@camstack/addon-post-analysis 1.2.94 → 1.2.96

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BdojoP7i.js");
+const require_dist = require("../dist-BQsMSX2A.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -5562,24 +5562,39 @@ async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
 	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
 }
 //#endregion
-//#region src/notification-center/audio-still.ts
+//#region src/notification-center/still-shelf.ts
 /**
-* The audio still shelf — the PHOTOGRAPH a sound rule's notification carries.
+* The still shelf — the PHOTOGRAPH a notification carries when nothing it can
+* name owns a frame.
 *
-* ## Why a sound needs one at all
+* ## Why a trigger needs one at all
 *
-* The attachment ladder resolves media by OWNER, and every other trigger has
-* one: an object or package event owns its crops, a closed track owns its best
-* shot, a doorbell press owns the marker track the same press projected
+* The attachment ladder resolves media by OWNER, and most triggers have one: an
+* object or package event owns its crops, a closed track owns its best shot, a
+* doorbell press owns the marker track the same press projected
 * (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
-* counted (`chooseOccupancyMediaOwner`). An audio match owns nothing. Nothing
-* was boxed, nothing was tracked, and — deliberately — nothing is persisted at
-* all: a confirmed window is a claim about sound that has already stopped, and
-* `event-intake.ts` states why replaying it later would be wrong.
+* counted (`chooseOccupancyMediaOwner`). Two triggers own nothing, and for the
+* same reason in both cases — the subject is an ABSENCE:
+*
+*  - an **audio** match: nothing was boxed, nothing was tracked, and —
+*    deliberately — nothing is persisted at all. A confirmed window is a claim
+*    about sound that has already stopped, and `event-intake.ts` states why
+*    replaying it later would be wrong.
+*  - an **occupancy** edge whose scope is EMPTY — "posto libero". The vehicle
+*    whose departure IS the news has left, so `chooseOccupancyMediaOwner` names
+*    nobody and the ladder logs `no still could be resolved … owners=[]`.
 *
 * So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
-* of the match. Not of the sound — of what the camera could see while it was
-* heard.
+* of the trigger. Not of the sound, not of the object that left — of what the
+* camera can see now that it happened. For a freed parking space that is
+* exactly the answer the operator wants: the space, empty.
+*
+* **One shelf, not two.** The mechanism is identical down to the reuse window,
+* and the only thing that differs between the two triggers is the GATE deciding
+* that a photograph is owed at all — which belongs at the trigger site, where
+* the rules are, and not here. A twin module would be a second derivation of
+* one thing. The trigger rides along as {@link NcStillTrigger} only so the logs
+* can say which absence they are about.
 *
 * ## Three properties, and each one is a decision
 *
@@ -5587,27 +5602,30 @@ async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
 * TTL that covers the outbox's whole retry horizon — and nowhere else. The
 * alternative was the doorbell's: materialise a synthetic marker track through
 * `SyntheticTrackMaterializer` and let the notification name it. That would put
-* a durable Track on the camera's timeline for every confirmed window, feeding
-* the digest's `listTracks`, retention, and the audio-marker feature's own
-* operator ceilings (`audio-marker-projector.ts` exists precisely to bound how
-* many audio markers a camera may emit). A notification must not manufacture
-* timeline history as a side effect of wanting a picture.
-*
-* **The capture STARTS immediately and is never awaited.** A sound is transient
-* — a scream is over before a snapshot round-trip completes — so the fetch is
-* kicked off at the confirmation, before the rule evaluation runs, and the
-* owner id is minted synchronously so the outbox row can name it. The bytes
-* land while the row waits in the queue, and the dispatcher's existing bounded
-* still-wait (or the pause its own footage render already costs) picks them up.
-* A camera that never answers costs the picture and never the notification.
-*
-* **Two confirmations seconds apart share ONE capture.** A barking dog confirms
+* a durable Track on the camera's timeline for every confirmed window and every
+* emptied zone, feeding the digest's `listTracks`, retention, and the audio-
+* marker feature's own operator ceilings (`audio-marker-projector.ts` exists
+* precisely to bound how many audio markers a camera may emit). A notification
+* must not manufacture timeline history as a side effect of wanting a picture.
+*
+* **The capture STARTS immediately and is never awaited.** The subject is
+* transient — a scream is over before a snapshot round-trip completes, and a
+* freed space is about to be taken by the next car — so the fetch is kicked off
+* at the trigger, before the rule evaluation runs, and the owner id is minted
+* synchronously so the outbox row can name it. The bytes land while the row
+* waits in the queue, and the dispatcher's existing bounded still-wait (or the
+* pause its own footage render already costs) picks them up. A camera that
+* never answers costs the picture and never the notification.
+*
+* **Two triggers seconds apart share ONE capture.** A barking dog confirms
 * repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
 * rule's cooldown is its only brake, and the cooldown is applied AFTER this.
 * Without a reuse window this would photograph a camera at whatever rate the
-* sound happens to occur. Each confirmation still gets its OWN owner id, so two
+* sound happens to occur. Each trigger still gets its OWN owner id, so two
 * outbox rows are never mistaken for one subject; they merely point at the same
-* frame, which is the truth — the scene did not change in ten seconds.
+* frame, which is the truth — the scene did not change in ten seconds. The
+* window is per CAMERA and trigger-agnostic for the same reason: a sound and an
+* emptied zone ten seconds apart are two claims about one scene.
 *
 * Nothing here is silent: a capture that lands and a camera that refuses each
 * emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
@@ -5615,13 +5633,13 @@ async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
 */
 /**
 * The owner-id namespace. It is what routes a lookup here instead of to the
-* media store, and it is the reason the dispatcher needs no audio branch —
-* `getMediaForOwner` answers for both under one signature.
+* media store, and it is the reason the dispatcher needs no audio or occupancy
+* branch — `getMediaForOwner` answers for all of them under one signature.
 */
-var NC_AUDIO_STILL_PREFIX = "nc-audio-still:";
+var NC_STILL_SHELF_PREFIX = "nc-still:";
 /** True for an owner id this shelf minted. */
-function isAudioStillId(id) {
-	return id.startsWith(NC_AUDIO_STILL_PREFIX);
+function isStillShelfId(id) {
+	return id.startsWith(NC_STILL_SHELF_PREFIX);
 }
 /**
 * How long the bytes are held.
@@ -5631,16 +5649,16 @@ function isAudioStillId(id) {
 * ships text-only, which is the correct degradation for a photograph of a scene
 * that is a quarter of an hour stale anyway.
 */
-var NC_AUDIO_STILL_TTL_MS = 15 * 6e4;
+var NC_STILL_SHELF_TTL_MS = 15 * 6e4;
 /** A hanging snapshot cap must not pin a capture slot forever. */
 var SNAPSHOT_TIMEOUT_MS = 8e3;
 /**
-* Hard bound on held captures. Reached only if every camera on the hub confirms
-* an audio rule inside one TTL; the oldest is dropped first, which costs a
+* Hard bound on held captures. Reached only if every camera on the hub triggers
+* one inside a single TTL; the oldest is dropped first, which costs a
 * fifteen-minute-old picture nobody is waiting for.
 */
 var MAX_CAPTURES = 64;
-var NcAudioStillShelf = class {
+var NcStillShelf = class {
 	deps;
 	/** captureId → the photograph. */
 	captures = /* @__PURE__ */ new Map();
@@ -5652,14 +5670,14 @@ var NcAudioStillShelf = class {
 		this.deps = deps;
 	}
 	/**
-	* Photograph `deviceId` for a match at `atMs`, and return the owner id the
-	* subject should name. SYNCHRONOUS by contract: the caller is on the audio
-	* confirmation path and the outbox row is built from what this returns.
+	* Photograph `deviceId` for a trigger at `atMs`, and return the owner id the
+	* subject should name. SYNCHRONOUS by contract: the caller is on the trigger
+	* path and the outbox row is built from what this returns.
 	*/
-	capture(deviceId, atMs) {
+	capture(deviceId, atMs, trigger) {
 		const now = this.deps.now();
 		this.prune(now);
-		const ownerId = `${NC_AUDIO_STILL_PREFIX}${(0, node_crypto.randomUUID)()}`;
+		const ownerId = `${NC_STILL_SHELF_PREFIX}${(0, node_crypto.randomUUID)()}`;
 		const recent = this.newest.get(deviceId);
 		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
 			this.owners.set(ownerId, recent.captureId);
@@ -5668,8 +5686,9 @@ var NcAudioStillShelf = class {
 		const captureId = (0, node_crypto.randomUUID)();
 		this.captures.set(captureId, {
 			deviceId,
+			trigger,
 			startedAt: now,
-			expiresAt: now + NC_AUDIO_STILL_TTL_MS,
+			expiresAt: now + NC_STILL_SHELF_TTL_MS,
 			files: []
 		});
 		this.newest.set(deviceId, {
@@ -5677,7 +5696,7 @@ var NcAudioStillShelf = class {
 			at: now
 		});
 		this.owners.set(ownerId, captureId);
-		this.fetch(captureId, deviceId, atMs);
+		this.fetch(captureId, deviceId, atMs, trigger);
 		return ownerId;
 	}
 	/**
@@ -5713,11 +5732,11 @@ var NcAudioStillShelf = class {
 		this.owners.clear();
 		this.newest.clear();
 	}
-	async fetch(captureId, deviceId, atMs) {
+	async fetch(captureId, deviceId, atMs, trigger) {
 		try {
 			const shot = await withTimeout$3(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
 			if (shot === null || shot.base64.length === 0) {
-				this.reportMiss(deviceId, "the camera returned no snapshot");
+				this.reportMiss(deviceId, trigger, "the camera returned no snapshot");
 				return;
 			}
 			const raw = Buffer.from(shot.base64, "base64");
@@ -5729,17 +5748,18 @@ var NcAudioStillShelf = class {
 			if (held === void 0) return;
 			this.captures.set(captureId, {
 				...held,
-				files: audioStillMedia(data, atMs)
+				files: stillShelfMedia(data, atMs)
 			});
-			this.deps.logger.info("audio still captured", {
+			this.deps.logger.info(`${trigger} still captured`, {
 				tags: { deviceId },
 				meta: {
+					trigger,
 					bytes: data.byteLength,
 					tookMs: this.deps.now() - held.startedAt
 				}
 			});
 		} catch (err) {
-			this.reportMiss(deviceId, err instanceof Error ? err.message : String(err));
+			this.reportMiss(deviceId, trigger, err instanceof Error ? err.message : String(err));
 		}
 	}
 	/**
@@ -5747,10 +5767,13 @@ var NcAudioStillShelf = class {
 	* on a notification they DID receive, so it is a warn and it carries the
 	* camera — the only key the question is ever asked with.
 	*/
-	reportMiss(deviceId, reason) {
-		this.deps.logger.warn("the camera did not answer the audio still — this notification ships text-only", {
+	reportMiss(deviceId, trigger, reason) {
+		this.deps.logger.warn(`the camera did not answer the ${trigger} still — this notification ships text-only`, {
 			tags: { deviceId },
-			meta: { reason }
+			meta: {
+				trigger,
+				reason
+			}
 		});
 	}
 };
@@ -5765,10 +5788,10 @@ var NcAudioStillShelf = class {
 * so. Inventing a centre crop would answer a different question from the one
 * the operator asked.
 */
-function audioStillMedia(data, timestamp) {
+function stillShelfMedia(data, timestamp) {
 	const base64 = data.toString("base64");
 	const file = (kind) => ({
-		key: `${NC_AUDIO_STILL_PREFIX}${kind}`,
+		key: `${NC_STILL_SHELF_PREFIX}${kind}`,
 		kind,
 		base64,
 		sizeBytes: data.byteLength,
@@ -6405,6 +6428,16 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/default-tap-url.ts
+/** The viewer's hosted base path under the hub. */
+var VIEWER_BASE_PATH = "/viewer/camstack";
+function defaultTapUrl(input) {
+	if (input.systemEvent === true) return null;
+	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
+	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
+}
+//#endregion
 //#region src/shared/frame/box-drawer.ts
 var DEFAULT_COLOR = require_dist.DEFAULT_EVENT_COLOR;
 var DEFAULT_QUALITY = 80;
@@ -7424,7 +7457,7 @@ function subjectFromSensorEvent(ev, markerTrackId) {
 * (see the {@link evaluateRule} audio gate + the matchers below).
 *
 * `stillOwnerId` is the audio still shelf's owner id — the photograph of the
-* camera taken at the match (`audio-still.ts`). It rides `trackId` because that
+* camera taken at the match (`still-shelf.ts`). It rides `trackId` because that
 * is the field the attachment ladder reads, exactly as a doorbell press rides
 * its marker track's id; nothing else about the subject is track-scoped, and
 * `buildEntries` keys an audio row on its record id, never on this. Absent when
@@ -7516,10 +7549,18 @@ function audioSubjectFor(hit, spec) {
 * chosen at commit (`chooseOccupancyMediaOwner`) — rides on `trackId`, and that
 * is the whole of what gives an occupancy notification a picture: the ordinary
 * media-owner ladder resolves it, exactly as it resolves a doorbell's marker
-* track. Absent when the scope held no member (a became-free edge) ⇒ text-only,
-* by design.
-*/
-function subjectFromOccupancyEvent(edge) {
+* track.
+*
+* `stillOwnerId` is the SECOND source of that picture and the only one an
+* emptied scope can have: with no member left to name — "posto libero", where
+* the object whose departure is the news has gone — the trigger site photographs
+* the camera and holds the bytes on the still shelf (`still-shelf.ts`), exactly
+* as an audio match does. The member track always WINS: it is a picture of the
+* counted object, and a photograph is only ever the stand-in for not having one.
+* Neither present (no snapshot cap on this node) ⇒ text-only, as before.
+*/
+function subjectFromOccupancyEvent(edge, stillOwnerId) {
+	const mediaOwner = edge.mediaTrackId ?? stillOwnerId;
 	return {
 		kind: "occupancy-event",
 		recordId: `occ:${edge.deviceId}:${edge.zoneId ?? "@frame"}:${edge.className ?? "@all"}:t${edge.threshold}:${edge.occupied ? "occ" : "free"}:${edge.timestamp}`,
@@ -7527,17 +7568,28 @@ function subjectFromOccupancyEvent(edge) {
 		timestamp: edge.timestamp,
 		classNames: [edge.className ?? "occupancy"],
 		zones: [],
-		...edge.mediaTrackId !== void 0 ? { trackId: edge.mediaTrackId } : {},
+		...mediaOwner !== void 0 ? { trackId: mediaOwner } : {},
 		source: "pipeline",
-		occupancy: {
-			...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
-			...edge.zoneName !== void 0 ? { zoneName: edge.zoneName } : {},
-			...edge.className !== void 0 ? { className: edge.className } : {},
-			count: edge.count,
-			previousCount: edge.previousCount,
-			occupied: edge.occupied,
-			threshold: edge.threshold
-		}
+		occupancy: occupancySubjectFromEdge(edge)
+	};
+}
+/**
+* The scope + level half of an occupancy subject, ALONE.
+*
+* Split out for one reason: the still-shelf gate must ask `matchesOccupancy`
+* whether a rule would fire on an edge BEFORE the subject that would carry the
+* answer exists (the owner id it mints is an input to that subject). Sharing
+* this keeps the gate reading the same numbers the verdict will.
+*/
+function occupancySubjectFromEdge(edge) {
+	return {
+		...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
+		...edge.zoneName !== void 0 ? { zoneName: edge.zoneName } : {},
+		...edge.className !== void 0 ? { className: edge.className } : {},
+		count: edge.count,
+		previousCount: edge.previousCount,
+		occupied: edge.occupied,
+		threshold: edge.threshold
 	};
 }
 /** Build the subject for a `package-event` evaluation (a persisted `package`
@@ -7664,6 +7716,13 @@ function matchesAudio(cond, s) {
 	}
 	return false;
 }
+/**
+* Exported for ONE caller: the still-shelf gate in the centre, which must know
+* — before the outbox row exists — whether any enabled rule would fire on THIS
+* edge and wants a picture for it. Sharing the predicate is what keeps that gate
+* from becoming a second, drifting opinion about which edge belongs to which
+* rule. It is pure and reads nothing.
+*/
 function matchesOccupancy(occ, s) {
 	if ((occ.zoneId ?? void 0) !== (s.zoneId ?? void 0)) return false;
 	if ((occ.className ?? void 0) !== (s.className ?? void 0)) return false;
@@ -9262,12 +9321,19 @@ var NcDispatcher = class {
 		}) : rendered;
 		const attachments = [...await this.withArtifactUrls(entry, await this.resolveAttachments(entry)), ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
+		const tapUrl = params.clickUrl === void 0 && this.deps.viewerUrlBase !== void 0 ? defaultTapUrl({
+			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
+			timestampMs: subject.timestamp,
+			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
+			systemEvent: systemEvent !== void 0
+		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
 			body,
 			title,
 			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
 			...params,
+			...tapUrl !== null ? { clickUrl: tapUrl } : {},
 			tag: entry.payload.group?.key ?? entry.ruleId,
 			...systemEvent !== void 0 ? systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {} : { deviceId: subject.deviceId },
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
@@ -9864,7 +9930,7 @@ function incomingFromSensorEvent(event, markerTrackId) {
 * Audio-event persist (classified episode).
 *
 * `stillOwnerId` is the audio still shelf's owner id for the photograph taken
-* at this episode (`audio-still.ts`). Absent when no rule that could fire asked
+* at this episode (`still-shelf.ts`). Absent when no rule that could fire asked
 * for a picture — the same shape `incomingFromSensorEvent` carries its marker.
 */
 function incomingFromAudioEvent(event, stillOwnerId) {
@@ -9945,10 +10011,16 @@ function audioHitMeta(hit) {
 		samples: window.samples
 	};
 }
-/** A committed ZoneAnalytics occupancy edge. */
-function incomingFromOccupancyEdge(edge) {
+/**
+* A committed ZoneAnalytics occupancy edge.
+*
+* `stillOwnerId` — see {@link subjectFromOccupancyEvent}. An edge whose scope is
+* empty owns no member track, so the only picture it can carry is a photograph
+* of its camera taken at the edge, held on the still shelf under this id.
+*/
+function incomingFromOccupancyEdge(edge, stillOwnerId) {
 	return {
-		subject: subjectFromOccupancyEvent(edge),
+		subject: subjectFromOccupancyEvent(edge, stillOwnerId),
 		kind: "occupancy-event",
 		origin: "pipeline",
 		log: () => ({
@@ -16077,7 +16149,7 @@ function isSyntheticId(id) {
 *  - and, since 2026-08-15, a `trackId` for both AUDIO kinds: a sound owns no
 *    frame, so production photographs the camera at the match and holds the
 *    bytes on the still shelf under an owner id the subject names
-*    (`audio-still.ts`). The tester's RAM-held frame stands in for exactly that
+*    (`still-shelf.ts`). The tester's RAM-held frame stands in for exactly that
 *    photograph, and — unlike every other kind here — it is taken the same way
 *    production takes it, at the same moment, from the same cap.
 *
@@ -18744,11 +18816,12 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	syntheticMedia = /* @__PURE__ */ new Map();
 	/**
-	* The photograph a SOUND rule's notification carries — see `audio-still.ts`.
-	* Null when this wiring has no snapshot cap, which leaves every audio
-	* notification text-only rather than broken.
+	* The photograph a notification carries when the subject it is about is an
+	* ABSENCE — a sound that owns no frame, an emptied occupancy scope that owns
+	* no member. See `still-shelf.ts`. Null when this wiring has no snapshot cap,
+	* which leaves those notifications text-only rather than broken.
 	*/
-	audioStills;
+	stills;
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
 	lastNoMatchReportAt = /* @__PURE__ */ new Map();
 	noMatchSuppressed = /* @__PURE__ */ new Map();
@@ -19045,9 +19118,9 @@ var NotificationCenter = class NotificationCenter {
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
 		const getSnapshot = deps.getSnapshot;
-		this.audioStills = getSnapshot !== void 0 ? new NcAudioStillShelf({
+		this.stills = getSnapshot !== void 0 ? new NcStillShelf({
 			getSnapshot,
-			logger: this.logger.child("audio-still"),
+			logger: this.logger.child("still-shelf"),
 			now: this.now
 		}) : null;
 		this.rules = new NcRuleStore({
@@ -19137,8 +19210,8 @@ var NotificationCenter = class NotificationCenter {
 			getMediaForOwner: async (ownerKind, ownerId) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
-				const audio = isAudioStillId(ownerId) ? this.audioStills?.get(ownerId) : void 0;
-				if (audio !== void 0) return audio;
+				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
+				if (shelved !== void 0) return shelved;
 				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
 			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
@@ -19148,7 +19221,8 @@ var NotificationCenter = class NotificationCenter {
 				confirmGate: (input) => confirmGate.judge(input),
 				confirmStats: () => confirmGate.stats()
 			} : {},
-			releaseCooldown: (input) => this.releaseCooldown(input)
+			releaseCooldown: (input) => this.releaseCooldown(input),
+			...deps.dispatcher.viewerUrlBase !== void 0 ? { viewerUrlBase: deps.dispatcher.viewerUrlBase } : {}
 		});
 		this.outbox = new NcOutbox({
 			store: deps.store,
@@ -19343,7 +19417,7 @@ var NotificationCenter = class NotificationCenter {
 		}
 		this.timelapseScheduler?.stop();
 		this.summaryProducer?.stop();
-		this.audioStills?.clear();
+		this.stills?.clear();
 		this.addonUpdates.dispose();
 		this.livenessHoldoff.dispose();
 		this.evaluationActive = false;
@@ -19695,14 +19769,14 @@ var NotificationCenter = class NotificationCenter {
 	* direction that DESTROYS the media.
 	*/
 	audioStillOwner(deviceId, atMs, mode) {
-		const shelf = this.audioStills;
+		const shelf = this.stills;
 		if (shelf === null || !this.evaluationActive) return void 0;
 		for (const rule of this.rules.listEnabled("immediate")) {
 			if (rule.media.attach === "none") continue;
 			if (!(mode === "condition" ? rule.conditions.audio !== void 0 : rule.conditions.audio === void 0 && referencesAudioClass(rule.conditions.classes))) continue;
 			const devices = rule.conditions.devices;
 			if (devices !== void 0 && devices.length > 0 && !devices.includes(deviceId)) continue;
-			return shelf.capture(deviceId, atMs);
+			return shelf.capture(deviceId, atMs, "audio");
 		}
 	}
 	/**
@@ -19761,7 +19835,48 @@ var NotificationCenter = class NotificationCenter {
 	* Public so a test / a future out-of-band edge source can drive it directly.
 	*/
 	onOccupancyEdge(edge) {
-		this.consumeEvent(incomingFromOccupancyEdge(edge));
+		this.consumeEvent(incomingFromOccupancyEdge(edge, this.occupancyStillOwner(edge)));
+	}
+	/**
+	* Start photographing this edge's camera NOW and return the owner id its
+	* subject should name — or `undefined` when nothing would use it.
+	*
+	* **Only an edge that owns NOBODY.** `chooseOccupancyMediaOwner` names a
+	* member track whenever the scope holds one, and that picture is of the
+	* counted object itself; a photograph is strictly the stand-in for not having
+	* one. The case this exists for is "posto libero" (camera 617): the vehicle
+	* whose departure IS the notification has left, so the scope is empty, the
+	* ladder resolves nothing and the delivery logged `no still could be resolved
+	* … owners=[]`. A became-free edge has no owner BY CONSTRUCTION, and a
+	* became-occupied edge can lack one too (every member parked, i.e.
+	* `stationary:`) — so the gate is the ABSENCE itself, not the polarity. That
+	* is the honest predicate: photograph exactly the edges whose media cannot be
+	* resolved, and no others.
+	*
+	* **The capture is not awaited**, for the audio shelf's reason and one of its
+	* own: a freed space is about to be taken by the next car, and a still fetched
+	* after the outbox drained would show it occupied again.
+	*
+	* **The gate is the RULE's media policy AND the engine's own verdict.** The
+	* watcher commits both polarities of every watched key, so a hub with only a
+	* became-occupied rule still produces free edges — photographing those would
+	* be a snapshot no notification can ever carry. `matchesOccupancy` is the same
+	* predicate `evaluateRule` will apply, shared rather than restated. The rule
+	* cache is an in-memory mirror, so this is not a fallible read (D49).
+	*/
+	occupancyStillOwner(edge) {
+		const shelf = this.stills;
+		if (shelf === null || !this.evaluationActive) return void 0;
+		if (edge.mediaTrackId !== void 0) return void 0;
+		const subject = occupancySubjectFromEdge(edge);
+		for (const rule of this.rules.listEnabled("device-event")) {
+			if (rule.media.attach === "none") continue;
+			const occ = rule.conditions.occupancy;
+			if (occ === void 0 || !matchesOccupancy(occ, subject)) continue;
+			const devices = rule.conditions.devices;
+			if (devices !== void 0 && devices.length > 0 && !devices.includes(edge.deviceId)) continue;
+			return shelf.capture(edge.deviceId, edge.timestamp, "occupancy");
+		}
 	}
 	/**
 	* Feed ONE audio inference frame into the sampling-window matcher.
@@ -20728,7 +20843,7 @@ var NotificationCenter = class NotificationCenter {
 						kind,
 						ruleId: rule.id,
 						rule: rule.name,
-						snapshotWired: this.audioStills !== null
+						snapshotWired: this.stills !== null
 					}
 				});
 			}
@@ -20893,6 +21008,7 @@ var NotificationCenter = class NotificationCenter {
 		if (subject.kind === "audio-window" || subject.kind === "audio-event") return { outcome: "disabled" };
 		const trackId = subject.trackId;
 		if (trackId === void 0) return { outcome: "disabled" };
+		if (isStillShelfId(trackId)) return { outcome: "disabled" };
 		const member = {
 			trackId,
 			className: subject.classNames[0] ?? "event",
@@ -24856,6 +24972,188 @@ function clusterByEmbedding(items, threshold = .5) {
 	})).toSorted((a, b) => b.size - a.size || b.cohesion - a.cohesion);
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/face-matcher.ts
+/**
+* Count enrolled samples per identity for probes of a matching model+dimension.
+* Only identities meeting `minIdentitySamples` are eligible auto-match targets.
+*/
+function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probeModelId) continue;
+		if (s.embedding.length !== probeDim) continue;
+		counts.set(s.identityId, (counts.get(s.identityId) ?? 0) + 1);
+	}
+	const eligible = /* @__PURE__ */ new Set();
+	for (const [id, count] of counts) if (count >= minIdentitySamples) eligible.add(id);
+	return eligible;
+}
+/**
+* Match a probe embedding against the gallery. Only samples with the same
+* `modelId` AND the same dimension are compared (model-version safety). Returns
+* the best identity when its score ≥ threshold and it beats the best OTHER
+* identity by ≥ margin; otherwise null.
+*/
+function matchEmbedding(probe, gallery, opts) {
+	const probeVec = new Float32Array(probe.embedding);
+	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
+	const bestByIdentity = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probe.modelId) continue;
+		if (s.embedding.length !== probe.embedding.length) continue;
+		if (!eligible.has(s.identityId)) continue;
+		const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		const prev = bestByIdentity.get(s.identityId);
+		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+	}
+	if (bestByIdentity.size === 0) return null;
+	let bestId = null;
+	let bestScore = -Infinity;
+	let secondScore = -Infinity;
+	for (const [id, score] of bestByIdentity) if (score > bestScore) {
+		secondScore = bestScore;
+		bestScore = score;
+		bestId = id;
+	} else if (score > secondScore) secondScore = score;
+	if (bestId === null || bestScore < opts.threshold) return null;
+	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
+	return {
+		identityId: bestId,
+		score: bestScore
+	};
+}
+/**
+* Assign at most one identity per track AND at most one track per identity for
+* a single frame. Greedy by score: compute every candidate's full ranked match
+* list, then repeatedly take the globally-highest (track, identity) pair whose
+* track and identity are both still free, until none qualify. A losing track
+* falls back to its next-best free identity ≥ threshold. Ties resolve by input order.
+*/
+/**
+* Enrollment bound: the maximum cosine an embedding may score against a sample
+* of a DIFFERENT identity and still be enrolled. Genuine ArcFace cross-person
+* cosines sit under ~0.4; the low-information attractor (IR, blur, backs of
+* heads) sits at 0.95+. Measured 2026-08-18: 22 of 50 live samples were
+* enrolled from that attractor, with inter-identity cosines up to 0.988 — each
+* one a magnet that "recognises" every degraded probe as its owner.
+*/
+var ENROLLMENT_MAX_FOREIGN_COSINE = .9;
+/**
+* Gate an embedding BEFORE it becomes a gallery sample: condemned when its
+* best cosine against any sample of ANOTHER identity (same model + dimension)
+* reaches {@link ENROLLMENT_MAX_FOREIGN_COSINE}. Null = safe to enroll.
+* Closeness to the TARGET identity's own samples is expected and never
+* condemns.
+*/
+function enrollmentPromiscuity(embedding, modelId, targetIdentityId, gallery, bound = ENROLLMENT_MAX_FOREIGN_COSINE) {
+	const probeVec = new Float32Array(embedding);
+	let worst = null;
+	for (const s of gallery) {
+		if (s.identityId === targetIdentityId) continue;
+		if (s.modelId !== modelId) continue;
+		if (s.embedding.length !== embedding.length) continue;
+		const cosine = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		if (cosine >= bound && (worst === null || cosine > worst.cosine)) worst = {
+			identityId: s.identityId,
+			cosine
+		};
+	}
+	return worst;
+}
+function assignUniquePerFrame(candidates, gallery, opts) {
+	const pairs = [];
+	candidates.forEach((c, trackIdx) => {
+		const probeVec = new Float32Array(c.embedding);
+		const eligible = eligibleIdentities(gallery, c.modelId, c.embedding.length, opts.minIdentitySamples ?? 1);
+		const bestByIdentity = /* @__PURE__ */ new Map();
+		for (const s of gallery) {
+			if (s.modelId !== c.modelId) continue;
+			if (s.embedding.length !== c.embedding.length) continue;
+			if (!eligible.has(s.identityId)) continue;
+			const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+			const prev = bestByIdentity.get(s.identityId);
+			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+		}
+		let bestId = null;
+		let bestScore = -1;
+		let secondScore = -1;
+		for (const [identityId, score] of bestByIdentity) if (score > bestScore) {
+			if (bestId !== null) secondScore = bestScore;
+			bestId = identityId;
+			bestScore = score;
+		} else if (score > secondScore) secondScore = score;
+		const ambiguous = secondScore >= 0 && bestScore - secondScore < opts.margin;
+		if (bestId !== null && !ambiguous) {
+			for (const [identityId, score] of bestByIdentity) if (score >= opts.threshold) pairs.push({
+				trackIdx,
+				identityId,
+				score
+			});
+		}
+	});
+	pairs.sort((a, b) => b.score - a.score);
+	const takenTracks = /* @__PURE__ */ new Set();
+	const takenIdentities = /* @__PURE__ */ new Set();
+	const result = /* @__PURE__ */ new Map();
+	for (const p of pairs) {
+		if (takenTracks.has(p.trackIdx) || takenIdentities.has(p.identityId)) continue;
+		takenTracks.add(p.trackIdx);
+		takenIdentities.add(p.identityId);
+		result.set(candidates[p.trackIdx].trackId, {
+			identityId: p.identityId,
+			score: p.score
+		});
+	}
+	return result;
+}
+var EMPTY_AGGREGATE = Object.freeze({
+	assignedIdentityId: null,
+	confirmations: Object.freeze({})
+});
+/**
+* Fold one frame's match into a track's aggregate. A null match leaves state
+* untouched. An identity is assigned once its cumulative confirmation count
+* reaches `confirmFrames`; once assigned, a different identity must independently
+* reach `confirmFrames` to switch. `changed` is true only on a (re)assignment to
+* a NEW identity, so callers fire the label update exactly once per transition.
+*
+* On each (re)assignment the confirmations record is reset to contain only the
+* newly-assigned identity's count, so any challenger must independently re-reach
+* `confirmFrames` from scratch after any assignment.
+*/
+function updateTrackAggregate(prev, match, opts) {
+	if (match === null) return {
+		state: prev,
+		changed: false
+	};
+	const count = (prev.confirmations[match.identityId] ?? 0) + 1;
+	const confirmations = {
+		...prev.confirmations,
+		[match.identityId]: count
+	};
+	if (count < opts.confirmFrames) return {
+		state: {
+			...prev,
+			confirmations
+		},
+		changed: false
+	};
+	if (prev.assignedIdentityId === match.identityId) return {
+		state: {
+			...prev,
+			confirmations
+		},
+		changed: false
+	};
+	return {
+		state: {
+			assignedIdentityId: match.identityId,
+			confirmations: { [match.identityId]: count }
+		},
+		changed: true
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/face-gallery-provider.ts
 /** Attribution of a face identity NAMED BY THE OPERATOR in the gallery. */
 var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
@@ -25102,6 +25400,19 @@ var FaceGalleryProvider = class {
 		}
 		const currentFace = await this.faceStore.get(faceId);
 		if (!currentFace) throw new Error(`FaceGalleryProvider.assignFace: face disappeared after pre-cleanup: ${faceId}`);
+		const verdict = enrollmentPromiscuity(currentFace.embedding, MODEL_ID, identityId, await this.identityStore.loadGallery());
+		if (verdict !== null) {
+			this.logger.warn("assignFace refused: embedding too close to a FOREIGN identity sample", {
+				tags: { deviceId: currentFace.deviceId },
+				meta: {
+					faceId,
+					identityId,
+					foreignIdentityId: verdict.identityId,
+					cosine: verdict.cosine
+				}
+			});
+			throw new Error(`FaceGalleryProvider.assignFace: embedding is ambiguous — cosine ${verdict.cosine.toFixed(3)} with a sample of another identity (${verdict.identityId}); pick a clearer crop`);
+		}
 		let newKey;
 		if (currentFace.mediaKey) {
 			newKey = await this.mediaStore.reown({
@@ -33552,146 +33863,6 @@ async function resolveDefaultEventMedia(deps) {
 	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/face-matcher.ts
-/**
-* Count enrolled samples per identity for probes of a matching model+dimension.
-* Only identities meeting `minIdentitySamples` are eligible auto-match targets.
-*/
-function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		if (s.modelId !== probeModelId) continue;
-		if (s.embedding.length !== probeDim) continue;
-		counts.set(s.identityId, (counts.get(s.identityId) ?? 0) + 1);
-	}
-	const eligible = /* @__PURE__ */ new Set();
-	for (const [id, count] of counts) if (count >= minIdentitySamples) eligible.add(id);
-	return eligible;
-}
-/**
-* Match a probe embedding against the gallery. Only samples with the same
-* `modelId` AND the same dimension are compared (model-version safety). Returns
-* the best identity when its score ≥ threshold and it beats the best OTHER
-* identity by ≥ margin; otherwise null.
-*/
-function matchEmbedding(probe, gallery, opts) {
-	const probeVec = new Float32Array(probe.embedding);
-	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
-	const bestByIdentity = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		if (s.modelId !== probe.modelId) continue;
-		if (s.embedding.length !== probe.embedding.length) continue;
-		if (!eligible.has(s.identityId)) continue;
-		const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
-		const prev = bestByIdentity.get(s.identityId);
-		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
-	}
-	if (bestByIdentity.size === 0) return null;
-	let bestId = null;
-	let bestScore = -Infinity;
-	let secondScore = -Infinity;
-	for (const [id, score] of bestByIdentity) if (score > bestScore) {
-		secondScore = bestScore;
-		bestScore = score;
-		bestId = id;
-	} else if (score > secondScore) secondScore = score;
-	if (bestId === null || bestScore < opts.threshold) return null;
-	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
-	return {
-		identityId: bestId,
-		score: bestScore
-	};
-}
-/**
-* Assign at most one identity per track AND at most one track per identity for
-* a single frame. Greedy by score: compute every candidate's full ranked match
-* list, then repeatedly take the globally-highest (track, identity) pair whose
-* track and identity are both still free, until none qualify. A losing track
-* falls back to its next-best free identity ≥ threshold. Ties resolve by input order.
-*/
-function assignUniquePerFrame(candidates, gallery, opts) {
-	const pairs = [];
-	candidates.forEach((c, trackIdx) => {
-		const probeVec = new Float32Array(c.embedding);
-		const eligible = eligibleIdentities(gallery, c.modelId, c.embedding.length, opts.minIdentitySamples ?? 1);
-		const bestByIdentity = /* @__PURE__ */ new Map();
-		for (const s of gallery) {
-			if (s.modelId !== c.modelId) continue;
-			if (s.embedding.length !== c.embedding.length) continue;
-			if (!eligible.has(s.identityId)) continue;
-			const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
-			const prev = bestByIdentity.get(s.identityId);
-			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
-		}
-		for (const [identityId, score] of bestByIdentity) if (score >= opts.threshold) pairs.push({
-			trackIdx,
-			identityId,
-			score
-		});
-	});
-	pairs.sort((a, b) => b.score - a.score);
-	const takenTracks = /* @__PURE__ */ new Set();
-	const takenIdentities = /* @__PURE__ */ new Set();
-	const result = /* @__PURE__ */ new Map();
-	for (const p of pairs) {
-		if (takenTracks.has(p.trackIdx) || takenIdentities.has(p.identityId)) continue;
-		takenTracks.add(p.trackIdx);
-		takenIdentities.add(p.identityId);
-		result.set(candidates[p.trackIdx].trackId, {
-			identityId: p.identityId,
-			score: p.score
-		});
-	}
-	return result;
-}
-var EMPTY_AGGREGATE = Object.freeze({
-	assignedIdentityId: null,
-	confirmations: Object.freeze({})
-});
-/**
-* Fold one frame's match into a track's aggregate. A null match leaves state
-* untouched. An identity is assigned once its cumulative confirmation count
-* reaches `confirmFrames`; once assigned, a different identity must independently
-* reach `confirmFrames` to switch. `changed` is true only on a (re)assignment to
-* a NEW identity, so callers fire the label update exactly once per transition.
-*
-* On each (re)assignment the confirmations record is reset to contain only the
-* newly-assigned identity's count, so any challenger must independently re-reach
-* `confirmFrames` from scratch after any assignment.
-*/
-function updateTrackAggregate(prev, match, opts) {
-	if (match === null) return {
-		state: prev,
-		changed: false
-	};
-	const count = (prev.confirmations[match.identityId] ?? 0) + 1;
-	const confirmations = {
-		...prev.confirmations,
-		[match.identityId]: count
-	};
-	if (count < opts.confirmFrames) return {
-		state: {
-			...prev,
-			confirmations
-		},
-		changed: false
-	};
-	if (prev.assignedIdentityId === match.identityId) return {
-		state: {
-			...prev,
-			confirmations
-		},
-		changed: false
-	};
-	return {
-		state: {
-			assignedIdentityId: match.identityId,
-			confirmations: { [match.identityId]: count }
-		},
-		changed: true
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/face-recognizer.ts
 /** Attribution of an identity resolved by the in-process ArcFace matcher. */
 var FACE_RECOGNIZER_STEP_ID = "face-recognizer";
@@ -52396,6 +52567,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				},
 				renderEventMedia: (req) => this.renderEventMedia(req),
 				publishArtifact: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
+				viewerUrlBase: async () => pickArtifactBaseUrl(await this.ncEndpoints()),
 				indexArtifact: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? {
 					url: null,
 					artifactId: null