. Always swept.
+	* - **Orphans** — rows whose file a byte/count bound took before the age bound
+	*   did — are found by reconciling against the shelf. That reconcile is only
+	*   valid for a caller whose shelf holds the bytes for the WHOLE index, and
+	*   the index is CENTRAL while the shelf is local: a second node running this
+	*   with its own (empty) shelf would read every row as an orphan and delete
+	*   the entire library. Hence `keptIds: null` — a caller that is not the
+	*   producing node states so, and the destructive half becomes unreachable
+	*   rather than merely un-called.
+	*
+	* @param keptIds the ids the caller's shelf holds, or `null` when this node is
+	*                not the one that produces artefacts.
+	*/
+	async prune(keptIds) {
+		let removed = 0;
+		try {
+			const expired = await this.store.deleteWhere.mutate({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter: { whereBetween: { expiresAt: [TIME_MIN, this.now() - 1] } }
+			});
+			removed += expired.deleted;
+			if (keptIds === null) {
+				if (removed > 0) this.logger.debug("artifact index pruned (expired only)", { meta: { removed } });
+				return removed;
+			}
+			const alive = new Set(keptIds);
+			const orphans = (await this.store.query.query({
+				collection: NC_ARTIFACTS_COLLECTION,
+				filter: { limit: NC_ARTIFACT_PRUNE_SCAN_LIMIT }
+			})).map((r) => r.id).filter((id) => !alive.has(id));
+			for (const id of orphans) {
+				await this.store.delete.mutate({
+					collection: NC_ARTIFACTS_COLLECTION,
+					key: id
+				});
+				removed += 1;
+			}
+			if (removed > 0) this.logger.debug("artifact index pruned", { meta: {
+				removed,
+				expired: expired.deleted,
+				orphaned: orphans.length
+			} });
+			return removed;
+		} catch (err) {
+			this.logger.warn("artifact index prune failed", { meta: { error: String(err) } });
+			return removed;
+		}
+	}
+	/** The visibility predicate: a caller sees global artefacts plus his own; an
+	*  admin sees every one. */
+	visibility(viewer) {
+		if (viewer.isAdmin) return {};
+		return { whereIn: { ownerUserId: ["", viewer.userId] } };
+	}
+	buildFilter(query, viewer) {
+		const whereIn = { ...this.visibility(viewer).whereIn };
+		if (query.kinds !== void 0 && query.kinds.length > 0) whereIn["kind"] = [...query.kinds];
+		if (query.deviceIds !== void 0 && query.deviceIds.length > 0) whereIn["deviceId"] = [...query.deviceIds];
+		const whereBetween = {
+			capturedAt: [query.fromMs ?? TIME_MIN, query.toMs ?? TIME_MAX],
+			expiresAt: [this.now(), TIME_MAX]
+		};
+		return {
+			...query.ruleId !== void 0 ? { where: { ruleId: query.ruleId } } : {},
+			...Object.keys(whereIn).length > 0 ? { whereIn } : {},
+			whereBetween
+		};
+	}
+	/** Parse the JSON column, skipping rows that no longer validate. A degraded
+	*  row must never cost the whole page. */
+	parseRows(rows) {
+		const out = [];
+		let skipped = 0;
+		for (const row of rows) {
+			const parsed = NcArtifactRecordSchema.safeParse(row.data["record"]);
+			if (!parsed.success) {
+				skipped += 1;
+				continue;
+			}
+			out.push(parsed.data);
+		}
+		if (skipped > 0) this.logger.warn("artifact index rows skipped as invalid", { meta: { skipped } });
+		return out;
+	}
+};
+//#endregion
 //#region ../types/dist/node.mjs
 var node_exports = /* @__PURE__ */ __exportAll({
 	FilesystemStorageProvider: () => FilesystemStorageProvider,
@@ -1963,6 +2358,61 @@ var NcArtifactPlane = class {
 		}
 	}
 	/**
+	* Publish bytes AND file them in the viewer's browsable index (task #36).
+	*
+	* Two differences from {@link publish}, both deliberate:
+	*
+	* 1. **The bytes are stored FIRST, and stored even when no public base URL
+	*    exists.** `publish` returns early on a loopback-only install because a
+	*    signed link nobody can open is worth nothing — but the VIEWER reaches
+	*    the hub directly over its own session, so an install with no tunnel
+	*    still gets a full artifact library. Making the index depend on a
+	*    reachable public address would have made the feature absent exactly on
+	*    the installs that are LAN-only.
+	* 2. **It answers the artefact id**, so a caller can link one artefact to
+	*    another — a timelapse's poster is its preview frame, and the video row
+	*    cannot name it without knowing the id the preview got.
+	*
+	* Never throws, for the same reason `publish` does not: an artefact library
+	* is an enhancement and must never cost a notification.
+	*/
+	async publishIndexed(bytes, mime, meta) {
+		let artifactId = null;
+		try {
+			const index = this.deps.index;
+			const stored = await this.deps.store.put(bytes, mime, { retain: index !== void 0 });
+			if (index !== void 0) artifactId = (await index.record({
+				...meta,
+				id: stored.id,
+				mime,
+				sizeBytes: stored.bytes
+			}))?.id ?? null;
+			const baseUrl = await this.resolveBaseUrl();
+			return {
+				url: baseUrl === null ? null : buildArtifactUrl({
+					baseUrl,
+					routePrefix: this.deps.routePrefix,
+					id: stored.id,
+					secret: this.deps.secret,
+					expMs: this.now() + (this.deps.ttlMs ?? DEFAULT_TTL_MS)
+				}),
+				artifactId
+			};
+		} catch (err) {
+			this.deps.logger.warn("indexed artifact publish failed — shipping bytes only", {
+				...meta.deviceId !== null ? { tags: { deviceId: meta.deviceId } } : {},
+				meta: {
+					kind: meta.kind,
+					error: String(err)
+				}
+			});
+			return {
+				url: null,
+				artifactId
+			};
+		}
+	}
+	/**
 	* Absolutize a path against the SAME base URL an artifact link would use.
 	*
 	* For links this plane does not host but a RECIPIENT still has to open — a
@@ -2028,6 +2478,124 @@ var NcArtifactPlane = class {
 	}
 };
 //#endregion
+//#region src/notification-center/artifact-read-plane.ts
+/**
+* Parse a single-range `Range` header against a known length.
+*
+* Returns `null` when there is nothing to honour (absent, malformed, multi-range
+* — all of which mean "send the whole thing"), and `'unsatisfiable'` when the
+* client asked for a range that cannot exist, which is a 416 and not a 200.
+*/
+function parseByteRange(header, length) {
+	if (header === void 0) return null;
+	const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+	if (match === null) return null;
+	const rawStart = match[1] ?? "";
+	const rawEnd = match[2] ?? "";
+	if (rawStart === "" && rawEnd === "") return null;
+	if (length === 0) return "unsatisfiable";
+	if (rawStart === "") {
+		const suffix = Number(rawEnd);
+		if (suffix === 0) return "unsatisfiable";
+		return {
+			start: Math.max(0, length - suffix),
+			end: length - 1
+		};
+	}
+	const start = Number(rawStart);
+	if (start >= length) return "unsatisfiable";
+	const end = rawEnd === "" ? length - 1 : Math.min(Number(rawEnd), length - 1);
+	if (end < start) return "unsatisfiable";
+	return {
+		start,
+		end
+	};
+}
+/** The last path segment, percent-decoded. */
+function artifactIdFrom(req) {
+	const url = new URL(req.url ?? "/", "http://placeholder");
+	try {
+		return decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
+	} catch {
+		return "";
+	}
+}
+var NcArtifactReadPlane = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	handler = async (req, res) => {
+		const artifactId = artifactIdFrom(req);
+		const record = await this.deps.index.resolve(artifactId);
+		if (record === null) {
+			this.refuse(res, 404, "not found");
+			return;
+		}
+		const found = await this.deps.store.read(artifactId);
+		if (found === null) {
+			this.deps.logger.warn("artifact bytes gone — index row outlived the shelf", {
+				...record.deviceId !== null ? { tags: { deviceId: record.deviceId } } : {},
+				meta: {
+					artifactId,
+					kind: record.kind,
+					expiresAt: record.expiresAt
+				}
+			});
+			this.refuse(res, 404, "not found");
+			return;
+		}
+		if (req.method === "HEAD") {
+			res.writeHead(200, this.baseHeaders(record, found.bytes.byteLength, found.mime));
+			res.end();
+			return;
+		}
+		const range = parseByteRange(headerOf(req, "range"), found.bytes.byteLength);
+		if (range === "unsatisfiable") {
+			res.writeHead(416, {
+				"content-range": `bytes */${found.bytes.byteLength}`,
+				"content-type": "text/plain"
+			});
+			res.end("range not satisfiable");
+			return;
+		}
+		if (range === null) {
+			res.writeHead(200, this.baseHeaders(record, found.bytes.byteLength, found.mime));
+			res.end(found.bytes);
+			return;
+		}
+		const slice = found.bytes.subarray(range.start, range.end + 1);
+		res.writeHead(206, {
+			...this.baseHeaders(record, slice.byteLength, found.mime),
+			"content-range": `bytes ${range.start}-${range.end}/${found.bytes.byteLength}`
+		});
+		res.end(slice);
+	};
+	baseHeaders(record, length, mime) {
+		return {
+			"content-type": mime,
+			"content-length": String(length),
+			"accept-ranges": "bytes",
+			"cache-control": "private, max-age=3600",
+			"content-disposition": `inline; filename="${filenameFor(record)}"`
+		};
+	}
+	refuse(res, status, body) {
+		res.writeHead(status, { "content-type": "text/plain" });
+		res.end(body);
+	}
+};
+/** A name a client will accept, from what the artefact IS. */
+function filenameFor(record) {
+	const ext = record.mime === "video/mp4" ? "mp4" : record.mime === "image/gif" ? "gif" : record.mime === "image/png" ? "png" : "jpg";
+	return `${record.kind}-${record.capturedAt}.${ext}`;
+}
+function headerOf(req, name) {
+	const value = req.headers[name];
+	if (Array.isArray(value)) return value[0];
+	return value;
+}
+//#endregion
 //#region src/notification-center/artifact-store.ts
 /**
 * NcArtifactStore — the bytes behind a signed notification-artifact URL.
@@ -2042,9 +2610,25 @@ var NcArtifactPlane = class {
 * bites first, the oldest artifacts go. A sweep on boot clears whatever a crash
 * left behind — the directory is disposable by construction, so a lost file is
 * a 404 on one link, never a corrupt state.
+*
+* ## The retained shelf (`kept/`)
+*
+* Task #36 gave the viewer a browsable artifact index, and an index whose bytes
+* evaporate in six hours is an index of 404s. So a `put` may ask to be RETAINED:
+* the bytes then land on a second shelf inside the same directory with its OWN
+* three bounds (age, count, and — because a timelapse mp4 is megabytes — total
+* BYTES). It is still a scratch, just a longer one: the index row carries an
+* `expiresAt` derived from the same age bound, so "gone" is a state the viewer
+* is told about rather than a surprise 404.
+*
+* The shelf is a subdirectory ON PURPOSE. The scratch's `list()` skips
+* non-files, so the two shelves cannot sweep each other, and neither bound had
+* to learn about the other's entries.
 */
 var DEFAULT_MAX_AGE_MS = 6 * 36e5;
 var DEFAULT_MAX_ENTRIES = 500;
+/** The retained shelf's subdirectory name, inside the scratch directory. */
+var KEPT_SUBDIR = "kept";
 /** `image/jpeg` → `jpg`, so a fetched link has a name a client will accept. */
 function extensionFor(mime) {
 	if (mime === "image/jpeg") return "jpg";
@@ -2058,6 +2642,10 @@ var NcArtifactStore = class {
 	now;
 	maxAgeMs;
 	maxEntries;
+	keptMaxAgeMs;
+	keptMaxEntries;
+	keptMaxBytes;
+	keptDir;
 	/** id → mime, so the route can answer with the right content-type without
 	*  re-deriving it from the extension on every request. */
 	mimeById = /* @__PURE__ */ new Map();
@@ -2066,17 +2654,32 @@ var NcArtifactStore = class {
 		this.now = options.now ?? (() => Date.now());
 		this.maxAgeMs = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
 		this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+		this.keptMaxAgeMs = options.keptMaxAgeMs ?? 12096e5;
+		this.keptMaxEntries = options.keptMaxEntries ?? 2e3;
+		this.keptMaxBytes = options.keptMaxBytes ?? 2147483648;
+		this.keptDir = path.join(options.dir, KEPT_SUBDIR);
+	}
+	/** How long a retained artifact stays fetchable — the index's `expiresAt`
+	*  is derived from this, so the two can never disagree. */
+	get retentionMs() {
+		return this.keptMaxAgeMs;
 	}
 	/** Create the directory and sweep whatever a previous run left behind. */
 	async start() {
 		await promises.mkdir(this.options.dir, { recursive: true });
 		await this.sweep();
 	}
-	/** Persist bytes and return the artifact handle (never throws on sweep). */
-	async put(bytes, mime) {
+	/**
+	* Persist bytes and return the artifact handle (never throws on sweep).
+	*
+	* The retained shelf is created LAZILY: an install that never produces a
+	* browsable artifact keeps a directory that is empty when it is empty.
+	*/
+	async put(bytes, mime, options = {}) {
 		const id = `${this.now()}-${randomUUID()}`;
-		const file = path.join(this.options.dir, `${id}.${extensionFor(mime)}`);
-		await promises.mkdir(this.options.dir, { recursive: true });
+		const dir = options.retain === true ? this.keptDir : this.options.dir;
+		const file = path.join(dir, `${id}.${extensionFor(mime)}`);
+		await promises.mkdir(dir, { recursive: true });
 		await promises.writeFile(file, bytes);
 		this.mimeById.set(id, mime);
 		await this.sweep();
@@ -2089,7 +2692,7 @@ var NcArtifactStore = class {
 	/** Read an artifact's bytes + mime, or null when it is gone (expired/swept). */
 	async read(id) {
 		if (!/^[0-9]+-[0-9a-f-]{36}$/i.test(id)) return null;
-		const found = (await this.list()).find((e) => e.id === id);
+		const found = [...await this.list(this.options.dir), ...await this.list(this.keptDir)].find((e) => e.id === id);
 		if (!found) return null;
 		try {
 			return {
@@ -2100,6 +2703,10 @@ var NcArtifactStore = class {
 			return null;
 		}
 	}
+	/** The ids still on the retained shelf — what the index reconciles against. */
+	async keptIds() {
+		return (await this.list(this.keptDir)).map((e) => e.id);
+	}
 	/** Delete every artifact (operator cleanup / shutdown). */
 	async clear() {
 		await promises.rm(this.options.dir, {
@@ -2108,13 +2715,39 @@ var NcArtifactStore = class {
 		}).catch(() => {});
 		this.mimeById.clear();
 	}
-	/** Age- then count-bounded prune. Best-effort: a failed unlink is logged once. */
+	/** Prune both shelves under their own bounds. Best-effort: a failed unlink is
+	*  logged once and the rest of the sweep still runs. */
 	async sweep() {
-		const entries = await this.list();
-		const cutoff = this.now() - this.maxAgeMs;
+		await this.sweepShelf(await this.list(this.options.dir), {
+			maxAgeMs: this.maxAgeMs,
+			maxEntries: this.maxEntries
+		});
+		await this.sweepShelf(await this.list(this.keptDir), {
+			maxAgeMs: this.keptMaxAgeMs,
+			maxEntries: this.keptMaxEntries,
+			maxBytes: this.keptMaxBytes
+		});
+	}
+	/**
+	* Age first, then count, then total bytes — newest always survives.
+	*
+	* The newest entry is never swept by the byte bound even when it alone
+	* exceeds it: a shelf that deletes what it has just written can serve
+	* nothing, and the caller has already paid for the render.
+	*/
+	async sweepShelf(entries, bounds) {
+		const cutoff = this.now() - bounds.maxAgeMs;
 		const doomed = entries.filter((e) => e.mtimeMs < cutoff);
-		const survivors = entries.filter((e) => e.mtimeMs >= cutoff).toSorted((a, b) => b.mtimeMs - a.mtimeMs);
-		doomed.push(...survivors.slice(this.maxEntries));
+		const fresh = entries.filter((e) => e.mtimeMs >= cutoff).toSorted((a, b) => b.mtimeMs - a.mtimeMs);
+		doomed.push(...fresh.slice(bounds.maxEntries));
+		const maxBytes = bounds.maxBytes;
+		if (maxBytes !== void 0) {
+			let running = 0;
+			for (const [i, e] of fresh.slice(0, bounds.maxEntries).entries()) {
+				running += e.sizeBytes;
+				if (running > maxBytes && i > 0) doomed.push(e);
+			}
+		}
 		for (const e of doomed) try {
 			await promises.rm(e.file, { force: true });
 			this.mimeById.delete(e.id);
@@ -2125,23 +2758,24 @@ var NcArtifactStore = class {
 			} });
 		}
 	}
-	async list() {
+	async list(dir) {
 		let names;
 		try {
-			names = await promises.readdir(this.options.dir);
+			names = await promises.readdir(dir);
 		} catch {
 			return [];
 		}
 		const out = [];
 		for (const name of names) {
-			const file = path.join(this.options.dir, name);
+			const file = path.join(dir, name);
 			try {
 				const st = await promises.stat(file);
 				if (!st.isFile()) continue;
 				out.push({
 					id: name.slice(0, name.lastIndexOf(".")),
 					file,
-					mtimeMs: st.mtimeMs
+					mtimeMs: st.mtimeMs,
+					sizeBytes: st.size
 				});
 			} catch {}
 		}
@@ -2904,6 +3538,17 @@ var NcDeviceDirectory = class {
 	size() {
 		return this.devices.size;
 	}
+	/**
+	* Every identity in the current snapshot.
+	*
+	* Exists for the ONE caller that needs the whole directory rather than one
+	* id: the liveness ledger's boot seed, which has to know what every device
+	* was last known to be before the first event arrives. Off the event path by
+	* construction — it is called once, from `start()`.
+	*/
+	all() {
+		return [...this.devices.values()];
+	}
 	/** Has a refresh ever succeeded? A cold directory notifies about nothing. */
 	isWarm() {
 		return this.loadedOnce;
@@ -3307,6 +3952,43 @@ function displayLabel(state) {
 	return state.subLabel ?? state.label;
 }
 /**
+* The tiered columns a row should carry to AGREE with the track, or `undefined`
+* when the track says nothing yet.
+*
+* The projection is total: whichever tiers the track holds are copied, and a
+* track holding neither yields `undefined` rather than a patch of blanks — the
+* caller then leaves the row exactly as it was.
+*/
+function knownTrackLabelPatch(state) {
+	if (state === void 0) return void 0;
+	if (state.label === void 0 && state.subLabel === void 0) return void 0;
+	return {
+		...state.label !== void 0 ? { label: state.label } : {},
+		...state.labelScore !== void 0 ? { labelScore: state.labelScore } : {},
+		...state.labelMeta !== void 0 ? { labelMeta: state.labelMeta } : {},
+		...state.subLabel !== void 0 ? { subLabel: state.subLabel } : {},
+		...state.subLabelScore !== void 0 ? { subLabelScore: state.subLabelScore } : {},
+		...state.subLabelMeta !== void 0 ? { subLabelMeta: state.subLabelMeta } : {}
+	};
+}
+/**
+* Does this row already say what the subject IS?
+*
+* The gate behind `DetailDispatcher.hasTrackLabel`: a periodic face-detection
+* refresh on a track that already has an answer runs geometry-only and drops
+* the ArcFace embedding. It reads {@link displayLabel} and not the `label`
+* column, and the difference is the whole point — an identity is a TIER-2
+* value and lands in `subLabel`, so the column read reported "unlabelled" for
+* every track ArcFace had already named and kept re-embedding it forever,
+* while suppressing the face chain on tracks that carried only a tier-1
+* sub-class (`van`). Exactly backwards, in both directions.
+*/
+function hasResolvedLabel(state) {
+	if (state === null || state === void 0) return false;
+	const label = displayLabel(state);
+	return label !== void 0 && label.length > 0;
+}
+/**
 * The display label of a frame-path tracked detection — the same
 * `subLabel ?? label` question asked of a patch rather than a row. Used by
 * every caller that wants the caption, not the tier (media captions, lifecycle
@@ -3316,6 +3998,36 @@ function patchDisplayLabel(patch) {
 	if (patch === void 0) return void 0;
 	return patch.subLabel ?? patch.label;
 }
+/**
+* WHAT a tier-2 label is about — a recognised PERSON or a read PLATE.
+*
+* Derived from the deciding step, never stored a second time: the step that
+* wrote the value is already on the attribution, and a second column stating
+* the same thing is a knob that can disagree with the first (D62). Both the
+* machine step and the operator override of each family are listed, because a
+* hand-assigned identity is still an identity.
+*
+* Callers use it to pick a SENTENCE: "Gianluca è arrivato" and "Veicolo AB123CD"
+* are different keys in the notification text catalog, and a single
+* `{{label}}` slot cannot word both.
+*/
+var FACE_LABEL_STEP_IDS = new Set([
+	"face-recognizer",
+	"face-embedding",
+	"operator:face-gallery"
+]);
+/** Steps whose tier-2 value is a PLATE / vehicle name. See {@link FACE_LABEL_STEP_IDS}. */
+var PLATE_LABEL_STEP_IDS = new Set(["plate-ocr", "operator:plate-gallery"]);
+/**
+* Classify a tier-2 attribution. `undefined` for an unattributed value, a
+* migrated one, or any step outside the two recognition families (a species, a
+* sub-class) — the caller then falls back to the generic labelled sentence.
+*/
+function labelKindOf(meta) {
+	if (meta === void 0) return void 0;
+	if (FACE_LABEL_STEP_IDS.has(meta.stepId)) return "identity";
+	if (PLATE_LABEL_STEP_IDS.has(meta.stepId)) return "plate";
+}
 /** Whether an attribution came from the 4g migration rather than a real step. */
 function isMigrated(meta) {
 	return meta?.stepId === MIGRATION_STEP_ID;
@@ -3371,7 +4083,8 @@ function resolveTieredLabelWrite(state, candidate) {
 	const meta = {
 		stepId: candidate.stepId,
 		...candidate.modelId !== void 0 ? { modelId: candidate.modelId } : {},
-		decidedAt: candidate.decidedAt
+		decidedAt: candidate.decidedAt,
+		...candidate.identityId !== void 0 ? { identityId: candidate.identityId } : {}
 	};
 	const incumbent = candidate.tier === 1 ? state.label : state.subLabel;
 	const incumbentScore = candidate.tier === 1 ? state.labelScore : state.subLabelScore;
@@ -3593,6 +4306,7 @@ function subjectFromObjectEvent(ev) {
 		timestamp: ev.timestamp,
 		classNames: [ev.className],
 		...displayLabel(ev) !== void 0 ? { label: displayLabel(ev) } : {},
+		...recognitionPatch(ev.subLabelMeta),
 		...ev.confidence !== void 0 ? { confidence: ev.confidence } : {},
 		zones: ev.zones ?? [],
 		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {},
@@ -3606,6 +4320,19 @@ function subjectFromObjectEvent(ev) {
 function bboxPatch(bbox) {
 	return bbox !== void 0 ? { bbox } : {};
 }
+/**
+* The recognition half of a subject, read off the tier-2 attribution: WHICH
+* gallery row and WHAT KIND of thing. Both absent on an unattributed label, so
+* every condition that depends on them fails closed for a legacy record — which
+* is why the id/name matcher keeps its name leg.
+*/
+function recognitionPatch(meta) {
+	const kind = labelKindOf(meta);
+	return {
+		...meta?.identityId !== void 0 ? { identityId: meta.identityId } : {},
+		...kind !== void 0 ? { labelKind: kind } : {}
+	};
+}
 /** Convert a normalized 0..1 track envelope (min/max) into the subject's
 *  top-left+size `BboxRect`. `undefined` in ⇒ `undefined` out (fail closed). */
 function envelopeToBbox(envelope) {
@@ -3770,6 +4497,7 @@ function subjectFromPackageEvent(ev, phase) {
 		timestamp: ev.timestamp,
 		classNames: [ev.className],
 		...displayLabel(ev) !== void 0 ? { label: displayLabel(ev) } : {},
+		...recognitionPatch(ev.subLabelMeta),
 		...ev.confidence !== void 0 ? { confidence: ev.confidence } : {},
 		zones: ev.zones ?? [],
 		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {},
@@ -3788,6 +4516,7 @@ function subjectFromTrack(track, info) {
 		timestamp: track.lastSeen,
 		classNames: track.classes && track.classes.length > 0 ? track.classes : [track.className],
 		...displayLabel(track) !== void 0 ? { label: displayLabel(track) } : {},
+		...recognitionPatch(track.subLabelMeta),
 		...info?.bestConfidence !== void 0 ? { confidence: info.bestConfidence } : {},
 		zones: track.zonesVisited,
 		trackId: track.trackId,
@@ -3823,7 +4552,7 @@ function presentConditionIds(c) {
 	if (c.zonesExclude !== void 0 && c.zonesExclude.length > 0) ids.push("zonesExclude");
 	if (c.crossing !== void 0 && c.crossing !== "enter") ids.push("crossing");
 	if (c.labelEquals !== void 0 && c.labelEquals.length > 0) ids.push("labelEquals");
-	if (c.identities !== void 0 && c.identities.length > 0) ids.push("identities");
+	if (c.identities !== void 0) ids.push("identities");
 	if (c.identitiesExclude !== void 0 && c.identitiesExclude.length > 0) ids.push("identitiesExclude");
 	if (c.minLabelConfidence !== void 0) ids.push("minLabelConfidence");
 	if (c.plates !== void 0) ids.push("plates");
@@ -3909,6 +4638,70 @@ function toLowerSet(values) {
 	return new Set(values.map((v) => v.trim().toLowerCase()));
 }
 /**
+* Does the subject's identity appear in `scope`?
+*
+* TWO LEGS, both load-bearing, and the reason is the migration rather than
+* indecision. `scope` holds gallery ids after `NcRuleStore.load` has resolved
+* them; a name it could not resolve is left as it stands (reported, never
+* dropped), and a record written before ids reached `LabelAttribution` carries
+* a name and no id. Matching only the id would silence the first case; matching
+* only the name would re-introduce the rename bug the id exists to fix.
+*
+* The id leg is exact (a uuid has no case); the name leg is the historical
+* trim + lowercase comparison, unchanged, so a rule that matched yesterday
+* matches today.
+*/
+function matchesIdentityScope(subject, scope) {
+	if (subject.identityId !== void 0 && scope.includes(subject.identityId)) return true;
+	const label = subject.label?.trim().toLowerCase();
+	return label !== void 0 && toLowerSet(scope).has(label);
+}
+/**
+* Does this rule's match depend on RECOGNITION — a face identity or a plate
+* read — rather than on the detection alone?
+*
+* Derived from the conditions the rule already carries; nothing stores it. It
+* is what makes `waitForEnhancement` inert on a rule with nothing to wait for,
+* and what decides whether a track close owes an "…is Gianluca" follow-up.
+* `identitiesExclude` is deliberately NOT in the set: a veto is satisfied by
+* the ABSENCE of a recognition, so waiting for one would delay every
+* notification the rule exists to send.
+*/
+function ruleAwaitsRecognition(rule) {
+	return rule.conditions.identities !== void 0 || rule.conditions.plates !== void 0;
+}
+/**
+* Does this rule stop firing on the object event and fire at TRACK CLOSE?
+*
+* `waitForEnhancement` AND something to wait for AND an `immediate` delivery.
+* A `track-end` rule already fires at close, and a rule with no recognition
+* scope would be delayed for nothing — in both cases the flag is inert, and
+* that is deliberate: the operator sets one switch and the rule tells them
+* whether it applies rather than silently changing when a notification arrives.
+*
+* The consequence is stated where the flag is declared and repeated in the
+* editor: a deferred rule inherits TRACK-CLOSE semantics. Its `zones` condition
+* tests every zone the track visited, and a `crossing` condition can no longer
+* be satisfied. Nothing is remembered between the two moments — the closed
+* track IS the evaluation, so a respawn in the middle costs nothing and the
+* doorbell-mirror failure (D49) has no surface here.
+*/
+function ruleDefersToTrackEnd(rule) {
+	return rule.waitForEnhancement === true && rule.delivery === "immediate" && ruleAwaitsRecognition(rule);
+}
+/**
+* Does a track close owe this rule an "…and it was Gianluca" SECOND
+* notification?
+*
+* The mirror of {@link ruleDefersToTrackEnd}: an `immediate` recognition rule
+* that did NOT wait fired seconds before the face was confirmed, so its
+* notification is true and incomplete. The upgrade is what makes "off" an
+* honest setting rather than a silent downgrade.
+*/
+function ruleUpgradesAtTrackEnd(rule) {
+	return rule.waitForEnhancement !== true && rule.delivery === "immediate" && ruleAwaitsRecognition(rule);
+}
+/**
 * Expand each selected class id to itself PLUS its taxonomy leaf subs, so a
 * MACRO selection (`vehicle`) matches its sub classNames (`car`/`truck`) — the
 * `EVENT_TAXONOMY` tree is the SINGLE source (mirrors the timeline/filter
@@ -3974,7 +4767,9 @@ function evaluateRule(rule, subject, deviceState, zoneOwners) {
 		if (rule.conditions.occupancy !== void 0) return fail("occupancy");
 		if (rule.conditions.systemEvent !== void 0) return fail("systemEvent");
 	} else {
-		if ((rule.delivery === "immediate" ? "object-event" : rule.delivery) !== subject.kind) return fail("delivery");
+		if ((rule.delivery === "immediate" ? "object-event" : rule.delivery) !== subject.kind) {
+			if (!(subject.kind === "track-end" && ruleDefersToTrackEnd(rule))) return fail("delivery");
+		}
 		if (rule.conditions.occupancy !== void 0) return fail("occupancy");
 		if (rule.conditions.systemEvent !== void 0) return fail("systemEvent");
 		if (rule.conditions.audio !== void 0) return fail("audio");
@@ -4044,17 +4839,17 @@ function evaluateRule(rule, subject, deviceState, zoneOwners) {
 	if (c.labelEquals !== void 0 && c.labelEquals.length > 0) {
 		if (label === void 0 || !toLowerSet(c.labelEquals).has(label)) return fail("labelEquals");
 	}
-	if (c.identities !== void 0 && c.identities.length > 0) {
-		if (label === void 0 || !toLowerSet(c.identities).has(label)) return fail("identities");
+	if (c.identities !== void 0) {
+		if (!(c.identities.length > 0 ? matchesIdentityScope(subject, c.identities) : subject.labelKind === "identity")) return fail("identities");
 	}
 	if (c.identitiesExclude !== void 0 && c.identitiesExclude.length > 0) {
-		if (label !== void 0 && toLowerSet(c.identitiesExclude).has(label)) return fail("identitiesExclude");
+		if (matchesIdentityScope(subject, c.identitiesExclude)) return fail("identitiesExclude");
 	}
 	if (c.minLabelConfidence !== void 0) {
 		if (subject.labelConfidence === void 0 || subject.labelConfidence < c.minLabelConfidence) return fail("minLabelConfidence");
 	}
 	if (c.plates !== void 0) {
-		if (subject.label === void 0 || !matchesPlate(subject.label, c.plates.values, c.plates.maxDistance)) return fail("plates");
+		if (!(c.plates.values.length > 0 ? subject.label !== void 0 && matchesPlate(subject.label, c.plates.values, c.plates.maxDistance) : subject.labelKind === "plate")) return fail("plates");
 	}
 	if (c.sensorKinds !== void 0 && c.sensorKinds.length > 0) {
 		if (subject.sensorKind === void 0 || !toLowerSet(c.sensorKinds).has(subject.sensorKind.trim().toLowerCase())) return fail("sensorKinds");
@@ -4119,6 +4914,27 @@ function keysPerClass(rule, subject) {
 	if (subject.kind === "audio-event" || subject.kind === "audio-window") return true;
 	return rule.throttle.granularity === "per-class";
 }
+/**
+* The cooldown scope of ONE system event — subject AND direction.
+*
+* The `kind` is here because a cooldown is a budget for VOLUME and must never
+* be a budget for a DIRECTION. `Eventi di sistema` (60 s, `rule-device`)
+* covers `device-offline` and `device-online` together, so on 2026-08-13 a
+* camera that came back 13 s after going down had its recovery suppressed:
+* the operator kept a "camera offline" as the last word while the camera was
+* up, and — because the liveness ledger HAD advanced on the suppressed flip —
+* the next outage was a genuine flip again and arrived as what read like a
+* duplicate. Same split D62 made one level up between `device-switch:<id>` and
+* `device:<id>`, for the same reason: two facts must not share a slot and
+* cancel each other out.
+*
+* ONE authority: `cooldownKey` and the boot-time cooldown reseed
+* (`NotificationCenter.seedCooldowns`) both call this. They used to build the
+* string separately, which is how a key format drifts across a restart.
+*/
+function systemEventCooldownScope(systemEvent) {
+	return `s:${systemEvent.subject}:k:${systemEvent.kind}`;
+}
 /** Stable cooldown key per the rule's throttle scope + class granularity. */
 /**
 * Does the rule's device scope cover this subject?
@@ -4145,8 +4961,9 @@ function matchesDeviceScope(scope, subject) {
 function cooldownKey(rule, subject) {
 	const first = subject.classNames[0];
 	const classKey = keysPerClass(rule, subject) && first !== void 0 ? `:c:${first}` : "";
-	const scopeRef = subject.systemEvent !== void 0 ? `s:${subject.systemEvent.subject}` : `d:${subject.deviceId}`;
-	return rule.throttle.scope === "rule" ? `r:${rule.id}${classKey}` : `r:${rule.id}:${scopeRef}${classKey}`;
+	const scopeRef = subject.systemEvent !== void 0 ? systemEventCooldownScope(subject.systemEvent) : `d:${subject.deviceId}`;
+	const kindKey = subject.systemEvent !== void 0 ? `:k:${subject.systemEvent.kind}` : "";
+	return rule.throttle.scope === "rule" ? `r:${rule.id}${kindKey}${classKey}` : `r:${rule.id}:${scopeRef}${classKey}`;
 }
 /** True when the rule fired within its cooldown window before `now`. */
 function isCoolingDown(rule, lastFiredAt, now) {
@@ -4259,8 +5076,11 @@ var en_default = {
 	"detection.title": "{{rule}}",
 	"detection.body": "{{subject}} on {{camera}}{{inZones}}",
 	"detection.body.trackEnd": "{{subject}} on {{camera}}{{inZones}} — visit ended",
+	"detection.body.enhanced": "{{subject}} on {{camera}}{{inZones}} — now recognised",
 	"detection.subject": "{{classNoun}}",
 	"detection.subject.labelled": "{{classNoun}} ({{label}})",
+	"detection.subject.identity": "{{label}}",
+	"detection.subject.plate": "{{classNoun}} {{label}}",
 	"detection.inZones": " in {{zones}}",
 	"class.person": {
 		"one": "person",
@@ -4340,6 +5160,7 @@ var en_default = {
 	"system.camera-disabled.body": "Device {{deviceName}} was switched off",
 	"system.camera-enabled.title": "Device switched on",
 	"system.camera-enabled.body": "Device {{deviceName}} was switched back on",
+	"test.prefix": "[TEST] {{body}}",
 	"timelapse.title": "Timelapse — {{camera}}",
 	"timelapse.body.window": "{{rule}} — {{from}}→{{to}}",
 	"timelapse.body.tooManyEvents": "too many events for dense sampling: video at a uniform cadence",
@@ -4422,8 +5243,11 @@ var it_default = {
 	"detection.title": "{{rule}}",
 	"detection.body": "{{subject}} su {{camera}}{{inZones}}",
 	"detection.body.trackEnd": "{{subject}} su {{camera}}{{inZones}} — visita terminata",
+	"detection.body.enhanced": "{{subject}} su {{camera}}{{inZones}} — ora riconosciuto",
 	"detection.subject": "{{classNoun}}",
 	"detection.subject.labelled": "{{classNoun}} ({{label}})",
+	"detection.subject.identity": "{{label}}",
+	"detection.subject.plate": "{{classNoun}} {{label}}",
 	"detection.inZones": " in {{zones}}",
 	"class.person": {
 		"one": "persona",
@@ -4503,6 +5327,7 @@ var it_default = {
 	"system.camera-disabled.body": "Il dispositivo {{deviceName}} è stato spento",
 	"system.camera-enabled.title": "Dispositivo riacceso",
 	"system.camera-enabled.body": "Il dispositivo {{deviceName}} è stato riacceso",
+	"test.prefix": "[TEST] {{body}}",
 	"timelapse.title": "Timelapse — {{camera}}",
 	"timelapse.body.window": "{{rule}} — {{from}}→{{to}}",
 	"timelapse.body.tooManyEvents": "troppi eventi per il campionamento denso: video a cadenza uniforme",
@@ -4777,7 +5602,7 @@ function ncSubjectText(texts, input) {
 		vars: { classNoun }
 	});
 	return texts.text({
-		key: "detection.subject.labelled",
+		key: subjectLabelKey(input.labelKind),
 		vars: {
 			classNoun,
 			label: input.label
@@ -4785,6 +5610,16 @@ function ncSubjectText(texts, input) {
 	});
 }
 /**
+* Which labelled-subject key a recognition gets. A kind the catalog does not
+* name falls back to the generic key rather than printing nothing — the same
+* direction `ncClassNoun` degrades in, and for the same reason.
+*/
+function subjectLabelKey(kind) {
+	if (kind === "identity") return "detection.subject.identity";
+	if (kind === "plate") return "detection.subject.plate";
+	return "detection.subject.labelled";
+}
+/**
 * ` in gate, drive` — INCLUDING its leading space, and empty when there are no
 * zones.
 *
@@ -5283,13 +6118,18 @@ var NcDispatcher = class {
 			...systemCount,
 			frozen: systemEvent?.title ?? entry.payload.ruleName
 		});
-		const body = this.renderText({
+		const rendered = this.renderText({
 			template: entry.payload.template?.body,
 			key: bodyKeyFor(entry),
 			vars,
 			...systemCount,
 			...systemEvent?.body !== void 0 ? { frozen: systemEvent.body } : {}
 		});
+		const body = entry.payload.synthetic === true ? this.renderText({
+			key: "test.prefix",
+			vars: { body: rendered },
+			frozen: rendered
+		}) : rendered;
 		const attachments = [...await this.withArtifactUrls(await this.resolveAttachments(entry)), ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
 		const actions = await this.mintActions(entry, target);
@@ -5646,7 +6486,8 @@ function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
 			...detection.label !== void 0 ? { label: detection.label } : {}
 		}) : systemEvent?.subject ?? ncSubjectText(texts, {
 			className: subject.className,
-			...subject.label !== void 0 ? { label: subject.label } : {}
+			...subject.label !== void 0 ? { label: subject.label } : {},
+			...subject.labelKind !== void 0 ? { labelKind: subject.labelKind } : {}
 		}),
 		inZones: ncInZonesText(texts, zoneLabels),
 		scope: occupancy?.zone ?? deviceName,
@@ -5678,6 +6519,7 @@ function bodyKeyFor(entry) {
 	const subject = entry.payload.subject;
 	if (subject.systemEvent !== void 0) return subject.systemEvent.bodyKey ?? "";
 	if (subject.occupancy !== void 0) return "occupancy.body";
+	if (entry.payload.enhancement === true) return "detection.body.enhanced";
 	return entry.recordKind === "track-end" ? "detection.body.trackEnd" : "detection.body";
 }
 /** The default TITLE key — same shape, same pre-catalog reasoning. */
@@ -6667,6 +7509,73 @@ var NcLivenessLedger = class {
 	async load() {
 		return (await this.ledger.load()).length;
 	}
+	/**
+	* Boot seed from the DEVICE DIRECTORY — the second half of the reseed, and
+	* the fix for the outage this ledger used to swallow.
+	*
+	* ## The hole
+	*
+	* {@link load} recovers what the ledger itself accepted. A device that has
+	* never produced a liveness event since the ledger was created has no row at
+	* all, so its FIRST observation ever seeds silently — and if that first
+	* observation is the camera DYING, the outage is thrown away. Live cost,
+	* 2026-08-13 21:36 CEST: the operator unplugged four cameras and received two
+	* notifications. `device:584` and `device:587` had never spoken; their
+	* unplugging was recorded and never announced. A camera that is quiet until
+	* it dies is a camera whose death is silent, indefinitely.
+	*
+	* ## Why only the ONLINE ones
+	*
+	* The directory is the device manager's own `online` flag (D132 §3: the
+	* authority seeds the mirror at boot and stays the authority). Seeding only
+	* the devices it calls ONLINE is what makes this change one-directional:
+	*
+	*  - a row seeded `online` can only ever turn a later `device.offline` into a
+	*    notification — a true sentence about a device that just went away;
+	*  - it can NEVER turn a `device.online` into one, and that is the only shape
+	*    the 2026-08-13 notification flood (D130) ever had.
+	*
+	* A device the directory calls offline — which is also what a cold or
+	* still-settling directory would say — gets no row and keeps today's
+	* behaviour exactly. Failing toward discard, unchanged.
+	*
+	* ## D49
+	*
+	* An EXISTING row is never overwritten. The ledger is the authority for what
+	* it accepted; the directory is a mirror refreshed on a tick and may be
+	* stale. A stale `online` overwriting an accepted `offline` would make the
+	* camera's real recovery a no-flip and lose it. A failed directory read
+	* simply yields an empty list here and seeds nothing.
+	*
+	* ## Staged, not persisted
+	*
+	* The seed is DERIVED from an authority that is read again on every boot, so
+	* losing it costs nothing — the next boot re-derives it. `stage` therefore
+	* advances the mirror without a write, which matters on this hub: the
+	* pipeline-analytics runner respawns several times an hour, and persisting
+	* ~500 re-derivable rows on each respawn would offer thousands of pointless
+	* commits a day to the checkpoint lottery (D96). The first real
+	* {@link observe} flip persists through the ordinary write-behind path.
+	*
+	* Returns how many rows were seeded, so the caller can say it out loud.
+	*/
+	seedFromDirectory(identities, now) {
+		let seeded = 0;
+		for (const identity of identities) {
+			if (identity.online !== true) continue;
+			const subject = `device:${identity.deviceId}`;
+			if (this.ledger.has(subject)) continue;
+			this.ledger.stage({
+				subject,
+				state: "online",
+				kind: "device-online",
+				deviceId: identity.deviceId,
+				updatedAt: now
+			});
+			seeded += 1;
+		}
+		return seeded;
+	}
 	/** The in-RAM mirror, subject-ordered so two readers agree. */
 	snapshot() {
 		return this.ledger.snapshot().toSorted((a, b) => a.subject.localeCompare(b.subject));
@@ -7159,7 +8068,7 @@ function probeOccupancyNow(input) {
 * field for them would be a cross-package change for a sentence.
 */
 function occupancyProbeLabel(occupancy, probe, cooldownSec) {
-	const classNote = impossibleClassNote(occupancy.className);
+	const classNote = occupancyClassWarning(occupancy.className);
 	if (probe.kind === "unavailable") {
 		const reason = probe.reason === "no-snapshot" ? "no ZoneAnalytics snapshot for this camera — the condition fails closed until one arrives" : "that zone is not in the camera’s current snapshot — the condition fails closed (deleted zone?)";
 		return classNote === null ? reason : `${classNote} · ${reason}`;
@@ -7184,7 +8093,7 @@ function occupancyProbeLabel(occupancy, probe, cooldownSec) {
 * pixel-identical to an empty parking space. `byClass` is MACRO-keyed, so that
 * counter is 0 structurally and no scene can change it.
 */
-function impossibleClassNote(className) {
+function occupancyClassWarning(className) {
 	if (className === void 0 || isDetectionMacroClass(className)) return null;
 	return `⚠ “${className}” is a sub-type, not a macro class: this counter is always 0 (use ${[...DETECTION_MACRO_CLASSES].join(" / ")})`;
 }
@@ -7438,7 +8347,7 @@ var DEFAULT_DRAIN_BATCH = 20;
 var DEDUP_HYDRATE_WINDOW_MS = 168 * 36e5;
 /** Stable dedup id — the durable per-track/per-record fire guarantee. */
 function outboxEntryId(input) {
-	const dedupRef = input.trackId ?? input.recordId;
+	const dedupRef = input.dedupRef ?? input.trackId ?? input.recordId;
 	return `${input.ruleId}:${dedupRef}:${input.targetId}`;
 }
 var NcOutbox = class {
@@ -7990,7 +8899,130 @@ var NcRuleActionRunner = class {
 	}
 };
 //#endregion
+//#region src/notification-center/rule-status.ts
+/**
+* The live occupancy of the scope ONE rule counts.
+*
+* `count`/`occupied` come from the SAME probe the dry-run uses
+* (`probeOccupancyNow`), so the status and the dry-run can never disagree about
+* a camera. `since` comes from the watcher's CONFIRMED row, which is a
+* different fact and the one the operator actually asks for: the probe reads a
+* level, the watcher records when that level was last confirmed to change.
+*/
+var NcOccupancyRuleStatusSchema = object({
+	kind: literal("occupancy"),
+	deviceId: number().int(),
+	/** Zone NAME when the snapshot knows one, else the zone id, else absent for
+	*  whole-frame — the words a card puts after "in". */
+	scope: string().optional(),
+	/** The class counted; absent = every class. */
+	className: string().optional(),
+	/** The capacity the predicate compares against (`<=C` keys on C+1). */
+	threshold: number().int(),
+	sustainSeconds: number().int(),
+	/** The count read for the scope. Absent when the probe was unavailable. */
+	count: number().int().optional(),
+	/** `count >= threshold` at the probe. Absent when unavailable. */
+	occupied: boolean().optional(),
+	/** Frame time of the snapshot the count came from — how FRESH it is, which
+	*  is a different question from "now". */
+	observedAt: number().int().optional(),
+	/** When the watcher last CONFIRMED a change of this key's level. Absent when
+	*  the watcher holds no confirmed row (a cold boot, or a key nothing
+	*  watches). */
+	since: number().int().optional(),
+	/** Why there is no count: the two fail-closed shapes of the live path. */
+	unavailable: _enum(["no-snapshot", "zone-absent"]).optional(),
+	/** A scope the counter can never answer (a sub-type class) — stated, because
+	*  its reading of 0 is pixel-identical to an empty zone. */
+	warning: string().optional()
+});
+/** One camera of a timelapse rule — each renders its own video. */
+var NcTimelapseDeviceStatusSchema = object({
+	deviceId: number().int(),
+	/** Last successful generation for THIS camera (the per-device map, with the
+	*  rule-wide fallback). Absent = never generated. */
+	lastGeneratedAt: number().int().optional(),
+	/** The artefact that generation produced, when it is still on the shelf. */
+	lastArtifact: NcArtifactRecordSchema.optional(),
+	/** A render this process is waiting on right now. */
+	rendering: object({
+		startedAt: number().int(),
+		windowStartMs: number().int(),
+		windowEndMs: number().int()
+	}).optional()
+});
+var NcTimelapseRuleStatusSchema = object({
+	kind: literal("timelapse"),
+	devices: array(NcTimelapseDeviceStatusSchema),
+	/** The most recent window that has already closed — what the next tick would
+	*  render for any camera that has not got it yet. Absent = none in the
+	*  lookback (a schedule that never closes, or a rule younger than its window). */
+	lastWindow: object({
+		startMs: number(),
+		endMs: number()
+	}).optional(),
+	/** The next OPENING. `endMs` null = the close is beyond the scan horizon. */
+	nextWindow: object({
+		startMs: number(),
+		endMs: number().nullable()
+	}).optional(),
+	/** How long after a close the producer waits for the footage to settle. */
+	settleMs: number().int()
+});
+var NcRuleStatusSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("none"),
+		reason: string()
+	}),
+	NcOccupancyRuleStatusSchema,
+	NcTimelapseRuleStatusSchema
+]);
+/**
+* Assemble the occupancy status from the probe and the watcher's confirmed row.
+*
+* Pure. The two inputs are deliberately separate rather than one blob: they
+* answer different questions from different substrates, and merging them at the
+* source would let a missing snapshot erase a `since` the watcher still knows.
+*/
+function buildOccupancyStatus(input) {
+	const { condition, probe, threshold } = input;
+	const key = occupancyKey(input.deviceId, condition.zoneId, condition.className, threshold);
+	const row = input.confirmed.find((r) => r.key === key);
+	const scope = probe.kind === "probed" ? probe.zoneName ?? condition.zoneId : condition.zoneId;
+	return {
+		kind: "occupancy",
+		deviceId: input.deviceId,
+		...scope !== void 0 ? { scope } : {},
+		...condition.className !== void 0 ? { className: condition.className } : {},
+		threshold,
+		sustainSeconds: condition.sustainSeconds,
+		...probe.kind === "probed" ? {
+			count: probe.count,
+			occupied: probe.subject.occupancy?.occupied === true,
+			observedAt: probe.observedAt
+		} : { unavailable: probe.reason },
+		...row !== void 0 ? { since: row.lastChangeAt } : {},
+		...input.warning !== void 0 ? { warning: input.warning } : {}
+	};
+}
+//#endregion
 //#region src/notification-center/rule-store.ts
+/**
+* NcRuleStore — durable Notification Center rule set.
+*
+* Follows the `stationary-registry.ts` precedent: a declared SQLite
+* collection (via the central `SettingsStoreClient`) mirrored into an
+* in-memory cache. The cache serves the hot read path (per-persist rule
+* matching) with zero I/O; every mutation writes through to the store
+* FIRST and only then updates the cache (a failed persist never leaves a
+* phantom in-RAM rule).
+*
+* Cross-node note: the collection lives in the hub's centralized
+* settings-store, so a CRUD served on one node is visible to the
+* evaluating (post-processing) node after its periodic `load()` refresh —
+* bounded staleness, never wrongness (D8 reconcile-over-events).
+*/
 var NC_RULES_COLLECTION = "notification-center:rules";
 var NC_RULES_COLUMNS = [
 	{
@@ -8032,17 +9064,75 @@ var NC_RULES_INDEXES = [{
 	name: "idx_nc_rules_enabled",
 	columns: ["enabled"]
 }];
+/**
+* Resolve display names to gallery ids inside one rule's identity conditions.
+*
+* NON-DESTRUCTIVE and IDEMPOTENT, in that order of importance:
+*
+*  - a value the map answers for becomes the id;
+*  - a value it does not answer for is LEFT AS IT STANDS, not dropped. It is
+*    either already an id (the second load of a migrated rule, and every load
+*    after that), or a name the gallery no longer holds — and a rule whose
+*    scope silently shrank is exactly the failure this repo keeps paying for.
+*    The engine's name leg keeps such a value matching what it always matched;
+*    the caller reports it once.
+*  - nothing is written back. The migration is a READ projection, so a gallery
+*    that failed to load, or loaded empty, cannot rewrite a rule into one that
+*    matches nobody. The stored rule keeps the operator's words forever.
+*
+* Returns the rule unchanged (by identity) when nothing resolved, so `load`
+* can tell a migrated rule from an untouched one without comparing.
+*/
+function migrateIdentityNames(rule, idsByName) {
+	const identities = rule.conditions.identities;
+	const excluded = rule.conditions.identitiesExclude;
+	if (identities === void 0 && excluded === void 0) return {
+		rule,
+		unresolved: []
+	};
+	const unresolved = [];
+	const known = new Set(idsByName.values());
+	const resolve = (values) => values.map((value) => {
+		if (known.has(value)) return value;
+		const id = idsByName.get(value.trim().toLowerCase());
+		if (id !== void 0) return id;
+		unresolved.push(value);
+		return value;
+	});
+	const nextIdentities = identities !== void 0 ? resolve(identities) : void 0;
+	const nextExcluded = excluded !== void 0 ? resolve(excluded) : void 0;
+	if (!(nextIdentities !== void 0 && !sameList(identities ?? [], nextIdentities) || nextExcluded !== void 0 && !sameList(excluded ?? [], nextExcluded))) return {
+		rule,
+		unresolved
+	};
+	return {
+		rule: {
+			...rule,
+			conditions: {
+				...rule.conditions,
+				...nextIdentities !== void 0 ? { identities: nextIdentities } : {},
+				...nextExcluded !== void 0 ? { identitiesExclude: nextExcluded } : {}
+			}
+		},
+		unresolved
+	};
+}
+function sameList(a, b) {
+	return a.length === b.length && a.every((v, i) => v === b[i]);
+}
 var NcRuleStore = class {
 	byId = /* @__PURE__ */ new Map();
 	store;
 	logger;
 	now;
 	newId;
+	identityIdsByName;
 	constructor(deps) {
 		this.store = deps.store;
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
 		this.newId = deps.newId ?? (() => randomUUID());
+		if (deps.identityIdsByName !== void 0) this.identityIdsByName = deps.identityIdsByName;
 	}
 	static async declare(store) {
 		await store.declareCollection.mutate({
@@ -8063,24 +9153,48 @@ var NcRuleStore = class {
 				collection: NC_RULES_COLLECTION,
 				filter: { limit: 1e4 }
 			});
+			const idsByName = await this.readIdentityIds();
 			this.byId.clear();
 			let skipped = 0;
+			let migrated = 0;
+			const unresolved = /* @__PURE__ */ new Set();
 			for (const row of rows) {
 				const parsed = NcRuleSchema.safeParse(row.data["rule"]);
 				if (!parsed.success) {
 					skipped += 1;
 					continue;
 				}
-				this.byId.set(parsed.data.id, parsed.data);
+				const result = migrateIdentityNames(parsed.data, idsByName);
+				if (result.rule !== parsed.data) migrated += 1;
+				for (const name of result.unresolved) unresolved.add(name);
+				this.byId.set(result.rule.id, result.rule);
 			}
 			this.logger.debug("notification rules loaded", { meta: {
 				rules: this.byId.size,
-				...skipped > 0 ? { skippedInvalid: skipped } : {}
+				...skipped > 0 ? { skippedInvalid: skipped } : {},
+				...migrated > 0 ? { identitiesResolvedToIds: migrated } : {}
 			} });
+			if (unresolved.size > 0) this.logger.info("notification rules name identities the gallery does not know", { meta: { names: [...unresolved].join(", ") } });
 		} catch (err) {
 			this.logger.warn("notification rules load failed", { meta: { error: String(err) } });
 		}
 	}
+	/**
+	* The name→id map, lower-cased, or EMPTY when there is none to be had.
+	*
+	* Empty is the safe answer and the only one: `migrateIdentityNames` resolves
+	* nothing from an empty map and leaves every rule as the operator wrote it.
+	* A gallery read that throws must never be able to change what a rule matches.
+	*/
+	async readIdentityIds() {
+		if (this.identityIdsByName === void 0) return /* @__PURE__ */ new Map();
+		try {
+			return await this.identityIdsByName();
+		} catch (err) {
+			this.logger.debug("identity gallery read failed — rules left unmigrated", { meta: { error: String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
 	list() {
 		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
 	}
@@ -8984,6 +10098,47 @@ function findLastClosedWindow(input) {
 	};
 	return null;
 }
+/**
+* The next window that will OPEN after `nowMs`, and when it closes.
+*
+* The forward twin of {@link findLastClosedWindow}, and the answer to the only
+* question an operator has about a timelapse rule that produced nothing yet:
+* "when is it going to run?". Standing INSIDE a window reports the NEXT one,
+* not the current one — the current one's boundaries are already answerable
+* from the last close, and reporting "next: now" would read as a render that is
+* owed.
+*
+* Derived by scanning `isScheduleActive` for the same reason the backwards scan
+* is: that function is the authority on what a window means (midnight crossing,
+* `invert`, IANA timezone), and a second implementation of it is drift this
+* repo has already paid for.
+*
+* @returns `null` for an always-active schedule (it never opens — it never
+*   closed either), and for one with no opening inside the lookahead. A window
+*   whose CLOSE falls beyond the horizon is reported with `endMs: null`: the
+*   opening is the fact the operator asked for, and clamping the close to the
+*   scan floor would report a window that ends when the scan gave up.
+*/
+function findNextWindowOpen(input) {
+	const step = Math.max(1e3, input.stepMs ?? 6e4);
+	const from = Math.floor(input.nowMs / step) * step;
+	const ceiling = input.nowMs + input.lookaheadMs;
+	const active = (t) => isScheduleActive(input.schedule, t);
+	let startMs = null;
+	for (let t = from; t + step <= ceiling; t += step) if (!active(t) && active(t + step)) {
+		startMs = t + step;
+		break;
+	}
+	if (startMs === null) return null;
+	for (let t = startMs; t + step <= ceiling; t += step) if (!active(t + step)) return {
+		startMs,
+		endMs: t + step
+	};
+	return {
+		startMs,
+		endMs: null
+	};
+}
 /** The canvas behind a tile whose aspect does not fill its cell. */
 var MOSAIC_BACKGROUND = {
 	r: 17,
@@ -9615,11 +10770,23 @@ var NcSummaryProducer = class {
 		this.tickMs = deps.tickMs ?? 6e4;
 		this.texts = deps.texts ?? new NcTextCatalog();
 	}
+	/**
+	* Boot: arm the interval, then fire the back-fill tick WITHOUT waiting on it.
+	*
+	* Same contract as the timelapse producer, and for the same reason: a digest
+	* tick renders a mosaic and publishes it, so awaiting it here would hold
+	* `NotificationCenter.start()` → the addon's `initialize()` → the runner's
+	* capability manifest. `start()` resolving means the producer is running,
+	* never that the back-fill has finished. See `timelapse-scheduler.start()`
+	* for the incident this pins.
+	*/
 	async start() {
-		await this.tick();
 		this.timer = setInterval(() => {
 			this.tick();
 		}, this.tickMs);
+		this.tick().catch((err) => {
+			this.deps.logger.warn("summary back-fill tick failed", { meta: { error: String(err) } });
+		});
 	}
 	stop() {
 		if (this.timer !== null) {
@@ -10005,7 +11172,15 @@ var NcSummaryProducer = class {
 		}
 		const bytes = new Uint8Array(rendered.jpeg.byteLength);
 		bytes.set(rendered.jpeg);
-		const url = await this.deps.publish(bytes, "image/jpeg");
+		const { url } = await this.deps.publish(bytes, "image/jpeg", {
+			kind: "summary-mosaic",
+			deviceId: rule.deviceIds[0] ?? null,
+			deviceIds: [...new Set(tiles.map((t) => t.candidate.deviceId))],
+			capturedAt: window.endMs,
+			ruleId: rule.id,
+			ruleName: rule.name,
+			...rule.ownerUserId !== void 0 ? { ownerUserId: rule.ownerUserId } : {}
+		});
 		if (url === null) {
 			this.deps.logger.warn("summary mosaic not published: no reachable public endpoint", { meta: { ruleId: rule.id } });
 			return {
@@ -10538,7 +11713,9 @@ var NcTestEventInputSchema = object({
 		"device-event",
 		"package-event",
 		"audio-event",
-		"occupancy-event"
+		"audio-window",
+		"occupancy-event",
+		"system-event"
 	]),
 	/** The CAMERA the event is attributed to (what a notification shows). */
 	deviceId: number().int(),
@@ -10594,6 +11771,47 @@ var NcTestEventInputSchema = object({
 		occupied: boolean(),
 		threshold: number().int().min(1)
 	}).optional(),
+	/**
+	* AUDIO-WINDOW: the confirmed sampling window.
+	*
+	* Every field of the engine's {@link NcAudioWindowSubject}, because
+	* `matchesAudio` pairs a rule to the window that BELONGS to it — the spec
+	* fields (`samplingSeconds`, `dbThreshold`, `specLabels`) are compared for
+	* equality, so a window built from anything but the rule's own condition
+	* fails closed and the test would report a rule that works as broken.
+	*/
+	audioWindow: object({
+		hitPercent: number().min(0).max(100),
+		samplingSeconds: number().int().min(1).max(300),
+		samples: number().int().min(0),
+		hits: number().int().min(0),
+		dbThreshold: number().optional(),
+		peakDbfs: number().optional(),
+		specLabels: array(string().min(1)).optional(),
+		labels: array(string().min(1)).default([])
+	}).optional(),
+	/**
+	* SYSTEM-EVENT: the normalized infrastructure event.
+	*
+	* The catalog KEYS travel, never the sentence — exactly as the live intake
+	* freezes them (`event-intake.ts`), so a tested system notification is
+	* worded by the same text catalog, in the same language, as the real one. A
+	* tester that froze English prose here would be testing its own prose.
+	*/
+	systemEvent: object({
+		kind: NcSystemEventKindSchema,
+		/** The dedup subject (`device:617`, `node:agent-1`, …). */
+		subject: string().min(1),
+		titleKey: string().min(1),
+		bodyKey: string().min(1),
+		textParams: record(string(), string()).default({}),
+		/** The device the event is ABOUT; absent = an event with no device. */
+		deviceId: number().int().optional(),
+		/** `DeviceType` value — what a `deviceTypes` condition is judged against. */
+		deviceType: string().min(1).optional(),
+		nodeId: string().min(1).optional(),
+		packageName: string().min(1).optional()
+	}).optional(),
 	/** The instant the event happened. Absent = now. Set it to test a schedule
 	*  condition without waiting for the hour. */
 	timestamp: number().int().optional(),
@@ -10681,6 +11899,12 @@ function isSyntheticId(id) {
 function triggerCanCarryStill(kind) {
 	return kind === "object-event" || kind === "package-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event";
 }
+/** The detection provenance production stamps on a subject of this kind. */
+function syntheticSource(kind) {
+	if (kind === "device-event") return "sensor";
+	if (kind === "audio-window") return "audio";
+	return "pipeline";
+}
 /**
 * Build the synthetic envelope. Pure: same input + same id + same clock ⇒ same
 * event, so the red-green test can assert that this subject and a
@@ -10694,7 +11918,7 @@ function buildSyntheticEvent(input, recordId, now) {
 		subject: {
 			kind,
 			recordId,
-			deviceId: input.deviceId,
+			deviceId: kind === "system-event" ? 0 : input.deviceId,
 			...input.sourceDeviceId !== void 0 && input.sourceDeviceId !== input.deviceId ? { sourceDeviceId: input.sourceDeviceId } : {},
 			timestamp,
 			classNames: input.classNames,
@@ -10702,7 +11926,7 @@ function buildSyntheticEvent(input, recordId, now) {
 			...input.confidence !== void 0 ? { confidence: input.confidence } : {},
 			zones: input.zones,
 			...carriesTrackId ? { trackId: recordId } : {},
-			source: input.source ?? (kind === "device-event" ? "sensor" : "pipeline"),
+			source: input.source ?? syntheticSource(kind),
 			...input.importance !== void 0 ? { importance: input.importance } : {},
 			...input.dwellSeconds !== void 0 ? { dwellSeconds: input.dwellSeconds } : {},
 			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
@@ -10711,6 +11935,28 @@ function buildSyntheticEvent(input, recordId, now) {
 			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
 			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
 			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
+			...input.audioWindow !== void 0 ? { audioWindow: {
+				hitPercent: input.audioWindow.hitPercent,
+				samplingSeconds: input.audioWindow.samplingSeconds,
+				samples: input.audioWindow.samples,
+				hits: input.audioWindow.hits,
+				...input.audioWindow.dbThreshold !== void 0 ? { dbThreshold: input.audioWindow.dbThreshold } : {},
+				...input.audioWindow.peakDbfs !== void 0 ? { peakDbfs: input.audioWindow.peakDbfs } : {},
+				...input.audioWindow.specLabels !== void 0 ? { specLabels: input.audioWindow.specLabels } : {},
+				labels: input.audioWindow.labels
+			} } : {},
+			...input.systemEvent !== void 0 ? { systemEvent: {
+				kind: input.systemEvent.kind,
+				subject: input.systemEvent.subject,
+				titleKey: input.systemEvent.titleKey,
+				bodyKey: input.systemEvent.bodyKey,
+				textParams: input.systemEvent.textParams,
+				...input.systemEvent.deviceId !== void 0 ? { deviceId: input.systemEvent.deviceId } : {},
+				...input.systemEvent.deviceType !== void 0 ? { deviceType: input.systemEvent.deviceType } : {},
+				...input.systemEvent.nodeId !== void 0 ? { nodeId: input.systemEvent.nodeId } : {},
+				...input.systemEvent.packageName !== void 0 ? { packageName: input.systemEvent.packageName } : {},
+				data: { category: "synthetic.test" }
+			} } : {},
 			...input.occupancy !== void 0 ? { occupancy: {
 				...input.occupancy.zoneId !== void 0 ? { zoneId: input.occupancy.zoneId } : {},
 				...input.occupancy.zoneName !== void 0 ? { zoneName: input.occupancy.zoneName } : {},
@@ -10999,7 +12245,7 @@ function unknownNcTextKeys(keys, bundles = NC_TEXT_BUNDLES) {
 * durable document stays the sparse map its schema describes.
 */
 function applyNcTextOverridePatch(current, language, patch) {
-	const next = { ...current[language] ?? {} };
+	const next = { ...current[language] };
 	for (const [key, value] of Object.entries(patch)) {
 		if (value === null || value.trim().length === 0) {
 			delete next[key];
@@ -11369,6 +12615,84 @@ function planDenseRanges(input) {
 		denseSec
 	};
 }
+function newGroup(event) {
+	const classCounts = /* @__PURE__ */ new Map();
+	if (event.className !== void 0) classCounts.set(event.className, 1);
+	return {
+		...event.trackId !== void 0 ? { trackId: event.trackId } : {},
+		firstSeen: event.timestamp,
+		lastSeen: event.timestamp,
+		classCounts
+	};
+}
+function absorb(group, event) {
+	if (event.timestamp < group.firstSeen) group.firstSeen = event.timestamp;
+	if (event.timestamp > group.lastSeen) group.lastSeen = event.timestamp;
+	if (event.className === void 0) return;
+	group.classCounts.set(event.className, (group.classCounts.get(event.className) ?? 0) + 1);
+}
+/** The class most rows agreed on; ties go to whichever appeared first, so the
+*  same window always produces the same sentence. */
+function dominantClass(group) {
+	let best;
+	let bestCount = 0;
+	for (const [className, count] of group.classCounts) if (count > bestCount) {
+		best = className;
+		bestCount = count;
+	}
+	return best;
+}
+function toInterval(group) {
+	const className = dominantClass(group);
+	return {
+		...group.trackId !== void 0 ? { trackId: group.trackId } : {},
+		firstSeen: group.firstSeen,
+		lastSeen: group.lastSeen,
+		...className !== void 0 ? { className } : {}
+	};
+}
+/**
+* Fold persisted tracks and object events into one subject-per-entry array.
+*
+* @returns intervals sorted by `firstSeen` ascending. A persisted track is
+*   returned unchanged and its own events are discarded: the store knows when
+*   the track really began, the events only know when the emitter chose to
+*   write one, and widening a persisted interval from event timestamps would
+*   move a range boundary for no operator-visible gain.
+*/
+function mergeDetectionIntervals(input) {
+	const gapMs = Math.max(0, input.tracklessGapMs ?? 1e4);
+	const persistedIds = /* @__PURE__ */ new Set();
+	for (const track of input.tracks) if (track.trackId !== void 0) persistedIds.add(track.trackId);
+	const ordered = input.events.toSorted((a, b) => a.timestamp - b.timestamp);
+	const byTrackId = /* @__PURE__ */ new Map();
+	const trackless = [];
+	const openByClass = /* @__PURE__ */ new Map();
+	for (const event of ordered) {
+		const trackId = event.trackId;
+		if (trackId !== void 0) {
+			if (persistedIds.has(trackId)) continue;
+			const existing = byTrackId.get(trackId);
+			if (existing === void 0) byTrackId.set(trackId, newGroup(event));
+			else absorb(existing, event);
+			continue;
+		}
+		const key = event.className ?? "";
+		const open = openByClass.get(key);
+		if (open !== void 0 && event.timestamp - open.lastSeen <= gapMs) {
+			absorb(open, event);
+			continue;
+		}
+		const group = newGroup(event);
+		trackless.push(group);
+		openByClass.set(key, group);
+	}
+	return [
+		...input.tracks,
+		...[...byTrackId.values()].map(toInterval),
+		...trackless.map(toInterval)
+	].toSorted((a, b) => a.firstSeen - b.firstSeen);
+}
 //#endregion
 //#region src/notification-center/timelapse/footage-coverage.ts
 /**
@@ -11421,8 +12745,6 @@ function footageCoverage(ranges, windowStartMs, windowEndMs) {
 		complete: windowMs - coveredMs <= COVERAGE_COMPLETE_SLACK_MS
 	};
 }
-/** How long a scheduled timelapse's file is kept by the export engine. */
-var TIMELAPSE_EXPORT_LIFE_MS = 7 * 864e5;
 var TimelapseRenderError = class extends Error {
 	reason;
 	constructor(reason, message) {
@@ -11450,8 +12772,79 @@ function pickProfile(ranges, window) {
 	}
 	return best;
 }
-/** `HH:MM`, for the export title an operator sees in the exports list. */
-function clockOf$1(atMs) {
+/**
+* Is `record` the render this request is about to order?
+*
+* The range, the source profile and the BASE cadence must match exactly — those
+* three decide what the video is. The dense overlay deliberately does NOT: it
+* is derived from the tracks the window happened to hold, and a retry minutes
+* later plans it from a slightly longer list. Refusing to adopt over a moved
+* range boundary would re-order the whole ten hours for a difference nobody can
+* see, which is precisely the loop this exists to break.
+*/
+function coversTheSameRender(record, want) {
+	const timelapse = record.options.timelapse;
+	if (timelapse === void 0) return false;
+	return record.profile === want.profile && record.fromMs === want.fromMs && record.toMs === want.toMs && timelapse.everyMs === want.everyMs && timelapse.outputFps === want.outputFps;
+}
+/**
+* Would adopting `record` LOSE the slowdown this render planned?
+*
+* The adoption check deliberately ignores the dense RANGES (a retry plans them
+* from a slightly longer track list, and re-ordering ten hours over a moved
+* boundary is the loop adoption exists to break). It must NOT ignore whether a
+* dense overlay exists at all.
+*
+* The failure this closes: attempt one reads the detections while the store is
+* unreachable, plans nothing, and queues a UNIFORM ten-hour export; every retry
+* then plans ranges correctly, finds that uniform export alive under the same
+* (profile, range, base cadence, fps) key, adopts it, and delivers a video that
+* never slows down — for the whole night, no matter how many retries run. The
+* notification would even caption it "2 persone". A re-order costs ~20 min of
+* ffmpeg ONCE; adopting the wrong product costs the night.
+*
+* Bounded, and that is why it is safe: the verdict is a function of the plan, so
+* the export ordered after a refusal carries the dense overlay and the NEXT
+* retry adopts it. Only a plan that changed direction refuses, never a retry.
+* A candidate DENSER than what we want is adopted — more slowdown than asked is
+* not a defect, and refusing it would re-order for nothing.
+*/
+function keepsThePlannedSlowdown(record, want) {
+	if (want === void 0) return true;
+	const dense = record.options.timelapse?.dense;
+	if (dense === void 0 || dense.ranges.length === 0) return false;
+	return dense.everyMs <= want.everyMs;
+}
+/** Can this row still become — or already be — a file we can fetch? */
+function isAdoptable(record, nowMs) {
+	if (record.expiresAt <= nowMs) return false;
+	if (record.state === "ready") return record.fileBytes !== null;
+	return record.state === "queued" || record.state === "rendering";
+}
+/**
+* `HH:MM` in the RULE's timezone, for the export title an operator reads.
+*
+* The zone is not decoration. The hub container runs on UTC while the operator
+* and every one of his schedules run on Europe/Rome, so the host-local
+* derivation this used to do titled a 21:00→07:00 window `19:00→05:00` — two
+* hours off, on the one string whose whole job is to say which night the file
+* is. The window boundaries themselves were always correct: `isScheduleActive`
+* has resolved minutes through `schedule.timezone` from the start, and only the
+* label lied.
+*
+* An absent or unknown IANA name falls back to the host zone, which is exactly
+* what `localDayMinute` does for the same input — one behaviour for a bad
+* zone, not two.
+*/
+function clockOf$1(atMs, timeZone) {
+	if (timeZone !== void 0) try {
+		return new Intl.DateTimeFormat("en-GB", {
+			timeZone,
+			hour: "2-digit",
+			minute: "2-digit",
+			hourCycle: "h23"
+		}).format(new Date(atMs));
+	} catch {}
 	const d = new Date(atMs);
 	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
@@ -11483,12 +12876,25 @@ var TimelapseRenderer = class {
 			});
 			throw new TimelapseRenderError("no-footage", `no footage for ${deviceId} in ${window.startMs}..${window.endMs}`);
 		}
-		const tracks = await this.ports.listTracks({
+		const [tracks, events] = await Promise.all([this.ports.listTracks({
+			deviceId,
+			since: window.startMs,
+			until: window.endMs
+		}).catch((err) => {
+			this.ports.logger.warn("timelapse track read failed — dense plan degraded", {
+				tags,
+				meta: {
+					ruleId: request.ruleId,
+					error: String(err)
+				}
+			});
+			return [];
+		}), this.ports.listDetectionEvents({
 			deviceId,
 			since: window.startMs,
 			until: window.endMs
 		}).catch((err) => {
-			this.ports.logger.warn("timelapse dense plan unavailable — rendering uniform", {
+			this.ports.logger.warn("timelapse detection-event read failed — dense plan degraded", {
 				tags,
 				meta: {
 					ruleId: request.ruleId,
@@ -11496,13 +12902,17 @@ var TimelapseRenderer = class {
 				}
 			});
 			return [];
+		})]);
+		const subjects = mergeDetectionIntervals({
+			tracks,
+			events
 		});
 		const detections = countDetections({
-			tracks,
+			tracks: subjects,
 			...request.reportClasses !== void 0 ? { reportClasses: request.reportClasses } : {}
 		});
 		const plan = planDenseRanges({
-			tracks,
+			tracks: subjects,
 			windowStartMs: window.startMs,
 			windowEndMs: window.endMs,
 			padSec: 5,
@@ -11535,16 +12945,25 @@ var TimelapseRenderer = class {
 				mergedRanges: plan.mergedCount
 			}
 		});
-		const queued = await this.ports.createExport({
+		const adopted = await this.findAdoptable({
+			deviceId,
+			profile: chosen.profile,
+			fromMs: window.startMs,
+			toMs: window.endMs
+		}, {
+			everyMs,
+			outputFps: request.framerate
+		}, dense, tags);
+		const queued = adopted ?? await this.ports.createExport({
 			deviceId,
 			profile: chosen.profile,
 			fromMs: window.startMs,
 			toMs: window.endMs,
 			options: {
 				includeAudio: false,
-				maxLifeMs: TIMELAPSE_EXPORT_LIFE_MS,
+				maxLifeMs: 6048e5,
 				deleteAfterDownload: false,
-				title: `${request.ruleName} ${clockOf$1(window.startMs)}→${clockOf$1(window.endMs)}`,
+				title: `${request.ruleName} ${clockOf$1(window.startMs, request.timezone)}→${clockOf$1(window.endMs, request.timezone)}`,
 				timelapse: {
 					everyMs,
 					outputFps: request.framerate,
@@ -11552,7 +12971,7 @@ var TimelapseRenderer = class {
 				}
 			}
 		});
-		this.ports.logger.info("timelapse export queued", {
+		this.ports.logger.info(adopted === null ? "timelapse export queued" : "timelapse export adopted", {
 			tags,
 			meta: {
 				ruleId: request.ruleId,
@@ -11563,11 +12982,15 @@ var TimelapseRenderer = class {
 				denseSource: cadence.source,
 				denseDwellApplied: cadence.dwellApplied,
 				denseRanges: plan.ranges.length,
-				coveragePct: chosen.coverage.percent
+				denseTracks: tracks.length,
+				denseEvents: events.length,
+				denseSubjects: subjects.length,
+				coveragePct: chosen.coverage.percent,
+				...adopted !== null ? { adoptedState: adopted.state } : {}
 			}
 		});
 		const finished = await this.awaitReady(queued, tags);
-		const published = await this.publish(finished.id, deviceId, tags, request.previewText, request.previewMode ?? "image");
+		const published = await this.publish(finished.id, request, tags);
 		const downloadUrl = await this.ports.resolveDownloadUrl?.({ exportId: finished.id }).catch(() => null);
 		return {
 			exportId: finished.id,
@@ -11581,14 +13004,79 @@ var TimelapseRenderer = class {
 			fileBytes: finished.fileBytes
 		};
 	}
-	/** Poll to a terminal state, under a bound. */
+	/**
+	* The render this request would order, if the engine already owes it.
+	*
+	* Never throws: an adoption lookup that fails costs one duplicate export,
+	* which is strictly better than costing the window. It says so, though — a
+	* branch that silently drops the protection reads as "there was nothing to
+	* adopt".
+	*/
+	async findAdoptable(want, cadence, wantDense, tags) {
+		const rows = await this.ports.listExports({ deviceId: want.deviceId }).catch((err) => {
+			this.ports.logger.warn("timelapse could not check for an export already in flight", {
+				tags,
+				meta: { error: String(err) }
+			});
+			return null;
+		});
+		if (rows === null) return null;
+		const now = this.ports.now();
+		const sameRender = rows.filter((r) => isAdoptable(r, now) && coversTheSameRender(r, {
+			...want,
+			...cadence
+		}));
+		const usable = sameRender.filter((r) => keepsThePlannedSlowdown(r, wantDense));
+		if (usable.length < sameRender.length) this.ports.logger.info("timelapse refused to adopt an export with no dense overlay", {
+			tags,
+			meta: {
+				candidates: sameRender.length,
+				refused: sameRender.length - usable.length,
+				wantDenseEveryMs: wantDense?.everyMs ?? null,
+				wantDenseRanges: wantDense?.ranges.length ?? 0
+			}
+		});
+		const ready = usable.find((r) => r.state === "ready");
+		if (ready !== void 0) return ready;
+		return usable.toSorted((a, b) => a.createdAt - b.createdAt)[0] ?? null;
+	}
+	/**
+	* Poll to a terminal state, under a bound.
+	*
+	* The bound belongs to the RENDER, not to any single poll of it. A
+	* `getExport` that fails on the transport says nothing at all about the
+	* ffmpeg on the recording node — and treating it as fatal is how a finished
+	* 12.5 MB video was abandoned on 2026-08-14: one `UDS request timed out after
+	* 60000ms` at 05:10:47 threw straight out of the wait for an export that
+	* reached `ready` at 05:23:47. So a failed poll is retried until the
+	* deadline, and only a TERMINAL state the engine actually reported ends the
+	* wait early.
+	*/
 	async awaitReady(queued, tags) {
 		if (queued.state === "ready") return queued;
 		const deadline = this.ports.now() + this.timeoutMs;
 		let current = queued;
+		let pollFailures = 0;
+		let lastPollError = null;
 		while (this.ports.now() < deadline) {
 			await this.ports.sleep(this.pollMs);
-			current = await this.ports.getExport({ exportId: queued.id });
+			const polled = await this.ports.getExport({ exportId: queued.id }).catch((err) => {
+				pollFailures += 1;
+				lastPollError = String(err);
+				const entry = {
+					tags,
+					meta: {
+						exportId: queued.id,
+						pollFailures,
+						error: lastPollError
+					}
+				};
+				if (pollFailures === 1) this.ports.logger.warn("timelapse export poll failed — the render is still owed", entry);
+				else this.ports.logger.debug("timelapse export poll failed again", entry);
+				return null;
+			});
+			if (polled === null) continue;
+			current = polled;
 			if (current.state === "ready") return current;
 			if (current.state === "failed" || current.state === "expired" || current.state === "deleted") {
 				this.ports.logger.warn("timelapse export did not finish", {
@@ -11607,10 +13095,12 @@ var TimelapseRenderer = class {
 			meta: {
 				exportId: queued.id,
 				timeoutMs: this.timeoutMs,
-				lastState: current.state
+				lastState: current.state,
+				pollFailures,
+				...lastPollError !== null ? { lastPollError } : {}
 			}
 		});
-		throw new TimelapseRenderError("export-timeout", `export ${queued.id} timed out after ${this.timeoutMs}ms`);
+		throw new TimelapseRenderError("export-timeout", `export ${queued.id} timed out after ${this.timeoutMs}ms` + (pollFailures > 0 ? ` (${pollFailures} poll failures, last: ${lastPollError})` : ""));
 	}
 	/**
 	* Mint the public link, or say why there is none.
@@ -11619,7 +13109,9 @@ var TimelapseRenderer = class {
 	* notification, not a failed window — and failing here would leave the pair
 	* unstamped and re-render the same eight hours on the next tick.
 	*/
-	async publish(exportId, deviceId, tags, previewText, previewMode) {
+	async publish(exportId, request, tags) {
+		const { deviceId, previewText } = request;
+		const previewMode = request.previewMode ?? "image";
 		const publish = this.ports.publishArtifact;
 		const none = {
 			video: null,
@@ -11639,7 +13131,11 @@ var TimelapseRenderer = class {
 				...previewText !== void 0 ? {
 					previewText,
 					previewMode
-				} : {}
+				} : {},
+				capturedAt: request.window.endMs,
+				ruleId: request.ruleId,
+				ruleName: request.ruleName,
+				...request.ownerUserId !== void 0 ? { ownerUserId: request.ownerUserId } : {}
 			});
 			if (set.video === null) this.ports.logger.warn("timelapse artifact could not be published — link-less delivery", {
 				tags,
@@ -11813,6 +13309,25 @@ function buildTimelapseOutboxInputs(input) {
 		};
 	});
 }
+//#endregion
+//#region src/notification-center/timelapse/timelapse-scheduler.ts
+/**
+* How long after a window closes before it is rendered.
+*
+* A track is persisted when it CLOSES, and a track that was open at 06:00
+* lands minutes later. Rendering at the stroke of the boundary would miss
+* exactly the tracks the dense plan is built from — the ones still moving when
+* the window ended.
+*/
+var TIMELAPSE_SETTLE_MS = 5 * 6e4;
+/**
+* How far back a tick may look for a close.
+*
+* Eight days, so a hub that was down over a long weekend still finds last
+* night. The scan short-circuits at the first close it meets, so a rule with a
+* nightly window costs about a day's worth of minute steps, not eight.
+*/
+var TIMELAPSE_LOOKBACK_MS = 8 * 864e5;
 /**
 * The earliest window CLOSE a (rule, device) pair may ever be offered.
 *
@@ -11842,10 +13357,15 @@ function buildTimelapseOutboxInputs(input) {
 function timelapseEligibilityFloor(rule, deviceId) {
 	return Math.max(readTimelapseGeneratedAt(rule, deviceId), rule.createdAt);
 }
+/** The in-flight map's key. One render per (rule, camera) pair by construction. */
+function renderFlightKey(ruleId, deviceId) {
+	return `${ruleId}:${String(deviceId)}`;
+}
 var TimelapseScheduler = class {
 	deps;
 	timer = null;
 	tickInFlight = false;
+	inFlight = /* @__PURE__ */ new Map();
 	settleMs;
 	lookbackMs;
 	tickMs;
@@ -11858,16 +13378,32 @@ var TimelapseScheduler = class {
 		this.texts = deps.texts ?? new NcTextCatalog();
 	}
 	/**
-	* Boot: one tick (the back-fill) and then the interval.
+	* Boot: arm the interval, then fire the back-fill tick WITHOUT waiting on it.
 	*
 	* The back-fill needs no special path — it IS a tick. A window that closed
 	* while the process was down is simply a window whose pair has no stamp.
+	*
+	* `start()` resolving must mean "the producer is running", never "the
+	* back-fill has finished". A back-fill tick renders video: one window can sit
+	* in `awaitReady` for the full `RENDER_TIMEOUT_MS` (30 min), once per (rule,
+	* camera) pair. Awaiting it here held `NotificationCenter.start()`, which held
+	* the addon's `initialize()`, which is what publishes the runner's capability
+	* manifest — so on 2026-08-14 a single 10-hour timelapse window took
+	* `notification-rules`, `videoclips`, `face-gallery`, `plate-gallery`,
+	* `zone-analytics`, `audio-metrics` and `pipeline-analytics` off the cluster
+	* entirely, and the admin UI answered "provider not available".
+	*
+	* `tick()` never throws for a render failure — `produce()` swallows those and
+	* leaves the pair unstamped — so the catch here only covers a store read that
+	* fails, and it must not become an unhandled rejection.
 	*/
 	async start() {
-		await this.tick();
 		this.timer = setInterval(() => {
 			this.tick();
 		}, this.tickMs);
+		this.tick().catch((err) => {
+			this.deps.logger.warn("timelapse back-fill tick failed", { meta: { error: String(err) } });
+		});
 	}
 	stop() {
 		if (this.timer !== null) {
@@ -11976,6 +13512,13 @@ var TimelapseScheduler = class {
 	*/
 	async produce(rule, deviceId, window, opts) {
 		const tags = { deviceId };
+		const flightKey = renderFlightKey(rule.id, deviceId);
+		this.inFlight.set(flightKey, {
+			ruleId: rule.id,
+			deviceId,
+			window,
+			startedAt: this.deps.now()
+		});
 		try {
 			const deviceName = await this.resolveDeviceName(deviceId);
 			const outcome = await this.deps.render({
@@ -11987,6 +13530,7 @@ var TimelapseScheduler = class {
 				framerate: rule.framerate,
 				...rule.denseCadenceSec !== void 0 ? { denseCadenceSec: rule.denseCadenceSec } : {},
 				...rule.minDwellSec !== void 0 ? { minDwellSec: rule.minDwellSec } : {},
+				...rule.schedule.timezone !== void 0 ? { timezone: rule.schedule.timezone } : {},
 				previewText: timelapsePreviewText({
 					deviceId,
 					...deviceName !== null ? { deviceName } : {},
@@ -11995,7 +13539,8 @@ var TimelapseScheduler = class {
 					...rule.previewText !== void 0 ? { text: rule.previewText } : {}
 				}),
 				previewMode: rule.previewMode,
-				...rule.reportClasses !== void 0 ? { reportClasses: rule.reportClasses } : {}
+				...rule.reportClasses !== void 0 ? { reportClasses: rule.reportClasses } : {},
+				...rule.ownerUserId !== void 0 ? { ownerUserId: rule.ownerUserId } : {}
 			});
 			const rows = buildTimelapseOutboxInputs({
 				texts: this.texts,
@@ -12058,8 +13603,15 @@ var TimelapseScheduler = class {
 				window,
 				error: err instanceof Error ? err.message : String(err)
 			};
+		} finally {
+			this.inFlight.delete(flightKey);
 		}
 	}
+	/** Renders this process currently owes, newest last. Read by the rule-status
+	*  surface; never a decision input for the scheduler itself. */
+	renderInFlight() {
+		return [...this.inFlight.values()];
+	}
 	async resolveDeviceName(deviceId) {
 		const get = this.deps.getDeviceName;
 		if (get === void 0) return null;
@@ -12471,6 +14023,14 @@ var NcZoneOwnershipCache = class {
 /** The one cap whose `trigger` the combined alarm notification joins on. */
 var ALARM_PANEL_CAP = alarmPanelCapability.name;
 /**
+* How far ahead a status may scan for the next window opening.
+*
+* Nine days rather than "as far as it takes": a weekly schedule opens within
+* seven, and a schedule that opens less often than that is one whose next run
+* is not the fact an operator is looking at a card for.
+*/
+var TIMELAPSE_LOOKAHEAD_MS = 9 * 864e5;
+/**
 * The synthetic rule id an alarm ANNOUNCEMENT is enqueued under.
 *
 * The arm announcement is addressed to the panel's own `announceTargets`, not
@@ -12654,6 +14214,44 @@ function historyRecordKind(kind) {
 function contactReadingOf(state) {
 	if (state === "open" || state === "closed") return state;
 }
+/**
+* The subject kind a persisted record kind maps to.
+*
+* `NcOutboxRecordKind` carries two kinds a rule subject never has —
+* `timelapse` and `ai-summary` are SCHEDULE boundaries, not records. They are
+* mapped to `device-event`, which is class-agnostic in `cooldownKey`, so their
+* key is the one the seeder already built for them. A switch rather than a
+* cast: a kind added to either union has to be answered for here.
+*/
+function cooldownSubjectKind(kind) {
+	switch (kind) {
+		case "timelapse":
+		case "ai-summary": return "device-event";
+		default: return kind;
+	}
+}
+/**
+* A persisted outbox row, reduced to exactly what `cooldownKey` reads.
+*
+* The point is that it reads NOTHING else: the boot-time cooldown reseed calls
+* the same builder the live path does, so the two can never address different
+* windows. Only the four fields the key is a function of are reconstructed —
+* the class (for `per-class` and audio), the subject kind (which decides
+* whether audio is keyed per class at all), the system event (subject +
+* direction) and the device.
+*/
+function cooldownSubjectFromOutbox(entry) {
+	const subject = entry.payload.subject;
+	return {
+		kind: cooldownSubjectKind(entry.recordKind),
+		recordId: entry.recordId,
+		deviceId: entry.deviceId,
+		timestamp: subject.timestamp,
+		classNames: subject.className.length > 0 ? [subject.className] : [],
+		zones: [...subject.zones],
+		...subject.systemEvent !== void 0 ? { systemEvent: subject.systemEvent } : {}
+	};
+}
 function historySystemEventKind(kind) {
 	if (kind === "alarm-arming") return "alarm-armed";
 	if (kind === "alarm-arm-refused") return "alarm-disarmed";
@@ -13117,7 +14715,8 @@ var NotificationCenter = class NotificationCenter {
 		this.now = deps.now ?? (() => Date.now());
 		this.rules = new NcRuleStore({
 			store: deps.store,
-			logger: this.logger.child("rules")
+			logger: this.logger.child("rules"),
+			...deps.identityIdsByName !== void 0 ? { identityIdsByName: deps.identityIdsByName } : {}
 		});
 		this.textStore = new NcTextCatalogStore({
 			store: deps.store,
@@ -13311,6 +14910,7 @@ var NotificationCenter = class NotificationCenter {
 		await TimelapseStore.declare(store);
 		await NcSummaryStore.declare(store);
 		await NcTextCatalogStore.declare(store);
+		await NcArtifactIndex.declare(store);
 	}
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
@@ -13490,6 +15090,120 @@ var NotificationCenter = class NotificationCenter {
 			...report.droppedBy !== void 0 ? { droppedBy: report.droppedBy } : {}
 		};
 	}
+	/**
+	* The live status of ONE detection rule — see `rule-status.ts`.
+	*
+	* `none` is a real answer, not a failure: most rule kinds have no live state
+	* a card could show, and returning an empty object would read as a read that
+	* failed. Only occupancy has one today, and it is the kind whose entire
+	* subject is a number nobody can see.
+	*/
+	async ruleStatusFor(rule) {
+		const occupancy = rule.conditions.occupancy;
+		if (occupancy === void 0) return {
+			kind: "none",
+			reason: "this rule has no live state to report"
+		};
+		const deviceId = rule.conditions.devices?.[0];
+		const read = this.deps.readOccupancySnapshots;
+		const threshold = occupancyThreshold(occupancy);
+		if (deviceId === void 0 || read === void 0) return buildOccupancyStatus({
+			deviceId: deviceId ?? 0,
+			condition: occupancy,
+			probe: {
+				kind: "unavailable",
+				reason: "no-snapshot"
+			},
+			confirmed: this.occupancyWatcher.snapshotState(),
+			threshold
+		});
+		let snapshot = null;
+		try {
+			snapshot = (await read([deviceId])).get(deviceId) ?? null;
+		} catch (err) {
+			this.logger.warn("rule status could not read the live occupancy snapshot", {
+				tags: { deviceId },
+				meta: {
+					ruleId: rule.id,
+					error: String(err)
+				}
+			});
+		}
+		const probe = probeOccupancyNow({
+			occupancy,
+			deviceId,
+			snapshot,
+			now: this.now()
+		});
+		const warning = occupancyClassWarning(occupancy.className);
+		return buildOccupancyStatus({
+			deviceId,
+			condition: occupancy,
+			probe,
+			confirmed: this.occupancyWatcher.snapshotState(),
+			threshold,
+			...warning !== null ? { warning } : {}
+		});
+	}
+	/**
+	* The live status of one TIMELAPSE rule.
+	*
+	* Three facts, and each answers a question the rule itself cannot: when each
+	* camera last produced (and the artefact it produced, while the shelf still
+	* holds it), whether a render is in flight RIGHT NOW, and when the next
+	* window opens. The window boundaries are scanned through `isScheduleActive`,
+	* the same authority the producer uses — a second reading of a schedule is
+	* how a status starts promising a run that is not coming.
+	*/
+	async timelapseStatusFor(rule, lookup) {
+		const now = this.now();
+		const flights = this.timelapseScheduler?.renderInFlight() ?? [];
+		const lastWindow = findLastClosedWindow({
+			schedule: rule.schedule,
+			nowMs: now,
+			lookbackMs: TIMELAPSE_LOOKBACK_MS
+		});
+		const nextWindow = findNextWindowOpen({
+			schedule: rule.schedule,
+			nowMs: now,
+			lookaheadMs: TIMELAPSE_LOOKAHEAD_MS
+		});
+		const devices = [];
+		for (const deviceId of rule.deviceIds) {
+			const generatedAt = readTimelapseGeneratedAt(rule, deviceId);
+			const flight = flights.find((f) => f.ruleId === rule.id && f.deviceId === deviceId);
+			const artifact = lookup === void 0 ? null : await lookup({
+				ruleId: rule.id,
+				deviceId
+			}).catch((err) => {
+				this.logger.warn("rule status could not read the timelapse artifact index", {
+					tags: { deviceId },
+					meta: {
+						ruleId: rule.id,
+						error: String(err)
+					}
+				});
+				return null;
+			});
+			devices.push({
+				deviceId,
+				...generatedAt > 0 ? { lastGeneratedAt: generatedAt } : {},
+				...artifact !== null ? { lastArtifact: artifact } : {},
+				...flight !== void 0 ? { rendering: {
+					startedAt: flight.startedAt,
+					windowStartMs: flight.window.startMs,
+					windowEndMs: flight.window.endMs
+				} } : {}
+			});
+		}
+		return {
+			kind: "timelapse",
+			devices,
+			...lastWindow !== null ? { lastWindow } : {},
+			...nextWindow !== null ? { nextWindow } : {},
+			settleMs: TIMELAPSE_SETTLE_MS
+		};
+	}
 	/** One live frame, or null. Never throws into an injection. */
 	async captureLiveStill(deviceId, deps) {
 		const capture = deps.getSnapshot;
@@ -14264,7 +15978,7 @@ var NotificationCenter = class NotificationCenter {
 			return report({ droppedBy: "muted" });
 		}
 		const delivery = deliveryForKind(kind);
-		const enabled = this.rules.listEnabled(delivery);
+		const enabled = this.rulesForTrigger(delivery, kind, subject);
 		const candidates = controls.onlyRuleId !== void 0 ? enabled.filter((r) => r.id === controls.onlyRuleId) : enabled;
 		if (candidates.length === 0) {
 			this.logger.debug("no enabled rule for this trigger", {
@@ -14276,6 +15990,7 @@ var NotificationCenter = class NotificationCenter {
 					rulesLoaded: this.rules.list().length
 				}
 			});
+			if (kind === "track-end") await this.enqueueRecognitionUpgrades(subject, outcomes);
 			return report({ droppedBy: "no-candidate-rule" });
 		}
 		const now = this.now();
@@ -14376,6 +16091,7 @@ var NotificationCenter = class NotificationCenter {
 				at: now
 			});
 			const inserted = await this.outbox.enqueue(entries);
+			this.noteRecognitionFire(rule, subject, kind, entries, inserted);
 			if (inserted > 0 && controls.bypassCooldown !== true) this.lastFiredAt.set(key, now);
 			outcomes.push({
 				ruleId: rule.id,
@@ -14389,9 +16105,124 @@ var NotificationCenter = class NotificationCenter {
 			anyMatched = true;
 		}
 		if (!anyMatched && rejections.length > 0) this.reportNoMatch(subject, kind, rejections, now);
+		if (kind === "track-end") await this.enqueueRecognitionUpgrades(subject, outcomes);
 		return report({ candidates: candidates.length });
 	}
 	/**
+	* The rules a trigger may fire, which is `listEnabled(delivery)` plus and
+	* minus exactly one thing: `waitForEnhancement`.
+	*
+	* An `immediate` rule that agreed to wait for a name is REMOVED from the
+	* object-event trigger and ADDED to the track close, because the closed track
+	* is the first record that carries the name. Both halves are needed and the
+	* removal is the load-bearing one — leaving it on the object event would fire
+	* the early, nameless notification, and the dedup key (`ruleId:trackId:target`)
+	* would then silently swallow the complete one as a duplicate. The operator
+	* would have set the switch and received exactly what they set it to avoid.
+	*
+	* The drop is REPORTED. A rule vanishing from a trigger reads as a broken rule
+	* from a log, and this repo has paid for that twice.
+	*/
+	rulesForTrigger(delivery, kind, subject) {
+		const enabled = this.rules.listEnabled(delivery);
+		if (kind === "object-event") {
+			const deferred = enabled.filter((r) => ruleDefersToTrackEnd(r));
+			if (deferred.length === 0) return enabled;
+			this.logger.debug("rules deferred to track close — waiting for recognition", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					rules: deferred.map((r) => r.name).join(", "),
+					eventId: subject.recordId,
+					...subject.trackId !== void 0 ? { trackId: subject.trackId } : {}
+				}
+			});
+			return enabled.filter((r) => !ruleDefersToTrackEnd(r));
+		}
+		if (kind === "track-end") return [...enabled, ...this.rules.listEnabled("immediate").filter((r) => ruleDefersToTrackEnd(r))];
+		return enabled;
+	}
+	/**
+	* What an `immediate` recognition rule already said about a track, kept only
+	* until that track closes.
+	*
+	* Keyed `ruleIdtrackId`, holding the targets the first push reached and
+	* the LABEL it froze. In RAM and deliberately not durable: losing it costs an
+	* upgrade, which degrades to "the operator got the first notification and not
+	* the second" — the state of the world before this feature. Making it durable
+	* would trade that for a second write on the enqueue path and a table that
+	* outlives the tracks it describes.
+	*/
+	recognitionFires = /* @__PURE__ */ new Map();
+	/** Bound on {@link recognitionFires}. A track that never closes (a crash
+	*  between its birth and its close) must not pin a row forever. */
+	static RECOGNITION_FIRE_TTL_MS = 30 * 6e4;
+	recognitionFireKey(ruleId, trackId) {
+		return `${ruleId}${trackId}`;
+	}
+	noteRecognitionFire(rule, subject, kind, entries, inserted) {
+		if (kind !== "object-event" || inserted === 0) return;
+		if (subject.trackId === void 0 || !ruleUpgradesAtTrackEnd(rule)) return;
+		const now = this.now();
+		for (const [key, held] of this.recognitionFires) if (now - held.at > NotificationCenter.RECOGNITION_FIRE_TTL_MS) this.recognitionFires.delete(key);
+		this.recognitionFires.set(this.recognitionFireKey(rule.id, subject.trackId), {
+			targetIds: entries.map((e) => e.targetId),
+			...subject.label !== void 0 ? { label: subject.label } : {},
+			at: now
+		});
+	}
+	/**
+	* Send the "…and it was Gianluca" follow-up for every rule that fired on this
+	* track WITHOUT a name and has one now.
+	*
+	* Four gates, and each one exists because its absence is a notification the
+	* operator did not ask for:
+	*
+	*  - the rule fired for this track at all (`recognitionFires`) — an upgrade
+	*    with no original is a notification about a rule that never matched;
+	*  - the track ended RECOGNISED (`labelKind`) — a person nobody could name
+	*    has nothing to add;
+	*  - the name is NEW — plates are frequently read on the first frame (0.0 s
+	*    observed), and re-sending the same word is the duplicate this whole
+	*    feature exists to avoid;
+	*  - one row per (rule, track, target), enforced by the outbox on the
+	*    `<trackId>:enhanced` dedup ref, which survives a respawn.
+	*
+	* A rule that ALREADY matched this closed track through the ordinary loop
+	* (`outcomes`) is skipped: it just sent a track-end notification carrying the
+	* name, and an upgrade would be that same sentence twice.
+	*/
+	async enqueueRecognitionUpgrades(subject, outcomes) {
+		const trackId = subject.trackId;
+		if (trackId === void 0 || subject.labelKind === void 0) return;
+		const alreadyFired = new Set(outcomes.filter((o) => o.matched).map((o) => o.ruleId));
+		for (const rule of this.rules.listEnabled("immediate")) {
+			if (!ruleUpgradesAtTrackEnd(rule) || alreadyFired.has(rule.id)) continue;
+			const key = this.recognitionFireKey(rule.id, trackId);
+			const held = this.recognitionFires.get(key);
+			if (held === void 0) continue;
+			this.recognitionFires.delete(key);
+			if (held.label === subject.label) continue;
+			const entries = this.buildEntries(rule, subject, "track-end", ["identities"], [], "pipeline", void 0, {
+				dedupRef: `${trackId}:enhanced`,
+				enhancement: true,
+				targetIds: held.targetIds
+			});
+			const inserted = await this.outbox.enqueue(entries);
+			this.logger.info("recognition upgrade — enqueueing a second notification", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					ruleId: rule.id,
+					rule: rule.name,
+					trackId,
+					was: held.label ?? "",
+					now: subject.label ?? "",
+					labelKind: subject.labelKind,
+					enqueued: inserted
+				}
+			});
+		}
+	}
+	/**
 	* Run this rule's `onTrigger` sequences for this match.
 	*
 	* Called BEFORE the cooldown gate — see the call site for why. Everything
@@ -14459,7 +16290,7 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
-	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline", cooldown) {
+	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline", cooldown, upgrade) {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
 		const isSystemEvent = kind === "system-event";
@@ -14470,11 +16301,13 @@ var NotificationCenter = class NotificationCenter {
 		const renderedZones = notificationZones(rule, subject);
 		const confirm = frozenConfirmPolicy(rule, isSystemEvent);
 		const cropZoneIds = rule.conditions.zones !== void 0 ? rule.conditions.zones.ids : rule.conditions.occupancy?.zoneId !== void 0 ? [rule.conditions.occupancy.zoneId] : void 0;
-		return [...rule.targets, ...userTargets.filter((t) => !direct.has(t.targetId))].filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
+		const allTargets = [...rule.targets, ...userTargets.filter((t) => !direct.has(t.targetId))];
+		return (upgrade !== void 0 ? allTargets.filter((t) => upgrade.targetIds.includes(t.targetId)) : allTargets).filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
 			const payload = {
 				ruleName: rule.name,
 				delivery: rule.delivery,
 				...origin === "synthetic" ? { synthetic: true } : {},
+				...upgrade !== void 0 ? { enhancement: true } : {},
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: noMedia ? "none" : mediaRule.media.attach,
@@ -14498,6 +16331,7 @@ var NotificationCenter = class NotificationCenter {
 					...alarmSource?.eventId !== void 0 ? { eventId: alarmSource.eventId } : hasEventMedia ? { eventId: subject.recordId } : {},
 					className: subject.classNames[0] ?? subject.sensorKind ?? "event",
 					...subject.label !== void 0 ? { label: subject.label } : {},
+					...subject.labelKind !== void 0 ? { labelKind: subject.labelKind } : {},
 					...subject.confidence !== void 0 ? { confidence: subject.confidence } : {},
 					zones: renderedZones,
 					timestamp: subject.timestamp,
@@ -14512,6 +16346,7 @@ var NotificationCenter = class NotificationCenter {
 				recordKind: kind === "occupancy-event" ? "device-event" : kind,
 				recordId: subject.recordId,
 				...isTrackScoped && subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
+				...upgrade !== void 0 ? { dedupRef: upgrade.dedupRef } : {},
 				payload
 			};
 		});
@@ -14604,13 +16439,26 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
-	/** Rebuild the cooldown map from persisted outbox rows (restart-proof). */
+	/**
+	* Rebuild the cooldown map from persisted outbox rows (restart-proof).
+	*
+	* The key comes from `cooldownKey` and NOWHERE else. This method used to
+	* build the string itself, and the copy had drifted: it knew the
+	* `r:<id>` / `r:<id>:d:<device>` shapes and neither the `:c:<class>` tail
+	* (`granularity: 'per-class'`, and unconditional for audio) nor — after
+	* 2026-08-14 — the `:k:<kind>` one. Every window it could not address was a
+	* window that did not survive a restart, so a per-class or audio rule
+	* re-fired immediately after every respawn despite the schema promising
+	* otherwise. `notifications.md` had carried it as a known defect since
+	* 2026-08-02 with the instruction "if you touch `cooldownKey`, fix the seeder
+	* in the same commit"; this is that commit.
+	*/
 	async seedCooldowns() {
 		const entries = await this.outbox.queryRecentPersisted(this.now() - 864e5);
 		for (const entry of entries) {
 			const rule = this.rules.get(entry.ruleId);
 			if (rule === null) continue;
-			const key = rule.throttle.scope === "rule" ? `r:${rule.id}` : entry.payload.subject.systemEvent !== void 0 ? `r:${rule.id}:s:${entry.payload.subject.systemEvent.subject}` : `r:${rule.id}:d:${entry.deviceId}`;
+			const key = cooldownKey(rule, cooldownSubjectFromOutbox(entry));
 			const prev = this.lastFiredAt.get(key) ?? 0;
 			if (entry.createdAt > prev) this.lastFiredAt.set(key, entry.createdAt);
 		}
@@ -14716,7 +16564,12 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	async hydrateLiveness() {
 		const subjects = await this.liveness.load();
-		this.logger.info("liveness ledger reseeded", { meta: { subjects } });
+		const seeded = this.liveness.seedFromDirectory(this.deviceDirectory.all(), this.now());
+		this.logger.info("liveness ledger reseeded", { meta: {
+			subjects,
+			seededFromDirectory: seeded,
+			directory: this.deviceDirectory.size()
+		} });
 	}
 	/**
 	* Say that the ledger refused a liveness event, and why.
@@ -15138,6 +16991,307 @@ var NotificationCenter = class NotificationCenter {
 	}
 };
 //#endregion
+//#region src/notification-center/rule-test-plan.ts
+/**
+* Which subject kind THIS rule fires on.
+*
+* `delivery` alone cannot answer, because two features ride an existing
+* delivery and are discriminated by a CONDITION — exactly as the engine
+* discriminates them (`rule-engine.ts`: an audio window fires only for a rule
+* declaring `conditions.audio`, an occupancy edge only for one declaring
+* `conditions.occupancy`). A third case is the LEGACY audio-class rule: an
+* `immediate` rule whose classes are all `audio-*` and which declares no
+* `audio` condition fires on a classified episode and on nothing else.
+*/
+function testTriggerForRule(rule) {
+	if (rule.delivery === "system-event") return "system-event";
+	if (rule.delivery === "track-end") return "track-end";
+	if (rule.delivery === "package-event") return "package-event";
+	if (rule.delivery === "device-event") return rule.conditions.occupancy !== void 0 ? "occupancy-event" : "device-event";
+	if (rule.conditions.audio !== void 0) return "audio-window";
+	const classes = rule.conditions.classes ?? [];
+	if (classes.length > 0 && classes.every((c) => c.trim().toLowerCase().startsWith("audio-"))) return "audio-event";
+	return "object-event";
+}
+/** Reserved device id for an event with no camera (mirrors the engine's). */
+var NC_SYSTEM_DEVICE_ID = 0;
+/** The grid a schedule is authored on — the same one `window-bounds.ts` scans. */
+var SCHEDULE_SCAN_STEP_MS = 6e4;
+/** How far back a schedule scan may look for an active minute (one week + a day). */
+var SCHEDULE_SCAN_LOOKBACK_MS = 8 * 864e5;
+/**
+* Nudge a threshold to a value that PASSES it, and that reads like something a
+* detector would produce. Clamped to 1 so a rule with a floor of 1 still gets a
+* legal value.
+*/
+function justAbove(floor) {
+	return Math.min(1, Math.round((floor + .05) * 100) / 100);
+}
+/**
+* A timestamp the rule's SCHEDULE is active at — `now` when it already is.
+*
+* Scans BACKWARDS on the schedule's own minute grid through `isScheduleActive`,
+* the single authority on what a window means (midnight crossing, `invert`,
+* IANA timezone). Backwards rather than forwards because a test must fire NOW:
+* a future instant would be a notification about something that has not
+* happened, and the outbox would deliver it immediately anyway.
+*
+* `null` when the schedule has no active minute in the lookback — a rule that
+* is currently unfireable, which is a note rather than a silent failure.
+*/
+function scheduleActiveAt(schedule, now) {
+	if (schedule === void 0) return now;
+	if (isScheduleActive(schedule, now)) return now;
+	const floor = now - SCHEDULE_SCAN_LOOKBACK_MS;
+	for (let t = now - SCHEDULE_SCAN_STEP_MS; t >= floor; t -= SCHEDULE_SCAN_STEP_MS) if (isScheduleActive(schedule, t)) return t;
+	return null;
+}
+/**
+* The bbox that satisfies a `customZones` polygon: the polygon's own bounding
+* box, clamped to the frame.
+*
+* The engine's test is `bboxPolygonOverlap(bbox, points) > 0`, and a polygon's
+* bounding box always overlaps it (a polygon with area is contained in its own
+* box). The admin simulator's centred half-frame box does NOT — a polygon drawn
+* in a corner fails it, and the operator reads a working rule as broken.
+*/
+function bboxForPolygon(points) {
+	if (points.length === 0) return void 0;
+	const xs = points.map((p) => p.x);
+	const ys = points.map((p) => p.y);
+	const minX = Math.max(0, Math.min(...xs));
+	const minY = Math.max(0, Math.min(...ys));
+	const maxX = Math.min(1, Math.max(...xs));
+	const maxY = Math.min(1, Math.max(...ys));
+	const w = Math.max(.01, maxX - minX);
+	const h = Math.max(.01, maxY - minY);
+	return {
+		x: minX,
+		y: minY,
+		w: Math.min(1 - minX, w),
+		h: Math.min(1 - minY, h)
+	};
+}
+/**
+* The window that answers an audio condition.
+*
+* Every spec field is copied from the CONDITION, because `matchesAudio`
+* compares them for equality — this is the pairing rule that stops a hub with
+* two sound rules on one camera answering one rule with the other's evidence.
+* `labels` are normalized and sorted exactly as `audioSpecFromCondition` does,
+* or the elementwise comparison fails on ordering alone.
+*/
+function audioWindowFor(condition) {
+	const labels = condition.labels !== void 0 && condition.labels.length > 0 ? [...new Set(condition.labels.map(normalizeAudioLabel))].sort() : void 0;
+	const samples = Math.max(2, condition.samplingSeconds);
+	const hits = Math.max(1, Math.ceil(samples * condition.hitPercent / 100));
+	return {
+		hitPercent: Math.min(100, Math.round(hits / samples * 100)),
+		samplingSeconds: condition.samplingSeconds,
+		samples,
+		hits,
+		...condition.dbThreshold !== void 0 ? {
+			dbThreshold: condition.dbThreshold,
+			peakDbfs: Math.min(0, condition.dbThreshold + 6)
+		} : {},
+		...labels !== void 0 ? { specLabels: labels } : {},
+		labels: labels ?? []
+	};
+}
+/**
+* The edge that satisfies an occupancy condition.
+*
+* Each op has exactly ONE edge that passes it (see `matchesOccupancy`): the
+* count arrives AT the threshold from below, falls to zero from it, or falls TO
+* the threshold from one above.
+*/
+function occupancyEdgeFor(condition) {
+	const threshold = Math.max(1, Math.round(condition.count));
+	const shared = {
+		...condition.zoneId !== void 0 ? { zoneId: condition.zoneId } : {},
+		...condition.className !== void 0 ? { className: condition.className } : {}
+	};
+	if (condition.op === "became-free") return {
+		...shared,
+		count: 0,
+		previousCount: threshold,
+		occupied: false,
+		threshold
+	};
+	if (condition.op === "<=") {
+		const count = Math.max(0, Math.round(condition.count));
+		return {
+			...shared,
+			count,
+			previousCount: count + 1,
+			occupied: false,
+			threshold: count + 1
+		};
+	}
+	return {
+		...shared,
+		count: threshold,
+		previousCount: Math.max(0, threshold - 1),
+		occupied: true,
+		threshold
+	};
+}
+/**
+* The catalog keys a synthetic system event of this kind carries.
+*
+* MIRRORS `incomingFromSystemEvent`'s key derivation, and the mirror is pinned
+* by a spec that asserts every key exists in the shipped English bundle — a key
+* nothing resolves renders an EMPTY notification, which is the one failure a
+* tester must not be able to produce. The BODY VARIANTS the intake chooses from
+* the payload (`.profiled`, `.agent`, `.onNode`) are deliberately not chosen
+* here: the plain variant is the one every kind has.
+*/
+function systemEventKeys(kind) {
+	if (kind === "node-online" || kind === "node-offline") return {
+		titleKey: `system.${kind}.title`,
+		bodyKey: `system.${kind}.body.agent`
+	};
+	if (kind === "alarm-armed" || kind === "alarm-arming" || kind === "alarm-arm-refused") return {
+		titleKey: `system.${kind}.title.${TEST_ALARM_MODE}`,
+		bodyKey: `system.${kind}.body`
+	};
+	return {
+		titleKey: `system.${kind}.title`,
+		bodyKey: `system.${kind}.body`
+	};
+}
+/** The arm mode a synthetic alarm event stands in for — see {@link systemEventKeys}. */
+var TEST_ALARM_MODE = "away";
+/** The dedup subject the live intake stamps for this kind — same families. */
+function systemEventSubject(kind, scope) {
+	if (kind === "device-disabled" || kind === "device-enabled") return `device-switch:${scope.deviceId ?? 0}`;
+	if (kind === "device-online" || kind === "device-offline") return `device:${scope.deviceId ?? 0}`;
+	if (kind === "stream-online" || kind === "stream-offline") return `stream:${scope.deviceId ?? 0}`;
+	if (kind === "node-online" || kind === "node-offline") return `node:${scope.nodeId ?? "hub"}`;
+	if (kind === "addon-update-available" || kind === "server-update-available") return `package:${scope.packageName ?? "@camstack/server"}`;
+	return `alarm:${scope.deviceId ?? 0}`;
+}
+/**
+* The class the subject carries, chosen so it PASSES the rule's class
+* conditions rather than merely existing.
+*
+* A macro selection (`vehicle`) is written verbatim: the engine expands macro →
+* leaves, so the macro itself is always in its own expansion. The exclude list
+* is then honoured — a class that is both wanted and vetoed is a rule that can
+* never fire, and the plan must not paper over it.
+*/
+function classNamesFor(conditions) {
+	const excluded = new Set((conditions.classesExclude ?? []).map((c) => c.trim().toLowerCase()));
+	const first = (conditions.classes ?? []).filter((c) => !excluded.has(c.trim().toLowerCase()))[0] ?? conditions.classes?.[0];
+	if (first !== void 0) return [first];
+	return excluded.has("person") ? [] : ["person"];
+}
+/** The label that satisfies the rule's identity / plate / label matchers. */
+function labelFor(conditions) {
+	return conditions.identities?.[0] ?? conditions.labelEquals?.[0] ?? conditions.plates?.values?.[0] ?? void 0;
+}
+/**
+* Plan the injection that fires this rule.
+*
+* Every condition the engine reads off the SUBJECT is satisfied here; the two
+* that read the world are reported in {@link NcRuleTestPlan.notes}.
+*/
+function planRuleTest(input) {
+	const { rule, now } = input;
+	const c = rule.conditions;
+	const trigger = testTriggerForRule(rule);
+	const notes = [];
+	const systemScope = {
+		...c.systemEvent?.deviceIds?.[0] !== void 0 ? { deviceId: c.systemEvent.deviceIds[0] } : {},
+		...c.systemEvent?.nodeIds?.[0] !== void 0 ? { nodeId: c.systemEvent.nodeIds[0] } : {},
+		...c.systemEvent?.packageNames?.[0] !== void 0 ? { packageName: c.systemEvent.packageNames[0] } : {}
+	};
+	const scopedDeviceId = trigger === "system-event" ? systemScope.deviceId ?? input.fallbackDeviceId ?? NC_SYSTEM_DEVICE_ID : c.devices?.[0] ?? input.fallbackDeviceId;
+	if (scopedDeviceId === void 0) notes.push({
+		conditionId: "devices",
+		note: "This rule names no camera and none was supplied, so the event is attributed to no device and carries no picture. Scope the rule to a camera, or pick one, to see the notification it would really send."
+	});
+	const deviceId = scopedDeviceId ?? NC_SYSTEM_DEVICE_ID;
+	const scheduledAt = scheduleActiveAt(rule.schedule, now);
+	if (scheduledAt === null) notes.push({
+		conditionId: "schedule",
+		note: "This rule’s weekly schedule has no active minute in the last eight days, so the test fires outside it and the schedule condition will refuse the event — exactly as it refuses every real one."
+	});
+	else if (scheduledAt !== now) notes.push({
+		conditionId: "schedule",
+		note: "The rule is outside its schedule right now, so the event is stamped with the most recent instant inside a window. The notification therefore reports a past time."
+	});
+	if (c.deviceState !== void 0) notes.push({
+		conditionId: "deviceState",
+		note: `This rule only fires while device #${c.deviceState.deviceId} is in one of its chosen states. That gate reads the REAL device and cannot be simulated — put the device in that state first, or the test fails closed exactly as production would.`
+	});
+	if (c.customZones !== void 0 && c.customZones.length > 0) notes.push({
+		conditionId: "customZones",
+		note: "The subject is placed over the first drawn polygon so the condition passes. A rule that needs a specific polygon should be checked in the simulator, where the box can be moved."
+	});
+	const zones = c.zones?.ids ?? [];
+	const label = labelFor(c);
+	const bbox = c.customZones !== void 0 && c.customZones.length > 0 ? bboxForPolygon(c.customZones[0]?.points ?? []) : void 0;
+	const audioWindow = trigger === "audio-window" && c.audio !== void 0 ? audioWindowFor(c.audio) : void 0;
+	const classNames = trigger === "audio-window" ? (audioWindow?.labels ?? []).map((l) => `audio-${l}`) : trigger === "occupancy-event" ? [c.occupancy?.className ?? "occupancy"] : trigger === "device-event" || trigger === "system-event" ? [] : classNamesFor(c);
+	const systemEventKind = c.systemEvent?.kinds[0];
+	if (trigger === "system-event" && systemEventKind === void 0) notes.push({
+		conditionId: "systemEvent",
+		note: "This rule names no system event, so nothing can be injected for it — the hub refuses such a rule at save time and the engine matches nothing."
+	});
+	return {
+		trigger,
+		input: {
+			trigger,
+			deviceId,
+			classNames: [...classNames],
+			...label !== void 0 ? { label } : {},
+			...c.minConfidence !== void 0 ? { confidence: justAbove(c.minConfidence) } : {},
+			...c.minLabelConfidence !== void 0 ? { labelConfidence: justAbove(c.minLabelConfidence) } : {},
+			...c.minImportance !== void 0 ? { importance: justAbove(c.minImportance) } : {},
+			...c.minDwellSeconds !== void 0 ? { dwellSeconds: Math.round(c.minDwellSeconds) + 1 } : {},
+			zones: [...zones],
+			...trigger === "object-event" && c.crossing === "exit" ? { crossing: {
+				zoneId: zones[0] ?? "zone",
+				direction: "exit"
+			} } : {},
+			...c.sensorKinds?.[0] !== void 0 ? { sensorKind: c.sensorKinds[0] } : {},
+			...c.eventTypeTokens?.[0] !== void 0 ? { eventType: c.eventTypeTokens[0] } : {},
+			...trigger === "package-event" ? { packagePhase: c.packagePhase === "picked-up" ? "picked-up" : "delivered" } : {},
+			...c.source !== void 0 && c.source !== "any" ? { source: c.source } : {},
+			...bbox !== void 0 ? { bbox } : {},
+			...trigger === "occupancy-event" && c.occupancy !== void 0 ? { occupancy: occupancyEdgeFor(c.occupancy) } : {},
+			...audioWindow !== void 0 ? { audioWindow } : {},
+			...trigger === "system-event" && systemEventKind !== void 0 ? { systemEvent: {
+				kind: systemEventKind,
+				subject: systemEventSubject(systemEventKind, systemScope),
+				...systemEventKeys(systemEventKind),
+				textParams: {
+					deviceId: String(systemScope.deviceId ?? deviceId),
+					deviceName: `camera ${String(systemScope.deviceId ?? deviceId)}`,
+					nodeId: systemScope.nodeId ?? "hub",
+					packageName: systemScope.packageName ?? "@camstack/server",
+					currentVersion: "0.0.0",
+					latestVersion: "0.0.0",
+					profile: "low",
+					seconds: "30"
+				},
+				...systemScope.deviceId !== void 0 ? { deviceId: systemScope.deviceId } : {},
+				...c.systemEvent?.deviceTypes?.[0] !== void 0 ? { deviceType: c.systemEvent.deviceTypes[0] } : {},
+				...systemScope.nodeId !== void 0 ? { nodeId: systemScope.nodeId } : {},
+				...systemScope.packageName !== void 0 ? { packageName: systemScope.packageName } : {}
+			} } : {},
+			timestamp: scheduledAt ?? now,
+			onlyRuleId: rule.id,
+			bypassCooldown: true,
+			bypassMute: true,
+			runActions: false,
+			still: "live"
+		},
+		notes
+	};
+}
+//#endregion
 //#region src/notification-center/nc-actions.ts
 /**
 * nc-actions — the `pipeline-analytics` rule-bridge action catalog.
@@ -15237,6 +17391,58 @@ var ncActions = defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
+	/**
+	* FIRE THIS RULE NOW — the per-rule Test button.
+	*
+	* `nc.injectTestEvent` asks the operator to describe an event; this asks the
+	* RULE. The server plans the synthetic subject from the rule's own conditions
+	* (`rule-test-plan.ts`) and hands it to exactly the same injection, so the
+	* notification travels the whole real path: `evaluateRule` → durable outbox →
+	* the ordinary drain → the ordinary media ladders → the notifier. It arrives
+	* on the phone, which is the entire point.
+	*
+	* It BYPASSES the cooldown and the per-camera mute, deliberately: the
+	* operator pressed a button and must receive the notification, not a report
+	* that a window from ten minutes ago swallowed it. Neither window is
+	* CONSUMED, so the next real fire is unaffected. It never runs the rule's
+	* action sequences — those unlock doors, and "does this notify" is not a
+	* request to open a gate.
+	*
+	* `auth: 'admin'` for the same reason as the injection it wraps: it delivers
+	* to every target the rule addresses, on other people's phones.
+	*/
+	"nc.testRule": customAction(object({
+		ruleId: string(),
+		/** The camera to attribute the event to when the rule scopes none. */
+		deviceId: number().int().optional()
+	}), NcTestEventResultSchema.extend({
+		/** The subject kind the rule was tested with — the answer to "why was my
+		*  rule not a candidate". */
+		trigger: string(),
+		/** What the plan could not reproduce (a device-state gate, a polygon). */
+		planNotes: array(object({
+			conditionId: string(),
+			note: string()
+		}))
+	}), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	/**
+	* What this rule is doing RIGHT NOW — a discriminated union per rule kind.
+	*
+	* Answers the question a rule LIST structurally cannot: an occupancy rule's
+	* subject is a live count, and a timelapse rule's output arrives hours after
+	* the window it is about. Everything returned is DERIVED from the watcher's
+	* mirror, the live snapshot and the stores — nothing is a second copy of
+	* state that could disagree with them.
+	*
+	* `caller: 'required'` and not admin-only: a personal rule's owner may read
+	* the status of their own rule, and the handler refuses a rule they cannot
+	* see rather than returning a redacted one.
+	*/
+	"nc.getRuleStatus": customAction(object({ ruleId: string() }), NcRuleStatusSchema, { caller: "required" }),
 	"nc.listTimelapseRules": customAction(object({}), object({ rules: array(NcViewerTimelapseRuleSchema) }), { caller: "required" }),
 	/**
 	* ONE action for create AND update, unlike the detection-rule pair.
@@ -15368,7 +17574,23 @@ var ncActions = defineCustomActions({
 	}), NcTextCatalogViewSchema, {
 		kind: "mutation",
 		auth: "admin"
-	})
+	}),
+	/**
+	* One page of artefacts, newest `capturedAt` first.
+	*
+	* `deviceIds` filters on the camera an artefact is FILED under. A digest
+	* spans cameras and is filed under its rule's first one (the same camera its
+	* outbox row uses); to ask "everything this digest produced" use `ruleId`.
+	*/
+	"nc.listArtifacts": customAction(NcArtifactQuerySchema, object({
+		artifacts: array(NcArtifactRecordSchema),
+		/** Rows matching the filter, not rows on this page. */
+		total: number().int().nonnegative(),
+		hasMore: boolean()
+	}), { caller: "required" }),
+	/** One artefact's metadata. `null` for unknown, expired AND not-yours alike —
+	*  a surface that distinguishes them reports what other people own. */
+	"nc.getArtifact": customAction(object({ artifactId: string().min(1) }), object({ artifact: NcArtifactRecordSchema.nullable() }), { caller: "required" })
 });
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
 function requireCaller(caller) {
@@ -15418,6 +17640,12 @@ function makeNcActionHandlers(deps) {
 		if (sum === void 0) throw new Error("this node does not host the summary producer — use the hub");
 		return sum;
 	};
+	/** The artefact index, or an honest refusal. */
+	const requireArtifacts = () => {
+		const index = deps.artifacts;
+		if (index === void 0) throw new Error("this node does not host the notification artifact index — use the hub");
+		return index;
+	};
 	/** The text catalog editor, or an honest refusal. */
 	const requireTexts = () => {
 		const editor = deps.texts;
@@ -15548,6 +17776,54 @@ function makeNcActionHandlers(deps) {
 			});
 			return inject(parsed);
 		},
+		"nc.testRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to test a rule");
+			const inject = deps.injectTestEvent;
+			if (inject === void 0) throw new Error("this node does not host the notification centre — test on the hub");
+			const rule = assertRuleVisible(input.ruleId, c);
+			const plan = planRuleTest({
+				rule,
+				now: Date.now(),
+				...input.deviceId !== void 0 ? { fallbackDeviceId: input.deviceId } : {}
+			});
+			deps.logger.info("rule test requested", {
+				tags: { deviceId: plan.input.deviceId },
+				meta: {
+					by: c.userId,
+					ruleId: rule.id,
+					ruleName: rule.name,
+					trigger: plan.trigger,
+					bypassCooldown: true,
+					bypassMute: true,
+					planNotes: plan.notes.map((n) => n.conditionId)
+				}
+			});
+			return {
+				...await inject(plan.input),
+				trigger: plan.trigger,
+				planNotes: plan.notes.map((n) => ({
+					conditionId: n.conditionId,
+					note: n.note
+				}))
+			};
+		},
+		"nc.getRuleStatus": async (input, caller) => {
+			const c = requireCaller(caller);
+			const status = deps.ruleStatus;
+			if (status === void 0) throw new Error("this node does not host the notification centre — ask the hub");
+			const detection = deps.ruleStore.get(input.ruleId);
+			if (detection !== null) {
+				assertRuleVisible(input.ruleId, c);
+				return status.forRule(detection);
+			}
+			const timelapse = deps.timelapse?.store.get(input.ruleId) ?? null;
+			if (timelapse !== null) {
+				if (!c.isAdmin && timelapse.ownerUserId !== c.userId) throw new Error(`forbidden: timelapse rule not owned: ${input.ruleId}`);
+				return status.forTimelapseRule(timelapse);
+			}
+			throw new Error(`rule not found: ${input.ruleId}`);
+		},
 		"nc.listTimelapseRules": async (_input, caller) => {
 			const c = requireCaller(caller);
 			const tl = requireTimelapse();
@@ -15729,7 +18005,26 @@ function makeNcActionHandlers(deps) {
 			return input.language === void 0 ? texts.view() : texts.view(input.language);
 		},
 		"nc.setLanguage": async (input) => requireTexts().setLanguage(input.language),
-		"nc.setTextOverrides": async (input) => requireTexts().setOverrides(input.language, input.overrides)
+		"nc.setTextOverrides": async (input) => requireTexts().setOverrides(input.language, input.overrides),
+		"nc.listArtifacts": async (input, caller) => {
+			const c = requireCaller(caller);
+			const page = await requireArtifacts().list(input, {
+				userId: c.userId,
+				isAdmin: c.isAdmin
+			});
+			return {
+				artifacts: [...page.artifacts],
+				total: page.total,
+				hasMore: page.hasMore
+			};
+		},
+		"nc.getArtifact": async (input, caller) => {
+			const c = requireCaller(caller);
+			return { artifact: await requireArtifacts().get(input.artifactId, {
+				userId: c.userId,
+				isAdmin: c.isAdmin
+			}) };
+		}
 	};
 }
 //#endregion
@@ -15783,7 +18078,8 @@ var PREVIEW_FALLBACK_NAME = "timelapse-preview.jpg";
 *          member has a logged reason. It never rejects.
 */
 function buildTimelapseArtifactPublisher(ports) {
-	return async ({ exportId, deviceId, previewText, previewMode }) => {
+	return async (request) => {
+		const { exportId, deviceId, previewText, previewMode } = request;
 		const tags = { deviceId };
 		const none = {
 			video: null,
@@ -15814,15 +18110,32 @@ function buildTimelapseArtifactPublisher(ports) {
 			return none;
 		}
 		const mp4 = Buffer$1.from(read.base64, "base64");
+		const capturedAt = request.capturedAt ?? Date.now();
+		const common = {
+			deviceId,
+			deviceIds: [deviceId],
+			capturedAt,
+			...request.ruleId !== void 0 ? { ruleId: request.ruleId } : {},
+			...request.ruleName !== void 0 ? { ruleName: request.ruleName } : {},
+			...request.ownerUserId !== void 0 ? { ownerUserId: request.ownerUserId } : {}
+		};
 		const preview = await publishPreview(ports, {
 			mp4,
 			deviceId,
 			tags,
 			previewText,
-			previewMode: previewMode ?? "image"
+			previewMode: previewMode ?? "image",
+			meta: {
+				...common,
+				kind: "timelapse-preview"
+			}
 		});
 		try {
-			const url = await ports.publish(mp4, read.contentType);
+			const { url } = await ports.publish(mp4, read.contentType, {
+				...common,
+				kind: "timelapse",
+				...preview.artifactId !== null ? { posterArtifactId: preview.artifactId } : {}
+			});
 			if (url === null) {
 				ports.logger.warn("timelapse artifact not published: no reachable public endpoint", {
 					tags,
@@ -15830,7 +18143,7 @@ function buildTimelapseArtifactPublisher(ports) {
 				});
 				return {
 					video: null,
-					preview
+					preview: preview.ref
 				};
 			}
 			ports.logger.info("timelapse artifact published", {
@@ -15839,7 +18152,7 @@ function buildTimelapseArtifactPublisher(ports) {
 					exportId,
 					bytes: read.bytes,
 					name: read.name,
-					preview: preview !== null
+					preview: preview.ref !== null
 				}
 			});
 			return {
@@ -15848,7 +18161,7 @@ function buildTimelapseArtifactPublisher(ports) {
 					mime: read.contentType,
 					name: read.name
 				},
-				preview
+				preview: preview.ref
 			};
 		} catch (err) {
 			ports.logger.warn("timelapse artifact not published: artifact plane refused the bytes", {
@@ -15860,18 +18173,22 @@ function buildTimelapseArtifactPublisher(ports) {
 			});
 			return {
 				video: null,
-				preview
+				preview: preview.ref
 			};
 		}
 	};
 }
+var NO_PREVIEW = {
+	ref: null,
+	artifactId: null
+};
 /**
 * The preview half. Best-effort at every step and never throws: the picture is
 * an enhancement, the video is the notification.
 */
 async function publishPreview(ports, input) {
 	const render = ports.renderPreview;
-	if (render === void 0 || input.previewText === void 0) return null;
+	if (render === void 0 || input.previewText === void 0) return NO_PREVIEW;
 	try {
 		const rendered = await render({
 			mp4: input.mp4,
@@ -15879,23 +18196,29 @@ async function publishPreview(ports, input) {
 			deviceId: input.deviceId,
 			mode: input.previewMode
 		});
-		if (rendered === null) return null;
-		const url = await ports.publish(rendered.bytes, rendered.mime);
+		if (rendered === null) return NO_PREVIEW;
+		const { url, artifactId } = await ports.publish(rendered.bytes, rendered.mime, input.meta);
 		if (url === null) {
 			ports.logger.warn("timelapse preview not published: no reachable public endpoint", { tags: input.tags });
-			return null;
+			return {
+				ref: null,
+				artifactId
+			};
 		}
 		return {
-			url,
-			mime: rendered.mime,
-			name: PREVIEW_NAME_BY_MIME[rendered.mime] ?? PREVIEW_FALLBACK_NAME
+			ref: {
+				url,
+				mime: rendered.mime,
+				name: PREVIEW_NAME_BY_MIME[rendered.mime] ?? PREVIEW_FALLBACK_NAME
+			},
+			artifactId
 		};
 	} catch (err) {
 		ports.logger.warn("timelapse preview not published: publish threw", {
 			tags: input.tags,
 			meta: { error: String(err) }
 		});
-		return null;
+		return NO_PREVIEW;
 	}
 }
 /** Title size as a fraction of the frame WIDTH — so it reads the same on a
@@ -16382,6 +18705,10 @@ function startAlarmPanelConvergence(ports) {
 * `data-plane-access.spec.ts` asserts they still match the constants their
 * handlers register with — a mirror nothing checks is a lie waiting to happen.
 */
+/** The artefact read route's prefix, imported rather than mirrored: it is
+*  ALSO the prefix `artifactDownloadPath` writes into every index row, and two
+*  copies of that string is a 404 nobody would find. */
+var NC_ARTIFACT_READ_PREFIX_REF = NC_ARTIFACT_READ_PREFIX;
 var TRAINING_EXPORT_PREFIX_REF = "training-export";
 var RETRAIN_EXPORT_PREFIX_REF = "retrain-export";
 var DEBUG_EXPORT_PREFIX_REF = "debug-export";
@@ -16397,6 +18724,14 @@ var PIPELINE_ANALYTICS_PLANE_ACCESS = {
 	"nc-action": "public",
 	/** Self-authenticating single-use artifact token (D47). */
 	"nc-artifact": "public",
+	/**
+	* The VIEWER's read of the same bytes (task #36). One indexed artefact by an
+	* unguessable id the caller was handed by `nc.listArtifacts` — the rule above,
+	* applied unchanged. It is deliberately NOT the `public` signed plane: the
+	* viewer holds a session, and pre-minting a 24 h signed link for every
+	* artefact a user might scroll to is a link-leak surface for no gain.
+	*/
+	[NC_ARTIFACT_READ_PREFIX_REF]: "authenticated",
 	/** Every frame behind a marked selection — a corpus, not an item. */
 	[TRAINING_EXPORT_PREFIX_REF]: "admin",
 	[RETRAIN_EXPORT_PREFIX_REF]: "admin",
@@ -17519,9 +19854,14 @@ async function recomputeTrackImportance(deps, trackId) {
 */
 async function applyTrackLabelCandidate(deps, deviceId, trackId, candidate) {
 	let trackWritten = false;
+	/** The patch the TRACK accepted — the ONE decision the events copy. */
+	let accepted;
 	try {
 		const decision = await deps.trackStore?.applyLabelCandidate(trackId, candidate);
-		if (decision?.kind === "write") trackWritten = true;
+		if (decision?.kind === "write") {
+			trackWritten = true;
+			accepted = decision.patch;
+		}
 		if (decision?.kind === "refused") {
 			const message = decision.reason.kind === "macro-class" ? "label tier collapse refused" : "label write refused";
 			deps.logger.info(message, {
@@ -17543,7 +19883,7 @@ async function applyTrackLabelCandidate(deps, deviceId, trackId, candidate) {
 	}
 	let eventsUpdated = 0;
 	try {
-		eventsUpdated = await deps.eventStore?.applyLabelCandidateForTrack(trackId, candidate) ?? 0;
+		eventsUpdated = accepted !== void 0 ? await deps.eventStore?.projectTrackLabel(trackId, accepted) ?? 0 : 0;
 	} catch (err) {
 		deps.logger.warn("event label back-patch failed", {
 			tags: { deviceId },
@@ -17916,7 +20256,8 @@ var FaceGalleryProvider = class {
 			score: 1,
 			stepId: OPERATOR_FACE_STEP_ID,
 			decidedAt: Date.now(),
-			operatorAuthority: true
+			operatorAuthority: true,
+			identityId
 		});
 		this.refreshGallery();
 		this.safeEmitFaceGalleryChanged({
@@ -19441,6 +21782,12 @@ var FrameProcessor = class {
 	/** Optional stationary-object gate (parked-object suppression). Null until
 	*  the addon wires it via {@link setStationaryGate}. */
 	stationaryGate = null;
+	/**
+	* The label the TRACK currently carries, read (never mirrored) from the
+	* active-track cache. See {@link setTrackLabelState} — and the use site in
+	* `toObjectEvent`, which is the reason it exists.
+	*/
+	trackLabelState = null;
 	constructor(deviceId, trackerConfig = {}, stateConfig = {}, emitterConfig = {}, source = "pipeline") {
 		this.deviceId = deviceId;
 		this.source = source;
@@ -19457,6 +21804,19 @@ var FrameProcessor = class {
 		this.zones = zones;
 	}
 	/**
+	* Wire the reader that answers "what does this track already say it is".
+	*
+	* A READ, not a mirror the late-label path has to remember to feed: the
+	* active-track cache is in-RAM and already the authority every other surface
+	* resolves against, and a mirror that can be forgotten is how a stamped row
+	* and an unstamped one end up in the same track. Absent (tests, and any
+	* caller that has not wired it) ⇒ the emitter behaves exactly as it did
+	* before, stamping only what the current frame decided.
+	*/
+	setTrackLabelState(read) {
+		this.trackLabelState = read;
+	}
+	/**
 	* How much of a detection's box must lie inside a zone for the zone to be
 	* stamped onto it (0–1 fraction of the box's own area).
 	*
@@ -19785,7 +22145,7 @@ var FrameProcessor = class {
 			const state = forcedState ?? mapObjectStateToTrackState(objectStates.find((o) => o.trackId === e.detection.trackId)?.state);
 			const zones = zonesByTrack.get(e.detection.trackId) ?? [];
 			const crossing = crossingOf(e);
-			const labelPatch = labelPatchByTrack.get(e.detection.trackId);
+			const labelPatch = labelPatchByTrack.get(e.detection.trackId) ?? knownTrackLabelPatch(this.trackLabelState?.(e.detection.trackId));
 			return {
 				id: randomUUID(),
 				deviceId: this.deviceId,
@@ -21456,7 +23816,8 @@ var PlateGalleryProvider = class {
 			score: 1,
 			stepId: OPERATOR_PLATE_STEP_ID,
 			decidedAt: Date.now(),
-			operatorAuthority: true
+			operatorAuthority: true,
+			identityId: vehicle.id
 		});
 		this.refreshGallery();
 		this.safeEmitPlateGalleryChanged({
@@ -24831,10 +27192,13 @@ var FaceRecognizer = class {
 				tier: 2,
 				score: work.matchScore ?? 0,
 				stepId: FACE_RECOGNIZER_STEP_ID,
-				decidedAt: Date.now()
+				decidedAt: Date.now(),
+				identityId: work.assignedIdentityId
 			};
+			let accepted;
 			try {
-				await this.deps.trackStore.applyLabelCandidate(work.trackId, candidate);
+				const decision = await this.deps.trackStore.applyLabelCandidate(work.trackId, candidate);
+				if (decision?.kind === "write") accepted = decision.patch;
 			} catch (err) {
 				this.deps.logger.warn("track identity label failed", {
 					tags: { deviceId: input.deviceId },
@@ -24844,8 +27208,8 @@ var FaceRecognizer = class {
 					}
 				});
 			}
-			try {
-				await this.deps.eventStore.applyLabelCandidateForTrack(work.trackId, candidate);
+			if (accepted !== void 0) try {
+				await this.deps.eventStore.projectTrackLabel(work.trackId, accepted);
 			} catch (err) {
 				this.deps.logger.warn("event identity label failed", {
 					tags: { deviceId: input.deviceId },
@@ -30046,8 +32410,25 @@ var PlateRecognizer = class {
 	*  for an implausible read (junk OCR off a distant/oblique plate) — the
 	*  caller must NOT stamp a label then. */
 	resolveLabel(text, score) {
+		return this.resolveLabelWithVehicle(text, score)?.text ?? null;
+	}
+	/**
+	* {@link resolveLabel} plus the GALLERY ROW it named, when a vehicle claimed
+	* the read.
+	*
+	* The id is what a notification rule matches on — a display name is
+	* renameable and a rule authored on the old spelling goes silently dark
+	* (`LabelAttribution.identityId`). An unclaimed but plausible read still
+	* returns its normalized text with NO `vehicleId`: it is a plate, it is just
+	* nobody's plate.
+	*/
+	resolveLabelWithVehicle(text, score) {
 		if (!isPlausiblePlateRead(text, score)) return null;
-		return this.matchVehicle(text, score)?.name ?? normalizePlate(text);
+		const matched = this.matchVehicle(text, score);
+		return matched !== null ? {
+			text: matched.name,
+			vehicleId: matched.vehicleId
+		} : { text: normalizePlate(text) };
 	}
 	async processFrame(input) {
 		const minConfidence = input.minConfidence ?? 0;
@@ -31606,48 +33987,49 @@ var EventStore = class {
 		}
 	}
 	/**
-	* Forward-only: offer a label CANDIDATE to every already-emitted object event
-	* of a track (roadmap 4g). Returns the number of events actually updated —
-	* which is NOT the number of rows, because the write rule is applied PER ROW
-	* against that row's own tiers.
+	* Project the TRACK's label decision onto every object event of that track.
+	* Returns how many rows took it.
 	*
-	* Per row, not once for the track, and that is the point: the events of one
-	* track do not all carry the same label. An early row may hold a tier-1
-	* sub-class the frame path stamped and a later row a tier-2 identity; a
-	* single decision taken on the track and blanket-applied would either
-	* overwrite the stronger value or skip the rows that had nothing.
+	* ONE DECISION, EVERY ROW — and that is the correction, not the design it
+	* replaced. This used to re-run `resolveTieredLabelWrite` per row against
+	* that row's own tiers, on the theory that "the events of one track do not
+	* all carry the same label". They do: a track has ONE subject, and every
+	* read surface (the timeline, the event page, a notification body, a rule's
+	* `identities` condition) shows the track's answer. Re-deciding per row meant
+	* a row whose incumbent happened to outscore the track's winner kept a
+	* different word, and the rows drifted apart from the track and from each
+	* other — measured 2026-08-14 as 407 of 437 tracks whose event rows
+	* disagreed with the track they belong to. A notification quoting one row and
+	* a timeline quoting another then told the operator two different names for
+	* the same person.
+	*
+	* The caller passes the patch the TRACK row accepted, so the two can never
+	* disagree by construction. A refused track write projects nothing: nothing
+	* changed, so there is nothing to copy.
 	*
 	* Used when face recognition, plate matching or a classifier answers after
 	* the events were emitted.
 	*/
-	async applyLabelCandidateForTrack(trackId, candidate) {
+	async projectTrackLabel(trackId, patch) {
 		const rows = await this.store.query.query({
 			collection: OBJECT_EVENTS_COLLECTION,
 			filter: { where: { trackId } }
 		});
+		const data = tieredLabelColumnData(patch);
 		let updated = 0;
-		for (const row of rows) {
-			const className = row.data["className"];
-			if (typeof className !== "string") continue;
-			const decision = resolveTieredLabelWrite({
-				className,
-				...readTieredLabelColumns(row.data)
-			}, candidate);
-			if (decision.kind !== "write") continue;
-			try {
-				await this.store.update.mutate({
-					collection: OBJECT_EVENTS_COLLECTION,
-					id: row.id,
-					data: tieredLabelColumnData(decision.patch)
-				});
-				updated++;
-			} catch (err) {
-				this.logger.warn("applyLabelCandidateForTrack update failed", { meta: {
-					trackId,
-					eventId: row.id,
-					error: String(err)
-				} });
-			}
+		for (const row of rows) try {
+			await this.store.update.mutate({
+				collection: OBJECT_EVENTS_COLLECTION,
+				id: row.id,
+				data
+			});
+			updated++;
+		} catch (err) {
+			this.logger.warn("projectTrackLabel update failed", { meta: {
+				trackId,
+				eventId: row.id,
+				error: String(err)
+			} });
 		}
 		return updated;
 	}
@@ -36062,138 +38444,6 @@ var BindingCache = class {
 	}
 };
 //#endregion
-//#region src/pipeline-analytics/runtime/detection-coverage-cache.ts
-/**
-* DetectionCoverageCache — fleet-seeded, event-invalidated mirror of WHICH
-* devices carry a WRAPPED `detection-pipeline` binding. This is the alarm's
-* coverage authority ("Away armed, 12 cameras" is false if three of them are
-* offline or no longer wrapped), read by the notification centre's device
-* directory (`listDeviceIdentities`).
-*
-* WHY a mirror, not a per-tick sweep. The directory refreshes on the NC's 30 s
-* rule-reload tick. Answering "who still has detection?" with a fleet-wide
-* `getAllBindings` on EVERY tick cost 903 ms / 373 KB / ~505 `getBindings:
-* default wrappers skipped` log lines on the live hub (524 devices), forever —
-* ~3% of hub-main's main thread plus a permanent log-spam baseline. Same defect
-* and fix as `SystemMirror.refreshBinding` (639073e8): ONE fleet read to warm,
-* then per-device updates driven by `DeviceBindingsChanged` events. A wrapper
-* toggle emits that event carrying the device's id and `capName`
-* (`detection-pipeline`), so a single `getBindings(deviceId)` — 21 ms / 613 B —
-* keeps the mirror current without ever touching the fleet again.
-*
-* ── Destructive-direction discipline (D49) ──────────────────────────────────
-*
-* `detectionActive: false` reports a camera as UNCOVERED / switched-off (D62) —
-* the destructive answer, and the one an operator reads as "my alarm is not
-* watching that door". A transient `getBindings` blip must never flip a
-* known-covered camera to uncovered:
-*   • a failed refresh KEEPS the previous value (a read that throws changes
-*     nothing), and
-*   • a single read that would flip a known `true → false` is confirmed by a
-*     concordant SECOND read before it lands — an empty binding list is not
-*     proof the wrapper is gone.
-* A COLD mirror (seed not yet landed, or a seed that failed) answers `undefined`
-* for every id — and unknown never reports a camera as excluded from coverage.
-*/
-var DetectionCoverageCache = class {
-	api;
-	logger;
-	/** deviceId → "has a WRAPPED detection-pipeline binding". Absent = unknown. */
-	state = /* @__PURE__ */ new Map();
-	warm = false;
-	seeding = null;
-	constructor(deps) {
-		this.api = deps.api;
-		this.logger = deps.logger;
-	}
-	/** Has the ONE fleet seed ever landed? A cold mirror knows nothing. */
-	isWarm() {
-		return this.warm;
-	}
-	/** Do we have an answer for this id at all? (`false` ⇒ absent ⇒ unknown.) */
-	has(deviceId) {
-		return this.state.has(deviceId);
-	}
-	/** The coverage answer, or `undefined` when this id is unknown. No I/O. */
-	get(deviceId) {
-		return this.state.get(deviceId);
-	}
-	/**
-	* Seed the whole fleet ONCE with a single `getAllBindings`. Idempotent: a
-	* warm cache is a no-op, and concurrent callers coalesce onto one read. A
-	* failed seed leaves the mirror COLD so the next tick retries — during that
-	* window every id answers unknown, which never reports a camera as excluded.
-	*/
-	async ensureWarm() {
-		if (this.warm) return;
-		if (this.seeding) return this.seeding;
-		this.seeding = this.seed();
-		try {
-			await this.seeding;
-		} finally {
-			this.seeding = null;
-		}
-	}
-	async seed() {
-		try {
-			const rows = await this.api.deviceManager.getAllBindings.query({});
-			for (const row of rows) {
-				if (this.state.has(row.deviceId)) continue;
-				this.state.set(row.deviceId, hasWrappedDetection(row.entries));
-			}
-			this.warm = true;
-			this.logger.info("detection-coverage mirror warm", { meta: { devices: this.state.size } });
-		} catch (err) {
-			this.logger.warn("detection-coverage seed failed — coverage unknown until it lands", { meta: { error: String(err) } });
-		}
-	}
-	/**
-	* A `DeviceBindingsChanged` for the detection cap re-reads THAT ONE device
-	* (never the fleet). Fire-and-forget from the synchronous event handler.
-	*/
-	onBindingsChanged(event) {
-		if (event.capName !== "detection-pipeline") return Promise.resolve();
-		return this.refreshDevice(event.deviceId);
-	}
-	/** Drop a device the fleet no longer has (`device.unregistered`). */
-	forget(deviceId) {
-		this.state.delete(deviceId);
-	}
-	/** Return to cold — used on addon shutdown. */
-	clearAll() {
-		this.state.clear();
-		this.warm = false;
-		this.seeding = null;
-	}
-	async refreshDevice(deviceId) {
-		try {
-			const active = await this.readWrappedDetection(deviceId);
-			const prev = this.state.get(deviceId);
-			if (!active && prev === true) {
-				if (await this.readWrappedDetection(deviceId)) {
-					this.state.set(deviceId, true);
-					return;
-				}
-			}
-			this.state.set(deviceId, active);
-		} catch (err) {
-			this.logger.debug("detection-coverage refresh failed — keeping the previous value", {
-				tags: { deviceId },
-				meta: { error: String(err) }
-			});
-		}
-	}
-	async readWrappedDetection(deviceId) {
-		return hasWrappedDetection((await this.api.deviceManager.getBindings.query({ deviceId })).entries);
-	}
-};
-/** The one authority: a WRAPPED `detection-pipeline` binding is present. A
-*  native binding of the same cap is NOT coverage (D62: absence of the WRAPPED
-*  binding is how a deactivated wrapper is represented). */
-function hasWrappedDetection(entries) {
-	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
-}
-//#endregion
 //#region src/pipeline-analytics/runtime/capture-scheduler.ts
 /**
 * Kind-derived default priorities (0 = highest). Explicit `priority` wins.
@@ -36466,6 +38716,138 @@ var CaptureScheduler = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/runtime/detection-coverage-cache.ts
+/**
+* DetectionCoverageCache — fleet-seeded, event-invalidated mirror of WHICH
+* devices carry a WRAPPED `detection-pipeline` binding. This is the alarm's
+* coverage authority ("Away armed, 12 cameras" is false if three of them are
+* offline or no longer wrapped), read by the notification centre's device
+* directory (`listDeviceIdentities`).
+*
+* WHY a mirror, not a per-tick sweep. The directory refreshes on the NC's 30 s
+* rule-reload tick. Answering "who still has detection?" with a fleet-wide
+* `getAllBindings` on EVERY tick cost 903 ms / 373 KB / ~505 `getBindings:
+* default wrappers skipped` log lines on the live hub (524 devices), forever —
+* ~3% of hub-main's main thread plus a permanent log-spam baseline. Same defect
+* and fix as `SystemMirror.refreshBinding` (639073e8): ONE fleet read to warm,
+* then per-device updates driven by `DeviceBindingsChanged` events. A wrapper
+* toggle emits that event carrying the device's id and `capName`
+* (`detection-pipeline`), so a single `getBindings(deviceId)` — 21 ms / 613 B —
+* keeps the mirror current without ever touching the fleet again.
+*
+* ── Destructive-direction discipline (D49) ──────────────────────────────────
+*
+* `detectionActive: false` reports a camera as UNCOVERED / switched-off (D62) —
+* the destructive answer, and the one an operator reads as "my alarm is not
+* watching that door". A transient `getBindings` blip must never flip a
+* known-covered camera to uncovered:
+*   • a failed refresh KEEPS the previous value (a read that throws changes
+*     nothing), and
+*   • a single read that would flip a known `true → false` is confirmed by a
+*     concordant SECOND read before it lands — an empty binding list is not
+*     proof the wrapper is gone.
+* A COLD mirror (seed not yet landed, or a seed that failed) answers `undefined`
+* for every id — and unknown never reports a camera as excluded from coverage.
+*/
+var DetectionCoverageCache = class {
+	api;
+	logger;
+	/** deviceId → "has a WRAPPED detection-pipeline binding". Absent = unknown. */
+	state = /* @__PURE__ */ new Map();
+	warm = false;
+	seeding = null;
+	constructor(deps) {
+		this.api = deps.api;
+		this.logger = deps.logger;
+	}
+	/** Has the ONE fleet seed ever landed? A cold mirror knows nothing. */
+	isWarm() {
+		return this.warm;
+	}
+	/** Do we have an answer for this id at all? (`false` ⇒ absent ⇒ unknown.) */
+	has(deviceId) {
+		return this.state.has(deviceId);
+	}
+	/** The coverage answer, or `undefined` when this id is unknown. No I/O. */
+	get(deviceId) {
+		return this.state.get(deviceId);
+	}
+	/**
+	* Seed the whole fleet ONCE with a single `getAllBindings`. Idempotent: a
+	* warm cache is a no-op, and concurrent callers coalesce onto one read. A
+	* failed seed leaves the mirror COLD so the next tick retries — during that
+	* window every id answers unknown, which never reports a camera as excluded.
+	*/
+	async ensureWarm() {
+		if (this.warm) return;
+		if (this.seeding) return this.seeding;
+		this.seeding = this.seed();
+		try {
+			await this.seeding;
+		} finally {
+			this.seeding = null;
+		}
+	}
+	async seed() {
+		try {
+			const rows = await this.api.deviceManager.getAllBindings.query({});
+			for (const row of rows) {
+				if (this.state.has(row.deviceId)) continue;
+				this.state.set(row.deviceId, hasWrappedDetection(row.entries));
+			}
+			this.warm = true;
+			this.logger.info("detection-coverage mirror warm", { meta: { devices: this.state.size } });
+		} catch (err) {
+			this.logger.warn("detection-coverage seed failed — coverage unknown until it lands", { meta: { error: String(err) } });
+		}
+	}
+	/**
+	* A `DeviceBindingsChanged` for the detection cap re-reads THAT ONE device
+	* (never the fleet). Fire-and-forget from the synchronous event handler.
+	*/
+	onBindingsChanged(event) {
+		if (event.capName !== "detection-pipeline") return Promise.resolve();
+		return this.refreshDevice(event.deviceId);
+	}
+	/** Drop a device the fleet no longer has (`device.unregistered`). */
+	forget(deviceId) {
+		this.state.delete(deviceId);
+	}
+	/** Return to cold — used on addon shutdown. */
+	clearAll() {
+		this.state.clear();
+		this.warm = false;
+		this.seeding = null;
+	}
+	async refreshDevice(deviceId) {
+		try {
+			const active = await this.readWrappedDetection(deviceId);
+			const prev = this.state.get(deviceId);
+			if (!active && prev === true) {
+				if (await this.readWrappedDetection(deviceId)) {
+					this.state.set(deviceId, true);
+					return;
+				}
+			}
+			this.state.set(deviceId, active);
+		} catch (err) {
+			this.logger.debug("detection-coverage refresh failed — keeping the previous value", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+		}
+	}
+	async readWrappedDetection(deviceId) {
+		return hasWrappedDetection((await this.api.deviceManager.getBindings.query({ deviceId })).entries);
+	}
+};
+/** The one authority: a WRAPPED `detection-pipeline` binding is present. A
+*  native binding of the same cap is NOT coverage (D62: absence of the WRAPPED
+*  binding is how a deactivated wrapper is represented). */
+function hasWrappedDetection(entries) {
+	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
 	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
@@ -41338,7 +43720,27 @@ var REBUILD_FALLBACK_NODE_ID = "hub";
 * count. Two thousand is far above any real night and still a bounded read.
 */
 var TIMELAPSE_TRACK_QUERY_LIMIT = 2e3;
+/**
+* How many object-event rows ONE timelapse window may read.
+*
+* Higher than the track limit because these are per-FRAME rows, not per-subject:
+* one track routinely writes a handful (`entered`, some `moving`, `left`), and
+* the merge in `detection-intervals.ts` folds them back to one subject. Ten
+* thousand covers every night this deployment has produced and still bounds the
+* read; the store returns the NEWEST rows, so an overflow loses the start of the
+* window rather than a random slice of it.
+*/
+var TIMELAPSE_EVENT_QUERY_LIMIT = 1e4;
 var PIPELINE_ANALYTICS_ADDON_ID = "pipeline-analytics";
+/** Artefact index ⇄ shelf reconcile cadence. Hourly: the two only drift on the
+*  bounds' own timescale (14 days / 2000 entries / 2 GiB). */
+var NC_ARTIFACT_PRUNE_INTERVAL_MS = 36e5;
+/** What a publish answers on a node whose artifact plane never came up: no
+*  link, no index row — and, exactly as before, bytes-only delivery. */
+var NO_PUBLICATION = {
+	url: null,
+	artifactId: null
+};
 /**
 * The FULL action catalog for this addon.
 *
@@ -41620,6 +44022,12 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  data-plane handle. Null until served / when the facility is absent. */
 	ncArtifactPlane = null;
 	ncArtifactDataPlane = null;
+	/** The viewer's artefact library (task #36): the index, its authenticated
+	*  bytes route, and the store the two share. Null until served. */
+	ncArtifactIndex = null;
+	ncArtifactStore = null;
+	ncArtifactReadDataPlane = null;
+	ncArtifactPruneTimer = null;
 	/**
 	* Roadmap 4b: ONE cut of an event, in every container the rule asked for.
 	*
@@ -41806,6 +44214,31 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* Best-effort at every step: no facility, no secret or no reachable base URL
 	* ⇒ no plane, and the dispatcher keeps shipping bytes exactly as before.
 	*/
+	/**
+	* Reconcile the artefact index against the shelf that holds the bytes.
+	*
+	* Hourly, because the two drift only on the bounds' timescale: a row expires
+	* on the shelf's own age bound (14 d) or its file is evicted by the count/byte
+	* bound. Without this, a list eventually serves rows whose bytes 404 — and a
+	* broken tile is the one failure an operator DOES report.
+	*/
+	startNcArtifactPrune() {
+		if (this.ncArtifactPruneTimer !== null) return;
+		const run = async () => {
+			const index = this.ncArtifactIndex;
+			const store = this.ncArtifactStore;
+			if (index === null || store === null) return;
+			try {
+				await store.sweep();
+				await index.prune(this.isPostProcessingNode ? await store.keptIds() : null);
+			} catch (err) {
+				this.ctx.logger.warn("nc artifact prune failed", { meta: { error: errMsg(err) } });
+			}
+		};
+		run();
+		this.ncArtifactPruneTimer = setInterval(() => void run(), NC_ARTIFACT_PRUNE_INTERVAL_MS);
+		this.ncArtifactPruneTimer.unref?.();
+	}
 	async serveNcArtifactPlane() {
 		try {
 			const secretState = this.state("ncArtifactSecret", NcArtifactSecretSchema, "");
@@ -41819,9 +44252,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				logger: this.ctx.logger.child("nc-artifacts")
 			});
 			await store.start();
+			this.ncArtifactStore = store;
+			const index = new NcArtifactIndex({
+				store: this.ctx.api.settingsStore,
+				logger: this.ctx.logger.child("nc-artifacts"),
+				addonId: this.ctx.id,
+				retentionMs: store.retentionMs
+			});
+			this.ncArtifactIndex = index;
 			const plane = new NcArtifactPlane({
 				store,
 				secret,
+				index,
 				logger: this.ctx.logger.child("nc-artifacts"),
 				routePrefix: `/addon/${this.ctx.id}/nc-artifact`,
 				listEndpoints: () => this.ncEndpoints()
@@ -41832,7 +44274,23 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				handler: plane.handler
 			}) ?? null;
 			this.ncArtifactPlane = this.ncArtifactDataPlane !== null ? plane : null;
-			this.ctx.logger.info("nc-artifact data-plane served", { meta: { served: this.ncArtifactPlane !== null } });
+			const readPlane = new NcArtifactReadPlane({
+				index,
+				store,
+				logger: this.ctx.logger.child("nc-artifacts")
+			});
+			this.ncArtifactReadDataPlane = await this.ctx.dataPlane?.serve({
+				prefix: NC_ARTIFACT_READ_PREFIX_REF,
+				access: planeAccess(NC_ARTIFACT_READ_PREFIX_REF),
+				handler: readPlane.handler
+			}) ?? null;
+			this.startNcArtifactPrune();
+			this.ctx.logger.info("nc-artifact data-plane served", { meta: {
+				served: this.ncArtifactPlane !== null,
+				libraryServed: this.ncArtifactReadDataPlane !== null,
+				libraryAccess: planeAccess(NC_ARTIFACT_READ_PREFIX_REF),
+				retentionDays: Math.round(store.retentionMs / 864e5)
+			} });
 		} catch (err) {
 			this.ctx.logger.warn("nc-artifact data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
@@ -42280,7 +44738,25 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				store: center.summaryStore,
 				runNow: (input) => center.runSummaryNow(input)
 			},
-			texts: center.textCatalogEditor
+			texts: center.textCatalogEditor,
+			...this.ncArtifactIndex !== null ? { artifacts: this.ncArtifactIndex } : {},
+			ruleStatus: {
+				forRule: (rule) => center.ruleStatusFor(rule),
+				forTimelapseRule: (rule) => center.timelapseStatusFor(rule, async ({ ruleId, deviceId }) => {
+					const index = this.ncArtifactIndex;
+					if (index === null) return null;
+					return (await index.list({
+						kinds: ["timelapse"],
+						ruleId,
+						deviceIds: [deviceId],
+						limit: 1,
+						offset: 0
+					}, {
+						userId: "",
+						isAdmin: true
+					})).artifacts[0] ?? null;
+				})
+			}
 		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
@@ -42753,10 +45229,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				const buf = await this.captureCrop(frame.frameHandle, { ...frame.bbox }, frame.frameWidth, frame.frameHeight, DETAIL_FALLBACK_CROP_PADDING);
 				return buf ? buf.toString("base64") : null;
 			},
-			hasTrackLabel: (trackId) => {
-				const label = this.trackStore?.getActiveByTrack(trackId)?.label;
-				return label !== void 0 && label.length > 0;
-			}
+			hasTrackLabel: (trackId) => hasResolvedLabel(this.trackStore?.getActiveByTrack(trackId))
 		});
 	}
 	/** Binding cache + the zone-analytics / audio-metrics cap providers. */
@@ -42848,6 +45321,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					addonId: device.addonId
 				};
 			},
+			identityIdsByName: async () => {
+				const byName = /* @__PURE__ */ new Map();
+				const identities = await stores.identityStore.listIdentities();
+				for (const identity of identities) byName.set(identity.name.trim().toLowerCase(), identity.id);
+				const vehicles = await stores.vehicleStore.listVehicles();
+				for (const vehicle of vehicles) byName.set(vehicle.name.trim().toLowerCase(), vehicle.id);
+				return byName;
+			},
 			listDeviceIdentities: async () => {
 				const all = await api.deviceManager.listAll.query({ projection: "slim" });
 				const coverage = this.detectionCoverage;
@@ -43069,7 +45550,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				timestamp,
 				data: jpeg
 			}),
-			publish: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null
+			publish: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? NO_PUBLICATION
 		};
 	}
 	/**
@@ -43110,11 +45591,40 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					projection: "slim",
 					limit: TIMELAPSE_TRACK_QUERY_LIMIT
 				})).map((t) => ({
+					trackId: t.trackId,
 					firstSeen: t.firstSeen,
 					lastSeen: t.lastSeen,
 					className: t.className
 				}));
 			},
+			/**
+			* The other half of "did anything happen here": the object-event rows.
+			*
+			* The persisted track store is NOT a complete record of the window. Three
+			* gates destroy a track before it is written — the confirmation gate
+			* retracting a suspected false birth, stationary promotion dropping a
+			* parked object, zero-media suppression cascading a thumbnail-less track
+			* away — and on 2026-08-13 they left camera 615 with zero persisted tracks
+			* across a ten-hour night that held a person pass at 23:31. These rows
+			* survive all three.
+			*
+			* FULL projection, not slim: `slimObject` drops `trackId`, and without it
+			* every event of one subject becomes its own detection. It costs nothing
+			* at the store — the row is read whole either way and slim only strips
+			* fields afterwards.
+			*/
+			listDetectionEvents: async ({ deviceId, since, until }) => {
+				return (await stores.eventStore.queryObject({
+					deviceId,
+					since,
+					until,
+					limit: TIMELAPSE_EVENT_QUERY_LIMIT
+				})).map((e) => ({
+					timestamp: e.timestamp,
+					className: e.className,
+					...e.trackId !== void 0 ? { trackId: e.trackId } : {}
+				}));
+			},
 			createExport: (input) => api.recordingExport.createExport.mutate({
 				deviceId: input.deviceId,
 				profile: input.profile,
@@ -43139,10 +45649,11 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				}
 			}),
 			getExport: ({ exportId }) => api.recordingExport.getExport.query({ exportId }),
+			listExports: ({ deviceId }) => api.recordingExport.listExports.query({ deviceId }),
 			publishArtifact: buildTimelapseArtifactPublisher({
 				logger: this.ctx.logger.child("Timelapse"),
 				readExportBytes: ({ exportId }) => api.recordingExport.readExportBytes.query({ exportId }),
-				publish: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
+				publish: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? NO_PUBLICATION,
 				renderPreview: async ({ mode, ...input }) => {
 					const previewPorts = {
 						logger: this.ctx.logger.child("Timelapse"),
@@ -43809,6 +46320,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		this.retrainExportDataPlane = null;
 		await this.debugExportDataPlane?.dispose();
 		this.debugExportDataPlane = null;
+		if (this.ncArtifactPruneTimer !== null) {
+			clearInterval(this.ncArtifactPruneTimer);
+			this.ncArtifactPruneTimer = null;
+		}
+		await this.ncArtifactReadDataPlane?.dispose();
+		this.ncArtifactReadDataPlane = null;
+		this.ncArtifactIndex = null;
+		this.ncArtifactStore = null;
 	}
 	async handleInferenceResult(data) {
 		if (this.shuttingDown) return;
@@ -44772,8 +47291,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						});
 					}
 				}
-				const label = d.className === "plate" ? this.plateRecognizer?.resolveLabel(d.label, d.score) ?? null : d.label;
-				if (label !== null && label !== void 0) await this.applyTrackEnrichmentLabel(deviceId, trackId, label, d, frame.timestamp);
+				const resolved = d.className === "plate" ? this.plateRecognizer?.resolveLabelWithVehicle(d.label, d.score) ?? null : { text: d.label };
+				if (resolved !== null && resolved.text !== void 0) await this.applyTrackEnrichmentLabel(deviceId, trackId, resolved.text, d, frame.timestamp, resolved.vehicleId);
 			}
 		} catch (err) {
 			this.ctx.logger.warn("detail result route failed", {
@@ -44861,7 +47380,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* a runner older than the declaration, because the alternative is guessing
 	* and putting a species in the coarse slot.
 	*/
-	async applyTrackEnrichmentLabel(deviceId, trackId, label, detail, decidedAt) {
+	async applyTrackEnrichmentLabel(deviceId, trackId, label, detail, decidedAt, identityId) {
 		await applyTrackLabelCandidate({
 			...this.trackStore ? { trackStore: this.trackStore } : {},
 			...this.eventStore ? { eventStore: this.eventStore } : {},
@@ -44872,7 +47391,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			score: detail.score,
 			stepId: detail.stepId,
 			...detail.labelModelId !== void 0 ? { modelId: detail.labelModelId } : {},
-			decidedAt
+			decidedAt,
+			...identityId !== void 0 ? { identityId } : {}
 		});
 	}
 	/** Active CLIP image-embedding model id (== the text encoder's), TTL-cached.
@@ -45942,6 +48462,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				cooldownSec,
 				minTrackAgeMs: trk.minTrackAgeMs
 			}, source);
+			p.setTrackLabelState((trackId) => {
+				const active = this.trackStore?.getActiveByTrack(trackId);
+				return active !== null && active !== void 0 ? {
+					className: active.className,
+					...active.label !== void 0 ? { label: active.label } : {},
+					...active.labelScore !== void 0 ? { labelScore: active.labelScore } : {},
+					...active.labelMeta !== void 0 ? { labelMeta: active.labelMeta } : {},
+					...active.subLabel !== void 0 ? { subLabel: active.subLabel } : {},
+					...active.subLabelScore !== void 0 ? { subLabelScore: active.subLabelScore } : {},
+					...active.subLabelMeta !== void 0 ? { subLabelMeta: active.subLabelMeta } : {}
+				} : void 0;
+			});
 			if (source === "pipeline" && this.stationaryRegistry) {
 				const registry = this.stationaryRegistry;
 				p.setStationaryGate({ filter: (input) => {