@camstack/addon-post-analysis 1.2.96 → 1.2.98

package/dist/pipeline-analytics/index.mjs

@@ -12091,6 +12091,18 @@ var NcOutbox = class {
 	maxAttempts;
 	drainBatchSize;
 	drainInFlight = false;
+	/**
+	* Has {@link load} landed?
+	*
+	* The load moved OFF the boot critical path (see
+	* `NotificationCenter.runBootBackfill`), so for the first seconds of a boot
+	* the centre evaluates and enqueues with an EMPTY `knownIds` — and
+	* `knownIds` is the dedup ledger. Until this flips, {@link enqueue} asks the
+	* store itself instead. False is therefore not "the load failed", it is
+	* "the horizon is not authoritative yet"; a load that FAILED leaves it false
+	* forever, which keeps the per-enqueue guard on, which is exactly right.
+	*/
+	horizonLoaded = false;
 	constructor(deps) {
 		this.store = deps.store;
 		this.logger = deps.logger;
@@ -12112,7 +12124,26 @@ var NcOutbox = class {
 			columns: [...NC_META_COLUMNS]
 		});
 	}
-	/** Hydrate pending rows + the dedup id horizon. Best-effort. */
+	/**
+	* Hydrate pending rows + the dedup id horizon. Best-effort.
+	*
+	* **Runs OFF the boot critical path** (2026-08-17: 743 rows over the UDS
+	* store client, ~50 s, inside the `initialize()` that publishes the runner's
+	* capability manifest). So it lands against a centre that has already been
+	* evaluating, enqueueing and DELIVERING for as long as the query took — and
+	* the rows it is holding are a snapshot taken before all of that.
+	*
+	* That is why an id this process already knows is SKIPPED rather than
+	* applied. `knownIds` is only ever written by an in-process {@link enqueue}
+	* or by this method, so an id already in it at apply time is one whose live
+	* state (pending, or absent because it went terminal) is strictly newer than
+	* the snapshot. Applying the snapshot over it would put a row that has
+	* already been DELIVERED back into `pending`, and the operator would receive
+	* the same notification twice.
+	*
+	* Nothing is lost by the same token: this method only ADDS to `pending`, so
+	* a row enqueued while the query was in flight is untouched.
+	*/
 	async load() {
 		try {
 			const rows = await this.store.query.query({
@@ -12122,19 +12153,30 @@ var NcOutbox = class {
 					limit: 1e5
 				}
 			});
+			let superseded = 0;
 			for (const row of rows) {
+				if (this.knownIds.has(row.id)) {
+					superseded += 1;
+					continue;
+				}
 				this.knownIds.add(row.id);
 				const entry = rowToEntry$1(row.id, row.data);
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
+			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
-				known: this.knownIds.size
+				known: this.knownIds.size,
+				superseded
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
 		}
 	}
+	/** Is the dedup horizon authoritative? See {@link horizonLoaded}. */
+	hydrated() {
+		return this.horizonLoaded;
+	}
 	pendingCount() {
 		return this.pending.size;
 	}
@@ -12149,6 +12191,18 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
+			if (!this.horizonLoaded && await this.rowExists(id)) {
+				this.knownIds.add(id);
+				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
+					tags: { deviceId: input.deviceId },
+					meta: {
+						id,
+						ruleId: input.ruleId,
+						targetId: input.targetId
+					}
+				});
+				continue;
+			}
 			const entry = {
 				id,
 				ruleId: input.ruleId,
@@ -12421,6 +12475,35 @@ var NcOutbox = class {
 		this.pending.set(entry.id, retry);
 		await this.mutate(retry);
 	}
+	/**
+	* Does a row already exist under this dedup id?
+	*
+	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
+	* with `set` — an UPSERT keyed by the dedup id — so an enqueue that ran
+	* before the horizon landed would rewrite a row that had already been
+	* DELIVERED back to `pending`, and the drain would send it again. That is
+	* the D-3 `maxPerTrack: 1` guarantee, and it cannot be allowed to depend on
+	* whether a 743-row query had finished.
+	*
+	* A read that FAILS answers `false`, i.e. the intent is enqueued. Duplicate
+	* over lost: a duplicate notification is an annoyance the operator can see,
+	* and a dropped one is a notification nobody ever knows was owed.
+	*/
+	async rowExists(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return row !== null && row !== void 0;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return false;
+		}
+	}
 	async persist(entry) {
 		await this.store.set.mutate({
 			collection: NC_OUTBOX_COLLECTION,
@@ -14199,7 +14282,11 @@ function mosaicTextPlan(captions) {
 	};
 }
 /** Grid shape for `n` tiles: as square as possible, rows never exceeding cols
-*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip. */
+*  by more than one — a 3×3 for nine, a 3×2 for five, never a 1×9 strip.
+*
+*  `rows` is the load-bearing half — it is how many rows {@link mosaicRowCounts}
+*  distributes into. `cols` describes the WIDEST row, and is no longer a cell
+*  count: see {@link mosaicRowCounts} for why a `cols × rows` grid was the bug. */
 function mosaicGrid(n) {
 	const count = Math.max(1, Math.floor(n));
 	const cols = Math.ceil(Math.sqrt(count));
@@ -14209,31 +14296,84 @@ function mosaicGrid(n) {
 	};
 }
 /**
+* How many tiles each ROW carries, top to bottom — and the reason the mosaic
+* can no longer have a hole in it.
+*
+* The layout used to be a `cols × rows` GRID, and a grid holds more cells than
+* tiles for every count that is not a perfect fit: 3 into a 2×2, 5 into a 3×2,
+* 7 and 8 into a 3×3. The composite only ever wrote the tiles, so the spare
+* cells stayed the canvas — `MOSAIC_BACKGROUND`, rgb 17 — and the operator's
+* three-tile digest was a quarter black. Measured on the shipped renderer:
+* 24.8% of a three-tile mosaic was background. His words: *"se ci sono 3
+* elementi non dovrebbe renderizzare buchi neri"*.
+*
+* Counting ROWS instead removes the failure by construction rather than by
+* patching it. Every row spans the full width and divides it among the tiles it
+* actually has, so a row is full whatever the remainder and there is no such
+* thing as a spare cell. The shapes fall out of it, and they are the ones asked
+* for: 1 ⇒ full frame, 2 ⇒ side by side, 3 ⇒ one big over two small, 4 ⇒ 2×2.
+*
+* **The fewer-tiled row comes FIRST.** Tiles arrive in the selection's order,
+* so row 0 is the head of the ranking; putting the remainder at the top would
+* make the WORST tile the big one.
+*
+* Every cell keeps {@link TILE_ASPECT}, so rows differ in height — which is
+* also what stops the letterbox: a full-width hero tile is 16:9 exactly, not a
+* 16:9 picture centred in a double-height cell with bars over and under it.
+*/
+function mosaicRowCounts(n) {
+	const count = Math.max(1, Math.floor(n));
+	const { rows } = mosaicGrid(count);
+	const base = Math.floor(count / rows);
+	const remainder = count % rows;
+	const counts = [];
+	for (let row = 0; row < rows; row += 1) counts.push(row < rows - remainder ? base : base + 1);
+	return counts;
+}
+/**
 * Where every tile lands. Pure — no bytes, no sharp, no clock.
 *
 * Exported because the rectangles are DATA the artefact should carry: a viewer
 * that wants a tappable mosaic reads these rather than re-deriving a layout
 * that could drift from the one actually rendered.
+*
+* The rectangles COVER the picture area exactly — that is the property the
+* spec asserts, and it is the one the old grid broke.
 */
 function mosaicLayout(input) {
-	const { cols, rows } = mosaicGrid(input.tileCount);
-	const maxWidth = input.maxWidth ?? 1920;
-	const tileWidth = Math.max(160, Math.floor(maxWidth / cols));
+	const rowCounts = mosaicRowCounts(input.tileCount);
+	const width = Math.max(1, Math.floor(input.maxWidth ?? 1920));
+	const firstRowCount = rowCounts[0] ?? 1;
+	const tileWidth = Math.floor(width / firstRowCount);
 	const tileHeight = Math.round(tileWidth * TILE_ASPECT);
 	const titleHeight = input.withTitle === true ? Math.round(tileHeight * TITLE_BAND_FRACTION) : 0;
 	const tiles = [];
-	for (let index = 0; index < Math.max(1, input.tileCount); index += 1) tiles.push({
-		index,
-		x: index % cols * tileWidth,
-		y: titleHeight + Math.floor(index / cols) * tileHeight,
-		w: tileWidth,
-		h: tileHeight
-	});
+	let y = titleHeight;
+	let index = 0;
+	for (const count of rowCounts) {
+		const nominalWidth = Math.floor(width / count);
+		const rowHeight = Math.round(nominalWidth * TILE_ASPECT);
+		let x = 0;
+		for (let inRow = 0; inRow < count; inRow += 1) {
+			const w = inRow === count - 1 ? width - x : nominalWidth;
+			tiles.push({
+				index,
+				x,
+				y,
+				w,
+				h: rowHeight
+			});
+			x += w;
+			index += 1;
+		}
+		y += rowHeight;
+	}
 	return {
-		width: cols * tileWidth,
-		height: titleHeight + rows * tileHeight,
-		cols,
-		rows,
+		width,
+		height: y,
+		cols: Math.max(...rowCounts),
+		rows: rowCounts.length,
+		rowCounts,
 		tileWidth,
 		tileHeight,
 		titleHeight,
@@ -14297,36 +14437,20 @@ function titleSvg(width, height, caption) {
 *
 * A tile sharp cannot read is DROPPED and counted, never composited as a blank
 * cell — a black square in a digest reads as "the camera saw nothing", which is
-* the opposite of what happened. The grid is recomputed from the survivors so
-* the mosaic has no hole.
+* the opposite of what happened. The layout is computed from the SURVIVORS, and
+* because {@link mosaicRowCounts} counts rows rather than grid cells there is no
+* remainder to leave empty either.
 *
-* @throws only if sharp cannot produce the final canvas at all; the caller
-*         treats that as "no mosaic" and still delivers the counts.
+* @throws when every tile was dropped, and when sharp cannot produce the final
+*         canvas at all; the caller treats both as "no mosaic" and still
+*         delivers the counts.
 */
 async function renderMosaic(request, logger) {
 	const plan = mosaicTextPlan(request.captions);
-	const decoded = [];
-	const probeLayout = mosaicLayout({
-		tileCount: Math.max(1, request.tiles.length),
-		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {}
-	});
+	const usable = [];
 	for (const tile of request.tiles) try {
-		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
-		const fitted = sharp(tile.jpeg).resize({
-			width: probeLayout.tileWidth,
-			height: probeLayout.tileHeight,
-			fit: "contain",
-			background: MOSAIC_BACKGROUND
-		});
-		const resized = await (label.length === 0 ? fitted : fitted.composite([{
-			input: tileLabelSvg(probeLayout.tileWidth, probeLayout.tileHeight, label),
-			top: 0,
-			left: 0
-		}])).jpeg({ quality: 82 }).toBuffer();
-		decoded.push({
-			tile,
-			resized
-		});
+		await sharp(tile.jpeg).metadata();
+		usable.push(tile);
 	} catch (err) {
 		logger.warn("summary mosaic: a tile could not be decoded and was dropped", {
 			tags: { deviceId: tile.deviceId },
@@ -14336,23 +14460,34 @@ async function renderMosaic(request, logger) {
 			}
 		});
 	}
-	const droppedTiles = request.tiles.length - decoded.length;
+	const droppedTiles = request.tiles.length - usable.length;
+	if (usable.length === 0) throw new Error(`summary mosaic: no tile could be decoded (${request.tiles.length} offered)`);
 	const caption = plan.titleBand ? request.caption?.trim() ?? "" : "";
 	const layout = mosaicLayout({
-		tileCount: Math.max(1, decoded.length),
+		tileCount: usable.length,
 		...request.maxWidth !== void 0 ? { maxWidth: request.maxWidth } : {},
 		withTitle: caption.length > 0
 	});
-	const composites = await Promise.all(decoded.map(async ({ resized }, index) => ({
-		input: layout.tileWidth === probeLayout.tileWidth && layout.tileHeight === probeLayout.tileHeight ? resized : await sharp(resized).resize({
-			width: layout.tileWidth,
-			height: layout.tileHeight,
+	const composites = await Promise.all(usable.map(async (tile, index) => {
+		const rect = layout.tiles[index];
+		if (rect === void 0) throw new Error("summary mosaic: layout lost a tile");
+		const label = plan.tileLabels ? tile.label?.trim() ?? "" : "";
+		const fitted = sharp(tile.jpeg).resize({
+			width: rect.w,
+			height: rect.h,
 			fit: "contain",
 			background: MOSAIC_BACKGROUND
-		}).jpeg({ quality: 82 }).toBuffer(),
-		top: layout.tiles[index]?.y ?? 0,
-		left: layout.tiles[index]?.x ?? 0
-	})));
+		});
+		return {
+			input: await (label.length === 0 ? fitted : fitted.composite([{
+				input: tileLabelSvg(rect.w, rect.h, label),
+				top: 0,
+				left: 0
+			}])).jpeg({ quality: 82 }).toBuffer(),
+			top: rect.y,
+			left: rect.x
+		};
+	}));
 	if (caption.length > 0 && layout.titleHeight > 0) composites.unshift({
 		input: titleSvg(layout.width, layout.titleHeight, caption),
 		top: 0,
@@ -14568,6 +14703,36 @@ function buildSummaryOutboxInputs(input) {
 * the quota degrades honestly: the best cameras get their one tile, the rest
 * are counted as dropped and the count rides the log line — never silently.
 *
+* ## Only tracks the pipeline PROMOTED
+*
+* A digest is retrospective. The operator's own framing, verbatim: *"ideale
+* sarebbe considerare solo tracce che vengono alla fine promosse a tracce, dato
+* che il summary non è atteso di essere realtime"* — the window is closed
+* before this function is called, so the selection may wait for the pipeline's
+* verdict instead of guessing at it.
+*
+* The verdict is `SortTracker`'s own promotion threshold: a candidate is not
+* emitted as a track until it has been matched on `minHits` frames
+* (`isConfirmedForEmit`, per-device setting, *"minimum consecutive detection
+* hits before a track is promoted to output"*). The gate here re-applies that
+* same threshold to what the CLOSED row actually left behind — the count of
+* recorded sightings on its trajectory — and the port that builds a candidate
+* is the only thing that knows the device's `minHits`.
+*
+* This is not a movement heuristic and deliberately so: `totalDistance` and
+* `state` were both measured against live traffic and both hide real passages.
+* What they cannot see is the shape this gate is for — a row whose whole life
+* is one or two frames. Measured on device 617 (2026-08-19 04:12): two rows,
+* `closedReason` NULL so the parked pass is blind to them, dwell 53 ms,
+* `totalDistance` 0, two recorded sightings each. And `minImportance` cannot
+* cover it either, structurally: the static-track gate that demotes a frozen
+* subject needs two centroids to measure anything
+* (`computeStaticTrackMetrics`), so a single-sighting row is exactly the shape
+* it never scores down — 33 of the live hub's 34 such rows sit at or above 0.2.
+*
+* There is no rule field to turn it off. A digest of things that were never
+* tracks has no audience, and this repo has shipped knobs nobody read.
+*
 * ## Zones are scoped PER CAMERA
 *
 * `filters.zones` is a flat id list on a rule that spans cameras, and zone ids
@@ -14591,15 +14756,20 @@ function dwellSeconds(candidate) {
 * branch that discards work silently reads as "it never happened".
 */
 function filterSummaryCandidates(candidates, filters, zoneOwner) {
-	const moving = filters?.includeStationary === true ? candidates : candidates.filter((candidate) => candidate.stationary !== true);
-	const droppedStationary = candidates.length - moving.length;
+	const promoted = candidates.filter((candidate) => candidate.confirmed !== false);
+	const droppedUnconfirmed = candidates.length - promoted.length;
+	const unknownConfirmation = promoted.filter((candidate) => candidate.confirmed === void 0).length;
+	const moving = filters?.includeStationary === true ? promoted : promoted.filter((candidate) => candidate.stationary !== true);
+	const droppedStationary = promoted.length - moving.length;
 	if (filters === void 0) return {
 		kept: [...moving],
 		droppedByClass: 0,
 		droppedByZone: 0,
 		droppedByImportance: 0,
 		droppedByDwell: 0,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 	const include = filters.classes;
 	const exclude = new Set(filters.classesExclude ?? []);
@@ -14645,7 +14815,9 @@ function filterSummaryCandidates(candidates, filters, zoneOwner) {
 		droppedByZone,
 		droppedByImportance,
 		droppedByDwell,
-		droppedStationary
+		droppedStationary,
+		droppedUnconfirmed,
+		unknownConfirmation
 	};
 }
 /**
@@ -15021,7 +15193,9 @@ var NcSummaryProducer = class {
 					droppedByZone: filtered.droppedByZone,
 					droppedByImportance: filtered.droppedByImportance,
 					droppedByDwell: filtered.droppedByDwell,
-					droppedStationary: filtered.droppedStationary
+					droppedStationary: filtered.droppedStationary,
+					droppedUnconfirmed: filtered.droppedUnconfirmed,
+					unknownConfirmation: filtered.unknownConfirmation
 				} });
 				if (opts.stamp) await this.deps.store.markGenerated(rule.id, window.endMs);
 				return {
@@ -15085,6 +15259,8 @@ var NcSummaryProducer = class {
 				scanned: candidates.length,
 				matched: filtered.kept.length,
 				droppedStationary: filtered.droppedStationary,
+				droppedUnconfirmed: filtered.droppedUnconfirmed,
+				unknownConfirmation: filtered.unknownConfirmation,
 				droppedByClass: filtered.droppedByClass,
 				tiles: loaded.length,
 				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
@@ -18838,6 +19014,18 @@ var NotificationCenter = class NotificationCenter {
 	drainTicks = 0;
 	evaluationActive = false;
 	/**
+	* The armed boot back-fill — see {@link runBootBackfill}. Held so
+	* {@link whenHydrated} can be awaited by an operator surface or a test that
+	* needs the durable state, and so nothing re-arms it.
+	*/
+	hydration = null;
+	/**
+	* The instant `start()` opened the intake. Everything persisted from here on
+	* is evaluated live by THIS process, which is what bounds the boot reconcile
+	* at its late end — see {@link reconcile}.
+	*/
+	intakeOpenedAt = 0;
+	/**
 	* The tap-through buttons for ONE delivery, each with its own single-use
 	* token.
 	*
@@ -19339,49 +19527,190 @@ var NotificationCenter = class NotificationCenter {
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
 	* When `evaluation` is true (the designated post-processing node ONLY),
-	* also hydrate the outbox, seed cooldowns, run the crash-gap reconcile
-	* and start the drain + rule-reload timers.
+	* open the intake and arm the drain + rule-reload timers.
+	*
+	* ## `start()` resolving means "the centre is EVALUATING"
+	*
+	* It does NOT mean the durable back-fill has finished. That contract was
+	* written on 2026-08-14 for the two producers (a timelapse render inside
+	* `initialize()` took eight capabilities off the cluster for two render
+	* timeouts) and it applies to the centre itself for the same reason: this
+	* method is awaited by `buildNotificationCenter`, which is awaited by
+	* `pipeline-analytics.onInitialize()`, and `addon-runner` publishes a
+	* child's capability manifest only AFTER `initialize()` returns.
+	*
+	* Measured on the live hub 2026-08-17 at ZERO transport contention, the
+	* `buildNotificationCenter` boot step took **270 s** — all of it durable
+	* back-fill: `hydrateLiveness` (775 subjects), `outbox.load` (743 rows),
+	* and two N+1 per-device refresh loops (`readDeviceStates` and
+	* `readDeviceZoneIds` issue ONE RPC per watched device, serially). For
+	* those 270 s the cluster had no provider for any capability this addon
+	* declares, and the intake below had not been opened either — so nothing
+	* arriving in that window was late, it was never evaluated at all.
+	*
+	* ## What stays here, and why
+	*
+	* Only reads a notification cannot be CORRECT without, and each is one
+	* store query:
+	*
+	*  - the TEXT catalog — a notification built before it goes out in the
+	*    wrong language;
+	*  - the RULES — without them there is nothing to evaluate;
+	*  - the SNOOZE windows and the per-camera MUTES — both SUPPRESS, so a cold
+	*    one fails OPEN: the operator gets pushes they explicitly silenced;
+	*  - the timelapse + summary rule sets, which the producers armed below read.
+	*
+	* Everything else is a mirror the 30 s reload tick re-reads anyway, or a
+	* boot-once hydration whose cold behaviour is already defined and safe —
+	* see {@link runBootBackfill}, which names the direction for each one.
 	*/
 	async start(opts) {
-		await this.reloadTexts();
-		await this.rules.load();
-		await this.snoozes.load();
-		await this.deviceMutes.load();
-		await this.timelapseRules.load();
-		await this.summaryRules.load();
+		const t0 = Date.now();
+		let phaseT = t0;
+		const timed = async (phase, run) => {
+			await run();
+			const now = Date.now();
+			this.logger.info("notification start phase", { meta: {
+				phase,
+				ms: now - phaseT,
+				sinceStartMs: now - t0
+			} });
+			phaseT = now;
+		};
+		await timed("texts", () => this.reloadTexts());
+		await timed("rules", () => this.rules.load());
+		await timed("snoozes", () => this.snoozes.load());
+		await timed("deviceMutes", () => this.deviceMutes.load());
+		await timed("timelapseRules", () => this.timelapseRules.load());
+		await timed("summaryRules", () => this.summaryRules.load());
 		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
-		await this.deviceStates.refresh();
-		await this.deviceDirectory.refresh();
-		await this.hydrateLiveness();
-		await this.zoneOwners.refresh();
 		this.sceneStates.refresh();
+		this.intakeOpenedAt = this.now();
 		this.evaluationActive = true;
-		await this.outbox.load();
-		await this.seedCooldowns();
-		await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
-		await this.hydrateOccupancy();
-		await this.reconcile();
 		this.drainTimer = setInterval(() => {
 			this.drainTick();
 		}, this.deps.drainIntervalMs ?? DEFAULT_DRAIN_INTERVAL_MS);
 		this.reloadTimer = setInterval(() => {
 			this.reloadRules();
 		}, this.deps.ruleReloadIntervalMs ?? DEFAULT_RULE_RELOAD_INTERVAL_MS);
-		if (this.timelapseScheduler !== null) await this.timelapseScheduler.start().catch((err) => {
+		const timelapseScheduler = this.timelapseScheduler;
+		if (timelapseScheduler !== null) await timed("timelapseProducer", () => timelapseScheduler.start()).catch((err) => {
 			this.logger.warn("timelapse producer did not start", { meta: { error: String(err) } });
 		});
-		if (this.summaryProducer !== null) await this.summaryProducer.start().catch((err) => {
+		const summaryProducer = this.summaryProducer;
+		if (summaryProducer !== null) await timed("summaryProducer", () => summaryProducer.start()).catch((err) => {
 			this.logger.warn("summary producer did not start", { meta: { error: String(err) } });
 		});
+		this.armBootBackfill();
 		this.logger.info("notification center started", { meta: {
+			ms: Date.now() - t0,
 			rules: this.rules.list().length,
-			pendingOutbox: this.outbox.pendingCount(),
 			timelapseRules: this.timelapseRules.list().length,
 			timelapseProducer: this.timelapseScheduler !== null,
 			summaryRules: this.summaryRules.list().length,
 			summaryProducer: this.summaryProducer !== null,
-			summaryAi: this.summaryAi !== null
+			summaryAi: this.summaryAi !== null,
+			backfill: "armed"
+		} });
+	}
+	/**
+	* The durable back-fill, finished.
+	*
+	* Resolves immediately when nothing was armed (a non-evaluation node, or a
+	* centre that was never started). Never rejects — every phase owns its own
+	* failure. Exists so a caller that genuinely needs the hydrated state — a
+	* test asserting the reseed, an operator surface reporting readiness — can
+	* ask for it instead of sleeping.
+	*/
+	whenHydrated() {
+		return this.hydration ?? Promise.resolve();
+	}
+	/**
+	* ONE drain pass, awaited — the interval's own tick, called directly.
+	*
+	* The same code path the timer drives, deliberately: a caller that flushes
+	* the queue through a parallel implementation is testing the parallel
+	* implementation.
+	*/
+	async drainNow() {
+		await this.drainTick();
+	}
+	armBootBackfill() {
+		if (this.hydration !== null) return;
+		this.hydration = this.runBootBackfill().catch((err) => {
+			this.logger.warn("notification back-fill could not be armed", { meta: { error: String(err) } });
+		});
+	}
+	/**
+	* The boot back-fill: everything `start()` used to await.
+	*
+	* Ordered by what a cold mirror COSTS, most expensive first — this is a
+	* sequence, not a `Promise.all`, because these reads share one UDS store
+	* client and racing them is how a boot becomes a queue again.
+	*
+	*  1. the device directory + the LIVENESS ledger. Cold costs a FLOOD (D130:
+	*     one "camera online" per camera on the installation, 2026-08-13), so it
+	*     goes first. The ledger's own contract holds in the window: an empty
+	*     mirror SEEDS silently rather than notifying (D49, fail toward
+	*     discard), and device liveness is additionally held for 5 minutes by
+	*     `DeviceLivenessHoldoff` before it can notify at all — which is far
+	*     longer than this phase.
+	*  2. the OCCUPANCY state. Cold costs a re-announced edge (the cold-baseline
+	*     bug, `occupancy-cold-seed.spec.ts`).
+	*  3. the OUTBOX horizon, then the COOLDOWN seed. Both cost a REPEAT while
+	*     cold — a dedup id nobody remembers, a cooldown nobody recovered — and
+	*     the horizon goes first because it is what makes every phase after it
+	*     (the reconcile above all) idempotent. The outbox's own cold window is
+	*     made safe structurally — see `NcOutbox.load` / `rowExists`.
+	*  4. the ZONE ownership. Cold costs a WIDER verdict (a zone-scoped rule
+	*     evaluates camera-wide), so it precedes the gates that fail closed.
+	*  5. the DEVICE STATES. Cold costs silence — `undefined` never matches — so
+	*     it is the safest of the lot and goes after the N+1 above it.
+	*  6. the RECONCILE, which replays records persisted across the crash gap.
+	*     After the outbox on purpose: the replay is idempotent only through the
+	*     dedup horizon.
+	*  7. the retention prune. Pure hygiene, nothing reads its result.
+	*
+	* Every phase reports its own ms. The 2026-08-17 boot could not say which of
+	* these owned the 270 s because none of them said anything, and the addon's
+	* own per-step timing stopped at `buildNotificationCenter`.
+	*/
+	async runBootBackfill() {
+		const t0 = Date.now();
+		const phase = async (name, run) => {
+			if (!this.evaluationActive) return false;
+			const at = Date.now();
+			try {
+				await run();
+			} catch (err) {
+				this.logger.warn("notification back-fill phase failed", { meta: {
+					phase: name,
+					error: String(err)
+				} });
+			}
+			this.logger.info("notification back-fill phase", { meta: {
+				phase: name,
+				ms: Date.now() - at,
+				sinceStartMs: Date.now() - t0
+			} });
+			return true;
+		};
+		if (!await phase("deviceDirectory", () => this.deviceDirectory.refresh())) return;
+		if (!await phase("liveness", () => this.hydrateLiveness())) return;
+		if (!await phase("occupancy", () => this.hydrateOccupancy())) return;
+		if (!await phase("outbox", () => this.outbox.load())) return;
+		if (!await phase("cooldowns", () => this.seedCooldowns())) return;
+		if (!await phase("zoneOwners", () => this.zoneOwners.refresh())) return;
+		if (!await phase("deviceStates", () => this.deviceStates.refresh())) return;
+		if (!await phase("reconcile", () => this.reconcile())) return;
+		if (!await phase("prune", async () => {
+			await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
+		})) return;
+		this.logger.info("notification center back-fill complete", { meta: {
+			ms: Date.now() - t0,
+			pendingOutbox: this.outbox.pendingCount(),
+			dedupHorizon: this.outbox.hydrated()
 		} });
 	}
 	async stop() {
@@ -19399,6 +19728,7 @@ var NotificationCenter = class NotificationCenter {
 		this.addonUpdates.dispose();
 		this.livenessHoldoff.dispose();
 		this.evaluationActive = false;
+		this.hydration = null;
 	}
 	/**
 	* Consume ONE event. THE entry point of the notification path — every
@@ -21581,14 +21911,31 @@ var NotificationCenter = class NotificationCenter {
 			});
 		}
 	}
-	/** Boot crash-gap reconcile — see the module docstring. */
+	/**
+	* Boot crash-gap reconcile — see the module docstring.
+	*
+	* **Bounded at BOTH ends.** `since` closes the gap the previous process left;
+	* {@link intakeOpenedAt} closes the one this one would otherwise open. The
+	* reconcile used to run before the intake existed, so "a record newer than
+	* the watermark" and "a record this process has not evaluated" were the same
+	* set. They are not any more: the reconcile is a back-fill phase now, and
+	* every record persisted since `start()` opened the intake has ALREADY been
+	* evaluated in-process — the exact sentence `drainTick` uses to justify
+	* advancing the watermark to `now`.
+	*
+	* Replaying one of those is not merely redundant. The outbox dedup id makes
+	* the DELIVERY idempotent, but a rule's `onTrigger` sequence is actuated
+	* before the cooldown gate and before any dedup (see `runRuleActions`), so a
+	* replay would open the gate, arm the alarm or sound the siren a second time.
+	*/
 	async reconcile() {
 		const now = this.now();
 		const watermark = await this.outbox.getWatermark();
 		const windowStart = now - (this.deps.reconcileWindowMs ?? DEFAULT_RECONCILE_WINDOW_MS);
 		const since = Math.max(windowStart, (watermark ?? 0) - RECONCILE_OVERLAP_MS);
+		const until = this.intakeOpenedAt;
 		try {
-			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].sort((a, b) => a.timestamp - b.timestamp);
+			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].filter((e) => e.timestamp < until).sort((a, b) => a.timestamp - b.timestamp);
 			for (const event of ordered) {
 				const phase = packagePhaseOf(event);
 				this.consumeEvent(asReconcile(phase !== null ? incomingFromPackageEvent(event, phase) : incomingFromObjectEvent(event)));
@@ -22229,6 +22576,16 @@ function planRuleTest(input) {
 *    never be re-owned through a patch.
 *  - `nc.setRuleTargetEnabled` — a user opting HIS OWN target out of a rule
 *    VISIBLE to him (his own personal rule OR a global/admin rule).
+*  - the TIMELAPSE and DIGEST families (`nc.*TimelapseRule*`,
+*    `nc.*SummaryRule*`) repeat that model exactly over their own stores. The
+*    digest half was `auth: 'admin'` in v1 and was relaxed once the operator
+*    closed the cost question; `nc.listSummaryRules` reports the current answer
+*    as `canAuthor` so a client talking to an older hub degrades to a read-only
+*    list instead of discovering the refusal as a 403 on a filled-in form.
+*  - the three TEST actions (`nc.injectTestEvent`, `nc.testRule`,
+*    `nc.testTimelapseRule`, `nc.testSummaryRule`) stay `auth: 'admin'`
+*    regardless of who owns the rule: they DELIVER, to every target the rule
+*    addresses, on other people's phones.
 *
 * Target-ownership limits (personal-rule delivery target list + the opt-out
 * target) are enforced against the notifiers target catalog; ADMINS bypass the
@@ -22447,7 +22804,25 @@ var ncActions = defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
-	"nc.listSummaryRules": customAction(object({}), object({ rules: array(NcViewerSummaryRuleSchema) }), { caller: "required" }),
+	"nc.listSummaryRules": customAction(object({}), object({
+		rules: array(NcViewerSummaryRuleSchema),
+		/**
+		* DOES THIS HUB LET THE CALLER AUTHOR ONE? The capability probe, and the
+		* only honest way a client can know.
+		*
+		* `nc.upsertSummaryRule` was `auth: 'admin'` until the operator closed
+		* that decision, and a viewer talking to a hub that still refuses has to
+		* find out BEFORE it offers a "New summary rule" button — otherwise the
+		* only feedback is a 403 taken in front of the operator on a form they
+		* had already filled in. ADDITIVE and therefore `.optional()` on every
+		* client mirror: absent means an older hub, which the viewer reads as "no
+		* authoring" and degrades to a read-only list with a note.
+		*
+		* Derived from the same predicate the handlers enforce — never a constant
+		* `true` — so a hub that re-tightened the auth could not say otherwise.
+		*/
+		canAuthor: boolean()
+	}), { caller: "required" }),
 	/**
 	* ONE action for create AND update, like `nc.upsertTimelapseRule`: a digest
 	* rule is authored as a whole (cameras + window + filters + targets) and the
@@ -22456,10 +22831,18 @@ var ncActions = defineCustomActions({
 	*
 	* `ruleId` absent ⇒ create from `rule`; present ⇒ patch.
 	*
-	* `auth: 'admin'` in v1 (operator decision): a digest spans cameras and, once
-	* P2 lands, consumes the local vision model. A personal rule that fans vision
-	* calls across other people's cameras is a decision to take after the real
-	* cost has been watched for a few weeks, not before.
+	* `caller: 'required'`, NOT `auth: 'admin'`. It was admin-only in v1 because
+	* a digest spans cameras and consumes the local vision model, and that cost
+	* had not been watched yet. The operator closed the decision, so this now
+	* carries exactly the auth the two rule families beside it carry: ownership
+	* is enforced in the handler, `ownerUserId` is STAMPED from the resolved
+	* caller, a personal rule may deliver only to targets that caller OWNS, and an
+	* admin still authors GLOBAL rules. No new ownership model was invented for
+	* it — `NcSummaryStore` has had `ownerUserId` / `listForOwner` since it was
+	* written and they were simply not reachable.
+	*
+	* `nc.testSummaryRule` stays admin: that one DELIVERS, on other people's
+	* phones.
 	*/
 	"nc.upsertSummaryRule": customAction(object({
 		ruleId: string().optional(),
@@ -22467,12 +22850,10 @@ var ncActions = defineCustomActions({
 		patch: NcSummaryRulePatchSchema.optional()
 	}), object({ rule: NcSummaryRuleSchema }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	"nc.deleteSummaryRule": customAction(object({ ruleId: string() }), object({ success: literal(true) }), {
 		kind: "mutation",
-		auth: "admin",
 		caller: "required"
 	}),
 	/**
@@ -22566,6 +22947,17 @@ var ncActions = defineCustomActions({
 	*  a surface that distinguishes them reports what other people own. */
 	"nc.getArtifact": customAction(object({ artifactId: string().min(1) }), object({ artifact: NcArtifactRecordSchema.nullable() }), { caller: "required" })
 });
+/**
+* Does THIS build let a non-admin author a digest rule?
+*
+* A named constant rather than a literal `true` at the call site, so the one
+* fact `nc.listSummaryRules.canAuthor` reports and the auth the upsert actually
+* carries sit beside each other and are changed together. If the operator ever
+* re-tightens the action, this goes to `false` in the same edit and the viewer
+* degrades on the next list — instead of the app discovering it by taking a 403
+* on a form the operator had already filled in.
+*/
+var SUMMARY_AUTHORING_OPEN = true;
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
 function requireCaller$1(caller) {
 	if (!caller || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error("forbidden: authenticated caller required");
@@ -22626,6 +23018,22 @@ function makeNcActionHandlers(deps) {
 		if (editor === void 0) throw new Error("this node does not host the notification text catalog — use the hub");
 		return editor;
 	};
+	/**
+	* A digest rule the caller may EDIT. Same shape and same admin bypass as
+	* {@link assertTimelapseEditable} — deliberately, because a second ownership
+	* model for the third rule family is a second place to get it wrong.
+	*
+	* A GLOBAL rule (no `ownerUserId`, what an admin authors) is VISIBLE to
+	* everyone and editable by admins only: `listForOwner` returns it, so a user
+	* sees it in the list, and `readOnly` says so.
+	*/
+	const assertSummaryEditable = (ruleId, caller, sum) => {
+		const rule = sum.store.get(ruleId);
+		if (rule === null) throw new Error(`forbidden: summary rule not found: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== caller.userId) throw new Error(`forbidden: summary rule not owned: ${ruleId}`);
+		return rule;
+	};
 	/** A timelapse rule the caller may EDIT. Same admin bypass as `NcRule`. */
 	const assertTimelapseEditable = (ruleId, caller, tl) => {
 		const rule = tl.store.get(ruleId);
@@ -22896,21 +23304,23 @@ function makeNcActionHandlers(deps) {
 		"nc.listSummaryRules": async (_input, caller) => {
 			const c = requireCaller$1(caller);
 			const sum = requireSummary();
-			return { rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
-				...r,
-				readOnly: !c.isAdmin
-			})) };
+			return {
+				rules: (c.isAdmin ? sum.store.list() : sum.store.listForOwner(c.userId)).map((r) => ({
+					...r,
+					readOnly: !c.isAdmin && r.ownerUserId !== c.userId
+				})),
+				canAuthor: SUMMARY_AUTHORING_OPEN
+			};
 		},
 		"nc.upsertSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to author a summary rule");
 			const sum = requireSummary();
 			if (input.ruleId === void 0) {
 				if (input.rule === void 0) throw new Error("upsertSummaryRule: rule or ruleId required");
 				const parsed = NcSummaryRuleInputSchema.parse(input.rule);
 				assertSummaryBudget(parsed);
 				await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
-				const rule = await sum.store.create(parsed, c.userId);
+				const rule = await sum.store.create(parsed, c.userId, c.isAdmin ? void 0 : c.userId);
 				deps.logger.info("summary rule created", { meta: {
 					ruleId: rule.id,
 					owner: c.userId,
@@ -22918,8 +23328,7 @@ function makeNcActionHandlers(deps) {
 				} });
 				return { rule };
 			}
-			const existing = sum.store.get(input.ruleId);
-			if (existing === null) throw new Error(`forbidden: summary rule not found: ${input.ruleId}`);
+			const existing = assertSummaryEditable(input.ruleId, c, sum);
 			if (input.patch === void 0) throw new Error("upsertSummaryRule: patch required");
 			const patch = NcSummaryRulePatchSchema.parse(input.patch);
 			assertSummaryBudget({
@@ -22936,8 +23345,9 @@ function makeNcActionHandlers(deps) {
 		},
 		"nc.deleteSummaryRule": async (input, caller) => {
 			const c = requireCaller$1(caller);
-			if (!c.isAdmin) throw new Error("forbidden: admin required to delete a summary rule");
-			await requireSummary().store.delete(input.ruleId);
+			const sum = requireSummary();
+			assertSummaryEditable(input.ruleId, c, sum);
+			await sum.store.delete(input.ruleId);
 			deps.logger.info("summary rule deleted", { meta: {
 				ruleId: input.ruleId,
 				owner: c.userId
@@ -44216,7 +44626,9 @@ var TrackStore = class {
 	*/
 	rowToTrack(id, data, projection) {
 		const slim = projection === "slim";
-		const positions = slim ? [] : data["positions"] ?? [];
+		const storedPositions = data["positions"] ?? [];
+		const observations = storedPositions.length;
+		const positions = slim ? [] : storedPositions;
 		const snapshots = slim ? [] : data["snapshots"] ?? [];
 		const zones = data["zonesVisited"] ?? [];
 		const classes = data["classes"];
@@ -44273,6 +44685,7 @@ var TrackStore = class {
 			...typeof hasFace === "boolean" ? { hasFace } : {},
 			...typeof hasRider === "boolean" ? { hasRider } : {},
 			...closedReason !== void 0 ? { closedReason } : {},
+			observations,
 			...envelope !== null ? { envelope } : {}
 		};
 	}
@@ -51661,7 +52074,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			return out;
 		};
 		await step("declareCollections", () => this.declareCollections(api));
-		await step("declareAlarmPanel", () => this.declareAlarmPanel(api));
+		this.armAlarmPanelDeclaration(api);
 		const logger = this.ctx.logger;
 		const storage = await step("resolveMediaStorage", () => this.resolveMediaStorage(logger));
 		const stores = await step("buildStores", () => this.buildStores(api, logger, storage));
@@ -51804,8 +52217,33 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* name over the operator's rename. What is left is the declaration and the
 	* ports.
 	*/
+	/**
+	* Arm the declaration as BACKGROUND work and return immediately.
+	*
+	* `initialize()` is on the critical path of the whole capability graph — the
+	* runner publishes an addon's manifest only after it returns — so an await
+	* that can outlive a boot is an outage with a fixed blast radius
+	* (docs/architecture/addon-lifecycle.md). This one could not merely outlive a
+	* boot, it could not possibly succeed during one: the first port call is
+	* `integrations.getByAddonId`, a hub-CORE namespace served by `$core-caps`,
+	* which `main.ts` registers only AFTER `app.init()` returns, i.e. after the
+	* whole addon boot. Core caps are excluded from the boot-window retry, so the
+	* call sat in the 60 s UDS timeout — measured at 61 s of DETERMINISTIC delay
+	* on every boot of this addon (D167).
+	*
+	* And the wait bought nothing. The retry ladder is the real path: on the live
+	* boot of 2026-08-19 the panel was declared at t0+204 s with `attempts=1`,
+	* i.e. on the ladder's FIRST tick, after the doomed boot attempt had already
+	* been paid for.
+	*/
+	armAlarmPanelDeclaration(api) {
+		this.declareAlarmPanel(api).catch((err) => {
+			this.ctx.logger.warn("alarm panel declaration could not be armed — the Alarm tab stays empty until this addon restarts", { meta: { error: errMsg(err) } });
+		});
+	}
 	async declareAlarmPanel(api) {
 		if (await this.attemptAlarmPanelDeclaration(api)) return;
+		if (this.shuttingDown) return;
 		this.alarmPanelConvergence = startAlarmPanelConvergence({
 			attempt: () => this.attemptAlarmPanelDeclaration(api),
 			logger: this.ctx.logger.child("alarm")
@@ -52582,13 +53020,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	buildSummaryPorts(stores) {
 		return {
 			listTracks: async ({ deviceId, sinceMs, untilMs, limit }) => {
-				return (await stores.trackStore.queryHistorical({
+				const tracks = await stores.trackStore.queryHistorical({
 					deviceId,
 					since: sinceMs,
 					until: untilMs,
 					projection: "slim",
 					limit
-				})).map((t) => ({
+				});
+				const { minHits } = await this.resolveDeviceDetectionSensitivitySettings(deviceId);
+				return tracks.map((t) => ({
 					trackId: t.trackId,
 					deviceId: t.deviceId,
 					className: t.className,
@@ -52597,7 +53037,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					...t.importance !== void 0 ? { importance: t.importance } : {},
 					zones: [...t.zonesVisited],
 					...t.classes !== void 0 ? { classes: [...t.classes] } : {},
-					...t.closedReason === "stationary-promotion" ? { stationary: true } : {}
+					...t.closedReason === "stationary-promotion" ? { stationary: true } : {},
+					...t.observations !== void 0 ? { confirmed: t.observations >= minHits } : {}
 				}));
 			},
 			listMediaInfo: async (trackId) => {