@camstack/addon-post-analysis 1.2.76 → 1.2.78

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as isDetectionMacroClass, At as unknown, B as alarmPanelCapability, C as NcSnoozeSchema, Ct as discriminatedUnion, D as OpsLogEntrySchema, Dt as partialRecord, E as NcTaxonomySchema, Et as object, F as TimelapseRuleInputSchema, G as cosineSimilarity$1, H as audioMetricsCapability, I as TimelapseRulePatchSchema, J as deriveRecordingMode, K as customAction, L as TimelapseRuleSchema, M as SCENE_DIVERGED, N as SceneMonitorSchema, O as RECORDING_EXPORT_MAX_READ_BYTES, Ot as record, P as TIMELAPSE_DENSE_FLOOR_SEC, R as TrackSourceSchema, S as NcSnoozeInputSchema, St as boolean, T as NcSystemEventKindSchema, Tt as number, U as audioModeOf, V as assertTimelapseCadences, W as buildEventKindDescriptor, X as encodeVectorBase64, Z as faceGalleryCapability, _ as NcRuleInputSchema, _t as isDeviceScopedCap, at as readDeviceStateFrom, b as NcRuleTargetSchema, bt as _enum, c as EVENT_PAD_MS, ct as subKindsOf, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as zoneAnalyticsCapability, et as isScheduleActive, f as NC_CONDITION_CATALOG, ft as errMsg, g as NcConditionDescriptorSchema, gt as hydrateSchema, h as NC_TAXONOMY, ht as createEvent, i as DETECTION_MACRO_CLASSES, it as plateGalleryCapability, j as SCENE_DEFAULT_ANCHOR_THRESHOLD, jt as EventCategory, k as RetrainStatusSchema, kt as string, l as LabelAttributionSchema, lt as vectorDimFromBase64, mt as DeviceType, n as DEFAULT_EVENT_COLOR, nt as notificationRulesCapability, o as DeclaredDevices, ot as readTimelapseGeneratedAt, p as NC_DEFAULT_SNOOZE_MINUTES, pt as BaseAddon, q as defineCustomActions, rt as pipelineAnalyticsCapability, s as EVENT_KIND_BY_CAP, st as sceneMonitorCapability, t as BaseDevice, tt as kebabToCamel, u as MACRO_LABELS, ut as videoclipsCapability, v as NcRulePatchSchema, vt as nodePin, w as NcSnoozeSuppressedSchema, wt as literal, x as NcScheduleSchema, xt as array, y as NcRuleSchema, yt as sleep, z as addonWidgetsSourceCapability } from "../dist-CYfG8ulU.mjs";
+import { At as string, B as addonWidgetsSourceCapability, C as NcSnoozeSchema, Ct as boolean, D as OpsLogEntrySchema, Dt as object, E as NcTaxonomySchema, Et as number, F as TIMELAPSE_DENSE_FLOOR_SEC, G as buildEventKindDescriptor, H as assertTimelapseCadences, I as TimelapseRuleInputSchema, J as defineCustomActions, K as cosineSimilarity$1, L as TimelapseRulePatchSchema, M as SCENE_DEFAULT_UNCOVERED_POLICY, Mt as EventCategory, N as SCENE_DIVERGED, O as RECORDING_EXPORT_MAX_READ_BYTES, Ot as partialRecord, P as SceneMonitorSchema, Q as faceGalleryCapability, R as TimelapseRuleSchema, S as NcSnoozeInputSchema, St as array, T as NcSystemEventKindSchema, Tt as literal, U as audioMetricsCapability, V as alarmPanelCapability, W as audioModeOf, Y as deriveRecordingMode, Z as encodeVectorBase64, _ as NcRuleInputSchema, _t as hydrateSchema, at as plateGalleryCapability, b as NcRuleTargetSchema, bt as sleep, c as EVENT_PAD_MS, ct as sceneMonitorCapability, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as videoclipsCapability, et as isDetectionMacroClass, f as NC_CONDITION_CATALOG, ft as zoneAnalyticsCapability, g as NcConditionDescriptorSchema, gt as createEvent, h as NC_TAXONOMY, ht as DeviceType, i as DETECTION_MACRO_CLASSES, it as pipelineAnalyticsCapability, j as SCENE_DEFAULT_ANCHOR_THRESHOLD, jt as unknown, k as RetrainStatusSchema, kt as record, l as LabelAttributionSchema, lt as subKindsOf, mt as BaseAddon, n as DEFAULT_EVENT_COLOR, nt as kebabToCamel, o as DeclaredDevices, ot as readDeviceStateFrom, p as NC_DEFAULT_SNOOZE_MINUTES, pt as errMsg, q as customAction, rt as notificationRulesCapability, s as EVENT_KIND_BY_CAP, st as readTimelapseGeneratedAt, t as BaseDevice, tt as isScheduleActive, u as MACRO_LABELS, ut as vectorDimFromBase64, v as NcRulePatchSchema, vt as isDeviceScopedCap, w as NcSnoozeSuppressedSchema, wt as discriminatedUnion, x as NcScheduleSchema, xt as _enum, y as NcRuleSchema, yt as nodePin, z as TrackSourceSchema } from "../dist-CA2KdMY9.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -3384,19 +3384,26 @@ function cosineSimilarity(a, b) {
 }
 /**
 * Select the references a live crop is scored against for a given condition —
-* **exact condition match, with NO fallback.**
-*
-* There used to be a silent fallback to every reference when the current
-* condition had none. For a named-states monitor that was a defensible "better
-* than blind". For a latched alarm it is a false positive every single night:
-* the day reference is compared against an IR frame, the cosine collapses, the
-* scene latches `diverged`, and the operator is told the bin was taken at
-* 21:40. Cross-condition cosines are not comparable, so the honest answer to "I
-* have never seen this scene in this light" is *I don't know* — never a guess
-* in the direction that raises an alarm.
-*/
-function selectConditionRefs(references, currentCondition) {
-	return references.filter((r) => r.condition === currentCondition);
+* **exact condition match, and by default NO fallback.**
+*
+* There used to be an unconditional silent fallback to every reference when the
+* current condition had none. For a named-states monitor that was a defensible
+* "better than blind". For a latched alarm it is a false positive every single
+* night: the day reference is compared against an IR frame, the cosine
+* collapses, the scene latches `diverged`, and the operator is told the bin was
+* taken at 21:40. Cross-condition cosines are not comparable, so the honest
+* answer to "I have never seen this scene in this light" is *I don't know* —
+* never a guess in the direction that raises an alarm.
+*
+* The fallback survives only as an explicit per-scene opt-in, and even then it
+* is a LAST resort: when the exact condition has references of its own they
+* win outright, so opting in never widens a comparison the operator already
+* covered properly.
+*/
+function selectConditionRefs(references, currentCondition, crossConditionFallback) {
+	const exact = references.filter((r) => r.condition === currentCondition);
+	if (exact.length > 0 || !crossConditionFallback) return exact;
+	return references;
 }
 /** A reference is comparable only when its `modelId` equals the live encoder's
 *  model AND its dimension equals the encoder's embedding dim (face-matcher
@@ -3412,11 +3419,12 @@ function comparable(r, encoderModelId, encoderDim) {
 * Returns `{ bestStateId: null, bestScore: null }` when NOTHING was comparable
 * — see `ScoreResult.bestScore`.
 */
-function scoreStates(states, liveEmbedding, currentCondition, encoderModelId, encoderDim) {
+function scoreStates(states, liveEmbedding, currentCondition, encoderModelId, encoderDim, options) {
 	let bestStateId = null;
 	let bestScore = null;
+	const crossConditionFallback = options?.crossConditionFallback === true;
 	for (const s of states) {
-		const refs = selectConditionRefs(s.references, currentCondition);
+		const refs = selectConditionRefs(s.references, currentCondition, crossConditionFallback);
 		let stateScore = null;
 		for (const r of refs) {
 			if (!comparable(r, encoderModelId, encoderDim)) continue;
@@ -3602,7 +3610,8 @@ var SceneEngine = class {
 			lastCountedAt: 0,
 			lastAvailability: "ok",
 			lastVerdict: currentStateId === null ? "unknown" : "matched",
-			lastUnavailable: null
+			lastUnavailable: null,
+			suspendedCondition: null
 		});
 	}
 	/** Force an out-of-cycle check for a single monitor. */
@@ -3625,7 +3634,8 @@ var SceneEngine = class {
 			lastCountedAt: 0,
 			lastAvailability: monitor.availability,
 			lastVerdict: monitor.verdict,
-			lastUnavailable: monitor.unavailable
+			lastUnavailable: monitor.unavailable,
+			suspendedCondition: monitor.suspendedCondition
 		};
 		rt.lastCheckAt = now;
 		this.runtime.set(k, rt);
@@ -3676,6 +3686,7 @@ var SceneEngine = class {
 						availability: "unavailable",
 						unavailableReason: llmResult.reason,
 						coveredConditions: [],
+						suspendedCondition: null,
 						transitioned: false,
 						checkedAt: now
 					});
@@ -3729,12 +3740,20 @@ var SceneEngine = class {
 		if (monitor.check.mode !== "similarity") return;
 		const { embedding } = await this.deps.encoder.encode(crop, cropWidth, cropHeight);
 		const info = await this.encoderInfo();
-		const { bestStateId, bestScore } = scoreStates(monitor.states, embedding, condition, info.modelId, info.embeddingDim);
+		const { bestStateId, bestScore } = scoreStates(monitor.states, embedding, condition, info.modelId, info.embeddingDim, { crossConditionFallback: monitor.onUncoveredCondition === "judge-anyway" });
 		const covered = [...coveredConditions(monitor.states, info.modelId, info.embeddingDim)];
 		if (bestScore === null) {
 			const cause = unknownCause(monitor, condition);
 			rt.lastAvailability = "ok";
 			this.runtime.set(k, rt);
+			if (cause === "no-reference-for-condition" && covered.length > 0 && monitor.onUncoveredCondition === "skip") {
+				await this.reportSuspended(deviceId, monitor, rt, {
+					condition,
+					covered,
+					now
+				});
+				return;
+			}
 			await this.reportUnknown(deviceId, monitor, rt, {
 				condition,
 				cause,
@@ -3802,9 +3821,11 @@ var SceneEngine = class {
 		rt.lastAvailability = "ok";
 		this.runtime.set(k, rt);
 		const verdict = projectVerdict(step.currentStateId, monitor.baselineStateId);
-		const changed = step.transitioned || verdict !== rt.lastVerdict || rt.lastAvailability !== monitor.availability || rt.lastUnavailable !== null;
+		const resumed = rt.suspendedCondition !== null;
+		const changed = step.transitioned || verdict !== rt.lastVerdict || rt.lastAvailability !== monitor.availability || rt.lastUnavailable !== null || resumed;
 		rt.lastVerdict = verdict;
 		rt.lastUnavailable = null;
+		rt.suspendedCondition = null;
 		this.runtime.set(k, rt);
 		if (changed) await this.deps.applyEngineResult(deviceId, monitor.id, {
 			currentStateId: step.currentStateId,
@@ -3816,20 +3837,61 @@ var SceneEngine = class {
 			availability: "ok",
 			unavailableReason: null,
 			coveredConditions: covered,
+			suspendedCondition: null,
 			transitioned: step.transitioned,
 			checkedAt: now
 		});
 	}
 	/**
+	* Announce that this scene is SITTING OUT the current light — once per
+	* transition into it, never once per tick. At a 60 s cadence a per-tick line
+	* would be ~480 lines a night per scene, which is how a log stops being read
+	* at all.
+	*
+	* `info`, not `warn`: nothing is wrong. The operator chose not to capture
+	* this light, or has not got round to it, and either way the scene is doing
+	* exactly what it was configured to do. A branch that drops work still has to
+	* SAY so — silence reads as "never happened" — but saying it at warning level
+	* would train the operator to ignore the one channel that reports real
+	* faults.
+	*/
+	async reportSuspended(deviceId, monitor, rt, input) {
+		if (rt.suspendedCondition === input.condition) return;
+		rt.suspendedCondition = input.condition;
+		this.deps.logger.info("scene checks paused — nothing captured in this light", {
+			tags: { deviceId },
+			meta: {
+				monitorId: monitor.id,
+				condition: input.condition,
+				covered: input.covered.join(",")
+			}
+		});
+		await this.deps.applyEngineResult(deviceId, monitor.id, {
+			currentStateId: rt.hysteresis.currentStateId,
+			previousStateId: rt.hysteresis.currentStateId,
+			lastConfidence: null,
+			currentCondition: input.condition,
+			verdict: rt.lastVerdict,
+			unavailable: rt.lastUnavailable,
+			availability: "ok",
+			unavailableReason: null,
+			coveredConditions: input.covered,
+			suspendedCondition: input.condition,
+			transitioned: false,
+			checkedAt: input.now
+		});
+	}
+	/**
 	* Push an `unknown` verdict — once per transition, not once per poll. The
 	* held state is deliberately NOT destroyed: a scene that cannot judge is a
 	* scene that has not observed anything, and an observation it could not make
 	* must never spend or clear hysteresis credit in either direction.
 	*/
 	async reportUnknown(deviceId, monitor, rt, input) {
-		if (rt.lastVerdict === "unknown" && rt.lastUnavailable === input.cause) return;
+		if (rt.lastVerdict === "unknown" && rt.lastUnavailable === input.cause && rt.suspendedCondition === null) return;
 		rt.lastVerdict = "unknown";
 		rt.lastUnavailable = input.cause;
+		rt.suspendedCondition = null;
 		this.deps.logger.warn("scene cannot judge — reporting unknown", {
 			tags: { deviceId },
 			meta: {
@@ -3849,6 +3911,7 @@ var SceneEngine = class {
 			availability: "ok",
 			unavailableReason: `no comparable reference for "${input.condition}"`,
 			coveredConditions: input.covered,
+			suspendedCondition: null,
 			transitioned: false,
 			checkedAt: input.now
 		});
@@ -4571,6 +4634,8 @@ var SceneMonitorProvider = class {
 			minObservationSpacingSec: 120,
 			anchorThreshold: SCENE_DEFAULT_ANCHOR_THRESHOLD,
 			autoRestore: false,
+			onUncoveredCondition: SCENE_DEFAULT_UNCOVERED_POLICY,
+			suspendedCondition: null,
 			unavailable: "no-reference-for-condition",
 			coveredConditions: []
 		};
@@ -4600,7 +4665,9 @@ var SceneMonitorProvider = class {
 		this.refresh(input.deviceId);
 	}
 	async deleteScene(input) {
+		const doomed = this.deps.store.getScene(input.deviceId, input.monitorId);
 		await this.deps.store.deleteScene(input.deviceId, input.monitorId);
+		await this.dropOrphanedMedia(doomed?.monitor.states.flatMap((s) => s.references) ?? []);
 		this.deps.logger.info("scene deleted", {
 			tags: { deviceId: input.deviceId },
 			meta: { monitorId: input.monitorId }
@@ -4623,7 +4690,9 @@ var SceneMonitorProvider = class {
 		const stateId = input.stateId ?? monitor.states[0]?.id ?? randomUUID();
 		const existing = monitor.states.find((s) => s.id === stateId);
 		const label = input.label ?? existing?.label ?? monitor.label;
-		const references = boundReferences([...existing?.references ?? [], reference], condition);
+		const kept = [...existing?.references ?? [], reference];
+		const references = boundReferences(kept, condition);
+		await this.dropOrphanedMedia(kept.filter((r) => !references.includes(r)));
 		const state = {
 			id: stateId,
 			label,
@@ -4657,6 +4726,7 @@ var SceneMonitorProvider = class {
 	}
 	async deleteReference(input) {
 		const monitor = this.requireScene(input.deviceId, input.monitorId);
+		const removed = monitor.states.find((s) => s.id === input.stateId)?.references[input.index];
 		const states = monitor.states.map((s) => {
 			if (s.id !== input.stateId) return s;
 			const references = s.references.filter((_, i) => i !== input.index);
@@ -4670,6 +4740,17 @@ var SceneMonitorProvider = class {
 			...monitor,
 			states
 		}, this.now());
+		await this.dropOrphanedMedia(removed === void 0 ? [] : [removed]);
+		this.deps.logger.info("scene reference deleted", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				monitorId: input.monitorId,
+				stateId: input.stateId,
+				index: input.index,
+				condition: removed?.condition ?? "(none)",
+				remaining: states.reduce((n, s) => n + s.references.length, 0)
+			}
+		});
 		this.refresh(input.deviceId);
 	}
 	async recheckNow(input) {
@@ -4754,6 +4835,15 @@ var SceneMonitorProvider = class {
 		const row = this.deps.store.getScene(deviceId, monitorId);
 		if (row === void 0) return;
 		const monitor = row.monitor;
+		if (result.suspendedCondition !== null) {
+			await this.deps.store.putScene(deviceId, {
+				...monitor,
+				suspendedCondition: result.suspendedCondition,
+				coveredConditions: [...result.coveredConditions]
+			}, result.checkedAt);
+			this.refresh(deviceId);
+			return;
+		}
 		const previous = this.deps.store.getLatch(deviceId, monitorId);
 		const wasLatched = previous?.latched ?? monitor.latched;
 		const wasVerdict = previous?.verdict ?? monitor.verdict;
@@ -4780,6 +4870,7 @@ var SceneMonitorProvider = class {
 		const merged = {
 			...monitor,
 			coveredConditions: [...result.coveredConditions],
+			suspendedCondition: null,
 			availability: result.availability,
 			unavailableReason: result.unavailableReason
 		};
@@ -4815,6 +4906,7 @@ var SceneMonitorProvider = class {
 			direction,
 			verdict: result.verdict,
 			latched,
+			emit: monitor.emit,
 			condition: result.currentCondition,
 			confidence: result.lastConfidence,
 			timestamp: result.checkedAt
@@ -4882,8 +4974,29 @@ var SceneMonitorProvider = class {
 			updatedAt: now
 		};
 	}
+	/**
+	* Drop the pictures of references that are no longer stored anywhere.
+	*
+	* Best-effort per blob and never throwing: the reference row is already gone,
+	* and refusing the operator's delete because a JPEG would not unlink would be
+	* failing the request over the follower rather than the fact.
+	*/
+	async dropOrphanedMedia(references) {
+		const drop = this.deps.dropMedia;
+		if (drop === void 0) return;
+		for (const r of references) {
+			if (r.thumbnailMediaId === void 0) continue;
+			await drop(r.thumbnailMediaId).catch((err) => {
+				this.deps.logger.debug("scene reference thumbnail delete failed", { meta: {
+					mediaId: r.thumbnailMediaId,
+					error: String(err)
+				} });
+			});
+		}
+	}
 	/** Snapshot → ROI crop + whole-frame anchor → two embeddings + a thumbnail. */
 	async encodeReference(deviceId, monitor, condition) {
+		const capturedAt = this.now();
 		const snap = await this.deps.getSnapshot(deviceId, true);
 		if (snap === null) throw new Error("no snapshot available for this camera");
 		const encoded = Buffer.from(snap.base64, "base64");
@@ -4901,15 +5014,15 @@ var SceneMonitorProvider = class {
 		});
 		const thumbnailMediaId = await this.deps.putMedia?.({
 			deviceId,
-			ownerId: `scene-${monitor.id}-${condition}`,
+			ownerId: `scene-${monitor.id}-${condition}-${capturedAt}`,
 			data: roi.crop,
-			timestamp: this.now()
+			timestamp: capturedAt
 		}).catch(() => void 0);
 		return {
 			embedding,
 			modelId: info.modelId,
 			condition,
-			capturedAt: this.now(),
+			capturedAt,
 			...thumbnailMediaId !== void 0 ? { thumbnailMediaId } : {},
 			...anchor !== null ? { anchorEmbedding: anchor } : {}
 		};
@@ -5405,6 +5518,256 @@ function observeLabel(deviceId, spec, sample, now) {
 		spec
 	};
 }
+/** JPEG quality for the downscaled full frame — matches the crop path. */
+var FULL_FRAME_QUALITY = 80;
+/**
+* Downscale an already-encoded JPEG full frame to FIT WITHIN
+* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
+* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
+* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
+* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
+* at night) is never stored or served — the privacy fix moved to CAPTURE time.
+*/
+async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
+	return sharp(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
+		fit: "inside",
+		withoutEnlargement: true
+	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
+}
+//#endregion
+//#region src/notification-center/audio-still.ts
+/**
+* The audio still shelf — the PHOTOGRAPH a sound rule's notification carries.
+*
+* ## Why a sound needs one at all
+*
+* The attachment ladder resolves media by OWNER, and every other trigger has
+* one: an object or package event owns its crops, a closed track owns its best
+* shot, a doorbell press owns the marker track the same press projected
+* (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
+* counted (`chooseOccupancyMediaOwner`). An audio match owns nothing. Nothing
+* was boxed, nothing was tracked, and — deliberately — nothing is persisted at
+* all: a confirmed window is a claim about sound that has already stopped, and
+* `event-intake.ts` states why replaying it later would be wrong.
+*
+* So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
+* of the match. Not of the sound — of what the camera could see while it was
+* heard.
+*
+* ## Three properties, and each one is a decision
+*
+* **It is not a record.** The bytes live here, in RAM, under an owner id and a
+* TTL that covers the outbox's whole retry horizon — and nowhere else. The
+* alternative was the doorbell's: materialise a synthetic marker track through
+* `SyntheticTrackMaterializer` and let the notification name it. That would put
+* a durable Track on the camera's timeline for every confirmed window, feeding
+* the digest's `listTracks`, retention, and the audio-marker feature's own
+* operator ceilings (`audio-marker-projector.ts` exists precisely to bound how
+* many audio markers a camera may emit). A notification must not manufacture
+* timeline history as a side effect of wanting a picture.
+*
+* **The capture STARTS immediately and is never awaited.** A sound is transient
+* — a scream is over before a snapshot round-trip completes — so the fetch is
+* kicked off at the confirmation, before the rule evaluation runs, and the
+* owner id is minted synchronously so the outbox row can name it. The bytes
+* land while the row waits in the queue, and the dispatcher's existing bounded
+* still-wait (or the pause its own footage render already costs) picks them up.
+* A camera that never answers costs the picture and never the notification.
+*
+* **Two confirmations seconds apart share ONE capture.** A barking dog confirms
+* repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
+* rule's cooldown is its only brake, and the cooldown is applied AFTER this.
+* Without a reuse window this would photograph a camera at whatever rate the
+* sound happens to occur. Each confirmation still gets its OWN owner id, so two
+* outbox rows are never mistaken for one subject; they merely point at the same
+* frame, which is the truth — the scene did not change in ten seconds.
+*
+* Nothing here is silent: a capture that lands and a camera that refuses each
+* emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
+* and 615 not" is the only form that question is ever asked in.
+*/
+/**
+* The owner-id namespace. It is what routes a lookup here instead of to the
+* media store, and it is the reason the dispatcher needs no audio branch —
+* `getMediaForOwner` answers for both under one signature.
+*/
+var NC_AUDIO_STILL_PREFIX = "nc-audio-still:";
+/** True for an owner id this shelf minted. */
+function isAudioStillId(id) {
+	return id.startsWith(NC_AUDIO_STILL_PREFIX);
+}
+/**
+* How long the bytes are held.
+*
+* The outbox retries 8 times with a 5 s → 300 s backoff, which tops out around
+* ten minutes; fifteen covers that with room for a slow drain. Past it the row
+* ships text-only, which is the correct degradation for a photograph of a scene
+* that is a quarter of an hour stale anyway.
+*/
+var NC_AUDIO_STILL_TTL_MS = 15 * 6e4;
+/** A hanging snapshot cap must not pin a capture slot forever. */
+var SNAPSHOT_TIMEOUT_MS = 8e3;
+/**
+* Hard bound on held captures. Reached only if every camera on the hub confirms
+* an audio rule inside one TTL; the oldest is dropped first, which costs a
+* fifteen-minute-old picture nobody is waiting for.
+*/
+var MAX_CAPTURES = 64;
+var NcAudioStillShelf = class {
+	deps;
+	/** captureId → the photograph. */
+	captures = /* @__PURE__ */ new Map();
+	/** ownerId → captureId. Several owners may name one capture (the reuse window). */
+	owners = /* @__PURE__ */ new Map();
+	/** deviceId → its newest capture, for the reuse window. */
+	newest = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Photograph `deviceId` for a match at `atMs`, and return the owner id the
+	* subject should name. SYNCHRONOUS by contract: the caller is on the audio
+	* confirmation path and the outbox row is built from what this returns.
+	*/
+	capture(deviceId, atMs) {
+		const now = this.deps.now();
+		this.prune(now);
+		const ownerId = `${NC_AUDIO_STILL_PREFIX}${randomUUID()}`;
+		const recent = this.newest.get(deviceId);
+		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
+			this.owners.set(ownerId, recent.captureId);
+			return ownerId;
+		}
+		const captureId = randomUUID();
+		this.captures.set(captureId, {
+			deviceId,
+			startedAt: now,
+			expiresAt: now + NC_AUDIO_STILL_TTL_MS,
+			files: []
+		});
+		this.newest.set(deviceId, {
+			captureId,
+			at: now
+		});
+		this.owners.set(ownerId, captureId);
+		this.fetch(captureId, deviceId, atMs);
+		return ownerId;
+	}
+	/**
+	* The media an owner id holds, or `undefined` when this shelf never minted
+	* it. An EMPTY array is a different answer: the capture exists and has not
+	* landed (or never will), which is exactly the case the dispatcher's bounded
+	* wait and its `no still could be resolved` line are for.
+	*/
+	get(ownerId) {
+		const captureId = this.owners.get(ownerId);
+		if (captureId === void 0) return void 0;
+		return this.captures.get(captureId)?.files ?? [];
+	}
+	/** Drop expired captures and the owners that named them. */
+	prune(now) {
+		for (const [captureId, held] of this.captures) {
+			if (held.expiresAt > now) continue;
+			this.captures.delete(captureId);
+			if (this.newest.get(held.deviceId)?.captureId === captureId) this.newest.delete(held.deviceId);
+		}
+		while (this.captures.size > MAX_CAPTURES) {
+			const oldest = this.captures.keys().next();
+			if (oldest.done === true) break;
+			const held = this.captures.get(oldest.value);
+			this.captures.delete(oldest.value);
+			if (held !== void 0 && this.newest.get(held.deviceId)?.captureId === oldest.value) this.newest.delete(held.deviceId);
+		}
+		for (const [ownerId, captureId] of this.owners) if (!this.captures.has(captureId)) this.owners.delete(ownerId);
+	}
+	/** Drop everything (shutdown). */
+	clear() {
+		this.captures.clear();
+		this.owners.clear();
+		this.newest.clear();
+	}
+	async fetch(captureId, deviceId, atMs) {
+		try {
+			const shot = await withTimeout$2(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
+			if (shot === null || shot.base64.length === 0) {
+				this.reportMiss(deviceId, "the camera returned no snapshot");
+				return;
+			}
+			const raw = Buffer.from(shot.base64, "base64");
+			let data = raw;
+			try {
+				data = await downscaleFullFrameJpeg(raw, 960, 540);
+			} catch {}
+			const held = this.captures.get(captureId);
+			if (held === void 0) return;
+			this.captures.set(captureId, {
+				...held,
+				files: audioStillMedia(data, atMs)
+			});
+			this.deps.logger.info("audio still captured", {
+				tags: { deviceId },
+				meta: {
+					bytes: data.byteLength,
+					tookMs: this.deps.now() - held.startedAt
+				}
+			});
+		} catch (err) {
+			this.reportMiss(deviceId, err instanceof Error ? err.message : String(err));
+		}
+	}
+	/**
+	* A branch that drops work says so. This one costs the operator the picture
+	* on a notification they DID receive, so it is a warn and it carries the
+	* camera — the only key the question is ever asked with.
+	*/
+	reportMiss(deviceId, reason) {
+		this.deps.logger.warn("the camera did not answer the audio still — this notification ships text-only", {
+			tags: { deviceId },
+			meta: { reason }
+		});
+	}
+};
+/**
+* The photograph, in the three kinds the CLEAN-SCENE ladders ask for.
+*
+* `keyFrameSmall` leads because it is the first rung of both `attach: 'best'`
+* and `attach: 'keyFrame'` on a track owner; `keyFrame` and `fullFrame` answer
+* `frame: 'full'` and `frame: 'boxed'`'s honest degrade. There is deliberately
+* no `crop` / `thumbnail`: nothing was boxed, so `frame: 'cropped'` resolves
+* NOTHING and the notification ships text-only with the ordinary line saying
+* so. Inventing a centre crop would answer a different question from the one
+* the operator asked.
+*/
+function audioStillMedia(data, timestamp) {
+	const base64 = data.toString("base64");
+	const file = (kind) => ({
+		key: `${NC_AUDIO_STILL_PREFIX}${kind}`,
+		kind,
+		base64,
+		sizeBytes: data.byteLength,
+		timestamp
+	});
+	return [
+		file("keyFrameSmall"),
+		file("keyFrame"),
+		file("fullFrame")
+	];
+}
+/** Reject if `promise` does not settle within `ms`. */
+function withTimeout$2(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`snapshot cap timed out after ${String(ms)}ms`));
+		}, ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
 //#endregion
 //#region src/shared/llm-vision/prompt-hygiene.ts
 /**
@@ -6015,6 +6378,298 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/shared/frame/box-drawer.ts
+var DEFAULT_COLOR = DEFAULT_EVENT_COLOR;
+var DEFAULT_QUALITY = 80;
+var STROKE_WIDTH = 3;
+function escapeXml$2(s) {
+	return s.replace(/[<>&'"]/g, (ch) => {
+		switch (ch) {
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			case "&": return "&amp;";
+			case "'": return "&apos;";
+			default: return "&quot;";
+		}
+	});
+}
+/** Clamp a pixel box to the frame so the rect always stays inside [0,W]×[0,H]. */
+function clampBox(b, frameWidth, frameHeight) {
+	const x = Math.max(0, Math.min(Math.round(b.x), frameWidth - 1));
+	const y = Math.max(0, Math.min(Math.round(b.y), frameHeight - 1));
+	return {
+		x,
+		y,
+		w: Math.max(1, Math.min(Math.round(b.w), frameWidth - x)),
+		h: Math.max(1, Math.min(Math.round(b.h), frameHeight - y))
+	};
+}
+/**
+* Draw bounding boxes over a raw RGB frame and JPEG-encode it.
+*
+* The frame is composited with an SVG overlay (one `<rect>` per box, plus an
+* optional caption) at full resolution, then optionally downscaled — so the
+* box stays crisp relative to the scene. Boxes are clamped to frame bounds to
+* avoid sharp `extract`/region errors on slightly-out-of-range detections.
+*/
+async function drawBoxedFrame(frameData, frameWidth, frameHeight, boxes, opts = {}) {
+	const quality = opts.quality ?? DEFAULT_QUALITY;
+	let base = frameData;
+	let baseIsRaw = true;
+	if (boxes.length > 0) {
+		const fontSize = Math.max(12, Math.round(frameHeight / 30));
+		const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${frameWidth}" height="${frameHeight}">${boxes.map((b) => {
+			const c = clampBox(b, frameWidth, frameHeight);
+			const color = b.color ?? DEFAULT_COLOR;
+			const rect = `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${c.h}" fill="none" stroke="${color}" stroke-width="${STROKE_WIDTH}"/>`;
+			if (!b.label) return rect;
+			const ty = Math.max(fontSize, c.y - 4);
+			return rect + `<text x="${c.x}" y="${ty}" font-family="sans-serif" font-size="${fontSize}" fill="${color}" stroke="black" stroke-width="0.5">${escapeXml$2(b.label)}</text>`;
+		}).join("")}</svg>`;
+		base = await sharp(frameData, { raw: {
+			width: frameWidth,
+			height: frameHeight,
+			channels: 3
+		} }).composite([{
+			input: Buffer.from(svg),
+			top: 0,
+			left: 0
+		}]).png().toBuffer();
+		baseIsRaw = false;
+	}
+	let pipeline = baseIsRaw ? sharp(base, { raw: {
+		width: frameWidth,
+		height: frameHeight,
+		channels: 3
+	} }) : sharp(base);
+	if (opts.maxWidth !== void 0) pipeline = pipeline.resize({
+		width: opts.maxWidth,
+		withoutEnlargement: true
+	});
+	return pipeline.jpeg({ quality }).toBuffer();
+}
+/** JPEG quality of the composed artefact — the mosaic's number, same reasons. */
+var GROUP_FRAME_QUALITY = 82;
+/**
+* Draw the members onto the frame. Returns `null` when there is nothing to
+* draw, or when anything at all goes wrong — the caller then ships the
+* unannotated frame unchanged.
+*/
+async function composeGroupFrame(input) {
+	const freshnessMs = input.freshnessMs ?? 3e3;
+	const fresh = input.boxes.filter((b) => Math.abs(input.at - b.observedAt) <= freshnessMs);
+	const withheld = input.boxes.length - fresh.length;
+	if (fresh.length < 2) {
+		if (withheld > 0) input.logger.info("group frame not drawn — too few members with fresh geometry", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				groupKey: input.groupKey,
+				members: input.boxes.length,
+				fresh: fresh.length,
+				withheld
+			}
+		});
+		return null;
+	}
+	try {
+		const decoded = await sharp(input.jpeg).raw().toBuffer({ resolveWithObject: true });
+		const { width, height, channels } = decoded.info;
+		if (!(width > 0 && height > 0) || channels !== 3) {
+			input.logger.warn("group frame not drawn — unexpected raster shape", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					groupKey: input.groupKey,
+					width,
+					height,
+					channels
+				}
+			});
+			return null;
+		}
+		const boxes = fresh.map((b) => ({
+			x: b.bbox.x * width,
+			y: b.bbox.y * height,
+			w: b.bbox.w * width,
+			h: b.bbox.h * height,
+			...b.label !== void 0 && b.label.length > 0 ? { label: b.label } : {}
+		}));
+		const bytes = await drawBoxedFrame(decoded.data, width, height, boxes, { quality: GROUP_FRAME_QUALITY });
+		input.logger.debug("group frame composed", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				groupKey: input.groupKey,
+				drawn: boxes.length,
+				withheld,
+				width,
+				height
+			}
+		});
+		return {
+			bytes,
+			drawn: boxes.length,
+			withheld
+		};
+	} catch (err) {
+		input.logger.warn("group frame compose failed — shipping the unannotated frame", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				groupKey: input.groupKey,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return null;
+	}
+}
+//#endregion
+//#region src/notification-center/text-compose.ts
+/** One normalisation, used on both sides of every class lookup — a pipeline
+*  that emitted `Person` must find the key written `class.person`. */
+function normaliseClass(className) {
+	return className.trim().toLowerCase();
+}
+/**
+* The noun for a class, in the count's plural category.
+*
+* A class no locale names falls through to `class.other`, which prints the RAW
+* name: a custom model's class must appear in the sentence rather than vanish
+* out of it, and a missing translation is a smaller defect than a missing
+* detection.
+*/
+function ncClassNoun(texts, className, count) {
+	const key = `class.${normaliseClass(className)}`;
+	if (texts.has(key)) return texts.text({
+		key,
+		count,
+		vars: { name: className }
+	});
+	return texts.text({
+		key: "class.other",
+		count,
+		vars: { name: className }
+	});
+}
+/** `person (John)` / `persona (John)` — the thing the notification is about. */
+function ncSubjectText(texts, input) {
+	const classNoun = ncClassNoun(texts, input.className, 1);
+	if (input.label === void 0) return texts.text({
+		key: "detection.subject",
+		vars: { classNoun }
+	});
+	return texts.text({
+		key: subjectLabelKey(input.labelKind),
+		vars: {
+			classNoun,
+			label: input.label
+		}
+	});
+}
+/**
+* Which labelled-subject key a recognition gets. A kind the catalog does not
+* name falls back to the generic key rather than printing nothing — the same
+* direction `ncClassNoun` degrades in, and for the same reason.
+*/
+function subjectLabelKey(kind) {
+	if (kind === "identity") return "detection.subject.identity";
+	if (kind === "plate") return "detection.subject.plate";
+	return "detection.subject.labelled";
+}
+/**
+* ` in gate, drive` — INCLUDING its leading space, and empty when there are no
+* zones.
+*
+* The space belongs to the fragment rather than to the body key because the
+* alternative is a body that ends in a trailing space on every zone-less
+* notification. A translator moving the clause moves the space with it.
+*/
+function ncInZonesText(texts, zoneLabels) {
+	if (zoneLabels.length === 0) return "";
+	return texts.text({
+		key: "detection.inZones",
+		vars: { zones: zoneLabels.join(", ") }
+	});
+}
+/** The human-readable edge polarity behind `{{op}}` and the occupancy body. */
+function ncOccupancyOp(texts, occupied) {
+	return texts.text({ key: occupied ? "occupancy.op.occupied" : "occupancy.op.free" });
+}
+/**
+* `1 persona, 2 veicoli e 3 animali` — the language's own conjunction, its own
+* plural rules, and its own nouns.
+*
+* Zero-count classes are dropped: a selected class the window never contained
+* is a legitimate `0` in `{{count_vehicle}}`, but "0 veicoli" inside a summary
+* sentence is a line nobody reads. Order is the caller's (busiest first) and is
+* preserved, so the same night always produces the same sentence.
+*/
+function ncDetectionSummary(texts, counts) {
+	const parts = counts.filter((entry) => entry.count > 0).map((entry) => `${entry.count} ${ncClassNoun(texts, entry.className, entry.count)}`);
+	return texts.join(parts);
+}
+//#endregion
+//#region src/notification-center/group/nc-group-text.ts
+var DEFAULT_MAX_NAMES = 2;
+/**
+* `N altre persone` — the remainder phrase for one class, in its own gender.
+*
+* Mirrors {@link ncClassNoun} byte for byte, including the fallback: a class no
+* locale names falls through to `group.others.other`, which prints the raw class
+* name rather than vanishing. A custom model's class must appear in the sentence.
+*/
+function ncGroupOthers(texts, className, count) {
+	const classNoun = ncClassNoun(texts, className, count);
+	const key = `group.others.${className.trim().toLowerCase()}`;
+	if (texts.has(key)) return texts.text({
+		key,
+		count,
+		vars: {
+			count: `${count}`,
+			classNoun
+		}
+	});
+	return texts.text({
+		key: "group.others.other",
+		count,
+		vars: {
+			count: `${count}`,
+			classNoun
+		}
+	});
+}
+/** Counts per class, in first-seen order so the same burst always reads the same. */
+function countByClass(members) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const m of members) counts.set(m.className, (counts.get(m.className) ?? 0) + 1);
+	return [...counts].map(([className, count]) => ({
+		className,
+		count
+	}));
+}
+/**
+* The finished `{{subject}}` phrase for a group.
+*
+* Pure: a catalog in, a string out. No clock, no store, no I/O — like every
+* other composer in `text-compose.ts`, and for the same reason.
+*/
+function ncGroupSubjectText(texts, input) {
+	const members = input.members;
+	const only = members.length === 1 ? members[0] : void 0;
+	if (only !== void 0) return ncSubjectText(texts, {
+		className: only.className,
+		...only.label !== void 0 ? { label: only.label } : {},
+		...only.labelKind !== void 0 ? { labelKind: only.labelKind } : {}
+	});
+	if (members.length === 0) return "";
+	const maxNames = input.maxNames !== void 0 && input.maxNames >= 0 ? input.maxNames : DEFAULT_MAX_NAMES;
+	const named = members.filter((m) => m.label !== void 0 && m.label.length > 0);
+	const names = named.slice(0, maxNames).map((m) => m.label ?? "");
+	if (names.length === 0) return ncDetectionSummary(texts, countByClass(members));
+	const spoken = new Set(named.slice(0, maxNames));
+	const remainder = members.filter((m) => !spoken.has(m));
+	if (remainder.length === 0) return texts.join(names);
+	const others = countByClass(remainder).map((c) => ncGroupOthers(texts, c.className, c.count));
+	return texts.join([...names, ...others]);
+}
+//#endregion
 //#region src/notification-center/render-template.ts
 /**
 * The ONE `{{var}}` renderer of the notification centre.
@@ -6479,6 +7134,110 @@ function maskPolygonOverlap(mask, maskWidth, maskHeight, bbox, polygon, _frameWi
 	if (totalMaskPixels === 0) return 0;
 	return insidePolygon / totalMaskPixels;
 }
+var NcSceneStateCache = class {
+	deps;
+	entries = /* @__PURE__ */ new Map();
+	noted = /* @__PURE__ */ new Map();
+	ids = [];
+	now;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	/**
+	* The scene ids worth reading — recomputed from the rule set, so a cluster
+	* with no scene-gated rule does no work at all and logs nothing.
+	*/
+	setWatched(ids) {
+		this.ids = [...new Set(ids)].sort();
+	}
+	watched() {
+		return this.ids;
+	}
+	/**
+	* "This scene, in this process, is in this state, NOW."
+	*
+	* Synchronous by contract — the caller is the scene provider's own edge tap
+	* and the next rule evaluation must already see it.
+	*/
+	note(observation) {
+		this.noted.set(observation.sceneId, {
+			observation,
+			at: this.now()
+		});
+	}
+	/** Hot-path read. No I/O, no await — this is called per event. */
+	get(sceneId) {
+		const now = this.now();
+		const noted = this.noted.get(sceneId);
+		if (noted !== void 0) {
+			if (now - noted.at <= 3e5) return noted.observation;
+			this.noted.delete(sceneId);
+		}
+		const entry = this.entries.get(sceneId);
+		if (entry === void 0) return void 0;
+		if (now - entry.at > 3e5) return void 0;
+		return entry.observation;
+	}
+	/**
+	* Re-read every watched scene. Never throws: a gate that could fail the
+	* evaluation tick would take the notification pipeline with it.
+	*
+	* On failure the previous entries are KEPT — their timestamps are not
+	* touched, so they age out on their own rather than vanishing at once.
+	*/
+	refresh() {
+		if (this.ids.length === 0) {
+			this.entries = /* @__PURE__ */ new Map();
+			this.noted.clear();
+			return;
+		}
+		let observations;
+		try {
+			observations = this.deps.readScenes();
+		} catch (err) {
+			this.deps.logger.warn("scene-state refresh failed — keeping the previous states until they age out", { meta: {
+				watched: this.ids.length,
+				error: String(err)
+			} });
+			return;
+		}
+		const at = this.now();
+		const wanted = new Set(this.ids);
+		const next = /* @__PURE__ */ new Map();
+		for (const observation of observations) {
+			if (!wanted.has(observation.sceneId)) continue;
+			next.set(observation.sceneId, {
+				observation,
+				at
+			});
+		}
+		this.entries = next;
+		for (const sceneId of this.ids) {
+			if (next.has(sceneId)) continue;
+			this.deps.logger.info("scene gate: no state for a watched scene", { meta: { sceneId } });
+		}
+	}
+};
+/**
+* Does this observation satisfy the rule's scene condition?
+*
+* Exported and pure so the semantics can be tested without a cache, a provider
+* or a rule — and so there is exactly ONE place that decides what `latched`
+* absent means. See `NcSceneConditionSchema` for the reasoning behind each
+* branch.
+*/
+function sceneConditionSatisfied(condition, observation) {
+	if (condition.latched ?? observation.emit === "latched") return observation.latched === (condition.requiredState === "diverged");
+	return observation.verdict === condition.requiredState;
+}
+/** One-line "why", for the suppression log. Never a bare boolean: a drop the
+*  operator cannot explain is the failure this whole feature is one misstep
+*  away from. */
+function sceneGateReason(condition, observation) {
+	if (observation === void 0) return "no mirrored state for this scene";
+	return condition.latched ?? observation.emit === "latched" ? `latched=${observation.latched} (wanted ${condition.requiredState})` : `verdict=${observation.verdict} (wanted ${condition.requiredState})`;
+}
 //#endregion
 //#region src/notification-center/zone-ownership.ts
 var UNCHANGED = { kind: "unchanged" };
@@ -6634,10 +7393,17 @@ function subjectFromSensorEvent(ev, markerTrackId) {
 * `minConfidence` condition composes naturally). A level-path audio event (no
 * `classification`) yields NO class ⇒ it can never satisfy the audio opt-in
 * gate, so only classified audio ever notifies (documented boundary). Audio has
-* no zones / bbox / label / track, so the object/track-specific conditions all
-* fail closed (see the {@link evaluateRule} audio gate + the matchers below).
+* no zones / bbox / label, so the object-specific conditions all fail closed
+* (see the {@link evaluateRule} audio gate + the matchers below).
+*
+* `stillOwnerId` is the audio still shelf's owner id — the photograph of the
+* camera taken at the match (`audio-still.ts`). It rides `trackId` because that
+* is the field the attachment ladder reads, exactly as a doorbell press rides
+* its marker track's id; nothing else about the subject is track-scoped, and
+* `buildEntries` keys an audio row on its record id, never on this. Absent when
+* no rule that could fire wants a still.
 */
-function subjectFromAudioEvent(ev) {
+function subjectFromAudioEvent(ev, stillOwnerId) {
 	const macro = ev.classification?.className;
 	return {
 		kind: "audio-event",
@@ -6647,6 +7413,7 @@ function subjectFromAudioEvent(ev) {
 		classNames: macro !== void 0 ? [`audio-${macro}`] : [],
 		...ev.classification?.score !== void 0 ? { confidence: ev.classification.score } : {},
 		zones: [],
+		...stillOwnerId !== void 0 ? { trackId: stillOwnerId } : {},
 		source: "pipeline"
 	};
 }
@@ -6667,8 +7434,12 @@ function subjectFromAudioEvent(ev) {
 * neither is a score, and lending one to `minConfidence` would let a detection
 * condition silently re-judge an audio rule on a number that means something
 * else.
+*
+* `stillOwnerId` — see {@link subjectFromAudioEvent}. A sound owns no frame, so
+* the only picture it can carry is a photograph of its camera taken at the
+* confirmation, held on the still shelf under this id.
 */
-function subjectFromAudioWindow(hit) {
+function subjectFromAudioWindow(hit, stillOwnerId) {
 	const spec = hit.spec;
 	return {
 		kind: "audio-window",
@@ -6677,6 +7448,7 @@ function subjectFromAudioWindow(hit) {
 		timestamp: hit.timestamp,
 		classNames: hit.labels.map((l) => `audio-${l}`),
 		zones: [],
+		...stillOwnerId !== void 0 ? { trackId: stillOwnerId } : {},
 		source: "audio",
 		audioWindow: audioSubjectFor(hit, spec)
 	};
@@ -6815,6 +7587,7 @@ function presentConditionIds(c) {
 	if (c.packagePhase !== void 0 && c.packagePhase !== "both") ids.push("packagePhase");
 	if (c.customZones !== void 0 && c.customZones.length > 0) ids.push("customZones");
 	if (c.occupancy !== void 0) ids.push("occupancy");
+	if (c.scene !== void 0) ids.push("scene");
 	return ids;
 }
 /**
@@ -6994,7 +7767,7 @@ function matchesSystemEvent(condition, subject) {
 	if (condition.packageNames !== void 0 && (subject.packageName === void 0 || !condition.packageNames.includes(subject.packageName))) return false;
 	return true;
 }
-function evaluateRule(rule, subject, deviceState, zoneOwners) {
+function evaluateRule(rule, subject, deviceState, zoneOwners, sceneStates) {
 	if (subject.kind === "system-event") {
 		if (rule.delivery !== "system-event") return fail("delivery");
 		const condition = rule.conditions.systemEvent;
@@ -7035,6 +7808,11 @@ function evaluateRule(rule, subject, deviceState, zoneOwners) {
 		if (current === void 0) return fail("deviceState");
 		if (!toLowerSet(c.deviceState.states).has(current.trim().toLowerCase())) return fail("deviceState");
 	}
+	if (c.scene !== void 0) {
+		const observation = sceneStates?.(c.scene.sceneId);
+		if (observation === void 0) return fail("scene");
+		if (!sceneConditionSatisfied(c.scene, observation)) return fail("scene");
+	}
 	if (c.devices !== void 0 && c.devices.length > 0 && !matchesDeviceScope(c.devices, subject)) return fail("devices");
 	if (c.source !== void 0 && c.source !== "any") {
 		if ((subject.source ?? "pipeline") !== c.source) return fail("source");
@@ -7893,298 +8671,6 @@ var NcTextCatalog = class {
 	}
 };
 //#endregion
-//#region src/shared/frame/box-drawer.ts
-var DEFAULT_COLOR = DEFAULT_EVENT_COLOR;
-var DEFAULT_QUALITY = 80;
-var STROKE_WIDTH = 3;
-function escapeXml$2(s) {
-	return s.replace(/[<>&'"]/g, (ch) => {
-		switch (ch) {
-			case "<": return "&lt;";
-			case ">": return "&gt;";
-			case "&": return "&amp;";
-			case "'": return "&apos;";
-			default: return "&quot;";
-		}
-	});
-}
-/** Clamp a pixel box to the frame so the rect always stays inside [0,W]×[0,H]. */
-function clampBox(b, frameWidth, frameHeight) {
-	const x = Math.max(0, Math.min(Math.round(b.x), frameWidth - 1));
-	const y = Math.max(0, Math.min(Math.round(b.y), frameHeight - 1));
-	return {
-		x,
-		y,
-		w: Math.max(1, Math.min(Math.round(b.w), frameWidth - x)),
-		h: Math.max(1, Math.min(Math.round(b.h), frameHeight - y))
-	};
-}
-/**
-* Draw bounding boxes over a raw RGB frame and JPEG-encode it.
-*
-* The frame is composited with an SVG overlay (one `<rect>` per box, plus an
-* optional caption) at full resolution, then optionally downscaled — so the
-* box stays crisp relative to the scene. Boxes are clamped to frame bounds to
-* avoid sharp `extract`/region errors on slightly-out-of-range detections.
-*/
-async function drawBoxedFrame(frameData, frameWidth, frameHeight, boxes, opts = {}) {
-	const quality = opts.quality ?? DEFAULT_QUALITY;
-	let base = frameData;
-	let baseIsRaw = true;
-	if (boxes.length > 0) {
-		const fontSize = Math.max(12, Math.round(frameHeight / 30));
-		const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${frameWidth}" height="${frameHeight}">${boxes.map((b) => {
-			const c = clampBox(b, frameWidth, frameHeight);
-			const color = b.color ?? DEFAULT_COLOR;
-			const rect = `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${c.h}" fill="none" stroke="${color}" stroke-width="${STROKE_WIDTH}"/>`;
-			if (!b.label) return rect;
-			const ty = Math.max(fontSize, c.y - 4);
-			return rect + `<text x="${c.x}" y="${ty}" font-family="sans-serif" font-size="${fontSize}" fill="${color}" stroke="black" stroke-width="0.5">${escapeXml$2(b.label)}</text>`;
-		}).join("")}</svg>`;
-		base = await sharp(frameData, { raw: {
-			width: frameWidth,
-			height: frameHeight,
-			channels: 3
-		} }).composite([{
-			input: Buffer.from(svg),
-			top: 0,
-			left: 0
-		}]).png().toBuffer();
-		baseIsRaw = false;
-	}
-	let pipeline = baseIsRaw ? sharp(base, { raw: {
-		width: frameWidth,
-		height: frameHeight,
-		channels: 3
-	} }) : sharp(base);
-	if (opts.maxWidth !== void 0) pipeline = pipeline.resize({
-		width: opts.maxWidth,
-		withoutEnlargement: true
-	});
-	return pipeline.jpeg({ quality }).toBuffer();
-}
-/** JPEG quality of the composed artefact — the mosaic's number, same reasons. */
-var GROUP_FRAME_QUALITY = 82;
-/**
-* Draw the members onto the frame. Returns `null` when there is nothing to
-* draw, or when anything at all goes wrong — the caller then ships the
-* unannotated frame unchanged.
-*/
-async function composeGroupFrame(input) {
-	const freshnessMs = input.freshnessMs ?? 3e3;
-	const fresh = input.boxes.filter((b) => Math.abs(input.at - b.observedAt) <= freshnessMs);
-	const withheld = input.boxes.length - fresh.length;
-	if (fresh.length < 2) {
-		if (withheld > 0) input.logger.info("group frame not drawn — too few members with fresh geometry", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				groupKey: input.groupKey,
-				members: input.boxes.length,
-				fresh: fresh.length,
-				withheld
-			}
-		});
-		return null;
-	}
-	try {
-		const decoded = await sharp(input.jpeg).raw().toBuffer({ resolveWithObject: true });
-		const { width, height, channels } = decoded.info;
-		if (!(width > 0 && height > 0) || channels !== 3) {
-			input.logger.warn("group frame not drawn — unexpected raster shape", {
-				tags: { deviceId: input.deviceId },
-				meta: {
-					groupKey: input.groupKey,
-					width,
-					height,
-					channels
-				}
-			});
-			return null;
-		}
-		const boxes = fresh.map((b) => ({
-			x: b.bbox.x * width,
-			y: b.bbox.y * height,
-			w: b.bbox.w * width,
-			h: b.bbox.h * height,
-			...b.label !== void 0 && b.label.length > 0 ? { label: b.label } : {}
-		}));
-		const bytes = await drawBoxedFrame(decoded.data, width, height, boxes, { quality: GROUP_FRAME_QUALITY });
-		input.logger.debug("group frame composed", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				groupKey: input.groupKey,
-				drawn: boxes.length,
-				withheld,
-				width,
-				height
-			}
-		});
-		return {
-			bytes,
-			drawn: boxes.length,
-			withheld
-		};
-	} catch (err) {
-		input.logger.warn("group frame compose failed — shipping the unannotated frame", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				groupKey: input.groupKey,
-				error: err instanceof Error ? err.message : String(err)
-			}
-		});
-		return null;
-	}
-}
-//#endregion
-//#region src/notification-center/text-compose.ts
-/** One normalisation, used on both sides of every class lookup — a pipeline
-*  that emitted `Person` must find the key written `class.person`. */
-function normaliseClass(className) {
-	return className.trim().toLowerCase();
-}
-/**
-* The noun for a class, in the count's plural category.
-*
-* A class no locale names falls through to `class.other`, which prints the RAW
-* name: a custom model's class must appear in the sentence rather than vanish
-* out of it, and a missing translation is a smaller defect than a missing
-* detection.
-*/
-function ncClassNoun(texts, className, count) {
-	const key = `class.${normaliseClass(className)}`;
-	if (texts.has(key)) return texts.text({
-		key,
-		count,
-		vars: { name: className }
-	});
-	return texts.text({
-		key: "class.other",
-		count,
-		vars: { name: className }
-	});
-}
-/** `person (John)` / `persona (John)` — the thing the notification is about. */
-function ncSubjectText(texts, input) {
-	const classNoun = ncClassNoun(texts, input.className, 1);
-	if (input.label === void 0) return texts.text({
-		key: "detection.subject",
-		vars: { classNoun }
-	});
-	return texts.text({
-		key: subjectLabelKey(input.labelKind),
-		vars: {
-			classNoun,
-			label: input.label
-		}
-	});
-}
-/**
-* Which labelled-subject key a recognition gets. A kind the catalog does not
-* name falls back to the generic key rather than printing nothing — the same
-* direction `ncClassNoun` degrades in, and for the same reason.
-*/
-function subjectLabelKey(kind) {
-	if (kind === "identity") return "detection.subject.identity";
-	if (kind === "plate") return "detection.subject.plate";
-	return "detection.subject.labelled";
-}
-/**
-* ` in gate, drive` — INCLUDING its leading space, and empty when there are no
-* zones.
-*
-* The space belongs to the fragment rather than to the body key because the
-* alternative is a body that ends in a trailing space on every zone-less
-* notification. A translator moving the clause moves the space with it.
-*/
-function ncInZonesText(texts, zoneLabels) {
-	if (zoneLabels.length === 0) return "";
-	return texts.text({
-		key: "detection.inZones",
-		vars: { zones: zoneLabels.join(", ") }
-	});
-}
-/** The human-readable edge polarity behind `{{op}}` and the occupancy body. */
-function ncOccupancyOp(texts, occupied) {
-	return texts.text({ key: occupied ? "occupancy.op.occupied" : "occupancy.op.free" });
-}
-/**
-* `1 persona, 2 veicoli e 3 animali` — the language's own conjunction, its own
-* plural rules, and its own nouns.
-*
-* Zero-count classes are dropped: a selected class the window never contained
-* is a legitimate `0` in `{{count_vehicle}}`, but "0 veicoli" inside a summary
-* sentence is a line nobody reads. Order is the caller's (busiest first) and is
-* preserved, so the same night always produces the same sentence.
-*/
-function ncDetectionSummary(texts, counts) {
-	const parts = counts.filter((entry) => entry.count > 0).map((entry) => `${entry.count} ${ncClassNoun(texts, entry.className, entry.count)}`);
-	return texts.join(parts);
-}
-//#endregion
-//#region src/notification-center/group/nc-group-text.ts
-var DEFAULT_MAX_NAMES = 2;
-/**
-* `N altre persone` — the remainder phrase for one class, in its own gender.
-*
-* Mirrors {@link ncClassNoun} byte for byte, including the fallback: a class no
-* locale names falls through to `group.others.other`, which prints the raw class
-* name rather than vanishing. A custom model's class must appear in the sentence.
-*/
-function ncGroupOthers(texts, className, count) {
-	const classNoun = ncClassNoun(texts, className, count);
-	const key = `group.others.${className.trim().toLowerCase()}`;
-	if (texts.has(key)) return texts.text({
-		key,
-		count,
-		vars: {
-			count: `${count}`,
-			classNoun
-		}
-	});
-	return texts.text({
-		key: "group.others.other",
-		count,
-		vars: {
-			count: `${count}`,
-			classNoun
-		}
-	});
-}
-/** Counts per class, in first-seen order so the same burst always reads the same. */
-function countByClass(members) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const m of members) counts.set(m.className, (counts.get(m.className) ?? 0) + 1);
-	return [...counts].map(([className, count]) => ({
-		className,
-		count
-	}));
-}
-/**
-* The finished `{{subject}}` phrase for a group.
-*
-* Pure: a catalog in, a string out. No clock, no store, no I/O — like every
-* other composer in `text-compose.ts`, and for the same reason.
-*/
-function ncGroupSubjectText(texts, input) {
-	const members = input.members;
-	const only = members.length === 1 ? members[0] : void 0;
-	if (only !== void 0) return ncSubjectText(texts, {
-		className: only.className,
-		...only.label !== void 0 ? { label: only.label } : {},
-		...only.labelKind !== void 0 ? { labelKind: only.labelKind } : {}
-	});
-	if (members.length === 0) return "";
-	const maxNames = input.maxNames !== void 0 && input.maxNames >= 0 ? input.maxNames : DEFAULT_MAX_NAMES;
-	const named = members.filter((m) => m.label !== void 0 && m.label.length > 0);
-	const names = named.slice(0, maxNames).map((m) => m.label ?? "");
-	if (names.length === 0) return ncDetectionSummary(texts, countByClass(members));
-	const spoken = new Set(named.slice(0, maxNames));
-	const remainder = members.filter((m) => !spoken.has(m));
-	if (remainder.length === 0) return texts.join(names);
-	const others = countByClass(remainder).map((c) => ncGroupOthers(texts, c.className, c.count));
-	return texts.join([...names, ...others]);
-}
-//#endregion
 //#region src/notification-center/dispatcher.ts
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
 /**
@@ -8747,7 +9233,7 @@ var NcDispatcher = class {
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
 		const firstLook = await this.resolveAttachment(entry, stillOverride);
 		const footage = await this.renderFootage(entry);
-		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : footage.attempted ? await this.resolveAttachment(entry, stillOverride) : await this.waitForStill(entry, stillOverride);
+		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : footage.attempted ? await this.resolveAttachment(entry, stillOverride) ?? await this.waitForStill(entry, stillOverride) : await this.waitForStill(entry, stillOverride);
 		if (still !== null) {
 			const zoneIds = zoneIdsWanted;
 			if (zoneIds !== void 0 && zoneIds.length > 0) {
@@ -9235,17 +9721,24 @@ function incomingFromSensorEvent(event, markerTrackId) {
 		})
 	};
 }
-/** Audio-event persist (classified episode). */
-function incomingFromAudioEvent(event) {
+/**
+* Audio-event persist (classified episode).
+*
+* `stillOwnerId` is the audio still shelf's owner id for the photograph taken
+* at this episode (`audio-still.ts`). Absent when no rule that could fire asked
+* for a picture — the same shape `incomingFromSensorEvent` carries its marker.
+*/
+function incomingFromAudioEvent(event, stillOwnerId) {
 	return {
-		subject: subjectFromAudioEvent(event),
+		subject: subjectFromAudioEvent(event, stillOwnerId),
 		kind: "audio-event",
 		origin: "pipeline",
 		log: () => ({
 			tags: { deviceId: event.deviceId },
 			meta: {
 				audioEventId: event.id,
-				class: event.classification?.className
+				class: event.classification?.className,
+				...stillOwnerId !== void 0 ? { stillOwner: stillOwnerId } : {}
 			}
 		})
 	};
@@ -9275,15 +9768,20 @@ function incomingFromPackageEvent(event, phase) {
 * and a crash in the confirm→outbox window drops the notification rather than
 * replaying it. Deliberate: a stale match is a claim about a noise that has
 * already stopped.
+*
+* `stillOwnerId` — see {@link incomingFromAudioEvent}.
 */
-function incomingFromAudioWindow(hit) {
+function incomingFromAudioWindow(hit, stillOwnerId) {
 	return {
-		subject: subjectFromAudioWindow(hit),
+		subject: subjectFromAudioWindow(hit, stillOwnerId),
 		kind: "audio-window",
 		origin: "pipeline",
 		log: () => ({
 			tags: { deviceId: hit.deviceId },
-			meta: audioHitMeta(hit)
+			meta: {
+				...audioHitMeta(hit),
+				...stillOwnerId !== void 0 ? { stillOwner: stillOwnerId } : {}
+			}
 		})
 	};
 }
@@ -13224,6 +13722,29 @@ function escapeXml$1(s) {
 		}
 	});
 }
+/**
+* The single decision about drawn text — and the home of the DEFAULT.
+*
+* `undefined` means `none`, not `all`: a rule stored before this option existed
+* has no `captions` key, and the operator's request is that such a rule deliver
+* pictures. The schema materialises the same default on read
+* (`NcSummaryRuleInputSchema`), so this arm only fires for a caller that never
+* had a rule — the test bridge and the spec. Both agreeing is the point.
+*/
+function mosaicTextPlan(captions) {
+	if (captions === "all") return {
+		tileLabels: true,
+		titleBand: true
+	};
+	if (captions === "tiles") return {
+		tileLabels: true,
+		titleBand: false
+	};
+	return {
+		tileLabels: false,
+		titleBand: false
+	};
+}
 /** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
 *  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
 function mosaicGrid(n) {
@@ -13330,22 +13851,25 @@ function titleSvg(width, height, caption) {
 *         treats that as "no mosaic" and still delivers the counts.
 */
 async function renderMosaic(request, logger) {
+	const plan = mosaicTextPlan(request.captions);
 	const decoded = [];
 	const probeLayout = mosaicLayout({
 		tileCount: Math.max(1, request.tiles.length),
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
 	});
 	for (const tile of request.tiles) try {
-		const resized = await sharp(tile.jpeg).resize({
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = sharp(tile.jpeg).resize({
 			width: probeLayout.tileWidth,
 			height: probeLayout.tileHeight,
 			fit: "contain",
 			background: MOSAIC_BACKGROUND
-		}).composite([{
-			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, tile.label),
+		});
+		const resized = await (label.length === 0 ? fitted : fitted.composite([{
+			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, label),
 			top: 0,
 			left: 0
-		}]).jpeg({ quality: 82 }).toBuffer();
+		}])).jpeg({ quality: 82 }).toBuffer();
 		decoded.push({
 			tile,
 			resized
@@ -13360,7 +13884,7 @@ async function renderMosaic(request, logger) {
 		});
 	}
 	const droppedTiles = request.tiles.length - decoded.length;
-	const caption = request.caption?.trim() ?? "";
+	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
 	const layout = mosaicLayout({
 		tileCount: Math.max(1, decoded.length),
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
@@ -14229,18 +14753,20 @@ var NcSummaryProducer = class {
 		};
 		let rendered;
 		try {
+			const plan = mosaicTextPlan(rule.captions);
 			rendered = await renderMosaic({
 				tiles: tiles.map(({ candidate, jpeg }) => ({
 					jpeg,
-					label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf$2(candidate.firstSeen)} · ${candidate.className}`,
+					...plan.tileLabels ? { label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf$2(candidate.firstSeen)} · ${candidate.className}` } : {},
 					deviceId: candidate.deviceId,
 					trackId: candidate.trackId
 				})),
-				caption: summaryCaptionText({
+				captions: rule.captions,
+				...plan.titleBand ? { caption: summaryCaptionText({
 					...rule.captionText !== void 0 ? { captionText: rule.captionText } : {},
 					ruleName: rule.name,
 					window
-				})
+				}) } : {}
 			}, this.deps.logger);
 		} catch (err) {
 			this.deps.logger.warn("summary mosaic could not be composed — delivering the counts alone", { meta: {
@@ -14504,6 +15030,34 @@ var NcSummaryRankSchema = _enum([
 	"dwell"
 ]);
 /**
+* How much TEXT is burnt into the mosaic — and the answer is NONE by default.
+*
+* `none` is the shipped default and, crucially, the reading of an ABSENT field:
+* `.default()` on the Input schema materialises it, and the persisted schema
+* extends Input, so a rule authored before this option existed parses as `none`
+* on the next read. No migration, no backfill, no rewrite of a stored rule.
+*
+* The operator asked for "solo immagini". Three reasons it is the right
+* default rather than a preference:
+*
+*  - a caption is PERMANENT in the artefact, exactly like a detection box, and
+*    a mosaic is re-read days later;
+*  - the per-tile strip covers 14% of the tile from the bottom edge up, which
+*    is where feet, wheels and parcels are;
+*  - nothing downstream needs it. The AI pass is given the RAW per-track JPEGs
+*    and gets camera, class and time as PROMPT TEXT — it never reads the
+*    mosaic, so the pixels carry no fact the judge would lose.
+*
+* `tiles` and `all` keep the old behaviour reachable for an operator who wants
+* it; `all` is byte-for-byte what every rule produced before this field.
+*/
+var NcSummaryCaptionsSchema = _enum([
+	"none",
+	"tiles",
+	"all"
+]);
+var NC_SUMMARY_DEFAULT_CAPTIONS = "none";
+/**
 * The AI section — DECLARED IN P1, WIRED IN P2.
 *
 * Nothing in this addon reads it today. It is here so the rule shape does not
@@ -14537,6 +15091,8 @@ var NcSummaryRuleInputSchema = object({
 	barrierSeconds: BarrierSecondsField.default(120),
 	targets: TargetsField,
 	template: NcSummaryTemplateSchema.optional(),
+	/** Burned onto the mosaic's title band — and ONLY when `captions` is `all`. */
+	captions: NcSummaryCaptionsSchema.default(NC_SUMMARY_DEFAULT_CAPTIONS),
 	/** Burned onto the mosaic's title band. `''` is reachable and means "no
 	*  caption" — which is why this is not `.min(1)`. */
 	captionText: string().max(200).optional(),
@@ -14566,6 +15122,7 @@ var NcSummaryRulePatchSchema = object({
 	barrierSeconds: BarrierSecondsField.optional(),
 	targets: TargetsField.optional(),
 	template: NcSummaryTemplateSchema.nullable().optional(),
+	captions: NcSummaryCaptionsSchema.optional(),
 	captionText: string().max(200).optional(),
 	deliverEmpty: boolean().optional(),
 	priority: PriorityField.optional(),
@@ -15085,14 +15642,19 @@ function isSyntheticId(id) {
 *    snapshot that produced it lists the members being counted and the edge
 *    names one (`chooseOccupancyMediaOwner`), so the tester stands in for that
 *    member exactly as it stands in for the marker.
+*  - and, since 2026-08-15, a `trackId` for both AUDIO kinds: a sound owns no
+*    frame, so production photographs the camera at the match and holds the
+*    bytes on the still shelf under an owner id the subject names
+*    (`audio-still.ts`). The tester's RAM-held frame stands in for exactly that
+*    photograph, and — unlike every other kind here — it is taken the same way
+*    production takes it, at the same moment, from the same cap.
 *
-* An audio episode still freezes neither. It HAS a marker projection, but its
-* id does not reach the notification subject yet, so it remains honestly
-* unattachable — a tester that invented a picture for it would be advertising a
-* feature that does not exist.
+* Only `system-event` remains: an infrastructure event is about no camera at
+* all, so there is nothing to photograph and a tester that invented a picture
+* for it would be advertising a feature that does not exist.
 */
 function triggerCanCarryStill(kind) {
-	return kind === "object-event" || kind === "package-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event";
+	return kind !== "system-event";
 }
 /** The detection provenance production stamps on a subject of this kind. */
 function syntheticSource(kind) {
@@ -15130,7 +15692,7 @@ function audioSubjectOf(input) {
 function buildSyntheticEvent(input, recordId, now) {
 	const kind = input.trigger;
 	const timestamp = input.timestamp ?? now;
-	const carriesTrackId = kind === "object-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event";
+	const carriesTrackId = kind === "object-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event" || kind === "audio-event" || kind === "audio-window";
 	return {
 		subject: {
 			kind,
@@ -17623,6 +18185,22 @@ var NotificationCenter = class NotificationCenter {
 	/** States the `deviceState` rule gate reads. Refreshed on the reload tick;
 	*  read with no I/O on the persist hook. */
 	deviceStates;
+	/** Scene verdicts + latches the `scene` rule gate reads. Same contract as
+	*  {@link deviceStates}: refreshed on the reload tick and on the provider's
+	*  in-process edge tap, read with no I/O on the persist hook (D49). */
+	sceneStates;
+	/**
+	* The last scene-gate answer REPORTED per rule, so the suppression line is
+	* written on CHANGE rather than on every event.
+	*
+	* A branch that drops work silently must log it, and a gate that logged on
+	* every detection on a busy camera would be a line nobody reads — which is
+	* the same silence by a different route.
+	*/
+	sceneGateReported = /* @__PURE__ */ new Map();
+	/** The watched scene id set, as last REPORTED — so the line is written when it
+	*  changes and not on every reload tick. `null` = never reported. */
+	sceneWatchSignature = null;
 	/** WHO each device id is (name + type). The system-event intake reads it with
 	*  no I/O; the reload tick refreshes it — see `device-directory.ts`. */
 	deviceDirectory;
@@ -17694,6 +18272,12 @@ var NotificationCenter = class NotificationCenter {
 	* is the one thing the synthetic producer promises not to do.
 	*/
 	syntheticMedia = /* @__PURE__ */ new Map();
+	/**
+	* The photograph a SOUND rule's notification carries — see `audio-still.ts`.
+	* Null when this wiring has no snapshot cap, which leaves every audio
+	* notification text-only rather than broken.
+	*/
+	audioStills;
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
 	lastNoMatchReportAt = /* @__PURE__ */ new Map();
 	noMatchSuppressed = /* @__PURE__ */ new Map();
@@ -17985,6 +18569,12 @@ var NotificationCenter = class NotificationCenter {
 		this.deps = deps;
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
+		const getSnapshot = deps.getSnapshot;
+		this.audioStills = getSnapshot !== void 0 ? new NcAudioStillShelf({
+			getSnapshot,
+			logger: this.logger.child("audio-still"),
+			now: this.now
+		}) : null;
 		this.rules = new NcRuleStore({
 			store: deps.store,
 			logger: this.logger.child("rules"),
@@ -18022,6 +18612,11 @@ var NotificationCenter = class NotificationCenter {
 			readStates: deps.readDeviceStates ?? (async () => /* @__PURE__ */ new Map()),
 			...deps.now !== void 0 ? { now: deps.now } : {}
 		});
+		this.sceneStates = new NcSceneStateCache({
+			logger: this.logger.child("scene-state"),
+			readScenes: deps.readSceneStates ?? (() => []),
+			...deps.now !== void 0 ? { now: deps.now } : {}
+		});
 		this.deviceDirectory = new NcDeviceDirectory({
 			logger: this.logger.child("device-directory"),
 			listDevices: deps.listDeviceIdentities ?? (async () => {
@@ -18057,6 +18652,8 @@ var NotificationCenter = class NotificationCenter {
 			getMediaForOwner: async (ownerKind, ownerId) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
+				const audio = isAudioStillId(ownerId) ? this.audioStills?.get(ownerId) : void 0;
+				if (audio !== void 0) return audio;
 				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
 			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
@@ -18221,6 +18818,7 @@ var NotificationCenter = class NotificationCenter {
 		await this.deviceDirectory.refresh();
 		await this.hydrateLiveness();
 		await this.zoneOwners.refresh();
+		this.sceneStates.refresh();
 		this.evaluationActive = true;
 		await this.outbox.load();
 		await this.seedCooldowns();
@@ -18260,6 +18858,7 @@ var NotificationCenter = class NotificationCenter {
 		}
 		this.timelapseScheduler?.stop();
 		this.summaryProducer?.stop();
+		this.audioStills?.clear();
 		this.evaluationActive = false;
 	}
 	/**
@@ -18589,7 +19188,35 @@ var NotificationCenter = class NotificationCenter {
 	* durable guarantee begins at this hook, matching the device-event boundary.
 	*/
 	onAudioEventPersisted(event) {
-		this.consumeEvent(incomingFromAudioEvent(event));
+		this.consumeEvent(incomingFromAudioEvent(event, this.audioStillOwner(event.deviceId, event.timestamp, "legacy")));
+	}
+	/**
+	* Start photographing `deviceId` NOW and return the owner id the audio
+	* subject should name — or `undefined` when nothing would use it.
+	*
+	* **The capture is not awaited.** A sound is transient and a notification
+	* about a scream must not wait on a camera; the bytes land while the outbox
+	* row queues, and the dispatcher's ordinary bounded still-wait picks them up.
+	* That is also why this runs BEFORE the cooldown and the mute are consulted:
+	* by the time a rule's window has been judged the moment is gone.
+	*
+	* **The gate is the RULE's media policy, not the trigger.** Photographing a
+	* camera on every confirmed window for rules that ship text anyway would be a
+	* snapshot at whatever rate the sound happens to occur, for nothing. The rule
+	* cache is an in-memory mirror, so this is not a fallible read (D49) — a
+	* failed one would look exactly like "no rule wants a picture", which is the
+	* direction that DESTROYS the media.
+	*/
+	audioStillOwner(deviceId, atMs, mode) {
+		const shelf = this.audioStills;
+		if (shelf === null || !this.evaluationActive) return void 0;
+		for (const rule of this.rules.listEnabled("immediate")) {
+			if (rule.media.attach === "none") continue;
+			if (!(mode === "condition" ? rule.conditions.audio !== void 0 : rule.conditions.audio === void 0 && referencesAudioClass(rule.conditions.classes))) continue;
+			const devices = rule.conditions.devices;
+			if (devices !== void 0 && devices.length > 0 && !devices.includes(deviceId)) continue;
+			return shelf.capture(deviceId, atMs);
+		}
 	}
 	/**
 	* Called at the package object-event persist site (`PackageDropDetector` —
@@ -18687,7 +19314,7 @@ var NotificationCenter = class NotificationCenter {
 				tags: { deviceId },
 				meta: audioHitMeta(hit)
 			});
-			this.consumeEvent(incomingFromAudioWindow(hit));
+			this.consumeEvent(incomingFromAudioWindow(hit, this.audioStillOwner(deviceId, hit.timestamp, "condition")));
 		}
 	}
 	/**
@@ -18985,6 +19612,73 @@ var NotificationCenter = class NotificationCenter {
 		if (identity.isCamera && identity.detectionActive === false) return "detection-off";
 	}
 	/**
+	* SAY that the scene gate suppressed this rule.
+	*
+	* A branch that drops work silently logs it — the three-hour media blackout
+	* produced not one line, and a gate is the same shape of failure: from the
+	* operator's side "the rule stopped notifying" and "the pipeline stopped
+	* working" look identical. `rule did not match` covers it at DEBUG, which is
+	* not a level this installation runs at.
+	*
+	* On CHANGE only, per rule: the alternative is one line per detection on a
+	* busy camera, which is silence by a different route. The `deviceId` tag is
+	* the SUBJECT's — that is the camera whose notification went missing, and the
+	* question is always asked per-camera. The SCENE's own device is named in the
+	* meta beside its id, because the two are frequently different cameras.
+	*/
+	reportSceneSuppression(rule, subject) {
+		const condition = rule.conditions.scene;
+		if (condition === void 0) return;
+		const observation = this.sceneStates.get(condition.sceneId);
+		const reason = sceneGateReason(condition, observation);
+		if (this.sceneGateReported.get(rule.id) === reason) return;
+		this.sceneGateReported.set(rule.id, reason);
+		this.logger.info("rule suppressed by its scene condition", {
+			tags: { deviceId: subject.deviceId },
+			meta: {
+				ruleId: rule.id,
+				rule: rule.name,
+				sceneId: condition.sceneId,
+				sceneLabel: observation?.label,
+				sceneDeviceId: observation?.deviceId ?? condition.deviceId,
+				requiredState: condition.requiredState,
+				reason
+			}
+		});
+	}
+	/**
+	* A confirmed scene transition, straight from the provider in this process.
+	*
+	* Synchronous on purpose and for the same reason {@link onAlarmPublish} is:
+	* the reload tick would otherwise be the only writer, and a rule gated on
+	* "while the bin is out" would keep its old answer for up to thirty seconds
+	* after the bin came back. The tick stays as reconciliation.
+	*
+	* A DIRECT CALL, not a bus subscription. `EnrichmentSceneStateChanged` is
+	* still emitted for the badge and for anyone else, but D8 events are
+	* droppable telemetry and a gate fed by droppable telemetry is a gate that is
+	* sometimes wrong and never says so.
+	*
+	* This never OPENS a gate that the mirror had shut for lack of an entry: it
+	* writes an observation the caller actually made. It is `refresh` that
+	* removes entries, and it never empties on a failed read (D49).
+	*/
+	onSceneEdge(observation) {
+		this.sceneStates.note(observation);
+	}
+	/**
+	* Reconcile the scene mirror now.
+	*
+	* The scene provider is constructed AFTER this centre starts (it needs the
+	* media store and the embedding encoder), so the boot refresh reads an empty
+	* provider. The addon calls this once the provider has hydrated, rather than
+	* leaving every scene-gated rule shut for a whole reload tick after every
+	* respawn.
+	*/
+	refreshSceneStates() {
+		this.sceneStates.refresh();
+	}
+	/**
 	* Everything the panel reports, on every publish.
 	*
 	* Synchronous on purpose. The state half refreshes the `deviceState` gate's
@@ -19283,8 +19977,9 @@ var NotificationCenter = class NotificationCenter {
 		let noOwnerReported = false;
 		const rejections = [];
 		for (const rule of candidates) {
-			const evaluation = evaluateRule(rule, subject, (id) => this.deviceStates.get(id), (id) => this.zoneOwners.get(id));
+			const evaluation = evaluateRule(rule, subject, (id) => this.deviceStates.get(id), (id) => this.zoneOwners.get(id), (sceneId) => this.sceneStates.get(sceneId));
 			if (!evaluation.matched) {
+				if (evaluation.failedCondition === "scene") this.reportSceneSuppression(rule, subject);
 				rejections.push(`${rule.name}:${evaluation.failedCondition ?? "unknown"}`);
 				outcomes.push({
 					ruleId: rule.id,
@@ -19309,6 +20004,7 @@ var NotificationCenter = class NotificationCenter {
 				});
 				continue;
 			}
+			this.sceneGateReported.delete(rule.id);
 			this.runRuleActions(rule, subject, kind, controls);
 			const admission = this.admitToGroup(rule, subject, now);
 			if (admission.outcome === "unchanged") {
@@ -19435,6 +20131,19 @@ var NotificationCenter = class NotificationCenter {
 					}
 				});
 			}
+			if (!noOwnerReported && (kind === "audio-window" || kind === "audio-event") && subject.trackId === void 0 && rule.media.attach !== "none") {
+				noOwnerReported = true;
+				this.logger.warn("audio match has no still owner — this notification ships text-only", {
+					tags: { deviceId: subject.deviceId },
+					meta: {
+						recordId: subject.recordId,
+						kind,
+						ruleId: rule.id,
+						rule: rule.name,
+						snapshotWired: this.audioStills !== null
+					}
+				});
+			}
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
 			const entries = this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets, origin, {
 				key,
@@ -19591,6 +20300,7 @@ var NotificationCenter = class NotificationCenter {
 	admitToGroup(rule, subject, now) {
 		const idleSec = rule.groupIdleSec;
 		if (idleSec === void 0 || idleSec <= 0) return { outcome: "disabled" };
+		if (subject.kind === "audio-window" || subject.kind === "audio-event") return { outcome: "disabled" };
 		const trackId = subject.trackId;
 		if (trackId === void 0) return { outcome: "disabled" };
 		const member = {
@@ -19940,10 +20650,13 @@ var NotificationCenter = class NotificationCenter {
 		this.reportAudioWatch(audioWatch);
 		const gated = [];
 		const zoneScoped = [];
+		const sceneIds = [];
 		for (const rule of this.rules.list()) {
 			if (!rule.enabled) continue;
 			const ds = rule.conditions.deviceState;
 			if (ds !== void 0) gated.push(ds.deviceId);
+			const scene = rule.conditions.scene;
+			if (scene !== void 0) sceneIds.push(scene.sceneId);
 			const zones = rule.conditions.zones;
 			const devices = rule.conditions.devices;
 			if (zones !== void 0 && zones.ids.length > 0 && devices !== void 0) zoneScoped.push(...devices);
@@ -19952,6 +20665,15 @@ var NotificationCenter = class NotificationCenter {
 		if (panel !== null) gated.push(...alarmContactWatchList(this.rules.list(), panel.deviceId, panel.availableModes()));
 		this.deviceStates.setWatched(gated);
 		this.zoneOwners.setWatched(zoneScoped);
+		this.sceneStates.setWatched(sceneIds);
+		const signature = [...new Set(sceneIds)].sort().join(",");
+		if (signature !== this.sceneWatchSignature) {
+			this.sceneWatchSignature = signature;
+			this.logger.info("scene gate watched set", { meta: {
+				scenes: this.sceneStates.watched(),
+				gatedRules: sceneIds.length
+			} });
+		}
 	}
 	/**
 	* Feed every excluded sensor's mirrored state back to the panel.
@@ -20088,6 +20810,7 @@ var NotificationCenter = class NotificationCenter {
 		await this.deviceStates.refresh();
 		await this.deviceDirectory.refresh();
 		await this.zoneOwners.refresh();
+		this.sceneStates.refresh();
 		this.observeAlarmContacts();
 		await this.occupancyStore.pruneExcept(this.activeOccupancyKeys());
 	}
@@ -20385,12 +21108,17 @@ var NotificationCenter = class NotificationCenter {
 			const fresh = await this.deps.readDeviceZoneIds(zoneScope);
 			zoneLookup = (id) => fresh.get(id) ?? this.zoneOwners.get(id);
 		} catch {}
+		let sceneLookup = (id) => this.sceneStates.get(id);
+		if (rule.conditions.scene !== void 0 && this.deps.readSceneStates !== void 0) try {
+			const fresh = new Map(this.deps.readSceneStates().map((o) => [o.sceneId, o]));
+			sceneLookup = (id) => fresh.get(id) ?? this.sceneStates.get(id);
+		} catch {}
 		const occupancy = rule.conditions.occupancy;
-		if (rule.delivery === "device-event" && occupancy !== void 0) return this.occupancyDryRun(rule, occupancy, lookup, zoneLookup);
+		if (rule.delivery === "device-event" && occupancy !== void 0) return this.occupancyDryRun(rule, occupancy, lookup, zoneLookup, sceneLookup);
 		const results = [];
 		for (const subject of subjects.sort((a, b) => b.timestamp - a.timestamp)) {
 			if (results.length >= TEST_RULE_MAX_RESULTS) break;
-			const evaluation = evaluateRule(rule, subject, lookup, zoneLookup);
+			const evaluation = evaluateRule(rule, subject, lookup, zoneLookup, sceneLookup);
 			results.push({
 				recordId: subject.recordId,
 				recordKind: subject.kind === "track-end" ? "track" : subject.kind === "audio-event" || subject.kind === "audio-window" ? "object-event" : subject.kind === "occupancy-event" ? "device-event" : subject.kind,
@@ -20414,7 +21142,7 @@ var NotificationCenter = class NotificationCenter {
 	* from the ordinary `evaluateRule` on the ordinary subject — this method
 	* chooses the cameras and writes the sentence, nothing else.
 	*/
-	async occupancyDryRun(rule, occupancy, lookup, zoneLookup) {
+	async occupancyDryRun(rule, occupancy, lookup, zoneLookup, sceneLookup) {
 		const read = this.deps.readOccupancySnapshots;
 		if (read === void 0) return [];
 		const now = this.now();
@@ -20457,7 +21185,7 @@ var NotificationCenter = class NotificationCenter {
 				});
 				continue;
 			}
-			const evaluation = evaluateRule(rule, probe.subject, lookup, zoneLookup);
+			const evaluation = evaluateRule(rule, probe.subject, lookup, zoneLookup, sceneLookup);
 			results.push({
 				...common,
 				recordId: probe.subject.recordId,
@@ -20712,6 +21440,10 @@ function planRuleTest(input) {
 		conditionId: "deviceState",
 		note: `This rule only fires while device #${c.deviceState.deviceId} is in one of its chosen states. That gate reads the REAL device and cannot be simulated — put the device in that state first, or the test fails closed exactly as production would.`
 	});
+	if (c.scene !== void 0) notes.push({
+		conditionId: "scene",
+		note: `This rule only fires while scene ${c.scene.sceneId} is ${c.scene.requiredState}. That gate reads the scene's REAL state and cannot be simulated — the test answers with whatever the scene is right now, and fails closed while it cannot judge or has not been read yet, exactly as production would.`
+	});
 	if (c.customZones !== void 0 && c.customZones.length > 0) notes.push({
 		conditionId: "customZones",
 		note: "The subject is placed over the first drawn polygon so the condition passes. A rule that needs a specific polygon should be checked in the simulator, where the box can be moved."
@@ -25957,6 +26689,72 @@ function decideZeroMediaPolicy(input, config = DEFAULT_ZERO_MEDIA_POLICY_CONFIG)
 }
 //#endregion
 //#region src/pipeline-analytics/pipeline/delete-track-cascade.ts
+var EMPTY_CASCADE_TALLY = {
+	tracks: 0,
+	events: 0,
+	media: 0,
+	faces: 0,
+	plates: 0,
+	embeddings: 0,
+	bytesReclaimed: 0
+};
+/** Fold a leaf store's receipts into a running tally. */
+function addLeafCounts(tally, counts) {
+	let next = tally;
+	for (const c of counts) {
+		const bytesReclaimed = next.bytesReclaimed + c.bytes;
+		switch (c.family) {
+			case "events":
+				next = {
+					...next,
+					events: next.events + c.rows,
+					bytesReclaimed
+				};
+				break;
+			case "media":
+				next = {
+					...next,
+					media: next.media + c.rows,
+					bytesReclaimed
+				};
+				break;
+			case "faces":
+				next = {
+					...next,
+					faces: next.faces + c.rows,
+					bytesReclaimed
+				};
+				break;
+			case "plates":
+				next = {
+					...next,
+					plates: next.plates + c.rows,
+					bytesReclaimed
+				};
+				break;
+			case "embeddings":
+				next = {
+					...next,
+					embeddings: next.embeddings + c.rows,
+					bytesReclaimed
+				};
+				break;
+		}
+	}
+	return next;
+}
+/** Sum two tallies (per-track results into a per-device one). */
+function mergeCascadeTallies(a, b) {
+	return {
+		tracks: a.tracks + b.tracks,
+		events: a.events + b.events,
+		media: a.media + b.media,
+		faces: a.faces + b.faces,
+		plates: a.plates + b.plates,
+		embeddings: a.embeddings + b.embeddings,
+		bytesReclaimed: a.bytesReclaimed + b.bytesReclaimed
+	};
+}
 /**
 * Extensible whole-track deletion cascade. Runs every registered
 * `TrackScopedStore` (each removes its ephemeral rows + owned media for the
@@ -25973,8 +26771,16 @@ function decideZeroMediaPolicy(input, config = DEFAULT_ZERO_MEDIA_POLICY_CONFIG)
 *   ]
 */
 async function cascadeDeleteTracks(registry, trackStore, trackIds) {
-	for (const store of registry) await store.deleteByTracks(trackIds);
-	for (const trackId of trackIds) await trackStore.deletePersisted(trackId);
+	let tally = EMPTY_CASCADE_TALLY;
+	for (const store of registry) tally = addLeafCounts(tally, await store.deleteByTracks(trackIds));
+	for (const trackId of trackIds) {
+		await trackStore.deletePersisted(trackId);
+		tally = {
+			...tally,
+			tracks: tally.tracks + 1
+		};
+	}
+	return tally;
 }
 /**
 * The one registry, in the one order — leaves first, root deleted internally
@@ -26005,14 +26811,28 @@ function buildAnalyticsCascadeRegistry(stores) {
 * embeddings) is opted in by the CALLER's registry, not by this legacy shim.
 */
 async function cascadeDeleteTrack(stores, trackId) {
-	await cascadeDeleteTracks([{ deleteByTracks: async (ids) => {
+	return cascadeDeleteTracks([{ deleteByTracks: async (ids) => {
+		let events = 0;
+		let media = 0;
 		for (const id of ids) {
 			const eventIds = await stores.eventStore.deleteByTrack(id);
-			if (eventIds.length > 0) await stores.mediaStore.deleteForEvents([...eventIds]);
+			events += eventIds.length;
+			if (eventIds.length > 0) media += await stores.mediaStore.deleteForEvents([...eventIds]);
 		}
-	} }, { deleteByTracks: async (ids) => {
-		await stores.mediaStore.deleteForTracks([...ids]);
-	} }], stores.trackStore, [trackId]);
+		return [{
+			family: "events",
+			rows: events,
+			bytes: 0
+		}, {
+			family: "media",
+			rows: media,
+			bytes: 0
+		}];
+	} }, { deleteByTracks: async (ids) => [{
+		family: "media",
+		rows: await stores.mediaStore.deleteForTracks([...ids]),
+		bytes: 0
+	}] }], stores.trackStore, [trackId]);
 }
 /**
 * Widened batch whole-track deletion — the ONE engine behind the three §5 entry
@@ -26023,9 +26843,10 @@ async function cascadeDeleteTrack(stores, trackId) {
 */
 async function runTrackCascadeBatch(deps, trackIds) {
 	let deleted = 0;
+	let tally = EMPTY_CASCADE_TALLY;
 	const failed = [];
 	for (const trackId of trackIds) try {
-		await cascadeDeleteTracks(deps.registry, deps.trackStore, [trackId]);
+		tally = mergeCascadeTallies(tally, await cascadeDeleteTracks(deps.registry, deps.trackStore, [trackId]));
 		deps.onTrackCleanup(deps.deviceId, trackId);
 		deleted += 1;
 	} catch (err) {
@@ -26034,7 +26855,8 @@ async function runTrackCascadeBatch(deps, trackIds) {
 	}
 	return {
 		deleted,
-		failed
+		failed,
+		tally
 	};
 }
 //#endregion
@@ -27446,6 +28268,51 @@ var PlateGalleryProvider = class {
 		};
 	}
 };
+var OrphanAuditActionInputSchema = object({
+	mode: _enum(["report", "reclaim"]).default("report"),
+	/**
+	* Start every scope from the top instead of resuming its persisted cursor.
+	*
+	* What draining a backlog wants, and never the default — the cursor exists
+	* so a 6-hourly pass makes progress instead of re-walking the same head.
+	*/
+	restart: boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per collection in this pass — the pacing bound. */
+	maxRowsPerScope: number().int().min(1).max(2e5).optional(),
+	/** Rows DELETED per collection in this pass — the blast-radius bound. */
+	maxReclaimPerScope: number().int().min(1).max(1e5).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them, which is what keeps this off
+	* the one-age-keyed-sweep guard's books.
+	*/
+	graceMinutes: number().int().min(1).max(10080).optional()
+});
+var OrphanAuditScopeReportSchema = object({
+	collection: string(),
+	examined: number(),
+	orphans: number(),
+	reclaimed: number(),
+	bytesReclaimed: number(),
+	exempt: number(),
+	withinGrace: number(),
+	unresolvable: number(),
+	stoppedBy: string(),
+	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
+	nextCursor: number()
+});
+var orphanAuditActions = defineCustomActions({ "retention.orphanAudit": customAction(OrphanAuditActionInputSchema, object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: boolean(),
+	mode: _enum(["report", "reclaim"]),
+	scopes: array(OrphanAuditScopeReportSchema),
+	totalOrphans: number(),
+	totalReclaimed: number(),
+	totalBytesReclaimed: number(),
+	durationMs: number()
+}), { auth: "admin" }) });
 //#endregion
 //#region src/pipeline-analytics/videoclips-provider.ts
 var SOURCE = "analytics";
@@ -33190,13 +34057,25 @@ var StoragePressureTracker = class {
 };
 //#endregion
 //#region src/pipeline-analytics/store/media-store.ts
+/**
+* `scene` is its own owner kind rather than borrowing `event`.
+*
+* Scene reference thumbnails were written as `ownerKind: 'event'` with an
+* `ownerId` of `scene-<monitorId>-…`, which resolves through
+* `resolveMediaOwner` to `{ kind: 'event', eventId: 'scene-…' }` — an event row
+* that has never existed. The orphan audit therefore classified every
+* operator-captured reference picture as collectable. It is the same class of
+* mistake `identity` and `vehicle` are exempt for: a blob the OPERATOR curated,
+* which nothing else can regenerate and no cascade owns.
+*/
 var OWNER_KINDS = [
 	"event",
 	"track",
 	"face",
 	"identity",
 	"plate",
-	"vehicle"
+	"vehicle",
+	"scene"
 ];
 /**
 * Narrow an arbitrary string to an `OwnerKind`.
@@ -33657,21 +34536,33 @@ var MediaStore = class {
 	* Best-effort per row; returns the number of index rows removed.
 	*/
 	async deleteForOwner(ownerKind, ownerIds) {
+		return (await this.gated(() => this.deleteForOwnerUnchecked(ownerKind, ownerIds))).rows;
+	}
+	/**
+	* The same delete, reporting the BYTES it released as well as the row count.
+	*
+	* `sizeBytes` is already on the index row, so the number costs nothing — it
+	* was simply never returned, which is why every retention ops-log row this
+	* addon has ever written says `bytesReclaimed: 0` (D161).
+	*/
+	async deleteForOwnerCounted(ownerKind, ownerIds) {
 		return this.gated(() => this.deleteForOwnerUnchecked(ownerKind, ownerIds));
 	}
 	async deleteForOwnerUnchecked(ownerKind, ownerIds) {
-		let removed = 0;
+		let rows = 0;
+		let bytes = 0;
 		for (const ownerId of ownerIds) {
-			const rows = await this.store.query.query({
+			const found = await this.store.query.query({
 				collection: MEDIA_COLLECTION,
 				filter: { where: {
 					ownerKind,
 					ownerId
 				} }
 			});
-			for (const row of rows) {
+			for (const row of found) {
 				const rowData = row.data;
 				const path = String(rowData["path"] ?? "");
+				const sizeBytes = Number(rowData["sizeBytes"]);
 				try {
 					if (path) await this.storage.delete({
 						location: mediaRowLocation(rowData),
@@ -33683,7 +34574,8 @@ var MediaStore = class {
 						collection: MEDIA_COLLECTION,
 						key: row.id
 					});
-					removed++;
+					rows++;
+					if (Number.isFinite(sizeBytes)) bytes += sizeBytes;
 				} catch (err) {
 					this.logger.debug("media delete-for-owner failed", { meta: {
 						key: row.id,
@@ -33692,7 +34584,10 @@ var MediaStore = class {
 				}
 			}
 		}
-		return removed;
+		return {
+			rows,
+			bytes
+		};
 	}
 	/**
 	* On-demand footprint aggregation for the events-management UI: sum
@@ -33831,11 +34726,20 @@ var MediaStore = class {
 	* batch.
 	*/
 	async deleteByTracks(trackIds) {
-		await this.gated(async () => {
-			await this.deleteForOwnerUnchecked("track", trackIds);
-			await this.deleteForOwnerUnchecked("face", trackIds.map((id) => FACE_MEDIA_OWNER_PREFIX + id));
+		const own = await this.gated(async () => {
+			const tracks = await this.deleteForOwnerUnchecked("track", trackIds);
+			const faces = await this.deleteForOwnerUnchecked("face", trackIds.map((id) => FACE_MEDIA_OWNER_PREFIX + id));
+			return {
+				rows: tracks.rows + faces.rows,
+				bytes: tracks.bytes + faces.bytes
+			};
 		});
-		await this.deleteForOwner("plate", trackIds.map((id) => PLATE_MEDIA_OWNER_PREFIX + id));
+		const plates = await this.deleteForOwnerCounted("plate", trackIds.map((id) => PLATE_MEDIA_OWNER_PREFIX + id));
+		return [{
+			family: "media",
+			rows: own.rows + plates.rows,
+			bytes: own.bytes + plates.bytes
+		}];
 	}
 	/**
 	* A stable page of media INDEX rows for the orphan audit — no blobs, no
@@ -38273,11 +39177,21 @@ var EventStore = class {
 				error: String(err)
 			} });
 		}
+		let mediaRows = 0;
 		if (eventIds.length > 0 && this.media !== void 0) try {
-			await this.media.deleteForEvents(eventIds);
+			mediaRows = await this.media.deleteForEvents(eventIds);
 		} catch (err) {
 			this.logger.warn("EventStore.deleteByTracks: event media delete failed", { meta: { error: String(err) } });
 		}
+		return [{
+			family: "events",
+			rows: eventIds.length,
+			bytes: 0
+		}, {
+			family: "media",
+			rows: mediaRows,
+			bytes: 0
+		}];
 	}
 };
 function slimMotion(id, data) {
@@ -38668,6 +39582,7 @@ var FaceStore = class {
 	* aborts the batch. (Crop media of these rows is removed by `MediaStore`.)
 	*/
 	async deleteByTracks(trackIds) {
+		let removed = 0;
 		for (const trackId of trackIds) try {
 			const eligible = (await this.store.query.query({
 				collection: FACES_COLLECTION,
@@ -38678,6 +39593,7 @@ var FaceStore = class {
 					collection: FACES_COLLECTION,
 					key: row.id
 				});
+				removed++;
 			} catch (err) {
 				this.logger.warn("FaceStore.deleteByTracks delete failed", { meta: {
 					faceId: row.id,
@@ -38690,6 +39606,11 @@ var FaceStore = class {
 				error: String(err)
 			} });
 		}
+		return [{
+			family: "faces",
+			rows: removed,
+			bytes: 0
+		}];
 	}
 	/** Delete a single buffered face row by id (its crop media is removed by the
 	*  caller — the FaceStore owns rows, not blobs). Best-effort. */
@@ -39625,6 +40546,7 @@ var PlateStore = class {
 	* the batch. (Crop media of these rows is removed by `MediaStore`.)
 	*/
 	async deleteByTracks(trackIds) {
+		let removed = 0;
 		for (const trackId of trackIds) try {
 			const eligible = (await this.store.query.query({
 				collection: PLATES_COLLECTION,
@@ -39635,6 +40557,7 @@ var PlateStore = class {
 					collection: PLATES_COLLECTION,
 					key: row.id
 				});
+				removed++;
 			} catch (err) {
 				this.logger.warn("PlateStore.deleteByTracks delete failed", { meta: {
 					plateId: row.id,
@@ -39647,6 +40570,11 @@ var PlateStore = class {
 				error: String(err)
 			} });
 		}
+		return [{
+			family: "plates",
+			rows: removed,
+			bytes: 0
+		}];
 	}
 	/**
 	* Hold the unassigned plate buffer to `maxPerDevice` newest reads per camera.
@@ -40768,6 +41696,36 @@ var TrackStore = class {
 	dropActive(trackId) {
 		this.active.delete(trackId);
 	}
+	/**
+	* Close a still-ACTIVE track NOW: persist its row, then drop the in-RAM
+	* entry. The early-close counterpart of {@link expireStale}, for a caller
+	* that knows the track is over before its TTL says so.
+	*
+	* **This exists because {@link dropActive} orphans everything the track
+	* owns.** A track's media, object events and CLIP vector are keyed by trackId
+	* and written throughout its life; the ROW is what retention cascades from,
+	* and it is written only here or at expiry. Forgetting a lived-in track
+	* therefore leaves a full media set — key frame, thumbnail, first/last frame,
+	* the snapshot filmstrip — with no owner any sweep can ever reach. Measured on
+	* the live hub 2026-08-14: 74,700 such media rows, 18.9 GB, growing
+	* ~1.15 GB/day, plus 23,296 object events and 4,543 CLIP vectors (D161).
+	*
+	* `dropActive` is still correct for a birth RETRACTED before it lived —
+	* nothing has been written under that id yet. It is never correct for a track
+	* that ran.
+	*
+	* Returns whether an active entry was found. THROWS if the persist fails: the
+	* caller must log it, because a swallowed failure here IS the leak.
+	*/
+	async closeActive(trackId) {
+		const t = this.active.get(trackId);
+		if (t === void 0) return false;
+		t.active = false;
+		const record = cloneTrack(t);
+		await this.persistCompleted(record);
+		this.active.delete(trackId);
+		return true;
+	}
 	/** Delete the persisted track row (keyed by trackId) and drop the in-RAM
 	*  active entry if present. Used by the whole-track deletion cascade. */
 	async deletePersisted(trackId) {
@@ -41899,7 +42857,11 @@ function auditableCollections() {
 * exemption lives here now, and the orphan collector — the only sweep that
 * walks media it was not handed by name — reads it.
 */
-var RETENTION_EXEMPT_OWNER_KINDS = new Set(["identity", "vehicle"]);
+var RETENTION_EXEMPT_OWNER_KINDS = new Set([
+	"identity",
+	"vehicle",
+	"scene"
+]);
 function isRetentionExemptOwnerKind(kind) {
 	return RETENTION_EXEMPT_OWNER_KINDS.has(kind);
 }
@@ -42118,6 +43080,7 @@ async function auditScope(scope, deps, limits, cursor) {
 				} });
 			}
 		}
+		if (deps.breathe) await deps.breathe();
 		if (ceilingHit) {
 			stoppedBy = "reclaim-ceiling";
 			offset += rows.length - reclaimedInPage;
@@ -44837,22 +45800,6 @@ async function projectSensorMarkers(deps, data, timestamp) {
 	}
 	return landed;
 }
-/** JPEG quality for the downscaled full frame — matches the crop path. */
-var FULL_FRAME_QUALITY = 80;
-/**
-* Downscale an already-encoded JPEG full frame to FIT WITHIN
-* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
-* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
-* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
-* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
-* at night) is never stored or served — the privacy fix moved to CAPTURE time.
-*/
-async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
-	return sharp(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
-		fit: "inside",
-		withoutEnlargement: true
-	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
-}
 //#endregion
 //#region src/pipeline-analytics/services/synthetic-track.ts
 /**
@@ -46893,7 +47840,11 @@ var ObjectEmbeddingStore = class {
 	* breaks recognition (design §2/§4).
 	*/
 	async deleteByTracks(trackIds) {
-		if (trackIds.length === 0) return;
+		if (trackIds.length === 0) return [{
+			family: "embeddings",
+			rows: 0,
+			bytes: 0
+		}];
 		try {
 			await this.vectorStore.deleteByIds.mutate({
 				index: OBJECT_CLIP_INDEX,
@@ -46904,7 +47855,17 @@ var ObjectEmbeddingStore = class {
 				count: trackIds.length,
 				error: String(err)
 			} });
+			return [{
+				family: "embeddings",
+				rows: 0,
+				bytes: 0
+			}];
 		}
+		return [{
+			family: "embeddings",
+			rows: trackIds.length,
+			bytes: 0
+		}];
 	}
 };
 /** Build the vector-store metadata for one embedding. */
@@ -47778,7 +48739,8 @@ var NO_PUBLICATION = {
 var customActions = {
 	...ncActions,
 	...embeddingActions,
-	...debugActions
+	...debugActions,
+	...orphanAuditActions
 };
 /**
 * Assist threshold when the caller does not pin one. Packages have their own
@@ -48756,7 +49718,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				customActions: {
 					...ncActions,
 					...embeddingActions,
-					...debugActions
+					...debugActions,
+					...orphanAuditActions
 				},
 				actionHandlers: {
 					...ncHandlers,
@@ -49381,6 +50344,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					addonId: device.addonId
 				};
 			},
+			getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }),
 			identityIdsByName: async () => {
 				const byName = /* @__PURE__ */ new Map();
 				const identities = await stores.identityStore.listIdentities();
@@ -49474,6 +50438,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				}
 				return out;
 			},
+			readSceneStates: () => (this.sceneProvider?.listAllEnabled() ?? []).map(({ deviceId, monitor }) => ({
+				sceneId: monitor.id,
+				deviceId,
+				label: monitor.label,
+				verdict: monitor.verdict,
+				latched: monitor.latched,
+				emit: monitor.emit
+			})),
 			readOccupancySnapshots: async (deviceIds) => {
 				const za = this.zoneAnalytics;
 				if (za === null) return /* @__PURE__ */ new Map();
@@ -50249,13 +51221,16 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				if (media === null) throw new Error("media store not ready");
 				return media.putReplacing({
 					deviceId,
-					ownerKind: "event",
+					ownerKind: "scene",
 					ownerId,
 					kind: "thumbnailSmall",
 					timestamp,
 					data
 				});
 			},
+			dropMedia: async (mediaId) => {
+				await this.mediaStore?.deleteByKey(mediaId);
+			},
 			mirrorSlice: (deviceId, status) => {
 				this.mirrorSceneSlice(deviceId, status);
 			},
@@ -50272,6 +51247,16 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					data: payload
 				});
 			},
+			onSceneEdge: (edge) => {
+				this.notificationCenter?.onSceneEdge({
+					sceneId: edge.monitorId,
+					deviceId: edge.deviceId,
+					label: edge.monitorLabel,
+					verdict: edge.verdict,
+					latched: edge.latched,
+					emit: edge.emit
+				});
+			},
 			currentCondition: async (deviceId) => resolveCondition({
 				...await this.sceneConditionContext(deviceId),
 				now: /* @__PURE__ */ new Date()
@@ -50280,6 +51265,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		});
 		provider.hydrate();
 		this.sceneProvider = provider;
+		this.notificationCenter?.refreshSceneStates();
 		if (!this.isPostProcessingNode) {
 			log.info("scene evaluation INERT on this node — CRUD only");
 			return;
@@ -52741,7 +53727,17 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 		};
 		if (plausible) this.stationaryRegistry?.promote(entry);
 		processor.dropTrack(track.trackId);
-		this.trackStore?.dropActive(track.trackId);
+		this.trackStore?.closeActive(track.trackId).catch((err) => {
+			this.ctx.logger.warn("stationary promotion: closing the source track failed — its media, events and vector are now unowned", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					trackId: track.trackId,
+					entryId: entry.id,
+					error: String(err)
+				}
+			});
+		});
 		const faceEnd = this.faceRecognizer?.onTrackEnd(deviceId, track.trackId);
 		const dropKeyFrame = () => {
 			this.residents.dropKeyFrameKey(track.trackId);
@@ -53331,19 +54327,19 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* stops at a per-scope row ceiling, RESUMES from a persisted cursor next run,
 	* and refuses to start if the previous run has not finished.
 	*/
-	async runOrphanAuditPass() {
-		if (this.shuttingDown) return;
+	async runOrphanAuditPass(overrides) {
+		if (this.shuttingDown) return null;
 		if (this.orphanAuditRunning) {
 			this.ctx.logger.info("analytics orphan audit skipped — previous run still in flight");
-			return;
+			return null;
 		}
 		const trackStore = this.trackStore;
 		const eventStore = this.eventStore;
 		const mediaStore = this.mediaStore;
-		if (!trackStore || !eventStore || !mediaStore) return;
+		if (!trackStore || !eventStore || !mediaStore) return null;
 		this.orphanAuditRunning = true;
 		try {
-			const limits = await this.orphanAuditLimits();
+			const limits = await this.orphanAuditLimits(overrides);
 			const deps = {
 				page: async (collection, offset, limit) => {
 					if (collection === "pipeline-analytics:media") return mediaStore.pageForAudit(offset, limit);
@@ -53375,13 +54371,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					});
 				},
 				now: () => Date.now(),
-				logger: this.ctx.logger
+				logger: this.ctx.logger,
+				breathe: () => new Promise((resolve) => setImmediate(resolve))
 			};
 			const { report, cursors } = await runOrphanAudit({
 				scopes: buildOrphanScopes(),
 				deps,
 				limits,
-				cursors: this.orphanAuditCursors
+				cursors: overrides?.restart === true ? /* @__PURE__ */ new Map() : this.orphanAuditCursors
 			});
 			this.orphanAuditCursors = cursors;
 			for (const scope of report.scopes) {
@@ -53416,8 +54413,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				bytesReclaimed: report.totalBytesReclaimed,
 				detail: `orphan audit (${report.mode}): ${report.totalOrphans} orphaned rows across ${report.scopes.length} collections, ${report.totalReclaimed} reclaimed in ${report.durationMs}ms`
 			});
+			return report;
 		} catch (err) {
 			this.ctx.logger.warn("analytics orphan audit failed", { meta: { error: String(err) } });
+			return null;
 		} finally {
 			this.orphanAuditRunning = false;
 		}
@@ -53480,15 +54479,65 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* raising them is raising the blast radius of a bug, and that should take a
 	* release.
 	*/
-	async orphanAuditLimits() {
+	async orphanAuditLimits(overrides) {
 		const mode = await this.orphanAuditModeState.get();
 		const pageSize = await this.orphanAuditPageSizeState.get();
+		const graceMinutes = overrides?.graceMinutes;
+		return {
+			mode: overrides !== void 0 ? overrides.mode ?? "report" : mode === "reclaim" ? "reclaim" : "report",
+			graceMs: graceMinutes === void 0 ? DEFAULT_ORPHAN_LIMITS.graceMs : graceMinutes * 6e4,
+			pageSize: overrides?.pageSize ?? pageSize,
+			maxRowsPerScope: overrides?.maxRowsPerScope ?? DEFAULT_ORPHAN_LIMITS.maxRowsPerScope,
+			maxReclaimPerScope: overrides?.maxReclaimPerScope ?? DEFAULT_ORPHAN_LIMITS.maxReclaimPerScope
+		};
+	}
+	/**
+	* One operator-driven orphan-audit pass — the entry point behind
+	* `retention.orphanAudit`.
+	*
+	* DRY RUN BY DEFAULT: an input with no `mode` reports and deletes nothing,
+	* whatever `orphanAuditMode` is set to. Reclaiming is a word the caller has to
+	* type. Draining the standing 18.9 GB means running this with
+	* `mode: 'reclaim'` repeatedly until `totalOrphans` reaches 0 (D161).
+	*/
+	async runOrphanAuditNow(overrides) {
+		const report = await this.runOrphanAuditPass(overrides);
+		if (report === null) return {
+			ran: false,
+			mode: overrides.mode ?? "report",
+			scopes: [],
+			totalOrphans: 0,
+			totalReclaimed: 0,
+			totalBytesReclaimed: 0,
+			durationMs: 0
+		};
+		this.ctx.logger.info("analytics orphan audit (operator)", { meta: {
+			mode: report.mode,
+			orphans: report.totalOrphans,
+			reclaimed: report.totalReclaimed,
+			bytesReclaimed: report.totalBytesReclaimed,
+			durationMs: report.durationMs,
+			restart: overrides.restart === true
+		} });
 		return {
-			mode: mode === "reclaim" ? "reclaim" : "report",
-			graceMs: DEFAULT_ORPHAN_LIMITS.graceMs,
-			pageSize,
-			maxRowsPerScope: DEFAULT_ORPHAN_LIMITS.maxRowsPerScope,
-			maxReclaimPerScope: DEFAULT_ORPHAN_LIMITS.maxReclaimPerScope
+			ran: true,
+			mode: report.mode,
+			scopes: report.scopes.map((scope) => ({
+				collection: scope.collection,
+				examined: scope.examined,
+				orphans: scope.orphans,
+				reclaimed: scope.reclaimed,
+				bytesReclaimed: scope.bytesReclaimed,
+				exempt: scope.exempt,
+				withinGrace: scope.withinGrace,
+				unresolvable: scope.unresolvable,
+				stoppedBy: scope.stoppedBy,
+				nextCursor: scope.nextCursor
+			})),
+			totalOrphans: report.totalOrphans,
+			totalReclaimed: report.totalReclaimed,
+			totalBytesReclaimed: report.totalBytesReclaimed,
+			durationMs: report.durationMs
 		};
 	}
 	/**
@@ -53688,7 +54737,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					indexed
 				};
 			},
-			"embedding.wipe": async () => this.wipeObjectEmbeddings()
+			"embedding.wipe": async () => this.wipeObjectEmbeddings(),
+			"retention.orphanAudit": async (input) => this.runOrphanAuditNow(input)
 		};
 	}
 	/** Progress of the detached rebuild — the only way to observe a long pass. */
@@ -53947,8 +54997,14 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* Track-centric time-based retention (design §5.1). Drains every persisted
 	* track for the device whose `lastSeen < cutoffMs`, page by page, through the
 	* widened cascade — enrolled faces/plates + identity media are exempt (design
-	* §4). `tracks` is the authoritative count; leaf families are best-effort 0
-	* under the void `TrackScopedStore` contract (see cap doc).
+	* §4).
+	*
+	* **Every family count here is REAL.** It used to return `tracks` and a
+	* literal 0 for every leaf, because `TrackScopedStore.deleteByTracks` returned
+	* `void` — so `bytesReclaimed: 0` went onto all 3,732 ops-log rows this addon
+	* had ever written and 18.9 GB of leaked media read as "nothing to reclaim"
+	* (D161). The bytes ride {@link lastPruneBytes} rather than
+	* `TrackCascadeCounts`, which is a cap output shape.
 	*/
 	async pruneTracksBefore(input) {
 		const empty = {
@@ -53959,26 +55015,32 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			plates: 0,
 			embeddings: 0
 		};
+		this.lastPruneBytes = 0;
 		const cascade = this.buildTrackCascadeRegistry();
 		if (!cascade) return empty;
+		let tally = EMPTY_CASCADE_TALLY;
 		const { deleted: totalDeleted, skipped } = await drainTracksBefore({
 			stopped: () => this.shuttingDown,
 			listIdsBefore: (offset, limit) => cascade.trackStore.listIdsBefore(input.deviceId, input.cutoffMs, limit, offset),
-			cascade: (ids) => runTrackCascadeBatch({
-				registry: cascade.registry,
-				trackStore: cascade.trackStore,
-				deviceId: input.deviceId,
-				onTrackCleanup: (deviceId, trackId) => this.clearLiveTrackState(deviceId, trackId),
-				onFailure: (trackId, err) => {
-					this.ctx.logger.debug("pruneTracksBefore track failed", {
-						tags: { deviceId: input.deviceId },
-						meta: {
-							trackId,
-							error: String(err)
-						}
-					});
-				}
-			}, ids)
+			cascade: async (ids) => {
+				const result = await runTrackCascadeBatch({
+					registry: cascade.registry,
+					trackStore: cascade.trackStore,
+					deviceId: input.deviceId,
+					onTrackCleanup: (deviceId, trackId) => this.clearLiveTrackState(deviceId, trackId),
+					onFailure: (trackId, err) => {
+						this.ctx.logger.debug("pruneTracksBefore track failed", {
+							tags: { deviceId: input.deviceId },
+							meta: {
+								trackId,
+								error: String(err)
+							}
+						});
+					}
+				}, ids);
+				tally = mergeCascadeTallies(tally, result.tally);
+				return { deleted: result.deleted };
+			}
 		});
 		if (skipped > 0) this.ctx.logger.warn("analytics track retention skipped undeletable rows", {
 			tags: { deviceId: input.deviceId },
@@ -53989,20 +55051,41 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				pruned: totalDeleted
 			}
 		});
+		this.lastPruneBytes = tally.bytesReclaimed;
 		if (totalDeleted > 0) this.ctx.logger.info("analytics track retention prune", {
 			tags: { deviceId: input.deviceId },
 			meta: {
 				deviceId: input.deviceId,
 				cutoffMs: input.cutoffMs,
-				tracks: totalDeleted
+				tracks: totalDeleted,
+				events: tally.events,
+				media: tally.media,
+				faces: tally.faces,
+				plates: tally.plates,
+				embeddings: tally.embeddings,
+				bytesReclaimed: tally.bytesReclaimed
 			}
 		});
 		return {
 			...empty,
-			tracks: totalDeleted
+			tracks: totalDeleted,
+			events: tally.events,
+			media: tally.media,
+			faces: tally.faces,
+			plates: tally.plates,
+			embeddings: tally.embeddings
 		};
 	}
 	/**
+	* Bytes released by the most recent {@link pruneTracksBefore}.
+	*
+	* A field rather than a return value because `TrackCascadeCounts` is a cap
+	* OUTPUT shape and widening it is a codegen change; the ops-log row already
+	* has a `bytesReclaimed` column and this is what fills it. Reset to 0 at the
+	* top of every prune, so a stale value can never be reported as a fresh one.
+	*/
+	lastPruneBytes = 0;
+	/**
 	* Operator "clean slate" for a device (design §5.3): prune EVERY persisted
 	* track via the same cascade as `pruneTracksBefore` with `cutoffMs = now`.
 	* Enrolled gallery + identity media are exempt.
@@ -54056,8 +55139,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 						reason: "retention",
 						deviceId,
 						itemsAffected: counts.tracks,
-						bytesReclaimed: 0,
-						detail: `track retention cascade: ${counts.tracks} tracks, ${counts.events} events, ${counts.media} media`
+						bytesReclaimed: this.lastPruneBytes,
+						detail: `track retention cascade: ${counts.tracks} tracks, ${counts.events} events, ${counts.media} media, ${counts.faces} faces, ${counts.plates} plates, ${counts.embeddings} vectors`
 					});
 					return counts;
 				},