@trillboards/edge-sdk 0.2.140 → 0.2.150

package/dist/localSensing.js

@@ -1,20 +1,68 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LocalSensingClient = void 0;
+exports.VIDEO_SEGMENTS_DIRNAME = exports.LocalSensingClient = void 0;
 exports.fieldSetForProfileType = fieldSetForProfileType;
 exports.repairLowConfidencePresenceContradiction = repairLowConfidencePresenceContradiction;
 exports.isAlertWorthy = isAlertWorthy;
 exports.resolveMaxStreamSessionsPerSource = resolveMaxStreamSessionsPerSource;
+exports.recordingUrlKey = recordingUrlKey;
+exports.videoFeedKey = videoFeedKey;
+exports.getVideoRecordingPlan = getVideoRecordingPlan;
 exports.buildLocalSensingLoops = buildLocalSensingLoops;
 const crypto_1 = require("crypto");
+const path = __importStar(require("path"));
+const dataDir_1 = require("./dataDir");
+const VideoSegmentUploader_1 = require("./VideoSegmentUploader");
 const AudienceAnalyzeClient_1 = require("./AudienceAnalyzeClient");
 const LiteRtVlmProvider_1 = require("./LiteRtVlmProvider");
 const analyzeCostObserver_1 = require("./analyzeCostObserver");
+const continuousReview_1 = require("./continuousReview");
+const ProfileReviewWork_1 = require("./ProfileReviewWork");
 const DetectorFieldProducer_1 = require("./DetectorFieldProducer");
 const SensingProfileClient_1 = require("./SensingProfileClient");
+const detectorCountReview_1 = require("./detectorCountReview");
+const jpegFrameSize_1 = require("./jpegFrameSize");
+const ScopedVlmReview_1 = require("./ScopedVlmReview");
 const CloudSensingManager_1 = require("./CloudSensingManager");
 const localInferenceSchema_1 = require("./localInferenceSchema");
 const legacyRecorderProfile_1 = require("./legacyRecorderProfile");
+const ReviewPriority_1 = require("./ReviewPriority");
+const RetainedFieldContract_1 = require("./RetainedFieldContract");
+const RuntimeModelSelection_1 = require("./RuntimeModelSelection");
+const ReviewModelUse_1 = require("./ReviewModelUse");
 const connectorCadence_1 = require("./connectorCadence");
 /** How long a fetched profile is cached before the connector re-checks for a new alert. */
 const DEFAULT_PROFILE_TTL_MS = 5 * 60 * 1000;
@@ -302,6 +350,15 @@ class LocalSensingClient {
     constructor(localProvider, uploadClient, options = {}) {
         this.localProvider = localProvider;
         this.uploadClient = uploadClient;
+        this.cachedDetectorCounts = false;
+        this.cachedMixedScopedCounts = false;
+        this.cachedMixedFrameCounts = false;
+        this.cachedReviewPolicy = null;
+        this.cachedFieldContract = null;
+        this.cachedModelSelection = null;
+        this.cachedDeclaredProfileReview = false;
+        this.cachedVlmFields = [];
+        this.cachedFocusRegionsValid = true;
         /**
          * Fields whose ABSENT reading an operator route on this screen fires on, from the
          * deployed profile (see SensingProfileClient.absenceWatchedFields). Refreshed on the
@@ -411,6 +468,9 @@ class LocalSensingClient {
          * profile. See fieldSetForProfileType.
          */
         this.activeFieldSet = 'audience';
+        this.retainedApiBaseUrl = options.retainedApiBaseUrl;
+        if (this.retainedApiBaseUrl !== undefined)
+            (0, continuousReview_1.assertRetainedReviewReceiver)(this.getEndpoint(), this.retainedApiBaseUrl);
         this.profileClient = options.profileClient;
         this.profileTtlMs = options.profileTtlMs ?? DEFAULT_PROFILE_TTL_MS;
         this.baseSchema = options.schema ?? (0, localInferenceSchema_1.buildLocalSensingSchema)();
@@ -418,7 +478,34 @@ class LocalSensingClient {
         this.cachedSchema = this.baseSchema;
         this.cachedPrompt = this.basePrompt;
         this.attachEvidenceFrame = options.attachEvidenceFrame !== false;
+        this.detectorCountsEnabled = options.detectorCounts === true;
+        if (this.detectorCountsEnabled)
+            this.assertLocalCountReceiver();
+        this.scopedVlmReviewEnabled = options.scopedVlmReview === true;
+        if (this.scopedVlmReviewEnabled)
+            this.assertLocalScopedReceiver();
+        this.overlapMixedReviewEnabled = options.overlapMixedReview === true;
+        if (this.overlapMixedReviewEnabled)
+            this.assertLocalScopedReceiver();
+        this.declaredProfileReviewEnabled = options.declaredProfileReview === true;
+        this.websiteManagedProfiles = options.websiteManagedProfiles === true;
+        if (this.declaredProfileReviewEnabled) {
+            this.assertLocalScopedReceiver();
+            if (!this.scopedVlmReviewEnabled)
+                throw Error('Declared profile review requires scoped review');
+        }
         this.producerOptions = options.detectorFieldProducerOptions ?? {};
+        this.imageClassifierProducer = options.imageClassifierFieldProducer;
+        if (this.imageClassifierProducer)
+            this.assertLocalScopedReceiver();
+        if (options.rfDetrSourceRuntime) {
+            this.assertLocalScopedReceiver();
+            const pin = options.rfDetrSourceRuntime;
+            if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(pin.modelId) || !/^[a-f0-9]{64}$/.test(pin.sha256)) {
+                throw Error('Invalid RF-DETR source-runtime binding');
+            }
+            this.rfDetrSourceRuntime = Object.freeze({ modelId: pin.modelId, sha256: pin.sha256 });
+        }
         // `null` is an explicit OFF and must not be confused with `undefined`,
         // which is "build the default one". A deployment without the detector
         // service is the former; every shipping connector is the latter.
@@ -462,7 +549,11 @@ class LocalSensingClient {
         const profile = await this.profileClient.fetchProfile();
         if (profile === null)
             return; // transient error — keep last-good schema
+        this.reviewProfileState = profile.profileState;
         this.activeProfileName = profile.profileName;
+        this.cachedReviewPolicy = (0, ReviewPriority_1.parseReviewPolicy)(profile.reviewPolicy);
+        this.cachedFieldContract = profile.retainedFieldContract ?? null;
+        this.cachedModelSelection = (0, RuntimeModelSelection_1.parseModelSelection)(profile.modelSelection);
         this.cachedAbsenceWatchedFields = new Set(profile.absenceWatchedFields || []);
         const fieldSet = fieldSetForProfileType(profile.profileType);
         this.activeFieldSet = fieldSet;
@@ -472,11 +563,22 @@ class LocalSensingClient {
         // TypeError on the path to every alert. A field with no consumer is not
         // known to be safe — it is only known to be unread.
         this.cachedProducerFields = profile.producerFields ?? [];
+        this.cachedDetectorCounts = this.detectorCountsEnabled && profile.detectorCountEligible === true;
+        this.cachedMixedFrameCounts = this.detectorCountsEnabled && this.scopedVlmReviewEnabled
+            && profile.mixedFrameCountEligible === true && profile.mixedScopedCountEligible !== true;
+        this.cachedMixedScopedCounts = this.detectorCountsEnabled && this.scopedVlmReviewEnabled
+            && (profile.mixedScopedCountEligible === true || this.cachedMixedFrameCounts);
         // The geometry half of the same partition. `?? new Map()` for the reason the
         // line above carries `?? []`: this assignment can outlive a profile object
         // that predates the key, and an undefined map is a TypeError on the path to
         // every alert the first time anything reads it.
         this.cachedAlertFocusRegions = profile.alertFocusRegions ?? new Map();
+        this.cachedFocusRegionsValid = profile.alertFocusRegionsValid !== false;
+        this.cachedVlmFields = this.usesWebsiteProfile()
+            ? profile.vlmFields.filter(field => field.type !== 'hidden') : profile.vlmFields;
+        this.cachedDeclaredProfileReview = this.declaredProfileReviewEnabled && fieldSet === 'operator'
+            && !this.cachedProducerFields.length && profile.vlmFields.length > 0
+            && this.cachedModelSelection !== null;
         // Rebuilt only on a real change, and NEVER when the producer was injected —
         // a test's stub must not be silently replaced by a real one the moment a
         // profile arrives.
@@ -516,6 +618,45 @@ class LocalSensingClient {
             this.cachedSchema = this.baseSchema;
             this.cachedPrompt = this.basePrompt;
         }
+        if (this.cachedDetectorCounts) {
+            // A complete counting observation has no VLM certainty score. Do not invent
+            // confidence from a box score, especially when the detector sees zero boxes.
+            this.cachedSchema = {
+                type: 'object', additionalProperties: false,
+                properties: Object.fromEntries([
+                    ...this.cachedProducerFields.map(f => [f.field, { type: f.type === 'boolean' ? 'boolean' : 'integer' }]),
+                    ['people_present', { type: 'boolean' }],
+                ]),
+                required: [...this.cachedProducerFields.map(f => f.field), 'people_present'],
+            };
+            this.cachedPrompt = 'RF-DETR person counts; people_present is derived from whole-frame person_count > 0. VLM confidence is not measured.';
+        }
+        if (this.cachedMixedScopedCounts) {
+            // Only the explicitly declared activity questions reach Gemma. RF-DETR owns
+            // person_count, people_present is derived, and global confidence is unmeasured.
+            const properties = this.cachedSchema.properties;
+            this.cachedSchema = { type: 'object', additionalProperties: false,
+                properties: Object.fromEntries(profile.vlmFields.map(field => [field.field, properties[field.field]])),
+                required: profile.vlmFields.map(field => field.field) };
+        }
+        if (this.cachedDeclaredProfileReview) {
+            // Preserve every declared question (including explicitly requested presence).
+            // This is a separate captured method, not permission to shorten old evidence.
+            const properties = this.cachedSchema.properties;
+            this.cachedSchema = { type: 'object', additionalProperties: false,
+                properties: Object.fromEntries(profile.vlmFields.map(field => [field.field, properties[field.field]])),
+                required: profile.vlmFields.map(field => field.field) };
+            this.cachedPrompt = 'Review only the captured operator fields in their assigned camera areas.';
+        }
+        if (this.usesWebsiteProfile()) {
+            // Strict website selection already owns the entire partition. Do not add
+            // generic presence/count/confidence questions back into its VLM half.
+            const properties = this.cachedSchema.properties;
+            this.cachedSchema = { type: 'object', additionalProperties: false,
+                properties: Object.fromEntries(this.cachedVlmFields.map(field => [field.field, properties[field.field]])),
+                required: this.cachedVlmFields.map(field => field.field) };
+            this.cachedPrompt = 'Review only the captured website fields in their assigned camera areas.';
+        }
     }
     /**
      * What the on-device runtime resolved about this host's accelerator (which
@@ -565,168 +706,430 @@ class LocalSensingClient {
     getObservedAnalyzeMs() {
         return this.analyzeCost.medianMs();
     }
-    async analyze(request) {
+    /** Resolve once before LOOK starts; later refreshes never hold up capture. */
+    async prepareReview() {
         await this.refreshProfileIfStale();
-        // The measured dimensions of THIS frame, forwarded to every upload path
-        // below. This client sits between the cadence loop and the upload client,
-        // so anything it does not forward is dropped — and the connector is the
-        // multi-channel DVR/NVR product, i.e. precisely the topology whose
-        // configured width is absent. Undefined here simply falls back to the
-        // upload client's constructor value.
-        const frameDimensions = {
-            imageWidth: request.imageWidth,
-            imageHeight: request.imageHeight,
-        };
-        // Mint the evidence identity BEFORE inference. This digest therefore names
-        // the model input, rather than a later recapture or re-encoded thumbnail.
+    }
+    /** Only an explicitly verified inactive profile pauses new model work. */
+    isReviewActive() {
+        return this.reviewProfileState !== 'inactive';
+    }
+    usesWebsiteProfile() {
+        return this.websiteManagedProfiles && this.reviewProfileState === 'active';
+    }
+    captureReviewContext() {
+        void this.prepareReview().catch(() => { });
+        const context = JSON.parse(JSON.stringify({
+            version: 1,
+            ...(this.reviewProfileState ? { profileState: this.reviewProfileState } : {}),
+            schema: this.cachedSchema,
+            ...(this.cachedReviewPolicy ? { reviewPolicy: this.cachedReviewPolicy } : {}),
+            ...(this.cachedFieldContract ? { retainedFieldContract: this.cachedFieldContract } : {}),
+            ...(this.cachedModelSelection ? { modelSelection: this.cachedModelSelection } : {}),
+            prompt: this.cachedPrompt,
+            absenceWatchedFields: [...this.cachedAbsenceWatchedFields],
+            producerFields: this.cachedProducerFields,
+            regions: [...this.cachedAlertFocusRegions],
+            // The API advertises operating points from every executable grant. This
+            // complete mixed contract owns only person_count; retain exactly its point.
+            operatingPoints: this.cachedMixedScopedCounts
+                ? [['person', this.cachedProducerOperatingPoints.get('person')]]
+                : [...this.cachedProducerOperatingPoints],
+            ...(this.cachedDetectorCounts ? { detectorCounts: true } : {}),
+            ...((this.scopedVlmReviewEnabled || this.usesWebsiteProfile()) && !this.cachedDetectorCounts && this.activeFieldSet === 'operator'
+                && (this.usesWebsiteProfile() && this.cachedVlmFields.length || this.cachedDeclaredProfileReview
+                    || this.cachedMixedFrameCounts || this.cachedAlertFocusRegions.size || !this.cachedFocusRegionsValid) ? { scopedVlmReview: {
+                    version: 1, fieldSet: 'operator', fields: this.cachedVlmFields, regionsValid: this.cachedFocusRegionsValid,
+                    ...(this.usesWebsiteProfile() ? { declaredVlmFieldsOnly: true }
+                        : this.cachedDeclaredProfileReview ? { declaredFieldsOnly: true } : {}),
+                    ...(this.cachedMixedScopedCounts ? { personCounts: {
+                            version: 1, modelId: 'rfdetr_medium', minConfidence: this.cachedProducerOperatingPoints.get('person'),
+                            ...(this.cachedMixedFrameCounts ? { scopePolicy: 'declared_regions_v2' } : {}),
+                        }, ...(this.overlapMixedReviewEnabled ? { countExecution: 'overlap_v1' } : {}) } : {}),
+                } } : {}),
+        }));
+        if (this.overlapMixedReviewEnabled && !context.detectorCounts && !context.scopedVlmReview
+            && context.producerFields.length && context.modelSelection && !('invalid' in context.modelSelection)
+            && context.modelSelection.models.some(m => m.format === 'onnx')
+            && context.modelSelection.models.some(m => m.format === 'litert-lm')) {
+            context.mixedModelExecution = 'overlap_v1';
+        }
+        return context;
+    }
+    /** Admission follows the saved profile, never the camera's current setting. */
+    getReviewModelUse(context) {
+        return (0, ReviewModelUse_1.retainedReviewModelUse)(context);
+    }
+    /** Finish and durably checkpoint inference without starting a network upload. */
+    async reviewCandidate(request) {
+        if (!request.checkpointAnalysis)
+            throw new Error('Independent review requires a durable checkpoint');
+        await this.prepareAnalysis(request);
+    }
+    /** Isolated review-only rehearsal. Sparse results never enter the normal upload envelope. */
+    async reviewProfileWork(request, work, checkpoint) {
+        const url = new URL(this.getEndpoint());
+        if (!['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname) ||
+            !request.evidenceId || request.capturedAt === undefined || !request.reviewContext || typeof checkpoint !== 'function') {
+            throw Error('Profile work requires isolated durable evidence');
+        }
+        const context = request.reviewContext;
+        const selection = (0, RuntimeModelSelection_1.retainedModelSelection)(context, !!this.imageClassifierProducer, !!this.rfDetrSourceRuntime);
+        const sourcePin = selection?.models.find(model => model.format === 'safetensors-rfdetr');
+        if (sourcePin && (!this.rfDetrSourceRuntime || selection.models.length !== 1
+            || sourcePin.modelId !== this.rfDetrSourceRuntime.modelId || sourcePin.sha256 !== this.rfDetrSourceRuntime.sha256)) {
+            throw Error('RF-DETR source comparison requires its own exactly bound arm');
+        }
+        const classifierPin = selection?.models.find(model => model.format === 'tflite-image-classifier');
+        if (classifierPin) {
+            if (!this.imageClassifierProducer || selection.models.length !== 1) {
+                throw Error('Image classifier comparison requires its own explicitly injected arm');
+            }
+            this.imageClassifierProducer.assertContext(context, classifierPin);
+        }
+        const vlmPin = selection?.models.find(model => model.format === 'litert-lm');
+        const detectorPins = selection ? new Map(selection.models.filter(model => model.format === 'onnx' || model.format === 'safetensors-rfdetr')
+            .map(model => [model.modelId, model.sha256])) : undefined;
+        const regions = new Map(context.regions ?? []);
+        const producer = !this.producerInjected ? new DetectorFieldProducer_1.DetectorFieldProducer({ ...this.producerOptions,
+            classThresholds: new Map(context.operatingPoints ?? []), regionForField: field => regions.get(field) ?? null }) : this.producer;
+        const result = await (0, ProfileReviewWork_1.reviewProfileBatch)({ jpeg: request.jpeg, evidenceId: request.evidenceId,
+            capturedAtMs: request.capturedAt, context, work,
+            analyze: async (r) => {
+                if (selection && !vlmPin)
+                    throw Error('Retained work has no selected language model');
+                return repairLowConfidencePresenceContradiction(await this.localProvider.analyze({ ...r,
+                    ...(vlmPin ? { expectedModel: vlmPin } : {}) }));
+            },
+            produce: fields => classifierPin
+                ? this.imageClassifierProducer.produce(request.jpeg, fields, classifierPin)
+                : producer ? producer.produce(request.jpeg, fields, detectorPins) : Promise.resolve({ produced: [], withheld: [] }) });
+        checkpoint(result);
+        return result;
+    }
+    async prepareAnalysis(request) {
+        if (!request.reviewContext && !request.cachedAnalysis)
+            await this.refreshProfileIfStale();
+        const context = request.reviewContext;
+        if (!context && this.cachedModelSelection)
+            throw Error('Selected model review requires retained evidence');
+        if (context && (context.version !== 1 || !context.schema || typeof context.prompt !== 'string' ||
+            !Array.isArray(context.producerFields) || !Array.isArray(context.regions) ||
+            !Array.isArray(context.operatingPoints) || !Array.isArray(context.absenceWatchedFields)
+            || (context.detectorCounts !== undefined && context.detectorCounts !== true))) {
+            throw new Error('Invalid retained sensing profile');
+        }
         const capturedAtMs = request.capturedAt ?? Date.now();
-        const evidenceId = request.evidenceId || `ev_${(0, crypto_1.randomUUID)()}`;
         const evidenceSha256 = (0, crypto_1.createHash)('sha256').update(request.jpeg).digest('hex');
-        let structured;
-        // Bracket the ONE call whose duration is the quantity the whole capacity
-        // model is built on. Started before the await and read after it, so it is
-        // the frame's wall-clock cost and not a stage of it.
-        const analyzeStartedAt = Date.now();
-        try {
-            structured = await this.localProvider.analyze({
-                jpeg: request.jpeg,
-                schema: this.cachedSchema,
-                prompt: this.cachedPrompt,
-            });
+        let saved = request.cachedAnalysis;
+        const detectorCounts = context?.detectorCounts === true;
+        const scopedReview = context?.scopedVlmReview;
+        const capturedPolicy = (0, ReviewPriority_1.parseReviewPolicy)(context?.reviewPolicy);
+        if (capturedPolicy && 'invalid' in capturedPolicy) {
+            throw Error('Invalid retained profile review policy; evidence retained for diagnosis');
         }
-        catch (err) {
-            // LOCAL-INFERENCE ONLY: a frame the on-device runtime could not analyze is
-            // DROPPED, not metered. This branch used to POST the frame to the cloud
-            // VLM (`cloudFallbackOnError`) at $0.007008 each — the per-frame cost this
-            // whole change exists to remove. The capture loop's own cadence is the
-            // resilience: the next frame is seconds away, and a runtime that keeps
-            // throwing is a fault to surface, not a bill to pay.
-            throw err;
-        }
-        structured = repairLowConfidencePresenceContradiction(structured);
-        // THE PRODUCER HALF. Fields a granted specialist owns are answered by the
-        // detector, never by the prompt — this is the consumer that closes the
-        // partition the server has been shipping since `fieldRouting` landed, and
-        // without it `producer[]` was a diagnostic and the specialists answered
-        // nothing.
-        //
-        // AFTER the VLM, not before: the two runtimes are separate processes but
-        // share the box's compute, and issuing them together would make each
-        // frame's cost the sum under contention rather than the max. The detector's
-        // measured p50 is ~61 ms against a 7.3 s analyze, so the ordering costs
-        // nothing that the budget below does not already bound.
-        //
-        // `produce` NEVER THROWS by contract, so no try/catch: adding one would
-        // imply it can, and would swallow a genuine programming error in it.
-        let producedSet = null;
-        /** field -> the specialist that answered it, or null when none did. */
-        let detectorProduced = null;
-        if (this.producer && this.cachedProducerFields.length > 0) {
-            producedSet = await this.producer.produce(request.jpeg, 
-            // `derivation` is carried, not dropped. `classifyProducerField` reads the
-            // relation kind from THIS object and from nowhere else, so a map that
-            // rebuilt the entry without it sent every relation field down the suffix
-            // rule — which cannot express one. That is what made `zone_count`
-            // unreachable and the geometric region inert.
-            this.cachedProducerFields.map((f) => ({
-                field: f.field,
-                modelId: f.modelId,
-                type: f.type ?? null,
-                derivation: f.derivation ?? null,
-            })));
-            this.producerProduced += producedSet.produced.length;
-            for (const w of producedSet.withheld) {
-                this.producerWithheldByReason[w.reason] = (this.producerWithheldByReason[w.reason] || 0) + 1;
+        const requiredFields = (0, RetainedFieldContract_1.readFieldContract)(context?.retainedFieldContract);
+        const selection = (0, RuntimeModelSelection_1.retainedModelSelection)(context);
+        if (saved?.runtimeSelectionSha256 !== undefined && !selection)
+            throw Error('Saved model-verified result requires its retained selection');
+        const vlmPin = selection?.models.find(model => model.format === 'litert-lm');
+        const detectorPins = selection ? new Map(selection.models.filter(model => model.format === 'onnx')
+            .map(model => [model.modelId, model.sha256])) : undefined;
+        if (context?.mixedModelExecution !== undefined) {
+            this.assertLocalScopedReceiver();
+            if (context.mixedModelExecution !== 'overlap_v1' || detectorCounts || scopedReview
+                || !vlmPin || !detectorPins?.size || !context.producerFields.length
+                || !request.evidenceId || !Number.isFinite(request.capturedAt)
+                || !Number.isFinite(request.reviewWindowMs) || !request.checkpointAnalysis) {
+                throw Error('Overlapping paired review requires its complete retained contract');
+            }
+        }
+        if (saved && selection && saved.runtimeSelectionSha256 !== (0, ProfileReviewWork_1.reviewContextHash)(context)) {
+            throw Error('Saved result does not match retained model selection');
+        }
+        const mixedCounts = scopedReview?.personCounts !== undefined;
+        if (scopedReview?.declaredVlmFieldsOnly !== undefined) {
+            const vlmFields = requiredFields?.filter(field => field.modelId === undefined);
+            if (context?.profileState !== 'active' || !selection || !vlmPin || !vlmFields
+                || !Array.isArray(scopedReview.fields) || scopedReview.fields.length !== vlmFields.length
+                || vlmFields.some(field => !scopedReview.fields.some(f => f.field === field.field && f.type === field.type))
+                || context.absenceWatchedFields.some(field => !requiredFields.some(f => f.field === field))) {
+                throw Error('Website review requires complete captured ownership and absence conditions');
+            }
+            (0, ScopedVlmReview_1.planScopedVlmReview)(context.schema, scopedReview, context.regions, context.producerFields);
+        }
+        if (scopedReview?.declaredFieldsOnly !== undefined) {
+            if (!selection || !vlmPin || selection.models.length !== 1
+                || !Array.isArray(scopedReview.fields) || !requiredFields
+                || scopedReview.fields.length !== requiredFields.length
+                || requiredFields.some(field => !scopedReview.fields.some(f => f.field === field.field && f.type === field.type))
+                || context.absenceWatchedFields.some(field => !scopedReview.fields.some(f => f.field === field))) {
+                throw Error('Declared review requires complete pinned VLM ownership and absence conditions');
+            }
+            // Revalidate on cached delivery too; an edited snapshot must never drop a question.
+            (0, ScopedVlmReview_1.planScopedVlmReview)(context.schema, scopedReview, context.regions, context.producerFields);
+        }
+        const scopedMethod = mixedCounts ? 'scoped_detector_counts_v1' : 'scoped_vlm_v1';
+        if (scopedReview || saved?.analysisMethod === 'scoped_vlm_v1' || saved?.analysisMethod === 'scoped_detector_counts_v1') {
+            this.assertLocalScopedReceiver();
+            if (!scopedReview || detectorCounts || !request.evidenceId || !Number.isFinite(request.capturedAt)
+                || !Number.isFinite(request.reviewWindowMs) || !request.checkpointAnalysis
+                || !saved && !request.checkpointScopedReview) {
+                throw Error('Scoped review requires its retained profile and durable evidence');
+            }
+            if (mixedCounts) {
+                (0, ScopedVlmReview_1.planScopedVlmReview)(context.schema, scopedReview, context.regions, context.producerFields);
+                if (context.operatingPoints.length !== 1 || context.operatingPoints[0][0] !== 'person'
+                    || context.operatingPoints[0][1] !== scopedReview.personCounts.minConfidence
+                    || context.absenceWatchedFields.some(field => !['person_count', 'people_present',
+                        ...scopedReview.fields.map(f => f.field)].includes(field))) {
+                    throw Error('Mixed review requires the retained threshold and complete field ownership');
+                }
+            }
+        }
+        if (!context && this.scopedVlmReviewEnabled)
+            throw Error('Scoped review requires a retained profile');
+        if (!context && this.cachedDetectorCounts)
+            throw Error('Detector counts require a retained profile and durable evidence');
+        // Pin the captured choice across profile changes/restarts. Neither a new
+        // profile nor a saved answer can send this experimental contract to production.
+        if (detectorCounts || saved?.analysisMethod === 'detector_counts_v1') {
+            this.assertLocalCountReceiver();
+            if (!context || !detectorCounts || !request.evidenceId || !Number.isFinite(request.capturedAt)
+                || !Number.isFinite(request.reviewWindowMs) || !request.checkpointAnalysis
+                || !(0, detectorCountReview_1.isPersonCountContract)(context.producerFields, new Map(context.regions))) {
+                throw Error('Detector counts require a complete retained profile and durable evidence');
+            }
+            const properties = context.schema.properties;
+            const required = context.schema.required;
+            const keys = [...context.producerFields.map(f => f.field), 'people_present'];
+            if (!properties || Object.keys(properties).length !== keys.length
+                || !Array.isArray(required) || required.length !== keys.length || new Set(required).size !== keys.length
+                || keys.some(key => !required.includes(key)) || properties.people_present?.type !== 'boolean'
+                || context.producerFields.some(f => properties[f.field]?.type !== (f.type === 'boolean' ? 'boolean' : 'integer'))) {
+                throw Error('Detector counts require a complete retained count schema');
             }
-            const { merged, collisions, producedBy } = mergeProducedFields(structured, producedSet);
-            structured = merged;
-            detectorProduced = Object.keys(producedBy).length > 0 ? producedBy : null;
-            if (collisions.length > 0) {
-                // The prompt was never given these fields, so the model answering them
-                // means the schema and the partition disagree about who owns them.
+            if (context.regions.length && !(0, jpegFrameSize_1.readJpegFrameSize)(request.jpeg)) {
+                throw Error('Detector count lasso requires readable image dimensions; retain for retry');
+            }
+        }
+        if (saved && (saved.version !== 1 || saved.evidenceSha256 !== evidenceSha256 ||
+            !saved.structured || Array.isArray(saved.structured) || typeof saved.structured !== 'object' ||
+            typeof saved.promptText !== 'string' || typeof saved.hasSignal !== 'boolean' ||
+            !Number.isFinite(saved.analyzeMs) || !Number.isFinite(saved.reviewedAtMs)
+            || (saved.analysisMethod !== undefined && saved.analysisMethod !== 'detector_counts_v1'
+                && saved.analysisMethod !== 'scoped_vlm_v1' && saved.analysisMethod !== 'scoped_detector_counts_v1'))) {
+            throw new Error('Invalid saved model result');
+        }
+        if (saved && (detectorCounts !== (saved.analysisMethod === 'detector_counts_v1'))) {
+            throw Error('Saved result does not match retained review method');
+        }
+        if (saved && (!!scopedReview !== (saved.analysisMethod === 'scoped_vlm_v1' || saved.analysisMethod === 'scoped_detector_counts_v1')
+            || scopedReview && saved.analysisMethod !== scopedMethod
+            || scopedReview && (!Array.isArray(saved.scopeReviews) || !saved.scopeReviews.length
+                || saved.scopeContextSha256 !== (0, ProfileReviewWork_1.reviewContextHash)(context)))) {
+            throw Error('Saved result does not match retained scoped review method');
+        }
+        if (saved && mixedCounts && (!saved.hasSignal || !saved.detectorProduced
+            || Object.keys(saved.detectorProduced).length !== 1 || saved.detectorProduced.person_count !== 'rfdetr_medium'
+            || Object.keys(saved.structured).length !== scopedReview.fields.length + 2
+            || !Number.isSafeInteger(saved.structured.person_count) || saved.structured.person_count < 0
+            || saved.structured.people_present !== (saved.structured.person_count > 0)
+            || scopedReview.fields.some(field => typeof saved.structured[field.field] !== 'boolean'))) {
+            throw Error('Invalid saved mixed count and behavior result');
+        }
+        if (saved && detectorCounts) {
+            const fields = context.producerFields;
+            if (!saved.hasSignal || !saved.detectorProduced || Object.keys(saved.detectorProduced).length !== fields.length
+                || Object.keys(saved.structured).length !== fields.length + 1
+                || saved.structured.people_present !== (saved.structured.person_count > 0)
+                || fields.some(f => saved.detectorProduced[f.field] !== f.modelId
+                    || (f.type === 'boolean' ? typeof saved.structured[f.field] !== 'boolean'
+                        : !Number.isSafeInteger(saved.structured[f.field]) || saved.structured[f.field] < 0))) {
+                throw Error('Invalid saved detector count result');
+            }
+        }
+        if (saved?.reuseMethod === 'exact_recent' && (typeof saved.reusedFromEvidenceId !== 'string' || !saved.reusedFromEvidenceId ||
+            typeof saved.sourceCapturedAtMs !== 'number' || !Number.isFinite(saved.sourceCapturedAtMs) ||
+            typeof saved.sourceReviewedAtMs !== 'number' || !Number.isFinite(saved.sourceReviewedAtMs) ||
+            saved.sourceCapturedAtMs > saved.sourceReviewedAtMs || saved.sourceReviewedAtMs > capturedAtMs ||
+            capturedAtMs > saved.reviewedAtMs || request.reviewWindowMs === undefined ||
+            saved.reviewedAtMs - saved.sourceCapturedAtMs > request.reviewWindowMs)) {
+            throw new Error('Invalid recent answer provenance');
+        }
+        if (!saved) {
+            const promptText = context?.prompt ?? this.cachedPrompt;
+            const schema = context?.schema ?? this.cachedSchema;
+            const fields = context?.producerFields ?? this.cachedProducerFields;
+            const absence = context ? new Set(context.absenceWatchedFields) : this.cachedAbsenceWatchedFields;
+            const regions = new Map(context?.regions ?? []);
+            const producer = context && !this.producerInjected
+                ? new DetectorFieldProducer_1.DetectorFieldProducer({
+                    ...this.producerOptions,
+                    classThresholds: new Map(context.operatingPoints),
+                    regionForField: field => regions.get(field) ?? null,
+                })
+                : this.producer;
+            const startedAt = Date.now();
+            let structured = {};
+            let scopeReviews;
+            let detectorProduced = null;
+            const reviewVlm = async () => {
+                if (scopedReview) {
+                    const scoped = await (0, ScopedVlmReview_1.reviewScopedVlm)({ jpeg: request.jpeg, schema, contract: scopedReview,
+                        ...(selection ? { modelSelectionSha256: (0, ProfileReviewWork_1.reviewContextHash)(context) } : {}),
+                        regions: context.regions, producerFields: fields,
+                        progress: request.scopedVlmProgress, checkpoint: request.checkpointScopedReview,
+                        ...(mixedCounts ? { produceCounts: async () => {
+                                if (!producer)
+                                    throw Error('Mixed count producer unavailable; retain for retry');
+                                const produced = await producer.produce(request.jpeg, [...fields], detectorPins);
+                                this.producerProduced += produced.produced.length;
+                                for (const withheld of produced.withheld) {
+                                    this.producerWithheldByReason[withheld.reason] = (this.producerWithheldByReason[withheld.reason] || 0) + 1;
+                                }
+                                return produced;
+                            } } : {}),
+                        analyze: async (input) => {
+                            if (selection && !vlmPin)
+                                throw Error('Retained scope has no selected language model');
+                            const result = await this.localProvider.analyze({ ...input, ...(vlmPin ? { expectedModel: vlmPin } : {}) });
+                            this.localInferencesCompleted++;
+                            return result;
+                        } });
+                    structured = mixedCounts ? scoped.structured : repairLowConfidencePresenceContradiction(scoped.structured);
+                    scopeReviews = scoped.traces;
+                    if (mixedCounts)
+                        detectorProduced = { person_count: 'rfdetr_medium' };
+                }
+                else if (!detectorCounts && (!selection || vlmPin)) {
+                    structured = repairLowConfidencePresenceContradiction(await this.localProvider.analyze({
+                        jpeg: request.jpeg, schema, prompt: promptText,
+                        ...(vlmPin ? { expectedModel: vlmPin } : {}),
+                    }));
+                    this.localInferencesCompleted++;
+                }
+                else if (!producer) {
+                    throw Error('Detector count producer unavailable; retain for retry');
+                }
+            };
+            const reviewDetector = async () => {
+                if (!producer || !fields.length || mixedCounts)
+                    return undefined;
+                return producer.produce(request.jpeg, fields.map(f => ({
+                    field: f.field, modelId: f.modelId,
+                    type: f.type ?? null, derivation: f.derivation ?? null,
+                })), detectorPins);
+            };
+            let produced;
+            if (context?.mixedModelExecution === 'overlap_v1') {
+                // Keep both scheduler reservations until both calls settle, even on failure.
+                // An early rejection must not admit another candidate onto a still-busy model.
+                const [vlmResult, detectorResult] = await Promise.allSettled([reviewVlm(), reviewDetector()]);
+                if (vlmResult.status === 'rejected')
+                    throw vlmResult.reason;
+                if (detectorResult.status === 'rejected')
+                    throw detectorResult.reason;
+                produced = detectorResult.value;
+            }
+            else {
+                await reviewVlm();
+                produced = await reviewDetector();
+            }
+            if (produced) {
+                this.producerProduced += produced.produced.length;
+                for (const withheld of produced.withheld) {
+                    this.producerWithheldByReason[withheld.reason] =
+                        (this.producerWithheldByReason[withheld.reason] || 0) + 1;
+                }
+                const { merged, collisions, producedBy } = mergeProducedFields(structured, produced);
+                structured = merged;
+                if (detectorCounts)
+                    structured = (0, detectorCountReview_1.completePersonCounts)(produced, fields);
+                detectorProduced = Object.keys(producedBy).length ? producedBy : null;
                 this.producerFieldCollisions += collisions.length;
             }
+            const analyzeMs = Date.now() - startedAt;
+            this.analyzeCost.record(analyzeMs);
+            saved = {
+                version: 1, structured, detectorProduced, analyzeMs, promptText,
+                reviewedAtMs: Date.now(), evidenceSha256,
+                ...(selection ? { runtimeSelectionSha256: (0, ProfileReviewWork_1.reviewContextHash)(context) } : {}),
+                // Zero can satisfy a below-count/absence rule too. Keep its evidence.
+                hasSignal: detectorCounts || mixedCounts || isAlertWorthy(structured, absence),
+                ...(detectorCounts ? { analysisMethod: 'detector_counts_v1' } : {}),
+                ...(scopedReview ? { analysisMethod: scopedMethod, scopeReviews,
+                    scopeContextSha256: (0, ProfileReviewWork_1.reviewContextHash)(context) } : {}),
+            };
         }
-        // The on-device runtime returned a result: the ONLY event that proves it is
-        // alive. Counted here, past every throw, so nothing but a real on-device
-        // inference can advance it.
-        this.localInferencesCompleted += 1;
-        // Recorded HERE, past every throw, for the same reason the counter above is:
-        // a request that failed is not a frame cost. A fast failure recorded as a
-        // fast frame is how a box talks itself into a cadence it cannot serve.
-        const analyzeMs = Date.now() - analyzeStartedAt;
-        this.analyzeCost.record(analyzeMs);
-        // Connector-controlled provenance + time (don't trust the model for these).
-        // PRIVACY-CONSCIOUS evidence frame: attach the SAME JPEG the VLM analyzed
-        // (no re-capture) only when enabled AND the observation is potentially
-        // alert-worthy. Empty/uninteresting scenes send results only — no frame.
-        // Evaluate over the raw model output (not the provenance-stamped `result`,
-        // though both yield the same gate since source/captured_at are strings).
-        const hasSignal = isAlertWorthy(structured, this.cachedAbsenceWatchedFields);
+        // Also retry a previously failed disk commit before any upload. The spool
+        // keeps that answer in memory while disk recovers; inference is not repeated.
+        (0, RetainedFieldContract_1.assertCompleteFields)(requiredFields, saved.structured, saved.detectorProduced);
+        request.checkpointAnalysis?.(saved);
+        return saved;
+    }
+    assertLocalCountReceiver() {
+        (0, continuousReview_1.assertRetainedReviewReceiver)(this.getEndpoint(), this.retainedApiBaseUrl);
+    }
+    assertLocalScopedReceiver() {
+        (0, continuousReview_1.assertRetainedReviewReceiver)(this.getEndpoint(), this.retainedApiBaseUrl);
+    }
+    async analyze(request) {
+        const capturedAtMs = request.capturedAt ?? Date.now();
+        const saved = await this.prepareAnalysis({ ...request, capturedAt: capturedAtMs });
+        const evidenceId = request.evidenceId || `ev_${(0, crypto_1.randomUUID)()}`;
+        const evidenceSha256 = saved.evidenceSha256;
+        const review = request.reviewWindowMs === undefined ? undefined :
+            (0, continuousReview_1.evidenceReview)(capturedAtMs, saved.reviewedAtMs, request.reviewWindowMs);
+        if (review && typeof saved.reusedFromEvidenceId === 'string') {
+            review.reusedFromEvidenceId = saved.reusedFromEvidenceId;
+        }
+        if (review && saved.reuseMethod === 'exact_recent') {
+            review.reuseMethod = 'exact_recent';
+            review.sourceCapturedAtMs = saved.sourceCapturedAtMs;
+            review.sourceReviewedAtMs = saved.sourceReviewedAtMs;
+        }
+        const selection = (0, RuntimeModelSelection_1.retainedModelSelection)(request.reviewContext);
+        const selectedDetectorOnly = selection && selection.models.every(model => model.format === 'onnx')
+            && saved.analysisMethod === undefined;
         const result = {
-            ...structured,
-            source: 'vlm_edge',
+            ...saved.structured,
+            source: selectedDetectorOnly || saved.analysisMethod === 'detector_counts_v1' ? 'detector_edge'
+                : saved.analysisMethod === 'scoped_detector_counts_v1' ? 'mixed_edge' : 'vlm_edge',
             captured_at: new Date(capturedAtMs).toISOString(),
         };
-        const includeFrame = this.attachEvidenceFrame && hasSignal;
         return this.uploadClient.analyzePreAnalyzed(result, {
             capturedAt: capturedAtMs,
             captureMode: request.captureMode,
-            // Reported even when no evidence frame is attached: the observation was
-            // still DERIVED from a frame of this size, and the privacy gate decides
-            // whether the pixels leave, not whether their dimensions do.
-            ...frameDimensions,
-            // Reported on EVERY analysis, not only the alert-worthy ones that carry a
-            // frame. This is the number the entire capacity model is built on — it is
-            // what `MEASURED_LOCAL_ANALYZE_MS` is a stand-in for — and until now it
-            // was measured here, spent on the local cadence, and then dropped, so
-            // vision_call_log.latency_ms was NULL on 100% of local-vlm rows while the
-            // cloud path was 100% populated. A quantity every box computes and no box
-            // reports is the telemetry-producer-substrate defect in
-            // docs/runbooks/telemetry-producer-substrate.md.
-            //
-            // Deliberately OUTSIDE the `includeFrame` branch below: the frame only
-            // rides along on alert-worthy analyses, and sampling the fleet's per-frame
-            // cost on busy scenes alone would bias the very number the cadence is
-            // derived from.
-            analyzeMs,
-            // The prompt this analysis actually used. `cachedPrompt` is rebuilt
-            // whenever the deployed profile changes, so this reports the question as
-            // it was asked for THIS frame rather than as the current source would
-            // rebuild it — which is the distinction that matters when a fleet is
-            // mid-rollout across two connector versions.
-            promptText: this.cachedPrompt,
-            // WHICH FIELDS A SPECIALIST ANSWERED. This used to be dropped here, with a
-            // comment saying it would ship "when it has a column" — because an ingest
-            // that destructures its accepted keys by name silently discards an unnamed
-            // one and still answers 2xx, and a producer whose output nothing reads must
-            // not report success.
-            //
-            // IT NOW HAS ONE. `earner-misc.js` names `detectorProduced`, and
-            // `ingestPreAnalyzedFrame` stamps those fields `local_detector` in
-            // `_provenance_map` — which `chipPersistence.fanOutProfileFields` already
-            // writes, unchanged, into `observation_field_values.provenance`. So the
-            // fact lands at the grain it belongs to, per field per observation, in the
-            // per-field provenance column that has existed all along.
-            //
-            // WHY IT HAD TO SHIP: a merged `forklift_present: true` is byte-identical
-            // whether `gh_forklift_combine` counted a detection at its fitted 0.7435 or
-            // the VLM wrote it in prose. Without this key, "the false-alarm rate WITH
-            // specialists serving" is not a hard measurement — it is an unanswerable
-            // one, and a run whose detectors all withheld would report VLM numbers
-            // under a specialist label with nothing able to contradict it.
-            //
-            // OMITTED, never `{}`, when no field was produced: absent means "no
-            // specialist answered anything on this frame", and an empty object would
-            // make a box with no granted specialist indistinguishable from one whose
-            // detector was down — the same absent-vs-negative distinction the withhold
-            // rule exists for, one layer up.
-            ...(detectorProduced ? { detectorProduced } : {}),
-            // Forwarded verbatim. `analyzePreAnalyzed` spreads it last with the same
-            // override semantics `analyze` documents, so this is one channel end to
-            // end rather than a second one shaped like the first.
-            ...(request.extra ? { extra: request.extra } : {}),
-            ...(includeFrame ? { jpeg: request.jpeg, evidenceId, evidenceSha256 } : {}),
+            imageWidth: request.imageWidth,
+            imageHeight: request.imageHeight,
+            analyzeMs: saved.analyzeMs,
+            promptText: saved.promptText,
+            ...(saved.detectorProduced ? { detectorProduced: saved.detectorProduced } : {}),
+            ...((request.extra || review) ? {
+                extra: { ...request.extra, ...(review ? { evidenceReview: review } : {}),
+                    ...(selectedDetectorOnly ? { selectedDetectorReview: {
+                            version: 1, selectionSha256: saved.runtimeSelectionSha256,
+                            fields: selection.fieldOwners.map(owner => owner.field), confidence: 'not_measured',
+                        } } : {}),
+                    ...(saved.analysisMethod === 'detector_counts_v1' ? { detectorCountReview: {
+                            version: 1, fields: Object.keys(saved.detectorProduced ?? {}),
+                            derivedPresenceFrom: 'person_count', confidence: 'not_measured',
+                        } } : {}),
+                    ...(saved.analysisMethod === 'scoped_detector_counts_v1' ? { mixedCountReview: {
+                            version: 1, fields: request.reviewContext.scopedVlmReview.fields.map(f => f.field),
+                            countModel: 'rfdetr_medium',
+                            countMinConfidence: request.reviewContext.scopedVlmReview.personCounts.minConfidence,
+                            confidence: 'not_measured', scopeContextSha256: saved.scopeContextSha256,
+                        } } : {}),
+                },
+            } : {}),
+            // Retained ingest accepts ownership of the original evidence, including a
+            // completed negative observation. Omitting its JPEG causes endless 400 retries.
+            ...(review ? { evidenceId, evidenceSha256 } : {}),
+            ...(this.attachEvidenceFrame && (saved.hasSignal || review) ? {
+                jpeg: request.jpeg, evidenceId, evidenceSha256,
+            } : {}),
         });
     }
 }
@@ -778,6 +1181,60 @@ function resolveMaxStreamSessionsPerSource(requested, warn = (m) => console.warn
     }
     return effective;
 }
+/** Under the connector's data root: one directory per recording feed. */
+exports.VIDEO_SEGMENTS_DIRNAME = 'video-segments';
+/**
+ * One stream, one key: scheme, host, port, path and query of an RTSP URL,
+ * WITHOUT its credentials — two feeds pointing at the same channel with
+ * different logins are one camera, and record once.
+ */
+function recordingUrlKey(rtspUrl) {
+    if (!rtspUrl)
+        return null;
+    try {
+        const u = new URL(rtspUrl);
+        const port = u.port || (u.protocol === 'rtsps:' ? '322' : u.protocol === 'rtsp:' ? '554' : '');
+        return `${u.protocol}//${u.hostname.toLowerCase()}:${port}${u.pathname}${u.search}`;
+    }
+    catch {
+        return rtspUrl;
+    }
+}
+/**
+ * A feed's video directory name: its screen id (stable across restarts and
+ * re-pairs), else a hash of its token — never the token itself.
+ */
+function videoFeedKey(feed) {
+    const screen = feed.screenId ? String(feed.screenId).replace(/[^A-Za-z0-9._-]/g, '_') : '';
+    if (screen)
+        return screen;
+    return `token-${(0, crypto_1.createHash)('sha256').update(String(feed.deviceToken)).digest('hex').slice(0, 16)}`;
+}
+let lastVideoRecordingPlan = { recordingFeeds: [], sharedUrlFeeds: [], croppedFeeds: [] };
+/** The plan `buildLocalSensingLoops` last built, for diagnostics. */
+function getVideoRecordingPlan() {
+    return {
+        recordingFeeds: [...lastVideoRecordingPlan.recordingFeeds],
+        sharedUrlFeeds: [...lastVideoRecordingPlan.sharedUrlFeeds],
+        croppedFeeds: [...lastVideoRecordingPlan.croppedFeeds],
+    };
+}
+function summarizeVideoRecordingPlan(feeds, recordingFeedByUrl) {
+    const recordingFeeds = [...recordingFeedByUrl.values()];
+    const recording = new Set(recordingFeeds);
+    const sharedUrlFeeds = [];
+    const croppedFeeds = [];
+    for (const feed of feeds) {
+        if (recording.has(feed.name))
+            continue;
+        const key = recordingUrlKey(feed.rtspUrl);
+        if (key !== null && recordingFeedByUrl.has(key))
+            sharedUrlFeeds.push(feed.name);
+        else if (feed.crop)
+            croppedFeeds.push(feed.name);
+    }
+    return { recordingFeeds, sharedUrlFeeds, croppedFeeds };
+}
 /**
  * Build per-feed capture loops for LOCAL sensing — one RTSP provider + one
  * LocalSensingClient (local VLM + preAnalyzed upload) per feed, each under its
@@ -862,12 +1319,32 @@ function buildLocalSensingLoops(config, deps) {
      * silent clamp — the same standard `formatDeployedCadence` is held to.
      */
     const maxStreamSessionsPerSource = resolveMaxStreamSessionsPerSource(config.cloudSensing?.maxStreamSessionsPerSource);
+    /**
+     * VIDEO — the same persistent session records the camera's own bitstream as
+     * MP4 segments (a stream copy: no decode, no second RTSP session), and a
+     * recorder per feed delivers them into `video_segment`.
+     *
+     * ONE recording per distinct RTSP URL. Mosaic tiles share their source's
+     * URL: the source feed's provider (built crop-less, under the source feed's
+     * own token) records, and every other feed on that URL is skipped and
+     * counted in `getVideoRecordingPlan()`. A cropped per-tile pull never
+     * records — its crop belongs to the look output, and a copy would file the
+     * whole composite under one tile's screen.
+     *
+     * Recording itself is the SERVER's call: the recorder applies the `video`
+     * knobs from this feed's sensing profile, and records nothing until the
+     * server has answered once. Segments live under the connector's data root,
+     * the one directory the Linux unit grants write access to.
+     */
+    const videoRoot = path.join((0, dataDir_1.resolveDataDir)(config.dataDir), exports.VIDEO_SEGMENTS_DIRNAME);
+    const recordingFeedByUrl = new Map();
+    const attachVideo = deps?.videoRecorderFactory === undefined ? VideoSegmentUploader_1.attachCctvVideoRecorder : deps.videoRecorderFactory;
     const rtspFactory = deps?.rtspProviderFactory ??
         ((feed) => {
             // eslint-disable-next-line @typescript-eslint/no-var-requires
             const { RTSPStreamCameraProvider } = require('@trillboards/edge-platform-rtsp');
             const legacy = (0, legacyRecorderProfile_1.legacyRecorderRtspOptions)(feed.sourceType);
-            return new RTSPStreamCameraProvider({
+            const provider = new RTSPStreamCameraProvider({
                 rtspUrl: feed.rtspUrl,
                 width: feed.width,
                 height: feed.height,
@@ -903,12 +1380,38 @@ function buildLocalSensingLoops(config, deps) {
                     outputFormat: feed.outputFormat ?? 'jpeg',
                 },
             });
+            const urlKey = recordingUrlKey(feed.rtspUrl);
+            if (attachVideo && !feed.crop && urlKey !== null && !recordingFeedByUrl.has(urlKey)) {
+                // Recording is an addition to a feed, never a condition of it: a
+                // recorder that cannot be built leaves the feed sensing exactly as before.
+                try {
+                    attachVideo({
+                        provider,
+                        dir: path.join(videoRoot, videoFeedKey(feed)),
+                        feedName: feed.name,
+                        apiBaseUrl: config.apiBaseUrl,
+                        deviceToken: feed.deviceToken,
+                        // The same cadence the local profile cache refetches on.
+                        pollMs: DEFAULT_PROFILE_TTL_MS,
+                        ...(deps?.httpPoster ? { httpPoster: deps.httpPoster } : {}),
+                    });
+                    recordingFeedByUrl.set(urlKey, feed.name);
+                }
+                catch (err) {
+                    console.warn(`[video] ${feed.name}: recording not attached: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            return provider;
         });
     const localProviderFactory = deps?.localProviderFactory ??
         (() => new LiteRtVlmProvider_1.LiteRtVlmProvider({ litertLmBaseUrl, model, accelerator }));
+    const reviewOptions = config.cloudSensing?.candidateBuffer?.continuousReview;
+    const retainedApiBaseUrl = (0, continuousReview_1.retainedReviewApiBase)(reviewOptions, config.apiBaseUrl);
     const uploadClientFactory = deps?.uploadClientFactory ??
         ((feed) => new AudienceAnalyzeClient_1.AudienceAnalyzeClient({
-            apiBaseUrl: config.apiBaseUrl,
+            apiBaseUrl: config.cloudSensing?.candidateBuffer?.continuousReview?.enabled
+                ? retainedApiBaseUrl ?? config.cloudSensing.candidateBuffer.continuousReview.receiverUrl ?? continuousReview_1.DEFAULT_LOCAL_REVIEW_RECEIVER_URL
+                : config.apiBaseUrl,
             deviceToken: feed.deviceToken,
             screenId: feed.screenId,
             imageWidth: feed.width,
@@ -922,7 +1425,7 @@ function buildLocalSensingLoops(config, deps) {
     // a single shared pull + crops each tile, so local-sense honors mosaic configs
     // identically to cloud-sense. `sharedSources` lets the VLM attach to the SAME
     // pull the on-device zoo uses (combined-sense), so one RTSP pull feeds both.
-    return (0, CloudSensingManager_1.buildTiledCameras)(feeds, rtspFactory, {
+    const tiled = (0, CloudSensingManager_1.buildTiledCameras)(feeds, rtspFactory, {
         sharedSources: deps?.sharedSources,
         // A MOSAIC TILE MUST NOT SILENTLY KEEP THE OLD CADENCE.
         //
@@ -944,12 +1447,34 @@ function buildLocalSensingLoops(config, deps) {
         // pulls remain bounded by `CaptureAdmission` (2 per physical recorder) —
         // a recorder-scoped bound, which is the one that was doing the protecting.
         sharedFrameMaxAgeMs: (0, connectorCadence_1.lookIntervalMsForFeedCount)(feeds.length, 'persistent') ?? connectorCadence_1.LOOK_INTERVAL_MS,
-    }).map(({ feed, camera }) => ({
+    });
+    // Only the default factory records, so only its build has a plan to report.
+    if (!deps?.rtspProviderFactory) {
+        lastVideoRecordingPlan = summarizeVideoRecordingPlan(feeds, recordingFeedByUrl);
+        if (attachVideo) {
+            const plan = lastVideoRecordingPlan;
+            console.log(`[video] ${plan.recordingFeeds.length} feed(s) can record (one per RTSP URL); ` +
+                `${plan.sharedUrlFeeds.length} share a recorded URL; ${plan.croppedFeeds.length} cropped tile(s) without one. ` +
+                'Recording follows the server\'s video knobs.');
+        }
+    }
+    return tiled.map(({ feed, camera }) => ({
         name: feed.name,
         camera,
         client: new LocalSensingClient(localProviderFactory(feed), uploadClientFactory(feed), {
+            websiteManagedProfiles: deps?.websiteManagedProfiles,
+            retainedApiBaseUrl,
             profileClient: profileClientFactory(feed),
             attachEvidenceFrame,
+            detectorFieldProducerOptions: deps?.detectorFieldProducerOptions,
+            detectorCounts: config.cloudSensing?.candidateBuffer?.continuousReview?.enabled === true
+                && config.cloudSensing.candidateBuffer.continuousReview.detectorCounts === true,
+            scopedVlmReview: config.cloudSensing?.candidateBuffer?.continuousReview?.enabled === true
+                && config.cloudSensing.candidateBuffer.continuousReview.scopedVlmReview === true,
+            overlapMixedReview: config.cloudSensing?.candidateBuffer?.continuousReview?.enabled === true
+                && config.cloudSensing.candidateBuffer.continuousReview.overlapMixedReview === true,
+            declaredProfileReview: config.cloudSensing?.candidateBuffer?.continuousReview?.enabled === true
+                && config.cloudSensing.candidateBuffer.continuousReview.declaredProfileReview === true,
         }),
     }));
 }