@camstack/addon-post-analysis 1.2.91 → 1.2.93

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CTIUuGRB.js");
+const require_dist = require("../dist-DYoWeRRt.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -8289,6 +8289,8 @@ var en_default = {
 	"system.node-offline.body.worker": "Worker {{nodeId}} is offline",
 	"system.node-inference-unavailable.title": "Node has no usable inference device",
 	"system.node-inference-unavailable.body": "Node {{nodeId}} can no longer run inference — every enabled device is unavailable ({{devices}}). It will not receive cameras until one returns.",
+	"system.addon-crash-loop.title": "Addon stopped after repeated crashes",
+	"system.addon-crash-loop.body": "The {{addons}} addon on node {{nodeId}} crashed {{count}} times in a row and will NOT be restarted. Everything it provides is offline until it is repaired.",
 	"system.detection-blind.title": "Camera detecting nothing",
 	"system.detection-blind.body": {
 		"one": "Camera {{deviceName}} has been analysed for {{minutes}} minute with no detection at all",
@@ -8501,6 +8503,8 @@ var it_default = {
 	"system.node-offline.body.worker": "Il worker {{nodeId}} è offline",
 	"system.node-inference-unavailable.title": "Nodo senza dispositivi di inferenza utilizzabili",
 	"system.node-inference-unavailable.body": "Il nodo {{nodeId}} non può più eseguire inferenza — tutti i dispositivi abilitati non sono disponibili ({{devices}}). Non riceverà camere finché uno non torna disponibile.",
+	"system.addon-crash-loop.title": "Addon fermato dopo ripetuti crash",
+	"system.addon-crash-loop.body": "L'addon {{addons}} sul nodo {{nodeId}} è andato in crash {{count}} volte di seguito e NON verrà riavviato. Tutto ciò che fornisce resta offline finché non viene riparato.",
 	"system.detection-blind.title": "Camera che non rileva nulla",
 	"system.detection-blind.body": {
 		"one": "La camera {{deviceName}} è analizzata da {{minutes}} minuto senza alcun rilevamento",
@@ -10273,6 +10277,27 @@ function incomingFromSystemEvent(event, lookup) {
 				nodeId
 			});
 		}
+		case "addon.runner-failed": {
+			const nodeId = stringField(data, "nodeId");
+			const runnerId = stringField(data, "runnerId");
+			const crashes = numberField(data, "crashesInWindow");
+			if (nodeId === void 0 || runnerId === void 0 || crashes === void 0) return null;
+			const ids = data["addonIds"];
+			const addons = Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
+			return systemSubject({
+				facts,
+				kind: "addon-crash-loop",
+				subject: `addon-crash:${nodeId}:${runnerId}`,
+				titleKey: "system.addon-crash-loop.title",
+				bodyKey: "system.addon-crash-loop.body",
+				textParams: {
+					nodeId,
+					addons: addons.length > 0 ? addons.join(", ") : runnerId,
+					count: String(crashes)
+				},
+				nodeId
+			});
+		}
 		case "pipeline.detection-blind": {
 			const deviceId = numberField(data, "deviceId");
 			const blindForMs = numberField(data, "blindForMs");
@@ -21940,6 +21965,9 @@ function systemEventKeys(kind) {
 }
 /** The arm mode a synthetic alarm event stands in for — see {@link systemEventKeys}. */
 var TEST_ALARM_MODE = "away";
+/** The runner a synthetic `addon-crash-loop` stands in for. A test fire has no
+*  real crashed runner, and a blank one would render "The  addon on node hub". */
+var TEST_CRASHED_RUNNER = "recorder";
 /** The dedup subject the live intake stamps for this kind — same families. */
 function systemEventSubject(kind, scope) {
 	if (kind === "device-disabled" || kind === "device-enabled") return `device-switch:${scope.deviceId ?? 0}`;
@@ -21948,6 +21976,7 @@ function systemEventSubject(kind, scope) {
 	if (kind === "node-online" || kind === "node-offline") return `node:${scope.nodeId ?? "hub"}`;
 	if (kind === "node-inference-unavailable") return `node-inference:${scope.nodeId ?? "hub"}`;
 	if (kind === "detection-blind") return `detection-blind:${scope.deviceId ?? 0}`;
+	if (kind === "addon-crash-loop") return `addon-crash:${scope.nodeId ?? "hub"}:${TEST_CRASHED_RUNNER}`;
 	if (kind === "addon-update-available" || kind === "server-update-available") return `package:${scope.packageName ?? "@camstack/server"}`;
 	if (kind === "addon-updated") return `packages:addon-updated:${scope.packageName ?? "pkg"}`;
 	if (kind === "server-updated") return `server-updated:${scope.nodeId ?? "hub"}`;
@@ -22064,6 +22093,7 @@ function planRuleTest(input) {
 					seconds: "30",
 					devices: "cuda:0",
 					minutes: "15",
+					addons: TEST_CRASHED_RUNNER,
 					list: "@camstack/addon-pipeline 1.0.0 (current 0.0.0)",
 					nodes: "hub",
 					fromVersion: "0.0.0",
@@ -28856,88 +28886,6 @@ var PlateGalleryProvider = class {
 	}
 };
 //#endregion
-//#region src/pipeline-analytics/retention/orphan-audit-actions.ts
-/**
-* The operator button for the orphan audit.
-*
-* The audit engine, its five bounds and its resumable cursor already existed
-* and had run in `report` mode for weeks; what it had no way to be was
-* *asked*. Its only trigger was a 6-hourly timer reading a durable setting, so
-* draining a standing backlog meant flipping a persistent mode, waiting up to
-* six hours, and remembering to flip it back — with nothing returned to look
-* at. On 2026-08-14 the backlog was 74,700 media rows / 18.9 GB plus 23,296
-* object events and 4,543 CLIP vectors (D161), and that is not a thing to
-* drain by leaving a switch on.
-*
-* Three properties this action does NOT leave to the caller's care:
-*
-*  1. **Dry run is the default.** `mode` omitted means `report`: it counts,
-*     logs and returns, and deletes nothing — regardless of what the durable
-*     `orphanAuditMode` setting says. `reclaim` is a word that has to be
-*     typed. The engine's own default is the same for the same reason.
-*  2. **It is paced.** `pageSize` bounds one read, `maxRowsPerScope` bounds
-*     one pass, `maxReclaimPerScope` bounds the damage, and the engine yields
-*     the thread between pages — `better-sqlite3` is synchronous and shares
-*     hub-main with every live frame.
-*  3. **It answers.** The report comes back per collection with rows AND
-*     bytes, so "did it do anything" is not a question anyone has to infer
-*     from a log line.
-*/
-/**
-* `report` counts; `reclaim` deletes.
-*
-* `.default('report')` is load-bearing, not decoration: the settings form
-* sends `{}` for a button with no fields, and the safe interpretation of an
-* unstated intent here is the one that destroys nothing.
-*/
-var OrphanAuditActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
-var OrphanAuditActionInputSchema = require_dist.object({
-	mode: OrphanAuditActionModeSchema,
-	/**
-	* Start every scope from the top instead of resuming its persisted cursor.
-	*
-	* What draining a backlog wants, and never the default — the cursor exists
-	* so a 6-hourly pass makes progress instead of re-walking the same head.
-	*/
-	restart: require_dist.boolean().optional(),
-	/** Rows read per statement. Smaller = more yields = a gentler pass. */
-	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
-	/** Rows EXAMINED per collection in this pass — the pacing bound. */
-	maxRowsPerScope: require_dist.number().int().min(1).max(2e5).optional(),
-	/** Rows DELETED per collection in this pass — the blast-radius bound. */
-	maxReclaimPerScope: require_dist.number().int().min(1).max(1e5).optional(),
-	/**
-	* Minutes of immunity for a recent row. Protective ONLY — raising it can
-	* exclusively save rows, never select them, which is what keeps this off
-	* the one-age-keyed-sweep guard's books.
-	*/
-	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
-});
-var OrphanAuditScopeReportSchema = require_dist.object({
-	collection: require_dist.string(),
-	examined: require_dist.number(),
-	orphans: require_dist.number(),
-	reclaimed: require_dist.number(),
-	bytesReclaimed: require_dist.number(),
-	exempt: require_dist.number(),
-	withinGrace: require_dist.number(),
-	unresolvable: require_dist.number(),
-	stoppedBy: require_dist.string(),
-	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
-	nextCursor: require_dist.number()
-});
-var OrphanAuditActionResultSchema = require_dist.object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: require_dist.boolean(),
-	mode: require_dist._enum(["report", "reclaim"]),
-	scopes: require_dist.array(OrphanAuditScopeReportSchema),
-	totalOrphans: require_dist.number(),
-	totalReclaimed: require_dist.number(),
-	totalBytesReclaimed: require_dist.number(),
-	durationMs: require_dist.number()
-});
-var orphanAuditActions = require_dist.defineCustomActions({ "retention.orphanAudit": require_dist.customAction(OrphanAuditActionInputSchema, OrphanAuditActionResultSchema, { auth: "admin" }) });
-//#endregion
 //#region src/pipeline-analytics/store/storage-pressure.ts
 /**
 * storage-pressure — make a full disk something the system REACTS to, not just
@@ -29104,6 +29052,11 @@ var FACE_MEDIA_OWNER_PREFIX = "face-";
 *  `plate-<trackId>`. Used by `deleteByTracks` to derive the plate crop owners
 *  of a set of tracks without a `trackId` column on media rows. */
 var PLATE_MEDIA_OWNER_PREFIX = "plate-";
+/** Index rows per page inside one presence chunk. Must stay under
+*  `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000) so the engine's backstop can never
+*  silently truncate a page — an owner reported absent because a cap bit would
+*  DELETE a live thumbnail from the surface. */
+var MEDIA_PRESENCE_PAGE_SIZE = 1e3;
 /**
 * Kinds that hold exactly ONE row per `(ownerKind, ownerId)` — the current
 * "best"/rolling/first artefact, never a filmstrip. Their row id + blob path are
@@ -29531,6 +29484,59 @@ var MediaStore = class {
 		});
 	}
 	/**
+	* Which of `ownerIds` hold at least ONE media row — index only, no blob is
+	* opened, no base64 is allocated.
+	*
+	* This is the licence `videoclips` needs to publish a `thumbnail`. The
+	* event-media URL is stamped from a template for every event in the system,
+	* so "the plane is up" was being served as "there are bytes": 64 of one
+	* camera's 179 clips pointed at a 404 on 2026-08-17.
+	*
+	* Batched by `whereIn` and paged by offset. NOT `listInfoByOwner` in a loop:
+	* that is one query per owner, which is the N+1 this exists to prevent (and
+	* `queryObjectByTrackIds` already records what believing `whereIn` was
+	* unavailable cost the search path).
+	*
+	* `deviceId` is the AUTHORIZATION filter, exactly as in `listByOwner`.
+	*
+	* THROWS on a query failure rather than answering partially — a probe that
+	* quietly under-reports reads as "these owners have nothing", and the caller
+	* drops thumbnails that exist.
+	*/
+	async ownersWithMedia(ownerKind, ownerIds, deviceId) {
+		const found = /* @__PURE__ */ new Set();
+		const unique = [...new Set(ownerIds)];
+		for (let i = 0; i < unique.length; i += 200) {
+			const chunk = unique.slice(i, i + 200);
+			const answered = /* @__PURE__ */ new Set();
+			for (let offset = 0;; offset += MEDIA_PRESENCE_PAGE_SIZE) {
+				const rows = await this.store.query.query({
+					collection: MEDIA_COLLECTION,
+					filter: {
+						where: {
+							ownerKind,
+							deviceId
+						},
+						whereIn: { ownerId: chunk },
+						orderBy: {
+							field: "ownerId",
+							direction: "asc"
+						},
+						limit: MEDIA_PRESENCE_PAGE_SIZE,
+						offset
+					}
+				});
+				for (const row of rows) {
+					const ownerId = row.data["ownerId"];
+					if (typeof ownerId === "string") answered.add(ownerId);
+				}
+				if (rows.length < 1e3 || answered.size >= chunk.length) break;
+			}
+			for (const ownerId of answered) found.add(ownerId);
+		}
+		return found;
+	}
+	/**
 	* Delete all media (blobs + index rows) for the given owners of one kind.
 	* Best-effort per row; returns the number of index rows removed.
 	*/
@@ -29878,6 +29884,88 @@ async function reconcileDeviceFromDisk(deps, deviceId) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/retention/orphan-audit-actions.ts
+/**
+* The operator button for the orphan audit.
+*
+* The audit engine, its five bounds and its resumable cursor already existed
+* and had run in `report` mode for weeks; what it had no way to be was
+* *asked*. Its only trigger was a 6-hourly timer reading a durable setting, so
+* draining a standing backlog meant flipping a persistent mode, waiting up to
+* six hours, and remembering to flip it back — with nothing returned to look
+* at. On 2026-08-14 the backlog was 74,700 media rows / 18.9 GB plus 23,296
+* object events and 4,543 CLIP vectors (D161), and that is not a thing to
+* drain by leaving a switch on.
+*
+* Three properties this action does NOT leave to the caller's care:
+*
+*  1. **Dry run is the default.** `mode` omitted means `report`: it counts,
+*     logs and returns, and deletes nothing — regardless of what the durable
+*     `orphanAuditMode` setting says. `reclaim` is a word that has to be
+*     typed. The engine's own default is the same for the same reason.
+*  2. **It is paced.** `pageSize` bounds one read, `maxRowsPerScope` bounds
+*     one pass, `maxReclaimPerScope` bounds the damage, and the engine yields
+*     the thread between pages — `better-sqlite3` is synchronous and shares
+*     hub-main with every live frame.
+*  3. **It answers.** The report comes back per collection with rows AND
+*     bytes, so "did it do anything" is not a question anyone has to infer
+*     from a log line.
+*/
+/**
+* `report` counts; `reclaim` deletes.
+*
+* `.default('report')` is load-bearing, not decoration: the settings form
+* sends `{}` for a button with no fields, and the safe interpretation of an
+* unstated intent here is the one that destroys nothing.
+*/
+var OrphanAuditActionModeSchema = require_dist._enum(["report", "reclaim"]).default("report");
+var OrphanAuditActionInputSchema = require_dist.object({
+	mode: OrphanAuditActionModeSchema,
+	/**
+	* Start every scope from the top instead of resuming its persisted cursor.
+	*
+	* What draining a backlog wants, and never the default — the cursor exists
+	* so a 6-hourly pass makes progress instead of re-walking the same head.
+	*/
+	restart: require_dist.boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: require_dist.number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per collection in this pass — the pacing bound. */
+	maxRowsPerScope: require_dist.number().int().min(1).max(2e5).optional(),
+	/** Rows DELETED per collection in this pass — the blast-radius bound. */
+	maxReclaimPerScope: require_dist.number().int().min(1).max(1e5).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them, which is what keeps this off
+	* the one-age-keyed-sweep guard's books.
+	*/
+	graceMinutes: require_dist.number().int().min(1).max(10080).optional()
+});
+var OrphanAuditScopeReportSchema = require_dist.object({
+	collection: require_dist.string(),
+	examined: require_dist.number(),
+	orphans: require_dist.number(),
+	reclaimed: require_dist.number(),
+	bytesReclaimed: require_dist.number(),
+	exempt: require_dist.number(),
+	withinGrace: require_dist.number(),
+	unresolvable: require_dist.number(),
+	stoppedBy: require_dist.string(),
+	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
+	nextCursor: require_dist.number()
+});
+var OrphanAuditActionResultSchema = require_dist.object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: require_dist.boolean(),
+	mode: require_dist._enum(["report", "reclaim"]),
+	scopes: require_dist.array(OrphanAuditScopeReportSchema),
+	totalOrphans: require_dist.number(),
+	totalReclaimed: require_dist.number(),
+	totalBytesReclaimed: require_dist.number(),
+	durationMs: require_dist.number()
+});
+var orphanAuditActions = require_dist.defineCustomActions({ "retention.orphanAudit": require_dist.customAction(OrphanAuditActionInputSchema, OrphanAuditActionResultSchema, { auth: "admin" }) });
+//#endregion
 //#region src/pipeline-analytics/videoclip-visits.ts
 /**
 * Videoclip visits — the grain a clip should have on an events-mode camera.
@@ -29944,7 +30032,22 @@ function dominantKind(attached) {
 	for (const kind of KIND_ORDER) if (attached.some((a) => a.kind === kind)) return kind;
 	return "motion";
 }
-function visitsToClips(visits, events, pad) {
+/**
+* The instant a recorded still can actually be decoded inside a visit: the
+* midpoint of its LONGEST contiguous range.
+*
+* NOT the midpoint of the visit. A visit spans its holes by construction (it is
+* ranges glued across gaps up to `VISIT_MERGE_GAP_MS`), so the naive midpoint
+* lands in dead air roughly as often as not and the recorder's still route
+* answers 204 for a visit with plenty of footage.
+*/
+function stillInstantMs(ranges) {
+	let best;
+	for (const range of ranges) if (best === void 0 || range.endMs - range.startMs > best.endMs - best.startMs) best = range;
+	if (best === void 0) return void 0;
+	return Math.floor((best.startMs + best.endMs) / 2);
+}
+function visitsToClips(visits, events, pad, vouched) {
 	const tagged = [
 		...events.object.map((event) => ({
 			kind: "object",
@@ -29962,7 +30065,8 @@ function visitsToClips(visits, events, pad) {
 	return visits.map((visit) => {
 		const attached = tagged.filter((t) => eventOverlapsVisit(t.event, visit, pad));
 		const kind = dominantKind(attached);
-		const withThumb = attached.find((a) => a.kind === kind && a.event.mediaUrl) ?? attached.find((a) => a.event.mediaUrl);
+		const withThumb = attached.find((a) => a.kind === kind && a.event.mediaUrl && vouched.has(a.event.id)) ?? attached.find((a) => a.event.mediaUrl && vouched.has(a.event.id));
+		const stillAtMs = stillInstantMs(visit.ranges);
 		return {
 			id: `analytics:${visit.startMs}:${visit.endMs}:${VISIT_EVENT_ID}`,
 			source: "analytics",
@@ -29971,8 +30075,10 @@ function visitsToClips(visits, events, pad) {
 				startMs: visit.startMs,
 				endMs: visit.endMs
 			},
-			thumbnail: withThumb?.event.mediaUrl,
-			eventIds: attached.map((a) => a.event.id),
+			...withThumb?.event.mediaUrl !== void 0 ? { thumbnail: withThumb.event.mediaUrl } : {},
+			...stillAtMs !== void 0 ? { stillAtMs } : {},
+			eventIds: attached.slice(0, 24).map((a) => a.event.id),
+			eventCount: attached.length,
 			holes: [...visit.holes]
 		};
 	}).toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
@@ -29996,6 +30102,17 @@ function visitsToClips(visits, events, pad) {
 * injected fetch/resolve deps so the compose logic is testable without I/O.
 */
 var SOURCE = "analytics";
+/**
+* Backstop on the ANNOTATION read — never on the clip list.
+*
+* A visit is annotated by every event inside it, so the clip `limit` must not
+* reach this fetch (one 615 visit legitimately spans 2 345 motion rows). This
+* bound exists only so a pathological camera-day cannot pull an unbounded page:
+* the store orders `timestamp DESC`, so a truncation drops the OLDEST rows and
+* the EARLIEST visits silently lose their annotations — which is why hitting it
+* is logged, per camera, rather than absorbed.
+*/
+var VISIT_EVENT_FETCH_LIMIT = 5e3;
 function clipIdFor(eventId, startMs, endMs) {
 	return `${SOURCE}:${startMs}:${endMs}:${eventId}`;
 }
@@ -30016,7 +30133,7 @@ function parseClipId(clipId) {
 	};
 }
 /** Map per-kind events into time-ranged clips, newest-first. Pure. */
-function eventsToClips(events, pad) {
+function eventsToClips(events, pad, vouched) {
 	const make = (e, kind) => {
 		const startMs = e.timestamp - pad.preMs;
 		const endMs = e.timestamp + pad.postMs;
@@ -30028,7 +30145,7 @@ function eventsToClips(events, pad) {
 				startMs,
 				endMs
 			},
-			thumbnail: e.mediaUrl
+			...e.mediaUrl !== void 0 && vouched.has(e.id) ? { thumbnail: e.mediaUrl } : {}
 		};
 	};
 	return [
@@ -30037,29 +30154,106 @@ function eventsToClips(events, pad) {
 		...events.audio.map((e) => make(e, "audio"))
 	].toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
 }
+/** Every id in the three buckets, in the order the composers tag them. */
+function allEventIds(events) {
+	return [
+		...events.motion,
+		...events.object,
+		...events.audio
+	].map((e) => e.id);
+}
+/**
+* Resolve the event ids whose `mediaUrl` is backed by real bytes, mirroring
+* `resolveDefaultEventMedia`: the event's OWN media when it has any, else its
+* owning TRACK's. Two batched index reads at most, and the second only over the
+* object events the first did not already answer for — motion and audio are
+* trackless roots, so they never need it.
+*
+* THROWS on a failed read. The caller fails closed on the CLAIM and open on the
+* LIST; swallowing here would collapse those two opposite directions into one.
+*/
+async function resolveVouchedEvents(deviceId, events, fetchMediaOwners) {
+	const eventIds = allEventIds(events);
+	if (eventIds.length === 0) return /* @__PURE__ */ new Set();
+	const ownMedia = await fetchMediaOwners({
+		deviceId,
+		ownerKind: "event",
+		ownerIds: eventIds
+	});
+	const residualTracks = [];
+	const seenTracks = /* @__PURE__ */ new Set();
+	for (const event of events.object) {
+		const trackId = event.trackId;
+		if (trackId === void 0 || ownMedia.has(event.id) || seenTracks.has(trackId)) continue;
+		seenTracks.add(trackId);
+		residualTracks.push(trackId);
+	}
+	const trackMedia = residualTracks.length === 0 ? /* @__PURE__ */ new Set() : await fetchMediaOwners({
+		deviceId,
+		ownerKind: "track",
+		ownerIds: residualTracks
+	});
+	const vouched = new Set(ownMedia);
+	for (const event of events.object) {
+		const trackId = event.trackId;
+		if (trackId !== void 0 && trackMedia.has(trackId)) vouched.add(event.id);
+	}
+	return vouched;
+}
+/** Keep only clips that actually touch the caller's window. The reads are
+*  widened by {@link leftOverhangMs}; the ANSWER is not. */
+function intersectsWindow(clip, since, until) {
+	return clip.timeRange.startMs < until && clip.timeRange.endMs > since;
+}
+/**
+* How far BEFORE `since` the event + availability reads must reach.
+*
+* A visit straddling `since` keeps its heartbeat rows and loses the transition
+* row — the only one that ever carries a snapshot — so the same visit shows a
+* picture or doesn't depending on where the operator scrolled. One wider range
+* scan on an indexed column buys a list that stops changing under the cursor.
+*/
+function leftOverhangMs(pad) {
+	return require_dist.VISIT_MERGE_GAP_MS + pad.preMs;
+}
 function createVideoclipsProvider(deps) {
 	return {
 		listClips: async ({ deviceId, since, until, limit }) => {
+			const readSince = since - leftOverhangMs(deps.defaultPad);
 			const events = await deps.fetchEvents({
 				deviceId,
-				since,
+				since: readSince,
 				until,
-				...deps.fetchAvailability ? {} : { limit }
+				limit: deps.fetchAvailability ? VISIT_EVENT_FETCH_LIMIT : limit
 			});
-			let clips = eventsToClips(events, deps.defaultPad);
+			warnOnTruncatedFetch(deps, deviceId, events);
+			let vouched = /* @__PURE__ */ new Set();
+			try {
+				vouched = await resolveVouchedEvents(deviceId, events, deps.fetchMediaOwners);
+			} catch (err) {
+				deps.logWarn?.("videoclips: media presence read failed — listing without thumbnails", {
+					deviceId,
+					events: allEventIds(events).length,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+			let clips = eventsToClips(events, deps.defaultPad, vouched);
 			if (deps.fetchAvailability) try {
 				clips = visitsToClips(clusterFootageVisits(await deps.fetchAvailability({
 					deviceId,
-					since,
+					since: readSince,
 					until
-				}), require_dist.VISIT_MERGE_GAP_MS), events, deps.defaultPad);
+				}), require_dist.VISIT_MERGE_GAP_MS), events, deps.defaultPad, vouched);
 			} catch (err) {
 				deps.logWarn?.("videoclips: availability read failed — listing unfiltered", {
 					deviceId,
 					error: err instanceof Error ? err.message : String(err)
 				});
 			}
-			return limit != null ? clips.slice(0, limit) : clips;
+			const inWindow = clips.filter((c) => intersectsWindow(c, since, until));
+			const answer = limit != null ? inWindow.slice(0, limit) : inWindow;
+			reportUnvouchedClips(deps, deviceId, answer);
+			return answer;
 		},
 		getClipPlayback: async ({ deviceId, clipId }) => {
 			const parsed = parseClipId(clipId);
@@ -30072,6 +30266,33 @@ function createVideoclipsProvider(deps) {
 		}
 	};
 }
+/** The annotation backstop biting is a SILENT loss of the earliest visits'
+*  events — say so, per camera, instead of shipping a thinner list. */
+function warnOnTruncatedFetch(deps, deviceId, events) {
+	if (!deps.fetchAvailability) return;
+	const truncated = [
+		"motion",
+		"object",
+		"audio"
+	].filter((kind) => events[kind].length >= VISIT_EVENT_FETCH_LIMIT);
+	if (truncated.length === 0) return;
+	deps.logWarn?.("videoclips: annotation fetch truncated — earliest visits lose their events", {
+		deviceId,
+		kinds: truncated,
+		limit: VISIT_EVENT_FETCH_LIMIT
+	});
+}
+/** The operator's acceptance criterion as a number: a rising count on one
+*  camera is its motion-snapshot capturer failing, not a quiet day. */
+function reportUnvouchedClips(deps, deviceId, clips) {
+	const clipsWithoutStill = clips.filter((c) => c.thumbnail === void 0).length;
+	if (clipsWithoutStill === 0) return;
+	deps.logInfo?.("videoclips: visit has no vouched still", {
+		deviceId,
+		clipsWithoutStill,
+		clips: clips.length
+	});
+}
 //#endregion
 //#region src/pipeline-analytics/viewer-settings-actions.ts
 /**
@@ -45918,6 +46139,7 @@ var NC_SYSTEM_EVENT_CATEGORIES = [
 	require_dist.EventCategory.WorkerOffline,
 	require_dist.EventCategory.PipelineNodeInferenceUnavailable,
 	require_dist.EventCategory.PipelineDetectionBlind,
+	require_dist.EventCategory.AddonRunnerFailed,
 	require_dist.EventCategory.UpdateAvailable,
 	require_dist.EventCategory.AddonUpdated,
 	require_dist.EventCategory.SystemRestartCompleted,
@@ -47262,6 +47484,66 @@ var EventMediaDispatcher = class {
 		}
 	}
 };
+var SnapshotTimeoutError$1 = class extends Error {
+	constructor(ms) {
+		super(`snapshot cap timed out after ${ms}ms`);
+		this.name = "SnapshotTimeoutError";
+	}
+};
+function withTimeout$1(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(new SnapshotTimeoutError$1(ms)), ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+var MotionEventSnapshotCapturer = class {
+	deps;
+	snapshotTimeoutMs;
+	constructor(deps) {
+		this.deps = deps;
+		this.snapshotTimeoutMs = deps.snapshotTimeoutMs ?? 2500;
+	}
+	/**
+	* Fetch a still and persist it as the motion event's snapshot. Never
+	* throws — the durable record is the motion row, already inserted by
+	* the caller.
+	*/
+	async capture(input) {
+		let snap;
+		try {
+			snap = await withTimeout$1(this.deps.snapshot.getSnapshot({ deviceId: input.deviceId }), this.snapshotTimeoutMs);
+		} catch (err) {
+			this.deps.onError?.(err instanceof SnapshotTimeoutError$1 ? "snapshotTimeout" : "snapshotFetch", err, input.deviceId);
+			return;
+		}
+		if (snap === null) return;
+		const raw = Buffer.from(snap.base64, "base64");
+		let data = raw;
+		try {
+			data = await downscaleFullFrameJpeg(raw, 960, 540);
+		} catch (err) {
+			this.deps.onError?.("downscaleSnapshot", err, input.deviceId);
+		}
+		try {
+			await this.deps.media.put({
+				deviceId: input.deviceId,
+				ownerKind: "event",
+				ownerId: input.eventId,
+				kind: "snapshot",
+				timestamp: input.timestamp,
+				data
+			});
+		} catch (err) {
+			this.deps.onError?.("snapshotMedia", err, input.deviceId);
+		}
+	}
+};
 /**
 * Project one `DeviceStateChanged` of a mapped sensor/control cap into a
 * synthetic track per camera the event belongs to. Returns the number of
@@ -47358,16 +47640,16 @@ var DEFAULT_DEBOUNCE_MS = 1e4;
 /** A hanging snapshot cap must not stall the sensor state-change path. */
 var DEFAULT_SNAPSHOT_TIMEOUT_MS = 1e4;
 /** Distinguishes a snapshot-cap timeout from a fetch failure for reporting. */
-var SnapshotTimeoutError$1 = class extends Error {
+var SnapshotTimeoutError = class extends Error {
 	constructor(ms) {
 		super(`snapshot cap timed out after ${ms}ms`);
 		this.name = "SnapshotTimeoutError";
 	}
 };
 /** Reject with `SnapshotTimeoutError` if `promise` doesn't settle within `ms`. */
-function withTimeout$1(promise, ms) {
+function withTimeout(promise, ms) {
 	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => reject(new SnapshotTimeoutError$1(ms)), ms);
+		const timer = setTimeout(() => reject(new SnapshotTimeoutError(ms)), ms);
 		promise.then((value) => {
 			clearTimeout(timer);
 			resolve(value);
@@ -47422,11 +47704,11 @@ var SyntheticTrackMaterializer = class {
 	*/
 	async fetchSnapshot(cameraId, timeoutMs) {
 		try {
-			const snap = await withTimeout$1(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), timeoutMs);
+			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), timeoutMs);
 			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"), cameraId);
 			return snap;
 		} catch (err) {
-			this.deps.onError?.(err instanceof SnapshotTimeoutError$1 ? "snapshotTimeout" : "snapshotMedia", err, cameraId);
+			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotMedia", err, cameraId);
 			return null;
 		}
 	}
@@ -47492,66 +47774,6 @@ var SyntheticTrackMaterializer = class {
 		return track;
 	}
 };
-var SnapshotTimeoutError = class extends Error {
-	constructor(ms) {
-		super(`snapshot cap timed out after ${ms}ms`);
-		this.name = "SnapshotTimeoutError";
-	}
-};
-function withTimeout(promise, ms) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => reject(new SnapshotTimeoutError(ms)), ms);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
-var MotionEventSnapshotCapturer = class {
-	deps;
-	snapshotTimeoutMs;
-	constructor(deps) {
-		this.deps = deps;
-		this.snapshotTimeoutMs = deps.snapshotTimeoutMs ?? 2500;
-	}
-	/**
-	* Fetch a still and persist it as the motion event's snapshot. Never
-	* throws — the durable record is the motion row, already inserted by
-	* the caller.
-	*/
-	async capture(input) {
-		let snap;
-		try {
-			snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: input.deviceId }), this.snapshotTimeoutMs);
-		} catch (err) {
-			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotFetch", err, input.deviceId);
-			return;
-		}
-		if (snap === null) return;
-		const raw = Buffer.from(snap.base64, "base64");
-		let data = raw;
-		try {
-			data = await downscaleFullFrameJpeg(raw, 960, 540);
-		} catch (err) {
-			this.deps.onError?.("downscaleSnapshot", err, input.deviceId);
-		}
-		try {
-			await this.deps.media.put({
-				deviceId: input.deviceId,
-				ownerKind: "event",
-				ownerId: input.eventId,
-				kind: "snapshot",
-				timestamp: input.timestamp,
-				data
-			});
-		} catch (err) {
-			this.deps.onError?.("snapshotMedia", err, input.deviceId);
-		}
-	}
-};
 var TrackingSettingsSchema = require_dist.object({
 	/**
 	* How much of a detection's box must lie inside a zone (0-1 fraction of the
@@ -53091,6 +53313,9 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					audio
 				};
 			},
+			fetchMediaOwners: async ({ deviceId, ownerKind, ownerIds }) => {
+				return stores.mediaStore.ownersWithMedia(ownerKind, ownerIds, deviceId);
+			},
 			fetchAvailability: async ({ deviceId, since, until }) => {
 				return (await api.recording.getAvailability.query({
 					deviceId,
@@ -53102,6 +53327,10 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				tags: { deviceId: Number(meta["deviceId"]) },
 				meta
 			}),
+			logInfo: (message, meta) => this.ctx.logger.info(message, {
+				tags: { deviceId: Number(meta["deviceId"]) },
+				meta
+			}),
 			resolvePlayback: async ({ deviceId, startMs, endMs }) => {
 				const manifest = await api.recording.getPlaybackManifest.query({
 					deviceId,