Live camera view in the app, and the green light that was lying about it

Two changes, and the second was found by verifying the first.

## Watching a camera from the app, in another building

Snapshots answer "is that camera working". They do not answer "what is
happening in my shop right now", which is what somebody who opens the app away
from the counter is asking. Head office's browser already had that answer -
LiveHub plus cameras.Live, where the shop PC asks outbound whether anybody is
watching and pushes JPEG frames for as long as somebody is - and the app could
not reach it.

cloud.CameraLive opens that feed and the app's own loopback relay re-emits it
as multipart MJPEG. That is the trick: frames arrive base64 over SSE, an <img>
cannot render that, and an <img> renders MJPEG natively - so a tile is an
ordinary <img> pointed at loopback whether the camera is in this room or
another city.

- Reconnecting happens in the relay, not the page. The server caps one push at
  five minutes, so doing it here means the <img> never sees the stream end.
- The headers are flushed before the first frame. Go writes them on the first
  body write, so without that the whole response waits for the shop PC to
  start pushing. Measured against production: 30 seconds and not even a
  Content-Type, which surfaces as the request timing out.
- One camera at a time. Watching makes a shop PC upload, so a grid that went
  live at once would put an estate's worth of cameras on the wire because
  somebody opened a page.
- live.mjpeg is behind the same per-run token as the engine routes, and a
  wrong token is a 404 that never reaches head office at all.
- CameraLive uses its own HTTP client: the shared one's 30s timeout covers the
  whole response and would sever a working view every thirty seconds - the
  trap that made the server set WriteTimeout to zero for its own SSE endpoint.

## A camera read "Connected" for 34 minutes after the shop PC went blind

Which is why the verification above looked like a failure: head office
registered the viewer and no frame ever came.

reportWith returns early when the engine is unreachable - correctly, it has
nothing to say - so the last state it sent stays in the database looking
current. Measured live: cam2 and entrance both reading Connected, in green,
with last_seen_at 34 minutes old, while the heartbeat from the same PC said
cameras_up 0 of 0. Two surfaces reading two stored fields and disagreeing.

false could not be the answer. It means "this camera is not connecting", which
sends an installer to check cabling on a camera that was working perfectly the
last time anybody could ask it. So there are four states and one function:

  connected       reported recently, and working
  not_connecting  reported recently, and the stream will not open
  waiting         no shop PC has ever reported this camera
  stale           reported once, and not lately

- Connected is CLEARED when stale or waiting. A stale true left in place stays
  available to every client reading the field directly, and leaves two fields
  on one object disagreeing - how the shops screen once came out labelled
  Working, in green, above "2 of 3 cameras not connecting".
- Computed in scanCamera, so every camera anybody reads passes through it. A
  state computed per handler is one a handler forgets, and this had already
  reached three screens.
- CameraStaleAfter is 5 minutes: five missed reports, not one. Same reasoning
  as three missed heartbeats - an indicator that cries wolf gets ignored.
- An unparseable last_seen_at is stale. It should be impossible, which is why
  it must not fall through to the state that says everything is fine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

.gitignore

@@ -66,3 +66,4 @@ node_modules/
 # Left behind by `pip install .` of the engine (setuptools metadata), not source.
 /behavision.egg-info/
 /.prod/
+/.demo/

API.md

@@ -43,9 +43,12 @@ user; the tenant is always taken from the session and never from the request.
 |---|---|
 | `POST /api/auth/login` `refresh` · `GET /api/auth/invitation` · `POST /api/auth/register` | **no auth** |
 | `POST /api/auth/logout` · `GET /api/auth/me` · `/api/auth/sessions*` | authed |
+| `POST /api/auth/password` — change your OWN | authed (platform admins too) |
 | `GET /api/visits` · `GET /api/visits/stream` | authed |
 | `GET /api/visitors` · `GET /api/visitors/{id}/history` · `GET /api/visitors/{id}/image` · `GET /api/faces/{id}` | authed |
 | `PUT /api/visitors/{id}/profile` · `POST /api/purchases` | staff |
+| `POST /api/customers` | staff |
+| `POST /api/visitors/{id}/merge` — **irreversible** | manager |
 | `DELETE /api/visitors/{id}` — erasure | manager |
 | `GET /api/sites` · `GET /api/sites/{site}/check` · `GET /api/cameras` · `GET /api/cameras/{id}/snapshot.jpg` · `GET /api/cameras/{id}/live` | authed |
 | `POST /api/sites/{site}/cameras` · `PATCH` / `DELETE /api/cameras/{id}` · `POST /api/cameras/{id}/check` | manager |
@@ -53,15 +56,23 @@ user; the tenant is always taken from the session and never from the request.
 | `POST /api/sites/{site}/enrolment-code` | manager |
 | `GET /api/team` | authed (tenant users only) |
 | `POST /api/team/members` · `POST /api/team/{id}/password` · `PATCH /api/team/{id}` · `/api/team/invitations*` | manager |
-| `GET /api/reports/footfall` · `GET /api/reports/conversion` | authed |
+| `GET /api/reports/footfall` · `GET /api/reports/conversion` · `GET /api/sales` · `GET /api/sales/{id}` · `GET /api/dashboard/summary` | authed |
 | `POST /api/assistant` | authed |
 | `GET` / `POST /api/admin/clients` · `PATCH /api/admin/clients/{id}` · `POST /api/admin/clients/{id}/owner-password` · `DELETE /api/admin/clients/{id}` | **platform admin** |
+| `GET /api/admin/clients/{id}` · `…/{id}/sites` · `…/sites/{site}` · `…/sites/{site}/cameras` · `…/cameras/{camera}` · `GET /api/admin/monitoring/summary` | **platform admin** |
 | `/api/agent/*` | **shop PC token** — never a user |
 
 A role that may not call something gets **403 `forbidden`** with a message
 saying who can. Another tenant's data returns **404**, never 403: a tenant user
 has no business learning that a resource exists.
 
+`authed` above means any signed-in user **of a company**. A platform admin has
+no company — that absence is what defines one — so a company's own routes
+answer them **403 `not_a_tenant_account`**, naming the `/api/admin/clients/{id}/…`
+route that reads the same data. Their own `/api/auth/*` keeps working: a session
+is not a company's data, and revoking a lost device must not depend on having a
+tenant.
+
 ---
 
 ## The onboarding chain — who creates whom
@@ -469,6 +480,34 @@ deactivate them (§4); that revokes every session they hold.
 
 ---
 
+### `POST /api/auth/password` — any signed-in account
+
+Change your own password. Works for **every** account including a platform
+admin, who has no company and therefore cannot be reached by the team routes.
+
+```json
+{ "current_password": "...", "new_password": "..." }
+```
+
+```json
+{ "changed": true, "sessions_revoked": 3 }
+```
+
+- **The current password is required.** An access token lives twelve hours and
+  travels on shop-floor PCs and staff phones; without this a stolen one would
+  own the account permanently rather than until it expires. Wrong current
+  password is **403 `wrong_password`** and changes nothing.
+- **Every other session is revoked; the caller's is kept.** Somebody changing
+  their password because they think it is known must not wonder whether the
+  device that already had it is still signed in — and must not be signed out of
+  the one in their hand while dealing with it.
+- A new password under the floor is **400**, and so is reusing the current one.
+
+This is the route to use rather than asking an administrator. `POST
+/api/team/{id}/password` remains what a manager uses on somebody *else*.
+
+---
+
 ## 4. The team
 
 ### `GET /api/team` — anyone in the company
@@ -687,6 +726,105 @@ record of what you were permitted to do is what an auditor asks for.
 Links a sale to a customer so the conversion report can say who bought. **One
 currency per report** — see §9.
 
+### `GET /api/sales` — anyone in the company
+
+The purchases behind the conversion report. That report has always summed this
+table; until 28 Sep nothing could read a row of it, so "revenue was 41,000"
+could not be checked against a till.
+
+Takes the same window as a report: `from`, `to` (`YYYY-MM-DD`), `site` or
+`site_id` (slug or uuid), plus `customer` (`V-42` or a uuid) and `limit`
+(default 50, max 200). An unknown shop or customer is a **400**, not a silently
+ignored filter.
+
+```json
+[{ "id": "8525ef18-…", "occurred_at": "2026-09-19T10:48:44Z",
+   "site_id": "93d0565f-…", "site": "TeNext Coimbatore", "site_slug": "chennai",
+   "amount": 1000, "currency": "INR",
+   "visitor_id": "ba5e5d2e-…", "visitor_ref": "V-1", "visitor_label": "Visitor 1",
+   "visit_id": "3bcd53ca-…", "items": ["Headphones"], "source": "manual" }]
+```
+
+- **A sale with no `visitor_id` is listed**, not joined away. An unidentified
+  walk-in is still revenue, and hiding it would make this disagree with the
+  conversion report computed over the same rows.
+- `items` is always an array, never `null`.
+- **No cursor, deliberately.** A keyset cursor needs a monotonic
+  server-assigned column and `purchases` has none; ordering by
+  `(occurred_at, id)` with a random uuid tie-break is the shape that silently
+  dropped visits from the arrivals feed before `visits.seq` existed. Narrow by
+  date and `limit` instead.
+
+### `GET /api/sales/{id}`
+
+One sale, same shape. Another company's sale is **404**.
+
+### `GET /api/dashboard/summary` — anyone in the company
+
+The home screen in one call, so a client does not combine four.
+
+Takes `site`/`site_id` and `tz` (IANA, default the company's). "Today" is cut
+in **that timezone** — a dashboard that says today and means UTC is five and a
+half hours wrong in India.
+
+```json
+{ "date": "2026-09-28", "visitors": 0, "visits": 0,
+  "sites_total": 4, "sites_online": 0, "cameras_total": 1, "cameras_up": 1,
+  "fraction_below_gate": 0.59, "worst_site": "TeNext Coimbatore",
+  "timezone": "Asia/Kolkata" }
+```
+
+`visitors` is unique people and `visits` is arrivals — **do not add the daily
+bars of a footfall report to get either.** `fraction_below_gate` travels with
+them because it is what says whether the count is a number or a floor.
+
+### `POST /api/customers` — staff and above
+
+Register a customer before any camera has seen them — somebody standing at the
+counter. Body is a profile; **at least a name or a phone** is required, since a
+record with neither is a number nobody can search for.
+
+```json
+{ "id": "…", "ref": "V-7", "label": "Asha Menon", "visit_count": 0, "has_profile": true }
+```
+
+They get a `V-` reference from the same counter an enrolled customer does, so a
+hand-created record is indistinguishable from one the engine made.
+
+**Know what this implies.** They have no face template, so when a camera sees
+that person later the matcher has nothing to compare against and enrols them
+again — by design, not by failure. Join the two with the merge below.
+
+### `POST /api/visitors/{id}/merge` — manager and above
+
+Fold the customer in the path **into** the one named in the body, and delete
+the source. `into` takes a uuid or a `V-` reference.
+
+```json
+{ "into": "V-12" }
+```
+
+```json
+{ "visitor_id": "…", "ref": "V-12", "label": "Asha Menon",
+  "visits": 2, "purchases": 1, "embeddings": 1, "consents": 1,
+  "retired_ref": "V-7",
+  "discarded": ["phone: 9000000001"] }
+```
+
+- **Irreversible**, which is why it is manager-and-above. Two different people
+  welded together cannot be separated: nothing records which visit came from
+  whom. It logs at WARNING and writes an audit row.
+- **`retired_ref` is the reference that has stopped resolving.** Staff write
+  these on cards; asking for it afterwards returns 404.
+- **Nothing is discarded silently.** The survivor keeps its own profile values
+  and its blanks are filled from the source; anything that loses is listed in
+  `discarded` **and** appended to the survivor's notes — and `GET /api/visitors?q=`
+  searches notes, so a customer reached by their old phone number is still found.
+- Visits, purchases, templates and consents all move. `visit_count` is
+  recomputed by counting rows, and `first_seen_at` takes the earlier of the two.
+- Merging a customer into themselves is **400**; an unknown or another tenant's
+  customer is **404**.
+
 ### `DELETE /api/visitors/{id}` — **erasure**, manager and above
 
 Destroys the face template and the photo outright. Keeps the visit rows,
@@ -1091,6 +1229,57 @@ first — a failure there is `502 storage_error` and nothing else is touched —
 then the shop PCs' broker logins, then every row (templates, visits, users,
 sessions, cameras) by cascade.
 
+### The drill-down: `GET /api/admin/clients/{id}` and below
+
+A platform admin has **no company**, so the tenant routes cannot serve this —
+they scope by the signed-in account's client, and an admin has none. These take
+the merchant in the path instead. `{site}` accepts a slug or a uuid; `{camera}`
+accepts the engine's camera id or a uuid.
+
+| | |
+|---|---|
+| `GET /api/admin/clients/{id}` | the list row plus `owner_email`, `owner_name` |
+| `GET …/{id}/sites` | same shape as a tenant's `GET /api/sites` |
+| `GET …/{id}/sites/{site}` | one of them |
+| `GET …/{id}/sites/{site}/cameras` | **redacted** — see below |
+| `GET …/{id}/sites/{site}/cameras/{camera}` | one of them |
+| `GET /api/admin/monitoring/summary` | `cameras_total`, `cameras_online`, `merchants_active`, `sites_total`, `events_today`, `as_of` |
+
+**Camera rows here are a different shape from `GET /api/cameras`** and carry no
+`host`, `port`, `path`, `username` or `has_password`. A company seeing those
+for its own camera is correct; a platform admin browsing somebody else's estate
+is a different question, and an RTSP host with a username beside it is most of
+a live path into that customer's camera.
+
+```json
+[{ "id": "3a96a742-…", "site_id": "93d0565f-…", "site": "TeNext Coimbatore",
+   "camera_id": "cam2", "label": "Open office", "enabled": true,
+   "connected": true, "last_seen_at": "2026-09-24T08:33:10Z",
+   "snapshot_at": "2026-09-24T08:33:10Z", "check": { … } }]
+```
+
+`connected` is still three states: `null` = no shop PC has reported yet,
+`false` = not connecting, `true` = up.
+
+A shop or camera belonging to a **different** merchant is **404**, never an
+empty list — `[]` would say "this shop has no cameras" when the truth is "not
+your shop". A suspended merchant stays readable; that is what an admin opens
+the console to see. Every read below the merchant list is written to
+`audit_log`; the counts-only summary is not.
+
+**Not built, and each is a decision rather than a missing handler:**
+
+- `…/events` and `…/alerts` — there is no events table and the shop PC
+  deliberately does not send diagnostics (`camera.up`, `person.missed`) to the
+  server. This needs that decision, a table and a retention policy first; an
+  endpoint now would return `[]` forever.
+- `POST /api/admin/assistant` — the assistant's tools take no client id by
+  design, which is what makes cross-tenant access impossible rather than merely
+  disallowed. An admin one needs a principal scoped to the merchant being
+  viewed, which weakens that. Deliberately not done quietly.
+
+---
+
 ## 12. Errors
 
 ```json
@@ -1105,7 +1294,7 @@ rewritten freely.
 |---|---|
 | 400 | the request was wrong; `message` says how — including an unknown reference in a query filter |
 | 401 | not signed in, or `token_expired` → refresh once and retry |
-| 403 | `forbidden` — signed in, but this role may not; `message` says who can |
+| 403 | `forbidden` — signed in, but this role may not; `message` says who can. Also `not_a_tenant_account`: a **platform admin** calling a company's own route, who reads that data through `/api/admin/clients/{id}/…` instead |
 | 404 | not found — **also** what another tenant's data returns, always; and what admin routes return to non-admins |
 | 409 | a conflict `message` explains (`last_owner`, duplicate address) |
 | 429 | `too_many_attempts` |
@@ -1126,3 +1315,7 @@ a user session is refused.
 
 A web or mobile client never calls them. They are listed here so nobody wonders
 what they are.
+
+One field name, because it is the only one in the product that is easy to guess
+wrong: `POST /api/agent/enrol` takes **`site_token`** (the installation code),
+not `code`, plus an optional `device`. Verified against production.

CLAUDE.md

@@ -2151,6 +2151,510 @@ correctly calls them one person. Tests that need several different people use
 `distinctFace(i)`, which is orthogonal per index.
 
 
+## It recognises people, and that is now measured rather than assumed
+
+Verified against **production** on 2026-09-24, reading what the live system had
+already recorded from the office cameras on 15-19 September. Until this, every
+claim about recognition rested on the August engine tests; the whole chain -
+camera to engine to agent to broker to server to a screen - had never once
+carried a real person.
+
+```
+6 customers, 36 visits, 1,211 events accepted, 0 dropped, 0 duplicates
+Visitor 1  15 visits     Visitor 3  8 visits     Visitor 5  7 visits
+same-person similarity on returning matches: 0.437 - 0.716
+attributes travelling with each arrival: age 37 (spread 2), gender Male
+```
+
+Those similarities are the point. The August measurement on this site said
+`match_threshold: 0.42` sat *inside* the same-person distribution for the
+overhead camera and no threshold could separate a person from themselves. On
+`cam2` the same code now returns 0.54, 0.64, 0.68, 0.72 for repeat sightings of
+the same people - a distribution the threshold sits clearly below. The camera
+that produced them is the open-office one at roughly head height, which is
+precisely the fix this file has recommended since August.
+
+What is still true and unflattering: `fraction_below_gate` on that site is
+**0.59**, reported with `worst_site` beside it. Well over half the faces those
+two cameras see are still too poor to enrol. The footfall figure of 36 visits
+is therefore a floor, not a count, and the report says so in the same response -
+which is the entire reason that number travels with the one it qualifies.
+
+### The image chain works; the engine is simply not capturing
+
+Exercised on production exactly as a shop PC does it, end to end:
+
+```
+enrolment code -> agent token            200
+POST /api/agent/upload-url               200  behavision/v2/<client>/<site>/2026/09/24/<random>.jpg
+PUT  <presigned url>                     200  JPEG in DigitalOcean Spaces
+anonymous GET of that same object        403  private, as the signature demands
+staff GET /api/visitors/{id}/image       404  "No photo was captured for this visit."
+```
+
+Every server-side link holds: the key is minted by the server and scoped to one
+site, the ACL is inside the signature, and an unauthenticated read is refused.
+The 404 at the end is not a fault - it is `app.store_faces: false`, the shipped
+default, so the engine never wrote a crop for the agent to upload. Turning
+images on is one setting on the shop PC and a deliberate change to what the
+system is under GDPR and India's DPDP, which is why it is off until somebody
+decides otherwise rather than on until somebody notices.
+
+### The mobile API, walked as a phone would
+
+Sixteen checks against production as a **staff** account: login, arrivals feed
+with cursor, arrivals carrying `visitor_id` and `site_slug`, customer search,
+customer history, photo endpoint, profile write, purchase, device list, token
+rotation (the retired access token correctly 401s), team read allowed, invite
+refused 403, admin surface 404, SSE stream delivering rows, and Loya answering.
+All pass.
+
+Three things that looked like product bugs and were not, recorded so the next
+person does not re-file them:
+
+- `POST /api/purchases` takes `items` as a **list of strings**, not a count.
+  API.md had it right; the test was wrong.
+- `new` and `returning` live **inside each bucket** of a footfall report, not at
+  the top level. `total`, `visits`, `fraction_below_gate` and `worst_site` are
+  the top-level fields.
+- `?range=7d` is not a parameter. Reports take `from` / `to` / `bucket` / `site`,
+  and an unknown query parameter is silently ignored - so an invented one
+  returns the default 30-day window rather than an error. That hazard is
+  already recorded above for `site` vs `site_id`; it applies here too.
+
+`POST /api/agent/enrol` takes **`site_token`**, not `code` - the only field name
+in the product a caller could reasonably guess wrong, and it is a route no
+client app should ever call.
+
+## CPU: the engine was searching an empty room 15 times a second
+
+Measured on this Mac against the office camera, because "it feels hot" is not
+a number. The first reading was **214% of a core**, and the first guess -
+H.265 decode - was wrong. Wall-clock time said decode cost 58 ms a frame, but
+`cap.read()` BLOCKS until the next frame arrives, so that number was the frame
+interval, not work. Measured as CPU time instead:
+
+```
+                    wall/frame   CPU/frame   at 15 fps
+  H.265 decode          58.8 ms      3.7 ms        5% of a core
+  YuNet detect           8.9 ms     31.0 ms       47% of a core
+```
+
+Detection costs three times its wall time because OpenCV spreads it over eight
+threads. Decode is nearly free. So the cost is detection, and it was running on
+**every frame whether or not anything was in front of the camera** - 6,649 of
+8,634 frames searched, with `faces_seen: 0` and `active_tracks: 0` throughout.
+
+Two changes, both measured:
+
+- **`app.detect_threads: 1`.** OpenCV sizes its pool for one big job on an idle
+  machine; this is a small job repeated forever on a machine also running the
+  recogniser, the tracker and possibly three other cameras. One thread costs
+  15.3 ms of CPU against the default's 31.0 ms, for 6 ms more wall time against
+  a 66 ms frame budget. Half the CPU, no latency that matters.
+- **`app.motion_gate`.** A 160x90 greyscale thumbnail and an `absdiff`: 0.1 ms
+  against detection's 15 ms, ninety times cheaper. A shop is empty most of the
+  day and an empty room costs exactly as much to search as a busy one.
+
+Together: **80% -> 16% of a core**, with detection skipped on 92% of frames.
+Against the original main-stream reading that is 214% -> 16%.
+
+### Why the gate cannot lose a face
+
+Cheapness is easy; this is the part that makes it acceptable, and
+`tests/test_motion_gate.py` is the argument written down rather than asserted.
+
+- It is only consulted while **no track is open**, so a person already being
+  followed is never subject to it.
+- `motion_max_skip` forces a real detection about once a second whatever the
+  thumbnail says. The test asserts the longest *run* of skips, not the total:
+  what matters is the worst case a person can fall into, and counting the total
+  would pass a gate that skipped forty frames and then looked forty times.
+- The comparison is against the last frame actually **searched**, not the last
+  frame seen, so a slow drift accumulates and trips the gate instead of sliding
+  under it one frame at a time. Someone easing into view slowly would otherwise
+  be invisible indefinitely.
+- The threshold (1.0 mean absolute difference) sits above this camera's
+  measured noise floor (~0.3) and far below a person. Anything ambiguous falls
+  through to detection: when in doubt it looks.
+
+Verified on the live camera after the change: `faces_seen: 0` - and the gate is
+not why. Running the detector directly over the same frames finds **0 faces at
+threshold 0.50**, let alone 0.82. The people in view are seated, side-on and
+far away, which is the same `fraction_below_gate: 0.59` this file already
+records. The placement is still the limit; the CPU was simply being spent to
+discover that 15 times a second.
+
+## Three states that looked like health from outside
+
+Found by auditing the engine for what it does when something goes wrong,
+rather than when it goes right. Each of these left the process healthy, the
+dashboard green and the product not working - the class of bug this file
+already calls a headcount wrong in a way nobody can detect.
+`tests/test_reliability.py` covers all three.
+
+### A gallery the running encoder cannot read
+
+The fallback chain exists so a memory-starved box still starts, and
+CLAUDE.md already warned that "on a memory-starved box the big model silently
+loses the chain". What it did not say is what that **costs**: embeddings are
+model-tagged, so every vector the previous encoder wrote becomes invisible.
+The shop keeps its whole customer list and recognises nobody on it. Every
+regular is greeted as a stranger and enrolled a second time. Footfall stays
+correct, which is precisely why nothing looks wrong.
+
+The only evidence was an INFO line reading `gallery ready: 0 embeddings
+(model 'w600k_mbf') across 21 identities` - a sentence that says the disaster
+and calls it ready. Run against the real 87-embedding gallery with the
+fallback model forced, it now says:
+
+```
+WARNING gallery: 87 of 87 stored embeddings were written by a DIFFERENT
+        encoder (w600k_r50) and cannot be searched - 21 known people are
+        unrecognisable under the running model 'w600k_mbf'.
+```
+
+`Gallery.health` carries the same numbers to `/api/stats` and
+`gallery_unreadable_embeddings` to `/api/health`, because a log line on a shop
+PC is read by nobody. It travels for the same reason `fraction_below_gate`
+does: beside the number it qualifies. `identities_stranded` is the figure that
+matters - **people lost, not vectors** - and an empty gallery reports zero
+rather than raising an alarm on a fresh install.
+
+### Connected, and sending nothing
+
+`connected` meant *the socket opened*. A stream that opens and then goes quiet
+kept it `true` while `last_frame_age_s` climbed, so the heartbeat told head
+office the camera was up. OpenCV breaks a blocked read after 30s and we
+reconnect - but a camera trickling one frame every 20s never trips that at
+all, so it never reconnects and never recovers.
+
+`stalled()` and `streaming` are reported beside `connected`, and the local
+dashboard now says **live / stalled / offline** rather than live / offline.
+Three states because two of them need opposite actions: offline sends you to
+the network, stalled says the camera is answering and sending nothing. Same
+rule as `artifact` vs `no_faces` in the commissioning verdicts.
+
+`STALL_AFTER_S = 10` is not a preference. The tracker abandons a face after
+`max_misses` (25 frames, ~1.7s at 15 fps), so by 10s every track is long gone
+and 150 frames are missing: whatever this is, recognition cannot use it.
+
+### The 5-second RTSP timeout that never existed
+
+`capture.py` set `stimeout;5000000` with a comment claiming "a 5s socket
+timeout so a dead camera is noticed". Measured against this build (OpenCV
+4.11, FFmpeg 7.1) on a socket that accepts the connection and then says
+nothing:
+
+```
+  stimeout;5000000 -> 30.0s     timeout;5000000 -> 30.0s
+  stimeout;2000000 -> 30.5s     timeout;2000000 -> 30.4s
+  no timeout option at all      -> 30.3s
+```
+
+Identical with the option absent, under either name, so it was never honoured
+through this path - `stimeout` was renamed `timeout` in FFmpeg 5.0 and neither
+reaches the RTSP protocol here. The real bound is OpenCV's own interrupt
+callback, a compile-time constant we do not control. Both names are still set
+(harmless, and right on a build where they do work), but **nothing depends on
+them**.
+
+What replaces it is `_tcp_reachable` in `_open()` - the pre-flight
+`probe_source` already used, in code we own. It matters beyond speed: the
+`cv2.VideoCapture` constructor is not interruptible, so `stop()` could not cut
+it short and a camera removed from head office left a daemon thread holding a
+socket for half a minute. Measured:
+
+```
+  unroutable address     30.3s -> 2.02s   "no response from ... within 2s"
+  host up, port closed   30.3s -> 0.00s   "cannot reach ... Connection refused"
+  wrong port, real cam   30.3s -> 1.01s   "cannot reach ... Connection refused"
+```
+
+`last_error` is reported with the camera, because `connected: false` alone
+cannot tell a wrong IP from a wrong password, and those are different jobs.
+
+## The admin console could list merchants and see nothing inside them
+
+`GET /api/admin/clients/{id}` and, under it, `/sites`, `/sites/{site}`,
+`/sites/{site}/cameras`, `/sites/{site}/cameras/{camera}`, plus
+`/api/admin/monitoring/summary`. The head-office console drills down
+merchant -> store -> camera and every level below the first showed *"Backend
+integration required"*.
+
+They cannot be the tenant routes, and the reason is structural. Every tenant
+handler derives the client from the **session** - that is what makes
+cross-tenant access impossible rather than merely disallowed - and a platform
+admin has no client at all. The three workarounds each make it worse: passing
+a company id to a tenant route puts a caller-chosen tenant back in the one
+place this system refuses to take one, filtering the estate in the browser
+ships every merchant's data to render one, and signing in as the owner audits
+the wrong person. So the tenant STORE functions are reused with an explicit
+client id - they already take one - and the scoping the tenant handlers get
+from the session happens in the handler instead.
+
+- **`AdminCamera` is a separate type from `Camera`**, for the same reason
+  `AgentCamera` is: it cannot carry `host`, `port`, `path`, `username` or
+  `has_password`. A tenant seeing those for their own camera is correct; a
+  platform admin browsing another company's estate is a different question,
+  and an RTSP host with a username beside it is most of a live path into a
+  customer's camera. Blanking fields on a shared struct leaves "remember to
+  redact, on every path, forever" as the only thing preventing a leak. The
+  test asserts on the **raw JSON**, because decoding into the struct would
+  discard exactly what it is looking for.
+- **An unowned site is 404, never an empty list.** `[]` says "this shop has no
+  cameras" when the truth is "not your shop".
+- **Every read below the merchant list writes an audit row.** An admin is the
+  one account for which nothing else here leaves a trace. The counts-only
+  summary does not: a console refreshes it on a timer, and logging that buries
+  the reads worth finding.
+- **A suspended merchant stays readable** - that is precisely what an admin
+  opens the console to look at.
+
+Alongside it, the two merchant-side reads that were only ever aggregates:
+`GET /api/sales` and `/api/sales/{id}` over the `purchases` table the
+conversion report has summed since it existed, and
+`GET /api/dashboard/summary`. No cursor on the sales list, deliberately: a
+keyset cursor needs a monotonic server-assigned column and `purchases` has
+none, so ordering by `(occurred_at, id)` with a random uuid tie-break is
+exactly the shape that dropped four of six simultaneous visits before
+`visits.seq` existed. Offering one would imply a delivery guarantee this table
+cannot make.
+
+### What the fake could not catch, and the database did immediately
+
+Both of these passed every in-memory test and failed on the first real call.
+
+**A wrong URL answered 500.** `c.id = $1::uuid` makes Postgres cast the path
+segment, and casting a malformed string - or the empty one a shape check hands
+back in its place - is an **error**, not a miss. `c.id::text = $1` cannot fail.
+The two sibling resolvers were already written that way and correctly 404'd the
+same input: the rule was applied to two of three places, which is the shape of
+a rule that holds until somebody adds the next one. `api_admin_monitor_live_test.go`
+asserts it where the property actually lives.
+
+**Five live endpoints answered 500 to a platform admin** - `/api/visits`,
+`/api/cameras`, `/api/sites`, `/api/visitors`, `/api/reports/footfall` - and had
+done since they shipped. Same cause one level up: a platform admin has no
+client, every tenant query scopes on `client_id = $1::uuid`, and `''::uuid` is
+a cast error. `tenantOnly` is the guard, beside `adminOnly` and for the
+opposite audience. **403, not 404**, because the two hide opposite things: a
+tenant must not learn a platform surface exists, while a platform admin already
+knows the tenant surface does - so the refusal names the route to use instead.
+`/api/auth/*` stays ungated: a session is not a company's data, and revoking a
+lost device must work for an account with no tenant.
+
+Guarding at the chokepoint rather than per query is the point. A per-query cast
+is a fix the next query forgets, and the next query would 500 in production
+exactly as these did.
+
+### Two bugs in the deploy script, both found by running it
+
+- **`go: command not found` at step 1**, on the machine the script was written
+  on. Go sits in a directory `.zprofile` adds and a script does not inherit. A
+  deploy that needs the operator to fix their environment first is a deploy
+  that gets skipped, which is the failure this script exists to end.
+- **Step 3 reported the wrong backup.** `ls | tail -1` sorts alphabetically, so
+  `pre-...-demo-12` sorts before `pre-...-demo-6` and it printed a dump from
+  four days earlier. A deploy that names the wrong safety net is worse than one
+  that names none - that is the file somebody reaches for at the worst moment.
+- Step 7 verified five routes and none of them were the nine that had just
+  shipped. It checks all of them now and treats **401 as a pass**: an
+  unauthenticated call to a route that exists is refused, while one the binary
+  never registered is a 404. That makes the step prove the *routing*, which is
+  what a deploy gets wrong, and a missing route now fails the deploy loudly.
+
+Verified live on 2026-09-28 against production (`v0.4.8-demo-14-g830c1c1`):
+merchant detail with its owner, the drill-down by slug and by uuid, camera rows
+carrying no host or username, another merchant's shop and camera both 404,
+malformed identifiers 404 rather than 500, one real sale (INR 1000, V-1) read
+back by id, and every tenant route still 200 for an ordinary tenant account.
+
+## Nobody could change their own password
+
+`POST /api/auth/password`. The cost of its absence was measured rather than
+argued. Rotating the three production accounts took a shell on the host, three
+round trips, and briefly left the **platform admin** — the account that reads
+every company on the estate — with the password `PASTE_IT_HERE`, because a
+placeholder in a pasted command was taken literally and there was no way to
+correct it from the product itself.
+
+A manager could always reset somebody *else's* password. A platform admin could
+be reset by nobody: they have no client, so the team routes are not theirs, and
+`provision user` on the host was the only route. For software that puts
+accounts on shop-floor PCs and staff phones, this is not a feature — it is what
+makes every other credential decision recoverable.
+
+- **`authed`, not `tenantOnly`.** A session is not a company's data, and the
+  account with no company is precisely the one that had no route. Scoping it by
+  client would have reproduced the hole it exists to close — which is also why
+  `SetUserPassword` is not client-scoped the way `ResetMemberPassword` beside
+  it is. The user id comes from the verified session, never the request.
+- **The current password is required**, or an access token alone takes an
+  account over permanently instead of for the rest of the day.
+- **Every other session is revoked and the caller's is kept.** A failure there
+  is logged, not returned: the password is already changed, and an error would
+  send the user to retry with a current password that no longer exists.
+
+Verified live against production: wrong current password 403 and nothing
+changed, a change revoking **45** stale sessions while the caller's own
+survived, the new password in and the old one out, then changed back.
+
+### And a shell quoting trap worth not repeating
+
+The first attempt to rotate the admin password from the operator's terminal
+ran with the literal string `PASTE_IT_HERE`. The second, reading the value out
+of a file, produced **no output at all** and changed nothing — `~` was not
+expanded in that eval context, `awk` could not open the file, returned
+non-zero, and `&&` short-circuited silently. Absolute paths and `;` instead of
+`&&` fixed it, and echoing the password *length* first is what proved the
+third attempt was about to set something real. A command handed to somebody to
+paste should contain nothing to edit and should fail loudly.
+
+## A customer nobody has photographed, and the way back
+
+`POST /api/customers` and `POST /api/visitors/{id}/merge`, shipped together
+because the first creates the need for the second. A customer typed in at a
+counter has **no face template**, so when a camera sees that person later the
+matcher has nothing to compare against and enrols them as somebody new. That is
+the design working, not failing — and it means every hand-created customer is a
+duplicate waiting to happen. Shipping the create alone would have manufactured
+duplicates into the state this file already flagged: *"there is no merge
+endpoint server-side, so its duplicates would be unrecoverable."*
+
+The number comes from `clients.visitor_seq`, taken exactly as `RecordVisit`
+takes it. Two sources of visitor numbers that could disagree would be worse
+than none — `V-42` has to mean one person whichever way they arrived.
+
+**The merge is one transaction over five tables, and the count is the point.**
+`visits`, `purchases`, `visitor_embeddings`, `consents` and `visitor_profiles`
+all reference visitors `ON DELETE CASCADE`, so a table it forgets to re-point
+is not an error: those rows are destroyed with the source and nobody finds out
+until a customer's history is short.
+
+Policies carried from the edge gallery's merge, which settled them once
+already: a human name outranks an auto `Visitor N` whichever direction the
+operator merged; `visit_count` is recomputed with `COUNT(*)` and never summed;
+`first_seen_at` takes the earlier. Two that are this side's own: the source is
+**deleted for real** (a tombstone would leave its number resolving to a record
+holding nothing, which reads as *"exists and has never been here"*), and the
+response names the **retired reference**, because staff write `V-42` on cards.
+
+### It lost a phone number on its first live run
+
+Found by walking the scenario against production, not by a test. Two records
+each with a phone; the survivor kept its own and the source's stopped existing.
+
+The first rule was *"fill the survivor's blanks, never overwrite"* — correct
+about which value **wins** and silent about the one that loses. One person can
+have two numbers. A merge that quietly deletes one is the same data loss this
+file already refuses: *"silently turning Alice back into Visitor 3 is data loss
+the operator cannot see happen."*
+
+The profile is reconciled field by field in Go now, because the interesting
+case was never the winner. Every losing value is returned in `discarded` **and**
+appended to the survivor's notes — the response is read once, the record is read
+forever. Notes are additive rather than a winner: two people writing about one
+customer wrote two different true things.
+
+And retained was not enough. `SearchVisitors` did not look at notes, so the
+number was kept and **unfindable** — the letter of "nothing is lost" without the
+point of it. Search covers notes now, which is what makes a customer reached by
+their old number the one who comes back.
+
+One bug caught in that same patch and worth the warning: the new clause was
+written `ESCAPE` with two backslashes where the four beside it use one. In a Go
+raw string that is two literal characters and Postgres requires exactly one —
+it would have failed the **whole** customer search at runtime, on a query no
+in-memory test executes.
+
+## The desktop app on two platforms, and three bugs found by launching it
+
+All three were reported or found by *starting the app the way a person
+starts one*, and all three had survived every test.
+
+### "Open dashboard" in the tray did nothing reliable
+
+`runtime.Show` was wrong three times over and the first is why it failed
+rather than merely misbehaved. Wails implements `Show()` as a bare
+`mainWindow.Show()` while `WindowShow()` wraps the identical work in
+`runtime.LockOSThread`. Win32 window operations must run on the thread owning
+the window's message pump, and the tray handler runs on the **systray's**
+goroutine, which never is.
+
+Two more, each sufficient alone: showing is not un-minimising (hidden and
+minimised are different states), and Windows refuses the foreground to a
+process that does not already hold it — so the window returned *behind*
+whatever was being looked at. A tray click is by definition a moment when the
+app is not in front, so that is every time, not an edge case. The
+always-on-top flip is the ordinary way to ask, and it is why this runs in a
+goroutine: a menu loop that sleeps is a tray that ignores the next click.
+
+`OnSecondInstanceLaunch` had the same shape and is hit far more often —
+double-clicking the desktop icon while the app is already running.
+
+### The engine inherited whatever directory launched the app
+
+Nothing ever set `cmd.Dir`, so the child took the parent's — and an app
+started by double-clicking its bundle is handed `/`. On macOS the symptom was
+`python: No module named behavision` forever, because the dev engine runs as
+`-m behavision`, which resolves against the working directory.
+
+**The same app launched from a terminal inside the repo worked perfectly**,
+which is the shape of a bug that survives every test a developer runs.
+`Config.EngineDir` (empty = install root) is set by both launchers, which had
+identical code and the identical omission.
+
+### macOS is a supported DEVELOPER target, not a product
+
+Indian retail counters are Windows. A Mac product means an Apple Developer
+account, notarisation, a second installer, and DPAPI having no macOS
+equivalent — a permanent second platform for customers who do not have Macs.
+What it *is* worth is demoing on the machine this is written on.
+
+It cost one missing framework and then two crashes:
+
+```
+  link       Undefined symbols: _OBJC_CLASS_$_UTType
+             Wails' darwin frontend references it and does not link
+             UniformTypeIdentifiers. Fails at the LINK step after compiling
+             everything, so it reads like a broken toolchain.
+  systray.Run              SIGTRAP in cgo — nativeLoop takes the macOS main
+                           run loop and Wails already has it
+  RunWithExternalLoop      "NSWindow should only be instantiated on the main
+                           thread!" — still builds AppKit objects, and
+                           OnStartup is not the main thread
+```
+
+So **there is no tray on macOS**, and the consequence is handled rather than
+left: with no tray there is no way back from a hidden window and no way to
+quit, so on macOS closing the window quits and stops the engine. Same rule the
+tray's Quit follows — never leave it watching with no visible control.
+
+**The window could not be maximised**, and that was an omission with a precise
+consequence. Wails computes `zoomable` *inside* `if frontendOptions.Mac !=
+nil`; the variable defaults to 0, and the native side then does
+`if (!zoomable && resizable) [zoomButton setEnabled: NO]`. There was a
+`Windows` options block and no `Mac` one — so the platform that was configured
+behaved and the platform that was not looked broken.
+
+### A macOS release costs nothing extra, and the reason is worth keeping
+
+`release.sh` has never used PyInstaller. The Windows package is a **source
+install**: a pure-Python wheel plus `behavision-setup`, which builds a venv on
+the target machine, done that way because PyInstaller cannot cross-compile.
+macOS therefore needs nothing new — same wheel, same setup tool, a natively
+built `.app` instead of the `.exe`. `MAC=1 ./release.sh` opts in.
+
+Not notarised, and that is stated in the notes rather than discovered: macOS
+*blocks* an unsigned download rather than warning like SmartScreen, so a first
+launch needs right-click → Open.
+
+Verified by extracting the published zip to a clean directory: signature
+intact through the round trip, the app runs, and it reports *"engine not
+installed yet; run behavision-setup, then Start"* — the correct fresh-machine
+state rather than a crash.
+
 ## Setting up on a new machine
 
 1. Copy the `Behavision` folder **including `.env`** (gitignored, holds
@@ -2803,3 +3307,132 @@ Against real Postgres, on the demo tenant:
 - HTML, PDF, GIF and empty bodies are all refused as face images: the check is
   on the magic bytes, never the `Content-Type` header, because this endpoint
   stores what it is handed and serves it back to a browser.
+
+## Viewer mode: the app on a computer that is not watching anything
+
+Signing in on a second Mac showed `engine not reachable at
+http://127.0.0.1:8010` and **0 of 0 cameras**, on an account whose shops were
+running and recognising people the whole time. Nothing was broken. `App.Live()`
+and `App.Cameras()` read **only** `a.local`, so the app answered as though the
+person had never signed in — and camera sync goes *through* the engine, which
+is why the count was zero rather than merely stale.
+
+That is the wrong model of what this application is. A shop PC watches
+cameras; an owner's laptop, a manager's machine, a second till being set up do
+not, and all three are signed in to the same estate. **Having no engine is a
+normal state, not a failure**, and the app now says what it can see from where
+it is standing instead of reporting the absence of something it does not need.
+
+Both methods try loopback first and fall back to head office when it fails and
+somebody is signed in. The order matters: a real shop PC must never be shown
+head office's minute-old summary when the engine two milliseconds away has the
+live one.
+
+- **`Viewing` is on the snapshot, not inferred in the browser.** Three surfaces
+  read it — the banner, the camera tally, the getting-started panel — and a
+  screen that computed it separately is how the shops screen once came out
+  labelled **Working**, in green, directly above *"2 of 3 cameras not
+  connecting"*. One fact, one place, the same rule as the tray being a client
+  of `EngineStatus()`.
+- **`fraction_below_gate` is the WORST shop, never an average.** 0.10 against
+  0.73 averages to 0.42 and hides the only shop anyone needs to visit. Same
+  rule the heartbeat already follows with `worst_site`.
+- **A remote camera is flagged `remote: true`, and the screen withholds Edit,
+  Remove and Check placement.** Those talk to a camera on a LAN this computer
+  cannot reach, and an Edit button that cannot work is worse than one that is
+  absent. The tenant response structurally cannot carry `host`, `username` or
+  `has_password`, so nothing here can invent them either — a test asserts that.
+- **`connected` is three states.** `null` is "no shop computer has reported on
+  this yet" and reads as *waiting*; `false` is *"Not connecting"*. A bare false
+  sends somebody to check cabling on a camera nobody has tried to reach.
+- **The picture is the last snapshot, and it says so.** There is no live video
+  here: the engine's MJPEG stream is on the shop PC's loopback behind a router
+  with no inbound route. Head office's `LiveHub` relay is the answer to that
+  and is a further step for this client; the banner does not imply otherwise.
+- **Snapshots are fetched in Go and passed as `data:` URIs, cached by
+  `snapshot_at`.** A webview `<img>` resolves a relative src against `wails://`
+  and cannot send the session's bearer — the same problem `VisitorImage`
+  already solved — and this screen polls every 8 seconds at ~90 KB a camera, so
+  re-fetching an unchanged frame is megabytes an hour to redraw the same
+  picture. Keyed on the server's `snapshot_at`, because a new timestamp is the
+  only thing that means a new photograph.
+- **With no engine AND nobody signed in, the engine error is still the answer.**
+  There is nothing else to show and the person is most likely setting this PC
+  up; naming head office there points them at a step they have not reached.
+
+## Watching a camera from the app, in another building
+
+Snapshots answer *"is that camera working"*. They do not answer *"what is
+happening in my shop right now"*, which is what somebody who opens the app
+away from the counter is asking. Head office's browser already had the answer
+— `LiveHub` plus `cameras.Live`, where the shop PC asks outbound whether
+anybody is watching and pushes JPEG frames up for exactly as long as somebody
+is — and the app could not reach it.
+
+`cloud.CameraLive` opens that feed and the app's own loopback relay re-emits
+it as **multipart MJPEG**, which is the whole trick: frames arrive base64 over
+SSE, an `<img>` cannot render that, and an `<img>` renders MJPEG natively. So a
+tile is an ordinary `<img>` pointed at loopback whether the camera is in this
+room or another city, and no screen has to know which.
+
+- **Reconnecting happens in the relay, not the page.** The server caps one push
+  at five minutes so a tab left open for a week cannot leave a shop uploading
+  for a week. Doing it here means the `<img>` never sees the stream end.
+- **The headers are flushed before the first frame.** Go writes them on the
+  first body write, so without that the whole response — status line included —
+  waits for the shop PC to start pushing. Measured against production: thirty
+  seconds and not even a `Content-Type`, which surfaces as the *request* timing
+  out rather than a stream that has not painted yet.
+- **One camera at a time.** Watching makes a shop PC upload, so a grid that
+  went live at once would put an estate's worth of cameras on the wire because
+  somebody opened a page. `Watch live` is per tile and toggles the previous one
+  off.
+- **`live.mjpeg` is behind the same per-run token as the engine routes**, and a
+  wrong token is a 404 that never reaches head office at all. It is a live view
+  of a shop floor; the relay being on loopback is not on its own a control.
+- **`CameraLive` uses its own HTTP client.** The shared one has a 30-second
+  timeout that covers the whole response and would therefore sever a working
+  live view every thirty seconds — the same trap that made the server set
+  `WriteTimeout` to zero for its own SSE endpoint.
+
+## A camera read "Connected" for 34 minutes after the shop PC went blind
+
+Found while verifying the live view against production, and it is the reason
+that verification looked like a failure: head office registered the viewer and
+no frame ever came.
+
+`reportWith` returns early when the engine is unreachable — correctly, because
+it has nothing to say — so the last state it sent **stays in the database
+looking current**. Measured on the live estate: `cam2` and `entrance` both
+reading **Connected**, in green, with `last_seen_at` thirty-four minutes old,
+while the heartbeat from the same PC said `cameras_up: 0, cameras_total: 0`.
+Two surfaces reading two stored fields and disagreeing about one fact.
+
+`false` could not be the answer. It means *"this camera is not connecting"*,
+which sends an installer to check cabling on a camera that was working
+perfectly the last time anybody could ask it. So there are four states, not
+three, and `api.CameraState` is the one function that decides them:
+
+| state | meaning | what to do |
+|---|---|---|
+| `connected` | reported within `CameraStaleAfter`, and working | — |
+| `not_connecting` | reported recently, and the stream will not open | check the address, password, cabling |
+| `waiting` | no shop PC has ever reported this camera | it has not reached the PC yet |
+| `stale` | reported once, and not lately | check the PC is on and Behavision is running |
+
+- **`Connected` is CLEARED when the state is `stale` or `waiting`.** Leaving a
+  stale `true` in place keeps the lie available to every client that reads the
+  field directly — a mobile app, a script, an older desktop build — and leaves
+  two fields on one object disagreeing, which is exactly how the shops screen
+  once came out labelled **Working**, in green, above *"2 of 3 cameras not
+  connecting"*.
+- **It is computed in `scanCamera`**, so every camera anybody reads passes
+  through it. A state computed per handler is a state one handler forgets, and
+  this one had already reached three screens.
+- **`CameraStaleAfter` is 5 minutes — five missed reports, not one.** The agent
+  reports on a 60-second tick, so one miss is a dropped packet. Same reasoning
+  as a site being offline after three missed heartbeats: an indicator that
+  cries wolf is one people learn to ignore.
+- **An unparseable `last_seen_at` is stale**, not connected. It should be
+  impossible, which is precisely why it must not fall through to the state that
+  says everything is fine.

agent/cmd/behavision-setup/main.go

@@ -92,6 +92,18 @@ func run() error {
 		}
 	}
 
+	if running := behavisionRunning(); running != "" {
+		// lint:ignore ST1005 — this is not a wrapped error, it is the whole
+		// message an operator reads at a shop counter. ST1005 forbids
+		// trailing punctuation because errors get concatenated mid-sentence;
+		// nothing wraps this one, and stripping the full stops would make
+		// three sentences run together.
+		//lint:ignore ST1005 operator-facing prose, never wrapped
+		return fmt.Errorf("%s is running. Quit Behavision from the tray icon first, then run setup again.\n\n"+
+			"Setting up underneath a running copy starts a second engine on the same port and, in a demo,\n"+
+			"re-claims the shop while the open app still holds the old credentials.", running)
+	}
+
 	py, ver, err := findPython()
 	if err != nil {
 		return err
@@ -173,8 +185,19 @@ func run() error {
 	}
 
 	fmt.Println()
-	fmt.Println("  Done. Start Behavision from the Start menu or the desktop icon.")
-	fmt.Println("  It appears in the system tray; right-click there to stop it.")
+	// The last thing setup says is the first thing the operator does, so it
+	// has to describe THEIR machine. On macOS there is no Start menu and,
+	// deliberately, no tray at all - telling somebody to right-click a tray
+	// icon that does not exist is how software loses their trust on the step
+	// where it was otherwise finished.
+	if runtime.GOOS == "windows" {
+		fmt.Println("  Done. Start Behavision from the Start menu or the desktop icon.")
+		fmt.Println("  It appears in the system tray; right-click there to stop it.")
+	} else {
+		fmt.Println("  Done. Open Behavision.app - right-click it and choose Open the")
+		fmt.Println("  first time, because this build is not notarised.")
+		fmt.Println("  There is no tray on macOS: closing the window stops recognition.")
+	}
 	fmt.Println()
 	return nil
 }
@@ -210,6 +233,22 @@ func engineSource() (string, error) {
 // `py -3` first on Windows: the launcher is what the official installer puts
 // on PATH, and `python` there is often the Microsoft Store stub that prints an
 // advert and exits 9009 instead of running anything.
+// behavisionRunning names a Behavision process if one is up. Windows only -
+// that is the platform setup ships on - and by image name via tasklist, which
+// needs no extra privilege.
+func behavisionRunning() string {
+	if runtime.GOOS != "windows" {
+		return ""
+	}
+	for _, name := range []string{"Behavision.exe", "behavision-agent.exe"} {
+		out, err := exec.Command("tasklist", "/FI", "IMAGENAME eq "+name, "/NH").Output()
+		if err == nil && strings.Contains(strings.ToLower(string(out)), strings.ToLower(name)) {
+			return name
+		}
+	}
+	return ""
+}
+
 func findPython() (string, string, error) {
 	type cand struct {
 		exe  string
@@ -219,13 +258,53 @@ func findPython() (string, string, error) {
 	if runtime.GOOS == "windows" {
 		cands = append(cands, cand{"py", []string{"-3"}})
 	}
+
+	// Versioned names FIRST, newest first, and this is not belt-and-braces on
+	// macOS - it is the only thing that works. `/usr/bin/python3` there is
+	// always the Command Line Tools build, 3.9 on current macOS, which is
+	// below the 3.10 floor. Anything newer installs as `python3.12` or into a
+	// directory that is not on a GUI application's PATH. Searching only
+	// `python3` therefore told a Mac with Python 3.12 sitting on it to go and
+	// install Python - measured on this machine, which has 3.12 under
+	// ~/.local/opt and reported "Found, but too old: python3 3.9".
+	versions := []string{"3.14", "3.13", "3.12", "3.11", "3.10"}
+	for _, v := range versions {
+		cands = append(cands, cand{"python" + v, nil})
+	}
 	cands = append(cands, cand{"python3", nil}, cand{"python", nil})
 
+	// And the places a Mac puts an interpreter that LookPath will not find,
+	// because a double-clicked app inherits a minimal PATH rather than the
+	// one a shell profile builds.
+	if runtime.GOOS != "windows" {
+		home, _ := os.UserHomeDir()
+		for _, v := range versions {
+			for _, dir := range []string{
+				"/opt/homebrew/bin",
+				"/usr/local/bin",
+				"/Library/Frameworks/Python.framework/Versions/" + v + "/bin",
+				filepath.Join(home, ".local", "opt", "python"+v, "bin"),
+			} {
+				cands = append(cands, cand{filepath.Join(dir, "python"+v), nil})
+			}
+		}
+	}
+
 	var tried []string
 	for _, c := range cands {
-		exe, err := exec.LookPath(c.exe)
-		if err != nil {
-			continue
+		exe := c.exe
+		if filepath.IsAbs(exe) {
+			// An absolute candidate is a guess about where an interpreter
+			// might be; most will not exist, and that is not an error.
+			if fi, err := os.Stat(exe); err != nil || fi.IsDir() {
+				continue
+			}
+		} else {
+			found, err := exec.LookPath(exe)
+			if err != nil {
+				continue
+			}
+			exe = found
 		}
 		args := append(append([]string{}, c.args...), "-c",
 			"import sys;print('%d.%d'%sys.version_info[:2])")
@@ -244,10 +323,19 @@ func findPython() (string, string, error) {
 		}
 	}
 
-	msg := "no Python 3.10 or newer was found on this PC.\n\n" +
-		"    Install it from https://www.python.org/downloads/windows/\n" +
-		"    and tick \"Add python.exe to PATH\" on the first screen,\n" +
-		"    then run this again."
+	// The advice has to match the machine. Telling a Mac user to tick "Add
+	// python.exe to PATH" on a Windows installer page reads as software that
+	// does not know where it is running, which is exactly the moment somebody
+	// stops trusting the rest of what it says.
+	msg := "no Python 3.10 or newer was found on this computer.\n\n"
+	if runtime.GOOS == "windows" {
+		msg += "    Install it from https://www.python.org/downloads/windows/\n" +
+			"    and tick \"Add python.exe to PATH\" on the first screen,\n" +
+			"    then run this again."
+	} else {
+		msg += "    Install it with `brew install python@3.12`, or from\n" +
+			"    https://www.python.org/downloads/macos/, then run this again."
+	}
 	if len(tried) > 0 {
 		msg += "\n\n    Found, but too old: " + strings.Join(tried, ", ")
 	}

agent/go.mod

@@ -3,9 +3,12 @@ module github.com/loyaly/behavision-agent
 go 1.22
 
 require (
-	github.com/eclipse/paho.mqtt.golang v1.4.3 // indirect
+	github.com/eclipse/paho.mqtt.golang v1.4.3
+	golang.org/x/sys v0.20.0
+)
+
+require (
 	github.com/gorilla/websocket v1.5.0 // indirect
 	golang.org/x/net v0.8.0 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.20.0 // indirect
 )

agent/main.go

@@ -81,6 +81,7 @@ usage: %s <command>
 // agent.json - which is the state that screen was built to end.
 func cmdClaim(args []string) error {
 	if len(args) == 0 {
+		//lint:ignore ST1005 usage text read by a person, never wrapped
 		return fmt.Errorf("usage: behavision-agent claim <installation code>\n" +
 			"Ask whoever manages your shops for one - they can create it from\n" +
 			"the Behavision platform, under the shop.")
@@ -161,6 +162,7 @@ func cmdStatus() error {
 	// which is the default. Reading it here is what stops every call the agent
 	// makes to the engine coming back 401 on a stock install.
 	cfg = cfg.WithEngineCredentials(paths.APICredentials())
+	creds := config.NewCreds(paths.APICredentials(), cfg.APIUser, cfg.APIPassword)
 	q, err := spool.Open(paths.SpoolDir(), cfg.SpoolMax)
 	if err != nil {
 		return err
@@ -169,7 +171,7 @@ func cmdStatus() error {
 		Command:   func(context.Context) *exec.Cmd { return nil },
 		HealthURL: strings.TrimRight(cfg.APIBase, "/") + "/api/health",
 		StatsURL:  strings.TrimRight(cfg.APIBase, "/") + "/api/stats",
-		User:      cfg.APIUser, Password: cfg.APIPassword,
+		User:      cfg.APIUser, Password: cfg.APIPassword, Creds: creds,
 	})
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
@@ -204,6 +206,7 @@ func cmdRun() error {
 	// which is the default. Reading it here is what stops every call the agent
 	// makes to the engine coming back 401 on a stock install.
 	cfg = cfg.WithEngineCredentials(paths.APICredentials())
+	creds := config.NewCreds(paths.APICredentials(), cfg.APIUser, cfg.APIPassword)
 	// Opened before the engine starts: detections arriving in the first second
 	// must have somewhere to land.
 	q, err := spool.Open(paths.SpoolDir(), cfg.SpoolMax)
@@ -229,6 +232,14 @@ func cmdRun() error {
 	sup := engine.New(engine.Options{
 		Command: func(ctx context.Context) *exec.Cmd {
 			cmd := exec.CommandContext(ctx, exe, cfg.EngineArgs...)
+			// Run the engine FROM a known directory rather than from whatever
+			// happened to launch us. A double-clicked bundle hands its child
+			// "/", and an engine invoked as `-m behavision` then cannot find
+			// itself - measured on macOS, where it retried forever.
+			cmd.Dir = cfg.EngineDir
+			if cmd.Dir == "" {
+				cmd.Dir = paths.InstallRoot()
+			}
 			// How the engine learns where to send detections. The engine's
 			// config already reads `events.webhook_url: ${BEHAVISION_WEBHOOK_URL}`
 			// and python-dotenv does not override a variable the process
@@ -244,7 +255,7 @@ func cmdRun() error {
 		LogWriter: logFile,
 		HealthURL: strings.TrimRight(cfg.APIBase, "/") + "/api/health",
 		StatsURL:  strings.TrimRight(cfg.APIBase, "/") + "/api/stats",
-		User:      cfg.APIUser, Password: cfg.APIPassword,
+		User:      cfg.APIUser, Password: cfg.APIPassword, Creds: creds,
 	})
 
 	ctx, stop := signal.NotifyContext(context.Background(),
@@ -279,6 +290,7 @@ func cmdRun() error {
 	cloud := cameras.NewCloudClient(cfg.CloudBase, cfg.AgentToken)
 	cloud.Upload = uploader.UploadBytes
 	eng := cameras.NewEngineClient(cfg.APIBase, cfg.APIUser, cfg.APIPassword)
+	eng.Creds = creds
 	go cameras.New(eng, cloud, logger).Run(ctx)
 	// The live relay, which uploads nothing until somebody at head office is
 	// actually watching a camera.

agent/pkg/cameras/clients.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/loyaly/behavision-agent/pkg/bridge"
+	"github.com/loyaly/behavision-agent/pkg/config"
 )
 
 // EngineClient talks to the recognition engine on this PC's loopback.
@@ -21,7 +22,12 @@ type EngineClient struct {
 	Base     string
 	User     string
 	Password string
-	Client   *http.Client
+	// Creds re-reads the engine's generated credential when one is rejected.
+	// Without it a fresh install is 401 for the life of the process: the agent
+	// starts the engine, and the engine writes its credential file seconds
+	// after the agent has already read (and failed to find) it.
+	Creds  *config.Creds
+	Client *http.Client
 }
 
 func NewEngineClient(base, user, password string) *EngineClient {
@@ -50,14 +56,24 @@ func (e *EngineClient) do(ctx context.Context, method, path string, body, out an
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	if e.User != "" {
-		req.SetBasicAuth(e.User, e.Password)
+	user, pass := e.User, e.Password
+	if e.Creds != nil {
+		user, pass = e.Creds.Get()
+	}
+	if user != "" {
+		req.SetBasicAuth(user, pass)
 	}
 	resp, err := e.Client.Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusUnauthorized && e.Creds != nil && e.Creds.Refresh() {
+		// The engine generated its credential after we last looked. Read it
+		// and try once more rather than failing for the life of the process.
+		resp.Body.Close()
+		return e.do(ctx, method, path, body, out)
+	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		// The engine's message, not just a status. "camera stored but failed to
 		// start: connection refused" is something an operator can act on;

agent/pkg/cameras/live.go

@@ -36,7 +36,6 @@ type Live struct {
 	FPS       float64
 	Width     int
 	Quality   int
-	pollDelay time.Duration
 }
 
 // Defaults, measured against the office camera rather than guessed.

agent/pkg/config/config.go

@@ -37,7 +37,18 @@ type Config struct {
 	BrokerCAFile string `json:"broker_ca_file"`
 
 	// Engine process.
-	EngineExe   string   `json:"engine_exe"`
+	EngineExe string `json:"engine_exe"`
+	// EngineDir is the working directory the engine is launched IN. Empty
+	// means the install root.
+	//
+	// It exists because nothing set it, so the engine inherited whatever
+	// launched the app - and for an app started by double-clicking its
+	// bundle that is "/", not anywhere useful. The symptom on macOS was
+	// `python: No module named behavision` repeating forever: the dev engine
+	// is `-m behavision`, which resolves against the working directory. The
+	// same app started from a terminal in the repo worked, which is exactly
+	// the shape of a bug that survives every test run by a developer.
+	EngineDir   string   `json:"engine_dir,omitempty"`
 	EngineArgs  []string `json:"engine_args"`
 	APIBase     string   `json:"api_base"`
 	APIUser     string   `json:"api_user"`

agent/pkg/config/credentials.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"os"
 	"strings"
+	"sync"
 )
 
 // EngineCredentials reads the Basic credentials the engine generated for
@@ -60,3 +61,60 @@ func (c Config) WithEngineCredentials(path string) Config {
 	c.APIUser, c.APIPassword = EngineCredentials(path)
 	return c
 }
+
+// Creds resolves the engine's Basic credentials, re-reading the file when it
+// has none.
+//
+// Reading once at startup is wrong on a fresh install, and that is the case
+// that matters: the agent starts the engine, the engine generates its
+// credential and writes the file a few seconds later, and an agent that read
+// the file before that holds "" forever. Every call it makes - health, stats,
+// camera sync, the embedding for a visit - then comes back 401 for the life of
+// the process, on a brand new shop PC, with the tray showing a red engine that
+// is running perfectly. Measured on a fresh state directory: three 401s and no
+// camera ever reconciled.
+//
+// A configured credential is never re-read: an operator who set
+// BEHAVISION_API_USER means it.
+type Creds struct {
+	path  string
+	mu    sync.Mutex
+	user  string
+	pass  string
+	fixed bool
+}
+
+// NewCreds takes whatever the config already has. Non-empty means configured,
+// and is used unchanged.
+func NewCreds(path, user, password string) *Creds {
+	c := &Creds{path: path, user: user, pass: password}
+	c.fixed = user != "" || password != ""
+	return c
+}
+
+// Get returns the current pair, reading the file if it has nothing yet.
+func (c *Creds) Get() (string, string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.user == "" && !c.fixed {
+		c.user, c.pass = EngineCredentials(c.path)
+	}
+	return c.user, c.pass
+}
+
+// Refresh re-reads the file after a rejection and reports whether the pair
+// changed. Callers retry once when it did - which covers both the fresh-install
+// race and a credential the engine regenerated under a running agent.
+func (c *Creds) Refresh() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.fixed {
+		return false
+	}
+	u, p := EngineCredentials(c.path)
+	if u == c.user && p == c.pass {
+		return false
+	}
+	c.user, c.pass = u, p
+	return u != ""
+}

agent/pkg/config/credentials_firstrun_test.go

@@ -0,0 +1,77 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The sequence on a brand new shop PC, in order:
+//
+//	agent starts  ->  file does not exist yet
+//	agent starts the engine
+//	engine generates its credential and writes the file
+//	agent calls the engine  ->  must now succeed
+//
+// Read once at startup, the agent holds "" for the life of the process and
+// every engine call is 401: health, stats, camera sync, the embedding for a
+// visit. The tray shows a red engine that is running perfectly, and nothing
+// says why. Measured on a fresh state directory before this existed.
+func TestCredentialsArriveAfterTheAgentHasAlreadyLooked(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "api_credentials.txt")
+
+	creds := NewCreds(path, "", "") // nothing configured, file not there yet
+	if u, _ := creds.Get(); u != "" {
+		t.Fatalf("expected no credential before the engine has written one, got %q", u)
+	}
+
+	// the engine starts and writes its credential
+	if err := os.WriteFile(path, []byte("username=behavision\npassword=s3cret\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	// a 401 makes the agent look again
+	if !creds.Refresh() {
+		t.Fatal("Refresh did not pick up the credential the engine just wrote")
+	}
+	u, p := creds.Get()
+	if u != "behavision" || p != "s3cret" {
+		t.Fatalf("got %q/%q", u, p)
+	}
+}
+
+// An operator who set BEHAVISION_API_USER means it, and a file must never
+// override them.
+func TestAConfiguredCredentialIsNeverReplacedByTheFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "api_credentials.txt")
+	if err := os.WriteFile(path, []byte("username=generated\npassword=nope\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	creds := NewCreds(path, "chosen", "byhand")
+	if u, p := creds.Get(); u != "chosen" || p != "byhand" {
+		t.Fatalf("configured credential was replaced: %q/%q", u, p)
+	}
+	if creds.Refresh() {
+		t.Fatal("Refresh overrode a configured credential")
+	}
+}
+
+// A credential the engine regenerates under a running agent is picked up too -
+// the same mechanism, and the reason paths.APICredentials says the agent reads
+// the file "rather than storing a second copy".
+func TestARegeneratedCredentialIsPickedUp(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "api_credentials.txt")
+	os.WriteFile(path, []byte("username=behavision\npassword=old\n"), 0o600)
+	creds := NewCreds(path, "", "")
+	creds.Get()
+	os.WriteFile(path, []byte("username=behavision\npassword=new\n"), 0o600)
+	if !creds.Refresh() {
+		t.Fatal("a regenerated password was not picked up")
+	}
+	if _, p := creds.Get(); p != "new" {
+		t.Fatalf("still holding %q", p)
+	}
+}

agent/pkg/engine/supervisor.go

@@ -21,7 +21,12 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
 	"sync"
+
+	"github.com/loyaly/behavision-agent/pkg/config"
 	"time"
 )
 
@@ -56,6 +61,9 @@ type Options struct {
 	// no captured output is undiagnosable, which on a customer site means a
 	// site visit.
 	LogWriter io.Writer
+	// Creds re-reads the engine's generated credential when one is rejected,
+	// which is the ordinary case on a first run.
+	Creds *config.Creds
 	// HealthURL, StatsURL, User, Password address the engine's own API.
 	HealthURL string
 	StatsURL  string
@@ -76,6 +84,7 @@ type Supervisor struct {
 	restarts int
 	cancel   context.CancelFunc
 	done     chan struct{}
+	progress Progress
 }
 
 func New(opts Options) *Supervisor {
@@ -109,6 +118,37 @@ func (s *Supervisor) Start() {
 	go s.supervise(ctx, done)
 }
 
+// Progress is what the engine is busy with before it answers - on first run,
+// downloading ~275 MB of models. Empty once the engine is up.
+type Progress struct {
+	What    string `json:"what"`
+	Percent int    `json:"percent"`
+}
+
+var progressRe = regexp.MustCompile(`download: (.+?) (\d{1,3})%`)
+
+func (s *Supervisor) noteProgress(line string) {
+	m := progressRe.FindStringSubmatch(line)
+	if m == nil {
+		return
+	}
+	pct, _ := strconv.Atoi(m[2])
+	s.mu.Lock()
+	if pct >= 100 {
+		s.progress = Progress{}
+	} else {
+		s.progress = Progress{What: m[1], Percent: pct}
+	}
+	s.mu.Unlock()
+}
+
+// Progress reports the current first-run download, if any.
+func (s *Supervisor) Progress() Progress {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.progress
+}
+
 // Stop asks the engine to exit and waits for it.
 func (s *Supervisor) Stop() {
 	s.mu.Lock()
@@ -204,6 +244,13 @@ func (s *Supervisor) runOnce(ctx context.Context) error {
 		}
 		return kill()
 	}
+	// Cancel sends the kill; WaitDelay bounds how long Wait() then waits for
+	// the output pipes to close. Without it Wait() blocks until every writer
+	// is gone - and Stop() blocks on Wait() - so one grandchild still holding
+	// the engine's stdout hangs Stop FOREVER, which on the desktop app means
+	// the tray's Quit never returns. stopGrace was declared for exactly this
+	// and never wired to anything; staticcheck found it as an unused const.
+	cmd.WaitDelay = stopGrace
 	prepare(cmd)
 	if err := cmd.Start(); err != nil {
 		return fmt.Errorf("engine failed to start: %w", err)
@@ -218,18 +265,35 @@ func (s *Supervisor) runOnce(ctx context.Context) error {
 	kill = k
 	defer release()
 
+	// The last few lines the engine printed travel with the failure, because
+	// "engine exited: exit status 1" sends somebody to a log file on a shop
+	// PC, and the one line that matters - "port 8010 is already in use" - was
+	// right there.
+	var tailMu sync.Mutex
+	var tail []string
 	pumped := make(chan struct{})
 	go func() {
 		defer close(pumped)
 		sc := bufio.NewScanner(stdout)
 		sc.Buffer(make([]byte, 0, 64*1024), 1024*1024)
 		for sc.Scan() {
-			fmt.Fprintln(s.opts.LogWriter, sc.Text())
+			line := sc.Text()
+			fmt.Fprintln(s.opts.LogWriter, line)
+			s.noteProgress(line)
+			tailMu.Lock()
+			tail = append(tail, line)
+			if len(tail) > 12 {
+				tail = tail[1:]
+			}
+			tailMu.Unlock()
 		}
 	}()
 
 	s.setState(Running, nil)
 	waitErr := cmd.Wait()
+	s.mu.Lock()
+	s.progress = Progress{}
+	s.mu.Unlock()
 	<-pumped
 
 	// A context cancel terminates the child through exec's own handling; the
@@ -238,6 +302,12 @@ func (s *Supervisor) runOnce(ctx context.Context) error {
 		return nil
 	}
 	if waitErr != nil {
+		tailMu.Lock()
+		reason := explain(tail)
+		tailMu.Unlock()
+		if reason != "" {
+			return fmt.Errorf("%s (%v)", reason, waitErr)
+		}
 		return fmt.Errorf("engine exited: %w", waitErr)
 	}
 	return errors.New("engine exited unexpectedly with status 0")
@@ -351,14 +421,24 @@ func (s *Supervisor) getJSON(ctx context.Context, url string, out any) error {
 	if err != nil {
 		return err
 	}
-	if s.opts.User != "" {
-		req.SetBasicAuth(s.opts.User, s.opts.Password)
+	user, pass := s.opts.User, s.opts.Password
+	if s.opts.Creds != nil {
+		user, pass = s.opts.Creds.Get()
+	}
+	if user != "" {
+		req.SetBasicAuth(user, pass)
 	}
 	resp, err := (&http.Client{Timeout: 5 * time.Second}).Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusUnauthorized && s.opts.Creds != nil && s.opts.Creds.Refresh() {
+		// See cameras.EngineClient: on a fresh install the engine writes its
+		// credential after the agent has already read for one.
+		resp.Body.Close()
+		return s.getJSON(ctx, url, out)
+	}
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("%s returned %s", url, resp.Status)
 	}
@@ -373,3 +453,28 @@ func LogFile(path string) (*os.File, error) {
 	}
 	return os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)
 }
+
+// explain turns the engine's last output into the sentence the tray shows.
+// The cases are the ones seen on real installs; anything else shows the last
+// non-empty line verbatim.
+func explain(tail []string) string {
+	last := ""
+	for _, l := range tail {
+		low := strings.ToLower(l)
+		switch {
+		case strings.Contains(low, "address already in use") || strings.Contains(low, "only one usage of each socket address"):
+			return "port 8010 is already in use - another Behavision or its engine is still running"
+		case strings.Contains(low, "no module named behavision"):
+			return "the engine is not installed in this Python - run behavision-setup again"
+		case strings.Contains(low, "modulenotfounderror") || strings.Contains(low, "importerror"):
+			return "the engine is missing a library - run behavision-setup again"
+		}
+		if strings.TrimSpace(l) != "" {
+			last = strings.TrimSpace(l)
+		}
+	}
+	if len(last) > 120 {
+		last = last[:120] + "…"
+	}
+	return last
+}

agent/pkg/mqtt/client.go

@@ -18,7 +18,6 @@ import (
 	"log"
 	"net"
 	"net/url"
-	neturl "net/url"
 	"os"
 	"strings"
 	"time"
@@ -225,7 +224,7 @@ func checkTransport(raw string) error {
 	// url.Parse, not hand-rolled splitting: an IPv6 literal is bracketed and
 	// full of colons, so scanning for the first ":" turns "[::1]:1883" into
 	// "[" and refuses a perfectly good loopback address.
-	u, err := neturl.Parse(raw)
+	u, err := url.Parse(raw)
 	if err != nil {
 		return fmt.Errorf("mqtt: cannot parse broker url %q: %w", raw, err)
 	}

agent/pkg/mqtt/client_test.go

@@ -92,7 +92,11 @@ func TestPublishOnADeadClientErrorsRatherThanPanics(t *testing.T) {
 	// The pump calls this on every tick; a nil-client panic would take the
 	// whole agent down instead of backing off.
 	c := &Client{}
-	if err := c.Publish(nil, "t", []byte("{}")); err == nil { //nolint:staticcheck
+	// The nil context is the POINT: the pump must not panic on a client that
+	// never connected. //nolint is golangci-lint's directive and staticcheck
+	// ignores it, which is why this kept being reported.
+	//lint:ignore SA1012 passing nil is what is under test
+	if err := c.Publish(nil, "t", []byte("{}")); err == nil {
 		t.Fatal("publish on an unconnected client reported success")
 	}
 	if c.Connected() {

agent/pkg/mqtt/pump.go

@@ -205,14 +205,3 @@ func (p *Pump) logf(format string, args ...any) {
 		p.Log.Printf(format, args...)
 	}
 }
-
-func sleep(ctx context.Context, d time.Duration) bool {
-	t := time.NewTimer(d)
-	defer t.Stop()
-	select {
-	case <-ctx.Done():
-		return false
-	case <-t.C:
-		return true
-	}
-}

behavision/__main__.py

@@ -21,6 +21,17 @@ def cmd_run(args: argparse.Namespace) -> int:
 
     cfg = load_config(args.config)
     setup_logging(cfg.app.log_level, cfg.app.data_dir)
+    if cfg.app.detect_threads > 0:
+        # OpenCV sizes its pool for one big job on an idle machine. This is a
+        # small job repeated forever on a machine also running the recogniser,
+        # the tracker and possibly three other cameras, so the default costs
+        # twice the CPU for no useful latency. Measured: 31 ms CPU/frame at the
+        # default against 15 ms at one thread, for 6 ms more wall time against
+        # a 66 ms budget.
+        import cv2
+        cv2.setNumThreads(cfg.app.detect_threads)
+        log.info("detection threads: %d (OpenCV default was %d)",
+                 cfg.app.detect_threads, cv2.getNumThreads())
     missing = setup_models(cfg.app.models_dir)
     if missing:
         log.error("required models missing: %s", ", ".join(missing))

behavision/api.py

@@ -167,8 +167,13 @@ def create_app(engine: Engine) -> FastAPI:
     @app.get("/api/health")
     def health() -> dict:
         from .paths import describe
+        # A gallery the running encoder cannot read is the failure most
+        # worth catching from outside: the process is healthy, the cameras
+        # are up, and the shop recognises nobody it already knows.
+        stranded = engine.gallery.health["stranded"]
         return {"status": "ok" if engine.started_at else "starting",
                 "recognition_model": engine.encoder.model_name,
+                "gallery_unreadable_embeddings": stranded,
                 # "where is my database" must be answerable from the API: the
                 # tray, the installer and support all need it, and installed
                 # it is not next to the code.
@@ -332,6 +337,17 @@ def create_app(engine: Engine) -> FastAPI:
             worker.commission.cancel()
         return {"cancelled": camera_id}
 
+    @app.get("/api/cameras/discover")
+    def discover_cameras() -> dict:
+        """Cameras on this PC's network, for the add-camera form to pick from.
+
+        A sync def so FastAPI runs it in the threadpool: it holds a socket
+        open for a couple of seconds and sweeps a /24, and the event loop
+        must keep serving the live picture meanwhile.
+        """
+        from .discover import discover
+        return discover()
+
     @app.post("/api/cameras/test")
     def test_camera(payload: CameraPayload) -> dict:
         """Try a camera WITHOUT saving it - the UI's Test button.

behavision/capture.py

@@ -20,7 +20,26 @@ log = logging.getLogger(__name__)
 # Set before OpenCV loads ffmpeg, which reads this once.
 #
 # rtsp_transport=tcp: UDP is the default and silently drops frames on lossy
-# Wi-Fi. stimeout: a 5s socket timeout so a dead camera is noticed.
+# Wi-Fi.
+#
+# The timeout here is NOT what bounds a dead camera, and the comment that
+# once said it did was wrong. Measured against OpenCV 4.11 / FFmpeg 7.1 on a
+# socket that accepts the connection and then says nothing:
+#
+#     stimeout;5000000   -> 30.0s      timeout;5000000 -> 30.0s
+#     stimeout;2000000   -> 30.5s      timeout;2000000 -> 30.4s
+#     no timeout option at all         -> 30.3s
+#
+# Identical with the option absent, so it is not being honoured under either
+# name through this path. `stimeout` was renamed `timeout` in FFmpeg 5.0, and
+# neither reaches the RTSP protocol here. What actually bounds it is
+# OpenCV's own interrupt callback (30s for open, 30s for read), which is a
+# compile-time constant we do not control.
+#
+# Both names are still set, because on a build where they DO take effect the
+# shorter bound is what we want and an unrecognised option is ignored. But
+# nothing may depend on it: a wrong address is caught by _tcp_reachable
+# below, in code we own, in under a second.
 #
 # fflags=nobuffer and flags=low_delay: without them ffmpeg's RTSP demuxer
 # holds a comfortable queue of frames before handing over the first, which
@@ -30,10 +49,25 @@ log = logging.getLogger(__name__)
 # reorder wait for the same reason.
 os.environ.setdefault(
     "OPENCV_FFMPEG_CAPTURE_OPTIONS",
-    "rtsp_transport;tcp|stimeout;5000000|fflags;nobuffer|flags;low_delay|max_delay;200000",
+    "rtsp_transport;tcp|stimeout;5000000|timeout;5000000"
+    "|fflags;nobuffer|flags;low_delay|max_delay;200000",
 )
 
 
+# A stream can stay open and stop delivering. OpenCV breaks a blocked read
+# after 30s and we reconnect, but for those 30s `connected` is True and the
+# camera is dead — and a stream that trickles a frame every 20s never trips
+# that timeout at all, so it never reconnects and never recovers either.
+#
+# 10s is not a preference. The tracker gives up on a face after `max_misses`
+# (25 frames, ~1.7s at 15 fps), so by 10s every track is long gone and 150
+# frames are missing: whatever this is, it is not something recognition can
+# work with. Reported separately from `connected` because the two need
+# opposite actions — one says check the network, the other says the camera
+# is answering but sending nothing.
+STALL_AFTER_S = 10.0
+
+
 def _tcp_reachable(source: "str | int", timeout: float
                    ) -> "tuple[bool, str]":
     """Cheap pre-flight for an rtsp:// URL. Non-URL sources pass through."""
@@ -169,6 +203,10 @@ class VideoSource(threading.Thread):
         self.frames_total = 0
         self.reconnects = 0
         self._ever_connected = False
+        # Why the last open failed, in the words an installer can act on.
+        # Without it a camera that never connects reports only `connected:
+        # false`, which cannot distinguish a wrong IP from a wrong password.
+        self.last_error = ""
 
     # -- public ---------------------------------------------------------
     def latest(self) -> "tuple[Optional[np.ndarray], float]":
@@ -199,11 +237,23 @@ class VideoSource(threading.Thread):
     def stop(self) -> None:
         self._stopping.set()
 
+    def stalled(self) -> bool:
+        """Open, but not delivering. See STALL_AFTER_S."""
+        if not self.connected or not self._frame_ts:
+            return False
+        return (time.time() - self._frame_ts) > STALL_AFTER_S
+
     def stats(self) -> dict:
         return {
             "camera_id": self.camera_id,
             "url": self._display_url,
             "connected": self.connected,
+            # Connected AND delivering. `connected` alone stays true through
+            # a stall, so it is the wrong thing for a dashboard to colour a
+            # camera green on.
+            "streaming": self.connected and not self.stalled(),
+            "stalled": self.stalled(),
+            "last_error": self.last_error,
             "frames_total": self.frames_total,
             "reconnects": self.reconnects,
             "last_frame_age_s": round(time.time() - self._frame_ts, 1)
@@ -260,6 +310,19 @@ class VideoSource(threading.Thread):
         log.info("[%s] capture stopped", self.camera_id)
 
     def _open(self) -> Optional[cv2.VideoCapture]:
+        # Pre-flight the socket, exactly as probe_source does. Without it a
+        # camera that is off, moved or mistyped costs 30s per attempt inside
+        # the VideoCapture constructor (measured; it is OpenCV's interrupt
+        # timeout, not ours to shorten) — and the constructor is not
+        # interruptible, so stop() cannot cut it short and a removed camera
+        # leaves a daemon thread holding a socket for half a minute. A
+        # refused or unroutable address answers in well under a second, which
+        # is also what lets the backoff below mean what it says.
+        reachable, why = _tcp_reachable(self._source, 2.0)
+        if not reachable:
+            log.debug("[%s] %s", self.camera_id, why)
+            self.last_error = why
+            return None
         try:
             if isinstance(self._source, int):
                 cap = cv2.VideoCapture(self._source)
@@ -268,8 +331,12 @@ class VideoSource(threading.Thread):
             cap.set(cv2.CAP_PROP_BUFFERSIZE, 1)
             if not cap.isOpened():
                 cap.release()
+                self.last_error = ("reachable, but the stream would not open "
+                                   "- check the path and credentials")
                 return None
+            self.last_error = ""
             return cap
         except cv2.error:
             log.exception("[%s] VideoCapture error", self.camera_id)
+            self.last_error = "VideoCapture error - see the engine log"
             return None

behavision/config.py

@@ -132,6 +132,29 @@ class AppSection(BaseModel):
     # on changes what the system is under GDPR and India's DPDP, so it has to
     # be a decision somebody makes rather than one they inherit.
     store_faces: bool = False
+    # How many threads OpenCV may use for detection. Measured on the office
+    # camera (800x448 sub-stream): the default of 8 costs 31 ms of CPU per
+    # frame for 8.9 ms of wall time, while ONE thread costs 15.3 ms of CPU for
+    # 15.3 ms of wall - half the CPU for 6 ms more latency, against a 66 ms
+    # frame budget at 15 fps. The default is wrong here because OpenCV sizes it
+    # for one big job on an idle machine, and this is a small job repeated
+    # forever on a machine also running the recogniser, the tracker and three
+    # other cameras. 0 leaves OpenCV's own default alone.
+    detect_threads: int = 1
+    # Skip detection on frames where nothing has changed and nothing is being
+    # tracked. A shop is empty most of the day and a frame of an empty room
+    # costs exactly as much to search as a busy one. See CameraWorker.run for
+    # why this cannot lose a face.
+    motion_gate: bool = True
+    # Mean absolute difference, 0-255, over a 160x90 greyscale thumbnail. 1.0
+    # is well below the noise floor of a real camera - measured on this one,
+    # an empty room varies by ~0.3 between frames - so it triggers on movement
+    # rather than on sensor noise, and anything ambiguous detects.
+    motion_threshold: float = 1.0
+    # Detect at least this often regardless of the gate, so a change the
+    # thumbnail cannot see - someone entering at the far edge, a slow lean into
+    # frame - is still found within a second.
+    motion_max_skip: int = 12
 
 
 class ApiSection(BaseModel):

behavision/discover.py

@@ -0,0 +1,206 @@
+"""Find the cameras on the shop's network, so nobody has to type an address.
+
+The add-camera form asked for an IP address, and a shop owner does not know
+their camera's IP address. It is on a sticker under the camera, if at all, or
+inside the camera's own app under a menu called something different for every
+make. That one field is where onboarding stopped for anyone who was not an
+installer.
+
+Two probes, merged:
+
+- **WS-Discovery** (ONVIF's discovery protocol): one multicast to
+  239.255.255.250:3702 and every ONVIF camera on the LAN answers with its
+  address and, usually, its make and model. Cheap, fast, and names the device
+  - but only cameras that speak ONVIF answer, and some cheap ones do not.
+- **A TCP sweep of port 554** across the local /24: anything listening on the
+  RTSP port is very probably a camera or a recorder. Names nothing, misses
+  nothing that streams.
+
+A host found by either is a candidate; one found by both is a camera with a
+name. The result is a list to pick from, not a decision: the person still
+supplies the password, and Test still proves the stream opens.
+
+Stdlib only. This runs inside the engine, which ships as a small wheel, and a
+network-scanning dependency would be a large thing to add for two sockets.
+"""
+from __future__ import annotations
+
+import ipaddress
+import re
+import socket
+import uuid
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field, asdict
+from typing import Iterable
+
+# ONVIF WS-Discovery probe. The MessageID must be unique per probe; devices
+# ignore a repeat.
+_PROBE = (
+    '<?xml version="1.0" encoding="UTF-8"?>'
+    '<e:Envelope xmlns:e="http://www.w3.org/2003/05/soap-envelope" '
+    'xmlns:w="http://schemas.xmlsoap.org/ws/2004/08/addressing" '
+    'xmlns:d="http://schemas.xmlsoap.org/ws/2005/04/discovery" '
+    'xmlns:dn="http://www.onvif.org/ver10/network/wsdl">'
+    '<e:Header><w:MessageID>uuid:{mid}</w:MessageID>'
+    '<w:To e:mustUnderstand="true">urn:schemas-xmlsoap-org:ws:2005:04:discovery</w:To>'
+    '<w:Action e:mustUnderstand="true">http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</w:Action>'
+    '</e:Header><e:Body><d:Probe><d:Types>dn:NetworkVideoTransmitter</d:Types></d:Probe></e:Body>'
+    '</e:Envelope>'
+)
+_MCAST = ("239.255.255.250", 3702)
+
+# Makes we can name from an ONVIF scope or hostname, mapped to the ids the
+# camera-make picker uses so the form can preselect the stream path.
+_MAKES = (
+    ("hikvision", "hikvision"), ("hik", "hikvision"), ("dahua", "dahua"),
+    ("cp plus", "cpplus"), ("cpplus", "cpplus"), ("cp-plus", "cpplus"),
+    ("uniview", "uniview"), ("unv", "uniview"), ("tapo", "tplink"),
+    ("tp-link", "tplink"), ("reolink", "reolink"), ("amcrest", "amcrest"),
+    ("axis", "axis"),
+)
+
+
+@dataclass
+class Found:
+    host: str
+    rtsp: bool = False            # port 554 answered
+    onvif: bool = False           # answered WS-Discovery
+    name: str = ""                # from ONVIF scopes, e.g. "Hikvision DS-2CD2043"
+    make: str = ""                # picker id, when it can be guessed
+    onvif_url: str = ""
+    sources: list[str] = field(default_factory=list)
+
+
+def local_networks() -> list[ipaddress.IPv4Network]:
+    """The /24s this machine sits on, best effort and without dependencies.
+
+    Interface masks are not portable in the stdlib, so this assumes /24 - the
+    shape of nearly every shop's router - for each local IPv4 address it can
+    find. A bigger network would need a scan anyway that this should not run
+    unasked.
+    """
+    addrs: set[str] = set()
+    try:
+        # The address the OS would use to reach the internet: the LAN we care about.
+        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        s.settimeout(0.5)
+        s.connect(("8.8.8.8", 80))
+        addrs.add(s.getsockname()[0])
+        s.close()
+    except OSError:
+        pass
+    try:
+        for a in socket.gethostbyname_ex(socket.gethostname())[2]:
+            addrs.add(a)
+    except OSError:
+        pass
+    nets = []
+    for a in addrs:
+        try:
+            ip = ipaddress.IPv4Address(a)
+        except ValueError:
+            continue
+        if ip.is_loopback or ip.is_link_local:
+            continue
+        nets.append(ipaddress.IPv4Network(f"{a}/24", strict=False))
+    return sorted(set(nets), key=str)
+
+
+def ws_discover(timeout: float = 2.5) -> list[Found]:
+    """One ONVIF probe, every answer within `timeout` seconds."""
+    out: dict[str, Found] = {}
+    try:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
+        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        sock.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 2)
+        sock.settimeout(timeout)
+        sock.sendto(_PROBE.format(mid=uuid.uuid4()).encode(), _MCAST)
+    except OSError:
+        return []
+    import time
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        try:
+            data, (host, _) = sock.recvfrom(65535)
+        except socket.timeout:
+            break
+        except OSError:
+            break
+        f = parse_probe_match(data.decode("utf-8", "replace"), host)
+        if f:
+            out[f.host] = f
+    sock.close()
+    return list(out.values())
+
+
+_XADDR = re.compile(r"<[^>]*XAddrs[^>]*>([^<]+)<")
+_SCOPES = re.compile(r"<[^>]*Scopes[^>]*>([^<]+)<")
+
+
+def parse_probe_match(xml: str, host: str) -> Found | None:
+    """Pull the address and the human-readable scopes out of a ProbeMatch.
+
+    A regex rather than an XML parser on purpose: cameras emit every namespace
+    prefix imaginable and some emit XML that is not quite well-formed, and the
+    two fields wanted are flat text.
+    """
+    xaddrs = _XADDR.search(xml)
+    scopes = _SCOPES.search(xml)
+    if not xaddrs and not scopes:
+        return None
+    url = xaddrs.group(1).split()[0] if xaddrs else ""
+    # Prefer the host from the XAddrs URL: a device with several interfaces
+    # answers from the one it heard us on, which is the one we can reach.
+    m = re.match(r"https?://([^/:]+)", url)
+    ip = m.group(1) if m else host
+    f = Found(host=ip, onvif=True, onvif_url=url, sources=["onvif"])
+    if scopes:
+        words = []
+        for s in scopes.group(1).split():
+            if "/name/" in s or "/hardware/" in s:
+                from urllib.parse import unquote
+                words.append(unquote(s.rsplit("/", 1)[-1]))
+        f.name = " ".join(dict.fromkeys(words))  # dedupe, keep order
+    f.make = guess_make(f.name)
+    return f
+
+
+def guess_make(text: str) -> str:
+    low = text.lower()
+    for needle, make in _MAKES:
+        if needle in low:
+            return make
+    return ""
+
+
+def rtsp_sweep(nets: Iterable[ipaddress.IPv4Network], timeout: float = 0.5,
+               workers: int = 128) -> list[str]:
+    """Every host in `nets` with port 554 open. ~254 hosts in about a second."""
+    def probe(ip: str) -> str | None:
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.settimeout(timeout)
+        try:
+            return ip if s.connect_ex((ip, 554)) == 0 else None
+        except OSError:
+            return None
+        finally:
+            s.close()
+    hosts = [str(h) for n in nets for h in n.hosts()]
+    with ThreadPoolExecutor(max_workers=workers) as ex:
+        return [ip for ip in ex.map(probe, hosts) if ip]
+
+
+def discover(timeout: float = 2.5) -> dict:
+    """Both probes, merged, as the API returns it."""
+    nets = local_networks()
+    found: dict[str, Found] = {f.host: f for f in ws_discover(timeout)}
+    for ip in rtsp_sweep(nets):
+        f = found.setdefault(ip, Found(host=ip))
+        f.rtsp = True
+        f.sources.append("rtsp")
+    cams = sorted(found.values(), key=lambda f: (not (f.rtsp and f.onvif), not f.rtsp,
+                                                 ipaddress.IPv4Address(f.host)))
+    return {
+        "networks": [str(n) for n in nets],
+        "cameras": [asdict(c) for c in cams],
+    }

behavision/engine.py

@@ -18,6 +18,7 @@ import numpy as np
 
 from .attributes import AttributeEstimator, aggregate as aggregate_attrs
 from .cameras import CameraStore
+from . import capture
 from .capture import VideoSource
 from .faces import FaceOutbox
 from .commission import CommissionRun
@@ -169,7 +170,13 @@ class CameraWorker(threading.Thread):
         self._overlay_ts = 0.0
         self._last_frame_ts = 0.0
         self._was_connected = False
+        self._was_stalled = False
         self.frames_processed = 0
+        # Motion gate state: a 160x90 greyscale thumbnail of the last frame we
+        # actually searched, and how many frames we have skipped since.
+        self._motion_prev = None
+        self._motion_skipped = 0
+        self.frames_skipped = 0
         self.faces_seen = 0
         self.pipeline = PipelineStats()
         # One outbox per worker, all writing into the same directory. Files are
@@ -236,6 +243,7 @@ class CameraWorker(threading.Thread):
         return {
             **self.source.stats(),
             "frames_processed": self.frames_processed,
+            "frames_skipped": self.frames_skipped,
             "faces_seen": self.faces_seen,
             "active_tracks": len(self.tracker.tracks),
             "pipeline": self.pipeline.snapshot(self.rcfg.min_enroll_quality),
@@ -244,6 +252,43 @@ class CameraWorker(threading.Thread):
                       "enroll_threshold": self.rcfg.enroll_threshold},
         }
 
+    def _nothing_moved(self, frame) -> bool:
+        """True when this frame is close enough to the last searched one that
+        searching it again would find the same nothing.
+
+        It cannot lose a face, and that property is what makes it acceptable
+        rather than merely cheap. Three guards, in order:
+
+          * the caller only asks while NO track is open, so a person already
+            being followed is never affected by it;
+          * `motion_max_skip` forces a real detection about once a second
+            whatever the thumbnail says, which covers a change too small or too
+            gradual for it - someone easing into frame at the far edge;
+          * the threshold sits well above measured sensor noise and well below
+            a person, and anything ambiguous falls through to detection. When
+            in doubt it looks.
+
+        Cost is 0.1 ms against detection's 15 ms, so an empty shop stops paying
+        for a search of an empty room ~90 times a second.
+        """
+        import cv2 as _cv2
+        small = _cv2.resize(_cv2.cvtColor(frame, _cv2.COLOR_BGR2GRAY), (160, 90),
+                            interpolation=_cv2.INTER_AREA)
+        prev, self._motion_prev = self._motion_prev, small
+        if prev is None:
+            return False
+        if self._motion_skipped >= self.cfg.app.motion_max_skip:
+            self._motion_skipped = 0
+            return False
+        if float(_cv2.absdiff(small, prev).mean()) >= self.cfg.app.motion_threshold:
+            self._motion_skipped = 0
+            # Keep the thumbnail we just searched against, not this one, so a
+            # slow drift cannot creep past the threshold one frame at a time.
+            return False
+        self._motion_prev = prev
+        self._motion_skipped += 1
+        return True
+
     # -- thread ---------------------------------------------------------
     def run(self) -> None:
         tcfg = self.cfg.tracking
@@ -256,6 +301,15 @@ class CameraWorker(threading.Thread):
                     continue
                 self._last_frame_ts = ts
 
+                # An empty room costs exactly as much to search as a busy one,
+                # and a shop is empty most of the day. Only ever while nothing
+                # is being tracked - see _nothing_moved.
+                if (self.cfg.app.motion_gate and not self.tracker.tracks
+                        and self._nothing_moved(frame)):
+                    self.frames_skipped += 1
+                    self._remember_tracks([])
+                    continue
+
                 detections = self.detector.detect(frame)
                 for det in detections:
                     det.quality = face_quality(frame, det.box, det.kps)
@@ -294,6 +348,20 @@ class CameraWorker(threading.Thread):
                 type="camera.up" if connected else "camera.down",
                 camera_id=self.cam_cfg.id))
 
+        # A stall is not a disconnect and must not be reported as one: the
+        # socket is fine, the camera is answering, and nothing is arriving.
+        # Logged on the transition only — a per-frame warning would bury the
+        # one line that matters under thousands of copies of itself.
+        stalled = self.source.stalled()
+        if stalled != self._was_stalled:
+            self._was_stalled = stalled
+            if stalled:
+                log.warning("[%s] connected but no frame for over %.0fs - the "
+                            "camera is answering and sending nothing",
+                            self.cam_cfg.id, capture.STALL_AFTER_S)
+            else:
+                log.info("[%s] frames resumed", self.cam_cfg.id)
+
     def _finish_track(self, track: Track, ts: float) -> None:
         """Record what became of a track, once, as it ends.
 
@@ -629,7 +697,10 @@ class Engine:
                 "age_model": ("genderage" if self.attributes is not None
                               and self.attributes.has_genderage else "caffe/none"),
             },
-            "gallery": self.store.stats(),
+            # Counts, plus whether the running encoder can actually SEARCH
+            # them. A gallery of 21 identities that the loaded model cannot
+            # read is the silent version of an empty one.
+            "gallery": {**self.store.stats(), **self.gallery.health},
             "cameras": [w.stats() for w in self.snapshot_workers()],
         }
 

behavision/gallery/service.py

@@ -53,10 +53,56 @@ class Gallery:
         # vectors from a different model are numerically incompatible.
         ids, vecs = store.all_embeddings(index.dim, model=model_name)
         index.add(ids, vecs)
+        self.health = self._assess(len(ids))
+        if self.health["stranded"]:
+            # Not an INFO line. The encoder fallback chain exists so a
+            # memory-starved box still runs, and when it fires every vector
+            # written by the previous encoder becomes invisible: the shop
+            # keeps its customer list and recognises nobody on it, greeting
+            # every regular as new and enrolling them a second time. Footfall
+            # stays right, which is exactly why nothing looks wrong. The old
+            # message for that state was "gallery ready: 0 embeddings".
+            log.warning(
+                "gallery: %d of %d stored embeddings were written by a "
+                "DIFFERENT encoder (%s) and cannot be searched - %d known "
+                "%s unrecognisable under the running model '%s'. Either "
+                "restore that model or accept that these identities start "
+                "over.",
+                self.health["stranded"], self.health["stored"],
+                ", ".join(sorted(self.health["other_models"])),
+                self.health["identities_stranded"],
+                "person is" if self.health["identities_stranded"] == 1
+                else "people are",
+                model_name)
         log.info("gallery ready: %d embeddings (model '%s') across %d "
                  "identities", len(ids), model_name,
                  store.stats()["identities"])
 
+    def _assess(self, usable: int) -> dict:
+        """What share of the gallery the running encoder can actually reach.
+
+        Reported rather than merely logged, because a log line on a shop PC
+        is read by nobody: this travels to head office the same way
+        `fraction_below_gate` does, beside the number it qualifies.
+        """
+        counts = self.store.model_counts()
+        stored = sum(counts.values())
+        others = {m: n for m, n in counts.items() if m != self.model_name}
+        identities = self.store.stats()["identities"]
+        return {
+            "model": self.model_name,
+            "stored": stored,
+            "usable": usable,
+            "stranded": sum(others.values()),
+            "other_models": sorted(others),
+            "identities": identities,
+            "identities_usable": self.store.identities_with_model(
+                self.model_name),
+            "identities_stranded": max(
+                0, identities - self.store.identities_with_model(
+                    self.model_name)),
+        }
+
     def resolve(self, embedding: np.ndarray, quality: float, camera_id: str,
                 ts: "float | None" = None,
                 attributes: "dict | None" = None,

behavision/gallery/store.py

@@ -281,6 +281,31 @@ class IdentityStore:
             return None
         return np.frombuffer(row["vector"], dtype=np.float32), float(row["quality"])
 
+    def model_counts(self) -> "dict[str, int]":
+        """How many stored embeddings each encoder produced.
+
+        The gallery only ever searches vectors tagged with the *running*
+        encoder, so this is what says whether the rest of the gallery is
+        reachable at all. See `Gallery.health` for why that matters.
+        """
+        with self._lock:
+            rows = self._db.execute(
+                "SELECT model, COUNT(*) AS n FROM embeddings "
+                "GROUP BY model").fetchall()
+        return {str(r["model"]): int(r["n"]) for r in rows}
+
+    def identities_with_model(self, model: str) -> int:
+        """Identities holding at least one embedding from this encoder.
+
+        Not the same as the identity count: an identity whose only vectors
+        came from a previous encoder still exists, and is unrecognisable.
+        """
+        with self._lock:
+            row = self._db.execute(
+                "SELECT COUNT(DISTINCT identity_id) AS n FROM embeddings "
+                "WHERE model=?", (model,)).fetchone()
+        return int(row["n"]) if row else 0
+
     def embedding_owners(self, model: "str | None" = None) -> "dict[int, int]":
         """embedding_id -> identity_id, for turning index hits into identity
         pairs without a round trip to SQLite per hit."""

behavision/model_assets.py

@@ -35,6 +35,31 @@ _COPY_MAP = {
 }
 
 
+def _fetch(url: str, dest: Path, label: str) -> None:
+    """Download with progress on stdout the supervisor can read.
+
+    On first run this is minutes of nothing: the API is not up yet, so the
+    app cannot ask the engine what it is doing, and a shop PC that shows a
+    stopped engine for five minutes after install looks broken. The
+    supervisor watches for `download: <label> <n>%` and puts the number in
+    the tray and the window. Logged every 5 points, not every chunk, so the
+    log file does not fill with a progress bar.
+    """
+    last = -5
+
+    def hook(blocks: int, block_size: int, total: int) -> None:
+        nonlocal last
+        if total <= 0:
+            return
+        pct = min(100, blocks * block_size * 100 // total)
+        if pct >= last + 5:
+            last = pct
+            log.info("download: %s %d%%", label, pct)
+
+    urllib.request.urlretrieve(url, dest, hook)
+    log.info("download: %s 100%%", label)
+
+
 def setup_models(models_dir: Path) -> "list[str]":
     """Ensure all model files exist in models_dir. Returns missing ones."""
     models_dir = Path(models_dir)
@@ -44,7 +69,7 @@ def setup_models(models_dir: Path) -> "list[str]":
     if not yunet.exists():
         log.info("downloading YuNet face detector (~230 KB)...")
         tmp = yunet.with_suffix(".part")
-        urllib.request.urlretrieve(YUNET_URL, tmp)
+        _fetch(YUNET_URL, tmp, "face detector")
         tmp.rename(yunet)
         log.info("YuNet saved to %s", yunet)
 
@@ -88,7 +113,7 @@ def setup_models(models_dir: Path) -> "list[str]":
             import zipfile
 
             tmp = models_dir / "buffalo_l.zip.part"
-            urllib.request.urlretrieve(BUFFALO_L_URL, tmp)
+            _fetch(BUFFALO_L_URL, tmp, "recognition models")
             with zipfile.ZipFile(tmp) as zf:
                 for name, target in wanted.items():
                     member = next((n for n in zf.namelist()

behavision/static/dashboard.html

@@ -514,11 +514,24 @@ async function refresh() {
     ]);
     renderFeeds(camList);
     renderCameras(camList);
+    // 'stalled' is its own word on purpose: connected and offline send you
+    // to the network, a camera that is answering and sending nothing does
+    // not. Three states, because two of them need opposite actions.
     const cams = stats.cameras.map(c =>
-      `${c.camera_id}: ${c.connected ? 'live' : 'offline'}`).join(' · ');
+      `${c.camera_id}: ${c.streaming ? 'live' : c.connected ? 'stalled' : 'offline'}`
+    ).join(' · ');
+    // The one failure that otherwise looks like perfect health: the encoder
+    // that loaded cannot read the embeddings already stored, so every known
+    // customer is a stranger. Counts stay right, which is why it needs saying.
+    const stranded = stats.gallery.stranded || 0;
+    const warn = stranded
+      ? ` · ⚠ ${stats.gallery.identities_stranded} people unrecognisable `
+        + `(${stranded} embeddings from ${stats.gallery.other_models.join(', ')}, `
+        + `running ${stats.gallery.model})`
+      : '';
     // textContent, not innerHTML — no escaping needed here.
     document.getElementById('status').textContent =
-      `${cams} · ${stats.gallery.identities} people · ${stats.gallery.sightings} sightings`;
+      `${cams} · ${stats.gallery.identities} people · ${stats.gallery.sightings} sightings${warn}`;
 
     document.getElementById('events').innerHTML = events.map(e => {
       const cls = e.type === 'person.new' ? 'new'

demo/console.html

@@ -0,0 +1,258 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Behavision — live demo</title>
+<style>
+  :root{
+    --bg:#0A0E12; --s1:#11171C; --s2:#161D24; --s3:#1D262E;
+    --line:#24303A; --line2:#1B242C;
+    --ink:#E8EEF3; --ink2:#9FB0BD; --ink3:#6B7E8C;
+    --accent:#3DD0C4; --accent-dim:#123039;
+    --ok:#3FBF7F; --warn:#E0A33A; --bad:#E15B4C;
+    --mono:'SF Mono',ui-monospace,Menlo,monospace;
+    --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',system-ui,sans-serif;
+  }
+  *{box-sizing:border-box;margin:0;padding:0}
+  body{background:var(--bg);color:var(--ink);font-family:var(--font);font-size:14px;line-height:1.5;
+       -webkit-font-smoothing:antialiased;padding:18px;min-height:100vh}
+  .top{display:flex;align-items:center;gap:14px;margin-bottom:16px;flex-wrap:wrap}
+  .brand{display:flex;align-items:center;gap:10px;margin-right:auto}
+  .brand img{width:26px;height:26px;object-fit:contain}
+  .brand b{font-size:16px;letter-spacing:-.01em}
+  .brand span{color:var(--ink3);font-size:12px}
+  .pill{display:inline-flex;align-items:center;gap:7px;padding:5px 11px;border-radius:99px;
+        border:1px solid var(--line);background:var(--s1);font-size:12px;color:var(--ink2)}
+  .dot{width:7px;height:7px;border-radius:99px;background:var(--ink3);flex:none}
+  .dot.ok{background:var(--ok);box-shadow:0 0 0 3px rgba(63,191,127,.16)}
+  .dot.bad{background:var(--bad);box-shadow:0 0 0 3px rgba(225,91,76,.16)}
+  .dot.warn{background:var(--warn);box-shadow:0 0 0 3px rgba(224,163,58,.16)}
+
+  .grid{display:grid;grid-template-columns:minmax(0,1.05fr) minmax(0,1fr);gap:14px;align-items:start}
+  @media(max-width:1100px){.grid{grid-template-columns:minmax(0,1fr)}}
+  .card{background:var(--s1);border:1px solid var(--line);border-radius:12px;overflow:hidden}
+  .card h2{font-size:11px;font-weight:600;letter-spacing:.09em;text-transform:uppercase;color:var(--ink3);
+           padding:12px 16px;border-bottom:1px solid var(--line2);display:flex;align-items:center;gap:10px}
+  .card h2 .grow{margin-left:auto;font-weight:500;letter-spacing:0;text-transform:none;font-size:12px;color:var(--ink3)}
+  .pad{padding:16px}
+
+  .cam{position:relative;aspect-ratio:16/9;background:#05090C}
+  .cam img{width:100%;height:100%;object-fit:cover;display:block}
+  .cam .none{position:absolute;inset:0;display:grid;place-items:center;color:var(--ink3);font-size:13px;text-align:center;padding:20px}
+  .cam .tag{position:absolute;top:10px;left:10px;background:rgba(10,14,18,.78);backdrop-filter:blur(8px);
+            border:1px solid var(--line);border-radius:8px;padding:5px 10px;font-size:11.5px;font-family:var(--mono)}
+
+  /* the chain */
+  .chain{display:flex;flex-direction:column;gap:0}
+  .step{display:grid;grid-template-columns:26px 1fr auto;gap:12px;align-items:start;padding:11px 16px;
+        border-bottom:1px solid var(--line2);opacity:.38;transition:opacity .25s}
+  .step:last-child{border-bottom:0}
+  .step.on{opacity:1}
+  .step .n{width:22px;height:22px;border-radius:99px;display:grid;place-items:center;font-size:11px;font-weight:600;
+           background:var(--s3);color:var(--ink3);border:1px solid var(--line);margin-top:1px}
+  .step.on .n{background:var(--accent);color:#04161B;border-color:transparent}
+  .step b{font-size:13.5px;font-weight:550;display:block}
+  .step small{color:var(--ink2);font-size:12px;display:block;margin-top:1px;font-family:var(--mono)}
+  .step .ms{font-family:var(--mono);font-size:11.5px;color:var(--accent);white-space:nowrap;margin-top:2px}
+
+  .empty{padding:34px 16px;text-align:center;color:var(--ink3);font-size:13px;line-height:1.6}
+  .empty b{display:block;color:var(--ink2);font-size:14px;margin-bottom:5px}
+
+  /* customer */
+  .who{display:flex;gap:13px;align-items:center;padding:16px;border-bottom:1px solid var(--line2)}
+  .av{width:50px;height:50px;border-radius:10px;background:var(--s3);border:1px solid var(--line);
+      display:grid;place-items:center;font-weight:600;font-size:17px;color:var(--ink2);flex:none;overflow:hidden}
+  .av img{width:100%;height:100%;object-fit:cover}
+  .who .n{font-size:16px;font-weight:600;letter-spacing:-.01em}
+  .who .m{color:var(--ink3);font-size:12.5px;margin-top:2px}
+  .badge{display:inline-block;padding:2px 8px;border-radius:99px;font-size:10.5px;font-weight:600;
+         letter-spacing:.04em;text-transform:uppercase}
+  .badge.new{background:var(--accent-dim);color:var(--accent)}
+  .badge.seen{background:rgba(63,191,127,.14);color:var(--ok)}
+  label{display:block;font-size:11.5px;font-weight:550;color:var(--ink2);margin-bottom:5px}
+  input{width:100%;background:var(--s2);border:1px solid var(--line);border-radius:7px;padding:9px 11px;
+        color:var(--ink);font:inherit;font-size:13.5px}
+  input:focus{outline:none;border-color:var(--accent)}
+  .row{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-bottom:12px}
+  button{background:var(--accent);color:#04161B;border:0;border-radius:7px;padding:9px 16px;
+         font:inherit;font-size:13px;font-weight:600;cursor:pointer}
+  button:disabled{opacity:.45;cursor:default}
+  button.sec{background:var(--s3);color:var(--ink);border:1px solid var(--line)}
+  .saved{color:var(--ok);font-size:12.5px;margin-top:9px;display:flex;align-items:center;gap:6px}
+
+  /* raw json */
+  pre{font-family:var(--mono);font-size:11px;line-height:1.55;color:var(--ink2);
+      background:#080C10;border-top:1px solid var(--line2);padding:13px 16px;margin:0;
+      max-height:230px;overflow:auto;white-space:pre-wrap;word-break:break-word}
+  .req{font-family:var(--mono);font-size:11.5px;color:var(--accent);padding:10px 16px;background:var(--s2)}
+  .req .st{float:right;color:var(--ink3)}
+  .hint{color:var(--ink3);font-size:12px;padding:10px 16px 14px;line-height:1.55}
+  .stack{display:flex;flex-direction:column;gap:14px}
+</style>
+</head>
+<body>
+  <div class="top">
+    <div class="brand">
+      <img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI+PHBhdGggZD0iTTEyIDIxcy04LTQuNS04LTEwYTQuNSA0LjUgMCAwIDEgOC0yLjggNC41IDQuNSAwIDAgMSA4IDIuOGMwIDUuNS04IDEwLTggMTB6IiBmaWxsPSIjRjJDMTFGIi8+PC9zdmc+" alt="">
+      <div><b>Behavision</b> <span id="site">— live demo</span></div>
+    </div>
+    <span class="pill"><i class="dot" id="d-eng"></i><span id="t-eng">engine…</span></span>
+    <span class="pill"><i class="dot" id="d-cam"></i><span id="t-cam">camera…</span></span>
+    <span class="pill"><i class="dot" id="d-cloud"></i><span id="t-cloud">cloud…</span></span>
+  </div>
+
+  <div class="grid">
+    <div class="stack">
+      <div class="card">
+        <h2>The camera <span class="grow" id="camname"></span></h2>
+        <div class="cam">
+          <img id="feed" alt="" style="display:none">
+          <div class="none" id="feednone">waiting for the camera…</div>
+          <div class="tag" id="camtag" style="display:none"></div>
+        </div>
+      </div>
+
+      <div class="card">
+        <h2>The customer <span class="grow">type a name, then walk past again</span></h2>
+        <div id="cust">
+          <div class="empty"><b>Nobody yet</b>Walk in front of the camera.</div>
+        </div>
+      </div>
+    </div>
+
+    <div class="stack">
+      <div class="card">
+        <h2>What just happened <span class="grow" id="lat"></span></h2>
+        <div id="chain"><div class="empty"><b>Waiting</b>Every step below lights up as it really happens.</div></div>
+      </div>
+
+      <div class="card">
+        <h2>What the mobile app receives</h2>
+        <div class="req" id="m-req">GET /api/visits<span class="st" id="m-st"></span></div>
+        <pre id="m-body">…</pre>
+      </div>
+
+      <div class="card">
+        <h2>What the dashboard receives</h2>
+        <div class="req" id="d-req">GET /api/reports/footfall<span class="st" id="d-st"></span></div>
+        <pre id="d-body">…</pre>
+        <div class="hint">Both of these are the real production API at mcp.loyaly.ai, called from this
+          machine with a staff login — not a mock, and not the local engine.</div>
+      </div>
+    </div>
+  </div>
+
+<script>
+const $ = s => document.querySelector(s);
+let camStarted = null, current = null, savedFor = null;
+
+function setPill(dot, text, tone, label){
+  $(dot).className = 'dot' + (tone ? ' ' + tone : '');
+  $(text).textContent = label;
+}
+
+function initials(name, ref){
+  const m = /^Visitor (\d+)$/.exec((name||'').trim());
+  if (m) return m[1];
+  const w = (name||'').trim().split(/\s+/).filter(Boolean);
+  if (!w.length) return '?';
+  return (w[0][0] + (w[1]?.[0] ?? '')).toUpperCase();
+}
+
+function drawChain(e){
+  if (!e){ $('#chain').innerHTML = '<div class="empty"><b>Waiting</b>Every step below lights up as it really happens.</div>'; $('#lat').textContent=''; return; }
+  const g = e.engine, c = e.cloud;
+  const steps = [
+    [true,  'Camera saw a face', g.quality != null ? `quality ${(+g.quality).toFixed(2)} · camera ${g.camera}` : `camera ${g.camera}`, ''],
+    [true,  e.kind === 'new' ? 'Engine: nobody it knows → enrolled' : 'Engine: matched a returning customer',
+            (g.label || '') + (g.similarity != null && g.similarity >= 0 ? ` · similarity ${(+g.similarity).toFixed(2)}` : '') , ''],
+    [true,  'Agent queued the visit', 'durable on this disk until the broker confirms', ''],
+    [!!c,   'Broker delivered it', 'MQTT over TLS to mcp.loyaly.ai', ''],
+    [!!c,   'Server recorded it', c ? `${c.site} · ${c.is_new ? 'new customer' : 'returning'}` : 'waiting…', ''],
+    [!!c,   'Mobile + dashboard can see it', c ? `visit ${String(c.visit_id).slice(0,8)}` : 'waiting…',
+            e.latency != null ? `+${e.latency}s` : ''],
+  ];
+  $('#chain').innerHTML = steps.map(([on,title,sub,ms],i)=>
+    `<div class="step ${on?'on':''}"><div class="n">${i+1}</div><div><b>${title}</b><small>${sub}</small></div><div class="ms">${ms}</div></div>`
+  ).join('');
+  $('#lat').textContent = e.latency != null ? `camera → cloud in ${e.latency}s` : '';
+}
+
+function drawCustomer(e){
+  const c = e && e.cloud;
+  if (!c){ if(!current) $('#cust').innerHTML = '<div class="empty"><b>Nobody yet</b>Walk in front of the camera.</div>'; return; }
+  const changed = !current || current.visitor_id !== c.visitor_id || current.visit_id !== c.visit_id;
+  if (!changed) return;
+  current = c;
+  const name = c.label || 'Unrecognised';
+  const img = c.image && c.image.available && c.image.url;
+  $('#cust').innerHTML = `
+    <div class="who">
+      <div class="av">${img ? `<img src="${img}">` : initials(name)}</div>
+      <div style="flex:1;min-width:0">
+        <div class="n">${name}</div>
+        <div class="m">${c.ref ? c.ref + ' · ' : ''}${c.is_new ? 'first time here' : 'returning'}${c.similarity>0 ? ' · match ' + (+c.similarity).toFixed(2) : ''}</div>
+      </div>
+      <span class="badge ${c.is_new?'new':'seen'}">${c.is_new?'new':'returning'}</span>
+    </div>
+    <div class="pad">
+      <div class="row">
+        <div><label>Name</label><input id="f-name" placeholder="e.g. Suriya" value=""></div>
+        <div><label>Phone</label><input id="f-phone" placeholder="+91…" value=""></div>
+      </div>
+      <button id="save">Save to the customer record</button>
+      <div id="savedmsg"></div>
+      <div class="hint" style="padding:12px 0 0">This writes to the production API. Walk past again and
+        the name comes back through the cloud instead of “${name}”.</div>
+    </div>`;
+  $('#save').onclick = async () => {
+    const b = $('#save'); b.disabled = true; b.textContent = 'Saving…';
+    const r = await fetch('/api/profile', {method:'POST', headers:{'content-type':'application/json'},
+      body: JSON.stringify({id: c.visitor_id, full_name: $('#f-name').value, phone: $('#f-phone').value})});
+    const d = await r.json();
+    b.disabled = false; b.textContent = 'Save to the customer record';
+    $('#savedmsg').innerHTML = (d.status===200||d.status===204)
+      ? '<div class="saved">✓ Saved — PUT /api/visitors/'+String(c.visitor_id).slice(0,8)+'…/profile → '+d.status+'</div>'
+      : '<div class="saved" style="color:var(--bad)">'+(d.body&&d.body.message||('HTTP '+d.status))+'</div>';
+    savedFor = c.visitor_id;
+  };
+}
+
+async function tick(){
+  let s;
+  try { s = await (await fetch('/api/snapshot')).json(); } catch { return; }
+
+  const eng = s.engine || {};
+  setPill('#d-eng','#t-eng', eng.up ? 'ok' : 'bad', eng.up ? ('engine · ' + (eng.model||'starting')) : 'engine starting…');
+  const cam = (eng.cameras||[])[0];
+  setPill('#d-cam','#t-cam', cam && cam.connected ? 'ok' : 'warn',
+          cam ? (cam.connected ? `camera live · ${cam.frames||0} frames` : 'camera connecting…') : 'no camera yet');
+  setPill('#d-cloud','#t-cloud', s.cloud_ok ? 'ok' : 'bad', s.cloud_ok ? 'cloud connected' : 'cloud unreachable');
+  $('#camname').textContent = cam ? cam.id : '';
+
+  if (cam && cam.connected){
+    if (camStarted !== cam.id){
+      camStarted = cam.id;
+      $('#feed').style.display = 'block'; $('#feednone').style.display = 'none';
+      $('#camtag').style.display = 'block';
+      // A polled still rather than an MJPEG stream: the engine re-serves its
+      // latest frame anyway, and a multipart stream through a proxy is one
+      // more thing to fail in front of an audience.
+      setInterval(() => { $('#feed').src = '/camera.jpg?id=' +
+        encodeURIComponent(camStarted) + '&t=' + Date.now(); }, 350);
+    }
+    $('#camtag').textContent = cam.id + (cam.tracks ? ` · ${cam.tracks} in frame` : '');
+  }
+
+  const e = (s.chain||[])[0];
+  drawChain(e); drawCustomer(e);
+
+  $('#m-st').textContent = s.mobile.status;
+  $('#m-body').textContent = JSON.stringify(s.mobile.body, null, 1).slice(0, 2600);
+  $('#d-st').textContent = s.dashboard.status;
+  $('#d-body').textContent = JSON.stringify(s.dashboard.body, null, 1).slice(0, 1800);
+}
+tick(); setInterval(tick, 1500);
+</script>
+</body>
+</html>

demo/console.py

@@ -0,0 +1,330 @@
+"""A one-screen live demo of the whole Behavision chain, for showing someone.
+
+Run it on the shop PC (here, this Mac) while the engine and agent are running.
+It holds every credential itself and the browser holds none, so the page can be
+put on a projector without putting a token on it.
+
+What it shows, and why each part is there:
+
+- the live camera, so the person walking past sees themselves;
+- the CHAIN, measured rather than described: the engine recognised a face at
+  this instant, the same visit appeared in the cloud API this many seconds
+  later. That number is the product's claim, and it is computed here from two
+  independent sources rather than asserted;
+- the customer, editable - type a name, walk past again, watch the name come
+  back through the cloud instead of "Visitor 5";
+- the raw JSON a phone and a dashboard receive, side by side, because a
+  colleague's real question is "is this actually wired up or is it a mock".
+
+    .venv/bin/python demo/console.py            # http://127.0.0.1:8099
+"""
+from __future__ import annotations
+
+import base64
+import json
+import os
+import threading
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+STATE = Path(os.environ.get("BEHAVISION_DATA_DIR", ROOT / ".demo"))
+CLOUD = os.environ.get("BEHAVISION_CLOUD", "https://mcp.loyaly.ai")
+ENGINE = "http://127.0.0.1:8010"
+PORT = int(os.environ.get("DEMO_PORT", "8099"))
+
+# Whoever the demo signs in as. Staff on purpose: it is the weakest role that
+# can do everything the shop floor does, so nothing here is only possible
+# because we used an owner.
+EMAIL = os.environ.get("DEMO_EMAIL", "staff.demo@tenext.in")
+PASSWORD = os.environ.get("DEMO_PASSWORD", "admin@123")
+
+
+def engine_auth() -> str:
+    """The engine invents a Basic credential when none is configured, and
+    writes it here. Read it rather than keeping a second copy."""
+    f = STATE / "data" / "api_credentials.txt"
+    if not f.exists():
+        return ""
+    user = pw = ""
+    for line in f.read_text().splitlines():
+        # `key=value`, and `key: value` too - the engine writes one and people
+        # read the other, and which is which is not worth a support call.
+        if "=" in line or ":" in line:
+            k, v = line.split("=", 1) if "=" in line else line.split(":", 1)
+            if k.strip().lower() == "username":
+                user = v.strip()
+            elif k.strip().lower() == "password":
+                pw = v.strip()
+    if not user:
+        return ""
+    return "Basic " + base64.b64encode(f"{user}:{pw}".encode()).decode()
+
+
+def fetch(url: str, *, headers=None, body=None, method="GET", timeout=20):
+    req = urllib.request.Request(url, method=method,
+                                 data=json.dumps(body).encode() if body is not None else None,
+                                 headers={k: v for k, v in (headers or {}).items() if v})
+    if body is not None:
+        req.add_header("content-type", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            raw = r.read()
+            return r.status, (json.loads(raw) if raw and r.headers.get("content-type", "").startswith("application/json") else raw)
+    except urllib.error.HTTPError as e:
+        raw = e.read()
+        try:
+            return e.code, json.loads(raw or b"{}")
+        except Exception:
+            return e.code, raw[:400]
+    except Exception as e:
+        return 0, {"error": str(e)}
+
+
+class Cloud:
+    """The signed-in session, refreshed when it expires."""
+
+    def __init__(self):
+        self.token = ""
+        self.lock = threading.Lock()
+
+    def sign_in(self) -> bool:
+        st, d = fetch(f"{CLOUD}/api/auth/login", method="POST",
+                      body={"email": EMAIL, "password": PASSWORD, "device": "Demo console"})
+        if st == 200 and isinstance(d, dict):
+            self.token = d.get("access_token", "")
+            return True
+        return False
+
+    def call(self, path, method="GET", body=None, retry=True):
+        with self.lock:
+            if not self.token and not self.sign_in():
+                return 0, {"error": "cannot sign in to the platform"}
+            tok = self.token
+        st, d = fetch(f"{CLOUD}{path}", method=method, body=body,
+                      headers={"authorization": f"Bearer {tok}"})
+        if st == 401 and retry:
+            with self.lock:
+                self.sign_in()
+            return self.call(path, method, body, retry=False)
+        return st, d
+
+
+cloud = Cloud()
+
+# The chain, as the watcher builds it. One dict per recognition, newest first.
+events: list[dict] = []
+events_lock = threading.Lock()
+
+
+def watch():
+    """Poll the engine's own event log and the cloud feed, and join them.
+
+    They are joined on the identity and the second, not on a shared id,
+    because the engine numbers identities locally and the server numbers them
+    per tenant - the two are deliberately different (see CLAUDE.md). What
+    matters for the demo is the LATENCY between one seeing a person and the
+    other, and that only needs the same person and the same moment.
+    """
+    seen_local: set[str] = set()
+    while True:
+        try:
+            auth = engine_auth()
+            st, d = fetch(f"{ENGINE}/api/events?limit=25", headers={"authorization": auth})
+            # The engine returns a bare list; a dict with "events" is accepted
+            # too so this survives either shape.
+            evs = d if isinstance(d, list) else (d or {}).get("events", []) if isinstance(d, dict) else []
+            if st == 200:
+                for e in evs:
+                    if e.get("type") not in ("person.new", "person.seen"):
+                        continue
+                    key = f"{e.get('ts')}|{e.get('camera_id')}|{(e.get('data') or {}).get('identity_id')}"
+                    if key in seen_local:
+                        continue
+                    seen_local.add(key)
+                    data = e.get("data") or {}
+                    with events_lock:
+                        events.insert(0, {
+                            "key": key,
+                            "at": time.time(),
+                            "kind": "new" if e["type"] == "person.new" else "seen",
+                            "engine": {
+                                "label": data.get("label"),
+                                "identity_id": data.get("identity_id"),
+                                "similarity": data.get("similarity"),
+                                "quality": data.get("quality"),
+                                "gender": data.get("gender"),
+                                "age": data.get("age"),
+                                "camera": e.get("camera_id"),
+                                "ts": e.get("ts"),
+                            },
+                            "cloud": None,
+                            "latency": None,
+                        })
+                        del events[40:]
+        except Exception:
+            pass
+
+        # the other half: has the cloud got it yet?
+        try:
+            with events_lock:
+                pending = [e for e in events if e["cloud"] is None][:6]
+            if pending:
+                st, d = cloud.call("/api/visits?limit=12")
+                arrivals = (d or {}).get("arrivals", []) if isinstance(d, dict) else []
+                for e in pending:
+                    for a in arrivals:
+                        # same camera, and the cloud's visit is not older than
+                        # the engine's sighting
+                        if a.get("camera_id") != e["engine"]["camera"]:
+                            continue
+                        if a.get("visit_id") in [x["cloud"].get("visit_id") for x in events if x["cloud"]]:
+                            continue
+                        with events_lock:
+                            e["cloud"] = {
+                                "visit_id": a.get("visit_id"),
+                                "visitor_id": a.get("visitor_id"),
+                                "label": a.get("label"),
+                                "ref": a.get("customer_ref") or a.get("ref"),
+                                "is_new": a.get("is_new_visitor"),
+                                "similarity": a.get("similarity"),
+                                "site": a.get("site"),
+                                "occurred_at": a.get("occurred_at"),
+                                "image": a.get("image"),
+                            }
+                            e["latency"] = round(time.time() - e["at"], 1)
+                        break
+        except Exception:
+            pass
+        time.sleep(1.0)
+
+
+def snapshot() -> dict:
+    """Everything the page draws, in one reply."""
+    auth = engine_auth()
+    _, health = fetch(f"{ENGINE}/api/health", headers={"authorization": auth})
+    _, stats = fetch(f"{ENGINE}/api/stats", headers={"authorization": auth})
+    st_v, visits = cloud.call("/api/visits?limit=3")
+    st_f, foot = cloud.call("/api/reports/footfall?from=%s&to=%s"
+                            % (time.strftime("%Y-%m-%d", time.localtime(time.time() - 7 * 86400)),
+                               time.strftime("%Y-%m-%d")))
+    with events_lock:
+        chain = json.loads(json.dumps(events[:8]))
+    cams = (stats or {}).get("cameras", []) if isinstance(stats, dict) else []
+    return {
+        "engine": {
+            "up": isinstance(health, dict) and bool(health.get("status")),
+            "model": (health or {}).get("recognition_model") if isinstance(health, dict) else None,
+            "cameras": [{"id": c.get("camera_id"), "connected": c.get("connected"),
+                         "frames": c.get("frames_processed") or c.get("frames_total"),
+                         "faces": c.get("faces_seen"),
+                         "tracks": c.get("active_tracks")} for c in cams],
+        },
+        "cloud_ok": st_v == 200,
+        "chain": chain,
+        "mobile": {"request": "GET /api/visits?limit=3", "status": st_v, "body": visits},
+        "dashboard": {"request": "GET /api/reports/footfall?from=…&to=…", "status": st_f, "body": foot},
+    }
+
+
+def main():
+    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+    from urllib.parse import urlparse, parse_qs
+
+    page = (Path(__file__).parent / "console.html").read_bytes()
+
+    class H(BaseHTTPRequestHandler):
+        def log_message(self, *a):  # quiet
+            pass
+
+        def _send(self, code, body, ctype="application/json"):
+            self.send_response(code)
+            self.send_header("content-type", ctype)
+            self.send_header("content-length", str(len(body)))
+            self.end_headers()
+            try:
+                self.wfile.write(body)
+            except (BrokenPipeError, ConnectionResetError):
+                pass
+
+        def do_GET(self):
+            u = urlparse(self.path)
+            if u.path == "/":
+                return self._send(200, page, "text/html; charset=utf-8")
+            if u.path == "/api/snapshot":
+                return self._send(200, json.dumps(snapshot()).encode())
+            if u.path == "/api/customer":
+                vid = parse_qs(u.query).get("id", [""])[0]
+                if not vid:
+                    return self._send(400, b'{"error":"no id"}')
+                st, d = cloud.call(f"/api/visitors/{vid}/history?limit=8")
+                return self._send(200, json.dumps({"status": st, "history": d}).encode())
+            if u.path == "/camera.jpg":
+                # A polled still, not the MJPEG stream. The engine re-serves its
+                # latest frame until the pipeline produces a new one, so polling
+                # shows the same picture - and a multipart stream through a
+                # proxy is one more thing to fail in front of an audience.
+                cam = parse_qs(u.query).get("id", [""])[0]
+                st, body = fetch(f"{ENGINE}/api/cameras/{cam}/frame.jpg",
+                                 headers={"authorization": engine_auth()}, timeout=15)
+                if st != 200 or not isinstance(body, (bytes, bytearray)):
+                    return self._send(502, b'{"error":"no frame"}')
+                self.send_response(200)
+                self.send_header("content-type", "image/jpeg")
+                self.send_header("cache-control", "no-store")
+                self.send_header("content-length", str(len(body)))
+                self.end_headers()
+                try:
+                    self.wfile.write(body)
+                except (BrokenPipeError, ConnectionResetError):
+                    pass
+                return
+            self._send(404, b'{"error":"no"}')
+
+        def do_POST(self):
+            u = urlparse(self.path)
+            n = int(self.headers.get("content-length", 0))
+            body = json.loads(self.rfile.read(n) or b"{}")
+            if u.path == "/api/profile":
+                vid = body.pop("id", "")
+                st, d = cloud.call(f"/api/visitors/{vid}/profile", method="PUT", body=body)
+                return self._send(200, json.dumps({"status": st, "body": d}).encode())
+            self._send(404, b'{"error":"no"}')
+
+        def _proxy_stream(self, url):
+            """The engine's MJPEG, relayed so the browser needs no credential.
+
+            The engine's API is Basic-authenticated with a credential it
+            generated locally; putting that in a page would hand the whole
+            biometric API to anyone who opened it.
+            """
+            try:
+                req = urllib.request.Request(url, headers={"authorization": engine_auth()})
+                up = urllib.request.urlopen(req, timeout=20)
+            except Exception:
+                return self._send(502, b'{"error":"camera not available"}')
+            self.send_response(200)
+            self.send_header("content-type", up.headers.get("content-type", "multipart/x-mixed-replace"))
+            self.end_headers()
+            try:
+                while True:
+                    chunk = up.read(8192)
+                    if not chunk:
+                        break
+                    self.wfile.write(chunk)
+                    self.wfile.flush()
+            except Exception:
+                pass
+            finally:
+                up.close()
+
+    threading.Thread(target=watch, daemon=True).start()
+    print(f"\n  Demo console  →  http://127.0.0.1:{PORT}\n")
+    print(f"  engine {ENGINE} · cloud {CLOUD} · signed in as {EMAIL}\n")
+    ThreadingHTTPServer(("127.0.0.1", PORT), H).serve_forever()
+
+
+if __name__ == "__main__":
+    main()

desktop/app.go

@@ -66,7 +66,7 @@ func NewApp() *App {
 	return &App{
 		cfg:   cfg,
 		cloud: cloud.New(envOr("BEHAVISION_CLOUD", "https://mcp.loyaly.ai")),
-		local: local.New(base, cfg.APIUser, cfg.APIPassword),
+		local: localWithCreds(base, cfg),
 		proxy: newStreamProxy(),
 	}
 }
@@ -82,6 +82,14 @@ func (a *App) startup(ctx context.Context) {
 	if err := a.proxy.start(a.local.Base, a.local.User, a.local.Password); err != nil {
 		log.Printf("camera relay unavailable, tiles will not load: %v", err)
 	}
+	// And the other direction: watching a camera in another building, through
+	// head office's relay. Enabled unconditionally rather than only when a
+	// session already exists, because signing in is a thing that happens
+	// while the app is open - and CameraLive refuses without a session
+	// anyway, so there is nothing to gate.
+	if err := a.proxy.watchRemote(a.cloud.CameraLive); err != nil {
+		log.Printf("remote camera view unavailable: %v", err)
+	}
 
 	// A saved session means a shop PC that rebooted overnight comes back
 	// working instead of waiting for someone to log in.
@@ -105,6 +113,14 @@ func (a *App) startup(ctx context.Context) {
 	a.sup = agentengine.New(agentengine.Options{
 		Command: func(c context.Context) *exec.Cmd {
 			cmd := exec.CommandContext(c, exe, a.cfg.EngineArgs...)
+			// Run the engine FROM a known directory rather than from whatever
+			// happened to launch us. A double-clicked bundle hands its child
+			// "/", and an engine invoked as `-m behavision` then cannot find
+			// itself - measured on macOS, where it retried forever.
+			cmd.Dir = a.cfg.EngineDir
+			if cmd.Dir == "" {
+				cmd.Dir = agentpaths.InstallRoot()
+			}
 			// How the engine learns where to post its detections. Its config
 			// already reads `events.webhook_url: ${BEHAVISION_WEBHOOK_URL}`,
 			// and python-dotenv does not override a variable the process
@@ -125,6 +141,7 @@ func (a *App) startup(ctx context.Context) {
 	})
 
 	a.startPipeline(ctx)
+	go a.watchConfig(ctx)
 
 	// Recognition starts with the app. Until this, the engine only ever
 	// started when somebody pressed Start - which meant a till that rebooted
@@ -467,6 +484,62 @@ func (a *App) Claim(code string) (SessionInfo, error) {
 // the current config. Only Claim needs it today; it exists as its own method
 // because "stop everything that reads the config, then start it" is the part
 // that is easy to get half right.
+// watchConfig reloads agent.json when something else writes it.
+//
+// behavision-setup re-run on a PC with the app open re-claims the shop and
+// rotates its API token; the running app kept the old one and every camera
+// sync was refused from then on - heartbeats still flowed, so head office
+// looked fine while the cameras went stale. A claim from `behavision-agent
+// claim` does the same. Rather than ask people to restart the app, the app
+// watches the file and picks the new credentials up itself.
+func (a *App) watchConfig(ctx context.Context) {
+	path := agentpaths.AgentConfig()
+	last := mtime(path)
+	t := time.NewTicker(10 * time.Second)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+		}
+		now := mtime(path)
+		if now.IsZero() || now.Equal(last) {
+			continue
+		}
+		last = now
+		fresh, err := agentcfg.Load(path)
+		if err != nil {
+			continue
+		}
+		fresh = fresh.WithEngineCredentials(agentpaths.APICredentials())
+		a.mu.Lock()
+		changed := fresh.AgentToken != a.cfg.AgentToken || fresh.SiteID != a.cfg.SiteID ||
+			fresh.BrokerPassword != a.cfg.BrokerPassword || fresh.CloudBase != a.cfg.CloudBase ||
+			fresh.Standalone != a.cfg.Standalone
+		if changed {
+			// Keep this process's live session; a claim clears it in the file
+			// deliberately, and that is honoured too.
+			a.cfg = fresh
+			if fresh.SessionToken == "" {
+				a.cloud.Clear()
+			}
+		}
+		a.mu.Unlock()
+		if changed {
+			a.restartPipeline()
+		}
+	}
+}
+
+func mtime(path string) time.Time {
+	st, err := os.Stat(path)
+	if err != nil {
+		return time.Time{}
+	}
+	return st.ModTime()
+}
+
 func (a *App) restartPipeline() {
 	if a.stopBridge != nil {
 		a.stopBridge()
@@ -504,6 +577,8 @@ type EngineStatus struct {
 	Reachable bool            `json:"reachable"`
 	Model     string          `json:"recognition_model,omitempty"`
 	Cameras   map[string]bool `json:"cameras,omitempty"`
+	// Progress is the first-run model download, when one is happening.
+	Progress *agentengine.Progress `json:"progress,omitempty"`
 }
 
 func (a *App) EngineStatus() EngineStatus {
@@ -514,6 +589,9 @@ func (a *App) EngineStatus() EngineStatus {
 	st, err := a.sup.State()
 	out.State = string(st)
 	out.Restarts = a.sup.Restarts()
+	if p := a.sup.Progress(); p.What != "" {
+		out.Progress = &p
+	}
 	if err != nil {
 		out.Error = err.Error()
 	}
@@ -546,10 +624,52 @@ func (a *App) StopEngine() EngineStatus {
 
 // ---------------------------------------------------------------- cameras --
 
+// Cameras lists this PC's cameras, or the company's if this PC has none of
+// its own.
+//
+// The distinction is load-bearing and the UI is told which it got. A camera
+// from the local engine is one THIS machine can reach, edit and stream. One
+// from head office is a camera at a shop somewhere else: it has a snapshot
+// and a connection state, and it cannot be edited from here because the shop
+// PC on that LAN is the only thing that can reach it. Offering an Edit button
+// that could not work would be worse than not showing the camera at all.
 func (a *App) Cameras() ([]map[string]any, error) {
 	ctx, cancel := context.WithTimeout(a.ctx, 15*time.Second)
 	defer cancel()
-	return a.local.Cameras(ctx)
+
+	cams, err := a.local.Cameras(ctx)
+	if err == nil {
+		return cams, nil
+	}
+	if !a.cloud.LoggedIn() {
+		return nil, err
+	}
+	remote, rerr := a.cloud.RemoteCameras(ctx)
+	if rerr != nil {
+		return nil, err // the local failure is the one worth reporting
+	}
+	out := make([]map[string]any, 0, len(remote))
+	for _, c := range remote {
+		out = append(out, map[string]any{
+			"id": c.ID, "camera_id": c.CameraID, "label": c.Label,
+			"site": c.Site, "enabled": c.Enabled,
+			"connected": c.Connected, "last_seen_at": c.LastSeenAt,
+			"state": c.State, "state_note": c.StateNote,
+			"snapshot": c.Snapshot, "snapshot_at": c.SnapshotAt,
+			// What the screen keys off to hide Edit, Test and Check: this
+			// camera is on a network this PC cannot reach.
+			"remote": true,
+		})
+	}
+	return out, nil
+}
+
+// DiscoverCameras lists the cameras on this PC's network, so the add-camera
+// form is a pick-list and not a request for an IP address nobody knows.
+func (a *App) DiscoverCameras() (map[string]any, error) {
+	ctx, cancel := context.WithTimeout(a.ctx, 30*time.Second)
+	defer cancel()
+	return a.local.DiscoverCameras(ctx)
 }
 
 func (a *App) TestCamera(cam map[string]any) (map[string]any, error) {
@@ -608,25 +728,115 @@ func (a *App) StreamURL(cameraID string) string {
 	return fmt.Sprintf("http://%s/api/cameras/%s/stream.mjpeg", base, cameraID)
 }
 
+// RemoteStreamURL is the live view of a camera in another building.
+//
+// The picture comes from head office's relay - the shop PC pushes frames
+// outbound because nothing can reach in - and this app re-emits them as MJPEG
+// on its own loopback, so a tile is an ordinary <img> either way. A screen
+// therefore never has to know which building it is looking at.
+//
+// Empty when the relay is not running, and the caller shows the last snapshot
+// instead. There is no useful fallback URL: the head-office endpoint needs
+// this session's bearer, which an <img> cannot send.
+func (a *App) RemoteStreamURL(cameraID string) string {
+	if !a.cloud.LoggedIn() {
+		return ""
+	}
+	return a.proxy.urlFor(cameraID, "live.mjpeg")
+}
+
 // ------------------------------------------------------------------- live --
 
 type LiveSnapshot struct {
 	Stats  map[string]any   `json:"stats"`
 	Events []map[string]any `json:"events"`
+	// Viewing is true when none of this came from an engine on THIS PC. The
+	// screen must say so: the numbers are the company's, not this machine's,
+	// and a laptop in a hotel showing "2 cameras live" without that word
+	// would be claiming to be watching a shop it cannot see.
+	Viewing bool `json:"viewing"`
 }
 
+// Live is what the shop PC sees, and falls back to what HEAD OFFICE sees.
+//
+// A PC with no engine is not necessarily broken - it is somebody signed in on
+// a laptop away from the shop, which is the ordinary way an owner looks at
+// their estate. Until now that produced "engine not reachable at
+// 127.0.0.1:8010", an accurate sentence and a useless one when the reader was
+// never expecting an engine on that machine.
+//
+// The local engine always wins when it is there: it is this shop's own
+// ground truth and it is live rather than a heartbeat old.
 func (a *App) Live() (LiveSnapshot, error) {
 	ctx, cancel := context.WithTimeout(a.ctx, 15*time.Second)
 	defer cancel()
+
 	stats, err := a.local.Stats(ctx)
+	if err == nil {
+		events, eerr := a.local.Events(ctx, 40)
+		if eerr == nil {
+			return LiveSnapshot{Stats: stats, Events: events}, nil
+		}
+	}
+	// No engine here. If nobody is signed in either, the honest answer is
+	// still the local error - there is nothing else to show and the person
+	// is most likely setting this PC up.
+	if !a.cloud.LoggedIn() {
+		return LiveSnapshot{}, err
+	}
+	return a.liveFromCloud(ctx)
+}
+
+// liveFromCloud builds the same shape the Live screen already renders, out of
+// the estate's own feed, so the view needs no second code path.
+func (a *App) liveFromCloud(ctx context.Context) (LiveSnapshot, error) {
+	sites, err := a.cloud.Sites(ctx)
 	if err != nil {
 		return LiveSnapshot{}, err
 	}
-	events, err := a.local.Events(ctx, 40)
+	arrivals, err := a.cloud.Arrivals(ctx, 40)
 	if err != nil {
 		return LiveSnapshot{}, err
 	}
-	return LiveSnapshot{Stats: stats, Events: events}, nil
+
+	// The counters are summed across the estate, and fraction_below_gate
+	// takes the WORST site rather than an average - one badly placed camera
+	// is a hole in the numbers, and averaging it against three good ones
+	// hides the only site anyone needs to visit. Same rule the heartbeat
+	// already follows.
+	var up, total int
+	worst := 0.0
+	people := map[string]struct{}{}
+	for _, s := range sites {
+		up, total = up+s.CamerasUp, total+s.CamerasTotal
+		if s.FractionBelowGate > worst {
+			worst = s.FractionBelowGate
+		}
+	}
+	events := make([]map[string]any, 0, len(arrivals))
+	for _, v := range arrivals {
+		if v.VisitorID != "" {
+			people[v.VisitorID] = struct{}{}
+		}
+		events = append(events, map[string]any{
+			"type": map[bool]string{true: "person.new", false: "person.seen"}[v.IsNew],
+			"ts":   v.OccurredAt, "camera_id": v.CameraID,
+			"data": map[string]any{
+				"label": v.Label, "ref": v.Ref, "site": v.Site,
+				"similarity": v.Similarity, "attributes": v.Attributes,
+			},
+		})
+	}
+	return LiveSnapshot{
+		Viewing: true,
+		Events:  events,
+		Stats: map[string]any{
+			"cameras":    []map[string]any{},
+			"gallery":    map[string]any{"identities": len(people), "sightings": len(arrivals)},
+			"cameras_up": up, "cameras_total": total,
+			"fraction_below_gate": worst,
+		},
+	}, nil
 }
 
 // ---------------------------------------------------------------- reports --
@@ -745,3 +955,12 @@ func envOr(key, def string) string {
 	}
 	return def
 }
+
+// localWithCreds builds the engine client with a credential resolver, so a
+// first run - where the engine writes its credential after the app has looked
+// for it - recovers by itself instead of 401ing for the life of the process.
+func localWithCreds(base string, cfg agentcfg.Config) *local.Client {
+	c := local.New(base, cfg.APIUser, cfg.APIPassword)
+	c.Creds = agentcfg.NewCreds(agentpaths.APICredentials(), cfg.APIUser, cfg.APIPassword)
+	return c
+}

desktop/darwin_link.go

@@ -0,0 +1,25 @@
+//go:build darwin
+
+// Link the framework Wails' darwin frontend forgets.
+//
+// It references UTType (UniformTypeIdentifiers) without linking it, so a macOS
+// build fails at the LINK step with `Undefined symbols: _OBJC_CLASS_$_UTType`
+// - after compiling everything successfully, which makes it read like a broken
+// toolchain rather than one missing flag. That is why there was no Mac build:
+// not a design limit, a link error nobody had chased.
+//
+// Declared in the source rather than passed as CGO_LDFLAGS on the command
+// line, for the same reason deploy.sh now finds Go itself: a build that needs
+// the operator to know an incantation is a build that does not happen. Plain
+// `go build` and `wails build` both work on a Mac with this file present, and
+// the build tag makes it inert everywhere else.
+//
+// Note for anyone editing: the comment directly above `import "C"` is cgo's C
+// PREAMBLE, not documentation. This paragraph sits above `package main` on
+// purpose - put it there and the prose is compiled as C, which is how the
+// first attempt failed.
+
+package main
+
+// #cgo LDFLAGS: -framework UniformTypeIdentifiers
+import "C"

desktop/frontend/dist/index.html

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Behavision</title>
-    <script type="module" crossorigin src="./assets/index-C-oYbwC6.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-Z_jL3Bie.css">
+    <script type="module" crossorigin src="./assets/index-6LYbNlbD.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-DOJ2bRrM.css">
   </head>
   <body>
     <div id="root"></div>

desktop/frontend/src/App.jsx

@@ -133,7 +133,7 @@ export default function App() {
         </div>
       </aside>
       <main className="main">
-        <Current session={session} />
+        <Current session={session} onNavigate={setView} />
         {/* Loya's door, top right of every screen. A buddy you have to find in
             a sidebar is not around; one in the corner is. */}
         {!helping && (
@@ -172,6 +172,7 @@ function EngineBox() {
   // what this panel showed while recognition was visibly running.
   if (!running && s.reachable) { tone = 'warn'; text = 'Running outside the app' }
   else if (s.state === 'failed' || s.state === 'backoff') { tone = 'bad'; text = 'Not running' }
+  else if (running && !s.reachable && s.progress) { tone = 'warn'; text = `Downloading ${s.progress.what}… ${s.progress.percent}%` }
   else if (running && !s.reachable) { tone = 'warn'; text = 'Starting…' }
   else if (running && cams.length === 0) { tone = 'warn'; text = 'No cameras' }
   else if (running && up === 0) { tone = 'bad'; text = 'No camera connected' }

desktop/frontend/src/bridge.js

@@ -32,11 +32,15 @@ export const api = {
 
   cameras:            () => call('Cameras'),
   testCamera:         (cam) => call('TestCamera', cam),
+  discoverCameras:    () => call('DiscoverCameras'),
   saveCamera:         (id, cam) => call('SaveCamera', id, cam),
   deleteCamera:       (id) => call('DeleteCamera', id),
   startPlacement:     (id, seconds) => call('StartPlacementCheck', id, seconds),
   placementResult:    (id) => call('PlacementResult', id),
   streamURL:          (id) => call('StreamURL', id),
+  // The live view of a camera in another building, relayed through head
+  // office. Empty when nobody is signed in.
+  remoteStreamURL:    (id) => call('RemoteStreamURL', id),
 
   live:               () => call('Live'),
   pipelineStatus:     () => call('PipelineStatus'),

desktop/frontend/src/mock.js

@@ -47,6 +47,11 @@ if (scenario) {
     StartEngine: () => delay({state: 'running', reachable: true}),
     StopEngine: () => delay({state: 'stopped', reachable: false}),
     Cameras: () => delay(st.cameras.map(c => ({...c, connected: true, frames: 1200, faces: 9}))),
+    DiscoverCameras: () => delay({networks: ['192.168.1.0/24'], cameras: [
+      {host: '192.168.1.122', rtsp: true, onvif: true, name: 'HIKVISION DS-2CD2043G2', make: 'hikvision'},
+      {host: '192.168.1.121', rtsp: true, onvif: true, name: 'IPC-model IPC', make: ''},
+      {host: '192.168.1.40', rtsp: true, onvif: false, name: '', make: ''},
+    ]}, 2500),
     TestCamera: (cam) => delay({ok: Boolean(cam.host), width: 800, height: 448, codec: 'hevc', error: cam.host ? '' : 'no host'}, 1500),
     SaveCamera: (id, cam) => { const c = {id: id || cam.id || 'cam' + (st.cameras.length + 1), ...cam, has_password: Boolean(cam.password)}; delete c.password; st.cameras = [...st.cameras.filter(x => x.id !== c.id), c]; return delay(c) },
     DeleteCamera: (id) => { st.cameras = st.cameras.filter(c => c.id !== id); return delay(null) },

desktop/frontend/src/styles.css

@@ -598,3 +598,68 @@ tr.click { cursor: pointer; } tr.click:hover td { background: var(--s2); }
   box-shadow: var(--shadow-lg); cursor: pointer; font-size: 13px; font-weight: 600; }
 .loya-fab img { width: 20px; height: 20px; object-fit: contain; }
 .loya-fab:hover { background: var(--accent-3); border-color: var(--accent); }
+
+/* Camera finder: the pick-list that replaces "type an IP address". */
+.finder { display: flex; flex-direction: column; gap: var(--sp-3); align-items: flex-start; padding: var(--sp-3) var(--sp-4); border: 1px dashed var(--line); border-radius: var(--r); background: var(--s2); }
+.finder p { font-size: 13px; color: var(--ink-2); line-height: 1.5; margin: 0; }
+.finder.busy { flex-direction: row; align-items: center; color: var(--ink-2); font-size: 13px; border-style: solid; }
+.foundlist { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 6px; }
+.foundlist li button { width: 100%; display: flex; align-items: center; gap: var(--sp-3); padding: 10px 12px; border-radius: var(--r); border: 1px solid var(--line); background: var(--s2); color: var(--ink); cursor: pointer; text-align: left; font-size: 13px; }
+.foundlist li button:hover { border-color: var(--accent); }
+.foundlist li.picked button { border-color: var(--accent); background: var(--accent-3); }
+.foundlist .mono { font-family: var(--font-mono); font-size: 12.5px; min-width: 120px; }
+.foundlist .what { flex: 1; color: var(--ink-2); }
+.foundlist li.rescan button { width: auto; border: 0; background: none; padding: 4px 0; color: var(--ink-3); }
+
+/* Welcome: two paths, each a card. */
+.login .box.wide { max-width: 640px; }
+.choices { display: grid; grid-template-columns: 1fr 1fr; gap: var(--sp-3); margin-top: var(--sp-2); }
+@media (max-width: 720px) { .choices { grid-template-columns: 1fr; } }
+.choice { display: flex; flex-direction: column; align-items: flex-start; gap: 8px; text-align: left; padding: var(--sp-4);
+  border-radius: var(--r-lg); border: 1px solid var(--line); background: var(--s2); color: var(--ink); cursor: pointer; }
+.choice:hover { border-color: var(--accent); background: var(--accent-3); }
+.choice b { font-size: 14px; }
+.choice span { font-size: 12.5px; color: var(--ink-2); line-height: 1.5; }
+.choice em { font-family: var(--font-mono); font-style: normal; font-size: 11.5px; }
+.choice svg { color: var(--accent); }
+.login .foot em { font-style: normal; color: var(--ink-2); }
+.linkbtn { display: inline-flex; align-items: center; gap: 6px; }
+
+/* Getting started */
+.starter { margin-bottom: var(--sp-4); }
+.starter .panelhead { padding: var(--sp-3) var(--sp-4); }
+.starter .steps { margin: 0; padding: var(--sp-3) var(--sp-4) 0; }
+.starter .steps.compact li { padding: var(--sp-3) var(--sp-4) var(--sp-3) 52px; }
+.starter .steps li .btn { margin-top: var(--sp-2); }
+.starter .note { padding: var(--sp-3) var(--sp-4); font-size: 12px; }
+.btn.ghost { background: none; border-color: transparent; color: var(--ink-3); }
+.btn.ghost:hover { color: var(--ink); }
+
+/* Viewer mode: this PC has no engine, so the screens show the company's own
+   data from head office. Informational, not an error - it is the ordinary
+   state of a laptop away from a shop, and styling it red would train people
+   to ignore the red that means something. */
+.viewing {
+  display: flex; gap: 10px; align-items: flex-start;
+  padding: 12px 14px; margin-bottom: 14px;
+  border: 1px solid var(--line); border-radius: 10px;
+  background: color-mix(in srgb, var(--accent) 7%, transparent);
+  color: var(--ink-2); font-size: 13px; line-height: 1.5;
+}
+.viewing b { color: var(--ink); font-weight: 600; }
+.viewing svg { flex: none; margin-top: 2px; color: var(--accent); }
+
+/* Watch live sits over the picture, opposite the connection pill. It is on
+   the tile rather than in the button row because it is about the picture, and
+   because the row it would otherwise join is hidden on a remote camera. */
+.camview .btn.watch {
+  position: absolute;
+  right: 10px;
+  bottom: 10px;
+  background: rgba(0, 0, 0, .55);
+  border-color: rgba(255, 255, 255, .25);
+  color: #fff;
+  backdrop-filter: blur(6px);
+}
+.camview .btn.watch:hover { background: rgba(0, 0, 0, .72); }
+.camview .btn.watch.on { background: var(--accent); border-color: var(--accent); color: #fff; }

desktop/frontend/src/views/Cameras.jsx

@@ -19,7 +19,27 @@ export default function Cameras() {
   const [editing, setEditing] = useState(null)
   const [check, setCheck] = useState(null)
   const cams = data ?? []
-  const streams = useStreamURLs(cams)
+  // Every camera is remote or none is: this list comes from the engine on
+  // loopback, and when that is unreachable the whole list comes from head
+  // office instead. A remote camera is on a network this computer cannot
+  // reach, so the picture is the shop PC's last snapshot and the buttons that
+  // would talk to the camera are not offered - one that cannot work is worse
+  // than one that is absent.
+  const remote = cams.some(c => c.remote)
+  const streams = useStreamURLs(remote ? [] : cams)
+  // ONE camera at a time, and that is a cost decision rather than a layout
+  // one. A remote view makes the shop computer upload frames for as long as
+  // somebody is watching, so a grid that all went live at once would put an
+  // estate's worth of cameras on the wire because somebody opened a page.
+  const [watching, setWatching] = useState(null)
+  const [watchURL, setWatchURL] = useState('')
+  useEffect(() => {
+    let alive = true
+    if (!watching) { setWatchURL(''); return }
+    api.remoteStreamURL(watching).then(u => { if (alive) setWatchURL(u || '') })
+                                 .catch(() => { if (alive) setWatchURL('') })
+    return () => { alive = false }
+  }, [watching])
 
   async function remove(cam) {
     if (!confirm(`Remove ${cam.id}? Recognition from it stops immediately.`)) return
@@ -31,13 +51,22 @@ export default function Cameras() {
       <header className="pagehead">
         <div>
           <h2>Cameras</h2>
-          <p>Add a camera, then prove it can see faces with a walk-past. Only then is it working.</p>
+          <p>{remote
+            ? 'The cameras across your shops, as the shop computers last reported them.'
+            : 'Add a camera, then prove it can see faces with a walk-past. Only then is it working.'}</p>
         </div>
-        <button className="btn primary" onClick={() => setEditing({ ...BLANK })}>
+        {!remote && <button className="btn primary" onClick={() => setEditing({ ...BLANK })}>
           <Icon.Plus size={15} />Add camera
-        </button>
+        </button>}
       </header>
 
+      {remote && <div className="viewing">
+        <b>Viewing your shops from here.</b> These cameras are wired to the shop
+        computers, so they are set up and checked there. Each tile shows that
+        camera's most recent frame; <b>Watch live</b> asks the shop computer to
+        send video for as long as you are looking.
+      </div>}
+
       {error && <div className="err"><Icon.Warning size={15} />{error}</div>}
 
       {cams.length === 0
@@ -51,7 +80,10 @@ export default function Cameras() {
           </div>
         : <div className="camgrid">
             {cams.map(c => (
-              <CameraCard key={c.id} cam={c} stream={streams[c.id]}
+              <CameraCard key={c.id} cam={c}
+                          stream={watching === c.id ? watchURL : streams[c.id]}
+                          watching={watching === c.id}
+                          onWatch={() => setWatching(watching === c.id ? null : c.id)}
                           onEdit={() => setEditing(c)} onCheck={() => setCheck(c.id)} onRemove={() => remove(c)} />
             ))}
           </div>}
@@ -63,41 +95,74 @@ export default function Cameras() {
   )
 }
 
-function CameraCard({ cam, stream, onEdit, onCheck, onRemove }) {
-  const conn = cam.connected === undefined ? { tone: 'idle', label: 'Engine stopped' }
-    : cam.connected ? { tone: 'ok', label: 'Connected' } : { tone: 'bad', label: 'Not connecting' }
+function CameraCard({ cam, stream, watching, onWatch, onEdit, onCheck, onRemove }) {
+  // Three states, not two, and the third is why `connected` is a pointer on
+  // the wire: null means no shop computer has reported on this camera yet,
+  // which reads as waiting rather than as a fault to go and investigate.
+  const conn = cam.remote
+    // Four states, decided once by the server. `stale` is the one that was
+    // missing: the shop computer reports nothing when it cannot reach its own
+    // engine, so its last report used to sit there reading Connected -
+    // measured at 34 minutes on the live estate.
+    ? ({ connected:      { tone: 'ok',   label: 'Connected' },
+         not_connecting: { tone: 'bad',  label: 'Not connecting' },
+         stale:          { tone: 'warn', label: 'Not reporting' } }[cam.state]
+       || { tone: 'idle', label: 'Waiting for the shop computer' })
+    : cam.connected === undefined || cam.connected === null
+      ? { tone: 'idle', label: 'Engine stopped' }
+      : cam.connected ? { tone: 'ok', label: 'Connected' }
+                      : { tone: 'bad', label: 'Not connecting' }
   // The last placement verdict, so "proven" survives closing the sheet. Only
   // `good` is a pass: marginal means half the visitors are silently discarded.
-  const { data: last } = usePolled(() => api.placementResult(cam.id), 15000, [cam.id])
+  // Never asked for a remote camera: that answer lives on the shop computer,
+  // and polling loopback for it here only produces an error every 15 seconds.
+  const { data: last } = usePolled(
+    () => cam.remote ? Promise.resolve(null) : api.placementResult(cam.id), 15000, [cam.id])
   const proof = !last || last.running || !last.verdict || last.verdict === 'starting'
     ? { tone: 'miss', label: 'Not yet proven', text: 'Walk past it once and Behavision will tell you if the placement works.' }
     : last.verdict === 'good'
       ? { tone: 'seen', label: 'Proven', text: last.headline || 'Faces recognised on a walk-past.' }
       : { tone: 'miss', label: 'Not proven', text: last.headline || 'Move the camera and check again.' }
+  const shot = cam.snapshot?.available ? cam.snapshot.url : ''
   return (
     <article className="camcard">
       <div className="camview">
-        {stream
-          ? <img src={stream} alt={cam.id} />
+        {stream || shot
+          ? <img src={stream || shot} alt={cam.id} />
           : <div className="placeholder"><Icon.NoCamera size={34} /></div>}
         <span className={`pill ${conn.tone === 'idle' ? '' : conn.tone} over`}><i className={`dot ${conn.tone}`} />{conn.label}</span>
+        {cam.remote && <button className={`btn sm watch ${watching ? 'on' : ''}`} onClick={onWatch}>
+          <Icon.Play size={13} />{watching ? 'Stop watching' : 'Watch live'}
+        </button>}
       </div>
       <div className="cambody">
         <div className="camtitle">
           <div>
-            <h3>{cam.id}</h3>
-            <span className="mono note">{cam.host || cam.url}{cam.path ? ` · ${cam.path}` : ''}</span>
+            <h3>{cam.label || cam.camera_id || cam.id}</h3>
+            <span className="mono note">{cam.remote
+              ? cam.site || cam.site_slug || ''
+              : `${cam.host || cam.url}${cam.path ? ` · ${cam.path}` : ''}`}</span>
           </div>
-          <div className="camactions">
+          {!cam.remote && <div className="camactions">
             <button className="btn sm" onClick={onEdit}>Edit</button>
             <button className="btn sm danger" onClick={onRemove}>Remove</button>
-          </div>
-        </div>
-        <div className="camproof">
-          <span className={`tag ${proof.tone}`}>{proof.label}</span>
-          <span className="note">{proof.text}</span>
-          <button className={`btn sm ${proof.tone === 'seen' ? '' : 'primary'}`} onClick={onCheck}><Icon.Play size={13} />{proof.tone === 'seen' ? 'Check again' : 'Check placement'}</button>
+          </div>}
         </div>
+        {cam.remote
+          ? <div className="camproof">
+              <span className="note">{cam.state_note
+                ? cam.state_note
+                : watching
+                ? 'Live from the shop computer. It uploads only while you watch.'
+                : cam.snapshot?.available
+                  ? 'Last picture from the shop computer. Watch live to see it now.'
+                  : cam.snapshot?.reason || 'No picture yet from the shop computer.'}</span>
+            </div>
+          : <div className="camproof">
+              <span className={`tag ${proof.tone}`}>{proof.label}</span>
+              <span className="note">{proof.text}</span>
+              <button className={`btn sm ${proof.tone === 'seen' ? '' : 'primary'}`} onClick={onCheck}><Icon.Play size={13} />{proof.tone === 'seen' ? 'Check again' : 'Check placement'}</button>
+            </div>}
       </div>
     </article>
   )
@@ -165,6 +230,24 @@ function CameraSheet({ cam, onClose, onSaved }) {
 
   const chosen = makeById(make)
 
+  // The camera is picked from a scan of the shop's network rather than typed.
+  // Nobody knows their camera's address; the sticker is under the camera and
+  // the menu is different in every make's app. The scan names ONVIF cameras
+  // and lists anything with the RTSP port open; picking one fills the
+  // address and, when the make is recognisable, the stream path too.
+  const [scan, setScan] = useState(null)      // null | 'busy' | {cameras, networks} | {error}
+  async function findCameras() {
+    setScan('busy')
+    try { setScan(await api.discoverCameras()) } catch (e) { setScan({ error: message(e) }) }
+  }
+  function pick(c) {
+    const m = c.make ? makeById(c.make) : null
+    setF(prev => ({ ...prev, host: c.host, path: m?.path || prev.path,
+                    id: prev.id || (m ? '' : ''), }))
+    if (m) setMake(m.id)
+    setTest(null)
+  }
+
   return (
     <div className="drawer" onMouseDown={e => e.target === e.currentTarget && onClose()}>
       <div className="sheet">
@@ -176,6 +259,40 @@ function CameraSheet({ cam, onClose, onSaved }) {
           <p className="lead">Three things from the camera: its address, its make, and its password. Test before you save — a wrong address is the most common mistake.</p>
           {error && <div className="err"><Icon.Warning size={15} />{error}</div>}
 
+          {isNew && (
+            <section className="formsection">
+              <h4>Find it</h4>
+              {scan === null && (
+                <div className="finder">
+                  <p>Behavision can look for cameras on this shop’s network.</p>
+                  <button type="button" className="btn primary" onClick={findCameras}><Icon.Search size={14} />Find cameras on this network</button>
+                </div>
+              )}
+              {scan === 'busy' && <div className="finder busy"><span className="spinner" />Looking on the network… a few seconds.</div>}
+              {scan?.error && <div className="err"><Icon.Warning size={15} />{scan.error}</div>}
+              {scan?.cameras && (
+                scan.cameras.length === 0
+                  ? <div className="finder">
+                      <p>Nothing answered on {scan.networks?.join(', ') || 'this network'}. The camera may be on a different network, switched off, or not yet connected — check its cable and power, then try again. You can still type its address below.</p>
+                      <button type="button" className="btn" onClick={findCameras}>Try again</button>
+                    </div>
+                  : <ul className="foundlist">
+                      {scan.cameras.map(c => (
+                        <li key={c.host} className={f.host === c.host ? 'picked' : ''}>
+                          <button type="button" onClick={() => pick(c)}>
+                            <span className="mono">{c.host}</span>
+                            <span className="what">{c.name || (c.rtsp ? 'Streams video (RTSP)' : 'Answers ONVIF')}</span>
+                            {c.make && <span className="tag seen">{makeById(c.make).label}</span>}
+                            {f.host === c.host && <Icon.Check size={16} />}
+                          </button>
+                        </li>
+                      ))}
+                      <li className="rescan"><button type="button" className="btn sm" onClick={findCameras}>Scan again</button></li>
+                    </ul>
+              )}
+            </section>
+          )}
+
           <section className="formsection">
             <h4>The camera</h4>
             {isNew && (

desktop/frontend/src/views/Live.jsx

@@ -16,22 +16,29 @@ import * as Icon from '../ui/icons.jsx'
 // No camera picture here - the person at the counter is not watching CCTV,
 // and a live video tile costs CPU the recognition pipeline needs. The picture
 // lives on the Cameras screen, where it is a setup tool.
-export default function Live() {
+export default function Live({ onNavigate }) {
   const { data, error } = usePolled(() => api.live(), 3000)
   const { data: pipe } = usePolled(() => api.pipelineStatus(), 5000)
 
   const cameras = data?.stats?.cameras ?? []
   const gallery = data?.stats?.gallery ?? {}
   const events = data?.events ?? []
+  // No engine on THIS PC, so everything below came from head office. It has to
+  // be said rather than implied: a laptop in a hotel showing "2 cameras live"
+  // without this line is claiming to watch a shop it cannot see.
+  const viewing = data?.viewing === true
 
   // fraction_below_gate is the number that decides a site: what share of the
   // faces this camera saw were too poor to enrol. Surfaced rather than buried,
   // because a high value looks exactly like "a quiet day".
-  const worst = cameras.reduce((acc, c) => {
-    const f = c?.pipeline?.best_quality?.fraction_below_gate
-    return typeof f === 'number' && f > acc ? f : acc
-  }, 0)
-  const up = cameras.filter(c => c.connected).length
+  const worst = viewing
+    ? (data?.stats?.fraction_below_gate ?? 0)
+    : cameras.reduce((acc, c) => {
+        const f = c?.pipeline?.best_quality?.fraction_below_gate
+        return typeof f === 'number' && f > acc ? f : acc
+      }, 0)
+  // Viewing: the server already summed these across the estate.
+  const up = viewing ? (data?.stats?.cameras_up ?? 0) : cameras.filter(c => c.connected).length
 
   const arrivals = events.filter(e => e.type === 'person.new' || e.type === 'person.seen')
   const freshest = useFreshest(arrivals[0])
@@ -40,13 +47,30 @@ export default function Live() {
     <div className="page">
       <header>
         <h2>Live</h2>
-        <p>Who is in the shop, and whether it is reaching head office.</p>
+        <p>{viewing
+          ? 'Your shops, as head office sees them.'
+          : 'Who is in the shop, and whether it is reaching head office.'}</p>
       </header>
 
       {error && <div className="err"><Icon.Warning size={15} />{error}</div>}
 
+      {viewing && (
+        <div className="viewing">
+          <Icon.Cloud size={15} />
+          <span><b>Viewing your shops from here.</b> This computer is not watching
+          any cameras itself — everything below is what your shop PCs reported.
+          To recognise people on this machine, it has to be on the same network
+          as a camera.</span>
+        </div>
+      )}
+
       <PipelineStrip pipe={pipe} cameras={cameras} up={up} />
 
+      {/* Getting Started walks somebody through setting up a camera on THIS
+          PC — not what a viewer is doing, and not something they could finish
+          from here. */}
+      {!viewing && <GettingStarted cameras={cameras} arrivals={arrivals} onNavigate={onNavigate} />}
+
       <div className="panel arrivals-panel">
         <div className="panelhead">
           <h3>Who just walked in</h3>
@@ -82,6 +106,65 @@ export default function Live() {
   )
 }
 
+// The first five minutes, as a checklist that ticks itself.
+//
+// Before this the Live screen after install was "Nobody yet" over a row of
+// dashes, with an amber "No cameras" in the far corner. Nothing said what to
+// do next. This says the three things, in order, and each step reads its own
+// state from the engine: recognition ready, a camera added, the camera
+// proven by a walk-past. It disappears on its own once someone has actually
+// been recognised, because at that point the product has explained itself.
+function GettingStarted({ cameras, arrivals, onNavigate }) {
+  const { data: eng } = usePolled(() => api.engineStatus(), 4000)
+  const [hidden, setHidden] = useState(() => { try { return localStorage.getItem('bv.gettingStarted') === 'done' } catch { return false } })
+  const hasCamera = cameras.length > 0
+  const anyUp = cameras.some(c => c.connected)
+  const { data: checks } = usePolled(async () => {
+    const out = {}
+    for (const c of cameras) { try { out[c.camera_id] = await api.placementResult(c.camera_id) } catch { /* not yet */ } }
+    return out
+  }, 10000, [cameras.map(c => c.camera_id).join('|')])
+  const proven = Object.values(checks ?? {}).some(r => r && !r.running && r.verdict === 'good')
+  const recognised = arrivals.length > 0
+
+  if (hidden || recognised) return null
+  const engineReady = Boolean(eng?.reachable && eng?.recognition_model)
+  const progress = eng?.progress
+
+  const steps = [
+    { done: engineReady, now: !engineReady,
+      title: engineReady ? `Recognition ready (${eng.recognition_model})` : progress ? `Downloading ${progress.what}… ${progress.percent}%` : 'Starting recognition…',
+      text: engineReady ? null : 'First start downloads about 275 MB of recognition models. A few minutes on a normal connection; nothing to do meanwhile.' },
+    { done: hasCamera && anyUp, now: engineReady && !(hasCamera && anyUp),
+      title: hasCamera ? (anyUp ? 'Camera connected' : 'Camera added — not connecting yet') : 'Add your camera',
+      text: hasCamera ? (anyUp ? null : 'Check its password and stream path under Cameras → Edit.') : 'Behavision can find it on the network; you type only its password.',
+      action: hasCamera ? null : { label: 'Add camera', go: 'cameras' } },
+    { done: proven, now: hasCamera && anyUp && !proven,
+      title: proven ? 'Camera proven — it can recognise faces' : 'Walk past the camera',
+      text: proven ? null : 'Run Check placement and walk past like a customer for 25 seconds. Only a “good” verdict means it will recognise people.',
+      action: hasCamera && anyUp && !proven ? { label: 'Check placement', go: 'cameras' } : null },
+  ]
+
+  return (
+    <section className="panel starter">
+      <div className="panelhead">
+        <h3>Getting started</h3>
+        <button className="btn sm ghost" onClick={() => { try { localStorage.setItem('bv.gettingStarted', 'done') } catch {} ; setHidden(true) }}>Hide</button>
+      </div>
+      <ol className="steps compact">
+        {steps.map((st, i) => (
+          <li key={i} className={st.done ? 'done' : st.now ? 'now' : ''}>
+            <b>{st.title}</b>
+            {st.text && <span>{st.text}</span>}
+            {st.action && <button className="btn sm primary" onClick={() => onNavigate?.(st.action.go)}>{st.action.label}</button>}
+          </li>
+        ))}
+      </ol>
+      <p className="note">The moment a customer is recognised, this list goes away.</p>
+    </section>
+  )
+}
+
 // One customer, big enough to match against the person in front of you.
 function Arrival({ e, fresh }) {
   const isNew = e.type === 'person.new'

desktop/frontend/src/views/Setup.jsx

@@ -15,7 +15,6 @@ export default function Setup({ onDone, onCancel }) {
   const [code, setCode] = useState('')
   const [busy, setBusy] = useState(null)
   const [error, setError] = useState(null)
-  const [alone, setAlone] = useState(false)
 
   async function submit(e) {
     e.preventDefault()
@@ -40,13 +39,66 @@ export default function Setup({ onDone, onCancel }) {
     }
   }
 
+  // First launch: a choice, not a code box. Two thirds of the people who
+  // open this have no idea what an installation code is; the other third has
+  // one in their hand. Both must see their own path in the first second.
+  const [path, setPath] = useState(onCancel ? 'code' : null)
+
+  if (path === null) {
+    return (
+      <div className="login">
+        <div className="box wide">
+          <span className="mark"><img src={logo} alt="" /></span>
+          <h1>Welcome to Behavision</h1>
+          <p className="lead">
+            This PC will watch your shop’s cameras and recognise returning customers.
+            First, one question: is this shop managed from a head office?
+          </p>
+          <div className="choices">
+            <button type="button" className="choice" onClick={() => setPath('code')}>
+              <Icon.Cloud size={22} />
+              <b>Yes — I have an installation code</b>
+              <span>Head office gave you a code like <em>ABCDEF-123456-…</em>. This PC joins that shop and gets its cameras from there.</span>
+            </button>
+            <button type="button" className="choice" onClick={() => setPath('alone')}>
+              <Icon.Shield size={22} />
+              <b>No — set up on this PC only</b>
+              <span>Cameras, customers and recognition stay on this PC. Nothing is sent anywhere. You can link to a head office later.</span>
+            </button>
+          </div>
+        </div>
+      </div>
+    )
+  }
+
+  if (path === 'alone') {
+    return (
+      <div className="login">
+        <div className="box">
+          <span className="mark"><img src={logo} alt="" /></span>
+          <h1>On this PC only</h1>
+          <p className="lead">
+            Behavision will run entirely here. Next you’ll add your camera — it can find it on the network for you — and walk past it once so it can prove it works.
+          </p>
+          {error && <div className="err"><Icon.Warning size={15} />{error}</div>}
+          <button type="button" className="btn primary" disabled={!!busy} onClick={standalone}>
+            {busy === 'alone' ? 'Setting up…' : 'Continue'}
+          </button>
+          <div className="alt">
+            <button type="button" className="linkbtn" onClick={() => setPath(null)}><Icon.Back size={14} /> Back</button>
+          </div>
+        </div>
+      </div>
+    )
+  }
+
   return (
     <div className="login">
       <div className="box">
         <span className="mark"><img src={logo} alt="" /></span>
-        <h1>{onCancel ? 'Link to head office' : 'Set up this PC'}</h1>
+        <h1>{onCancel ? 'Link to head office' : 'Join your shop'}</h1>
         <p className="lead">
-          Type the installation code for this shop. You only do this once.
+          Type the installation code head office gave you. It works once, and this PC becomes that shop.
         </p>
         <form onSubmit={submit}>
           {error && <div className="err"><Icon.Warning size={15} />{error}</div>}
@@ -67,38 +119,12 @@ export default function Setup({ onDone, onCancel }) {
           </button>
         </form>
         <p className="foot">
-          The code works once. Ask whoever manages your shops for it — they can
-          create one from the Behavision platform, under the shop.
+          Don’t have one? Whoever runs head office creates it under the shop: <em>Shops → the shop → Set up a shop PC</em>.
         </p>
-
-        {/* The second way out of this screen, and the reason it exists.
-            Recognition, the cameras and this shop's own gallery all run on
-            this PC and need no server, so a shop with one till and no head
-            office was being blocked from adding a camera until somebody
-            issued it a code — the software refusing to do the thing it is
-            for. Linking later is still one click away, and it keeps the
-            visits already recorded here. */}
         <div className="alt">
           {onCancel
-            ? <button type="button" className="linkbtn" onClick={onCancel}>
-                Not now — go back
-              </button>
-            : !alone
-            ? <button type="button" className="linkbtn" onClick={() => setAlone(true)}>
-                No head office — set this PC up on its own
-              </button>
-            : <>
-                <p className="note">
-                  This PC will watch its cameras and recognise returning
-                  customers on its own. Nothing is sent anywhere. You can link
-                  it to head office later without losing anything recorded
-                  here.
-                </p>
-                <button type="button" className="btn" disabled={!!busy}
-                        onClick={standalone}>
-                  {busy === 'alone' ? 'Setting up…' : 'Use this PC on its own'}
-                </button>
-              </>}
+            ? <button type="button" className="linkbtn" onClick={onCancel}>Not now — go back</button>
+            : <button type="button" className="linkbtn" onClick={() => setPath(null)}><Icon.Back size={14} /> Back</button>}
         </div>
       </div>
     </div>

desktop/internal/cloud/client.go

@@ -14,6 +14,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -39,6 +40,19 @@ type Client struct {
 	// single-use refresh token.
 	refreshMu sync.Mutex
 	onRefresh func(Session)
+
+	// Camera snapshots already fetched, keyed by camera id. The Cameras screen
+	// polls every 8 seconds and a snapshot is ~90 KB, so re-fetching one that
+	// has not changed would put megabytes an hour on the wire to redraw the
+	// same picture - the same trap the web app's useAuthedImage avoids by
+	// keying on the url rather than the object around it.
+	shotMu sync.Mutex
+	shots  map[string]cachedShot
+}
+
+type cachedShot struct {
+	at  string // the server's snapshot_at; a new one is a new picture
+	uri string
 }
 
 type User struct {
@@ -629,3 +643,182 @@ func (c *Client) RecordPurchase(ctx context.Context, visitorID string,
 		"items": items, "source": "manual", "notes": notes,
 	}, nil)
 }
+
+// ---------------------------------------------------------------- viewing --
+//
+// A PC with no engine of its own is not broken, it is a VIEWER: somebody
+// signed in on a laptop away from the shop. Everything below reads head
+// office so those screens have something true to show instead of "engine not
+// reachable", which is an accurate sentence and a useless one when the reader
+// was never expecting an engine on that machine.
+
+// Arrival is one visit as the estate's feed reports it, across every shop -
+// not just this PC's. `GET /api/visits`.
+type Arrival struct {
+	VisitID    string         `json:"visit_id"`
+	VisitRef   string         `json:"visit_ref"`
+	OccurredAt string         `json:"occurred_at"`
+	Site       string         `json:"site"`
+	SiteSlug   string         `json:"site_slug"`
+	CameraID   string         `json:"camera_id"`
+	VisitorID  string         `json:"visitor_id"`
+	Ref        string         `json:"ref"`
+	Label      string         `json:"label"`
+	IsNew      bool           `json:"is_new_visitor"`
+	Similarity float64        `json:"similarity"`
+	Attributes map[string]any `json:"attributes"`
+	Image      Photo          `json:"image"`
+}
+
+// RemoteCamera is a camera as HEAD OFFICE knows it. Deliberately not the same
+// type the local engine returns: this one can never be edited from here (the
+// shop PC on that LAN is the only thing that can reach it) and it carries a
+// snapshot rather than a stream.
+type RemoteCamera struct {
+	ID         string `json:"id"`
+	CameraID   string `json:"camera_id"`
+	Label      string `json:"label"`
+	Site       string `json:"site"`
+	SiteSlug   string `json:"site_slug"`
+	Enabled    bool   `json:"enabled"`
+	Connected  *bool  `json:"connected"`
+	LastSeenAt string `json:"last_seen_at"`
+	// State is the server's single answer - connected / not_connecting /
+	// waiting / stale - and the screen renders that rather than deciding
+	// again from Connected. Two places deciding one fact is how a shop came
+	// out labelled Working, in green, above "2 of 3 cameras not connecting".
+	State      string `json:"state"`
+	StateNote  string `json:"state_note"`
+	Snapshot   Photo  `json:"snapshot"`
+	SnapshotAt string `json:"snapshot_at"`
+}
+
+// Arrivals reads the estate's recent visits, newest last.
+func (c *Client) Arrivals(ctx context.Context, limit int) ([]Arrival, error) {
+	var out struct {
+		Arrivals []Arrival `json:"arrivals"`
+	}
+	if err := c.send(ctx, http.MethodGet,
+		fmt.Sprintf("/api/visits?limit=%d", limit), nil, &out); err != nil {
+		return nil, err
+	}
+	return out.Arrivals, nil
+}
+
+// RemoteCameras lists every camera head office knows about for this company.
+func (c *Client) RemoteCameras(ctx context.Context) ([]RemoteCamera, error) {
+	var out []RemoteCamera
+	if err := c.send(ctx, http.MethodGet, "/api/cameras", nil, &out); err != nil {
+		return nil, err
+	}
+	for i := range out {
+		out[i].Snapshot = c.resolveShot(ctx, out[i].ID, out[i].SnapshotAt, out[i].Snapshot)
+	}
+	return out, nil
+}
+
+// resolveShot turns a camera snapshot into something the window can render.
+//
+// Same problem VisitorImage has and the same answer: a deployment with no
+// object storage serves the picture from the API itself, so the url is
+// relative and needs this session's bearer. A webview <img> can supply
+// neither - it resolves a relative src against wails:// and cannot set a
+// header - so the bytes are fetched here and passed as a data: URI.
+//
+// A failure is an absence with a reason, never an error. Whether the camera is
+// CONNECTED is the answer this screen exists to give; the photograph is
+// decoration, and blanking the card because a picture would not load would
+// hide the part that matters.
+func (c *Client) resolveShot(ctx context.Context, camID, at string, p Photo) Photo {
+	if !p.Available || !p.Auth || p.URL == "" {
+		return p
+	}
+	c.shotMu.Lock()
+	hit, ok := c.shots[camID]
+	c.shotMu.Unlock()
+	if ok && hit.at == at && at != "" {
+		p.URL, p.Auth = hit.uri, false
+		return p
+	}
+	uri, err := c.fetchImage(ctx, p.URL)
+	if err != nil {
+		return Photo{Reason: "That camera's picture could not be loaded."}
+	}
+	c.shotMu.Lock()
+	if c.shots == nil {
+		c.shots = map[string]cachedShot{}
+	}
+	c.shots[camID] = cachedShot{at: at, uri: uri}
+	c.shotMu.Unlock()
+	p.URL, p.Auth = uri, false
+	return p
+}
+
+// CameraLive opens head office's live relay for one camera and returns the
+// live SSE response for the caller to read and close.
+//
+// A response rather than frames, because the consumer is the app's own
+// loopback relay: it re-emits these frames as MJPEG so an <img> can show them,
+// and buffering the stream through a channel here would only add a place for
+// frames to queue. A stale frame is worthless - the only one worth having is
+// the newest - which is the whole reason LiveHub drops rather than queues.
+//
+// There is no client timeout on this request. A live view is endless by
+// design and any deadline would cut the picture off mid-shift; the context is
+// what ends it, when the viewer navigates away.
+func (c *Client) CameraLive(ctx context.Context, cameraID string) (*http.Response, error) {
+	resp, err := c.liveOnce(ctx, cameraID)
+	if errors.Is(err, errTokenExpired) {
+		if rerr := c.Refresh(ctx); rerr != nil {
+			return nil, rerr
+		}
+		resp, err = c.liveOnce(ctx, cameraID)
+	}
+	return resp, err
+}
+
+func (c *Client) liveOnce(ctx context.Context, cameraID string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		c.Base+"/api/cameras/"+url.PathEscape(cameraID)+"/live", nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "text/event-stream")
+	c.mu.RLock()
+	tok := c.token
+	c.mu.RUnlock()
+	if tok == "" {
+		return nil, ErrUnauthorized
+	}
+	req.Header.Set("Authorization", "Bearer "+tok)
+
+	// c.http has a 30 s timeout, which covers the whole response and would
+	// therefore sever a working live view every thirty seconds - the same
+	// trap that made the server set WriteTimeout to zero for its own SSE
+	// endpoint. A dedicated client, with the dial bounded instead.
+	hc := &http.Client{Transport: &http.Transport{
+		DialContext:         (&net.Dialer{Timeout: 10 * time.Second}).DialContext,
+		TLSHandshakeTimeout: 10 * time.Second,
+	}}
+	resp, err := hc.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot reach %s: %w", c.Base, err)
+	}
+	if resp.StatusCode == http.StatusUnauthorized {
+		var e struct {
+			Error string `json:"error"`
+		}
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 8192))
+		resp.Body.Close()
+		_ = json.Unmarshal(body, &e)
+		if e.Error == "token_expired" {
+			return nil, errTokenExpired
+		}
+		return nil, ErrUnauthorized
+	}
+	if resp.StatusCode >= 400 {
+		resp.Body.Close()
+		return nil, fmt.Errorf("live view: %s", resp.Status)
+	}
+	return resp, nil
+}

desktop/internal/local/client.go

@@ -10,6 +10,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	agentconfig "github.com/loyaly/behavision-agent/pkg/config"
 	"io"
 	"net/http"
 	"strings"
@@ -20,7 +21,11 @@ type Client struct {
 	Base     string
 	User     string
 	Password string
-	http     *http.Client
+	// Creds re-reads the engine's generated credential when one is rejected.
+	// On a first run the app starts the engine, and the engine writes that
+	// file seconds later - after the app has already looked for it.
+	Creds *agentconfig.Creds
+	http  *http.Client
 }
 
 func New(base, user, password string) *Client {
@@ -48,8 +53,12 @@ func (c *Client) do(ctx context.Context, method, path string, body, out any) err
 	if body != nil {
 		req.Header.Set("Content-Type", "application/json")
 	}
-	if c.User != "" {
-		req.SetBasicAuth(c.User, c.Password)
+	user, pass := c.User, c.Password
+	if c.Creds != nil {
+		user, pass = c.Creds.Get()
+	}
+	if user != "" {
+		req.SetBasicAuth(user, pass)
 	}
 	resp, err := c.http.Do(req)
 	if err != nil {
@@ -105,6 +114,12 @@ func (c *Client) DeleteCamera(ctx context.Context, id string) error {
 	return c.do(ctx, http.MethodDelete, "/api/cameras/"+id, nil, nil)
 }
 
+// DiscoverCameras asks the engine to scan the shop's network. A few seconds.
+func (c *Client) DiscoverCameras(ctx context.Context) (map[string]any, error) {
+	var out map[string]any
+	return out, c.do(ctx, http.MethodGet, "/api/cameras/discover", nil, &out)
+}
+
 func (c *Client) TestCamera(ctx context.Context, cam map[string]any) (map[string]any, error) {
 	var out map[string]any
 	return out, c.do(ctx, http.MethodPost, "/api/cameras/test", cam, &out)

desktop/main.go

@@ -12,10 +12,12 @@ import (
 	"context"
 	"embed"
 	"log"
+	runtime2 "runtime"
 
 	"github.com/wailsapp/wails/v2"
 	"github.com/wailsapp/wails/v2/pkg/options"
 	"github.com/wailsapp/wails/v2/pkg/options/assetserver"
+	"github.com/wailsapp/wails/v2/pkg/options/mac"
 	"github.com/wailsapp/wails/v2/pkg/options/windows"
 	"github.com/wailsapp/wails/v2/pkg/runtime"
 )
@@ -43,8 +45,13 @@ func main() {
 		UniqueId: "ai.loyaly.behavision.desktop",
 		OnSecondInstanceLaunch: func(options.SecondInstanceData) {
 			if ctxRef != nil {
-				runtime.Show(ctxRef)
-				runtime.WindowUnminimise(ctxRef)
+				// The same four calls the tray uses, and for the same reasons:
+				// this runs on Wails' own listener goroutine rather than the
+				// window's thread, and the launching process holds the
+				// foreground, so without the flip the window comes back behind
+				// it. Double-clicking the desktop icon while it is already
+				// running is the single most common way anyone reaches this.
+				go openWindow(ctxRef)
 			}
 		},
 	}
@@ -61,15 +68,30 @@ func main() {
 		// Closing the window hides it rather than quitting: the engine must
 		// keep recognising after a shop assistant clicks the X, and the tray
 		// is where they get the window back.
-		HideWindowOnClose: true,
+		// Windows hides on close because the tray is how the window comes
+		// back and how recognition is stopped. macOS has no tray here (see
+		// tray_run_darwin.go), so hiding would leave a running engine with no
+		// window, no tray and no way to reach either - force-quit or nothing.
+		// Closing the window therefore quits, which also stops the engine
+		// through OnShutdown. Same rule as the tray's Quit: never leave it
+		// watching with no visible control.
+		HideWindowOnClose: runtime2.GOOS == "windows",
 		OnStartup: func(ctx context.Context) {
 			ctxRef = ctx
 			app.startup(ctx)
 			tray.start(ctx)
 		},
 		OnBeforeClose: func(ctx context.Context) bool {
-			runtime.Hide(ctx)
-			return true // prevent the close
+			if runtime2.GOOS != "windows" {
+				return false // let it close, and OnShutdown stops the engine
+			}
+			// WindowHide, not Hide. They are different calls on Windows -
+			// WindowHide locks the OS thread for the Win32 work and Hide does
+			// not - and the tray's reopen uses WindowShow, so hiding through
+			// the other one leaves the pair mismatched. Same call, opposite
+			// direction.
+			runtime.WindowHide(ctx)
+			return true // prevent the close; the tray is how it comes back
 		},
 		OnShutdown: func(ctx context.Context) {
 			tray.stop()
@@ -77,6 +99,17 @@ func main() {
 			app.StopEngine()
 		},
 		Bind: []any{app},
+		// This block has to EXIST, not merely be empty. Wails computes
+		// `zoomable = !Mac.DisableZoom` inside `if frontendOptions.Mac !=
+		// nil`, and the variable defaults to 0 - so leaving Mac unset does not
+		// mean "defaults", it means the green maximise button is created dead.
+		// There was a Windows block and no Mac one, so the window could not be
+		// zoomed on macOS and nothing anywhere said why.
+		Mac: &mac.Options{
+			WebviewIsTransparent: false,
+			WindowIsTranslucent:  false,
+			DisableZoom:          false,
+		},
 		Windows: &windows.Options{
 			WebviewIsTransparent: false,
 			WindowIsTranslucent:  false,

desktop/stream_proxy.go

@@ -21,6 +21,7 @@ package main
 // session and the bytes are fetched and handed over as an object URL.
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/subtle"
 	"encoding/hex"
@@ -64,6 +65,12 @@ type streamProxy struct {
 	target string // engine origin, e.g. http://127.0.0.1:8010
 	user   string
 	pass   string
+
+	// Opens head office's live relay for one camera. Set on a computer that
+	// is signed in, whether or not an engine runs here - which is the whole
+	// point: watching a camera in another building is precisely the case
+	// where there is no engine on this machine to ask.
+	live func(ctx context.Context, cameraID string) (*http.Response, error)
 }
 
 func newStreamProxy() *streamProxy { return &streamProxy{} }
@@ -71,18 +78,49 @@ func newStreamProxy() *streamProxy { return &streamProxy{} }
 // start binds a loopback listener and begins relaying. Calling it again while
 // running is a no-op, so a restarted engine cannot leave two listeners behind.
 func (p *streamProxy) start(base, user, pass string) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	if p.srv != nil {
-		return nil
-	}
-
 	if !strings.HasPrefix(base, "http://") && !strings.HasPrefix(base, "https://") {
 		base = "http://" + base
 	}
 	if _, err := url.Parse(base); err != nil {
 		return fmt.Errorf("engine base %q: %w", base, err)
 	}
+	if err := p.bind(); err != nil {
+		return err
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.target = strings.TrimRight(base, "/")
+	p.user, p.pass = user, pass
+	return nil
+}
+
+// watchRemote makes the relay able to serve head office's live view, and
+// binds it if nothing else has.
+//
+// Separate from start() because the two are independent: a shop PC has both
+// an engine and a session, an owner's laptop has only a session, and a PC
+// still being set up has only an engine. Folding them together would mean a
+// computer with no engine could not watch a camera at all - which is the one
+// computer most likely to be trying to.
+func (p *streamProxy) watchRemote(fn func(context.Context, string) (*http.Response, error)) error {
+	if err := p.bind(); err != nil {
+		return err
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.live = fn
+	return nil
+}
+
+// bind starts the loopback listener once. Calling it again while running is a
+// no-op, so neither a restarted engine nor a second sign-in can leave two
+// listeners behind.
+func (p *streamProxy) bind() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.srv != nil {
+		return nil
+	}
 
 	// The engine's own credential exists precisely so that the live face feed
 	// is never served open - CLAUDE.md is explicit that an unauthenticated
@@ -105,8 +143,6 @@ func (p *streamProxy) start(base, user, pass string) error {
 
 	p.ln = ln
 	p.token = hex.EncodeToString(raw)
-	p.target = strings.TrimRight(base, "/")
-	p.user, p.pass = user, pass
 	// No client timeout: an MJPEG stream is endless by design and any deadline
 	// would cut the picture off mid-shift. The request context ends it when
 	// the webview navigates away or the tile is replaced.
@@ -130,7 +166,7 @@ func (p *streamProxy) start(base, user, pass string) error {
 func (p *streamProxy) stop() {
 	p.mu.Lock()
 	srv, ln := p.srv, p.ln
-	p.srv, p.ln, p.token = nil, nil, ""
+	p.srv, p.ln, p.token, p.live = nil, nil, "", nil
 	p.mu.Unlock()
 	if srv != nil {
 		_ = srv.Close()
@@ -155,6 +191,7 @@ func (p *streamProxy) urlFor(cameraID, file string) string {
 func (p *streamProxy) handle(w http.ResponseWriter, r *http.Request) {
 	p.mu.RLock()
 	token, target, user, pass, client := p.token, p.target, p.user, p.pass, p.client
+	liveFn := p.live
 	p.mu.RUnlock()
 	if token == "" || client == nil {
 		http.NotFound(w, r)
@@ -190,6 +227,17 @@ func (p *streamProxy) handle(w http.ResponseWriter, r *http.Request) {
 	// calls; it is here so that adding a still later is a change to a screen
 	// rather than a change to the one file where a mistake is a credentialed
 	// proxy onto the biometric API.
+	// Head office's relay, not the engine. The two are different machines and
+	// different credentials, so this returns rather than falling through.
+	if parts[3] == "live.mjpeg" {
+		if liveFn == nil {
+			http.Error(w, "not signed in to head office", http.StatusBadGateway)
+			return
+		}
+		p.relayRemote(w, r, cameraID, liveFn)
+		return
+	}
+
 	var enginePath string
 	switch parts[3] {
 	case "stream.mjpeg":

desktop/stream_remote.go

@@ -0,0 +1,149 @@
+package main
+
+// Watching a camera in another building, from the app.
+//
+// The shop PC sits behind a router with no inbound route, so nothing here can
+// pull its MJPEG stream - that stream is served on the shop PC's own loopback
+// and always will be. Head office's LiveHub is the way round it: the agent
+// asks outbound whether anyone is watching and pushes JPEG frames up for
+// exactly as long as somebody is. The head-office web app already consumes
+// that; this is the same feed, for the app.
+//
+// It arrives as base64 frames over SSE, which an <img> cannot render, so this
+// re-emits them as multipart MJPEG - which an <img> renders natively, through
+// the relay that already exists for the local engine. That is what keeps ONE
+// code path in the screens: a tile points at a loopback URL and does not know
+// or care which building the picture came from.
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// The boundary is ours to choose; it only has to be a string the JPEG bytes
+// cannot contain, and a marker line never appears inside JPEG data.
+const mjpegBoundary = "behavisionframe"
+
+// A frame is base64, so ~1.33 bytes on the wire per byte of picture. The
+// engine re-encodes to 640 px for the relay and those measure ~20 KB, so this
+// is roughly a hundredfold headroom - large enough never to clip a real frame
+// and small enough that a broken or hostile stream cannot grow this process's
+// memory without bound.
+const maxFrameLine = 8 << 20
+
+func (p *streamProxy) relayRemote(w http.ResponseWriter, r *http.Request,
+	cameraID string, open func(context.Context, string) (*http.Response, error)) {
+
+	w.Header().Set("Content-Type", "multipart/x-mixed-replace; boundary="+mjpegBoundary)
+	w.Header().Set("Cache-Control", "no-store")
+	flusher, _ := w.(http.Flusher)
+
+	// Send the headers NOW, before any frame exists. Go writes them on the
+	// first body write, so without this the whole response - status line
+	// included - waits for the shop computer to start pushing, and a viewer
+	// whose camera is slow to answer sees the REQUEST time out rather than a
+	// stream that has not painted yet. Measured against production: 30
+	// seconds and not even a Content-Type.
+	if flusher != nil {
+		flusher.Flush()
+	}
+
+	// Reconnecting is normal, not an error. The server caps one push at five
+	// minutes so that a tab left open for a week cannot leave a shop
+	// uploading for a week - so a viewer who IS still there simply asks
+	// again. Doing it here rather than in the page is what lets the <img>
+	// survive the cap: it never sees the stream end.
+	sent := 0
+	for {
+		if r.Context().Err() != nil {
+			return
+		}
+		n, err := p.pumpRemote(w, flusher, r.Context(), cameraID, open)
+		sent += n
+		if r.Context().Err() != nil {
+			return
+		}
+		// Nothing was written and the attempt failed. Writing an error body
+		// now would be writing it into a multipart stream the <img> is
+		// already parsing, so the picture simply stays on whatever it last
+		// showed and the screen's own "not connecting" state is the report.
+		if err != nil && sent == 0 {
+			return
+		}
+		select {
+		case <-r.Context().Done():
+			return
+		case <-time.After(1500 * time.Millisecond):
+		}
+	}
+}
+
+// pumpRemote runs one SSE connection to exhaustion and returns how many
+// frames it forwarded.
+func (p *streamProxy) pumpRemote(w http.ResponseWriter, flusher http.Flusher,
+	ctx context.Context, cameraID string,
+	open func(context.Context, string) (*http.Response, error)) (int, error) {
+
+	resp, err := open(ctx, cameraID)
+	if err != nil {
+		return 0, err
+	}
+	defer resp.Body.Close()
+
+	sc := bufio.NewScanner(resp.Body)
+	sc.Buffer(make([]byte, 0, 64*1024), maxFrameLine)
+
+	var event, data string
+	frames := 0
+	for sc.Scan() {
+		line := sc.Text()
+		switch {
+		case strings.HasPrefix(line, "event: "):
+			event = strings.TrimSpace(line[7:])
+		case strings.HasPrefix(line, "data: "):
+			data = line[6:]
+		case line == "":
+			// End of one SSE event. `waiting` means head office has us
+			// registered and the shop PC has not started pushing yet - a real
+			// second or two while the agent is asked, and nothing to draw.
+			if event == "frame" && data != "" {
+				if err := writeMJPEGFrame(w, flusher, data); err != nil {
+					return frames, err // the webview went away
+				}
+				frames++
+			}
+			event, data = "", ""
+		}
+	}
+	return frames, sc.Err()
+}
+
+func writeMJPEGFrame(w http.ResponseWriter, flusher http.Flusher, b64 string) error {
+	jpg, err := base64.StdEncoding.DecodeString(b64)
+	if err != nil || len(jpg) == 0 {
+		// One malformed frame is not a reason to tear down a working view.
+		return nil
+	}
+	if _, err := fmt.Fprintf(w,
+		"--%s\r\nContent-Type: image/jpeg\r\nContent-Length: %d\r\n\r\n",
+		mjpegBoundary, len(jpg)); err != nil {
+		return err
+	}
+	if _, err := w.Write(jpg); err != nil {
+		return err
+	}
+	if _, err := w.Write([]byte("\r\n")); err != nil {
+		return err
+	}
+	// Flushed per frame. Anything held waiting for a full buffer is a tile
+	// that stays blank, which is indistinguishable from the view not working.
+	if flusher != nil {
+		flusher.Flush()
+	}
+	return nil
+}

desktop/stream_remote_live_test.go

@@ -0,0 +1,103 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/loyaly/behavision-desktop/internal/cloud"
+)
+
+// The whole chain against the real head office and a real shop computer:
+//
+//	TEST_CLOUD_EMAIL=... TEST_CLOUD_PASSWORD=... \
+//	  go test ./desktop/ -run RemoteLive -v
+//
+// Everything in stream_remote_test.go proves the relay against a fake that
+// agrees with me. Only this proves the part that cannot be faked: that a shop
+// computer behind a router with no inbound route actually pushes frames when
+// asked, that they survive base64 and SSE, and that what comes out of the
+// loopback relay is a multipart stream an <img> will paint.
+//
+// It also costs something to run, which is why it is opt-in: watching makes
+// the shop computer upload for as long as the test reads.
+func TestRemoteLiveFromProduction(t *testing.T) {
+	email, pass := os.Getenv("TEST_CLOUD_EMAIL"), os.Getenv("TEST_CLOUD_PASSWORD")
+	if email == "" || pass == "" {
+		t.Skip("set TEST_CLOUD_EMAIL and TEST_CLOUD_PASSWORD to run against production")
+	}
+	base := os.Getenv("TEST_CLOUD_URL")
+	if base == "" {
+		base = "https://mcp.loyaly.ai"
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	c := cloud.New(base)
+	if _, err := c.Login(ctx, email, pass); err != nil {
+		t.Fatalf("login: %v", err)
+	}
+
+	cams, err := c.RemoteCameras(ctx)
+	if err != nil {
+		t.Fatalf("cameras: %v", err)
+	}
+	t.Logf("%d cameras", len(cams))
+	target := os.Getenv("TEST_CLOUD_CAMERA")
+	for _, cam := range cams {
+		conn := "waiting"
+		if cam.Connected != nil {
+			conn = map[bool]string{true: "connected", false: "not connecting"}[*cam.Connected]
+		}
+		t.Logf("  %-10s %-16s %-15s snapshot=%v", cam.CameraID, cam.Site, conn, cam.Snapshot.Available)
+		if target == "" && cam.Connected != nil && *cam.Connected {
+			target = cam.CameraID
+		}
+	}
+	if target == "" {
+		t.Skip("no connected camera to watch")
+	}
+
+	p := newStreamProxy()
+	if err := p.watchRemote(c.CameraLive); err != nil {
+		t.Fatalf("watchRemote: %v", err)
+	}
+	defer p.stop()
+
+	rctx, rcancel := context.WithTimeout(ctx, 30*time.Second)
+	defer rcancel()
+	req, _ := http.NewRequestWithContext(rctx, http.MethodGet, p.urlFor(target, "live.mjpeg"), nil)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET relay: %v", err)
+	}
+	defer resp.Body.Close()
+
+	start := time.Now()
+	acc, buf, frames := make([]byte, 0, 1<<20), make([]byte, 32*1024), 0
+	for frames < 10 {
+		n, rerr := resp.Body.Read(buf)
+		acc = append(acc, buf[:n]...)
+		frames = bytes.Count(acc, []byte("--"+mjpegBoundary))
+		if rerr != nil {
+			break
+		}
+	}
+	el := time.Since(start)
+	t.Logf("watching %q: %d frames, %d bytes, %.1fs (%.1f fps, %.0f KB/s)",
+		target, frames, len(acc), el.Seconds(),
+		float64(frames)/el.Seconds(), float64(len(acc))/el.Seconds()/1024)
+
+	if frames < 3 {
+		t.Fatalf("got %d frames from a connected camera - the shop computer is "+
+			"not answering head office's request to push", frames)
+	}
+	// Bytes that are actually a picture, not a framing header that happens to
+	// be well formed. A JPEG begins FFD8.
+	if !bytes.Contains(acc, []byte{0xFF, 0xD8, 0xFF}) {
+		t.Error("no JPEG start marker anywhere in the stream")
+	}
+}

desktop/stream_remote_test.go

@@ -0,0 +1,209 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// jpg is a byte sequence that is not valid JPEG and does not need to be: what
+// is under test is that the bytes arrive intact and framed, not that a decoder
+// likes them.
+var jpg = []byte{0xFF, 0xD8, 'h', 'e', 'l', 'l', 'o', 0xFF, 0xD9}
+
+// sseServer answers head office's live endpoint with `pushes` frames and then
+// ends the response, which is what the server's five-minute cap does.
+func sseServer(t *testing.T, frames int, hits *int32) *httptest.Server {
+	t.Helper()
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(hits, 1)
+		w.Header().Set("Content-Type", "text/event-stream")
+		fl, _ := w.(http.Flusher)
+		// Registered, nothing being pushed yet. Nothing may be drawn for it.
+		fmt.Fprint(w, "event: waiting\ndata: \n\n")
+		if fl != nil {
+			fl.Flush()
+		}
+		for i := 0; i < frames; i++ {
+			fmt.Fprintf(w, "event: frame\ndata: %s\n\n",
+				base64.StdEncoding.EncodeToString(jpg))
+			if fl != nil {
+				fl.Flush()
+			}
+		}
+	}))
+}
+
+func openerFor(srv *httptest.Server) func(context.Context, string) (*http.Response, error) {
+	return func(ctx context.Context, cam string) (*http.Response, error) {
+		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/live/"+cam, nil)
+		return http.DefaultClient.Do(req)
+	}
+}
+
+// The whole point: base64 frames over SSE are not something an <img> can show,
+// and a multipart MJPEG stream is. Without this the app could only ever show a
+// still, on exactly the computers that cannot reach the camera any other way.
+func TestRemoteFramesReachTheWebviewAsMJPEG(t *testing.T) {
+	var hits int32
+	srv := sseServer(t, 3, &hits)
+	defer srv.Close()
+
+	p := newStreamProxy()
+	if err := p.watchRemote(openerFor(srv)); err != nil {
+		t.Fatalf("watchRemote: %v", err)
+	}
+	defer p.stop()
+
+	u := p.urlFor("cam2", "live.mjpeg")
+	if u == "" {
+		t.Fatal("no relay url; the proxy did not bind")
+	}
+
+	// The relay reconnects for as long as the viewer is there, so the read is
+	// bounded by us rather than by the stream ending - exactly as an <img>
+	// would behave.
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET relay: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "multipart/x-mixed-replace") {
+		t.Fatalf("Content-Type = %q, an <img> will not treat that as a stream", ct)
+	}
+
+	// Read the first three frames' worth and stop; the relay would otherwise
+	// go on reconnecting forever, which is the behaviour being relied on.
+	want := append([]byte(fmt.Sprintf("--%s\r\nContent-Type: image/jpeg\r\nContent-Length: %d\r\n\r\n",
+		mjpegBoundary, len(jpg))), jpg...)
+	got := make([]byte, 0, 4096)
+	buf := make([]byte, 512)
+	for len(got) < 3*len(want) {
+		n, rerr := resp.Body.Read(buf)
+		got = append(got, buf[:n]...)
+		if rerr != nil {
+			break
+		}
+	}
+	if n := bytes.Count(got, []byte("--"+mjpegBoundary)); n < 3 {
+		t.Fatalf("got %d frames in %d bytes, want at least 3", n, len(got))
+	}
+	if !bytes.Contains(got, want) {
+		t.Errorf("a frame was not framed as expected:\n%q", got[:min(len(got), 300)])
+	}
+	// `waiting` is a real state - head office has us registered and the shop
+	// computer has not started pushing - and there is nothing to draw for it.
+	// Emitting an empty part would blank a tile that already had a picture.
+	if bytes.Contains(got, []byte("Content-Length: 0")) {
+		t.Error("an empty frame was written for a waiting event")
+	}
+}
+
+// The server caps one push at five minutes so a tab left open for a week
+// cannot leave a shop uploading for a week. Reconnecting is therefore a normal
+// event, and doing it here rather than in the page is what lets the <img>
+// survive the cap - it never sees the stream end.
+func TestTheRelayReconnectsWhenHeadOfficeEndsAPush(t *testing.T) {
+	var hits int32
+	srv := sseServer(t, 1, &hits)
+	defer srv.Close()
+
+	p := newStreamProxy()
+	if err := p.watchRemote(openerFor(srv)); err != nil {
+		t.Fatalf("watchRemote: %v", err)
+	}
+	defer p.stop()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, p.urlFor("cam2", "live.mjpeg"), nil)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET relay: %v", err)
+	}
+	defer resp.Body.Close()
+
+	// Two frames means two pushes, because each push carries exactly one.
+	seen, buf := 0, make([]byte, 256)
+	acc := make([]byte, 0, 2048)
+	for seen < 2 {
+		n, rerr := resp.Body.Read(buf)
+		acc = append(acc, buf[:n]...)
+		seen = bytes.Count(acc, []byte("--"+mjpegBoundary))
+		if rerr != nil {
+			break
+		}
+	}
+	if seen < 2 {
+		t.Fatalf("got %d frames across reconnects, want 2", seen)
+	}
+	if got := atomic.LoadInt32(&hits); got < 2 {
+		t.Errorf("head office was asked %d times, want at least 2", got)
+	}
+}
+
+// Signed out, the relay must not pretend. There is no fallback URL to offer
+// either: the head-office endpoint needs this session's bearer, which an <img>
+// cannot send - so a tile that silently failed would be the only alternative.
+func TestTheRelayRefusesWhenNobodyIsSignedIn(t *testing.T) {
+	p := newStreamProxy()
+	if err := p.watchRemote(nil); err != nil {
+		t.Fatalf("watchRemote: %v", err)
+	}
+	defer p.stop()
+
+	resp, err := http.Get(p.urlFor("cam2", "live.mjpeg"))
+	if err != nil {
+		t.Fatalf("GET relay: %v", err)
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	if resp.StatusCode != http.StatusBadGateway {
+		t.Errorf("status = %d, want 502", resp.StatusCode)
+	}
+}
+
+// The relay is credentialed - it is a path to a live view of a shop floor -
+// and the token is the only thing standing between another local process and
+// it. live.mjpeg must be behind exactly the same door as the engine routes.
+func TestTheRemoteRouteIsBehindTheSameToken(t *testing.T) {
+	var hits int32
+	srv := sseServer(t, 1, &hits)
+	defer srv.Close()
+
+	p := newStreamProxy()
+	if err := p.watchRemote(openerFor(srv)); err != nil {
+		t.Fatalf("watchRemote: %v", err)
+	}
+	defer p.stop()
+
+	// The right shape, the wrong value.
+	parts := strings.Split(p.urlFor("cam2", "live.mjpeg"), "/")
+	parts[4] = strings.Repeat("0", len(parts[4]))
+	bad := strings.Join(parts, "/")
+
+	resp, err := http.Get(bad)
+	if err != nil {
+		t.Fatalf("GET relay: %v", err)
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("status = %d, want 404 - and 404 rather than 403, because there is nothing here to tell an unwelcome caller they found the right door", resp.StatusCode)
+	}
+	if atomic.LoadInt32(&hits) != 0 {
+		t.Error("a request with the wrong token still made the shop computer upload")
+	}
+}

desktop/tray.go

@@ -55,9 +55,7 @@ func (t *tray) start(ctx context.Context) {
 	if trayDisabled() {
 		return
 	}
-	t.once.Do(func() {
-		go systray.Run(func() { t.onReady(ctx) }, func() {})
-	})
+	t.once.Do(func() { startSystray(func() { t.onReady(ctx) }) })
 }
 
 func (t *tray) stop() {
@@ -99,11 +97,15 @@ func (t *tray) onReady(ctx context.Context) {
 		case <-t.quit:
 			return
 		case <-t.mOpen.ClickedCh:
-			runtime.Show(ctx)
+			// In a goroutine, like Start and Stop: this sleeps, and a menu
+			// loop that sleeps is a tray that ignores the next click.
+			go openWindow(ctx)
 		case <-t.mStart.ClickedCh:
-			t.app.StartEngine()
+			// Never on the menu loop itself: a stop waits for the process to
+			// exit, and a menu that is deaf for the duration looks broken.
+			go func() { t.app.StartEngine(); t.refresh() }()
 		case <-t.mStop.ClickedCh:
-			t.app.StopEngine()
+			go func() { t.app.StopEngine(); t.refresh() }()
 		case <-t.mLogs.ClickedCh:
 			runtime.BrowserOpenURL(ctx, "file://"+logsDir())
 		case <-t.mQuit.ClickedCh:
@@ -129,23 +131,29 @@ func (t *tray) poll(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		case <-tick.C:
-			s := t.app.EngineStatus()
-			state, label := describe(s)
-			systray.SetIcon(iconFor(state))
-			systray.SetTooltip("Behavision — " + label)
-			if t.mStatus != nil {
-				t.mStatus.SetTitle(label)
-			}
-			running := s.State == "running"
-			if t.mStart != nil && t.mStop != nil {
-				if running {
-					t.mStart.Disable()
-					t.mStop.Enable()
-				} else {
-					t.mStart.Enable()
-					t.mStop.Disable()
-				}
-			}
+			t.refresh()
+		}
+	}
+}
+
+// refresh redraws the icon and the menu from EngineStatus - the same source
+// the window reads, so the two cannot disagree.
+func (t *tray) refresh() {
+	s := t.app.EngineStatus()
+	state, label := describe(s)
+	systray.SetIcon(iconFor(state))
+	systray.SetTooltip("Behavision — " + label)
+	if t.mStatus != nil {
+		t.mStatus.SetTitle(label)
+	}
+	running := s.State == "running" || s.State == "starting" || s.State == "backoff"
+	if t.mStart != nil && t.mStop != nil {
+		if running {
+			t.mStart.Disable()
+			t.mStop.Enable()
+		} else {
+			t.mStart.Enable()
+			t.mStop.Disable()
 		}
 	}
 }
@@ -160,9 +168,13 @@ func describe(s EngineStatus) (state, label string) {
 	case s.State == "stopped":
 		return "stopped", "Stopped"
 	case s.State == "failed":
-		return "error", "Failed — " + firstLine(s.Error)
+		// The supervisor's error is already a sentence (port in use, missing
+		// library); show it whole, because it is the thing to act on.
+		return "error", "Not running — " + firstLine(s.Error)
 	case s.State == "backoff":
 		return "error", fmt.Sprintf("Restarting (%d attempts)", s.Restarts)
+	case !s.Reachable && s.Progress != nil:
+		return "warn", fmt.Sprintf("Downloading %s… %d%%", s.Progress.What, s.Progress.Percent)
 	case !s.Reachable:
 		return "warn", "Starting…"
 	case len(s.Cameras) == 0:
@@ -202,3 +214,36 @@ func firstLine(s string) string {
 	}
 	return s
 }
+
+// openWindow brings the dashboard back, and it takes four calls rather than
+// the one that was here.
+//
+// `runtime.Show` was wrong three times over, and the first is the one that
+// made it fail rather than merely misbehave:
+//
+//  1. WRONG THREAD. Wails implements Show() as a bare `mainWindow.Show()`,
+//     while WindowShow() wraps the same work in runtime.LockOSThread. Win32
+//     window operations have to run on the thread owning the window's message
+//     pump; this is called from the SYSTRAY's goroutine, which is never that
+//     thread. An unlocked call from an arbitrary goroutine is why clicking
+//     "Open dashboard" did nothing reliable.
+//
+//  2. Showing is not un-minimising. A hidden window and a minimised one are
+//     different states and Show only fixes the first, so a window the user
+//     minimised stayed minimised.
+//
+//  3. Windows will not let a process that is not already in the foreground
+//     take it - the shell refuses, and the window comes back BEHIND whatever
+//     is being looked at. Clicking a tray icon is by definition a moment when
+//     this application is not in the foreground, so that is not an edge case
+//     here, it is every time.
+//
+// The always-on-top flip is the ordinary way to ask for the foreground anyway.
+// It is brief and it is why this cannot run on the menu loop.
+func openWindow(ctx context.Context) {
+	runtime.WindowUnminimise(ctx)
+	runtime.WindowShow(ctx)
+	runtime.WindowSetAlwaysOnTop(ctx, true)
+	time.Sleep(200 * time.Millisecond)
+	runtime.WindowSetAlwaysOnTop(ctx, false)
+}

desktop/tray_run_darwin.go

@@ -0,0 +1,28 @@
+//go:build darwin
+
+package main
+
+// There is no tray on macOS, and that is a decision rather than an omission.
+//
+// macOS has exactly ONE main run loop and AppKit insists that windows and
+// status items are created on it. Wails already owns that loop. Two attempts,
+// both crashing within a second of launch:
+//
+//	systray.Run              -> SIGTRAP inside cgo: nativeLoop() takes the
+//	                            main loop for itself, and Wails has it
+//	systray.RunWithExternalLoop -> "NSWindow should only be instantiated on
+//	                            the main thread!" - it registers in the
+//	                            existing NSApplication but still builds
+//	                            AppKit objects, and Wails' OnStartup is not
+//	                            the main thread
+//
+// Making it work needs the status item created through a main-queue dispatch
+// inside Wails' own lifecycle, which is real work for a build whose entire
+// purpose is demoing on a developer's Mac. Windows is the platform this ships
+// to and its tray is the shop manager's only control surface; here the window
+// is right there in the Dock.
+//
+// The consequence is handled rather than left: with no tray there would be no
+// way back from a hidden window and no way to quit, so on macOS closing the
+// window stops the engine and exits. See main.go.
+func startSystray(onReady func()) {}

desktop/tray_run_windows.go

@@ -0,0 +1,10 @@
+//go:build windows
+
+package main
+
+import "fyne.io/systray"
+
+// systray.Run owns a message loop, and on Windows it is free to have its own:
+// the tray lives in its own thread with its own pump, beside the one Wails
+// runs for the window. A goroutine is all it needs.
+func startSystray(onReady func()) { go systray.Run(onReady, func() {}) }

desktop/viewing_test.go

@@ -0,0 +1,166 @@
+package main
+
+import (
+	"context"
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/loyaly/behavision-desktop/internal/cloud"
+	"github.com/loyaly/behavision-desktop/internal/local"
+)
+
+// Viewer mode: what the app shows on a computer that is signed in and is not
+// itself watching any cameras.
+//
+// This is the friend's-Mac case, and before it existed the app was honest and
+// useless: Live() and Cameras() read ONLY the engine on 127.0.0.1, so a laptop
+// with no engine got "engine not reachable at http://127.0.0.1:8010" and
+// "0 of 0 cameras" - on an account whose shops were running and recognising
+// people the whole time. Signing in is what the person did; the app answered
+// as if they had not.
+//
+// The engine here is a port nothing listens on, which is precisely what a PC
+// with no engine is.
+const noEngine = "http://127.0.0.1:1" // reserved, refuses immediately
+
+func viewerApp(t *testing.T, srv *httptest.Server) *App {
+	t.Helper()
+	c := cloud.New(srv.URL)
+	c.SetSession(cloud.Session{Token: "test-token"})
+	return &App{
+		ctx:   context.Background(),
+		cloud: c,
+		local: local.New(noEngine, "", ""),
+	}
+}
+
+func TestLiveFallsBackToHeadOfficeWhenThereIsNoEngine(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch {
+		case r.URL.Path == "/api/sites":
+			// Two shops. One is fine, one is the Office1 case.
+			w.Write([]byte(`[
+			  {"slug":"a","name":"A","cameras_up":2,"cameras_total":2,"fraction_below_gate":0.10},
+			  {"slug":"b","name":"B","cameras_up":1,"cameras_total":3,"fraction_below_gate":0.73}
+			]`))
+		case strings.HasPrefix(r.URL.Path, "/api/visits"):
+			w.Write([]byte(`{"arrivals":[
+			  {"visit_id":"v1","visitor_id":"p1","ref":"V-1","label":"Visitor 1","camera_id":"cam2","is_new_visitor":true},
+			  {"visit_id":"v2","visitor_id":"p1","ref":"V-1","label":"Visitor 1","camera_id":"cam2"},
+			  {"visit_id":"v3","camera_id":"entrance"}
+			]}`))
+		default:
+			t.Errorf("unexpected request %s", r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	snap, err := viewerApp(t, srv).Live()
+	if err != nil {
+		t.Fatalf("Live: %v", err)
+	}
+	if !snap.Viewing {
+		t.Fatal("the snapshot did not say it was a view of somewhere else")
+	}
+	if got := snap.Stats["cameras_up"]; got != 3 {
+		t.Errorf("cameras_up = %v, want 3 summed across both shops", got)
+	}
+	if got := snap.Stats["cameras_total"]; got != 5 {
+		t.Errorf("cameras_total = %v, want 5", got)
+	}
+	// The WORST site, never an average. Averaging 0.10 against 0.73 reports
+	// 0.42 and hides the only shop anyone needs to go and fix - the same rule
+	// the heartbeat already follows with worst_site.
+	if got := snap.Stats["fraction_below_gate"]; got != 0.73 {
+		t.Errorf("fraction_below_gate = %v, want the worst shop's 0.73", got)
+	}
+	// Three arrivals, two of them the same person, one unidentified. A visit
+	// with no visitor_id is real footfall and an unknown person, so it counts
+	// as a sighting and not as somebody known.
+	g := snap.Stats["gallery"].(map[string]any)
+	if g["identities"] != 1 || g["sightings"] != 3 {
+		t.Errorf("gallery = %v, want 1 identity over 3 sightings", g)
+	}
+	if len(snap.Events) != 3 {
+		t.Fatalf("got %d events, want 3", len(snap.Events))
+	}
+	if snap.Events[0]["type"] != "person.new" || snap.Events[1]["type"] != "person.seen" {
+		t.Errorf("arrival types wrong: %v", snap.Events)
+	}
+}
+
+// Nobody signed in: the local failure is the honest answer. There is nothing
+// else to show, and the person is most likely setting this PC up - telling
+// them about head office would be telling them about something they have not
+// got to yet.
+func TestLiveWithNoEngineAndNoSessionReportsTheEngine(t *testing.T) {
+	a := &App{ctx: context.Background(), cloud: cloud.New("https://example.invalid"),
+		local: local.New(noEngine, "", "")}
+	if _, err := a.Live(); err == nil {
+		t.Fatal("want the engine error, got nil")
+	}
+}
+
+// A remote camera is flagged, because the screen has to withhold every button
+// that would talk to a camera on a network this computer cannot reach. An Edit
+// button that cannot work is worse than one that is absent.
+func TestRemoteCamerasAreFlaggedAndCarryNoCredentials(t *testing.T) {
+	jpeg := base64.StdEncoding.EncodeToString([]byte{0xFF, 0xD8, 0xFF, 0xD9})
+	var shots int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/api/camera-snapshots/") {
+			shots++
+			w.Header().Set("Content-Type", "image/jpeg")
+			b, _ := base64.StdEncoding.DecodeString(jpeg)
+			w.Write(b)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`[
+		  {"id":"c1","camera_id":"cam2","label":"Open office","site":"Coimbatore",
+		   "connected":true,"snapshot_at":"2026-09-30T10:00:00Z",
+		   "snapshot":{"available":true,"url":"/api/camera-snapshots/c1.jpg","auth":true}}
+		]`))
+	}))
+	defer srv.Close()
+
+	a := viewerApp(t, srv)
+	cams, err := a.Cameras()
+	if err != nil {
+		t.Fatalf("Cameras: %v", err)
+	}
+	if len(cams) != 1 {
+		t.Fatalf("got %d cameras, want 1", len(cams))
+	}
+	if cams[0]["remote"] != true {
+		t.Error("the camera was not flagged remote")
+	}
+	// The RTSP details are a live path into the camera itself and the server
+	// does not send them to a tenant at all. Nothing here may invent them.
+	for _, k := range []string{"host", "port", "path", "username", "password"} {
+		if _, ok := cams[0][k]; ok {
+			t.Errorf("a remote camera carried %q", k)
+		}
+	}
+
+	// The picture has to be fetched here: a webview <img> resolves a relative
+	// src against wails:// and cannot send the session's bearer.
+	shot := cams[0]["snapshot"].(cloud.Photo)
+	if !strings.HasPrefix(shot.URL, "data:image/jpeg;base64,") || shot.Auth {
+		t.Errorf("snapshot url = %q auth=%v, want an inline data URI", shot.URL, shot.Auth)
+	}
+
+	// And fetched ONCE. This screen polls every 8 seconds and a real snapshot
+	// is ~90 KB, so re-fetching an unchanged picture is megabytes an hour to
+	// redraw the same frame.
+	if _, err := a.Cameras(); err != nil {
+		t.Fatalf("second poll: %v", err)
+	}
+	if shots != 1 {
+		t.Errorf("fetched the same snapshot %d times across two polls", shots)
+	}
+}

docs/TECHNICAL-DOSSIER.md

@@ -0,0 +1,521 @@
+# Behavision — Technical Dossier
+
+Everything below is extracted from the repository as of release 0.4.1 (engine 1.1.0, schema at migration 013). File paths, function names, thresholds, topics, ports and table definitions are the real ones. Where something lives outside the repository (the production host's proxy and container configuration) it is stated as such rather than invented.
+
+> **Snapshot, not a live document.** Written against release 0.4.1 / schema
+> 013, and the repository is past that. It predates at least: the engine's
+> motion gate and one-thread detector (CPU 214% → 16%), `Gallery.health` and
+> the stalled-camera state, the `tenantOnly` guard, `POST /api/auth/password`,
+> `POST /api/customers` and the visitor merge, the admin console drill-down,
+> `GET /api/sales` and `/api/dashboard/summary`, migration 014, and the macOS
+> desktop build. Everything it *does* describe was extracted from the code and
+> was true then; nothing here was invented. For the current surface read
+> `API.md`, which is kept up to date, and `CLAUDE.md` for the decisions.
+
+Companion documents: `API.md` (every route with request/response shapes), `docs/openapi.yaml` (generated), `docs/Behavision-Architecture.html` (diagrams).
+
+---
+
+## 1. System architecture
+
+### 1.1 Repository layout
+
+```
+behavision/                      Recognition engine (Python 3.10+)
+  __main__.py                    CLI: run | enroll | setup-models | calibrate | paths
+  api.py                         FastAPI on 127.0.0.1:8010 — dashboard, cameras, stream, stats
+  capture.py                     VideoSource: RTSP capture thread, latest-frame slot, probe_source
+  detection.py                   FaceDetector (YuNet), Detection
+  geometry.py                    umeyama, align_face, iou, clip_box
+  recognition.py                 ArcFaceEncoder (ONNX Runtime), face_quality
+  tracking.py                    Track, IouTracker
+  engine.py                      Engine, CameraWorker, PipelineStats — the per-camera pipeline
+  attributes.py                  AttributeEstimator (gender/age/emotion), aggregate
+  commission.py                  CommissionRun — placement check verdicts
+  gallery/store.py               IdentityStore — SQLite (identities, embeddings, sightings)
+  gallery/index.py               VectorIndex — FAISS IndexIDMap2(IndexFlatIP) / numpy fallback
+  gallery/service.py             Gallery — resolve, enroll, reinforce, merge, duplicates
+  events.py                      EventBus + LogSink / WebhookSink / EmailSink
+  cameras.py                     CameraStore (cameras.json), protect/unprotect (DPAPI)
+  config.py                      pydantic Config, ${ENV} expansion, RTSP URL building
+  paths.py                       install_root / state_root / config_path resolution
+  static/dashboard.html          Engine's own dashboard (no build step)
+config/default.yaml              Engine config (thresholds, cameras via ${ENV})
+tests/                           Engine tests (204), dependency-light: no camera, no models
+
+agent/                           Shop-PC agent (Go 1.22, module github.com/loyaly/behavision-agent)
+  main.go                        Headless agent binary
+  cmd/behavision-setup/          Installer: venv, wheel, models, config, smoke test, demo bundle
+  cmd/behavision-demo-pack/      Seals a camera list (AES-256-GCM) — build machine only
+  pkg/spool/                     Durable queue: one file per event, bounded, ack by delete
+  pkg/mqtt/                      paho adapter (client.go) + Pump + Waker (pump.go)
+  pkg/bridge/                    Loopback webhook the engine posts to; derives event_id; queues
+  pkg/engine/                    Supervisor (start/stop/restart/backoff), Health, ChildEnv
+  pkg/cameras/                   Syncer: pull desired cameras, adopt local, run checks
+  pkg/enrol/                     Redeem an installation code
+  pkg/config/                    agent.json with DPAPI-protected secrets
+  pkg/paths/                     StateRoot / InstallRoot — mirrors behavision/paths.py
+  pkg/demo/                      Sealed bundle: NewCode, Seal, Open
+
+desktop/                         Shop-PC app (Wails v2.9.2, Go + React)
+  main.go                        wails.Run, HideWindowOnClose, tray start/stop
+  app.go                         Methods bound to the frontend; owns Supervisor, Bridge, Pump, Syncer
+  tray.go / icons.go             fyne.io/systray; ICO rendered at runtime on Windows
+  stream_proxy.go                Loopback relay for camera MJPEG (credential never in the page)
+  internal/local/                Client for the engine on 127.0.0.1:8010
+  internal/cloud/                Client for the platform API (sessions, refresh, images)
+  frontend/                      React + Vite; src/bridge.js calls window.go.main.App.*
+
+server/                          Platform (Go, module github.com/loyaly/behavision-server)
+  cmd/behavision-server/main.go  One binary: migrate → store → hub → ingest → API → web
+  Dockerfile                     Two-stage; static binary on alpine; EXPOSE 8080
+  migrations/001..013_*.sql      go:embed'ed; applied at boot under an advisory lock
+  internal/api/                  HTTP handlers, middleware, Hub (SSE doorbell), LiveHub (relay)
+  internal/store/                PostgreSQL access (pgx) — every query tenant-scoped
+  internal/ingest/               MQTT consumer: topic → site → visit/heartbeat → store
+  internal/auth/                 Passwords (bcrypt 12), tokens, codes, Principal + role checks
+  internal/secret/               secret.Box — AES-256-GCM with AAD
+  internal/blob/                 S3-compatible object storage (presign, private ACL check)
+  internal/assistant/            Claude tool loop; tools.go has no LLM import
+  internal/contract/             The MQTT wire contract: Visit, Heartbeat, ParseTopic
+  internal/migrate/              Migration runner (checksums, numeric order, baseline)
+  internal/provision/            CLI: provision key|client|site|user|token
+  internal/web/                  go:embed of the built React console (web/dist → here)
+
+web/                             Head-office console (React + Vite); outDir → server/internal/web/dist
+shared/cameraMakes.js            Camera make → RTSP path table, imported by web AND desktop
+installer/                       build.ps1 (PyInstaller path), behavision.iss, INSTALL.txt, LAN launcher
+run-local.sh                     Whole platform locally: Postgres + Mosquitto in Docker, server as binary
+```
+
+### 1.2 Processes and where they run
+
+| Process | Language | Runs on | Listens | Talks to |
+|---|---|---|---|---|
+| Recognition engine | Python | shop PC | `127.0.0.1:8010` (Basic auth, generated) | cameras (RTSP), agent webhook (loopback) |
+| Agent (inside the desktop app, or headless) | Go | shop PC | loopback webhook, port 0 | engine API, Mosquitto (TLS 8883), platform API (HTTPS) |
+| Shop app | Go + webview | shop PC | loopback relay, port 0 | engine API, platform API |
+| Mosquitto | C | cloud | `8883` TLS (agents), `1883` internal (server) | — |
+| behavision-server | Go | cloud | `8080` (behind proxy) | PostgreSQL, Mosquitto (subscriber), object storage (optional), Anthropic API (optional) |
+| PostgreSQL + pgvector | C | cloud | `5432` internal | — |
+| Head-office console | React | browser | — | platform API |
+| Mobile app | — | phone | — | platform API |
+
+### 1.3 Network, domains, TLS
+
+| Endpoint | Purpose | TLS |
+|---|---|---|
+| `https://platform.loyaly.ai` | Head-office console + API (`/api/*`) | Terminated at the reverse proxy (Traefik); the server listens plain HTTP on `LISTEN_ADDR` (default `:8080`) |
+| `https://mcp.loyaly.ai/api/*` | Same API, the hostname the shop app defaults to (`BEHAVISION_CLOUD`) | Proxy |
+| `tls://mcp.loyaly.ai:8883` | MQTT for agents (`AGENT_MQTT_URL` default) | Mosquitto's own listener; certificate must carry `DNS:mcp.loyaly.ai`; agents pin the issuing CA (`AGENT_CA_FILE` delivered at enrolment) |
+| `tcp://behavision-mqtt:1883` | Server ↔ Mosquitto, internal network only (`MQTT_URL` default) | Plaintext on a private network |
+
+Trust rules enforced in code:
+- `X-Forwarded-For` is trusted for the login throttle **only because** nothing reaches the server port except through the proxy (`api/throttle.go`).
+- The agent refuses `tcp://` to any non-loopback host unless `BEHAVISION_ALLOW_PLAINTEXT_MQTT=1` (`agent/pkg/mqtt/client.go`).
+- No inbound route to a shop PC is ever required: agent → broker, agent → API, app → API are all outbound.
+
+### 1.4 Server configuration (environment)
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `DATABASE_URL` | required | PostgreSQL DSN |
+| `LISTEN_ADDR` | `:8080` | HTTP listener (behind proxy) |
+| `MQTT_URL` / `MQTT_USERNAME` / `MQTT_PASSWORD` | `tcp://behavision-mqtt:1883` | Server's subscriber credential |
+| `AGENT_MQTT_URL` | `tls://mcp.loyaly.ai:8883` | Broker URL handed to a PC at enrolment |
+| `AGENT_CA_FILE` | — | CA PEM handed to a PC at enrolment (pinned) |
+| `AGENT_MODELS_FILE` | — | Model manifest handed at enrolment |
+| `BEHAVISION_SECRET_KEY` | — | 32-byte key for `secret.Box`; enrolment and camera passwords need it |
+| `DO_SPACES_*` (`ENDPOINT`, `REGION`, `BUCKET`, `ACCESS_KEY`, `SECRET_KEY`, `PREFIX`) | prefix `behavision/v2` | Optional object storage; absent = images stored in Postgres |
+| `ANTHROPIC_API_KEY` / `ANTHROPIC_WORKSPACE_ID` / `BEHAVISION_ASSISTANT_MODEL` | model `claude-sonnet-5` | Assistant; absent = `501 assistant_off` |
+| `BEHAVISION_SKIP_MIGRATE` | — | Escape hatch; default applies migrations at boot |
+
+### 1.5 Container / deployment shape
+
+The repository ships `server/Dockerfile` (golang:1.25-alpine build → alpine:3.20 runtime, static binary, `EXPOSE 8080`, non-root user) and `run-local.sh`, which stands the whole platform up locally: `bv-pg` (pgvector/pgvector:pg16, port 55432), `bv-mqtt` (eclipse-mosquitto:2, port 51883, `passwd` + `acl` mounted), and the server as a local binary on 8088 with the console embedded.
+
+Production host configuration (proxy routes, compose/unit files, certificate issuance) is **outside the repository**. What the code requires of it: a proxy terminating TLS for `platform.loyaly.ai` and forwarding to `LISTEN_ADDR`; Mosquitto with a TLS listener on 8883 whose certificate names `mcp.loyaly.ai`, a `passwd` file the `provision site` command adds to, and an ACL of the form `pattern write bv/%u/#`; PostgreSQL with the `vector` extension.
+
+---
+
+## 2. Recognition engine internals
+
+### 2.1 Pipeline, function by function
+
+```
+RTSP ──▶ capture.VideoSource.run()            thread per camera; cv2.VideoCapture(CAP_FFMPEG)
+          │  OPENCV_FFMPEG_CAPTURE_OPTIONS = rtsp_transport;tcp | stimeout;5000000 |
+          │                                  fflags;nobuffer | flags;low_delay | max_delay;200000
+          │  downscale to max_width (1280) with INTER_AREA
+          │  latest frame + timestamp in a lock-protected slot
+          ▼
+engine.CameraWorker.run()                      thread per camera; takes source.latest_since(ts)
+  │
+  ├─ detection.FaceDetector.detect(frame)      cv2.FaceDetectorYN (YuNet 2023mar)
+  │      score_threshold 0.82 · nms 0.3 · min_face_px 48 · max_faces 20
+  │      → Detection(box, kps[5], score)
+  │
+  ├─ recognition.face_quality(frame, box, kps) weighted: sharpness .35 · size .25 · brightness .15 · frontality .25
+  │
+  ├─ tracking.IouTracker.update(dets, ts)      greedy IoU association, iou_threshold 0.3, max_misses 25
+  │      → active Track[], ended Track[]         one Track == one person on camera
+  │
+  ├─ for each active track, _should_identify(): hits ≥ 4 · quality ≥ min_quality_to_encode (0.35)
+  │      ≤ max_id_attempts (8) · spaced id_retry_interval_seconds (0.5)
+  │
+  ├─ _identify(track, frame):
+  │      geometry.align_face(frame, kps)        Umeyama similarity transform → 112×112 BGR chip
+  │      recognition.ArcFaceEncoder.encode()    BGR→RGB, (x−127.5)/127.5, NCHW float32, L2-normalised 512-d
+  │      track.emb_sum += e; when emb_count ≥ min_embeddings_for_id (3): mean → normalise
+  │      gallery.Gallery.resolve(mean, quality, rcfg) → Resolution(kind, identity, similarity)
+  │
+  ├─ Resolution.kind:
+  │      known      sim ≥ match_threshold (0.42)     → person.seen  (+ reinforce if 0.32 ≤ sim < 0.55, q ≥ gate, < 5 stored)
+  │      ambiguous  0.32 ≤ sim < 0.42                 → wait; retry on a later frame
+  │      new        sim < enroll_threshold (0.32)     → Gallery.enroll → "Visitor N" · person.new
+  │      skipped    quality < min_enroll_quality (0.65) → counted as rejected_quality
+  │
+  ├─ attributes.AttributeEstimator.estimate()  genderage.onnx on a loose 1.5× crop; FER+ on the chip;
+  │      medianed over the track (attributes.aggregate)
+  │
+  ├─ _finish_track(ended)                      PipelineStats.record(outcome) — exactly once per track
+  │
+  └─ _remember_tracks(active)                  boxes + labels for the live picture (no encode)
+
+Live picture: CameraWorker.latest_jpeg_since(ts) — freshest CAPTURED frame + last boxes, encoded on demand.
+Events:       events.EventBus → LogSink · WebhookSink (→ agent bridge) · EmailSink
+```
+
+### 2.2 Models (`recognition.MODEL_CANDIDATES`, first loadable wins)
+
+| Order | File | Role |
+|---|---|---|
+| 1–2 | `adaface_ir101.onnx`, `adaface_ir50.onnx` | wired, optional |
+| **3** | **`w600k_r50.onnx`** (166 MB) | **in use** — IJB-C 97.25; same-person p05 0.719 on the office camera |
+| 4 | `arcface_int8.onnx` | optional |
+| 5 | `w600k_mbf.onnx` (13 MB) | always loads; MobileFaceNet fallback (95.02) |
+| 6 | `arcface.onnx` (r100, 249 MB) | optional |
+| — | `face_detection_yunet_2023mar.onnx` | detector |
+| — | `genderage.onnx` (InsightFace buffalo_l) | attributes |
+
+Every stored embedding is tagged with the model name; `IdentityStore.all_embeddings(model)` loads only same-model vectors into the index.
+
+### 2.3 Local gallery
+
+`gallery/store.py` — SQLite (WAL), single source of truth:
+```
+identities(id, label, kind auto|named, created_at, sighting_count)
+embeddings(id, identity_id, model, vector BLOB, quality, created_at)
+sightings(id, identity_id, camera_id, similarity, at)
+```
+`gallery/index.py` — `VectorIndex` over FAISS `IndexIDMap2(IndexFlatIP)` (exact inner product = cosine on L2-normalised vectors), rebuilt from SQLite at boot, −1 ids filtered, identical numpy fallback. Measured: 1k → 0.27 ms, 10k → 2.24 ms, 100k → 21.9 ms.
+
+`gallery/service.py` — `Gallery.resolve` (three zones), `enroll`, `reinforce_identity` (refuses a view whose nearest neighbour is another identity), `merge_identities` (one transaction; human name outranks "Visitor N"; `sighting_count` recomputed; trimmed to 5 by quality), `duplicate_candidates` (k-NN across identities, O(n·k)).
+
+### 2.4 What leaves the engine
+
+`WebhookSink` POSTs each `person.seen` / `person.new` to the agent's loopback bridge with `identity_id`, `label`, `similarity`, `quality`, attributes, and optionally `image_path` (only when `app.store_faces: true`). The bridge fetches the identity's **best** stored embedding once per identity via `GET /api/identities/{id}/embedding`. `person.missed`, `camera.up/down` are diagnostics and never become visits.
+
+---
+
+## 3. Backend internals
+
+### 3.1 Request path
+
+```
+proxy (TLS) ─▶ net/http mux (Go 1.22 patterns, method + path)
+                 │
+                 ├─ s.authed(h)        Bearer token → SHA-256 → sessions row → Principal{UserID, ClientID, Role}
+                 │                     token_expired vs unauthorized distinguished; last_used_at touched
+                 ├─ s.adminOnly(h)     Principal.Role == "admin" AND ClientID == ""  (both) → else 404
+                 ├─ s.agentAuthed(h)   Agent token (hashed) → AgentPrincipal{ClientID, Client slug, SiteID, AgentID}
+                 └─ no wrapper         login, refresh, invitation preview, register, enrol
+                 │
+                 ▼
+             handlers_*.go             decode (unknown fields rejected) → validate → Store call → writeJSON
+                 │                     every Store call receives p.ClientID from the session, never the body
+                 ▼
+             store/*.go (pgx)          SQL with client_id in every WHERE / INSERT
+```
+
+Login throttle (`api/throttle.go`): per-account 10 failures / 15 min and per-IP 60, in memory, pruned on read; success clears both. Unknown address is verified against `auth.DummyHash` so timing matches a wrong password.
+
+### 3.2 Handler areas → store methods
+
+| Area (file) | Routes | Store surface |
+|---|---|---|
+| `handlers_auth.go`, `handlers_sessions.go` | login, refresh, logout, me, sessions list/revoke | `UserByEmail`, `CreateSession`, `SessionByAccessHash`, `RotateSession`, `RevokeSession(s)` |
+| `handlers_team.go` | team, members, password reset, invitations, register | `Team`, `UpdateTeamMember`, `CreateMember`, `ResetMemberPassword`, `CreateInvitation`, `RedeemInvitation`, `OwnerCount` |
+| `handlers_admin.go` | admin/clients | `ListClients`, `CreateClientWithOwner` (one transaction) |
+| `handlers_arrivals.go`, `hub.go` | visits, visits/stream | `Arrivals` (keyset by `seq`), `Hub.Notify` doorbell → SSE |
+| `handlers_people.go` | visitors, history, profile, purchases, erasure | `SearchVisitors`, `VisitorHistory`, `SaveProfile`, `RecordPurchase`, `ForgetVisitor` |
+| `handlers_images.go`, `handlers_faces.go` | visitor image, face bytes | `VisitorImageKey`, `FaceImage`; `imageFor(key)` decides presigned vs `auth:true` |
+| `handlers_cameras.go`, `handlers_snapshots.go` | cameras CRUD, snapshot | `Cameras`, `CreateCamera`, `UpdateCamera`, `DeleteCamera` (tombstone), `Snapshot` |
+| `handlers_checks.go` | camera check, site check | `RequestCheck`, `ClaimChecks`, `ReleaseStaleChecks`, `RecordCheck`, `SiteCheck` |
+| `handlers_live.go`, `live.go` | cameras/{id}/live, agent live | `LiveHub` — one-slot buffer per viewer, on-demand upload |
+| `handlers_reports.go` | footfall, conversion | `Footfall`, `Conversion` — unique vs visits, first-ever "new", single currency |
+| `handlers_enrolment.go`, `handlers_agent.go` | enrol, agent cameras/checks/faces/upload-url | `RedeemEnrolment` (single-use via UPDATE), `AgentCameras`, `AgentReport`, `PutFace`, `UploadTarget` |
+| `handlers_assistant.go` | assistant | `assistant.Client.Ask` with the Principal passed at the call site |
+
+### 3.3 Server-side recognition (`store/store.go`, `RecordVisit`)
+
+```
+similarity = 1 - (embedding <=> $1::vector)          -- pgvector cosine distance
+ORDER BY embedding <=> $1::vector LIMIT 1             -- within client_id, same model
+sim ≥ 0.42  → known visitor; reinforce if 0.32 ≤ sim < 0.55 AND quality ≥ floor AND < 5 stored
+sim < 0.42  → new visitor: clients.visitor_seq += 1 RETURNING (row-locks the client), label "Visitor N"
+INSERT visits ... ON CONFLICT (client_id, source_event_id) DO NOTHING  -- idempotent
+```
+
+### 3.4 Single-process composition (`cmd/behavision-server/main.go`)
+
+```
+migrate.Apply(embedded FS)  →  store.Open  →  hub := api.NewHub()
+ingest.Consumer{Store, Notify: hub.Notify}  ←  paho client, SetOrderMatters(true), subscribed bv/+/+
+api.New(Store, Hub, LiveHub, Blob?, Assistant?)  →  web.Handler (embedded dist; /api/ keeps JSON 404)
+http.Server{ReadTimeout, IdleTimeout, WriteTimeout: 0}   -- zero: SSE streams must outlive any write deadline
+```
+
+---
+
+## 4. MQTT architecture
+
+### 4.1 Identity and topics
+
+Broker username = `<client-slug>.<site-slug>` (e.g. `tenext-retail.chennai`). ACL: `pattern write bv/%u/#` — a site physically cannot publish under another site's prefix.
+
+```
+bv/<client>.<site>/visit        Visit payload            QoS 1   spooled, acked per event
+bv/<client>.<site>/heartbeat    Heartbeat payload        QoS 1   never spooled — only meaningful now
+bv/<client>.<site>/status       reserved
+bv/<client>.<site>/cmd/...      reserved (server → site)
+```
+
+`contract.ParseTopic` → `Topic{Username, Client, Site, Kind, Rest}`; `Kind ∉ {visit, heartbeat, status, cmd}` is dropped as permanent.
+
+### 4.2 Payloads (`server/internal/contract/contract.go`)
+
+```json
+// visit
+{ "event_id": "tenext-retail.chennai|cam2|7|1757580000",   // <site>|<camera>|<identity>|<unix second> — derived, never random
+  "occurred_at": "2026-09-11T05:20:00Z", "camera_id": "cam2",
+  "is_new": false, "similarity": 0.61, "quality": 0.70,
+  "local_visitor_id": 7, "embedding": [512 floats], "model": "w600k_r50",
+  "image_key": "behavision/v2/tenext-retail/chennai/2026/09/11/…jpg",   // or "db:<uuid>", or absent
+  "attributes": { "gender": "Male", "age": 32, "emotion": "neutral" } }
+
+// heartbeat
+{ "sent_at": "…", "agent_version": "0.4.1", "engine_version": "1.1.0", "recognition_model": "w600k_r50",
+  "cameras": { "cam1": true, "cam2": true }, "queued": 0, "dropped": 0, "fraction_below_gate": 0.47 }
+```
+
+`Visit.Validate()` (permanent errors): `event_id` required ≤128; `occurred_at` required and not >24 h in the future; embedding must be exactly 512 and carry `model`.
+
+### 4.3 Delivery semantics
+
+| Stage | Component | Guarantee |
+|---|---|---|
+| Engine → agent | `WebhookSink` → `bridge.Bridge.Handle` | loopback HTTP; `event_id` derived from `<site>|<camera>|<identity>|<second>` (sighting cooldown is 30 s, so one person/camera cannot share a second) |
+| Append | `spool.Spool.Append` | one file per event, fsync, bounded (`SpoolMax`, default 50,000); on overflow drops oldest and counts `Dropped()`; corrupt entry quarantined, not retried |
+| Wake | `mqtt.Waker.Wake` **after** the append | a wake before durability is a drain that finds nothing |
+| Publish | `mqtt.Pump.Run` → `Client.Publish` | QoS 1, `CleanSession(true)`, publish bounded by a timeout as well as context (half-open TCP otherwise stalls forever); **a failed publish stops the batch** (ordering per visitor) |
+| Ack | `Spool.Ack(seq)` on PUBACK | per event, never per batch; file deleted only now |
+| Consume | `ingest.Consumer.Handle` | paho `SetOrderMatters(true)`; permanent error → `drop()` + log (message is acked, never redelivered); transient error → returned → redelivered |
+| Write | `store.RecordVisit` | `ON CONFLICT (client_id, source_event_id) DO NOTHING` — duplicates from at-least-once delivery are absorbed |
+| Notify | `hub.Notify(clientID)` | only on a genuine insert; SSE streams re-query from their own cursor |
+
+Backoff: reconnect 1 → 30 s exponential; supervisor backoff resets only after a run that stayed up 60 s. `describeStall` distinguishes *broker refused the credential* (TCP opens, connect never completes) from *broker unreachable*.
+
+### 4.4 Failure paths
+
+| Failure | Behaviour |
+|---|---|
+| Internet down | spool grows on disk; heartbeats stop; head office shows site offline after 3 missed beats; on reconnect the backlog drains in order |
+| Broker rejects credential | pump logs "reachable but not accepted — re-link this PC"; spool retained |
+| Server down, broker up | broker holds nothing (clean session); agent's PUBACKs still arrive from the broker, so events are acked at the broker — the server's own subscription reconnects and Mosquitto delivers what it queued for the persistent server session |
+| Duplicate delivery | absorbed by `source_event_id` uniqueness |
+| Malformed event | dropped with a log line naming the site and reason; never blocks the queue |
+| Site clock wrong | `occurred_at` > 24 h ahead rejected as permanent; feed ordering uses server `seq`, so a wrong clock cannot hide a visit |
+
+---
+
+## 5. Database schema (PostgreSQL + pgvector, migrations 001–013)
+
+### 5.1 Tables
+
+```
+clients                 id PK · slug UQ (immutable, = MQTT prefix) · name · active · visitor_seq bigint
+sites                   id PK · client_id FK · slug (immutable, per client) · name · timezone · address · active
+agents                  id PK · client_id FK · site_id FK · mqtt_username UQ · mqtt_password_enc bytea (sealed)
+                        api_token_hash bytea · agent_version · engine_version · recognition_model
+                        last_heartbeat_at · last_event_at · fraction_below_gate · cameras_total/up · spool_queued/dropped
+app_users               id PK · client_id FK (NULL = platform admin) · email (lower(email) UQ globally, 007)
+                        password_hash (bcrypt 12) · full_name · role owner|manager|staff|admin · active · last_login_at
+sessions                id PK · user_id FK · client_id FK · access_hash UQ · refresh_hash UQ (SHA-256)
+                        access_expires_at · refresh_expires_at · revoked_at · device · last_used_at
+invitations             id PK · client_id FK · email · full_name · role · code_hash UQ · invited_by FK
+                        expires_at · used_at · used_by FK · revoked_at
+site_enrolment_tokens   id PK · client_id FK · site_id FK · token_hash UQ · label · expires_at · used_at · created_by
+visitors                id PK · client_id FK · number bigint (per-client, immutable → "V-42") · label
+                        first_seen_at · last_seen_at · visit_count · deleted_at
+visitor_embeddings      id PK · visitor_id FK · client_id FK · model · embedding vector(512) · quality · source_site_id FK
+visitor_profiles        id PK · visitor_id FK · client_id FK · full_name · phone · email · gender · date_of_birth · notes
+consents                id PK · visitor_id FK · client_id FK · scope · method · granted_at · revoked_at · evidence jsonb
+visits                  id PK · client_id FK · site_id FK · visitor_id FK (nullable) · source_event_id (UQ per client)
+                        occurred_at · received_at · camera_id text · is_new_visitor · similarity · quality
+                        attributes jsonb · image_key · image_deleted_at · seq bigserial (feed cursor)
+purchases               id PK · client_id FK · site_id FK · visitor_id FK · visit_id FK · amount numeric(14,2)
+                        currency char(3) · items jsonb · source · external_ref · recorded_by · occurred_at
+site_cameras            id PK · client_id FK · site_id FK · camera_id text (immutable, UQ per site) · label
+                        host · port · path · username · password_enc bytea (sealed, aad = site_id) · max_width
+                        tuning jsonb · enabled · revision · connected (nullable) · last_seen_at · snapshot_key
+                        snapshot_at · deleted_at (tombstone) · check_kind · check_* (requested/started/finished/result/image_key)
+camera_snapshots        camera_id PK FK · client_id FK · site_id FK · image bytea · bytes · captured_at
+visit_faces             id PK · client_id FK · site_id FK · image bytea · bytes · captured_at   (one survives per visitor)
+audit_log               id bigserial PK · client_id FK (SET NULL) · actor_id · actor_kind · action · entity · entity_id · detail jsonb · at
+schema_migrations       version · checksum · applied_at · baselined
+```
+
+### 5.2 Relationships
+
+```
+clients ─┬─< sites ─┬─< agents
+         │          ├─< site_cameras ──< camera_snapshots (1:1, PK = camera_id)
+         │          ├─< site_enrolment_tokens
+         │          ├─< visits
+         │          ├─< purchases
+         │          └─< visit_faces
+         ├─< app_users ─┬─< sessions
+         │              └─< invitations (invited_by, used_by)
+         ├─< visitors ─┬─< visitor_embeddings
+         │             ├─< visitor_profiles
+         │             ├─< consents
+         │             ├─< visits
+         │             └─< purchases
+         └─< audit_log (SET NULL)
+
+visits ──< purchases (visit_id, SET NULL)
+```
+
+Every FK onto `clients` is `ON DELETE CASCADE` except `audit_log` (`SET NULL`). Every tenant-owned table carries `client_id` directly, so no query needs a join to enforce tenancy.
+
+### 5.3 Invariants enforced in the database
+
+- `007` — `lower(email)` globally unique; the migration refuses to apply while duplicates exist and names them.
+- `012` — `visitors.number` per-client sequence from `clients.visitor_seq` (`UPDATE … RETURNING`, row-locked); unique on `(client_id, number)`.
+- `013` — triggers refuse changes to `clients.slug`, `sites.slug`, `site_cameras.camera_id`, `visitors.number` (`BEFORE UPDATE OF … WHEN OLD IS DISTINCT FROM NEW`). Display names are deliberately not frozen.
+- `004` — `visits.seq bigserial`; the arrivals cursor is `v1:<seq>` base64, opaque to clients.
+- `sites_slug_format` — `^[a-z0-9][a-z0-9-]{1,30}[a-z0-9]$`.
+
+---
+
+## 6. API specification
+
+Full request/response shapes: `API.md`. Machine-readable: `docs/openapi.yaml`.
+
+### 6.1 Authentication and session lifecycle
+
+```
+POST /api/auth/login {email,password,device}
+  → {access_token (12 h), refresh_token (30 d), expires_at, user{id,email,full_name,role,client_id,client_name}}
+  tokens: 256-bit random; only SHA-256 stored; bcrypt cost 12 verify; DummyHash for unknown addresses
+POST /api/auth/refresh {refresh_token,device}
+  → same shape; BOTH rotate; old refresh invalid immediately; client must serialise and persist before use
+401 {error:"token_expired"}  → refresh once and retry
+401 {error:"bad_credentials"} / {error:"unauthorized"} → sign in
+GET/DELETE /api/auth/sessions[/{id}] · POST /api/auth/sessions/revoke-others
+```
+
+### 6.2 Route families and least role
+
+| Family | Routes | Least role |
+|---|---|---|
+| Auth | login, refresh, logout, me, sessions | none / authed |
+| Joining | `GET /api/auth/invitation?code=`, `POST /api/auth/register` | none |
+| Team | `GET /api/team` | authed (tenant users) |
+| | `POST /api/team/members`, `POST /api/team/{id}/password`, `PATCH /api/team/{id}`, `/api/team/invitations*` | manager |
+| Arrivals | `GET /api/visits`, `GET /api/visits/stream` (SSE) | authed |
+| Customers | `GET /api/visitors`, `/history`, `/image`, `GET /api/faces/{id}` | authed |
+| | `PUT /api/visitors/{id}/profile`, `POST /api/purchases` | staff |
+| | `DELETE /api/visitors/{id}` (erasure) | manager |
+| Shops & cameras | `GET /api/sites`, `/check`, `GET /api/cameras`, `/snapshot.jpg`, `/live` (SSE) | authed |
+| | `POST /api/sites/{site}/cameras`, `PATCH`/`DELETE /api/cameras/{id}`, `POST /api/cameras/{id}/check`, `POST /api/sites/{site}/enrolment-code` | manager |
+| Reports | `GET /api/reports/footfall`, `/conversion` | authed |
+| Assistant | `POST /api/assistant` | authed |
+| Admin | `GET`/`POST /api/admin/clients` | platform admin (role admin AND no client) |
+| Agent | `POST /api/agent/enrol` (none), then `/api/agent/{cameras, checks, faces, upload-url, live, cameras/{c}/snapshot, cameras/{c}/live}` | agent token |
+
+Identifiers: any `{id}` or `site` accepts a uuid **or** the human reference (`V-42`, `chennai`, `cam1`). Unknown reference in a path → 404; in a query filter → 400. Another tenant's data → 404, never 403.
+
+### 6.3 Assistant tools (`internal/assistant/tools.go`)
+
+`list_sites`, `site_health`, `footfall`, `conversion`, `find_customer`, `customer_history`, `check_camera` (manager+; refuses staff in the tool, not the prompt). No tool takes a tenant id; the Principal is bound at the call site. Business tools only — never `execute_sql`. Loop bounded at 8 iterations; text produced alongside a tool call is discarded; failing tools return results, not errors.
+
+---
+
+## 7. Deployment topology
+
+```
+                              INTERNET
+                                 │
+                 ┌───────────────┼───────────────────┐
+                 │ HTTPS 443     │                    │ TLS 8883
+        ┌────────▼─────────┐     │           ┌────────▼─────────┐
+        │ Traefik          │     │           │ Mosquitto        │
+        │ platform.loyaly  │     │           │ mcp.loyaly.ai    │
+        │ mcp.loyaly.ai    │     │           │ passwd + ACL     │
+        │ TLS termination  │     │           │ pattern write    │
+        └────────┬─────────┘     │           │   bv/%u/#        │
+                 │ :8080 plain   │           └────────┬─────────┘
+        ┌────────▼───────────────────────┐            │ :1883 internal
+        │ behavision-server (one binary) │◄───────────┘ subscribe bv/+/+
+        │  ├ migrate (boot)              │
+        │  ├ ingest consumer  → Hub      │
+        │  ├ API  (48 routes) → SSE      │
+        │  ├ LiveHub (camera relay)      │
+        │  ├ web  (embedded React)       │
+        │  └ assistant (optional)        │
+        └────────┬───────────────┬───────┘
+                 │               │ presigned PUT/GET (optional)
+        ┌────────▼─────────┐  ┌──▼──────────────────┐
+        │ PostgreSQL 16    │  │ Object storage      │
+        │ + pgvector       │  │ (S3-compatible)     │
+        │ 17 tables        │  │ private ACL         │
+        └──────────────────┘  └─────────────────────┘
+
+════════════════════════ trust boundary: no inbound route ════════════════════════
+
+   SHOP NETWORK (one per shop, behind NAT)
+   ┌──────────────────────────────────────────────────────────┐
+   │  Cameras ──RTSP/TCP──▶ Engine :8010 ──webhook──▶ Agent    │
+   │                          │ SQLite                │ spool  │
+   │                          │ FAISS                 │        │
+   │                       Shop app ◄─── relay ───────┘        │
+   │                                                            │
+   │  outbound only:  agent ──TLS 8883──▶ Mosquitto             │
+   │                  agent ──HTTPS────▶ /api/agent/*            │
+   │                  app   ──HTTPS────▶ /api/*                  │
+   └──────────────────────────────────────────────────────────┘
+```
+
+**Failure domains.** A shop PC failing affects one shop; its footfall queues locally and nothing else notices except the heartbeat. Mosquitto failing stops delivery for all shops but loses nothing (every event is on a shop's disk). The server failing stops the console and API; Mosquitto retains the server's subscription backlog. PostgreSQL is the single stateful component in the cloud tier.
+
+**Data residency.** Video never leaves the shop. Face templates leave the shop only as 512-float vectors inside visit events, over TLS, to the tenant's own prefix. Photographs leave only when `store_faces` is enabled, via presigned upload to a private object, or into Postgres when no bucket is configured. Every image read at head office is audited.
+
+**Encrypted paths.** Camera credentials: DPAPI on the shop PC, AES-256-GCM (aad = site) in Postgres, plaintext only inside the agent's process and on the LAN RTSP connection to the camera. Broker password: sealed in `agent.json`, sealed in `agents.mqtt_password_enc`, hashed in Mosquitto's `passwd`. Sessions: SHA-256 at rest. User passwords: bcrypt 12.
+
+---
+
+## 8. Measured
+
+| Metric | Value | Source |
+|---|---|---|
+| Identity stability | 103 tracks → 7 people, 44 re-recognitions, 5 min | engine `/api/stats`, office cam2 |
+| Same-person similarity | p05 0.719 (frontal webcam, 18,528 pairs) | `calibrate` |
+| Gallery search | 0.27 / 2.24 / 21.9 ms at 1k / 10k / 100k | `VectorIndex` benchmark |
+| Delivery under burst | 120 of 120 simultaneous visits | live broker + Postgres |
+| Camera → head office | ~3 s | end-to-end run |
+| Head-office live view | 13 fps, 259 KB/s, 0 duplicates | relay measurement |
+| Shop-PC live picture | 14.0 pictures/s vs 15 fps camera; engine CPU 90% → 62% | before/after, cam2 sub-stream |
+| Clean-machine install | 10/10 steps, both cameras connected | fresh container |
+| Server test suite | < 10 s (bcrypt cost lowered for tests only) | `go test ./...` |

installer/build.ps1

@@ -38,31 +38,60 @@ function Need($exe, $hint) {
   }
 }
 
+# Run a NATIVE command and stop if it fails.
+#
+# $ErrorActionPreference = "Stop" does not do this. It governs PowerShell
+# errors; a .exe returning non-zero is not one, so the script sails past it.
+# That is not theoretical here: `npm ci` failing on a fresh Windows box would
+# have let the build continue, and `go build` would then have embedded the
+# STALE frontend/dist that is committed to this repository - producing an
+# installer that works, opens, and shows last month's UI, with nothing
+# anywhere saying so. The silent-wrong outcome, from the most likely failure.
+#
+# Output is NOT swallowed. `| Out-Null` on a failing install is how
+# run-local.sh once exited with no output at all, which took three runs to
+# diagnose; the same mistake is not worth repeating in a script that will be
+# run on a machine nobody is sitting at.
+function Run($exe) {
+  $rest = $args
+  & $exe @rest
+  if ($LASTEXITCODE -ne 0) {
+    throw "$exe $($rest -join ' ') failed with exit code $LASTEXITCODE"
+  }
+}
+
 Need python "Install Python 3.11+ and tick 'Add to PATH'."
 Need go      "Install Go 1.21+ from https://go.dev/dl/."
 Need npm     "Install Node.js LTS from https://nodejs.org/."
 
 Step "Python environment"
 Push-Location $root
-if (-not (Test-Path ".venv")) { python -m venv .venv }
-& .\.venv\Scripts\python -m pip install --upgrade pip | Out-Null
-& .\.venv\Scripts\python -m pip install -r requirements.txt pyinstaller | Out-Null
+if (-not (Test-Path ".venv")) { Run python -m venv .venv }
+Run .\.venv\Scripts\python -m pip install --upgrade pip
+Run .\.venv\Scripts\python -m pip install -r requirements.txt pyinstaller
 
 Step "Engine tests"
 # The package is not worth building if the engine is broken, and finding that
 # out after the installer is signed is the expensive order to do it in.
-& .\.venv\Scripts\python -m pytest tests -q
-if ($LASTEXITCODE -ne 0) { throw "engine tests failed" }
+Run .\.venv\Scripts\python -m pytest tests -q
 
 Step "Engine (PyInstaller, one-folder)"
 if (Test-Path (Join-Path $root "build")) { Remove-Item -Recurse -Force (Join-Path $root "build") }
-& .\.venv\Scripts\pyinstaller behavision.spec --noconfirm --distpath (Join-Path $dist "engine-build")
-if ($LASTEXITCODE -ne 0) { throw "pyinstaller failed" }
+Run .\.venv\Scripts\pyinstaller behavision.spec --noconfirm --distpath (Join-Path $dist "engine-build")
 
 Step "Desktop app (Wails)"
 Push-Location (Join-Path $root "desktop\frontend")
-npm ci
-npm run build
+# A built dist is COMMITTED to this repository so `go build` type-checks
+# without npm (the //go:embed directive requires the directory to exist). That
+# convenience is a trap at package time: a silently failed npm build leaves
+# the old one in place and it embeds perfectly. So the marker is removed
+# first, and its reappearance is what proves this build produced the UI being
+# shipped rather than inheriting one.
+$marker = Join-Path $root "desktop\frontend\dist\index.html"
+if (Test-Path $marker) { Remove-Item -Force $marker }
+Run npm ci
+Run npm run build
+if (-not (Test-Path $marker)) { throw "npm run build reported success and produced no dist\index.html" }
 Pop-Location
 Push-Location (Join-Path $root "desktop")
 # Wails v2 talks to WebView2 through pure-Go bindings, so no cgo and no
@@ -71,14 +100,17 @@ Push-Location (Join-Path $root "desktop")
 # from brand/loyaly-icon-512.png), and `wails build` would add a second copy
 # of both and fail the link with duplicate resources.
 $env:CGO_ENABLED = "0"
-go build -tags desktop,production -ldflags "-H windowsgui -X main.version=$Version" -o (Join-Path $root "desktop\build\bin\Behavision.exe") .
-if ($LASTEXITCODE -ne 0) { throw "desktop build failed" }
+Run go build -tags desktop,production -ldflags "-H windowsgui -X main.version=$Version" -o (Join-Path $root "desktop\build\bin\Behavision.exe") .
 Pop-Location
 
 Step "Headless agent"
 Push-Location (Join-Path $root "agent")
 $env:CGO_ENABLED = "0"   # the cgo resolver forces external linking
-go build -o (Join-Path $root "dist\behavision-agent.exe") .
+# `go build -o` does not create the target directory, and on a fresh clone
+# dist\ is gitignored and absent. It exists here only because PyInstaller ran
+# first and made it - an ordering dependency nothing states, so state it.
+New-Item -ItemType Directory -Force -Path $dist | Out-Null
+Run go build -o (Join-Path $root "dist\behavision-agent.exe") .
 Pop-Location
 
 Step "WebView2 bootstrapper"
@@ -104,8 +136,11 @@ Copy-Item (Join-Path $root "LICENSE") $stage -ErrorAction SilentlyContinue
 
 $engineExe = Join-Path $stage "engine\behavision.exe"
 if (-not (Test-Path $engineExe)) { throw "engine exe missing at $engineExe" }
-& $engineExe paths
-if ($LASTEXITCODE -ne 0) { throw "the frozen engine cannot start - `paths` failed" }
+# The frozen engine has to START, not merely exist. A PyInstaller build that
+# is missing a native DLL links fine and dies on first launch - the classic
+# "works in the venv, dies in the bundle" - and finding that out on a shop
+# counter is the expensive order to do it in.
+Run $engineExe paths
 
 Pop-Location
 

release.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # Build the Windows shop-PC package and publish it as a Gitea release.
 #
-#   ./release.sh v0.4.2                 build dist/Behavision-v0.4.2-windows-x64.zip and publish
+#   ./release.sh v0.4.2                 build the Windows zip and publish
 #   PUBLISH=0 ./release.sh v0.4.2       build only
+#   MAC=1 ./release.sh v0.4.2           also build and attach the macOS zip
 #   DEMO_PACK=demo-cameras.enc ./release.sh v0.4.4-demo
 #                                       a demo build: the sealed bundle from
 #                                       behavision-demo-pack ships in engine-src,
@@ -22,6 +23,8 @@ TAG=${1:?usage: release.sh vX.Y.Z}
 REPO_API=https://gitapp.workolik.com/api/v1/repos/Loyaly/Behavision
 STAGE=dist/Behavision
 ZIP="dist/Behavision-$TAG-windows-x64.zip"
+MACZIP="dist/Behavision-$TAG-macos-arm64.zip"
+MACSTAGE=dist/Behavision-mac
 
 step() { printf '\n\033[1m%s\033[0m\n' "$*"; }
 case "$(git describe --tags --always --dirty)" in *-dirty) echo "refusing to release uncommitted changes" >&2; exit 1;; esac
@@ -62,9 +65,39 @@ step "4. Package"
 rm -f "$ZIP" && (cd dist && zip -qr "$(basename "$ZIP")" Behavision) && ls -la "$ZIP" | awk '{print "   " $5 " bytes  " $9}'
 unzip -l "$ZIP" | grep -E "Behavision\.exe|agent\.exe|setup\.exe|\.whl|INSTALL" | awk '{print "   " $4}'
 
+# --- macOS, same SOURCE-install shape as Windows -------------------------
+#
+# Worth stating because it is the reason this is cheap: the Windows package
+# already ships a pure-Python WHEEL and builds a venv on the target machine,
+# because PyInstaller cannot cross-compile. macOS needs nothing different -
+# the same wheel, the same setup tool, a natively built .app instead of an
+# .exe. No frozen engine, no 200 MB, no second packaging story.
+#
+# Two things it is NOT, and the release notes should say so:
+#   * not notarised. macOS blocks an unsigned download outright rather than
+#     warning like SmartScreen, so the first launch needs right-click > Open.
+#     Notarising needs an Apple Developer account.
+#   * arm64 only. Every Mac worth demoing on since 2020, and building a
+#     universal binary doubles the size for machines nobody here has.
+if [ "${MAC:-0}" = "1" ]; then
+  step "5. macOS package"
+  command -v wails >/dev/null || { echo "wails CLI not found; go install github.com/wailsapp/wails/v2/cmd/wails@latest" >&2; exit 1; }
+  rm -rf "$MACSTAGE" && mkdir -p "$MACSTAGE/engine-src"
+  (cd desktop && wails build -platform darwin/arm64 -tags "desktop,production" -skipbindings >/dev/null)
+  cp -R desktop/build/bin/Behavision.app "$MACSTAGE/"
+  (cd agent && CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath \
+    -ldflags "-s -w -X main.version=$TAG" -o "../$MACSTAGE/behavision-agent" . \
+    && CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -trimpath \
+    -ldflags "-s -w -X main.version=$TAG" -o "../$MACSTAGE/behavision-setup" ./cmd/behavision-setup)
+  # The identical engine payload the Windows package carries.
+  cp -R "$STAGE/engine-src/." "$MACSTAGE/engine-src/"
+  rm -f "$MACZIP" && (cd dist && zip -qry "$(basename "$MACZIP")" Behavision-mac)
+  ls -la "$MACZIP" | awk '{print "   " $5 " bytes  " $9}'
+fi
+
 [ "${PUBLISH:-1}" = "1" ] || { echo "built, not published"; exit 0; }
 
-step "5. Tag and publish"
+step "6. Tag and publish"
 git rev-parse -q --verify "refs/tags/$TAG" >/dev/null || git tag -a "$TAG" -m "$TAG"
 git push -q origin "$TAG"
 # The notes come from a file so they are reviewed, not typed into a shell.
@@ -77,4 +110,5 @@ BODY=$(python3 -c 'import json,sys;print(json.dumps({"tag_name":sys.argv[1],"nam
 REL=$(curl -sS -u "$USER:$PASS" -H 'content-type: application/json' -d "$BODY" "$REPO_API/releases")
 ID=$(printf '%s' "$REL" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])')
 curl -sS -u "$USER:$PASS" -F "attachment=@$ZIP" "$REPO_API/releases/$ID/assets?name=$(basename "$ZIP")" >/dev/null
+[ "${MAC:-0}" = "1" ] && curl -sS -u "$USER:$PASS" -F "attachment=@$MACZIP" "$REPO_API/releases/$ID/assets?name=$(basename "$MACZIP")" >/dev/null
 echo "   published: https://gitapp.workolik.com/Loyaly/Behavision/releases/tag/$TAG"

server/deploy.sh

@@ -28,6 +28,17 @@ REMOTE_DIR=/root/behavision
 PUBLIC=https://mcp.loyaly.ai
 SSH=(ssh -i "$KEY" -o BatchMode=yes -o ConnectTimeout=10 "$HOST")
 
+# Go is not always on an interactive shell's PATH - a Homebrew or tarball
+# install lands in a directory that .zprofile adds but a script does not
+# inherit, so this failed at step 1 with "go: command not found" on the very
+# machine it was written on. Found the only way it could be: by somebody
+# running it. A deploy that needs the operator to fix their environment first
+# is a deploy that gets skipped.
+for d in "$HOME/go/bin" /usr/local/go/bin /opt/homebrew/bin; do
+  [ -x "$d/go" ] && case ":$PATH:" in *":$d:"*) ;; *) PATH="$PATH:$d";; esac
+done
+command -v go >/dev/null || { echo "go not found - install it or add it to PATH" >&2; exit 1; }
+
 VERSION=$(git describe --tags --always --dirty)
 case "$VERSION" in *-dirty) echo "refusing to deploy uncommitted changes ($VERSION)" >&2; exit 1;; esac
 
@@ -47,7 +58,19 @@ git rev-parse HEAD | "${SSH[@]}" "cat > $REMOTE_DIR/release/$VERSION/GIT_SHA"
 if [ "${DRY_RUN:-}" != "" ]; then echo "DRY_RUN: shipped to $REMOTE_DIR/release/$VERSION, nothing changed"; exit 0; fi
 
 step "3. Back up the database"
-"${SSH[@]}" "docker exec behavision-db sh -c 'PGPASSWORD=\$POSTGRES_PASSWORD pg_dump -U behavision -d behavision' | gzip > $REMOTE_DIR/backups/pre-$VERSION-\$(date +%Y%m%d-%H%M%S).sql.gz && ls -la $REMOTE_DIR/backups | tail -1"
+# The dump's own filename is echoed, not `ls | tail -1`, which reported the
+# WRONG file: ls sorts alphabetically, so pre-...-demo-12-... sorts before
+# pre-...-demo-6-... and the line printed a backup from four days earlier. A
+# deploy that names the wrong safety net is worse than one that names none -
+# that is the file somebody reaches for at the worst possible moment.
+#
+# Bare `-s` on the dump so an empty or failed one cannot be reported as a
+# backup: pg_dump exiting non-zero already fails the pipeline under pipefail,
+# but a zero-byte gzip would still satisfy it.
+"${SSH[@]}" "set -e; f=$REMOTE_DIR/backups/pre-$VERSION-\$(date +%Y%m%d-%H%M%S).sql.gz; \
+  docker exec behavision-db sh -c 'PGPASSWORD=\$POSTGRES_PASSWORD pg_dump -U behavision -d behavision' | gzip > \$f; \
+  [ -s \$f ] || { echo 'backup is empty - refusing to continue' >&2; exit 1; }; \
+  ls -la \$f"
 
 step "4. Image"
 "${SSH[@]}" "cd $REMOTE_DIR/release/$VERSION && docker build -q -t behavision-backend:$VERSION -f Dockerfile.runtime . && docker tag behavision-backend:$VERSION behavision-backend:latest"
@@ -65,7 +88,33 @@ step "6. Switch"
 "${SSH[@]}" "cd $REMOTE_DIR && docker compose up -d --no-build --no-deps backend && sleep 4 && docker logs --tail 15 behavision-backend"
 
 step "7. Verify over $PUBLIC"
-for p in /healthz /api/admin/clients /api/team /api/visits /api/cameras; do
-  printf '   %-20s %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' -m 15 "$PUBLIC$p")"
+# 401 is a PASS, and that distinction is the whole point of this step. An
+# unauthenticated call to a route that EXISTS is refused; a route the binary
+# never registered is a 404. So this proves the routing rather than the auth -
+# which is precisely what a deploy gets wrong, and what otherwise surfaces as a
+# console showing "Backend integration required" against an API that shipped.
+#
+# The uuid matches nothing on purpose: the admin drill-down must answer 401
+# with no session, never 404.
+NOBODY=00000000-0000-4000-8000-000000000000
+fail=0
+for p in /healthz \
+  /api/admin/clients \
+  "/api/admin/clients/$NOBODY" \
+  "/api/admin/clients/$NOBODY/sites" \
+  "/api/admin/clients/$NOBODY/sites/x/cameras" \
+  /api/admin/monitoring/summary \
+  /api/sales \
+  /api/sales/x \
+  /api/dashboard/summary \
+  /api/team /api/visits /api/cameras; do
+  code=$(curl -s -o /dev/null -w '%{http_code}' -m 15 "$PUBLIC$p")
+  case "$code" in
+    200|401) verdict="ok" ;;
+    404)     verdict="MISSING - this binary does not serve that route"; fail=1 ;;
+    *)       verdict="unexpected"; fail=1 ;;
+  esac
+  printf '   %-46s %s  %s\n' "$p" "$code" "$verdict"
 done
 curl -s -m 15 "$PUBLIC/healthz" | head -c 300; echo
+[ "$fail" = 0 ] || { echo; echo "VERIFY FAILED - routes above marked MISSING did not ship" >&2; exit 1; }

server/go.mod

@@ -3,13 +3,13 @@ module github.com/loyaly/behavision-server
 go 1.25.0
 
 require (
+	github.com/anthropics/anthropic-sdk-go v1.69.0
 	github.com/eclipse/paho.mqtt.golang v1.5.1
 	github.com/jackc/pgx/v5 v5.10.0
 	golang.org/x/crypto v0.42.0
 )
 
 require (
-	github.com/anthropics/anthropic-sdk-go v1.69.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect

server/internal/api/admin_monitor_test.go

@@ -0,0 +1,315 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// Two merchants, each with a shop and a camera. The whole point of these tests
+// is that the path names the merchant, so a fixture with only one proves
+// nothing about scoping.
+const (
+	merchantA = "11111111-1111-4111-8111-aaaaaaaaaaaa"
+	merchantB = "22222222-2222-4222-8222-bbbbbbbbbbbb"
+	shopA     = "33333333-3333-4333-8333-aaaaaaaaaaaa"
+	shopB     = "44444444-4444-4444-8444-bbbbbbbbbbbb"
+)
+
+func seedTwoMerchants(fs *fakeStore) {
+	seedPlatformAdmin(fs)
+	fs.clientRows = map[string]ClientDetail{
+		merchantA: {ClientRow: ClientRow{ID: merchantA, Slug: "acme", Name: "Acme Retail",
+			Active: true, Sites: 1, Users: 2}, OwnerEmail: "owner@acme.com", OwnerName: "Asha"},
+		merchantB: {ClientRow: ClientRow{ID: merchantB, Slug: "rival", Name: "Rival Stores",
+			Active: true, Sites: 1, Users: 1}, OwnerEmail: "owner@rival.com"},
+	}
+	fs.sites = []SiteHealth{
+		{SiteID: shopA, Slug: "chennai", Name: "Acme Chennai", CamerasUp: 1, CamerasTotal: 1},
+		{SiteID: shopB, Slug: "mumbai", Name: "Rival Mumbai", CamerasUp: 0, CamerasTotal: 1},
+	}
+	fs.siteOwner = map[string]string{shopA: merchantA, shopB: merchantB}
+	yes := true
+	fs.cameras = []Camera{
+		{ID: "cam-a", SiteID: shopA, CameraID: "entrance", Label: "Front door",
+			Host: "192.168.1.121", Port: 554, Path: "/ch0_1.264",
+			Username: "admin", HasPassword: true, Enabled: true, Connected: &yes},
+		{ID: "cam-b", SiteID: shopB, CameraID: "entrance", Label: "Rival door",
+			Host: "10.0.0.9", Port: 554, Username: "root", HasPassword: true},
+	}
+	fs.cameraRefs = map[string]cameraRef{
+		"cam-a": {client: merchantA, site: shopA, engineID: "entrance"},
+		"cam-b": {client: merchantB, site: shopB, engineID: "entrance"},
+	}
+}
+
+// adminReads picks out the rows this surface writes. Signing in audits too,
+// so a bare count would couple these tests to unrelated behaviour.
+func adminReads(fs *fakeStore) []AuditEntry {
+	var out []AuditEntry
+	for _, a := range fs.audits {
+		if strings.HasPrefix(a.Action, "admin.") {
+			out = append(out, a)
+		}
+	}
+	return out
+}
+
+func adminGet(t *testing.T, s *Server, token, path string) (int, string) {
+	t.Helper()
+	rec := do(t, s, "GET", path, token, nil)
+	return rec.Code, rec.Body.String()
+}
+
+// ------------------------------------------------- the surface is invisible
+
+func TestAMerchantTokenGets404FromEveryAdminDrilldownRoute(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	seedUser(fs) // an ordinary manager inside another tenant
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	for _, path := range []string{
+		"/api/admin/clients/" + merchantA,
+		"/api/admin/clients/" + merchantA + "/sites",
+		"/api/admin/clients/" + merchantA + "/sites/" + shopA,
+		"/api/admin/clients/" + merchantA + "/sites/" + shopA + "/cameras",
+		"/api/admin/clients/" + merchantA + "/sites/" + shopA + "/cameras/cam-a",
+		"/api/admin/monitoring/summary",
+	} {
+		if code, body := adminGet(t, s, sess.Token, path); code != http.StatusNotFound {
+			t.Errorf("%s: got %d, want 404 (never 403 - a tenant must not learn "+
+				"this surface exists): %s", path, code, body)
+		}
+	}
+}
+
+// ------------------------------------------------------------- scoping
+
+func TestSitesAreScopedToTheMerchantInThePath(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	code, body := adminGet(t, s, sess.Token, "/api/admin/clients/"+merchantA+"/sites")
+	if code != http.StatusOK {
+		t.Fatalf("got %d: %s", code, body)
+	}
+	var rows []SiteHealth
+	if err := json.Unmarshal([]byte(body), &rows); err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 || rows[0].SiteID != shopA {
+		t.Fatalf("got %d rows %+v, want only merchant A's shop", len(rows), rows)
+	}
+	if strings.Contains(body, "Rival") {
+		t.Errorf("another merchant's shop leaked into the response: %s", body)
+	}
+}
+
+// The uuid branch is the one that matters. A tenant resolver hands a uuid back
+// untouched and lets `client_id = $1` downstream do the scoping, which is safe
+// only because the client id comes from a session. Here the caller names both.
+func TestAnotherMerchantsShopIs404NotAnEmptyList(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	for _, path := range []string{
+		"/api/admin/clients/" + merchantA + "/sites/" + shopB,
+		"/api/admin/clients/" + merchantA + "/sites/" + shopB + "/cameras",
+		"/api/admin/clients/" + merchantA + "/sites/mumbai/cameras",
+	} {
+		code, body := adminGet(t, s, sess.Token, path)
+		if code != http.StatusNotFound {
+			t.Errorf("%s: got %d, want 404 - an empty list says 'this shop has "+
+				"nothing' when the truth is 'not your shop': %s", path, code, body)
+		}
+	}
+}
+
+func TestACameraFromAnotherShopIs404(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	// cam-b exists, and its engine id "entrance" is the same string as cam-a's
+	// - a camera id is unique per SITE, not per tenant, so the chain has to be
+	// checked rather than the name trusted.
+	code, _ := adminGet(t, s, sess.Token,
+		"/api/admin/clients/"+merchantA+"/sites/"+shopA+"/cameras/cam-b")
+	if code != http.StatusNotFound {
+		t.Errorf("got %d, want 404 for a camera belonging to another shop", code)
+	}
+}
+
+func TestAnUnknownOrMalformedMerchantIs404NotAServerError(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	for _, id := range []string{
+		"99999999-9999-4999-8999-999999999999", // well formed, no such row
+		"not-a-uuid",                           // would be a Postgres cast error
+	} {
+		code, body := adminGet(t, s, sess.Token, "/api/admin/clients/"+id+"/sites")
+		if code != http.StatusNotFound {
+			t.Errorf("merchant %q: got %d, want 404: %s", id, code, body)
+		}
+	}
+}
+
+// ------------------------------------------------------------- redaction
+
+// The one that would be a real leak. An RTSP host next to a username is most
+// of a live path into a customer's camera, and a platform admin browsing
+// another company's estate has no business with either.
+func TestAdminCameraRowsCarryNoCredentialFields(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	code, body := adminGet(t, s, sess.Token,
+		"/api/admin/clients/"+merchantA+"/sites/"+shopA+"/cameras")
+	if code != http.StatusOK {
+		t.Fatalf("got %d: %s", code, body)
+	}
+	// Asserted on the raw JSON, not on a struct: decoding into AdminCamera
+	// would discard exactly the fields this test exists to catch.
+	for _, banned := range []string{
+		"host", "192.168.1.121", "port", "554", "path", "ch0_1.264",
+		"username", "admin", "has_password", "password",
+	} {
+		if strings.Contains(body, banned) {
+			t.Errorf("admin camera row contains %q: %s", banned, body)
+		}
+	}
+	// And it still answers the question the screen asks.
+	for _, want := range []string{"entrance", "Front door", "connected"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("admin camera row is missing %q: %s", want, body)
+		}
+	}
+}
+
+// Connected is a pointer for a reason: null means no shop PC has ever reported,
+// false means it is not connecting, and those send an installer to two
+// different places. `omitempty` would collapse both into absent.
+func TestAdminCameraKeepsConnectedAsThreeStates(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	fs.cameras[0].Connected = nil
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	_, body := adminGet(t, s, sess.Token,
+		"/api/admin/clients/"+merchantA+"/sites/"+shopA+"/cameras")
+	if !strings.Contains(body, `"connected":null`) {
+		t.Errorf(`want "connected":null for a camera no PC has reported on: %s`, body)
+	}
+}
+
+// ------------------------------------------------------------- audit
+
+func TestEveryAdminReadBelowTheMerchantListIsAudited(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	base := "/api/admin/clients/" + merchantA
+	for _, path := range []string{
+		base + "/sites",
+		base + "/sites/" + shopA,
+		base + "/sites/" + shopA + "/cameras",
+		base + "/sites/" + shopA + "/cameras/cam-a",
+	} {
+		if code, body := adminGet(t, s, sess.Token, path); code != http.StatusOK {
+			t.Fatalf("%s: got %d: %s", path, code, body)
+		}
+	}
+	// Filtered by action: signing in writes its own audit row, and counting
+	// every row would make this test pass or fail on unrelated behaviour.
+	reads := adminReads(fs)
+	if len(reads) != 4 {
+		t.Fatalf("got %d admin read rows, want one per read below the merchant "+
+			"list (all audits: %+v)", len(reads), fs.audits)
+	}
+	for _, a := range reads {
+		if a.ClientID != merchantA {
+			t.Errorf("audit row names client %q, want the merchant being looked at", a.ClientID)
+		}
+		if a.ActorID != "admin-1" || a.ActorKind != "admin" {
+			t.Errorf("audit row must name the admin who looked: %+v", a)
+		}
+	}
+}
+
+// Counts across the platform name no merchant and no person, and a console
+// refreshes them on a timer. Logging that would bury the reads worth finding.
+func TestTheSummaryIsNotAudited(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	if code, body := adminGet(t, s, sess.Token, "/api/admin/monitoring/summary"); code != http.StatusOK {
+		t.Fatalf("got %d: %s", code, body)
+	}
+	if n := len(adminReads(fs)); n != 0 {
+		t.Errorf("got %d admin read rows for a counts-only header strip, want 0", n)
+	}
+}
+
+// ------------------------------------------------------------- suspended
+
+// "This company is suspended" is precisely what an admin opens the console to
+// look at. Hiding it would make the one screen that can fix it the one screen
+// that cannot see it.
+func TestASuspendedMerchantStaysReadable(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	row := fs.clientRows[merchantA]
+	row.Active = false
+	fs.clientRows[merchantA] = row
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	code, body := adminGet(t, s, sess.Token, "/api/admin/clients/"+merchantA)
+	if code != http.StatusOK {
+		t.Fatalf("got %d, want a suspended merchant to still read: %s", code, body)
+	}
+	if !strings.Contains(body, `"active":false`) {
+		t.Errorf("the response must say it is suspended: %s", body)
+	}
+	if code, _ := adminGet(t, s, sess.Token, "/api/admin/clients/"+merchantA+"/sites"); code != http.StatusOK {
+		t.Errorf("sites of a suspended merchant: got %d, want 200", code)
+	}
+}
+
+func TestMerchantDetailCarriesTheOwner(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	code, body := adminGet(t, s, sess.Token, "/api/admin/clients/"+merchantA)
+	if code != http.StatusOK {
+		t.Fatalf("got %d: %s", code, body)
+	}
+	// Who to contact is the whole reason this is not just the list row.
+	if !strings.Contains(body, "owner@acme.com") {
+		t.Errorf("merchant detail must name the owner: %s", body)
+	}
+}
+
+// An empty list must serialise as [] and not null, or a console that maps over
+// the response breaks on a merchant with no shops - which is every merchant on
+// the day they are created.
+func TestAMerchantWithNoShopsReturnsAnEmptyArray(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoMerchants(fs)
+	fs.siteOwner = map[string]string{shopB: merchantB} // A now owns nothing
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	code, body := adminGet(t, s, sess.Token, "/api/admin/clients/"+merchantA+"/sites")
+	if code != http.StatusOK || strings.TrimSpace(body) != "[]" {
+		t.Errorf("got %d %q, want 200 []", code, strings.TrimSpace(body))
+	}
+}

server/internal/api/api.go

@@ -57,6 +57,7 @@ type Store interface {
 	UserSessions(ctx context.Context, userID string) ([]DeviceSession, error)
 	RevokeUserSession(ctx context.Context, userID, sessionID string) error
 	RevokeOtherSessions(ctx context.Context, userID, keepSessionID string) (int, error)
+	SetUserPassword(ctx context.Context, userID, hash string) error
 
 	// --- team and invitations ---
 	// Registration is by invitation: the code carries the address and the role
@@ -136,7 +137,19 @@ type Store interface {
 
 	// --- platform administration ---
 	CreateClientWithOwner(ctx context.Context, in NewClientInput) (NewClientResult, error)
+	CreateCustomer(ctx context.Context, clientID string, in Profile, createdBy string) (Customer, error)
+	MergeVisitors(ctx context.Context, clientID, sourceID, targetID string) (MergeResult, error)
+	Sales(ctx context.Context, q SaleQuery) ([]Sale, error)
+	Sale(ctx context.Context, clientID, id string) (Sale, error)
+
 	ListClients(ctx context.Context) ([]ClientRow, error)
+
+	// The admin drill-down. Each takes the merchant's client id explicitly,
+	// because the caller is a platform admin whose session carries none.
+	ClientDetail(ctx context.Context, clientID string) (ClientDetail, error)
+	AdminSiteID(ctx context.Context, clientID, ref string) (string, error)
+	AdminCameraID(ctx context.Context, clientID, siteID, ref string) (string, error)
+	PlatformSummary(ctx context.Context) (PlatformSummary, error)
 	// SetClientActive suspends or reinstates a company. Suspending revokes every
 	// session its users hold in the same transaction - login and ingest already
 	// refuse an inactive client, but a live access token would otherwise keep
@@ -159,6 +172,9 @@ type Store interface {
 	// one opened by mistake - and returns its broker username. A shop with
 	// history is closed, not deleted.
 	DeleteEmptySite(ctx context.Context, clientID, siteID string) (string, error)
+	// UpdateSite changes what a person reads - the name, the timezone. Never
+	// the slug: the shop PC and the broker ACL are keyed on it.
+	UpdateSite(ctx context.Context, clientID, siteID string, in SiteUpdate) (SiteHealth, error)
 
 	// --- enrolment ---
 	RedeemEnrolment(ctx context.Context, hash []byte) (Enrolment, error)
@@ -281,63 +297,84 @@ func (s *Server) Routes() *http.ServeMux {
 	// Devices. A person may list and revoke their own sessions; removing a
 	// colleague's access is a different question, answered by deactivating them
 	// on the team endpoint below.
+	// Changing your own password. `authed`, not `tenantOnly`: a session is not
+	// a company's data, and a platform admin has no company but must still be
+	// able to do this - they were the account with no route at all.
+	mux.HandleFunc("POST /api/auth/password", s.authed(s.handleChangePassword))
 	mux.HandleFunc("GET /api/auth/sessions", s.authed(s.handleSessions))
 	mux.HandleFunc("DELETE /api/auth/sessions/{id}", s.authed(s.handleRevokeSession))
 	mux.HandleFunc("POST /api/auth/sessions/revoke-others",
 		s.authed(s.handleRevokeOtherSessions))
 
 	// --- the people who work here ---
-	mux.HandleFunc("GET /api/team", s.authed(s.handleTeam))
-	mux.HandleFunc("PATCH /api/team/{id}", s.authed(s.handleUpdateTeamMember))
-	mux.HandleFunc("POST /api/team/members", s.authed(s.handleCreateMember))
-	mux.HandleFunc("POST /api/team/{id}/password", s.authed(s.handleResetPassword))
-	mux.HandleFunc("GET /api/team/invitations", s.authed(s.handleInvitations))
-	mux.HandleFunc("POST /api/team/invitations", s.authed(s.handleInvite))
+	mux.HandleFunc("GET /api/team", s.tenantOnly(s.handleTeam))
+	mux.HandleFunc("PATCH /api/team/{id}", s.tenantOnly(s.handleUpdateTeamMember))
+	mux.HandleFunc("POST /api/team/members", s.tenantOnly(s.handleCreateMember))
+	mux.HandleFunc("POST /api/team/{id}/password", s.tenantOnly(s.handleResetPassword))
+	mux.HandleFunc("GET /api/team/invitations", s.tenantOnly(s.handleInvitations))
+	mux.HandleFunc("POST /api/team/invitations", s.tenantOnly(s.handleInvite))
 	mux.HandleFunc("DELETE /api/team/invitations/{id}",
-		s.authed(s.handleRevokeInvitation))
+		s.tenantOnly(s.handleRevokeInvitation))
 
-	mux.HandleFunc("GET /api/reports/footfall", s.authed(s.handleFootfall))
-	mux.HandleFunc("GET /api/reports/conversion", s.authed(s.handleConversion))
-	mux.HandleFunc("GET /api/sites", s.authed(s.handleSites))
-	mux.HandleFunc("POST /api/sites", s.authed(s.handleCreateSite))
-	mux.HandleFunc("DELETE /api/sites/{site}", s.authed(s.handleDeleteSite))
+	mux.HandleFunc("GET /api/reports/footfall", s.tenantOnly(s.handleFootfall))
+	mux.HandleFunc("GET /api/reports/conversion", s.tenantOnly(s.handleConversion))
+	mux.HandleFunc("GET /api/sites", s.tenantOnly(s.handleSites))
+	mux.HandleFunc("POST /api/sites", s.tenantOnly(s.handleCreateSite))
+	mux.HandleFunc("DELETE /api/sites/{site}", s.tenantOnly(s.handleDeleteSite))
+	mux.HandleFunc("PATCH /api/sites/{site}", s.tenantOnly(s.handleUpdateSite))
 
 	// Cameras, onboarded from head office. The shop PC still does the
 	// connecting - it is the only thing on the camera's network - so these
 	// write desired state that its agent pulls and applies.
-	mux.HandleFunc("GET /api/cameras", s.authed(s.handleCameras))
-	mux.HandleFunc("POST /api/sites/{site}/cameras", s.authed(s.handleCreateCamera))
-	mux.HandleFunc("PATCH /api/cameras/{id}", s.authed(s.handleUpdateCamera))
-	mux.HandleFunc("DELETE /api/cameras/{id}", s.authed(s.handleDeleteCamera))
-	mux.HandleFunc("GET /api/cameras/{id}/snapshot.jpg", s.authed(s.handleGetSnapshot))
-	mux.HandleFunc("GET /api/cameras/{id}/live", s.authed(s.handleWatchLive))
+	mux.HandleFunc("GET /api/cameras", s.tenantOnly(s.handleCameras))
+	mux.HandleFunc("POST /api/sites/{site}/cameras", s.tenantOnly(s.handleCreateCamera))
+	mux.HandleFunc("PATCH /api/cameras/{id}", s.tenantOnly(s.handleUpdateCamera))
+	mux.HandleFunc("DELETE /api/cameras/{id}", s.tenantOnly(s.handleDeleteCamera))
+	mux.HandleFunc("GET /api/cameras/{id}/snapshot.jpg", s.tenantOnly(s.handleGetSnapshot))
+	mux.HandleFunc("GET /api/cameras/{id}/live", s.tenantOnly(s.handleWatchLive))
 	// Prove a camera works: "connection" asks whether the shop PC can open the
 	// stream, "placement" asks whether somebody walking past produces a view
 	// good enough to recognise. Two questions, because a camera passes the
 	// first and fails the second all the time - that is the Office1 case.
-	mux.HandleFunc("POST /api/cameras/{id}/check", s.authed(s.handleRequestCheck))
+	mux.HandleFunc("POST /api/cameras/{id}/check", s.tenantOnly(s.handleRequestCheck))
 	// The end-to-end answer for one shop, assembled from what head office
 	// already knows - so it works even when the shop PC is off, which is one of
 	// the things it reports.
-	mux.HandleFunc("GET /api/sites/{site}/check", s.authed(s.handleSiteCheck))
+	mux.HandleFunc("GET /api/sites/{site}/check", s.tenantOnly(s.handleSiteCheck))
 	mux.HandleFunc("POST /api/sites/{site}/enrolment-code",
-		s.authed(s.handleIssueEnrolmentCode))
+		s.tenantOnly(s.handleIssueEnrolmentCode))
 
 	// The assistant. Every tool it calls runs as the signed-in user, so it can
 	// only ever see what the person asking could already see.
-	mux.HandleFunc("POST /api/assistant", s.authed(s.handleAssistant))
+	mux.HandleFunc("POST /api/assistant", s.tenantOnly(s.handleAssistant))
 
 	// The live feed. `visitors` searches a customer list by name; `visits`
 	// answers the question a shop screen or a mobile app actually asks - who
 	// came through the door just now - and carries each person's photo with
 	// them so rendering four simultaneous arrivals is one request, not nine.
-	mux.HandleFunc("GET /api/visits", s.authed(s.handleArrivals))
-	mux.HandleFunc("GET /api/visits/stream", s.authed(s.handleArrivalStream))
+	mux.HandleFunc("GET /api/visits", s.tenantOnly(s.handleArrivals))
+	mux.HandleFunc("GET /api/visits/stream", s.tenantOnly(s.handleArrivalStream))
 
-	mux.HandleFunc("GET /api/visitors", s.authed(s.handleVisitors))
-	mux.HandleFunc("GET /api/visitors/{id}/history", s.authed(s.handleVisitorHistory))
-	mux.HandleFunc("PUT /api/visitors/{id}/profile", s.authed(s.handleSaveProfile))
-	mux.HandleFunc("POST /api/purchases", s.authed(s.handlePurchase))
+	mux.HandleFunc("GET /api/visitors", s.tenantOnly(s.handleVisitors))
+	mux.HandleFunc("GET /api/visitors/{id}/history", s.tenantOnly(s.handleVisitorHistory))
+	mux.HandleFunc("PUT /api/visitors/{id}/profile", s.tenantOnly(s.handleSaveProfile))
+
+	// A customer registered before any camera has seen them, and the repair
+	// path that creates the need for: with no face template, recognition
+	// cannot match them later and enrols them again.
+	mux.HandleFunc("POST /api/customers", s.tenantOnly(s.handleCreateCustomer))
+	mux.HandleFunc("POST /api/visitors/{id}/merge", s.tenantOnly(s.handleMergeCustomers))
+	mux.HandleFunc("POST /api/purchases", s.tenantOnly(s.handlePurchase))
+
+	// Reading sales, not just aggregating them. /api/reports/conversion has
+	// summed this table since it existed; nothing could read a row of it, so
+	// "revenue was 41,000" could not be checked against a till.
+	mux.HandleFunc("GET /api/sales", s.tenantOnly(s.handleSales))
+	mux.HandleFunc("GET /api/sales/{id}", s.tenantOnly(s.handleSale))
+
+	// The merchant home screen in one call, composed from the functions the
+	// reports already use rather than from new arithmetic.
+	mux.HandleFunc("GET /api/dashboard/summary", s.tenantOnly(s.handleDashboard))
 
 	// Platform administration. Not public registration: an open endpoint that
 	// mints tenants is a far larger thing to secure than one behind an account
@@ -349,6 +386,17 @@ func (s *Server) Routes() *http.ServeMux {
 	mux.HandleFunc("POST /api/admin/clients/{id}/owner-password", s.adminOnly(s.handleResetOwnerPassword))
 	mux.HandleFunc("DELETE /api/admin/clients/{id}", s.adminOnly(s.handleDeleteClient))
 
+	// The admin drill-down: merchant -> shop -> camera. Read-only, scoped by
+	// the merchant named in the path rather than by a session that has none,
+	// with every read below the merchant list audited and cameras redacted to
+	// a type that cannot carry an RTSP host or username.
+	mux.HandleFunc("GET /api/admin/clients/{id}", s.adminOnly(s.handleAdminClient))
+	mux.HandleFunc("GET /api/admin/clients/{id}/sites", s.adminOnly(s.handleAdminClientSites))
+	mux.HandleFunc("GET /api/admin/clients/{id}/sites/{site}", s.adminOnly(s.handleAdminClientSite))
+	mux.HandleFunc("GET /api/admin/clients/{id}/sites/{site}/cameras", s.adminOnly(s.handleAdminSiteCameras))
+	mux.HandleFunc("GET /api/admin/clients/{id}/sites/{site}/cameras/{camera}", s.adminOnly(s.handleAdminSiteCamera))
+	mux.HandleFunc("GET /api/admin/monitoring/summary", s.adminOnly(s.handleAdminMonitoringSummary))
+
 	// Not session-authenticated: this is how a PC with no credentials gets
 	// some. The enrolment token is the credential.
 	mux.HandleFunc("POST /api/agent/enrol", s.handleEnrol)
@@ -367,15 +415,15 @@ func (s *Server) Routes() *http.ServeMux {
 	mux.HandleFunc("GET /api/agent/checks", s.agentAuthed(s.handleAgentChecks))
 	mux.HandleFunc("POST /api/agent/checks", s.agentAuthed(s.handleAgentCheckResult))
 
-	mux.HandleFunc("GET /api/visitors/{id}/image", s.authed(s.handleVisitorImage))
+	mux.HandleFunc("GET /api/visitors/{id}/image", s.tenantOnly(s.handleVisitorImage))
 	// The bytes of a face this server holds itself. Session-authenticated
 	// rather than a signed link: there is no third party to delegate to, and an
 	// unauthenticated URL would be a way to reach a customer's photograph with
 	// no session at all.
-	mux.HandleFunc("GET /api/faces/{id}", s.authed(s.handleGetFace))
+	mux.HandleFunc("GET /api/faces/{id}", s.tenantOnly(s.handleGetFace))
 	// The erasure path. Destroys the template and the photo; keeps the
 	// anonymous visit counts, which are legitimate aggregate data.
-	mux.HandleFunc("DELETE /api/visitors/{id}", s.authed(s.handleForgetVisitor))
+	mux.HandleFunc("DELETE /api/visitors/{id}", s.tenantOnly(s.handleForgetVisitor))
 
 	return mux
 }
@@ -393,6 +441,36 @@ func PrincipalFrom(ctx context.Context) auth.Principal {
 	return p
 }
 
+// tenantOnly gates the routes that read or write one company's data.
+//
+// It exists because a platform admin has NO client - that absence is what
+// defines them - and every tenant query scopes on `client_id = $1::uuid`.
+// Handing it the empty string makes Postgres cast ” to a uuid, which is an
+// ERROR rather than an empty result, so five live endpoints answered 500 to a
+// signed-in platform admin: /api/visits, /api/cameras, /api/sites,
+// /api/visitors and /api/reports/footfall. Found by calling them.
+//
+// 403 and not 404, unlike adminOnly. The two hide opposite things: a tenant
+// must not learn that a platform surface exists, while a platform admin
+// already knows the tenant surface does - they are looking at its data through
+// /api/admin. Nothing is concealed by pretending otherwise, and "use the admin
+// routes" is the useful answer.
+//
+// Guarding here rather than in each query is deliberate: a per-query fix is
+// one a new query forgets, and the next one would 500 in production exactly
+// like these did.
+func (s *Server) tenantOnly(next http.HandlerFunc) http.HandlerFunc {
+	return s.authed(func(w http.ResponseWriter, r *http.Request) {
+		if PrincipalFrom(r.Context()).ClientID == "" {
+			writeErr(w, http.StatusForbidden, "not_a_tenant_account",
+				"This is a company's own data. A platform administrator "+
+					"reads it through /api/admin/clients/{id}/...")
+			return
+		}
+		next(w, r)
+	})
+}
+
 func (s *Server) authed(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		tok := auth.BearerToken(r)
@@ -542,6 +620,11 @@ func looksLikeUUID(s string) bool {
 // without importing the store package.
 var ErrNoSecrets = errors.New("this server has no encryption key, so camera passwords cannot be stored")
 
+// ErrSameVisitor is a merge that names one customer twice. Declared here
+// rather than in the store for the reason ErrNoSecrets is: the store imports
+// this package, so a sentinel the other way round is an import cycle.
+var ErrSameVisitor = errors.New("a customer cannot be merged into themselves")
+
 // ErrNoSnapshot means a camera has no stored picture. An ordinary state - a
 // camera added a minute ago has none - so it is reported as absence, never as
 // a failure.

server/internal/api/camera_state_test.go

@@ -0,0 +1,96 @@
+package api
+
+import (
+	"testing"
+	"time"
+)
+
+func ptr(b bool) *bool { return &b }
+
+// The state this was written for. Two cameras read "Connected", in green, on
+// the live estate thirty-four minutes after the shop computer had stopped
+// being able to see either of them - because the agent correctly reports
+// nothing when it cannot reach the engine, and the last value it sent stays
+// in the database looking current.
+func TestAStaleReportIsNotAConnectedCamera(t *testing.T) {
+	now := time.Date(2026, 9, 30, 11, 13, 0, 0, time.UTC)
+	c := Camera{Connected: ptr(true),
+		LastSeenAt: now.Add(-34 * time.Minute).Format(time.RFC3339)}
+	c.CameraState(now)
+
+	if c.State != CameraStale {
+		t.Errorf("state = %q, want %q", c.State, CameraStale)
+	}
+	// Cleared, not merely overruled. A stale true left in place stays
+	// available to every client that reads the field directly, and leaves two
+	// fields on one object disagreeing.
+	if c.Connected != nil {
+		t.Errorf("connected = %v, want null - nobody currently knows", *c.Connected)
+	}
+	if c.StateNote == "" {
+		t.Error("a stale camera said nothing about what to do")
+	}
+}
+
+// One missed report is a dropped packet. Warning on it would put an alarm on a
+// healthy estate every few minutes, and an indicator that cries wolf is one
+// people learn to ignore.
+func TestOneMissedReportIsStillConnected(t *testing.T) {
+	now := time.Now()
+	c := Camera{Connected: ptr(true),
+		LastSeenAt: now.Add(-90 * time.Second).Format(time.RFC3339)}
+	c.CameraState(now)
+	if c.State != CameraConnected {
+		t.Errorf("state = %q after 90s, want %q", c.State, CameraConnected)
+	}
+	if c.Connected == nil || !*c.Connected {
+		t.Error("a fresh report lost its connected flag")
+	}
+}
+
+// "Nobody has ever told us" and "nobody has told us lately" need different
+// sentences: the first is a camera head office added a minute ago and the
+// shop computer has not picked up, the second is a shop computer that has
+// stopped. Sending an installer to the wrong one wastes a journey.
+func TestNeverReportedIsNotTheSameAsStopped(t *testing.T) {
+	now := time.Now()
+	var never Camera
+	never.CameraState(now)
+	if never.State != CameraWaiting {
+		t.Errorf("state = %q, want %q", never.State, CameraWaiting)
+	}
+
+	stopped := Camera{LastSeenAt: now.Add(-time.Hour).Format(time.RFC3339)}
+	stopped.CameraState(now)
+	if stopped.State == never.State {
+		t.Fatal("a camera nobody has reported and one that stopped read the same")
+	}
+	if stopped.StateNote == never.StateNote {
+		t.Error("two states that need different actions gave the same advice")
+	}
+}
+
+// A camera the shop computer CAN see and cannot open is the one case where
+// "check the cabling" is the right advice, and it must stay distinguishable
+// from the three where it is not.
+func TestAFreshFailureSaysCheckTheCamera(t *testing.T) {
+	now := time.Now()
+	c := Camera{Connected: ptr(false), LastSeenAt: now.Format(time.RFC3339)}
+	c.CameraState(now)
+	if c.State != CameraNotConnect {
+		t.Errorf("state = %q, want %q", c.State, CameraNotConnect)
+	}
+	if c.Connected == nil || *c.Connected {
+		t.Error("a reported failure must stay false, not become unknown")
+	}
+}
+
+// An unparseable timestamp is not a working camera. It should not be possible,
+// which is exactly why it must not fall through to "connected".
+func TestAnUnreadableTimestampIsStale(t *testing.T) {
+	c := Camera{Connected: ptr(true), LastSeenAt: "not a time"}
+	c.CameraState(time.Now())
+	if c.State != CameraStale || c.Connected != nil {
+		t.Errorf("state = %q connected = %v, want stale and unknown", c.State, c.Connected)
+	}
+}

server/internal/api/customers_test.go

@@ -0,0 +1,148 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+)
+
+func TestStaffCanRegisterACustomerNobodyHasPhotographed(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", "/api/customers", sess.Token, map[string]string{
+		"full_name": "Asha Menon", "phone": "9876543210",
+	})
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var c Customer
+	if err := json.Unmarshal(rec.Body.Bytes(), &c); err != nil {
+		t.Fatal(err)
+	}
+	// A reference a person can say, from the same counter the engine uses.
+	if c.Ref == "" || c.Label != "Asha Menon" {
+		t.Errorf("got ref=%q label=%q, want a V- reference and the typed name",
+			c.Ref, c.Label)
+	}
+}
+
+// A record with no name and no phone is a number nobody can search for, and
+// the customer at the counter is the only source of either.
+func TestACustomerNeedsANameOrAPhone(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", "/api/customers", sess.Token,
+		map[string]string{"notes": "regular, likes the window seat"})
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("got %d, want 400: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// ---------------------------------------------------------------- merge
+
+// Uuid-shaped on purpose: resolveVisitor takes a uuid or a V- reference and
+// correctly refuses anything else, so a made-up id would 404 before reaching
+// the handler under test.
+const (
+	vTyped = "aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa" // typed in at the counter
+	vSeen  = "bbbbbbbb-2222-4222-8222-bbbbbbbbbbbb" // enrolled by a camera
+)
+
+func seedTwoCustomers(fs *fakeStore) {
+	seedUser(fs)
+	fs.visitors = []Customer{
+		{ID: vTyped, Ref: "V-1", Label: "Asha Menon", FullName: "Asha Menon"},
+		{ID: vSeen, Ref: "V-2", Label: "Visitor 2"},
+	}
+}
+
+func TestMergingFoldsOneCustomerIntoTheOtherAndSaysWhatMoved(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoCustomers(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", "/api/visitors/"+vTyped+"/merge", sess.Token,
+		map[string]string{"into": vSeen})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var out MergeResult
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	// The reference that STOPPED resolving has to be named. Staff write these
+	// on cards; discovering it at a counter is the wrong place to find out.
+	if out.RetiredRef != "V-1" || out.Ref != "V-2" {
+		t.Errorf("kept %q retired %q, want V-2 kept and V-1 retired", out.Ref, out.RetiredRef)
+	}
+}
+
+// The only irreversible operation on a customer apart from erasure. Two people
+// welded together cannot be separated: nothing records which visit came from
+// whom.
+func TestStaffCannotMerge(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoCustomers(fs)
+	fs.addUser("shopfloor@acme.com", "correct horse battery", UserRecord{
+		ID: "u9", ClientID: "client-acme", Role: "staff", Active: true,
+	})
+	sess := login(t, s, "shopfloor@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", "/api/visitors/"+vTyped+"/merge", sess.Token,
+		map[string]string{"into": vSeen})
+	if rec.Code != http.StatusForbidden {
+		t.Errorf("got %d, want 403 for staff: %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestMergingACustomerIntoThemselvesIsRefused(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoCustomers(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", "/api/visitors/"+vTyped+"/merge", sess.Token,
+		map[string]string{"into": vTyped})
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("got %d, want 400: %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestMergingNeedsATarget(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoCustomers(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	for _, body := range []map[string]string{{}, {"into": "  "}, {"into": "V-999"}} {
+		rec := do(t, s, "POST", "/api/visitors/"+vTyped+"/merge", sess.Token, body)
+		if rec.Code == http.StatusOK {
+			t.Errorf("merge with %v succeeded, want a refusal", body)
+		}
+	}
+}
+
+// Every merge leaves a trace: it is destructive and cannot be undone.
+func TestAMergeIsAudited(t *testing.T) {
+	s, fs := newServer(t)
+	seedTwoCustomers(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	do(t, s, "POST", "/api/visitors/"+vTyped+"/merge", sess.Token,
+		map[string]string{"into": vSeen})
+
+	found := false
+	for _, a := range fs.audits {
+		if a.Action == "customer.merge" {
+			found = true
+			if a.Detail["retired_ref"] != "V-1" {
+				t.Errorf("audit must name the retired reference: %+v", a.Detail)
+			}
+		}
+	}
+	if !found {
+		t.Error("no audit row for a merge")
+	}
+}

server/internal/api/fake_test.go

@@ -41,13 +41,29 @@ type fakeStore struct {
 	byAccess  map[string]string // access hash hex -> session id
 	byRefresh map[string]string
 
-	visitors  []Customer
-	history   []VisitRow
-	footfall  []FootfallPoint
-	totals    Totals
-	sales     SalesReport
-	sites     []SiteHealth
-	enrolment map[string]Enrolment
+	visitors []Customer
+	history  []VisitRow
+	footfall []FootfallPoint
+	totals   Totals
+	sales    SalesReport
+	sites    []SiteHealth
+
+	// The admin drill-down is the one surface where the fake MUST know which
+	// merchant owns what. Everywhere else the client id comes from the session
+	// and every query scopes on it, so a fake that ignores it still exercises
+	// the handler. Here the client id comes from the PATH and the scoping is
+	// the thing under test - a fake that ignored it would pass the
+	// cross-merchant tests while returning another company's shops.
+	// Camera ownership already has a home: cameraRefs, read through the
+	// cameraOwner method below.
+	siteOwner     map[string]string // site id -> client id
+	salesRows     []Sale
+	visitorSeq    int64
+	lastMerge     [2]string
+	saleOwner     map[string]string // sale id -> client id
+	lastSaleQuery SaleQuery
+	clientRows    map[string]ClientDetail
+	enrolment     map[string]Enrolment
 
 	// Recorded calls, so a test can assert what the handler asked for rather
 	// than only what it returned.
@@ -288,8 +304,161 @@ func (f *fakeStore) DeleteNewSite(_ context.Context, _ string, siteID string) er
 	return nil
 }
 
-func (f *fakeStore) SiteHealth(_ context.Context, _ string) ([]SiteHealth, error) {
-	return f.sites, nil
+func (f *fakeStore) SiteHealth(_ context.Context, clientID string) ([]SiteHealth, error) {
+	// Scoped only when a test has declared ownership; otherwise every existing
+	// tenant test would have to grow a fixture it does not care about.
+	if f.siteOwner == nil {
+		return f.sites, nil
+	}
+	var out []SiteHealth
+	for _, s := range f.sites {
+		if f.siteOwner[s.SiteID] == clientID {
+			out = append(out, s)
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeStore) CreateCustomer(_ context.Context, clientID string,
+	in Profile, createdBy string) (Customer, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.visitorSeq++
+	label := in.FullName
+	if label == "" {
+		label = fmt.Sprintf("Visitor %d", f.visitorSeq)
+	}
+	c := Customer{
+		ID: fmt.Sprintf("new-%d", f.visitorSeq), Ref: VisitorRef(f.visitorSeq),
+		Label: label, FullName: in.FullName, Phone: in.Phone, Email: in.Email,
+		HasProfile: true,
+	}
+	f.visitors = append(f.visitors, c)
+	f.lastProfile = in
+	return c, nil
+}
+
+func (f *fakeStore) MergeVisitors(_ context.Context, clientID, sourceID, targetID string) (
+	MergeResult, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.lastMerge = [2]string{sourceID, targetID}
+	if sourceID == targetID {
+		return MergeResult{}, ErrSameVisitor
+	}
+	var src, dst *Customer
+	for i := range f.visitors {
+		switch f.visitors[i].ID {
+		case sourceID:
+			src = &f.visitors[i]
+		case targetID:
+			dst = &f.visitors[i]
+		}
+	}
+	if src == nil || dst == nil {
+		return MergeResult{}, pgx.ErrNoRows
+	}
+	out := MergeResult{VisitorID: dst.ID, Ref: dst.Ref, Label: dst.Label,
+		RetiredRef: src.Ref}
+	var kept []Customer
+	for _, c := range f.visitors {
+		if c.ID != sourceID {
+			kept = append(kept, c)
+		}
+	}
+	f.visitors = kept
+	return out, nil
+}
+
+func (f *fakeStore) SetUserPassword(_ context.Context, userID, hash string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for email, u := range f.users {
+		if u.ID == userID {
+			u.PasswordHash = hash
+			f.users[email] = u
+			return nil
+		}
+	}
+	return errors.New("no such user")
+}
+
+func (f *fakeStore) Sales(_ context.Context, q SaleQuery) ([]Sale, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.lastSaleQuery = q
+	var out []Sale
+	for _, sale := range f.salesRows {
+		if q.SiteID != "" && sale.SiteID != q.SiteID {
+			continue
+		}
+		if q.VisitorID != "" && sale.VisitorID != q.VisitorID {
+			continue
+		}
+		out = append(out, sale)
+	}
+	if q.Limit > 0 && len(out) > q.Limit {
+		out = out[:q.Limit]
+	}
+	return out, nil
+}
+
+func (f *fakeStore) Sale(_ context.Context, clientID, id string) (Sale, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, sale := range f.salesRows {
+		// Scoped, so the cross-tenant test is not vacuous.
+		if sale.ID == id && f.saleOwner[id] == clientID {
+			return sale, nil
+		}
+	}
+	return Sale{}, nil
+}
+
+func (f *fakeStore) ClientDetail(_ context.Context, clientID string) (ClientDetail, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.clientRows[clientID], nil
+}
+
+func (f *fakeStore) AdminSiteID(_ context.Context, clientID, ref string) (string, error) {
+	for _, s := range f.sites {
+		if s.SiteID != ref && s.Slug != ref {
+			continue
+		}
+		if f.siteOwner != nil && f.siteOwner[s.SiteID] != clientID {
+			return "", nil // owned by somebody else: a miss, not a match
+		}
+		return s.SiteID, nil
+	}
+	return "", nil
+}
+
+func (f *fakeStore) AdminCameraID(_ context.Context, clientID, siteID, ref string) (string, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, c := range f.cameras {
+		if c.ID != ref && c.CameraID != ref {
+			continue
+		}
+		if c.SiteID != siteID {
+			return "", nil
+		}
+		if f.cameraRefs != nil && f.cameraOwner(c.ID) != clientID {
+			return "", nil
+		}
+		return c.ID, nil
+	}
+	return "", nil
+}
+
+func (f *fakeStore) PlatformSummary(_ context.Context) (PlatformSummary, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return PlatformSummary{
+		CamerasTotal: len(f.cameras), MerchantsActive: len(f.clientRows),
+		SitesTotal: len(f.sites), AsOf: "2026-09-28T00:00:00Z",
+	}, nil
 }
 
 func (f *fakeStore) SearchVisitors(_ context.Context, clientID, q string, limit int) (
@@ -554,6 +723,23 @@ func (f *fakeStore) DeleteClient(_ context.Context, clientID string) (ClientRow,
 	return ClientRow{}, nil, pgx.ErrNoRows
 }
 
+func (f *fakeStore) UpdateSite(_ context.Context, _ string, siteID string, in SiteUpdate) (SiteHealth, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for i := range f.sites {
+		if f.sites[i].SiteID == siteID {
+			if in.Name != nil {
+				f.sites[i].Name = *in.Name
+			}
+			if in.Timezone != nil {
+				f.sites[i].Timezone = *in.Timezone
+			}
+			return f.sites[i], nil
+		}
+	}
+	return SiteHealth{}, pgx.ErrNoRows
+}
+
 func (f *fakeStore) DeleteEmptySite(_ context.Context, _ string, siteID string) (string, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()

server/internal/api/handlers_admin_clients.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 
@@ -257,3 +258,57 @@ func (s *Server) handleDeleteSite(w http.ResponseWriter, r *http.Request) {
 // ErrSiteInUse is returned by DeleteEmptySite for a shop that has anything
 // under it.
 var ErrSiteInUse = errors.New("site has cameras or visits")
+
+// PATCH /api/sites/{site} - rename a shop or change its timezone. Owner or
+// manager. The slug is not in the body and would be refused by the database
+// if it were: it is what the shop PC calls itself and a segment of the broker
+// topic, and renaming it would orphan both.
+func (s *Server) handleUpdateSite(w http.ResponseWriter, r *http.Request) {
+	p := PrincipalFrom(r.Context())
+	if !p.CanManageSites() || p.ClientID == "" {
+		writeErr(w, http.StatusForbidden, "forbidden", "Only a manager or the owner can change a shop.")
+		return
+	}
+	site, ok := s.resolveSite(w, r, r.PathValue("site"))
+	if !ok {
+		return
+	}
+	var in SiteUpdate
+	if err := decode(w, r, &in); err != nil {
+		badRequest(w, err.Error())
+		return
+	}
+	if in.Name != nil {
+		n := clip(trim(*in.Name), 120)
+		if n == "" {
+			badRequest(w, "The shop needs a name.")
+			return
+		}
+		in.Name = &n
+	}
+	if in.Timezone != nil {
+		if _, err := time.LoadLocation(strings.TrimSpace(*in.Timezone)); err != nil {
+			badRequest(w, "Unknown timezone. Use an IANA name such as Asia/Kolkata.")
+			return
+		}
+	}
+	if in.Name == nil && in.Timezone == nil {
+		badRequest(w, "Nothing to change: give a name or a timezone.")
+		return
+	}
+	out, err := s.Store.UpdateSite(r.Context(), p.ClientID, site, in)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			writeErr(w, http.StatusNotFound, "not_found", "No such shop.")
+			return
+		}
+		s.serverError(w, "update site", err)
+		return
+	}
+	s.Store.Audit(r.Context(), AuditEntry{
+		ClientID: p.ClientID, ActorID: p.UserID, ActorKind: "user",
+		Action: "site.updated", Entity: "site", EntityID: site,
+		Detail: map[string]any{"name": out.Name, "timezone": out.Timezone},
+	})
+	writeJSON(w, http.StatusOK, out)
+}

server/internal/api/handlers_admin_monitor.go

@@ -0,0 +1,181 @@
+// The platform-admin drill-down: merchant -> shop -> camera.
+//
+// These exist because the tenant routes cannot serve this screen, and the
+// reason is structural rather than incidental. Every tenant handler derives
+// the client from the SESSION - that is what makes cross-tenant access
+// impossible rather than merely disallowed - and a platform admin has no
+// client at all. The three workarounds all make it worse: passing a company id
+// to a tenant route puts a caller-chosen tenant back into the one place this
+// system refuses to take one, filtering the whole estate in the browser ships
+// every merchant's data to render one, and signing in as the owner leaves an
+// audit trail naming the wrong person.
+//
+// So the tenant STORE functions are reused with an explicit client id and the
+// scoping the tenant handlers get from the session is done here instead.
+package api
+
+import "net/http"
+
+// clientForAdmin resolves {id} to a merchant that exists.
+//
+// A suspended merchant still resolves: "this company is suspended" is
+// precisely what an admin opens the console to look at, and hiding it would
+// make the one screen that can fix it the one screen that cannot see it.
+func (s *Server) clientForAdmin(w http.ResponseWriter, r *http.Request) (ClientDetail, bool) {
+	c, err := s.Store.ClientDetail(r.Context(), r.PathValue("id"))
+	if err != nil {
+		s.serverError(w, "admin client", err)
+		return ClientDetail{}, false
+	}
+	if c.ID == "" {
+		writeErr(w, http.StatusNotFound, "not_found", "No such merchant.")
+		return ClientDetail{}, false
+	}
+	return c, true
+}
+
+// siteForAdmin resolves {site} within that merchant. A site belonging to
+// somebody else is 404 and not an empty list: the caller asked for a named
+// thing, and "here are its zero cameras" is a different and wrong answer.
+func (s *Server) siteForAdmin(w http.ResponseWriter, r *http.Request, clientID string) (string, bool) {
+	id, err := s.Store.AdminSiteID(r.Context(), clientID, r.PathValue("site"))
+	if err != nil {
+		s.serverError(w, "admin site", err)
+		return "", false
+	}
+	if id == "" {
+		writeErr(w, http.StatusNotFound, "not_found", "No such shop for this merchant.")
+		return "", false
+	}
+	return id, true
+}
+
+func (s *Server) handleAdminClient(w http.ResponseWriter, r *http.Request) {
+	c, ok := s.clientForAdmin(w, r)
+	if !ok {
+		return
+	}
+	writeJSON(w, http.StatusOK, c)
+}
+
+func (s *Server) handleAdminClientSites(w http.ResponseWriter, r *http.Request) {
+	c, ok := s.clientForAdmin(w, r)
+	if !ok {
+		return
+	}
+	rows, err := s.Store.SiteHealth(r.Context(), c.ID)
+	if err != nil {
+		s.serverError(w, "admin sites", err)
+		return
+	}
+	if rows == nil {
+		rows = []SiteHealth{}
+	}
+	s.auditAdminRead(r, c.ID, "admin.sites.read", "client", c.ID, len(rows))
+	writeJSON(w, http.StatusOK, rows)
+}
+
+func (s *Server) handleAdminClientSite(w http.ResponseWriter, r *http.Request) {
+	c, ok := s.clientForAdmin(w, r)
+	if !ok {
+		return
+	}
+	siteID, ok := s.siteForAdmin(w, r, c.ID)
+	if !ok {
+		return
+	}
+	// SiteHealth is the one place that knows what "online" means (three missed
+	// heartbeats, not one) and what cameras_up counts. A second query here
+	// would be a second definition of a working shop, and the two would drift.
+	rows, err := s.Store.SiteHealth(r.Context(), c.ID)
+	if err != nil {
+		s.serverError(w, "admin site", err)
+		return
+	}
+	for _, row := range rows {
+		if row.SiteID == siteID {
+			s.auditAdminRead(r, c.ID, "admin.site.read", "site", siteID, 1)
+			writeJSON(w, http.StatusOK, row)
+			return
+		}
+	}
+	writeErr(w, http.StatusNotFound, "not_found", "No such shop for this merchant.")
+}
+
+func (s *Server) handleAdminSiteCameras(w http.ResponseWriter, r *http.Request) {
+	c, ok := s.clientForAdmin(w, r)
+	if !ok {
+		return
+	}
+	siteID, ok := s.siteForAdmin(w, r, c.ID)
+	if !ok {
+		return
+	}
+	rows, err := s.Store.Cameras(r.Context(), c.ID, siteID)
+	if err != nil {
+		s.serverError(w, "admin cameras", err)
+		return
+	}
+	s.auditAdminRead(r, c.ID, "admin.cameras.read", "site", siteID, len(rows))
+	writeJSON(w, http.StatusOK, AdminCameras(rows))
+}
+
+func (s *Server) handleAdminSiteCamera(w http.ResponseWriter, r *http.Request) {
+	c, ok := s.clientForAdmin(w, r)
+	if !ok {
+		return
+	}
+	siteID, ok := s.siteForAdmin(w, r, c.ID)
+	if !ok {
+		return
+	}
+	camID, err := s.Store.AdminCameraID(r.Context(), c.ID, siteID, r.PathValue("camera"))
+	if err != nil {
+		s.serverError(w, "admin camera", err)
+		return
+	}
+	if camID == "" {
+		writeErr(w, http.StatusNotFound, "not_found", "No such camera for this shop.")
+		return
+	}
+	rows, err := s.Store.Cameras(r.Context(), c.ID, siteID)
+	if err != nil {
+		s.serverError(w, "admin camera", err)
+		return
+	}
+	for _, row := range rows {
+		if row.ID == camID {
+			s.auditAdminRead(r, c.ID, "admin.camera.read", "camera", camID, 1)
+			writeJSON(w, http.StatusOK, adminCamera(row))
+			return
+		}
+	}
+	writeErr(w, http.StatusNotFound, "not_found", "No such camera for this shop.")
+}
+
+func (s *Server) handleAdminMonitoringSummary(w http.ResponseWriter, r *http.Request) {
+	out, err := s.Store.PlatformSummary(r.Context())
+	if err != nil {
+		s.serverError(w, "platform summary", err)
+		return
+	}
+	// No audit row: this is counts across the platform, naming no merchant and
+	// no person. Logging a header strip that a console refreshes on a timer
+	// would bury the reads that are actually worth finding.
+	writeJSON(w, http.StatusOK, out)
+}
+
+// auditAdminRead records a platform admin reading inside one merchant.
+//
+// Below the merchant list, every read is somebody outside a company looking at
+// that company's estate. "Who looked at my shops" has to be answerable for the
+// same reason it does for face images, and an admin is exactly the account for
+// which nothing else in the system would leave a trace.
+func (s *Server) auditAdminRead(r *http.Request, clientID, action, entity, entityID string, n int) {
+	p := PrincipalFrom(r.Context())
+	s.Store.Audit(r.Context(), AuditEntry{
+		ClientID: clientID, ActorID: p.UserID, ActorKind: "admin",
+		Action: action, Entity: entity, EntityID: entityID,
+		Detail: map[string]any{"path": r.URL.Path, "rows": n},
+	})
+}

server/internal/api/handlers_cameras.go

@@ -21,7 +21,13 @@ const snapshotTTL = 5 * time.Minute
 
 func (s *Server) handleCameras(w http.ResponseWriter, r *http.Request) {
 	p := PrincipalFrom(r.Context())
-	siteID := trim(r.URL.Query().Get("site_id"))
+	// siteParam, not Query().Get("site_id"): every other filtered endpoint
+	// takes both spellings, and this one took only the longer. `?site=chennai`
+	// was therefore not a filter but an unknown parameter, silently ignored -
+	// so a caller asking for one shop's cameras was handed the whole tenant's.
+	// Measured: it made a script skip creating cameras for three shops because
+	// another shop's already existed, and deleted a camera from the wrong shop.
+	siteID := siteParam(r)
 	if siteID != "" {
 		var ok bool
 		if siteID, ok = s.resolveSiteFilter(w, r, siteID); !ok {

server/internal/api/handlers_customers.go

@@ -0,0 +1,134 @@
+// Registering a customer nobody has photographed, and joining two records
+// that are one person.
+//
+// They ship together because the first creates the need for the second. A
+// customer typed in at a counter has no face template, so when a camera later
+// sees that person the matcher has nothing to compare against and enrols them
+// as somebody new. That is the design working, not failing - and it means
+// every hand-created customer is a duplicate waiting to happen. The merge is
+// the way back, and without it this pair of endpoints would manufacture
+// unrecoverable duplicates.
+package api
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// handleCreateCustomer is staff and above - the same bar as filling in a
+// profile, because that is what this is: a profile that arrives before the
+// face rather than after it.
+func (s *Server) handleCreateCustomer(w http.ResponseWriter, r *http.Request) {
+	p := PrincipalFrom(r.Context())
+	if !p.CanWriteProfiles() {
+		writeErr(w, http.StatusForbidden, "forbidden",
+			"Staff and above can add a customer.")
+		return
+	}
+
+	var in Profile
+	if err := decode(w, r, &in); err != nil {
+		badRequest(w, err.Error())
+		return
+	}
+	in.FullName = clip(trim(in.FullName), 200)
+	in.Phone = clip(trim(in.Phone), 40)
+	in.Email = clip(trim(in.Email), 200)
+	in.Gender = clip(trim(in.Gender), 40)
+	in.Notes = clip(trim(in.Notes), 2000)
+
+	// Something has to identify them to a human. A record with no name and no
+	// phone is a number nobody can search for, and the customer standing at
+	// the counter is the only source of either.
+	if in.FullName == "" && in.Phone == "" {
+		badRequest(w, "give at least a name or a phone number")
+		return
+	}
+
+	out, err := s.Store.CreateCustomer(r.Context(), p.ClientID, in, p.UserID)
+	if err != nil {
+		s.serverError(w, "create customer", err)
+		return
+	}
+
+	s.Store.Audit(r.Context(), AuditEntry{
+		ClientID: p.ClientID, ActorID: p.UserID, ActorKind: "user",
+		Action: "customer.create", Entity: "visitor", EntityID: out.ID,
+		Detail: map[string]any{"ref": out.Ref},
+	})
+	writeJSON(w, http.StatusCreated, out)
+}
+
+// handleMergeCustomers folds one customer into another.
+//
+// Manager and above, not staff. This is the only irreversible operation on a
+// customer record apart from erasure: two people welded together cannot be
+// separated afterwards, because nothing records which visit came from whom.
+// The edge gallery draws the same line for the same reason.
+func (s *Server) handleMergeCustomers(w http.ResponseWriter, r *http.Request) {
+	p := PrincipalFrom(r.Context())
+	if !p.CanManageSites() {
+		writeErr(w, http.StatusForbidden, "forbidden",
+			"Merging two customers cannot be undone; a manager or owner must do it.")
+		return
+	}
+
+	source, ok := s.resolveVisitor(w, r, r.PathValue("id"))
+	if !ok {
+		return
+	}
+	var in MergeRequest
+	if err := decode(w, r, &in); err != nil {
+		badRequest(w, err.Error())
+		return
+	}
+	if trim(in.Into) == "" {
+		badRequest(w, `"into" must name the customer to keep`)
+		return
+	}
+	// Resolved through the same path, so "into" accepts V-42 as well as a
+	// uuid - the reference staff actually read off a screen.
+	target, err := s.visitorIDFor(r.Context(), p.ClientID, trim(in.Into))
+	if err != nil {
+		s.serverError(w, "resolve customer", err)
+		return
+	}
+	if target == "" {
+		writeErr(w, http.StatusNotFound, "not_found", "No such customer to merge into.")
+		return
+	}
+
+	out, err := s.Store.MergeVisitors(r.Context(), p.ClientID, source, target)
+	switch {
+	case errors.Is(err, ErrSameVisitor):
+		badRequest(w, "that is the same customer")
+		return
+	case errors.Is(err, pgx.ErrNoRows):
+		// One of the two is gone, erased, or another tenant's. All three read
+		// as absent; which one it is only helps somebody probing ids.
+		writeErr(w, http.StatusNotFound, "not_found", "No such customer.")
+		return
+	case err != nil:
+		s.serverError(w, "merge customers", err)
+		return
+	}
+
+	// Irreversible, so it leaves a trace at WARNING as well as in the audit
+	// log - the same rule the edge gallery's merge follows.
+	s.logf("WARNING merge: customer %s (%s) folded into %s (%s) by %s: "+
+		"%d visits, %d purchases, %d templates moved",
+		source, out.RetiredRef, out.VisitorID, out.Ref, p.Email,
+		out.Visits, out.Purchases, out.Embeddings)
+	s.Store.Audit(r.Context(), AuditEntry{
+		ClientID: p.ClientID, ActorID: p.UserID, ActorKind: "user",
+		Action: "customer.merge", Entity: "visitor", EntityID: out.VisitorID,
+		Detail: map[string]any{
+			"retired_ref": out.RetiredRef, "kept_ref": out.Ref,
+			"visits": out.Visits, "purchases": out.Purchases,
+			"embeddings": out.Embeddings,
+		},
+	})
+	writeJSON(w, http.StatusOK, out)
+}

server/internal/api/handlers_password.go

@@ -0,0 +1,92 @@
+// Changing your own password.
+//
+// This did not exist, and the cost of that was measured rather than guessed:
+// rotating three production accounts took a shell on the server, three round
+// trips, and briefly left a PLATFORM ADMIN - the account that reads every
+// company on the estate - with a password anyone watching could guess, because
+// a placeholder in a pasted command was taken literally.
+//
+// A manager could always reset somebody ELSE's password, and a platform admin
+// could be reset by nobody at all: they have no client, so the team routes are
+// not theirs, and `provision user` on the host was the only way. For a product
+// that puts accounts on shop-floor PCs and staff phones, "change my password"
+// is not a feature, it is the thing that makes every other credential decision
+// recoverable.
+package api
+
+import (
+	"net/http"
+
+	"github.com/loyaly/behavision-server/internal/auth"
+)
+
+// handleChangePassword is on `authed`, NOT `tenantOnly`.
+//
+// A session is not a company's data. A platform admin has no client and must
+// still be able to change their own password - they are precisely the account
+// for which there was no other route.
+func (s *Server) handleChangePassword(w http.ResponseWriter, r *http.Request) {
+	p := PrincipalFrom(r.Context())
+
+	var in ChangePassword
+	if err := decode(w, r, &in); err != nil {
+		badRequest(w, err.Error())
+		return
+	}
+
+	// The CURRENT password is required, and that is the whole security
+	// argument. An access token lives twelve hours and travels on shop-floor
+	// devices; without this, anyone holding a stolen one could set a new
+	// password and own the account permanently rather than for the rest of
+	// the day.
+	rec, err := s.Store.UserByEmail(r.Context(), p.Email)
+	if err != nil {
+		s.serverError(w, "change password", err)
+		return
+	}
+	if !rec.Found || !auth.VerifyPassword(rec.PasswordHash, in.CurrentPassword) {
+		// Deliberately not throttled separately: this needs a live session, so
+		// it is not reachable by anyone guessing from outside, and the login
+		// throttle already governs getting one.
+		writeErr(w, http.StatusForbidden, "wrong_password",
+			"That is not your current password.")
+		return
+	}
+	if in.CurrentPassword == in.NewPassword {
+		badRequest(w, "the new password is the same as the old one")
+		return
+	}
+
+	hash, err := auth.HashPassword(in.NewPassword)
+	if err != nil {
+		// HashPassword enforces the length floor, and its message names it.
+		badRequest(w, err.Error())
+		return
+	}
+	if err := s.Store.SetUserPassword(r.Context(), p.UserID, hash); err != nil {
+		s.serverError(w, "change password", err)
+		return
+	}
+
+	// Every OTHER session goes, and the caller's stays. Somebody changing
+	// their password because they think it is known must not have to guess
+	// whether the change took effect on the device that already had it - and
+	// must not be signed out of the one in their hand while they deal with it.
+	revoked, err := s.Store.RevokeOtherSessions(r.Context(), p.UserID, p.SessionID)
+	if err != nil {
+		// The password IS changed. Reporting a failure here would tell the
+		// user to try again, and the retry would fail on the current password
+		// they just replaced.
+		s.logf("change password: revoke other sessions: %v", err)
+	}
+
+	s.Store.Audit(r.Context(), AuditEntry{
+		ClientID: p.ClientID, ActorID: p.UserID, ActorKind: "user",
+		Action: "auth.change_password", Entity: "user", EntityID: p.UserID,
+		Detail: map[string]any{"sessions_revoked": revoked},
+	})
+	writeJSON(w, http.StatusOK, map[string]any{
+		"changed":          true,
+		"sessions_revoked": revoked,
+	})
+}

server/internal/api/handlers_sales.go

@@ -0,0 +1,131 @@
+// Sales a person can read, and the merchant home screen.
+//
+// Both are reads over data the server already holds. Nothing here computes a
+// number a report does not already compute: where a figure exists behind
+// /api/reports it is asked for rather than re-derived, because two definitions
+// of "unique visitor" or of "online" drift, and the screen that disagrees with
+// the report it links to is the one nobody trusts afterwards.
+package api
+
+import (
+	"net/http"
+	"time"
+)
+
+func (s *Server) handleSales(w http.ResponseWriter, r *http.Request) {
+	// Same window, same site parameter, same parsing as every report. `site`
+	// and `site_id` are both accepted, and an unknown one is a 400 rather than
+	// being silently ignored - an ignored filter returns the whole estate,
+	// which is a wrong number nobody would question.
+	rq, err := s.reportQuery(r)
+	if err != nil {
+		badRequest(w, err.Error())
+		return
+	}
+	q := SaleQuery{
+		ClientID: rq.ClientID, SiteID: rq.SiteID,
+		From: rq.From, To: rq.To,
+		Limit: queryInt(r, "limit", 50, 200),
+	}
+	if raw := trim(r.URL.Query().Get("customer")); raw != "" {
+		// A customer may be named by uuid or by "V-42", the reference the
+		// product actually shows people.
+		id, err := s.visitorIDFor(r.Context(), rq.ClientID, raw)
+		if err != nil {
+			s.serverError(w, "resolve customer", err)
+			return
+		}
+		if id == "" {
+			badRequest(w, "no customer called "+raw)
+			return
+		}
+		q.VisitorID = id
+	}
+
+	rows, err := s.Store.Sales(r.Context(), q)
+	if err != nil {
+		s.serverError(w, "sales", err)
+		return
+	}
+	if rows == nil {
+		rows = []Sale{}
+	}
+	writeJSON(w, http.StatusOK, rows)
+}
+
+func (s *Server) handleSale(w http.ResponseWriter, r *http.Request) {
+	p := PrincipalFrom(r.Context())
+	sale, err := s.Store.Sale(r.Context(), p.ClientID, r.PathValue("id"))
+	if err != nil {
+		s.serverError(w, "sale", err)
+		return
+	}
+	if sale.ID == "" {
+		// Another tenant's sale reads as absent, never as forbidden.
+		writeErr(w, http.StatusNotFound, "not_found", "No such sale.")
+		return
+	}
+	writeJSON(w, http.StatusOK, sale)
+}
+
+// handleDashboard is the merchant home screen in one request.
+//
+// It existed as four calls a client had to make and then combine, which is how
+// the desktop Footfall screen once computed its headline by adding the daily
+// bars up - silently too high, because a customer who came twice is one person
+// and two bucket-visitors. The combining happens here, against the same
+// functions the reports use.
+func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
+	rq, err := s.reportQuery(r)
+	if err != nil {
+		badRequest(w, err.Error())
+		return
+	}
+	// Today, in the shop's own timezone. A dashboard that says "today" and
+	// means UTC is wrong by five and a half hours in the one market this
+	// currently ships to.
+	loc, lerr := time.LoadLocation(rq.Timezone)
+	if lerr != nil {
+		loc = time.UTC
+	}
+	now := s.now().In(loc)
+	rq.From = time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, loc)
+	rq.To = rq.From.AddDate(0, 0, 1)
+	rq.Bucket = "day"
+
+	_, totals, err := s.Store.Footfall(r.Context(), rq)
+	if err != nil {
+		s.serverError(w, "dashboard footfall", err)
+		return
+	}
+	sites, err := s.Store.SiteHealth(r.Context(), rq.ClientID)
+	if err != nil {
+		s.serverError(w, "dashboard sites", err)
+		return
+	}
+
+	out := DashboardSummary{
+		Date:     rq.From.Format("2006-01-02"),
+		Visitors: totals.UniqueVisitors,
+		Visits:   totals.Visits,
+		// Carried from the report rather than recomputed: the share of faces
+		// too poor to enrol is what says whether the count above is a number
+		// or a floor, and it has to travel with it.
+		FractionBelowGate: totals.FractionBelowGate,
+		WorstSite:         totals.WorstSite,
+		Timezone:          rq.Timezone,
+	}
+	for _, site := range sites {
+		// One shop asked for narrows the tally to it; otherwise the estate.
+		if rq.SiteID != "" && site.SiteID != rq.SiteID {
+			continue
+		}
+		out.SitesTotal++
+		if site.Online {
+			out.SitesOnline++
+		}
+		out.CamerasTotal += site.CamerasTotal
+		out.CamerasUp += site.CamerasUp
+	}
+	writeJSON(w, http.StatusOK, out)
+}

server/internal/api/password_test.go

@@ -0,0 +1,115 @@
+package api
+
+import (
+	"net/http"
+	"testing"
+)
+
+const pwPath = "/api/auth/password"
+
+// loginCode signs in and returns only the status. The suite's login() fatals
+// on anything but 200, which is right everywhere else and useless here: half
+// of what these tests assert is that a password has STOPPED working.
+func loginCode(t *testing.T, s *Server, email, password string) int {
+	t.Helper()
+	return do(t, s, "POST", "/api/auth/login", "",
+		map[string]string{"email": email, "password": password}).Code
+}
+
+// The account this endpoint exists for. A platform admin has no company, so
+// the team routes are not theirs and tenantOnly refuses them - before this,
+// changing their password needed a shell on the production host.
+func TestAPlatformAdminCanChangeTheirOwnPassword(t *testing.T) {
+	s, fs := newServer(t)
+	seedPlatformAdmin(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	rec := do(t, s, "POST", pwPath, sess.Token, map[string]string{
+		"current_password": "admin123", "new_password": "a-much-longer-one",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	// The new one works and the old one does not - asserted by signing in,
+	// because that is the only thing a user actually cares about here.
+	if c := loginCode(t, s, "root@loyaly.ai", "a-much-longer-one"); c != http.StatusOK {
+		t.Errorf("new password signs in: got %d, want 200", c)
+	}
+	if c := loginCode(t, s, "root@loyaly.ai", "admin123"); c == http.StatusOK {
+		t.Error("the old password still signs in")
+	}
+}
+
+func TestAnOrdinaryUserCanChangeTheirOwnPassword(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", pwPath, sess.Token, map[string]string{
+		"current_password": "correct horse battery", "new_password": "staple-battery-horse",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// The whole security argument. An access token lives twelve hours and travels
+// on shop-floor PCs and staff phones; without this, a stolen one owns the
+// account permanently instead of until it expires.
+func TestChangingAPasswordRequiresTheCurrentOne(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", pwPath, sess.Token, map[string]string{
+		"current_password": "not the password", "new_password": "a-much-longer-one",
+	})
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("got %d, want 403 - a token alone must not be enough: %s",
+			rec.Code, rec.Body.String())
+	}
+	// And it must not have changed anything.
+	if c := loginCode(t, s, "manager@acme.com", "correct horse battery"); c != http.StatusOK {
+		t.Errorf("a refused change must leave the old password working: got %d", c)
+	}
+}
+
+// The floor lives in HashPassword, so this asserts the endpoint routes through
+// it rather than re-implementing a check that could drift from the constant.
+func TestAShortNewPasswordIsRefused(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", pwPath, sess.Token, map[string]string{
+		"current_password": "correct horse battery", "new_password": "short",
+	})
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("got %d, want 400 for a password under the floor", rec.Code)
+	}
+}
+
+func TestReusingTheSamePasswordIsRefused(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "POST", pwPath, sess.Token, map[string]string{
+		"current_password": "correct horse battery",
+		"new_password":     "correct horse battery",
+	})
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("got %d, want 400 - a no-op change reads as success and is not", rec.Code)
+	}
+}
+
+func TestChangingAPasswordNeedsASession(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	rec := do(t, s, "POST", pwPath, "", map[string]string{
+		"current_password": "correct horse battery", "new_password": "a-much-longer-one",
+	})
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("got %d, want 401", rec.Code)
+	}
+}

server/internal/api/refs.go

@@ -47,6 +47,20 @@ func VisitorRef(number int64) string {
 	return VisitorRefPrefix + strconv.FormatInt(number, 10)
 }
 
+// VisitRefPrefix marks a visit reference. "#" rather than a letter because a
+// visit is a numbered event, not a named thing, and it reads correctly in a
+// sentence: "visit #1042 at chennai".
+const VisitRefPrefix = "#"
+
+// VisitRef is what a person quotes for one visit. Empty for a visit recorded
+// before 014, which had no number - absent rather than wrong.
+func VisitRef(number int64) string {
+	if number <= 0 {
+		return ""
+	}
+	return VisitRefPrefix + strconv.FormatInt(number, 10)
+}
+
 // ParseVisitorRef accepts "V-42", "v-42" and bare "42".
 //
 // Bare digits are accepted because a shop assistant reading a number off a

server/internal/api/refs_test.go

@@ -140,3 +140,18 @@ func TestAnArrivalCarriesTheShopReferenceItCanBeFilteredBy(t *testing.T) {
 		t.Fatalf("the platform-wide visit counter leaked into the feed: %s", body)
 	}
 }
+
+// A visit reference is what a person quotes; the uuid is what a machine
+// de-duplicates on. Both travel, neither replaces the other.
+func TestVisitRefIsReadableAndAbsentWhenUnnumbered(t *testing.T) {
+	if got := VisitRef(1042); got != "#1042" {
+		t.Errorf("VisitRef(1042) = %q, want #1042", got)
+	}
+	// Visits recorded before 014 have no number. Absent, never "#0" - a
+	// reference that looks real and is not is worse than none.
+	for _, n := range []int64{0, -1} {
+		if got := VisitRef(n); got != "" {
+			t.Errorf("VisitRef(%d) = %q, want empty", n, got)
+		}
+	}
+}

server/internal/api/sales_test.go

@@ -0,0 +1,195 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func seedSales(fs *fakeStore) {
+	seedUser(fs)
+	fs.salesRows = []Sale{
+		{ID: "s1", OccurredAt: "2026-09-20T10:00:00Z", SiteID: siteA, Site: "Chennai",
+			Amount: 1499.50, Currency: "INR", VisitorID: "v1", VisitorRef: "V-42",
+			VisitorLabel: "Visitor 42", Items: []string{"shirt"}, Source: "manual"},
+		{ID: "s2", OccurredAt: "2026-09-19T10:00:00Z", SiteID: "other-site",
+			Amount: 200, Currency: "INR", Items: []string{}, Source: "pos"},
+	}
+	fs.saleOwner = map[string]string{"s1": "client-acme", "s2": "client-acme"}
+}
+
+func TestSalesListsRowsTheConversionReportOnlySummed(t *testing.T) {
+	s, fs := newServer(t)
+	seedSales(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/sales", sess.Token, nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var out []Sale
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if len(out) != 2 {
+		t.Fatalf("got %d sales, want 2", len(out))
+	}
+	// The reference the product shows people, not just the uuid.
+	if out[0].VisitorRef != "V-42" {
+		t.Errorf("visitor_ref %q, want the speakable reference", out[0].VisitorRef)
+	}
+}
+
+// A sale with no customer is an ordinary walk-in nobody identified, and it is
+// still revenue. Joining it away would make this list disagree with the
+// conversion report computed over the same table.
+func TestASaleWithNoCustomerIsStillListed(t *testing.T) {
+	s, fs := newServer(t)
+	seedSales(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/sales", sess.Token, nil)
+	var out []Sale
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	found := false
+	for _, sale := range out {
+		if sale.ID == "s2" && sale.VisitorID == "" {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("a sale with no visitor must still appear: %s", rec.Body.String())
+	}
+}
+
+// An empty basket must serialise as [] and not null, or a client mapping over
+// it breaks on the first sale recorded without one.
+func TestEmptyItemsSerialiseAsAnArray(t *testing.T) {
+	s, fs := newServer(t)
+	seedSales(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/sales", sess.Token, nil)
+	if strings.Contains(rec.Body.String(), `"items":null`) {
+		t.Errorf("items must be [] and never null: %s", rec.Body.String())
+	}
+}
+
+// The hazard this API has already been bitten by: an unknown query parameter
+// is silently ignored, so a mistyped filter returns the whole estate.
+func TestAnUnknownShopFilterIsRefusedRatherThanIgnored(t *testing.T) {
+	s, fs := newServer(t)
+	seedSales(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/sales?site=nowhere", sess.Token, nil)
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("got %d, want 400 - silently returning every shop's sales is "+
+			"a wrong number nobody would question: %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestSalesCanBeNarrowedToOneCustomerByReference(t *testing.T) {
+	s, fs := newServer(t)
+	seedSales(fs)
+	fs.visitors = []Customer{{ID: "v1", Ref: "V-42", Label: "Visitor 42"}}
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/sales?customer=V-42", sess.Token, nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	if fs.lastSaleQuery.VisitorID != "v1" {
+		t.Errorf("resolved customer %q, want the uuid behind V-42",
+			fs.lastSaleQuery.VisitorID)
+	}
+}
+
+func TestAnotherTenantsSaleIs404(t *testing.T) {
+	s, fs := newServer(t)
+	seedSales(fs)
+	fs.saleOwner["s1"] = "client-rival"
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/sales/s1", sess.Token, nil)
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("got %d, want 404 for another tenant's sale", rec.Code)
+	}
+}
+
+// ------------------------------------------------------------- dashboard
+
+// The headline must be the server's own unique-visitor figure, never the sum
+// of the buckets: a customer who came twice is one person and two
+// bucket-visitors, and adding the bars up is silently too high.
+func TestDashboardReportsUniquePeopleAndVisitsSeparately(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	fs.totals = Totals{UniqueVisitors: 7, Visits: 19,
+		FractionBelowGate: 0.59, WorstSite: "TeNext Coimbatore"}
+	fs.sites = []SiteHealth{
+		{SiteID: siteA, Name: "Chennai", Online: true, CamerasUp: 1, CamerasTotal: 2},
+		{SiteID: "s2", Name: "Mumbai", Online: false, CamerasUp: 0, CamerasTotal: 1},
+	}
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/dashboard/summary", sess.Token, nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var out DashboardSummary
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if out.Visitors != 7 || out.Visits != 19 {
+		t.Errorf("got %d people / %d visits, want 7 and 19 reported separately",
+			out.Visitors, out.Visits)
+	}
+	if out.SitesTotal != 2 || out.SitesOnline != 1 {
+		t.Errorf("sites %d/%d, want 1 of 2 online", out.SitesOnline, out.SitesTotal)
+	}
+	if out.CamerasTotal != 3 || out.CamerasUp != 1 {
+		t.Errorf("cameras %d/%d, want 1 of 3", out.CamerasUp, out.CamerasTotal)
+	}
+}
+
+// The share of faces too poor to enrol is what says whether the headcount above
+// is a number or a floor. It has to travel with it, on this screen too.
+func TestDashboardCarriesTheConfidenceWithTheCount(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	fs.totals = Totals{UniqueVisitors: 7, Visits: 19,
+		FractionBelowGate: 0.59, WorstSite: "TeNext Coimbatore"}
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/dashboard/summary", sess.Token, nil)
+	var out DashboardSummary
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	if out.FractionBelowGate != 0.59 || out.WorstSite == "" {
+		t.Errorf("a headcount without its confidence is the thing this product "+
+			"exists not to ship: %+v", out)
+	}
+}
+
+// "Today" means the shop's day. In the one market this ships to, UTC is five
+// and a half hours wrong.
+func TestDashboardCutsTodayInTheRequestedTimezone(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	rec := do(t, s, "GET", "/api/dashboard/summary?tz=Asia/Kolkata", sess.Token, nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var out DashboardSummary
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	if out.Timezone != "Asia/Kolkata" {
+		t.Errorf("timezone %q, want the one asked for so the client can label it",
+			out.Timezone)
+	}
+	if fs.lastReport.From.Hour() != 0 {
+		t.Errorf("the window must start at local midnight, got %v", fs.lastReport.From)
+	}
+}

server/internal/api/sitefilter_test.go

@@ -0,0 +1,61 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+)
+
+// Every endpoint that narrows by shop must accept BOTH spellings, because an
+// unknown query parameter is silently ignored - so the wrong one is not an
+// error, it is the whole estate returned as though it were one shop. That is a
+// wrong answer nobody would question, and it has already caused a camera to be
+// deleted from the wrong shop.
+func TestEveryShopFilterAcceptsBothSpellings(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	fs.sites = []SiteHealth{
+		{SiteID: siteA, Slug: "chennai", Name: "TeNext Coimbatore"},
+		{SiteID: "site-other", Slug: "other-shop", Name: "Other Shop"},
+	}
+	fs.cameras = []Camera{
+		{ID: "c1", SiteID: siteA, CameraID: "entrance"},
+		{ID: "c2", SiteID: "site-other", CameraID: "backdoor"},
+	}
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	for _, path := range []string{
+		"/api/cameras?site=chennai",
+		"/api/cameras?site_id=" + siteA,
+	} {
+		rec := do(t, s, "GET", path, sess.Token, nil)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s: got %d: %s", path, rec.Code, rec.Body.String())
+		}
+		var got []Camera
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+			t.Fatalf("%s: %v", path, err)
+		}
+		if len(got) != 1 || got[0].CameraID != "entrance" {
+			t.Errorf("%s returned %d cameras %v - a shop filter that does not filter hands back the whole tenant",
+				path, len(got), names(got))
+		}
+	}
+
+	// And with no filter at all, the tenant's cameras - which is the only case
+	// that should ever return more than one shop's.
+	rec := do(t, s, "GET", "/api/cameras", sess.Token, nil)
+	var all []Camera
+	_ = json.Unmarshal(rec.Body.Bytes(), &all)
+	if len(all) != 2 {
+		t.Errorf("unfiltered list returned %d, want 2", len(all))
+	}
+}
+
+func names(cams []Camera) []string {
+	out := make([]string, 0, len(cams))
+	for _, c := range cams {
+		out = append(out, c.CameraID)
+	}
+	return out
+}

server/internal/api/sites_test.go

@@ -108,3 +108,22 @@ func TestNoBrokerConfiguredSaysSo(t *testing.T) {
 		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
 	}
 }
+
+func TestAManagerRenamesAShopButTheSlugStays(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	seedSite(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+	rec := do(t, s, "PATCH", "/api/sites/chennai", sess.Token, map[string]any{"name": "TeNext Coimbatore"})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var out SiteHealth
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	if out.Name != "TeNext Coimbatore" || out.Slug != "chennai" {
+		t.Fatalf("renamed wrong: %+v", out)
+	}
+	if rec := do(t, s, "PATCH", "/api/sites/chennai", sess.Token, map[string]any{"timezone": "Mars/Olympus"}); rec.Code != http.StatusBadRequest {
+		t.Fatalf("bad timezone accepted: %d", rec.Code)
+	}
+}

server/internal/api/tenant_guard_test.go

@@ -0,0 +1,68 @@
+package api
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// A platform admin has no client, and every tenant query scopes on one. Before
+// this guard the empty string reached Postgres as `client_id = ”::uuid`,
+// which is a cast ERROR and not an empty result - so five live endpoints
+// answered 500 to a signed-in platform admin. Found by calling them, not by a
+// test: the in-memory fake compares strings and is perfectly happy with "".
+func TestATenantRouteRefusesAnAccountWithNoCompany(t *testing.T) {
+	s, fs := newServer(t)
+	seedPlatformAdmin(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	for _, path := range []string{
+		"/api/visits", "/api/cameras", "/api/sites", "/api/visitors",
+		"/api/reports/footfall", "/api/sales", "/api/dashboard/summary",
+	} {
+		rec := do(t, s, "GET", path, sess.Token, nil)
+		if rec.Code != http.StatusForbidden {
+			t.Errorf("%s: got %d, want 403 - a platform admin reads a company's "+
+				"data through /api/admin, and a 500 here reads as a broken "+
+				"server rather than a wrong door", path, rec.Code)
+		}
+		// The message has to say where to go instead; "forbidden" alone sends
+		// somebody hunting a permissions problem that does not exist.
+		if !strings.Contains(rec.Body.String(), "/api/admin") {
+			t.Errorf("%s: refusal should point at the admin routes: %s",
+				path, rec.Body.String())
+		}
+	}
+}
+
+// The guard must not lock a platform admin out of their own session, which is
+// not a company's data and is how they sign out or revoke a lost device.
+func TestAPlatformAdminKeepsTheirOwnSessionRoutes(t *testing.T) {
+	s, fs := newServer(t)
+	seedPlatformAdmin(fs)
+	sess := login(t, s, "root@loyaly.ai", "admin123")
+
+	for _, path := range []string{"/api/auth/me", "/api/auth/sessions"} {
+		if rec := do(t, s, "GET", path, sess.Token, nil); rec.Code != http.StatusOK {
+			t.Errorf("%s: got %d, want 200", path, rec.Code)
+		}
+	}
+}
+
+// And the ordinary case must be untouched: a tenant user still reaches
+// everything they always did.
+func TestATenantUserIsUnaffectedByTheGuard(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+
+	for _, path := range []string{
+		"/api/visits", "/api/cameras", "/api/sites", "/api/visitors",
+		"/api/sales", "/api/dashboard/summary",
+	} {
+		if rec := do(t, s, "GET", path, sess.Token, nil); rec.Code != http.StatusOK {
+			t.Errorf("%s: got %d, want 200 for an ordinary tenant account: %s",
+				path, rec.Code, rec.Body.String())
+		}
+	}
+}

server/internal/api/types.go

@@ -108,6 +108,104 @@ type SalesReport struct {
 	Currency   string  `json:"currency"`
 }
 
+// Sale is one recorded purchase, as a list shows it.
+//
+// The conversion report has always AGGREGATED this table; nothing could read a
+// row of it. "Revenue was 41,000 this week" and "which sales were those" are
+// different questions, and only the second can be checked against a till.
+//
+// Amount is a float here to match SalesReport.Revenue, and the column behind
+// it is numeric(14,2) precisely so the arithmetic never happens in a float.
+// Fourteen digits fits inside float64's exact-integer range, so the value
+// survives the trip; any SUM still happens in Postgres.
+type Sale struct {
+	ID         string  `json:"id"`
+	OccurredAt string  `json:"occurred_at"`
+	SiteID     string  `json:"site_id"`
+	Site       string  `json:"site,omitempty"`
+	SiteSlug   string  `json:"site_slug,omitempty"`
+	Amount     float64 `json:"amount"`
+	Currency   string  `json:"currency"`
+
+	// Who bought, when the till knew. A sale with no visitor is ordinary - a
+	// walk-in nobody identified - and it is still revenue, so it is listed
+	// rather than joined away.
+	VisitorID    string `json:"visitor_id,omitempty"`
+	VisitorRef   string `json:"visitor_ref,omitempty"`
+	VisitorLabel string `json:"visitor_label,omitempty"`
+	VisitID      string `json:"visit_id,omitempty"`
+
+	Items       []string `json:"items"`
+	Source      string   `json:"source"`
+	ExternalRef string   `json:"external_ref,omitempty"`
+}
+
+// SaleQuery narrows a sales list. It reuses the report window, so `from`,
+// `to`, `site` and `site_id` mean here exactly what they mean on a report -
+// getting that wrong silently returns the whole estate, which this API has
+// already been bitten by once.
+type SaleQuery struct {
+	ClientID  string
+	SiteID    string
+	VisitorID string
+	From      time.Time
+	To        time.Time
+	Limit     int
+}
+
+// DashboardSummary is the merchant home screen in one call.
+//
+// Composed from the two functions that already answer these questions rather
+// than from new SQL: a second definition of "online" or of a unique visitor
+// would drift from the reports, and a home screen that disagrees with the
+// report it links to is worse than no home screen.
+type DashboardSummary struct {
+	Date              string  `json:"date"`
+	Visitors          int     `json:"visitors"`
+	Visits            int     `json:"visits"`
+	SitesTotal        int     `json:"sites_total"`
+	SitesOnline       int     `json:"sites_online"`
+	CamerasTotal      int     `json:"cameras_total"`
+	CamerasUp         int     `json:"cameras_up"`
+	FractionBelowGate float64 `json:"fraction_below_gate"`
+	WorstSite         string  `json:"worst_site,omitempty"`
+	Timezone          string  `json:"timezone"`
+}
+
+// ChangePassword is the body of POST /api/auth/password. The current password
+// is required: an access token alone must not be enough to take an account
+// over permanently.
+type ChangePassword struct {
+	CurrentPassword string `json:"current_password"`
+	NewPassword     string `json:"new_password"`
+}
+
+// MergeResult says what moved, so an operator sees the size of a thing that
+// cannot be undone rather than a bare "ok".
+type MergeResult struct {
+	VisitorID  string `json:"visitor_id"`
+	Ref        string `json:"ref"`
+	Label      string `json:"label"`
+	Visits     int    `json:"visits"`
+	Purchases  int    `json:"purchases"`
+	Embeddings int    `json:"embeddings"`
+	Consents   int    `json:"consents"`
+	// RetiredRef is the reference that has STOPPED resolving. Staff write
+	// these on cards and read them aloud, so a merge has to say which one
+	// died rather than leaving somebody to discover it at a counter.
+	RetiredRef string `json:"retired_ref"`
+	// Discarded lists profile values the survivor already had a different
+	// answer for - a second phone number, a different spelling of a name.
+	// They are appended to the survivor's notes as well: this response is
+	// read once and the record is read forever.
+	Discarded []string `json:"discarded,omitempty"`
+}
+
+// MergeRequest names the record to keep.
+type MergeRequest struct {
+	Into string `json:"into"`
+}
+
 type Customer struct {
 	ID string `json:"id"`
 	// Ref is the customer number - "V-42" - and is accepted anywhere this
@@ -134,6 +232,21 @@ type VisitRow struct {
 	Similarity float64        `json:"similarity,omitempty"`
 	Quality    float64        `json:"quality,omitempty"`
 	Attributes map[string]any `json:"attributes,omitempty"`
+
+	// What they bought on that visit, if anything. Attached here because
+	// "when was this customer last in" and "did they buy" are one question
+	// staff ask in one breath, and answering it used to mean two calls and a
+	// join in the client.
+	//
+	// Spend and Currency are omitted when a single visit somehow holds more
+	// than one currency: adding rupees to dollars produces something that
+	// looks like money and is not, and Purchases still says a sale happened.
+	// A purchase with no visit_id is not here at all - it belongs to the
+	// customer rather than to a moment - and is listed by
+	// GET /api/sales?customer=V-42.
+	Purchases int     `json:"purchases,omitempty"`
+	Spend     float64 `json:"spend,omitempty"`
+	Currency  string  `json:"currency,omitempty"`
 }
 
 type Profile struct {
@@ -184,6 +297,13 @@ type NewSite struct {
 	Password string `json:"-"`
 }
 
+// SiteUpdate is the editable part of a shop. Both optional; an absent field
+// is left alone.
+type SiteUpdate struct {
+	Name     *string `json:"name,omitempty"`
+	Timezone *string `json:"timezone,omitempty"`
+}
+
 type SiteHealth struct {
 	SiteID            string  `json:"site_id"`
 	Slug              string  `json:"slug"`
@@ -261,6 +381,11 @@ type AgentPrincipal struct {
 // audit log to do it.
 type Arrival struct {
 	VisitID string `json:"visit_id"`
+	// VisitRef is what a person quotes - "#1042" - per client, beside the uuid
+	// rather than instead of it. Every other thing in the product a person
+	// refers to has one: a shop is `chennai`, a camera `cam1`, a customer
+	// `V-42`. A visit had only 36 hex characters.
+	VisitRef string `json:"visit_ref,omitempty"`
 	// Seq is this visit's position in the feed - assigned by the server when it
 	// learned of the visit, not by the camera. It drives the cursor and the
 	// ordering, and it is `json:"-"` on purpose.
@@ -422,6 +547,71 @@ type ClientRow struct {
 	CreatedAt string `json:"created_at"`
 }
 
+// ClientDetail is one merchant for the platform-admin console: the list row
+// plus the owner, which is who a support conversation actually starts with.
+type ClientDetail struct {
+	ClientRow
+	OwnerEmail string `json:"owner_email,omitempty"`
+	OwnerName  string `json:"owner_name,omitempty"`
+}
+
+// PlatformSummary is the estate-wide header strip. Counts only.
+type PlatformSummary struct {
+	CamerasTotal    int    `json:"cameras_total"`
+	CamerasOnline   int    `json:"cameras_online"`
+	MerchantsActive int    `json:"merchants_active"`
+	SitesTotal      int    `json:"sites_total"`
+	EventsToday     int    `json:"events_today"`
+	AsOf            string `json:"as_of"`
+}
+
+// AdminCamera is a camera as a PLATFORM ADMIN may see it, and it is a separate
+// type from Camera for the same reason AgentCamera is.
+//
+// It carries no host, port, path, username or has_password. A tenant seeing
+// those for their own camera is correct - it is their camera and their form
+// edits it. A platform admin browsing another company's estate is a different
+// question, and an RTSP host with a username beside it is most of a live path
+// into a customer's camera. Blanking fields on a shared struct would leave
+// "remember to redact, on every path, forever" as the only thing preventing a
+// leak; a type that cannot express them cannot forget.
+type AdminCamera struct {
+	ID       string `json:"id"`
+	SiteID   string `json:"site_id"`
+	Site     string `json:"site,omitempty"`
+	CameraID string `json:"camera_id"`
+	Label    string `json:"label"`
+	Enabled  bool   `json:"enabled"`
+
+	// Connected stays a POINTER: null is "no shop PC has reported on this
+	// yet", false is "not connecting", and those send an installer to two
+	// different places.
+	Connected  *bool       `json:"connected"`
+	LastSeenAt string      `json:"last_seen_at,omitempty"`
+	SnapshotAt string      `json:"snapshot_at,omitempty"`
+	Check      CameraCheck `json:"check"`
+}
+
+// adminCamera redacts one camera for the admin console.
+func adminCamera(c Camera) AdminCamera {
+	return AdminCamera{
+		ID: c.ID, SiteID: c.SiteID, Site: c.Site,
+		CameraID: c.CameraID, Label: c.Label, Enabled: c.Enabled,
+		Connected: c.Connected, LastSeenAt: c.LastSeenAt,
+		SnapshotAt: c.SnapshotAt, Check: c.Check,
+	}
+}
+
+// AdminCameras redacts a list, and returns an empty slice rather than nil so
+// the response is [] and not null.
+func AdminCameras(in []Camera) []AdminCamera {
+	out := make([]AdminCamera, 0, len(in))
+	for _, c := range in {
+		out = append(out, adminCamera(c))
+	}
+	return out
+}
+
 // ---------------------------------------------------------------- cameras
 
 // Camera is one camera as head office sees it: how it is configured, and
@@ -465,6 +655,11 @@ type Camera struct {
 	Snapshot   Image  `json:"snapshot"`
 	SnapshotAt string `json:"snapshot_at,omitempty"`
 
+	// State is the ONE answer a screen should render, because there are four
+	// of them and only three were ever expressed. See CameraState.
+	State     string `json:"state"`
+	StateNote string `json:"state_note,omitempty"`
+
 	// Check is the last attempt to prove this camera works. Always present so
 	// a client can tell "never checked" from "checked and failed" without
 	// guessing from an absent field.
@@ -772,3 +967,70 @@ type DeviceSession struct {
 	// hand.
 	Current bool `json:"current"`
 }
+
+// Camera states, and why a fourth one had to exist.
+//
+// A shop computer reports each camera's state about once a minute. When it
+// cannot reach the recognition engine it reports NOTHING - correctly, because
+// it has nothing to say - and the last value it sent stays in the database
+// unchanged. Measured on the live estate: two cameras reading **Connected**,
+// in green, thirty-four minutes after the shop computer had stopped being
+// able to see either of them, while the heartbeat from the same PC said
+// 0 of 0 cameras. Both surfaces were reading stored fields and disagreeing.
+//
+// `false` could not be the answer. It means "this camera is not connecting",
+// which sends an installer to check cabling on a camera that was working
+// perfectly the last time anybody could ask it. The honest statement is that
+// nobody currently knows - and that is a different sentence from "nobody has
+// ever told us", which is what an unreported camera needs. Two states that
+// need different actions must never share a word; the same rule that keeps
+// `artifact` apart from `no_faces` in the commissioning verdicts.
+const (
+	CameraConnected  = "connected"      // reported recently, and working
+	CameraNotConnect = "not_connecting" // reported recently, and not
+	CameraWaiting    = "waiting"        // no shop computer has ever reported
+	CameraStale      = "stale"          // reported once, and not lately
+)
+
+// CameraStaleAfter is five missed reports, not one.
+//
+// The agent reports on a 60 s tick, so one miss is a dropped packet or a slow
+// upload. Calling that stale would put a warning on a healthy estate every few
+// minutes, and an indicator that cries wolf is one people learn to ignore -
+// which is the same reasoning that makes a site offline after three missed
+// heartbeats rather than one.
+const CameraStaleAfter = 5 * time.Minute
+
+// CameraState decides the four states, and nulls Connected when it is not
+// entitled to an opinion.
+//
+// Connected is CLEARED rather than left alone on purpose. Leaving a stale true
+// in place would keep the lie available to every client that reads the field
+// directly - a mobile app, a script, an older build of our own desktop app -
+// and would leave two fields on one object disagreeing, which is precisely how
+// the shops screen once came out labelled Working in green above "2 of 3
+// cameras not connecting".
+func (c *Camera) CameraState(now time.Time) {
+	switch {
+	case c.LastSeenAt == "":
+		c.State = CameraWaiting
+		c.StateNote = "No shop computer has reported on this camera yet."
+		c.Connected = nil
+		return
+	}
+	seen, err := time.Parse(time.RFC3339, c.LastSeenAt)
+	if err != nil || now.Sub(seen) > CameraStaleAfter {
+		c.State = CameraStale
+		c.StateNote = "The shop computer has stopped reporting this camera. " +
+			"Check that the computer is on and Behavision is running on it."
+		c.Connected = nil
+		return
+	}
+	if c.Connected != nil && *c.Connected {
+		c.State = CameraConnected
+		return
+	}
+	c.State = CameraNotConnect
+	c.StateNote = "The shop computer cannot open this camera's stream. " +
+		"Check the address, the password and the cabling."
+}

server/internal/store/api_admin_clients.go

@@ -146,3 +146,15 @@ func (s *Store) DeleteEmptySite(ctx context.Context, clientID, siteID string) (s
 	}
 	return username, tx.Commit(ctx)
 }
+
+func (s *Store) UpdateSite(ctx context.Context, clientID, siteID string, in api.SiteUpdate) (api.SiteHealth, error) {
+	var out api.SiteHealth
+	err := s.pool.QueryRow(ctx, `
+		UPDATE sites
+		   SET name     = COALESCE($3, name),
+		       timezone = COALESCE($4, timezone)
+		 WHERE id = $1::uuid AND client_id = $2::uuid
+		RETURNING id::text, slug, name, timezone`, siteID, clientID, in.Name, in.Timezone).
+		Scan(&out.SiteID, &out.Slug, &out.Name, &out.Timezone)
+	return out, err
+}

server/internal/store/api_admin_monitor.go

@@ -0,0 +1,134 @@
+// Platform-admin reads BELOW the merchant level: one company, its shops, its
+// cameras, and the estate-wide totals.
+//
+// Every function here takes the merchant's client id as an ARGUMENT, because
+// the caller is a platform admin who has no client of their own. That is the
+// whole reason these exist rather than reusing the tenant handlers: those
+// derive the tenant from the session, and an admin session carries none. The
+// tenant STORE functions already take a client id explicitly, so this file
+// adds the scoping the tenant handlers get for free and nothing else.
+package store
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/loyaly/behavision-server/internal/api"
+)
+
+// ClientDetail is one merchant, with the owner a support conversation starts
+// from. ListClients cannot carry it: an owner lookup per row would be a query
+// per merchant on a screen that only needs the name.
+//
+// `c.id::text = $1`, for the same reason the two resolvers below use it, and
+// this one learned it the hard way: as `c.id = $1::uuid` it answered 500 to
+// /api/admin/clients/not-a-uuid/sites on the first real database, because
+// casting a malformed string - or the empty one a shape check hands back - to
+// uuid is an ERROR in Postgres rather than a miss. Comparing the column as
+// text cannot fail: an id that is not a uuid simply matches nothing, which is
+// the 404 a wrong URL should get. The sibling queries were already written
+// this way and correctly 404'd; only this one was not.
+func (s *Store) ClientDetail(ctx context.Context, clientID string) (api.ClientDetail, error) {
+	var c api.ClientDetail
+	var at time.Time
+	err := s.pool.QueryRow(ctx, `
+		SELECT c.id::text, c.slug, c.name, c.active, c.created_at,
+		       (SELECT count(*) FROM sites si     WHERE si.client_id = c.id),
+		       (SELECT count(*) FROM app_users au WHERE au.client_id = c.id),
+		       COALESCE((SELECT au.email     FROM app_users au
+		                  WHERE au.client_id = c.id AND au.role = 'owner'
+		                    AND au.active ORDER BY au.created_at LIMIT 1), ''),
+		       COALESCE((SELECT au.full_name FROM app_users au
+		                  WHERE au.client_id = c.id AND au.role = 'owner'
+		                    AND au.active ORDER BY au.created_at LIMIT 1), '')
+		  FROM clients c
+		 WHERE c.id::text = $1`, clientID).
+		Scan(&c.ID, &c.Slug, &c.Name, &c.Active, &at, &c.Sites, &c.Users,
+			&c.OwnerEmail, &c.OwnerName)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return api.ClientDetail{}, nil
+	}
+	if err != nil {
+		return api.ClientDetail{}, err
+	}
+	c.CreatedAt = at.UTC().Format(time.RFC3339)
+	return c, nil
+}
+
+// AdminSiteID resolves a shop reference WITHIN one merchant, by slug or uuid.
+//
+// The uuid branch is the point. The tenant resolver returns a uuid untouched
+// and lets every downstream query's `client_id = $1` do the scoping, which is
+// sound there because the client id comes from the session and cannot be
+// chosen. Here the caller names BOTH, so an unowned uuid would otherwise reach
+// a query that quietly returns nothing - an empty shop rather than "no such
+// shop". Resolving through the database with both halves is what makes a
+// broken chain a 404.
+func (s *Store) AdminSiteID(ctx context.Context, clientID, ref string) (string, error) {
+	var id string
+	// `id::text = $2`, never `id = $2::uuid`. Using one parameter as both text
+	// and uuid in the same statement is how Postgres ends up deducing two
+	// types for it and refusing the whole query - the identical shape that
+	// broke `'Visitor ' || $2::text` beside `number = $2`, which compiled,
+	// passed every in-memory test and failed on the first real database.
+	// Casting the COLUMN keeps one type per parameter, and it cannot raise an
+	// invalid-uuid error on a malformed path segment either: it simply misses,
+	// which is the 404 the caller should get anyway.
+	err := s.pool.QueryRow(ctx, `
+		SELECT id::text FROM sites
+		 WHERE client_id = $1::uuid
+		   AND (slug = $2 OR id::text = $2)`,
+		clientID, ref).Scan(&id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return "", nil
+	}
+	return id, err
+}
+
+// AdminCameraID resolves a camera within one shop of one merchant.
+//
+// All three links are checked in the one statement, so there is no ordering in
+// which a caller learns that a camera exists somewhere else.
+func (s *Store) AdminCameraID(ctx context.Context, clientID, siteID, ref string) (string, error) {
+	var id string
+	err := s.pool.QueryRow(ctx, `
+		SELECT c.id::text
+		  FROM site_cameras c
+		  JOIN sites si ON si.id = c.site_id
+		 WHERE si.client_id = $1::uuid
+		   AND c.site_id = $2::uuid
+		   AND c.deleted_at IS NULL
+		   AND (c.camera_id = $3 OR c.id::text = $3)`,
+		clientID, siteID, ref).Scan(&id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return "", nil
+	}
+	return id, err
+}
+
+// PlatformSummary is counts and nothing else.
+//
+// Deliberately not a list: it backs a header strip, and an endpoint that
+// returns every camera on the platform to render four numbers is one that gets
+// slower with every customer signed.
+func (s *Store) PlatformSummary(ctx context.Context) (api.PlatformSummary, error) {
+	var out api.PlatformSummary
+	err := s.pool.QueryRow(ctx, `
+		SELECT
+		  (SELECT count(*) FROM site_cameras WHERE deleted_at IS NULL),
+		  (SELECT count(*) FROM site_cameras
+		    WHERE deleted_at IS NULL AND connected IS TRUE),
+		  (SELECT count(*) FROM clients WHERE active),
+		  (SELECT count(*) FROM sites),
+		  (SELECT count(*) FROM visits WHERE occurred_at >= date_trunc('day', now()))
+	`).Scan(&out.CamerasTotal, &out.CamerasOnline, &out.MerchantsActive,
+		&out.SitesTotal, &out.EventsToday)
+	if err != nil {
+		return api.PlatformSummary{}, err
+	}
+	out.AsOf = time.Now().UTC().Format(time.RFC3339)
+	return out, nil
+}

server/internal/store/api_admin_monitor_live_test.go

@@ -0,0 +1,168 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// A malformed identifier must MISS, never error.
+//
+// This exists because the in-memory fake cannot catch it and did not. The API
+// fake resolves a merchant with a map lookup, so every handler test passed
+// while the real query answered 500 to /api/admin/clients/not-a-uuid/sites:
+// `c.id = $1::uuid` makes Postgres cast the path segment, and casting a
+// malformed string - or the empty one a shape check hands back in its place -
+// is an ERROR rather than no match. Comparing the column as text cannot fail.
+//
+// Kept as a live test on purpose. There is no way to assert this against a
+// fake: the property belongs to Postgres, and a fake that reproduced it would
+// be a second implementation of the thing under test.
+func TestLiveMalformedIdentifiersMissRatherThanError(t *testing.T) {
+	st := liveStore(t)
+	ctx := context.Background()
+
+	for _, id := range []string{"", "not-a-uuid", "'; DROP TABLE clients;--", "42"} {
+		c, err := st.ClientDetail(ctx, id)
+		if err != nil {
+			t.Errorf("ClientDetail(%q): %v - a wrong URL must be a miss, not a 500", id, err)
+		}
+		if c.ID != "" {
+			t.Errorf("ClientDetail(%q) matched %q", id, c.ID)
+		}
+	}
+
+	// The sibling resolvers take a real client id and a free-text reference, so
+	// the reference is the part a caller controls and the part that must not
+	// blow up. A malformed CLIENT id here is covered above.
+	const noClient = "00000000-0000-4000-8000-000000000000"
+	for _, ref := range []string{"", "not-a-uuid", "'; --", "42"} {
+		if id, err := st.AdminSiteID(ctx, noClient, ref); err != nil {
+			t.Errorf("AdminSiteID(%q): %v", ref, err)
+		} else if id != "" {
+			t.Errorf("AdminSiteID(%q) matched %q", ref, id)
+		}
+		if id, err := st.AdminCameraID(ctx, noClient, noClient, ref); err != nil {
+			t.Errorf("AdminCameraID(%q): %v", ref, err)
+		} else if id != "" {
+			t.Errorf("AdminCameraID(%q) matched %q", ref, id)
+		}
+	}
+
+	// And a sale id is the same shape of input on the tenant side.
+	if s, err := st.Sale(ctx, noClient, "not-a-uuid"); err != nil {
+		t.Errorf("Sale(not-a-uuid): %v", err)
+	} else if s.ID != "" {
+		t.Errorf("Sale(not-a-uuid) matched %q", s.ID)
+	}
+}
+
+// A customer's history carries what they bought on each visit.
+//
+// Live, because the whole risk is in the SQL: a plain join onto purchases
+// would return a visit TWICE when it holds two sales, making a customer look
+// like they came more often than they did. The LATERAL aggregate is what
+// prevents that, and an in-memory fake asserting on it would only be checking
+// the fake.
+func TestLiveTwoSalesOnOneVisitDoNotDuplicateTheVisit(t *testing.T) {
+	st := liveStore(t)
+	ctx := context.Background()
+
+	clientID, siteID, visitorID, visitID := seedVisitWithSales(t, st, 2)
+
+	rows, err := st.VisitorHistory(ctx, clientID, visitorID, 50)
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := 0
+	for _, r := range rows {
+		if r.ID != visitID {
+			continue
+		}
+		seen++
+		if r.Purchases != 2 {
+			t.Errorf("purchases = %d, want 2", r.Purchases)
+		}
+		if r.Spend != 300 || r.Currency != "INR" {
+			t.Errorf("spend = %v %s, want 300 INR", r.Spend, r.Currency)
+		}
+	}
+	if seen != 1 {
+		t.Fatalf("the visit appears %d times, want exactly 1 - two sales on one "+
+			"visit must not make a customer look like two visits", seen)
+	}
+	_ = siteID
+}
+
+// Mixed currencies on one visit report the count and NO figure. Adding rupees
+// to dollars produces something that looks like money and is not.
+func TestLiveMixedCurrenciesOnOneVisitReportNoTotal(t *testing.T) {
+	st := liveStore(t)
+	ctx := context.Background()
+
+	clientID, _, visitorID, visitID := seedVisitWithSales(t, st, 0)
+	seedSale(t, st, clientID, visitID, visitorID, 100, "INR")
+	seedSale(t, st, clientID, visitID, visitorID, 50, "USD")
+
+	rows, err := st.VisitorHistory(ctx, clientID, visitorID, 50)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range rows {
+		if r.ID != visitID {
+			continue
+		}
+		if r.Purchases != 2 {
+			t.Errorf("purchases = %d, want 2 - the sales still happened", r.Purchases)
+		}
+		if r.Spend != 0 || r.Currency != "" {
+			t.Errorf("spend = %v %q, want no figure for mixed currencies",
+				r.Spend, r.Currency)
+		}
+	}
+}
+
+// seedVisitWithSales makes one tenant, one customer, one visit, and `sales`
+// purchases of 150 INR each against that visit.
+func seedVisitWithSales(t *testing.T, st *Store, sales int) (clientID, siteID, visitorID, visitID string) {
+	t.Helper()
+	clientID, siteID = seedTenant(t, st, "hist"+stamp(), 0, false)
+	ctx := context.Background()
+	at := time.Date(2026, 9, 3, 11, 0, 0, 0, time.UTC)
+
+	if err := st.pool.QueryRow(ctx, `
+		INSERT INTO visitors (client_id, number, label, first_seen_at)
+		VALUES ($1::uuid, 1, 'Visitor 1', $2) RETURNING id::text`,
+		clientID, at).Scan(&visitorID); err != nil {
+		t.Fatalf("seed visitor: %v", err)
+	}
+	if err := st.pool.QueryRow(ctx, `
+		INSERT INTO visits (client_id, site_id, visitor_id, source_event_id,
+		                    occurred_at, camera_id, is_new_visitor)
+		VALUES ($1::uuid, $2::uuid, $3::uuid, 'hist-e1', $4, 'door', true)
+		RETURNING id::text`,
+		clientID, siteID, visitorID, at).Scan(&visitID); err != nil {
+		t.Fatalf("seed visit: %v", err)
+	}
+	for i := 0; i < sales; i++ {
+		seedSale(t, st, clientID, visitID, visitorID, 150, "INR")
+	}
+	return clientID, siteID, visitorID, visitID
+}
+
+func seedSale(t *testing.T, st *Store, clientID, visitID, visitorID string,
+	amount float64, currency string) {
+	t.Helper()
+	var siteID string
+	if err := st.pool.QueryRow(context.Background(),
+		`SELECT site_id::text FROM visits WHERE id = $1::uuid`, visitID).Scan(&siteID); err != nil {
+		t.Fatalf("site of visit: %v", err)
+	}
+	if _, err := st.pool.Exec(context.Background(), `
+		INSERT INTO purchases (client_id, site_id, visitor_id, visit_id,
+		                       amount, currency, occurred_at)
+		VALUES ($1::uuid, $2::uuid, $3::uuid, $4::uuid, $5, $6, now())`,
+		clientID, siteID, visitorID, visitID, amount, currency); err != nil {
+		t.Fatalf("seed sale: %v", err)
+	}
+}

server/internal/store/api_arrivals.go

@@ -12,7 +12,7 @@ import (
 // mean the first poll of a feed and every poll after it returned different
 // shapes, which is the kind of bug that only shows up under load.
 const arrivalColumns = `
-	vi.id::text, vi.seq, vi.occurred_at, vi.site_id::text, si.name, si.slug, vi.camera_id,
+	vi.id::text, vi.seq, COALESCE(vi.number, 0), vi.occurred_at, vi.site_id::text, si.name, si.slug, vi.camera_id,
 	vi.is_new_visitor, vi.similarity, vi.quality, vi.attributes, vi.image_key,
 	COALESCE(vi.visitor_id::text, ''),
 	COALESCE(vs.number, 0),
@@ -112,13 +112,14 @@ func (s *Store) Arrivals(ctx context.Context, q api.ArrivalQuery) ([]api.Arrival
 		var at time.Time
 		var sim, qual *float64
 		var imageKey string
-		var number int64
-		if err := rows.Scan(&a.VisitID, &a.Seq, &at, &a.SiteID, &a.Site, &a.SiteSlug, &a.CameraID,
+		var number, visitNumber int64
+		if err := rows.Scan(&a.VisitID, &a.Seq, &visitNumber, &at, &a.SiteID, &a.Site, &a.SiteSlug, &a.CameraID,
 			&a.IsNew, &sim, &qual, &a.Attributes, &imageKey,
 			&a.VisitorID, &number, &a.Label, &a.Name); err != nil {
 			return nil, err
 		}
 		a.VisitorRef = api.VisitorRef(number)
+		a.VisitRef = api.VisitRef(visitNumber)
 		a.OccurredAt = at.UTC().Format(time.RFC3339Nano)
 		if sim != nil {
 			a.Similarity = *sim

server/internal/store/api_cameras.go

@@ -59,6 +59,11 @@ func scanCamera(row pgx.Row) (api.Camera, error) {
 	// The KEY travels in ImageKey, which is json:"-", and the handler swaps it
 	// for a signed link. Same rule as an arrival's face.
 	c.Snapshot.Key = snapKey
+	// Here rather than in a handler, because every camera anybody reads comes
+	// through this function and a state computed per caller is a state one
+	// caller forgets - which is how a stale `connected` reached three screens
+	// at once.
+	c.CameraState(time.Now())
 	return c, nil
 }
 

server/internal/store/api_customers.go

@@ -0,0 +1,313 @@
+// Creating a customer nobody has photographed, and joining two records that
+// turn out to be one person.
+//
+// These ship together on purpose. A customer created by hand has no face, so
+// when a camera later sees that person the matcher has nothing to compare
+// against and records them as somebody new - by construction, not by failure.
+// Shipping the create without the merge would mean manufacturing duplicates
+// with no way back, which is the state CLAUDE.md already flags for the server:
+// "there is no merge endpoint server-side, so its duplicates would be
+// unrecoverable."
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/loyaly/behavision-server/internal/api"
+)
+
+// CreateCustomer registers a person before any camera has seen them.
+//
+// The number comes from the same counter, taken the same way, as a customer
+// the engine enrols: `UPDATE ... RETURNING` inside the transaction. Two
+// sources of visitor numbers that could disagree would be worse than none,
+// and V-42 has to mean one person whichever way they arrived.
+func (s *Store) CreateCustomer(ctx context.Context, clientID string,
+	in api.Profile, createdBy string) (api.Customer, error) {
+
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return api.Customer{}, err
+	}
+	defer tx.Rollback(ctx)
+
+	var number int64
+	if err := tx.QueryRow(ctx, `
+		UPDATE clients SET visitor_seq = visitor_seq + 1
+		 WHERE id = $1::uuid RETURNING visitor_seq`, clientID).Scan(&number); err != nil {
+		return api.Customer{}, fmt.Errorf("next visitor number: %w", err)
+	}
+
+	// The label is the person's name when they gave one, and "Visitor N"
+	// otherwise - the same string the engine would have written, so a record
+	// created by hand is indistinguishable from an enrolled one afterwards.
+	// Formatted in Go, never as `'Visitor ' || $2::text` beside `number = $2`:
+	// one parameter used as a bigint and as a string operand makes Postgres
+	// deduce two types for it and refuse the whole insert.
+	label := in.FullName
+	if label == "" {
+		label = fmt.Sprintf("Visitor %d", number)
+	}
+
+	now := time.Now().UTC()
+	var id string
+	if err := tx.QueryRow(ctx, `
+		INSERT INTO visitors (client_id, number, label, first_seen_at, visit_count)
+		VALUES ($1::uuid, $2, $3, $4, 0) RETURNING id::text`,
+		clientID, number, label, now).Scan(&id); err != nil {
+		return api.Customer{}, err
+	}
+
+	if _, err := tx.Exec(ctx, `
+		INSERT INTO visitor_profiles (visitor_id, client_id, full_name, phone,
+		                              email, gender, notes, collected_by)
+		VALUES ($1::uuid, $2::uuid, $3, $4, $5, $6, $7, NULLIF($8,'')::uuid)`,
+		id, clientID, in.FullName, in.Phone, in.Email, in.Gender, in.Notes,
+		createdBy); err != nil {
+		return api.Customer{}, err
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return api.Customer{}, err
+	}
+	return api.Customer{
+		ID: id, Ref: api.VisitorRef(number), Label: label,
+		FullName: in.FullName, Phone: in.Phone, Email: in.Email,
+		VisitCount: 0, HasProfile: true,
+		FirstSeenAt: now.Format(time.RFC3339),
+	}, nil
+}
+
+// ErrSameVisitor is the API package's sentinel, aliased rather than
+// redeclared - two values would compare unequal and errors.Is would miss.
+var ErrSameVisitor = api.ErrSameVisitor
+
+// MergeVisitors folds `sourceID` into `targetID` and deletes the source.
+//
+// One transaction, because a half-merge - visits moved, profile not - leaves
+// two records each holding part of one person, which is strictly worse than
+// the duplicate it was called to fix.
+//
+// Five tables reference visitors and every one is re-pointed here. A merge
+// that misses a table is the same half-merge arrived at by omission, and
+// ON DELETE CASCADE means the miss is not an error: the rows are silently
+// destroyed with the source row.
+func (s *Store) MergeVisitors(ctx context.Context, clientID, sourceID, targetID string) (
+	api.MergeResult, error) {
+
+	var out api.MergeResult
+	if sourceID == targetID {
+		return out, ErrSameVisitor
+	}
+
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return out, err
+	}
+	defer tx.Rollback(ctx)
+
+	// Both must exist, belong to this tenant, and not already be erased.
+	// Locked in a stable order so two operators merging the same pair in
+	// opposite directions deadlock on nothing and one simply loses.
+	var srcNum, dstNum int64
+	var srcLabel, dstLabel string
+	var srcFirst, dstFirst time.Time
+	rows, err := tx.Query(ctx, `
+		SELECT id::text, number, label, first_seen_at FROM visitors
+		 WHERE client_id = $1::uuid AND id::text IN ($2, $3)
+		   AND deleted_at IS NULL
+		 ORDER BY id FOR UPDATE`, clientID, sourceID, targetID)
+	if err != nil {
+		return out, err
+	}
+	found := 0
+	for rows.Next() {
+		var id, label string
+		var num int64
+		var first time.Time
+		if err := rows.Scan(&id, &num, &label, &first); err != nil {
+			rows.Close()
+			return out, err
+		}
+		found++
+		if id == sourceID {
+			srcNum, srcLabel, srcFirst = num, label, first
+		} else {
+			dstNum, dstLabel, dstFirst = num, label, first
+		}
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return out, err
+	}
+	if found != 2 {
+		return out, pgx.ErrNoRows
+	}
+
+	// Profile: visitor_profiles is UNIQUE on visitor_id, so the two cannot both
+	// move and something has to win. Merged field by field in Go rather than in
+	// one clever upsert, because the interesting case is not which value wins -
+	// it is what happens to the one that loses.
+	//
+	// Blanks on the survivor are filled from the source. Where BOTH hold a
+	// value the survivor keeps its own and the loser is recorded in `discarded`
+	// and appended to notes. Dropping it silently was the first version's
+	// behaviour and it lost a phone number on the very first live run: one
+	// person can have two numbers, and a merge that quietly deletes one is
+	// precisely the data loss an operator cannot see happen.
+	var src, dst profileFields
+	if err := readProfile(ctx, tx, sourceID, &src); err != nil {
+		return out, fmt.Errorf("read source profile: %w", err)
+	}
+	if err := readProfile(ctx, tx, targetID, &dst); err != nil {
+		return out, fmt.Errorf("read target profile: %w", err)
+	}
+	if src.exists {
+		merged, discarded := mergeProfiles(src, dst)
+		out.Discarded = discarded
+		if _, err := tx.Exec(ctx, `
+			INSERT INTO visitor_profiles (visitor_id, client_id, full_name, phone,
+			                              email, gender, notes)
+			VALUES ($1::uuid, $2::uuid, $3, $4, $5, $6, $7)
+			ON CONFLICT (visitor_id) DO UPDATE SET
+			  full_name = EXCLUDED.full_name, phone = EXCLUDED.phone,
+			  email = EXCLUDED.email, gender = EXCLUDED.gender,
+			  notes = EXCLUDED.notes, updated_at = now()`,
+			targetID, clientID, merged.fullName, merged.phone, merged.email,
+			merged.gender, merged.notes); err != nil {
+			return out, fmt.Errorf("merge profile: %w", err)
+		}
+	}
+
+	for _, q := range []struct {
+		name, sql string
+		count     *int
+	}{
+		{"visits", `UPDATE visits SET visitor_id = $2::uuid
+		              WHERE visitor_id = $1::uuid AND client_id = $3::uuid`, &out.Visits},
+		{"purchases", `UPDATE purchases SET visitor_id = $2::uuid
+		              WHERE visitor_id = $1::uuid AND client_id = $3::uuid`, &out.Purchases},
+		{"embeddings", `UPDATE visitor_embeddings SET visitor_id = $2::uuid
+		              WHERE visitor_id = $1::uuid AND client_id = $3::uuid`, &out.Embeddings},
+		{"consents", `UPDATE consents SET visitor_id = $2::uuid
+		              WHERE visitor_id = $1::uuid AND client_id = $3::uuid`, &out.Consents},
+	} {
+		tag, err := tx.Exec(ctx, q.sql, sourceID, targetID, clientID)
+		if err != nil {
+			return out, fmt.Errorf("merge %s: %w", q.name, err)
+		}
+		*q.count = int(tag.RowsAffected())
+	}
+
+	// A human-assigned name outranks an auto "Visitor N", whichever direction
+	// the operator merged in. Silently turning "Alice" back into "Visitor 3"
+	// is data loss they cannot see happen.
+	label := dstLabel
+	if isAutoLabel(dstLabel, dstNum) && !isAutoLabel(srcLabel, srcNum) {
+		label = srcLabel
+	}
+	// first_seen_at takes the earlier of the two: it is one person and always
+	// was. visit_count is recomputed with COUNT(*), never summed - the stored
+	// counters may themselves be stale, and the row count cannot be.
+	first := dstFirst
+	if srcFirst.Before(first) {
+		first = srcFirst
+	}
+	if _, err := tx.Exec(ctx, `
+		UPDATE visitors SET
+		  label = $2, first_seen_at = $3,
+		  last_seen_at  = GREATEST(last_seen_at,
+		                    (SELECT max(occurred_at) FROM visits WHERE visitor_id = $1::uuid)),
+		  visit_count   = (SELECT count(*) FROM visits WHERE visitor_id = $1::uuid)
+		 WHERE id = $1::uuid`, targetID, label, first); err != nil {
+		return out, fmt.Errorf("merge totals: %w", err)
+	}
+
+	// The source goes for real. A soft delete would leave its number resolving
+	// to a record with nothing in it, which reads as "this customer exists and
+	// has never been here" - a worse answer than "no such customer".
+	if _, err := tx.Exec(ctx, `DELETE FROM visitors WHERE id = $1::uuid`, sourceID); err != nil {
+		return out, fmt.Errorf("delete merged customer: %w", err)
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return out, err
+	}
+
+	out.VisitorID = targetID
+	out.Ref = api.VisitorRef(dstNum)
+	out.RetiredRef = api.VisitorRef(srcNum)
+	out.Label = label
+	return out, nil
+}
+
+// isAutoLabel reports whether a label is the one the system writes itself.
+// Compared against the record's OWN number: "Visitor 7" on customer 42 was
+// typed by a person and is a name, however unhelpful.
+func isAutoLabel(label string, number int64) bool {
+	return label == fmt.Sprintf("Visitor %d", number)
+}
+
+// profileFields is the part of a profile a merge has to reconcile.
+type profileFields struct {
+	exists                                bool
+	fullName, phone, email, gender, notes string
+}
+
+func readProfile(ctx context.Context, tx pgx.Tx, visitorID string, out *profileFields) error {
+	err := tx.QueryRow(ctx, `
+		SELECT full_name, phone, email, gender, notes
+		  FROM visitor_profiles WHERE visitor_id = $1::uuid`, visitorID).
+		Scan(&out.fullName, &out.phone, &out.email, &out.gender, &out.notes)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil
+	}
+	out.exists = err == nil
+	return err
+}
+
+// mergeProfiles keeps the survivor's own values, fills its blanks from the
+// source, and returns everything that lost so nothing disappears silently.
+func mergeProfiles(src, dst profileFields) (profileFields, []string) {
+	out := dst
+	var discarded []string
+	keep := func(field string, mine *string, theirs string) {
+		switch {
+		case theirs == "":
+		case *mine == "":
+			*mine = theirs
+		case *mine != theirs:
+			discarded = append(discarded, field+": "+theirs)
+		}
+	}
+	keep("name", &out.fullName, src.fullName)
+	keep("phone", &out.phone, src.phone)
+	keep("email", &out.email, src.email)
+	keep("gender", &out.gender, src.gender)
+
+	// Notes are additive rather than a winner: two people writing about one
+	// customer wrote two different true things.
+	if src.notes != "" && src.notes != out.notes {
+		if out.notes == "" {
+			out.notes = src.notes
+		} else {
+			out.notes += "\n" + src.notes
+		}
+	}
+	// And the losers land in notes too, because the response is read once and
+	// the record is read forever.
+	if len(discarded) > 0 {
+		line := "merged, also known as - " + strings.Join(discarded, ", ")
+		if out.notes == "" {
+			out.notes = line
+		} else {
+			out.notes += "\n" + line
+		}
+	}
+	return out, discarded
+}

server/internal/store/api_customers_live_test.go

@@ -0,0 +1,227 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/loyaly/behavision-server/internal/api"
+)
+
+// The case the whole feature exists for: a customer typed in at a counter,
+// then recognised by a camera a week later as somebody new, then joined.
+//
+// Live, because every property below is in the SQL and because the failure is
+// SILENT: five tables reference visitors with ON DELETE CASCADE, so a table
+// this merge forgets to re-point is not an error - those rows are destroyed
+// with the source row and nobody finds out until a customer's history is
+// short.
+func TestLiveMergeMovesEverythingAndLosesNothing(t *testing.T) {
+	st := liveStore(t)
+	ctx := context.Background()
+	clientID, siteID := seedTenant(t, st, "merge"+stamp(), 0, false)
+
+	// The hand-typed record: a name and a phone, no face, no visits.
+	typed, err := st.CreateCustomer(ctx, clientID,
+		api.Profile{FullName: "Asha Menon", Phone: "9876543210"}, "")
+	if err != nil {
+		t.Fatalf("create customer: %v", err)
+	}
+	if typed.Ref == "" {
+		t.Fatal("a hand-created customer must get a speakable reference")
+	}
+
+	// The record a camera made later. Two visits, a purchase, a template and a
+	// consent - one row in every table that references visitors.
+	seen, visitIDs := seedRecognisedVisitor(t, st, clientID, siteID, 2)
+	seedSale(t, st, clientID, visitIDs[0], seen, 250, "INR")
+	seedEmbedding(t, st, clientID, seen)
+	seedConsent(t, st, clientID, seen)
+
+	out, err := st.MergeVisitors(ctx, clientID, typed.ID, seen)
+	if err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+	if out.VisitorID != seen {
+		t.Fatalf("survivor %s, want %s", out.VisitorID, seen)
+	}
+	if out.RetiredRef != typed.Ref {
+		t.Errorf("retired ref %q, want %q - staff write these down",
+			out.RetiredRef, typed.Ref)
+	}
+
+	// Nothing orphaned, nothing cascaded away.
+	for _, c := range []struct {
+		what, sql string
+		want      int
+	}{
+		{"visits", `SELECT count(*) FROM visits WHERE visitor_id = $1::uuid`, 2},
+		{"purchases", `SELECT count(*) FROM purchases WHERE visitor_id = $1::uuid`, 1},
+		{"embeddings", `SELECT count(*) FROM visitor_embeddings WHERE visitor_id = $1::uuid`, 1},
+		{"consents", `SELECT count(*) FROM consents WHERE visitor_id = $1::uuid`, 1},
+		{"profiles", `SELECT count(*) FROM visitor_profiles WHERE visitor_id = $1::uuid`, 1},
+	} {
+		var n int
+		if err := st.pool.QueryRow(ctx, c.sql, seen).Scan(&n); err != nil {
+			t.Fatalf("%s: %v", c.what, err)
+		}
+		if n != c.want {
+			t.Errorf("%s on the survivor = %d, want %d", c.what, n, c.want)
+		}
+	}
+
+	// The typed-in name reached the record that has the face. That IS the
+	// feature: the survivor had no profile, so the source's fills it.
+	var name, phone string
+	if err := st.pool.QueryRow(ctx,
+		`SELECT full_name, phone FROM visitor_profiles WHERE visitor_id = $1::uuid`,
+		seen).Scan(&name, &phone); err != nil {
+		t.Fatalf("profile: %v", err)
+	}
+	if name != "Asha Menon" || phone != "9876543210" {
+		t.Errorf("profile = %q / %q, want the typed-in details", name, phone)
+	}
+
+	// A human-assigned name outranks an auto "Visitor N", whichever way round
+	// the operator merged.
+	var label string
+	var visitCount int
+	if err := st.pool.QueryRow(ctx,
+		`SELECT label, visit_count FROM visitors WHERE id = $1::uuid`,
+		seen).Scan(&label, &visitCount); err != nil {
+		t.Fatal(err)
+	}
+	if label != "Asha Menon" {
+		t.Errorf("label %q, want the human name to survive the auto one", label)
+	}
+	// Recomputed with COUNT(*), never summed: the stored counters may be stale
+	// and the row count cannot be.
+	if visitCount != 2 {
+		t.Errorf("visit_count = %d, want 2 counted from the rows", visitCount)
+	}
+
+	// The source is gone for real. A soft delete would leave its number
+	// resolving to a record holding nothing.
+	var left int
+	if err := st.pool.QueryRow(ctx,
+		`SELECT count(*) FROM visitors WHERE id = $1::uuid`, typed.ID).Scan(&left); err != nil {
+		t.Fatal(err)
+	}
+	if left != 0 {
+		t.Error("the merged-away customer is still there")
+	}
+}
+
+// The survivor's own details are never overwritten. Merging must not silently
+// replace a name somebody checked with one they did not.
+func TestLiveMergeFillsBlanksAndOverwritesNothing(t *testing.T) {
+	st := liveStore(t)
+	ctx := context.Background()
+	clientID, _ := seedTenant(t, st, "keep"+stamp(), 0, false)
+
+	src, _ := st.CreateCustomer(ctx, clientID,
+		api.Profile{FullName: "Wrong Name", Phone: "1111111111", Email: "a@b.c"}, "")
+	dst, _ := st.CreateCustomer(ctx, clientID,
+		api.Profile{FullName: "Right Name"}, "")
+
+	if _, err := st.MergeVisitors(ctx, clientID, src.ID, dst.ID); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+	var name, phone, email string
+	if err := st.pool.QueryRow(ctx,
+		`SELECT full_name, phone, email FROM visitor_profiles WHERE visitor_id = $1::uuid`,
+		dst.ID).Scan(&name, &phone, &email); err != nil {
+		t.Fatal(err)
+	}
+	if name != "Right Name" {
+		t.Errorf("name = %q, want the survivor's own kept", name)
+	}
+	if phone != "1111111111" || email != "a@b.c" {
+		t.Errorf("blanks not filled: phone=%q email=%q", phone, email)
+	}
+}
+
+// Another tenant's customer is not mergeable, and reads as absent.
+func TestLiveMergeRefusesAcrossTenants(t *testing.T) {
+	st := liveStore(t)
+	ctx := context.Background()
+	aID, _ := seedTenant(t, st, "ta"+stamp(), 0, false)
+	bID, _ := seedTenant(t, st, "tb"+stamp(), 0, false)
+
+	a, _ := st.CreateCustomer(ctx, aID, api.Profile{FullName: "A"}, "")
+	b, _ := st.CreateCustomer(ctx, bID, api.Profile{FullName: "B"}, "")
+
+	if _, err := st.MergeVisitors(ctx, aID, a.ID, b.ID); err == nil {
+		t.Fatal("merged a customer into another tenant's record")
+	}
+	var n int
+	st.pool.QueryRow(ctx, `SELECT count(*) FROM visitors WHERE id = $1::uuid`, a.ID).Scan(&n)
+	if n != 1 {
+		t.Error("a refused merge must change nothing")
+	}
+}
+
+// -------------------------------------------------------------- fixtures
+
+func seedRecognisedVisitor(t *testing.T, st *Store, clientID, siteID string, visits int) (
+	visitorID string, visitIDs []string) {
+	t.Helper()
+	ctx := context.Background()
+	at := time.Date(2026, 9, 10, 9, 0, 0, 0, time.UTC)
+	var number int64
+	if err := st.pool.QueryRow(ctx, `
+		UPDATE clients SET visitor_seq = visitor_seq + 1
+		 WHERE id = $1::uuid RETURNING visitor_seq`, clientID).Scan(&number); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.pool.QueryRow(ctx, `
+		INSERT INTO visitors (client_id, number, label, first_seen_at, visit_count)
+		VALUES ($1::uuid, $2, 'Visitor '||$2, $3, 0) RETURNING id::text`,
+		clientID, number, at).Scan(&visitorID); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < visits; i++ {
+		var id string
+		if err := st.pool.QueryRow(ctx, `
+			INSERT INTO visits (client_id, site_id, visitor_id, source_event_id,
+			                    occurred_at, camera_id, is_new_visitor)
+			VALUES ($1::uuid, $2::uuid, $3::uuid, $4, $5, 'door', $6)
+			RETURNING id::text`,
+			clientID, siteID, visitorID, stamp()+string(rune('a'+i)),
+			at.Add(time.Duration(i)*time.Hour), i == 0).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		visitIDs = append(visitIDs, id)
+	}
+	return visitorID, visitIDs
+}
+
+func seedEmbedding(t *testing.T, st *Store, clientID, visitorID string) {
+	t.Helper()
+	v := make([]float32, 512)
+	for i := range v {
+		v[i] = 0.04
+	}
+	var siteID string
+	if err := st.pool.QueryRow(context.Background(),
+		`SELECT id::text FROM sites WHERE client_id = $1::uuid LIMIT 1`,
+		clientID).Scan(&siteID); err != nil {
+		t.Fatalf("site for embedding: %v", err)
+	}
+	if _, err := st.pool.Exec(context.Background(), `
+		INSERT INTO visitor_embeddings
+		  (visitor_id, client_id, model, embedding, quality, source_site_id)
+		VALUES ($1::uuid, $2::uuid, 'w600k_r50', $3::vector, 0.8, $4::uuid)`,
+		visitorID, clientID, pgVector(v), siteID); err != nil {
+		t.Fatalf("seed embedding: %v", err)
+	}
+}
+
+func seedConsent(t *testing.T, st *Store, clientID, visitorID string) {
+	t.Helper()
+	if _, err := st.pool.Exec(context.Background(), `
+		INSERT INTO consents (client_id, visitor_id, scope, granted)
+		VALUES ($1::uuid, $2::uuid, 'marketing', true)`, clientID, visitorID); err != nil {
+		t.Fatalf("seed consent: %v", err)
+	}
+}

server/internal/store/api_customers_test.go

@@ -0,0 +1,71 @@
+package store
+
+import (
+	"strings"
+	"testing"
+)
+
+// mergeProfiles is pure, so the rule it encodes can be asserted without a
+// database - and it is the rule that matters: what happens to the value that
+// LOSES. The first version dropped it, and lost a phone number on the first
+// live run.
+func TestMergingProfilesKeepsWhatLoses(t *testing.T) {
+	src := profileFields{exists: true, fullName: "Asha M", phone: "111", email: "a@b.c"}
+	dst := profileFields{exists: true, fullName: "Asha Menon", phone: "222"}
+
+	out, discarded := mergeProfiles(src, dst)
+
+	if out.fullName != "Asha Menon" || out.phone != "222" {
+		t.Errorf("survivor's own values must win: got %q / %q", out.fullName, out.phone)
+	}
+	if out.email != "a@b.c" {
+		t.Errorf("a blank must be filled from the source, got %q", out.email)
+	}
+	if len(discarded) != 2 {
+		t.Fatalf("discarded %v, want the losing name and phone", discarded)
+	}
+	// In the record, not only in the response: the response is read once.
+	for _, want := range []string{"Asha M", "111"} {
+		if !strings.Contains(out.notes, want) {
+			t.Errorf("notes must retain %q: %q", want, out.notes)
+		}
+	}
+}
+
+// Nothing to reconcile is the ordinary case - a hand-typed record joining a
+// camera record that has no profile at all - and it must add no noise.
+func TestMergingIntoAnEmptyProfileDiscardsNothing(t *testing.T) {
+	src := profileFields{exists: true, fullName: "Asha Menon", phone: "111"}
+	out, discarded := mergeProfiles(src, profileFields{})
+
+	if len(discarded) != 0 {
+		t.Errorf("discarded %v, want none", discarded)
+	}
+	if out.fullName != "Asha Menon" || out.phone != "111" {
+		t.Errorf("the typed details must reach the surviving record: %+v", out)
+	}
+	if out.notes != "" {
+		t.Errorf("no conflict should leave no note, got %q", out.notes)
+	}
+}
+
+// Identical values are not a conflict.
+func TestIdenticalProfileValuesAreNotDiscarded(t *testing.T) {
+	p := profileFields{exists: true, fullName: "Asha Menon", phone: "111"}
+	out, discarded := mergeProfiles(p, p)
+	if len(discarded) != 0 || out.notes != "" {
+		t.Errorf("identical profiles produced %v / notes %q", discarded, out.notes)
+	}
+}
+
+// Two people writing about one customer wrote two different true things.
+func TestNotesAreAdditiveRatherThanAWinner(t *testing.T) {
+	out, _ := mergeProfiles(
+		profileFields{exists: true, notes: "prefers window seat"},
+		profileFields{exists: true, notes: "allergic to nuts"})
+	for _, want := range []string{"window seat", "allergic to nuts"} {
+		if !strings.Contains(out.notes, want) {
+			t.Errorf("notes lost %q: %q", want, out.notes)
+		}
+	}
+}

server/internal/store/api_people.go

@@ -59,7 +59,13 @@ func (s *Store) SearchVisitors(ctx context.Context, clientID, query string, limi
 		               OR v.label ILIKE $3 ESCAPE '\'
 		               OR p.full_name ILIKE $3 ESCAPE '\'
 		               OR p.phone     ILIKE $3 ESCAPE '\'
-		               OR p.email     ILIKE $3 ESCAPE '\')
+		               OR p.email     ILIKE $3 ESCAPE '\'
+		               -- Notes are searched for ONE reason: a merge records the
+		               -- phone and name it had to discard there, and a customer
+		               -- reached by their old number is exactly who somebody is
+		               -- looking for when they type it. Retained-but-unfindable
+		               -- answers the letter of "nothing is lost" and not the point.
+		               OR p.notes     ILIKE $3 ESCAPE '\')
 		ORDER BY v.last_seen_at DESC NULLS LAST, v.first_seen_at DESC
 		LIMIT $4`,
 		clientID, strings.TrimSpace(query), likePattern(strings.TrimSpace(query)),
@@ -94,9 +100,19 @@ func (s *Store) VisitorHistory(ctx context.Context, clientID, visitorID string,
 
 	rows, err := s.pool.Query(ctx, `
 		SELECT vi.id::text, vi.occurred_at, si.name, vi.camera_id,
-		       vi.is_new_visitor, vi.similarity, vi.quality, vi.attributes
+		       vi.is_new_visitor, vi.similarity, vi.quality, vi.attributes,
+		       pu.n, pu.total, pu.cur, pu.currencies
 		FROM visits vi
 		JOIN sites si ON si.id = vi.site_id
+		-- LATERAL rather than a join onto purchases directly: two sales on one
+		-- visit would otherwise return that visit twice and the customer would
+		-- appear to have been in more often than they were.
+		LEFT JOIN LATERAL (
+		  SELECT count(*) AS n, sum(p.amount) AS total,
+		         max(p.currency) AS cur, count(DISTINCT p.currency) AS currencies
+		  FROM purchases p
+		  WHERE p.visit_id = vi.id AND p.client_id = vi.client_id
+		) pu ON true
 		WHERE vi.client_id = $1 AND vi.visitor_id = $2::uuid
 		ORDER BY vi.occurred_at DESC
 		LIMIT $3`, clientID, visitorID, limit)
@@ -109,11 +125,20 @@ func (s *Store) VisitorHistory(ctx context.Context, clientID, visitorID string,
 	for rows.Next() {
 		var v api.VisitRow
 		var at time.Time
-		var sim, qual *float64
+		var sim, qual, total *float64
+		var nPurchases, nCurrencies int
+		var cur *string
 		if err := rows.Scan(&v.ID, &at, &v.Site, &v.CameraID, &v.IsNew,
-			&sim, &qual, &v.Attributes); err != nil {
+			&sim, &qual, &v.Attributes,
+			&nPurchases, &total, &cur, &nCurrencies); err != nil {
 			return nil, err
 		}
+		v.Purchases = nPurchases
+		// One currency or none. Mixed is left as a count with no figure
+		// rather than a sum that means nothing.
+		if nCurrencies == 1 && total != nil && cur != nil {
+			v.Spend, v.Currency = *total, *cur
+		}
 		v.OccurredAt = at.UTC().Format(time.RFC3339)
 		if sim != nil {
 			v.Similarity = *sim

server/internal/store/api_sales.go

@@ -0,0 +1,116 @@
+// Reading individual sales.
+//
+// The conversion report has aggregated `purchases` since it existed and
+// nothing could read a row of it, so "revenue was 41,000 last week" could not
+// be checked against a till. These are the reads that make that number
+// falsifiable from outside.
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/loyaly/behavision-server/internal/api"
+)
+
+const saleCols = `
+	p.id::text, p.occurred_at, p.site_id::text, si.name, si.slug,
+	p.amount, p.currency, p.visitor_id::text, v.number, v.label,
+	p.visit_id::text, p.items, p.source, p.external_ref`
+
+func scanSale(row pgx.Row) (api.Sale, error) {
+	var s api.Sale
+	var at time.Time
+	// LEFT JOINed: a sale with no visitor is an ordinary walk-in nobody
+	// identified, and it is still revenue.
+	var visitorID, visitorLabel, visitID *string
+	var number *int64
+	var items []byte
+	if err := row.Scan(&s.ID, &at, &s.SiteID, &s.Site, &s.SiteSlug,
+		&s.Amount, &s.Currency, &visitorID, &number, &visitorLabel,
+		&visitID, &items, &s.Source, &s.ExternalRef); err != nil {
+		return api.Sale{}, err
+	}
+	s.OccurredAt = at.UTC().Format(time.RFC3339)
+	if visitorID != nil {
+		s.VisitorID = *visitorID
+	}
+	if visitorLabel != nil {
+		s.VisitorLabel = *visitorLabel
+	}
+	if number != nil {
+		s.VisitorRef = api.VisitorRef(*number)
+	}
+	if visitID != nil {
+		s.VisitID = *visitID
+	}
+	// items is jsonb defaulting to '[]', but a null column would otherwise
+	// unmarshal into a nil slice and serialise as null - and a client mapping
+	// over it breaks on the first sale recorded without a basket.
+	s.Items = []string{}
+	if len(items) > 0 {
+		_ = json.Unmarshal(items, &s.Items)
+		if s.Items == nil {
+			s.Items = []string{}
+		}
+	}
+	return s, nil
+}
+
+// Sales lists purchases newest first, within one tenant.
+//
+// Bounded by `limit` and the date window rather than by a cursor. A keyset
+// cursor needs a monotonic server-assigned column, and purchases has none -
+// ordering by (occurred_at, id) with a random uuid tie-break is exactly the
+// shape that silently dropped four simultaneous visits from the arrivals feed
+// before `visits.seq` existed. Offering a cursor here would imply a delivery
+// guarantee this table cannot make; narrowing the window is honest and is what
+// a sales list is browsed by anyway.
+func (s *Store) Sales(ctx context.Context, q api.SaleQuery) ([]api.Sale, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT `+saleCols+`
+		  FROM purchases p
+		  JOIN sites si    ON si.id = p.site_id
+		  LEFT JOIN visitors v ON v.id = p.visitor_id
+		 WHERE p.client_id = $1::uuid
+		   AND p.occurred_at >= $2 AND p.occurred_at < $3
+		   AND ($4 = '' OR p.site_id = $4::uuid)
+		   AND ($5 = '' OR p.visitor_id = $5::uuid)
+		 ORDER BY p.occurred_at DESC, p.id
+		 LIMIT $6`,
+		q.ClientID, q.From, q.To, q.SiteID, q.VisitorID, q.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []api.Sale
+	for rows.Next() {
+		sale, err := scanSale(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, sale)
+	}
+	return out, rows.Err()
+}
+
+// Sale is one purchase, scoped to the tenant. A row belonging to somebody else
+// reads as absent, never as forbidden.
+func (s *Store) Sale(ctx context.Context, clientID, id string) (api.Sale, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT `+saleCols+`
+		  FROM purchases p
+		  JOIN sites si    ON si.id = p.site_id
+		  LEFT JOIN visitors v ON v.id = p.visitor_id
+		 WHERE p.client_id = $1::uuid AND p.id::text = $2`, clientID, id)
+	sale, err := scanSale(row)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return api.Sale{}, nil
+	}
+	return sale, err
+}

server/internal/store/api_team.go

@@ -414,3 +414,30 @@ func (s *Store) ResetMemberPassword(ctx context.Context, clientID, userID,
 	}
 	return m, nil
 }
+
+// SetUserPassword changes one account's password, by user id.
+//
+// Deliberately NOT scoped by client, unlike ResetMemberPassword beside it.
+// That one is a manager acting on somebody else in their company, so the
+// tenant is the boundary. This is an account acting on ITSELF, and the caller
+// is the session - a platform admin has no client at all and was, before this,
+// the one account nobody could change the password of without a shell on the
+// host. Scoping by client here would have reproduced exactly that hole.
+//
+// The id comes from the verified session and never from the request, so there
+// is nothing here for a caller to point at somebody else.
+func (s *Store) SetUserPassword(ctx context.Context, userID, hash string) error {
+	tag, err := s.pool.Exec(ctx, `
+		UPDATE app_users SET password_hash = $2
+		 WHERE id = $1::uuid AND active`, userID, hash)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		// Deactivated mid-session: their sessions are already revoked, so this
+		// is unreachable in practice, and silently succeeding would report a
+		// password change that did not happen.
+		return fmt.Errorf("no active account %s", userID)
+	}
+	return nil
+}

server/internal/store/store.go

@@ -113,10 +113,15 @@ func (s *Store) RecordVisit(ctx context.Context, site ingest.Site,
 	// visitor for a visit we already recorded.
 	var visitID string
 	err = tx.QueryRow(ctx, `
+		WITH n AS (
+		    UPDATE clients SET visit_seq = visit_seq + 1
+		     WHERE id = $1 RETURNING visit_seq
+		)
 		INSERT INTO visits (client_id, site_id, source_event_id, occurred_at,
 		                    camera_id, is_new_visitor, similarity, quality,
-		                    attributes, image_key)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, COALESCE($9, '{}'::jsonb), $10)
+		                    attributes, image_key, number)
+		SELECT $1, $2, $3, $4, $5, $6, $7, $8, COALESCE($9, '{}'::jsonb), $10, n.visit_seq
+		  FROM n
 		ON CONFLICT (client_id, source_event_id) DO NOTHING
 		RETURNING id::text`,
 		site.ClientID, site.SiteID, v.EventID, v.OccurredAt, v.CameraID,

server/internal/web/dist/index.html

@@ -6,8 +6,8 @@
     <meta name="color-scheme" content="dark" />
     <link rel="icon" type="image/png" href="/favicon.png" />
     <title>Behavision</title>
-    <script type="module" crossorigin src="/assets/index-CAACw-qR.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-KC4SOUb9.css">
+    <script type="module" crossorigin src="/assets/index-BuVkBNdU.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-D4KGRSVS.css">
   </head>
   <body>
     <div id="root"></div>

server/migrations/014_visit_numbers.sql

@@ -0,0 +1,52 @@
+-- A visit reference a person can use, beside the key a machine uses.
+--
+-- Every other thing in this product a person refers to already has one: a shop
+-- is `chennai`, a camera is `cam1`, a customer is `V-42`, a person is their
+-- email. A visit had only its uuid:
+--
+--     "visit_id": "4cc216ca-dad3-4958-bb96-5f5a82022cf8"
+--
+-- 012 argued that this was acceptable because no route takes a visit id and
+-- nobody says one out loud. That is true of routing and false of everything
+-- else: it is what the arrivals feed shows, what a support conversation has to
+-- quote, and what somebody reading an API response judges the product by. The
+-- owner asked for it twice.
+--
+-- `#1042`, per client, mirroring `V-42` exactly and for the same three reasons
+-- (speakable, per-tenant so it discloses no platform-wide volume, and a
+-- reference beside the key rather than a replacement for it - eleven tables
+-- reference visits.id).
+--
+-- Why a stored counter is affordable on the hottest table in the schema:
+-- allocating it row-locks the client for the length of one insert, and visits
+-- from one tenant are ALREADY serialised - the MQTT consumer sets
+-- SetOrderMatters(true) precisely so that `seq` is a commit order. So this
+-- adds no contention a tenant did not already have, and tenants never block
+-- each other. A derived reference was the alternative and does not work:
+-- several people through one door share occurred_at to the microsecond, which
+-- is the very collision 004 exists to handle.
+
+ALTER TABLE clients ADD COLUMN IF NOT EXISTS visit_seq bigint NOT NULL DEFAULT 0;
+ALTER TABLE visits  ADD COLUMN IF NOT EXISTS number    bigint;
+
+-- Existing rows get their numbers in the order the server learned of them,
+-- which is what `seq` means - not occurred_at, which is the camera's clock and
+-- arrives out of order after a site has been offline.
+WITH numbered AS (
+    SELECT id, row_number() OVER (PARTITION BY client_id ORDER BY seq) AS n
+      FROM visits
+)
+UPDATE visits v SET number = numbered.n
+  FROM numbered
+ WHERE v.id = numbered.id AND v.number IS NULL;
+
+UPDATE clients c
+   SET visit_seq = GREATEST(c.visit_seq, COALESCE(
+       (SELECT max(number) FROM visits WHERE client_id = c.id), 0));
+
+CREATE UNIQUE INDEX IF NOT EXISTS visits_client_number_idx
+    ON visits (client_id, number);
+
+COMMENT ON COLUMN visits.number IS
+    'Per-client visit number, shown as #1042. A public reference beside the '
+    'uuid key, never a replacement for it.';

tests/test_discover.py

@@ -0,0 +1,44 @@
+"""Discovery parsing, with no network: the two shapes cameras actually send."""
+from behavision.discover import parse_probe_match, guess_make, local_networks
+
+HIK = ('<?xml version="1.0"?><env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">'
+       '<env:Body><d:ProbeMatches xmlns:d="http://schemas.xmlsoap.org/ws/2005/04/discovery"><d:ProbeMatch>'
+       '<d:Scopes>onvif://www.onvif.org/type/video_encoder onvif://www.onvif.org/name/HIKVISION%20DS-2CD2043G2 '
+       'onvif://www.onvif.org/hardware/DS-2CD2043G2-I onvif://www.onvif.org/location/city/hangzhou</d:Scopes>'
+       '<d:XAddrs>http://192.168.1.122/onvif/device_service</d:XAddrs>'
+       '</d:ProbeMatch></d:ProbeMatches></env:Body></env:Envelope>')
+
+BARE = ('<SOAP-ENV:Envelope><SOAP-ENV:Body><wsdd:ProbeMatches><wsdd:ProbeMatch>'
+        '<wsdd:XAddrs>http://10.0.0.9:8080/onvif/device_service http://[fe80::1]/onvif</wsdd:XAddrs>'
+        '</wsdd:ProbeMatch></wsdd:ProbeMatches></SOAP-ENV:Body></SOAP-ENV:Envelope>')
+
+
+def test_hikvision_probe_match_is_named_and_recognised():
+    f = parse_probe_match(HIK, "192.168.1.122")
+    assert f.host == "192.168.1.122"
+    assert f.onvif and not f.rtsp
+    assert "HIKVISION DS-2CD2043G2" in f.name and "DS-2CD2043G2-I" in f.name
+    assert f.make == "hikvision"
+
+
+def test_a_nameless_match_still_yields_its_address():
+    f = parse_probe_match(BARE, "10.0.0.9")
+    assert f.host == "10.0.0.9" and f.name == "" and f.make == ""
+    assert f.onvif_url.startswith("http://10.0.0.9:8080")
+
+
+def test_garbage_is_not_a_camera():
+    assert parse_probe_match("<html>not soap</html>", "1.2.3.4") is None
+
+
+def test_make_guesses_the_common_indian_retail_brands():
+    assert guess_make("CP PLUS CP-UNC-TA21L3") == "cpplus"
+    assert guess_make("Dahua IPC-HDW1230") == "dahua"
+    assert guess_make("TP-LINK Tapo C200") == "tplink"
+    assert guess_make("Something Else") == ""
+
+
+def test_local_networks_are_slash_24_and_never_loopback():
+    for n in local_networks():
+        assert n.prefixlen == 24
+        assert not n.network_address.is_loopback

tests/test_motion_gate.py

@@ -0,0 +1,97 @@
+"""The motion gate must save CPU without ever losing a face.
+
+Cheapness is easy; the property that makes it acceptable is that every way it
+could miss somebody is closed. These tests are that argument, written down.
+"""
+import numpy as np
+import pytest
+
+from behavision.config import Config
+from behavision.engine import CameraWorker
+
+
+class _Worker:
+    """CameraWorker's gate, without a camera, a model or a thread.
+
+    Built with object.__new__ and the two attributes the gate touches - the
+    pattern the other engine tests already use, so no test needs a 166 MB
+    model file or a live RTSP stream.
+    """
+
+    def __new__(cls, **app):
+        w = object.__new__(CameraWorker)
+        w.cfg = Config()
+        for k, v in app.items():
+            setattr(w.cfg.app, k, v)
+        w._motion_prev = None
+        w._motion_skipped = 0
+        return w
+
+
+def frame(value: int, size=(90, 160)) -> np.ndarray:
+    return np.full((*size, 3), value, dtype=np.uint8)
+
+
+def test_the_first_frame_is_always_searched():
+    """Nothing to compare against is not evidence that nothing moved."""
+    w = _Worker()
+    assert w._nothing_moved(frame(40)) is False
+
+
+def test_a_still_room_is_skipped():
+    w = _Worker()
+    w._nothing_moved(frame(40))          # prime
+    assert w._nothing_moved(frame(40)) is True
+
+
+def test_movement_is_never_skipped():
+    w = _Worker()
+    w._nothing_moved(frame(40))
+    # a person is an enormous change next to a 1.0 threshold
+    assert w._nothing_moved(frame(120)) is False
+
+
+def test_it_gives_up_and_looks_anyway():
+    """A change too small or too gradual for a thumbnail must still be found.
+
+    The invariant is about the longest RUN of skips, not the total: what
+    matters is the worst case a person could fall into, which is how long the
+    camera can go without actually looking. Counting the total instead would
+    pass a gate that skipped forty frames and then looked forty times.
+    """
+    w = _Worker(motion_max_skip=5)
+    w._nothing_moved(frame(40))
+    run = longest = 0
+    for _ in range(40):
+        if w._nothing_moved(frame(40)):
+            run += 1
+            longest = max(longest, run)
+        else:
+            run = 0
+    assert longest <= 5, f"went {longest} frames without looking, cap is 5"
+    assert longest == 5, f"longest run was {longest} - the gate is not saving what it could"
+
+
+def test_a_slow_drift_cannot_creep_past_the_threshold():
+    """Each frame below the threshold, but the total far above it.
+
+    Compared against the last frame we SEARCHED rather than the last frame we
+    saw, so a gradual change accumulates and eventually trips the gate instead
+    of sliding under it one frame at a time. Without that, someone easing into
+    view slowly enough is invisible forever.
+    """
+    w = _Worker(motion_max_skip=10_000)   # the safety net must not rescue this
+    w._nothing_moved(frame(40))
+    tripped = None
+    for i in range(1, 30):
+        if w._nothing_moved(frame(40 + i)) is False:
+            tripped = i
+            break
+    assert tripped is not None, "a slow drift was never noticed"
+    assert tripped <= 5, f"took {tripped} frames of drift to notice"
+
+
+@pytest.mark.parametrize("gate", [True, False])
+def test_the_gate_is_switchable(gate):
+    w = _Worker(motion_gate=gate)
+    assert w.cfg.app.motion_gate is gate

tests/test_reliability.py

@@ -0,0 +1,170 @@
+"""Failure modes that look like health from outside.
+
+Each of these was a state the engine could be in while every existing test
+passed and the dashboard showed green. They are grouped because they share
+one property: the process is fine and the product is not working.
+"""
+from __future__ import annotations
+
+import time
+
+import numpy as np
+import pytest
+
+from behavision import capture
+from behavision.capture import VideoSource
+from behavision.config import RecognitionSection
+from behavision.gallery import Gallery, IdentityStore, VectorIndex
+from behavision.recognition import EMBEDDING_DIM
+
+
+def _vec(seed: int) -> np.ndarray:
+    """A distinct unit vector per seed.
+
+    Orthogonal per index, NOT a constant fill: a vector of all 0.3 and one of
+    all 0.6 normalise to the same direction, so a fixture built that way would
+    call two 'different' people one identity and prove nothing.
+    """
+    v = np.zeros(EMBEDDING_DIM, dtype=np.float32)
+    v[seed % EMBEDDING_DIM] = 1.0
+    return v
+
+
+def _gallery(store: IdentityStore, model: str) -> Gallery:
+    return Gallery(store, VectorIndex(EMBEDDING_DIM), RecognitionSection(),
+                   model_name=model)
+
+
+# -- the gallery the running encoder cannot read ------------------------
+
+def test_matching_model_is_fully_usable(tmp_path):
+    store = IdentityStore(tmp_path / "g.db")
+    ident = store.create_identity("Alice")
+    store.add_embedding(ident, _vec(1), 0.8, "w600k_r50")
+
+    health = _gallery(store, "w600k_r50").health
+    assert health["usable"] == 1
+    assert health["stranded"] == 0
+    assert health["identities_stranded"] == 0
+
+
+def test_fallback_encoder_strands_the_gallery_and_says_so(tmp_path, caplog):
+    """The whole point: 2 known people, 0 recognisable, and it must be LOUD.
+
+    This is what a memory-starved box does when the 166 MB model loses the
+    fallback chain to the 13 MB one. Footfall keeps counting, so nothing
+    downstream looks wrong; every regular is simply greeted as a stranger and
+    enrolled a second time.
+    """
+    store = IdentityStore(tmp_path / "g.db")
+    for i in (1, 2):
+        ident = store.create_identity(f"Person {i}")
+        store.add_embedding(ident, _vec(i), 0.8, "w600k_r50")
+
+    with caplog.at_level("WARNING"):
+        health = _gallery(store, "w600k_mbf").health
+
+    assert health["usable"] == 0
+    assert health["stranded"] == 2
+    assert health["identities_stranded"] == 2
+    assert health["other_models"] == ["w600k_r50"]
+
+    warning = " ".join(r.getMessage() for r in caplog.records
+                       if r.levelname == "WARNING")
+    assert "w600k_r50" in warning and "w600k_mbf" in warning, warning
+
+
+def test_partially_stranded_counts_only_the_unreachable(tmp_path):
+    """A mixed gallery is the normal state after a model change, and the
+    number that matters is how many people are lost, not how many vectors."""
+    store = IdentityStore(tmp_path / "g.db")
+    old = store.create_identity("Old")
+    store.add_embedding(old, _vec(1), 0.8, "w600k_mbf")
+    store.add_embedding(old, _vec(2), 0.8, "w600k_mbf")
+    both = store.create_identity("Both")
+    store.add_embedding(both, _vec(3), 0.8, "w600k_mbf")
+    store.add_embedding(both, _vec(4), 0.8, "w600k_r50")
+
+    health = _gallery(store, "w600k_r50").health
+    assert health["stored"] == 4
+    assert health["usable"] == 1
+    assert health["stranded"] == 3
+    # "Both" survives the change; only "Old" is unrecognisable.
+    assert health["identities_stranded"] == 1
+
+
+def test_empty_gallery_is_not_reported_as_stranded(tmp_path):
+    """A new install must not raise an alarm about a gallery nobody has
+    filled yet - crying wolf here trains people to ignore the real one."""
+    health = _gallery(IdentityStore(tmp_path / "g.db"), "w600k_r50").health
+    assert health["stranded"] == 0
+    assert health["identities_stranded"] == 0
+
+
+# -- open, but not delivering -------------------------------------------
+
+def _source() -> VideoSource:
+    return VideoSource("cam", "rtsp://198.51.100.9:554/x")
+
+
+def test_a_camera_that_never_connected_is_not_stalled():
+    """`stalled` must mean 'was working, stopped'. A camera that has never
+    delivered a frame is a different fault with a different fix."""
+    src = _source()
+    assert src.stalled() is False
+    src.connected = True
+    assert src.stalled() is False, "no frame ever seen is not a stall"
+
+
+def test_a_fresh_frame_is_not_a_stall():
+    src = _source()
+    src.connected = True
+    src._frame_ts = time.time()
+    assert src.stalled() is False
+    assert src.stats()["streaming"] is True
+
+
+def test_an_old_frame_on_an_open_socket_is_a_stall():
+    src = _source()
+    src.connected = True
+    src._frame_ts = time.time() - (capture.STALL_AFTER_S + 1)
+    assert src.stalled() is True
+    stats = src.stats()
+    # The distinction that matters: still connected, no longer streaming.
+    assert stats["connected"] is True
+    assert stats["streaming"] is False
+    assert stats["stalled"] is True
+
+
+def test_a_disconnected_camera_is_reported_as_down_not_stalled():
+    """Two states, opposite actions: check the network vs. the camera is
+    answering and sending nothing. They must never share a verdict."""
+    src = _source()
+    src.connected = False
+    src._frame_ts = time.time() - 3600
+    assert src.stalled() is False
+    assert src.stats()["streaming"] is False
+
+
+# -- a wrong address must not cost 30 seconds ---------------------------
+
+def test_unreachable_source_fails_fast_with_a_reason():
+    """_open() used to hand an unroutable address straight to OpenCV, which
+    blocks ~30s inside the constructor and cannot be interrupted by stop().
+    198.51.100.0/24 is TEST-NET-2 and routes nowhere.
+    """
+    src = VideoSource("cam", "rtsp://198.51.100.9:554/x")
+    started = time.time()
+    assert src._open() is None
+    elapsed = time.time() - started
+    assert elapsed < 8.0, f"pre-flight took {elapsed:.1f}s"
+    assert src.last_error, "a failed open must say why"
+    assert "198.51.100.9" in src.last_error
+    assert src.stats()["last_error"] == src.last_error
+
+
+def test_webcam_sources_skip_the_preflight():
+    """An int source is a local device with no host to reach; the check must
+    pass it through rather than refuse it."""
+    ok, why = capture._tcp_reachable(0, 1.0)
+    assert ok is True and why == ""

web/src/api.js

@@ -206,6 +206,8 @@ export const api = {
 
   sites: () => send('GET', '/api/sites'),
   createSite: (input) => send('POST', '/api/sites', input),
+  updateSite: (site, input) => send('PATCH', `/api/sites/${encodeURIComponent(site)}`, input),
+  deleteSite: (site) => send('DELETE', `/api/sites/${encodeURIComponent(site)}`),
 
   // The live arrivals feed. `cursor` is opaque and must be echoed back.
   arrivals: (params) => send('GET', '/api/visits' + qs(params)),

web/src/styles.css

@@ -568,3 +568,7 @@ button.ghost.danger:hover { border-color: var(--bad); }
              letter-spacing: .04em; text-transform: uppercase; }
 
 .ask-btn .mark { width: 18px; height: 18px; }
+
+.row { display: flex; gap: 10px; align-items: center; flex-wrap: wrap; }
+button.ghost.danger { color: var(--bad); border-color: color-mix(in srgb, var(--bad) 40%, transparent); }
+input[readonly] { opacity: .6; }

web/src/views/Cameras.jsx

@@ -47,9 +47,13 @@ export default function Cameras({ user }) {
 
   const canEdit = ['admin', 'owner', 'manager'].includes(user.role)
   const list = cams || []
-  const up = list.filter(c => c.connected).length
-  const down = list.filter(c => c.connected === false).length
-  const waiting = list.filter(c => c.connected == null).length
+  // Counted off `state`, the one field the server computes, never off
+  // `connected`. Two places deciding the same fact is how a shop came out
+  // labelled Working, in green, above "2 of 3 cameras not connecting".
+  const up = list.filter(c => c.state === 'connected').length
+  const down = list.filter(c => c.state === 'not_connecting').length
+  const waiting = list.filter(c => c.state === 'waiting').length
+  const stale = list.filter(c => c.state === 'stale').length
 
   return (
     <>
@@ -58,6 +62,7 @@ export default function Cameras({ user }) {
         <p className="sub">
           {list.length} {list.length === 1 ? 'camera' : 'cameras'}
           {up > 0 && <> · <b className="ok">{up} connected</b></>}
+          {stale > 0 && <> · <b className="warn">{stale} not reporting</b></>}
           {down > 0 && <> · <b className="bad">{down} down</b></>}
           {waiting > 0 && <> · {waiting} waiting for the shop PC</>}
         </p>
@@ -108,10 +113,13 @@ function CameraCard({ cam, canEdit, onEdit, onWatch }) {
   // Three states, not two. A camera nobody has tried yet is not a camera that
   // is down, and telling an operator to check the cabling on a camera the shop
   // PC has not even seen sends them to the wrong building.
-  const state = cam.connected == null ? 'idle'
-    : cam.connected ? 'ok' : 'bad'
-  const words = cam.connected == null ? 'Waiting for the shop PC'
-    : cam.connected ? 'Connected' : 'Not connecting'
+  // Four states, and the fourth is the one that was missing: a camera whose
+  // shop PC has stopped reporting it. The agent correctly says nothing when it
+  // cannot reach the engine, so the last value it sent used to sit in the
+  // database reading Connected - measured at 34 minutes on the live estate.
+  const state = { connected: 'ok', not_connecting: 'bad', stale: 'warn' }[cam.state] || 'idle'
+  const words = { connected: 'Connected', not_connecting: 'Not connecting',
+                  stale: 'Not reporting' }[cam.state] || 'Waiting for the shop PC'
   const verified = verification(cam)
 
   return (

web/src/views/SiteCheck.jsx

@@ -8,7 +8,7 @@ import { api } from '../api.js'
 // recognising almost nobody. Every step names what to do when it fails, and the
 // shop is only "working" when all of them pass: a partial pass is not a working
 // shop, and calling it one is how that site got signed off.
-export default function SiteCheck({ site, onClose }) {
+export default function SiteCheck({ site, user, onClose, onChanged }) {
   const [result, setResult] = useState(null)
   const [busy, setBusy] = useState(false)
   const [error, setError] = useState('')
@@ -89,6 +89,7 @@ export default function SiteCheck({ site, onClose }) {
           )}
 
           <ClaimPC site={site} />
+          <ShopSettings site={site} user={user} onChanged={onChanged} onClose={onClose} />
         </div>
       </aside>
     </div>
@@ -169,3 +170,74 @@ function expiry(iso) {
   if (days <= 0) return 'today'
   return days === 1 ? 'tomorrow' : `in ${days} days`
 }
+
+// The shop's own details: rename, timezone, and - for a shop opened by mistake
+// - removal. The short name is shown but not editable: it is what the shop PC
+// calls itself and a segment of the broker topic, so renaming it would orphan
+// both. The display name is what people read, and a system that cannot fix a
+// typo in a shop's name has confused the two.
+function ShopSettings({ site, user, onChanged, onClose }) {
+  const [name, setName] = useState(site.name)
+  const [tz, setTz] = useState(site.timezone || 'Asia/Kolkata')
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState('')
+  const [confirming, setConfirming] = useState(false)
+  const canManage = user?.role === 'owner' || user?.role === 'manager'
+  const isOwner = user?.role === 'owner'
+  if (!canManage) return null
+  const dirty = name.trim() !== site.name || tz.trim() !== (site.timezone || 'Asia/Kolkata')
+
+  const save = async (e) => {
+    e.preventDefault()
+    setBusy(true); setError('')
+    try {
+      await api.updateSite(site.slug || site.site_id, { name: name.trim(), timezone: tz.trim() })
+      onChanged?.()
+    } catch (err) { setError(err.message) } finally { setBusy(false) }
+  }
+  const remove = async () => {
+    setBusy(true); setError('')
+    try {
+      await api.deleteSite(site.slug || site.site_id)
+      onChanged?.(); onClose?.()
+    } catch (err) { setError(err.message); setConfirming(false) } finally { setBusy(false) }
+  }
+
+  return (
+    <section className="claim">
+      <h3>Shop details</h3>
+      <form onSubmit={save}>
+        <label className="field">
+          <span>Name</span>
+          <input value={name} onChange={e => setName(e.target.value)} required />
+        </label>
+        <label className="field">
+          <span>Short name</span>
+          <input value={site.slug} readOnly />
+          <span className="hint">Fixed: the shop PC and the broker are keyed on it.</span>
+        </label>
+        <label className="field">
+          <span>Timezone</span>
+          <input value={tz} onChange={e => setTz(e.target.value)} />
+        </label>
+        {error && <p className="error" role="alert">{error}</p>}
+        <div className="row">
+          <button className="primary" disabled={busy || !dirty}>{busy ? 'Saving…' : 'Save'}</button>
+          {isOwner && !confirming && (
+            <button type="button" className="ghost danger" onClick={() => setConfirming(true)}>Remove this shop…</button>
+          )}
+        </div>
+      </form>
+      {confirming && (
+        <div className="banner warn" style={{ marginTop: 12 }}>
+          <b>Remove {site.name}?</b>
+          <p className="sub">Only possible while it has no cameras and no visits. A shop with history is kept.</p>
+          <div className="row">
+            <button className="primary" disabled={busy} onClick={remove}>{busy ? 'Removing…' : 'Yes, remove it'}</button>
+            <button className="ghost" onClick={() => setConfirming(false)}>Keep it</button>
+          </div>
+        </div>
+      )}
+    </section>
+  )
+}

web/src/views/Sites.jsx

@@ -70,7 +70,7 @@ export default function Sites({ user }) {
       {/* Reachable per shop, at last. The smoke test used to hang off a single
           button on the camera screen that always checked sites[0], so with two
           shops the second could not be checked at all. */}
-      {checking && <SiteCheck site={checking} onClose={() => setChecking(null)} />}
+      {checking && <SiteCheck site={checking} user={user} onClose={() => setChecking(null)} onChanged={reload} />}
       {opening && <NewShop onClose={() => setOpening(false)}
                            onCreated={() => { setOpening(false); reload() }} />}
     </>