@camstack/addon-post-analysis 1.2.72 → 1.2.73

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-C2w3cl2p.js");
+const require_dist = require("../dist-DDv-TKUR.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -3544,6 +3544,17 @@ var NcDeviceDirectory = class {
 	size() {
 		return this.devices.size;
 	}
+	/**
+	* Every identity in the current snapshot.
+	*
+	* Exists for the ONE caller that needs the whole directory rather than one
+	* id: the liveness ledger's boot seed, which has to know what every device
+	* was last known to be before the first event arrives. Off the event path by
+	* construction — it is called once, from `start()`.
+	*/
+	all() {
+		return [...this.devices.values()];
+	}
 	/** Has a refresh ever succeeded? A cold directory notifies about nothing. */
 	isWarm() {
 		return this.loadedOnce;
@@ -3947,6 +3958,43 @@ function displayLabel(state) {
 	return state.subLabel ?? state.label;
 }
 /**
+* The tiered columns a row should carry to AGREE with the track, or `undefined`
+* when the track says nothing yet.
+*
+* The projection is total: whichever tiers the track holds are copied, and a
+* track holding neither yields `undefined` rather than a patch of blanks — the
+* caller then leaves the row exactly as it was.
+*/
+function knownTrackLabelPatch(state) {
+	if (state === void 0) return void 0;
+	if (state.label === void 0 && state.subLabel === void 0) return void 0;
+	return {
+		...state.label !== void 0 ? { label: state.label } : {},
+		...state.labelScore !== void 0 ? { labelScore: state.labelScore } : {},
+		...state.labelMeta !== void 0 ? { labelMeta: state.labelMeta } : {},
+		...state.subLabel !== void 0 ? { subLabel: state.subLabel } : {},
+		...state.subLabelScore !== void 0 ? { subLabelScore: state.subLabelScore } : {},
+		...state.subLabelMeta !== void 0 ? { subLabelMeta: state.subLabelMeta } : {}
+	};
+}
+/**
+* Does this row already say what the subject IS?
+*
+* The gate behind `DetailDispatcher.hasTrackLabel`: a periodic face-detection
+* refresh on a track that already has an answer runs geometry-only and drops
+* the ArcFace embedding. It reads {@link displayLabel} and not the `label`
+* column, and the difference is the whole point — an identity is a TIER-2
+* value and lands in `subLabel`, so the column read reported "unlabelled" for
+* every track ArcFace had already named and kept re-embedding it forever,
+* while suppressing the face chain on tracks that carried only a tier-1
+* sub-class (`van`). Exactly backwards, in both directions.
+*/
+function hasResolvedLabel(state) {
+	if (state === null || state === void 0) return false;
+	const label = displayLabel(state);
+	return label !== void 0 && label.length > 0;
+}
+/**
 * The display label of a frame-path tracked detection — the same
 * `subLabel ?? label` question asked of a patch rather than a row. Used by
 * every caller that wants the caption, not the tier (media captions, lifecycle
@@ -3956,6 +4004,36 @@ function patchDisplayLabel(patch) {
 	if (patch === void 0) return void 0;
 	return patch.subLabel ?? patch.label;
 }
+/**
+* WHAT a tier-2 label is about — a recognised PERSON or a read PLATE.
+*
+* Derived from the deciding step, never stored a second time: the step that
+* wrote the value is already on the attribution, and a second column stating
+* the same thing is a knob that can disagree with the first (D62). Both the
+* machine step and the operator override of each family are listed, because a
+* hand-assigned identity is still an identity.
+*
+* Callers use it to pick a SENTENCE: "Gianluca è arrivato" and "Veicolo AB123CD"
+* are different keys in the notification text catalog, and a single
+* `{{label}}` slot cannot word both.
+*/
+var FACE_LABEL_STEP_IDS = new Set([
+	"face-recognizer",
+	"face-embedding",
+	"operator:face-gallery"
+]);
+/** Steps whose tier-2 value is a PLATE / vehicle name. See {@link FACE_LABEL_STEP_IDS}. */
+var PLATE_LABEL_STEP_IDS = new Set(["plate-ocr", "operator:plate-gallery"]);
+/**
+* Classify a tier-2 attribution. `undefined` for an unattributed value, a
+* migrated one, or any step outside the two recognition families (a species, a
+* sub-class) — the caller then falls back to the generic labelled sentence.
+*/
+function labelKindOf(meta) {
+	if (meta === void 0) return void 0;
+	if (FACE_LABEL_STEP_IDS.has(meta.stepId)) return "identity";
+	if (PLATE_LABEL_STEP_IDS.has(meta.stepId)) return "plate";
+}
 /** Whether an attribution came from the 4g migration rather than a real step. */
 function isMigrated(meta) {
 	return meta?.stepId === MIGRATION_STEP_ID;
@@ -4011,7 +4089,8 @@ function resolveTieredLabelWrite(state, candidate) {
 	const meta = {
 		stepId: candidate.stepId,
 		...candidate.modelId !== void 0 ? { modelId: candidate.modelId } : {},
-		decidedAt: candidate.decidedAt
+		decidedAt: candidate.decidedAt,
+		...candidate.identityId !== void 0 ? { identityId: candidate.identityId } : {}
 	};
 	const incumbent = candidate.tier === 1 ? state.label : state.subLabel;
 	const incumbentScore = candidate.tier === 1 ? state.labelScore : state.subLabelScore;
@@ -4233,6 +4312,7 @@ function subjectFromObjectEvent(ev) {
 		timestamp: ev.timestamp,
 		classNames: [ev.className],
 		...displayLabel(ev) !== void 0 ? { label: displayLabel(ev) } : {},
+		...recognitionPatch(ev.subLabelMeta),
 		...ev.confidence !== void 0 ? { confidence: ev.confidence } : {},
 		zones: ev.zones ?? [],
 		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {},
@@ -4246,6 +4326,19 @@ function subjectFromObjectEvent(ev) {
 function bboxPatch(bbox) {
 	return bbox !== void 0 ? { bbox } : {};
 }
+/**
+* The recognition half of a subject, read off the tier-2 attribution: WHICH
+* gallery row and WHAT KIND of thing. Both absent on an unattributed label, so
+* every condition that depends on them fails closed for a legacy record — which
+* is why the id/name matcher keeps its name leg.
+*/
+function recognitionPatch(meta) {
+	const kind = labelKindOf(meta);
+	return {
+		...meta?.identityId !== void 0 ? { identityId: meta.identityId } : {},
+		...kind !== void 0 ? { labelKind: kind } : {}
+	};
+}
 /** Convert a normalized 0..1 track envelope (min/max) into the subject's
 *  top-left+size `BboxRect`. `undefined` in ⇒ `undefined` out (fail closed). */
 function envelopeToBbox(envelope) {
@@ -4410,6 +4503,7 @@ function subjectFromPackageEvent(ev, phase) {
 		timestamp: ev.timestamp,
 		classNames: [ev.className],
 		...displayLabel(ev) !== void 0 ? { label: displayLabel(ev) } : {},
+		...recognitionPatch(ev.subLabelMeta),
 		...ev.confidence !== void 0 ? { confidence: ev.confidence } : {},
 		zones: ev.zones ?? [],
 		...ev.trackId !== void 0 ? { trackId: ev.trackId } : {},
@@ -4428,6 +4522,7 @@ function subjectFromTrack(track, info) {
 		timestamp: track.lastSeen,
 		classNames: track.classes && track.classes.length > 0 ? track.classes : [track.className],
 		...displayLabel(track) !== void 0 ? { label: displayLabel(track) } : {},
+		...recognitionPatch(track.subLabelMeta),
 		...info?.bestConfidence !== void 0 ? { confidence: info.bestConfidence } : {},
 		zones: track.zonesVisited,
 		trackId: track.trackId,
@@ -4463,7 +4558,7 @@ function presentConditionIds(c) {
 	if (c.zonesExclude !== void 0 && c.zonesExclude.length > 0) ids.push("zonesExclude");
 	if (c.crossing !== void 0 && c.crossing !== "enter") ids.push("crossing");
 	if (c.labelEquals !== void 0 && c.labelEquals.length > 0) ids.push("labelEquals");
-	if (c.identities !== void 0 && c.identities.length > 0) ids.push("identities");
+	if (c.identities !== void 0) ids.push("identities");
 	if (c.identitiesExclude !== void 0 && c.identitiesExclude.length > 0) ids.push("identitiesExclude");
 	if (c.minLabelConfidence !== void 0) ids.push("minLabelConfidence");
 	if (c.plates !== void 0) ids.push("plates");
@@ -4549,6 +4644,70 @@ function toLowerSet(values) {
 	return new Set(values.map((v) => v.trim().toLowerCase()));
 }
 /**
+* Does the subject's identity appear in `scope`?
+*
+* TWO LEGS, both load-bearing, and the reason is the migration rather than
+* indecision. `scope` holds gallery ids after `NcRuleStore.load` has resolved
+* them; a name it could not resolve is left as it stands (reported, never
+* dropped), and a record written before ids reached `LabelAttribution` carries
+* a name and no id. Matching only the id would silence the first case; matching
+* only the name would re-introduce the rename bug the id exists to fix.
+*
+* The id leg is exact (a uuid has no case); the name leg is the historical
+* trim + lowercase comparison, unchanged, so a rule that matched yesterday
+* matches today.
+*/
+function matchesIdentityScope(subject, scope) {
+	if (subject.identityId !== void 0 && scope.includes(subject.identityId)) return true;
+	const label = subject.label?.trim().toLowerCase();
+	return label !== void 0 && toLowerSet(scope).has(label);
+}
+/**
+* Does this rule's match depend on RECOGNITION — a face identity or a plate
+* read — rather than on the detection alone?
+*
+* Derived from the conditions the rule already carries; nothing stores it. It
+* is what makes `waitForEnhancement` inert on a rule with nothing to wait for,
+* and what decides whether a track close owes an "…is Gianluca" follow-up.
+* `identitiesExclude` is deliberately NOT in the set: a veto is satisfied by
+* the ABSENCE of a recognition, so waiting for one would delay every
+* notification the rule exists to send.
+*/
+function ruleAwaitsRecognition(rule) {
+	return rule.conditions.identities !== void 0 || rule.conditions.plates !== void 0;
+}
+/**
+* Does this rule stop firing on the object event and fire at TRACK CLOSE?
+*
+* `waitForEnhancement` AND something to wait for AND an `immediate` delivery.
+* A `track-end` rule already fires at close, and a rule with no recognition
+* scope would be delayed for nothing — in both cases the flag is inert, and
+* that is deliberate: the operator sets one switch and the rule tells them
+* whether it applies rather than silently changing when a notification arrives.
+*
+* The consequence is stated where the flag is declared and repeated in the
+* editor: a deferred rule inherits TRACK-CLOSE semantics. Its `zones` condition
+* tests every zone the track visited, and a `crossing` condition can no longer
+* be satisfied. Nothing is remembered between the two moments — the closed
+* track IS the evaluation, so a respawn in the middle costs nothing and the
+* doorbell-mirror failure (D49) has no surface here.
+*/
+function ruleDefersToTrackEnd(rule) {
+	return rule.waitForEnhancement === true && rule.delivery === "immediate" && ruleAwaitsRecognition(rule);
+}
+/**
+* Does a track close owe this rule an "…and it was Gianluca" SECOND
+* notification?
+*
+* The mirror of {@link ruleDefersToTrackEnd}: an `immediate` recognition rule
+* that did NOT wait fired seconds before the face was confirmed, so its
+* notification is true and incomplete. The upgrade is what makes "off" an
+* honest setting rather than a silent downgrade.
+*/
+function ruleUpgradesAtTrackEnd(rule) {
+	return rule.waitForEnhancement !== true && rule.delivery === "immediate" && ruleAwaitsRecognition(rule);
+}
+/**
 * Expand each selected class id to itself PLUS its taxonomy leaf subs, so a
 * MACRO selection (`vehicle`) matches its sub classNames (`car`/`truck`) — the
 * `EVENT_TAXONOMY` tree is the SINGLE source (mirrors the timeline/filter
@@ -4614,7 +4773,9 @@ function evaluateRule(rule, subject, deviceState, zoneOwners) {
 		if (rule.conditions.occupancy !== void 0) return fail("occupancy");
 		if (rule.conditions.systemEvent !== void 0) return fail("systemEvent");
 	} else {
-		if ((rule.delivery === "immediate" ? "object-event" : rule.delivery) !== subject.kind) return fail("delivery");
+		if ((rule.delivery === "immediate" ? "object-event" : rule.delivery) !== subject.kind) {
+			if (!(subject.kind === "track-end" && ruleDefersToTrackEnd(rule))) return fail("delivery");
+		}
 		if (rule.conditions.occupancy !== void 0) return fail("occupancy");
 		if (rule.conditions.systemEvent !== void 0) return fail("systemEvent");
 		if (rule.conditions.audio !== void 0) return fail("audio");
@@ -4684,17 +4845,17 @@ function evaluateRule(rule, subject, deviceState, zoneOwners) {
 	if (c.labelEquals !== void 0 && c.labelEquals.length > 0) {
 		if (label === void 0 || !toLowerSet(c.labelEquals).has(label)) return fail("labelEquals");
 	}
-	if (c.identities !== void 0 && c.identities.length > 0) {
-		if (label === void 0 || !toLowerSet(c.identities).has(label)) return fail("identities");
+	if (c.identities !== void 0) {
+		if (!(c.identities.length > 0 ? matchesIdentityScope(subject, c.identities) : subject.labelKind === "identity")) return fail("identities");
 	}
 	if (c.identitiesExclude !== void 0 && c.identitiesExclude.length > 0) {
-		if (label !== void 0 && toLowerSet(c.identitiesExclude).has(label)) return fail("identitiesExclude");
+		if (matchesIdentityScope(subject, c.identitiesExclude)) return fail("identitiesExclude");
 	}
 	if (c.minLabelConfidence !== void 0) {
 		if (subject.labelConfidence === void 0 || subject.labelConfidence < c.minLabelConfidence) return fail("minLabelConfidence");
 	}
 	if (c.plates !== void 0) {
-		if (subject.label === void 0 || !matchesPlate(subject.label, c.plates.values, c.plates.maxDistance)) return fail("plates");
+		if (!(c.plates.values.length > 0 ? subject.label !== void 0 && matchesPlate(subject.label, c.plates.values, c.plates.maxDistance) : subject.labelKind === "plate")) return fail("plates");
 	}
 	if (c.sensorKinds !== void 0 && c.sensorKinds.length > 0) {
 		if (subject.sensorKind === void 0 || !toLowerSet(c.sensorKinds).has(subject.sensorKind.trim().toLowerCase())) return fail("sensorKinds");
@@ -4759,6 +4920,27 @@ function keysPerClass(rule, subject) {
 	if (subject.kind === "audio-event" || subject.kind === "audio-window") return true;
 	return rule.throttle.granularity === "per-class";
 }
+/**
+* The cooldown scope of ONE system event — subject AND direction.
+*
+* The `kind` is here because a cooldown is a budget for VOLUME and must never
+* be a budget for a DIRECTION. `Eventi di sistema` (60 s, `rule-device`)
+* covers `device-offline` and `device-online` together, so on 2026-08-13 a
+* camera that came back 13 s after going down had its recovery suppressed:
+* the operator kept a "camera offline" as the last word while the camera was
+* up, and — because the liveness ledger HAD advanced on the suppressed flip —
+* the next outage was a genuine flip again and arrived as what read like a
+* duplicate. Same split D62 made one level up between `device-switch:<id>` and
+* `device:<id>`, for the same reason: two facts must not share a slot and
+* cancel each other out.
+*
+* ONE authority: `cooldownKey` and the boot-time cooldown reseed
+* (`NotificationCenter.seedCooldowns`) both call this. They used to build the
+* string separately, which is how a key format drifts across a restart.
+*/
+function systemEventCooldownScope(systemEvent) {
+	return `s:${systemEvent.subject}:k:${systemEvent.kind}`;
+}
 /** Stable cooldown key per the rule's throttle scope + class granularity. */
 /**
 * Does the rule's device scope cover this subject?
@@ -4785,8 +4967,9 @@ function matchesDeviceScope(scope, subject) {
 function cooldownKey(rule, subject) {
 	const first = subject.classNames[0];
 	const classKey = keysPerClass(rule, subject) && first !== void 0 ? `:c:${first}` : "";
-	const scopeRef = subject.systemEvent !== void 0 ? `s:${subject.systemEvent.subject}` : `d:${subject.deviceId}`;
-	return rule.throttle.scope === "rule" ? `r:${rule.id}${classKey}` : `r:${rule.id}:${scopeRef}${classKey}`;
+	const scopeRef = subject.systemEvent !== void 0 ? systemEventCooldownScope(subject.systemEvent) : `d:${subject.deviceId}`;
+	const kindKey = subject.systemEvent !== void 0 ? `:k:${subject.systemEvent.kind}` : "";
+	return rule.throttle.scope === "rule" ? `r:${rule.id}${kindKey}${classKey}` : `r:${rule.id}:${scopeRef}${classKey}`;
 }
 /** True when the rule fired within its cooldown window before `now`. */
 function isCoolingDown(rule, lastFiredAt, now) {
@@ -4899,8 +5082,11 @@ var en_default = {
 	"detection.title": "{{rule}}",
 	"detection.body": "{{subject}} on {{camera}}{{inZones}}",
 	"detection.body.trackEnd": "{{subject}} on {{camera}}{{inZones}} — visit ended",
+	"detection.body.enhanced": "{{subject}} on {{camera}}{{inZones}} — now recognised",
 	"detection.subject": "{{classNoun}}",
 	"detection.subject.labelled": "{{classNoun}} ({{label}})",
+	"detection.subject.identity": "{{label}}",
+	"detection.subject.plate": "{{classNoun}} {{label}}",
 	"detection.inZones": " in {{zones}}",
 	"class.person": {
 		"one": "person",
@@ -4980,6 +5166,7 @@ var en_default = {
 	"system.camera-disabled.body": "Device {{deviceName}} was switched off",
 	"system.camera-enabled.title": "Device switched on",
 	"system.camera-enabled.body": "Device {{deviceName}} was switched back on",
+	"test.prefix": "[TEST] {{body}}",
 	"timelapse.title": "Timelapse — {{camera}}",
 	"timelapse.body.window": "{{rule}} — {{from}}→{{to}}",
 	"timelapse.body.tooManyEvents": "too many events for dense sampling: video at a uniform cadence",
@@ -5062,8 +5249,11 @@ var it_default = {
 	"detection.title": "{{rule}}",
 	"detection.body": "{{subject}} su {{camera}}{{inZones}}",
 	"detection.body.trackEnd": "{{subject}} su {{camera}}{{inZones}} — visita terminata",
+	"detection.body.enhanced": "{{subject}} su {{camera}}{{inZones}} — ora riconosciuto",
 	"detection.subject": "{{classNoun}}",
 	"detection.subject.labelled": "{{classNoun}} ({{label}})",
+	"detection.subject.identity": "{{label}}",
+	"detection.subject.plate": "{{classNoun}} {{label}}",
 	"detection.inZones": " in {{zones}}",
 	"class.person": {
 		"one": "persona",
@@ -5143,6 +5333,7 @@ var it_default = {
 	"system.camera-disabled.body": "Il dispositivo {{deviceName}} è stato spento",
 	"system.camera-enabled.title": "Dispositivo riacceso",
 	"system.camera-enabled.body": "Il dispositivo {{deviceName}} è stato riacceso",
+	"test.prefix": "[TEST] {{body}}",
 	"timelapse.title": "Timelapse — {{camera}}",
 	"timelapse.body.window": "{{rule}} — {{from}}→{{to}}",
 	"timelapse.body.tooManyEvents": "troppi eventi per il campionamento denso: video a cadenza uniforme",
@@ -5417,7 +5608,7 @@ function ncSubjectText(texts, input) {
 		vars: { classNoun }
 	});
 	return texts.text({
-		key: "detection.subject.labelled",
+		key: subjectLabelKey(input.labelKind),
 		vars: {
 			classNoun,
 			label: input.label
@@ -5425,6 +5616,16 @@ function ncSubjectText(texts, input) {
 	});
 }
 /**
+* Which labelled-subject key a recognition gets. A kind the catalog does not
+* name falls back to the generic key rather than printing nothing — the same
+* direction `ncClassNoun` degrades in, and for the same reason.
+*/
+function subjectLabelKey(kind) {
+	if (kind === "identity") return "detection.subject.identity";
+	if (kind === "plate") return "detection.subject.plate";
+	return "detection.subject.labelled";
+}
+/**
 * ` in gate, drive` — INCLUDING its leading space, and empty when there are no
 * zones.
 *
@@ -5923,13 +6124,18 @@ var NcDispatcher = class {
 			...systemCount,
 			frozen: systemEvent?.title ?? entry.payload.ruleName
 		});
-		const body = this.renderText({
+		const rendered = this.renderText({
 			template: entry.payload.template?.body,
 			key: bodyKeyFor(entry),
 			vars,
 			...systemCount,
 			...systemEvent?.body !== void 0 ? { frozen: systemEvent.body } : {}
 		});
+		const body = entry.payload.synthetic === true ? this.renderText({
+			key: "test.prefix",
+			vars: { body: rendered },
+			frozen: rendered
+		}) : rendered;
 		const attachments = [...await this.withArtifactUrls(await this.resolveAttachments(entry)), ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
 		const actions = await this.mintActions(entry, target);
@@ -6286,7 +6492,8 @@ function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
 			...detection.label !== void 0 ? { label: detection.label } : {}
 		}) : systemEvent?.subject ?? ncSubjectText(texts, {
 			className: subject.className,
-			...subject.label !== void 0 ? { label: subject.label } : {}
+			...subject.label !== void 0 ? { label: subject.label } : {},
+			...subject.labelKind !== void 0 ? { labelKind: subject.labelKind } : {}
 		}),
 		inZones: ncInZonesText(texts, zoneLabels),
 		scope: occupancy?.zone ?? deviceName,
@@ -6318,6 +6525,7 @@ function bodyKeyFor(entry) {
 	const subject = entry.payload.subject;
 	if (subject.systemEvent !== void 0) return subject.systemEvent.bodyKey ?? "";
 	if (subject.occupancy !== void 0) return "occupancy.body";
+	if (entry.payload.enhancement === true) return "detection.body.enhanced";
 	return entry.recordKind === "track-end" ? "detection.body.trackEnd" : "detection.body";
 }
 /** The default TITLE key — same shape, same pre-catalog reasoning. */
@@ -7307,6 +7515,73 @@ var NcLivenessLedger = class {
 	async load() {
 		return (await this.ledger.load()).length;
 	}
+	/**
+	* Boot seed from the DEVICE DIRECTORY — the second half of the reseed, and
+	* the fix for the outage this ledger used to swallow.
+	*
+	* ## The hole
+	*
+	* {@link load} recovers what the ledger itself accepted. A device that has
+	* never produced a liveness event since the ledger was created has no row at
+	* all, so its FIRST observation ever seeds silently — and if that first
+	* observation is the camera DYING, the outage is thrown away. Live cost,
+	* 2026-08-13 21:36 CEST: the operator unplugged four cameras and received two
+	* notifications. `device:584` and `device:587` had never spoken; their
+	* unplugging was recorded and never announced. A camera that is quiet until
+	* it dies is a camera whose death is silent, indefinitely.
+	*
+	* ## Why only the ONLINE ones
+	*
+	* The directory is the device manager's own `online` flag (D132 §3: the
+	* authority seeds the mirror at boot and stays the authority). Seeding only
+	* the devices it calls ONLINE is what makes this change one-directional:
+	*
+	*  - a row seeded `online` can only ever turn a later `device.offline` into a
+	*    notification — a true sentence about a device that just went away;
+	*  - it can NEVER turn a `device.online` into one, and that is the only shape
+	*    the 2026-08-13 notification flood (D130) ever had.
+	*
+	* A device the directory calls offline — which is also what a cold or
+	* still-settling directory would say — gets no row and keeps today's
+	* behaviour exactly. Failing toward discard, unchanged.
+	*
+	* ## D49
+	*
+	* An EXISTING row is never overwritten. The ledger is the authority for what
+	* it accepted; the directory is a mirror refreshed on a tick and may be
+	* stale. A stale `online` overwriting an accepted `offline` would make the
+	* camera's real recovery a no-flip and lose it. A failed directory read
+	* simply yields an empty list here and seeds nothing.
+	*
+	* ## Staged, not persisted
+	*
+	* The seed is DERIVED from an authority that is read again on every boot, so
+	* losing it costs nothing — the next boot re-derives it. `stage` therefore
+	* advances the mirror without a write, which matters on this hub: the
+	* pipeline-analytics runner respawns several times an hour, and persisting
+	* ~500 re-derivable rows on each respawn would offer thousands of pointless
+	* commits a day to the checkpoint lottery (D96). The first real
+	* {@link observe} flip persists through the ordinary write-behind path.
+	*
+	* Returns how many rows were seeded, so the caller can say it out loud.
+	*/
+	seedFromDirectory(identities, now) {
+		let seeded = 0;
+		for (const identity of identities) {
+			if (identity.online !== true) continue;
+			const subject = `device:${identity.deviceId}`;
+			if (this.ledger.has(subject)) continue;
+			this.ledger.stage({
+				subject,
+				state: "online",
+				kind: "device-online",
+				deviceId: identity.deviceId,
+				updatedAt: now
+			});
+			seeded += 1;
+		}
+		return seeded;
+	}
 	/** The in-RAM mirror, subject-ordered so two readers agree. */
 	snapshot() {
 		return this.ledger.snapshot().toSorted((a, b) => a.subject.localeCompare(b.subject));
@@ -7799,7 +8074,7 @@ function probeOccupancyNow(input) {
 * field for them would be a cross-package change for a sentence.
 */
 function occupancyProbeLabel(occupancy, probe, cooldownSec) {
-	const classNote = impossibleClassNote(occupancy.className);
+	const classNote = occupancyClassWarning(occupancy.className);
 	if (probe.kind === "unavailable") {
 		const reason = probe.reason === "no-snapshot" ? "no ZoneAnalytics snapshot for this camera — the condition fails closed until one arrives" : "that zone is not in the camera’s current snapshot — the condition fails closed (deleted zone?)";
 		return classNote === null ? reason : `${classNote} · ${reason}`;
@@ -7824,7 +8099,7 @@ function occupancyProbeLabel(occupancy, probe, cooldownSec) {
 * pixel-identical to an empty parking space. `byClass` is MACRO-keyed, so that
 * counter is 0 structurally and no scene can change it.
 */
-function impossibleClassNote(className) {
+function occupancyClassWarning(className) {
 	if (className === void 0 || require_dist.isDetectionMacroClass(className)) return null;
 	return `⚠ “${className}” is a sub-type, not a macro class: this counter is always 0 (use ${[...require_dist.DETECTION_MACRO_CLASSES].join(" / ")})`;
 }
@@ -8078,7 +8353,7 @@ var DEFAULT_DRAIN_BATCH = 20;
 var DEDUP_HYDRATE_WINDOW_MS = 168 * 36e5;
 /** Stable dedup id — the durable per-track/per-record fire guarantee. */
 function outboxEntryId(input) {
-	const dedupRef = input.trackId ?? input.recordId;
+	const dedupRef = input.dedupRef ?? input.trackId ?? input.recordId;
 	return `${input.ruleId}:${dedupRef}:${input.targetId}`;
 }
 var NcOutbox = class {
@@ -8630,7 +8905,130 @@ var NcRuleActionRunner = class {
 	}
 };
 //#endregion
+//#region src/notification-center/rule-status.ts
+/**
+* The live occupancy of the scope ONE rule counts.
+*
+* `count`/`occupied` come from the SAME probe the dry-run uses
+* (`probeOccupancyNow`), so the status and the dry-run can never disagree about
+* a camera. `since` comes from the watcher's CONFIRMED row, which is a
+* different fact and the one the operator actually asks for: the probe reads a
+* level, the watcher records when that level was last confirmed to change.
+*/
+var NcOccupancyRuleStatusSchema = require_dist.object({
+	kind: require_dist.literal("occupancy"),
+	deviceId: require_dist.number().int(),
+	/** Zone NAME when the snapshot knows one, else the zone id, else absent for
+	*  whole-frame — the words a card puts after "in". */
+	scope: require_dist.string().optional(),
+	/** The class counted; absent = every class. */
+	className: require_dist.string().optional(),
+	/** The capacity the predicate compares against (`<=C` keys on C+1). */
+	threshold: require_dist.number().int(),
+	sustainSeconds: require_dist.number().int(),
+	/** The count read for the scope. Absent when the probe was unavailable. */
+	count: require_dist.number().int().optional(),
+	/** `count >= threshold` at the probe. Absent when unavailable. */
+	occupied: require_dist.boolean().optional(),
+	/** Frame time of the snapshot the count came from — how FRESH it is, which
+	*  is a different question from "now". */
+	observedAt: require_dist.number().int().optional(),
+	/** When the watcher last CONFIRMED a change of this key's level. Absent when
+	*  the watcher holds no confirmed row (a cold boot, or a key nothing
+	*  watches). */
+	since: require_dist.number().int().optional(),
+	/** Why there is no count: the two fail-closed shapes of the live path. */
+	unavailable: require_dist._enum(["no-snapshot", "zone-absent"]).optional(),
+	/** A scope the counter can never answer (a sub-type class) — stated, because
+	*  its reading of 0 is pixel-identical to an empty zone. */
+	warning: require_dist.string().optional()
+});
+/** One camera of a timelapse rule — each renders its own video. */
+var NcTimelapseDeviceStatusSchema = require_dist.object({
+	deviceId: require_dist.number().int(),
+	/** Last successful generation for THIS camera (the per-device map, with the
+	*  rule-wide fallback). Absent = never generated. */
+	lastGeneratedAt: require_dist.number().int().optional(),
+	/** The artefact that generation produced, when it is still on the shelf. */
+	lastArtifact: NcArtifactRecordSchema.optional(),
+	/** A render this process is waiting on right now. */
+	rendering: require_dist.object({
+		startedAt: require_dist.number().int(),
+		windowStartMs: require_dist.number().int(),
+		windowEndMs: require_dist.number().int()
+	}).optional()
+});
+var NcTimelapseRuleStatusSchema = require_dist.object({
+	kind: require_dist.literal("timelapse"),
+	devices: require_dist.array(NcTimelapseDeviceStatusSchema),
+	/** The most recent window that has already closed — what the next tick would
+	*  render for any camera that has not got it yet. Absent = none in the
+	*  lookback (a schedule that never closes, or a rule younger than its window). */
+	lastWindow: require_dist.object({
+		startMs: require_dist.number(),
+		endMs: require_dist.number()
+	}).optional(),
+	/** The next OPENING. `endMs` null = the close is beyond the scan horizon. */
+	nextWindow: require_dist.object({
+		startMs: require_dist.number(),
+		endMs: require_dist.number().nullable()
+	}).optional(),
+	/** How long after a close the producer waits for the footage to settle. */
+	settleMs: require_dist.number().int()
+});
+var NcRuleStatusSchema = require_dist.discriminatedUnion("kind", [
+	require_dist.object({
+		kind: require_dist.literal("none"),
+		reason: require_dist.string()
+	}),
+	NcOccupancyRuleStatusSchema,
+	NcTimelapseRuleStatusSchema
+]);
+/**
+* Assemble the occupancy status from the probe and the watcher's confirmed row.
+*
+* Pure. The two inputs are deliberately separate rather than one blob: they
+* answer different questions from different substrates, and merging them at the
+* source would let a missing snapshot erase a `since` the watcher still knows.
+*/
+function buildOccupancyStatus(input) {
+	const { condition, probe, threshold } = input;
+	const key = occupancyKey(input.deviceId, condition.zoneId, condition.className, threshold);
+	const row = input.confirmed.find((r) => r.key === key);
+	const scope = probe.kind === "probed" ? probe.zoneName ?? condition.zoneId : condition.zoneId;
+	return {
+		kind: "occupancy",
+		deviceId: input.deviceId,
+		...scope !== void 0 ? { scope } : {},
+		...condition.className !== void 0 ? { className: condition.className } : {},
+		threshold,
+		sustainSeconds: condition.sustainSeconds,
+		...probe.kind === "probed" ? {
+			count: probe.count,
+			occupied: probe.subject.occupancy?.occupied === true,
+			observedAt: probe.observedAt
+		} : { unavailable: probe.reason },
+		...row !== void 0 ? { since: row.lastChangeAt } : {},
+		...input.warning !== void 0 ? { warning: input.warning } : {}
+	};
+}
+//#endregion
 //#region src/notification-center/rule-store.ts
+/**
+* NcRuleStore — durable Notification Center rule set.
+*
+* Follows the `stationary-registry.ts` precedent: a declared SQLite
+* collection (via the central `SettingsStoreClient`) mirrored into an
+* in-memory cache. The cache serves the hot read path (per-persist rule
+* matching) with zero I/O; every mutation writes through to the store
+* FIRST and only then updates the cache (a failed persist never leaves a
+* phantom in-RAM rule).
+*
+* Cross-node note: the collection lives in the hub's centralized
+* settings-store, so a CRUD served on one node is visible to the
+* evaluating (post-processing) node after its periodic `load()` refresh —
+* bounded staleness, never wrongness (D8 reconcile-over-events).
+*/
 var NC_RULES_COLLECTION = "notification-center:rules";
 var NC_RULES_COLUMNS = [
 	{
@@ -8672,17 +9070,75 @@ var NC_RULES_INDEXES = [{
 	name: "idx_nc_rules_enabled",
 	columns: ["enabled"]
 }];
+/**
+* Resolve display names to gallery ids inside one rule's identity conditions.
+*
+* NON-DESTRUCTIVE and IDEMPOTENT, in that order of importance:
+*
+*  - a value the map answers for becomes the id;
+*  - a value it does not answer for is LEFT AS IT STANDS, not dropped. It is
+*    either already an id (the second load of a migrated rule, and every load
+*    after that), or a name the gallery no longer holds — and a rule whose
+*    scope silently shrank is exactly the failure this repo keeps paying for.
+*    The engine's name leg keeps such a value matching what it always matched;
+*    the caller reports it once.
+*  - nothing is written back. The migration is a READ projection, so a gallery
+*    that failed to load, or loaded empty, cannot rewrite a rule into one that
+*    matches nobody. The stored rule keeps the operator's words forever.
+*
+* Returns the rule unchanged (by identity) when nothing resolved, so `load`
+* can tell a migrated rule from an untouched one without comparing.
+*/
+function migrateIdentityNames(rule, idsByName) {
+	const identities = rule.conditions.identities;
+	const excluded = rule.conditions.identitiesExclude;
+	if (identities === void 0 && excluded === void 0) return {
+		rule,
+		unresolved: []
+	};
+	const unresolved = [];
+	const known = new Set(idsByName.values());
+	const resolve = (values) => values.map((value) => {
+		if (known.has(value)) return value;
+		const id = idsByName.get(value.trim().toLowerCase());
+		if (id !== void 0) return id;
+		unresolved.push(value);
+		return value;
+	});
+	const nextIdentities = identities !== void 0 ? resolve(identities) : void 0;
+	const nextExcluded = excluded !== void 0 ? resolve(excluded) : void 0;
+	if (!(nextIdentities !== void 0 && !sameList(identities ?? [], nextIdentities) || nextExcluded !== void 0 && !sameList(excluded ?? [], nextExcluded))) return {
+		rule,
+		unresolved
+	};
+	return {
+		rule: {
+			...rule,
+			conditions: {
+				...rule.conditions,
+				...nextIdentities !== void 0 ? { identities: nextIdentities } : {},
+				...nextExcluded !== void 0 ? { identitiesExclude: nextExcluded } : {}
+			}
+		},
+		unresolved
+	};
+}
+function sameList(a, b) {
+	return a.length === b.length && a.every((v, i) => v === b[i]);
+}
 var NcRuleStore = class {
 	byId = /* @__PURE__ */ new Map();
 	store;
 	logger;
 	now;
 	newId;
+	identityIdsByName;
 	constructor(deps) {
 		this.store = deps.store;
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
 		this.newId = deps.newId ?? (() => (0, node_crypto.randomUUID)());
+		if (deps.identityIdsByName !== void 0) this.identityIdsByName = deps.identityIdsByName;
 	}
 	static async declare(store) {
 		await store.declareCollection.mutate({
@@ -8703,24 +9159,48 @@ var NcRuleStore = class {
 				collection: NC_RULES_COLLECTION,
 				filter: { limit: 1e4 }
 			});
+			const idsByName = await this.readIdentityIds();
 			this.byId.clear();
 			let skipped = 0;
+			let migrated = 0;
+			const unresolved = /* @__PURE__ */ new Set();
 			for (const row of rows) {
 				const parsed = require_dist.NcRuleSchema.safeParse(row.data["rule"]);
 				if (!parsed.success) {
 					skipped += 1;
 					continue;
 				}
-				this.byId.set(parsed.data.id, parsed.data);
+				const result = migrateIdentityNames(parsed.data, idsByName);
+				if (result.rule !== parsed.data) migrated += 1;
+				for (const name of result.unresolved) unresolved.add(name);
+				this.byId.set(result.rule.id, result.rule);
 			}
 			this.logger.debug("notification rules loaded", { meta: {
 				rules: this.byId.size,
-				...skipped > 0 ? { skippedInvalid: skipped } : {}
+				...skipped > 0 ? { skippedInvalid: skipped } : {},
+				...migrated > 0 ? { identitiesResolvedToIds: migrated } : {}
 			} });
+			if (unresolved.size > 0) this.logger.info("notification rules name identities the gallery does not know", { meta: { names: [...unresolved].join(", ") } });
 		} catch (err) {
 			this.logger.warn("notification rules load failed", { meta: { error: String(err) } });
 		}
 	}
+	/**
+	* The name→id map, lower-cased, or EMPTY when there is none to be had.
+	*
+	* Empty is the safe answer and the only one: `migrateIdentityNames` resolves
+	* nothing from an empty map and leaves every rule as the operator wrote it.
+	* A gallery read that throws must never be able to change what a rule matches.
+	*/
+	async readIdentityIds() {
+		if (this.identityIdsByName === void 0) return /* @__PURE__ */ new Map();
+		try {
+			return await this.identityIdsByName();
+		} catch (err) {
+			this.logger.debug("identity gallery read failed — rules left unmigrated", { meta: { error: String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
 	list() {
 		return [...this.byId.values()].sort((a, b) => b.updatedAt - a.updatedAt);
 	}
@@ -9624,6 +10104,47 @@ function findLastClosedWindow(input) {
 	};
 	return null;
 }
+/**
+* The next window that will OPEN after `nowMs`, and when it closes.
+*
+* The forward twin of {@link findLastClosedWindow}, and the answer to the only
+* question an operator has about a timelapse rule that produced nothing yet:
+* "when is it going to run?". Standing INSIDE a window reports the NEXT one,
+* not the current one — the current one's boundaries are already answerable
+* from the last close, and reporting "next: now" would read as a render that is
+* owed.
+*
+* Derived by scanning `isScheduleActive` for the same reason the backwards scan
+* is: that function is the authority on what a window means (midnight crossing,
+* `invert`, IANA timezone), and a second implementation of it is drift this
+* repo has already paid for.
+*
+* @returns `null` for an always-active schedule (it never opens — it never
+*   closed either), and for one with no opening inside the lookahead. A window
+*   whose CLOSE falls beyond the horizon is reported with `endMs: null`: the
+*   opening is the fact the operator asked for, and clamping the close to the
+*   scan floor would report a window that ends when the scan gave up.
+*/
+function findNextWindowOpen(input) {
+	const step = Math.max(1e3, input.stepMs ?? 6e4);
+	const from = Math.floor(input.nowMs / step) * step;
+	const ceiling = input.nowMs + input.lookaheadMs;
+	const active = (t) => require_dist.isScheduleActive(input.schedule, t);
+	let startMs = null;
+	for (let t = from; t + step <= ceiling; t += step) if (!active(t) && active(t + step)) {
+		startMs = t + step;
+		break;
+	}
+	if (startMs === null) return null;
+	for (let t = startMs; t + step <= ceiling; t += step) if (!active(t + step)) return {
+		startMs,
+		endMs: t + step
+	};
+	return {
+		startMs,
+		endMs: null
+	};
+}
 /** The canvas behind a tile whose aspect does not fill its cell. */
 var MOSAIC_BACKGROUND = {
 	r: 17,
@@ -10255,11 +10776,23 @@ var NcSummaryProducer = class {
 		this.tickMs = deps.tickMs ?? 6e4;
 		this.texts = deps.texts ?? new NcTextCatalog();
 	}
+	/**
+	* Boot: arm the interval, then fire the back-fill tick WITHOUT waiting on it.
+	*
+	* Same contract as the timelapse producer, and for the same reason: a digest
+	* tick renders a mosaic and publishes it, so awaiting it here would hold
+	* `NotificationCenter.start()` → the addon's `initialize()` → the runner's
+	* capability manifest. `start()` resolving means the producer is running,
+	* never that the back-fill has finished. See `timelapse-scheduler.start()`
+	* for the incident this pins.
+	*/
 	async start() {
-		await this.tick();
 		this.timer = setInterval(() => {
 			this.tick();
 		}, this.tickMs);
+		this.tick().catch((err) => {
+			this.deps.logger.warn("summary back-fill tick failed", { meta: { error: String(err) } });
+		});
 	}
 	stop() {
 		if (this.timer !== null) {
@@ -11179,6 +11712,13 @@ var BboxSchema = require_dist.object({
 * all — picking the wrong one is the single most common reason an operator's
 * rule "does not fire", and making it an explicit choice is half the point of
 * the tester.
+*
+* It is now EVERY kind, without exception, because the per-rule Test button
+* (`nc.testRule`) plans its injection from the rule and must be able to test
+* any rule an operator can author. The two that arrived last are the two whose
+* rules were previously untestable end-to-end: a SOUND rule fires only on a
+* confirmed sampling window (`audio-window`, not the single classified sample
+* `audio-event` stands for), and a SYSTEM rule fires on no record at all.
 */
 var TriggerSchema = require_dist._enum([
 	"object-event",
@@ -11186,7 +11726,9 @@ var TriggerSchema = require_dist._enum([
 	"device-event",
 	"package-event",
 	"audio-event",
-	"occupancy-event"
+	"audio-window",
+	"occupancy-event",
+	"system-event"
 ]);
 /**
 * What the operator typed. Every field maps onto exactly one field of
@@ -11250,6 +11792,47 @@ var NcTestEventInputSchema = require_dist.object({
 		occupied: require_dist.boolean(),
 		threshold: require_dist.number().int().min(1)
 	}).optional(),
+	/**
+	* AUDIO-WINDOW: the confirmed sampling window.
+	*
+	* Every field of the engine's {@link NcAudioWindowSubject}, because
+	* `matchesAudio` pairs a rule to the window that BELONGS to it — the spec
+	* fields (`samplingSeconds`, `dbThreshold`, `specLabels`) are compared for
+	* equality, so a window built from anything but the rule's own condition
+	* fails closed and the test would report a rule that works as broken.
+	*/
+	audioWindow: require_dist.object({
+		hitPercent: require_dist.number().min(0).max(100),
+		samplingSeconds: require_dist.number().int().min(1).max(300),
+		samples: require_dist.number().int().min(0),
+		hits: require_dist.number().int().min(0),
+		dbThreshold: require_dist.number().optional(),
+		peakDbfs: require_dist.number().optional(),
+		specLabels: require_dist.array(require_dist.string().min(1)).optional(),
+		labels: require_dist.array(require_dist.string().min(1)).default([])
+	}).optional(),
+	/**
+	* SYSTEM-EVENT: the normalized infrastructure event.
+	*
+	* The catalog KEYS travel, never the sentence — exactly as the live intake
+	* freezes them (`event-intake.ts`), so a tested system notification is
+	* worded by the same text catalog, in the same language, as the real one. A
+	* tester that froze English prose here would be testing its own prose.
+	*/
+	systemEvent: require_dist.object({
+		kind: require_dist.NcSystemEventKindSchema,
+		/** The dedup subject (`device:617`, `node:agent-1`, …). */
+		subject: require_dist.string().min(1),
+		titleKey: require_dist.string().min(1),
+		bodyKey: require_dist.string().min(1),
+		textParams: require_dist.record(require_dist.string(), require_dist.string()).default({}),
+		/** The device the event is ABOUT; absent = an event with no device. */
+		deviceId: require_dist.number().int().optional(),
+		/** `DeviceType` value — what a `deviceTypes` condition is judged against. */
+		deviceType: require_dist.string().min(1).optional(),
+		nodeId: require_dist.string().min(1).optional(),
+		packageName: require_dist.string().min(1).optional()
+	}).optional(),
 	/** The instant the event happened. Absent = now. Set it to test a schedule
 	*  condition without waiting for the hour. */
 	timestamp: require_dist.number().int().optional(),
@@ -11337,6 +11920,12 @@ function isSyntheticId(id) {
 function triggerCanCarryStill(kind) {
 	return kind === "object-event" || kind === "package-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event";
 }
+/** The detection provenance production stamps on a subject of this kind. */
+function syntheticSource(kind) {
+	if (kind === "device-event") return "sensor";
+	if (kind === "audio-window") return "audio";
+	return "pipeline";
+}
 /**
 * Build the synthetic envelope. Pure: same input + same id + same clock ⇒ same
 * event, so the red-green test can assert that this subject and a
@@ -11350,7 +11939,7 @@ function buildSyntheticEvent(input, recordId, now) {
 		subject: {
 			kind,
 			recordId,
-			deviceId: input.deviceId,
+			deviceId: kind === "system-event" ? 0 : input.deviceId,
 			...input.sourceDeviceId !== void 0 && input.sourceDeviceId !== input.deviceId ? { sourceDeviceId: input.sourceDeviceId } : {},
 			timestamp,
 			classNames: input.classNames,
@@ -11358,7 +11947,7 @@ function buildSyntheticEvent(input, recordId, now) {
 			...input.confidence !== void 0 ? { confidence: input.confidence } : {},
 			zones: input.zones,
 			...carriesTrackId ? { trackId: recordId } : {},
-			source: input.source ?? (kind === "device-event" ? "sensor" : "pipeline"),
+			source: input.source ?? syntheticSource(kind),
 			...input.importance !== void 0 ? { importance: input.importance } : {},
 			...input.dwellSeconds !== void 0 ? { dwellSeconds: input.dwellSeconds } : {},
 			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
@@ -11367,6 +11956,28 @@ function buildSyntheticEvent(input, recordId, now) {
 			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
 			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
 			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
+			...input.audioWindow !== void 0 ? { audioWindow: {
+				hitPercent: input.audioWindow.hitPercent,
+				samplingSeconds: input.audioWindow.samplingSeconds,
+				samples: input.audioWindow.samples,
+				hits: input.audioWindow.hits,
+				...input.audioWindow.dbThreshold !== void 0 ? { dbThreshold: input.audioWindow.dbThreshold } : {},
+				...input.audioWindow.peakDbfs !== void 0 ? { peakDbfs: input.audioWindow.peakDbfs } : {},
+				...input.audioWindow.specLabels !== void 0 ? { specLabels: input.audioWindow.specLabels } : {},
+				labels: input.audioWindow.labels
+			} } : {},
+			...input.systemEvent !== void 0 ? { systemEvent: {
+				kind: input.systemEvent.kind,
+				subject: input.systemEvent.subject,
+				titleKey: input.systemEvent.titleKey,
+				bodyKey: input.systemEvent.bodyKey,
+				textParams: input.systemEvent.textParams,
+				...input.systemEvent.deviceId !== void 0 ? { deviceId: input.systemEvent.deviceId } : {},
+				...input.systemEvent.deviceType !== void 0 ? { deviceType: input.systemEvent.deviceType } : {},
+				...input.systemEvent.nodeId !== void 0 ? { nodeId: input.systemEvent.nodeId } : {},
+				...input.systemEvent.packageName !== void 0 ? { packageName: input.systemEvent.packageName } : {},
+				data: { category: "synthetic.test" }
+			} } : {},
 			...input.occupancy !== void 0 ? { occupancy: {
 				...input.occupancy.zoneId !== void 0 ? { zoneId: input.occupancy.zoneId } : {},
 				...input.occupancy.zoneName !== void 0 ? { zoneName: input.occupancy.zoneName } : {},
@@ -12025,6 +12636,84 @@ function planDenseRanges(input) {
 		denseSec
 	};
 }
+function newGroup(event) {
+	const classCounts = /* @__PURE__ */ new Map();
+	if (event.className !== void 0) classCounts.set(event.className, 1);
+	return {
+		...event.trackId !== void 0 ? { trackId: event.trackId } : {},
+		firstSeen: event.timestamp,
+		lastSeen: event.timestamp,
+		classCounts
+	};
+}
+function absorb(group, event) {
+	if (event.timestamp < group.firstSeen) group.firstSeen = event.timestamp;
+	if (event.timestamp > group.lastSeen) group.lastSeen = event.timestamp;
+	if (event.className === void 0) return;
+	group.classCounts.set(event.className, (group.classCounts.get(event.className) ?? 0) + 1);
+}
+/** The class most rows agreed on; ties go to whichever appeared first, so the
+*  same window always produces the same sentence. */
+function dominantClass(group) {
+	let best;
+	let bestCount = 0;
+	for (const [className, count] of group.classCounts) if (count > bestCount) {
+		best = className;
+		bestCount = count;
+	}
+	return best;
+}
+function toInterval(group) {
+	const className = dominantClass(group);
+	return {
+		...group.trackId !== void 0 ? { trackId: group.trackId } : {},
+		firstSeen: group.firstSeen,
+		lastSeen: group.lastSeen,
+		...className !== void 0 ? { className } : {}
+	};
+}
+/**
+* Fold persisted tracks and object events into one subject-per-entry array.
+*
+* @returns intervals sorted by `firstSeen` ascending. A persisted track is
+*   returned unchanged and its own events are discarded: the store knows when
+*   the track really began, the events only know when the emitter chose to
+*   write one, and widening a persisted interval from event timestamps would
+*   move a range boundary for no operator-visible gain.
+*/
+function mergeDetectionIntervals(input) {
+	const gapMs = Math.max(0, input.tracklessGapMs ?? 1e4);
+	const persistedIds = /* @__PURE__ */ new Set();
+	for (const track of input.tracks) if (track.trackId !== void 0) persistedIds.add(track.trackId);
+	const ordered = input.events.toSorted((a, b) => a.timestamp - b.timestamp);
+	const byTrackId = /* @__PURE__ */ new Map();
+	const trackless = [];
+	const openByClass = /* @__PURE__ */ new Map();
+	for (const event of ordered) {
+		const trackId = event.trackId;
+		if (trackId !== void 0) {
+			if (persistedIds.has(trackId)) continue;
+			const existing = byTrackId.get(trackId);
+			if (existing === void 0) byTrackId.set(trackId, newGroup(event));
+			else absorb(existing, event);
+			continue;
+		}
+		const key = event.className ?? "";
+		const open = openByClass.get(key);
+		if (open !== void 0 && event.timestamp - open.lastSeen <= gapMs) {
+			absorb(open, event);
+			continue;
+		}
+		const group = newGroup(event);
+		trackless.push(group);
+		openByClass.set(key, group);
+	}
+	return [
+		...input.tracks,
+		...[...byTrackId.values()].map(toInterval),
+		...trackless.map(toInterval)
+	].toSorted((a, b) => a.firstSeen - b.firstSeen);
+}
 //#endregion
 //#region src/notification-center/timelapse/footage-coverage.ts
 /**
@@ -12077,8 +12766,6 @@ function footageCoverage(ranges, windowStartMs, windowEndMs) {
 		complete: windowMs - coveredMs <= COVERAGE_COMPLETE_SLACK_MS
 	};
 }
-/** How long a scheduled timelapse's file is kept by the export engine. */
-var TIMELAPSE_EXPORT_LIFE_MS = 7 * 864e5;
 var TimelapseRenderError = class extends Error {
 	reason;
 	constructor(reason, message) {
@@ -12106,8 +12793,79 @@ function pickProfile(ranges, window) {
 	}
 	return best;
 }
-/** `HH:MM`, for the export title an operator sees in the exports list. */
-function clockOf$1(atMs) {
+/**
+* Is `record` the render this request is about to order?
+*
+* The range, the source profile and the BASE cadence must match exactly — those
+* three decide what the video is. The dense overlay deliberately does NOT: it
+* is derived from the tracks the window happened to hold, and a retry minutes
+* later plans it from a slightly longer list. Refusing to adopt over a moved
+* range boundary would re-order the whole ten hours for a difference nobody can
+* see, which is precisely the loop this exists to break.
+*/
+function coversTheSameRender(record, want) {
+	const timelapse = record.options.timelapse;
+	if (timelapse === void 0) return false;
+	return record.profile === want.profile && record.fromMs === want.fromMs && record.toMs === want.toMs && timelapse.everyMs === want.everyMs && timelapse.outputFps === want.outputFps;
+}
+/**
+* Would adopting `record` LOSE the slowdown this render planned?
+*
+* The adoption check deliberately ignores the dense RANGES (a retry plans them
+* from a slightly longer track list, and re-ordering ten hours over a moved
+* boundary is the loop adoption exists to break). It must NOT ignore whether a
+* dense overlay exists at all.
+*
+* The failure this closes: attempt one reads the detections while the store is
+* unreachable, plans nothing, and queues a UNIFORM ten-hour export; every retry
+* then plans ranges correctly, finds that uniform export alive under the same
+* (profile, range, base cadence, fps) key, adopts it, and delivers a video that
+* never slows down — for the whole night, no matter how many retries run. The
+* notification would even caption it "2 persone". A re-order costs ~20 min of
+* ffmpeg ONCE; adopting the wrong product costs the night.
+*
+* Bounded, and that is why it is safe: the verdict is a function of the plan, so
+* the export ordered after a refusal carries the dense overlay and the NEXT
+* retry adopts it. Only a plan that changed direction refuses, never a retry.
+* A candidate DENSER than what we want is adopted — more slowdown than asked is
+* not a defect, and refusing it would re-order for nothing.
+*/
+function keepsThePlannedSlowdown(record, want) {
+	if (want === void 0) return true;
+	const dense = record.options.timelapse?.dense;
+	if (dense === void 0 || dense.ranges.length === 0) return false;
+	return dense.everyMs <= want.everyMs;
+}
+/** Can this row still become — or already be — a file we can fetch? */
+function isAdoptable(record, nowMs) {
+	if (record.expiresAt <= nowMs) return false;
+	if (record.state === "ready") return record.fileBytes !== null;
+	return record.state === "queued" || record.state === "rendering";
+}
+/**
+* `HH:MM` in the RULE's timezone, for the export title an operator reads.
+*
+* The zone is not decoration. The hub container runs on UTC while the operator
+* and every one of his schedules run on Europe/Rome, so the host-local
+* derivation this used to do titled a 21:00→07:00 window `19:00→05:00` — two
+* hours off, on the one string whose whole job is to say which night the file
+* is. The window boundaries themselves were always correct: `isScheduleActive`
+* has resolved minutes through `schedule.timezone` from the start, and only the
+* label lied.
+*
+* An absent or unknown IANA name falls back to the host zone, which is exactly
+* what `localDayMinute` does for the same input — one behaviour for a bad
+* zone, not two.
+*/
+function clockOf$1(atMs, timeZone) {
+	if (timeZone !== void 0) try {
+		return new Intl.DateTimeFormat("en-GB", {
+			timeZone,
+			hour: "2-digit",
+			minute: "2-digit",
+			hourCycle: "h23"
+		}).format(new Date(atMs));
+	} catch {}
 	const d = new Date(atMs);
 	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
 }
@@ -12139,12 +12897,25 @@ var TimelapseRenderer = class {
 			});
 			throw new TimelapseRenderError("no-footage", `no footage for ${deviceId} in ${window.startMs}..${window.endMs}`);
 		}
-		const tracks = await this.ports.listTracks({
+		const [tracks, events] = await Promise.all([this.ports.listTracks({
+			deviceId,
+			since: window.startMs,
+			until: window.endMs
+		}).catch((err) => {
+			this.ports.logger.warn("timelapse track read failed — dense plan degraded", {
+				tags,
+				meta: {
+					ruleId: request.ruleId,
+					error: String(err)
+				}
+			});
+			return [];
+		}), this.ports.listDetectionEvents({
 			deviceId,
 			since: window.startMs,
 			until: window.endMs
 		}).catch((err) => {
-			this.ports.logger.warn("timelapse dense plan unavailable — rendering uniform", {
+			this.ports.logger.warn("timelapse detection-event read failed — dense plan degraded", {
 				tags,
 				meta: {
 					ruleId: request.ruleId,
@@ -12152,13 +12923,17 @@ var TimelapseRenderer = class {
 				}
 			});
 			return [];
+		})]);
+		const subjects = mergeDetectionIntervals({
+			tracks,
+			events
 		});
 		const detections = countDetections({
-			tracks,
+			tracks: subjects,
 			...request.reportClasses !== void 0 ? { reportClasses: request.reportClasses } : {}
 		});
 		const plan = planDenseRanges({
-			tracks,
+			tracks: subjects,
 			windowStartMs: window.startMs,
 			windowEndMs: window.endMs,
 			padSec: 5,
@@ -12191,16 +12966,25 @@ var TimelapseRenderer = class {
 				mergedRanges: plan.mergedCount
 			}
 		});
-		const queued = await this.ports.createExport({
+		const adopted = await this.findAdoptable({
+			deviceId,
+			profile: chosen.profile,
+			fromMs: window.startMs,
+			toMs: window.endMs
+		}, {
+			everyMs,
+			outputFps: request.framerate
+		}, dense, tags);
+		const queued = adopted ?? await this.ports.createExport({
 			deviceId,
 			profile: chosen.profile,
 			fromMs: window.startMs,
 			toMs: window.endMs,
 			options: {
 				includeAudio: false,
-				maxLifeMs: TIMELAPSE_EXPORT_LIFE_MS,
+				maxLifeMs: 6048e5,
 				deleteAfterDownload: false,
-				title: `${request.ruleName} ${clockOf$1(window.startMs)}→${clockOf$1(window.endMs)}`,
+				title: `${request.ruleName} ${clockOf$1(window.startMs, request.timezone)}→${clockOf$1(window.endMs, request.timezone)}`,
 				timelapse: {
 					everyMs,
 					outputFps: request.framerate,
@@ -12208,7 +12992,7 @@ var TimelapseRenderer = class {
 				}
 			}
 		});
-		this.ports.logger.info("timelapse export queued", {
+		this.ports.logger.info(adopted === null ? "timelapse export queued" : "timelapse export adopted", {
 			tags,
 			meta: {
 				ruleId: request.ruleId,
@@ -12219,7 +13003,11 @@ var TimelapseRenderer = class {
 				denseSource: cadence.source,
 				denseDwellApplied: cadence.dwellApplied,
 				denseRanges: plan.ranges.length,
-				coveragePct: chosen.coverage.percent
+				denseTracks: tracks.length,
+				denseEvents: events.length,
+				denseSubjects: subjects.length,
+				coveragePct: chosen.coverage.percent,
+				...adopted !== null ? { adoptedState: adopted.state } : {}
 			}
 		});
 		const finished = await this.awaitReady(queued, tags);
@@ -12237,14 +13025,79 @@ var TimelapseRenderer = class {
 			fileBytes: finished.fileBytes
 		};
 	}
-	/** Poll to a terminal state, under a bound. */
+	/**
+	* The render this request would order, if the engine already owes it.
+	*
+	* Never throws: an adoption lookup that fails costs one duplicate export,
+	* which is strictly better than costing the window. It says so, though — a
+	* branch that silently drops the protection reads as "there was nothing to
+	* adopt".
+	*/
+	async findAdoptable(want, cadence, wantDense, tags) {
+		const rows = await this.ports.listExports({ deviceId: want.deviceId }).catch((err) => {
+			this.ports.logger.warn("timelapse could not check for an export already in flight", {
+				tags,
+				meta: { error: String(err) }
+			});
+			return null;
+		});
+		if (rows === null) return null;
+		const now = this.ports.now();
+		const sameRender = rows.filter((r) => isAdoptable(r, now) && coversTheSameRender(r, {
+			...want,
+			...cadence
+		}));
+		const usable = sameRender.filter((r) => keepsThePlannedSlowdown(r, wantDense));
+		if (usable.length < sameRender.length) this.ports.logger.info("timelapse refused to adopt an export with no dense overlay", {
+			tags,
+			meta: {
+				candidates: sameRender.length,
+				refused: sameRender.length - usable.length,
+				wantDenseEveryMs: wantDense?.everyMs ?? null,
+				wantDenseRanges: wantDense?.ranges.length ?? 0
+			}
+		});
+		const ready = usable.find((r) => r.state === "ready");
+		if (ready !== void 0) return ready;
+		return usable.toSorted((a, b) => a.createdAt - b.createdAt)[0] ?? null;
+	}
+	/**
+	* Poll to a terminal state, under a bound.
+	*
+	* The bound belongs to the RENDER, not to any single poll of it. A
+	* `getExport` that fails on the transport says nothing at all about the
+	* ffmpeg on the recording node — and treating it as fatal is how a finished
+	* 12.5 MB video was abandoned on 2026-08-14: one `UDS request timed out after
+	* 60000ms` at 05:10:47 threw straight out of the wait for an export that
+	* reached `ready` at 05:23:47. So a failed poll is retried until the
+	* deadline, and only a TERMINAL state the engine actually reported ends the
+	* wait early.
+	*/
 	async awaitReady(queued, tags) {
 		if (queued.state === "ready") return queued;
 		const deadline = this.ports.now() + this.timeoutMs;
 		let current = queued;
+		let pollFailures = 0;
+		let lastPollError = null;
 		while (this.ports.now() < deadline) {
 			await this.ports.sleep(this.pollMs);
-			current = await this.ports.getExport({ exportId: queued.id });
+			const polled = await this.ports.getExport({ exportId: queued.id }).catch((err) => {
+				pollFailures += 1;
+				lastPollError = String(err);
+				const entry = {
+					tags,
+					meta: {
+						exportId: queued.id,
+						pollFailures,
+						error: lastPollError
+					}
+				};
+				if (pollFailures === 1) this.ports.logger.warn("timelapse export poll failed — the render is still owed", entry);
+				else this.ports.logger.debug("timelapse export poll failed again", entry);
+				return null;
+			});
+			if (polled === null) continue;
+			current = polled;
 			if (current.state === "ready") return current;
 			if (current.state === "failed" || current.state === "expired" || current.state === "deleted") {
 				this.ports.logger.warn("timelapse export did not finish", {
@@ -12263,10 +13116,12 @@ var TimelapseRenderer = class {
 			meta: {
 				exportId: queued.id,
 				timeoutMs: this.timeoutMs,
-				lastState: current.state
+				lastState: current.state,
+				pollFailures,
+				...lastPollError !== null ? { lastPollError } : {}
 			}
 		});
-		throw new TimelapseRenderError("export-timeout", `export ${queued.id} timed out after ${this.timeoutMs}ms`);
+		throw new TimelapseRenderError("export-timeout", `export ${queued.id} timed out after ${this.timeoutMs}ms` + (pollFailures > 0 ? ` (${pollFailures} poll failures, last: ${lastPollError})` : ""));
 	}
 	/**
 	* Mint the public link, or say why there is none.
@@ -12475,6 +13330,25 @@ function buildTimelapseOutboxInputs(input) {
 		};
 	});
 }
+//#endregion
+//#region src/notification-center/timelapse/timelapse-scheduler.ts
+/**
+* How long after a window closes before it is rendered.
+*
+* A track is persisted when it CLOSES, and a track that was open at 06:00
+* lands minutes later. Rendering at the stroke of the boundary would miss
+* exactly the tracks the dense plan is built from — the ones still moving when
+* the window ended.
+*/
+var TIMELAPSE_SETTLE_MS = 5 * 6e4;
+/**
+* How far back a tick may look for a close.
+*
+* Eight days, so a hub that was down over a long weekend still finds last
+* night. The scan short-circuits at the first close it meets, so a rule with a
+* nightly window costs about a day's worth of minute steps, not eight.
+*/
+var TIMELAPSE_LOOKBACK_MS = 8 * 864e5;
 /**
 * The earliest window CLOSE a (rule, device) pair may ever be offered.
 *
@@ -12504,10 +13378,15 @@ function buildTimelapseOutboxInputs(input) {
 function timelapseEligibilityFloor(rule, deviceId) {
 	return Math.max(require_dist.readTimelapseGeneratedAt(rule, deviceId), rule.createdAt);
 }
+/** The in-flight map's key. One render per (rule, camera) pair by construction. */
+function renderFlightKey(ruleId, deviceId) {
+	return `${ruleId}:${String(deviceId)}`;
+}
 var TimelapseScheduler = class {
 	deps;
 	timer = null;
 	tickInFlight = false;
+	inFlight = /* @__PURE__ */ new Map();
 	settleMs;
 	lookbackMs;
 	tickMs;
@@ -12520,16 +13399,32 @@ var TimelapseScheduler = class {
 		this.texts = deps.texts ?? new NcTextCatalog();
 	}
 	/**
-	* Boot: one tick (the back-fill) and then the interval.
+	* Boot: arm the interval, then fire the back-fill tick WITHOUT waiting on it.
 	*
 	* The back-fill needs no special path — it IS a tick. A window that closed
 	* while the process was down is simply a window whose pair has no stamp.
+	*
+	* `start()` resolving must mean "the producer is running", never "the
+	* back-fill has finished". A back-fill tick renders video: one window can sit
+	* in `awaitReady` for the full `RENDER_TIMEOUT_MS` (30 min), once per (rule,
+	* camera) pair. Awaiting it here held `NotificationCenter.start()`, which held
+	* the addon's `initialize()`, which is what publishes the runner's capability
+	* manifest — so on 2026-08-14 a single 10-hour timelapse window took
+	* `notification-rules`, `videoclips`, `face-gallery`, `plate-gallery`,
+	* `zone-analytics`, `audio-metrics` and `pipeline-analytics` off the cluster
+	* entirely, and the admin UI answered "provider not available".
+	*
+	* `tick()` never throws for a render failure — `produce()` swallows those and
+	* leaves the pair unstamped — so the catch here only covers a store read that
+	* fails, and it must not become an unhandled rejection.
 	*/
 	async start() {
-		await this.tick();
 		this.timer = setInterval(() => {
 			this.tick();
 		}, this.tickMs);
+		this.tick().catch((err) => {
+			this.deps.logger.warn("timelapse back-fill tick failed", { meta: { error: String(err) } });
+		});
 	}
 	stop() {
 		if (this.timer !== null) {
@@ -12638,6 +13533,13 @@ var TimelapseScheduler = class {
 	*/
 	async produce(rule, deviceId, window, opts) {
 		const tags = { deviceId };
+		const flightKey = renderFlightKey(rule.id, deviceId);
+		this.inFlight.set(flightKey, {
+			ruleId: rule.id,
+			deviceId,
+			window,
+			startedAt: this.deps.now()
+		});
 		try {
 			const deviceName = await this.resolveDeviceName(deviceId);
 			const outcome = await this.deps.render({
@@ -12649,6 +13551,7 @@ var TimelapseScheduler = class {
 				framerate: rule.framerate,
 				...rule.denseCadenceSec !== void 0 ? { denseCadenceSec: rule.denseCadenceSec } : {},
 				...rule.minDwellSec !== void 0 ? { minDwellSec: rule.minDwellSec } : {},
+				...rule.schedule.timezone !== void 0 ? { timezone: rule.schedule.timezone } : {},
 				previewText: timelapsePreviewText({
 					deviceId,
 					...deviceName !== null ? { deviceName } : {},
@@ -12721,8 +13624,15 @@ var TimelapseScheduler = class {
 				window,
 				error: err instanceof Error ? err.message : String(err)
 			};
+		} finally {
+			this.inFlight.delete(flightKey);
 		}
 	}
+	/** Renders this process currently owes, newest last. Read by the rule-status
+	*  surface; never a decision input for the scheduler itself. */
+	renderInFlight() {
+		return [...this.inFlight.values()];
+	}
 	async resolveDeviceName(deviceId) {
 		const get = this.deps.getDeviceName;
 		if (get === void 0) return null;
@@ -13134,6 +14044,14 @@ var NcZoneOwnershipCache = class {
 /** The one cap whose `trigger` the combined alarm notification joins on. */
 var ALARM_PANEL_CAP = require_dist.alarmPanelCapability.name;
 /**
+* How far ahead a status may scan for the next window opening.
+*
+* Nine days rather than "as far as it takes": a weekly schedule opens within
+* seven, and a schedule that opens less often than that is one whose next run
+* is not the fact an operator is looking at a card for.
+*/
+var TIMELAPSE_LOOKAHEAD_MS = 9 * 864e5;
+/**
 * The synthetic rule id an alarm ANNOUNCEMENT is enqueued under.
 *
 * The arm announcement is addressed to the panel's own `announceTargets`, not
@@ -13317,6 +14235,44 @@ function historyRecordKind(kind) {
 function contactReadingOf(state) {
 	if (state === "open" || state === "closed") return state;
 }
+/**
+* The subject kind a persisted record kind maps to.
+*
+* `NcOutboxRecordKind` carries two kinds a rule subject never has —
+* `timelapse` and `ai-summary` are SCHEDULE boundaries, not records. They are
+* mapped to `device-event`, which is class-agnostic in `cooldownKey`, so their
+* key is the one the seeder already built for them. A switch rather than a
+* cast: a kind added to either union has to be answered for here.
+*/
+function cooldownSubjectKind(kind) {
+	switch (kind) {
+		case "timelapse":
+		case "ai-summary": return "device-event";
+		default: return kind;
+	}
+}
+/**
+* A persisted outbox row, reduced to exactly what `cooldownKey` reads.
+*
+* The point is that it reads NOTHING else: the boot-time cooldown reseed calls
+* the same builder the live path does, so the two can never address different
+* windows. Only the four fields the key is a function of are reconstructed —
+* the class (for `per-class` and audio), the subject kind (which decides
+* whether audio is keyed per class at all), the system event (subject +
+* direction) and the device.
+*/
+function cooldownSubjectFromOutbox(entry) {
+	const subject = entry.payload.subject;
+	return {
+		kind: cooldownSubjectKind(entry.recordKind),
+		recordId: entry.recordId,
+		deviceId: entry.deviceId,
+		timestamp: subject.timestamp,
+		classNames: subject.className.length > 0 ? [subject.className] : [],
+		zones: [...subject.zones],
+		...subject.systemEvent !== void 0 ? { systemEvent: subject.systemEvent } : {}
+	};
+}
 function historySystemEventKind(kind) {
 	if (kind === "alarm-arming") return "alarm-armed";
 	if (kind === "alarm-arm-refused") return "alarm-disarmed";
@@ -13780,7 +14736,8 @@ var NotificationCenter = class NotificationCenter {
 		this.now = deps.now ?? (() => Date.now());
 		this.rules = new NcRuleStore({
 			store: deps.store,
-			logger: this.logger.child("rules")
+			logger: this.logger.child("rules"),
+			...deps.identityIdsByName !== void 0 ? { identityIdsByName: deps.identityIdsByName } : {}
 		});
 		this.textStore = new NcTextCatalogStore({
 			store: deps.store,
@@ -14154,6 +15111,120 @@ var NotificationCenter = class NotificationCenter {
 			...report.droppedBy !== void 0 ? { droppedBy: report.droppedBy } : {}
 		};
 	}
+	/**
+	* The live status of ONE detection rule — see `rule-status.ts`.
+	*
+	* `none` is a real answer, not a failure: most rule kinds have no live state
+	* a card could show, and returning an empty object would read as a read that
+	* failed. Only occupancy has one today, and it is the kind whose entire
+	* subject is a number nobody can see.
+	*/
+	async ruleStatusFor(rule) {
+		const occupancy = rule.conditions.occupancy;
+		if (occupancy === void 0) return {
+			kind: "none",
+			reason: "this rule has no live state to report"
+		};
+		const deviceId = rule.conditions.devices?.[0];
+		const read = this.deps.readOccupancySnapshots;
+		const threshold = occupancyThreshold(occupancy);
+		if (deviceId === void 0 || read === void 0) return buildOccupancyStatus({
+			deviceId: deviceId ?? 0,
+			condition: occupancy,
+			probe: {
+				kind: "unavailable",
+				reason: "no-snapshot"
+			},
+			confirmed: this.occupancyWatcher.snapshotState(),
+			threshold
+		});
+		let snapshot = null;
+		try {
+			snapshot = (await read([deviceId])).get(deviceId) ?? null;
+		} catch (err) {
+			this.logger.warn("rule status could not read the live occupancy snapshot", {
+				tags: { deviceId },
+				meta: {
+					ruleId: rule.id,
+					error: String(err)
+				}
+			});
+		}
+		const probe = probeOccupancyNow({
+			occupancy,
+			deviceId,
+			snapshot,
+			now: this.now()
+		});
+		const warning = occupancyClassWarning(occupancy.className);
+		return buildOccupancyStatus({
+			deviceId,
+			condition: occupancy,
+			probe,
+			confirmed: this.occupancyWatcher.snapshotState(),
+			threshold,
+			...warning !== null ? { warning } : {}
+		});
+	}
+	/**
+	* The live status of one TIMELAPSE rule.
+	*
+	* Three facts, and each answers a question the rule itself cannot: when each
+	* camera last produced (and the artefact it produced, while the shelf still
+	* holds it), whether a render is in flight RIGHT NOW, and when the next
+	* window opens. The window boundaries are scanned through `isScheduleActive`,
+	* the same authority the producer uses — a second reading of a schedule is
+	* how a status starts promising a run that is not coming.
+	*/
+	async timelapseStatusFor(rule, lookup) {
+		const now = this.now();
+		const flights = this.timelapseScheduler?.renderInFlight() ?? [];
+		const lastWindow = findLastClosedWindow({
+			schedule: rule.schedule,
+			nowMs: now,
+			lookbackMs: TIMELAPSE_LOOKBACK_MS
+		});
+		const nextWindow = findNextWindowOpen({
+			schedule: rule.schedule,
+			nowMs: now,
+			lookaheadMs: TIMELAPSE_LOOKAHEAD_MS
+		});
+		const devices = [];
+		for (const deviceId of rule.deviceIds) {
+			const generatedAt = require_dist.readTimelapseGeneratedAt(rule, deviceId);
+			const flight = flights.find((f) => f.ruleId === rule.id && f.deviceId === deviceId);
+			const artifact = lookup === void 0 ? null : await lookup({
+				ruleId: rule.id,
+				deviceId
+			}).catch((err) => {
+				this.logger.warn("rule status could not read the timelapse artifact index", {
+					tags: { deviceId },
+					meta: {
+						ruleId: rule.id,
+						error: String(err)
+					}
+				});
+				return null;
+			});
+			devices.push({
+				deviceId,
+				...generatedAt > 0 ? { lastGeneratedAt: generatedAt } : {},
+				...artifact !== null ? { lastArtifact: artifact } : {},
+				...flight !== void 0 ? { rendering: {
+					startedAt: flight.startedAt,
+					windowStartMs: flight.window.startMs,
+					windowEndMs: flight.window.endMs
+				} } : {}
+			});
+		}
+		return {
+			kind: "timelapse",
+			devices,
+			...lastWindow !== null ? { lastWindow } : {},
+			...nextWindow !== null ? { nextWindow } : {},
+			settleMs: TIMELAPSE_SETTLE_MS
+		};
+	}
 	/** One live frame, or null. Never throws into an injection. */
 	async captureLiveStill(deviceId, deps) {
 		const capture = deps.getSnapshot;
@@ -14928,7 +15999,7 @@ var NotificationCenter = class NotificationCenter {
 			return report({ droppedBy: "muted" });
 		}
 		const delivery = deliveryForKind(kind);
-		const enabled = this.rules.listEnabled(delivery);
+		const enabled = this.rulesForTrigger(delivery, kind, subject);
 		const candidates = controls.onlyRuleId !== void 0 ? enabled.filter((r) => r.id === controls.onlyRuleId) : enabled;
 		if (candidates.length === 0) {
 			this.logger.debug("no enabled rule for this trigger", {
@@ -14940,6 +16011,7 @@ var NotificationCenter = class NotificationCenter {
 					rulesLoaded: this.rules.list().length
 				}
 			});
+			if (kind === "track-end") await this.enqueueRecognitionUpgrades(subject, outcomes);
 			return report({ droppedBy: "no-candidate-rule" });
 		}
 		const now = this.now();
@@ -15040,6 +16112,7 @@ var NotificationCenter = class NotificationCenter {
 				at: now
 			});
 			const inserted = await this.outbox.enqueue(entries);
+			this.noteRecognitionFire(rule, subject, kind, entries, inserted);
 			if (inserted > 0 && controls.bypassCooldown !== true) this.lastFiredAt.set(key, now);
 			outcomes.push({
 				ruleId: rule.id,
@@ -15053,9 +16126,124 @@ var NotificationCenter = class NotificationCenter {
 			anyMatched = true;
 		}
 		if (!anyMatched && rejections.length > 0) this.reportNoMatch(subject, kind, rejections, now);
+		if (kind === "track-end") await this.enqueueRecognitionUpgrades(subject, outcomes);
 		return report({ candidates: candidates.length });
 	}
 	/**
+	* The rules a trigger may fire, which is `listEnabled(delivery)` plus and
+	* minus exactly one thing: `waitForEnhancement`.
+	*
+	* An `immediate` rule that agreed to wait for a name is REMOVED from the
+	* object-event trigger and ADDED to the track close, because the closed track
+	* is the first record that carries the name. Both halves are needed and the
+	* removal is the load-bearing one — leaving it on the object event would fire
+	* the early, nameless notification, and the dedup key (`ruleId:trackId:target`)
+	* would then silently swallow the complete one as a duplicate. The operator
+	* would have set the switch and received exactly what they set it to avoid.
+	*
+	* The drop is REPORTED. A rule vanishing from a trigger reads as a broken rule
+	* from a log, and this repo has paid for that twice.
+	*/
+	rulesForTrigger(delivery, kind, subject) {
+		const enabled = this.rules.listEnabled(delivery);
+		if (kind === "object-event") {
+			const deferred = enabled.filter((r) => ruleDefersToTrackEnd(r));
+			if (deferred.length === 0) return enabled;
+			this.logger.debug("rules deferred to track close — waiting for recognition", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					rules: deferred.map((r) => r.name).join(", "),
+					eventId: subject.recordId,
+					...subject.trackId !== void 0 ? { trackId: subject.trackId } : {}
+				}
+			});
+			return enabled.filter((r) => !ruleDefersToTrackEnd(r));
+		}
+		if (kind === "track-end") return [...enabled, ...this.rules.listEnabled("immediate").filter((r) => ruleDefersToTrackEnd(r))];
+		return enabled;
+	}
+	/**
+	* What an `immediate` recognition rule already said about a track, kept only
+	* until that track closes.
+	*
+	* Keyed `ruleIdtrackId`, holding the targets the first push reached and
+	* the LABEL it froze. In RAM and deliberately not durable: losing it costs an
+	* upgrade, which degrades to "the operator got the first notification and not
+	* the second" — the state of the world before this feature. Making it durable
+	* would trade that for a second write on the enqueue path and a table that
+	* outlives the tracks it describes.
+	*/
+	recognitionFires = /* @__PURE__ */ new Map();
+	/** Bound on {@link recognitionFires}. A track that never closes (a crash
+	*  between its birth and its close) must not pin a row forever. */
+	static RECOGNITION_FIRE_TTL_MS = 30 * 6e4;
+	recognitionFireKey(ruleId, trackId) {
+		return `${ruleId}${trackId}`;
+	}
+	noteRecognitionFire(rule, subject, kind, entries, inserted) {
+		if (kind !== "object-event" || inserted === 0) return;
+		if (subject.trackId === void 0 || !ruleUpgradesAtTrackEnd(rule)) return;
+		const now = this.now();
+		for (const [key, held] of this.recognitionFires) if (now - held.at > NotificationCenter.RECOGNITION_FIRE_TTL_MS) this.recognitionFires.delete(key);
+		this.recognitionFires.set(this.recognitionFireKey(rule.id, subject.trackId), {
+			targetIds: entries.map((e) => e.targetId),
+			...subject.label !== void 0 ? { label: subject.label } : {},
+			at: now
+		});
+	}
+	/**
+	* Send the "…and it was Gianluca" follow-up for every rule that fired on this
+	* track WITHOUT a name and has one now.
+	*
+	* Four gates, and each one exists because its absence is a notification the
+	* operator did not ask for:
+	*
+	*  - the rule fired for this track at all (`recognitionFires`) — an upgrade
+	*    with no original is a notification about a rule that never matched;
+	*  - the track ended RECOGNISED (`labelKind`) — a person nobody could name
+	*    has nothing to add;
+	*  - the name is NEW — plates are frequently read on the first frame (0.0 s
+	*    observed), and re-sending the same word is the duplicate this whole
+	*    feature exists to avoid;
+	*  - one row per (rule, track, target), enforced by the outbox on the
+	*    `<trackId>:enhanced` dedup ref, which survives a respawn.
+	*
+	* A rule that ALREADY matched this closed track through the ordinary loop
+	* (`outcomes`) is skipped: it just sent a track-end notification carrying the
+	* name, and an upgrade would be that same sentence twice.
+	*/
+	async enqueueRecognitionUpgrades(subject, outcomes) {
+		const trackId = subject.trackId;
+		if (trackId === void 0 || subject.labelKind === void 0) return;
+		const alreadyFired = new Set(outcomes.filter((o) => o.matched).map((o) => o.ruleId));
+		for (const rule of this.rules.listEnabled("immediate")) {
+			if (!ruleUpgradesAtTrackEnd(rule) || alreadyFired.has(rule.id)) continue;
+			const key = this.recognitionFireKey(rule.id, trackId);
+			const held = this.recognitionFires.get(key);
+			if (held === void 0) continue;
+			this.recognitionFires.delete(key);
+			if (held.label === subject.label) continue;
+			const entries = this.buildEntries(rule, subject, "track-end", ["identities"], [], "pipeline", void 0, {
+				dedupRef: `${trackId}:enhanced`,
+				enhancement: true,
+				targetIds: held.targetIds
+			});
+			const inserted = await this.outbox.enqueue(entries);
+			this.logger.info("recognition upgrade — enqueueing a second notification", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					ruleId: rule.id,
+					rule: rule.name,
+					trackId,
+					was: held.label ?? "",
+					now: subject.label ?? "",
+					labelKind: subject.labelKind,
+					enqueued: inserted
+				}
+			});
+		}
+	}
+	/**
 	* Run this rule's `onTrigger` sequences for this match.
 	*
 	* Called BEFORE the cooldown gate — see the call site for why. Everything
@@ -15123,7 +16311,7 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
-	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline", cooldown) {
+	buildEntries(rule, subject, kind, matchedOn, userTargets = [], origin = "pipeline", cooldown, upgrade) {
 		const hasEventMedia = kind === "object-event" || kind === "package-event";
 		const isTrackScoped = kind === "object-event" || kind === "track-end";
 		const isSystemEvent = kind === "system-event";
@@ -15134,11 +16322,13 @@ var NotificationCenter = class NotificationCenter {
 		const renderedZones = notificationZones(rule, subject);
 		const confirm = frozenConfirmPolicy(rule, isSystemEvent);
 		const cropZoneIds = rule.conditions.zones !== void 0 ? rule.conditions.zones.ids : rule.conditions.occupancy?.zoneId !== void 0 ? [rule.conditions.occupancy.zoneId] : void 0;
-		return [...rule.targets, ...userTargets.filter((t) => !direct.has(t.targetId))].filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
+		const allTargets = [...rule.targets, ...userTargets.filter((t) => !direct.has(t.targetId))];
+		return (upgrade !== void 0 ? allTargets.filter((t) => upgrade.targetIds.includes(t.targetId)) : allTargets).filter((target) => !rule.disabledTargetIds.includes(target.targetId)).map((target) => {
 			const payload = {
 				ruleName: rule.name,
 				delivery: rule.delivery,
 				...origin === "synthetic" ? { synthetic: true } : {},
+				...upgrade !== void 0 ? { enhancement: true } : {},
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
 				media: noMedia ? "none" : mediaRule.media.attach,
@@ -15162,6 +16352,7 @@ var NotificationCenter = class NotificationCenter {
 					...alarmSource?.eventId !== void 0 ? { eventId: alarmSource.eventId } : hasEventMedia ? { eventId: subject.recordId } : {},
 					className: subject.classNames[0] ?? subject.sensorKind ?? "event",
 					...subject.label !== void 0 ? { label: subject.label } : {},
+					...subject.labelKind !== void 0 ? { labelKind: subject.labelKind } : {},
 					...subject.confidence !== void 0 ? { confidence: subject.confidence } : {},
 					zones: renderedZones,
 					timestamp: subject.timestamp,
@@ -15176,6 +16367,7 @@ var NotificationCenter = class NotificationCenter {
 				recordKind: kind === "occupancy-event" ? "device-event" : kind,
 				recordId: subject.recordId,
 				...isTrackScoped && subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
+				...upgrade !== void 0 ? { dedupRef: upgrade.dedupRef } : {},
 				payload
 			};
 		});
@@ -15268,13 +16460,26 @@ var NotificationCenter = class NotificationCenter {
 			}
 		});
 	}
-	/** Rebuild the cooldown map from persisted outbox rows (restart-proof). */
+	/**
+	* Rebuild the cooldown map from persisted outbox rows (restart-proof).
+	*
+	* The key comes from `cooldownKey` and NOWHERE else. This method used to
+	* build the string itself, and the copy had drifted: it knew the
+	* `r:<id>` / `r:<id>:d:<device>` shapes and neither the `:c:<class>` tail
+	* (`granularity: 'per-class'`, and unconditional for audio) nor — after
+	* 2026-08-14 — the `:k:<kind>` one. Every window it could not address was a
+	* window that did not survive a restart, so a per-class or audio rule
+	* re-fired immediately after every respawn despite the schema promising
+	* otherwise. `notifications.md` had carried it as a known defect since
+	* 2026-08-02 with the instruction "if you touch `cooldownKey`, fix the seeder
+	* in the same commit"; this is that commit.
+	*/
 	async seedCooldowns() {
 		const entries = await this.outbox.queryRecentPersisted(this.now() - 864e5);
 		for (const entry of entries) {
 			const rule = this.rules.get(entry.ruleId);
 			if (rule === null) continue;
-			const key = rule.throttle.scope === "rule" ? `r:${rule.id}` : entry.payload.subject.systemEvent !== void 0 ? `r:${rule.id}:s:${entry.payload.subject.systemEvent.subject}` : `r:${rule.id}:d:${entry.deviceId}`;
+			const key = cooldownKey(rule, cooldownSubjectFromOutbox(entry));
 			const prev = this.lastFiredAt.get(key) ?? 0;
 			if (entry.createdAt > prev) this.lastFiredAt.set(key, entry.createdAt);
 		}
@@ -15380,7 +16585,12 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	async hydrateLiveness() {
 		const subjects = await this.liveness.load();
-		this.logger.info("liveness ledger reseeded", { meta: { subjects } });
+		const seeded = this.liveness.seedFromDirectory(this.deviceDirectory.all(), this.now());
+		this.logger.info("liveness ledger reseeded", { meta: {
+			subjects,
+			seededFromDirectory: seeded,
+			directory: this.deviceDirectory.size()
+		} });
 	}
 	/**
 	* Say that the ledger refused a liveness event, and why.
@@ -15802,6 +17012,307 @@ var NotificationCenter = class NotificationCenter {
 	}
 };
 //#endregion
+//#region src/notification-center/rule-test-plan.ts
+/**
+* Which subject kind THIS rule fires on.
+*
+* `delivery` alone cannot answer, because two features ride an existing
+* delivery and are discriminated by a CONDITION — exactly as the engine
+* discriminates them (`rule-engine.ts`: an audio window fires only for a rule
+* declaring `conditions.audio`, an occupancy edge only for one declaring
+* `conditions.occupancy`). A third case is the LEGACY audio-class rule: an
+* `immediate` rule whose classes are all `audio-*` and which declares no
+* `audio` condition fires on a classified episode and on nothing else.
+*/
+function testTriggerForRule(rule) {
+	if (rule.delivery === "system-event") return "system-event";
+	if (rule.delivery === "track-end") return "track-end";
+	if (rule.delivery === "package-event") return "package-event";
+	if (rule.delivery === "device-event") return rule.conditions.occupancy !== void 0 ? "occupancy-event" : "device-event";
+	if (rule.conditions.audio !== void 0) return "audio-window";
+	const classes = rule.conditions.classes ?? [];
+	if (classes.length > 0 && classes.every((c) => c.trim().toLowerCase().startsWith("audio-"))) return "audio-event";
+	return "object-event";
+}
+/** Reserved device id for an event with no camera (mirrors the engine's). */
+var NC_SYSTEM_DEVICE_ID = 0;
+/** The grid a schedule is authored on — the same one `window-bounds.ts` scans. */
+var SCHEDULE_SCAN_STEP_MS = 6e4;
+/** How far back a schedule scan may look for an active minute (one week + a day). */
+var SCHEDULE_SCAN_LOOKBACK_MS = 8 * 864e5;
+/**
+* Nudge a threshold to a value that PASSES it, and that reads like something a
+* detector would produce. Clamped to 1 so a rule with a floor of 1 still gets a
+* legal value.
+*/
+function justAbove(floor) {
+	return Math.min(1, Math.round((floor + .05) * 100) / 100);
+}
+/**
+* A timestamp the rule's SCHEDULE is active at — `now` when it already is.
+*
+* Scans BACKWARDS on the schedule's own minute grid through `isScheduleActive`,
+* the single authority on what a window means (midnight crossing, `invert`,
+* IANA timezone). Backwards rather than forwards because a test must fire NOW:
+* a future instant would be a notification about something that has not
+* happened, and the outbox would deliver it immediately anyway.
+*
+* `null` when the schedule has no active minute in the lookback — a rule that
+* is currently unfireable, which is a note rather than a silent failure.
+*/
+function scheduleActiveAt(schedule, now) {
+	if (schedule === void 0) return now;
+	if (require_dist.isScheduleActive(schedule, now)) return now;
+	const floor = now - SCHEDULE_SCAN_LOOKBACK_MS;
+	for (let t = now - SCHEDULE_SCAN_STEP_MS; t >= floor; t -= SCHEDULE_SCAN_STEP_MS) if (require_dist.isScheduleActive(schedule, t)) return t;
+	return null;
+}
+/**
+* The bbox that satisfies a `customZones` polygon: the polygon's own bounding
+* box, clamped to the frame.
+*
+* The engine's test is `bboxPolygonOverlap(bbox, points) > 0`, and a polygon's
+* bounding box always overlaps it (a polygon with area is contained in its own
+* box). The admin simulator's centred half-frame box does NOT — a polygon drawn
+* in a corner fails it, and the operator reads a working rule as broken.
+*/
+function bboxForPolygon(points) {
+	if (points.length === 0) return void 0;
+	const xs = points.map((p) => p.x);
+	const ys = points.map((p) => p.y);
+	const minX = Math.max(0, Math.min(...xs));
+	const minY = Math.max(0, Math.min(...ys));
+	const maxX = Math.min(1, Math.max(...xs));
+	const maxY = Math.min(1, Math.max(...ys));
+	const w = Math.max(.01, maxX - minX);
+	const h = Math.max(.01, maxY - minY);
+	return {
+		x: minX,
+		y: minY,
+		w: Math.min(1 - minX, w),
+		h: Math.min(1 - minY, h)
+	};
+}
+/**
+* The window that answers an audio condition.
+*
+* Every spec field is copied from the CONDITION, because `matchesAudio`
+* compares them for equality — this is the pairing rule that stops a hub with
+* two sound rules on one camera answering one rule with the other's evidence.
+* `labels` are normalized and sorted exactly as `audioSpecFromCondition` does,
+* or the elementwise comparison fails on ordering alone.
+*/
+function audioWindowFor(condition) {
+	const labels = condition.labels !== void 0 && condition.labels.length > 0 ? [...new Set(condition.labels.map(normalizeAudioLabel))].sort() : void 0;
+	const samples = Math.max(2, condition.samplingSeconds);
+	const hits = Math.max(1, Math.ceil(samples * condition.hitPercent / 100));
+	return {
+		hitPercent: Math.min(100, Math.round(hits / samples * 100)),
+		samplingSeconds: condition.samplingSeconds,
+		samples,
+		hits,
+		...condition.dbThreshold !== void 0 ? {
+			dbThreshold: condition.dbThreshold,
+			peakDbfs: Math.min(0, condition.dbThreshold + 6)
+		} : {},
+		...labels !== void 0 ? { specLabels: labels } : {},
+		labels: labels ?? []
+	};
+}
+/**
+* The edge that satisfies an occupancy condition.
+*
+* Each op has exactly ONE edge that passes it (see `matchesOccupancy`): the
+* count arrives AT the threshold from below, falls to zero from it, or falls TO
+* the threshold from one above.
+*/
+function occupancyEdgeFor(condition) {
+	const threshold = Math.max(1, Math.round(condition.count));
+	const shared = {
+		...condition.zoneId !== void 0 ? { zoneId: condition.zoneId } : {},
+		...condition.className !== void 0 ? { className: condition.className } : {}
+	};
+	if (condition.op === "became-free") return {
+		...shared,
+		count: 0,
+		previousCount: threshold,
+		occupied: false,
+		threshold
+	};
+	if (condition.op === "<=") {
+		const count = Math.max(0, Math.round(condition.count));
+		return {
+			...shared,
+			count,
+			previousCount: count + 1,
+			occupied: false,
+			threshold: count + 1
+		};
+	}
+	return {
+		...shared,
+		count: threshold,
+		previousCount: Math.max(0, threshold - 1),
+		occupied: true,
+		threshold
+	};
+}
+/**
+* The catalog keys a synthetic system event of this kind carries.
+*
+* MIRRORS `incomingFromSystemEvent`'s key derivation, and the mirror is pinned
+* by a spec that asserts every key exists in the shipped English bundle — a key
+* nothing resolves renders an EMPTY notification, which is the one failure a
+* tester must not be able to produce. The BODY VARIANTS the intake chooses from
+* the payload (`.profiled`, `.agent`, `.onNode`) are deliberately not chosen
+* here: the plain variant is the one every kind has.
+*/
+function systemEventKeys(kind) {
+	if (kind === "node-online" || kind === "node-offline") return {
+		titleKey: `system.${kind}.title`,
+		bodyKey: `system.${kind}.body.agent`
+	};
+	if (kind === "alarm-armed" || kind === "alarm-arming" || kind === "alarm-arm-refused") return {
+		titleKey: `system.${kind}.title.${TEST_ALARM_MODE}`,
+		bodyKey: `system.${kind}.body`
+	};
+	return {
+		titleKey: `system.${kind}.title`,
+		bodyKey: `system.${kind}.body`
+	};
+}
+/** The arm mode a synthetic alarm event stands in for — see {@link systemEventKeys}. */
+var TEST_ALARM_MODE = "away";
+/** The dedup subject the live intake stamps for this kind — same families. */
+function systemEventSubject(kind, scope) {
+	if (kind === "device-disabled" || kind === "device-enabled") return `device-switch:${scope.deviceId ?? 0}`;
+	if (kind === "device-online" || kind === "device-offline") return `device:${scope.deviceId ?? 0}`;
+	if (kind === "stream-online" || kind === "stream-offline") return `stream:${scope.deviceId ?? 0}`;
+	if (kind === "node-online" || kind === "node-offline") return `node:${scope.nodeId ?? "hub"}`;
+	if (kind === "addon-update-available" || kind === "server-update-available") return `package:${scope.packageName ?? "@camstack/server"}`;
+	return `alarm:${scope.deviceId ?? 0}`;
+}
+/**
+* The class the subject carries, chosen so it PASSES the rule's class
+* conditions rather than merely existing.
+*
+* A macro selection (`vehicle`) is written verbatim: the engine expands macro →
+* leaves, so the macro itself is always in its own expansion. The exclude list
+* is then honoured — a class that is both wanted and vetoed is a rule that can
+* never fire, and the plan must not paper over it.
+*/
+function classNamesFor(conditions) {
+	const excluded = new Set((conditions.classesExclude ?? []).map((c) => c.trim().toLowerCase()));
+	const first = (conditions.classes ?? []).filter((c) => !excluded.has(c.trim().toLowerCase()))[0] ?? conditions.classes?.[0];
+	if (first !== void 0) return [first];
+	return excluded.has("person") ? [] : ["person"];
+}
+/** The label that satisfies the rule's identity / plate / label matchers. */
+function labelFor(conditions) {
+	return conditions.identities?.[0] ?? conditions.labelEquals?.[0] ?? conditions.plates?.values?.[0] ?? void 0;
+}
+/**
+* Plan the injection that fires this rule.
+*
+* Every condition the engine reads off the SUBJECT is satisfied here; the two
+* that read the world are reported in {@link NcRuleTestPlan.notes}.
+*/
+function planRuleTest(input) {
+	const { rule, now } = input;
+	const c = rule.conditions;
+	const trigger = testTriggerForRule(rule);
+	const notes = [];
+	const systemScope = {
+		...c.systemEvent?.deviceIds?.[0] !== void 0 ? { deviceId: c.systemEvent.deviceIds[0] } : {},
+		...c.systemEvent?.nodeIds?.[0] !== void 0 ? { nodeId: c.systemEvent.nodeIds[0] } : {},
+		...c.systemEvent?.packageNames?.[0] !== void 0 ? { packageName: c.systemEvent.packageNames[0] } : {}
+	};
+	const scopedDeviceId = trigger === "system-event" ? systemScope.deviceId ?? input.fallbackDeviceId ?? NC_SYSTEM_DEVICE_ID : c.devices?.[0] ?? input.fallbackDeviceId;
+	if (scopedDeviceId === void 0) notes.push({
+		conditionId: "devices",
+		note: "This rule names no camera and none was supplied, so the event is attributed to no device and carries no picture. Scope the rule to a camera, or pick one, to see the notification it would really send."
+	});
+	const deviceId = scopedDeviceId ?? NC_SYSTEM_DEVICE_ID;
+	const scheduledAt = scheduleActiveAt(rule.schedule, now);
+	if (scheduledAt === null) notes.push({
+		conditionId: "schedule",
+		note: "This rule’s weekly schedule has no active minute in the last eight days, so the test fires outside it and the schedule condition will refuse the event — exactly as it refuses every real one."
+	});
+	else if (scheduledAt !== now) notes.push({
+		conditionId: "schedule",
+		note: "The rule is outside its schedule right now, so the event is stamped with the most recent instant inside a window. The notification therefore reports a past time."
+	});
+	if (c.deviceState !== void 0) notes.push({
+		conditionId: "deviceState",
+		note: `This rule only fires while device #${c.deviceState.deviceId} is in one of its chosen states. That gate reads the REAL device and cannot be simulated — put the device in that state first, or the test fails closed exactly as production would.`
+	});
+	if (c.customZones !== void 0 && c.customZones.length > 0) notes.push({
+		conditionId: "customZones",
+		note: "The subject is placed over the first drawn polygon so the condition passes. A rule that needs a specific polygon should be checked in the simulator, where the box can be moved."
+	});
+	const zones = c.zones?.ids ?? [];
+	const label = labelFor(c);
+	const bbox = c.customZones !== void 0 && c.customZones.length > 0 ? bboxForPolygon(c.customZones[0]?.points ?? []) : void 0;
+	const audioWindow = trigger === "audio-window" && c.audio !== void 0 ? audioWindowFor(c.audio) : void 0;
+	const classNames = trigger === "audio-window" ? (audioWindow?.labels ?? []).map((l) => `audio-${l}`) : trigger === "occupancy-event" ? [c.occupancy?.className ?? "occupancy"] : trigger === "device-event" || trigger === "system-event" ? [] : classNamesFor(c);
+	const systemEventKind = c.systemEvent?.kinds[0];
+	if (trigger === "system-event" && systemEventKind === void 0) notes.push({
+		conditionId: "systemEvent",
+		note: "This rule names no system event, so nothing can be injected for it — the hub refuses such a rule at save time and the engine matches nothing."
+	});
+	return {
+		trigger,
+		input: {
+			trigger,
+			deviceId,
+			classNames: [...classNames],
+			...label !== void 0 ? { label } : {},
+			...c.minConfidence !== void 0 ? { confidence: justAbove(c.minConfidence) } : {},
+			...c.minLabelConfidence !== void 0 ? { labelConfidence: justAbove(c.minLabelConfidence) } : {},
+			...c.minImportance !== void 0 ? { importance: justAbove(c.minImportance) } : {},
+			...c.minDwellSeconds !== void 0 ? { dwellSeconds: Math.round(c.minDwellSeconds) + 1 } : {},
+			zones: [...zones],
+			...trigger === "object-event" && c.crossing === "exit" ? { crossing: {
+				zoneId: zones[0] ?? "zone",
+				direction: "exit"
+			} } : {},
+			...c.sensorKinds?.[0] !== void 0 ? { sensorKind: c.sensorKinds[0] } : {},
+			...c.eventTypeTokens?.[0] !== void 0 ? { eventType: c.eventTypeTokens[0] } : {},
+			...trigger === "package-event" ? { packagePhase: c.packagePhase === "picked-up" ? "picked-up" : "delivered" } : {},
+			...c.source !== void 0 && c.source !== "any" ? { source: c.source } : {},
+			...bbox !== void 0 ? { bbox } : {},
+			...trigger === "occupancy-event" && c.occupancy !== void 0 ? { occupancy: occupancyEdgeFor(c.occupancy) } : {},
+			...audioWindow !== void 0 ? { audioWindow } : {},
+			...trigger === "system-event" && systemEventKind !== void 0 ? { systemEvent: {
+				kind: systemEventKind,
+				subject: systemEventSubject(systemEventKind, systemScope),
+				...systemEventKeys(systemEventKind),
+				textParams: {
+					deviceId: String(systemScope.deviceId ?? deviceId),
+					deviceName: `camera ${String(systemScope.deviceId ?? deviceId)}`,
+					nodeId: systemScope.nodeId ?? "hub",
+					packageName: systemScope.packageName ?? "@camstack/server",
+					currentVersion: "0.0.0",
+					latestVersion: "0.0.0",
+					profile: "low",
+					seconds: "30"
+				},
+				...systemScope.deviceId !== void 0 ? { deviceId: systemScope.deviceId } : {},
+				...c.systemEvent?.deviceTypes?.[0] !== void 0 ? { deviceType: c.systemEvent.deviceTypes[0] } : {},
+				...systemScope.nodeId !== void 0 ? { nodeId: systemScope.nodeId } : {},
+				...systemScope.packageName !== void 0 ? { packageName: systemScope.packageName } : {}
+			} } : {},
+			timestamp: scheduledAt ?? now,
+			onlyRuleId: rule.id,
+			bypassCooldown: true,
+			bypassMute: true,
+			runActions: false,
+			still: "live"
+		},
+		notes
+	};
+}
+//#endregion
 //#region src/notification-center/nc-actions.ts
 /**
 * nc-actions — the `pipeline-analytics` rule-bridge action catalog.
@@ -15901,6 +17412,58 @@ var ncActions = require_dist.defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
+	/**
+	* FIRE THIS RULE NOW — the per-rule Test button.
+	*
+	* `nc.injectTestEvent` asks the operator to describe an event; this asks the
+	* RULE. The server plans the synthetic subject from the rule's own conditions
+	* (`rule-test-plan.ts`) and hands it to exactly the same injection, so the
+	* notification travels the whole real path: `evaluateRule` → durable outbox →
+	* the ordinary drain → the ordinary media ladders → the notifier. It arrives
+	* on the phone, which is the entire point.
+	*
+	* It BYPASSES the cooldown and the per-camera mute, deliberately: the
+	* operator pressed a button and must receive the notification, not a report
+	* that a window from ten minutes ago swallowed it. Neither window is
+	* CONSUMED, so the next real fire is unaffected. It never runs the rule's
+	* action sequences — those unlock doors, and "does this notify" is not a
+	* request to open a gate.
+	*
+	* `auth: 'admin'` for the same reason as the injection it wraps: it delivers
+	* to every target the rule addresses, on other people's phones.
+	*/
+	"nc.testRule": require_dist.customAction(require_dist.object({
+		ruleId: require_dist.string(),
+		/** The camera to attribute the event to when the rule scopes none. */
+		deviceId: require_dist.number().int().optional()
+	}), NcTestEventResultSchema.extend({
+		/** The subject kind the rule was tested with — the answer to "why was my
+		*  rule not a candidate". */
+		trigger: require_dist.string(),
+		/** What the plan could not reproduce (a device-state gate, a polygon). */
+		planNotes: require_dist.array(require_dist.object({
+			conditionId: require_dist.string(),
+			note: require_dist.string()
+		}))
+	}), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	/**
+	* What this rule is doing RIGHT NOW — a discriminated union per rule kind.
+	*
+	* Answers the question a rule LIST structurally cannot: an occupancy rule's
+	* subject is a live count, and a timelapse rule's output arrives hours after
+	* the window it is about. Everything returned is DERIVED from the watcher's
+	* mirror, the live snapshot and the stores — nothing is a second copy of
+	* state that could disagree with them.
+	*
+	* `caller: 'required'` and not admin-only: a personal rule's owner may read
+	* the status of their own rule, and the handler refuses a rule they cannot
+	* see rather than returning a redacted one.
+	*/
+	"nc.getRuleStatus": require_dist.customAction(require_dist.object({ ruleId: require_dist.string() }), NcRuleStatusSchema, { caller: "required" }),
 	"nc.listTimelapseRules": require_dist.customAction(require_dist.object({}), require_dist.object({ rules: require_dist.array(NcViewerTimelapseRuleSchema) }), { caller: "required" }),
 	/**
 	* ONE action for create AND update, unlike the detection-rule pair.
@@ -16234,6 +17797,54 @@ function makeNcActionHandlers(deps) {
 			});
 			return inject(parsed);
 		},
+		"nc.testRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to test a rule");
+			const inject = deps.injectTestEvent;
+			if (inject === void 0) throw new Error("this node does not host the notification centre — test on the hub");
+			const rule = assertRuleVisible(input.ruleId, c);
+			const plan = planRuleTest({
+				rule,
+				now: Date.now(),
+				...input.deviceId !== void 0 ? { fallbackDeviceId: input.deviceId } : {}
+			});
+			deps.logger.info("rule test requested", {
+				tags: { deviceId: plan.input.deviceId },
+				meta: {
+					by: c.userId,
+					ruleId: rule.id,
+					ruleName: rule.name,
+					trigger: plan.trigger,
+					bypassCooldown: true,
+					bypassMute: true,
+					planNotes: plan.notes.map((n) => n.conditionId)
+				}
+			});
+			return {
+				...await inject(plan.input),
+				trigger: plan.trigger,
+				planNotes: plan.notes.map((n) => ({
+					conditionId: n.conditionId,
+					note: n.note
+				}))
+			};
+		},
+		"nc.getRuleStatus": async (input, caller) => {
+			const c = requireCaller(caller);
+			const status = deps.ruleStatus;
+			if (status === void 0) throw new Error("this node does not host the notification centre — ask the hub");
+			const detection = deps.ruleStore.get(input.ruleId);
+			if (detection !== null) {
+				assertRuleVisible(input.ruleId, c);
+				return status.forRule(detection);
+			}
+			const timelapse = deps.timelapse?.store.get(input.ruleId) ?? null;
+			if (timelapse !== null) {
+				if (!c.isAdmin && timelapse.ownerUserId !== c.userId) throw new Error(`forbidden: timelapse rule not owned: ${input.ruleId}`);
+				return status.forTimelapseRule(timelapse);
+			}
+			throw new Error(`rule not found: ${input.ruleId}`);
+		},
 		"nc.listTimelapseRules": async (_input, caller) => {
 			const c = requireCaller(caller);
 			const tl = requireTimelapse();
@@ -18264,9 +19875,14 @@ async function recomputeTrackImportance(deps, trackId) {
 */
 async function applyTrackLabelCandidate(deps, deviceId, trackId, candidate) {
 	let trackWritten = false;
+	/** The patch the TRACK accepted — the ONE decision the events copy. */
+	let accepted;
 	try {
 		const decision = await deps.trackStore?.applyLabelCandidate(trackId, candidate);
-		if (decision?.kind === "write") trackWritten = true;
+		if (decision?.kind === "write") {
+			trackWritten = true;
+			accepted = decision.patch;
+		}
 		if (decision?.kind === "refused") {
 			const message = decision.reason.kind === "macro-class" ? "label tier collapse refused" : "label write refused";
 			deps.logger.info(message, {
@@ -18288,7 +19904,7 @@ async function applyTrackLabelCandidate(deps, deviceId, trackId, candidate) {
 	}
 	let eventsUpdated = 0;
 	try {
-		eventsUpdated = await deps.eventStore?.applyLabelCandidateForTrack(trackId, candidate) ?? 0;
+		eventsUpdated = accepted !== void 0 ? await deps.eventStore?.projectTrackLabel(trackId, accepted) ?? 0 : 0;
 	} catch (err) {
 		deps.logger.warn("event label back-patch failed", {
 			tags: { deviceId },
@@ -18661,7 +20277,8 @@ var FaceGalleryProvider = class {
 			score: 1,
 			stepId: OPERATOR_FACE_STEP_ID,
 			decidedAt: Date.now(),
-			operatorAuthority: true
+			operatorAuthority: true,
+			identityId
 		});
 		this.refreshGallery();
 		this.safeEmitFaceGalleryChanged({
@@ -20186,6 +21803,12 @@ var FrameProcessor = class {
 	/** Optional stationary-object gate (parked-object suppression). Null until
 	*  the addon wires it via {@link setStationaryGate}. */
 	stationaryGate = null;
+	/**
+	* The label the TRACK currently carries, read (never mirrored) from the
+	* active-track cache. See {@link setTrackLabelState} — and the use site in
+	* `toObjectEvent`, which is the reason it exists.
+	*/
+	trackLabelState = null;
 	constructor(deviceId, trackerConfig = {}, stateConfig = {}, emitterConfig = {}, source = "pipeline") {
 		this.deviceId = deviceId;
 		this.source = source;
@@ -20202,6 +21825,19 @@ var FrameProcessor = class {
 		this.zones = zones;
 	}
 	/**
+	* Wire the reader that answers "what does this track already say it is".
+	*
+	* A READ, not a mirror the late-label path has to remember to feed: the
+	* active-track cache is in-RAM and already the authority every other surface
+	* resolves against, and a mirror that can be forgotten is how a stamped row
+	* and an unstamped one end up in the same track. Absent (tests, and any
+	* caller that has not wired it) ⇒ the emitter behaves exactly as it did
+	* before, stamping only what the current frame decided.
+	*/
+	setTrackLabelState(read) {
+		this.trackLabelState = read;
+	}
+	/**
 	* How much of a detection's box must lie inside a zone for the zone to be
 	* stamped onto it (0–1 fraction of the box's own area).
 	*
@@ -20530,7 +22166,7 @@ var FrameProcessor = class {
 			const state = forcedState ?? mapObjectStateToTrackState(objectStates.find((o) => o.trackId === e.detection.trackId)?.state);
 			const zones = zonesByTrack.get(e.detection.trackId) ?? [];
 			const crossing = crossingOf(e);
-			const labelPatch = labelPatchByTrack.get(e.detection.trackId);
+			const labelPatch = labelPatchByTrack.get(e.detection.trackId) ?? knownTrackLabelPatch(this.trackLabelState?.(e.detection.trackId));
 			return {
 				id: (0, node_crypto.randomUUID)(),
 				deviceId: this.deviceId,
@@ -22201,7 +23837,8 @@ var PlateGalleryProvider = class {
 			score: 1,
 			stepId: OPERATOR_PLATE_STEP_ID,
 			decidedAt: Date.now(),
-			operatorAuthority: true
+			operatorAuthority: true,
+			identityId: vehicle.id
 		});
 		this.refreshGallery();
 		this.safeEmitPlateGalleryChanged({
@@ -25576,10 +27213,13 @@ var FaceRecognizer = class {
 				tier: 2,
 				score: work.matchScore ?? 0,
 				stepId: FACE_RECOGNIZER_STEP_ID,
-				decidedAt: Date.now()
+				decidedAt: Date.now(),
+				identityId: work.assignedIdentityId
 			};
+			let accepted;
 			try {
-				await this.deps.trackStore.applyLabelCandidate(work.trackId, candidate);
+				const decision = await this.deps.trackStore.applyLabelCandidate(work.trackId, candidate);
+				if (decision?.kind === "write") accepted = decision.patch;
 			} catch (err) {
 				this.deps.logger.warn("track identity label failed", {
 					tags: { deviceId: input.deviceId },
@@ -25589,8 +27229,8 @@ var FaceRecognizer = class {
 					}
 				});
 			}
-			try {
-				await this.deps.eventStore.applyLabelCandidateForTrack(work.trackId, candidate);
+			if (accepted !== void 0) try {
+				await this.deps.eventStore.projectTrackLabel(work.trackId, accepted);
 			} catch (err) {
 				this.deps.logger.warn("event identity label failed", {
 					tags: { deviceId: input.deviceId },
@@ -30791,8 +32431,25 @@ var PlateRecognizer = class {
 	*  for an implausible read (junk OCR off a distant/oblique plate) — the
 	*  caller must NOT stamp a label then. */
 	resolveLabel(text, score) {
+		return this.resolveLabelWithVehicle(text, score)?.text ?? null;
+	}
+	/**
+	* {@link resolveLabel} plus the GALLERY ROW it named, when a vehicle claimed
+	* the read.
+	*
+	* The id is what a notification rule matches on — a display name is
+	* renameable and a rule authored on the old spelling goes silently dark
+	* (`LabelAttribution.identityId`). An unclaimed but plausible read still
+	* returns its normalized text with NO `vehicleId`: it is a plate, it is just
+	* nobody's plate.
+	*/
+	resolveLabelWithVehicle(text, score) {
 		if (!isPlausiblePlateRead(text, score)) return null;
-		return this.matchVehicle(text, score)?.name ?? normalizePlate(text);
+		const matched = this.matchVehicle(text, score);
+		return matched !== null ? {
+			text: matched.name,
+			vehicleId: matched.vehicleId
+		} : { text: normalizePlate(text) };
 	}
 	async processFrame(input) {
 		const minConfidence = input.minConfidence ?? 0;
@@ -32351,48 +34008,49 @@ var EventStore = class {
 		}
 	}
 	/**
-	* Forward-only: offer a label CANDIDATE to every already-emitted object event
-	* of a track (roadmap 4g). Returns the number of events actually updated —
-	* which is NOT the number of rows, because the write rule is applied PER ROW
-	* against that row's own tiers.
+	* Project the TRACK's label decision onto every object event of that track.
+	* Returns how many rows took it.
 	*
-	* Per row, not once for the track, and that is the point: the events of one
-	* track do not all carry the same label. An early row may hold a tier-1
-	* sub-class the frame path stamped and a later row a tier-2 identity; a
-	* single decision taken on the track and blanket-applied would either
-	* overwrite the stronger value or skip the rows that had nothing.
+	* ONE DECISION, EVERY ROW — and that is the correction, not the design it
+	* replaced. This used to re-run `resolveTieredLabelWrite` per row against
+	* that row's own tiers, on the theory that "the events of one track do not
+	* all carry the same label". They do: a track has ONE subject, and every
+	* read surface (the timeline, the event page, a notification body, a rule's
+	* `identities` condition) shows the track's answer. Re-deciding per row meant
+	* a row whose incumbent happened to outscore the track's winner kept a
+	* different word, and the rows drifted apart from the track and from each
+	* other — measured 2026-08-14 as 407 of 437 tracks whose event rows
+	* disagreed with the track they belong to. A notification quoting one row and
+	* a timeline quoting another then told the operator two different names for
+	* the same person.
+	*
+	* The caller passes the patch the TRACK row accepted, so the two can never
+	* disagree by construction. A refused track write projects nothing: nothing
+	* changed, so there is nothing to copy.
 	*
 	* Used when face recognition, plate matching or a classifier answers after
 	* the events were emitted.
 	*/
-	async applyLabelCandidateForTrack(trackId, candidate) {
+	async projectTrackLabel(trackId, patch) {
 		const rows = await this.store.query.query({
 			collection: OBJECT_EVENTS_COLLECTION,
 			filter: { where: { trackId } }
 		});
+		const data = tieredLabelColumnData(patch);
 		let updated = 0;
-		for (const row of rows) {
-			const className = row.data["className"];
-			if (typeof className !== "string") continue;
-			const decision = resolveTieredLabelWrite({
-				className,
-				...readTieredLabelColumns(row.data)
-			}, candidate);
-			if (decision.kind !== "write") continue;
-			try {
-				await this.store.update.mutate({
-					collection: OBJECT_EVENTS_COLLECTION,
-					id: row.id,
-					data: tieredLabelColumnData(decision.patch)
-				});
-				updated++;
-			} catch (err) {
-				this.logger.warn("applyLabelCandidateForTrack update failed", { meta: {
-					trackId,
-					eventId: row.id,
-					error: String(err)
-				} });
-			}
+		for (const row of rows) try {
+			await this.store.update.mutate({
+				collection: OBJECT_EVENTS_COLLECTION,
+				id: row.id,
+				data
+			});
+			updated++;
+		} catch (err) {
+			this.logger.warn("projectTrackLabel update failed", { meta: {
+				trackId,
+				eventId: row.id,
+				error: String(err)
+			} });
 		}
 		return updated;
 	}
@@ -36807,138 +38465,6 @@ var BindingCache = class {
 	}
 };
 //#endregion
-//#region src/pipeline-analytics/runtime/detection-coverage-cache.ts
-/**
-* DetectionCoverageCache — fleet-seeded, event-invalidated mirror of WHICH
-* devices carry a WRAPPED `detection-pipeline` binding. This is the alarm's
-* coverage authority ("Away armed, 12 cameras" is false if three of them are
-* offline or no longer wrapped), read by the notification centre's device
-* directory (`listDeviceIdentities`).
-*
-* WHY a mirror, not a per-tick sweep. The directory refreshes on the NC's 30 s
-* rule-reload tick. Answering "who still has detection?" with a fleet-wide
-* `getAllBindings` on EVERY tick cost 903 ms / 373 KB / ~505 `getBindings:
-* default wrappers skipped` log lines on the live hub (524 devices), forever —
-* ~3% of hub-main's main thread plus a permanent log-spam baseline. Same defect
-* and fix as `SystemMirror.refreshBinding` (639073e8): ONE fleet read to warm,
-* then per-device updates driven by `DeviceBindingsChanged` events. A wrapper
-* toggle emits that event carrying the device's id and `capName`
-* (`detection-pipeline`), so a single `getBindings(deviceId)` — 21 ms / 613 B —
-* keeps the mirror current without ever touching the fleet again.
-*
-* ── Destructive-direction discipline (D49) ──────────────────────────────────
-*
-* `detectionActive: false` reports a camera as UNCOVERED / switched-off (D62) —
-* the destructive answer, and the one an operator reads as "my alarm is not
-* watching that door". A transient `getBindings` blip must never flip a
-* known-covered camera to uncovered:
-*   • a failed refresh KEEPS the previous value (a read that throws changes
-*     nothing), and
-*   • a single read that would flip a known `true → false` is confirmed by a
-*     concordant SECOND read before it lands — an empty binding list is not
-*     proof the wrapper is gone.
-* A COLD mirror (seed not yet landed, or a seed that failed) answers `undefined`
-* for every id — and unknown never reports a camera as excluded from coverage.
-*/
-var DetectionCoverageCache = class {
-	api;
-	logger;
-	/** deviceId → "has a WRAPPED detection-pipeline binding". Absent = unknown. */
-	state = /* @__PURE__ */ new Map();
-	warm = false;
-	seeding = null;
-	constructor(deps) {
-		this.api = deps.api;
-		this.logger = deps.logger;
-	}
-	/** Has the ONE fleet seed ever landed? A cold mirror knows nothing. */
-	isWarm() {
-		return this.warm;
-	}
-	/** Do we have an answer for this id at all? (`false` ⇒ absent ⇒ unknown.) */
-	has(deviceId) {
-		return this.state.has(deviceId);
-	}
-	/** The coverage answer, or `undefined` when this id is unknown. No I/O. */
-	get(deviceId) {
-		return this.state.get(deviceId);
-	}
-	/**
-	* Seed the whole fleet ONCE with a single `getAllBindings`. Idempotent: a
-	* warm cache is a no-op, and concurrent callers coalesce onto one read. A
-	* failed seed leaves the mirror COLD so the next tick retries — during that
-	* window every id answers unknown, which never reports a camera as excluded.
-	*/
-	async ensureWarm() {
-		if (this.warm) return;
-		if (this.seeding) return this.seeding;
-		this.seeding = this.seed();
-		try {
-			await this.seeding;
-		} finally {
-			this.seeding = null;
-		}
-	}
-	async seed() {
-		try {
-			const rows = await this.api.deviceManager.getAllBindings.query({});
-			for (const row of rows) {
-				if (this.state.has(row.deviceId)) continue;
-				this.state.set(row.deviceId, hasWrappedDetection(row.entries));
-			}
-			this.warm = true;
-			this.logger.info("detection-coverage mirror warm", { meta: { devices: this.state.size } });
-		} catch (err) {
-			this.logger.warn("detection-coverage seed failed — coverage unknown until it lands", { meta: { error: String(err) } });
-		}
-	}
-	/**
-	* A `DeviceBindingsChanged` for the detection cap re-reads THAT ONE device
-	* (never the fleet). Fire-and-forget from the synchronous event handler.
-	*/
-	onBindingsChanged(event) {
-		if (event.capName !== "detection-pipeline") return Promise.resolve();
-		return this.refreshDevice(event.deviceId);
-	}
-	/** Drop a device the fleet no longer has (`device.unregistered`). */
-	forget(deviceId) {
-		this.state.delete(deviceId);
-	}
-	/** Return to cold — used on addon shutdown. */
-	clearAll() {
-		this.state.clear();
-		this.warm = false;
-		this.seeding = null;
-	}
-	async refreshDevice(deviceId) {
-		try {
-			const active = await this.readWrappedDetection(deviceId);
-			const prev = this.state.get(deviceId);
-			if (!active && prev === true) {
-				if (await this.readWrappedDetection(deviceId)) {
-					this.state.set(deviceId, true);
-					return;
-				}
-			}
-			this.state.set(deviceId, active);
-		} catch (err) {
-			this.logger.debug("detection-coverage refresh failed — keeping the previous value", {
-				tags: { deviceId },
-				meta: { error: String(err) }
-			});
-		}
-	}
-	async readWrappedDetection(deviceId) {
-		return hasWrappedDetection((await this.api.deviceManager.getBindings.query({ deviceId })).entries);
-	}
-};
-/** The one authority: a WRAPPED `detection-pipeline` binding is present. A
-*  native binding of the same cap is NOT coverage (D62: absence of the WRAPPED
-*  binding is how a deactivated wrapper is represented). */
-function hasWrappedDetection(entries) {
-	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
-}
-//#endregion
 //#region src/pipeline-analytics/runtime/capture-scheduler.ts
 /**
 * Kind-derived default priorities (0 = highest). Explicit `priority` wins.
@@ -37211,6 +38737,138 @@ var CaptureScheduler = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/runtime/detection-coverage-cache.ts
+/**
+* DetectionCoverageCache — fleet-seeded, event-invalidated mirror of WHICH
+* devices carry a WRAPPED `detection-pipeline` binding. This is the alarm's
+* coverage authority ("Away armed, 12 cameras" is false if three of them are
+* offline or no longer wrapped), read by the notification centre's device
+* directory (`listDeviceIdentities`).
+*
+* WHY a mirror, not a per-tick sweep. The directory refreshes on the NC's 30 s
+* rule-reload tick. Answering "who still has detection?" with a fleet-wide
+* `getAllBindings` on EVERY tick cost 903 ms / 373 KB / ~505 `getBindings:
+* default wrappers skipped` log lines on the live hub (524 devices), forever —
+* ~3% of hub-main's main thread plus a permanent log-spam baseline. Same defect
+* and fix as `SystemMirror.refreshBinding` (639073e8): ONE fleet read to warm,
+* then per-device updates driven by `DeviceBindingsChanged` events. A wrapper
+* toggle emits that event carrying the device's id and `capName`
+* (`detection-pipeline`), so a single `getBindings(deviceId)` — 21 ms / 613 B —
+* keeps the mirror current without ever touching the fleet again.
+*
+* ── Destructive-direction discipline (D49) ──────────────────────────────────
+*
+* `detectionActive: false` reports a camera as UNCOVERED / switched-off (D62) —
+* the destructive answer, and the one an operator reads as "my alarm is not
+* watching that door". A transient `getBindings` blip must never flip a
+* known-covered camera to uncovered:
+*   • a failed refresh KEEPS the previous value (a read that throws changes
+*     nothing), and
+*   • a single read that would flip a known `true → false` is confirmed by a
+*     concordant SECOND read before it lands — an empty binding list is not
+*     proof the wrapper is gone.
+* A COLD mirror (seed not yet landed, or a seed that failed) answers `undefined`
+* for every id — and unknown never reports a camera as excluded from coverage.
+*/
+var DetectionCoverageCache = class {
+	api;
+	logger;
+	/** deviceId → "has a WRAPPED detection-pipeline binding". Absent = unknown. */
+	state = /* @__PURE__ */ new Map();
+	warm = false;
+	seeding = null;
+	constructor(deps) {
+		this.api = deps.api;
+		this.logger = deps.logger;
+	}
+	/** Has the ONE fleet seed ever landed? A cold mirror knows nothing. */
+	isWarm() {
+		return this.warm;
+	}
+	/** Do we have an answer for this id at all? (`false` ⇒ absent ⇒ unknown.) */
+	has(deviceId) {
+		return this.state.has(deviceId);
+	}
+	/** The coverage answer, or `undefined` when this id is unknown. No I/O. */
+	get(deviceId) {
+		return this.state.get(deviceId);
+	}
+	/**
+	* Seed the whole fleet ONCE with a single `getAllBindings`. Idempotent: a
+	* warm cache is a no-op, and concurrent callers coalesce onto one read. A
+	* failed seed leaves the mirror COLD so the next tick retries — during that
+	* window every id answers unknown, which never reports a camera as excluded.
+	*/
+	async ensureWarm() {
+		if (this.warm) return;
+		if (this.seeding) return this.seeding;
+		this.seeding = this.seed();
+		try {
+			await this.seeding;
+		} finally {
+			this.seeding = null;
+		}
+	}
+	async seed() {
+		try {
+			const rows = await this.api.deviceManager.getAllBindings.query({});
+			for (const row of rows) {
+				if (this.state.has(row.deviceId)) continue;
+				this.state.set(row.deviceId, hasWrappedDetection(row.entries));
+			}
+			this.warm = true;
+			this.logger.info("detection-coverage mirror warm", { meta: { devices: this.state.size } });
+		} catch (err) {
+			this.logger.warn("detection-coverage seed failed — coverage unknown until it lands", { meta: { error: String(err) } });
+		}
+	}
+	/**
+	* A `DeviceBindingsChanged` for the detection cap re-reads THAT ONE device
+	* (never the fleet). Fire-and-forget from the synchronous event handler.
+	*/
+	onBindingsChanged(event) {
+		if (event.capName !== "detection-pipeline") return Promise.resolve();
+		return this.refreshDevice(event.deviceId);
+	}
+	/** Drop a device the fleet no longer has (`device.unregistered`). */
+	forget(deviceId) {
+		this.state.delete(deviceId);
+	}
+	/** Return to cold — used on addon shutdown. */
+	clearAll() {
+		this.state.clear();
+		this.warm = false;
+		this.seeding = null;
+	}
+	async refreshDevice(deviceId) {
+		try {
+			const active = await this.readWrappedDetection(deviceId);
+			const prev = this.state.get(deviceId);
+			if (!active && prev === true) {
+				if (await this.readWrappedDetection(deviceId)) {
+					this.state.set(deviceId, true);
+					return;
+				}
+			}
+			this.state.set(deviceId, active);
+		} catch (err) {
+			this.logger.debug("detection-coverage refresh failed — keeping the previous value", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+		}
+	}
+	async readWrappedDetection(deviceId) {
+		return hasWrappedDetection((await this.api.deviceManager.getBindings.query({ deviceId })).entries);
+	}
+};
+/** The one authority: a WRAPPED `detection-pipeline` binding is present. A
+*  native binding of the same cap is NOT coverage (D62: absence of the WRAPPED
+*  binding is how a deactivated wrapper is represented). */
+function hasWrappedDetection(entries) {
+	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
 	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
@@ -42083,6 +43741,17 @@ var REBUILD_FALLBACK_NODE_ID = "hub";
 * count. Two thousand is far above any real night and still a bounded read.
 */
 var TIMELAPSE_TRACK_QUERY_LIMIT = 2e3;
+/**
+* How many object-event rows ONE timelapse window may read.
+*
+* Higher than the track limit because these are per-FRAME rows, not per-subject:
+* one track routinely writes a handful (`entered`, some `moving`, `left`), and
+* the merge in `detection-intervals.ts` folds them back to one subject. Ten
+* thousand covers every night this deployment has produced and still bounds the
+* read; the store returns the NEWEST rows, so an overflow loses the start of the
+* window rather than a random slice of it.
+*/
+var TIMELAPSE_EVENT_QUERY_LIMIT = 1e4;
 var PIPELINE_ANALYTICS_ADDON_ID = "pipeline-analytics";
 /** Artefact index ⇄ shelf reconcile cadence. Hourly: the two only drift on the
 *  bounds' own timescale (14 days / 2000 entries / 2 GiB). */
@@ -43091,7 +44760,24 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				runNow: (input) => center.runSummaryNow(input)
 			},
 			texts: center.textCatalogEditor,
-			...this.ncArtifactIndex !== null ? { artifacts: this.ncArtifactIndex } : {}
+			...this.ncArtifactIndex !== null ? { artifacts: this.ncArtifactIndex } : {},
+			ruleStatus: {
+				forRule: (rule) => center.ruleStatusFor(rule),
+				forTimelapseRule: (rule) => center.timelapseStatusFor(rule, async ({ ruleId, deviceId }) => {
+					const index = this.ncArtifactIndex;
+					if (index === null) return null;
+					return (await index.list({
+						kinds: ["timelapse"],
+						ruleId,
+						deviceIds: [deviceId],
+						limit: 1,
+						offset: 0
+					}, {
+						userId: "",
+						isAdmin: true
+					})).artifacts[0] ?? null;
+				})
+			}
 		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
@@ -43564,10 +45250,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				const buf = await this.captureCrop(frame.frameHandle, { ...frame.bbox }, frame.frameWidth, frame.frameHeight, DETAIL_FALLBACK_CROP_PADDING);
 				return buf ? buf.toString("base64") : null;
 			},
-			hasTrackLabel: (trackId) => {
-				const label = this.trackStore?.getActiveByTrack(trackId)?.label;
-				return label !== void 0 && label.length > 0;
-			}
+			hasTrackLabel: (trackId) => hasResolvedLabel(this.trackStore?.getActiveByTrack(trackId))
 		});
 	}
 	/** Binding cache + the zone-analytics / audio-metrics cap providers. */
@@ -43659,6 +45342,14 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					addonId: device.addonId
 				};
 			},
+			identityIdsByName: async () => {
+				const byName = /* @__PURE__ */ new Map();
+				const identities = await stores.identityStore.listIdentities();
+				for (const identity of identities) byName.set(identity.name.trim().toLowerCase(), identity.id);
+				const vehicles = await stores.vehicleStore.listVehicles();
+				for (const vehicle of vehicles) byName.set(vehicle.name.trim().toLowerCase(), vehicle.id);
+				return byName;
+			},
 			listDeviceIdentities: async () => {
 				const all = await api.deviceManager.listAll.query({ projection: "slim" });
 				const coverage = this.detectionCoverage;
@@ -43921,11 +45612,40 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					projection: "slim",
 					limit: TIMELAPSE_TRACK_QUERY_LIMIT
 				})).map((t) => ({
+					trackId: t.trackId,
 					firstSeen: t.firstSeen,
 					lastSeen: t.lastSeen,
 					className: t.className
 				}));
 			},
+			/**
+			* The other half of "did anything happen here": the object-event rows.
+			*
+			* The persisted track store is NOT a complete record of the window. Three
+			* gates destroy a track before it is written — the confirmation gate
+			* retracting a suspected false birth, stationary promotion dropping a
+			* parked object, zero-media suppression cascading a thumbnail-less track
+			* away — and on 2026-08-13 they left camera 615 with zero persisted tracks
+			* across a ten-hour night that held a person pass at 23:31. These rows
+			* survive all three.
+			*
+			* FULL projection, not slim: `slimObject` drops `trackId`, and without it
+			* every event of one subject becomes its own detection. It costs nothing
+			* at the store — the row is read whole either way and slim only strips
+			* fields afterwards.
+			*/
+			listDetectionEvents: async ({ deviceId, since, until }) => {
+				return (await stores.eventStore.queryObject({
+					deviceId,
+					since,
+					until,
+					limit: TIMELAPSE_EVENT_QUERY_LIMIT
+				})).map((e) => ({
+					timestamp: e.timestamp,
+					className: e.className,
+					...e.trackId !== void 0 ? { trackId: e.trackId } : {}
+				}));
+			},
 			createExport: (input) => api.recordingExport.createExport.mutate({
 				deviceId: input.deviceId,
 				profile: input.profile,
@@ -43950,6 +45670,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				}
 			}),
 			getExport: ({ exportId }) => api.recordingExport.getExport.query({ exportId }),
+			listExports: ({ deviceId }) => api.recordingExport.listExports.query({ deviceId }),
 			publishArtifact: buildTimelapseArtifactPublisher({
 				logger: this.ctx.logger.child("Timelapse"),
 				readExportBytes: ({ exportId }) => api.recordingExport.readExportBytes.query({ exportId }),
@@ -45591,8 +47312,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 						});
 					}
 				}
-				const label = d.className === "plate" ? this.plateRecognizer?.resolveLabel(d.label, d.score) ?? null : d.label;
-				if (label !== null && label !== void 0) await this.applyTrackEnrichmentLabel(deviceId, trackId, label, d, frame.timestamp);
+				const resolved = d.className === "plate" ? this.plateRecognizer?.resolveLabelWithVehicle(d.label, d.score) ?? null : { text: d.label };
+				if (resolved !== null && resolved.text !== void 0) await this.applyTrackEnrichmentLabel(deviceId, trackId, resolved.text, d, frame.timestamp, resolved.vehicleId);
 			}
 		} catch (err) {
 			this.ctx.logger.warn("detail result route failed", {
@@ -45680,7 +47401,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	* a runner older than the declaration, because the alternative is guessing
 	* and putting a species in the coarse slot.
 	*/
-	async applyTrackEnrichmentLabel(deviceId, trackId, label, detail, decidedAt) {
+	async applyTrackEnrichmentLabel(deviceId, trackId, label, detail, decidedAt, identityId) {
 		await applyTrackLabelCandidate({
 			...this.trackStore ? { trackStore: this.trackStore } : {},
 			...this.eventStore ? { eventStore: this.eventStore } : {},
@@ -45691,7 +47412,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			score: detail.score,
 			stepId: detail.stepId,
 			...detail.labelModelId !== void 0 ? { modelId: detail.labelModelId } : {},
-			decidedAt
+			decidedAt,
+			...identityId !== void 0 ? { identityId } : {}
 		});
 	}
 	/** Active CLIP image-embedding model id (== the text encoder's), TTL-cached.
@@ -46761,6 +48483,18 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				cooldownSec,
 				minTrackAgeMs: trk.minTrackAgeMs
 			}, source);
+			p.setTrackLabelState((trackId) => {
+				const active = this.trackStore?.getActiveByTrack(trackId);
+				return active !== null && active !== void 0 ? {
+					className: active.className,
+					...active.label !== void 0 ? { label: active.label } : {},
+					...active.labelScore !== void 0 ? { labelScore: active.labelScore } : {},
+					...active.labelMeta !== void 0 ? { labelMeta: active.labelMeta } : {},
+					...active.subLabel !== void 0 ? { subLabel: active.subLabel } : {},
+					...active.subLabelScore !== void 0 ? { subLabelScore: active.subLabelScore } : {},
+					...active.subLabelMeta !== void 0 ? { subLabelMeta: active.subLabelMeta } : {}
+				} : void 0;
+			});
 			if (source === "pipeline" && this.stationaryRegistry) {
 				const registry = this.stationaryRegistry;
 				p.setStationaryGate({ filter: (input) => {