@camstack/addon-post-analysis 1.2.97 → 1.2.99

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DyXoKV7Z.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-Caz0R4UZ.mjs}

@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.61",
+		version: "1.2.62",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",

package/dist/pipeline-analytics/{hostInit-CkEakaQn.mjs → hostInit-By6c47y7.mjs}

@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.61",
+				version: "1.2.62",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/pipeline-analytics/index.js

@@ -12098,6 +12098,18 @@ var NcOutbox = class {
 	maxAttempts;
 	drainBatchSize;
 	drainInFlight = false;
+	/**
+	* Has {@link load} landed?
+	*
+	* The load moved OFF the boot critical path (see
+	* `NotificationCenter.runBootBackfill`), so for the first seconds of a boot
+	* the centre evaluates and enqueues with an EMPTY `knownIds` — and
+	* `knownIds` is the dedup ledger. Until this flips, {@link enqueue} asks the
+	* store itself instead. False is therefore not "the load failed", it is
+	* "the horizon is not authoritative yet"; a load that FAILED leaves it false
+	* forever, which keeps the per-enqueue guard on, which is exactly right.
+	*/
+	horizonLoaded = false;
 	constructor(deps) {
 		this.store = deps.store;
 		this.logger = deps.logger;
@@ -12119,7 +12131,26 @@ var NcOutbox = class {
 			columns: [...NC_META_COLUMNS]
 		});
 	}
-	/** Hydrate pending rows + the dedup id horizon. Best-effort. */
+	/**
+	* Hydrate pending rows + the dedup id horizon. Best-effort.
+	*
+	* **Runs OFF the boot critical path** (2026-08-17: 743 rows over the UDS
+	* store client, ~50 s, inside the `initialize()` that publishes the runner's
+	* capability manifest). So it lands against a centre that has already been
+	* evaluating, enqueueing and DELIVERING for as long as the query took — and
+	* the rows it is holding are a snapshot taken before all of that.
+	*
+	* That is why an id this process already knows is SKIPPED rather than
+	* applied. `knownIds` is only ever written by an in-process {@link enqueue}
+	* or by this method, so an id already in it at apply time is one whose live
+	* state (pending, or absent because it went terminal) is strictly newer than
+	* the snapshot. Applying the snapshot over it would put a row that has
+	* already been DELIVERED back into `pending`, and the operator would receive
+	* the same notification twice.
+	*
+	* Nothing is lost by the same token: this method only ADDS to `pending`, so
+	* a row enqueued while the query was in flight is untouched.
+	*/
 	async load() {
 		try {
 			const rows = await this.store.query.query({
@@ -12129,19 +12160,30 @@ var NcOutbox = class {
 					limit: 1e5
 				}
 			});
+			let superseded = 0;
 			for (const row of rows) {
+				if (this.knownIds.has(row.id)) {
+					superseded += 1;
+					continue;
+				}
 				this.knownIds.add(row.id);
 				const entry = rowToEntry$1(row.id, row.data);
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
+			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
-				known: this.knownIds.size
+				known: this.knownIds.size,
+				superseded
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
 		}
 	}
+	/** Is the dedup horizon authoritative? See {@link horizonLoaded}. */
+	hydrated() {
+		return this.horizonLoaded;
+	}
 	pendingCount() {
 		return this.pending.size;
 	}
@@ -12156,6 +12198,18 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
+			if (!this.horizonLoaded && await this.rowExists(id)) {
+				this.knownIds.add(id);
+				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
+					tags: { deviceId: input.deviceId },
+					meta: {
+						id,
+						ruleId: input.ruleId,
+						targetId: input.targetId
+					}
+				});
+				continue;
+			}
 			const entry = {
 				id,
 				ruleId: input.ruleId,
@@ -12428,6 +12482,35 @@ var NcOutbox = class {
 		this.pending.set(entry.id, retry);
 		await this.mutate(retry);
 	}
+	/**
+	* Does a row already exist under this dedup id?
+	*
+	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
+	* with `set` — an UPSERT keyed by the dedup id — so an enqueue that ran
+	* before the horizon landed would rewrite a row that had already been
+	* DELIVERED back to `pending`, and the drain would send it again. That is
+	* the D-3 `maxPerTrack: 1` guarantee, and it cannot be allowed to depend on
+	* whether a 743-row query had finished.
+	*
+	* A read that FAILS answers `false`, i.e. the intent is enqueued. Duplicate
+	* over lost: a duplicate notification is an annoyance the operator can see,
+	* and a dropped one is a notification nobody ever knows was owed.
+	*/
+	async rowExists(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return row !== null && row !== void 0;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return false;
+		}
+	}
 	async persist(entry) {
 		await this.store.set.mutate({
 			collection: NC_OUTBOX_COLLECTION,
@@ -12955,7 +13038,20 @@ var NcRuleStore = class {
 	* The operator's words stay on disk forever.
 	*/
 	async load() {
-		const rules = await this.ledger.load();
+		await this.ledger.load();
+		this.logger.debug("notification rules loaded", { meta: { rules: this.ledger.size } });
+	}
+	/**
+	* The identity NAME→ID migration, split out of {@link load} on 2026-08-19:
+	* `readIdentityIds` reaches the identity gallery, and at boot that single
+	* read cost 119 s — 74 s more than every other start() read combined —
+	* while buying only an ENRICHMENT: the engine still matches by name (it
+	* keeps that leg precisely for the gallery-cannot-answer case below). It
+	* now runs as a back-fill phase; the rename-immunity ids arrive seconds
+	* later instead of gating the intake.
+	*/
+	async migrateIdentityIds() {
+		const rules = this.ledger.snapshot();
 		const idsByName = await this.readIdentityIds();
 		let migrated = 0;
 		const unresolved = /* @__PURE__ */ new Set();
@@ -12966,10 +13062,7 @@ var NcRuleStore = class {
 			migrated += 1;
 			this.ledger.stage(result.rule);
 		}
-		this.logger.debug("notification rules loaded", { meta: {
-			rules: this.ledger.size,
-			...migrated > 0 ? { identitiesResolvedToIds: migrated } : {}
-		} });
+		if (migrated > 0) this.logger.info("notification rules migrated identity names to ids", { meta: { identitiesResolvedToIds: migrated } });
 		if (unresolved.size > 0) this.logger.info("notification rules name identities the gallery does not know", { meta: { names: [...unresolved].join(", ") } });
 	}
 	/**
@@ -18953,6 +19046,18 @@ var NotificationCenter = class NotificationCenter {
 	drainTicks = 0;
 	evaluationActive = false;
 	/**
+	* The armed boot back-fill — see {@link runBootBackfill}. Held so
+	* {@link whenHydrated} can be awaited by an operator surface or a test that
+	* needs the durable state, and so nothing re-arms it.
+	*/
+	hydration = null;
+	/**
+	* The instant `start()` opened the intake. Everything persisted from here on
+	* is evaluated live by THIS process, which is what bounds the boot reconcile
+	* at its late end — see {@link reconcile}.
+	*/
+	intakeOpenedAt = 0;
+	/**
 	* The tap-through buttons for ONE delivery, each with its own single-use
 	* token.
 	*
@@ -19454,49 +19559,192 @@ var NotificationCenter = class NotificationCenter {
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
 	* When `evaluation` is true (the designated post-processing node ONLY),
-	* also hydrate the outbox, seed cooldowns, run the crash-gap reconcile
-	* and start the drain + rule-reload timers.
+	* open the intake and arm the drain + rule-reload timers.
+	*
+	* ## `start()` resolving means "the centre is EVALUATING"
+	*
+	* It does NOT mean the durable back-fill has finished. That contract was
+	* written on 2026-08-14 for the two producers (a timelapse render inside
+	* `initialize()` took eight capabilities off the cluster for two render
+	* timeouts) and it applies to the centre itself for the same reason: this
+	* method is awaited by `buildNotificationCenter`, which is awaited by
+	* `pipeline-analytics.onInitialize()`, and `addon-runner` publishes a
+	* child's capability manifest only AFTER `initialize()` returns.
+	*
+	* Measured on the live hub 2026-08-17 at ZERO transport contention, the
+	* `buildNotificationCenter` boot step took **270 s** — all of it durable
+	* back-fill: `hydrateLiveness` (775 subjects), `outbox.load` (743 rows),
+	* and two N+1 per-device refresh loops (`readDeviceStates` and
+	* `readDeviceZoneIds` issue ONE RPC per watched device, serially). For
+	* those 270 s the cluster had no provider for any capability this addon
+	* declares, and the intake below had not been opened either — so nothing
+	* arriving in that window was late, it was never evaluated at all.
+	*
+	* ## What stays here, and why
+	*
+	* Only reads a notification cannot be CORRECT without, and each is one
+	* store query:
+	*
+	*  - the TEXT catalog — a notification built before it goes out in the
+	*    wrong language;
+	*  - the RULES — without them there is nothing to evaluate;
+	*  - the SNOOZE windows and the per-camera MUTES — both SUPPRESS, so a cold
+	*    one fails OPEN: the operator gets pushes they explicitly silenced;
+	*  - the timelapse + summary rule sets, which the producers armed below read.
+	*
+	* Everything else is a mirror the 30 s reload tick re-reads anyway, or a
+	* boot-once hydration whose cold behaviour is already defined and safe —
+	* see {@link runBootBackfill}, which names the direction for each one.
 	*/
 	async start(opts) {
-		await this.reloadTexts();
-		await this.rules.load();
-		await this.snoozes.load();
-		await this.deviceMutes.load();
-		await this.timelapseRules.load();
-		await this.summaryRules.load();
+		const t0 = Date.now();
+		const timed = async (phase, run) => {
+			const started = Date.now();
+			await run();
+			const now = Date.now();
+			this.logger.info("notification start phase", { meta: {
+				phase,
+				ms: now - started,
+				sinceStartMs: now - t0
+			} });
+		};
+		await Promise.all([
+			timed("texts", () => this.reloadTexts()),
+			timed("rules", () => this.rules.load()),
+			timed("snoozes", () => this.snoozes.load()),
+			timed("deviceMutes", () => this.deviceMutes.load()),
+			timed("timelapseRules", () => this.timelapseRules.load()),
+			timed("summaryRules", () => this.summaryRules.load())
+		]);
 		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
-		await this.deviceStates.refresh();
-		await this.deviceDirectory.refresh();
-		await this.hydrateLiveness();
-		await this.zoneOwners.refresh();
 		this.sceneStates.refresh();
+		this.intakeOpenedAt = this.now();
 		this.evaluationActive = true;
-		await this.outbox.load();
-		await this.seedCooldowns();
-		await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
-		await this.hydrateOccupancy();
-		await this.reconcile();
 		this.drainTimer = setInterval(() => {
 			this.drainTick();
 		}, this.deps.drainIntervalMs ?? DEFAULT_DRAIN_INTERVAL_MS);
 		this.reloadTimer = setInterval(() => {
 			this.reloadRules();
 		}, this.deps.ruleReloadIntervalMs ?? DEFAULT_RULE_RELOAD_INTERVAL_MS);
-		if (this.timelapseScheduler !== null) await this.timelapseScheduler.start().catch((err) => {
+		const timelapseScheduler = this.timelapseScheduler;
+		if (timelapseScheduler !== null) await timed("timelapseProducer", () => timelapseScheduler.start()).catch((err) => {
 			this.logger.warn("timelapse producer did not start", { meta: { error: String(err) } });
 		});
-		if (this.summaryProducer !== null) await this.summaryProducer.start().catch((err) => {
+		const summaryProducer = this.summaryProducer;
+		if (summaryProducer !== null) await timed("summaryProducer", () => summaryProducer.start()).catch((err) => {
 			this.logger.warn("summary producer did not start", { meta: { error: String(err) } });
 		});
+		this.armBootBackfill();
 		this.logger.info("notification center started", { meta: {
+			ms: Date.now() - t0,
 			rules: this.rules.list().length,
-			pendingOutbox: this.outbox.pendingCount(),
 			timelapseRules: this.timelapseRules.list().length,
 			timelapseProducer: this.timelapseScheduler !== null,
 			summaryRules: this.summaryRules.list().length,
 			summaryProducer: this.summaryProducer !== null,
-			summaryAi: this.summaryAi !== null
+			summaryAi: this.summaryAi !== null,
+			backfill: "armed"
+		} });
+	}
+	/**
+	* The durable back-fill, finished.
+	*
+	* Resolves immediately when nothing was armed (a non-evaluation node, or a
+	* centre that was never started). Never rejects — every phase owns its own
+	* failure. Exists so a caller that genuinely needs the hydrated state — a
+	* test asserting the reseed, an operator surface reporting readiness — can
+	* ask for it instead of sleeping.
+	*/
+	whenHydrated() {
+		return this.hydration ?? Promise.resolve();
+	}
+	/**
+	* ONE drain pass, awaited — the interval's own tick, called directly.
+	*
+	* The same code path the timer drives, deliberately: a caller that flushes
+	* the queue through a parallel implementation is testing the parallel
+	* implementation.
+	*/
+	async drainNow() {
+		await this.drainTick();
+	}
+	armBootBackfill() {
+		if (this.hydration !== null) return;
+		this.hydration = this.runBootBackfill().catch((err) => {
+			this.logger.warn("notification back-fill could not be armed", { meta: { error: String(err) } });
+		});
+	}
+	/**
+	* The boot back-fill: everything `start()` used to await.
+	*
+	* Ordered by what a cold mirror COSTS, most expensive first — this is a
+	* sequence, not a `Promise.all`, because these reads share one UDS store
+	* client and racing them is how a boot becomes a queue again.
+	*
+	*  1. the device directory + the LIVENESS ledger. Cold costs a FLOOD (D130:
+	*     one "camera online" per camera on the installation, 2026-08-13), so it
+	*     goes first. The ledger's own contract holds in the window: an empty
+	*     mirror SEEDS silently rather than notifying (D49, fail toward
+	*     discard), and device liveness is additionally held for 5 minutes by
+	*     `DeviceLivenessHoldoff` before it can notify at all — which is far
+	*     longer than this phase.
+	*  2. the OCCUPANCY state. Cold costs a re-announced edge (the cold-baseline
+	*     bug, `occupancy-cold-seed.spec.ts`).
+	*  3. the OUTBOX horizon, then the COOLDOWN seed. Both cost a REPEAT while
+	*     cold — a dedup id nobody remembers, a cooldown nobody recovered — and
+	*     the horizon goes first because it is what makes every phase after it
+	*     (the reconcile above all) idempotent. The outbox's own cold window is
+	*     made safe structurally — see `NcOutbox.load` / `rowExists`.
+	*  4. the ZONE ownership. Cold costs a WIDER verdict (a zone-scoped rule
+	*     evaluates camera-wide), so it precedes the gates that fail closed.
+	*  5. the DEVICE STATES. Cold costs silence — `undefined` never matches — so
+	*     it is the safest of the lot and goes after the N+1 above it.
+	*  6. the RECONCILE, which replays records persisted across the crash gap.
+	*     After the outbox on purpose: the replay is idempotent only through the
+	*     dedup horizon.
+	*  7. the retention prune. Pure hygiene, nothing reads its result.
+	*
+	* Every phase reports its own ms. The 2026-08-17 boot could not say which of
+	* these owned the 270 s because none of them said anything, and the addon's
+	* own per-step timing stopped at `buildNotificationCenter`.
+	*/
+	async runBootBackfill() {
+		const t0 = Date.now();
+		const phase = async (name, run) => {
+			if (!this.evaluationActive) return false;
+			const at = Date.now();
+			try {
+				await run();
+			} catch (err) {
+				this.logger.warn("notification back-fill phase failed", { meta: {
+					phase: name,
+					error: String(err)
+				} });
+			}
+			this.logger.info("notification back-fill phase", { meta: {
+				phase: name,
+				ms: Date.now() - at,
+				sinceStartMs: Date.now() - t0
+			} });
+			return true;
+		};
+		if (!await phase("deviceDirectory", () => this.deviceDirectory.refresh())) return;
+		if (!await phase("liveness", () => this.hydrateLiveness())) return;
+		if (!await phase("occupancy", () => this.hydrateOccupancy())) return;
+		if (!await phase("outbox", () => this.outbox.load())) return;
+		if (!await phase("cooldowns", () => this.seedCooldowns())) return;
+		if (!await phase("zoneOwners", () => this.zoneOwners.refresh())) return;
+		if (!await phase("deviceStates", () => this.deviceStates.refresh())) return;
+		if (!await phase("ruleIdentityIds", () => this.rules.migrateIdentityIds())) return;
+		if (!await phase("reconcile", () => this.reconcile())) return;
+		if (!await phase("prune", async () => {
+			await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
+		})) return;
+		this.logger.info("notification center back-fill complete", { meta: {
+			ms: Date.now() - t0,
+			pendingOutbox: this.outbox.pendingCount(),
+			dedupHorizon: this.outbox.hydrated()
 		} });
 	}
 	async stop() {
@@ -19514,6 +19762,7 @@ var NotificationCenter = class NotificationCenter {
 		this.addonUpdates.dispose();
 		this.livenessHoldoff.dispose();
 		this.evaluationActive = false;
+		this.hydration = null;
 	}
 	/**
 	* Consume ONE event. THE entry point of the notification path — every
@@ -21696,14 +21945,31 @@ var NotificationCenter = class NotificationCenter {
 			});
 		}
 	}
-	/** Boot crash-gap reconcile — see the module docstring. */
+	/**
+	* Boot crash-gap reconcile — see the module docstring.
+	*
+	* **Bounded at BOTH ends.** `since` closes the gap the previous process left;
+	* {@link intakeOpenedAt} closes the one this one would otherwise open. The
+	* reconcile used to run before the intake existed, so "a record newer than
+	* the watermark" and "a record this process has not evaluated" were the same
+	* set. They are not any more: the reconcile is a back-fill phase now, and
+	* every record persisted since `start()` opened the intake has ALREADY been
+	* evaluated in-process — the exact sentence `drainTick` uses to justify
+	* advancing the watermark to `now`.
+	*
+	* Replaying one of those is not merely redundant. The outbox dedup id makes
+	* the DELIVERY idempotent, but a rule's `onTrigger` sequence is actuated
+	* before the cooldown gate and before any dedup (see `runRuleActions`), so a
+	* replay would open the gate, arm the alarm or sound the siren a second time.
+	*/
 	async reconcile() {
 		const now = this.now();
 		const watermark = await this.outbox.getWatermark();
 		const windowStart = now - (this.deps.reconcileWindowMs ?? DEFAULT_RECONCILE_WINDOW_MS);
 		const since = Math.max(windowStart, (watermark ?? 0) - RECONCILE_OVERLAP_MS);
+		const until = this.intakeOpenedAt;
 		try {
-			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].sort((a, b) => a.timestamp - b.timestamp);
+			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].filter((e) => e.timestamp < until).sort((a, b) => a.timestamp - b.timestamp);
 			for (const event of ordered) {
 				const phase = packagePhaseOf(event);
 				this.consumeEvent(asReconcile(phase !== null ? incomingFromPackageEvent(event, phase) : incomingFromObjectEvent(event)));
@@ -51880,7 +52146,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			return out;
 		};
 		await step("declareCollections", () => this.declareCollections(api));
-		await step("declareAlarmPanel", () => this.declareAlarmPanel(api));
+		this.armAlarmPanelDeclaration(api);
 		const logger = this.ctx.logger;
 		const storage = await step("resolveMediaStorage", () => this.resolveMediaStorage(logger));
 		const stores = await step("buildStores", () => this.buildStores(api, logger, storage));
@@ -52023,8 +52289,33 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	* name over the operator's rename. What is left is the declaration and the
 	* ports.
 	*/
+	/**
+	* Arm the declaration as BACKGROUND work and return immediately.
+	*
+	* `initialize()` is on the critical path of the whole capability graph — the
+	* runner publishes an addon's manifest only after it returns — so an await
+	* that can outlive a boot is an outage with a fixed blast radius
+	* (docs/architecture/addon-lifecycle.md). This one could not merely outlive a
+	* boot, it could not possibly succeed during one: the first port call is
+	* `integrations.getByAddonId`, a hub-CORE namespace served by `$core-caps`,
+	* which `main.ts` registers only AFTER `app.init()` returns, i.e. after the
+	* whole addon boot. Core caps are excluded from the boot-window retry, so the
+	* call sat in the 60 s UDS timeout — measured at 61 s of DETERMINISTIC delay
+	* on every boot of this addon (D167).
+	*
+	* And the wait bought nothing. The retry ladder is the real path: on the live
+	* boot of 2026-08-19 the panel was declared at t0+204 s with `attempts=1`,
+	* i.e. on the ladder's FIRST tick, after the doomed boot attempt had already
+	* been paid for.
+	*/
+	armAlarmPanelDeclaration(api) {
+		this.declareAlarmPanel(api).catch((err) => {
+			this.ctx.logger.warn("alarm panel declaration could not be armed — the Alarm tab stays empty until this addon restarts", { meta: { error: require_dist.errMsg(err) } });
+		});
+	}
 	async declareAlarmPanel(api) {
 		if (await this.attemptAlarmPanelDeclaration(api)) return;
+		if (this.shuttingDown) return;
 		this.alarmPanelConvergence = startAlarmPanelConvergence({
 			attempt: () => this.attemptAlarmPanelDeclaration(api),
 			logger: this.ctx.logger.child("alarm")

package/dist/pipeline-analytics/index.mjs

@@ -12091,6 +12091,18 @@ var NcOutbox = class {
 	maxAttempts;
 	drainBatchSize;
 	drainInFlight = false;
+	/**
+	* Has {@link load} landed?
+	*
+	* The load moved OFF the boot critical path (see
+	* `NotificationCenter.runBootBackfill`), so for the first seconds of a boot
+	* the centre evaluates and enqueues with an EMPTY `knownIds` — and
+	* `knownIds` is the dedup ledger. Until this flips, {@link enqueue} asks the
+	* store itself instead. False is therefore not "the load failed", it is
+	* "the horizon is not authoritative yet"; a load that FAILED leaves it false
+	* forever, which keeps the per-enqueue guard on, which is exactly right.
+	*/
+	horizonLoaded = false;
 	constructor(deps) {
 		this.store = deps.store;
 		this.logger = deps.logger;
@@ -12112,7 +12124,26 @@ var NcOutbox = class {
 			columns: [...NC_META_COLUMNS]
 		});
 	}
-	/** Hydrate pending rows + the dedup id horizon. Best-effort. */
+	/**
+	* Hydrate pending rows + the dedup id horizon. Best-effort.
+	*
+	* **Runs OFF the boot critical path** (2026-08-17: 743 rows over the UDS
+	* store client, ~50 s, inside the `initialize()` that publishes the runner's
+	* capability manifest). So it lands against a centre that has already been
+	* evaluating, enqueueing and DELIVERING for as long as the query took — and
+	* the rows it is holding are a snapshot taken before all of that.
+	*
+	* That is why an id this process already knows is SKIPPED rather than
+	* applied. `knownIds` is only ever written by an in-process {@link enqueue}
+	* or by this method, so an id already in it at apply time is one whose live
+	* state (pending, or absent because it went terminal) is strictly newer than
+	* the snapshot. Applying the snapshot over it would put a row that has
+	* already been DELIVERED back into `pending`, and the operator would receive
+	* the same notification twice.
+	*
+	* Nothing is lost by the same token: this method only ADDS to `pending`, so
+	* a row enqueued while the query was in flight is untouched.
+	*/
 	async load() {
 		try {
 			const rows = await this.store.query.query({
@@ -12122,19 +12153,30 @@ var NcOutbox = class {
 					limit: 1e5
 				}
 			});
+			let superseded = 0;
 			for (const row of rows) {
+				if (this.knownIds.has(row.id)) {
+					superseded += 1;
+					continue;
+				}
 				this.knownIds.add(row.id);
 				const entry = rowToEntry$1(row.id, row.data);
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
+			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
-				known: this.knownIds.size
+				known: this.knownIds.size,
+				superseded
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
 		}
 	}
+	/** Is the dedup horizon authoritative? See {@link horizonLoaded}. */
+	hydrated() {
+		return this.horizonLoaded;
+	}
 	pendingCount() {
 		return this.pending.size;
 	}
@@ -12149,6 +12191,18 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
+			if (!this.horizonLoaded && await this.rowExists(id)) {
+				this.knownIds.add(id);
+				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
+					tags: { deviceId: input.deviceId },
+					meta: {
+						id,
+						ruleId: input.ruleId,
+						targetId: input.targetId
+					}
+				});
+				continue;
+			}
 			const entry = {
 				id,
 				ruleId: input.ruleId,
@@ -12421,6 +12475,35 @@ var NcOutbox = class {
 		this.pending.set(entry.id, retry);
 		await this.mutate(retry);
 	}
+	/**
+	* Does a row already exist under this dedup id?
+	*
+	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
+	* with `set` — an UPSERT keyed by the dedup id — so an enqueue that ran
+	* before the horizon landed would rewrite a row that had already been
+	* DELIVERED back to `pending`, and the drain would send it again. That is
+	* the D-3 `maxPerTrack: 1` guarantee, and it cannot be allowed to depend on
+	* whether a 743-row query had finished.
+	*
+	* A read that FAILS answers `false`, i.e. the intent is enqueued. Duplicate
+	* over lost: a duplicate notification is an annoyance the operator can see,
+	* and a dropped one is a notification nobody ever knows was owed.
+	*/
+	async rowExists(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return row !== null && row !== void 0;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return false;
+		}
+	}
 	async persist(entry) {
 		await this.store.set.mutate({
 			collection: NC_OUTBOX_COLLECTION,
@@ -12948,7 +13031,20 @@ var NcRuleStore = class {
 	* The operator's words stay on disk forever.
 	*/
 	async load() {
-		const rules = await this.ledger.load();
+		await this.ledger.load();
+		this.logger.debug("notification rules loaded", { meta: { rules: this.ledger.size } });
+	}
+	/**
+	* The identity NAME→ID migration, split out of {@link load} on 2026-08-19:
+	* `readIdentityIds` reaches the identity gallery, and at boot that single
+	* read cost 119 s — 74 s more than every other start() read combined —
+	* while buying only an ENRICHMENT: the engine still matches by name (it
+	* keeps that leg precisely for the gallery-cannot-answer case below). It
+	* now runs as a back-fill phase; the rename-immunity ids arrive seconds
+	* later instead of gating the intake.
+	*/
+	async migrateIdentityIds() {
+		const rules = this.ledger.snapshot();
 		const idsByName = await this.readIdentityIds();
 		let migrated = 0;
 		const unresolved = /* @__PURE__ */ new Set();
@@ -12959,10 +13055,7 @@ var NcRuleStore = class {
 			migrated += 1;
 			this.ledger.stage(result.rule);
 		}
-		this.logger.debug("notification rules loaded", { meta: {
-			rules: this.ledger.size,
-			...migrated > 0 ? { identitiesResolvedToIds: migrated } : {}
-		} });
+		if (migrated > 0) this.logger.info("notification rules migrated identity names to ids", { meta: { identitiesResolvedToIds: migrated } });
 		if (unresolved.size > 0) this.logger.info("notification rules name identities the gallery does not know", { meta: { names: [...unresolved].join(", ") } });
 	}
 	/**
@@ -18931,6 +19024,18 @@ var NotificationCenter = class NotificationCenter {
 	drainTicks = 0;
 	evaluationActive = false;
 	/**
+	* The armed boot back-fill — see {@link runBootBackfill}. Held so
+	* {@link whenHydrated} can be awaited by an operator surface or a test that
+	* needs the durable state, and so nothing re-arms it.
+	*/
+	hydration = null;
+	/**
+	* The instant `start()` opened the intake. Everything persisted from here on
+	* is evaluated live by THIS process, which is what bounds the boot reconcile
+	* at its late end — see {@link reconcile}.
+	*/
+	intakeOpenedAt = 0;
+	/**
 	* The tap-through buttons for ONE delivery, each with its own single-use
 	* token.
 	*
@@ -19432,49 +19537,192 @@ var NotificationCenter = class NotificationCenter {
 	/**
 	* Load rules (every node — the cap provider serves CRUD from any node).
 	* When `evaluation` is true (the designated post-processing node ONLY),
-	* also hydrate the outbox, seed cooldowns, run the crash-gap reconcile
-	* and start the drain + rule-reload timers.
+	* open the intake and arm the drain + rule-reload timers.
+	*
+	* ## `start()` resolving means "the centre is EVALUATING"
+	*
+	* It does NOT mean the durable back-fill has finished. That contract was
+	* written on 2026-08-14 for the two producers (a timelapse render inside
+	* `initialize()` took eight capabilities off the cluster for two render
+	* timeouts) and it applies to the centre itself for the same reason: this
+	* method is awaited by `buildNotificationCenter`, which is awaited by
+	* `pipeline-analytics.onInitialize()`, and `addon-runner` publishes a
+	* child's capability manifest only AFTER `initialize()` returns.
+	*
+	* Measured on the live hub 2026-08-17 at ZERO transport contention, the
+	* `buildNotificationCenter` boot step took **270 s** — all of it durable
+	* back-fill: `hydrateLiveness` (775 subjects), `outbox.load` (743 rows),
+	* and two N+1 per-device refresh loops (`readDeviceStates` and
+	* `readDeviceZoneIds` issue ONE RPC per watched device, serially). For
+	* those 270 s the cluster had no provider for any capability this addon
+	* declares, and the intake below had not been opened either — so nothing
+	* arriving in that window was late, it was never evaluated at all.
+	*
+	* ## What stays here, and why
+	*
+	* Only reads a notification cannot be CORRECT without, and each is one
+	* store query:
+	*
+	*  - the TEXT catalog — a notification built before it goes out in the
+	*    wrong language;
+	*  - the RULES — without them there is nothing to evaluate;
+	*  - the SNOOZE windows and the per-camera MUTES — both SUPPRESS, so a cold
+	*    one fails OPEN: the operator gets pushes they explicitly silenced;
+	*  - the timelapse + summary rule sets, which the producers armed below read.
+	*
+	* Everything else is a mirror the 30 s reload tick re-reads anyway, or a
+	* boot-once hydration whose cold behaviour is already defined and safe —
+	* see {@link runBootBackfill}, which names the direction for each one.
 	*/
 	async start(opts) {
-		await this.reloadTexts();
-		await this.rules.load();
-		await this.snoozes.load();
-		await this.deviceMutes.load();
-		await this.timelapseRules.load();
-		await this.summaryRules.load();
+		const t0 = Date.now();
+		const timed = async (phase, run) => {
+			const started = Date.now();
+			await run();
+			const now = Date.now();
+			this.logger.info("notification start phase", { meta: {
+				phase,
+				ms: now - started,
+				sinceStartMs: now - t0
+			} });
+		};
+		await Promise.all([
+			timed("texts", () => this.reloadTexts()),
+			timed("rules", () => this.rules.load()),
+			timed("snoozes", () => this.snoozes.load()),
+			timed("deviceMutes", () => this.deviceMutes.load()),
+			timed("timelapseRules", () => this.timelapseRules.load()),
+			timed("summaryRules", () => this.summaryRules.load())
+		]);
 		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
-		await this.deviceStates.refresh();
-		await this.deviceDirectory.refresh();
-		await this.hydrateLiveness();
-		await this.zoneOwners.refresh();
 		this.sceneStates.refresh();
+		this.intakeOpenedAt = this.now();
 		this.evaluationActive = true;
-		await this.outbox.load();
-		await this.seedCooldowns();
-		await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
-		await this.hydrateOccupancy();
-		await this.reconcile();
 		this.drainTimer = setInterval(() => {
 			this.drainTick();
 		}, this.deps.drainIntervalMs ?? DEFAULT_DRAIN_INTERVAL_MS);
 		this.reloadTimer = setInterval(() => {
 			this.reloadRules();
 		}, this.deps.ruleReloadIntervalMs ?? DEFAULT_RULE_RELOAD_INTERVAL_MS);
-		if (this.timelapseScheduler !== null) await this.timelapseScheduler.start().catch((err) => {
+		const timelapseScheduler = this.timelapseScheduler;
+		if (timelapseScheduler !== null) await timed("timelapseProducer", () => timelapseScheduler.start()).catch((err) => {
 			this.logger.warn("timelapse producer did not start", { meta: { error: String(err) } });
 		});
-		if (this.summaryProducer !== null) await this.summaryProducer.start().catch((err) => {
+		const summaryProducer = this.summaryProducer;
+		if (summaryProducer !== null) await timed("summaryProducer", () => summaryProducer.start()).catch((err) => {
 			this.logger.warn("summary producer did not start", { meta: { error: String(err) } });
 		});
+		this.armBootBackfill();
 		this.logger.info("notification center started", { meta: {
+			ms: Date.now() - t0,
 			rules: this.rules.list().length,
-			pendingOutbox: this.outbox.pendingCount(),
 			timelapseRules: this.timelapseRules.list().length,
 			timelapseProducer: this.timelapseScheduler !== null,
 			summaryRules: this.summaryRules.list().length,
 			summaryProducer: this.summaryProducer !== null,
-			summaryAi: this.summaryAi !== null
+			summaryAi: this.summaryAi !== null,
+			backfill: "armed"
+		} });
+	}
+	/**
+	* The durable back-fill, finished.
+	*
+	* Resolves immediately when nothing was armed (a non-evaluation node, or a
+	* centre that was never started). Never rejects — every phase owns its own
+	* failure. Exists so a caller that genuinely needs the hydrated state — a
+	* test asserting the reseed, an operator surface reporting readiness — can
+	* ask for it instead of sleeping.
+	*/
+	whenHydrated() {
+		return this.hydration ?? Promise.resolve();
+	}
+	/**
+	* ONE drain pass, awaited — the interval's own tick, called directly.
+	*
+	* The same code path the timer drives, deliberately: a caller that flushes
+	* the queue through a parallel implementation is testing the parallel
+	* implementation.
+	*/
+	async drainNow() {
+		await this.drainTick();
+	}
+	armBootBackfill() {
+		if (this.hydration !== null) return;
+		this.hydration = this.runBootBackfill().catch((err) => {
+			this.logger.warn("notification back-fill could not be armed", { meta: { error: String(err) } });
+		});
+	}
+	/**
+	* The boot back-fill: everything `start()` used to await.
+	*
+	* Ordered by what a cold mirror COSTS, most expensive first — this is a
+	* sequence, not a `Promise.all`, because these reads share one UDS store
+	* client and racing them is how a boot becomes a queue again.
+	*
+	*  1. the device directory + the LIVENESS ledger. Cold costs a FLOOD (D130:
+	*     one "camera online" per camera on the installation, 2026-08-13), so it
+	*     goes first. The ledger's own contract holds in the window: an empty
+	*     mirror SEEDS silently rather than notifying (D49, fail toward
+	*     discard), and device liveness is additionally held for 5 minutes by
+	*     `DeviceLivenessHoldoff` before it can notify at all — which is far
+	*     longer than this phase.
+	*  2. the OCCUPANCY state. Cold costs a re-announced edge (the cold-baseline
+	*     bug, `occupancy-cold-seed.spec.ts`).
+	*  3. the OUTBOX horizon, then the COOLDOWN seed. Both cost a REPEAT while
+	*     cold — a dedup id nobody remembers, a cooldown nobody recovered — and
+	*     the horizon goes first because it is what makes every phase after it
+	*     (the reconcile above all) idempotent. The outbox's own cold window is
+	*     made safe structurally — see `NcOutbox.load` / `rowExists`.
+	*  4. the ZONE ownership. Cold costs a WIDER verdict (a zone-scoped rule
+	*     evaluates camera-wide), so it precedes the gates that fail closed.
+	*  5. the DEVICE STATES. Cold costs silence — `undefined` never matches — so
+	*     it is the safest of the lot and goes after the N+1 above it.
+	*  6. the RECONCILE, which replays records persisted across the crash gap.
+	*     After the outbox on purpose: the replay is idempotent only through the
+	*     dedup horizon.
+	*  7. the retention prune. Pure hygiene, nothing reads its result.
+	*
+	* Every phase reports its own ms. The 2026-08-17 boot could not say which of
+	* these owned the 270 s because none of them said anything, and the addon's
+	* own per-step timing stopped at `buildNotificationCenter`.
+	*/
+	async runBootBackfill() {
+		const t0 = Date.now();
+		const phase = async (name, run) => {
+			if (!this.evaluationActive) return false;
+			const at = Date.now();
+			try {
+				await run();
+			} catch (err) {
+				this.logger.warn("notification back-fill phase failed", { meta: {
+					phase: name,
+					error: String(err)
+				} });
+			}
+			this.logger.info("notification back-fill phase", { meta: {
+				phase: name,
+				ms: Date.now() - at,
+				sinceStartMs: Date.now() - t0
+			} });
+			return true;
+		};
+		if (!await phase("deviceDirectory", () => this.deviceDirectory.refresh())) return;
+		if (!await phase("liveness", () => this.hydrateLiveness())) return;
+		if (!await phase("occupancy", () => this.hydrateOccupancy())) return;
+		if (!await phase("outbox", () => this.outbox.load())) return;
+		if (!await phase("cooldowns", () => this.seedCooldowns())) return;
+		if (!await phase("zoneOwners", () => this.zoneOwners.refresh())) return;
+		if (!await phase("deviceStates", () => this.deviceStates.refresh())) return;
+		if (!await phase("ruleIdentityIds", () => this.rules.migrateIdentityIds())) return;
+		if (!await phase("reconcile", () => this.reconcile())) return;
+		if (!await phase("prune", async () => {
+			await this.outbox.pruneBefore(this.now() - OUTBOX_RETENTION_MS);
+		})) return;
+		this.logger.info("notification center back-fill complete", { meta: {
+			ms: Date.now() - t0,
+			pendingOutbox: this.outbox.pendingCount(),
+			dedupHorizon: this.outbox.hydrated()
 		} });
 	}
 	async stop() {
@@ -19492,6 +19740,7 @@ var NotificationCenter = class NotificationCenter {
 		this.addonUpdates.dispose();
 		this.livenessHoldoff.dispose();
 		this.evaluationActive = false;
+		this.hydration = null;
 	}
 	/**
 	* Consume ONE event. THE entry point of the notification path — every
@@ -21674,14 +21923,31 @@ var NotificationCenter = class NotificationCenter {
 			});
 		}
 	}
-	/** Boot crash-gap reconcile — see the module docstring. */
+	/**
+	* Boot crash-gap reconcile — see the module docstring.
+	*
+	* **Bounded at BOTH ends.** `since` closes the gap the previous process left;
+	* {@link intakeOpenedAt} closes the one this one would otherwise open. The
+	* reconcile used to run before the intake existed, so "a record newer than
+	* the watermark" and "a record this process has not evaluated" were the same
+	* set. They are not any more: the reconcile is a back-fill phase now, and
+	* every record persisted since `start()` opened the intake has ALREADY been
+	* evaluated in-process — the exact sentence `drainTick` uses to justify
+	* advancing the watermark to `now`.
+	*
+	* Replaying one of those is not merely redundant. The outbox dedup id makes
+	* the DELIVERY idempotent, but a rule's `onTrigger` sequence is actuated
+	* before the cooldown gate and before any dedup (see `runRuleActions`), so a
+	* replay would open the gate, arm the alarm or sound the siren a second time.
+	*/
 	async reconcile() {
 		const now = this.now();
 		const watermark = await this.outbox.getWatermark();
 		const windowStart = now - (this.deps.reconcileWindowMs ?? DEFAULT_RECONCILE_WINDOW_MS);
 		const since = Math.max(windowStart, (watermark ?? 0) - RECONCILE_OVERLAP_MS);
+		const until = this.intakeOpenedAt;
 		try {
-			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].sort((a, b) => a.timestamp - b.timestamp);
+			const ordered = [...await this.deps.listObjectEventsSince(since, RECONCILE_SCAN_LIMIT)].filter((e) => e.timestamp < until).sort((a, b) => a.timestamp - b.timestamp);
 			for (const event of ordered) {
 				const phase = packagePhaseOf(event);
 				this.consumeEvent(asReconcile(phase !== null ? incomingFromPackageEvent(event, phase) : incomingFromObjectEvent(event)));
@@ -51820,7 +52086,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			return out;
 		};
 		await step("declareCollections", () => this.declareCollections(api));
-		await step("declareAlarmPanel", () => this.declareAlarmPanel(api));
+		this.armAlarmPanelDeclaration(api);
 		const logger = this.ctx.logger;
 		const storage = await step("resolveMediaStorage", () => this.resolveMediaStorage(logger));
 		const stores = await step("buildStores", () => this.buildStores(api, logger, storage));
@@ -51963,8 +52229,33 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* name over the operator's rename. What is left is the declaration and the
 	* ports.
 	*/
+	/**
+	* Arm the declaration as BACKGROUND work and return immediately.
+	*
+	* `initialize()` is on the critical path of the whole capability graph — the
+	* runner publishes an addon's manifest only after it returns — so an await
+	* that can outlive a boot is an outage with a fixed blast radius
+	* (docs/architecture/addon-lifecycle.md). This one could not merely outlive a
+	* boot, it could not possibly succeed during one: the first port call is
+	* `integrations.getByAddonId`, a hub-CORE namespace served by `$core-caps`,
+	* which `main.ts` registers only AFTER `app.init()` returns, i.e. after the
+	* whole addon boot. Core caps are excluded from the boot-window retry, so the
+	* call sat in the 60 s UDS timeout — measured at 61 s of DETERMINISTIC delay
+	* on every boot of this addon (D167).
+	*
+	* And the wait bought nothing. The retry ladder is the real path: on the live
+	* boot of 2026-08-19 the panel was declared at t0+204 s with `attempts=1`,
+	* i.e. on the ladder's FIRST tick, after the doomed boot attempt had already
+	* been paid for.
+	*/
+	armAlarmPanelDeclaration(api) {
+		this.declareAlarmPanel(api).catch((err) => {
+			this.ctx.logger.warn("alarm panel declaration could not be armed — the Alarm tab stays empty until this addon restarts", { meta: { error: errMsg(err) } });
+		});
+	}
 	async declareAlarmPanel(api) {
 		if (await this.attemptAlarmPanelDeclaration(api)) return;
+		if (this.shuttingDown) return;
 		this.alarmPanelConvergence = startAlarmPanelConvergence({
 			attempt: () => this.attemptAlarmPanelDeclaration(api),
 			logger: this.ctx.logger.child("alarm")

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DyXoKV7Z.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-Caz0R4UZ.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.97",
+  "version": "1.2.99",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",