@camstack/addon-post-analysis 1.2.95 → 1.2.97

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as encodeVectorBase64, A as RetrainStatusSchema, At as literal, B as TrackSourceSchema, C as NcSnoozeSchema, Ct as isDeviceScopedCap, D as OpsLogEntrySchema, Dt as array, E as NcTaxonomySchema, Et as _enum, F as SceneMonitorSchema, Ft as string, G as audioMetricsCapability, H as addonWidgetsSourceCapability, I as TIMELAPSE_DENSE_FLOOR_SEC, It as unknown, J as cosineSimilarity$1, K as audioModeOf, L as TimelapseRuleInputSchema, Lt as EventCategory, M as SCENE_DEFAULT_ANCHOR_THRESHOLD, Mt as object, N as SCENE_DEFAULT_UNCOVERED_POLICY, Nt as partialRecord, Ot as boolean, P as SCENE_DIVERGED, Pt as record, R as TimelapseRulePatchSchema, S as NcSnoozeInputSchema, St as hydrateSchema, T as NcSystemEventKindSchema, Tt as sleep, U as alarmPanelCapability, V as VISIT_MERGE_GAP_MS, W as assertTimelapseCadences, X as defineCustomActions, Y as customAction, Z as deriveRecordingMode, _ as NcRuleInputSchema, _t as zoneAnalyticsCapability, at as notificationRulesCapability, b as NcRuleTargetSchema, bt as DeviceType, c as EVENT_PAD_MS, ct as plateGalleryCapability, d as NC_ALARM_SYSTEM_EVENT_KINDS, et as faceGalleryCapability, f as NC_CONDITION_CATALOG, ft as sceneMonitorCapability, g as NcConditionDescriptorSchema, gt as videoclipsCapability, h as NC_TAXONOMY, ht as vectorDimFromBase64, i as DETECTION_MACRO_CLASSES, it as kebabToCamel, jt as number, k as RECORDING_EXPORT_MAX_READ_BYTES, kt as discriminatedUnion, l as LabelAttributionSchema, lt as readDeviceStateFrom, mt as systemEventFilterApplies, n as DEFAULT_EVENT_COLOR, nt as isDetectionMacroClass, o as DeclaredDevices, p as NC_DEFAULT_SNOOZE_MINUTES, pt as subKindsOf, q as buildEventKindDescriptor, rt as isScheduleActive, s as EVENT_KIND_BY_CAP, st as pipelineAnalyticsCapability, t as BaseDevice, u as MACRO_LABELS, ut as readTimelapseGeneratedAt, v as NcRulePatchSchema, vt as errMsg, w as NcSnoozeSuppressedSchema, wt as nodePin, x as NcScheduleSchema, xt as createEvent, y as NcRuleSchema, yt as BaseAddon, z as TimelapseRuleSchema } from "../dist-C-_TL-I1.mjs";
+import { $ as encodeVectorBase64, A as RetrainStatusSchema, At as literal, B as TrackSourceSchema, C as NcSnoozeSchema, Ct as isDeviceScopedCap, D as OpsLogEntrySchema, Dt as array, E as NcTaxonomySchema, Et as _enum, F as SceneMonitorSchema, Ft as string, G as audioMetricsCapability, H as addonWidgetsSourceCapability, I as TIMELAPSE_DENSE_FLOOR_SEC, It as unknown, J as cosineSimilarity$1, K as audioModeOf, L as TimelapseRuleInputSchema, Lt as EventCategory, M as SCENE_DEFAULT_ANCHOR_THRESHOLD, Mt as object, N as SCENE_DEFAULT_UNCOVERED_POLICY, Nt as partialRecord, Ot as boolean, P as SCENE_DIVERGED, Pt as record, R as TimelapseRulePatchSchema, S as NcSnoozeInputSchema, St as hydrateSchema, T as NcSystemEventKindSchema, Tt as sleep, U as alarmPanelCapability, V as VISIT_MERGE_GAP_MS, W as assertTimelapseCadences, X as defineCustomActions, Y as customAction, Z as deriveRecordingMode, _ as NcRuleInputSchema, _t as zoneAnalyticsCapability, at as notificationRulesCapability, b as NcRuleTargetSchema, bt as DeviceType, c as EVENT_PAD_MS, ct as plateGalleryCapability, d as NC_ALARM_SYSTEM_EVENT_KINDS, et as faceGalleryCapability, f as NC_CONDITION_CATALOG, ft as sceneMonitorCapability, g as NcConditionDescriptorSchema, gt as videoclipsCapability, h as NC_TAXONOMY, ht as vectorDimFromBase64, i as DETECTION_MACRO_CLASSES, it as kebabToCamel, jt as number, k as RECORDING_EXPORT_MAX_READ_BYTES, kt as discriminatedUnion, l as LabelAttributionSchema, lt as readDeviceStateFrom, mt as systemEventFilterApplies, n as DEFAULT_EVENT_COLOR, nt as isDetectionMacroClass, o as DeclaredDevices, p as NC_DEFAULT_SNOOZE_MINUTES, pt as subKindsOf, q as buildEventKindDescriptor, rt as isScheduleActive, s as EVENT_KIND_BY_CAP, st as pipelineAnalyticsCapability, t as BaseDevice, u as MACRO_LABELS, ut as readTimelapseGeneratedAt, v as NcRulePatchSchema, vt as errMsg, w as NcSnoozeSuppressedSchema, wt as nodePin, x as NcScheduleSchema, xt as createEvent, y as NcRuleSchema, yt as BaseAddon, z as TimelapseRuleSchema } from "../dist-ecY_-nDx.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -5555,24 +5555,39 @@ async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
 	}).jpeg({ quality: FULL_FRAME_QUALITY }).toBuffer();
 }
 //#endregion
-//#region src/notification-center/audio-still.ts
+//#region src/notification-center/still-shelf.ts
 /**
-* The audio still shelf — the PHOTOGRAPH a sound rule's notification carries.
+* The still shelf — the PHOTOGRAPH a notification carries when nothing it can
+* name owns a frame.
 *
-* ## Why a sound needs one at all
+* ## Why a trigger needs one at all
 *
-* The attachment ladder resolves media by OWNER, and every other trigger has
-* one: an object or package event owns its crops, a closed track owns its best
-* shot, a doorbell press owns the marker track the same press projected
+* The attachment ladder resolves media by OWNER, and most triggers have one: an
+* object or package event owns its crops, a closed track owns its best shot, a
+* doorbell press owns the marker track the same press projected
 * (`sensor-marker-projector.ts`), an occupancy edge names one of the objects it
-* counted (`chooseOccupancyMediaOwner`). An audio match owns nothing. Nothing
-* was boxed, nothing was tracked, and — deliberately — nothing is persisted at
-* all: a confirmed window is a claim about sound that has already stopped, and
-* `event-intake.ts` states why replaying it later would be wrong.
+* counted (`chooseOccupancyMediaOwner`). Two triggers own nothing, and for the
+* same reason in both cases — the subject is an ABSENCE:
+*
+*  - an **audio** match: nothing was boxed, nothing was tracked, and —
+*    deliberately — nothing is persisted at all. A confirmed window is a claim
+*    about sound that has already stopped, and `event-intake.ts` states why
+*    replaying it later would be wrong.
+*  - an **occupancy** edge whose scope is EMPTY — "posto libero". The vehicle
+*    whose departure IS the news has left, so `chooseOccupancyMediaOwner` names
+*    nobody and the ladder logs `no still could be resolved … owners=[]`.
 *
 * So the only honest picture is a PHOTOGRAPH of the camera taken at the moment
-* of the match. Not of the sound — of what the camera could see while it was
-* heard.
+* of the trigger. Not of the sound, not of the object that left — of what the
+* camera can see now that it happened. For a freed parking space that is
+* exactly the answer the operator wants: the space, empty.
+*
+* **One shelf, not two.** The mechanism is identical down to the reuse window,
+* and the only thing that differs between the two triggers is the GATE deciding
+* that a photograph is owed at all — which belongs at the trigger site, where
+* the rules are, and not here. A twin module would be a second derivation of
+* one thing. The trigger rides along as {@link NcStillTrigger} only so the logs
+* can say which absence they are about.
 *
 * ## Three properties, and each one is a decision
 *
@@ -5580,27 +5595,30 @@ async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
 * TTL that covers the outbox's whole retry horizon — and nowhere else. The
 * alternative was the doorbell's: materialise a synthetic marker track through
 * `SyntheticTrackMaterializer` and let the notification name it. That would put
-* a durable Track on the camera's timeline for every confirmed window, feeding
-* the digest's `listTracks`, retention, and the audio-marker feature's own
-* operator ceilings (`audio-marker-projector.ts` exists precisely to bound how
-* many audio markers a camera may emit). A notification must not manufacture
-* timeline history as a side effect of wanting a picture.
-*
-* **The capture STARTS immediately and is never awaited.** A sound is transient
-* — a scream is over before a snapshot round-trip completes — so the fetch is
-* kicked off at the confirmation, before the rule evaluation runs, and the
-* owner id is minted synchronously so the outbox row can name it. The bytes
-* land while the row waits in the queue, and the dispatcher's existing bounded
-* still-wait (or the pause its own footage render already costs) picks them up.
-* A camera that never answers costs the picture and never the notification.
-*
-* **Two confirmations seconds apart share ONE capture.** A barking dog confirms
+* a durable Track on the camera's timeline for every confirmed window and every
+* emptied zone, feeding the digest's `listTracks`, retention, and the audio-
+* marker feature's own operator ceilings (`audio-marker-projector.ts` exists
+* precisely to bound how many audio markers a camera may emit). A notification
+* must not manufacture timeline history as a side effect of wanting a picture.
+*
+* **The capture STARTS immediately and is never awaited.** The subject is
+* transient — a scream is over before a snapshot round-trip completes, and a
+* freed space is about to be taken by the next car — so the fetch is kicked off
+* at the trigger, before the rule evaluation runs, and the owner id is minted
+* synchronously so the outbox row can name it. The bytes land while the row
+* waits in the queue, and the dispatcher's existing bounded still-wait (or the
+* pause its own footage render already costs) picks them up. A camera that
+* never answers costs the picture and never the notification.
+*
+* **Two triggers seconds apart share ONE capture.** A barking dog confirms
 * repeatedly and a label-mode rule has no re-arm timer at all (D157) — the
 * rule's cooldown is its only brake, and the cooldown is applied AFTER this.
 * Without a reuse window this would photograph a camera at whatever rate the
-* sound happens to occur. Each confirmation still gets its OWN owner id, so two
+* sound happens to occur. Each trigger still gets its OWN owner id, so two
 * outbox rows are never mistaken for one subject; they merely point at the same
-* frame, which is the truth — the scene did not change in ten seconds.
+* frame, which is the truth — the scene did not change in ten seconds. The
+* window is per CAMERA and trigger-agnostic for the same reason: a sound and an
+* emptied zone ten seconds apart are two claims about one scene.
 *
 * Nothing here is silent: a capture that lands and a camera that refuses each
 * emit one line carrying `tags: { deviceId }`, because "why did 617 get a photo
@@ -5608,13 +5626,13 @@ async function downscaleFullFrameJpeg(jpeg, maxWidth = 640, maxHeight = 360) {
 */
 /**
 * The owner-id namespace. It is what routes a lookup here instead of to the
-* media store, and it is the reason the dispatcher needs no audio branch —
-* `getMediaForOwner` answers for both under one signature.
+* media store, and it is the reason the dispatcher needs no audio or occupancy
+* branch — `getMediaForOwner` answers for all of them under one signature.
 */
-var NC_AUDIO_STILL_PREFIX = "nc-audio-still:";
+var NC_STILL_SHELF_PREFIX = "nc-still:";
 /** True for an owner id this shelf minted. */
-function isAudioStillId(id) {
-	return id.startsWith(NC_AUDIO_STILL_PREFIX);
+function isStillShelfId(id) {
+	return id.startsWith(NC_STILL_SHELF_PREFIX);
 }
 /**
 * How long the bytes are held.
@@ -5624,16 +5642,16 @@ function isAudioStillId(id) {
 * ships text-only, which is the correct degradation for a photograph of a scene
 * that is a quarter of an hour stale anyway.
 */
-var NC_AUDIO_STILL_TTL_MS = 15 * 6e4;
+var NC_STILL_SHELF_TTL_MS = 15 * 6e4;
 /** A hanging snapshot cap must not pin a capture slot forever. */
 var SNAPSHOT_TIMEOUT_MS = 8e3;
 /**
-* Hard bound on held captures. Reached only if every camera on the hub confirms
-* an audio rule inside one TTL; the oldest is dropped first, which costs a
+* Hard bound on held captures. Reached only if every camera on the hub triggers
+* one inside a single TTL; the oldest is dropped first, which costs a
 * fifteen-minute-old picture nobody is waiting for.
 */
 var MAX_CAPTURES = 64;
-var NcAudioStillShelf = class {
+var NcStillShelf = class {
 	deps;
 	/** captureId → the photograph. */
 	captures = /* @__PURE__ */ new Map();
@@ -5645,14 +5663,14 @@ var NcAudioStillShelf = class {
 		this.deps = deps;
 	}
 	/**
-	* Photograph `deviceId` for a match at `atMs`, and return the owner id the
-	* subject should name. SYNCHRONOUS by contract: the caller is on the audio
-	* confirmation path and the outbox row is built from what this returns.
+	* Photograph `deviceId` for a trigger at `atMs`, and return the owner id the
+	* subject should name. SYNCHRONOUS by contract: the caller is on the trigger
+	* path and the outbox row is built from what this returns.
 	*/
-	capture(deviceId, atMs) {
+	capture(deviceId, atMs, trigger) {
 		const now = this.deps.now();
 		this.prune(now);
-		const ownerId = `${NC_AUDIO_STILL_PREFIX}${randomUUID()}`;
+		const ownerId = `${NC_STILL_SHELF_PREFIX}${randomUUID()}`;
 		const recent = this.newest.get(deviceId);
 		if (recent !== void 0 && now - recent.at < 1e4 && this.captures.has(recent.captureId)) {
 			this.owners.set(ownerId, recent.captureId);
@@ -5661,8 +5679,9 @@ var NcAudioStillShelf = class {
 		const captureId = randomUUID();
 		this.captures.set(captureId, {
 			deviceId,
+			trigger,
 			startedAt: now,
-			expiresAt: now + NC_AUDIO_STILL_TTL_MS,
+			expiresAt: now + NC_STILL_SHELF_TTL_MS,
 			files: []
 		});
 		this.newest.set(deviceId, {
@@ -5670,7 +5689,7 @@ var NcAudioStillShelf = class {
 			at: now
 		});
 		this.owners.set(ownerId, captureId);
-		this.fetch(captureId, deviceId, atMs);
+		this.fetch(captureId, deviceId, atMs, trigger);
 		return ownerId;
 	}
 	/**
@@ -5706,11 +5725,11 @@ var NcAudioStillShelf = class {
 		this.owners.clear();
 		this.newest.clear();
 	}
-	async fetch(captureId, deviceId, atMs) {
+	async fetch(captureId, deviceId, atMs, trigger) {
 		try {
 			const shot = await withTimeout$3(this.deps.getSnapshot(deviceId), SNAPSHOT_TIMEOUT_MS);
 			if (shot === null || shot.base64.length === 0) {
-				this.reportMiss(deviceId, "the camera returned no snapshot");
+				this.reportMiss(deviceId, trigger, "the camera returned no snapshot");
 				return;
 			}
 			const raw = Buffer.from(shot.base64, "base64");
@@ -5722,17 +5741,18 @@ var NcAudioStillShelf = class {
 			if (held === void 0) return;
 			this.captures.set(captureId, {
 				...held,
-				files: audioStillMedia(data, atMs)
+				files: stillShelfMedia(data, atMs)
 			});
-			this.deps.logger.info("audio still captured", {
+			this.deps.logger.info(`${trigger} still captured`, {
 				tags: { deviceId },
 				meta: {
+					trigger,
 					bytes: data.byteLength,
 					tookMs: this.deps.now() - held.startedAt
 				}
 			});
 		} catch (err) {
-			this.reportMiss(deviceId, err instanceof Error ? err.message : String(err));
+			this.reportMiss(deviceId, trigger, err instanceof Error ? err.message : String(err));
 		}
 	}
 	/**
@@ -5740,10 +5760,13 @@ var NcAudioStillShelf = class {
 	* on a notification they DID receive, so it is a warn and it carries the
 	* camera — the only key the question is ever asked with.
 	*/
-	reportMiss(deviceId, reason) {
-		this.deps.logger.warn("the camera did not answer the audio still — this notification ships text-only", {
+	reportMiss(deviceId, trigger, reason) {
+		this.deps.logger.warn(`the camera did not answer the ${trigger} still — this notification ships text-only`, {
 			tags: { deviceId },
-			meta: { reason }
+			meta: {
+				trigger,
+				reason
+			}
 		});
 	}
 };
@@ -5758,10 +5781,10 @@ var NcAudioStillShelf = class {
 * so. Inventing a centre crop would answer a different question from the one
 * the operator asked.
 */
-function audioStillMedia(data, timestamp) {
+function stillShelfMedia(data, timestamp) {
 	const base64 = data.toString("base64");
 	const file = (kind) => ({
-		key: `${NC_AUDIO_STILL_PREFIX}${kind}`,
+		key: `${NC_STILL_SHELF_PREFIX}${kind}`,
 		kind,
 		base64,
 		sizeBytes: data.byteLength,
@@ -7427,7 +7450,7 @@ function subjectFromSensorEvent(ev, markerTrackId) {
 * (see the {@link evaluateRule} audio gate + the matchers below).
 *
 * `stillOwnerId` is the audio still shelf's owner id — the photograph of the
-* camera taken at the match (`audio-still.ts`). It rides `trackId` because that
+* camera taken at the match (`still-shelf.ts`). It rides `trackId` because that
 * is the field the attachment ladder reads, exactly as a doorbell press rides
 * its marker track's id; nothing else about the subject is track-scoped, and
 * `buildEntries` keys an audio row on its record id, never on this. Absent when
@@ -7519,10 +7542,18 @@ function audioSubjectFor(hit, spec) {
 * chosen at commit (`chooseOccupancyMediaOwner`) — rides on `trackId`, and that
 * is the whole of what gives an occupancy notification a picture: the ordinary
 * media-owner ladder resolves it, exactly as it resolves a doorbell's marker
-* track. Absent when the scope held no member (a became-free edge) ⇒ text-only,
-* by design.
-*/
-function subjectFromOccupancyEvent(edge) {
+* track.
+*
+* `stillOwnerId` is the SECOND source of that picture and the only one an
+* emptied scope can have: with no member left to name — "posto libero", where
+* the object whose departure is the news has gone — the trigger site photographs
+* the camera and holds the bytes on the still shelf (`still-shelf.ts`), exactly
+* as an audio match does. The member track always WINS: it is a picture of the
+* counted object, and a photograph is only ever the stand-in for not having one.
+* Neither present (no snapshot cap on this node) ⇒ text-only, as before.
+*/
+function subjectFromOccupancyEvent(edge, stillOwnerId) {
+	const mediaOwner = edge.mediaTrackId ?? stillOwnerId;
 	return {
 		kind: "occupancy-event",
 		recordId: `occ:${edge.deviceId}:${edge.zoneId ?? "@frame"}:${edge.className ?? "@all"}:t${edge.threshold}:${edge.occupied ? "occ" : "free"}:${edge.timestamp}`,
@@ -7530,17 +7561,28 @@ function subjectFromOccupancyEvent(edge) {
 		timestamp: edge.timestamp,
 		classNames: [edge.className ?? "occupancy"],
 		zones: [],
-		...edge.mediaTrackId !== void 0 ? { trackId: edge.mediaTrackId } : {},
+		...mediaOwner !== void 0 ? { trackId: mediaOwner } : {},
 		source: "pipeline",
-		occupancy: {
-			...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
-			...edge.zoneName !== void 0 ? { zoneName: edge.zoneName } : {},
-			...edge.className !== void 0 ? { className: edge.className } : {},
-			count: edge.count,
-			previousCount: edge.previousCount,
-			occupied: edge.occupied,
-			threshold: edge.threshold
-		}
+		occupancy: occupancySubjectFromEdge(edge)
+	};
+}
+/**
+* The scope + level half of an occupancy subject, ALONE.
+*
+* Split out for one reason: the still-shelf gate must ask `matchesOccupancy`
+* whether a rule would fire on an edge BEFORE the subject that would carry the
+* answer exists (the owner id it mints is an input to that subject). Sharing
+* this keeps the gate reading the same numbers the verdict will.
+*/
+function occupancySubjectFromEdge(edge) {
+	return {
+		...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
+		...edge.zoneName !== void 0 ? { zoneName: edge.zoneName } : {},
+		...edge.className !== void 0 ? { className: edge.className } : {},
+		count: edge.count,
+		previousCount: edge.previousCount,
+		occupied: edge.occupied,
+		threshold: edge.threshold
 	};
 }
 /** Build the subject for a `package-event` evaluation (a persisted `package`
@@ -7667,6 +7709,13 @@ function matchesAudio(cond, s) {
 	}
 	return false;
 }
+/**
+* Exported for ONE caller: the still-shelf gate in the centre, which must know
+* — before the outbox row exists — whether any enabled rule would fire on THIS
+* edge and wants a picture for it. Sharing the predicate is what keeps that gate
+* from becoming a second, drifting opinion about which edge belongs to which
+* rule. It is pure and reads nothing.
+*/
 function matchesOccupancy(occ, s) {
 	if ((occ.zoneId ?? void 0) !== (s.zoneId ?? void 0)) return false;
 	if ((occ.className ?? void 0) !== (s.className ?? void 0)) return false;
@@ -9874,7 +9923,7 @@ function incomingFromSensorEvent(event, markerTrackId) {
 * Audio-event persist (classified episode).
 *
 * `stillOwnerId` is the audio still shelf's owner id for the photograph taken
-* at this episode (`audio-still.ts`). Absent when no rule that could fire asked
+* at this episode (`still-shelf.ts`). Absent when no rule that could fire asked
 * for a picture — the same shape `incomingFromSensorEvent` carries its marker.
 */
 function incomingFromAudioEvent(event, stillOwnerId) {
@@ -9955,10 +10004,16 @@ function audioHitMeta(hit) {
 		samples: window.samples
 	};
 }
-/** A committed ZoneAnalytics occupancy edge. */
-function incomingFromOccupancyEdge(edge) {
+/**
+* A committed ZoneAnalytics occupancy edge.
+*
+* `stillOwnerId` — see {@link subjectFromOccupancyEvent}. An edge whose scope is
+* empty owns no member track, so the only picture it can carry is a photograph
+* of its camera taken at the edge, held on the still shelf under this id.
+*/
+function incomingFromOccupancyEdge(edge, stillOwnerId) {
 	return {
-		subject: subjectFromOccupancyEvent(edge),
+		subject: subjectFromOccupancyEvent(edge, stillOwnerId),
 		kind: "occupancy-event",
 		origin: "pipeline",
 		log: () => ({
@@ -14144,7 +14199,11 @@ function mosaicTextPlan(captions) {
 	};
 }
 /** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
-*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
+*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip.
+*
+*  `rows` is the load-bearing half — it is how many rows {@link mosaicRowCounts}
+*  distributes into. `cols` describes the WIDEST row, and is no longer a cell
+*  count: see {@link mosaicRowCounts} for why a `cols × rows` grid was the bug. */
 function mosaicGrid(n) {
 	const count = Math.max(1, Math.floor(n));
 	const cols = Math.ceil(Math.sqrt(count));
@@ -14154,31 +14213,84 @@ function mosaicGrid(n) {
 	};
 }
 /**
+* How many tiles each ROW carries, top to bottom — and the reason the mosaic
+* can no longer have a hole in it.
+*
+* The layout used to be a `cols × rows` GRID, and a grid holds more cells than
+* tiles for every count that is not a perfect fit: 3 into a 2×2, 5 into a 3×2,
+* 7 and 8 into a 3×3. The composite only ever wrote the tiles, so the spare
+* cells stayed the canvas — `MOSAIC_BACKGROUND`, rgb 17 — and the operator's
+* three-tile digest was a quarter black. Measured on the shipped renderer:
+* 24.8% of a three-tile mosaic was background. His words: *"se ci sono 3
+* elementi non dovrebbe renderizzare buchi neri"*.
+*
+* Counting ROWS instead removes the failure by construction rather than by
+* patching it. Every row spans the full width and divides it among the tiles it
+* actually has, so a row is full whatever the remainder and there is no such
+* thing as a spare cell. The shapes fall out of it, and they are the ones asked
+* for: 1 ⇒ full frame, 2 ⇒ side by side, 3 ⇒ one big over two small, 4 ⇒ 2×2.
+*
+* **The fewer-tiled row comes FIRST.** Tiles arrive in the selection's order,
+* so row 0 is the head of the ranking; putting the remainder at the top would
+* make the WORST tile the big one.
+*
+* Every cell keeps {@link TILE_ASPECT}, so rows differ in height — which is
+* also what stops the letterbox: a full-width hero tile is 16:9 exactly, not a
+* 16:9 picture centred in a double-height cell with bars over and under it.
+*/
+function mosaicRowCounts(n) {
+	const count = Math.max(1, Math.floor(n));
+	const { rows } = mosaicGrid(count);
+	const base = Math.floor(count / rows);
+	const remainder = count % rows;
+	const counts = [];
+	for (let row = 0; row < rows; row += 1) counts.push(row < rows - remainder ? base : base + 1);
+	return counts;
+}
+/**
 * Where every tile lands. Pure — no bytes, no sharp, no clock.
 *
 * Exported because the rectangles are DATA the artefact should carry: a viewer
 * that wants a tappable mosaic reads these rather than re-deriving a layout
 * that could drift from the one actually rendered.
+*
+* The rectangles COVER the picture area exactly — that is the property the
+* spec asserts, and it is the one the old grid broke.
 */
 function mosaicLayout(input) {
-	const { cols, rows } = mosaicGrid(input.tileCount);
-	const maxWidth = input.maxWidth ?? 1920;
-	const tileWidth = Math.max(160, Math.floor(maxWidth / cols));
+	const rowCounts = mosaicRowCounts(input.tileCount);
+	const width = Math.max(1, Math.floor(input.maxWidth ?? 1920));
+	const firstRowCount = rowCounts[0] ?? 1;
+	const tileWidth = Math.floor(width / firstRowCount);
 	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
 	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
 	const tiles = [];
-	for (let index = 0; index < Math.max(1, input.tileCount); index += 1) tiles.push({
-		index,
-		x: index % cols * tileWidth,
-		y: titleHeight + Math.floor(index / cols) * tileHeight,
-		w: tileWidth,
-		h: tileHeight
-	});
+	let y = titleHeight;
+	let index = 0;
+	for (const count of rowCounts) {
+		const nominalWidth = Math.floor(width / count);
+		const rowHeight = Math.round(nominalWidth * TILE_ASPECT);
+		let x = 0;
+		for (let inRow = 0; inRow < count; inRow += 1) {
+			const w = inRow === count - 1 ? width - x : nominalWidth;
+			tiles.push({
+				index,
+				x,
+				y,
+				w,
+				h: rowHeight
+			});
+			x += w;
+			index += 1;
+		}
+		y += rowHeight;
+	}
 	return {
-		width: cols * tileWidth,
-		height: titleHeight + rows * tileHeight,
-		cols,
-		rows,
+		width,
+		height: y,
+		cols: Math.max(...rowCounts),
+		rows: rowCounts.length,
+		rowCounts,
 		tileWidth,
 		tileHeight,
 		titleHeight,
@@ -14242,36 +14354,20 @@ function titleSvg(width, height, caption) {
 *
 * A tile sharp cannot read is DROPPED and counted, never composited as a blank
 * cell — a black square in a digest reads as "the camera saw nothing", which is
-* the opposite of what happened. The grid is recomputed from the survivors so
-* the mosaic has no hole.
+* the opposite of what happened. The layout is computed from the SURVIVORS, and
+* because {@link mosaicRowCounts} counts rows rather than grid cells there is no
+* remainder to leave empty either.
 *
-* @throws only if sharp cannot produce the final canvas at all; the caller
-*         treats that as "no mosaic" and still delivers the counts.
+* @throws when every tile was dropped, and when sharp cannot produce the final
+*         canvas at all; the caller treats both as "no mosaic" and still
+*         delivers the counts.
 */
 async function renderMosaic(request, logger) {
 	const plan = mosaicTextPlan(request.captions);
-	const decoded = [];
-	const probeLayout = mosaicLayout({
-		tileCount: Math.max(1, request.tiles.length),
-		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
-	});
+	const usable = [];
 	for (const tile of request.tiles) try {
-		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
-		const fitted = sharp(tile.jpeg).resize({
-			width: probeLayout.tileWidth,
-			height: probeLayout.tileHeight,
-			fit: "contain",
-			background: MOSAIC_BACKGROUND
-		});
-		const resized = await (label.length === 0 ? fitted : fitted.composite([{
-			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, label),
-			top: 0,
-			left: 0
-		}])).jpeg({ quality: 82 }).toBuffer();
-		decoded.push({
-			tile,
-			resized
-		});
+		await sharp(tile.jpeg).metadata();
+		usable.push(tile);
 	} catch (err) {
 		logger.warn("summary mosaic: a tile could not be decoded and was dropped", {
 			tags: { deviceId: tile.deviceId },
@@ -14281,23 +14377,34 @@ async function renderMosaic(request, logger) {
 			}
 		});
 	}
-	const droppedTiles = request.tiles.length - decoded.length;
+	const droppedTiles = request.tiles.length - usable.length;
+	if (usable.length === 0) throw new Error(`summary mosaic: no tile could be decoded (${request.tiles.length} offered)`);
 	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
 	const layout = mosaicLayout({
-		tileCount: Math.max(1, decoded.length),
+		tileCount: usable.length,
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
 		withTitle: caption.length > 0
 	});
-	const composites = await Promise.all(decoded.map(async ({ resized }, index) => ({
-		input: layout.tileWidth === probeLayout.tileWidth && layout.tileHeight === probeLayout.tileHeight ? resized : await sharp(resized).resize({
-			width: layout.tileWidth,
-			height: layout.tileHeight,
+	const composites = await Promise.all(usable.map(async (tile, index) => {
+		const rect = layout.tiles[index];
+		if (rect === void 0) throw new Error("summary mosaic: layout lost a tile");
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = sharp(tile.jpeg).resize({
+			width: rect.w,
+			height: rect.h,
 			fit: "contain",
 			background: MOSAIC_BACKGROUND
-		}).jpeg({ quality: 82 }).toBuffer(),
-		top: layout.tiles[index]?.y ?? 0,
-		left: layout.tiles[index]?.x ?? 0
-	})));
+		});
+		return {
+			input: await (label.length === 0 ? fitted : fitted.composite([{
+				input: tileLabelSvg(rect.w, rect.h, label),
+				top: 0,
+				left: 0
+			}])).jpeg({ quality: 82 }).toBuffer(),
+			top: rect.y,
+			left: rect.x
+		};
+	}));
 	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
 		input: titleSvg(layout.width, layout.titleHeight, caption),
 		top: 0,
@@ -14513,6 +14620,36 @@ function buildSummaryOutboxInputs(input) {
 * the quota degrades honestly: the best cameras get their one tile, the rest
 * are counted as dropped and the count rides the log line — never silently.
 *
+* ## Only tracks the pipeline PROMOTED
+*
+* A digest is retrospective. The operator's own framing, verbatim: *"ideale
+* sarebbe considerare solo tracce che vengono alla fine promosse a tracce, dato
+* che il summary non è atteso di essere realtime"* — the window is closed
+* before this function is called, so the selection may wait for the pipeline's
+* verdict instead of guessing at it.
+*
+* The verdict is `SortTracker`'s own promotion threshold: a candidate is not
+* emitted as a track until it has been matched on `minHits` frames
+* (`isConfirmedForEmit`, per-device setting, *"minimum consecutive detection
+* hits before a track is promoted to output"*). The gate here re-applies that
+* same threshold to what the CLOSED row actually left behind — the count of
+* recorded sightings on its trajectory — and the port that builds a candidate
+* is the only thing that knows the device's `minHits`.
+*
+* This is not a movement heuristic and deliberately so: `totalDistance` and
+* `state` were both measured against live traffic and both hide real passages.
+* What they cannot see is the shape this gate is for — a row whose whole life
+* is one or two frames. Measured on device 617 (2026-08-19 04:12): two rows,
+* `closedReason` NULL so the parked pass is blind to them, dwell 53 ms,
+* `totalDistance` 0, two recorded sightings each. And `minImportance` cannot
+* cover it either, structurally: the static-track gate that demotes a frozen
+* subject needs two centroids to measure anything
+* (`computeStaticTrackMetrics`), so a single-sighting row is exactly the shape
+* it never scores down — 33 of the live hub's 34 such rows sit at or above 0.2.
+*
+* There is no rule field to turn it off. A digest of things that were never
+* tracks has no audience, and this repo has shipped knobs nobody read.
+*
 * ## Zones are scoped PER CAMERA
 *
 * `filters.zones` is a flat id list on a rule that spans cameras, and zone ids
@@ -14536,15 +14673,20 @@ function dwellSeconds(candidate) {
 * branch that discards work silently reads as "it never happened".
 */
 function filterSummaryCandidates(candidates, filters, zoneOwner) {
-	const moving = filters?.includeStationary === true ? candidates : candidates.filter((candidate) => candidate.stationary !== true);
-	const droppedStationary = candidates.length - moving.length;
+	const promoted = candidates.filter((candidate) => candidate.confirmed !== false);
+	const droppedUnconfirmed = candidates.length - promoted.length;
+	const unknownConfirmation = promoted.filter((candidate) => candidate.confirmed === void 0).length;
+	const moving = filters?.includeStationary === true ? promoted : promoted.filter((candidate) => candidate.stationary !== true);
+	const droppedStationary = promoted.length - moving.length;
 	if (filters === void 0) return {
 		kept: [...moving],
 		droppedByClass: 0,
 		droppedByZone: 0,
 		droppedByImportance: 0,
 		droppedByDwell: 0,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 	const include = filters.classes;
 	const exclude = new Set(filters.classesExclude ?? []);
@@ -14590,7 +14732,9 @@ function filterSummaryCandidates(candidates, filters, zoneOwner) {
 		droppedByZone,
 		droppedByImportance,
 		droppedByDwell,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 }
 /**
@@ -14966,7 +15110,9 @@ var NcSummaryProducer = class {
 					droppedByZone: filtered.droppedByZone,
 					droppedByImportance: filtered.droppedByImportance,
 					droppedByDwell: filtered.droppedByDwell,
-					droppedStationary: filtered.droppedStationary
+					droppedStationary: filtered.droppedStationary,
+					droppedUnconfirmed: filtered.droppedUnconfirmed,
+					unknownConfirmation: filtered.unknownConfirmation
 				} });
 				if (opts.stamp) await this.deps.store.markGenerated(rule.id, window.endMs);
 				return {
@@ -15030,6 +15176,8 @@ var NcSummaryProducer = class {
 				scanned: candidates.length,
 				matched: filtered.kept.length,
 				droppedStationary: filtered.droppedStationary,
+				droppedUnconfirmed: filtered.droppedUnconfirmed,
+				unknownConfirmation: filtered.unknownConfirmation,
 				droppedByClass: filtered.droppedByClass,
 				tiles: loaded.length,
 				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
@@ -16072,7 +16220,7 @@ function isSyntheticId(id) {
 *  - and, since 2026-08-15, a `trackId` for both AUDIO kinds: a sound owns no
 *    frame, so production photographs the camera at the match and holds the
 *    bytes on the still shelf under an owner id the subject names
-*    (`audio-still.ts`). The tester's RAM-held frame stands in for exactly that
+*    (`still-shelf.ts`). The tester's RAM-held frame stands in for exactly that
 *    photograph, and — unlike every other kind here — it is taken the same way
 *    production takes it, at the same moment, from the same cap.
 *
@@ -18739,11 +18887,12 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	syntheticMedia = /* @__PURE__ */ new Map();
 	/**
-	* The photograph a SOUND rule's notification carries — see `audio-still.ts`.
-	* Null when this wiring has no snapshot cap, which leaves every audio
-	* notification text-only rather than broken.
+	* The photograph a notification carries when the subject it is about is an
+	* ABSENCE — a sound that owns no frame, an emptied occupancy scope that owns
+	* no member. See `still-shelf.ts`. Null when this wiring has no snapshot cap,
+	* which leaves those notifications text-only rather than broken.
 	*/
-	audioStills;
+	stills;
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
 	lastNoMatchReportAt = /* @__PURE__ */ new Map();
 	noMatchSuppressed = /* @__PURE__ */ new Map();
@@ -19040,9 +19189,9 @@ var NotificationCenter = class NotificationCenter {
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
 		const getSnapshot = deps.getSnapshot;
-		this.audioStills = getSnapshot !== void 0 ? new NcAudioStillShelf({
+		this.stills = getSnapshot !== void 0 ? new NcStillShelf({
 			getSnapshot,
-			logger: this.logger.child("audio-still"),
+			logger: this.logger.child("still-shelf"),
 			now: this.now
 		}) : null;
 		this.rules = new NcRuleStore({
@@ -19132,8 +19281,8 @@ var NotificationCenter = class NotificationCenter {
 			getMediaForOwner: async (ownerKind, ownerId) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
-				const audio = isAudioStillId(ownerId) ? this.audioStills?.get(ownerId) : void 0;
-				if (audio !== void 0) return audio;
+				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
+				if (shelved !== void 0) return shelved;
 				return deps.dispatcher.getMediaForOwner(ownerKind, ownerId);
 			},
 			...deps.now !== void 0 ? { now: deps.now } : {},
@@ -19339,7 +19488,7 @@ var NotificationCenter = class NotificationCenter {
 		}
 		this.timelapseScheduler?.stop();
 		this.summaryProducer?.stop();
-		this.audioStills?.clear();
+		this.stills?.clear();
 		this.addonUpdates.dispose();
 		this.livenessHoldoff.dispose();
 		this.evaluationActive = false;
@@ -19691,14 +19840,14 @@ var NotificationCenter = class NotificationCenter {
 	* direction that DESTROYS the media.
 	*/
 	audioStillOwner(deviceId, atMs, mode) {
-		const shelf = this.audioStills;
+		const shelf = this.stills;
 		if (shelf === null || !this.evaluationActive) return void 0;
 		for (const rule of this.rules.listEnabled("immediate")) {
 			if (rule.media.attach === "none") continue;
 			if (!(mode === "condition" ? rule.conditions.audio !== void 0 : rule.conditions.audio === void 0 && referencesAudioClass(rule.conditions.classes))) continue;
 			const devices = rule.conditions.devices;
 			if (devices !== void 0 && devices.length > 0 && !devices.includes(deviceId)) continue;
-			return shelf.capture(deviceId, atMs);
+			return shelf.capture(deviceId, atMs, "audio");
 		}
 	}
 	/**
@@ -19757,7 +19906,48 @@ var NotificationCenter = class NotificationCenter {
 	* Public so a test / a future out-of-band edge source can drive it directly.
 	*/
 	onOccupancyEdge(edge) {
-		this.consumeEvent(incomingFromOccupancyEdge(edge));
+		this.consumeEvent(incomingFromOccupancyEdge(edge, this.occupancyStillOwner(edge)));
+	}
+	/**
+	* Start photographing this edge's camera NOW and return the owner id its
+	* subject should name — or `undefined` when nothing would use it.
+	*
+	* **Only an edge that owns NOBODY.** `chooseOccupancyMediaOwner` names a
+	* member track whenever the scope holds one, and that picture is of the
+	* counted object itself; a photograph is strictly the stand-in for not having
+	* one. The case this exists for is "posto libero" (camera 617): the vehicle
+	* whose departure IS the notification has left, so the scope is empty, the
+	* ladder resolves nothing and the delivery logged `no still could be resolved
+	* … owners=[]`. A became-free edge has no owner BY CONSTRUCTION, and a
+	* became-occupied edge can lack one too (every member parked, i.e.
+	* `stationary:`) — so the gate is the ABSENCE itself, not the polarity. That
+	* is the honest predicate: photograph exactly the edges whose media cannot be
+	* resolved, and no others.
+	*
+	* **The capture is not awaited**, for the audio shelf's reason and one of its
+	* own: a freed space is about to be taken by the next car, and a still fetched
+	* after the outbox drained would show it occupied again.
+	*
+	* **The gate is the RULE's media policy AND the engine's own verdict.** The
+	* watcher commits both polarities of every watched key, so a hub with only a
+	* became-occupied rule still produces free edges — photographing those would
+	* be a snapshot no notification can ever carry. `matchesOccupancy` is the same
+	* predicate `evaluateRule` will apply, shared rather than restated. The rule
+	* cache is an in-memory mirror, so this is not a fallible read (D49).
+	*/
+	occupancyStillOwner(edge) {
+		const shelf = this.stills;
+		if (shelf === null || !this.evaluationActive) return void 0;
+		if (edge.mediaTrackId !== void 0) return void 0;
+		const subject = occupancySubjectFromEdge(edge);
+		for (const rule of this.rules.listEnabled("device-event")) {
+			if (rule.media.attach === "none") continue;
+			const occ = rule.conditions.occupancy;
+			if (occ === void 0 || !matchesOccupancy(occ, subject)) continue;
+			const devices = rule.conditions.devices;
+			if (devices !== void 0 && devices.length > 0 && !devices.includes(edge.deviceId)) continue;
+			return shelf.capture(edge.deviceId, edge.timestamp, "occupancy");
+		}
 	}
 	/**
 	* Feed ONE audio inference frame into the sampling-window matcher.
@@ -20724,7 +20914,7 @@ var NotificationCenter = class NotificationCenter {
 						kind,
 						ruleId: rule.id,
 						rule: rule.name,
-						snapshotWired: this.audioStills !== null
+						snapshotWired: this.stills !== null
 					}
 				});
 			}
@@ -20889,6 +21079,7 @@ var NotificationCenter = class NotificationCenter {
 		if (subject.kind === "audio-window" || subject.kind === "audio-event") return { outcome: "disabled" };
 		const trackId = subject.trackId;
 		if (trackId === void 0) return { outcome: "disabled" };
+		if (isStillShelfId(trackId)) return { outcome: "disabled" };
 		const member = {
 			trackId,
 			className: subject.classNames[0] ?? "event",
@@ -22131,6 +22322,16 @@ function planRuleTest(input) {
 *    never be re-owned through a patch.
 *  - `nc.setRuleTargetEnabled` — a user opting HIS OWN target out of a rule
 *    VISIBLE to him (his own personal rule OR a global/admin rule).
+*  - the TIMELAPSE and DIGEST families (`nc.*TimelapseRule*`,
+*    `nc.*SummaryRule*`) repeat that model exactly over their own stores. The
+*    digest half was `auth: 'admin'` in v1 and was relaxed once the operator
+*    closed the cost question; `nc.listSummaryRules` reports the current answer
+*    as `canAuthor` so a client talking to an older hub degrades to a read-only
+*    list instead of discovering the refusal as a 403 on a filled-in form.
+*  - the three TEST actions (`nc.injectTestEvent`, `nc.testRule`,
+*    `nc.testTimelapseRule`, `nc.testSummaryRule`) stay `auth: 'admin'`
+*    regardless of who owns the rule: they DELIVER, to every target the rule
+*    addresses, on other people's phones.
 *
 * Target-ownership limits (personal-rule delivery target list + the opt-out
 * target) are enforced against the notifiers target catalog; ADMINS bypass the
@@ -22349,7 +22550,25 @@ var ncActions = defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
-	"nc.listSummaryRules": customAction(object({}), object({ rules: array(NcViewerSummaryRuleSchema) }), { caller: "required" }),
+	"nc.listSummaryRules": customAction(object({}), object({
+		rules: array(NcViewerSummaryRuleSchema),
+		/**
+		* DOES THIS HUB LET THE CALLER AUTHOR ONE? The capability probe, and the
+		* only honest way a client can know.
+		*
+		* `nc.upsertSummaryRule` was `auth: 'admin'` until the operator closed
+		* that decision, and a viewer talking to a hub that still refuses has to
+		* find out BEFORE it offers a "New summary rule" button — otherwise the
+		* only feedback is a 403 taken in front of the operator on a form they
+		* had already filled in. ADDITIVE and therefore `.optional()` on every
+		* client mirror: absent means an older hub, which the viewer reads as "no
+		* authoring" and degrades to a read-only list with a note.
+		*
+		* Derived from the same predicate the handlers enforce — never a constant
+		* `true` — so a hub that re-tightened the auth could not say otherwise.
+		*/
+		canAuthor: boolean()
+	}), { caller: "required" }),
 	/**
 	* ONE action for create AND update, like `nc.upsertTimelapseRule`: a digest
 	* rule is authored as a whole (cameras + window + filters + targets) and the
@@ -22358,10 +22577,18 @@ var ncActions = defineCustomActions({
 	*
 	* `ruleId` absent ⇒ create from `rule`; present ⇒ patch.
 	*
-	* `auth: 'admin'` in v1 (operator decision): a digest spans cameras and, once
-	* P2 lands, consumes the local vision model. A personal rule that fans vision
-	* calls across other people's cameras is a decision to take after the real
-	* cost has been watched for a few weeks, not before.
+	* `caller: 'required'`, NOT `auth: 'admin'`. It was admin-only in v1 because
+	* a digest spans cameras and consumes the local vision model, and that cost
+	* had not been watched yet. The operator closed the decision, so this now
+	* carries exactly the auth the two rule families beside it carry: ownership
+	* is enforced in the handler, `ownerUserId` is STAMPED from the resolved
+	* caller, a personal rule may deliver only to targets that caller OWNS, and an
+	* admin still authors GLOBAL rules. No new ownership model was invented for
+	* it — `NcSummaryStore` has had `ownerUserId` / `listForOwner` since it was
+	* written and they were simply not reachable.
+	*
+	* `nc.testSummaryRule` stays admin: that one DELIVERS, on other people's
+	* phones.
 	*/
 	"nc.upsertSummaryRule": customAction(object({
 		ruleId: string().optional(),
@@ -22369,12 +22596,10 @@ var ncActions = defineCustomActions({
 		patch: NcSummaryRulePatchSchema.optional()
 	}), object({ rule: NcSummaryRuleSchema }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	"nc.deleteSummaryRule": customAction(object({ ruleId: string() }), object({ success: literal(true) }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	/**
@@ -22468,6 +22693,17 @@ var ncActions = defineCustomActions({
 	*  a surface that distinguishes them reports what other people own. */
 	"nc.getArtifact": customAction(object({ artifactId: string().min(1) }), object({ artifact: NcArtifactRecordSchema.nullable() }), { caller: "required" })
 });
+/**
+* Does THIS build let a non-admin author a digest rule?
+*
+* A named constant rather than a literal `true` at the call site, so the one
+* fact `nc.listSummaryRules.canAuthor` reports and the auth the upsert actually
+* carries sit beside each other and are changed together. If the operator ever
+* re-tightens the action, this goes to `false` in the same edit and the viewer
+* degrades on the next list — instead of the app discovering it by taking a 403
+* on a form the operator had already filled in.
+*/
+var SUMMARY_AUTHORING_OPEN = true;
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
 function requireCaller$1(caller) {
 	if (!caller || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error("forbidden: authenticated caller required");
@@ -22528,6 +22764,22 @@ function makeNcActionHandlers(deps) {
 		if (editor === void 0) throw new Error("this node does not host the notification text catalog — use the hub");
 		return editor;
 	};
+	/**
+	* A digest rule the caller may EDIT. Same shape and same admin bypass as
+	* {@link assertTimelapseEditable} — deliberately, because a second ownership
+	* model for the third rule family is a second place to get it wrong.
+	*
+	* A GLOBAL rule (no `ownerUserId`, what an admin authors) is VISIBLE to
+	* everyone and editable by admins only: `listForOwner` returns it, so a user
+	* sees it in the list, and `readOnly` says so.
+	*/
+	const assertSummaryEditable = (ruleId, caller, sum) => {
+		const rule = sum.store.get(ruleId);
+		if (rule === null) throw new Error(`forbidden: summary rule not found: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== caller.userId) throw new Error(`forbidden: summary rule not owned: ${ruleId}`);
+		return rule;
+	};
 	/** A timelapse rule the caller may EDIT. Same admin bypass as `NcRule`. */
 	const assertTimelapseEditable = (ruleId, caller, tl) => {
 		const rule = tl.store.get(ruleId);
@@ -22798,21 +23050,23 @@ function makeNcActionHandlers(deps) {
 		"nc.listSummaryRules": async (_input, caller) => {
 			const c = requireCaller$1(caller);
 			const sum = requireSummary();
-			return { rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
-				...r,
-				readOnly: !c.isAdmin
-			})) };
+			return {
+				rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
+					...r,
+					readOnly: !c.isAdmin && r.ownerUserId !== c.userId
+				})),
+				canAuthor: SUMMARY_AUTHORING_OPEN
+			};
 		},
 		"nc.upsertSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to author a summary rule");
 			const sum = requireSummary();
 			if (input.ruleId === void 0) {
 				if (input.rule === void 0) throw new Error("upsertSummaryRule: rule or ruleId required");
 				const parsed = NcSummaryRuleInputSchema.parse(input.rule);
 				assertSummaryBudget(parsed);
 				await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
-				const rule = await sum.store.create(parsed, c.userId);
+				const rule = await sum.store.create(parsed, c.userId, c.isAdmin ? void 0 : c.userId);
 				deps.logger.info("summary rule created", { meta: {
 					ruleId: rule.id,
 					owner: c.userId,
@@ -22820,8 +23074,7 @@ function makeNcActionHandlers(deps) {
 				} });
 				return { rule };
 			}
-			const existing = sum.store.get(input.ruleId);
-			if (existing === null) throw new Error(`forbidden: summary rule not found: ${input.ruleId}`);
+			const existing = assertSummaryEditable(input.ruleId, c, sum);
 			if (input.patch === void 0) throw new Error("upsertSummaryRule: patch required");
 			const patch = NcSummaryRulePatchSchema.parse(input.patch);
 			assertSummaryBudget({
@@ -22838,8 +23091,9 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.deleteSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to delete a summary rule");
-			await requireSummary().store.delete(input.ruleId);
+			const sum = requireSummary();
+			assertSummaryEditable(input.ruleId, c, sum);
+			await sum.store.delete(input.ruleId);
 			deps.logger.info("summary rule deleted", { meta: {
 				ruleId: input.ruleId,
 				owner: c.userId
@@ -44118,7 +44372,9 @@ var TrackStore = class {
 	*/
 	rowToTrack(id, data, projection) {
 		const slim = projection === "slim";
-		const positions = slim ? [] : data["positions"] ?? [];
+		const storedPositions = data["positions"] ?? [];
+		const observations = storedPositions.length;
+		const positions = slim ? [] : storedPositions;
 		const snapshots = slim ? [] : data["snapshots"] ?? [];
 		const zones = data["zonesVisited"] ?? [];
 		const classes = data["classes"];
@@ -44175,6 +44431,7 @@ var TrackStore = class {
 			...typeof hasFace === "boolean" ? { hasFace } : {},
 			...typeof hasRider === "boolean" ? { hasRider } : {},
 			...closedReason !== void 0 ? { closedReason } : {},
+			observations,
 			...envelope !== null ? { envelope } : {}
 		};
 	}
@@ -52484,13 +52741,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	buildSummaryPorts(stores) {
 		return {
 			listTracks: async ({ deviceId, sinceMs, untilMs, limit }) => {
-				return (await stores.trackStore.queryHistorical({
+				const tracks = await stores.trackStore.queryHistorical({
 					deviceId,
 					since: sinceMs,
 					until: untilMs,
 					projection: "slim",
 					limit
-				})).map((t) => ({
+				});
+				const { minHits } = await this.resolveDeviceDetectionSensitivitySettings(deviceId);
+				return tracks.map((t) => ({
 					trackId: t.trackId,
 					deviceId: t.deviceId,
 					className: t.className,
@@ -52499,7 +52758,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					...t.importance !== void 0 ? { importance: t.importance } : {},
 					zones: [...t.zonesVisited],
 					...t.classes !== void 0 ? { classes: [...t.classes] } : {},
-					...t.closedReason === "stationary-promotion" ? { stationary: true } : {}
+					...t.closedReason === "stationary-promotion" ? { stationary: true } : {},
+					...t.observations !== void 0 ? { confirmed: t.observations >= minHits } : {}
 				}));
 			},
 			listMediaInfo: async (trackId) => {