@camstack/addon-post-analysis 1.2.135 → 1.2.137

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-kn_4KEmG.js");
+const require_dist = require("../dist-5kMCMfln.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -27000,8 +27000,12 @@ function rankAndCap(faces, order, limit) {
 *     track through FaceStore.deleteByTracks, and enrolled (`assigned`) rows are
 *     exempt from that and from every sweep — an assignment is a curation act.
 *     The only other bound is capacity: pruneCapOverflow holds each camera's
-*     UNASSIGNED buffer to bufferMaxPerDevice newest rows (default 50). At 10.8 KB
-*     of JSON embedding per row, that cap is what keeps the table small."
+*     UNASSIGNED buffer to bufferMaxPerDevice newest rows (default 50), plus a
+*     SEPARATE, larger budget of deriveSuggestedBufferCap(bufferMaxPerDevice)
+*     rows (default 200) for rows carrying a suggestedIdentityId — a question
+*     the operator has not answered outlives a row nobody asked about, and
+*     evicting one is logged with its deviceId. At 10.8 KB of JSON embedding
+*     per row, those caps are what keep the table small."
 */
 var FACES_COLLECTION = "pipeline-analytics:faces";
 /**
@@ -27029,6 +27033,17 @@ var FACES_COLLECTION = "pipeline-analytics:faces";
 * cap, so the page is always the caller's bound and never the engine's.
 */
 var FACE_SWEEP_PAGE = 1e3;
+/** How many evicted face ids one per-camera eviction line names before it
+*  stops — enough to find the rows, not enough to turn a log line into a page. */
+var SUGGESTED_EVICTION_IDS_LOGGED = 10;
+/**
+* A stored suggestion is present. The relational backend surfaces an unset
+* column as SQL NULL and the fake store as `undefined`; an empty string is
+* neither an identity nor a question, so it is not a suggestion either.
+*/
+function hasSuggestion(raw) {
+	return typeof raw === "string" && raw.length > 0;
+}
 /**
 * Refuses to loop forever if a page ever fails to advance. 1 000 pages is a
 * million faces — far past anything real, and reached only by a bug.
@@ -27235,12 +27250,21 @@ var FaceStore = class {
 	* property the recognizer actually depends on: the gallery of recent
 	* unassigned faces stays small.
 	*
-	* ENROLLED (`assigned`) rows are skipped entirely and do not consume cap
-	* slots. Returns all deleted ids (the caller removes their crops).
+	* **A row the system asked a question about outlives one it said nothing
+	* about.** A single cap evicted both alike, so on 15 of 24 live cameras
+	* (measured 2026-08-25) the buffer sat at exactly the cap and an unanswered
+	* suggestion was deleted within about a day. Rows carrying a
+	* `suggestedIdentityId` are ranked in their OWN, larger budget
+	* (`maxSuggestedPerDevice`) — never immortality, because nothing clears a
+	* suggestion the operator merely declines to answer. Size and trade-off:
+	* `deriveSuggestedBufferCap` in `face-settings.ts:263`.
+	*
+	* ENROLLED (`assigned`) rows are skipped entirely and consume NO slot in
+	* either tier. Returns all deleted ids (the caller removes their crops).
 	*/
 	async pruneCapOverflow(input) {
 		/**
-		* Paged, not one statement. Only three scalars per row survive the page —
+		* Paged, not one statement. Only four scalars per row survive the page —
 		* the `embedding` string that dominates the row is dropped as soon as the
 		* page goes out of scope, so peak heap is one page rather than the whole
 		* face table. The prune still considers EVERY row, which is what makes it a
@@ -27262,38 +27286,79 @@ var FaceStore = class {
 			if (rows.length === 0) break;
 			for (const r of rows) {
 				const data = r.data;
-				if (data.assigned) continue;
-				const deviceId = Number(data.deviceId ?? -1);
+				if (data["assigned"]) continue;
+				const deviceId = Number(data["deviceId"] ?? -1);
 				const list = byDevice.get(deviceId) ?? [];
 				list.push({
 					id: r.id,
-					timestamp: Number(data.timestamp ?? 0)
+					timestamp: Number(data["timestamp"] ?? 0),
+					suggested: hasSuggestion(data["suggestedIdentityId"])
 				});
 				byDevice.set(deviceId, list);
 			}
 			if (rows.length < 1e3) break;
 		}
 		const toDelete = /* @__PURE__ */ new Set();
-		for (const list of byDevice.values()) {
+		const suggestedVictims = /* @__PURE__ */ new Map();
+		for (const [deviceId, list] of byDevice) {
 			list.sort((a, b) => b.timestamp - a.timestamp);
-			list.forEach((row, idx) => {
-				if (idx >= input.maxPerDevice) toDelete.add(row.id);
-			});
+			let ordinaryRank = 0;
+			let suggestedRank = 0;
+			for (const row of list) {
+				if (row.suggested) {
+					if (suggestedRank++ < input.maxSuggestedPerDevice) continue;
+					toDelete.add(row.id);
+					const victims = suggestedVictims.get(deviceId) ?? [];
+					victims.push(row.id);
+					suggestedVictims.set(deviceId, victims);
+					continue;
+				}
+				if (ordinaryRank++ < input.maxPerDevice) continue;
+				toDelete.add(row.id);
+			}
 		}
-		const deleted = [];
+		const deleted = /* @__PURE__ */ new Set();
 		for (const id of toDelete) try {
 			await this.store.delete.mutate({
 				collection: FACES_COLLECTION,
 				key: id
 			});
-			deleted.push(id);
+			deleted.add(id);
 		} catch (err) {
 			this.logger.warn("FaceStore.pruneCapOverflow delete failed", { meta: {
 				faceId: id,
 				error: String(err)
 			} });
 		}
-		return deleted;
+		this.announceSuggestedEvictions(suggestedVictims, deleted, input.maxSuggestedPerDevice);
+		return [...deleted];
+	}
+	/**
+	* Name every camera that lost an UNANSWERED suggestion, and how many.
+	*
+	* This exists because the loss it reports ran for weeks without a single log
+	* line: the prune only ever logged an aggregate count with no `deviceId`, so
+	* "why did camera 618 forget the person it asked me about" could not be asked
+	* of the logs at all. One line per camera (not per row) keeps the volume sane
+	* while still answering the per-camera question.
+	*
+	* Reports rows that were ACTUALLY deleted — a row whose delete threw is still
+	* in the buffer, and is reported by the failure line above instead.
+	*/
+	announceSuggestedEvictions(victimsByDevice, deleted, cap) {
+		for (const [deviceId, victims] of victimsByDevice) {
+			const gone = victims.filter((id) => deleted.has(id));
+			if (gone.length === 0) continue;
+			this.logger.warn("face buffer evicted UNANSWERED suggestions — the operator never saw them", {
+				tags: { deviceId },
+				meta: {
+					deleted: gone.length,
+					cap,
+					faceIds: gone.slice(0, SUGGESTED_EVICTION_IDS_LOGGED),
+					why: "the suggested tier is full on this camera: suggestions arrive faster than they are answered, and the OLDEST unanswered ones are dropped first."
+				}
+			});
+		}
 	}
 	/** Flip `assigned` to true and record which identity was matched. Optionally persist the sample id. */
 	async markAssigned(faceId, identityId, sampleId) {
@@ -37844,13 +37909,20 @@ var FaceSettingsSchema = require_dist.object({
 	* 0.175, best accuracy 98.3% at threshold 0.28.
 	*
 	* Recalibration plan, in this order:
-	*   1. land the landmark-precision gate (the alignment fix),
+	*   1. DONE (2026-08-19, commit b6641329f): the landmark-precision gate —
+	*      `landmark-precision-gate.ts` in `addon-pipeline`, called from
+	*      `detection-pipeline/pipeline/executor.ts:1164` BEFORE the native-size
+	*      substitution, floor `minLandmarkFaceSize` (default 24 detection px).
+	*      Do not re-implement it; the steps below are what is still open.
 	*   2. re-enrol the gallery from crops produced AFTER it,
 	*   3. re-measure genuine/impostor over a week of post-fix traffic,
 	*   4. expect to lower this toward ~0.30, and `margin` with it.
-	* Lowering it BEFORE step 1 would be actively harmful: a misaligned crop
-	* scores ~0.9 against everything, so the degenerate population sits ABOVE
-	* any threshold you could pick — the knob cannot reach it.
+	* Lowering it before step 2 is still actively harmful: the gate stops NEW
+	* degenerate crops, but every vector enrolled before it is still in the
+	* gallery, and a misaligned crop scores ~0.9 against everything — so the
+	* degenerate population sits ABOVE any threshold you could pick and the knob
+	* cannot reach it. Steps 3 and 4 need data that only exists once step 2 has
+	* run and post-fix traffic has accumulated.
 	*/
 	similarityThreshold: require_dist.number().min(0).max(1).default(.55),
 	/** Reject ambiguous matches: require best − secondBest ≥ margin. 0.10→0.15
@@ -37986,6 +38058,18 @@ function deriveSuggestionMinCosine(similarityThreshold) {
 	return rounded < similarityThreshold ? rounded : exact;
 }
 /**
+* The suggested tier's capacity for a given ordinary capacity.
+*
+* INVARIANT, total over every finite input: the result is a non-negative
+* integer, is never BELOW `bufferMaxPerDevice` (a suggested row is never worse
+* off than an unsuggested one), and is `0` exactly when the ordinary cap is `0`
+* (one switch turns the buffer off, not two).
+*/
+function deriveSuggestedBufferCap(bufferMaxPerDevice) {
+	if (!Number.isFinite(bufferMaxPerDevice) || bufferMaxPerDevice <= 0) return 0;
+	return Math.round(bufferMaxPerDevice * 4);
+}
+/**
 * The settings key that used to hold the suggestion floor. Named once, here,
 * because the ONLY code allowed to mention it now is the migration that removes
 * it from a store.
@@ -44560,13 +44644,27 @@ var SUPPRESS_IOU = .6;
 */
 var WAKE_ASSOC_IOU = .1;
 /**
-* Look-back window over which a track must have stayed put to be PROMOTED. A
-* car that drives in then parks has a large whole-life displacement but a tiny
-* last-`windowMs` displacement — so promotion is judged on the recent window,
-* not the full path. Also the minimum age (the track must have EXISTED this
-* long) so a freshly-spawned static blob isn't promoted instantly.
-*/
-var PROMOTION_WINDOW_MS = 3e4;
+* Look-back window over which a track must have stayed put to stop counting as
+* PRESENT for the orchestrator's session hold.
+*
+* This used to be the promotion criterion — "a track that stayed still this
+* long IS a parked object" — and it was measuring the wrong thing: it rewarded
+* an object seen well and often, while the parked cars that actually need
+* suppressing are re-discovered as dozens of short tracks that never live this
+* long (device 617: 140 tracks for one car, median life 6.8 s). Birth moved to
+* repetition — see `stationary-evidence.ts`.
+*
+* The stillness test survives because it was doing TWO jobs and only one of
+* them was destructive. Creating an entry BLINDS the pipeline to an object, so
+* it needs repeated evidence. Deciding that a motionless subject should stop
+* holding a motion session open destroys nothing — if it is wrong the session
+* closes early and the next motion re-opens it — so one recent stillness read
+* is the right amount of proof. Without this valve, removing promotion would
+* leave every session containing a parked car pinned to `maxSessionHoldMs`
+* (120 s) forever: 617 measured 504 sessions in 24 h, which is 70% detection
+* uptime on one camera, and three cameras are already above 50%.
+*/
+var SESSION_STILLNESS_WINDOW_MS = 3e4;
 /** Unconfirmed-entry time-to-live: if no detection confirms an entry for this
 *  long (object removed while unobserved, or a long occlusion) → retire it. */
 var ENTRY_TTL_MS = 5 * 6e4;
@@ -44587,15 +44685,20 @@ var DEFAULT_MATCH_CONFIG = {
 *     which entries are confirmed present, and which entries WOKE (their object
 *     moved → retire the entry and let the detection spawn a normal track).
 *
-*  2. `evaluateStationaryPromotion` — given a track's recent centroid path,
-*     decides whether it has stayed put long enough to become a stationary
-*     entry. Reuses the static-track-gate metrics (net displacement + path span
-*     normalised to the frame diagonal) over the recent look-back window.
+*  2. `trackIsStill` — given a track's recent centroid path, decides whether it
+*     has stopped moving. Reuses the static-track-gate metrics (net
+*     displacement + path span normalised to the frame diagonal) over the
+*     recent look-back window.
+*
+*     This does NOT create a stationary entry, and used to. Birth is decided by
+*     repetition (`stationary-evidence.ts`); this predicate now answers the one
+*     question whose wrong answer is harmless — "should this subject still hold
+*     a motion session open?"
 */
-/** Default promotion tunables — static thresholds shared with the key-event
-*  static gate so "stationary" means the same thing in both places. */
-var DEFAULT_PROMOTION_CONFIG = {
-	windowMs: PROMOTION_WINDOW_MS,
+/** Default stillness tunables — static thresholds shared with the key-event
+*  static gate so "still" means the same thing in both places. */
+var DEFAULT_SESSION_STILLNESS_CONFIG = {
+	windowMs: SESSION_STILLNESS_WINDOW_MS,
 	netFracMax: STATIC_DISPLACEMENT_FRAC,
 	spanFracMax: STATIC_SPAN_FRAC,
 	minPoints: 4
@@ -44717,26 +44820,29 @@ function partitionDetectionsAgainstRegistry(input) {
 }
 var EMPTY_ARMED = /* @__PURE__ */ new Set();
 /**
-* A track is promoted when, over the recent `windowMs`, its centroid barely
-* moved (both net displacement and path span below the static thresholds) AND
-* the track has actually EXISTED for at least `windowMs` (so a car that just
-* arrived isn't parked yet). Judging on the recent window — not the whole life
-* — is what lets a car that drove in then parked be recognised as stationary.
+* A track is STILL when, over the recent `windowMs`, its centroid barely moved
+* (both net displacement and path span below the static thresholds) AND the
+* track has actually EXISTED for at least `windowMs` (so a car that just
+* arrived has not stopped yet). Judging on the recent window — not the whole
+* life — is what lets a car that drove in then stopped be recognised.
+*
+* The one consumer is the orchestrator's presence signal: a still subject stops
+* holding its motion session open. It creates nothing and suppresses nothing.
 */
-function evaluateStationaryPromotion(input) {
+function trackIsStill(input) {
 	const { positions, referenceDiagonalPx, now, config } = input;
-	if (!(referenceDiagonalPx > 0) || positions.length === 0) return { promote: false };
-	if (now - positions[0].timestamp < config.windowMs) return { promote: false };
+	if (!(referenceDiagonalPx > 0) || positions.length === 0) return { still: false };
+	if (now - positions[0].timestamp < config.windowMs) return { still: false };
 	const cutoff = now - config.windowMs;
 	const window = positions.filter((p) => p.timestamp >= cutoff);
-	if (window.length < config.minPoints) return { promote: false };
+	if (window.length < config.minPoints) return { still: false };
 	const metrics = computeStaticTrackMetrics(window.map((p) => ({
 		x: p.x,
 		y: p.y
 	})), referenceDiagonalPx);
-	if (metrics === void 0) return { promote: false };
+	if (metrics === void 0) return { still: false };
 	return {
-		promote: metrics.netDisplacementFrac < config.netFracMax && metrics.pathSpanFrac < config.spanFracMax,
+		still: metrics.netDisplacementFrac < config.netFracMax && metrics.pathSpanFrac < config.spanFracMax,
 		netFrac: metrics.netDisplacementFrac,
 		spanFrac: metrics.pathSpanFrac
 	};
@@ -45243,6 +45349,602 @@ var PackageDropDetector = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-evidence.ts
+/**
+* stationary-evidence — how a parked object EARNS a registry entry.
+*
+* ## The criterion this replaces, and why it was measuring the wrong thing
+*
+* Until 2026-08-28 an object became stationary by TRACK CONTINUITY: one track
+* had to stay alive and barely move for `PROMOTION_WINDOW_MS` (30 s). That
+* rewards an object that is *seen well and often* — precisely the opposite of
+* what the operator needs. Measured on device 617 (the parking lot), 24 h:
+*
+*   - three cars are parked in view; the registry held exactly ONE entry;
+*   - the two it missed were re-discovered as **140 and 112 separate tracks**,
+*     median life **6.8 s**, p90 29 s. Not one of them could ever reach 30 s.
+*   - those two objects alone produced **13 494 of 18 402** vehicle
+*     observations (73%) — the whole re-spawn flood the registry exists to stop.
+*
+* The track dies; the OBJECT does not. So the evidence must outlive the track.
+*
+* ## The new criterion: a RATIO, not a count
+*
+* "The same thing, in the same place, most of the times it was seen."
+*
+*   N — observations that AGREED with the candidate's anchor box (IoU ≥
+*       {@link StationaryEvidencePolicy.agreeIou}).
+*   M — observations OFFERED by a track once it bound to this candidate,
+*       agreeing or not.
+*
+* A count would rescue nothing: a badly-lit car at night is seen rarely, and
+* any floor high enough to exclude a passer-by would exclude it too. A RATIO
+* asks a question a rarely-seen object can still answer well — 8 sightings out
+* of 10 in the same spot is stationary even though 10 is a small number.
+*
+* The dilution is the whole point, and it is why M counts a bound track's
+* observations even after it walks away: a car that drives THROUGH a spot binds
+* for a few frames and then contributes dozens of disagreeing ones. Measured on
+* 617 the two populations do not overlap:
+*
+*   | candidate                    | N / M       | ratio |
+*   | ---------------------------- | ----------- | ----- |
+*   | parked car A (missed today)  | 6405 / 6467 | 0.99  |
+*   | parked car B (missed today)  |  343 /  343 | 1.00  |
+*   | car crossing the lot         |    5 /   70 | 0.07  |
+*   | car turning through the lot  |   14 /   91 | 0.15  |
+*   | car manoeuvring              |   12 /   41 | 0.29  |
+*
+* The threshold sits in the empty band between 0.29 and 0.99.
+*
+* ## The span is what a ratio cannot say
+*
+* A ratio alone promotes a car that paused for four seconds — its handful of
+* observations all agree. So evidence must also STRETCH: the agreeing
+* observations must span {@link StationaryEvidencePolicy.minSpanMs}. Measured
+* on 617, real parked cars span 2 min to 24 h; the two momentary stops in the
+* same day spanned 4.2 s and 8.0 s. Setting the span to
+* `DEFAULT_MAX_SESSION_HOLD_MS` also buys a structural guarantee: no single
+* motion session, however long it is held open, can promote on its own.
+*
+* ## ONE ledger, two producers
+*
+* Evidence is anchored to a BOX, not to a track and not to a session, so an
+* object confirmed half by an active motion session and half by a periodic
+* burst still promotes. Occasion A (the session) is implemented and is
+* sufficient on its own — it is free, because the pipeline is already decoding
+* and already inferring. Occasion B (the burst) is a precaution for the cases
+* where A could not have fired at all (hub restarted, camera offline, motion
+* detection failed, object already parked at boot); it is NOT implemented yet,
+* and {@link StationaryEvidenceSource} is the seam it will arrive through.
+*
+* ## Identity is IoU. There is no grid.
+*
+* The predecessor mechanism (`phantom-cells.ts`) quantises a point to a 32 px
+* cell, and its write path passes a CENTROID while its read path passes a
+* top-left CORNER — at 32 px every box bigger than 32 px lands in a different
+* cell on read, and its unit test never crosses that boundary because it calls
+* both halves with the same literal coordinates. This module has no such
+* boundary to get wrong: a candidate is found by overlap against the boxes a
+* device already holds, bounded by {@link EVIDENCE_MAX_CANDIDATES_PER_DEVICE}.
+* Device 617 — the busiest lot in the fleet — holds 8.
+*/
+/**
+* `vehicle` and its kin. Every number below is read off device 617 over 24 h
+* (18 402 vehicle observations, 290 tracks) with the three parked cars the
+* operator can see out of the window as the bench.
+*
+* - `agreeIou` **0.5** — between the registry's own `WAKE_ASSOC_IOU` (0.1) and
+*   `SUPPRESS_IOU` (0.6). At 0.7 the two missed cars lose 11% of their evidence
+*   to night-time box wobble for no reduction in promotions; at 0.3 the day's
+*   promotions double (10 vs 5) without catching anything new.
+* - `minAgreementRatio` **0.6** — the measured gap is [0.29, 0.90]; 0.6 is the
+*   middle of it. Raising it to 0.95 starts dropping real parked cars.
+* - `minAgreed` **8** — a floor, not a discriminator: sweeping it 3→60 changes
+*   nothing on 617 (the smallest true positive promotes with N=15). Set well
+*   below that so a rarely-seen object is never excluded for being rare, which
+*   is the entire point of using a ratio.
+* - `minSpanMs` **120 000** — the real discriminator. True positives span
+*   2 min–24 h; the day's two momentary stops spanned 4.2 s and 8.0 s.
+*/
+var VEHICLE_EVIDENCE_POLICY = {
+	agreeIou: .5,
+	minAgreed: 8,
+	minAgreementRatio: .6,
+	minSpanMs: 12e4,
+	promotesByDefault: true
+};
+/**
+* `person`, and it ships OFF.
+*
+* This is not caution, it is a measurement. Replaying 24 h of person
+* observations from devices 617, 1443, 590 and 592 through this exact ledger:
+*
+*   | ratio | minAgreed | minSpanMs | promotions / 24 h across 4 cameras |
+*   | ----- | --------- | --------- | ---------------------------------- |
+*   | 0.85  |        20 |     600 s | 22                                 |
+*   | 0.95  |        40 |    1800 s | 10                                 |
+*   | 0.99  |        80 |    1800 s | **6**                              |
+*
+* There is no setting that reaches zero. Device 590 holds a person-shaped thing
+* that agrees with itself 1292 times out of 1654 (0.78) across 26 tracks over
+* ten hours, and device 592 produced eleven candidates at ratio 1.00 between
+* 02:00 and 05:00 — a statue, a poster, an IR artifact; the ledger cannot tell
+* those from a person standing still, because they look identical to it.
+*
+* Promoting a person is a BLINDING decision (D49 read in the direction that
+* destroys work: for a car the destructive read is the RETIREMENT — the flood
+* comes back; for a person it is the BIRTH — we stop seeing them). So the
+* class is available, tuned as strictly as the data allows, and switched off
+* until an operator turns it on for a camera where they know what is standing
+* there.
+*/
+var PERSON_EVIDENCE_POLICY = {
+	agreeIou: .5,
+	minAgreed: 40,
+	minAgreementRatio: .95,
+	minSpanMs: 18e5,
+	promotesByDefault: false
+};
+/** Classes with no policy of their own fall back to the vehicle numbers —
+*  `animal`, `package` and friends are all "an object that ended up somewhere",
+*  and none of them makes the camera blind to a person. */
+var DEFAULT_EVIDENCE_POLICY = VEHICLE_EVIDENCE_POLICY;
+var POLICY_BY_CLASS = new Map([["vehicle", VEHICLE_EVIDENCE_POLICY], ["person", PERSON_EVIDENCE_POLICY]]);
+function evidencePolicyFor(className) {
+	return POLICY_BY_CLASS.get(className) ?? DEFAULT_EVIDENCE_POLICY;
+}
+function stationaryEvidenceKey(deviceId, className, anchorId) {
+	return `${deviceId}:${className}:${anchorId}`;
+}
+/**
+* Does this candidate's evidence justify a registry entry?
+*
+* Pure, and ordered cheapest-question-first so the reason a candidate was
+* refused is the FIRST thing it failed, not the last.
+*/
+function evaluateStationaryEvidence(row, policy, classEnabled) {
+	const ratio = row.seen > 0 ? row.agreed / row.seen : 0;
+	const spanMs = row.lastAgreedAt - row.firstAgreedAt;
+	const base = {
+		agreed: row.agreed,
+		seen: row.seen,
+		ratio,
+		spanMs
+	};
+	if (!classEnabled) return {
+		kind: "accumulating",
+		shortfall: "class-not-promoted",
+		...base
+	};
+	if (row.agreed < policy.minAgreed) return {
+		kind: "accumulating",
+		shortfall: "too-few-agreements",
+		...base
+	};
+	if (ratio < policy.minAgreementRatio) return {
+		kind: "accumulating",
+		shortfall: "inconsistent-position",
+		...base
+	};
+	if (spanMs < policy.minSpanMs) return {
+		kind: "accumulating",
+		shortfall: "span-too-short",
+		...base
+	};
+	return {
+		kind: "promote",
+		...base
+	};
+}
+/**
+* The candidate this observation belongs to: the same-class row whose anchor it
+* overlaps most, provided the overlap reaches `agreeIou`. Overlap is the ONLY
+* notion of sameness here, and it is the same {@link iou} the suppression gate
+* uses — a second notion of "same place" is a second source of truth.
+*/
+function matchEvidenceCandidate(rows, className, bbox, agreeIou) {
+	let best;
+	let bestOverlap = 0;
+	for (const row of rows) {
+		if (row.className !== className) continue;
+		const overlap = iou(row.anchor, bbox);
+		if (overlap > bestOverlap) {
+			bestOverlap = overlap;
+			best = row;
+		}
+	}
+	if (best === void 0 || bestOverlap < agreeIou) return void 0;
+	return {
+		row: best,
+		overlap: bestOverlap
+	};
+}
+/**
+* Fold one observation into a candidate.
+*
+* `agrees` is decided by the CALLER, because M is what makes the ratio mean
+* anything: once a track has bound to a candidate, every later observation of
+* that track counts toward M whether it agrees or not. That is what dilutes a
+* car that merely drove through the spot, and it is why this function cannot
+* re-derive agreement from the box alone.
+*/
+function foldObservation(row, observation, agrees, overlap) {
+	const seen = row.seen + 1;
+	if (!agrees) return {
+		...row,
+		seen,
+		updatedAt: observation.timestamp
+	};
+	const improves = overlap >= iou(row.anchor, row.bestBbox);
+	return {
+		...row,
+		seen,
+		agreed: row.agreed + 1,
+		firstAgreedAt: Math.min(row.firstAgreedAt, observation.timestamp),
+		lastAgreedAt: Math.max(row.lastAgreedAt, observation.timestamp),
+		...improves ? {
+			bestBbox: { ...observation.bbox },
+			...observation.trackId !== void 0 ? { sourceTrackId: observation.trackId } : {},
+			...observation.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: observation.keyFrameMediaKey } : {},
+			...observation.label !== void 0 ? { label: observation.label } : {}
+		} : {},
+		sessionAgreed: row.sessionAgreed + (observation.source === "session" ? 1 : 0),
+		burstAgreed: row.burstAgreed + (observation.source === "burst" ? 1 : 0),
+		updatedAt: observation.timestamp
+	};
+}
+/** A brand-new candidate anchored on the observation that had nowhere to go. */
+function newEvidenceRow(observation, anchorId) {
+	return {
+		key: stationaryEvidenceKey(observation.deviceId, observation.className, anchorId),
+		deviceId: observation.deviceId,
+		className: observation.className,
+		anchor: { ...observation.bbox },
+		agreed: 1,
+		seen: 1,
+		firstAgreedAt: observation.timestamp,
+		lastAgreedAt: observation.timestamp,
+		bestBbox: { ...observation.bbox },
+		...observation.trackId !== void 0 ? { sourceTrackId: observation.trackId } : {},
+		...observation.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: observation.keyFrameMediaKey } : {},
+		...observation.label !== void 0 ? { label: observation.label } : {},
+		sessionAgreed: observation.source === "session" ? 1 : 0,
+		burstAgreed: observation.source === "burst" ? 1 : 0,
+		updatedAt: observation.timestamp
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-evidence-ledger.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="a candidate's BIRTH and its PROMOTION are written immediately; the per-frame agreement tallies are STAGED in RAM and flushed on the 5-minute sweep (a parked car is observed 5-30 times a second and one commit per observation would offer ~10^6 writes a day to maintain a handful of rows)"
+*   retention="a candidate untouched for 6h is deleted, and a device is capped at 512 candidates (least-recently-touched evicted). A promoted candidate is deleted the moment its entry is born. Never orphaned by track retention — evidence describes an OBJECT that outlives every track that ever saw it, which is the entire reason this collection exists."
+*/
+var STATIONARY_EVIDENCE_COLLECTION = "pipeline-analytics:stationary-evidence";
+var STATIONARY_EVIDENCE_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "className",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "anchor",
+		type: "JSON"
+	},
+	{
+		name: "agreed",
+		type: "INTEGER"
+	},
+	{
+		name: "seen",
+		type: "INTEGER"
+	},
+	{
+		name: "firstAgreedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "lastAgreedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "bestBbox",
+		type: "JSON"
+	},
+	{
+		name: "sourceTrackId",
+		type: "TEXT"
+	},
+	{
+		name: "keyFrameMediaKey",
+		type: "TEXT"
+	},
+	{
+		name: "label",
+		type: "TEXT"
+	},
+	{
+		name: "sessionAgreed",
+		type: "INTEGER"
+	},
+	{
+		name: "burstAgreed",
+		type: "INTEGER"
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER"
+	}
+];
+var STATIONARY_EVIDENCE_INDEXES = [{
+	name: "idx_stationary_evidence_device",
+	columns: ["deviceId"]
+}];
+function parseBbox(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const { x, y, w, h } = { ...value };
+	if (typeof x !== "number" || typeof y !== "number") return null;
+	if (typeof w !== "number" || typeof h !== "number") return null;
+	return {
+		x,
+		y,
+		w,
+		h
+	};
+}
+function numberOr(value, fallback) {
+	return typeof value === "number" ? value : fallback;
+}
+function stringOrUndefined(value) {
+	return typeof value === "string" ? value : void 0;
+}
+var StationaryEvidenceLedger = class {
+	ledger;
+	logger;
+	/** deviceId → candidate keys, so a device's candidates are found without
+	*  scanning the fleet. */
+	byDevice = /* @__PURE__ */ new Map();
+	/** `deviceId:trackId` → candidate key. RAM-only, see the file header. */
+	binding = /* @__PURE__ */ new Map();
+	/** Keys whose staged tallies have not been persisted yet. */
+	dirty = /* @__PURE__ */ new Set();
+	anchorSeq = 0;
+	constructor(deps) {
+		this.logger = deps.logger;
+		const spec = {
+			collection: STATIONARY_EVIDENCE_COLLECTION,
+			columns: [...STATIONARY_EVIDENCE_COLUMNS],
+			indexes: [...STATIONARY_EVIDENCE_INDEXES],
+			writeMode: "write-behind",
+			keyOf: (row) => row.key,
+			toValue: (row) => ({
+				deviceId: row.deviceId,
+				className: row.className,
+				anchor: { ...row.anchor },
+				agreed: row.agreed,
+				seen: row.seen,
+				firstAgreedAt: row.firstAgreedAt,
+				lastAgreedAt: row.lastAgreedAt,
+				bestBbox: { ...row.bestBbox },
+				...row.sourceTrackId !== void 0 ? { sourceTrackId: row.sourceTrackId } : {},
+				...row.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: row.keyFrameMediaKey } : {},
+				...row.label !== void 0 ? { label: row.label } : {},
+				sessionAgreed: row.sessionAgreed,
+				burstAgreed: row.burstAgreed,
+				updatedAt: row.updatedAt
+			}),
+			fromRecord: (key, data) => {
+				const deviceId = data.deviceId;
+				const className = data.className;
+				if (typeof deviceId !== "number" || typeof className !== "string") return null;
+				const anchor = parseBbox(data.anchor);
+				const bestBbox = parseBbox(data.bestBbox) ?? anchor;
+				if (anchor === null || bestBbox === null) return null;
+				const sourceTrackId = stringOrUndefined(data.sourceTrackId);
+				const keyFrameMediaKey = stringOrUndefined(data.keyFrameMediaKey);
+				const label = stringOrUndefined(data.label);
+				const updatedAt = numberOr(data.updatedAt, 0);
+				return {
+					key,
+					deviceId,
+					className,
+					anchor,
+					agreed: numberOr(data.agreed, 0),
+					seen: numberOr(data.seen, 0),
+					firstAgreedAt: numberOr(data.firstAgreedAt, updatedAt),
+					lastAgreedAt: numberOr(data.lastAgreedAt, updatedAt),
+					bestBbox,
+					...sourceTrackId !== void 0 ? { sourceTrackId } : {},
+					...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {},
+					...label !== void 0 ? { label } : {},
+					sessionAgreed: numberOr(data.sessionAgreed, 0),
+					burstAgreed: numberOr(data.burstAgreed, 0),
+					updatedAt
+				};
+			},
+			deviceIdOf: (row) => row.deviceId
+		};
+		this.ledger = new DurableLedger({
+			spec,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	/** Boot reseed. Returns how many candidates came back — "loaded 0" after a
+	*  container recreate is the one line that explains a silent regression. */
+	async load() {
+		const rows = await this.ledger.load();
+		for (const row of rows) this.index(row);
+		return rows.length;
+	}
+	get size() {
+		return this.ledger.snapshot().length;
+	}
+	candidatesFor(deviceId) {
+		const keys = this.byDevice.get(deviceId);
+		if (!keys) return [];
+		const rows = [];
+		for (const key of keys) {
+			const row = this.ledger.get(key);
+			if (row) rows.push(row);
+		}
+		return rows;
+	}
+	/**
+	* Fold ONE observation in and say whether it just earned an entry.
+	*
+	* Synchronous by construction: the verdict is read from the RAM mirror, so a
+	* slow or failing store can never change what this frame decides. The
+	* durable half is fired behind the verdict.
+	*/
+	observe(observation, classEnabled) {
+		const policy = evidencePolicyFor(observation.className);
+		this.expire(observation.deviceId, observation.timestamp);
+		const bindKey = observation.trackId === void 0 ? void 0 : `${observation.deviceId}:${observation.trackId}`;
+		const candidates = this.candidatesFor(observation.deviceId);
+		let row;
+		const boundKey = bindKey === void 0 ? void 0 : this.binding.get(bindKey);
+		if (boundKey !== void 0) row = this.ledger.get(boundKey);
+		let overlap = row === void 0 ? 0 : iou(row.anchor, observation.bbox);
+		let created = false;
+		if (row === void 0) {
+			const match = matchEvidenceCandidate(candidates, observation.className, observation.bbox, policy.agreeIou);
+			if (match) {
+				row = match.row;
+				overlap = match.overlap;
+			} else {
+				this.anchorSeq += 1;
+				row = newEvidenceRow(observation, `a${this.anchorSeq}`);
+				overlap = 1;
+				created = true;
+				this.index(row);
+				this.write(row);
+				if (bindKey !== void 0) this.binding.set(bindKey, row.key);
+				this.capDevice(observation.deviceId);
+				return {
+					row,
+					verdict: evaluateStationaryEvidence(row, policy, classEnabled),
+					promoted: false
+				};
+			}
+			if (bindKey !== void 0) this.binding.set(bindKey, row.key);
+		}
+		const agrees = overlap >= policy.agreeIou;
+		const next = foldObservation(row, observation, agrees, overlap);
+		this.ledger.stage(next);
+		this.dirty.add(next.key);
+		if (created) this.capDevice(observation.deviceId);
+		const verdict = evaluateStationaryEvidence(next, policy, classEnabled);
+		if (verdict.kind !== "promote") return {
+			row: next,
+			verdict,
+			promoted: false
+		};
+		this.forgetKey(next.key);
+		return {
+			row: next,
+			verdict,
+			promoted: true
+		};
+	}
+	/** Persist the staged tallies. Called from the registry's 5-minute sweep. */
+	async flush() {
+		const keys = [...this.dirty];
+		this.dirty.clear();
+		let written = 0;
+		for (const key of keys) {
+			const row = this.ledger.get(key);
+			if (!row) continue;
+			await this.write(row);
+			written += 1;
+		}
+		return written;
+	}
+	/** Drop a device's evidence wholesale (camera removed / analytics reset). */
+	async clearDevice(deviceId) {
+		for (const row of this.candidatesFor(deviceId)) await this.forgetKeyDurable(row.key);
+		this.byDevice.delete(deviceId);
+		for (const [bindKey] of this.binding) if (bindKey.startsWith(`${deviceId}:`)) this.binding.delete(bindKey);
+	}
+	/** Forget the bindings of tracks the tracker no longer carries, so the map
+	*  cannot grow for the process's lifetime on a busy camera. */
+	retainTracks(deviceId, liveTrackIds) {
+		const prefix = `${deviceId}:`;
+		for (const bindKey of [...this.binding.keys()]) {
+			if (!bindKey.startsWith(prefix)) continue;
+			if (!liveTrackIds.has(bindKey.slice(prefix.length))) this.binding.delete(bindKey);
+		}
+	}
+	forgetKey(key) {
+		this.forgetKeyDurable(key);
+	}
+	async forgetKeyDurable(key) {
+		const row = this.ledger.get(key);
+		this.dirty.delete(key);
+		if (row) this.byDevice.get(row.deviceId)?.delete(key);
+		for (const [bindKey, boundTo] of this.binding) if (boundTo === key) this.binding.delete(bindKey);
+		await this.ledger.forget(key);
+	}
+	async write(row) {
+		this.dirty.delete(row.key);
+		await this.ledger.put(row);
+	}
+	index(row) {
+		let keys = this.byDevice.get(row.deviceId);
+		if (!keys) {
+			keys = /* @__PURE__ */ new Set();
+			this.byDevice.set(row.deviceId, keys);
+		}
+		keys.add(row.key);
+	}
+	/** Drop candidates untouched for {@link EVIDENCE_WINDOW_MS}. Evidence
+	*  describes an object that can drive away; a stale candidate is not a
+	*  weaker one, it is one about a thing that is gone. */
+	expire(deviceId, now) {
+		for (const row of this.candidatesFor(deviceId)) {
+			if (now - row.updatedAt <= 216e5) continue;
+			this.logger.debug("stationary evidence expired — candidate untouched past the window", {
+				tags: { deviceId },
+				meta: {
+					className: row.className,
+					agreed: row.agreed,
+					seen: row.seen,
+					ageMs: now - row.updatedAt
+				}
+			});
+			this.forgetKey(row.key);
+		}
+	}
+	capDevice(deviceId) {
+		const rows = this.candidatesFor(deviceId);
+		if (rows.length <= 512) return;
+		const excess = [...rows].sort((a, b) => a.updatedAt - b.updatedAt).slice(0, rows.length - 512);
+		this.logger.info("stationary evidence capped — least-recently-touched candidates evicted", {
+			tags: { deviceId },
+			meta: {
+				evicted: excess.length,
+				cap: 512
+			}
+		});
+		for (const row of excess) this.forgetKey(row.key);
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/stationary/stationary-registry.ts
 /**
 * @durable class=ledger owner=pipeline-analytics
@@ -55888,8 +56590,8 @@ function resolveTrackingSettings(raw) {
 * with no drift. Guarded by a unit test asserting the equality.
 */
 var StationarySettingsSchema = require_dist.object({
-	/** Master switch. Off ⇒ no promotion + no suppression for this camera (every
-	*  parked object keeps spawning normal tracks). */
+	/** Master switch. Off ⇒ this camera gathers no evidence and suppresses
+	*  nothing (every parked object keeps spawning normal tracks). */
 	enabled: require_dist.boolean().default(true),
 	/** IoU at/above which a detection is the same parked object, unmoved →
 	*  suppress its spawn. `SUPPRESS_IOU`. */
@@ -55898,9 +56600,22 @@ var StationarySettingsSchema = require_dist.object({
 	*  wake it) — the overlap gate that stops a different vehicle from waking a
 	*  parked entry (the 617 flood fix). `WAKE_ASSOC_IOU`. */
 	wakeAssocIou: require_dist.number().min(.02).max(.5).default(WAKE_ASSOC_IOU),
-	/** Recent-window stillness a track must hold to be PROMOTED to a parked
-	*  entry (also the minimum track age). `PROMOTION_WINDOW_MS`. */
-	promotionWindowMs: require_dist.number().int().min(5e3).max(12e4).default(PROMOTION_WINDOW_MS),
+	/** Recent-window stillness after which a track stops holding its motion
+	*  session open (also the minimum track age). Creates nothing — birth is
+	*  decided by repeated evidence. `SESSION_STILLNESS_WINDOW_MS`. */
+	sessionStillnessWindowMs: require_dist.number().int().min(5e3).max(12e4).default(SESSION_STILLNESS_WINDOW_MS),
+	/**
+	* Let a motionless PERSON become a stationary entry on this camera.
+	*
+	* Off, and it is a measurement rather than caution. Replaying 24 h of person
+	* observations from devices 617/1443/590/592 through the evidence ledger
+	* produces 6-22 entries a day depending on how strictly it is tuned, and none
+	* of them can be tuned to zero: device 592 alone yielded eleven candidates at
+	* a perfect agreement ratio between 02:00 and 05:00. A stationary entry
+	* SUPPRESSES its object, so a wrong one makes the camera blind to a person —
+	* turn this on only for a camera where you know what is standing there.
+	*/
+	promotePersons: require_dist.boolean().default(false),
 	/** Observed-time TTL: retire an entry unconfirmed for this long (measured on
 	*  frames-flowing time, not wall-clock). `ENTRY_TTL_MS`. */
 	entryTtlMs: require_dist.number().int().min(6e4).max(18e5).default(ENTRY_TTL_MS)
@@ -55919,7 +56634,8 @@ function resolveStationarySettings(raw) {
 		enabled: pick("enabled"),
 		suppressIou: pick("suppressIou"),
 		wakeAssocIou: pick("wakeAssocIou"),
-		promotionWindowMs: pick("promotionWindowMs"),
+		sessionStillnessWindowMs: pick("sessionStillnessWindowMs"),
+		promotePersons: pick("promotePersons"),
 		entryTtlMs: pick("entryTtlMs")
 	};
 }
@@ -56444,17 +57160,24 @@ function buildDetectionSettingsSections() {
 				},
 				{
 					type: "slider",
-					key: "promotionWindowMs",
-					label: "Promotion stillness window",
-					description: "How long (ms) an object must stay put — and the track must have existed — before it is promoted to a parked entry. Longer = slower to stop a re-spawn flood.",
+					key: "sessionStillnessWindowMs",
+					label: "Session stillness window",
+					description: "How long (ms) a tracked object must stay put before it stops holding a motion session open. It creates nothing: a parked object becomes an entry by being seen repeatedly in the same place, not by one track surviving this long.",
 					min: 5e3,
 					max: 12e4,
 					step: 1e3,
-					default: STATIONARY_DEFAULTS.promotionWindowMs,
+					default: STATIONARY_DEFAULTS.sessionStillnessWindowMs,
 					showValue: true,
 					unit: "s",
 					displayScale: 1e3
 				},
+				{
+					type: "boolean",
+					key: "promotePersons",
+					label: "Also park motionless people",
+					description: "Off by default. A stationary entry SUPPRESSES its object, so a wrong one makes this camera blind to a person standing there. Replaying a day of real person detections produced entries on every camera tried, at every threshold tried — turn this on only where you know what is standing still.",
+					default: STATIONARY_DEFAULTS.promotePersons
+				},
 				{
 					type: "slider",
 					key: "entryTtlMs",
@@ -56603,9 +57326,9 @@ function buildGlobalSettingsSchema(cap) {
 			}, {
 				type: "boolean",
 				key: "embeddingEnabled",
-				label: "Legacy embedding dispatcher (no effect on search)",
-				description: "Legacy enrichment-engine dispatcher. It re-encoded detection crops through the embedding-encoder cap and DISCARDED the result — semantic search and face recognition never read it: search vectors come from the pipeline clip-embedding step, face embeddings from the in-pipeline arcface path. Leave OFF; it only burns CPU. Takes effect on addon restart.",
-				default: false
+				label: "Object/face embedding dispatcher",
+				description: "ON by default, and running on an untouched cluster. The dispatcher pulls the native key frame for a closed track, crops each qualifying detection and encodes it through the embedding-encoder capability, on the post-processing node only. Turning it OFF stops that CPU cost and changes nothing already indexed. Takes effect on addon restart.",
+				default: true
 			}]
 		},
 		{
@@ -56699,27 +57422,6 @@ function buildGlobalSettingsSchema(cap) {
 					showValue: true,
 					unit: "s",
 					displayScale: 1e3
-				},
-				{
-					type: "select",
-					key: "mediaAttachPolicy",
-					label: "Attach media to events",
-					description: "Which events get a persisted crop.",
-					default: "motion",
-					options: [
-						{
-							value: "always",
-							label: "Every event"
-						},
-						{
-							value: "motion",
-							label: "Only while motion is active"
-						},
-						{
-							value: "never",
-							label: "Never"
-						}
-					]
 				}
 			]
 		},
@@ -58947,6 +59649,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	*  confirmation gate's bar there; one moving track clears it. Null until
 	*  onInitialize. */
 	phantomCells = null;
+	/** Repeated-sighting evidence — the ONLY thing that creates a stationary
+	*  entry. Two producers may feed it; only the motion session does today. */
+	stationaryEvidence = null;
 	mediaStore = null;
 	/** The enrolled gallery's rows. Retained so the photo-enrollment bridge can
 	*  reach them without going back through the cap surface. Null until S7. */
@@ -59691,10 +60396,15 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		}
 		return this._trackCloser;
 	}
-	/** Master toggle for the migrated object/face EmbeddingDispatcher (default
-	*  ON — the enrichment-engine default was `embeddingEnabled:true`). Read at
+	/** Master toggle for the migrated object/face EmbeddingDispatcher. Read at
 	*  init; a change takes effect on addon restart (same convention as
-	*  `postProcessingNodeId`). */
+	*  `postProcessingNodeId`).
+	*
+	*  The fallback is {@link EMBEDDING_ENABLED_DEFAULT} — the SAME constant the
+	*  settings field declares. It is imported, not restated: this handle and
+	*  that field address one store key, and when they each carried their own
+	*  default they disagreed (`true` here, `false` on the form) and the form
+	*  reported the opposite of what the cluster was doing. */
 	_embeddingEnabledState = null;
 	get embeddingEnabledState() {
 		if (!this._embeddingEnabledState) this._embeddingEnabledState = this.state("embeddingEnabled", EmbeddingEnabledSchema, true);
@@ -60210,6 +60920,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			}
 		});
 		await this.stationaryRegistry.load();
+		this.stationaryEvidence = new StationaryEvidenceLedger({
+			store: api.settingsStore,
+			logger: logger.child("StationaryEvidence")
+		});
+		await this.stationaryEvidence.declare();
+		const evidenceLoaded = await this.stationaryEvidence.load();
+		logger.info("stationary evidence loaded", { meta: { candidates: evidenceLoaded } });
 		this.phantomCells = new PhantomCellRegistry({
 			store: api.settingsStore,
 			logger: logger.child("PhantomCells")
@@ -61598,6 +62315,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.retentionSweepTimer = setInterval(() => {
 			this.sweepRetention();
 			this.stationaryRegistry?.sweep(Date.now());
+			this.stationaryEvidence?.flush();
 			this.eventsOpsLog?.pruneBefore(Date.now() - OPS_LOG_RETENTION_MS);
 		}, RETENTION_SWEEP_INTERVAL_MS);
 		this.ltsFlushTimer = setInterval(() => {
@@ -62432,38 +63150,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const stationarySettings = this.stationarySettingsFromCache(deviceId);
 		const packageSettings = this.packageDropSettingsFromCache(deviceId);
 		const packageClasses = new Set(packageSettings.packageDropClassFilter);
-		if (source === "pipeline" && this.stationaryRegistry && stationarySettings.enabled) {
-			const dims = this.lastFrameDimsByDevice.get(deviceId);
-			if (dims && dims.w > 0 && dims.h > 0) {
-				const refDiag = Math.hypot(dims.w, dims.h);
-				const promotionConfig = {
-					...DEFAULT_PROMOTION_CONFIG,
-					windowMs: stationarySettings.promotionWindowMs
+		if (source === "pipeline" && this.stationaryRegistry && this.stationaryEvidence && stationarySettings.enabled) {
+			const evidence = this.stationaryEvidence;
+			for (const t of result.tracked) {
+				if (packageClasses.has(t.className)) continue;
+				const classEnabled = t.className === "person" ? stationarySettings.promotePersons : evidencePolicyFor(t.className).promotesByDefault;
+				const active = this.trackStore?.peekActive(t.trackId) ?? null;
+				const observedLabel = active === null ? void 0 : displayLabel(active);
+				const observedKeyFrame = this.residents.keyFrameKey(t.trackId);
+				const observation = {
+					deviceId,
+					className: t.className,
+					bbox: { ...t.bbox },
+					timestamp: result.timestamp,
+					source: "session",
+					trackId: t.trackId,
+					...observedKeyFrame !== void 0 ? { keyFrameMediaKey: observedKeyFrame } : {},
+					...observedLabel !== void 0 ? { label: observedLabel } : {}
 				};
-				for (const t of result.tracked) {
-					if (packageClasses.has(t.className)) continue;
-					const active = this.trackStore.peekActive(t.trackId);
-					if (!active) continue;
-					const { promote } = evaluateStationaryPromotion({
-						positions: active.positions,
-						referenceDiagonalPx: refDiag,
-						now: result.timestamp,
-						config: promotionConfig
-					});
-					if (!promote) continue;
-					this.promoteToStationary({
-						deviceId,
-						key,
-						processor,
-						track: t,
-						firstSeen: active.firstSeen,
-						label: displayLabel(active),
-						frameWidth: result.frameWidth,
-						frameHeight: result.frameHeight,
-						timestamp: result.timestamp
-					});
-				}
+				const outcome = evidence.observe(observation, classEnabled);
+				if (outcome === void 0 || !outcome.promoted) continue;
+				this.birthStationaryFromEvidence({
+					deviceId,
+					key,
+					processor,
+					track: t,
+					row: outcome.row,
+					frameWidth: result.frameWidth,
+					frameHeight: result.frameHeight,
+					timestamp: result.timestamp,
+					firstSeen: active === null ? outcome.row.firstAgreedAt : active.firstSeen
+				});
 			}
+			evidence.retainTracks(deviceId, currentTrackIds);
 		}
 		if (source === "pipeline") this.runPackageStillness({
 			deviceId,
@@ -62756,7 +63475,22 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			}
 			overlayDetections = frame.detections;
 		}
-		const hasMovingTrack = result.tracked.some((t) => t.state === "moving" || t.state === "entered" || t.state === "left");
+		const stillnessConfig = {
+			...DEFAULT_SESSION_STILLNESS_CONFIG,
+			windowMs: this.stationarySettingsFromCache(deviceId).sessionStillnessWindowMs
+		};
+		const stillnessDims = this.lastFrameDimsByDevice.get(deviceId);
+		const stillnessDiag = stillnessDims && stillnessDims.w > 0 && stillnessDims.h > 0 ? Math.hypot(stillnessDims.w, stillnessDims.h) : 0;
+		const hasLiveTrack = result.tracked.some((t) => {
+			const active = this.trackStore?.peekActive(t.trackId);
+			if (!active) return true;
+			return !trackIsStill({
+				positions: active.positions,
+				referenceDiagonalPx: stillnessDiag,
+				now: result.timestamp,
+				config: stillnessConfig
+			}).still;
+		});
 		this.ctx.eventBus.emit({
 			id: `pa-${(0, node_crypto.randomUUID)()}`,
 			timestamp: new Date(result.timestamp),
@@ -62772,7 +63506,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				frameWidth: result.frameWidth,
 				frameHeight: result.frameHeight,
 				detections: overlayDetections,
-				hasMovingTrack
+				hasLiveTrack
 			}
 		});
 	}
@@ -63039,9 +63773,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	/**
 	* Count SHORT + MOTIONLESS track closes per frame cell.
 	*
-	* The stationary registry cannot see this class of phantom. Promotion needs a
-	* track that has EXISTED for `PROMOTION_WINDOW_MS` (30 s), and these die long
-	* before: the dead ornamental grass on device 615 produced tracks of 3.8 s,
+	* The stationary registry answers a different question (is this object parked,
+	* and should it be suppressed?). This one raises a spawn bar. The dead
+	* ornamental grass on device 615 produced tracks of 3.8 s,
 	* 4.1 s, 6.5 s and 19.0 s with 0-2.5 px of total displacement, roughly
 	* fifteen of them in a day, all at the same spot. Each one is individually
 	* innocent; the RECURRENCE is the signal, and nothing survives a track death
@@ -64578,29 +65312,41 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* track-OWNED entity (both rows carry a `trackId`) and it aged crops out from
 	* under tracks still well inside their own window. Only the capacity bound
 	* remains (D61).
+	*
+	* The cap is the OPERATOR'S, not the schema default. `bufferMaxPerDevice` is
+	* offered on the settings form and this sweep read `FACE_DEFAULTS` instead,
+	* so an override was a knob that wrote a store nobody read — the D62 shape.
+	* The suggested tier is DERIVED from whatever value is in force
+	* (`deriveSuggestedBufferCap`), so the two can never disagree.
 	*/
 	async holdBufferCaps() {
 		const mediaStore = this.mediaStore;
 		if (!mediaStore) return;
+		const bufferMaxPerDevice = await this.resolveBufferCap();
+		const maxSuggestedPerDevice = deriveSuggestedBufferCap(bufferMaxPerDevice);
 		if (this.faceStore) try {
-			const deletedFaceIds = await this.faceStore.pruneCapOverflow({ maxPerDevice: FACE_DEFAULTS.bufferMaxPerDevice });
+			const deletedFaceIds = await this.faceStore.pruneCapOverflow({
+				maxPerDevice: bufferMaxPerDevice,
+				maxSuggestedPerDevice
+			});
 			if (deletedFaceIds.length > 0) {
 				await mediaStore.deleteForOwner("face", deletedFaceIds);
 				this.ctx.logger.info("face buffer capacity prune", { meta: {
 					deleted: deletedFaceIds.length,
-					cap: FACE_DEFAULTS.bufferMaxPerDevice
+					cap: bufferMaxPerDevice,
+					suggestedCap: maxSuggestedPerDevice
 				} });
 			}
 		} catch (err) {
 			this.ctx.logger.debug("face buffer cap prune failed", { meta: { error: String(err) } });
 		}
 		if (this.plateStore) try {
-			const deletedPlateIds = await this.plateStore.pruneCapOverflow({ maxPerDevice: FACE_DEFAULTS.bufferMaxPerDevice });
+			const deletedPlateIds = await this.plateStore.pruneCapOverflow({ maxPerDevice: bufferMaxPerDevice });
 			if (deletedPlateIds.length > 0) {
 				await mediaStore.deleteForOwner("plate", deletedPlateIds);
 				this.ctx.logger.info("plate buffer capacity prune", { meta: {
 					deleted: deletedPlateIds.length,
-					cap: FACE_DEFAULTS.bufferMaxPerDevice
+					cap: bufferMaxPerDevice
 				} });
 			}
 		} catch (err) {
@@ -64608,6 +65354,28 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		}
 	}
 	/**
+	* The buffer capacity actually in force: the GLOBAL setting, falling back to
+	* the schema default when the store cannot be read.
+	*
+	* Global-only on purpose. The sweep is one pass over the whole collection and
+	* a per-device cascade would mean one settings read per camera on every tick,
+	* for a knob whose whole job is bounding a table. A per-camera capacity is a
+	* decision nobody has asked for; the fallback here is the same number the
+	* sweep used unconditionally before, so a settings outage cannot make the
+	* bound stricter than it has ever been.
+	*/
+	async resolveBufferCap() {
+		try {
+			return resolveFaceSettings(await this.resolveGlobalStore()).bufferMaxPerDevice;
+		} catch (err) {
+			this.ctx.logger.debug("face buffer cap: global settings unreadable, using the default", { meta: {
+				error: String(err),
+				cap: FACE_DEFAULTS.bufferMaxPerDevice
+			} });
+			return FACE_DEFAULTS.bufferMaxPerDevice;
+		}
+	}
+	/**
 	* Ingest a native (onboard) camera detection push and run it through
 	* the SAME analysis layers as the ML pipeline, tagged `source:
 	* 'onboard'`. Flag-only pushes (no bbox) can't be zoned/tracked and are
@@ -64894,29 +65662,41 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			});
 		}
 	}
-	promoteToStationary(input) {
-		const { deviceId, key, processor, track, firstSeen, label, frameWidth, frameHeight, timestamp } = input;
-		const keyFrameMediaKey = this.residents.keyFrameKey(track.trackId);
-		const plausible = isPlausibleThumbnailBox(track.bbox, frameWidth, frameHeight);
-		if (!plausible) this.ctx.logger.info("stationary promotion rejected (near-full-frame box)", {
+	/**
+	* Turn a candidate whose evidence is sufficient into a registry entry.
+	*
+	* The BOX, label and key-frame come from the evidence row — the best agreeing
+	* sighting across every track that ever contributed — not from whichever
+	* track happened to be alive on the tipping frame. That is the point of the
+	* ledger: the object outlives its tracks, so the entry must be built from
+	* what was learned about the object, not from the last one to see it.
+	*/
+	birthStationaryFromEvidence(input) {
+		const { deviceId, key, processor, track, row, firstSeen, frameWidth, frameHeight, timestamp } = input;
+		const label = row.label;
+		const keyFrameMediaKey = row.keyFrameMediaKey ?? this.residents.keyFrameKey(track.trackId);
+		const plausible = isPlausibleThumbnailBox(row.bestBbox, frameWidth, frameHeight);
+		if (!plausible) this.ctx.logger.info("stationary birth rejected (near-full-frame box)", {
 			tags: { deviceId },
 			meta: {
 				trackId: track.trackId,
-				className: track.className,
-				bbox: track.bbox
+				className: row.className,
+				bbox: row.bestBbox,
+				agreed: row.agreed,
+				seen: row.seen
 			}
 		});
 		const entry = {
 			id: (0, node_crypto.randomUUID)(),
 			deviceId,
-			className: track.className,
-			bbox: { ...track.bbox },
+			className: row.className,
+			bbox: { ...row.bestBbox },
 			frameWidth,
 			frameHeight,
 			firstSeenAt: firstSeen,
 			becameStationaryAt: timestamp,
 			lastConfirmedAt: timestamp,
-			sourceTrackId: track.trackId,
+			sourceTrackId: row.sourceTrackId ?? track.trackId,
 			...label !== void 0 ? { label } : {},
 			...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {}
 		};
@@ -64954,12 +65734,19 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.detailDispatcher?.onTrackEnded(deviceId, track.trackId);
 		this.overlayState.onTrackEnded(deviceId, track.trackId);
 		this.lastActiveTrackIds.get(key)?.delete(track.trackId);
-		this.ctx.logger.info("track promoted to stationary", {
+		this.ctx.logger.info("stationary entry born from repeated evidence", {
 			tags: { deviceId },
 			meta: {
 				trackId: track.trackId,
-				className: track.className,
+				className: row.className,
 				entryId: entry.id,
+				agreed: row.agreed,
+				seen: row.seen,
+				agreementRatio: row.seen > 0 ? Number((row.agreed / row.seen).toFixed(3)) : 0,
+				spanMs: row.lastAgreedAt - row.firstAgreedAt,
+				sessionAgreed: row.sessionAgreed,
+				burstAgreed: row.burstAgreed,
+				plausible,
 				...label ? { label } : {}
 			}
 		});
@@ -65401,6 +66188,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.residents.closeDevice(input.deviceId);
 		this.stationaryRegistry?.clearDevice(input.deviceId);
 		this.phantomCells?.clearDevice(input.deviceId);
+		this.stationaryEvidence?.clearDevice(input.deviceId);
 		this.packageBackground?.clearDevice(input.deviceId);
 		this.overlayState.clearDevice(input.deviceId);
 		this.overlaySynthesisWarnAt.delete(input.deviceId);
@@ -66851,6 +67639,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	async wipeAllAnalytics(input) {
 		await this.stationaryRegistry?.clearDevice(input.deviceId);
 		await this.phantomCells?.clearDevice(input.deviceId);
+		await this.stationaryEvidence?.clearDevice(input.deviceId);
 		await this.packageBackground?.clearDevice(input.deviceId);
 		return this.pruneTracksBefore({
 			deviceId: input.deviceId,