@camstack/addon-post-analysis 1.2.77 → 1.2.78

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-Bs6oboqZ.js");
+const require_dist = require("../dist-CFOT1Yoz.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -3390,19 +3390,26 @@ function cosineSimilarity(a, b) {
 }
 /**
 * Select the references a live crop is scored against for a given condition —
-* **exact condition match, with NO fallback.**
-*
-* There used to be a silent fallback to every reference when the current
-* condition had none. For a named-states monitor that was a defensible "better
-* than blind". For a latched alarm it is a false positive every single night:
-* the day reference is compared against an IR frame, the cosine collapses, the
-* scene latches `diverged`, and the operator is told the bin was taken at
-* 21:40. Cross-condition cosines are not comparable, so the honest answer to "I
-* have never seen this scene in this light" is *I don't know* — never a guess
-* in the direction that raises an alarm.
-*/
-function selectConditionRefs(references, currentCondition) {
-	return references.filter((r) => r.condition === currentCondition);
+* **exact condition match, and by default NO fallback.**
+*
+* There used to be an unconditional silent fallback to every reference when the
+* current condition had none. For a named-states monitor that was a defensible
+* "better than blind". For a latched alarm it is a false positive every single
+* night: the day reference is compared against an IR frame, the cosine
+* collapses, the scene latches `diverged`, and the operator is told the bin was
+* taken at 21:40. Cross-condition cosines are not comparable, so the honest
+* answer to "I have never seen this scene in this light" is *I don't know* —
+* never a guess in the direction that raises an alarm.
+*
+* The fallback survives only as an explicit per-scene opt-in, and even then it
+* is a LAST resort: when the exact condition has references of its own they
+* win outright, so opting in never widens a comparison the operator already
+* covered properly.
+*/
+function selectConditionRefs(references, currentCondition, crossConditionFallback) {
+	const exact = references.filter((r) => r.condition === currentCondition);
+	if (exact.length > 0 || !crossConditionFallback) return exact;
+	return references;
 }
 /** A reference is comparable only when its `modelId` equals the live encoder's
 *  model AND its dimension equals the encoder's embedding dim (face-matcher
@@ -3418,11 +3425,12 @@ function comparable(r, encoderModelId, encoderDim) {
 * Returns `{ bestStateId: null, bestScore: null }` when NOTHING was comparable
 * — see `ScoreResult.bestScore`.
 */
-function scoreStates(states, liveEmbedding, currentCondition, encoderModelId, encoderDim) {
+function scoreStates(states, liveEmbedding, currentCondition, encoderModelId, encoderDim, options) {
 	let bestStateId = null;
 	let bestScore = null;
+	const crossConditionFallback = options?.crossConditionFallback === true;
 	for (const s of states) {
-		const refs = selectConditionRefs(s.references, currentCondition);
+		const refs = selectConditionRefs(s.references, currentCondition, crossConditionFallback);
 		let stateScore = null;
 		for (const r of refs) {
 			if (!comparable(r, encoderModelId, encoderDim)) continue;
@@ -3608,7 +3616,8 @@ var SceneEngine = class {
 			lastCountedAt: 0,
 			lastAvailability: "ok",
 			lastVerdict: currentStateId === null ? "unknown" : "matched",
-			lastUnavailable: null
+			lastUnavailable: null,
+			suspendedCondition: null
 		});
 	}
 	/** Force an out-of-cycle check for a single monitor. */
@@ -3631,7 +3640,8 @@ var SceneEngine = class {
 			lastCountedAt: 0,
 			lastAvailability: monitor.availability,
 			lastVerdict: monitor.verdict,
-			lastUnavailable: monitor.unavailable
+			lastUnavailable: monitor.unavailable,
+			suspendedCondition: monitor.suspendedCondition
 		};
 		rt.lastCheckAt = now;
 		this.runtime.set(k, rt);
@@ -3682,6 +3692,7 @@ var SceneEngine = class {
 						availability: "unavailable",
 						unavailableReason: llmResult.reason,
 						coveredConditions: [],
+						suspendedCondition: null,
 						transitioned: false,
 						checkedAt: now
 					});
@@ -3735,12 +3746,20 @@ var SceneEngine = class {
 		if (monitor.check.mode !== "similarity") return;
 		const { embedding } = await this.deps.encoder.encode(crop, cropWidth, cropHeight);
 		const info = await this.encoderInfo();
-		const { bestStateId, bestScore } = scoreStates(monitor.states, embedding, condition, info.modelId, info.embeddingDim);
+		const { bestStateId, bestScore } = scoreStates(monitor.states, embedding, condition, info.modelId, info.embeddingDim, { crossConditionFallback: monitor.onUncoveredCondition === "judge-anyway" });
 		const covered = [...coveredConditions(monitor.states, info.modelId, info.embeddingDim)];
 		if (bestScore === null) {
 			const cause = unknownCause(monitor, condition);
 			rt.lastAvailability = "ok";
 			this.runtime.set(k, rt);
+			if (cause === "no-reference-for-condition" && covered.length > 0 && monitor.onUncoveredCondition === "skip") {
+				await this.reportSuspended(deviceId, monitor, rt, {
+					condition,
+					covered,
+					now
+				});
+				return;
+			}
 			await this.reportUnknown(deviceId, monitor, rt, {
 				condition,
 				cause,
@@ -3808,9 +3827,11 @@ var SceneEngine = class {
 		rt.lastAvailability = "ok";
 		this.runtime.set(k, rt);
 		const verdict = projectVerdict(step.currentStateId, monitor.baselineStateId);
-		const changed = step.transitioned || verdict !== rt.lastVerdict || rt.lastAvailability !== monitor.availability || rt.lastUnavailable !== null;
+		const resumed = rt.suspendedCondition !== null;
+		const changed = step.transitioned || verdict !== rt.lastVerdict || rt.lastAvailability !== monitor.availability || rt.lastUnavailable !== null || resumed;
 		rt.lastVerdict = verdict;
 		rt.lastUnavailable = null;
+		rt.suspendedCondition = null;
 		this.runtime.set(k, rt);
 		if (changed) await this.deps.applyEngineResult(deviceId, monitor.id, {
 			currentStateId: step.currentStateId,
@@ -3822,20 +3843,61 @@ var SceneEngine = class {
 			availability: "ok",
 			unavailableReason: null,
 			coveredConditions: covered,
+			suspendedCondition: null,
 			transitioned: step.transitioned,
 			checkedAt: now
 		});
 	}
 	/**
+	* Announce that this scene is SITTING OUT the current light — once per
+	* transition into it, never once per tick. At a 60 s cadence a per-tick line
+	* would be ~480 lines a night per scene, which is how a log stops being read
+	* at all.
+	*
+	* `info`, not `warn`: nothing is wrong. The operator chose not to capture
+	* this light, or has not got round to it, and either way the scene is doing
+	* exactly what it was configured to do. A branch that drops work still has to
+	* SAY so — silence reads as "never happened" — but saying it at warning level
+	* would train the operator to ignore the one channel that reports real
+	* faults.
+	*/
+	async reportSuspended(deviceId, monitor, rt, input) {
+		if (rt.suspendedCondition === input.condition) return;
+		rt.suspendedCondition = input.condition;
+		this.deps.logger.info("scene checks paused — nothing captured in this light", {
+			tags: { deviceId },
+			meta: {
+				monitorId: monitor.id,
+				condition: input.condition,
+				covered: input.covered.join(",")
+			}
+		});
+		await this.deps.applyEngineResult(deviceId, monitor.id, {
+			currentStateId: rt.hysteresis.currentStateId,
+			previousStateId: rt.hysteresis.currentStateId,
+			lastConfidence: null,
+			currentCondition: input.condition,
+			verdict: rt.lastVerdict,
+			unavailable: rt.lastUnavailable,
+			availability: "ok",
+			unavailableReason: null,
+			coveredConditions: input.covered,
+			suspendedCondition: input.condition,
+			transitioned: false,
+			checkedAt: input.now
+		});
+	}
+	/**
 	* Push an `unknown` verdict — once per transition, not once per poll. The
 	* held state is deliberately NOT destroyed: a scene that cannot judge is a
 	* scene that has not observed anything, and an observation it could not make
 	* must never spend or clear hysteresis credit in either direction.
 	*/
 	async reportUnknown(deviceId, monitor, rt, input) {
-		if (rt.lastVerdict === "unknown" && rt.lastUnavailable === input.cause) return;
+		if (rt.lastVerdict === "unknown" && rt.lastUnavailable === input.cause && rt.suspendedCondition === null) return;
 		rt.lastVerdict = "unknown";
 		rt.lastUnavailable = input.cause;
+		rt.suspendedCondition = null;
 		this.deps.logger.warn("scene cannot judge — reporting unknown", {
 			tags: { deviceId },
 			meta: {
@@ -3855,6 +3917,7 @@ var SceneEngine = class {
 			availability: "ok",
 			unavailableReason: `no comparable reference for "${input.condition}"`,
 			coveredConditions: input.covered,
+			suspendedCondition: null,
 			transitioned: false,
 			checkedAt: input.now
 		});
@@ -4577,6 +4640,8 @@ var SceneMonitorProvider = class {
 			minObservationSpacingSec: 120,
 			anchorThreshold: require_dist.SCENE_DEFAULT_ANCHOR_THRESHOLD,
 			autoRestore: false,
+			onUncoveredCondition: require_dist.SCENE_DEFAULT_UNCOVERED_POLICY,
+			suspendedCondition: null,
 			unavailable: "no-reference-for-condition",
 			coveredConditions: []
 		};
@@ -4606,7 +4671,9 @@ var SceneMonitorProvider = class {
 		this.refresh(input.deviceId);
 	}
 	async deleteScene(input) {
+		const doomed = this.deps.store.getScene(input.deviceId, input.monitorId);
 		await this.deps.store.deleteScene(input.deviceId, input.monitorId);
+		await this.dropOrphanedMedia(doomed?.monitor.states.flatMap((s) => s.references) ?? []);
 		this.deps.logger.info("scene deleted", {
 			tags: { deviceId: input.deviceId },
 			meta: { monitorId: input.monitorId }
@@ -4629,7 +4696,9 @@ var SceneMonitorProvider = class {
 		const stateId = input.stateId ?? monitor.states[0]?.id ?? (0, node_crypto.randomUUID)();
 		const existing = monitor.states.find((s) => s.id === stateId);
 		const label = input.label ?? existing?.label ?? monitor.label;
-		const references = boundReferences([...existing?.references ?? [], reference], condition);
+		const kept = [...existing?.references ?? [], reference];
+		const references = boundReferences(kept, condition);
+		await this.dropOrphanedMedia(kept.filter((r) => !references.includes(r)));
 		const state = {
 			id: stateId,
 			label,
@@ -4663,6 +4732,7 @@ var SceneMonitorProvider = class {
 	}
 	async deleteReference(input) {
 		const monitor = this.requireScene(input.deviceId, input.monitorId);
+		const removed = monitor.states.find((s) => s.id === input.stateId)?.references[input.index];
 		const states = monitor.states.map((s) => {
 			if (s.id !== input.stateId) return s;
 			const references = s.references.filter((_, i) => i !== input.index);
@@ -4676,6 +4746,17 @@ var SceneMonitorProvider = class {
 			...monitor,
 			states
 		}, this.now());
+		await this.dropOrphanedMedia(removed === void 0 ? [] : [removed]);
+		this.deps.logger.info("scene reference deleted", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				monitorId: input.monitorId,
+				stateId: input.stateId,
+				index: input.index,
+				condition: removed?.condition ?? "(none)",
+				remaining: states.reduce((n, s) => n + s.references.length, 0)
+			}
+		});
 		this.refresh(input.deviceId);
 	}
 	async recheckNow(input) {
@@ -4760,6 +4841,15 @@ var SceneMonitorProvider = class {
 		const row = this.deps.store.getScene(deviceId, monitorId);
 		if (row === void 0) return;
 		const monitor = row.monitor;
+		if (result.suspendedCondition !== null) {
+			await this.deps.store.putScene(deviceId, {
+				...monitor,
+				suspendedCondition: result.suspendedCondition,
+				coveredConditions: [...result.coveredConditions]
+			}, result.checkedAt);
+			this.refresh(deviceId);
+			return;
+		}
 		const previous = this.deps.store.getLatch(deviceId, monitorId);
 		const wasLatched = previous?.latched ?? monitor.latched;
 		const wasVerdict = previous?.verdict ?? monitor.verdict;
@@ -4786,6 +4876,7 @@ var SceneMonitorProvider = class {
 		const merged = {
 			...monitor,
 			coveredConditions: [...result.coveredConditions],
+			suspendedCondition: null,
 			availability: result.availability,
 			unavailableReason: result.unavailableReason
 		};
@@ -4889,8 +4980,29 @@ var SceneMonitorProvider = class {
 			updatedAt: now
 		};
 	}
+	/**
+	* Drop the pictures of references that are no longer stored anywhere.
+	*
+	* Best-effort per blob and never throwing: the reference row is already gone,
+	* and refusing the operator's delete because a JPEG would not unlink would be
+	* failing the request over the follower rather than the fact.
+	*/
+	async dropOrphanedMedia(references) {
+		const drop = this.deps.dropMedia;
+		if (drop === void 0) return;
+		for (const r of references) {
+			if (r.thumbnailMediaId === void 0) continue;
+			await drop(r.thumbnailMediaId).catch((err) => {
+				this.deps.logger.debug("scene reference thumbnail delete failed", { meta: {
+					mediaId: r.thumbnailMediaId,
+					error: String(err)
+				} });
+			});
+		}
+	}
 	/** Snapshot → ROI crop + whole-frame anchor → two embeddings + a thumbnail. */
 	async encodeReference(deviceId, monitor, condition) {
+		const capturedAt = this.now();
 		const snap = await this.deps.getSnapshot(deviceId, true);
 		if (snap === null) throw new Error("no snapshot available for this camera");
 		const encoded = Buffer.from(snap.base64, "base64");
@@ -4908,15 +5020,15 @@ var SceneMonitorProvider = class {
 		});
 		const thumbnailMediaId = await this.deps.putMedia?.({
 			deviceId,
-			ownerId: `scene-${monitor.id}-${condition}`,
+			ownerId: `scene-${monitor.id}-${condition}-${capturedAt}`,
 			data: roi.crop,
-			timestamp: this.now()
+			timestamp: capturedAt
 		}).catch(() => void 0);
 		return {
 			embedding,
 			modelId: info.modelId,
 			condition,
-			capturedAt: this.now(),
+			capturedAt,
 			...thumbnailMediaId !== void 0 ? { thumbnailMediaId } : {},
 			...anchor !== null ? { anchorEmbedding: anchor } : {}
 		};
@@ -5412,6 +5524,256 @@ function observeLabel(deviceId, spec, sample, now) {
 		spec
 	};
 }
+/** JPEG quality for the downscaled full frame — matches the crop path. */
+var FULL_FRAME_QUALITY = 80;
+/**
+* Downscale an already-encoded JPEG full frame to FIT WITHIN
+* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
+* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
+* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
+* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
+* at night) is never stored or served — the privacy fix moved to CAPTURE time.
+*/
+async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
+	return (0, sharp.default)(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
+		fit: "inside",
+		withoutEnlargement: true
+	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
+}
+//#endregion
+//#region src/notification-center/audio-still.ts
+/**
+* The audio still shelf — the PHOTOGRAPH a sound rule's notification carries.
+*
+* ## Why a sound needs one at all
+*
+* The attachment ladder resolves media by OWNER, and every other trigger has
+* one: an object or package event owns its crops, a closed track owns its best
+* shot, a doorbell press owns the marker track the same press projected
+* (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
+* counted (`chooseOccupancyMediaOwner`). An audio match owns nothing. Nothing
+* was boxed, nothing was tracked, and — deliberately — nothing is persisted at
+* all: a confirmed window is a claim about sound that has already stopped, and
+* `event-intake.ts` states why replaying it later would be wrong.
+*
+* So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
+* of the match. Not of the sound — of what the camera could see while it was
+* heard.
+*
+* ## Three properties, and each one is a decision
+*
+* **It is not a record.** The bytes live here, in RAM, under an owner id and a
+* TTL that covers the outbox's whole retry horizon — and nowhere else. The
+* alternative was the doorbell's: materialise a synthetic marker track through
+* `SyntheticTrackMaterializer` and let the notification name it. That would put
+* a durable Track on the camera's timeline for every confirmed window, feeding
+* the digest's `listTracks`, retention, and the audio-marker feature's own
+* operator ceilings (`audio-marker-projector.ts` exists precisely to bound how
+* many audio markers a camera may emit). A notification must not manufacture
+* timeline history as a side effect of wanting a picture.
+*
+* **The capture STARTS immediately and is never awaited.** A sound is transient
+* — a scream is over before a snapshot round-trip completes — so the fetch is
+* kicked off at the confirmation, before the rule evaluation runs, and the
+* owner id is minted synchronously so the outbox row can name it. The bytes
+* land while the row waits in the queue, and the dispatcher's existing bounded
+* still-wait (or the pause its own footage render already costs) picks them up.
+* A camera that never answers costs the picture and never the notification.
+*
+* **Two confirmations seconds apart share ONE capture.** A barking dog confirms
+* repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
+* rule's cooldown is its only brake, and the cooldown is applied AFTER this.
+* Without a reuse window this would photograph a camera at whatever rate the
+* sound happens to occur. Each confirmation still gets its OWN owner id, so two
+* outbox rows are never mistaken for one subject; they merely point at the same
+* frame, which is the truth — the scene did not change in ten seconds.
+*
+* Nothing here is silent: a capture that lands and a camera that refuses each
+* emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
+* and 615 not" is the only form that question is ever asked in.
+*/
+/**
+* The owner-id namespace. It is what routes a lookup here instead of to the
+* media store, and it is the reason the dispatcher needs no audio branch —
+* `getMediaForOwner` answers for both under one signature.
+*/
+var NC_AUDIO_STILL_PREFIX = "nc-audio-still:";
+/** True for an owner id this shelf minted. */
+function isAudioStillId(id) {
+	return id.startsWith(NC_AUDIO_STILL_PREFIX);
+}
+/**
+* How long the bytes are held.
+*
+* The outbox retries 8 times with a 5 s → 300 s backoff, which tops out around
+* ten minutes; fifteen covers that with room for a slow drain. Past it the row
+* ships text-only, which is the correct degradation for a photograph of a scene
+* that is a quarter of an hour stale anyway.
+*/
+var NC_AUDIO_STILL_TTL_MS = 15 * 6e4;
+/** A hanging snapshot cap must not pin a capture slot forever. */
+var SNAPSHOT_TIMEOUT_MS = 8e3;
+/**
+* Hard bound on held captures. Reached only if every camera on the hub confirms
+* an audio rule inside one TTL; the oldest is dropped first, which costs a
+* fifteen-minute-old picture nobody is waiting for.
+*/
+var MAX_CAPTURES = 64;
+var NcAudioStillShelf = class {
+	deps;
+	/** captureId → the photograph. */
+	captures = /* @__PURE__ */ new Map();
+	/** ownerId → captureId. Several owners may name one capture (the reuse window). */
+	owners = /* @__PURE__ */ new Map();
+	/** deviceId → its newest capture, for the reuse window. */
+	newest = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Photograph `deviceId` for a match at `atMs`, and return the owner id the
+	* subject should name. SYNCHRONOUS by contract: the caller is on the audio
+	* confirmation path and the outbox row is built from what this returns.
+	*/
+	capture(deviceId, atMs) {
+		const now = this.deps.now();
+		this.prune(now);
+		const ownerId = `${NC_AUDIO_STILL_PREFIX}${(0, node_crypto.randomUUID)()}`;
+		const recent = this.newest.get(deviceId);
+		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
+			this.owners.set(ownerId, recent.captureId);
+			return ownerId;
+		}
+		const captureId = (0, node_crypto.randomUUID)();
+		this.captures.set(captureId, {
+			deviceId,
+			startedAt: now,
+			expiresAt: now + NC_AUDIO_STILL_TTL_MS,
+			files: []
+		});
+		this.newest.set(deviceId, {
+			captureId,
+			at: now
+		});
+		this.owners.set(ownerId, captureId);
+		this.fetch(captureId, deviceId, atMs);
+		return ownerId;
+	}
+	/**
+	* The media an owner id holds, or `undefined` when this shelf never minted
+	* it. An EMPTY array is a different answer: the capture exists and has not
+	* landed (or never will), which is exactly the case the dispatcher's bounded
+	* wait and its `no still could be resolved` line are for.
+	*/
+	get(ownerId) {
+		const captureId = this.owners.get(ownerId);
+		if (captureId === void 0) return void 0;
+		return this.captures.get(captureId)?.files ?? [];
+	}
+	/** Drop expired captures and the owners that named them. */
+	prune(now) {
+		for (const [captureId, held] of this.captures) {
+			if (held.expiresAt > now) continue;
+			this.captures.delete(captureId);
+			if (this.newest.get(held.deviceId)?.captureId === captureId) this.newest.delete(held.deviceId);
+		}
+		while (this.captures.size > MAX_CAPTURES) {
+			const oldest = this.captures.keys().next();
+			if (oldest.done === true) break;
+			const held = this.captures.get(oldest.value);
+			this.captures.delete(oldest.value);
+			if (held !== void 0 && this.newest.get(held.deviceId)?.captureId === oldest.value) this.newest.delete(held.deviceId);
+		}
+		for (const [ownerId, captureId] of this.owners) if (!this.captures.has(captureId)) this.owners.delete(ownerId);
+	}
+	/** Drop everything (shutdown). */
+	clear() {
+		this.captures.clear();
+		this.owners.clear();
+		this.newest.clear();
+	}
+	async fetch(captureId, deviceId, atMs) {
+		try {
+			const shot = await withTimeout$2(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
+			if (shot === null || shot.base64.length === 0) {
+				this.reportMiss(deviceId, "the camera returned no snapshot");
+				return;
+			}
+			const raw = Buffer.from(shot.base64, "base64");
+			let data = raw;
+			try {
+				data = await downscaleFullFrameJpeg(raw, 960, 540);
+			} catch {}
+			const held = this.captures.get(captureId);
+			if (held === void 0) return;
+			this.captures.set(captureId, {
+				...held,
+				files: audioStillMedia(data, atMs)
+			});
+			this.deps.logger.info("audio still captured", {
+				tags: { deviceId },
+				meta: {
+					bytes: data.byteLength,
+					tookMs: this.deps.now() - held.startedAt
+				}
+			});
+		} catch (err) {
+			this.reportMiss(deviceId, err instanceof Error ? err.message : String(err));
+		}
+	}
+	/**
+	* A branch that drops work says so. This one costs the operator the picture
+	* on a notification they DID receive, so it is a warn and it carries the
+	* camera — the only key the question is ever asked with.
+	*/
+	reportMiss(deviceId, reason) {
+		this.deps.logger.warn("the camera did not answer the audio still — this notification ships text-only", {
+			tags: { deviceId },
+			meta: { reason }
+		});
+	}
+};
+/**
+* The photograph, in the three kinds the CLEAN-SCENE ladders ask for.
+*
+* `keyFrameSmall` leads because it is the first rung of both `attach: 'best'`
+* and `attach: 'keyFrame'` on a track owner; `keyFrame` and `fullFrame` answer
+* `frame: 'full'` and `frame: 'boxed'`'s honest degrade. There is deliberately
+* no `crop` / `thumbnail`: nothing was boxed, so `frame: 'cropped'` resolves
+* NOTHING and the notification ships text-only with the ordinary line saying
+* so. Inventing a centre crop would answer a different question from the one
+* the operator asked.
+*/
+function audioStillMedia(data, timestamp) {
+	const base64 = data.toString("base64");
+	const file = (kind) => ({
+		key: `${NC_AUDIO_STILL_PREFIX}${kind}`,
+		kind,
+		base64,
+		sizeBytes: data.byteLength,
+		timestamp
+	});
+	return [
+		file("keyFrameSmall"),
+		file("keyFrame"),
+		file("fullFrame")
+	];
+}
+/** Reject if `promise` does not settle within `ms`. */
+function withTimeout$2(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`snapshot cap timed out after ${String(ms)}ms`));
+		}, ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
 //#endregion
 //#region src/shared/llm-vision/prompt-hygiene.ts
 /**
@@ -6022,6 +6384,298 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/shared/frame/box-drawer.ts
+var DEFAULT_COLOR = require_dist.DEFAULT_EVENT_COLOR;
+var DEFAULT_QUALITY = 80;
+var STROKE_WIDTH = 3;
+function escapeXml$2(s) {
+	return s.replace(/[<>&'"]/g, (ch) => {
+		switch (ch) {
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			case "&": return "&amp;";
+			case "'": return "&apos;";
+			default: return "&quot;";
+		}
+	});
+}
+/** Clamp a pixel box to the frame so the rect always stays inside [0,W]×[0,H]. */
+function clampBox(b, frameWidth, frameHeight) {
+	const x = Math.max(0, Math.min(Math.round(b.x), frameWidth - 1));
+	const y = Math.max(0, Math.min(Math.round(b.y), frameHeight - 1));
+	return {
+		x,
+		y,
+		w: Math.max(1, Math.min(Math.round(b.w), frameWidth - x)),
+		h: Math.max(1, Math.min(Math.round(b.h), frameHeight - y))
+	};
+}
+/**
+* Draw bounding boxes over a raw RGB frame and JPEG-encode it.
+*
+* The frame is composited with an SVG overlay (one `<rect>` per box, plus an
+* optional caption) at full resolution, then optionally downscaled — so the
+* box stays crisp relative to the scene. Boxes are clamped to frame bounds to
+* avoid sharp `extract`/region errors on slightly-out-of-range detections.
+*/
+async function drawBoxedFrame(frameData, frameWidth, frameHeight, boxes, opts = {}) {
+	const quality = opts.quality ?? DEFAULT_QUALITY;
+	let base = frameData;
+	let baseIsRaw = true;
+	if (boxes.length > 0) {
+		const fontSize = Math.max(12, Math.round(frameHeight / 30));
+		const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${frameWidth}" height="${frameHeight}">${boxes.map((b) => {
+			const c = clampBox(b, frameWidth, frameHeight);
+			const color = b.color ?? DEFAULT_COLOR;
+			const rect = `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${c.h}" fill="none" stroke="${color}" stroke-width="${STROKE_WIDTH}"/>`;
+			if (!b.label) return rect;
+			const ty = Math.max(fontSize, c.y - 4);
+			return rect + `<text x="${c.x}" y="${ty}" font-family="sans-serif" font-size="${fontSize}" fill="${color}" stroke="black" stroke-width="0.5">${escapeXml$2(b.label)}</text>`;
+		}).join("")}</svg>`;
+		base = await (0, sharp.default)(frameData, { raw: {
+			width: frameWidth,
+			height: frameHeight,
+			channels: 3
+		} }).composite([{
+			input: Buffer.from(svg),
+			top: 0,
+			left: 0
+		}]).png().toBuffer();
+		baseIsRaw = false;
+	}
+	let pipeline = baseIsRaw ? (0, sharp.default)(base, { raw: {
+		width: frameWidth,
+		height: frameHeight,
+		channels: 3
+	} }) : (0, sharp.default)(base);
+	if (opts.maxWidth !== void 0) pipeline = pipeline.resize({
+		width: opts.maxWidth,
+		withoutEnlargement: true
+	});
+	return pipeline.jpeg({ quality }).toBuffer();
+}
+/** JPEG quality of the composed artefact — the mosaic's number, same reasons. */
+var GROUP_FRAME_QUALITY = 82;
+/**
+* Draw the members onto the frame. Returns `null` when there is nothing to
+* draw, or when anything at all goes wrong — the caller then ships the
+* unannotated frame unchanged.
+*/
+async function composeGroupFrame(input) {
+	const freshnessMs = input.freshnessMs ?? 3e3;
+	const fresh = input.boxes.filter((b) => Math.abs(input.at - b.observedAt) <= freshnessMs);
+	const withheld = input.boxes.length - fresh.length;
+	if (fresh.length < 2) {
+		if (withheld > 0) input.logger.info("group frame not drawn — too few members with fresh geometry", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				groupKey: input.groupKey,
+				members: input.boxes.length,
+				fresh: fresh.length,
+				withheld
+			}
+		});
+		return null;
+	}
+	try {
+		const decoded = await (0, sharp.default)(input.jpeg).raw().toBuffer({ resolveWithObject: true });
+		const { width, height, channels } = decoded.info;
+		if (!(width > 0 && height > 0) || channels !== 3) {
+			input.logger.warn("group frame not drawn — unexpected raster shape", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					groupKey: input.groupKey,
+					width,
+					height,
+					channels
+				}
+			});
+			return null;
+		}
+		const boxes = fresh.map((b) => ({
+			x: b.bbox.x * width,
+			y: b.bbox.y * height,
+			w: b.bbox.w * width,
+			h: b.bbox.h * height,
+			...b.label !== void 0 && b.label.length > 0 ? { label: b.label } : {}
+		}));
+		const bytes = await drawBoxedFrame(decoded.data, width, height, boxes, { quality: GROUP_FRAME_QUALITY });
+		input.logger.debug("group frame composed", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				groupKey: input.groupKey,
+				drawn: boxes.length,
+				withheld,
+				width,
+				height
+			}
+		});
+		return {
+			bytes,
+			drawn: boxes.length,
+			withheld
+		};
+	} catch (err) {
+		input.logger.warn("group frame compose failed — shipping the unannotated frame", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				groupKey: input.groupKey,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return null;
+	}
+}
+//#endregion
+//#region src/notification-center/text-compose.ts
+/** One normalisation, used on both sides of every class lookup — a pipeline
+*  that emitted `Person` must find the key written `class.person`. */
+function normaliseClass(className) {
+	return className.trim().toLowerCase();
+}
+/**
+* The noun for a class, in the count's plural category.
+*
+* A class no locale names falls through to `class.other`, which prints the RAW
+* name: a custom model's class must appear in the sentence rather than vanish
+* out of it, and a missing translation is a smaller defect than a missing
+* detection.
+*/
+function ncClassNoun(texts, className, count) {
+	const key = `class.${normaliseClass(className)}`;
+	if (texts.has(key)) return texts.text({
+		key,
+		count,
+		vars: { name: className }
+	});
+	return texts.text({
+		key: "class.other",
+		count,
+		vars: { name: className }
+	});
+}
+/** `person (John)` / `persona (John)` — the thing the notification is about. */
+function ncSubjectText(texts, input) {
+	const classNoun = ncClassNoun(texts, input.className, 1);
+	if (input.label === void 0) return texts.text({
+		key: "detection.subject",
+		vars: { classNoun }
+	});
+	return texts.text({
+		key: subjectLabelKey(input.labelKind),
+		vars: {
+			classNoun,
+			label: input.label
+		}
+	});
+}
+/**
+* Which labelled-subject key a recognition gets. A kind the catalog does not
+* name falls back to the generic key rather than printing nothing — the same
+* direction `ncClassNoun` degrades in, and for the same reason.
+*/
+function subjectLabelKey(kind) {
+	if (kind === "identity") return "detection.subject.identity";
+	if (kind === "plate") return "detection.subject.plate";
+	return "detection.subject.labelled";
+}
+/**
+* ` in gate, drive` — INCLUDING its leading space, and empty when there are no
+* zones.
+*
+* The space belongs to the fragment rather than to the body key because the
+* alternative is a body that ends in a trailing space on every zone-less
+* notification. A translator moving the clause moves the space with it.
+*/
+function ncInZonesText(texts, zoneLabels) {
+	if (zoneLabels.length === 0) return "";
+	return texts.text({
+		key: "detection.inZones",
+		vars: { zones: zoneLabels.join(", ") }
+	});
+}
+/** The human-readable edge polarity behind `{{op}}` and the occupancy body. */
+function ncOccupancyOp(texts, occupied) {
+	return texts.text({ key: occupied ? "occupancy.op.occupied" : "occupancy.op.free" });
+}
+/**
+* `1 persona, 2 veicoli e 3 animali` — the language's own conjunction, its own
+* plural rules, and its own nouns.
+*
+* Zero-count classes are dropped: a selected class the window never contained
+* is a legitimate `0` in `{{count_vehicle}}`, but "0 veicoli" inside a summary
+* sentence is a line nobody reads. Order is the caller's (busiest first) and is
+* preserved, so the same night always produces the same sentence.
+*/
+function ncDetectionSummary(texts, counts) {
+	const parts = counts.filter((entry) => entry.count > 0).map((entry) => `${entry.count} ${ncClassNoun(texts, entry.className, entry.count)}`);
+	return texts.join(parts);
+}
+//#endregion
+//#region src/notification-center/group/nc-group-text.ts
+var DEFAULT_MAX_NAMES = 2;
+/**
+* `N altre persone` — the remainder phrase for one class, in its own gender.
+*
+* Mirrors {@link ncClassNoun} byte for byte, including the fallback: a class no
+* locale names falls through to `group.others.other`, which prints the raw class
+* name rather than vanishing. A custom model's class must appear in the sentence.
+*/
+function ncGroupOthers(texts, className, count) {
+	const classNoun = ncClassNoun(texts, className, count);
+	const key = `group.others.${className.trim().toLowerCase()}`;
+	if (texts.has(key)) return texts.text({
+		key,
+		count,
+		vars: {
+			count: `${count}`,
+			classNoun
+		}
+	});
+	return texts.text({
+		key: "group.others.other",
+		count,
+		vars: {
+			count: `${count}`,
+			classNoun
+		}
+	});
+}
+/** Counts per class, in first-seen order so the same burst always reads the same. */
+function countByClass(members) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const m of members) counts.set(m.className, (counts.get(m.className) ?? 0) + 1);
+	return [...counts].map(([className, count]) => ({
+		className,
+		count
+	}));
+}
+/**
+* The finished `{{subject}}` phrase for a group.
+*
+* Pure: a catalog in, a string out. No clock, no store, no I/O — like every
+* other composer in `text-compose.ts`, and for the same reason.
+*/
+function ncGroupSubjectText(texts, input) {
+	const members = input.members;
+	const only = members.length === 1 ? members[0] : void 0;
+	if (only !== void 0) return ncSubjectText(texts, {
+		className: only.className,
+		...only.label !== void 0 ? { label: only.label } : {},
+		...only.labelKind !== void 0 ? { labelKind: only.labelKind } : {}
+	});
+	if (members.length === 0) return "";
+	const maxNames = input.maxNames !== void 0 && input.maxNames >= 0 ? input.maxNames : DEFAULT_MAX_NAMES;
+	const named = members.filter((m) => m.label !== void 0 && m.label.length > 0);
+	const names = named.slice(0, maxNames).map((m) => m.label ?? "");
+	if (names.length === 0) return ncDetectionSummary(texts, countByClass(members));
+	const spoken = new Set(named.slice(0, maxNames));
+	const remainder = members.filter((m) => !spoken.has(m));
+	if (remainder.length === 0) return texts.join(names);
+	const others = countByClass(remainder).map((c) => ncGroupOthers(texts, c.className, c.count));
+	return texts.join([...names, ...others]);
+}
+//#endregion
 //#region src/notification-center/render-template.ts
 /**
 * The ONE `{{var}}` renderer of the notification centre.
@@ -6745,10 +7399,17 @@ function subjectFromSensorEvent(ev, markerTrackId) {
 * `minConfidence` condition composes naturally). A level-path audio event (no
 * `classification`) yields NO class ⇒ it can never satisfy the audio opt-in
 * gate, so only classified audio ever notifies (documented boundary). Audio has
-* no zones / bbox / label / track, so the object/track-specific conditions all
-* fail closed (see the {@link evaluateRule} audio gate + the matchers below).
+* no zones / bbox / label, so the object-specific conditions all fail closed
+* (see the {@link evaluateRule} audio gate + the matchers below).
+*
+* `stillOwnerId` is the audio still shelf's owner id — the photograph of the
+* camera taken at the match (`audio-still.ts`). It rides `trackId` because that
+* is the field the attachment ladder reads, exactly as a doorbell press rides
+* its marker track's id; nothing else about the subject is track-scoped, and
+* `buildEntries` keys an audio row on its record id, never on this. Absent when
+* no rule that could fire wants a still.
 */
-function subjectFromAudioEvent(ev) {
+function subjectFromAudioEvent(ev, stillOwnerId) {
 	const macro = ev.classification?.className;
 	return {
 		kind: "audio-event",
@@ -6758,6 +7419,7 @@ function subjectFromAudioEvent(ev) {
 		classNames: macro !== void 0 ? [`audio-${macro}`] : [],
 		...ev.classification?.score !== void 0 ? { confidence: ev.classification.score } : {},
 		zones: [],
+		...stillOwnerId !== void 0 ? { trackId: stillOwnerId } : {},
 		source: "pipeline"
 	};
 }
@@ -6778,8 +7440,12 @@ function subjectFromAudioEvent(ev) {
 * neither is a score, and lending one to `minConfidence` would let a detection
 * condition silently re-judge an audio rule on a number that means something
 * else.
+*
+* `stillOwnerId` — see {@link subjectFromAudioEvent}. A sound owns no frame, so
+* the only picture it can carry is a photograph of its camera taken at the
+* confirmation, held on the still shelf under this id.
 */
-function subjectFromAudioWindow(hit) {
+function subjectFromAudioWindow(hit, stillOwnerId) {
 	const spec = hit.spec;
 	return {
 		kind: "audio-window",
@@ -6788,6 +7454,7 @@ function subjectFromAudioWindow(hit) {
 		timestamp: hit.timestamp,
 		classNames: hit.labels.map((l) => `audio-${l}`),
 		zones: [],
+		...stillOwnerId !== void 0 ? { trackId: stillOwnerId } : {},
 		source: "audio",
 		audioWindow: audioSubjectFor(hit, spec)
 	};
@@ -8010,298 +8677,6 @@ var NcTextCatalog = class {
 	}
 };
 //#endregion
-//#region src/shared/frame/box-drawer.ts
-var DEFAULT_COLOR = require_dist.DEFAULT_EVENT_COLOR;
-var DEFAULT_QUALITY = 80;
-var STROKE_WIDTH = 3;
-function escapeXml$2(s) {
-	return s.replace(/[<>&'"]/g, (ch) => {
-		switch (ch) {
-			case "<": return "&lt;";
-			case ">": return "&gt;";
-			case "&": return "&amp;";
-			case "'": return "&apos;";
-			default: return "&quot;";
-		}
-	});
-}
-/** Clamp a pixel box to the frame so the rect always stays inside [0,W]×[0,H]. */
-function clampBox(b, frameWidth, frameHeight) {
-	const x = Math.max(0, Math.min(Math.round(b.x), frameWidth - 1));
-	const y = Math.max(0, Math.min(Math.round(b.y), frameHeight - 1));
-	return {
-		x,
-		y,
-		w: Math.max(1, Math.min(Math.round(b.w), frameWidth - x)),
-		h: Math.max(1, Math.min(Math.round(b.h), frameHeight - y))
-	};
-}
-/**
-* Draw bounding boxes over a raw RGB frame and JPEG-encode it.
-*
-* The frame is composited with an SVG overlay (one `<rect>` per box, plus an
-* optional caption) at full resolution, then optionally downscaled — so the
-* box stays crisp relative to the scene. Boxes are clamped to frame bounds to
-* avoid sharp `extract`/region errors on slightly-out-of-range detections.
-*/
-async function drawBoxedFrame(frameData, frameWidth, frameHeight, boxes, opts = {}) {
-	const quality = opts.quality ?? DEFAULT_QUALITY;
-	let base = frameData;
-	let baseIsRaw = true;
-	if (boxes.length > 0) {
-		const fontSize = Math.max(12, Math.round(frameHeight / 30));
-		const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${frameWidth}" height="${frameHeight}">${boxes.map((b) => {
-			const c = clampBox(b, frameWidth, frameHeight);
-			const color = b.color ?? DEFAULT_COLOR;
-			const rect = `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${c.h}" fill="none" stroke="${color}" stroke-width="${STROKE_WIDTH}"/>`;
-			if (!b.label) return rect;
-			const ty = Math.max(fontSize, c.y - 4);
-			return rect + `<text x="${c.x}" y="${ty}" font-family="sans-serif" font-size="${fontSize}" fill="${color}" stroke="black" stroke-width="0.5">${escapeXml$2(b.label)}</text>`;
-		}).join("")}</svg>`;
-		base = await (0, sharp.default)(frameData, { raw: {
-			width: frameWidth,
-			height: frameHeight,
-			channels: 3
-		} }).composite([{
-			input: Buffer.from(svg),
-			top: 0,
-			left: 0
-		}]).png().toBuffer();
-		baseIsRaw = false;
-	}
-	let pipeline = baseIsRaw ? (0, sharp.default)(base, { raw: {
-		width: frameWidth,
-		height: frameHeight,
-		channels: 3
-	} }) : (0, sharp.default)(base);
-	if (opts.maxWidth !== void 0) pipeline = pipeline.resize({
-		width: opts.maxWidth,
-		withoutEnlargement: true
-	});
-	return pipeline.jpeg({ quality }).toBuffer();
-}
-/** JPEG quality of the composed artefact — the mosaic's number, same reasons. */
-var GROUP_FRAME_QUALITY = 82;
-/**
-* Draw the members onto the frame. Returns `null` when there is nothing to
-* draw, or when anything at all goes wrong — the caller then ships the
-* unannotated frame unchanged.
-*/
-async function composeGroupFrame(input) {
-	const freshnessMs = input.freshnessMs ?? 3e3;
-	const fresh = input.boxes.filter((b) => Math.abs(input.at - b.observedAt) <= freshnessMs);
-	const withheld = input.boxes.length - fresh.length;
-	if (fresh.length < 2) {
-		if (withheld > 0) input.logger.info("group frame not drawn — too few members with fresh geometry", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				groupKey: input.groupKey,
-				members: input.boxes.length,
-				fresh: fresh.length,
-				withheld
-			}
-		});
-		return null;
-	}
-	try {
-		const decoded = await (0, sharp.default)(input.jpeg).raw().toBuffer({ resolveWithObject: true });
-		const { width, height, channels } = decoded.info;
-		if (!(width > 0 && height > 0) || channels !== 3) {
-			input.logger.warn("group frame not drawn — unexpected raster shape", {
-				tags: { deviceId: input.deviceId },
-				meta: {
-					groupKey: input.groupKey,
-					width,
-					height,
-					channels
-				}
-			});
-			return null;
-		}
-		const boxes = fresh.map((b) => ({
-			x: b.bbox.x * width,
-			y: b.bbox.y * height,
-			w: b.bbox.w * width,
-			h: b.bbox.h * height,
-			...b.label !== void 0 && b.label.length > 0 ? { label: b.label } : {}
-		}));
-		const bytes = await drawBoxedFrame(decoded.data, width, height, boxes, { quality: GROUP_FRAME_QUALITY });
-		input.logger.debug("group frame composed", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				groupKey: input.groupKey,
-				drawn: boxes.length,
-				withheld,
-				width,
-				height
-			}
-		});
-		return {
-			bytes,
-			drawn: boxes.length,
-			withheld
-		};
-	} catch (err) {
-		input.logger.warn("group frame compose failed — shipping the unannotated frame", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				groupKey: input.groupKey,
-				error: err instanceof Error ? err.message : String(err)
-			}
-		});
-		return null;
-	}
-}
-//#endregion
-//#region src/notification-center/text-compose.ts
-/** One normalisation, used on both sides of every class lookup — a pipeline
-*  that emitted `Person` must find the key written `class.person`. */
-function normaliseClass(className) {
-	return className.trim().toLowerCase();
-}
-/**
-* The noun for a class, in the count's plural category.
-*
-* A class no locale names falls through to `class.other`, which prints the RAW
-* name: a custom model's class must appear in the sentence rather than vanish
-* out of it, and a missing translation is a smaller defect than a missing
-* detection.
-*/
-function ncClassNoun(texts, className, count) {
-	const key = `class.${normaliseClass(className)}`;
-	if (texts.has(key)) return texts.text({
-		key,
-		count,
-		vars: { name: className }
-	});
-	return texts.text({
-		key: "class.other",
-		count,
-		vars: { name: className }
-	});
-}
-/** `person (John)` / `persona (John)` — the thing the notification is about. */
-function ncSubjectText(texts, input) {
-	const classNoun = ncClassNoun(texts, input.className, 1);
-	if (input.label === void 0) return texts.text({
-		key: "detection.subject",
-		vars: { classNoun }
-	});
-	return texts.text({
-		key: subjectLabelKey(input.labelKind),
-		vars: {
-			classNoun,
-			label: input.label
-		}
-	});
-}
-/**
-* Which labelled-subject key a recognition gets. A kind the catalog does not
-* name falls back to the generic key rather than printing nothing — the same
-* direction `ncClassNoun` degrades in, and for the same reason.
-*/
-function subjectLabelKey(kind) {
-	if (kind === "identity") return "detection.subject.identity";
-	if (kind === "plate") return "detection.subject.plate";
-	return "detection.subject.labelled";
-}
-/**
-* ` in gate, drive` — INCLUDING its leading space, and empty when there are no
-* zones.
-*
-* The space belongs to the fragment rather than to the body key because the
-* alternative is a body that ends in a trailing space on every zone-less
-* notification. A translator moving the clause moves the space with it.
-*/
-function ncInZonesText(texts, zoneLabels) {
-	if (zoneLabels.length === 0) return "";
-	return texts.text({
-		key: "detection.inZones",
-		vars: { zones: zoneLabels.join(", ") }
-	});
-}
-/** The human-readable edge polarity behind `{{op}}` and the occupancy body. */
-function ncOccupancyOp(texts, occupied) {
-	return texts.text({ key: occupied ? "occupancy.op.occupied" : "occupancy.op.free" });
-}
-/**
-* `1 persona, 2 veicoli e 3 animali` — the language's own conjunction, its own
-* plural rules, and its own nouns.
-*
-* Zero-count classes are dropped: a selected class the window never contained
-* is a legitimate `0` in `{{count_vehicle}}`, but "0 veicoli" inside a summary
-* sentence is a line nobody reads. Order is the caller's (busiest first) and is
-* preserved, so the same night always produces the same sentence.
-*/
-function ncDetectionSummary(texts, counts) {
-	const parts = counts.filter((entry) => entry.count > 0).map((entry) => `${entry.count} ${ncClassNoun(texts, entry.className, entry.count)}`);
-	return texts.join(parts);
-}
-//#endregion
-//#region src/notification-center/group/nc-group-text.ts
-var DEFAULT_MAX_NAMES = 2;
-/**
-* `N altre persone` — the remainder phrase for one class, in its own gender.
-*
-* Mirrors {@link ncClassNoun} byte for byte, including the fallback: a class no
-* locale names falls through to `group.others.other`, which prints the raw class
-* name rather than vanishing. A custom model's class must appear in the sentence.
-*/
-function ncGroupOthers(texts, className, count) {
-	const classNoun = ncClassNoun(texts, className, count);
-	const key = `group.others.${className.trim().toLowerCase()}`;
-	if (texts.has(key)) return texts.text({
-		key,
-		count,
-		vars: {
-			count: `${count}`,
-			classNoun
-		}
-	});
-	return texts.text({
-		key: "group.others.other",
-		count,
-		vars: {
-			count: `${count}`,
-			classNoun
-		}
-	});
-}
-/** Counts per class, in first-seen order so the same burst always reads the same. */
-function countByClass(members) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const m of members) counts.set(m.className, (counts.get(m.className) ?? 0) + 1);
-	return [...counts].map(([className, count]) => ({
-		className,
-		count
-	}));
-}
-/**
-* The finished `{{subject}}` phrase for a group.
-*
-* Pure: a catalog in, a string out. No clock, no store, no I/O — like every
-* other composer in `text-compose.ts`, and for the same reason.
-*/
-function ncGroupSubjectText(texts, input) {
-	const members = input.members;
-	const only = members.length === 1 ? members[0] : void 0;
-	if (only !== void 0) return ncSubjectText(texts, {
-		className: only.className,
-		...only.label !== void 0 ? { label: only.label } : {},
-		...only.labelKind !== void 0 ? { labelKind: only.labelKind } : {}
-	});
-	if (members.length === 0) return "";
-	const maxNames = input.maxNames !== void 0 && input.maxNames >= 0 ? input.maxNames : DEFAULT_MAX_NAMES;
-	const named = members.filter((m) => m.label !== void 0 && m.label.length > 0);
-	const names = named.slice(0, maxNames).map((m) => m.label ?? "");
-	if (names.length === 0) return ncDetectionSummary(texts, countByClass(members));
-	const spoken = new Set(named.slice(0, maxNames));
-	const remainder = members.filter((m) => !spoken.has(m));
-	if (remainder.length === 0) return texts.join(names);
-	const others = countByClass(remainder).map((c) => ncGroupOthers(texts, c.className, c.count));
-	return texts.join([...names, ...others]);
-}
-//#endregion
 //#region src/notification-center/dispatcher.ts
 var DEFAULT_TARGET_CACHE_TTL_MS = 6e4;
 /**
@@ -8864,7 +9239,7 @@ var NcDispatcher = class {
 		const stillOverride = zoneIdsWanted !== void 0 && zoneIdsWanted.length > 0 ? "keyFrame" : void 0;
 		const firstLook = await this.resolveAttachment(entry, stillOverride);
 		const footage = await this.renderFootage(entry);
-		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : footage.attempted ? await this.resolveAttachment(entry, stillOverride) : await this.waitForStill(entry, stillOverride);
+		const still = firstLook !== null || entry.payload.media === "none" ? firstLook : footage.attempted ? await this.resolveAttachment(entry, stillOverride) ?? await this.waitForStill(entry, stillOverride) : await this.waitForStill(entry, stillOverride);
 		if (still !== null) {
 			const zoneIds = zoneIdsWanted;
 			if (zoneIds !== void 0 && zoneIds.length > 0) {
@@ -9352,17 +9727,24 @@ function incomingFromSensorEvent(event, markerTrackId) {
 		})
 	};
 }
-/** Audio-event persist (classified episode). */
-function incomingFromAudioEvent(event) {
+/**
+* Audio-event persist (classified episode).
+*
+* `stillOwnerId` is the audio still shelf's owner id for the photograph taken
+* at this episode (`audio-still.ts`). Absent when no rule that could fire asked
+* for a picture — the same shape `incomingFromSensorEvent` carries its marker.
+*/
+function incomingFromAudioEvent(event, stillOwnerId) {
 	return {
-		subject: subjectFromAudioEvent(event),
+		subject: subjectFromAudioEvent(event, stillOwnerId),
 		kind: "audio-event",
 		origin: "pipeline",
 		log: () => ({
 			tags: { deviceId: event.deviceId },
 			meta: {
 				audioEventId: event.id,
-				class: event.classification?.className
+				class: event.classification?.className,
+				...stillOwnerId !== void 0 ? { stillOwner: stillOwnerId } : {}
 			}
 		})
 	};
@@ -9392,15 +9774,20 @@ function incomingFromPackageEvent(event, phase) {
 * and a crash in the confirm→outbox window drops the notification rather than
 * replaying it. Deliberate: a stale match is a claim about a noise that has
 * already stopped.
+*
+* `stillOwnerId` — see {@link incomingFromAudioEvent}.
 */
-function incomingFromAudioWindow(hit) {
+function incomingFromAudioWindow(hit, stillOwnerId) {
 	return {
-		subject: subjectFromAudioWindow(hit),
+		subject: subjectFromAudioWindow(hit, stillOwnerId),
 		kind: "audio-window",
 		origin: "pipeline",
 		log: () => ({
 			tags: { deviceId: hit.deviceId },
-			meta: audioHitMeta(hit)
+			meta: {
+				...audioHitMeta(hit),
+				...stillOwnerId !== void 0 ? { stillOwner: stillOwnerId } : {}
+			}
 		})
 	};
 }
@@ -13341,6 +13728,29 @@ function escapeXml$1(s) {
 		}
 	});
 }
+/**
+* The single decision about drawn text — and the home of the DEFAULT.
+*
+* `undefined` means `none`, not `all`: a rule stored before this option existed
+* has no `captions` key, and the operator's request is that such a rule deliver
+* pictures. The schema materialises the same default on read
+* (`NcSummaryRuleInputSchema`), so this arm only fires for a caller that never
+* had a rule — the test bridge and the spec. Both agreeing is the point.
+*/
+function mosaicTextPlan(captions) {
+	if (captions === "all") return {
+		tileLabels: true,
+		titleBand: true
+	};
+	if (captions === "tiles") return {
+		tileLabels: true,
+		titleBand: false
+	};
+	return {
+		tileLabels: false,
+		titleBand: false
+	};
+}
 /** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
 *  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
 function mosaicGrid(n) {
@@ -13447,22 +13857,25 @@ function titleSvg(width, height, caption) {
 *         treats that as "no mosaic" and still delivers the counts.
 */
 async function renderMosaic(request, logger) {
+	const plan = mosaicTextPlan(request.captions);
 	const decoded = [];
 	const probeLayout = mosaicLayout({
 		tileCount: Math.max(1, request.tiles.length),
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
 	});
 	for (const tile of request.tiles) try {
-		const resized = await (0, sharp.default)(tile.jpeg).resize({
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = (0, sharp.default)(tile.jpeg).resize({
 			width: probeLayout.tileWidth,
 			height: probeLayout.tileHeight,
 			fit: "contain",
 			background: MOSAIC_BACKGROUND
-		}).composite([{
-			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, tile.label),
+		});
+		const resized = await (label.length === 0 ? fitted : fitted.composite([{
+			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, label),
 			top: 0,
 			left: 0
-		}]).jpeg({ quality: 82 }).toBuffer();
+		}])).jpeg({ quality: 82 }).toBuffer();
 		decoded.push({
 			tile,
 			resized
@@ -13477,7 +13890,7 @@ async function renderMosaic(request, logger) {
 		});
 	}
 	const droppedTiles = request.tiles.length - decoded.length;
-	const caption = request.caption?.trim() ?? "";
+	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
 	const layout = mosaicLayout({
 		tileCount: Math.max(1, decoded.length),
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
@@ -14346,18 +14759,20 @@ var NcSummaryProducer = class {
 		};
 		let rendered;
 		try {
+			const plan = mosaicTextPlan(rule.captions);
 			rendered = await renderMosaic({
 				tiles: tiles.map(({ candidate, jpeg }) => ({
 					jpeg,
-					label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf$2(candidate.firstSeen)} · ${candidate.className}`,
+					...plan.tileLabels ? { label: `${names.get(candidate.deviceId) ?? candidate.deviceId} · ${clockOf$2(candidate.firstSeen)} · ${candidate.className}` } : {},
 					deviceId: candidate.deviceId,
 					trackId: candidate.trackId
 				})),
-				caption: summaryCaptionText({
+				captions: rule.captions,
+				...plan.titleBand ? { caption: summaryCaptionText({
 					...rule.captionText !== void 0 ? { captionText: rule.captionText } : {},
 					ruleName: rule.name,
 					window
-				})
+				}) } : {}
 			}, this.deps.logger);
 		} catch (err) {
 			this.deps.logger.warn("summary mosaic could not be composed — delivering the counts alone", { meta: {
@@ -14621,6 +15036,34 @@ var NcSummaryRankSchema = require_dist._enum([
 	"dwell"
 ]);
 /**
+* How much TEXT is burnt into the mosaic — and the answer is NONE by default.
+*
+* `none` is the shipped default and, crucially, the reading of an ABSENT field:
+* `.default()` on the Input schema materialises it, and the persisted schema
+* extends Input, so a rule authored before this option existed parses as `none`
+* on the next read. No migration, no backfill, no rewrite of a stored rule.
+*
+* The operator asked for "solo immagini". Three reasons it is the right
+* default rather than a preference:
+*
+*  - a caption is PERMANENT in the artefact, exactly like a detection box, and
+*    a mosaic is re-read days later;
+*  - the per-tile strip covers 14% of the tile from the bottom edge up, which
+*    is where feet, wheels and parcels are;
+*  - nothing downstream needs it. The AI pass is given the RAW per-track JPEGs
+*    and gets camera, class and time as PROMPT TEXT — it never reads the
+*    mosaic, so the pixels carry no fact the judge would lose.
+*
+* `tiles` and `all` keep the old behaviour reachable for an operator who wants
+* it; `all` is byte-for-byte what every rule produced before this field.
+*/
+var NcSummaryCaptionsSchema = require_dist._enum([
+	"none",
+	"tiles",
+	"all"
+]);
+var NC_SUMMARY_DEFAULT_CAPTIONS = "none";
+/**
 * The AI section — DECLARED IN P1, WIRED IN P2.
 *
 * Nothing in this addon reads it today. It is here so the rule shape does not
@@ -14654,6 +15097,8 @@ var NcSummaryRuleInputSchema = require_dist.object({
 	barrierSeconds: BarrierSecondsField.default(120),
 	targets: TargetsField,
 	template: NcSummaryTemplateSchema.optional(),
+	/** Burned onto the mosaic's title band — and ONLY when `captions` is `all`. */
+	captions: NcSummaryCaptionsSchema.default(NC_SUMMARY_DEFAULT_CAPTIONS),
 	/** Burned onto the mosaic's title band. `''` is reachable and means "no
 	*  caption" — which is why this is not `.min(1)`. */
 	captionText: require_dist.string().max(200).optional(),
@@ -14683,6 +15128,7 @@ var NcSummaryRulePatchSchema = require_dist.object({
 	barrierSeconds: BarrierSecondsField.optional(),
 	targets: TargetsField.optional(),
 	template: NcSummaryTemplateSchema.nullable().optional(),
+	captions: NcSummaryCaptionsSchema.optional(),
 	captionText: require_dist.string().max(200).optional(),
 	deliverEmpty: require_dist.boolean().optional(),
 	priority: PriorityField.optional(),
@@ -15217,14 +15663,19 @@ function isSyntheticId(id) {
 *    snapshot that produced it lists the members being counted and the edge
 *    names one (`chooseOccupancyMediaOwner`), so the tester stands in for that
 *    member exactly as it stands in for the marker.
+*  - and, since 2026-08-15, a `trackId` for both AUDIO kinds: a sound owns no
+*    frame, so production photographs the camera at the match and holds the
+*    bytes on the still shelf under an owner id the subject names
+*    (`audio-still.ts`). The tester's RAM-held frame stands in for exactly that
+*    photograph, and — unlike every other kind here — it is taken the same way
+*    production takes it, at the same moment, from the same cap.
 *
-* An audio episode still freezes neither. It HAS a marker projection, but its
-* id does not reach the notification subject yet, so it remains honestly
-* unattachable — a tester that invented a picture for it would be advertising a
-* feature that does not exist.
+* Only `system-event` remains: an infrastructure event is about no camera at
+* all, so there is nothing to photograph and a tester that invented a picture
+* for it would be advertising a feature that does not exist.
 */
 function triggerCanCarryStill(kind) {
-	return kind === "object-event" || kind === "package-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event";
+	return kind !== "system-event";
 }
 /** The detection provenance production stamps on a subject of this kind. */
 function syntheticSource(kind) {
@@ -15262,7 +15713,7 @@ function audioSubjectOf(input) {
 function buildSyntheticEvent(input, recordId, now) {
 	const kind = input.trigger;
 	const timestamp = input.timestamp ?? now;
-	const carriesTrackId = kind === "object-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event";
+	const carriesTrackId = kind === "object-event" || kind === "track-end" || kind === "device-event" || kind === "occupancy-event" || kind === "audio-event" || kind === "audio-window";
 	return {
 		subject: {
 			kind,
@@ -17842,6 +18293,12 @@ var NotificationCenter = class NotificationCenter {
 	* is the one thing the synthetic producer promises not to do.
 	*/
 	syntheticMedia = /* @__PURE__ */ new Map();
+	/**
+	* The photograph a SOUND rule's notification carries — see `audio-still.ts`.
+	* Null when this wiring has no snapshot cap, which leaves every audio
+	* notification text-only rather than broken.
+	*/
+	audioStills;
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
 	lastNoMatchReportAt = /* @__PURE__ */ new Map();
 	noMatchSuppressed = /* @__PURE__ */ new Map();
@@ -18133,6 +18590,12 @@ var NotificationCenter = class NotificationCenter {
 		this.deps = deps;
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
+		const getSnapshot = deps.getSnapshot;
+		this.audioStills = getSnapshot !== void 0 ? new NcAudioStillShelf({
+			getSnapshot,
+			logger: this.logger.child("audio-still"),
+			now: this.now
+		}) : null;
 		this.rules = new NcRuleStore({
 			store: deps.store,
 			logger: this.logger.child("rules"),
@@ -18210,6 +18673,8 @@ var NotificationCenter = class NotificationCenter {
 			getMediaForOwner: async (ownerKind, ownerId) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
+				const audio = isAudioStillId(ownerId) ? this.audioStills?.get(ownerId) : void 0;
+				if (audio !== void 0) return audio;
 				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
 			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
@@ -18414,6 +18879,7 @@ var NotificationCenter = class NotificationCenter {
 		}
 		this.timelapseScheduler?.stop();
 		this.summaryProducer?.stop();
+		this.audioStills?.clear();
 		this.evaluationActive = false;
 	}
 	/**
@@ -18743,7 +19209,35 @@ var NotificationCenter = class NotificationCenter {
 	* durable guarantee begins at this hook, matching the device-event boundary.
 	*/
 	onAudioEventPersisted(event) {
-		this.consumeEvent(incomingFromAudioEvent(event));
+		this.consumeEvent(incomingFromAudioEvent(event, this.audioStillOwner(event.deviceId, event.timestamp, "legacy")));
+	}
+	/**
+	* Start photographing `deviceId` NOW and return the owner id the audio
+	* subject should name — or `undefined` when nothing would use it.
+	*
+	* **The capture is not awaited.** A sound is transient and a notification
+	* about a scream must not wait on a camera; the bytes land while the outbox
+	* row queues, and the dispatcher's ordinary bounded still-wait picks them up.
+	* That is also why this runs BEFORE the cooldown and the mute are consulted:
+	* by the time a rule's window has been judged the moment is gone.
+	*
+	* **The gate is the RULE's media policy, not the trigger.** Photographing a
+	* camera on every confirmed window for rules that ship text anyway would be a
+	* snapshot at whatever rate the sound happens to occur, for nothing. The rule
+	* cache is an in-memory mirror, so this is not a fallible read (D49) — a
+	* failed one would look exactly like "no rule wants a picture", which is the
+	* direction that DESTROYS the media.
+	*/
+	audioStillOwner(deviceId, atMs, mode) {
+		const shelf = this.audioStills;
+		if (shelf === null || !this.evaluationActive) return void 0;
+		for (const rule of this.rules.listEnabled("immediate")) {
+			if (rule.media.attach === "none") continue;
+			if (!(mode === "condition" ? rule.conditions.audio !== void 0 : rule.conditions.audio === void 0 && referencesAudioClass(rule.conditions.classes))) continue;
+			const devices = rule.conditions.devices;
+			if (devices !== void 0 && devices.length > 0 && !devices.includes(deviceId)) continue;
+			return shelf.capture(deviceId, atMs);
+		}
 	}
 	/**
 	* Called at the package object-event persist site (`PackageDropDetector` —
@@ -18841,7 +19335,7 @@ var NotificationCenter = class NotificationCenter {
 				tags: { deviceId },
 				meta: audioHitMeta(hit)
 			});
-			this.consumeEvent(incomingFromAudioWindow(hit));
+			this.consumeEvent(incomingFromAudioWindow(hit, this.audioStillOwner(deviceId, hit.timestamp, "condition")));
 		}
 	}
 	/**
@@ -19658,6 +20152,19 @@ var NotificationCenter = class NotificationCenter {
 					}
 				});
 			}
+			if (!noOwnerReported && (kind === "audio-window" || kind === "audio-event") && subject.trackId === void 0 && rule.media.attach !== "none") {
+				noOwnerReported = true;
+				this.logger.warn("audio match has no still owner — this notification ships text-only", {
+					tags: { deviceId: subject.deviceId },
+					meta: {
+						recordId: subject.recordId,
+						kind,
+						ruleId: rule.id,
+						rule: rule.name,
+						snapshotWired: this.audioStills !== null
+					}
+				});
+			}
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
 			const entries = this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets, origin, {
 				key,
@@ -19814,6 +20321,7 @@ var NotificationCenter = class NotificationCenter {
 	admitToGroup(rule, subject, now) {
 		const idleSec = rule.groupIdleSec;
 		if (idleSec === void 0 || idleSec <= 0) return { outcome: "disabled" };
+		if (subject.kind === "audio-window" || subject.kind === "audio-event") return { outcome: "disabled" };
 		const trackId = subject.trackId;
 		if (trackId === void 0) return { outcome: "disabled" };
 		const member = {
@@ -23466,88 +23974,6 @@ var embeddingActions = require_dist.defineCustomActions({
 	"embedding.wipe": require_dist.customAction(NoInputSchema, WipeResultSchema, { auth: "admin" })
 });
 //#endregion
-//#region src/pipeline-analytics/retention/orphan-audit-actions.ts
-/**
-* The operator button for the orphan audit.
-*
-* The audit engine, its five bounds and its resumable cursor already existed
-* and had run in `report` mode for weeks; what it had no way to be was
-* *asked*. Its only trigger was a 6-hourly timer reading a durable setting, so
-* draining a standing backlog meant flipping a persistent mode, waiting up to
-* six hours, and remembering to flip it back — with nothing returned to look
-* at. On 2026-08-14 the backlog was 74,700 media rows / 18.9 GB plus 23,296
-* object events and 4,543 CLIP vectors (D161), and that is not a thing to
-* drain by leaving a switch on.
-*
-* Three properties this action does NOT leave to the caller's care:
-*
-*  1. **Dry run is the default.** `mode` omitted means `report`: it counts,
-*     logs and returns, and deletes nothing — regardless of what the durable
-*     `orphanAuditMode` setting says. `reclaim` is a word that has to be
-*     typed. The engine's own default is the same for the same reason.
-*  2. **It is paced.** `pageSize` bounds one read, `maxRowsPerScope` bounds
-*     one pass, `maxReclaimPerScope` bounds the damage, and the engine yields
-*     the thread between pages — `better-sqlite3` is synchronous and shares
-*     hub-main with every live frame.
-*  3. **It answers.** The report comes back per collection with rows AND
-*     bytes, so "did it do anything" is not a question anyone has to infer
-*     from a log line.
-*/
-/**
-* `report` counts; `reclaim` deletes.
-*
-* `.default('report')` is load-bearing, not decoration: the settings form
-* sends `{}` for a button with no fields, and the safe interpretation of an
-* unstated intent here is the one that destroys nothing.
-*/
-var OrphanAuditActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
-var OrphanAuditActionInputSchema = require_dist.object({
-	mode: OrphanAuditActionModeSchema,
-	/**
-	* Start every scope from the top instead of resuming its persisted cursor.
-	*
-	* What draining a backlog wants, and never the default — the cursor exists
-	* so a 6-hourly pass makes progress instead of re-walking the same head.
-	*/
-	restart: require_dist.boolean().optional(),
-	/** Rows read per statement. Smaller = more yields = a gentler pass. */
-	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
-	/** Rows EXAMINED per collection in this pass — the pacing bound. */
-	maxRowsPerScope: require_dist.number().int().min(1).max(2e5).optional(),
-	/** Rows DELETED per collection in this pass — the blast-radius bound. */
-	maxReclaimPerScope: require_dist.number().int().min(1).max(1e5).optional(),
-	/**
-	* Minutes of immunity for a recent row. Protective ONLY — raising it can
-	* exclusively save rows, never select them, which is what keeps this off
-	* the one-age-keyed-sweep guard's books.
-	*/
-	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
-});
-var OrphanAuditScopeReportSchema = require_dist.object({
-	collection: require_dist.string(),
-	examined: require_dist.number(),
-	orphans: require_dist.number(),
-	reclaimed: require_dist.number(),
-	bytesReclaimed: require_dist.number(),
-	exempt: require_dist.number(),
-	withinGrace: require_dist.number(),
-	unresolvable: require_dist.number(),
-	stoppedBy: require_dist.string(),
-	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
-	nextCursor: require_dist.number()
-});
-var OrphanAuditActionResultSchema = require_dist.object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: require_dist.boolean(),
-	mode: require_dist._enum(["report", "reclaim"]),
-	scopes: require_dist.array(OrphanAuditScopeReportSchema),
-	totalOrphans: require_dist.number(),
-	totalReclaimed: require_dist.number(),
-	totalBytesReclaimed: require_dist.number(),
-	durationMs: require_dist.number()
-});
-var orphanAuditActions = require_dist.defineCustomActions({ "retention.orphanAudit": require_dist.customAction(OrphanAuditActionInputSchema, OrphanAuditActionResultSchema, { auth: "admin" }) });
-//#endregion
 //#region src/pipeline-analytics/map-with-concurrency.ts
 /**
 * Apply `mapper` to every item with at most `limit` in flight at once.
@@ -27864,6 +28290,88 @@ var PlateGalleryProvider = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/retention/orphan-audit-actions.ts
+/**
+* The operator button for the orphan audit.
+*
+* The audit engine, its five bounds and its resumable cursor already existed
+* and had run in `report` mode for weeks; what it had no way to be was
+* *asked*. Its only trigger was a 6-hourly timer reading a durable setting, so
+* draining a standing backlog meant flipping a persistent mode, waiting up to
+* six hours, and remembering to flip it back — with nothing returned to look
+* at. On 2026-08-14 the backlog was 74,700 media rows / 18.9 GB plus 23,296
+* object events and 4,543 CLIP vectors (D161), and that is not a thing to
+* drain by leaving a switch on.
+*
+* Three properties this action does NOT leave to the caller's care:
+*
+*  1. **Dry run is the default.** `mode` omitted means `report`: it counts,
+*     logs and returns, and deletes nothing — regardless of what the durable
+*     `orphanAuditMode` setting says. `reclaim` is a word that has to be
+*     typed. The engine's own default is the same for the same reason.
+*  2. **It is paced.** `pageSize` bounds one read, `maxRowsPerScope` bounds
+*     one pass, `maxReclaimPerScope` bounds the damage, and the engine yields
+*     the thread between pages — `better-sqlite3` is synchronous and shares
+*     hub-main with every live frame.
+*  3. **It answers.** The report comes back per collection with rows AND
+*     bytes, so "did it do anything" is not a question anyone has to infer
+*     from a log line.
+*/
+/**
+* `report` counts; `reclaim` deletes.
+*
+* `.default('report')` is load-bearing, not decoration: the settings form
+* sends `{}` for a button with no fields, and the safe interpretation of an
+* unstated intent here is the one that destroys nothing.
+*/
+var OrphanAuditActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
+var OrphanAuditActionInputSchema = require_dist.object({
+	mode: OrphanAuditActionModeSchema,
+	/**
+	* Start every scope from the top instead of resuming its persisted cursor.
+	*
+	* What draining a backlog wants, and never the default — the cursor exists
+	* so a 6-hourly pass makes progress instead of re-walking the same head.
+	*/
+	restart: require_dist.boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per collection in this pass — the pacing bound. */
+	maxRowsPerScope: require_dist.number().int().min(1).max(2e5).optional(),
+	/** Rows DELETED per collection in this pass — the blast-radius bound. */
+	maxReclaimPerScope: require_dist.number().int().min(1).max(1e5).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them, which is what keeps this off
+	* the one-age-keyed-sweep guard's books.
+	*/
+	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
+});
+var OrphanAuditScopeReportSchema = require_dist.object({
+	collection: require_dist.string(),
+	examined: require_dist.number(),
+	orphans: require_dist.number(),
+	reclaimed: require_dist.number(),
+	bytesReclaimed: require_dist.number(),
+	exempt: require_dist.number(),
+	withinGrace: require_dist.number(),
+	unresolvable: require_dist.number(),
+	stoppedBy: require_dist.string(),
+	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
+	nextCursor: require_dist.number()
+});
+var OrphanAuditActionResultSchema = require_dist.object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: require_dist.boolean(),
+	mode: require_dist._enum(["report", "reclaim"]),
+	scopes: require_dist.array(OrphanAuditScopeReportSchema),
+	totalOrphans: require_dist.number(),
+	totalReclaimed: require_dist.number(),
+	totalBytesReclaimed: require_dist.number(),
+	durationMs: require_dist.number()
+});
+var orphanAuditActions = require_dist.defineCustomActions({ "retention.orphanAudit": require_dist.customAction(OrphanAuditActionInputSchema, OrphanAuditActionResultSchema, { auth: "admin" }) });
+//#endregion
 //#region src/pipeline-analytics/videoclips-provider.ts
 var SOURCE = "analytics";
 function clipIdFor(eventId, startMs, endMs) {
@@ -33607,13 +34115,25 @@ var StoragePressureTracker = class {
 };
 //#endregion
 //#region src/pipeline-analytics/store/media-store.ts
+/**
+* `scene` is its own owner kind rather than borrowing `event`.
+*
+* Scene reference thumbnails were written as `ownerKind: 'event'` with an
+* `ownerId` of `scene-<monitorId>-…`, which resolves through
+* `resolveMediaOwner` to `{ kind: 'event', eventId: 'scene-…' }` — an event row
+* that has never existed. The orphan audit therefore classified every
+* operator-captured reference picture as collectable. It is the same class of
+* mistake `identity` and `vehicle` are exempt for: a blob the OPERATOR curated,
+* which nothing else can regenerate and no cascade owns.
+*/
 var OWNER_KINDS = [
 	"event",
 	"track",
 	"face",
 	"identity",
 	"plate",
-	"vehicle"
+	"vehicle",
+	"scene"
 ];
 /**
 * Narrow an arbitrary string to an `OwnerKind`.
@@ -42395,7 +42915,11 @@ function auditableCollections() {
 * exemption lives here now, and the orphan collector — the only sweep that
 * walks media it was not handed by name — reads it.
 */
-var RETENTION_EXEMPT_OWNER_KINDS = new Set(["identity", "vehicle"]);
+var RETENTION_EXEMPT_OWNER_KINDS = new Set([
+	"identity",
+	"vehicle",
+	"scene"
+]);
 function isRetentionExemptOwnerKind(kind) {
 	return RETENTION_EXEMPT_OWNER_KINDS.has(kind);
 }
@@ -45334,22 +45858,6 @@ async function projectSensorMarkers(deps, data, timestamp) {
 	}
 	return landed;
 }
-/** JPEG quality for the downscaled full frame — matches the crop path. */
-var FULL_FRAME_QUALITY = 80;
-/**
-* Downscale an already-encoded JPEG full frame to FIT WITHIN
-* {@link FULL_FRAME_MAX_WIDTH}×{@link FULL_FRAME_MAX_HEIGHT}, preserving aspect
-* ratio (`fit: 'inside'`) and never enlarging a source already smaller than the
-* box. Re-encodes as JPEG. Used before persisting a synthetic sensor/control
-* track's whole-scene snapshot so a raw native-resolution frame (a 4K bedroom
-* at night) is never stored or served — the privacy fix moved to CAPTURE time.
-*/
-async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
-	return (0, sharp.default)(Buffer.from(jpeg)).resize(maxWidth, maxHeight, {
-		fit: "inside",
-		withoutEnlargement: true
-	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
-}
 //#endregion
 //#region src/pipeline-analytics/services/synthetic-track.ts
 /**
@@ -49894,6 +50402,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					addonId: device.addonId
 				};
 			},
+			getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }),
 			identityIdsByName: async () => {
 				const byName = /* @__PURE__ */ new Map();
 				const identities = await stores.identityStore.listIdentities();
@@ -50770,13 +51279,16 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				if (media === null) throw new Error("media store not ready");
 				return media.putReplacing({
 					deviceId,
-					ownerKind: "event",
+					ownerKind: "scene",
 					ownerId,
 					kind: "thumbnailSmall",
 					timestamp,
 					data
 				});
 			},
+			dropMedia: async (mediaId) => {
+				await this.mediaStore?.deleteByKey(mediaId);
+			},
 			mirrorSlice: (deviceId, status) => {
 				this.mirrorSceneSlice(deviceId, status);
 			},