@camstack/addon-post-analysis 1.2.91 → 1.2.93

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as faceGalleryCapability, At as partialRecord, B as VISIT_MERGE_GAP_MS, C as NcSnoozeSchema, Ct as _enum, D as OpsLogEntrySchema, Dt as literal, E as NcTaxonomySchema, Et as discriminatedUnion, F as TIMELAPSE_DENSE_FLOOR_SEC, G as audioModeOf, H as alarmPanelCapability, I as TimelapseRuleInputSchema, J as customAction, K as buildEventKindDescriptor, L as TimelapseRulePatchSchema, M as SCENE_DEFAULT_UNCOVERED_POLICY, Mt as string, N as SCENE_DIVERGED, Nt as unknown, O as RECORDING_EXPORT_MAX_READ_BYTES, Ot as number, P as SceneMonitorSchema, Pt as EventCategory, Q as encodeVectorBase64, R as TimelapseRuleSchema, S as NcSnoozeInputSchema, St as sleep, T as NcSystemEventKindSchema, Tt as boolean, U as assertTimelapseCadences, V as addonWidgetsSourceCapability, W as audioMetricsCapability, X as deriveRecordingMode, Y as defineCustomActions, _ as NcRuleInputSchema, _t as DeviceType, at as pipelineAnalyticsCapability, b as NcRuleTargetSchema, bt as isDeviceScopedCap, c as EVENT_PAD_MS, ct as readTimelapseGeneratedAt, d as NC_ALARM_SYSTEM_EVENT_KINDS, dt as systemEventFilterApplies, f as NC_CONDITION_CATALOG, ft as vectorDimFromBase64, g as NcConditionDescriptorSchema, gt as BaseAddon, h as NC_TAXONOMY, ht as errMsg, i as DETECTION_MACRO_CLASSES, it as notificationRulesCapability, j as SCENE_DEFAULT_ANCHOR_THRESHOLD, jt as record, k as RetrainStatusSchema, kt as object, l as LabelAttributionSchema, lt as sceneMonitorCapability, mt as zoneAnalyticsCapability, n as DEFAULT_EVENT_COLOR, nt as isScheduleActive, o as DeclaredDevices, ot as plateGalleryCapability, p as NC_DEFAULT_SNOOZE_MINUTES, pt as videoclipsCapability, q as cosineSimilarity$1, rt as kebabToCamel, s as EVENT_KIND_BY_CAP, st as readDeviceStateFrom, t as BaseDevice, tt as isDetectionMacroClass, u as MACRO_LABELS, ut as subKindsOf, v as NcRulePatchSchema, vt as createEvent, w as NcSnoozeSuppressedSchema, wt as array, x as NcScheduleSchema, xt as nodePin, y as NcRuleSchema, yt as hydrateSchema, z as TrackSourceSchema } from "../dist-CquggoRC.mjs";
+import { $ as encodeVectorBase64, A as RetrainStatusSchema, At as literal, B as TrackSourceSchema, C as NcSnoozeSchema, Ct as isDeviceScopedCap, D as OpsLogEntrySchema, Dt as array, E as NcTaxonomySchema, Et as _enum, F as SceneMonitorSchema, Ft as string, G as audioMetricsCapability, H as addonWidgetsSourceCapability, I as TIMELAPSE_DENSE_FLOOR_SEC, It as unknown, J as cosineSimilarity$1, K as audioModeOf, L as TimelapseRuleInputSchema, Lt as EventCategory, M as SCENE_DEFAULT_ANCHOR_THRESHOLD, Mt as object, N as SCENE_DEFAULT_UNCOVERED_POLICY, Nt as partialRecord, Ot as boolean, P as SCENE_DIVERGED, Pt as record, R as TimelapseRulePatchSchema, S as NcSnoozeInputSchema, St as hydrateSchema, T as NcSystemEventKindSchema, Tt as sleep, U as alarmPanelCapability, V as VISIT_MERGE_GAP_MS, W as assertTimelapseCadences, X as defineCustomActions, Y as customAction, Z as deriveRecordingMode, _ as NcRuleInputSchema, _t as zoneAnalyticsCapability, at as notificationRulesCapability, b as NcRuleTargetSchema, bt as DeviceType, c as EVENT_PAD_MS, ct as plateGalleryCapability, d as NC_ALARM_SYSTEM_EVENT_KINDS, et as faceGalleryCapability, f as NC_CONDITION_CATALOG, ft as sceneMonitorCapability, g as NcConditionDescriptorSchema, gt as videoclipsCapability, h as NC_TAXONOMY, ht as vectorDimFromBase64, i as DETECTION_MACRO_CLASSES, it as kebabToCamel, jt as number, k as RECORDING_EXPORT_MAX_READ_BYTES, kt as discriminatedUnion, l as LabelAttributionSchema, lt as readDeviceStateFrom, mt as systemEventFilterApplies, n as DEFAULT_EVENT_COLOR, nt as isDetectionMacroClass, o as DeclaredDevices, p as NC_DEFAULT_SNOOZE_MINUTES, pt as subKindsOf, q as buildEventKindDescriptor, rt as isScheduleActive, s as EVENT_KIND_BY_CAP, st as pipelineAnalyticsCapability, t as BaseDevice, u as MACRO_LABELS, ut as readTimelapseGeneratedAt, v as NcRulePatchSchema, vt as errMsg, w as NcSnoozeSuppressedSchema, wt as nodePin, x as NcScheduleSchema, xt as createEvent, y as NcRuleSchema, yt as BaseAddon, z as TimelapseRuleSchema } from "../dist-3QRyOemL.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -8282,6 +8282,8 @@ var en_default = {
 	"system.node-offline.body.worker": "Worker {{nodeId}} is offline",
 	"system.node-inference-unavailable.title": "Node has no usable inference device",
 	"system.node-inference-unavailable.body": "Node {{nodeId}} can no longer run inference — every enabled device is unavailable ({{devices}}). It will not receive cameras until one returns.",
+	"system.addon-crash-loop.title": "Addon stopped after repeated crashes",
+	"system.addon-crash-loop.body": "The {{addons}} addon on node {{nodeId}} crashed {{count}} times in a row and will NOT be restarted. Everything it provides is offline until it is repaired.",
 	"system.detection-blind.title": "Camera detecting nothing",
 	"system.detection-blind.body": {
 		"one": "Camera {{deviceName}} has been analysed for {{minutes}} minute with no detection at all",
@@ -8494,6 +8496,8 @@ var it_default = {
 	"system.node-offline.body.worker": "Il worker {{nodeId}} è offline",
 	"system.node-inference-unavailable.title": "Nodo senza dispositivi di inferenza utilizzabili",
 	"system.node-inference-unavailable.body": "Il nodo {{nodeId}} non può più eseguire inferenza — tutti i dispositivi abilitati non sono disponibili ({{devices}}). Non riceverà camere finché uno non torna disponibile.",
+	"system.addon-crash-loop.title": "Addon fermato dopo ripetuti crash",
+	"system.addon-crash-loop.body": "L'addon {{addons}} sul nodo {{nodeId}} è andato in crash {{count}} volte di seguito e NON verrà riavviato. Tutto ciò che fornisce resta offline finché non viene riparato.",
 	"system.detection-blind.title": "Camera che non rileva nulla",
 	"system.detection-blind.body": {
 		"one": "La camera {{deviceName}} è analizzata da {{minutes}} minuto senza alcun rilevamento",
@@ -10266,6 +10270,27 @@ function incomingFromSystemEvent(event, lookup) {
 				nodeId
 			});
 		}
+		case "addon.runner-failed": {
+			const nodeId = stringField(data, "nodeId");
+			const runnerId = stringField(data, "runnerId");
+			const crashes = numberField(data, "crashesInWindow");
+			if (nodeId === void 0 || runnerId === void 0 || crashes === void 0) return null;
+			const ids = data["addonIds"];
+			const addons = Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
+			return systemSubject({
+				facts,
+				kind: "addon-crash-loop",
+				subject: `addon-crash:${nodeId}:${runnerId}`,
+				titleKey: "system.addon-crash-loop.title",
+				bodyKey: "system.addon-crash-loop.body",
+				textParams: {
+					nodeId,
+					addons: addons.length > 0 ? addons.join(", ") : runnerId,
+					count: String(crashes)
+				},
+				nodeId
+			});
+		}
 		case "pipeline.detection-blind": {
 			const deviceId = numberField(data, "deviceId");
 			const blindForMs = numberField(data, "blindForMs");
@@ -21918,6 +21943,9 @@ function systemEventKeys(kind) {
 }
 /** The arm mode a synthetic alarm event stands in for — see {@link systemEventKeys}. */
 var TEST_ALARM_MODE = "away";
+/** The runner a synthetic `addon-crash-loop` stands in for. A test fire has no
+*  real crashed runner, and a blank one would render "The  addon on node hub". */
+var TEST_CRASHED_RUNNER = "recorder";
 /** The dedup subject the live intake stamps for this kind — same families. */
 function systemEventSubject(kind, scope) {
 	if (kind === "device-disabled" || kind === "device-enabled") return `device-switch:${scope.deviceId ?? 0}`;
@@ -21926,6 +21954,7 @@ function systemEventSubject(kind, scope) {
 	if (kind === "node-online" || kind === "node-offline") return `node:${scope.nodeId ?? "hub"}`;
 	if (kind === "node-inference-unavailable") return `node-inference:${scope.nodeId ?? "hub"}`;
 	if (kind === "detection-blind") return `detection-blind:${scope.deviceId ?? 0}`;
+	if (kind === "addon-crash-loop") return `addon-crash:${scope.nodeId ?? "hub"}:${TEST_CRASHED_RUNNER}`;
 	if (kind === "addon-update-available" || kind === "server-update-available") return `package:${scope.packageName ?? "@camstack/server"}`;
 	if (kind === "addon-updated") return `packages:addon-updated:${scope.packageName ?? "pkg"}`;
 	if (kind === "server-updated") return `server-updated:${scope.nodeId ?? "hub"}`;
@@ -22042,6 +22071,7 @@ function planRuleTest(input) {
 					seconds: "30",
 					devices: "cuda:0",
 					minutes: "15",
+					addons: TEST_CRASHED_RUNNER,
 					list: "@camstack/addon-pipeline 1.0.0 (current 0.0.0)",
 					nodes: "hub",
 					fromVersion: "0.0.0",
@@ -28833,51 +28863,6 @@ var PlateGalleryProvider = class {
 		};
 	}
 };
-var OrphanAuditActionInputSchema = object({
-	mode: _enum(["report", "reclaim"]).default("report"),
-	/**
-	* Start every scope from the top instead of resuming its persisted cursor.
-	*
-	* What draining a backlog wants, and never the default — the cursor exists
-	* so a 6-hourly pass makes progress instead of re-walking the same head.
-	*/
-	restart: boolean().optional(),
-	/** Rows read per statement. Smaller = more yields = a gentler pass. */
-	pageSize: number().int().min(50).max(5e3).optional(),
-	/** Rows EXAMINED per collection in this pass — the pacing bound. */
-	maxRowsPerScope: number().int().min(1).max(2e5).optional(),
-	/** Rows DELETED per collection in this pass — the blast-radius bound. */
-	maxReclaimPerScope: number().int().min(1).max(1e5).optional(),
-	/**
-	* Minutes of immunity for a recent row. Protective ONLY — raising it can
-	* exclusively save rows, never select them, which is what keeps this off
-	* the one-age-keyed-sweep guard's books.
-	*/
-	graceMinutes: number().int().min(1).max(10080).optional()
-});
-var OrphanAuditScopeReportSchema = object({
-	collection: string(),
-	examined: number(),
-	orphans: number(),
-	reclaimed: number(),
-	bytesReclaimed: number(),
-	exempt: number(),
-	withinGrace: number(),
-	unresolvable: number(),
-	stoppedBy: string(),
-	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
-	nextCursor: number()
-});
-var orphanAuditActions = defineCustomActions({ "retention.orphanAudit": customAction(OrphanAuditActionInputSchema, object({
-	/** `false` when a pass was already in flight — nothing was done. */
-	ran: boolean(),
-	mode: _enum(["report", "reclaim"]),
-	scopes: array(OrphanAuditScopeReportSchema),
-	totalOrphans: number(),
-	totalReclaimed: number(),
-	totalBytesReclaimed: number(),
-	durationMs: number()
-}), { auth: "admin" }) });
 //#endregion
 //#region src/pipeline-analytics/store/storage-pressure.ts
 /**
@@ -29045,6 +29030,11 @@ var FACE_MEDIA_OWNER_PREFIX = "face-";
 *  `plate-<trackId>`. Used by `deleteByTracks` to derive the plate crop owners
 *  of a set of tracks without a `trackId` column on media rows. */
 var PLATE_MEDIA_OWNER_PREFIX = "plate-";
+/** Index rows per page inside one presence chunk. Must stay under
+*  `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000) so the engine's backstop can never
+*  silently truncate a page — an owner reported absent because a cap bit would
+*  DELETE a live thumbnail from the surface. */
+var MEDIA_PRESENCE_PAGE_SIZE = 1e3;
 /**
 * Kinds that hold exactly ONE row per `(ownerKind, ownerId)` — the current
 * "best"/rolling/first artefact, never a filmstrip. Their row id + blob path are
@@ -29472,6 +29462,59 @@ var MediaStore = class {
 		});
 	}
 	/**
+	* Which of `ownerIds` hold at least ONE media row — index only, no blob is
+	* opened, no base64 is allocated.
+	*
+	* This is the licence `videoclips` needs to publish a `thumbnail`. The
+	* event-media URL is stamped from a template for every event in the system,
+	* so "the plane is up" was being served as "there are bytes": 64 of one
+	* camera's 179 clips pointed at a 404 on 2026-08-17.
+	*
+	* Batched by `whereIn` and paged by offset. NOT `listInfoByOwner` in a loop:
+	* that is one query per owner, which is the N+1 this exists to prevent (and
+	* `queryObjectByTrackIds` already records what believing `whereIn` was
+	* unavailable cost the search path).
+	*
+	* `deviceId` is the AUTHORIZATION filter, exactly as in `listByOwner`.
+	*
+	* THROWS on a query failure rather than answering partially — a probe that
+	* quietly under-reports reads as "these owners have nothing", and the caller
+	* drops thumbnails that exist.
+	*/
+	async ownersWithMedia(ownerKind, ownerIds, deviceId) {
+		const found = /* @__PURE__ */ new Set();
+		const unique = [...new Set(ownerIds)];
+		for (let i = 0; i < unique.length; i += 200) {
+			const chunk = unique.slice(i, i + 200);
+			const answered = /* @__PURE__ */ new Set();
+			for (let offset = 0;; offset += MEDIA_PRESENCE_PAGE_SIZE) {
+				const rows = await this.store.query.query({
+					collection: MEDIA_COLLECTION,
+					filter: {
+						where: {
+							ownerKind,
+							deviceId
+						},
+						whereIn: { ownerId: chunk },
+						orderBy: {
+							field: "ownerId",
+							direction: "asc"
+						},
+						limit: MEDIA_PRESENCE_PAGE_SIZE,
+						offset
+					}
+				});
+				for (const row of rows) {
+					const ownerId = row.data["ownerId"];
+					if (typeof ownerId === "string") answered.add(ownerId);
+				}
+				if (rows.length < 1e3 || answered.size >= chunk.length) break;
+			}
+			for (const ownerId of answered) found.add(ownerId);
+		}
+		return found;
+	}
+	/**
 	* Delete all media (blobs + index rows) for the given owners of one kind.
 	* Best-effort per row; returns the number of index rows removed.
 	*/
@@ -29818,6 +29861,51 @@ async function reconcileDeviceFromDisk(deps, deviceId) {
 		events: doomedEvents.length
 	};
 }
+var OrphanAuditActionInputSchema = object({
+	mode: _enum(["report", "reclaim"]).default("report"),
+	/**
+	* Start every scope from the top instead of resuming its persisted cursor.
+	*
+	* What draining a backlog wants, and never the default — the cursor exists
+	* so a 6-hourly pass makes progress instead of re-walking the same head.
+	*/
+	restart: boolean().optional(),
+	/** Rows read per statement. Smaller = more yields = a gentler pass. */
+	pageSize: number().int().min(50).max(5e3).optional(),
+	/** Rows EXAMINED per collection in this pass — the pacing bound. */
+	maxRowsPerScope: number().int().min(1).max(2e5).optional(),
+	/** Rows DELETED per collection in this pass — the blast-radius bound. */
+	maxReclaimPerScope: number().int().min(1).max(1e5).optional(),
+	/**
+	* Minutes of immunity for a recent row. Protective ONLY — raising it can
+	* exclusively save rows, never select them, which is what keeps this off
+	* the one-age-keyed-sweep guard's books.
+	*/
+	graceMinutes: number().int().min(1).max(10080).optional()
+});
+var OrphanAuditScopeReportSchema = object({
+	collection: string(),
+	examined: number(),
+	orphans: number(),
+	reclaimed: number(),
+	bytesReclaimed: number(),
+	exempt: number(),
+	withinGrace: number(),
+	unresolvable: number(),
+	stoppedBy: string(),
+	/** Where the NEXT pass resumes. `0` = the scope was walked to the end. */
+	nextCursor: number()
+});
+var orphanAuditActions = defineCustomActions({ "retention.orphanAudit": customAction(OrphanAuditActionInputSchema, object({
+	/** `false` when a pass was already in flight — nothing was done. */
+	ran: boolean(),
+	mode: _enum(["report", "reclaim"]),
+	scopes: array(OrphanAuditScopeReportSchema),
+	totalOrphans: number(),
+	totalReclaimed: number(),
+	totalBytesReclaimed: number(),
+	durationMs: number()
+}), { auth: "admin" }) });
 //#endregion
 //#region src/pipeline-analytics/videoclip-visits.ts
 /**
@@ -29885,7 +29973,22 @@ function dominantKind(attached) {
 	for (const kind of KIND_ORDER) if (attached.some((a) => a.kind === kind)) return kind;
 	return "motion";
 }
-function visitsToClips(visits, events, pad) {
+/**
+* The instant a recorded still can actually be decoded inside a visit: the
+* midpoint of its LONGEST contiguous range.
+*
+* NOT the midpoint of the visit. A visit spans its holes by construction (it is
+* ranges glued across gaps up to `VISIT_MERGE_GAP_MS`), so the naive midpoint
+* lands in dead air roughly as often as not and the recorder's still route
+* answers 204 for a visit with plenty of footage.
+*/
+function stillInstantMs(ranges) {
+	let best;
+	for (const range of ranges) if (best === void 0 || range.endMs - range.startMs > best.endMs - best.startMs) best = range;
+	if (best === void 0) return void 0;
+	return Math.floor((best.startMs + best.endMs) / 2);
+}
+function visitsToClips(visits, events, pad, vouched) {
 	const tagged = [
 		...events.object.map((event) => ({
 			kind: "object",
@@ -29903,7 +30006,8 @@ function visitsToClips(visits, events, pad) {
 	return visits.map((visit) => {
 		const attached = tagged.filter((t) => eventOverlapsVisit(t.event, visit, pad));
 		const kind = dominantKind(attached);
-		const withThumb = attached.find((a) => a.kind === kind && a.event.mediaUrl) ?? attached.find((a) => a.event.mediaUrl);
+		const withThumb = attached.find((a) => a.kind === kind && a.event.mediaUrl && vouched.has(a.event.id)) ?? attached.find((a) => a.event.mediaUrl && vouched.has(a.event.id));
+		const stillAtMs = stillInstantMs(visit.ranges);
 		return {
 			id: `analytics:${visit.startMs}:${visit.endMs}:${VISIT_EVENT_ID}`,
 			source: "analytics",
@@ -29912,8 +30016,10 @@ function visitsToClips(visits, events, pad) {
 				startMs: visit.startMs,
 				endMs: visit.endMs
 			},
-			thumbnail: withThumb?.event.mediaUrl,
-			eventIds: attached.map((a) => a.event.id),
+			...withThumb?.event.mediaUrl !== void 0 ? { thumbnail: withThumb.event.mediaUrl } : {},
+			...stillAtMs !== void 0 ? { stillAtMs } : {},
+			eventIds: attached.slice(0, 24).map((a) => a.event.id),
+			eventCount: attached.length,
 			holes: [...visit.holes]
 		};
 	}).toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
@@ -29937,6 +30043,17 @@ function visitsToClips(visits, events, pad) {
 * injected fetch/resolve deps so the compose logic is testable without I/O.
 */
 var SOURCE = "analytics";
+/**
+* Backstop on the ANNOTATION read — never on the clip list.
+*
+* A visit is annotated by every event inside it, so the clip `limit` must not
+* reach this fetch (one 615 visit legitimately spans 2 345 motion rows). This
+* bound exists only so a pathological camera-day cannot pull an unbounded page:
+* the store orders `timestamp DESC`, so a truncation drops the OLDEST rows and
+* the EARLIEST visits silently lose their annotations — which is why hitting it
+* is logged, per camera, rather than absorbed.
+*/
+var VISIT_EVENT_FETCH_LIMIT = 5e3;
 function clipIdFor(eventId, startMs, endMs) {
 	return `${SOURCE}:${startMs}:${endMs}:${eventId}`;
 }
@@ -29957,7 +30074,7 @@ function parseClipId(clipId) {
 	};
 }
 /** Map per-kind events into time-ranged clips, newest-first. Pure. */
-function eventsToClips(events, pad) {
+function eventsToClips(events, pad, vouched) {
 	const make = (e, kind) => {
 		const startMs = e.timestamp - pad.preMs;
 		const endMs = e.timestamp + pad.postMs;
@@ -29969,7 +30086,7 @@ function eventsToClips(events, pad) {
 				startMs,
 				endMs
 			},
-			thumbnail: e.mediaUrl
+			...e.mediaUrl !== void 0 && vouched.has(e.id) ? { thumbnail: e.mediaUrl } : {}
 		};
 	};
 	return [
@@ -29978,29 +30095,106 @@ function eventsToClips(events, pad) {
 		...events.audio.map((e) => make(e, "audio"))
 	].toSorted((a, b) => b.timeRange.startMs - a.timeRange.startMs);
 }
+/** Every id in the three buckets, in the order the composers tag them. */
+function allEventIds(events) {
+	return [
+		...events.motion,
+		...events.object,
+		...events.audio
+	].map((e) => e.id);
+}
+/**
+* Resolve the event ids whose `mediaUrl` is backed by real bytes, mirroring
+* `resolveDefaultEventMedia`: the event's OWN media when it has any, else its
+* owning TRACK's. Two batched index reads at most, and the second only over the
+* object events the first did not already answer for — motion and audio are
+* trackless roots, so they never need it.
+*
+* THROWS on a failed read. The caller fails closed on the CLAIM and open on the
+* LIST; swallowing here would collapse those two opposite directions into one.
+*/
+async function resolveVouchedEvents(deviceId, events, fetchMediaOwners) {
+	const eventIds = allEventIds(events);
+	if (eventIds.length === 0) return /* @__PURE__ */ new Set();
+	const ownMedia = await fetchMediaOwners({
+		deviceId,
+		ownerKind: "event",
+		ownerIds: eventIds
+	});
+	const residualTracks = [];
+	const seenTracks = /* @__PURE__ */ new Set();
+	for (const event of events.object) {
+		const trackId = event.trackId;
+		if (trackId === void 0 || ownMedia.has(event.id) || seenTracks.has(trackId)) continue;
+		seenTracks.add(trackId);
+		residualTracks.push(trackId);
+	}
+	const trackMedia = residualTracks.length === 0 ? /* @__PURE__ */ new Set() : await fetchMediaOwners({
+		deviceId,
+		ownerKind: "track",
+		ownerIds: residualTracks
+	});
+	const vouched = new Set(ownMedia);
+	for (const event of events.object) {
+		const trackId = event.trackId;
+		if (trackId !== void 0 && trackMedia.has(trackId)) vouched.add(event.id);
+	}
+	return vouched;
+}
+/** Keep only clips that actually touch the caller's window. The reads are
+*  widened by {@link leftOverhangMs}; the ANSWER is not. */
+function intersectsWindow(clip, since, until) {
+	return clip.timeRange.startMs < until && clip.timeRange.endMs > since;
+}
+/**
+* How far BEFORE `since` the event + availability reads must reach.
+*
+* A visit straddling `since` keeps its heartbeat rows and loses the transition
+* row — the only one that ever carries a snapshot — so the same visit shows a
+* picture or doesn't depending on where the operator scrolled. One wider range
+* scan on an indexed column buys a list that stops changing under the cursor.
+*/
+function leftOverhangMs(pad) {
+	return VISIT_MERGE_GAP_MS + pad.preMs;
+}
 function createVideoclipsProvider(deps) {
 	return {
 		listClips: async ({ deviceId, since, until, limit }) => {
+			const readSince = since - leftOverhangMs(deps.defaultPad);
 			const events = await deps.fetchEvents({
 				deviceId,
-				since,
+				since: readSince,
 				until,
-				...deps.fetchAvailability ? {} : { limit }
+				limit: deps.fetchAvailability ? VISIT_EVENT_FETCH_LIMIT : limit
 			});
-			let clips = eventsToClips(events, deps.defaultPad);
+			warnOnTruncatedFetch(deps, deviceId, events);
+			let vouched = /* @__PURE__ */ new Set();
+			try {
+				vouched = await resolveVouchedEvents(deviceId, events, deps.fetchMediaOwners);
+			} catch (err) {
+				deps.logWarn?.("videoclips: media presence read failed — listing without thumbnails", {
+					deviceId,
+					events: allEventIds(events).length,
+					error: err instanceof Error ? err.message : String(err)
+				});
+			}
+			let clips = eventsToClips(events, deps.defaultPad, vouched);
 			if (deps.fetchAvailability) try {
 				clips = visitsToClips(clusterFootageVisits(await deps.fetchAvailability({
 					deviceId,
-					since,
+					since: readSince,
 					until
-				}), VISIT_MERGE_GAP_MS), events, deps.defaultPad);
+				}), VISIT_MERGE_GAP_MS), events, deps.defaultPad, vouched);
 			} catch (err) {
 				deps.logWarn?.("videoclips: availability read failed — listing unfiltered", {
 					deviceId,
 					error: err instanceof Error ? err.message : String(err)
 				});
 			}
-			return limit != null ? clips.slice(0, limit) : clips;
+			const inWindow = clips.filter((c) => intersectsWindow(c, since, until));
+			const answer = limit != null ? inWindow.slice(0, limit) : inWindow;
+			reportUnvouchedClips(deps, deviceId, answer);
+			return answer;
 		},
 		getClipPlayback: async ({ deviceId, clipId }) => {
 			const parsed = parseClipId(clipId);
@@ -30013,6 +30207,33 @@ function createVideoclipsProvider(deps) {
 		}
 	};
 }
+/** The annotation backstop biting is a SILENT loss of the earliest visits'
+*  events — say so, per camera, instead of shipping a thinner list. */
+function warnOnTruncatedFetch(deps, deviceId, events) {
+	if (!deps.fetchAvailability) return;
+	const truncated = [
+		"motion",
+		"object",
+		"audio"
+	].filter((kind) => events[kind].length >= VISIT_EVENT_FETCH_LIMIT);
+	if (truncated.length === 0) return;
+	deps.logWarn?.("videoclips: annotation fetch truncated — earliest visits lose their events", {
+		deviceId,
+		kinds: truncated,
+		limit: VISIT_EVENT_FETCH_LIMIT
+	});
+}
+/** The operator's acceptance criterion as a number: a rising count on one
+*  camera is its motion-snapshot capturer failing, not a quiet day. */
+function reportUnvouchedClips(deps, deviceId, clips) {
+	const clipsWithoutStill = clips.filter((c) => c.thumbnail === void 0).length;
+	if (clipsWithoutStill === 0) return;
+	deps.logInfo?.("videoclips: visit has no vouched still", {
+		deviceId,
+		clipsWithoutStill,
+		clips: clips.length
+	});
+}
 //#endregion
 //#region src/pipeline-analytics/viewer-settings-actions.ts
 /**
@@ -45858,6 +46079,7 @@ var NC_SYSTEM_EVENT_CATEGORIES = [
 	EventCategory.WorkerOffline,
 	EventCategory.PipelineNodeInferenceUnavailable,
 	EventCategory.PipelineDetectionBlind,
+	EventCategory.AddonRunnerFailed,
 	EventCategory.UpdateAvailable,
 	EventCategory.AddonUpdated,
 	EventCategory.SystemRestartCompleted,
@@ -47202,6 +47424,66 @@ var EventMediaDispatcher = class {
 		}
 	}
 };
+var SnapshotTimeoutError$1 = class extends Error {
+	constructor(ms) {
+		super(`snapshot cap timed out after ${ms}ms`);
+		this.name = "SnapshotTimeoutError";
+	}
+};
+function withTimeout$1(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(new SnapshotTimeoutError$1(ms)), ms);
+		promise.then((value) => {
+			clearTimeout(timer);
+			resolve(value);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err instanceof Error ? err : new Error(String(err)));
+		});
+	});
+}
+var MotionEventSnapshotCapturer = class {
+	deps;
+	snapshotTimeoutMs;
+	constructor(deps) {
+		this.deps = deps;
+		this.snapshotTimeoutMs = deps.snapshotTimeoutMs ?? 2500;
+	}
+	/**
+	* Fetch a still and persist it as the motion event's snapshot. Never
+	* throws — the durable record is the motion row, already inserted by
+	* the caller.
+	*/
+	async capture(input) {
+		let snap;
+		try {
+			snap = await withTimeout$1(this.deps.snapshot.getSnapshot({ deviceId: input.deviceId }), this.snapshotTimeoutMs);
+		} catch (err) {
+			this.deps.onError?.(err instanceof SnapshotTimeoutError$1 ? "snapshotTimeout" : "snapshotFetch", err, input.deviceId);
+			return;
+		}
+		if (snap === null) return;
+		const raw = Buffer.from(snap.base64, "base64");
+		let data = raw;
+		try {
+			data = await downscaleFullFrameJpeg(raw, 960, 540);
+		} catch (err) {
+			this.deps.onError?.("downscaleSnapshot", err, input.deviceId);
+		}
+		try {
+			await this.deps.media.put({
+				deviceId: input.deviceId,
+				ownerKind: "event",
+				ownerId: input.eventId,
+				kind: "snapshot",
+				timestamp: input.timestamp,
+				data
+			});
+		} catch (err) {
+			this.deps.onError?.("snapshotMedia", err, input.deviceId);
+		}
+	}
+};
 /**
 * Project one `DeviceStateChanged` of a mapped sensor/control cap into a
 * synthetic track per camera the event belongs to. Returns the number of
@@ -47298,16 +47580,16 @@ var DEFAULT_DEBOUNCE_MS = 1e4;
 /** A hanging snapshot cap must not stall the sensor state-change path. */
 var DEFAULT_SNAPSHOT_TIMEOUT_MS = 1e4;
 /** Distinguishes a snapshot-cap timeout from a fetch failure for reporting. */
-var SnapshotTimeoutError$1 = class extends Error {
+var SnapshotTimeoutError = class extends Error {
 	constructor(ms) {
 		super(`snapshot cap timed out after ${ms}ms`);
 		this.name = "SnapshotTimeoutError";
 	}
 };
 /** Reject with `SnapshotTimeoutError` if `promise` doesn't settle within `ms`. */
-function withTimeout$1(promise, ms) {
+function withTimeout(promise, ms) {
 	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => reject(new SnapshotTimeoutError$1(ms)), ms);
+		const timer = setTimeout(() => reject(new SnapshotTimeoutError(ms)), ms);
 		promise.then((value) => {
 			clearTimeout(timer);
 			resolve(value);
@@ -47362,11 +47644,11 @@ var SyntheticTrackMaterializer = class {
 	*/
 	async fetchSnapshot(cameraId, timeoutMs) {
 		try {
-			const snap = await withTimeout$1(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), timeoutMs);
+			const snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: cameraId }), timeoutMs);
 			if (snap === null) this.deps.onError?.("getSnapshot", /* @__PURE__ */ new Error("snapshot returned null"), cameraId);
 			return snap;
 		} catch (err) {
-			this.deps.onError?.(err instanceof SnapshotTimeoutError$1 ? "snapshotTimeout" : "snapshotMedia", err, cameraId);
+			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotMedia", err, cameraId);
 			return null;
 		}
 	}
@@ -47432,66 +47714,6 @@ var SyntheticTrackMaterializer = class {
 		return track;
 	}
 };
-var SnapshotTimeoutError = class extends Error {
-	constructor(ms) {
-		super(`snapshot cap timed out after ${ms}ms`);
-		this.name = "SnapshotTimeoutError";
-	}
-};
-function withTimeout(promise, ms) {
-	return new Promise((resolve, reject) => {
-		const timer = setTimeout(() => reject(new SnapshotTimeoutError(ms)), ms);
-		promise.then((value) => {
-			clearTimeout(timer);
-			resolve(value);
-		}, (err) => {
-			clearTimeout(timer);
-			reject(err instanceof Error ? err : new Error(String(err)));
-		});
-	});
-}
-var MotionEventSnapshotCapturer = class {
-	deps;
-	snapshotTimeoutMs;
-	constructor(deps) {
-		this.deps = deps;
-		this.snapshotTimeoutMs = deps.snapshotTimeoutMs ?? 2500;
-	}
-	/**
-	* Fetch a still and persist it as the motion event's snapshot. Never
-	* throws — the durable record is the motion row, already inserted by
-	* the caller.
-	*/
-	async capture(input) {
-		let snap;
-		try {
-			snap = await withTimeout(this.deps.snapshot.getSnapshot({ deviceId: input.deviceId }), this.snapshotTimeoutMs);
-		} catch (err) {
-			this.deps.onError?.(err instanceof SnapshotTimeoutError ? "snapshotTimeout" : "snapshotFetch", err, input.deviceId);
-			return;
-		}
-		if (snap === null) return;
-		const raw = Buffer.from(snap.base64, "base64");
-		let data = raw;
-		try {
-			data = await downscaleFullFrameJpeg(raw, 960, 540);
-		} catch (err) {
-			this.deps.onError?.("downscaleSnapshot", err, input.deviceId);
-		}
-		try {
-			await this.deps.media.put({
-				deviceId: input.deviceId,
-				ownerKind: "event",
-				ownerId: input.eventId,
-				kind: "snapshot",
-				timestamp: input.timestamp,
-				data
-			});
-		} catch (err) {
-			this.deps.onError?.("snapshotMedia", err, input.deviceId);
-		}
-	}
-};
 var TrackingSettingsSchema = object({
 	/**
 	* How much of a detection's box must lie inside a zone (0-1 fraction of the
@@ -53031,6 +53253,9 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					audio
 				};
 			},
+			fetchMediaOwners: async ({ deviceId, ownerKind, ownerIds }) => {
+				return stores.mediaStore.ownersWithMedia(ownerKind, ownerIds, deviceId);
+			},
 			fetchAvailability: async ({ deviceId, since, until }) => {
 				return (await api.recording.getAvailability.query({
 					deviceId,
@@ -53042,6 +53267,10 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				tags: { deviceId: Number(meta["deviceId"]) },
 				meta
 			}),
+			logInfo: (message, meta) => this.ctx.logger.info(message, {
+				tags: { deviceId: Number(meta["deviceId"]) },
+				meta
+			}),
 			resolvePlayback: async ({ deviceId, startMs, endMs }) => {
 				const manifest = await api.recording.getPlaybackManifest.query({
 					deviceId,