@camstack/addon-post-analysis 1.2.96 → 1.2.97

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-BdX09HCw.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DyXoKV7Z.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.89",
+		version: "1.2.90",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",

package/dist/pipeline-analytics/{hostInit-DULHUyr1.mjs → hostInit-CkEakaQn.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.89",
+				version: "1.2.90",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/pipeline-analytics/index.js

@@ -14206,7 +14206,11 @@ function mosaicTextPlan(captions) {
 	};
 }
 /** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
-*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
+*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip.
+*
+*  `rows` is the load-bearing half — it is how many rows {@link mosaicRowCounts}
+*  distributes into. `cols` describes the WIDEST row, and is no longer a cell
+*  count: see {@link mosaicRowCounts} for why a `cols × rows` grid was the bug. */
 function mosaicGrid(n) {
 	const count = Math.max(1, Math.floor(n));
 	const cols = Math.ceil(Math.sqrt(count));
@@ -14216,31 +14220,84 @@ function mosaicGrid(n) {
 	};
 }
 /**
+* How many tiles each ROW carries, top to bottom — and the reason the mosaic
+* can no longer have a hole in it.
+*
+* The layout used to be a `cols × rows` GRID, and a grid holds more cells than
+* tiles for every count that is not a perfect fit: 3 into a 2×2, 5 into a 3×2,
+* 7 and 8 into a 3×3. The composite only ever wrote the tiles, so the spare
+* cells stayed the canvas — `MOSAIC_BACKGROUND`, rgb 17 — and the operator's
+* three-tile digest was a quarter black. Measured on the shipped renderer:
+* 24.8% of a three-tile mosaic was background. His words: *"se ci sono 3
+* elementi non dovrebbe renderizzare buchi neri"*.
+*
+* Counting ROWS instead removes the failure by construction rather than by
+* patching it. Every row spans the full width and divides it among the tiles it
+* actually has, so a row is full whatever the remainder and there is no such
+* thing as a spare cell. The shapes fall out of it, and they are the ones asked
+* for: 1 ⇒ full frame, 2 ⇒ side by side, 3 ⇒ one big over two small, 4 ⇒ 2×2.
+*
+* **The fewer-tiled row comes FIRST.** Tiles arrive in the selection's order,
+* so row 0 is the head of the ranking; putting the remainder at the top would
+* make the WORST tile the big one.
+*
+* Every cell keeps {@link TILE_ASPECT}, so rows differ in height — which is
+* also what stops the letterbox: a full-width hero tile is 16:9 exactly, not a
+* 16:9 picture centred in a double-height cell with bars over and under it.
+*/
+function mosaicRowCounts(n) {
+	const count = Math.max(1, Math.floor(n));
+	const { rows } = mosaicGrid(count);
+	const base = Math.floor(count / rows);
+	const remainder = count % rows;
+	const counts = [];
+	for (let row = 0; row < rows; row += 1) counts.push(row < rows - remainder ? base : base + 1);
+	return counts;
+}
+/**
 * Where every tile lands. Pure — no bytes, no sharp, no clock.
 *
 * Exported because the rectangles are DATA the artefact should carry: a viewer
 * that wants a tappable mosaic reads these rather than re-deriving a layout
 * that could drift from the one actually rendered.
+*
+* The rectangles COVER the picture area exactly — that is the property the
+* spec asserts, and it is the one the old grid broke.
 */
 function mosaicLayout(input) {
-	const { cols, rows } = mosaicGrid(input.tileCount);
-	const maxWidth = input.maxWidth ?? 1920;
-	const tileWidth = Math.max(160, Math.floor(maxWidth / cols));
+	const rowCounts = mosaicRowCounts(input.tileCount);
+	const width = Math.max(1, Math.floor(input.maxWidth ?? 1920));
+	const firstRowCount = rowCounts[0] ?? 1;
+	const tileWidth = Math.floor(width / firstRowCount);
 	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
 	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
 	const tiles = [];
-	for (let index = 0; index < Math.max(1, input.tileCount); index += 1) tiles.push({
-		index,
-		x: index % cols * tileWidth,
-		y: titleHeight + Math.floor(index / cols) * tileHeight,
-		w: tileWidth,
-		h: tileHeight
-	});
+	let y = titleHeight;
+	let index = 0;
+	for (const count of rowCounts) {
+		const nominalWidth = Math.floor(width / count);
+		const rowHeight = Math.round(nominalWidth * TILE_ASPECT);
+		let x = 0;
+		for (let inRow = 0; inRow < count; inRow += 1) {
+			const w = inRow === count - 1 ? width - x : nominalWidth;
+			tiles.push({
+				index,
+				x,
+				y,
+				w,
+				h: rowHeight
+			});
+			x += w;
+			index += 1;
+		}
+		y += rowHeight;
+	}
 	return {
-		width: cols * tileWidth,
-		height: titleHeight + rows * tileHeight,
-		cols,
-		rows,
+		width,
+		height: y,
+		cols: Math.max(...rowCounts),
+		rows: rowCounts.length,
+		rowCounts,
 		tileWidth,
 		tileHeight,
 		titleHeight,
@@ -14304,36 +14361,20 @@ function titleSvg(width, height, caption) {
 *
 * A tile sharp cannot read is DROPPED and counted, never composited as a blank
 * cell — a black square in a digest reads as "the camera saw nothing", which is
-* the opposite of what happened. The grid is recomputed from the survivors so
-* the mosaic has no hole.
+* the opposite of what happened. The layout is computed from the SURVIVORS, and
+* because {@link mosaicRowCounts} counts rows rather than grid cells there is no
+* remainder to leave empty either.
 *
-* @throws only if sharp cannot produce the final canvas at all; the caller
-*         treats that as "no mosaic" and still delivers the counts.
+* @throws when every tile was dropped, and when sharp cannot produce the final
+*         canvas at all; the caller treats both as "no mosaic" and still
+*         delivers the counts.
 */
 async function renderMosaic(request, logger) {
 	const plan = mosaicTextPlan(request.captions);
-	const decoded = [];
-	const probeLayout = mosaicLayout({
-		tileCount: Math.max(1, request.tiles.length),
-		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
-	});
+	const usable = [];
 	for (const tile of request.tiles) try {
-		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
-		const fitted = (0, sharp.default)(tile.jpeg).resize({
-			width: probeLayout.tileWidth,
-			height: probeLayout.tileHeight,
-			fit: "contain",
-			background: MOSAIC_BACKGROUND
-		});
-		const resized = await (label.length === 0 ? fitted : fitted.composite([{
-			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, label),
-			top: 0,
-			left: 0
-		}])).jpeg({ quality: 82 }).toBuffer();
-		decoded.push({
-			tile,
-			resized
-		});
+		await (0, sharp.default)(tile.jpeg).metadata();
+		usable.push(tile);
 	} catch (err) {
 		logger.warn("summary mosaic: a tile could not be decoded and was dropped", {
 			tags: { deviceId: tile.deviceId },
@@ -14343,23 +14384,34 @@ async function renderMosaic(request, logger) {
 			}
 		});
 	}
-	const droppedTiles = request.tiles.length - decoded.length;
+	const droppedTiles = request.tiles.length - usable.length;
+	if (usable.length === 0) throw new Error(`summary mosaic: no tile could be decoded (${request.tiles.length} offered)`);
 	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
 	const layout = mosaicLayout({
-		tileCount: Math.max(1, decoded.length),
+		tileCount: usable.length,
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
 		withTitle: caption.length > 0
 	});
-	const composites = await Promise.all(decoded.map(async ({ resized }, index) => ({
-		input: layout.tileWidth === probeLayout.tileWidth && layout.tileHeight === probeLayout.tileHeight ? resized : await (0, sharp.default)(resized).resize({
-			width: layout.tileWidth,
-			height: layout.tileHeight,
+	const composites = await Promise.all(usable.map(async (tile, index) => {
+		const rect = layout.tiles[index];
+		if (rect === void 0) throw new Error("summary mosaic: layout lost a tile");
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = (0, sharp.default)(tile.jpeg).resize({
+			width: rect.w,
+			height: rect.h,
 			fit: "contain",
 			background: MOSAIC_BACKGROUND
-		}).jpeg({ quality: 82 }).toBuffer(),
-		top: layout.tiles[index]?.y ?? 0,
-		left: layout.tiles[index]?.x ?? 0
-	})));
+		});
+		return {
+			input: await (label.length === 0 ? fitted : fitted.composite([{
+				input: tileLabelSvg(rect.w, rect.h, label),
+				top: 0,
+				left: 0
+			}])).jpeg({ quality: 82 }).toBuffer(),
+			top: rect.y,
+			left: rect.x
+		};
+	}));
 	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
 		input: titleSvg(layout.width, layout.titleHeight, caption),
 		top: 0,
@@ -14575,6 +14627,36 @@ function buildSummaryOutboxInputs(input) {
 * the quota degrades honestly: the best cameras get their one tile, the rest
 * are counted as dropped and the count rides the log line — never silently.
 *
+* ## Only tracks the pipeline PROMOTED
+*
+* A digest is retrospective. The operator's own framing, verbatim: *"ideale
+* sarebbe considerare solo tracce che vengono alla fine promosse a tracce, dato
+* che il summary non è atteso di essere realtime"* — the window is closed
+* before this function is called, so the selection may wait for the pipeline's
+* verdict instead of guessing at it.
+*
+* The verdict is `SortTracker`'s own promotion threshold: a candidate is not
+* emitted as a track until it has been matched on `minHits` frames
+* (`isConfirmedForEmit`, per-device setting, *"minimum consecutive detection
+* hits before a track is promoted to output"*). The gate here re-applies that
+* same threshold to what the CLOSED row actually left behind — the count of
+* recorded sightings on its trajectory — and the port that builds a candidate
+* is the only thing that knows the device's `minHits`.
+*
+* This is not a movement heuristic and deliberately so: `totalDistance` and
+* `state` were both measured against live traffic and both hide real passages.
+* What they cannot see is the shape this gate is for — a row whose whole life
+* is one or two frames. Measured on device 617 (2026-08-19 04:12): two rows,
+* `closedReason` NULL so the parked pass is blind to them, dwell 53 ms,
+* `totalDistance` 0, two recorded sightings each. And `minImportance` cannot
+* cover it either, structurally: the static-track gate that demotes a frozen
+* subject needs two centroids to measure anything
+* (`computeStaticTrackMetrics`), so a single-sighting row is exactly the shape
+* it never scores down — 33 of the live hub's 34 such rows sit at or above 0.2.
+*
+* There is no rule field to turn it off. A digest of things that were never
+* tracks has no audience, and this repo has shipped knobs nobody read.
+*
 * ## Zones are scoped PER CAMERA
 *
 * `filters.zones` is a flat id list on a rule that spans cameras, and zone ids
@@ -14598,15 +14680,20 @@ function dwellSeconds(candidate) {
 * branch that discards work silently reads as "it never happened".
 */
 function filterSummaryCandidates(candidates, filters, zoneOwner) {
-	const moving = filters?.includeStationary === true ? candidates : candidates.filter((candidate) => candidate.stationary !== true);
-	const droppedStationary = candidates.length - moving.length;
+	const promoted = candidates.filter((candidate) => candidate.confirmed !== false);
+	const droppedUnconfirmed = candidates.length - promoted.length;
+	const unknownConfirmation = promoted.filter((candidate) => candidate.confirmed === void 0).length;
+	const moving = filters?.includeStationary === true ? promoted : promoted.filter((candidate) => candidate.stationary !== true);
+	const droppedStationary = promoted.length - moving.length;
 	if (filters === void 0) return {
 		kept: [...moving],
 		droppedByClass: 0,
 		droppedByZone: 0,
 		droppedByImportance: 0,
 		droppedByDwell: 0,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 	const include = filters.classes;
 	const exclude = new Set(filters.classesExclude ?? []);
@@ -14652,7 +14739,9 @@ function filterSummaryCandidates(candidates, filters, zoneOwner) {
 		droppedByZone,
 		droppedByImportance,
 		droppedByDwell,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 }
 /**
@@ -15028,7 +15117,9 @@ var NcSummaryProducer = class {
 					droppedByZone: filtered.droppedByZone,
 					droppedByImportance: filtered.droppedByImportance,
 					droppedByDwell: filtered.droppedByDwell,
-					droppedStationary: filtered.droppedStationary
+					droppedStationary: filtered.droppedStationary,
+					droppedUnconfirmed: filtered.droppedUnconfirmed,
+					unknownConfirmation: filtered.unknownConfirmation
 				} });
 				if (opts.stamp) await this.deps.store.markGenerated(rule.id, window.endMs);
 				return {
@@ -15092,6 +15183,8 @@ var NcSummaryProducer = class {
 				scanned: candidates.length,
 				matched: filtered.kept.length,
 				droppedStationary: filtered.droppedStationary,
+				droppedUnconfirmed: filtered.droppedUnconfirmed,
+				unknownConfirmation: filtered.unknownConfirmation,
 				droppedByClass: filtered.droppedByClass,
 				tiles: loaded.length,
 				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
@@ -22251,6 +22344,16 @@ function planRuleTest(input) {
 *    never be re-owned through a patch.
 *  - `nc.setRuleTargetEnabled` — a user opting HIS OWN target out of a rule
 *    VISIBLE to him (his own personal rule OR a global/admin rule).
+*  - the TIMELAPSE and DIGEST families (`nc.*TimelapseRule*`,
+*    `nc.*SummaryRule*`) repeat that model exactly over their own stores. The
+*    digest half was `auth: 'admin'` in v1 and was relaxed once the operator
+*    closed the cost question; `nc.listSummaryRules` reports the current answer
+*    as `canAuthor` so a client talking to an older hub degrades to a read-only
+*    list instead of discovering the refusal as a 403 on a filled-in form.
+*  - the three TEST actions (`nc.injectTestEvent`, `nc.testRule`,
+*    `nc.testTimelapseRule`, `nc.testSummaryRule`) stay `auth: 'admin'`
+*    regardless of who owns the rule: they DELIVER, to every target the rule
+*    addresses, on other people's phones.
 *
 * Target-ownership limits (personal-rule delivery target list + the opt-out
 * target) are enforced against the notifiers target catalog; ADMINS bypass the
@@ -22469,7 +22572,25 @@ var ncActions = require_dist.defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
-	"nc.listSummaryRules": require_dist.customAction(require_dist.object({}), require_dist.object({ rules: require_dist.array(NcViewerSummaryRuleSchema) }), { caller: "required" }),
+	"nc.listSummaryRules": require_dist.customAction(require_dist.object({}), require_dist.object({
+		rules: require_dist.array(NcViewerSummaryRuleSchema),
+		/**
+		* DOES THIS HUB LET THE CALLER AUTHOR ONE? The capability probe, and the
+		* only honest way a client can know.
+		*
+		* `nc.upsertSummaryRule` was `auth: 'admin'` until the operator closed
+		* that decision, and a viewer talking to a hub that still refuses has to
+		* find out BEFORE it offers a "New summary rule" button — otherwise the
+		* only feedback is a 403 taken in front of the operator on a form they
+		* had already filled in. ADDITIVE and therefore `.optional()` on every
+		* client mirror: absent means an older hub, which the viewer reads as "no
+		* authoring" and degrades to a read-only list with a note.
+		*
+		* Derived from the same predicate the handlers enforce — never a constant
+		* `true` — so a hub that re-tightened the auth could not say otherwise.
+		*/
+		canAuthor: require_dist.boolean()
+	}), { caller: "required" }),
 	/**
 	* ONE action for create AND update, like `nc.upsertTimelapseRule`: a digest
 	* rule is authored as a whole (cameras + window + filters + targets) and the
@@ -22478,10 +22599,18 @@ var ncActions = require_dist.defineCustomActions({
 	*
 	* `ruleId` absent ⇒ create from `rule`; present ⇒ patch.
 	*
-	* `auth: 'admin'` in v1 (operator decision): a digest spans cameras and, once
-	* P2 lands, consumes the local vision model. A personal rule that fans vision
-	* calls across other people's cameras is a decision to take after the real
-	* cost has been watched for a few weeks, not before.
+	* `caller: 'required'`, NOT `auth: 'admin'`. It was admin-only in v1 because
+	* a digest spans cameras and consumes the local vision model, and that cost
+	* had not been watched yet. The operator closed the decision, so this now
+	* carries exactly the auth the two rule families beside it carry: ownership
+	* is enforced in the handler, `ownerUserId` is STAMPED from the resolved
+	* caller, a personal rule may deliver only to targets that caller OWNS, and an
+	* admin still authors GLOBAL rules. No new ownership model was invented for
+	* it — `NcSummaryStore` has had `ownerUserId` / `listForOwner` since it was
+	* written and they were simply not reachable.
+	*
+	* `nc.testSummaryRule` stays admin: that one DELIVERS, on other people's
+	* phones.
 	*/
 	"nc.upsertSummaryRule": require_dist.customAction(require_dist.object({
 		ruleId: require_dist.string().optional(),
@@ -22489,12 +22618,10 @@ var ncActions = require_dist.defineCustomActions({
 		patch: NcSummaryRulePatchSchema.optional()
 	}), require_dist.object({ rule: NcSummaryRuleSchema }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	"nc.deleteSummaryRule": require_dist.customAction(require_dist.object({ ruleId: require_dist.string() }), require_dist.object({ success: require_dist.literal(true) }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	/**
@@ -22588,6 +22715,17 @@ var ncActions = require_dist.defineCustomActions({
 	*  a surface that distinguishes them reports what other people own. */
 	"nc.getArtifact": require_dist.customAction(require_dist.object({ artifactId: require_dist.string().min(1) }), require_dist.object({ artifact: NcArtifactRecordSchema.nullable() }), { caller: "required" })
 });
+/**
+* Does THIS build let a non-admin author a digest rule?
+*
+* A named constant rather than a literal `true` at the call site, so the one
+* fact `nc.listSummaryRules.canAuthor` reports and the auth the upsert actually
+* carries sit beside each other and are changed together. If the operator ever
+* re-tightens the action, this goes to `false` in the same edit and the viewer
+* degrades on the next list — instead of the app discovering it by taking a 403
+* on a form the operator had already filled in.
+*/
+var SUMMARY_AUTHORING_OPEN = true;
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
 function requireCaller$1(caller) {
 	if (!caller || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error("forbidden: authenticated caller required");
@@ -22648,6 +22786,22 @@ function makeNcActionHandlers(deps) {
 		if (editor === void 0) throw new Error("this node does not host the notification text catalog — use the hub");
 		return editor;
 	};
+	/**
+	* A digest rule the caller may EDIT. Same shape and same admin bypass as
+	* {@link assertTimelapseEditable} — deliberately, because a second ownership
+	* model for the third rule family is a second place to get it wrong.
+	*
+	* A GLOBAL rule (no `ownerUserId`, what an admin authors) is VISIBLE to
+	* everyone and editable by admins only: `listForOwner` returns it, so a user
+	* sees it in the list, and `readOnly` says so.
+	*/
+	const assertSummaryEditable = (ruleId, caller, sum) => {
+		const rule = sum.store.get(ruleId);
+		if (rule === null) throw new Error(`forbidden: summary rule not found: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== caller.userId) throw new Error(`forbidden: summary rule not owned: ${ruleId}`);
+		return rule;
+	};
 	/** A timelapse rule the caller may EDIT. Same admin bypass as `NcRule`. */
 	const assertTimelapseEditable = (ruleId, caller, tl) => {
 		const rule = tl.store.get(ruleId);
@@ -22918,21 +23072,23 @@ function makeNcActionHandlers(deps) {
 		"nc.listSummaryRules": async (_input, caller) => {
 			const c = requireCaller$1(caller);
 			const sum = requireSummary();
-			return { rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
-				...r,
-				readOnly: !c.isAdmin
-			})) };
+			return {
+				rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
+					...r,
+					readOnly: !c.isAdmin && r.ownerUserId !== c.userId
+				})),
+				canAuthor: SUMMARY_AUTHORING_OPEN
+			};
 		},
 		"nc.upsertSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to author a summary rule");
 			const sum = requireSummary();
 			if (input.ruleId === void 0) {
 				if (input.rule === void 0) throw new Error("upsertSummaryRule: rule or ruleId required");
 				const parsed = NcSummaryRuleInputSchema.parse(input.rule);
 				assertSummaryBudget(parsed);
 				await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
-				const rule = await sum.store.create(parsed, c.userId);
+				const rule = await sum.store.create(parsed, c.userId, c.isAdmin ? void 0 : c.userId);
 				deps.logger.info("summary rule created", { meta: {
 					ruleId: rule.id,
 					owner: c.userId,
@@ -22940,8 +23096,7 @@ function makeNcActionHandlers(deps) {
 				} });
 				return { rule };
 			}
-			const existing = sum.store.get(input.ruleId);
-			if (existing === null) throw new Error(`forbidden: summary rule not found: ${input.ruleId}`);
+			const existing = assertSummaryEditable(input.ruleId, c, sum);
 			if (input.patch === void 0) throw new Error("upsertSummaryRule: patch required");
 			const patch = NcSummaryRulePatchSchema.parse(input.patch);
 			assertSummaryBudget({
@@ -22958,8 +23113,9 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.deleteSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to delete a summary rule");
-			await requireSummary().store.delete(input.ruleId);
+			const sum = requireSummary();
+			assertSummaryEditable(input.ruleId, c, sum);
+			await sum.store.delete(input.ruleId);
 			deps.logger.info("summary rule deleted", { meta: {
 				ruleId: input.ruleId,
 				owner: c.userId
@@ -44276,7 +44432,9 @@ var TrackStore = class {
 	*/
 	rowToTrack(id, data, projection) {
 		const slim = projection === "slim";
-		const positions = slim ? [] : data["positions"] ?? [];
+		const storedPositions = data["positions"] ?? [];
+		const observations = storedPositions.length;
+		const positions = slim ? [] : storedPositions;
 		const snapshots = slim ? [] : data["snapshots"] ?? [];
 		const zones = data["zonesVisited"] ?? [];
 		const classes = data["classes"];
@@ -44333,6 +44491,7 @@ var TrackStore = class {
 			...typeof hasFace === "boolean" ? { hasFace } : {},
 			...typeof hasRider === "boolean" ? { hasRider } : {},
 			...closedReason !== void 0 ? { closedReason } : {},
+			observations,
 			...envelope !== null ? { envelope } : {}
 		};
 	}
@@ -52642,13 +52801,15 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	buildSummaryPorts(stores) {
 		return {
 			listTracks: async ({ deviceId, sinceMs, untilMs, limit }) => {
-				return (await stores.trackStore.queryHistorical({
+				const tracks = await stores.trackStore.queryHistorical({
 					deviceId,
 					since: sinceMs,
 					until: untilMs,
 					projection: "slim",
 					limit
-				})).map((t) => ({
+				});
+				const { minHits } = await this.resolveDeviceDetectionSensitivitySettings(deviceId);
+				return tracks.map((t) => ({
 					trackId: t.trackId,
 					deviceId: t.deviceId,
 					className: t.className,
@@ -52657,7 +52818,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					...t.importance !== void 0 ? { importance: t.importance } : {},
 					zones: [...t.zonesVisited],
 					...t.classes !== void 0 ? { classes: [...t.classes] } : {},
-					...t.closedReason === "stationary-promotion" ? { stationary: true } : {}
+					...t.closedReason === "stationary-promotion" ? { stationary: true } : {},
+					...t.observations !== void 0 ? { confirmed: t.observations >= minHits } : {}
 				}));
 			},
 			listMediaInfo: async (trackId) => {

package/dist/pipeline-analytics/index.mjs

@@ -14199,7 +14199,11 @@ function mosaicTextPlan(captions) {
 	};
 }
 /** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
-*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
+*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip.
+*
+*  `rows` is the load-bearing half — it is how many rows {@link mosaicRowCounts}
+*  distributes into. `cols` describes the WIDEST row, and is no longer a cell
+*  count: see {@link mosaicRowCounts} for why a `cols × rows` grid was the bug. */
 function mosaicGrid(n) {
 	const count = Math.max(1, Math.floor(n));
 	const cols = Math.ceil(Math.sqrt(count));
@@ -14209,31 +14213,84 @@ function mosaicGrid(n) {
 	};
 }
 /**
+* How many tiles each ROW carries, top to bottom — and the reason the mosaic
+* can no longer have a hole in it.
+*
+* The layout used to be a `cols × rows` GRID, and a grid holds more cells than
+* tiles for every count that is not a perfect fit: 3 into a 2×2, 5 into a 3×2,
+* 7 and 8 into a 3×3. The composite only ever wrote the tiles, so the spare
+* cells stayed the canvas — `MOSAIC_BACKGROUND`, rgb 17 — and the operator's
+* three-tile digest was a quarter black. Measured on the shipped renderer:
+* 24.8% of a three-tile mosaic was background. His words: *"se ci sono 3
+* elementi non dovrebbe renderizzare buchi neri"*.
+*
+* Counting ROWS instead removes the failure by construction rather than by
+* patching it. Every row spans the full width and divides it among the tiles it
+* actually has, so a row is full whatever the remainder and there is no such
+* thing as a spare cell. The shapes fall out of it, and they are the ones asked
+* for: 1 ⇒ full frame, 2 ⇒ side by side, 3 ⇒ one big over two small, 4 ⇒ 2×2.
+*
+* **The fewer-tiled row comes FIRST.** Tiles arrive in the selection's order,
+* so row 0 is the head of the ranking; putting the remainder at the top would
+* make the WORST tile the big one.
+*
+* Every cell keeps {@link TILE_ASPECT}, so rows differ in height — which is
+* also what stops the letterbox: a full-width hero tile is 16:9 exactly, not a
+* 16:9 picture centred in a double-height cell with bars over and under it.
+*/
+function mosaicRowCounts(n) {
+	const count = Math.max(1, Math.floor(n));
+	const { rows } = mosaicGrid(count);
+	const base = Math.floor(count / rows);
+	const remainder = count % rows;
+	const counts = [];
+	for (let row = 0; row < rows; row += 1) counts.push(row < rows - remainder ? base : base + 1);
+	return counts;
+}
+/**
 * Where every tile lands. Pure — no bytes, no sharp, no clock.
 *
 * Exported because the rectangles are DATA the artefact should carry: a viewer
 * that wants a tappable mosaic reads these rather than re-deriving a layout
 * that could drift from the one actually rendered.
+*
+* The rectangles COVER the picture area exactly — that is the property the
+* spec asserts, and it is the one the old grid broke.
 */
 function mosaicLayout(input) {
-	const { cols, rows } = mosaicGrid(input.tileCount);
-	const maxWidth = input.maxWidth ?? 1920;
-	const tileWidth = Math.max(160, Math.floor(maxWidth / cols));
+	const rowCounts = mosaicRowCounts(input.tileCount);
+	const width = Math.max(1, Math.floor(input.maxWidth ?? 1920));
+	const firstRowCount = rowCounts[0] ?? 1;
+	const tileWidth = Math.floor(width / firstRowCount);
 	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
 	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
 	const tiles = [];
-	for (let index = 0; index < Math.max(1, input.tileCount); index += 1) tiles.push({
-		index,
-		x: index % cols * tileWidth,
-		y: titleHeight + Math.floor(index / cols) * tileHeight,
-		w: tileWidth,
-		h: tileHeight
-	});
+	let y = titleHeight;
+	let index = 0;
+	for (const count of rowCounts) {
+		const nominalWidth = Math.floor(width / count);
+		const rowHeight = Math.round(nominalWidth * TILE_ASPECT);
+		let x = 0;
+		for (let inRow = 0; inRow < count; inRow += 1) {
+			const w = inRow === count - 1 ? width - x : nominalWidth;
+			tiles.push({
+				index,
+				x,
+				y,
+				w,
+				h: rowHeight
+			});
+			x += w;
+			index += 1;
+		}
+		y += rowHeight;
+	}
 	return {
-		width: cols * tileWidth,
-		height: titleHeight + rows * tileHeight,
-		cols,
-		rows,
+		width,
+		height: y,
+		cols: Math.max(...rowCounts),
+		rows: rowCounts.length,
+		rowCounts,
 		tileWidth,
 		tileHeight,
 		titleHeight,
@@ -14297,36 +14354,20 @@ function titleSvg(width, height, caption) {
 *
 * A tile sharp cannot read is DROPPED and counted, never composited as a blank
 * cell — a black square in a digest reads as "the camera saw nothing", which is
-* the opposite of what happened. The grid is recomputed from the survivors so
-* the mosaic has no hole.
+* the opposite of what happened. The layout is computed from the SURVIVORS, and
+* because {@link mosaicRowCounts} counts rows rather than grid cells there is no
+* remainder to leave empty either.
 *
-* @throws only if sharp cannot produce the final canvas at all; the caller
-*         treats that as "no mosaic" and still delivers the counts.
+* @throws when every tile was dropped, and when sharp cannot produce the final
+*         canvas at all; the caller treats both as "no mosaic" and still
+*         delivers the counts.
 */
 async function renderMosaic(request, logger) {
 	const plan = mosaicTextPlan(request.captions);
-	const decoded = [];
-	const probeLayout = mosaicLayout({
-		tileCount: Math.max(1, request.tiles.length),
-		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
-	});
+	const usable = [];
 	for (const tile of request.tiles) try {
-		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
-		const fitted = sharp(tile.jpeg).resize({
-			width: probeLayout.tileWidth,
-			height: probeLayout.tileHeight,
-			fit: "contain",
-			background: MOSAIC_BACKGROUND
-		});
-		const resized = await (label.length === 0 ? fitted : fitted.composite([{
-			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, label),
-			top: 0,
-			left: 0
-		}])).jpeg({ quality: 82 }).toBuffer();
-		decoded.push({
-			tile,
-			resized
-		});
+		await sharp(tile.jpeg).metadata();
+		usable.push(tile);
 	} catch (err) {
 		logger.warn("summary mosaic: a tile could not be decoded and was dropped", {
 			tags: { deviceId: tile.deviceId },
@@ -14336,23 +14377,34 @@ async function renderMosaic(request, logger) {
 			}
 		});
 	}
-	const droppedTiles = request.tiles.length - decoded.length;
+	const droppedTiles = request.tiles.length - usable.length;
+	if (usable.length === 0) throw new Error(`summary mosaic: no tile could be decoded (${request.tiles.length} offered)`);
 	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
 	const layout = mosaicLayout({
-		tileCount: Math.max(1, decoded.length),
+		tileCount: usable.length,
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
 		withTitle: caption.length > 0
 	});
-	const composites = await Promise.all(decoded.map(async ({ resized }, index) => ({
-		input: layout.tileWidth === probeLayout.tileWidth && layout.tileHeight === probeLayout.tileHeight ? resized : await sharp(resized).resize({
-			width: layout.tileWidth,
-			height: layout.tileHeight,
+	const composites = await Promise.all(usable.map(async (tile, index) => {
+		const rect = layout.tiles[index];
+		if (rect === void 0) throw new Error("summary mosaic: layout lost a tile");
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = sharp(tile.jpeg).resize({
+			width: rect.w,
+			height: rect.h,
 			fit: "contain",
 			background: MOSAIC_BACKGROUND
-		}).jpeg({ quality: 82 }).toBuffer(),
-		top: layout.tiles[index]?.y ?? 0,
-		left: layout.tiles[index]?.x ?? 0
-	})));
+		});
+		return {
+			input: await (label.length === 0 ? fitted : fitted.composite([{
+				input: tileLabelSvg(rect.w, rect.h, label),
+				top: 0,
+				left: 0
+			}])).jpeg({ quality: 82 }).toBuffer(),
+			top: rect.y,
+			left: rect.x
+		};
+	}));
 	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
 		input: titleSvg(layout.width, layout.titleHeight, caption),
 		top: 0,
@@ -14568,6 +14620,36 @@ function buildSummaryOutboxInputs(input) {
 * the quota degrades honestly: the best cameras get their one tile, the rest
 * are counted as dropped and the count rides the log line — never silently.
 *
+* ## Only tracks the pipeline PROMOTED
+*
+* A digest is retrospective. The operator's own framing, verbatim: *"ideale
+* sarebbe considerare solo tracce che vengono alla fine promosse a tracce, dato
+* che il summary non è atteso di essere realtime"* — the window is closed
+* before this function is called, so the selection may wait for the pipeline's
+* verdict instead of guessing at it.
+*
+* The verdict is `SortTracker`'s own promotion threshold: a candidate is not
+* emitted as a track until it has been matched on `minHits` frames
+* (`isConfirmedForEmit`, per-device setting, *"minimum consecutive detection
+* hits before a track is promoted to output"*). The gate here re-applies that
+* same threshold to what the CLOSED row actually left behind — the count of
+* recorded sightings on its trajectory — and the port that builds a candidate
+* is the only thing that knows the device's `minHits`.
+*
+* This is not a movement heuristic and deliberately so: `totalDistance` and
+* `state` were both measured against live traffic and both hide real passages.
+* What they cannot see is the shape this gate is for — a row whose whole life
+* is one or two frames. Measured on device 617 (2026-08-19 04:12): two rows,
+* `closedReason` NULL so the parked pass is blind to them, dwell 53 ms,
+* `totalDistance` 0, two recorded sightings each. And `minImportance` cannot
+* cover it either, structurally: the static-track gate that demotes a frozen
+* subject needs two centroids to measure anything
+* (`computeStaticTrackMetrics`), so a single-sighting row is exactly the shape
+* it never scores down — 33 of the live hub's 34 such rows sit at or above 0.2.
+*
+* There is no rule field to turn it off. A digest of things that were never
+* tracks has no audience, and this repo has shipped knobs nobody read.
+*
 * ## Zones are scoped PER CAMERA
 *
 * `filters.zones` is a flat id list on a rule that spans cameras, and zone ids
@@ -14591,15 +14673,20 @@ function dwellSeconds(candidate) {
 * branch that discards work silently reads as "it never happened".
 */
 function filterSummaryCandidates(candidates, filters, zoneOwner) {
-	const moving = filters?.includeStationary === true ? candidates : candidates.filter((candidate) => candidate.stationary !== true);
-	const droppedStationary = candidates.length - moving.length;
+	const promoted = candidates.filter((candidate) => candidate.confirmed !== false);
+	const droppedUnconfirmed = candidates.length - promoted.length;
+	const unknownConfirmation = promoted.filter((candidate) => candidate.confirmed === void 0).length;
+	const moving = filters?.includeStationary === true ? promoted : promoted.filter((candidate) => candidate.stationary !== true);
+	const droppedStationary = promoted.length - moving.length;
 	if (filters === void 0) return {
 		kept: [...moving],
 		droppedByClass: 0,
 		droppedByZone: 0,
 		droppedByImportance: 0,
 		droppedByDwell: 0,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 	const include = filters.classes;
 	const exclude = new Set(filters.classesExclude ?? []);
@@ -14645,7 +14732,9 @@ function filterSummaryCandidates(candidates, filters, zoneOwner) {
 		droppedByZone,
 		droppedByImportance,
 		droppedByDwell,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 }
 /**
@@ -15021,7 +15110,9 @@ var NcSummaryProducer = class {
 					droppedByZone: filtered.droppedByZone,
 					droppedByImportance: filtered.droppedByImportance,
 					droppedByDwell: filtered.droppedByDwell,
-					droppedStationary: filtered.droppedStationary
+					droppedStationary: filtered.droppedStationary,
+					droppedUnconfirmed: filtered.droppedUnconfirmed,
+					unknownConfirmation: filtered.unknownConfirmation
 				} });
 				if (opts.stamp) await this.deps.store.markGenerated(rule.id, window.endMs);
 				return {
@@ -15085,6 +15176,8 @@ var NcSummaryProducer = class {
 				scanned: candidates.length,
 				matched: filtered.kept.length,
 				droppedStationary: filtered.droppedStationary,
+				droppedUnconfirmed: filtered.droppedUnconfirmed,
+				unknownConfirmation: filtered.unknownConfirmation,
 				droppedByClass: filtered.droppedByClass,
 				tiles: loaded.length,
 				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
@@ -22229,6 +22322,16 @@ function planRuleTest(input) {
 *    never be re-owned through a patch.
 *  - `nc.setRuleTargetEnabled` — a user opting HIS OWN target out of a rule
 *    VISIBLE to him (his own personal rule OR a global/admin rule).
+*  - the TIMELAPSE and DIGEST families (`nc.*TimelapseRule*`,
+*    `nc.*SummaryRule*`) repeat that model exactly over their own stores. The
+*    digest half was `auth: 'admin'` in v1 and was relaxed once the operator
+*    closed the cost question; `nc.listSummaryRules` reports the current answer
+*    as `canAuthor` so a client talking to an older hub degrades to a read-only
+*    list instead of discovering the refusal as a 403 on a filled-in form.
+*  - the three TEST actions (`nc.injectTestEvent`, `nc.testRule`,
+*    `nc.testTimelapseRule`, `nc.testSummaryRule`) stay `auth: 'admin'`
+*    regardless of who owns the rule: they DELIVER, to every target the rule
+*    addresses, on other people's phones.
 *
 * Target-ownership limits (personal-rule delivery target list + the opt-out
 * target) are enforced against the notifiers target catalog; ADMINS bypass the
@@ -22447,7 +22550,25 @@ var ncActions = defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
-	"nc.listSummaryRules": customAction(object({}), object({ rules: array(NcViewerSummaryRuleSchema) }), { caller: "required" }),
+	"nc.listSummaryRules": customAction(object({}), object({
+		rules: array(NcViewerSummaryRuleSchema),
+		/**
+		* DOES THIS HUB LET THE CALLER AUTHOR ONE? The capability probe, and the
+		* only honest way a client can know.
+		*
+		* `nc.upsertSummaryRule` was `auth: 'admin'` until the operator closed
+		* that decision, and a viewer talking to a hub that still refuses has to
+		* find out BEFORE it offers a "New summary rule" button — otherwise the
+		* only feedback is a 403 taken in front of the operator on a form they
+		* had already filled in. ADDITIVE and therefore `.optional()` on every
+		* client mirror: absent means an older hub, which the viewer reads as "no
+		* authoring" and degrades to a read-only list with a note.
+		*
+		* Derived from the same predicate the handlers enforce — never a constant
+		* `true` — so a hub that re-tightened the auth could not say otherwise.
+		*/
+		canAuthor: boolean()
+	}), { caller: "required" }),
 	/**
 	* ONE action for create AND update, like `nc.upsertTimelapseRule`: a digest
 	* rule is authored as a whole (cameras + window + filters + targets) and the
@@ -22456,10 +22577,18 @@ var ncActions = defineCustomActions({
 	*
 	* `ruleId` absent ⇒ create from `rule`; present ⇒ patch.
 	*
-	* `auth: 'admin'` in v1 (operator decision): a digest spans cameras and, once
-	* P2 lands, consumes the local vision model. A personal rule that fans vision
-	* calls across other people's cameras is a decision to take after the real
-	* cost has been watched for a few weeks, not before.
+	* `caller: 'required'`, NOT `auth: 'admin'`. It was admin-only in v1 because
+	* a digest spans cameras and consumes the local vision model, and that cost
+	* had not been watched yet. The operator closed the decision, so this now
+	* carries exactly the auth the two rule families beside it carry: ownership
+	* is enforced in the handler, `ownerUserId` is STAMPED from the resolved
+	* caller, a personal rule may deliver only to targets that caller OWNS, and an
+	* admin still authors GLOBAL rules. No new ownership model was invented for
+	* it — `NcSummaryStore` has had `ownerUserId` / `listForOwner` since it was
+	* written and they were simply not reachable.
+	*
+	* `nc.testSummaryRule` stays admin: that one DELIVERS, on other people's
+	* phones.
 	*/
 	"nc.upsertSummaryRule": customAction(object({
 		ruleId: string().optional(),
@@ -22467,12 +22596,10 @@ var ncActions = defineCustomActions({
 		patch: NcSummaryRulePatchSchema.optional()
 	}), object({ rule: NcSummaryRuleSchema }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	"nc.deleteSummaryRule": customAction(object({ ruleId: string() }), object({ success: literal(true) }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	/**
@@ -22566,6 +22693,17 @@ var ncActions = defineCustomActions({
 	*  a surface that distinguishes them reports what other people own. */
 	"nc.getArtifact": customAction(object({ artifactId: string().min(1) }), object({ artifact: NcArtifactRecordSchema.nullable() }), { caller: "required" })
 });
+/**
+* Does THIS build let a non-admin author a digest rule?
+*
+* A named constant rather than a literal `true` at the call site, so the one
+* fact `nc.listSummaryRules.canAuthor` reports and the auth the upsert actually
+* carries sit beside each other and are changed together. If the operator ever
+* re-tightens the action, this goes to `false` in the same edit and the viewer
+* degrades on the next list — instead of the app discovering it by taking a 403
+* on a form the operator had already filled in.
+*/
+var SUMMARY_AUTHORING_OPEN = true;
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
 function requireCaller$1(caller) {
 	if (!caller || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error("forbidden: authenticated caller required");
@@ -22626,6 +22764,22 @@ function makeNcActionHandlers(deps) {
 		if (editor === void 0) throw new Error("this node does not host the notification text catalog — use the hub");
 		return editor;
 	};
+	/**
+	* A digest rule the caller may EDIT. Same shape and same admin bypass as
+	* {@link assertTimelapseEditable} — deliberately, because a second ownership
+	* model for the third rule family is a second place to get it wrong.
+	*
+	* A GLOBAL rule (no `ownerUserId`, what an admin authors) is VISIBLE to
+	* everyone and editable by admins only: `listForOwner` returns it, so a user
+	* sees it in the list, and `readOnly` says so.
+	*/
+	const assertSummaryEditable = (ruleId, caller, sum) => {
+		const rule = sum.store.get(ruleId);
+		if (rule === null) throw new Error(`forbidden: summary rule not found: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== caller.userId) throw new Error(`forbidden: summary rule not owned: ${ruleId}`);
+		return rule;
+	};
 	/** A timelapse rule the caller may EDIT. Same admin bypass as `NcRule`. */
 	const assertTimelapseEditable = (ruleId, caller, tl) => {
 		const rule = tl.store.get(ruleId);
@@ -22896,21 +23050,23 @@ function makeNcActionHandlers(deps) {
 		"nc.listSummaryRules": async (_input, caller) => {
 			const c = requireCaller$1(caller);
 			const sum = requireSummary();
-			return { rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
-				...r,
-				readOnly: !c.isAdmin
-			})) };
+			return {
+				rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
+					...r,
+					readOnly: !c.isAdmin && r.ownerUserId !== c.userId
+				})),
+				canAuthor: SUMMARY_AUTHORING_OPEN
+			};
 		},
 		"nc.upsertSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to author a summary rule");
 			const sum = requireSummary();
 			if (input.ruleId === void 0) {
 				if (input.rule === void 0) throw new Error("upsertSummaryRule: rule or ruleId required");
 				const parsed = NcSummaryRuleInputSchema.parse(input.rule);
 				assertSummaryBudget(parsed);
 				await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
-				const rule = await sum.store.create(parsed, c.userId);
+				const rule = await sum.store.create(parsed, c.userId, c.isAdmin ? void 0 : c.userId);
 				deps.logger.info("summary rule created", { meta: {
 					ruleId: rule.id,
 					owner: c.userId,
@@ -22918,8 +23074,7 @@ function makeNcActionHandlers(deps) {
 				} });
 				return { rule };
 			}
-			const existing = sum.store.get(input.ruleId);
-			if (existing === null) throw new Error(`forbidden: summary rule not found: ${input.ruleId}`);
+			const existing = assertSummaryEditable(input.ruleId, c, sum);
 			if (input.patch === void 0) throw new Error("upsertSummaryRule: patch required");
 			const patch = NcSummaryRulePatchSchema.parse(input.patch);
 			assertSummaryBudget({
@@ -22936,8 +23091,9 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.deleteSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to delete a summary rule");
-			await requireSummary().store.delete(input.ruleId);
+			const sum = requireSummary();
+			assertSummaryEditable(input.ruleId, c, sum);
+			await sum.store.delete(input.ruleId);
 			deps.logger.info("summary rule deleted", { meta: {
 				ruleId: input.ruleId,
 				owner: c.userId
@@ -44216,7 +44372,9 @@ var TrackStore = class {
 	*/
 	rowToTrack(id, data, projection) {
 		const slim = projection === "slim";
-		const positions = slim ? [] : data["positions"] ?? [];
+		const storedPositions = data["positions"] ?? [];
+		const observations = storedPositions.length;
+		const positions = slim ? [] : storedPositions;
 		const snapshots = slim ? [] : data["snapshots"] ?? [];
 		const zones = data["zonesVisited"] ?? [];
 		const classes = data["classes"];
@@ -44273,6 +44431,7 @@ var TrackStore = class {
 			...typeof hasFace === "boolean" ? { hasFace } : {},
 			...typeof hasRider === "boolean" ? { hasRider } : {},
 			...closedReason !== void 0 ? { closedReason } : {},
+			observations,
 			...envelope !== null ? { envelope } : {}
 		};
 	}
@@ -52582,13 +52741,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	buildSummaryPorts(stores) {
 		return {
 			listTracks: async ({ deviceId, sinceMs, untilMs, limit }) => {
-				return (await stores.trackStore.queryHistorical({
+				const tracks = await stores.trackStore.queryHistorical({
 					deviceId,
 					since: sinceMs,
 					until: untilMs,
 					projection: "slim",
 					limit
-				})).map((t) => ({
+				});
+				const { minHits } = await this.resolveDeviceDetectionSensitivitySettings(deviceId);
+				return tracks.map((t) => ({
 					trackId: t.trackId,
 					deviceId: t.deviceId,
 					className: t.className,
@@ -52597,7 +52758,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					...t.importance !== void 0 ? { importance: t.importance } : {},
 					zones: [...t.zonesVisited],
 					...t.classes !== void 0 ? { classes: [...t.classes] } : {},
-					...t.closedReason === "stationary-promotion" ? { stationary: true } : {}
+					...t.closedReason === "stationary-promotion" ? { stationary: true } : {},
+					...t.observations !== void 0 ? { confirmed: t.observations >= minHits } : {}
 				}));
 			},
 			listMediaInfo: async (trackId) => {

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-BdX09HCw.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DyXoKV7Z.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.96",
+  "version": "1.2.97",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",