@camstack/system 1.2.310 → 1.2.312

package/dist/{child-cap-dispatch-Be8e2cBP.js → child-cap-dispatch-Dyn_7ezH.js}

@@ -1,4 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
+const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-DmHNjbB0.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -3210,7 +3211,7 @@ function createAddonPeerBytesFacility(args) {
 * Failures THROW with an actionable message — a caller must never proceed as
 * if dependencies were installed when they were not.
 */
-var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 /** Where the bootstrap lands inside `cacheDir` (npm tgz carries a `package/` prefix). */
 function bootstrappedCliPath(cacheDir) {
@@ -3218,7 +3219,7 @@ function bootstrappedCliPath(cacheDir) {
 }
 async function defaultProbeSystemNpm() {
 	try {
-		await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
+		await execFileAsync$3("npm", ["--version"], { timeout: 15e3 });
 		return true;
 	} catch {
 		return false;
@@ -3236,7 +3237,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	await node_fs.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
-	await execFileAsync$2("tar", [
+	await execFileAsync$3("tar", [
 		"-xzf",
 		tgzPath,
 		"-C",
@@ -3307,7 +3308,7 @@ async function runNpm(args, options) {
 		registry: options.registry,
 		logger: options.logger
 	});
-	return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
+	return execFileAsync$3(invocation.command, [...invocation.argsPrefix, ...args], {
 		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
 		timeout: options.timeout ?? 3e5,
 		env: buildNpmChildEnv(options.env ?? process.env, process.execPath)
@@ -3388,7 +3389,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/deps/manifest-native-deps.ts
-var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Fallback bootstrap-cache location when the caller doesn't thread one
 * through (the forked addon-runner's spawn-time install). tmpdir survives the
@@ -3697,7 +3698,7 @@ async function rebuildNativeDeps(addonDir, packageNames, logger, npmCacheDir, re
 				return;
 			}
 			logger.warn("@electron/rebuild not available — falling back to npx", { meta: { addonDir } });
-			await execFileAsync$1("npx", [
+			await execFileAsync$2("npx", [
 				"--yes",
 				"electron-rebuild",
 				"-m",
@@ -12119,7 +12120,7 @@ function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs
 * the failure it precedes ("smbclient: ENOENT") arrives minutes later in a
 * different addon's logs.
 */
-var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /** How long a single package-manager invocation may take. */
 var INSTALL_TIMEOUT_MS = 300 * 1e3;
 /** How long the `command -v <binary>` presence probe may take. */
@@ -12281,7 +12282,7 @@ function planFor(manager, packageName) {
 }
 async function defaultHasBinary(binary) {
 	try {
-		await execFileAsync("command", ["-v", binary], {
+		await execFileAsync$1("command", ["-v", binary], {
 			timeout: PROBE_TIMEOUT_MS,
 			shell: process.platform === "win32" ? false : "/bin/sh"
 		});
@@ -12301,7 +12302,290 @@ async function defaultDetectManager() {
 	return null;
 }
 async function defaultRun(command, args) {
-	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+	await execFileAsync$1(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+}
+//#endregion
+//#region src/kernel/moleculer/runner-process-group.ts
+/**
+* A runner OWNS a process group, and the kernel reaps it on every runner exit (D668).
+*
+* ## Why
+*
+* An addon-runner spawns long-lived children: recorder ffmpeg writers, stream-broker
+* ffmpeg, llama-server, tailscaled, cloudflared, HAP ffmpeg. Their only kill was the
+* addon's own graceful `stop()`, which a runner that dies of SIGABRT (V8 OOM), SIGKILL
+* or a native crash never runs. ffmpeg ignores SIGPIPE and does not quit on stdin EOF,
+* so a dead reader does not stop it either. On 2026-09-28 at 10:21 CEST the hub's
+* recorder runner aborted; 28 ffmpeg writers survived as orphans and kept writing into
+* the SAME staging directories the respawned runner's 28 new writers used — 13 minutes
+* of dual writers on every camera, until they were killed by hand.
+*
+* Runners were spawned `detached: false`, i.e. inside hub-main's own group, so there
+* was no handle meaning "this runner and everything under it". Now every runner is
+* spawned `detached: true` on POSIX, which makes it a SESSION and group leader
+* (`setsid`): pgid === runner pid, and every descendant that does not itself call
+* `setsid`/`setpgid` inherits that group. A process group outlives its leader, so
+* `kill(-pgid)` still reaches the orphans after the runner is gone — which is exactly
+* the moment it matters.
+*
+* ## What `detached` does NOT change
+*
+* - The child stays REF'd: nothing calls `unref()`, so the parent still waits on it,
+*   still gets its `exit`, still reads its stdout/stderr pipes.
+* - `process.ppid` is unchanged, so the runner can detect a lost parent before or
+*   after READY and hard-stop its own group.
+* - UDS/stdio wiring is fd-based and independent of the session.
+*
+* What it DOES change: the runner is no longer in hub-main's group, so a signal sent to
+* hub-main's group (`kill -- -<pid>` in `server/backend/src/main.ts`, a terminal Ctrl+C)
+* no longer reaches runners by itself. `signalAllRunnerGroups` is the replacement, and
+* the process `exit` backstop below hard-stops any groups a hub/agent still owns.
+*
+* ## Out of scope, deliberately
+*
+* - Windows has no process groups in this sense; nothing here runs on `win32` and the
+*   runner is spawned exactly as before.
+* - A descendant that calls `setsid`/`setpgid` itself (or is spawned `detached: true`
+*   by an addon) leaves the group and is NOT reaped. No shipped addon does; one that
+*   needs to must own its child's lifetime some other way.
+* - The kernel knows the runner id, not which device a child served. Per-device
+*   attribution is the addon's (the recorder's own foreign-writer reap, D667).
+*/
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/** SIGTERM → SIGKILL grace for a runner's group, in ms. ffmpeg finalises a segment well inside it. */
+var RUNNER_GROUP_REAP_GRACE_MS = 2e3;
+/** How often the group is probed for emptiness during the grace. */
+var GROUP_PROBE_INTERVAL_MS = 100;
+/** Whether a runner is spawned as a process-group leader on this platform. */
+function runnerOwnsProcessGroup(platform = process.platform) {
+	return platform !== "win32";
+}
+function errnoOf(err) {
+	if (typeof err !== "object" || err === null) return void 0;
+	const code = Reflect.get(err, "code");
+	return typeof code === "string" ? code : void 0;
+}
+function signalGroup(ops, pgid, signal) {
+	try {
+		ops.kill(-pgid, signal);
+		return "delivered";
+	} catch (err) {
+		if (errnoOf(err) === "ESRCH") return "empty";
+		return { error: `${errnoOf(err) ?? "unknown"}: ${err instanceof Error ? err.message : String(err)}` };
+	}
+}
+function signalPid(ops, pid) {
+	try {
+		ops.kill(pid, 0);
+		return "delivered";
+	} catch (err) {
+		return errnoOf(err) === "ESRCH" ? "empty" : { error: errnoOf(err) ?? "unknown" };
+	}
+}
+/**
+* A pgid this module may address. `kill(-1)` signals every process the caller may
+* signal and `kill(-0)` is the caller's OWN group — both are catastrophes, not reaps.
+*/
+function isAddressableGroup(pgid) {
+	return Number.isInteger(pgid) && pgid > 1 && pgid !== process.pid;
+}
+/**
+* SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
+*
+* pid reuse: POSIX never hands out a pid while a process group with that id exists, so
+* the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
+* still populated at the end of the grace, which is the same group; the residual window
+* (group empties, the pid wraps around AND is reused as a new group leader, all inside
+* the grace) is not reachable in practice.
+*/
+async function reapProcessGroup(pgid, ops) {
+	if (!isAddressableGroup(pgid)) return {
+		pgid,
+		membersAtExit: null,
+		killed: null,
+		alreadyEmpty: true,
+		error: `refused pgid ${pgid}`
+	};
+	const membersAtExit = await ops.listMembers(pgid);
+	const term = signalGroup(ops, pgid, "SIGTERM");
+	if (term === "empty") return {
+		pgid,
+		membersAtExit,
+		killed: [],
+		alreadyEmpty: true,
+		error: null
+	};
+	if (typeof term === "object") return {
+		pgid,
+		membersAtExit,
+		killed: null,
+		alreadyEmpty: false,
+		error: term.error
+	};
+	for (let waited = 0; waited < ops.graceMs; waited += GROUP_PROBE_INTERVAL_MS) {
+		await ops.sleep(Math.min(GROUP_PROBE_INTERVAL_MS, ops.graceMs - waited));
+		if (signalGroup(ops, pgid, 0) === "empty") return {
+			pgid,
+			membersAtExit,
+			killed: [],
+			alreadyEmpty: false,
+			error: null
+		};
+	}
+	const survivors = membersAtExit === null ? null : membersAtExit.filter((m) => signalPid(ops, m.pid) === "delivered");
+	const kill = signalGroup(ops, pgid, "SIGKILL");
+	return {
+		pgid,
+		membersAtExit,
+		killed: kill === "empty" ? [] : survivors,
+		alreadyEmpty: false,
+		error: typeof kill === "object" ? kill.error : null
+	};
+}
+/** `ffmpeg×28 llama-server×1` — what a reap line says it removed. */
+function summarizeMembers(members) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const m of members) counts.set(m.command, (counts.get(m.command) ?? 0) + 1);
+	return [...counts.entries()].map(([command, n]) => `${command}×${n}`).join(" ");
+}
+async function listMembersFromProc(pgid, reader) {
+	const pids = await reader.listPids();
+	return (await Promise.all(pids.map(async (pid) => {
+		try {
+			return require_proc_stat.parseProcStat(await reader.readStat(pid));
+		} catch {
+			return null;
+		}
+	}))).flatMap((row) => row !== null && row.pgid === pgid && row.state !== "Z" ? [{
+		pid: row.pid,
+		command: row.comm
+	}] : []);
+}
+var PS_GROUP_ROW_RE = /^(\d+)\s+(\d+)\s+(\S+)\s+(.+)$/;
+/** Parse `ps -A -o pid=,pgid=,stat=,comm=` for one group, zombies excluded. */
+function parsePsGroupMembers(stdout, pgid) {
+	const members = [];
+	for (const line of stdout.split("\n")) {
+		const match = line.trim().match(PS_GROUP_ROW_RE);
+		if (!match) continue;
+		const [, pidS, pgidS, stat = "", comm = ""] = match;
+		if (Number(pgidS) !== pgid || stat.startsWith("Z")) continue;
+		const command = comm.trim();
+		members.push({
+			pid: Number(pidS),
+			command: command.slice(command.lastIndexOf("/") + 1)
+		});
+	}
+	return members;
+}
+async function listMembersFromPs(pgid) {
+	const { stdout } = await execFileAsync("ps", [
+		"-A",
+		"-o",
+		"pid=,pgid=,stat=,comm="
+	], {
+		timeout: 3e3,
+		maxBuffer: 8 * 1024 * 1024
+	});
+	return parsePsGroupMembers(stdout, pgid);
+}
+/** Live members of `pgid`: `/proc` on Linux, `ps` elsewhere; `null` when neither answers. */
+async function listProcessGroupMembers(pgid, platform = process.platform) {
+	try {
+		return platform === "linux" ? await listMembersFromProc(pgid, require_proc_stat.nodeProcReader) : await listMembersFromPs(pgid);
+	} catch {
+		return null;
+	}
+}
+var defaultProcessGroupOps = {
+	kill: (pid, signal) => {
+		process.kill(pid, signal);
+	},
+	listMembers: (pgid) => listProcessGroupMembers(pgid),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	graceMs: RUNNER_GROUP_REAP_GRACE_MS
+};
+/**
+* Every runner group this process leads and has not finished reaping. Process-wide on
+* purpose: `process.on('exit')` and hub-main's signal handler must reach the groups of
+* every `$process` service in the process, and neither holds a service reference.
+*/
+var ownedGroups = /* @__PURE__ */ new Map();
+var exitBackstopInstalled = false;
+function installExitBackstop() {
+	if (exitBackstopInstalled) return;
+	exitBackstopInstalled = true;
+	process.on("exit", () => {
+		for (const [pgid, group] of ownedGroups) try {
+			group.kill(-pgid, "SIGKILL");
+		} catch {}
+	});
+}
+function registerRunnerGroup(pgid, group) {
+	if (!isAddressableGroup(pgid)) return;
+	ownedGroups.set(pgid, group);
+	installExitBackstop();
+}
+function releaseRunnerGroup(pgid) {
+	ownedGroups.delete(pgid);
+}
+/**
+* Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
+* handler calls it: before D668 the runners were in hub-main's own group and its
+* `kill -- -<pid>` reached them and their children; now each is its own group.
+* Returns how many groups were signalled.
+*/
+function signalAllRunnerGroups(signal) {
+	let signalled = 0;
+	for (const [pgid, group] of ownedGroups) try {
+		group.kill(-pgid, signal);
+		signalled += 1;
+	} catch {}
+	return signalled;
+}
+/**
+* Arm the runner's parent-death watchdog before addon code starts loading.
+*
+* A parent can die while an addon module or `initialize()` is still pending, so
+* installing this only after READY leaves exactly the boot window where a detached
+* runner can become an orphan. Any PPID change means the direct parent died and the
+* kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
+*/
+function startRunnerParentDeathWatchdog(onParentDeath, options = {}) {
+	const initialPpid = options.initialPpid ?? process.ppid;
+	if (!Number.isInteger(initialPpid) || initialPpid <= 1) return null;
+	const readPpid = options.readPpid ?? (() => process.ppid);
+	const intervalMs = options.intervalMs ?? 5e3;
+	let fired = false;
+	const timer = setInterval(() => {
+		if (fired || readPpid() === initialPpid) return;
+		fired = true;
+		clearInterval(timer);
+		onParentDeath();
+	}, intervalMs);
+	return timer;
+}
+/**
+* Last resort for a detached runner whose direct parent disappeared without an
+* `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
+* one SIGKILL removes the runner and every descendant in that group atomically.
+*
+* Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
+* returns ESRCH: while this pid exists, no unrelated process group can have the
+* same id. That makes the failed call a safe compatibility fallback for an older
+* parent that did not spawn the runner detached.
+*/
+function killOwnRunnerGroupAfterParentLoss(platform = process.platform, kill = (target, signal) => {
+	process.kill(target, signal);
+}) {
+	const pid = process.pid;
+	if (!runnerOwnsProcessGroup(platform) || !Number.isInteger(pid) || pid <= 1) return false;
+	try {
+		kill(-pid, "SIGKILL");
+		return true;
+	} catch {
+		return false;
+	}
 }
 //#endregion
 //#region src/kernel/moleculer/child-cap-dispatch.ts
@@ -12942,6 +13226,12 @@ Object.defineProperty(exports, "createV8Reclaimer", {
 		return createV8Reclaimer;
 	}
 });
+Object.defineProperty(exports, "defaultProcessGroupOps", {
+	enumerable: true,
+	get: function() {
+		return defaultProcessGroupOps;
+	}
+});
 Object.defineProperty(exports, "describeRss", {
 	enumerable: true,
 	get: function() {
@@ -13122,6 +13412,12 @@ Object.defineProperty(exports, "isArrayBufferCensusReport", {
 		return isArrayBufferCensusReport;
 	}
 });
+Object.defineProperty(exports, "killOwnRunnerGroupAfterParentLoss", {
+	enumerable: true,
+	get: function() {
+		return killOwnRunnerGroupAfterParentLoss;
+	}
+});
 Object.defineProperty(exports, "localEndpointPath", {
 	enumerable: true,
 	get: function() {
@@ -13176,6 +13472,12 @@ Object.defineProperty(exports, "readSocketQueues", {
 		return readSocketQueues;
 	}
 });
+Object.defineProperty(exports, "reapProcessGroup", {
+	enumerable: true,
+	get: function() {
+		return reapProcessGroup;
+	}
+});
 Object.defineProperty(exports, "reclaimIntervalMs", {
 	enumerable: true,
 	get: function() {
@@ -13194,6 +13496,18 @@ Object.defineProperty(exports, "registerEventBusService", {
 		return registerEventBusService;
 	}
 });
+Object.defineProperty(exports, "registerRunnerGroup", {
+	enumerable: true,
+	get: function() {
+		return registerRunnerGroup;
+	}
+});
+Object.defineProperty(exports, "releaseRunnerGroup", {
+	enumerable: true,
+	get: function() {
+		return releaseRunnerGroup;
+	}
+});
 Object.defineProperty(exports, "resolveAddonClass", {
 	enumerable: true,
 	get: function() {
@@ -13218,6 +13532,12 @@ Object.defineProperty(exports, "runNpm", {
 		return runNpm;
 	}
 });
+Object.defineProperty(exports, "runnerOwnsProcessGroup", {
+	enumerable: true,
+	get: function() {
+		return runnerOwnsProcessGroup;
+	}
+});
 Object.defineProperty(exports, "sampleSocketDirection", {
 	enumerable: true,
 	get: function() {
@@ -13260,6 +13580,12 @@ Object.defineProperty(exports, "shouldReclaim", {
 		return shouldReclaim;
 	}
 });
+Object.defineProperty(exports, "signalAllRunnerGroups", {
+	enumerable: true,
+	get: function() {
+		return signalAllRunnerGroups;
+	}
+});
 Object.defineProperty(exports, "socketDirectionBytes", {
 	enumerable: true,
 	get: function() {
@@ -13284,6 +13610,12 @@ Object.defineProperty(exports, "startRunnerHeapWatch", {
 		return startRunnerHeapWatch;
 	}
 });
+Object.defineProperty(exports, "startRunnerParentDeathWatchdog", {
+	enumerable: true,
+	get: function() {
+		return startRunnerParentDeathWatchdog;
+	}
+});
 Object.defineProperty(exports, "strandedMb", {
 	enumerable: true,
 	get: function() {
@@ -13296,6 +13628,12 @@ Object.defineProperty(exports, "subscribePassthrough", {
 		return subscribePassthrough;
 	}
 });
+Object.defineProperty(exports, "summarizeMembers", {
+	enumerable: true,
+	get: function() {
+		return summarizeMembers;
+	}
+});
 Object.defineProperty(exports, "udsChildLogToWorkerEntry", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-B78pkrps.mjs → dist-Cj7pJmXq.mjs}

@@ -21776,7 +21776,15 @@ var RebuildObjectEmbeddingsInput = z.object({
 	* force is logged at start and finish so a deliberately slow pass reads
 	* differently from a stalled one.
 	*/
-	pacingMs: z.number().int().nonnegative().optional()
+	pacingMs: z.number().int().nonnegative().optional(),
+	/**
+	* Re-embed ONLY the tracks whose vector is ALREADY in the pinned model's
+	* space (D664) — the in-space skip inverted. It exists to redo vectors
+	* written from the wrong box, which a normal pass would skip as done
+	* forever. Requires `maxTracks`: a forced pass without a bound is refused
+	* (`force-requires-max-tracks`).
+	*/
+	force: z.boolean().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -21812,6 +21820,7 @@ var WipeObjectEmbeddingsResultSchema = z.object({
 *    - `reads-disagree` — the two reads named different choices.
 *  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
 *    index to fill and no dimension to check against (D649).
+*  - `force-requires-max-tracks` — `force: true` with no `maxTracks` (D664).
 */
 var RebuildObjectEmbeddingsRefusalSchema = z.enum([
 	"stores-unavailable",
@@ -21819,7 +21828,8 @@ var RebuildObjectEmbeddingsRefusalSchema = z.enum([
 	"method-unavailable",
 	"read-failed",
 	"reads-disagree",
-	"not-a-clip-model"
+	"not-a-clip-model",
+	"force-requires-max-tracks"
 ]);
 /**
 * Acknowledgement that a rebuild STARTED.
@@ -21844,11 +21854,32 @@ var RebuildStatusSchema = z.object({
 	running: z.boolean(),
 	scanned: z.number(),
 	rebuilt: z.number(),
-	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	/** Tracks whose key frame is gone — nothing to re-embed from. Pixels ONLY:
+	*  `missingEvent` is its own field since D664, never summed in. */
 	missingKeyFrame: z.number(),
-	/** Tracks with no usable detection box. */
+	/** Tracks with no object event at all (D664). */
+	missingEvent: z.number(),
+	/** Tracks with no box measured on the pixels to cut — see `boxSource.refused`. */
 	missingBbox: z.number(),
 	/**
+	* Which rule placed each judged track's box (D664): the key frame row's own
+	* `subjectBox`, `track.positions` at exactly its instant (older key frames),
+	* the event box (a key frame recovered from the recording, at the event's
+	* instant), or `refused` by name — the reasons are in the tagged log lines.
+	*/
+	boxSource: z.object({
+		subjectBox: z.number(),
+		positions: z.number(),
+		event: z.number(),
+		refused: z.number()
+	}),
+	/** Tracks skipped because their vector is already in the pinned space. */
+	alreadyInSpace: z.number(),
+	/** Whether the current / last pass was a `force` pass; `null` before any (D664). */
+	force: z.boolean().nullable(),
+	/** In-space tracks a `force` pass selected for re-embedding. */
+	forcedInSpace: z.number(),
+	/**
 	* Tracks an executing node REFUSED rather than broke on — an unreadable key
 	* frame, a step that threw. Separate from `failed` because the remedy is
 	* different, and because a whole camera silently contributing zero vectors

package/dist/{dist-Cy6DFFjs.js → dist-CkRwnhbo.js}

@@ -21776,7 +21776,15 @@ var RebuildObjectEmbeddingsInput = zod.z.object({
 	* force is logged at start and finish so a deliberately slow pass reads
 	* differently from a stalled one.
 	*/
-	pacingMs: zod.z.number().int().nonnegative().optional()
+	pacingMs: zod.z.number().int().nonnegative().optional(),
+	/**
+	* Re-embed ONLY the tracks whose vector is ALREADY in the pinned model's
+	* space (D664) — the in-space skip inverted. It exists to redo vectors
+	* written from the wrong box, which a normal pass would skip as done
+	* forever. Requires `maxTracks`: a forced pass without a bound is refused
+	* (`force-requires-max-tracks`).
+	*/
+	force: zod.z.boolean().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -21812,6 +21820,7 @@ var WipeObjectEmbeddingsResultSchema = zod.z.object({
 *    - `reads-disagree` — the two reads named different choices.
 *  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
 *    index to fill and no dimension to check against (D649).
+*  - `force-requires-max-tracks` — `force: true` with no `maxTracks` (D664).
 */
 var RebuildObjectEmbeddingsRefusalSchema = zod.z.enum([
 	"stores-unavailable",
@@ -21819,7 +21828,8 @@ var RebuildObjectEmbeddingsRefusalSchema = zod.z.enum([
 	"method-unavailable",
 	"read-failed",
 	"reads-disagree",
-	"not-a-clip-model"
+	"not-a-clip-model",
+	"force-requires-max-tracks"
 ]);
 /**
 * Acknowledgement that a rebuild STARTED.
@@ -21844,11 +21854,32 @@ var RebuildStatusSchema = zod.z.object({
 	running: zod.z.boolean(),
 	scanned: zod.z.number(),
 	rebuilt: zod.z.number(),
-	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	/** Tracks whose key frame is gone — nothing to re-embed from. Pixels ONLY:
+	*  `missingEvent` is its own field since D664, never summed in. */
 	missingKeyFrame: zod.z.number(),
-	/** Tracks with no usable detection box. */
+	/** Tracks with no object event at all (D664). */
+	missingEvent: zod.z.number(),
+	/** Tracks with no box measured on the pixels to cut — see `boxSource.refused`. */
 	missingBbox: zod.z.number(),
 	/**
+	* Which rule placed each judged track's box (D664): the key frame row's own
+	* `subjectBox`, `track.positions` at exactly its instant (older key frames),
+	* the event box (a key frame recovered from the recording, at the event's
+	* instant), or `refused` by name — the reasons are in the tagged log lines.
+	*/
+	boxSource: zod.z.object({
+		subjectBox: zod.z.number(),
+		positions: zod.z.number(),
+		event: zod.z.number(),
+		refused: zod.z.number()
+	}),
+	/** Tracks skipped because their vector is already in the pinned space. */
+	alreadyInSpace: zod.z.number(),
+	/** Whether the current / last pass was a `force` pass; `null` before any (D664). */
+	force: zod.z.boolean().nullable(),
+	/** In-space tracks a `force` pass selected for re-embedding. */
+	forcedInSpace: zod.z.number(),
+	/**
 	* Tracks an executing node REFUSED rather than broke on — an unreadable key
 	* frame, a step that threw. Separate from `failed` because the remedy is
 	* different, and because a whole camera silently contributing zero vectors