camstack 1.2.144 → 1.2.146

package/dist/{launcher-25V2QKN6.js → launcher-L5YPTDNE.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-DdRxWA7g.js
-var require_dist_DdRxWA7g = __commonJS({
-  "../system/dist/dist-DdRxWA7g.js"(exports) {
+// ../system/dist/dist-DUSfUAgz.js
+var require_dist_DUSfUAgz = __commonJS({
+  "../system/dist/dist-DUSfUAgz.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -25845,6 +25845,13 @@ var require_dist_DdRxWA7g = __commonJS({
       if (typeof err === "string") return err;
       return String(err);
     }
+    var EVENT_OWNER_TYPES = [
+      "motion",
+      "object",
+      "audio"
+    ];
+    var EventOwnerTypeSchema = zod.z.enum(EVENT_OWNER_TYPES);
+    new Set(EVENT_OWNER_TYPES);
     var VideoEncodeSchema = zod.z.object({
       codec: zod.z.enum([
         "h264",
@@ -25882,7 +25889,23 @@ var require_dist_DdRxWA7g = __commonJS({
         "zerolatency",
         "film",
         "animation"
-      ]).optional()
+      ]).optional(),
+      /**
+      * ONE slice per access unit.
+      *
+      * `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+      * the encoder as five NAL slices that share one RTP timestamp and carry one
+      * marker bit. A libwebrtc depacketiser sees five frame-starts and one
+      * frame-end per frame: the first pictures render and the video then freezes
+      * for good while the audio, on its own plane, plays on. Measured on this hub
+      * 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+      *
+      * A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+      * `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+      * consumers meaning the same thing spelled differently would stop sharing one
+      * child. Absent means "whatever the encoder does" — today's behaviour.
+      */
+      singleSlicePerFrame: zod.z.boolean().optional()
     });
     var AudioEncodeSchema = zod.z.union([zod.z.literal("passthrough"), zod.z.object({
       codec: zod.z.enum([
@@ -25930,7 +25953,7 @@ var require_dist_DdRxWA7g = __commonJS({
       audio: "passthrough"
     };
     ({ ...BASE_LIVE_EGRESS_PROFILE }, { ...BASE_LIVE_EGRESS_PROFILE.video });
-    ({ ...BASE_LIVE_EGRESS_PROFILE });
+    ({ ...BASE_LIVE_EGRESS_PROFILE }, { ...BASE_LIVE_EGRESS_PROFILE.video });
     var wiringProbeKindSchema = zod.z.enum([
       "singleton",
       "device",
@@ -30739,6 +30762,60 @@ var require_dist_DdRxWA7g = __commonJS({
           filter: QueryFilterSchema.optional(),
           columns: zod.z.array(zod.z.string()).readonly().optional()
         }), zod.z.array(SettingsRecordSchema).readonly()),
+        /**
+        * Make a SLOT hold this row — insert it, or update whatever already
+        * occupies the slot — and answer with the id the row HAS.
+        *
+        * ## Why the store needed this
+        *
+        * {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+        * caller has to know the id to address the row. That is exactly what a
+        * collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+        * the id, so a writer whose uniqueness rule is "one row per
+        * `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+        * express the rule. {@link insert} can express it (a UNIQUE index
+        * arbitrates) but only by THROWING at the loser of a race, and the loser
+        * here is a legitimate re-capture, not an error.
+        *
+        * Getting there without this method means read-then-write: query the slot,
+        * then `insert` or `update`. Two statements instead of one, a race between
+        * them, and a recovery path that has to recognise a UNIQUE violation by its
+        * MESSAGE — across a process boundary, because the store lives behind an
+        * RPC door. A string match would be the whole gate, and a store that
+        * rephrased its error would lose the row silently. One statement has no
+        * such gate (D482).
+        *
+        * ## The contract
+        *
+        * `conflict` names the DECLARED columns that identify the slot. They must
+        * be covered by a UNIQUE index on the collection — SQLite resolves an
+        * `ON CONFLICT` target against its indexes and REFUSES the statement when
+        * none matches, so a wrong list is a loud error on the first write, never a
+        * silently duplicated row. An empty list is refused rather than passed on:
+        * `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+        * encode ("no slot, just insert") is {@link insert}.
+        *
+        * Row shape is {@link insert}'s: `record.id` is used when the collection
+        * needs a supplied key and IGNORED when the primary key is an `INTEGER`
+        * rowid alias — exactly as `insert` and `insertMany` already treat it.
+        *
+        * Returns the id either way: the one SQLite assigned on an insert, or the
+        * one the row it updated already had. A caller cannot tell which happened,
+        * and deliberately — every caller wants the slot's id, and one that needed
+        * to distinguish creation from replacement would have to read first anyway.
+        */
+        upsert: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          /** Declared columns identifying the slot; must be covered by a UNIQUE
+          *  index on the collection. Never empty. */
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({
+          /** The id the row HAS: assigned by SQLite on an insert, or the existing
+          *  row's own id on an update. */
+          id: zod.z.union([zod.z.string(), zod.z.number()])
+        }), { kind: "mutation" }),
         /** Insert a new record. */
         insert: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -30982,6 +31059,20 @@ var require_dist_DdRxWA7g = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * Make a slot hold this row, and answer with the id the row HAS. The
+        * engine half of `settings-store.upsert` — read that docblock for why the
+        * store needed a slot that is not the primary key (D482).
+        */
+        upsert: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Insert many records in ONE transaction. All or nothing. */
         insertMany: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -37311,8 +37402,8 @@ var require_dist_DdRxWA7g = __commonJS({
     var TrackSnapshotSchema = zod.z.object({
       timestamp: zod.z.number(),
       position: TrackPositionSchema,
-      /** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-      mediaKey: zod.z.string()
+      /** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+      mediaId: zod.z.number().int()
     });
     var TrackEnvelopeSchema = zod.z.object({
       minX: zod.z.number(),
@@ -37751,14 +37842,14 @@ var require_dist_DdRxWA7g = __commonJS({
       *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
       frameWidth: zod.z.number().optional(),
       frameHeight: zod.z.number().optional(),
-      /** MediaStore key for the crop attached to this event (if any). */
-      mediaKey: zod.z.string().optional(),
-      /** Design B: MediaStore key of the track's native-resolution key frame (the
+      /** Media row id of the crop attached to this event (if any) — D482. */
+      mediaId: zod.z.number().int().optional(),
+      /** Design B: media row id of the track's native-resolution key frame (the
       *  best-detection full frame). Resolve via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
       *  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-      *  sources — consumers fall back to `mediaKey` (the tight crop). */
-      keyFrameMediaKey: zod.z.string().optional(),
+      *  sources — consumers fall back to `mediaId` (the tight crop). */
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Populated by B5 (recording playback URL for this event). */
       mediaUrl: zod.z.string().optional(),
       /** The parent track's key-event importance [0,1], propagated to every object
@@ -37795,7 +37886,19 @@ var require_dist_DdRxWA7g = __commonJS({
       "sceneFrame"
     ]);
     var MediaFileSchema = zod.z.object({
-      key: zod.z.string(),
+      /**
+      * The media row's OWN id — the rowid SQLite assigned it (D482).
+      *
+      * It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+      * [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+      * per-table rowid aliases, so `object:101314` and `motion:101314` are two
+      * different rows that spell the same number, and a track whose
+      * `bestEventId` was an object event was served a motion event's snapshot —
+      * a night-time thumbnail on an afternoon track, with no error anywhere. A
+      * surrogate id cannot name the wrong row's owner, because it names no owner
+      * at all.
+      */
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
@@ -37862,7 +37965,7 @@ var require_dist_DdRxWA7g = __commonJS({
       annotationCount: zod.z.number().int()
     });
     var RetrainFrameCandidateSchema = zod.z.object({
-      mediaKey: zod.z.string(),
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       timestamp: zod.z.number(),
       sizeBytes: zod.z.number().int(),
@@ -37875,7 +37978,7 @@ var require_dist_DdRxWA7g = __commonJS({
       deviceId: zod.z.number(),
       trackId: zod.z.string(),
       /** Provenance only. It may already point at nothing — that is expected. */
-      sourceMediaKey: zod.z.string(),
+      sourceMediaId: zod.z.number().int(),
       sourceKind: MediaFileKindEnum,
       sizeBytes: zod.z.number().int(),
       width: zod.z.number().int(),
@@ -37890,7 +37993,7 @@ var require_dist_DdRxWA7g = __commonJS({
     var RetrainFrameSelectionSchema = zod.z.object({
       copied: zod.z.array(RetrainFrameSchema).readonly(),
       refused: zod.z.array(zod.z.object({
-        sourceMediaKey: zod.z.string(),
+        sourceMediaId: zod.z.number().int(),
         reason: RetrainCopyRefusalSchema
       })).readonly()
     });
@@ -37898,7 +38001,7 @@ var require_dist_DdRxWA7g = __commonJS({
       candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
       copies: zod.z.array(RetrainFrameSchema).readonly(),
       /** What the page pre-selects — the native key frame when one survives. */
-      autoPickMediaKey: zod.z.string().optional()
+      autoPickMediaId: zod.z.number().int().optional()
     });
     var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
       kind: zod.z.literal("package"),
@@ -37991,19 +38094,97 @@ var require_dist_DdRxWA7g = __commonJS({
       lastActiveAt: zod.z.number(),
       sealedAt: zod.z.number().nullable(),
       memberCount: zod.z.number().int().nonnegative(),
-      groupShotKey: zod.z.string().nullable()
+      groupShotMediaId: zod.z.number().int().nullable()
     });
     var SummariesQueryInput = zod.z.object({
       deviceIds: zod.z.array(zod.z.number()).min(1),
       since: zod.z.number().optional(),
       until: zod.z.number().optional(),
-      limit: zod.z.number().int().min(1).max(200).default(50)
+      limit: zod.z.number().int().min(1).max(200).default(50),
+      /** The same member-wise filter {@link listRecentSummaries} takes — one
+      *  meaning of "dog" on every summary surface. */
+      classes: zod.z.array(zod.z.string().min(1).max(60)).max(40).optional()
+    });
+    var SummaryMemberSchema = zod.z.object({
+      trackId: zod.z.string(),
+      /**
+      * The track's class at the time it JOINED, or `null` when it was unresolved
+      * and the track no longer exists to fill it.
+      *
+      * The join, not the latest opinion: class voting can re-decide a track's
+      * class afterwards, and a group's composition is the history of who came
+      * together. A consumer counts these to badge a thumbnail — "two people and a
+      * dog" — rather than being handed a second, denormalised tally that would
+      * drift from the members it claims to describe.
+      */
+      className: zod.z.string().nullable(),
+      /** `primary` is the one member that carries the group's identity. */
+      role: zod.z.enum([
+        "primary",
+        "sibling",
+        "child"
+      ]).nullable(),
+      joinedAt: zod.z.number(),
+      /** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+      *  at read time. Absent when nothing resolved, never an empty string. */
+      label: zod.z.string().optional(),
+      /** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+      *  recognised nobody, and absent for a member whose track has been pruned —
+      *  a thumbnail that names the wrong person is worse than one naming nobody. */
+      subLabel: zod.z.string().optional()
     });
-    var SummariesPageSchema = zod.z.object({ summaries: zod.z.array(SummarySchema).readonly() });
     var SummaryDetailSchema = zod.z.object({
       summary: SummarySchema,
-      /** Member track ids, in absorption order. */
-      trackIds: zod.z.array(zod.z.string()).readonly()
+      /** Members in absorption order, oldest join first. */
+      members: zod.z.array(SummaryMemberSchema).readonly()
+    });
+    var SummaryListItemSchema = zod.z.object({
+      summary: SummarySchema,
+      /** Class counts, most numerous first; `className: null` is a member whose
+      *  class never resolved, counted so the counts add up to `memberCount`. */
+      classes: zod.z.array(zod.z.object({
+        className: zod.z.string().nullable(),
+        count: zod.z.number().int().positive()
+      })).readonly()
+    });
+    var SummariesPageSchema = zod.z.object({ summaries: zod.z.array(SummaryListItemSchema).readonly() });
+    var RecentSummariesQueryInput = zod.z.object({
+      /** Devices to merge. An empty array yields an empty page. */
+      deviceIds: zod.z.array(zod.z.number()),
+      /** Window lower bound on `lastActiveAt` (inclusive). */
+      since: zod.z.number().optional(),
+      /** Window upper bound on `lastActiveAt` (inclusive). */
+      until: zod.z.number().optional(),
+      limit: zod.z.number().int().min(1).max(500).default(100),
+      /** Opaque continuation cursor from a previous page's `nextCursor`. */
+      cursor: zod.z.string().optional(),
+      /**
+      * Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+      * deliberately the same name: the events filter tree emits one list of ticked
+      * taxonomy nodes, and a summaries feed that called it something else would
+      * make the operator's one filter component produce two shapes.
+      *
+      * A question about the MEMBERS: a group matches when ANY of them does. "Show
+      * me the arrivals with a dog" has to return the group of four people who had
+      * one with them; a filter on the group's own fields could only ever answer
+      * about its primary.
+      *
+      * Matched against all THREE tiers of a member — the class (`animal`), the
+      * sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+      * ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+      * an event kind in the tree and a tier-1 label on an `animal` track; a filter
+      * that read only the class would answer "animal" and never "dog".
+      *
+      * ABSENT or EMPTY means no filter — absent is not a selection of none.
+      */
+      classes: zod.z.array(zod.z.string().min(1).max(60)).max(40).optional()
+    });
+    var RecentSummariesPageSchema = zod.z.object({
+      /** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+      *  {@link listSummaries} — one list shape, so a card renders the same
+      *  whichever feed drew it. */
+      summaries: zod.z.array(SummaryListItemSchema).readonly(),
+      nextCursor: zod.z.string().nullable()
     });
     var RecentTracksPageSchema = zod.z.object({
       /** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -38355,6 +38536,11 @@ var require_dist_DdRxWA7g = __commonJS({
         listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
         /** Newest first by `openedAt`, for a camera set, inside an optional window. */
         listSummaries: method(SummariesQueryInput, SummariesPageSchema),
+        /**
+        * The PAGED feed — the reel and the Events gallery. Same cursor contract as
+        * {@link listRecentTracks}, so one screen cannot hold two ideas of newest.
+        */
+        listRecentSummaries: method(RecentSummariesQueryInput, RecentSummariesPageSchema),
         /** One summary with its member track ids; `null` for an id nobody wrote. */
         getSummary: method(zod.z.object({ id: zod.z.string() }), SummaryDetailSchema.nullable()),
         clearTracks: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
@@ -38884,7 +39070,7 @@ var require_dist_DdRxWA7g = __commonJS({
         selectRetrainFrames: method(zod.z.object({
           deviceId: zod.z.number(),
           trackId: zod.z.string(),
-          mediaKeys: zod.z.array(zod.z.string()).min(1)
+          mediaIds: zod.z.array(zod.z.number().int()).min(1)
         }), RetrainFrameSelectionSchema, {
           kind: "mutation",
           auth: "admin"
@@ -39048,8 +39234,29 @@ var require_dist_DdRxWA7g = __commonJS({
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * The media an EVENT owns.
+        *
+        * `ownerType` is REQUIRED, and that is the whole correction (D482). An
+        * event is a row in ONE of three tables, and since D474 each numbers from
+        * 1 independently: `motion:101314` and `object:101314` both exist. This
+        * method took a bare `eventId` and the provider probed motion → object →
+        * audio, stopping at the first hit — so on the live hub, where object
+        * events own no media of their own and 299 883 of 300 559 media rows are
+        * motion-owned, EVERY object event resolved to its motion namesake. A
+        * track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
+        * days earlier, silently.
+        *
+        * D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
+        * the API catching up to it. Naming the table is not a "qualification" of
+        * the ambiguity — a listing BY OWNER has no address to make surrogate: the
+        * owner IS (table, id), and half of it is not a question.
+        */
         getEventMedia: method(zod.z.object({
-          eventId: zod.z.string(),
+          /** Which of the three event tables owns the row. */
+          ownerType: EventOwnerTypeSchema,
+          /** The event's rowid in that table (D474: an event id is a number). */
+          eventId: zod.z.number().int(),
           kind: MediaFileKindEnum.optional(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileSchema).readonly()),
@@ -39094,11 +39301,14 @@ var require_dist_DdRxWA7g = __commonJS({
         * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
         * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
         *
-        * Same `deviceId` authorization subject as `getEventMedia`, and the same
-        * rows — this is a projection of that method, never a different question.
+        * Same `deviceId` authorization subject as `getEventMedia`, the same
+        * REQUIRED `ownerType` (read that method's docblock for the night-time
+        * thumbnail this closes — D482), and the same rows: this is a projection
+        * of that method, never a different question.
         */
         listEventMedia: method(zod.z.object({
-          eventId: zod.z.string(),
+          ownerType: EventOwnerTypeSchema,
+          eventId: zod.z.number().int(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
@@ -44602,8 +44812,8 @@ var require_dist_DdRxWA7g = __commonJS({
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
       *  Lets the UI render the person's face avatar instead of a placeholder icon. */
       coverBase64: zod.z.string().optional()
     });
@@ -44619,8 +44829,8 @@ var require_dist_DdRxWA7g = __commonJS({
       enrolledAt: zod.z.number().int(),
       deviceId: zod.z.number().int().optional(),
       source: zod.z.enum(["detected", "photo"]),
-      /** The enrolled crop's media key, so the panel can show the evidence. */
-      mediaKey: zod.z.string().optional(),
+      /** The enrolled crop's media row id, so the panel can show the evidence. */
+      mediaId: zod.z.number().int().optional(),
       /**
       * False = the sample is stamped with a DIFFERENT face model, and a cosine
       * across feature spaces is a well-formed float with no meaning. Every number
@@ -44689,15 +44899,15 @@ var require_dist_DdRxWA7g = __commonJS({
       */
       cropUrl: zod.z.string().optional(),
       /** Design B: the face bbox (pixel space) on the key frame — lets a detail
-      *  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+      *  view draw the box over the native `keyFrameMediaId` frame. Absent on
       *  legacy rows written before design B. */
       faceBbox: BoundingBoxSchema.optional(),
       /** Design B: MediaStore key of the track's native-resolution key frame.
       *  Fetch the native JPEG via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
       *  track produced no key frame (e.g. native/onboard source) — the UI falls
       *  back to the inline `base64` face crop. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Winning identity-match cosine (0..1) for this face's track, when an
       *  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
       *  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -44735,7 +44945,9 @@ var require_dist_DdRxWA7g = __commonJS({
       cohesion: zod.z.number()
     });
     var MediaFileLiteSchema$1 = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -44757,7 +44969,7 @@ var require_dist_DdRxWA7g = __commonJS({
           * covers inline, ~10 KB of base64 per row, on a query this UI mounts
           * four times and the viewer holds at `staleTime: 30_000`.
           *
-          * Nothing loses its avatar: `coverMediaKey` is already on every row and
+          * Nothing loses its avatar: `coverMediaId` is already on every row and
           * the `event-media` plane serves that key `immutable` with an ETag.
           *
           * **This is an INPUT field, so it does not reach the addon until the
@@ -47885,8 +48097,8 @@ var require_dist_DdRxWA7g = __commonJS({
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
       coverBase64: zod.z.string().optional()
     });
     var VehicleSampleInfoSchema = zod.z.object({
@@ -47919,7 +48131,7 @@ var require_dist_DdRxWA7g = __commonJS({
       /** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
       plateBbox: BoundingBoxSchema.optional(),
       /** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       base64: zod.z.string().optional(),
       /**
       * Same crop as a data-plane URL, always present when the plate has a stored
@@ -47930,7 +48142,9 @@ var require_dist_DdRxWA7g = __commonJS({
       cropUrl: zod.z.string().optional()
     });
     var MediaFileLiteSchema = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -48004,7 +48218,7 @@ var require_dist_DdRxWA7g = __commonJS({
         listVehicles: method(zod.z.object({
           /** Inline {@link VehicleSchema.coverBase64} on every row. Default
           *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-          *  option; `coverMediaKey` + the `event-media` plane carry the picture.
+          *  option; `coverMediaId` + the `event-media` plane carry the picture.
           *  INPUT field: stripped by the hub router until the train ships, which
           *  resolves to `false` and is exactly the intended default. */
           includeCrops: zod.z.boolean().optional()
@@ -49501,7 +49715,14 @@ var require_dist_DdRxWA7g = __commonJS({
       modelId: zod.z.string(),
       condition: SceneConditionSchema,
       capturedAt: zod.z.number(),
-      thumbnailMediaId: zod.z.string().optional(),
+      /**
+      * The reference thumbnail's media ROW id (D482).
+      *
+      * The name already said `mediaId` while the value was the row's composite
+      * key — a leftover that read as done and was not. It is the row's own id
+      * now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+      */
+      thumbnailMediaId: zod.z.number().int().optional(),
       /** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
       *  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
       *  normalized rect frame a different piece of world, and the scene would
@@ -50561,7 +50782,29 @@ var require_dist_DdRxWA7g = __commonJS({
       * disarmed the channels it did not mention would make the Levels page and
       * the Diagnostics page fight over the same value.
       */
-      channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
+      channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional(),
+      /**
+      * How many days the analytics OPS LOG is kept — the audit trail of what
+      * retention actually deleted.
+      *
+      * It lives HERE, on the logging document, and not on the analytics addon's
+      * settings form, on the operator's instruction: every other log-ish window in
+      * this system is configured through this one document, and a retention audit
+      * configured somewhere else is a second place to look when the question is
+      * "what happened to my data".
+      *
+      * That placement has a cost worth stating: this document ships in the
+      * framework closure, so this knob needs a published `@camstack/server` while
+      * the four windows beside it (D485) reach a node on `camstack deploy`.
+      *
+      * `retention-model.ts` argued this one must NOT follow a device window,
+      * because the audit trail is the history of the SWEEP and not of the camera.
+      * That argument stands and is untouched — what changes is that 30 days stops
+      * being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+      * rather than 0-as-delete: an audit log truncated to nothing is precisely the
+      * state in which the next 9.5 GiB leak cannot be explained.
+      */
+      opsLogRetentionDays: zod.z.number().int().min(0).max(3650).optional()
     });
     var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: zod.z.string() });
     var ReportedFailureContributionSchema = FailureContributionSchema.extend({ addonId: zod.z.string() });
@@ -50600,6 +50843,14 @@ var require_dist_DdRxWA7g = __commonJS({
       channels: zod.z.array(LogChannelDescriptorSchema).readonly(),
       /** The channels ARMED right now, each with its deadline. */
       activeChannels: zod.z.array(LogChannelWindowStateSchema).readonly(),
+      /**
+      * The ops-log window in days, as it is in force. `0` = kept forever.
+      *
+      * Reported rather than left to the caller's memory of what it wrote: this is
+      * the value the analytics sweep will actually use, and an operator asking how
+      * long their audit trail lives should not have to infer it from a default.
+      */
+      opsLogRetentionDays: zod.z.number().int().min(0),
       persisted: zod.z.boolean()
     });
     var systemCapability = {
@@ -51423,7 +51674,7 @@ var require_dist_DdRxWA7g = __commonJS({
       /** Enrichment label carried from the source track (identity / plate). */
       label: zod.z.string().optional(),
       /** Native-resolution key-frame media key for the parked object's best image. */
-      keyFrameMediaKey: zod.z.string().optional()
+      keyFrameMediaId: zod.z.number().int().optional()
     });
     var CameraOccupancySnapshotSchema = zod.z.object({
       /** Frame timestamp of the inference result that produced this snapshot. */
@@ -53287,6 +53538,12 @@ var require_dist_DdRxWA7g = __commonJS({
         addonId: null,
         access: "create"
       },
+      "dataStoreProvider.upsert": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "dayNight.getOptions": {
         capName: "day-night",
         capScope: "device",
@@ -55723,6 +55980,12 @@ var require_dist_DdRxWA7g = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listRecentSummaries": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listRecentTracks": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -57151,6 +57414,12 @@ var require_dist_DdRxWA7g = __commonJS({
         addonId: null,
         access: "create"
       },
+      "settingsStore.upsert": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "smtpProvider.getStatus": {
         capName: "smtp-provider",
         capScope: "system",
@@ -59544,6 +59813,11 @@ var require_dist_DdRxWA7g = __commonJS({
         form: "single",
         optional: true
       }],
+      "pipelineAnalytics.listRecentSummaries": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "pipelineAnalytics.listRecentTracks": [{
         name: "deviceIds",
         form: "array",
@@ -61865,7 +62139,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -62684,7 +62958,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -62778,7 +63052,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -63675,11 +63949,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-C-jOWHI0.js
-var require_retired_settings_keys_C_jOWHI0 = __commonJS({
-  "../system/dist/retired-settings-keys-C-jOWHI0.js"(exports) {
+// ../system/dist/retired-settings-keys-D61PxN8L.js
+var require_retired_settings_keys_D61PxN8L = __commonJS({
+  "../system/dist/retired-settings-keys-D61PxN8L.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63959,9 +64233,9 @@ var require_retired_settings_keys_C_jOWHI0 = __commonJS({
   }
 });
 
-// ../types/dist/canonical-hash-DNV8S5ET.js
-var require_canonical_hash_DNV8S5ET = __commonJS({
-  "../types/dist/canonical-hash-DNV8S5ET.js"(exports) {
+// ../types/dist/canonical-hash-9lydiEzx.js
+var require_canonical_hash_9lydiEzx = __commonJS({
+  "../types/dist/canonical-hash-9lydiEzx.js"(exports) {
     "use strict";
     var node_crypto = __require("crypto");
     var AUDIO_ENCODER_BY_CODEC = {
@@ -64048,6 +64322,7 @@ var require_canonical_hash_DNV8S5ET = __commonJS({
       ];
       if (video.preset !== void 0) args.push("-preset", video.preset);
       if (video.tune !== void 0) args.push("-tune", video.tune);
+      if (video.singleSlicePerFrame === true && video.encoder === "libx264") args.push("-x264-params", "sliced-threads=0");
       if (video.profile !== void 0) args.push("-profile:v", video.profile);
       if (video.level !== void 0) args.push("-level", video.level);
       if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
@@ -64231,6 +64506,7 @@ var require_canonical_hash_DNV8S5ET = __commonJS({
         scale,
         ...v.preset !== void 0 ? { preset: v.preset } : {},
         ...v.tune !== void 0 ? { tune: v.tune } : {},
+        ...v.singleSlicePerFrame !== void 0 ? { singleSlicePerFrame: v.singleSlicePerFrame } : {},
         ...v.profile !== void 0 ? { profile: v.profile } : {},
         ...v.level !== void 0 ? { level: v.level } : {},
         ...input.pixelFormat !== void 0 ? { pixelFormat: input.pixelFormat } : {},
@@ -64561,7 +64837,7 @@ var require_node = __commonJS({
       value: mod,
       enumerable: true
     }) : target, mod));
-    var require_canonical_hash = require_canonical_hash_DNV8S5ET();
+    var require_canonical_hash = require_canonical_hash_9lydiEzx();
     var require_err_msg = require_err_msg_COpsHMw2();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
@@ -65914,8 +66190,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
-    var require_retired_settings_keys = require_retired_settings_keys_C_jOWHI0();
+    var require_dist10 = require_dist_DUSfUAgz();
+    var require_retired_settings_keys = require_retired_settings_keys_D61PxN8L();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -71540,7 +71816,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -71677,7 +71953,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -71873,7 +72149,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -79686,7 +79962,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -80273,7 +80549,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var node_fs_promises = __require("fs/promises");
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
@@ -83026,7 +83302,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -84253,8 +84529,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
-    var require_retired_settings_keys = require_retired_settings_keys_C_jOWHI0();
+    var require_dist10 = require_dist_DUSfUAgz();
+    var require_retired_settings_keys = require_retired_settings_keys_D61PxN8L();
     var require_wal_checkpoint_policy = require_wal_checkpoint_policy_CCJZngds();
     var node_crypto = __require("crypto");
     var node_path = __require("path");
@@ -85082,6 +85358,54 @@ var require_sqlite_settings_addon = __commonJS({
         return { id: suppliedOrMinted ?? Number(rowid) };
       }
       /**
+      * Make a SLOT hold this row, and answer with the id the row HAS — one
+      * statement, `INSERT … ON CONFLICT(<slot>) DO UPDATE … RETURNING <pk>`.
+      *
+      * See `settings-store.cap.ts`'s `upsert` docblock for why the store needed a
+      * slot that is not the primary key (D482). Three things are load-bearing
+      * here:
+      *
+      *  - **`RETURNING` and not `lastInsertRowid`.** On the UPDATE branch
+      *    `lastInsertRowid` is whatever the connection last inserted — a
+      *    different row, or a different TABLE. It answers confidently and wrongly,
+      *    which is worse than not answering. `RETURNING` names the row this
+      *    statement actually touched, on both branches.
+      *  - **The conflict columns are checked against the declaration** before they
+      *    reach the SQL. An undeclared name would be interpolated into DDL-shaped
+      *    text; it is refused, by the same rule and for the same reason
+      *    {@link resolveProjection} throws on an unprojectable column.
+      *  - **The primary key is never part of the SET list.** An `INTEGER` rowid
+      *    alias is not in `row` at all, and on a TEXT key rewriting the id of the
+      *    row we just matched is the one update that cannot be right.
+      */
+      async upsert({ namespace, collection, conflict, record }) {
+        const scoped = this.scopedName(namespace, collection);
+        const decl = this.requireDeclared(scoped);
+        if (conflict.length === 0) throw new UnprojectableColumnError(`upsert on "${scoped}" was given an EMPTY conflict target \u2014 "ON CONFLICT()" is not valid SQL, and "no slot, just insert" is insert()`);
+        const unknownCols = conflict.filter((name) => !decl.columns.has(name) && name !== decl.primaryKey);
+        if (unknownCols.length > 0) throw new UnprojectableColumnError(`upsert on "${scoped}" names conflict column(s) the collection does not declare: ${unknownCols.join(", ")}`);
+        const suppliedOrMinted = decl.autoPrimaryKey ? null : record.id || (0, node_crypto.randomUUID)();
+        const row = decl.autoPrimaryKey ? {} : { [decl.primaryKey]: suppliedOrMinted };
+        if (decl.columns.size === 1 && decl.columns.has("data")) row["data"] = JSON.stringify(record.data);
+        else for (const [k, v] of Object.entries(record.data)) if (decl.columns.has(k)) row[k] = this.serializeColumnValue(v);
+        const keys = Object.keys(row);
+        const cols = keys.map((k) => `"${k}"`).join(", ");
+        const placeholders = keys.map(() => "?").join(", ");
+        const target = conflict.map((k) => `"${k}"`).join(", ");
+        const updates = keys.filter((k) => k !== decl.primaryKey && !conflict.includes(k)).map((k) => `"${k}" = excluded."${k}"`);
+        const sql = `INSERT INTO "${scoped}" (${cols}) VALUES (${placeholders}) ON CONFLICT(${target}) DO UPDATE SET ${updates.length > 0 ? updates.join(", ") : `"${conflict[0]}" = excluded."${conflict[0]}"`} RETURNING "${decl.primaryKey}"`;
+        const values = keys.map((k) => row[k] ?? null);
+        const id = this.measured({
+          op: "upsert",
+          collection: scoped,
+          sql,
+          params: values
+        }, () => this.getDb().prepare(sql).get(...values))?.[decl.primaryKey];
+        if (typeof id === "number" || typeof id === "bigint") return { id: Number(id) };
+        if (typeof id === "string") return { id };
+        throw new Error(`upsert on "${scoped}" returned no row \u2014 the ON CONFLICT target (${target}) resolved to no unique index, or the write was rejected`);
+      }
+      /**
       * Insert a batch in ONE transaction, on ONE prepared statement.
       *
       * The write-side twin of {@link deleteWhere}. Every row in the batch shares
@@ -86993,7 +87317,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -88030,6 +88354,7 @@ var require_storage_orchestrator_addon = __commonJS({
         set: async (input) => (await engine()).set(input),
         query: async (input) => (await engine()).query(input),
         insert: async (input) => (await engine()).insert(input),
+        upsert: async (input) => (await engine()).upsert(input),
         insertMany: async (input) => (await engine()).insertMany(input),
         update: async (input) => (await engine()).update(input),
         delete: async (input) => (await engine()).delete(input),
@@ -88177,6 +88502,7 @@ var require_storage_orchestrator_addon = __commonJS({
         set: (input) => send("set", input),
         query: (input) => send("query", input),
         insert: (input) => send("insert", input),
+        upsert: (input) => send("upsert", input),
         insertMany: (input) => send("insertMany", input),
         update: (input) => send("update", input),
         delete: (input) => send("delete", input),
@@ -88336,6 +88662,57 @@ var require_storage_orchestrator_addon = __commonJS({
       const percent = require_dist10.gbToBytes(minFreeGb) / totalBytes * 100;
       return Math.min(100, percent);
     }
+    function unknown(reason) {
+      return {
+        kind: "unknown",
+        reason
+      };
+    }
+    function freePercentOf(capacity) {
+      if (capacity === null || capacity.totalBytes <= 0) return 100;
+      return capacity.availableBytes / capacity.totalBytes * 100;
+    }
+    function volumeTotalBytesOf(capacity) {
+      return capacity === null ? 0 : capacity.totalBytes;
+    }
+    function probePathFor(location, locality, localNodeId, cwd) {
+      if (locality !== true) {
+        const why = locality === false ? `is served by the remote provider "${location.providerId}" (nodeLocal: false) \u2014 its bytes live on the remote host and no local statfs describes them` : `is served by "${location.providerId}", which this node has not classified yet (no getProviderInfo answer) \u2014 a local statfs would be a guess`;
+        return { reason: `location "${location.id}" ${why}` };
+      }
+      if (location.nodeId !== void 0 && location.nodeId !== localNodeId) return { reason: `location "${location.id}" lives on node "${location.nodeId}" and this is "${localNodeId}" \u2014 only the owning node can statfs its own volumes` };
+      const basePath = location.config["basePath"];
+      if (typeof basePath !== "string" || basePath.length === 0) return { reason: `location "${location.id}" declares no basePath to measure` };
+      if (!node_path.default.isAbsolute(basePath)) return { reason: `location "${location.id}" declares a RELATIVE basePath ("${basePath}") \u2014 that is a path inside its provider's own namespace, not on this node's filesystem, and resolving it against "${cwd}" would measure an unrelated volume` };
+      return { path: node_path.default.resolve(basePath) };
+    }
+    async function readLocalVolumeCapacity(location, locality, localNodeId, deps) {
+      const target = probePathFor(location, locality, localNodeId, deps.cwd);
+      if ("reason" in target) return unknown(target.reason);
+      const root = node_path.default.parse(target.path).root;
+      let probed = target.path;
+      for (; ; ) try {
+        await deps.probe.access(probed);
+        break;
+      } catch {
+        const parent = node_path.default.dirname(probed);
+        if (parent === probed) return unknown(`nothing on the path "${target.path}" exists on this node \u2014 the volume is not mounted, so the root filesystem's size is not an answer about it`);
+        probed = parent;
+      }
+      if (probed === root && target.path !== root) return unknown(`only the filesystem root exists on the path "${target.path}" \u2014 the volume is not mounted, so the root filesystem's size is not an answer about it`);
+      try {
+        const st = await deps.probe.statfs(probed);
+        return {
+          kind: "measured",
+          path: probed,
+          totalBytes: st.blocks * st.bsize,
+          availableBytes: st.bavail * st.bsize
+        };
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return unknown(`statfs("${probed}") failed: ${reason}`);
+      }
+    }
     var FRAMEWORK_CONFIG_KEYS = /* @__PURE__ */ new Set([
       "basePath",
       "readOnly",
@@ -90388,31 +90765,53 @@ var require_storage_orchestrator_addon = __commonJS({
         } });
         throw new Error(refusal);
       }
-      /** statfs capacity of a location's basePath, walking up to the nearest
-      *  existing ancestor. Null for remote-node locations or unstattable paths. */
+      /**
+      * The volume figures for one location, or `null` when this node cannot take
+      * a measurement that is genuinely about it.
+      *
+      * The decision lives in `location-volume-capacity.ts` — including why a
+      * remote-provider location (the SMB share that was reporting the hub's own
+      * disk) gets nothing rather than a number. Here we only supply the node id,
+      * the provider's declared locality and the real filesystem, and log the
+      * reason once per distinct fault: `listLocations` is on the admin UI's poll,
+      * so a line per call would be a line per second.
+      */
       async localCapacityOf(loc) {
-        const localNode = this.service?.getLocalNodeId() ?? "hub";
-        if (loc.nodeId !== void 0 && loc.nodeId !== localNode) return null;
-        const bp = loc.config["basePath"];
-        if (typeof bp !== "string" || bp.length === 0) return null;
-        try {
-          let target = node_path.resolve(bp);
-          for (; ; ) try {
-            await node_fs_promises.access(target);
-            break;
-          } catch {
-            const parent = node_path.dirname(target);
-            if (!parent || parent === target) return null;
-            target = parent;
-          }
-          const st = await node_fs_promises.statfs(target);
-          return {
-            totalBytes: st.blocks * st.bsize,
-            availableBytes: st.bavail * st.bsize
-          };
-        } catch {
+        const localNode = this.service?.getLocalNodeId() ?? HUB_NODE_ID;
+        const result = await readLocalVolumeCapacity(loc, this.providerIsNodeLocal(loc), localNode, {
+          probe: {
+            access: (target) => node_fs_promises.access(target),
+            statfs: async (target) => node_fs_promises.statfs(target)
+          },
+          cwd: node_path.resolve(".")
+        });
+        if (result.kind === "unknown") {
+          this.logCapacityUnknownOnce(loc.id, result.reason);
           return null;
         }
+        this.clearCapacityUnknown(loc.id, result.path);
+        return {
+          totalBytes: result.totalBytes,
+          availableBytes: result.availableBytes
+        };
+      }
+      /** locationId → the last unmeasurable reason logged for it. */
+      capacityUnknownLogged = /* @__PURE__ */ new Map();
+      logCapacityUnknownOnce(locationId, reason) {
+        if (this.capacityUnknownLogged.get(locationId) === reason) return;
+        this.capacityUnknownLogged.set(locationId, reason);
+        this.ctx.logger.warn("storage-orchestrator: capacity is UNKNOWN for a location \u2014 reporting nothing rather than another volume\u2019s figures", { meta: {
+          locationId,
+          reason
+        } });
+      }
+      clearCapacityUnknown(locationId, measuredPath) {
+        if (!this.capacityUnknownLogged.has(locationId)) return;
+        this.capacityUnknownLogged.delete(locationId);
+        this.ctx.logger.info("storage-orchestrator: capacity is measurable again", { meta: {
+          locationId,
+          measuredPath
+        } });
       }
       /** Per-location cap on EVICTABLE bytes (`config.maxUsedGb`): the operator's
       *  "recordings may use at most N GB in total" — enforced by the pressure
@@ -90501,28 +90900,30 @@ var require_storage_orchestrator_addon = __commonJS({
         } });
         return occupancy;
       }
-      /** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
+      /**
+      * The pressure guard's two readings come from the SAME probe the UI's
+      * capacity does — one capacity truth per location, not two.
+      *
+      * They used to `statfs` the raw `basePath` themselves, which on this node
+      * answers for whatever local path happens to carry that name: a location
+      * owned by another node, or served by a remote provider, could decide
+      * eviction from the hub's own disk. Both now degrade exactly as they did
+      * when the path was unstattable — `100` (guard inert) and `0` (no byte
+      * target) — but they do so for every reading that is not ABOUT the location,
+      * not only for the ones that threw.
+      */
+      async volumeCapacityOf(locationId) {
+        const loc = this.service?.listLocations().find((l) => l.id === locationId);
+        if (!loc) return null;
+        return this.localCapacityOf(loc);
+      }
+      /** Free capacity (%) on a location's volume; 100 (guard inert) when unmeasurable. */
       async locationFreePercent(locationId) {
-        const bp = this.locationBasePath(locationId);
-        if (!bp) return 100;
-        try {
-          const st = await node_fs_promises.statfs(bp);
-          if (st.blocks <= 0) return 100;
-          return st.bavail / st.blocks * 100;
-        } catch {
-          return 100;
-        }
+        return freePercentOf(await this.volumeCapacityOf(locationId));
       }
-      /** Total bytes on a location's volume via `statfs`; 0 when unstattable. */
+      /** Total bytes on a location's volume; 0 when unmeasurable. */
       async locationVolumeTotalBytes(locationId) {
-        const bp = this.locationBasePath(locationId);
-        if (!bp) return 0;
-        try {
-          const st = await node_fs_promises.statfs(bp);
-          return st.blocks * st.bsize;
-        } catch {
-          return 0;
-        }
+        return volumeTotalBytesOf(await this.volumeCapacityOf(locationId));
       }
       /**
       * Seed default storage locations from the addon-declared
@@ -90643,7 +91044,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -108704,7 +109105,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -110573,9 +110974,9 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
   }
 });
 
-// ../types/dist/event-category-BNJ9EE5B.js
-var require_event_category_BNJ9EE5B = __commonJS({
-  "../types/dist/event-category-BNJ9EE5B.js"(exports) {
+// ../types/dist/event-category-yW4s1MGD.js
+var require_event_category_yW4s1MGD = __commonJS({
+  "../types/dist/event-category-yW4s1MGD.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
@@ -110741,11 +111142,11 @@ var require_event_category_BNJ9EE5B = __commonJS({
   }
 });
 
-// ../types/dist/sleep-B1ZwxAhh.js
-var require_sleep_B1ZwxAhh = __commonJS({
-  "../types/dist/sleep-B1ZwxAhh.js"(exports) {
+// ../types/dist/sleep-DXsYD0RX.js
+var require_sleep_DXsYD0RX = __commonJS({
+  "../types/dist/sleep-DXsYD0RX.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_event_category = require_event_category_yW4s1MGD();
     var zod = require_zod();
     var AUDIO_CHUNK_FORMATS = [
       "f32le",
@@ -113522,6 +113923,7 @@ var require_sleep_B1ZwxAhh = __commonJS({
           listTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTracks", "query", input),
           listRecentTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRecentTracks", "query", input),
           listSummaries: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listSummaries", "query", input),
+          listRecentSummaries: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRecentSummaries", "query", input),
           getSummary: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getSummary", "query", input),
           clearTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "clearTracks", "mutation", input),
           getMotionEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getMotionEvents", "query", input),
@@ -114575,8 +114977,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_B1ZwxAhh();
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_sleep = require_sleep_DXsYD0RX();
+    var require_event_category = require_event_category_yW4s1MGD();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -114696,6 +115098,7 @@ var require_addon = __commonJS({
         "getMotionEvents": { "limit": 1e3 },
         "getObjectEvents": { "limit": 1e3 },
         "getSensorEvents": { "limit": 1e3 },
+        "listRecentSummaries": { "limit": 100 },
         "listRecentTracks": { "limit": 200 },
         "listSummaries": { "limit": 50 },
         "reclaimDebugMedia": { "mode": "report" },
@@ -121440,9 +121843,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-8x1jgPz_.js
-var require_manifest_system_deps_8x1jgPz = __commonJS({
-  "../system/dist/manifest-system-deps-8x1jgPz_.js"(exports) {
+// ../system/dist/manifest-system-deps-CrSP0Kkp.js
+var require_manifest_system_deps_CrSP0Kkp = __commonJS({
+  "../system/dist/manifest-system-deps-CrSP0Kkp.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     require_hub_cap_forward_DmHNjbB0();
@@ -122886,6 +123289,19 @@ var require_manifest_system_deps_8x1jgPz = __commonJS({
       });
       return cachedInvocation;
     }
+    function buildNpmChildEnv(env, execPath) {
+      const nodeDir = node_path.dirname(execPath);
+      const current = env["PATH"];
+      if (current === void 0 || current.length === 0) return {
+        ...env,
+        PATH: nodeDir
+      };
+      if (current === nodeDir || current.startsWith(`${nodeDir}${node_path.delimiter}`)) return { ...env };
+      return {
+        ...env,
+        PATH: `${nodeDir}${node_path.delimiter}${current}`
+      };
+    }
     async function runNpm(args, options) {
       const invocation = await resolveNpmInvocation({
         cacheDir: options.cacheDir,
@@ -122894,7 +123310,8 @@ var require_manifest_system_deps_8x1jgPz = __commonJS({
       });
       return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
         ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
-        timeout: options.timeout ?? 3e5
+        timeout: options.timeout ?? 3e5,
+        env: buildNpmChildEnv(options.env ?? process.env, process.execPath)
       });
     }
     async function resolveUncached(options) {
@@ -130397,6 +130814,12 @@ var require_manifest_system_deps_8x1jgPz = __commonJS({
         return buildNativeCapProxy;
       }
     });
+    Object.defineProperty(exports, "buildNpmChildEnv", {
+      enumerable: true,
+      get: function() {
+        return buildNpmChildEnv;
+      }
+    });
     Object.defineProperty(exports, "buildUdsNativeCapProxy", {
       enumerable: true,
       get: function() {
@@ -130964,11 +131387,11 @@ var require_manifest_system_deps_8x1jgPz = __commonJS({
   }
 });
 
-// ../system/dist/custom-action-registry-BTB-LgGN.js
-var require_custom_action_registry_BTB_LgGN = __commonJS({
-  "../system/dist/custom-action-registry-BTB-LgGN.js"(exports) {
+// ../system/dist/custom-action-registry-DAFhWd0h.js
+var require_custom_action_registry_DAFhWd0h = __commonJS({
+  "../system/dist/custom-action-registry-DAFhWd0h.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var CustomActionRegistry = class {
       byAddon = /* @__PURE__ */ new Map();
       registerAddon(addonId, catalog, handler) {
@@ -134782,7 +135205,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DdRxWA7g();
+    var require_dist10 = require_dist_DUSfUAgz();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -134809,9 +135232,9 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_event_loop_stall_monitor = require_event_loop_stall_monitor_CAsHdMwP();
     var require_tls$1 = require_tls_BFs4PzoW();
-    var require_manifest_system_deps = require_manifest_system_deps_8x1jgPz();
+    var require_manifest_system_deps = require_manifest_system_deps_CrSP0Kkp();
     var require_resource_monitor = require_resource_monitor_LVE1BoLs();
-    var require_custom_action_registry = require_custom_action_registry_BTB_LgGN();
+    var require_custom_action_registry = require_custom_action_registry_DAFhWd0h();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
@@ -215657,6 +216080,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.buildLinkChain = require_manifest_system_deps.buildLinkChain;
     exports.buildNativeCapProxy = require_manifest_system_deps.buildNativeCapProxy;
     exports.buildNodeManifest = buildNodeManifest;
+    exports.buildNpmChildEnv = require_manifest_system_deps.buildNpmChildEnv;
     exports.buildStorageLocationRegistry = require_builtins_storage_orchestrator_storage_orchestrator_addon.buildStorageLocationRegistry;
     exports.buildUdsNativeCapProxy = require_manifest_system_deps.buildUdsNativeCapProxy;
     exports.builderMountedCapNames = builderMountedCapNames;
@@ -215899,7 +216323,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_BNJ9EE5B();
+    var require_event_category = require_event_category_yW4s1MGD();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -215919,9 +216343,9 @@ var require_dist4 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_sleep = require_sleep_B1ZwxAhh();
-    var require_event_category = require_event_category_BNJ9EE5B();
-    var require_canonical_hash = require_canonical_hash_DNV8S5ET();
+    var require_sleep = require_sleep_DXsYD0RX();
+    var require_event_category = require_event_category_yW4s1MGD();
+    var require_canonical_hash = require_canonical_hash_9lydiEzx();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
     var zod = require_zod();
@@ -215935,18 +216359,19 @@ var require_dist4 = __commonJS({
       "scene",
       "motion",
       "object",
-      "audio"
+      "audio",
+      "mosaic"
     ];
     var OWNER_TYPES = new Set(MEDIA_OWNER_TYPES);
     var DIGITS = /^\d+$/;
-    function isOwnerType(value) {
+    function isMediaOwnerType(value) {
       return OWNER_TYPES.has(value);
     }
     function parseMediaOwnerKey(key) {
       const parts = key.split(":");
       if (parts.length !== 3 && parts.length !== 4) return null;
       const [ownerType, ownerId, fileKind, timestamp] = parts;
-      if (ownerType === void 0 || !isOwnerType(ownerType)) return null;
+      if (ownerType === void 0 || !isMediaOwnerType(ownerType)) return null;
       if (ownerId === void 0 || ownerId.length === 0) return null;
       if (fileKind === void 0 || fileKind.length === 0) return null;
       if (timestamp === void 0) return {
@@ -215971,6 +216396,7 @@ var require_dist4 = __commonJS({
       "object",
       "audio"
     ];
+    var EventOwnerTypeSchema = zod.z.enum(EVENT_OWNER_TYPES);
     var EVENT_OWNER_TYPE_SET = new Set(EVENT_OWNER_TYPES);
     function isEventOwnerType(ownerType) {
       return EVENT_OWNER_TYPE_SET.has(ownerType);
@@ -216099,7 +216525,23 @@ var require_dist4 = __commonJS({
         "zerolatency",
         "film",
         "animation"
-      ]).optional()
+      ]).optional(),
+      /**
+      * ONE slice per access unit.
+      *
+      * `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+      * the encoder as five NAL slices that share one RTP timestamp and carry one
+      * marker bit. A libwebrtc depacketiser sees five frame-starts and one
+      * frame-end per frame: the first pictures render and the video then freezes
+      * for good while the audio, on its own plane, plays on. Measured on this hub
+      * 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+      *
+      * A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+      * `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+      * consumers meaning the same thing spelled differently would stop sharing one
+      * child. Absent means "whatever the encoder does" — today's behaviour.
+      */
+      singleSlicePerFrame: zod.z.boolean().optional()
     });
     var AudioEncodeSchema = zod.z.union([zod.z.literal("passthrough"), zod.z.object({
       codec: zod.z.enum([
@@ -216172,7 +216614,11 @@ var require_dist4 = __commonJS({
     };
     var ALEXA_EGRESS_PROFILE = {
       ...BASE_LIVE_EGRESS_PROFILE,
-      audio: { codec: "opus" }
+      audio: { codec: "opus" },
+      video: {
+        ...BASE_LIVE_EGRESS_PROFILE.video,
+        singleSlicePerFrame: true
+      }
     };
     var RATE_CONTROL_TIGHT = {
       kind: "cbr",
@@ -216260,7 +216706,8 @@ var require_dist4 = __commonJS({
         gopFrames: video.gopFrames ?? -1,
         bf: video.bf ?? -1,
         preset: video.preset ?? UNSET,
-        tune: video.tune ?? UNSET
+        tune: video.tune ?? UNSET,
+        singleSlicePerFrame: video.singleSlicePerFrame === void 0 ? UNSET : String(video.singleSlicePerFrame)
       };
     }
     function canonicalAudio(audio) {
@@ -222875,6 +223322,60 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           filter: QueryFilterSchema.optional(),
           columns: zod.z.array(zod.z.string()).readonly().optional()
         }), zod.z.array(SettingsRecordSchema).readonly()),
+        /**
+        * Make a SLOT hold this row — insert it, or update whatever already
+        * occupies the slot — and answer with the id the row HAS.
+        *
+        * ## Why the store needed this
+        *
+        * {@link set} is already an upsert, but its slot is the PRIMARY KEY: the
+        * caller has to know the id to address the row. That is exactly what a
+        * collection keyed by an `INTEGER` rowid alias cannot do — SQLite assigns
+        * the id, so a writer whose uniqueness rule is "one row per
+        * `(ownerKind, ownerId, kind, slot)`" has no id to name and no way to
+        * express the rule. {@link insert} can express it (a UNIQUE index
+        * arbitrates) but only by THROWING at the loser of a race, and the loser
+        * here is a legitimate re-capture, not an error.
+        *
+        * Getting there without this method means read-then-write: query the slot,
+        * then `insert` or `update`. Two statements instead of one, a race between
+        * them, and a recovery path that has to recognise a UNIQUE violation by its
+        * MESSAGE — across a process boundary, because the store lives behind an
+        * RPC door. A string match would be the whole gate, and a store that
+        * rephrased its error would lose the row silently. One statement has no
+        * such gate (D482).
+        *
+        * ## The contract
+        *
+        * `conflict` names the DECLARED columns that identify the slot. They must
+        * be covered by a UNIQUE index on the collection — SQLite resolves an
+        * `ON CONFLICT` target against its indexes and REFUSES the statement when
+        * none matches, so a wrong list is a loud error on the first write, never a
+        * silently duplicated row. An empty list is refused rather than passed on:
+        * `ON CONFLICT()` is not valid SQL, and the intent it would most likely
+        * encode ("no slot, just insert") is {@link insert}.
+        *
+        * Row shape is {@link insert}'s: `record.id` is used when the collection
+        * needs a supplied key and IGNORED when the primary key is an `INTEGER`
+        * rowid alias — exactly as `insert` and `insertMany` already treat it.
+        *
+        * Returns the id either way: the one SQLite assigned on an insert, or the
+        * one the row it updated already had. A caller cannot tell which happened,
+        * and deliberately — every caller wants the slot's id, and one that needed
+        * to distinguish creation from replacement would have to read first anyway.
+        */
+        upsert: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          /** Declared columns identifying the slot; must be covered by a UNIQUE
+          *  index on the collection. Never empty. */
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({
+          /** The id the row HAS: assigned by SQLite on an insert, or the existing
+          *  row's own id on an update. */
+          id: zod.z.union([zod.z.string(), zod.z.number()])
+        }), { kind: "mutation" }),
         /** Insert a new record. */
         insert: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -223118,6 +223619,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * Make a slot hold this row, and answer with the id the row HAS. The
+        * engine half of `settings-store.upsert` — read that docblock for why the
+        * store needed a slot that is not the primary key (D482).
+        */
+        upsert: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          conflict: zod.z.array(zod.z.string()).readonly(),
+          record: BulkRecordSchema
+        }), zod.z.object({ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Insert many records in ONE transaction. All or nothing. */
         insertMany: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -230347,8 +230862,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var TrackSnapshotSchema = zod.z.object({
       timestamp: zod.z.number(),
       position: TrackPositionSchema,
-      /** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-      mediaKey: zod.z.string()
+      /** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+      mediaId: zod.z.number().int()
     });
     var TrackEnvelopeSchema = zod.z.object({
       minX: zod.z.number(),
@@ -230788,14 +231303,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
       frameWidth: zod.z.number().optional(),
       frameHeight: zod.z.number().optional(),
-      /** MediaStore key for the crop attached to this event (if any). */
-      mediaKey: zod.z.string().optional(),
-      /** Design B: MediaStore key of the track's native-resolution key frame (the
+      /** Media row id of the crop attached to this event (if any) — D482. */
+      mediaId: zod.z.number().int().optional(),
+      /** Design B: media row id of the track's native-resolution key frame (the
       *  best-detection full frame). Resolve via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`) for a detail view that
       *  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-      *  sources — consumers fall back to `mediaKey` (the tight crop). */
-      keyFrameMediaKey: zod.z.string().optional(),
+      *  sources — consumers fall back to `mediaId` (the tight crop). */
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Populated by B5 (recording playback URL for this event). */
       mediaUrl: zod.z.string().optional(),
       /** The parent track's key-event importance [0,1], propagated to every object
@@ -230832,7 +231347,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "sceneFrame"
     ]);
     var MediaFileRefSchema = zod.z.object({
-      key: zod.z.string(),
+      /**
+      * The media row's OWN id — the rowid SQLite assigned it (D482).
+      *
+      * It used to be the row's composite key, `<ownerType>:<ownerId>:<fileKind>
+      * [:<timestampMs>]`, which embedded a FOREIGN id. D474 made event ids
+      * per-table rowid aliases, so `object:101314` and `motion:101314` are two
+      * different rows that spell the same number, and a track whose
+      * `bestEventId` was an object event was served a motion event's snapshot —
+      * a night-time thumbnail on an afternoon track, with no error anywhere. A
+      * surrogate id cannot name the wrong row's owner, because it names no owner
+      * at all.
+      */
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
@@ -230900,7 +231427,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       annotationCount: zod.z.number().int()
     });
     var RetrainFrameCandidateSchema = zod.z.object({
-      mediaKey: zod.z.string(),
+      mediaId: zod.z.number().int(),
       kind: MediaFileKindEnum,
       timestamp: zod.z.number(),
       sizeBytes: zod.z.number().int(),
@@ -230913,7 +231440,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceId: zod.z.number(),
       trackId: zod.z.string(),
       /** Provenance only. It may already point at nothing — that is expected. */
-      sourceMediaKey: zod.z.string(),
+      sourceMediaId: zod.z.number().int(),
       sourceKind: MediaFileKindEnum,
       sizeBytes: zod.z.number().int(),
       width: zod.z.number().int(),
@@ -230928,7 +231455,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var RetrainFrameSelectionSchema = zod.z.object({
       copied: zod.z.array(RetrainFrameSchema).readonly(),
       refused: zod.z.array(zod.z.object({
-        sourceMediaKey: zod.z.string(),
+        sourceMediaId: zod.z.number().int(),
         reason: RetrainCopyRefusalSchema
       })).readonly()
     });
@@ -230936,7 +231463,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
       copies: zod.z.array(RetrainFrameSchema).readonly(),
       /** What the page pre-selects — the native key frame when one survives. */
-      autoPickMediaKey: zod.z.string().optional()
+      autoPickMediaId: zod.z.number().int().optional()
     });
     var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
       kind: zod.z.literal("package"),
@@ -231029,7 +231556,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       lastActiveAt: zod.z.number(),
       sealedAt: zod.z.number().nullable(),
       memberCount: zod.z.number().int().nonnegative(),
-      groupShotKey: zod.z.string().nullable()
+      groupShotMediaId: zod.z.number().int().nullable()
     });
     var SUMMARIES_MAX_LIMIT = 200;
     var SUMMARIES_DEFAULT_LIMIT = 50;
@@ -231037,13 +231564,91 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceIds: zod.z.array(zod.z.number()).min(1),
       since: zod.z.number().optional(),
       until: zod.z.number().optional(),
-      limit: zod.z.number().int().min(1).max(200).default(50)
+      limit: zod.z.number().int().min(1).max(200).default(50),
+      /** The same member-wise filter {@link listRecentSummaries} takes — one
+      *  meaning of "dog" on every summary surface. */
+      classes: zod.z.array(zod.z.string().min(1).max(60)).max(40).optional()
+    });
+    var SummaryMemberSchema = zod.z.object({
+      trackId: zod.z.string(),
+      /**
+      * The track's class at the time it JOINED, or `null` when it was unresolved
+      * and the track no longer exists to fill it.
+      *
+      * The join, not the latest opinion: class voting can re-decide a track's
+      * class afterwards, and a group's composition is the history of who came
+      * together. A consumer counts these to badge a thumbnail — "two people and a
+      * dog" — rather than being handed a second, denormalised tally that would
+      * drift from the members it claims to describe.
+      */
+      className: zod.z.string().nullable(),
+      /** `primary` is the one member that carries the group's identity. */
+      role: zod.z.enum([
+        "primary",
+        "sibling",
+        "child"
+      ]).nullable(),
+      joinedAt: zod.z.number(),
+      /** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+      *  at read time. Absent when nothing resolved, never an empty string. */
+      label: zod.z.string().optional(),
+      /** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+      *  recognised nobody, and absent for a member whose track has been pruned —
+      *  a thumbnail that names the wrong person is worse than one naming nobody. */
+      subLabel: zod.z.string().optional()
     });
-    var SummariesPageSchema = zod.z.object({ summaries: zod.z.array(SummarySchema).readonly() });
     var SummaryDetailSchema = zod.z.object({
       summary: SummarySchema,
-      /** Member track ids, in absorption order. */
-      trackIds: zod.z.array(zod.z.string()).readonly()
+      /** Members in absorption order, oldest join first. */
+      members: zod.z.array(SummaryMemberSchema).readonly()
+    });
+    var SummaryListItemSchema = zod.z.object({
+      summary: SummarySchema,
+      /** Class counts, most numerous first; `className: null` is a member whose
+      *  class never resolved, counted so the counts add up to `memberCount`. */
+      classes: zod.z.array(zod.z.object({
+        className: zod.z.string().nullable(),
+        count: zod.z.number().int().positive()
+      })).readonly()
+    });
+    var SummariesPageSchema = zod.z.object({ summaries: zod.z.array(SummaryListItemSchema).readonly() });
+    var RecentSummariesQueryInput = zod.z.object({
+      /** Devices to merge. An empty array yields an empty page. */
+      deviceIds: zod.z.array(zod.z.number()),
+      /** Window lower bound on `lastActiveAt` (inclusive). */
+      since: zod.z.number().optional(),
+      /** Window upper bound on `lastActiveAt` (inclusive). */
+      until: zod.z.number().optional(),
+      limit: zod.z.number().int().min(1).max(500).default(100),
+      /** Opaque continuation cursor from a previous page's `nextCursor`. */
+      cursor: zod.z.string().optional(),
+      /**
+      * Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+      * deliberately the same name: the events filter tree emits one list of ticked
+      * taxonomy nodes, and a summaries feed that called it something else would
+      * make the operator's one filter component produce two shapes.
+      *
+      * A question about the MEMBERS: a group matches when ANY of them does. "Show
+      * me the arrivals with a dog" has to return the group of four people who had
+      * one with them; a filter on the group's own fields could only ever answer
+      * about its primary.
+      *
+      * Matched against all THREE tiers of a member — the class (`animal`), the
+      * sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+      * ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+      * an event kind in the tree and a tier-1 label on an `animal` track; a filter
+      * that read only the class would answer "animal" and never "dog".
+      *
+      * ABSENT or EMPTY means no filter — absent is not a selection of none.
+      */
+      classes: zod.z.array(zod.z.string().min(1).max(60)).max(40).optional()
+    });
+    var RecentSummariesPageSchema = zod.z.object({
+      /** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+      *  {@link listSummaries} — one list shape, so a card renders the same
+      *  whichever feed drew it. */
+      summaries: zod.z.array(SummaryListItemSchema).readonly(),
+      nextCursor: zod.z.string().nullable()
     });
     var RecentTracksPageSchema = zod.z.object({
       /** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -231396,6 +232001,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         listRecentTracks: require_sleep.method(RecentTracksQueryInput, RecentTracksPageSchema),
         /** Newest first by `openedAt`, for a camera set, inside an optional window. */
         listSummaries: require_sleep.method(SummariesQueryInput, SummariesPageSchema),
+        /**
+        * The PAGED feed — the reel and the Events gallery. Same cursor contract as
+        * {@link listRecentTracks}, so one screen cannot hold two ideas of newest.
+        */
+        listRecentSummaries: require_sleep.method(RecentSummariesQueryInput, RecentSummariesPageSchema),
         /** One summary with its member track ids; `null` for an id nobody wrote. */
         getSummary: require_sleep.method(zod.z.object({ id: zod.z.string() }), SummaryDetailSchema.nullable()),
         clearTracks: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
@@ -231925,7 +232535,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         selectRetrainFrames: require_sleep.method(zod.z.object({
           deviceId: zod.z.number(),
           trackId: zod.z.string(),
-          mediaKeys: zod.z.array(zod.z.string()).min(1)
+          mediaIds: zod.z.array(zod.z.number().int()).min(1)
         }), RetrainFrameSelectionSchema, {
           kind: "mutation",
           auth: "admin"
@@ -232089,8 +232699,29 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * The media an EVENT owns.
+        *
+        * `ownerType` is REQUIRED, and that is the whole correction (D482). An
+        * event is a row in ONE of three tables, and since D474 each numbers from
+        * 1 independently: `motion:101314` and `object:101314` both exist. This
+        * method took a bare `eventId` and the provider probed motion → object →
+        * audio, stopping at the first hit — so on the live hub, where object
+        * events own no media of their own and 299 883 of 300 559 media rows are
+        * motion-owned, EVERY object event resolved to its motion namesake. A
+        * track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
+        * days earlier, silently.
+        *
+        * D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
+        * the API catching up to it. Naming the table is not a "qualification" of
+        * the ambiguity — a listing BY OWNER has no address to make surrogate: the
+        * owner IS (table, id), and half of it is not a question.
+        */
         getEventMedia: require_sleep.method(zod.z.object({
-          eventId: zod.z.string(),
+          /** Which of the three event tables owns the row. */
+          ownerType: EventOwnerTypeSchema,
+          /** The event's rowid in that table (D474: an event id is a number). */
+          eventId: zod.z.number().int(),
           kind: MediaFileKindEnum.optional(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileSchema).readonly()),
@@ -232135,11 +232766,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
         * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
         *
-        * Same `deviceId` authorization subject as `getEventMedia`, and the same
-        * rows — this is a projection of that method, never a different question.
+        * Same `deviceId` authorization subject as `getEventMedia`, the same
+        * REQUIRED `ownerType` (read that method's docblock for the night-time
+        * thumbnail this closes — D482), and the same rows: this is a projection
+        * of that method, never a different question.
         */
         listEventMedia: require_sleep.method(zod.z.object({
-          eventId: zod.z.string(),
+          ownerType: EventOwnerTypeSchema,
+          eventId: zod.z.number().int(),
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
@@ -237840,8 +238474,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's crop, resolved from `coverMediaKey`.
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's crop, resolved from `coverMediaId`.
       *  Lets the UI render the person's face avatar instead of a placeholder icon. */
       coverBase64: zod.z.string().optional()
     });
@@ -237857,8 +238491,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       enrolledAt: zod.z.number().int(),
       deviceId: zod.z.number().int().optional(),
       source: zod.z.enum(["detected", "photo"]),
-      /** The enrolled crop's media key, so the panel can show the evidence. */
-      mediaKey: zod.z.string().optional(),
+      /** The enrolled crop's media row id, so the panel can show the evidence. */
+      mediaId: zod.z.number().int().optional(),
       /**
       * False = the sample is stamped with a DIFFERENT face model, and a cosine
       * across feature spaces is a well-formed float with no meaning. Every number
@@ -237927,15 +238561,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       cropUrl: zod.z.string().optional(),
       /** Design B: the face bbox (pixel space) on the key frame — lets a detail
-      *  view draw the box over the native `keyFrameMediaKey` frame. Absent on
+      *  view draw the box over the native `keyFrameMediaId` frame. Absent on
       *  legacy rows written before design B. */
       faceBbox: BoundingBoxSchema.optional(),
       /** Design B: MediaStore key of the track's native-resolution key frame.
       *  Fetch the native JPEG via the event-media data-plane
-      *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
+      *  (`/addon/<addonId>/event-media/m/<keyFrameMediaId>`). Absent when the
       *  track produced no key frame (e.g. native/onboard source) — the UI falls
       *  back to the inline `base64` face crop. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       /** Winning identity-match cosine (0..1) for this face's track, when an
       *  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
       *  (confidence badge / low-confidence audit). Absent on legacy rows and on
@@ -237973,7 +238607,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       cohesion: zod.z.number()
     });
     var MediaFileLiteSchema$1 = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -237995,7 +238631,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           * covers inline, ~10 KB of base64 per row, on a query this UI mounts
           * four times and the viewer holds at `staleTime: 30_000`.
           *
-          * Nothing loses its avatar: `coverMediaKey` is already on every row and
+          * Nothing loses its avatar: `coverMediaId` is already on every row and
           * the `event-media` plane serves that key `immutable` with an ETag.
           *
           * **This is an INPUT field, so it does not reach the addon until the
@@ -241265,8 +241901,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       name: zod.z.string(),
       sampleCount: zod.z.number().int().nonnegative(),
-      coverMediaKey: zod.z.string().optional(),
-      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaKey`. */
+      coverMediaId: zod.z.number().int().optional(),
+      /** Inline base64 of the cover sample's plate crop, resolved from `coverMediaId`. */
       coverBase64: zod.z.string().optional()
     });
     var VehicleSampleInfoSchema = zod.z.object({
@@ -241299,7 +241935,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** keyFrame parity: the plate bbox (pixel space) on the native key frame. */
       plateBbox: BoundingBoxSchema.optional(),
       /** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
-      keyFrameMediaKey: zod.z.string().optional(),
+      keyFrameMediaId: zod.z.number().int().optional(),
       base64: zod.z.string().optional(),
       /**
       * Same crop as a data-plane URL, always present when the plate has a stored
@@ -241310,7 +241946,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       cropUrl: zod.z.string().optional()
     });
     var MediaFileLiteSchema = zod.z.object({
-      key: zod.z.string(),
+      /** The media row's own id — the same address `MediaFileRef.mediaId` carries
+      *  (D482). It was the row's composite key, which embedded the owner. */
+      mediaId: zod.z.number().int(),
       kind: zod.z.string(),
       url: zod.z.string(),
       sizeBytes: zod.z.number(),
@@ -241384,7 +242022,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         listVehicles: require_sleep.method(zod.z.object({
           /** Inline {@link VehicleSchema.coverBase64} on every row. Default
           *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
-          *  option; `coverMediaKey` + the `event-media` plane carry the picture.
+          *  option; `coverMediaId` + the `event-media` plane carry the picture.
           *  INPUT field: stripped by the hub router until the train ships, which
           *  resolves to `false` and is exactly the intended default. */
           includeCrops: zod.z.boolean().optional()
@@ -242897,7 +243535,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       modelId: zod.z.string(),
       condition: SceneConditionSchema,
       capturedAt: zod.z.number(),
-      thumbnailMediaId: zod.z.string().optional(),
+      /**
+      * The reference thumbnail's media ROW id (D482).
+      *
+      * The name already said `mediaId` while the value was the row's composite
+      * key — a leftover that read as done and was not. It is the row's own id
+      * now, addressed at `/addon/<addonId>/event-media/m/<id>`.
+      */
+      thumbnailMediaId: zod.z.number().int().optional(),
       /** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
       *  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
       *  normalized rect frame a different piece of world, and the scene would
@@ -243964,7 +244609,29 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * disarmed the channels it did not mention would make the Levels page and
       * the Diagnostics page fight over the same value.
       */
-      channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
+      channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional(),
+      /**
+      * How many days the analytics OPS LOG is kept — the audit trail of what
+      * retention actually deleted.
+      *
+      * It lives HERE, on the logging document, and not on the analytics addon's
+      * settings form, on the operator's instruction: every other log-ish window in
+      * this system is configured through this one document, and a retention audit
+      * configured somewhere else is a second place to look when the question is
+      * "what happened to my data".
+      *
+      * That placement has a cost worth stating: this document ships in the
+      * framework closure, so this knob needs a published `@camstack/server` while
+      * the four windows beside it (D485) reach a node on `camstack deploy`.
+      *
+      * `retention-model.ts` argued this one must NOT follow a device window,
+      * because the audit trail is the history of the SWEEP and not of the camera.
+      * That argument stands and is untouched — what changes is that 30 days stops
+      * being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+      * rather than 0-as-delete: an audit log truncated to nothing is precisely the
+      * state in which the next 9.5 GiB leak cannot be explained.
+      */
+      opsLogRetentionDays: zod.z.number().int().min(0).max(3650).optional()
     });
     var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: zod.z.string() });
     var ReportedFailureContributionSchema = FailureContributionSchema.extend({ addonId: zod.z.string() });
@@ -244003,6 +244670,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       channels: zod.z.array(LogChannelDescriptorSchema).readonly(),
       /** The channels ARMED right now, each with its deadline. */
       activeChannels: zod.z.array(LogChannelWindowStateSchema).readonly(),
+      /**
+      * The ops-log window in days, as it is in force. `0` = kept forever.
+      *
+      * Reported rather than left to the caller's memory of what it wrote: this is
+      * the value the analytics sweep will actually use, and an operator asking how
+      * long their audit trail lives should not have to infer it from a default.
+      */
+      opsLogRetentionDays: zod.z.number().int().min(0),
       persisted: zod.z.boolean()
     });
     var systemCapability = {
@@ -244826,7 +245501,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Enrichment label carried from the source track (identity / plate). */
       label: zod.z.string().optional(),
       /** Native-resolution key-frame media key for the parked object's best image. */
-      keyFrameMediaKey: zod.z.string().optional()
+      keyFrameMediaId: zod.z.number().int().optional()
     });
     var CameraOccupancySnapshotSchema = zod.z.object({
       /** Frame timestamp of the inference result that produced this snapshot. */
@@ -250039,6 +250714,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "dataStoreProvider.upsert": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "dayNight.getOptions": {
         capName: "day-night",
         capScope: "device",
@@ -252475,6 +253156,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listRecentSummaries": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listRecentTracks": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -253903,6 +254590,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "settingsStore.upsert": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "smtpProvider.getStatus": {
         capName: "smtp-provider",
         capScope: "system",
@@ -256560,6 +257253,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: true
       }],
+      "pipelineAnalytics.listRecentSummaries": [{
+        name: "deviceIds",
+        form: "array",
+        optional: false
+      }],
       "pipelineAnalytics.listRecentTracks": [{
         name: "deviceIds",
         form: "array",
@@ -258420,6 +259118,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           get: (input) => dispatch("settingsStore", "get", "query", input),
           set: (input) => dispatch("settingsStore", "set", "mutation", input),
           query: (input) => dispatch("settingsStore", "query", "query", input),
+          upsert: (input) => dispatch("settingsStore", "upsert", "mutation", input),
           insert: (input) => dispatch("settingsStore", "insert", "mutation", input),
           insertMany: (input) => dispatch("settingsStore", "insertMany", "mutation", input),
           update: (input) => dispatch("settingsStore", "update", "mutation", input),
@@ -261567,6 +262266,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.EventMediaCoverageSchema = EventMediaCoverageSchema;
     exports.EventMediaKindSchema = EventMediaKindSchema;
     exports.EventMediaProductionSchema = EventMediaProductionSchema;
+    exports.EventOwnerTypeSchema = EventOwnerTypeSchema;
     exports.EventSourceType = require_enums2.EventSourceType$1;
     exports.ExportBytesSchema = ExportBytesSchema;
     exports.ExportDenseRangeSchema = ExportDenseRangeSchema;
@@ -262539,6 +263239,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
     exports.isIsolatedBuiltin = isIsolatedBuiltin;
     exports.isLocationEnabled = isLocationEnabled;
+    exports.isMediaOwnerType = isMediaOwnerType;
     exports.isNode = isNode;
     exports.isObjectInput = isObjectInput;
     exports.isOccupancyRule = isOccupancyRule;
@@ -264364,6 +265065,15 @@ var require_server_root = __commonJS({
         __name(buildNpmRegistryArgs, "buildNpmRegistryArgs");
         var NPM_VIEW_TIMEOUT_MS = 2e4;
         var NPM_INSTALL_TIMEOUT_MS = 15 * 6e4;
+        var CLOSURE_ALLOW_SCRIPTS = {
+          "@camstack/server": true,
+          "better-sqlite3": true,
+          "node-av": true,
+          "node-pty": true,
+          ssh2: true,
+          "cpu-features": true,
+          esbuild: true
+        };
         var RESTART_REASON_PREFIX = "server-update";
         var STALE_TRANSIENT_MS = 24 * 60 * 60 * 1e3;
         function readWrapperProbes() {
@@ -264411,6 +265121,7 @@ var require_server_root = __commonJS({
           dataDir;
           execNpm;
           ensureNativePrebuildsFn;
+          applyClosurePatchesFn;
           env;
           readWrapperProbesFn;
           now;
@@ -264439,6 +265150,7 @@ var require_server_root = __commonJS({
               };
             });
             this.ensureNativePrebuildsFn = options.ensureNativePrebuilds ?? (async () => void 0);
+            this.applyClosurePatchesFn = options.applyClosurePatches ?? (async () => void 0);
             this.env = options.env ?? process.env;
             this.readWrapperProbesFn = options.readWrapperProbes ?? readWrapperProbes;
             this.now = options.now ?? Date.now;
@@ -264754,7 +265466,8 @@ var require_server_root = __commonJS({
               } else {
                 fs6.writeFileSync(path6.join(stagingDir, "package.json"), JSON.stringify({
                   name: "camstack-node-root",
-                  private: true
+                  private: true,
+                  allowScripts: CLOSURE_ALLOW_SCRIPTS
                 }, null, 2), "utf-8");
                 await this.execNpm([
                   ...installArgs,
@@ -264787,6 +265500,15 @@ var require_server_root = __commonJS({
               if (missingNatives.length > 0) {
                 throw new Error(`staged closure missing native prebuilds: ${missingNatives.join(", ")} \u2014 refusing to arm a swap that would break the forked runners`);
               }
+              try {
+                await this.applyClosurePatchesFn(stagingDir);
+              } catch (err) {
+                this.logger.warn("closure-patch apply step failed \u2014 validator will decide", {
+                  meta: {
+                    error: err instanceof Error ? err.message : String(err)
+                  }
+                });
+              }
               const unpatched = findUnappliedClosurePatches(stagingDir);
               if (unpatched.length > 0) {
                 throw new Error(`staged closure did not apply its shipped patches: ${unpatched.join(", ")} \u2014 refusing to arm a swap into an unpatched closure`);
@@ -264834,6 +265556,7 @@ var require_server_root = __commonJS({
             return {
               name: "camstack-node-root",
               private: true,
+              allowScripts: CLOSURE_ALLOW_SCRIPTS,
               dependencies: {
                 [this.spec.packageName]: fileRef(rootTgz)
               },
@@ -395791,6 +396514,78 @@ var require_system_ensure_prebuilds = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/server-update/system-apply-closure-patches.js
+var require_system_apply_closure_patches = __commonJS({
+  "../../server/backend/dist/core/server-update/system-apply-closure-patches.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildSystemApplyClosurePatches = buildSystemApplyClosurePatches;
+    var node_child_process_1 = __require("child_process");
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var node_util_1 = __require("util");
+    var execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+    var APPLIER_REL = ["node_modules", "@camstack", "server", "scripts", "closure-postinstall.mjs"];
+    var APPLY_TIMEOUT_MS = 6e4;
+    function buildSystemApplyClosurePatches(logger) {
+      return async (closureDir) => {
+        const applier = path.join(closureDir, ...APPLIER_REL);
+        if (!fs.existsSync(applier)) {
+          logger.debug("closure ships no patch applier \u2014 nothing to apply", {
+            meta: { applier }
+          });
+          return;
+        }
+        const { stdout, stderr } = await execFileAsync(process.execPath, [applier], {
+          cwd: path.dirname(path.dirname(applier)),
+          timeout: APPLY_TIMEOUT_MS
+        });
+        const output = `${stdout}${stderr}`.trim();
+        if (output.length > 0) {
+          logger.info("closure patches applied", { meta: { output } });
+        }
+      };
+    }
+  }
+});
+
 // ../../server/backend/dist/core/server-update/system-exec-npm.js
 var require_system_exec_npm = __commonJS({
   "../../server/backend/dist/core/server-update/system-exec-npm.js"(exports) {
@@ -396178,6 +396973,7 @@ var require_agent_update_service = __commonJS({
     var system_1 = require_dist3();
     var types_1 = require_dist4();
     var system_ensure_prebuilds_js_1 = require_system_ensure_prebuilds();
+    var system_apply_closure_patches_js_1 = require_system_apply_closure_patches();
     var system_exec_npm_js_1 = require_system_exec_npm();
     var update_availability_emitter_js_1 = require_update_availability_emitter();
     var update_availability_store_js_1 = require_update_availability_store();
@@ -396266,6 +397062,11 @@ var require_agent_update_service = __commonJS({
           // ships the identical bare Node, so its `applyServerUpdate` staging would
           // hit the same source-only `better-sqlite3` miss without this.
           ensureNativePrebuilds: options.ensureNativePrebuilds ?? (0, system_ensure_prebuilds_js_1.buildSystemEnsureNativePrebuilds)(options.logger),
+          // Apply the closure patches ourselves. npm 12 blocks the root package's
+          // postinstall by default, and a silently-unpatched closure is refused by
+          // the validator — an update that can never apply. Idempotent, so this
+          // costs nothing where npm did run the lifecycle.
+          applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
           env: options.env,
           now: options.now
         });
@@ -420705,7 +421506,7 @@ var require_logging_settings = __commonJS({
   "../../server/backend/dist/api/core/logging-settings.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.LoggingSettingsService = exports.MAX_CHANNEL_WINDOW_MS = exports.EMPTY_LOG_CHANNEL_PLANE = exports.HUB_NODE_ID = exports.LOGGING_SETTINGS_KEY = void 0;
+    exports.LoggingSettingsService = exports.MAX_CHANNEL_WINDOW_MS = exports.EMPTY_LOG_CHANNEL_PLANE = exports.OPS_LOG_RETENTION_DEFAULT_DAYS = exports.HUB_NODE_ID = exports.LOGGING_SETTINGS_KEY = void 0;
     exports.buildLogChannelPlane = buildLogChannelPlane;
     exports.toLoggingSettingsRecord = toLoggingSettingsRecord;
     exports.resolveLevel = resolveLevel;
@@ -420721,6 +421522,7 @@ var require_logging_settings = __commonJS({
     var SYSTEM_SETTINGS_COLLECTION = "system-settings";
     exports.HUB_NODE_ID = "hub";
     var LOG_LEVELS = ["debug", "info", "warn", "error"];
+    exports.OPS_LOG_RETENTION_DEFAULT_DAYS = 30;
     exports.EMPTY_LOG_CHANNEL_PLANE = {
       declarations: async () => [],
       apply: async () => {
@@ -420802,6 +421604,9 @@ var require_logging_settings = __commonJS({
         if (levelChanged) {
           next = mergeLevel(next, scope, component, patch.level ?? null, this.now());
         }
+        if (patch.opsLogRetentionDays !== void 0) {
+          next = { ...next, opsLogRetentionDays: patch.opsLogRetentionDays, updatedAt: this.now() };
+        }
         if (channelsChanged) {
           const declared = await this.channels.declarations();
           const rejected = validateChannelPatch(patch.channels ?? [], declared);
@@ -420891,6 +421696,7 @@ var require_logging_settings = __commonJS({
           activeWindows: await this.describeWindows(),
           channels: await this.declaredChannels(),
           activeChannels: describeChannelWindows(record ?? {}, this.now()),
+          opsLogRetentionDays: record?.opsLogRetentionDays ?? exports.OPS_LOG_RETENTION_DEFAULT_DAYS,
           persisted: record !== null
         };
       }
@@ -434339,6 +435145,7 @@ var require_server_update_service = __commonJS({
     var index_js_1 = require_server_root();
     var update_availability_emitter_js_1 = require_update_availability_emitter();
     var system_ensure_prebuilds_js_1 = require_system_ensure_prebuilds();
+    var system_apply_closure_patches_js_1 = require_system_apply_closure_patches();
     var system_exec_npm_js_1 = require_system_exec_npm();
     var ServerUpdateService = class extends index_js_1.RootUpdateService {
       updateAvailability;
@@ -434372,6 +435179,11 @@ var require_server_update_service = __commonJS({
           // native-prebuild validator refuses the swap (toolchain-less packaged
           // desktop). No-op on docker where the install already carried it.
           ensureNativePrebuilds: options.ensureNativePrebuilds ?? (0, system_ensure_prebuilds_js_1.buildSystemEnsureNativePrebuilds)(options.logger),
+          // Apply the closure patches ourselves. npm 12 blocks the root package's
+          // postinstall by default, and a silently-unpatched closure is refused by
+          // the validator — an update that can never apply. Idempotent, so this
+          // costs nothing where npm did run the lifecycle.
+          applyClosurePatches: options.applyClosurePatches ?? (0, system_apply_closure_patches_js_1.buildSystemApplyClosurePatches)(options.logger),
           env: options.env,
           now: options.now
         });