@camstack/addon-post-analysis 1.2.134 → 1.2.136

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-Dqa0bdV6.js");
+const require_dist = require("../dist-kn_4KEmG.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -27000,8 +27000,12 @@ function rankAndCap(faces, order, limit) {
 *     track through FaceStore.deleteByTracks, and enrolled (`assigned`) rows are
 *     exempt from that and from every sweep — an assignment is a curation act.
 *     The only other bound is capacity: pruneCapOverflow holds each camera's
-*     UNASSIGNED buffer to bufferMaxPerDevice newest rows (default 50). At 10.8 KB
-*     of JSON embedding per row, that cap is what keeps the table small."
+*     UNASSIGNED buffer to bufferMaxPerDevice newest rows (default 50), plus a
+*     SEPARATE, larger budget of deriveSuggestedBufferCap(bufferMaxPerDevice)
+*     rows (default 200) for rows carrying a suggestedIdentityId — a question
+*     the operator has not answered outlives a row nobody asked about, and
+*     evicting one is logged with its deviceId. At 10.8 KB of JSON embedding
+*     per row, those caps are what keep the table small."
 */
 var FACES_COLLECTION = "pipeline-analytics:faces";
 /**
@@ -27029,6 +27033,17 @@ var FACES_COLLECTION = "pipeline-analytics:faces";
 * cap, so the page is always the caller's bound and never the engine's.
 */
 var FACE_SWEEP_PAGE = 1e3;
+/** How many evicted face ids one per-camera eviction line names before it
+*  stops — enough to find the rows, not enough to turn a log line into a page. */
+var SUGGESTED_EVICTION_IDS_LOGGED = 10;
+/**
+* A stored suggestion is present. The relational backend surfaces an unset
+* column as SQL NULL and the fake store as `undefined`; an empty string is
+* neither an identity nor a question, so it is not a suggestion either.
+*/
+function hasSuggestion(raw) {
+	return typeof raw === "string" && raw.length > 0;
+}
 /**
 * Refuses to loop forever if a page ever fails to advance. 1 000 pages is a
 * million faces — far past anything real, and reached only by a bug.
@@ -27235,12 +27250,21 @@ var FaceStore = class {
 	* property the recognizer actually depends on: the gallery of recent
 	* unassigned faces stays small.
 	*
-	* ENROLLED (`assigned`) rows are skipped entirely and do not consume cap
-	* slots. Returns all deleted ids (the caller removes their crops).
+	* **A row the system asked a question about outlives one it said nothing
+	* about.** A single cap evicted both alike, so on 15 of 24 live cameras
+	* (measured 2026-08-25) the buffer sat at exactly the cap and an unanswered
+	* suggestion was deleted within about a day. Rows carrying a
+	* `suggestedIdentityId` are ranked in their OWN, larger budget
+	* (`maxSuggestedPerDevice`) — never immortality, because nothing clears a
+	* suggestion the operator merely declines to answer. Size and trade-off:
+	* `deriveSuggestedBufferCap` in `face-settings.ts:263`.
+	*
+	* ENROLLED (`assigned`) rows are skipped entirely and consume NO slot in
+	* either tier. Returns all deleted ids (the caller removes their crops).
 	*/
 	async pruneCapOverflow(input) {
 		/**
-		* Paged, not one statement. Only three scalars per row survive the page —
+		* Paged, not one statement. Only four scalars per row survive the page —
 		* the `embedding` string that dominates the row is dropped as soon as the
 		* page goes out of scope, so peak heap is one page rather than the whole
 		* face table. The prune still considers EVERY row, which is what makes it a
@@ -27262,38 +27286,79 @@ var FaceStore = class {
 			if (rows.length === 0) break;
 			for (const r of rows) {
 				const data = r.data;
-				if (data.assigned) continue;
-				const deviceId = Number(data.deviceId ?? -1);
+				if (data["assigned"]) continue;
+				const deviceId = Number(data["deviceId"] ?? -1);
 				const list = byDevice.get(deviceId) ?? [];
 				list.push({
 					id: r.id,
-					timestamp: Number(data.timestamp ?? 0)
+					timestamp: Number(data["timestamp"] ?? 0),
+					suggested: hasSuggestion(data["suggestedIdentityId"])
 				});
 				byDevice.set(deviceId, list);
 			}
 			if (rows.length < 1e3) break;
 		}
 		const toDelete = /* @__PURE__ */ new Set();
-		for (const list of byDevice.values()) {
+		const suggestedVictims = /* @__PURE__ */ new Map();
+		for (const [deviceId, list] of byDevice) {
 			list.sort((a, b) => b.timestamp - a.timestamp);
-			list.forEach((row, idx) => {
-				if (idx >= input.maxPerDevice) toDelete.add(row.id);
-			});
+			let ordinaryRank = 0;
+			let suggestedRank = 0;
+			for (const row of list) {
+				if (row.suggested) {
+					if (suggestedRank++ < input.maxSuggestedPerDevice) continue;
+					toDelete.add(row.id);
+					const victims = suggestedVictims.get(deviceId) ?? [];
+					victims.push(row.id);
+					suggestedVictims.set(deviceId, victims);
+					continue;
+				}
+				if (ordinaryRank++ < input.maxPerDevice) continue;
+				toDelete.add(row.id);
+			}
 		}
-		const deleted = [];
+		const deleted = /* @__PURE__ */ new Set();
 		for (const id of toDelete) try {
 			await this.store.delete.mutate({
 				collection: FACES_COLLECTION,
 				key: id
 			});
-			deleted.push(id);
+			deleted.add(id);
 		} catch (err) {
 			this.logger.warn("FaceStore.pruneCapOverflow delete failed", { meta: {
 				faceId: id,
 				error: String(err)
 			} });
 		}
-		return deleted;
+		this.announceSuggestedEvictions(suggestedVictims, deleted, input.maxSuggestedPerDevice);
+		return [...deleted];
+	}
+	/**
+	* Name every camera that lost an UNANSWERED suggestion, and how many.
+	*
+	* This exists because the loss it reports ran for weeks without a single log
+	* line: the prune only ever logged an aggregate count with no `deviceId`, so
+	* "why did camera 618 forget the person it asked me about" could not be asked
+	* of the logs at all. One line per camera (not per row) keeps the volume sane
+	* while still answering the per-camera question.
+	*
+	* Reports rows that were ACTUALLY deleted — a row whose delete threw is still
+	* in the buffer, and is reported by the failure line above instead.
+	*/
+	announceSuggestedEvictions(victimsByDevice, deleted, cap) {
+		for (const [deviceId, victims] of victimsByDevice) {
+			const gone = victims.filter((id) => deleted.has(id));
+			if (gone.length === 0) continue;
+			this.logger.warn("face buffer evicted UNANSWERED suggestions — the operator never saw them", {
+				tags: { deviceId },
+				meta: {
+					deleted: gone.length,
+					cap,
+					faceIds: gone.slice(0, SUGGESTED_EVICTION_IDS_LOGGED),
+					why: "the suggested tier is full on this camera: suggestions arrive faster than they are answered, and the OLDEST unanswered ones are dropped first."
+				}
+			});
+		}
 	}
 	/** Flip `assigned` to true and record which identity was matched. Optionally persist the sample id. */
 	async markAssigned(faceId, identityId, sampleId) {
@@ -29021,9 +29086,18 @@ function pairRiders(detections) {
 }
 //#endregion
 //#region src/pipeline-analytics/pipeline/tracker/rescue-growth.ts
-/** How far the grown box's centroid may sit, as a multiple of the LARGER
-*  diagonal. 1.35 covers the live 4285605a bird→dog jump (~75px / 59px). */
-var GROWTH_CENTROID_FACTOR = 1.35;
+/**
+* How far the grown box's centroid may sit, as a multiple of the **TRACK's own**
+* diagonal. It was a multiple of the LARGER of the two diagonals until
+* 2026-08-25, which meant the bigger the INTRUDING detection, the further it
+* could reach to steal an identity. Live track `59dfb972` lost its car that
+* way: a 386×752 box 574 px away out-reached a 364×385 track purely because it
+* was 2.07× the area. The reach is now a property of the track alone.
+*
+* 2.3 covers the live `4285605a` bird→dog jump (74.7 px over a 35.8 px crop
+* diagonal = 2.085) with the same ~10% headroom the old 1.35 gave it.
+*/
+var GROWTH_CENTROID_FACTOR = 2.3;
 function intersectionArea(a, b) {
 	const x1 = Math.max(a.x, b.x);
 	const y1 = Math.max(a.y, b.y);
@@ -29032,11 +29106,30 @@ function intersectionArea(a, b) {
 	if (x2 <= x1 || y2 <= y1) return 0;
 	return (x2 - x1) * (y2 - y1);
 }
-/** Same-class partial crop growing into (or collapsing from) a full-body box
-*  with IoU 0. Used by rescue and spawn-dedup so we do not mint a second id.
-*  A SMALL box nested inside a LARGE one is occlusion, not growth — those
-*  stay two tracks (sort-tracker occlusion suite). */
-function growthAdjacentMatch(track, det) {
+/**
+* Same-class partial crop growing into (or collapsing from) a full-body box
+* with IoU 0. Used by rescue and spawn-dedup so we do not mint a second id.
+* A SMALL box nested inside a LARGE one is occlusion, not growth — those
+* stay two tracks (sort-tracker occlusion suite).
+*
+* **Geometry alone cannot make this gate safe, and that is measured, not
+* assumed.** The two live cases:
+*
+* | case | dist | trackDiag | dist/trackDiag | dist/maxDiag | dt | trackDiag/s |
+* | --- | ---: | ---: | ---: | ---: | ---: | ---: |
+* | `4285605a` bird→dog (KEEP) | 74.7 | 35.8 | 2.085 | 1.238 | 170 ms | 12.26 |
+* | `59dfb972` car A→car B (REJECT) | 573.8 | 529.8 | 1.083 | 0.679 | 106 ms | 10.22 |
+*
+* The theft is a *milder* jump than the case the gate exists for, in EVERY
+* scale-relative measure — and still milder once divided by elapsed time. A
+* scale-invariant geometric predicate that accepts the bird therefore MUST
+* accept the car; so must a speed cap expressed in track-diagonals per second.
+* The separator has to be something other than the shape of the two boxes, and
+* the one that holds is track MATURITY ({@link GROWTH_MAX_TRACK_AGE_MS}).
+*/
+function growthAdjacentMatch(track, det, ctx) {
+	if (ctx.trackAgeMs > 1500) return false;
+	if (ctx.gapMs > 1e3) return false;
 	const trackArea = track.w * track.h;
 	const detArea = det.w * det.h;
 	if (trackArea <= 0 || detArea <= 0) return false;
@@ -29046,8 +29139,24 @@ function growthAdjacentMatch(track, det) {
 	if (intersectionArea(track, det) / smaller >= .5) return false;
 	const tc = bboxCentroid(track);
 	const dc = bboxCentroid(det);
-	return Math.hypot(tc.x - dc.x, tc.y - dc.y) <= GROWTH_CENTROID_FACTOR * Math.max(Math.hypot(track.w, track.h), Math.hypot(det.w, det.h));
+	return Math.hypot(tc.x - dc.x, tc.y - dc.y) <= GROWTH_CENTROID_FACTOR * Math.hypot(track.w, track.h);
 }
+/** Per-(stage, gate) counter + sampling decision. One instance per tracker, so
+*  the counts are per camera and per detection source. */
+var LooseBindSampler = class {
+	counts = /* @__PURE__ */ new Map();
+	/** Increment the (stage, gate) counter and answer with the running total when
+	*  this decision should be reported, or `undefined` when it is sampled out. */
+	next(stage, gate) {
+		const key = `${stage}|${gate}`;
+		const count = (this.counts.get(key) ?? 0) + 1;
+		this.counts.set(key, count);
+		if (count === 1 || count % 50 === 0) return count;
+	}
+	reset() {
+		this.counts.clear();
+	}
+};
 //#endregion
 //#region src/pipeline-analytics/pipeline/tracker/sort-tracker.ts
 var DEFAULT_TRACKER_CONFIG = {
@@ -29125,12 +29234,62 @@ var SortTracker = class SortTracker {
 	* moment the pair stops overlapping and are pruned when either track dies.
 	*/
 	dupStreaks = /* @__PURE__ */ new Map();
+	/** Per-(stage, gate) counters behind the sampled salvage-bind diagnostics. */
+	bindSampler = new LooseBindSampler();
+	/** Sink for salvage-bind diagnostics. Null until an owner that knows the
+	*  `deviceId` wires one — see {@link setBindObserver}. */
+	bindObserver = null;
 	constructor(config = {}) {
 		this.config = {
 			...DEFAULT_TRACKER_CONFIG,
 			...config
 		};
 	}
+	/**
+	* Wire the diagnostics sink for the salvage branches (rescue, resurrection,
+	* growth spawn-dedup). The tracker has no `deviceId`; the caller that does
+	* stamps it on the log line. Stage 1 is never reported — it runs per track
+	* per frame at frame-rate.
+	*/
+	setBindObserver(observer) {
+		this.bindObserver = observer;
+	}
+	/** Emit one salvage decision, subject to {@link LOOSE_BIND_LOG_SAMPLE_EVERY}.
+	*  Nothing is computed when no observer is wired. */
+	reportBind(stage, gate, track, det, timestamp) {
+		const observer = this.bindObserver;
+		if (!observer) return;
+		const bindCount = this.bindSampler.next(stage, gate);
+		if (bindCount === void 0) return;
+		const tc = bboxCentroid(track.bbox);
+		const dc = bboxCentroid(det.bbox);
+		const trackArea = track.bbox.w * track.bbox.h;
+		const detArea = det.bbox.w * det.bbox.h;
+		const smaller = Math.min(trackArea, detArea);
+		observer({
+			stage,
+			gate,
+			trackId: track.id,
+			trackClass: track.class,
+			detClass: det.class,
+			detScore: det.score,
+			iou: iou$2(track.bbox, det.bbox),
+			centroidDistPx: Math.hypot(tc.x - dc.x, tc.y - dc.y),
+			trackDiagPx: Math.hypot(track.bbox.w, track.bbox.h),
+			areaRatio: smaller > 0 ? Math.max(trackArea, detArea) / smaller : 0,
+			dtMs: timestamp - track.lastSeen,
+			trackAgeMs: timestamp - track.firstSeen,
+			bindCount,
+			sampledEvery: 50
+		});
+	}
+	/** When the pair is being judged, relative to `track`. */
+	static growthContext(track, timestamp) {
+		return {
+			trackAgeMs: timestamp - track.firstSeen,
+			gapMs: timestamp - track.lastSeen
+		};
+	}
 	/** Whether two macro-classes may be collapsed as the SAME subject. Same class
 	*  always; the {person,animal} pair only when `personAnimalDedup` is on. */
 	dedupCompatible(a, b) {
@@ -29175,8 +29334,15 @@ var SortTracker = class SortTracker {
 	* set of tracks already surviving this frame (matched, coasting, resurrected,
 	* and earlier same-frame spawns).
 	*/
-	isDuplicateSpawn(det, live) {
-		for (const t of live) if (this.dedupCompatible(t.class, det.class) && (iou$2(det.bbox, t.bbox) >= this.config.dedupSpawnIou || growthAdjacentMatch(t.bbox, det.bbox))) return true;
+	isDuplicateSpawn(det, live, timestamp) {
+		for (const t of live) {
+			if (!this.dedupCompatible(t.class, det.class)) continue;
+			if (iou$2(det.bbox, t.bbox) >= this.config.dedupSpawnIou) return true;
+			if (growthAdjacentMatch(t.bbox, det.bbox, SortTracker.growthContext(t, timestamp))) {
+				this.reportBind("spawn-dedup", "growth", t, det, timestamp);
+				return true;
+			}
+		}
 		if (this.config.personAnimalDedup && det.class === ANIMAL_CLASS && det.score < this.config.animalOverPersonMaxScore) {
 			for (const t of live) if (t.class === PERSON_CLASS && iou$2(det.bbox, t.bbox) >= this.config.animalOverPersonIou) return true;
 		}
@@ -29263,15 +29429,36 @@ var SortTracker = class SortTracker {
 	* crouch→animal flip when `classGroupAssoc` is on, but never by an unrelated
 	* class.
 	*/
-	looseMatch(track, det) {
-		if (this.assocGroup(track.class) !== this.assocGroup(det.class)) return false;
-		if (iou$2(track.bbox, det.bbox) >= this.config.rescueIouThreshold) return true;
+	looseMatch(track, det, timestamp) {
+		if (this.assocGroup(track.class) !== this.assocGroup(det.class)) return null;
+		if (iou$2(track.bbox, det.bbox) >= this.config.rescueIouThreshold) return "iou";
 		const tc = bboxCentroid(track.bbox);
 		const dc = bboxCentroid(det.bbox);
 		const dist = Math.hypot(tc.x - dc.x, tc.y - dc.y);
 		const diag = Math.hypot(track.bbox.w, track.bbox.h);
-		if (dist <= this.config.rescueCentroidFactor * diag) return true;
-		return growthAdjacentMatch(track.bbox, det.bbox);
+		if (dist <= this.config.rescueCentroidFactor * diag) return "centroid";
+		if (growthAdjacentMatch(track.bbox, det.bbox, SortTracker.growthContext(track, timestamp))) return "growth";
+		return null;
+	}
+	/**
+	* Whether `det` would mint a track of its own if no salvage branch claimed it:
+	* it clears BOTH spawn floors (per-class score, per-class bbox-area fraction).
+	*
+	* A rescue that rests on PROXIMITY ALONE — the `centroid` clause, reached only
+	* when the overlap is already below `rescueIouThreshold` — must lose to such a
+	* detection. Live track `27855a56` bound a second car 452 px away at IoU 0.058
+	* purely because 452 ≤ 0.75 × the 589×445 track diagonal; the box it stole was
+	* a full-size, floor-clearing vehicle that would have spawned perfectly well
+	* on its own. **A spare track costs media; a stolen track corrupts the plate,
+	* the travelled distance and the last frame of the track it was taken from.**
+	*
+	* The `iou` clause is untouched (real overlap IS evidence), and so is `growth`
+	* — that one is bounded by track maturity inside `growthAdjacentMatch`, and a
+	* partial crop is by construction the same subject, so refusing it here would
+	* re-fragment `4285605a`.
+	*/
+	isPlausibleBirth(det, frameArea) {
+		return this.meetsClassScoreFloor(det) && this.meetsSpawnAreaFloor(det, frameArea);
 	}
 	/** Fold a matched detection's class + score into a track's lifetime vote
 	*  tally. A non-positive score still counts as an infinitesimal vote so a
@@ -29385,20 +29572,25 @@ var SortTracker = class SortTracker {
 			for (let di = 0; di < detections.length; di++) {
 				if (used.has(di) || lowSet.has(di)) continue;
 				const det = detections[di];
-				if (!this.looseMatch(track, det)) continue;
+				const gate = this.looseMatch(track, det, timestamp);
+				if (gate === null) continue;
+				if (gate === "centroid" && this.isPlausibleBirth(det, frameArea)) continue;
 				rescuePairs.push({
 					track,
 					detIdx: di,
-					score: iou$2(track.bbox, det.bbox)
+					score: iou$2(track.bbox, det.bbox),
+					gate
 				});
 			}
 		}
 		rescuePairs.sort((a, b) => b.score - a.score);
 		for (const pair of rescuePairs) {
 			if (matchedTracks.has(pair.track) || used.has(pair.detIdx)) continue;
-			matched.set(pair.track, detections[pair.detIdx]);
+			const det = detections[pair.detIdx];
+			matched.set(pair.track, det);
 			matchedTracks.add(pair.track);
 			used.add(pair.detIdx);
+			this.reportBind("rescue", pair.gate, pair.track, det, timestamp);
 		}
 		if (this.config.byteTrackEnabled && lowIdxs.length > 0) this.greedyAssociate(detections, lowIdxs, this.config.byteTrackLowIouThreshold, used, matchedTracks, matched);
 		for (const [track, det] of matched) {
@@ -29452,17 +29644,22 @@ var SortTracker = class SortTracker {
 			const det = detections[di];
 			let best;
 			let bestScore = -1;
+			let bestGate = "iou";
 			for (const lost of this.lostTracks) {
 				if (!lost.resurrectable) continue;
 				if (timestamp - lost.lostAt > this.config.resurrectionWindowMs) continue;
-				if (!this.looseMatch(lost, det)) continue;
+				const gate = this.looseMatch(lost, det, timestamp);
+				if (gate === null) continue;
+				if (gate === "centroid" && this.isPlausibleBirth(det, frameArea)) continue;
 				const score = iou$2(lost.bbox, det.bbox);
 				if (score > bestScore) {
 					best = lost;
 					bestScore = score;
+					bestGate = gate;
 				}
 			}
 			if (!best) continue;
+			this.reportBind("resurrection", bestGate, best, det, timestamp);
 			this.lostTracks = this.lostTracks.filter((t) => t !== best);
 			best.bbox = det.bbox;
 			best.class = det.class;
@@ -29502,7 +29699,7 @@ var SortTracker = class SortTracker {
 				continue;
 			}
 			if (this.config.occlusionEnabled && occluderBoxes.some((ob) => containment(det.bbox, ob) >= this.config.occlusionContainment)) continue;
-			if (this.config.dedupEnabled && this.isDuplicateSpawn(det, surviving)) {
+			if (this.config.dedupEnabled && this.isDuplicateSpawn(det, surviving, timestamp)) {
 				used.add(di);
 				continue;
 			}
@@ -29561,6 +29758,7 @@ var SortTracker = class SortTracker {
 		this.tracks = [];
 		this.lostTracks = [];
 		this.dupStreaks.clear();
+		this.bindSampler.reset();
 	}
 };
 //#endregion
@@ -29977,6 +30175,16 @@ var FrameProcessor = class {
 	setStationaryGate(gate) {
 		this.stationaryGate = gate;
 	}
+	/**
+	* Wire (or clear) the tracker's salvage-bind diagnostics sink. The tracker
+	* itself knows no `deviceId`; the addon that owns this processor stamps
+	* `tags: { deviceId }` on the line — see the wiring in `pipeline-analytics`.
+	* Only the rescue / resurrection / growth branches report, and they report
+	* sampled: stage 1 runs per track per frame at frame-rate.
+	*/
+	setBindObserver(observer) {
+		this.tracker.setBindObserver(observer);
+	}
 	/** Forget a track in the underlying tracker (used when the addon promotes it
 	*  to a stationary-object registry entry). */
 	dropTrack(trackId) {
@@ -34936,6 +35144,70 @@ async function makeSquareThumb(bytes, size) {
 	}).jpeg({ quality: THUMB_QUALITY }).toBuffer();
 }
 //#endregion
+//#region src/pipeline-analytics/track-media-scope.ts
+/** The stored kind a detail owner's crop is written with. */
+var STORED_DETAIL_CROP_KIND = "crop";
+/** The kinds only a detail owner can produce. */
+var DETAIL_CROP_KINDS = ["faceCrop", "plateCrop"];
+/**
+* Every owner that holds media for `trackId`, in publication order (the track's
+* own rows first, then face, then plate).
+*/
+function trackMediaOwnerScopes(trackId) {
+	return [
+		{
+			ownerKind: "track",
+			ownerId: trackId,
+			publishCropAs: null
+		},
+		{
+			ownerKind: "face",
+			ownerId: `${FACE_MEDIA_OWNER_PREFIX}${trackId}`,
+			publishCropAs: "faceCrop"
+		},
+		{
+			ownerKind: "plate",
+			ownerId: `${PLATE_MEDIA_OWNER_PREFIX}${trackId}`,
+			publishCropAs: "plateCrop"
+		}
+	];
+}
+/**
+* The scopes worth READING for a `kinds`-filtered request.
+*
+* A detail owner can only ever publish `faceCrop` / `plateCrop`, so a request
+* that names neither is answered without opening those two owners — which is
+* what keeps the common per-entry fetch (`kinds: ['keyFrameSmall']`) at exactly
+* its previous cost. The track scope is never skipped: it is the only owner
+* whose kinds are open-ended, and dropping it on a guess is how a listing
+* starts lying about what a track has.
+*/
+function trackMediaScopesForKinds(trackId, kinds) {
+	const scopes = trackMediaOwnerScopes(trackId);
+	if (kinds === void 0 || kinds.length === 0) return scopes;
+	return kinds.some((kind) => DETAIL_CROP_KINDS.includes(kind)) ? scopes : scopes.filter((scope) => scope.publishCropAs === null);
+}
+/**
+* Fold every scope's rows into ONE track media listing: detail crops
+* relabelled, everything filtered to `kinds`, ordered oldest first.
+*
+* `relabel` is injected rather than spread inline so the caller keeps its own
+* concrete row type (`MediaFile` with bytes, `MediaFileInfo` without) — there
+* is no cast and no third shape in between.
+*/
+function collectTrackMedia(scoped, relabel, kinds) {
+	const out = [];
+	for (const { scope, rows } of scoped) for (const row of rows) {
+		if (scope.publishCropAs === null) {
+			out.push(row);
+			continue;
+		}
+		if (row.kind !== STORED_DETAIL_CROP_KIND) continue;
+		out.push(relabel(row, scope.publishCropAs));
+	}
+	return (kinds === void 0 || kinds.length === 0 ? out : out.filter((row) => kinds.includes(row.kind))).toSorted((a, b) => a.timestamp - b.timestamp);
+}
+//#endregion
 //#region src/pipeline-analytics/zone-name-stamp.ts
 /**
 * Copy each track with `zoneNames` stamped on.
@@ -35055,10 +35327,25 @@ var AnalyticsQueryFacade = class {
 		const all = await (this.deps.mediaStore()?.listByOwner("event", input.eventId, input.deviceId) ?? Promise.resolve([]));
 		return input.kind ? all.filter((m) => m.kind === input.kind) : all;
 	}
+	/**
+	* A track's media WITH the bytes, restricted to `kinds` when given.
+	*
+	* Reads every owner a track's media lives under — its own rows plus the face
+	* and plate detail crops, whose stored `kind: 'crop'` is published as
+	* `faceCrop` / `plateCrop`. See `track-media-scope.ts` for why the rename
+	* happens on the way out and not in the caller's question.
+	*/
 	async getTrackMedia(input) {
-		const all = await (this.deps.mediaStore()?.listByOwner("track", input.trackId, input.deviceId) ?? Promise.resolve([]));
-		const kinds = input.kinds;
-		return kinds && kinds.length > 0 ? all.filter((m) => kinds.includes(m.kind)) : all;
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		const scopes = trackMediaScopesForKinds(input.trackId, input.kinds);
+		return collectTrackMedia(await Promise.all(scopes.map(async (scope) => ({
+			scope,
+			rows: await store.listByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
+		}))), (row, kind) => ({
+			...row,
+			kind
+		}), input.kinds);
 	}
 	/**
 	* A track's media WITHOUT the bytes.
@@ -35068,9 +35355,21 @@ var AnalyticsQueryFacade = class {
 	* that path reads every blob off disk and base64-encodes it first, so the
 	* response would shrink while the work did not. Measured: 7.67 MB read and
 	* ~10 MB of string allocated, to answer a question the index already holds.
+	*
+	* Covers the same owners as {@link getTrackMedia} — a manifest that listed
+	* fewer keys than the byte read can serve (or more) is the disagreement the
+	* viewer's per-entry loader turns into a red triangle.
 	*/
 	async listTrackMedia(input) {
-		return this.deps.mediaStore()?.listInfoByOwner("track", input.trackId, input.deviceId) ?? Promise.resolve([]);
+		const store = this.deps.mediaStore();
+		if (store === null) return [];
+		return collectTrackMedia(await Promise.all(trackMediaOwnerScopes(input.trackId).map(async (scope) => ({
+			scope,
+			rows: await store.listInfoByOwner(scope.ownerKind, scope.ownerId, input.deviceId)
+		}))), (row, kind) => ({
+			...row,
+			kind
+		}), void 0);
 	}
 	async pruneEventsBefore(input) {
 		const eventStore = this.deps.eventStore();
@@ -37610,13 +37909,20 @@ var FaceSettingsSchema = require_dist.object({
 	* 0.175, best accuracy 98.3% at threshold 0.28.
 	*
 	* Recalibration plan, in this order:
-	*   1. land the landmark-precision gate (the alignment fix),
+	*   1. DONE (2026-08-19, commit b6641329f): the landmark-precision gate —
+	*      `landmark-precision-gate.ts` in `addon-pipeline`, called from
+	*      `detection-pipeline/pipeline/executor.ts:1164` BEFORE the native-size
+	*      substitution, floor `minLandmarkFaceSize` (default 24 detection px).
+	*      Do not re-implement it; the steps below are what is still open.
 	*   2. re-enrol the gallery from crops produced AFTER it,
 	*   3. re-measure genuine/impostor over a week of post-fix traffic,
 	*   4. expect to lower this toward ~0.30, and `margin` with it.
-	* Lowering it BEFORE step 1 would be actively harmful: a misaligned crop
-	* scores ~0.9 against everything, so the degenerate population sits ABOVE
-	* any threshold you could pick — the knob cannot reach it.
+	* Lowering it before step 2 is still actively harmful: the gate stops NEW
+	* degenerate crops, but every vector enrolled before it is still in the
+	* gallery, and a misaligned crop scores ~0.9 against everything — so the
+	* degenerate population sits ABOVE any threshold you could pick and the knob
+	* cannot reach it. Steps 3 and 4 need data that only exists once step 2 has
+	* run and post-fix traffic has accumulated.
 	*/
 	similarityThreshold: require_dist.number().min(0).max(1).default(.55),
 	/** Reject ambiguous matches: require best − secondBest ≥ margin. 0.10→0.15
@@ -37752,6 +38058,18 @@ function deriveSuggestionMinCosine(similarityThreshold) {
 	return rounded < similarityThreshold ? rounded : exact;
 }
 /**
+* The suggested tier's capacity for a given ordinary capacity.
+*
+* INVARIANT, total over every finite input: the result is a non-negative
+* integer, is never BELOW `bufferMaxPerDevice` (a suggested row is never worse
+* off than an unsuggested one), and is `0` exactly when the ordinary cap is `0`
+* (one switch turns the buffer off, not two).
+*/
+function deriveSuggestedBufferCap(bufferMaxPerDevice) {
+	if (!Number.isFinite(bufferMaxPerDevice) || bufferMaxPerDevice <= 0) return 0;
+	return Math.round(bufferMaxPerDevice * 4);
+}
+/**
 * The settings key that used to hold the suggestion floor. Named once, here,
 * because the ONLY code allowed to mention it now is the migration that removes
 * it from a store.
@@ -44326,13 +44644,27 @@ var SUPPRESS_IOU = .6;
 */
 var WAKE_ASSOC_IOU = .1;
 /**
-* Look-back window over which a track must have stayed put to be PROMOTED. A
-* car that drives in then parks has a large whole-life displacement but a tiny
-* last-`windowMs` displacement — so promotion is judged on the recent window,
-* not the full path. Also the minimum age (the track must have EXISTED this
-* long) so a freshly-spawned static blob isn't promoted instantly.
-*/
-var PROMOTION_WINDOW_MS = 3e4;
+* Look-back window over which a track must have stayed put to stop counting as
+* PRESENT for the orchestrator's session hold.
+*
+* This used to be the promotion criterion — "a track that stayed still this
+* long IS a parked object" — and it was measuring the wrong thing: it rewarded
+* an object seen well and often, while the parked cars that actually need
+* suppressing are re-discovered as dozens of short tracks that never live this
+* long (device 617: 140 tracks for one car, median life 6.8 s). Birth moved to
+* repetition — see `stationary-evidence.ts`.
+*
+* The stillness test survives because it was doing TWO jobs and only one of
+* them was destructive. Creating an entry BLINDS the pipeline to an object, so
+* it needs repeated evidence. Deciding that a motionless subject should stop
+* holding a motion session open destroys nothing — if it is wrong the session
+* closes early and the next motion re-opens it — so one recent stillness read
+* is the right amount of proof. Without this valve, removing promotion would
+* leave every session containing a parked car pinned to `maxSessionHoldMs`
+* (120 s) forever: 617 measured 504 sessions in 24 h, which is 70% detection
+* uptime on one camera, and three cameras are already above 50%.
+*/
+var SESSION_STILLNESS_WINDOW_MS = 3e4;
 /** Unconfirmed-entry time-to-live: if no detection confirms an entry for this
 *  long (object removed while unobserved, or a long occlusion) → retire it. */
 var ENTRY_TTL_MS = 5 * 6e4;
@@ -44353,15 +44685,20 @@ var DEFAULT_MATCH_CONFIG = {
 *     which entries are confirmed present, and which entries WOKE (their object
 *     moved → retire the entry and let the detection spawn a normal track).
 *
-*  2. `evaluateStationaryPromotion` — given a track's recent centroid path,
-*     decides whether it has stayed put long enough to become a stationary
-*     entry. Reuses the static-track-gate metrics (net displacement + path span
-*     normalised to the frame diagonal) over the recent look-back window.
+*  2. `trackIsStill` — given a track's recent centroid path, decides whether it
+*     has stopped moving. Reuses the static-track-gate metrics (net
+*     displacement + path span normalised to the frame diagonal) over the
+*     recent look-back window.
+*
+*     This does NOT create a stationary entry, and used to. Birth is decided by
+*     repetition (`stationary-evidence.ts`); this predicate now answers the one
+*     question whose wrong answer is harmless — "should this subject still hold
+*     a motion session open?"
 */
-/** Default promotion tunables — static thresholds shared with the key-event
-*  static gate so "stationary" means the same thing in both places. */
-var DEFAULT_PROMOTION_CONFIG = {
-	windowMs: PROMOTION_WINDOW_MS,
+/** Default stillness tunables — static thresholds shared with the key-event
+*  static gate so "still" means the same thing in both places. */
+var DEFAULT_SESSION_STILLNESS_CONFIG = {
+	windowMs: SESSION_STILLNESS_WINDOW_MS,
 	netFracMax: STATIC_DISPLACEMENT_FRAC,
 	spanFracMax: STATIC_SPAN_FRAC,
 	minPoints: 4
@@ -44483,26 +44820,29 @@ function partitionDetectionsAgainstRegistry(input) {
 }
 var EMPTY_ARMED = /* @__PURE__ */ new Set();
 /**
-* A track is promoted when, over the recent `windowMs`, its centroid barely
-* moved (both net displacement and path span below the static thresholds) AND
-* the track has actually EXISTED for at least `windowMs` (so a car that just
-* arrived isn't parked yet). Judging on the recent window — not the whole life
-* — is what lets a car that drove in then parked be recognised as stationary.
+* A track is STILL when, over the recent `windowMs`, its centroid barely moved
+* (both net displacement and path span below the static thresholds) AND the
+* track has actually EXISTED for at least `windowMs` (so a car that just
+* arrived has not stopped yet). Judging on the recent window — not the whole
+* life — is what lets a car that drove in then stopped be recognised.
+*
+* The one consumer is the orchestrator's presence signal: a still subject stops
+* holding its motion session open. It creates nothing and suppresses nothing.
 */
-function evaluateStationaryPromotion(input) {
+function trackIsStill(input) {
 	const { positions, referenceDiagonalPx, now, config } = input;
-	if (!(referenceDiagonalPx > 0) || positions.length === 0) return { promote: false };
-	if (now - positions[0].timestamp < config.windowMs) return { promote: false };
+	if (!(referenceDiagonalPx > 0) || positions.length === 0) return { still: false };
+	if (now - positions[0].timestamp < config.windowMs) return { still: false };
 	const cutoff = now - config.windowMs;
 	const window = positions.filter((p) => p.timestamp >= cutoff);
-	if (window.length < config.minPoints) return { promote: false };
+	if (window.length < config.minPoints) return { still: false };
 	const metrics = computeStaticTrackMetrics(window.map((p) => ({
 		x: p.x,
 		y: p.y
 	})), referenceDiagonalPx);
-	if (metrics === void 0) return { promote: false };
+	if (metrics === void 0) return { still: false };
 	return {
-		promote: metrics.netDisplacementFrac < config.netFracMax && metrics.pathSpanFrac < config.spanFracMax,
+		still: metrics.netDisplacementFrac < config.netFracMax && metrics.pathSpanFrac < config.spanFracMax,
 		netFrac: metrics.netDisplacementFrac,
 		spanFrac: metrics.pathSpanFrac
 	};
@@ -45009,6 +45349,602 @@ var PackageDropDetector = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-evidence.ts
+/**
+* stationary-evidence — how a parked object EARNS a registry entry.
+*
+* ## The criterion this replaces, and why it was measuring the wrong thing
+*
+* Until 2026-08-28 an object became stationary by TRACK CONTINUITY: one track
+* had to stay alive and barely move for `PROMOTION_WINDOW_MS` (30 s). That
+* rewards an object that is *seen well and often* — precisely the opposite of
+* what the operator needs. Measured on device 617 (the parking lot), 24 h:
+*
+*   - three cars are parked in view; the registry held exactly ONE entry;
+*   - the two it missed were re-discovered as **140 and 112 separate tracks**,
+*     median life **6.8 s**, p90 29 s. Not one of them could ever reach 30 s.
+*   - those two objects alone produced **13 494 of 18 402** vehicle
+*     observations (73%) — the whole re-spawn flood the registry exists to stop.
+*
+* The track dies; the OBJECT does not. So the evidence must outlive the track.
+*
+* ## The new criterion: a RATIO, not a count
+*
+* "The same thing, in the same place, most of the times it was seen."
+*
+*   N — observations that AGREED with the candidate's anchor box (IoU ≥
+*       {@link StationaryEvidencePolicy.agreeIou}).
+*   M — observations OFFERED by a track once it bound to this candidate,
+*       agreeing or not.
+*
+* A count would rescue nothing: a badly-lit car at night is seen rarely, and
+* any floor high enough to exclude a passer-by would exclude it too. A RATIO
+* asks a question a rarely-seen object can still answer well — 8 sightings out
+* of 10 in the same spot is stationary even though 10 is a small number.
+*
+* The dilution is the whole point, and it is why M counts a bound track's
+* observations even after it walks away: a car that drives THROUGH a spot binds
+* for a few frames and then contributes dozens of disagreeing ones. Measured on
+* 617 the two populations do not overlap:
+*
+*   | candidate                    | N / M       | ratio |
+*   | ---------------------------- | ----------- | ----- |
+*   | parked car A (missed today)  | 6405 / 6467 | 0.99  |
+*   | parked car B (missed today)  |  343 /  343 | 1.00  |
+*   | car crossing the lot         |    5 /   70 | 0.07  |
+*   | car turning through the lot  |   14 /   91 | 0.15  |
+*   | car manoeuvring              |   12 /   41 | 0.29  |
+*
+* The threshold sits in the empty band between 0.29 and 0.99.
+*
+* ## The span is what a ratio cannot say
+*
+* A ratio alone promotes a car that paused for four seconds — its handful of
+* observations all agree. So evidence must also STRETCH: the agreeing
+* observations must span {@link StationaryEvidencePolicy.minSpanMs}. Measured
+* on 617, real parked cars span 2 min to 24 h; the two momentary stops in the
+* same day spanned 4.2 s and 8.0 s. Setting the span to
+* `DEFAULT_MAX_SESSION_HOLD_MS` also buys a structural guarantee: no single
+* motion session, however long it is held open, can promote on its own.
+*
+* ## ONE ledger, two producers
+*
+* Evidence is anchored to a BOX, not to a track and not to a session, so an
+* object confirmed half by an active motion session and half by a periodic
+* burst still promotes. Occasion A (the session) is implemented and is
+* sufficient on its own — it is free, because the pipeline is already decoding
+* and already inferring. Occasion B (the burst) is a precaution for the cases
+* where A could not have fired at all (hub restarted, camera offline, motion
+* detection failed, object already parked at boot); it is NOT implemented yet,
+* and {@link StationaryEvidenceSource} is the seam it will arrive through.
+*
+* ## Identity is IoU. There is no grid.
+*
+* The predecessor mechanism (`phantom-cells.ts`) quantises a point to a 32 px
+* cell, and its write path passes a CENTROID while its read path passes a
+* top-left CORNER — at 32 px every box bigger than 32 px lands in a different
+* cell on read, and its unit test never crosses that boundary because it calls
+* both halves with the same literal coordinates. This module has no such
+* boundary to get wrong: a candidate is found by overlap against the boxes a
+* device already holds, bounded by {@link EVIDENCE_MAX_CANDIDATES_PER_DEVICE}.
+* Device 617 — the busiest lot in the fleet — holds 8.
+*/
+/**
+* `vehicle` and its kin. Every number below is read off device 617 over 24 h
+* (18 402 vehicle observations, 290 tracks) with the three parked cars the
+* operator can see out of the window as the bench.
+*
+* - `agreeIou` **0.5** — between the registry's own `WAKE_ASSOC_IOU` (0.1) and
+*   `SUPPRESS_IOU` (0.6). At 0.7 the two missed cars lose 11% of their evidence
+*   to night-time box wobble for no reduction in promotions; at 0.3 the day's
+*   promotions double (10 vs 5) without catching anything new.
+* - `minAgreementRatio` **0.6** — the measured gap is [0.29, 0.90]; 0.6 is the
+*   middle of it. Raising it to 0.95 starts dropping real parked cars.
+* - `minAgreed` **8** — a floor, not a discriminator: sweeping it 3→60 changes
+*   nothing on 617 (the smallest true positive promotes with N=15). Set well
+*   below that so a rarely-seen object is never excluded for being rare, which
+*   is the entire point of using a ratio.
+* - `minSpanMs` **120 000** — the real discriminator. True positives span
+*   2 min–24 h; the day's two momentary stops spanned 4.2 s and 8.0 s.
+*/
+var VEHICLE_EVIDENCE_POLICY = {
+	agreeIou: .5,
+	minAgreed: 8,
+	minAgreementRatio: .6,
+	minSpanMs: 12e4,
+	promotesByDefault: true
+};
+/**
+* `person`, and it ships OFF.
+*
+* This is not caution, it is a measurement. Replaying 24 h of person
+* observations from devices 617, 1443, 590 and 592 through this exact ledger:
+*
+*   | ratio | minAgreed | minSpanMs | promotions / 24 h across 4 cameras |
+*   | ----- | --------- | --------- | ---------------------------------- |
+*   | 0.85  |        20 |     600 s | 22                                 |
+*   | 0.95  |        40 |    1800 s | 10                                 |
+*   | 0.99  |        80 |    1800 s | **6**                              |
+*
+* There is no setting that reaches zero. Device 590 holds a person-shaped thing
+* that agrees with itself 1292 times out of 1654 (0.78) across 26 tracks over
+* ten hours, and device 592 produced eleven candidates at ratio 1.00 between
+* 02:00 and 05:00 — a statue, a poster, an IR artifact; the ledger cannot tell
+* those from a person standing still, because they look identical to it.
+*
+* Promoting a person is a BLINDING decision (D49 read in the direction that
+* destroys work: for a car the destructive read is the RETIREMENT — the flood
+* comes back; for a person it is the BIRTH — we stop seeing them). So the
+* class is available, tuned as strictly as the data allows, and switched off
+* until an operator turns it on for a camera where they know what is standing
+* there.
+*/
+var PERSON_EVIDENCE_POLICY = {
+	agreeIou: .5,
+	minAgreed: 40,
+	minAgreementRatio: .95,
+	minSpanMs: 18e5,
+	promotesByDefault: false
+};
+/** Classes with no policy of their own fall back to the vehicle numbers —
+*  `animal`, `package` and friends are all "an object that ended up somewhere",
+*  and none of them makes the camera blind to a person. */
+var DEFAULT_EVIDENCE_POLICY = VEHICLE_EVIDENCE_POLICY;
+var POLICY_BY_CLASS = new Map([["vehicle", VEHICLE_EVIDENCE_POLICY], ["person", PERSON_EVIDENCE_POLICY]]);
+function evidencePolicyFor(className) {
+	return POLICY_BY_CLASS.get(className) ?? DEFAULT_EVIDENCE_POLICY;
+}
+function stationaryEvidenceKey(deviceId, className, anchorId) {
+	return `${deviceId}:${className}:${anchorId}`;
+}
+/**
+* Does this candidate's evidence justify a registry entry?
+*
+* Pure, and ordered cheapest-question-first so the reason a candidate was
+* refused is the FIRST thing it failed, not the last.
+*/
+function evaluateStationaryEvidence(row, policy, classEnabled) {
+	const ratio = row.seen > 0 ? row.agreed / row.seen : 0;
+	const spanMs = row.lastAgreedAt - row.firstAgreedAt;
+	const base = {
+		agreed: row.agreed,
+		seen: row.seen,
+		ratio,
+		spanMs
+	};
+	if (!classEnabled) return {
+		kind: "accumulating",
+		shortfall: "class-not-promoted",
+		...base
+	};
+	if (row.agreed < policy.minAgreed) return {
+		kind: "accumulating",
+		shortfall: "too-few-agreements",
+		...base
+	};
+	if (ratio < policy.minAgreementRatio) return {
+		kind: "accumulating",
+		shortfall: "inconsistent-position",
+		...base
+	};
+	if (spanMs < policy.minSpanMs) return {
+		kind: "accumulating",
+		shortfall: "span-too-short",
+		...base
+	};
+	return {
+		kind: "promote",
+		...base
+	};
+}
+/**
+* The candidate this observation belongs to: the same-class row whose anchor it
+* overlaps most, provided the overlap reaches `agreeIou`. Overlap is the ONLY
+* notion of sameness here, and it is the same {@link iou} the suppression gate
+* uses — a second notion of "same place" is a second source of truth.
+*/
+function matchEvidenceCandidate(rows, className, bbox, agreeIou) {
+	let best;
+	let bestOverlap = 0;
+	for (const row of rows) {
+		if (row.className !== className) continue;
+		const overlap = iou(row.anchor, bbox);
+		if (overlap > bestOverlap) {
+			bestOverlap = overlap;
+			best = row;
+		}
+	}
+	if (best === void 0 || bestOverlap < agreeIou) return void 0;
+	return {
+		row: best,
+		overlap: bestOverlap
+	};
+}
+/**
+* Fold one observation into a candidate.
+*
+* `agrees` is decided by the CALLER, because M is what makes the ratio mean
+* anything: once a track has bound to a candidate, every later observation of
+* that track counts toward M whether it agrees or not. That is what dilutes a
+* car that merely drove through the spot, and it is why this function cannot
+* re-derive agreement from the box alone.
+*/
+function foldObservation(row, observation, agrees, overlap) {
+	const seen = row.seen + 1;
+	if (!agrees) return {
+		...row,
+		seen,
+		updatedAt: observation.timestamp
+	};
+	const improves = overlap >= iou(row.anchor, row.bestBbox);
+	return {
+		...row,
+		seen,
+		agreed: row.agreed + 1,
+		firstAgreedAt: Math.min(row.firstAgreedAt, observation.timestamp),
+		lastAgreedAt: Math.max(row.lastAgreedAt, observation.timestamp),
+		...improves ? {
+			bestBbox: { ...observation.bbox },
+			...observation.trackId !== void 0 ? { sourceTrackId: observation.trackId } : {},
+			...observation.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: observation.keyFrameMediaKey } : {},
+			...observation.label !== void 0 ? { label: observation.label } : {}
+		} : {},
+		sessionAgreed: row.sessionAgreed + (observation.source === "session" ? 1 : 0),
+		burstAgreed: row.burstAgreed + (observation.source === "burst" ? 1 : 0),
+		updatedAt: observation.timestamp
+	};
+}
+/** A brand-new candidate anchored on the observation that had nowhere to go. */
+function newEvidenceRow(observation, anchorId) {
+	return {
+		key: stationaryEvidenceKey(observation.deviceId, observation.className, anchorId),
+		deviceId: observation.deviceId,
+		className: observation.className,
+		anchor: { ...observation.bbox },
+		agreed: 1,
+		seen: 1,
+		firstAgreedAt: observation.timestamp,
+		lastAgreedAt: observation.timestamp,
+		bestBbox: { ...observation.bbox },
+		...observation.trackId !== void 0 ? { sourceTrackId: observation.trackId } : {},
+		...observation.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: observation.keyFrameMediaKey } : {},
+		...observation.label !== void 0 ? { label: observation.label } : {},
+		sessionAgreed: observation.source === "session" ? 1 : 0,
+		burstAgreed: observation.source === "burst" ? 1 : 0,
+		updatedAt: observation.timestamp
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-evidence-ledger.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="a candidate's BIRTH and its PROMOTION are written immediately; the per-frame agreement tallies are STAGED in RAM and flushed on the 5-minute sweep (a parked car is observed 5-30 times a second and one commit per observation would offer ~10^6 writes a day to maintain a handful of rows)"
+*   retention="a candidate untouched for 6h is deleted, and a device is capped at 512 candidates (least-recently-touched evicted). A promoted candidate is deleted the moment its entry is born. Never orphaned by track retention — evidence describes an OBJECT that outlives every track that ever saw it, which is the entire reason this collection exists."
+*/
+var STATIONARY_EVIDENCE_COLLECTION = "pipeline-analytics:stationary-evidence";
+var STATIONARY_EVIDENCE_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "className",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "anchor",
+		type: "JSON"
+	},
+	{
+		name: "agreed",
+		type: "INTEGER"
+	},
+	{
+		name: "seen",
+		type: "INTEGER"
+	},
+	{
+		name: "firstAgreedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "lastAgreedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "bestBbox",
+		type: "JSON"
+	},
+	{
+		name: "sourceTrackId",
+		type: "TEXT"
+	},
+	{
+		name: "keyFrameMediaKey",
+		type: "TEXT"
+	},
+	{
+		name: "label",
+		type: "TEXT"
+	},
+	{
+		name: "sessionAgreed",
+		type: "INTEGER"
+	},
+	{
+		name: "burstAgreed",
+		type: "INTEGER"
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER"
+	}
+];
+var STATIONARY_EVIDENCE_INDEXES = [{
+	name: "idx_stationary_evidence_device",
+	columns: ["deviceId"]
+}];
+function parseBbox(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const { x, y, w, h } = { ...value };
+	if (typeof x !== "number" || typeof y !== "number") return null;
+	if (typeof w !== "number" || typeof h !== "number") return null;
+	return {
+		x,
+		y,
+		w,
+		h
+	};
+}
+function numberOr(value, fallback) {
+	return typeof value === "number" ? value : fallback;
+}
+function stringOrUndefined(value) {
+	return typeof value === "string" ? value : void 0;
+}
+var StationaryEvidenceLedger = class {
+	ledger;
+	logger;
+	/** deviceId → candidate keys, so a device's candidates are found without
+	*  scanning the fleet. */
+	byDevice = /* @__PURE__ */ new Map();
+	/** `deviceId:trackId` → candidate key. RAM-only, see the file header. */
+	binding = /* @__PURE__ */ new Map();
+	/** Keys whose staged tallies have not been persisted yet. */
+	dirty = /* @__PURE__ */ new Set();
+	anchorSeq = 0;
+	constructor(deps) {
+		this.logger = deps.logger;
+		const spec = {
+			collection: STATIONARY_EVIDENCE_COLLECTION,
+			columns: [...STATIONARY_EVIDENCE_COLUMNS],
+			indexes: [...STATIONARY_EVIDENCE_INDEXES],
+			writeMode: "write-behind",
+			keyOf: (row) => row.key,
+			toValue: (row) => ({
+				deviceId: row.deviceId,
+				className: row.className,
+				anchor: { ...row.anchor },
+				agreed: row.agreed,
+				seen: row.seen,
+				firstAgreedAt: row.firstAgreedAt,
+				lastAgreedAt: row.lastAgreedAt,
+				bestBbox: { ...row.bestBbox },
+				...row.sourceTrackId !== void 0 ? { sourceTrackId: row.sourceTrackId } : {},
+				...row.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: row.keyFrameMediaKey } : {},
+				...row.label !== void 0 ? { label: row.label } : {},
+				sessionAgreed: row.sessionAgreed,
+				burstAgreed: row.burstAgreed,
+				updatedAt: row.updatedAt
+			}),
+			fromRecord: (key, data) => {
+				const deviceId = data.deviceId;
+				const className = data.className;
+				if (typeof deviceId !== "number" || typeof className !== "string") return null;
+				const anchor = parseBbox(data.anchor);
+				const bestBbox = parseBbox(data.bestBbox) ?? anchor;
+				if (anchor === null || bestBbox === null) return null;
+				const sourceTrackId = stringOrUndefined(data.sourceTrackId);
+				const keyFrameMediaKey = stringOrUndefined(data.keyFrameMediaKey);
+				const label = stringOrUndefined(data.label);
+				const updatedAt = numberOr(data.updatedAt, 0);
+				return {
+					key,
+					deviceId,
+					className,
+					anchor,
+					agreed: numberOr(data.agreed, 0),
+					seen: numberOr(data.seen, 0),
+					firstAgreedAt: numberOr(data.firstAgreedAt, updatedAt),
+					lastAgreedAt: numberOr(data.lastAgreedAt, updatedAt),
+					bestBbox,
+					...sourceTrackId !== void 0 ? { sourceTrackId } : {},
+					...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {},
+					...label !== void 0 ? { label } : {},
+					sessionAgreed: numberOr(data.sessionAgreed, 0),
+					burstAgreed: numberOr(data.burstAgreed, 0),
+					updatedAt
+				};
+			},
+			deviceIdOf: (row) => row.deviceId
+		};
+		this.ledger = new DurableLedger({
+			spec,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	/** Boot reseed. Returns how many candidates came back — "loaded 0" after a
+	*  container recreate is the one line that explains a silent regression. */
+	async load() {
+		const rows = await this.ledger.load();
+		for (const row of rows) this.index(row);
+		return rows.length;
+	}
+	get size() {
+		return this.ledger.snapshot().length;
+	}
+	candidatesFor(deviceId) {
+		const keys = this.byDevice.get(deviceId);
+		if (!keys) return [];
+		const rows = [];
+		for (const key of keys) {
+			const row = this.ledger.get(key);
+			if (row) rows.push(row);
+		}
+		return rows;
+	}
+	/**
+	* Fold ONE observation in and say whether it just earned an entry.
+	*
+	* Synchronous by construction: the verdict is read from the RAM mirror, so a
+	* slow or failing store can never change what this frame decides. The
+	* durable half is fired behind the verdict.
+	*/
+	observe(observation, classEnabled) {
+		const policy = evidencePolicyFor(observation.className);
+		this.expire(observation.deviceId, observation.timestamp);
+		const bindKey = observation.trackId === void 0 ? void 0 : `${observation.deviceId}:${observation.trackId}`;
+		const candidates = this.candidatesFor(observation.deviceId);
+		let row;
+		const boundKey = bindKey === void 0 ? void 0 : this.binding.get(bindKey);
+		if (boundKey !== void 0) row = this.ledger.get(boundKey);
+		let overlap = row === void 0 ? 0 : iou(row.anchor, observation.bbox);
+		let created = false;
+		if (row === void 0) {
+			const match = matchEvidenceCandidate(candidates, observation.className, observation.bbox, policy.agreeIou);
+			if (match) {
+				row = match.row;
+				overlap = match.overlap;
+			} else {
+				this.anchorSeq += 1;
+				row = newEvidenceRow(observation, `a${this.anchorSeq}`);
+				overlap = 1;
+				created = true;
+				this.index(row);
+				this.write(row);
+				if (bindKey !== void 0) this.binding.set(bindKey, row.key);
+				this.capDevice(observation.deviceId);
+				return {
+					row,
+					verdict: evaluateStationaryEvidence(row, policy, classEnabled),
+					promoted: false
+				};
+			}
+			if (bindKey !== void 0) this.binding.set(bindKey, row.key);
+		}
+		const agrees = overlap >= policy.agreeIou;
+		const next = foldObservation(row, observation, agrees, overlap);
+		this.ledger.stage(next);
+		this.dirty.add(next.key);
+		if (created) this.capDevice(observation.deviceId);
+		const verdict = evaluateStationaryEvidence(next, policy, classEnabled);
+		if (verdict.kind !== "promote") return {
+			row: next,
+			verdict,
+			promoted: false
+		};
+		this.forgetKey(next.key);
+		return {
+			row: next,
+			verdict,
+			promoted: true
+		};
+	}
+	/** Persist the staged tallies. Called from the registry's 5-minute sweep. */
+	async flush() {
+		const keys = [...this.dirty];
+		this.dirty.clear();
+		let written = 0;
+		for (const key of keys) {
+			const row = this.ledger.get(key);
+			if (!row) continue;
+			await this.write(row);
+			written += 1;
+		}
+		return written;
+	}
+	/** Drop a device's evidence wholesale (camera removed / analytics reset). */
+	async clearDevice(deviceId) {
+		for (const row of this.candidatesFor(deviceId)) await this.forgetKeyDurable(row.key);
+		this.byDevice.delete(deviceId);
+		for (const [bindKey] of this.binding) if (bindKey.startsWith(`${deviceId}:`)) this.binding.delete(bindKey);
+	}
+	/** Forget the bindings of tracks the tracker no longer carries, so the map
+	*  cannot grow for the process's lifetime on a busy camera. */
+	retainTracks(deviceId, liveTrackIds) {
+		const prefix = `${deviceId}:`;
+		for (const bindKey of [...this.binding.keys()]) {
+			if (!bindKey.startsWith(prefix)) continue;
+			if (!liveTrackIds.has(bindKey.slice(prefix.length))) this.binding.delete(bindKey);
+		}
+	}
+	forgetKey(key) {
+		this.forgetKeyDurable(key);
+	}
+	async forgetKeyDurable(key) {
+		const row = this.ledger.get(key);
+		this.dirty.delete(key);
+		if (row) this.byDevice.get(row.deviceId)?.delete(key);
+		for (const [bindKey, boundTo] of this.binding) if (boundTo === key) this.binding.delete(bindKey);
+		await this.ledger.forget(key);
+	}
+	async write(row) {
+		this.dirty.delete(row.key);
+		await this.ledger.put(row);
+	}
+	index(row) {
+		let keys = this.byDevice.get(row.deviceId);
+		if (!keys) {
+			keys = /* @__PURE__ */ new Set();
+			this.byDevice.set(row.deviceId, keys);
+		}
+		keys.add(row.key);
+	}
+	/** Drop candidates untouched for {@link EVIDENCE_WINDOW_MS}. Evidence
+	*  describes an object that can drive away; a stale candidate is not a
+	*  weaker one, it is one about a thing that is gone. */
+	expire(deviceId, now) {
+		for (const row of this.candidatesFor(deviceId)) {
+			if (now - row.updatedAt <= 216e5) continue;
+			this.logger.debug("stationary evidence expired — candidate untouched past the window", {
+				tags: { deviceId },
+				meta: {
+					className: row.className,
+					agreed: row.agreed,
+					seen: row.seen,
+					ageMs: now - row.updatedAt
+				}
+			});
+			this.forgetKey(row.key);
+		}
+	}
+	capDevice(deviceId) {
+		const rows = this.candidatesFor(deviceId);
+		if (rows.length <= 512) return;
+		const excess = [...rows].sort((a, b) => a.updatedAt - b.updatedAt).slice(0, rows.length - 512);
+		this.logger.info("stationary evidence capped — least-recently-touched candidates evicted", {
+			tags: { deviceId },
+			meta: {
+				evicted: excess.length,
+				cap: 512
+			}
+		});
+		for (const row of excess) this.forgetKey(row.key);
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-registry.ts
 /**
 * @durable class=ledger owner=pipeline-analytics
@@ -55654,8 +56590,8 @@ function resolveTrackingSettings(raw) {
 * with no drift. Guarded by a unit test asserting the equality.
 */
 var StationarySettingsSchema = require_dist.object({
-	/** Master switch. Off ⇒ no promotion + no suppression for this camera (every
-	*  parked object keeps spawning normal tracks). */
+	/** Master switch. Off ⇒ this camera gathers no evidence and suppresses
+	*  nothing (every parked object keeps spawning normal tracks). */
 	enabled: require_dist.boolean().default(true),
 	/** IoU at/above which a detection is the same parked object, unmoved →
 	*  suppress its spawn. `SUPPRESS_IOU`. */
@@ -55664,9 +56600,22 @@ var StationarySettingsSchema = require_dist.object({
 	*  wake it) — the overlap gate that stops a different vehicle from waking a
 	*  parked entry (the 617 flood fix). `WAKE_ASSOC_IOU`. */
 	wakeAssocIou: require_dist.number().min(.02).max(.5).default(WAKE_ASSOC_IOU),
-	/** Recent-window stillness a track must hold to be PROMOTED to a parked
-	*  entry (also the minimum track age). `PROMOTION_WINDOW_MS`. */
-	promotionWindowMs: require_dist.number().int().min(5e3).max(12e4).default(PROMOTION_WINDOW_MS),
+	/** Recent-window stillness after which a track stops holding its motion
+	*  session open (also the minimum track age). Creates nothing — birth is
+	*  decided by repeated evidence. `SESSION_STILLNESS_WINDOW_MS`. */
+	sessionStillnessWindowMs: require_dist.number().int().min(5e3).max(12e4).default(SESSION_STILLNESS_WINDOW_MS),
+	/**
+	* Let a motionless PERSON become a stationary entry on this camera.
+	*
+	* Off, and it is a measurement rather than caution. Replaying 24 h of person
+	* observations from devices 617/1443/590/592 through the evidence ledger
+	* produces 6-22 entries a day depending on how strictly it is tuned, and none
+	* of them can be tuned to zero: device 592 alone yielded eleven candidates at
+	* a perfect agreement ratio between 02:00 and 05:00. A stationary entry
+	* SUPPRESSES its object, so a wrong one makes the camera blind to a person —
+	* turn this on only for a camera where you know what is standing there.
+	*/
+	promotePersons: require_dist.boolean().default(false),
 	/** Observed-time TTL: retire an entry unconfirmed for this long (measured on
 	*  frames-flowing time, not wall-clock). `ENTRY_TTL_MS`. */
 	entryTtlMs: require_dist.number().int().min(6e4).max(18e5).default(ENTRY_TTL_MS)
@@ -55685,7 +56634,8 @@ function resolveStationarySettings(raw) {
 		enabled: pick("enabled"),
 		suppressIou: pick("suppressIou"),
 		wakeAssocIou: pick("wakeAssocIou"),
-		promotionWindowMs: pick("promotionWindowMs"),
+		sessionStillnessWindowMs: pick("sessionStillnessWindowMs"),
+		promotePersons: pick("promotePersons"),
 		entryTtlMs: pick("entryTtlMs")
 	};
 }
@@ -56210,17 +57160,24 @@ function buildDetectionSettingsSections() {
 				},
 				{
 					type: "slider",
-					key: "promotionWindowMs",
-					label: "Promotion stillness window",
-					description: "How long (ms) an object must stay put — and the track must have existed — before it is promoted to a parked entry. Longer = slower to stop a re-spawn flood.",
+					key: "sessionStillnessWindowMs",
+					label: "Session stillness window",
+					description: "How long (ms) a tracked object must stay put before it stops holding a motion session open. It creates nothing: a parked object becomes an entry by being seen repeatedly in the same place, not by one track surviving this long.",
 					min: 5e3,
 					max: 12e4,
 					step: 1e3,
-					default: STATIONARY_DEFAULTS.promotionWindowMs,
+					default: STATIONARY_DEFAULTS.sessionStillnessWindowMs,
 					showValue: true,
 					unit: "s",
 					displayScale: 1e3
 				},
+				{
+					type: "boolean",
+					key: "promotePersons",
+					label: "Also park motionless people",
+					description: "Off by default. A stationary entry SUPPRESSES its object, so a wrong one makes this camera blind to a person standing there. Replaying a day of real person detections produced entries on every camera tried, at every threshold tried — turn this on only where you know what is standing still.",
+					default: STATIONARY_DEFAULTS.promotePersons
+				},
 				{
 					type: "slider",
 					key: "entryTtlMs",
@@ -58713,6 +59670,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	*  confirmation gate's bar there; one moving track clears it. Null until
 	*  onInitialize. */
 	phantomCells = null;
+	/** Repeated-sighting evidence — the ONLY thing that creates a stationary
+	*  entry. Two producers may feed it; only the motion session does today. */
+	stationaryEvidence = null;
 	mediaStore = null;
 	/** The enrolled gallery's rows. Retained so the photo-enrollment bridge can
 	*  reach them without going back through the cap surface. Null until S7. */
@@ -59976,6 +60936,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			}
 		});
 		await this.stationaryRegistry.load();
+		this.stationaryEvidence = new StationaryEvidenceLedger({
+			store: api.settingsStore,
+			logger: logger.child("StationaryEvidence")
+		});
+		await this.stationaryEvidence.declare();
+		const evidenceLoaded = await this.stationaryEvidence.load();
+		logger.info("stationary evidence loaded", { meta: { candidates: evidenceLoaded } });
 		this.phantomCells = new PhantomCellRegistry({
 			store: api.settingsStore,
 			logger: logger.child("PhantomCells")
@@ -61364,6 +62331,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.retentionSweepTimer = setInterval(() => {
 			this.sweepRetention();
 			this.stationaryRegistry?.sweep(Date.now());
+			this.stationaryEvidence?.flush();
 			this.eventsOpsLog?.pruneBefore(Date.now() - OPS_LOG_RETENTION_MS);
 		}, RETENTION_SWEEP_INTERVAL_MS);
 		this.ltsFlushTimer = setInterval(() => {
@@ -62198,38 +63166,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const stationarySettings = this.stationarySettingsFromCache(deviceId);
 		const packageSettings = this.packageDropSettingsFromCache(deviceId);
 		const packageClasses = new Set(packageSettings.packageDropClassFilter);
-		if (source === "pipeline" && this.stationaryRegistry && stationarySettings.enabled) {
-			const dims = this.lastFrameDimsByDevice.get(deviceId);
-			if (dims && dims.w > 0 && dims.h > 0) {
-				const refDiag = Math.hypot(dims.w, dims.h);
-				const promotionConfig = {
-					...DEFAULT_PROMOTION_CONFIG,
-					windowMs: stationarySettings.promotionWindowMs
+		if (source === "pipeline" && this.stationaryRegistry && this.stationaryEvidence && stationarySettings.enabled) {
+			const evidence = this.stationaryEvidence;
+			for (const t of result.tracked) {
+				if (packageClasses.has(t.className)) continue;
+				const classEnabled = t.className === "person" ? stationarySettings.promotePersons : evidencePolicyFor(t.className).promotesByDefault;
+				const active = this.trackStore?.peekActive(t.trackId) ?? null;
+				const observedLabel = active === null ? void 0 : displayLabel(active);
+				const observedKeyFrame = this.residents.keyFrameKey(t.trackId);
+				const observation = {
+					deviceId,
+					className: t.className,
+					bbox: { ...t.bbox },
+					timestamp: result.timestamp,
+					source: "session",
+					trackId: t.trackId,
+					...observedKeyFrame !== void 0 ? { keyFrameMediaKey: observedKeyFrame } : {},
+					...observedLabel !== void 0 ? { label: observedLabel } : {}
 				};
-				for (const t of result.tracked) {
-					if (packageClasses.has(t.className)) continue;
-					const active = this.trackStore.peekActive(t.trackId);
-					if (!active) continue;
-					const { promote } = evaluateStationaryPromotion({
-						positions: active.positions,
-						referenceDiagonalPx: refDiag,
-						now: result.timestamp,
-						config: promotionConfig
-					});
-					if (!promote) continue;
-					this.promoteToStationary({
-						deviceId,
-						key,
-						processor,
-						track: t,
-						firstSeen: active.firstSeen,
-						label: displayLabel(active),
-						frameWidth: result.frameWidth,
-						frameHeight: result.frameHeight,
-						timestamp: result.timestamp
-					});
-				}
+				const outcome = evidence.observe(observation, classEnabled);
+				if (outcome === void 0 || !outcome.promoted) continue;
+				this.birthStationaryFromEvidence({
+					deviceId,
+					key,
+					processor,
+					track: t,
+					row: outcome.row,
+					frameWidth: result.frameWidth,
+					frameHeight: result.frameHeight,
+					timestamp: result.timestamp,
+					firstSeen: active === null ? outcome.row.firstAgreedAt : active.firstSeen
+				});
 			}
+			evidence.retainTracks(deviceId, currentTrackIds);
 		}
 		if (source === "pipeline") this.runPackageStillness({
 			deviceId,
@@ -62522,7 +63491,22 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			}
 			overlayDetections = frame.detections;
 		}
-		const hasMovingTrack = result.tracked.some((t) => t.state === "moving" || t.state === "entered" || t.state === "left");
+		const stillnessConfig = {
+			...DEFAULT_SESSION_STILLNESS_CONFIG,
+			windowMs: this.stationarySettingsFromCache(deviceId).sessionStillnessWindowMs
+		};
+		const stillnessDims = this.lastFrameDimsByDevice.get(deviceId);
+		const stillnessDiag = stillnessDims && stillnessDims.w > 0 && stillnessDims.h > 0 ? Math.hypot(stillnessDims.w, stillnessDims.h) : 0;
+		const hasLiveTrack = result.tracked.some((t) => {
+			const active = this.trackStore?.peekActive(t.trackId);
+			if (!active) return true;
+			return !trackIsStill({
+				positions: active.positions,
+				referenceDiagonalPx: stillnessDiag,
+				now: result.timestamp,
+				config: stillnessConfig
+			}).still;
+		});
 		this.ctx.eventBus.emit({
 			id: `pa-${(0, node_crypto.randomUUID)()}`,
 			timestamp: new Date(result.timestamp),
@@ -62538,7 +63522,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				frameWidth: result.frameWidth,
 				frameHeight: result.frameHeight,
 				detections: overlayDetections,
-				hasMovingTrack
+				hasLiveTrack
 			}
 		});
 	}
@@ -62805,9 +63789,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	/**
 	* Count SHORT + MOTIONLESS track closes per frame cell.
 	*
-	* The stationary registry cannot see this class of phantom. Promotion needs a
-	* track that has EXISTED for `PROMOTION_WINDOW_MS` (30 s), and these die long
-	* before: the dead ornamental grass on device 615 produced tracks of 3.8 s,
+	* The stationary registry answers a different question (is this object parked,
+	* and should it be suppressed?). This one raises a spawn bar. The dead
+	* ornamental grass on device 615 produced tracks of 3.8 s,
 	* 4.1 s, 6.5 s and 19.0 s with 0-2.5 px of total displacement, roughly
 	* fifteen of them in a day, all at the same spot. Each one is individually
 	* innocent; the RECURRENCE is the signal, and nothing survives a track death
@@ -64344,29 +65328,41 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* track-OWNED entity (both rows carry a `trackId`) and it aged crops out from
 	* under tracks still well inside their own window. Only the capacity bound
 	* remains (D61).
+	*
+	* The cap is the OPERATOR'S, not the schema default. `bufferMaxPerDevice` is
+	* offered on the settings form and this sweep read `FACE_DEFAULTS` instead,
+	* so an override was a knob that wrote a store nobody read — the D62 shape.
+	* The suggested tier is DERIVED from whatever value is in force
+	* (`deriveSuggestedBufferCap`), so the two can never disagree.
 	*/
 	async holdBufferCaps() {
 		const mediaStore = this.mediaStore;
 		if (!mediaStore) return;
+		const bufferMaxPerDevice = await this.resolveBufferCap();
+		const maxSuggestedPerDevice = deriveSuggestedBufferCap(bufferMaxPerDevice);
 		if (this.faceStore) try {
-			const deletedFaceIds = await this.faceStore.pruneCapOverflow({ maxPerDevice: FACE_DEFAULTS.bufferMaxPerDevice });
+			const deletedFaceIds = await this.faceStore.pruneCapOverflow({
+				maxPerDevice: bufferMaxPerDevice,
+				maxSuggestedPerDevice
+			});
 			if (deletedFaceIds.length > 0) {
 				await mediaStore.deleteForOwner("face", deletedFaceIds);
 				this.ctx.logger.info("face buffer capacity prune", { meta: {
 					deleted: deletedFaceIds.length,
-					cap: FACE_DEFAULTS.bufferMaxPerDevice
+					cap: bufferMaxPerDevice,
+					suggestedCap: maxSuggestedPerDevice
 				} });
 			}
 		} catch (err) {
 			this.ctx.logger.debug("face buffer cap prune failed", { meta: { error: String(err) } });
 		}
 		if (this.plateStore) try {
-			const deletedPlateIds = await this.plateStore.pruneCapOverflow({ maxPerDevice: FACE_DEFAULTS.bufferMaxPerDevice });
+			const deletedPlateIds = await this.plateStore.pruneCapOverflow({ maxPerDevice: bufferMaxPerDevice });
 			if (deletedPlateIds.length > 0) {
 				await mediaStore.deleteForOwner("plate", deletedPlateIds);
 				this.ctx.logger.info("plate buffer capacity prune", { meta: {
 					deleted: deletedPlateIds.length,
-					cap: FACE_DEFAULTS.bufferMaxPerDevice
+					cap: bufferMaxPerDevice
 				} });
 			}
 		} catch (err) {
@@ -64374,6 +65370,28 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		}
 	}
 	/**
+	* The buffer capacity actually in force: the GLOBAL setting, falling back to
+	* the schema default when the store cannot be read.
+	*
+	* Global-only on purpose. The sweep is one pass over the whole collection and
+	* a per-device cascade would mean one settings read per camera on every tick,
+	* for a knob whose whole job is bounding a table. A per-camera capacity is a
+	* decision nobody has asked for; the fallback here is the same number the
+	* sweep used unconditionally before, so a settings outage cannot make the
+	* bound stricter than it has ever been.
+	*/
+	async resolveBufferCap() {
+		try {
+			return resolveFaceSettings(await this.resolveGlobalStore()).bufferMaxPerDevice;
+		} catch (err) {
+			this.ctx.logger.debug("face buffer cap: global settings unreadable, using the default", { meta: {
+				error: String(err),
+				cap: FACE_DEFAULTS.bufferMaxPerDevice
+			} });
+			return FACE_DEFAULTS.bufferMaxPerDevice;
+		}
+	}
+	/**
 	* Ingest a native (onboard) camera detection push and run it through
 	* the SAME analysis layers as the ML pipeline, tagged `source:
 	* 'onboard'`. Flag-only pushes (no bbox) can't be zoned/tracked and are
@@ -64660,29 +65678,41 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			});
 		}
 	}
-	promoteToStationary(input) {
-		const { deviceId, key, processor, track, firstSeen, label, frameWidth, frameHeight, timestamp } = input;
-		const keyFrameMediaKey = this.residents.keyFrameKey(track.trackId);
-		const plausible = isPlausibleThumbnailBox(track.bbox, frameWidth, frameHeight);
-		if (!plausible) this.ctx.logger.info("stationary promotion rejected (near-full-frame box)", {
+	/**
+	* Turn a candidate whose evidence is sufficient into a registry entry.
+	*
+	* The BOX, label and key-frame come from the evidence row — the best agreeing
+	* sighting across every track that ever contributed — not from whichever
+	* track happened to be alive on the tipping frame. That is the point of the
+	* ledger: the object outlives its tracks, so the entry must be built from
+	* what was learned about the object, not from the last one to see it.
+	*/
+	birthStationaryFromEvidence(input) {
+		const { deviceId, key, processor, track, row, firstSeen, frameWidth, frameHeight, timestamp } = input;
+		const label = row.label;
+		const keyFrameMediaKey = row.keyFrameMediaKey ?? this.residents.keyFrameKey(track.trackId);
+		const plausible = isPlausibleThumbnailBox(row.bestBbox, frameWidth, frameHeight);
+		if (!plausible) this.ctx.logger.info("stationary birth rejected (near-full-frame box)", {
 			tags: { deviceId },
 			meta: {
 				trackId: track.trackId,
-				className: track.className,
-				bbox: track.bbox
+				className: row.className,
+				bbox: row.bestBbox,
+				agreed: row.agreed,
+				seen: row.seen
 			}
 		});
 		const entry = {
 			id: (0, node_crypto.randomUUID)(),
 			deviceId,
-			className: track.className,
-			bbox: { ...track.bbox },
+			className: row.className,
+			bbox: { ...row.bestBbox },
 			frameWidth,
 			frameHeight,
 			firstSeenAt: firstSeen,
 			becameStationaryAt: timestamp,
 			lastConfirmedAt: timestamp,
-			sourceTrackId: track.trackId,
+			sourceTrackId: row.sourceTrackId ?? track.trackId,
 			...label !== void 0 ? { label } : {},
 			...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {}
 		};
@@ -64720,12 +65750,19 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.detailDispatcher?.onTrackEnded(deviceId, track.trackId);
 		this.overlayState.onTrackEnded(deviceId, track.trackId);
 		this.lastActiveTrackIds.get(key)?.delete(track.trackId);
-		this.ctx.logger.info("track promoted to stationary", {
+		this.ctx.logger.info("stationary entry born from repeated evidence", {
 			tags: { deviceId },
 			meta: {
 				trackId: track.trackId,
-				className: track.className,
+				className: row.className,
 				entryId: entry.id,
+				agreed: row.agreed,
+				seen: row.seen,
+				agreementRatio: row.seen > 0 ? Number((row.agreed / row.seen).toFixed(3)) : 0,
+				spanMs: row.lastAgreedAt - row.firstAgreedAt,
+				sessionAgreed: row.sessionAgreed,
+				burstAgreed: row.burstAgreed,
+				plausible,
 				...label ? { label } : {}
 			}
 		});
@@ -64782,6 +65819,15 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				cooldownSec,
 				minTrackAgeMs: trk.minTrackAgeMs
 			}, source);
+			p.setBindObserver((record) => {
+				this.ctx.logger.debug("tracker: salvage bind", {
+					tags: { deviceId },
+					meta: {
+						source,
+						...record
+					}
+				});
+			});
 			p.setTrackLabelState((trackId) => {
 				const active = this.trackStore?.getActiveByTrack(trackId);
 				return active !== null && active !== void 0 ? {
@@ -65158,6 +66204,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.residents.closeDevice(input.deviceId);
 		this.stationaryRegistry?.clearDevice(input.deviceId);
 		this.phantomCells?.clearDevice(input.deviceId);
+		this.stationaryEvidence?.clearDevice(input.deviceId);
 		this.packageBackground?.clearDevice(input.deviceId);
 		this.overlayState.clearDevice(input.deviceId);
 		this.overlaySynthesisWarnAt.delete(input.deviceId);
@@ -66608,6 +67655,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	async wipeAllAnalytics(input) {
 		await this.stationaryRegistry?.clearDevice(input.deviceId);
 		await this.phantomCells?.clearDevice(input.deviceId);
+		await this.stationaryEvidence?.clearDevice(input.deviceId);
 		await this.packageBackground?.clearDevice(input.deviceId);
 		return this.pruneTracksBefore({
 			deviceId: input.deviceId,