@camstack/addon-post-analysis 1.2.190 → 1.2.192

package/dist/pipeline-analytics/index.js

@@ -33278,6 +33278,52 @@ var ClosedRowMediaGate = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/co-moving-subjects.ts
+/**
+* Report at this much containment. A rider and a bicycle overlap heavily; two
+* people passing each other in the frame do not stay contained for long.
+* Deliberately a REPORTING threshold, not a decision one — nothing branches on
+* it, so it can be loose enough to see the near misses.
+*/
+var CO_MOVING_MIN_CONTAINMENT = .6;
+function intersectionArea$4(a, b) {
+	return Math.max(0, Math.min(a.x + a.w, b.x + b.w) - Math.max(a.x, b.x)) * Math.max(0, Math.min(a.y + a.h, b.y + b.h) - Math.max(a.y, b.y));
+}
+/**
+* The overlaps a NEWLY born track has with live tracks of a DIFFERENT class.
+*
+* Same-class overlaps are excluded: those are the tracker's own duplicate
+* problem and are already measured elsewhere. A zero-area box reports nothing
+* rather than dividing by zero.
+*/
+function findCoMovingPairs(born, live, minContainment = CO_MOVING_MIN_CONTAINMENT) {
+	const out = [];
+	for (const b of born) {
+		const areaB = b.bbox.w * b.bbox.h;
+		if (areaB <= 0) continue;
+		for (const o of live) {
+			if (o.trackId === b.trackId) continue;
+			if (o.className === b.className) continue;
+			const areaO = o.bbox.w * o.bbox.h;
+			if (areaO <= 0) continue;
+			const inter = intersectionArea$4(b.bbox, o.bbox);
+			if (inter <= 0) continue;
+			const union = areaB + areaO - inter;
+			const containment = inter / Math.min(areaB, areaO);
+			if (containment < minContainment) continue;
+			out.push({
+				trackId: b.trackId,
+				className: b.className,
+				otherTrackId: o.trackId,
+				otherClassName: o.className,
+				iou: union > 0 ? inter / union : 0,
+				containment
+			});
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/edge-clear.ts
 /**
 * edge-clear — pure geometry for "is the subject fully in frame?" best-frame
@@ -33498,52 +33544,6 @@ function isEdgeAwareNewBest(current, candidate, hysteresis) {
 	return false;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/co-moving-subjects.ts
-/**
-* Report at this much containment. A rider and a bicycle overlap heavily; two
-* people passing each other in the frame do not stay contained for long.
-* Deliberately a REPORTING threshold, not a decision one — nothing branches on
-* it, so it can be loose enough to see the near misses.
-*/
-var CO_MOVING_MIN_CONTAINMENT = .6;
-function intersectionArea$4(a, b) {
-	return Math.max(0, Math.min(a.x + a.w, b.x + b.w) - Math.max(a.x, b.x)) * Math.max(0, Math.min(a.y + a.h, b.y + b.h) - Math.max(a.y, b.y));
-}
-/**
-* The overlaps a NEWLY born track has with live tracks of a DIFFERENT class.
-*
-* Same-class overlaps are excluded: those are the tracker's own duplicate
-* problem and are already measured elsewhere. A zero-area box reports nothing
-* rather than dividing by zero.
-*/
-function findCoMovingPairs(born, live, minContainment = CO_MOVING_MIN_CONTAINMENT) {
-	const out = [];
-	for (const b of born) {
-		const areaB = b.bbox.w * b.bbox.h;
-		if (areaB <= 0) continue;
-		for (const o of live) {
-			if (o.trackId === b.trackId) continue;
-			if (o.className === b.className) continue;
-			const areaO = o.bbox.w * o.bbox.h;
-			if (areaO <= 0) continue;
-			const inter = intersectionArea$4(b.bbox, o.bbox);
-			if (inter <= 0) continue;
-			const union = areaB + areaO - inter;
-			const containment = inter / Math.min(areaB, areaO);
-			if (containment < minContainment) continue;
-			out.push({
-				trackId: b.trackId,
-				className: b.className,
-				otherTrackId: o.trackId,
-				otherClassName: o.className,
-				iou: union > 0 ? inter / union : 0,
-				containment
-			});
-		}
-	}
-	return out;
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/first-frame-retry-bbox.ts
 /** Crop box for a late firstFrame retry: the BIRTH geometry, not the
 *  later frozen/coasted box (track 1b659d56). */
@@ -34067,7 +34067,7 @@ var MAX_PATH_LENGTH = 300;
 function clamp(value, min, max) {
 	return Math.max(min, Math.min(max, value));
 }
-function iou$2(a, b) {
+function iou$3(a, b) {
 	const ax1 = a.x, ay1 = a.y, ax2 = a.x + a.w, ay2 = a.y + a.h;
 	const bx1 = b.x, by1 = b.y, bx2 = b.x + b.w, by2 = b.y + b.h;
 	const ix1 = Math.max(ax1, bx1), iy1 = Math.max(ay1, by1);
@@ -34135,7 +34135,7 @@ var SortTracker = class SortTracker {
 			trackClass: track.class,
 			detClass: det.class,
 			detScore: det.score,
-			iou: iou$2(track.bbox, det.bbox),
+			iou: iou$3(track.bbox, det.bbox),
 			centroidDistPx: Math.hypot(tc.x - dc.x, tc.y - dc.y),
 			trackDiagPx: Math.hypot(track.bbox.w, track.bbox.h),
 			areaRatio: smaller > 0 ? Math.max(trackArea, detArea) / smaller : 0,
@@ -34199,14 +34199,14 @@ var SortTracker = class SortTracker {
 	isDuplicateSpawn(det, live, timestamp) {
 		for (const t of live) {
 			if (!this.dedupCompatible(t.class, det.class)) continue;
-			if (iou$2(det.bbox, t.bbox) >= this.config.dedupSpawnIou) return true;
-			if (growthAdjacentMatch(t.bbox, det.bbox, SortTracker.growthContext(t, timestamp))) {
+			if (iou$3(det.bbox, t.bbox) >= this.config.dedupSpawnIou) return true;
+			if (t.class === det.class && growthAdjacentMatch(t.bbox, det.bbox, SortTracker.growthContext(t, timestamp))) {
 				this.reportBind("spawn-dedup", "growth", t, det, timestamp);
 				return true;
 			}
 		}
 		if (this.config.personAnimalDedup && det.class === ANIMAL_CLASS && det.score < this.config.animalOverPersonMaxScore) {
-			for (const t of live) if (t.class === PERSON_CLASS && iou$2(det.bbox, t.bbox) >= this.config.animalOverPersonIou) return true;
+			for (const t of live) if (t.class === PERSON_CLASS && iou$3(det.bbox, t.bbox) >= this.config.animalOverPersonIou) return true;
 		}
 		return false;
 	}
@@ -34246,7 +34246,7 @@ var SortTracker = class SortTracker {
 			if (dropIds.has(a.id) || dropIds.has(b.id)) continue;
 			if (!this.dedupCompatible(a.class, b.class)) continue;
 			const key = SortTracker.pairKey(a.id, b.id);
-			if (iou$2(a.bbox, b.bbox) < this.config.dedupMergeIou) {
+			if (iou$3(a.bbox, b.bbox) < this.config.dedupMergeIou) {
 				this.dupStreaks.delete(key);
 				continue;
 			}
@@ -34322,7 +34322,7 @@ var SortTracker = class SortTracker {
 	*/
 	looseMatch(track, det, timestamp) {
 		if (this.assocGroup(track.class) !== this.assocGroup(det.class)) return null;
-		if (iou$2(track.bbox, det.bbox) >= this.config.rescueIouThreshold) return "iou";
+		if (iou$3(track.bbox, det.bbox) >= this.config.rescueIouThreshold) return "iou";
 		const tc = bboxCentroid(track.bbox);
 		const dc = bboxCentroid(det.bbox);
 		const dist = Math.hypot(tc.x - dc.x, tc.y - dc.y);
@@ -34408,7 +34408,7 @@ var SortTracker = class SortTracker {
 				if (used.has(di)) continue;
 				const det = detections[di];
 				if (!this.associable(track.class, det.class)) continue;
-				const score = iou$2(pbox, det.bbox);
+				const score = iou$3(pbox, det.bbox);
 				if (score >= iouThreshold) pairs.push({
 					track,
 					detIdx: di,
@@ -34470,7 +34470,7 @@ var SortTracker = class SortTracker {
 				rescuePairs.push({
 					track,
 					detIdx: di,
-					score: iou$2(track.bbox, det.bbox),
+					score: iou$3(track.bbox, det.bbox),
 					gate
 				});
 			}
@@ -34547,7 +34547,7 @@ var SortTracker = class SortTracker {
 				const gate = this.looseMatch(lost, det, timestamp);
 				if (gate === null) continue;
 				if (gate === "centroid" && this.isPlausibleBirth(det, frameArea)) continue;
-				const score = iou$2(lost.bbox, det.bbox);
+				const score = iou$3(lost.bbox, det.bbox);
 				const peers = this.sameGroupPeerCount(lost, surviving);
 				if (this.config.resurrectionCrowdGuard && peers > 0 && score < this.config.resurrectionCrowdedIouThreshold) {
 					if (score > refusedScore) {
@@ -44374,6 +44374,32 @@ var AnalyticsQueryFacade = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/audio-confirm-window.ts
+function emptyAudioConfirmState() {
+	return { hitsByClass: /* @__PURE__ */ new Map() };
+}
+function observeAudioConfirm(state, input, cfg) {
+	if (cfg.confirmHits <= 1) return {
+		confirmed: true,
+		nextState: state
+	};
+	const cutoff = input.timestampMs - cfg.confirmWindowSec * 1e3;
+	const kept = [...(state.hitsByClass.get(input.className) ?? []).filter((at) => at > cutoff), input.timestampMs];
+	const next = new Map(state.hitsByClass);
+	if (kept.length < cfg.confirmHits) {
+		next.set(input.className, kept);
+		return {
+			confirmed: false,
+			nextState: { hitsByClass: next }
+		};
+	}
+	next.delete(input.className);
+	return {
+		confirmed: true,
+		nextState: { hitsByClass: next }
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/audio-detection-settings.ts
 var AudioDetectionSettingsSchema = require_dist.object({
 	classificationMinScore: require_dist.number().min(0).max(1).default(.6),
@@ -44634,32 +44660,6 @@ function observeAudioEpisode(state, sample, knobs) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/audio-confirm-window.ts
-function emptyAudioConfirmState() {
-	return { hitsByClass: /* @__PURE__ */ new Map() };
-}
-function observeAudioConfirm(state, input, cfg) {
-	if (cfg.confirmHits <= 1) return {
-		confirmed: true,
-		nextState: state
-	};
-	const cutoff = input.timestampMs - cfg.confirmWindowSec * 1e3;
-	const kept = [...(state.hitsByClass.get(input.className) ?? []).filter((at) => at > cutoff), input.timestampMs];
-	const next = new Map(state.hitsByClass);
-	if (kept.length < cfg.confirmHits) {
-		next.set(input.className, kept);
-		return {
-			confirmed: false,
-			nextState: { hitsByClass: next }
-		};
-	}
-	next.delete(input.className);
-	return {
-		confirmed: true,
-		nextState: { hitsByClass: next }
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/audio-event-router.ts
 /**
 * Decide whether an audio frame is a (meaningful) classification event or a
@@ -45240,6 +45240,7 @@ async function runConfirmation(candidate, config, deps, exhausted) {
 	} else if (!bestIncompatible || d.score > bestIncompatible.score) bestIncompatible = d;
 	const bar = Math.max(config.minConfidence, deps.minConfidenceFor?.(candidate) ?? 0);
 	const confirmed = best !== void 0 && best.score >= bar;
+	const secondary = bestIncompatible ? promoteSecondary(candidate, bestIncompatible, bar, deps) : null;
 	return {
 		trackId: candidate.trackId,
 		verdict: confirmed ? "confirmed" : "suppressed",
@@ -45250,7 +45251,30 @@ async function runConfirmation(candidate, config, deps, exhausted) {
 		...bestIncompatible ? {
 			bestIncompatibleClass: bestIncompatible.macroClass,
 			bestIncompatibleScore: bestIncompatible.score
-		} : {}
+		} : {},
+		...secondary ? { secondary } : {}
+	};
+}
+/**
+* The incompatible best becomes a secondary subject when it clears the SAME
+* bar the candidate faced and can be placed in the frame. The crop-normalised
+* box is scaled into the crop's frame rectangle — the one derivation the
+* capture used, supplied by the caller, never re-derived here.
+*/
+function promoteSecondary(candidate, detection, bar, deps) {
+	if (detection.score < bar || detection.bbox === void 0) return null;
+	const rect = deps.cropRectFor?.(candidate) ?? null;
+	if (rect === null || rect.w <= 0 || rect.h <= 0) return null;
+	const box = detection.bbox;
+	return {
+		className: detection.macroClass,
+		score: detection.score,
+		bbox: {
+			x: rect.x + box.x * rect.w,
+			y: rect.y + box.y * rect.h,
+			w: box.w * rect.w,
+			h: box.h * rect.h
+		}
 	};
 }
 async function confirmOne(candidate, config, deps, exhausted) {
@@ -48010,6 +48034,336 @@ var MediaWriteGate = class {
 		this.paused = false;
 	}
 };
+//#endregion
+//#region src/pipeline-analytics/runtime/failure-report.ts
+/**
+* What `pipeline-analytics` reports through `failure-contribution` — the four
+* per-camera counters, and the ONE place their vocabulary is written down.
+*
+* ## Why the vocabulary is a module and not four string literals
+*
+* D276 gave a track row a `previewMissReason` composed from strings like
+* `keyframe:native-miss` and `thumbnail:overflow`. Those strings are now
+* joinable evidence: a row says which track lost its tile, and these counters
+* say how often that camera loses one and out of how many tries. A second
+* vocabulary for the same loss would break the join silently — the row would
+* say `native-miss` and the counter `nativeMiss`, and nobody would notice until
+* somebody tried to correlate them. So the reasons live here, named once, and
+* they deliberately reuse D276's spelling.
+*
+* ## Every family carries its denominator
+*
+* Each `note*` call is ONE attempt. The success calls are not decoration: a
+* failure count without them is the number that read as "35x worse than
+* yesterday" on 2026-08-28 and was flat all day once divided
+* (`packages/types/src/metrics/failure-counters.ts`).
+*
+* ## Nothing here logs
+*
+* These paths run at frame rate — 507 enrichment-crop misses in five minutes at
+* peak, ~100/min. A line each is its own defect, and the log lines that already
+* exist on these paths (`enrichment crop native miss`, `capture queue full`,
+* `plate: read discarded`) are unchanged and still throttled. This is the
+* counter that makes them countable without reading them.
+*/
+/**
+* The enrichment crop capture — face / plate / clip / detail-classifier.
+* Denominator: every crop this addon asked the owning runner for.
+*/
+var FAMILY_ENRICHMENT_CROP = "enrichment-crop";
+/**
+* The per-camera capture scheduler lane. Denominator: every queued capture that
+* reached a TERMINAL scheduling outcome — started, or dropped. A coalesced or
+* cancelled request is neither and is deliberately not counted: a track that
+* closed before its capture ran did not lose work, it stopped wanting it.
+*/
+var FAMILY_CAPTURE_SCHEDULE = "capture-schedule";
+/** Plate OCR reads routed from the detail plane. Denominator: every read. */
+var FAMILY_PLATE_OCR = "plate-ocr";
+/**
+* Person tracks born on this camera. Denominator: every confirmed person birth.
+*
+* The "failure" here is NOT suppressed and must not be — a person standing over
+* a car is a real person, and this repo will not trade that away for a cleaner
+* count (D275 made the same choice for stationary suppression). It is counted so
+* the phantom rate is a number instead of an impression: 4 of 23 on camera 617
+* in two hours, measured by hand on 2026-08-28.
+*/
+var FAMILY_PERSON_BIRTH = "person-birth";
+/**
+* The owning runner had no native pixels for the ROI.
+*
+* This collapses the runner-side causes the operator can already see in logs
+* (`worker-lease-gone`, `no-registry-entry`, `jpeg-encode-failed`) because
+* `pipelineRunner.getNativeCrop` answers an ROI miss with `null` and carries no
+* reason on the wire — and `FrameHandle` has no `deviceId`, so the runner could
+* not attribute the split per camera even if it reported it. Splitting this is a
+* framework change (a reason on the reply); until then the honest name is the
+* one the caller can actually stand behind.
+*/
+var REASON_NATIVE_MISS = "native-miss";
+/** Queued past `staleAfterMs`; the frame it wanted is gone. */
+var REASON_STALE_DROP = "stale-drop";
+/** Shed because the camera's lane was at its queue cap. */
+var REASON_QUEUE_OVERFLOW = "queue-overflow";
+/**
+* The OCR step returned, with nothing in it.
+*
+* The defect this counter was built for: ~35% of plate reads came back with an
+* empty label and fell through the detail router's `d.label.length > 0` gate
+* into no branch at all — no store, no log, no row. Silence read as "this camera
+* never saw a plate", which is a completely different fix.
+*/
+var REASON_EMPTY_READ = "empty-read";
+/** A plate detail with no bbox — nothing to crop, nothing to place. */
+var REASON_NO_BBOX = "no-bbox";
+/** `isPlausiblePlateRead` refused it (junk OCR off a distant/oblique plate). */
+var REASON_IMPLAUSIBLE = "implausible";
+/** Below the camera's configured minimum OCR confidence. */
+var REASON_BELOW_MIN_CONFIDENCE = "below-min-confidence";
+/** A person born with its box inside a vehicle's. See {@link FAMILY_PERSON_BIRTH}. */
+var REASON_PERSON_OVER_VEHICLE = "person-over-vehicle";
+/**
+* This addon's `failure-contribution` counters.
+*
+* One instance per addon process, handed to the paths that fail. Every method
+* takes the numeric `deviceId` first, for the same reason every log line does:
+* the question is always per camera.
+*/
+var AnalyticsFailureReport = class {
+	now;
+	counters;
+	constructor(now = Date.now, counters = new require_dist.FailureCounters()) {
+		this.now = now;
+		this.counters = counters;
+	}
+	/** One enrichment crop capture. `reason` absent = the native ROI landed. */
+	noteEnrichmentCrop(deviceId, reason) {
+		this.counters.note({
+			deviceId,
+			family: FAMILY_ENRICHMENT_CROP,
+			...reason !== void 0 ? { reason } : {}
+		}, this.now());
+	}
+	/** One capture that reached a terminal scheduling outcome. */
+	noteCaptureSchedule(deviceId, reason) {
+		this.counters.note({
+			deviceId,
+			family: FAMILY_CAPTURE_SCHEDULE,
+			...reason !== void 0 ? { reason } : {}
+		}, this.now());
+	}
+	/** One plate OCR read. `reason` absent = the read was accepted and stored. */
+	notePlateRead(deviceId, reason) {
+		this.counters.note({
+			deviceId,
+			family: FAMILY_PLATE_OCR,
+			...reason !== void 0 ? { reason } : {}
+		}, this.now());
+	}
+	/** One confirmed person birth. `reason` present = it was born over a vehicle. */
+	notePersonBirth(deviceId, reason) {
+		this.counters.note({
+			deviceId,
+			family: FAMILY_PERSON_BIRTH,
+			...reason !== void 0 ? { reason } : {}
+		}, this.now());
+	}
+	/** The `failure-contribution` provider's payload. Reads, never resets. */
+	list() {
+		return this.counters.snapshot(this.now());
+	}
+	/** Addon disposal. */
+	clear() {
+		this.counters.clear();
+	}
+};
+//#endregion
+//#region src/pipeline-analytics/pipeline/bbox-pad.ts
+/**
+* Pad a normalized bounding box by a fractional amount relative to its own
+* dimensions. All coordinates remain in the [0, 1] unit-square.
+*
+* Formula (before clamping):
+*   newX = x - padding * w
+*   newW = w + 2 * padding * w  (i.e. w * (1 + 2 * padding))
+*   newY = y - padding * h
+*   newH = h + 2 * padding * h
+*
+* padding === 0 is the identity operation. Pure, immutable — always returns a
+* new object.
+*
+* NOTE: clamping SHIFTS, it does not truncate — a window that overflows a
+* bound slides inward and keeps the extent that was asked for, on either side.
+* It shrinks only when the padded window is larger than the frame itself
+* would (e.g. a left-hugging box gains a bit more right-side context). This is
+* acceptable for detection crops (more context, never out of [0,1]); the
+* downstream `extractCrop` clamps to pixel bounds again regardless.
+*/
+function padBbox(bbox, padding) {
+	const rawX = bbox.x - padding * bbox.w;
+	const rawY = bbox.y - padding * bbox.h;
+	const rawW = bbox.w * (1 + 2 * padding);
+	const rawH = bbox.h * (1 + 2 * padding);
+	const w = Math.min(rawW, 1);
+	const h = Math.min(rawH, 1);
+	return {
+		x: Math.min(Math.max(0, rawX), 1 - w),
+		y: Math.min(Math.max(0, rawY), 1 - h),
+		w,
+		h
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/capture-crop.ts
+/**
+* The normalised window a capture asks the runner for: the box padded by
+* `padding` and slid inside the unit square. ONE derivation, shared by the
+* capture below and by any caller that must put a crop-relative box back
+* into the frame (the confirmation gate's secondary subject) — two copies of
+* this arithmetic would drift, and a drifted one places the subject somewhere
+* it is not.
+*/
+function captureCropWindow(bbox, frameWidth, frameHeight, padding) {
+	return padBbox({
+		x: bbox.x / frameWidth,
+		y: bbox.y / frameHeight,
+		w: bbox.w / frameWidth,
+		h: bbox.h / frameHeight
+	}, padding);
+}
+/** {@link captureCropWindow} in FRAME pixels. */
+function captureCropFrameRect(bbox, frameWidth, frameHeight, padding) {
+	const window = captureCropWindow(bbox, frameWidth, frameHeight, padding);
+	return {
+		x: window.x * frameWidth,
+		y: window.y * frameHeight,
+		w: window.w * frameWidth,
+		h: window.h * frameHeight
+	};
+}
+function createCaptureCrop(deps) {
+	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
+		const paddedNorm = captureCropWindow(bbox, frameWidth, frameHeight, padding);
+		const nativeCrop = await deps.tryNativeCrop(frameHandle, paddedNorm, maxWidth);
+		if (nativeCrop) {
+			deps.bumpCropMetric(true);
+			if (deviceId !== void 0) deps.noteCropOutcome?.(deviceId);
+			return nativeCrop;
+		}
+		deps.bumpCropMetric(false);
+		if (deviceId !== void 0) deps.noteCropOutcome?.(deviceId, REASON_NATIVE_MISS);
+		deps.logger.debug("enrichment crop native miss — detail scheduler will re-run", {
+			...deviceId !== void 0 ? { tags: { deviceId } } : {},
+			meta: { nodeId: frameHandle.nodeId }
+		});
+		return null;
+	};
+}
+//#endregion
+//#region src/pipeline-analytics/pipeline/secondary-subjects.ts
+/**
+* How long a promoted subject may keep riding. Rides are consumed within
+* ~300 ms at 10 fps; this bound is what stops a promotion made just before a
+* stall from riding a frame that belongs to a scene that has moved on.
+*/
+var SECONDARY_SUBJECT_TTL_MS = 3e3;
+var SecondarySubjectQueue = class {
+	byKey = /* @__PURE__ */ new Map();
+	nextId = 0;
+	add(key, subject, foundBesideTrackId, now) {
+		const pending = this.byKey.get(key) ?? [];
+		this.nextId += 1;
+		this.byKey.set(key, [...pending, {
+			id: `s${this.nextId}`,
+			subject,
+			foundBesideTrackId,
+			expiresAt: now + SECONDARY_SUBJECT_TTL_MS,
+			ridesLeft: 3
+		}]);
+	}
+	/**
+	* Every subject still owed a ride for `key`, one ride spent. An entry out of
+	* rides or past its TTL is forgotten here rather than served.
+	*/
+	take(key, now) {
+		const pending = this.byKey.get(key);
+		if (!pending) return [];
+		const live = pending.filter((entry) => entry.expiresAt > now && entry.ridesLeft > 0);
+		const remaining = live.map((entry) => ({
+			...entry,
+			ridesLeft: entry.ridesLeft - 1
+		})).filter((entry) => entry.ridesLeft > 0);
+		if (remaining.length === 0) this.byKey.delete(key);
+		else this.byKey.set(key, remaining);
+		return live.map((entry) => ({
+			id: entry.id,
+			subject: entry.subject,
+			foundBesideTrackId: entry.foundBesideTrackId
+		}));
+	}
+	/** A subject a real detection has taken over rides no further. */
+	drop(key, id) {
+		const pending = this.byKey.get(key);
+		if (!pending) return;
+		const remaining = pending.filter((entry) => entry.id !== id);
+		if (remaining.length === 0) this.byKey.delete(key);
+		else this.byKey.set(key, remaining);
+	}
+	forget(key) {
+		this.byKey.delete(key);
+	}
+};
+function iou$2(a, b) {
+	const inter = Math.max(0, Math.min(a.x + a.w, b.x + b.width) - Math.max(a.x, b.x)) * Math.max(0, Math.min(a.y + a.h, b.y + b.height) - Math.max(a.y, b.y));
+	const union = a.w * a.h + b.width * b.height - inter;
+	return union > 0 ? inter / union : 0;
+}
+/**
+* The runner's detections plus one synthetic first-level detection per pending
+* subject that no same-class detection already covers. The synthetic box
+* carries the gate's score — a measurement on a native crop, not an invention
+* — and an id that says where it came from. The original result is not
+* mutated.
+*/
+function injectSecondarySubjects(frame, pending) {
+	if (pending.length === 0) return {
+		frame,
+		covered: []
+	};
+	const added = [];
+	const covered = [];
+	for (const { id, subject, foundBesideTrackId } of pending) {
+		if ([...frame.detections, ...added].some((d) => d.kind === "first-level" && d.macroClass === subject.className && iou$2(subject.bbox, d.bbox) >= .5)) {
+			covered.push(id);
+			continue;
+		}
+		added.push({
+			id: `secondary-${id}-${foundBesideTrackId}`,
+			kind: "first-level",
+			macroClass: subject.className,
+			score: subject.score,
+			labels: [],
+			bbox: {
+				x: subject.bbox.x,
+				y: subject.bbox.y,
+				width: subject.bbox.w,
+				height: subject.bbox.h
+			}
+		});
+	}
+	if (added.length === 0) return {
+		frame,
+		covered
+	};
+	return {
+		frame: {
+			...frame,
+			detections: [...frame.detections, ...added]
+		},
+		covered
+	};
+}
 var MACRO_SET = new Set([
 	"person",
 	"vehicle",
@@ -51859,42 +52213,6 @@ function decideKeyFrameCapture(input) {
 	return { kind: "retry" };
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/bbox-pad.ts
-/**
-* Pad a normalized bounding box by a fractional amount relative to its own
-* dimensions. All coordinates remain in the [0, 1] unit-square.
-*
-* Formula (before clamping):
-*   newX = x - padding * w
-*   newW = w + 2 * padding * w  (i.e. w * (1 + 2 * padding))
-*   newY = y - padding * h
-*   newH = h + 2 * padding * h
-*
-* padding === 0 is the identity operation. Pure, immutable — always returns a
-* new object.
-*
-* NOTE: clamping SHIFTS, it does not truncate — a window that overflows a
-* bound slides inward and keeps the extent that was asked for, on either side.
-* It shrinks only when the padded window is larger than the frame itself
-* would (e.g. a left-hugging box gains a bit more right-side context). This is
-* acceptable for detection crops (more context, never out of [0,1]); the
-* downstream `extractCrop` clamps to pixel bounds again regardless.
-*/
-function padBbox(bbox, padding) {
-	const rawX = bbox.x - padding * bbox.w;
-	const rawY = bbox.y - padding * bbox.h;
-	const rawW = bbox.w * (1 + 2 * padding);
-	const rawH = bbox.h * (1 + 2 * padding);
-	const w = Math.min(rawW, 1);
-	const h = Math.min(rawH, 1);
-	return {
-		x: Math.min(Math.max(0, rawX), 1 - w),
-		y: Math.min(Math.max(0, rawY), 1 - h),
-		w,
-		h
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/subject-agreement.ts
 /**
 * `subjectAgreement` — the ONE predicate for "a rectangle measured on frame A
@@ -55249,150 +55567,6 @@ function votePlateText(reads) {
 	return out;
 }
 //#endregion
-//#region src/pipeline-analytics/runtime/failure-report.ts
-/**
-* What `pipeline-analytics` reports through `failure-contribution` — the four
-* per-camera counters, and the ONE place their vocabulary is written down.
-*
-* ## Why the vocabulary is a module and not four string literals
-*
-* D276 gave a track row a `previewMissReason` composed from strings like
-* `keyframe:native-miss` and `thumbnail:overflow`. Those strings are now
-* joinable evidence: a row says which track lost its tile, and these counters
-* say how often that camera loses one and out of how many tries. A second
-* vocabulary for the same loss would break the join silently — the row would
-* say `native-miss` and the counter `nativeMiss`, and nobody would notice until
-* somebody tried to correlate them. So the reasons live here, named once, and
-* they deliberately reuse D276's spelling.
-*
-* ## Every family carries its denominator
-*
-* Each `note*` call is ONE attempt. The success calls are not decoration: a
-* failure count without them is the number that read as "35x worse than
-* yesterday" on 2026-08-28 and was flat all day once divided
-* (`packages/types/src/metrics/failure-counters.ts`).
-*
-* ## Nothing here logs
-*
-* These paths run at frame rate — 507 enrichment-crop misses in five minutes at
-* peak, ~100/min. A line each is its own defect, and the log lines that already
-* exist on these paths (`enrichment crop native miss`, `capture queue full`,
-* `plate: read discarded`) are unchanged and still throttled. This is the
-* counter that makes them countable without reading them.
-*/
-/**
-* The enrichment crop capture — face / plate / clip / detail-classifier.
-* Denominator: every crop this addon asked the owning runner for.
-*/
-var FAMILY_ENRICHMENT_CROP = "enrichment-crop";
-/**
-* The per-camera capture scheduler lane. Denominator: every queued capture that
-* reached a TERMINAL scheduling outcome — started, or dropped. A coalesced or
-* cancelled request is neither and is deliberately not counted: a track that
-* closed before its capture ran did not lose work, it stopped wanting it.
-*/
-var FAMILY_CAPTURE_SCHEDULE = "capture-schedule";
-/** Plate OCR reads routed from the detail plane. Denominator: every read. */
-var FAMILY_PLATE_OCR = "plate-ocr";
-/**
-* Person tracks born on this camera. Denominator: every confirmed person birth.
-*
-* The "failure" here is NOT suppressed and must not be — a person standing over
-* a car is a real person, and this repo will not trade that away for a cleaner
-* count (D275 made the same choice for stationary suppression). It is counted so
-* the phantom rate is a number instead of an impression: 4 of 23 on camera 617
-* in two hours, measured by hand on 2026-08-28.
-*/
-var FAMILY_PERSON_BIRTH = "person-birth";
-/**
-* The owning runner had no native pixels for the ROI.
-*
-* This collapses the runner-side causes the operator can already see in logs
-* (`worker-lease-gone`, `no-registry-entry`, `jpeg-encode-failed`) because
-* `pipelineRunner.getNativeCrop` answers an ROI miss with `null` and carries no
-* reason on the wire — and `FrameHandle` has no `deviceId`, so the runner could
-* not attribute the split per camera even if it reported it. Splitting this is a
-* framework change (a reason on the reply); until then the honest name is the
-* one the caller can actually stand behind.
-*/
-var REASON_NATIVE_MISS = "native-miss";
-/** Queued past `staleAfterMs`; the frame it wanted is gone. */
-var REASON_STALE_DROP = "stale-drop";
-/** Shed because the camera's lane was at its queue cap. */
-var REASON_QUEUE_OVERFLOW = "queue-overflow";
-/**
-* The OCR step returned, with nothing in it.
-*
-* The defect this counter was built for: ~35% of plate reads came back with an
-* empty label and fell through the detail router's `d.label.length > 0` gate
-* into no branch at all — no store, no log, no row. Silence read as "this camera
-* never saw a plate", which is a completely different fix.
-*/
-var REASON_EMPTY_READ = "empty-read";
-/** A plate detail with no bbox — nothing to crop, nothing to place. */
-var REASON_NO_BBOX = "no-bbox";
-/** `isPlausiblePlateRead` refused it (junk OCR off a distant/oblique plate). */
-var REASON_IMPLAUSIBLE = "implausible";
-/** Below the camera's configured minimum OCR confidence. */
-var REASON_BELOW_MIN_CONFIDENCE = "below-min-confidence";
-/** A person born with its box inside a vehicle's. See {@link FAMILY_PERSON_BIRTH}. */
-var REASON_PERSON_OVER_VEHICLE = "person-over-vehicle";
-/**
-* This addon's `failure-contribution` counters.
-*
-* One instance per addon process, handed to the paths that fail. Every method
-* takes the numeric `deviceId` first, for the same reason every log line does:
-* the question is always per camera.
-*/
-var AnalyticsFailureReport = class {
-	now;
-	counters;
-	constructor(now = Date.now, counters = new require_dist.FailureCounters()) {
-		this.now = now;
-		this.counters = counters;
-	}
-	/** One enrichment crop capture. `reason` absent = the native ROI landed. */
-	noteEnrichmentCrop(deviceId, reason) {
-		this.counters.note({
-			deviceId,
-			family: FAMILY_ENRICHMENT_CROP,
-			...reason !== void 0 ? { reason } : {}
-		}, this.now());
-	}
-	/** One capture that reached a terminal scheduling outcome. */
-	noteCaptureSchedule(deviceId, reason) {
-		this.counters.note({
-			deviceId,
-			family: FAMILY_CAPTURE_SCHEDULE,
-			...reason !== void 0 ? { reason } : {}
-		}, this.now());
-	}
-	/** One plate OCR read. `reason` absent = the read was accepted and stored. */
-	notePlateRead(deviceId, reason) {
-		this.counters.note({
-			deviceId,
-			family: FAMILY_PLATE_OCR,
-			...reason !== void 0 ? { reason } : {}
-		}, this.now());
-	}
-	/** One confirmed person birth. `reason` present = it was born over a vehicle. */
-	notePersonBirth(deviceId, reason) {
-		this.counters.note({
-			deviceId,
-			family: FAMILY_PERSON_BIRTH,
-			...reason !== void 0 ? { reason } : {}
-		}, this.now());
-	}
-	/** The `failure-contribution` provider's payload. Reads, never resets. */
-	list() {
-		return this.counters.snapshot(this.now());
-	}
-	/** Addon disposal. */
-	clear() {
-		this.counters.clear();
-	}
-};
-//#endregion
 //#region src/pipeline-analytics/plate-recognizer.ts
 /**
 * PlateRecognizer — collects EVERY license-plate OCR read a vehicle track
@@ -60451,31 +60625,6 @@ var NativeCropDedupe = class {
 	}
 };
 //#endregion
-//#region src/pipeline-analytics/pipeline/capture-crop.ts
-function createCaptureCrop(deps) {
-	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
-		const paddedNorm = padBbox({
-			x: bbox.x / frameWidth,
-			y: bbox.y / frameHeight,
-			w: bbox.w / frameWidth,
-			h: bbox.h / frameHeight
-		}, padding);
-		const nativeCrop = await deps.tryNativeCrop(frameHandle, paddedNorm, maxWidth);
-		if (nativeCrop) {
-			deps.bumpCropMetric(true);
-			if (deviceId !== void 0) deps.noteCropOutcome?.(deviceId);
-			return nativeCrop;
-		}
-		deps.bumpCropMetric(false);
-		if (deviceId !== void 0) deps.noteCropOutcome?.(deviceId, REASON_NATIVE_MISS);
-		deps.logger.debug("enrichment crop native miss — detail scheduler will re-run", {
-			...deviceId !== void 0 ? { tags: { deviceId } } : {},
-			meta: { nodeId: frameHandle.nodeId }
-		});
-		return null;
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/pipeline/display-crop.ts
 /** Bound the once-per-owner memo so a long-lived process never leaks it. */
 var MAX_LOGGED_OWNERS = 5e3;
@@ -65351,6 +65500,144 @@ function rowFromMetadata(id, metadata) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/store/settings-raw-mirror.ts
+/** How long a mirrored entry is served before a refresh is started behind the
+*  next reader. See the module doc for why this matches the per-kind caches'
+*  own window rather than introducing a second staleness bound. */
+var RAW_SETTINGS_STALE_MS = 5e3;
+/**
+* How long a FAILED refresh is not retried.
+*
+* A refresh that throws leaves `fetchedAt` where it was, so without a
+* cooldown every subsequent reader would start another attempt — a broken
+* settings store would be hammered at frame rate by the very mechanism built
+* to stop that.
+*/
+var RAW_SETTINGS_MISS_COOLDOWN_MS = 5e3;
+/**
+* The addon's per-device raw blob (`pipeline-analytics:addon-devices`), kept
+* fresh OFF every per-kind settings cache's hot path.
+*
+* `resolve` is COLD-awaiting and single-flight: a burst of settings kinds
+* (or frames) missing on the same device in the same tick costs ONE read,
+* not one per caller — the exact failure this class exists to remove.
+*/
+var RawDeviceBlobMirror = class {
+	deps;
+	staleMs;
+	missCooldownMs;
+	entries = /* @__PURE__ */ new Map();
+	inFlight = /* @__PURE__ */ new Map();
+	now;
+	constructor(deps, staleMs = RAW_SETTINGS_STALE_MS, missCooldownMs = RAW_SETTINGS_MISS_COOLDOWN_MS) {
+		this.deps = deps;
+		this.staleMs = staleMs;
+		this.missCooldownMs = missCooldownMs;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	/**
+	* The device's raw stored blob.
+	*
+	* COLD awaits — the first settings kind to touch a device has to get the
+	* real answer. WARM returns immediately, stale or not, and starts the
+	* refresh behind the caller.
+	*/
+	async resolve(deviceId) {
+		const entry = this.entries.get(deviceId);
+		if (entry === void 0) return this.load(deviceId);
+		if (this.now() - entry.fetchedAt >= this.staleMs) this.load(deviceId);
+		return entry.value;
+	}
+	/** Drop a device's entry. Called by every in-process writer of this
+	*  device's row, so an operator's own change is never served stale. */
+	invalidate(deviceId) {
+		this.entries.delete(deviceId);
+	}
+	invalidateAll() {
+		this.entries.clear();
+	}
+	async load(deviceId) {
+		const pending = this.inFlight.get(deviceId);
+		if (pending !== void 0) return pending;
+		const run = this.deps.read(deviceId).then((value) => {
+			this.entries.set(deviceId, {
+				value,
+				fetchedAt: this.now()
+			});
+			return value;
+		}).catch((err) => {
+			this.deps.onRefreshFailed?.(deviceId, err);
+			const existing = this.entries.get(deviceId);
+			if (existing !== void 0) {
+				existing.fetchedAt = this.now() - this.staleMs + this.missCooldownMs;
+				return existing.value;
+			}
+			return {};
+		}).finally(() => {
+			this.inFlight.delete(deviceId);
+		});
+		this.inFlight.set(deviceId, run);
+		return run;
+	}
+};
+/**
+* The addon's ONE `addon_settings` row (`pipeline-analytics:addon-settings`),
+* kept fresh OFF every per-kind settings cache's hot path. Same shape as
+* {@link RawDeviceBlobMirror}, singleton rather than keyed — there is exactly
+* one addon store per process.
+*/
+var RawGlobalStoreMirror = class {
+	deps;
+	staleMs;
+	missCooldownMs;
+	entry = null;
+	inFlight = null;
+	now;
+	constructor(deps, staleMs = RAW_SETTINGS_STALE_MS, missCooldownMs = RAW_SETTINGS_MISS_COOLDOWN_MS) {
+		this.deps = deps;
+		this.staleMs = staleMs;
+		this.missCooldownMs = missCooldownMs;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	async resolve() {
+		const entry = this.entry;
+		if (entry === null) return this.load();
+		if (this.now() - entry.fetchedAt >= this.staleMs) this.load();
+		return entry.value;
+	}
+	/** Drop the mirrored store. Called by every in-process global-settings
+	*  writer (`onConfigChanged`), so an operator's own change is never served
+	*  stale. */
+	invalidate() {
+		this.entry = null;
+	}
+	async load() {
+		if (this.inFlight !== null) return this.inFlight;
+		const run = this.deps.read().then((value) => {
+			this.entry = {
+				value,
+				fetchedAt: this.now()
+			};
+			return value;
+		}).catch((err) => {
+			this.deps.onRefreshFailed?.(err);
+			const existing = this.entry;
+			if (existing !== null) {
+				this.entry = {
+					value: existing.value,
+					fetchedAt: this.now() - this.staleMs + this.missCooldownMs
+				};
+				return existing.value;
+			}
+			return {};
+		}).finally(() => {
+			this.inFlight = null;
+		});
+		this.inFlight = run;
+		return run;
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/summary/summary-score.ts
 /** A member whose own box is covered this much by others is hidden. */
 var OCCLUDED_COVER_FRACTION = .5;
@@ -65655,144 +65942,6 @@ var SummarySealer = class {
 	}
 };
 //#endregion
-//#region src/pipeline-analytics/store/settings-raw-mirror.ts
-/** How long a mirrored entry is served before a refresh is started behind the
-*  next reader. See the module doc for why this matches the per-kind caches'
-*  own window rather than introducing a second staleness bound. */
-var RAW_SETTINGS_STALE_MS = 5e3;
-/**
-* How long a FAILED refresh is not retried.
-*
-* A refresh that throws leaves `fetchedAt` where it was, so without a
-* cooldown every subsequent reader would start another attempt — a broken
-* settings store would be hammered at frame rate by the very mechanism built
-* to stop that.
-*/
-var RAW_SETTINGS_MISS_COOLDOWN_MS = 5e3;
-/**
-* The addon's per-device raw blob (`pipeline-analytics:addon-devices`), kept
-* fresh OFF every per-kind settings cache's hot path.
-*
-* `resolve` is COLD-awaiting and single-flight: a burst of settings kinds
-* (or frames) missing on the same device in the same tick costs ONE read,
-* not one per caller — the exact failure this class exists to remove.
-*/
-var RawDeviceBlobMirror = class {
-	deps;
-	staleMs;
-	missCooldownMs;
-	entries = /* @__PURE__ */ new Map();
-	inFlight = /* @__PURE__ */ new Map();
-	now;
-	constructor(deps, staleMs = RAW_SETTINGS_STALE_MS, missCooldownMs = RAW_SETTINGS_MISS_COOLDOWN_MS) {
-		this.deps = deps;
-		this.staleMs = staleMs;
-		this.missCooldownMs = missCooldownMs;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	/**
-	* The device's raw stored blob.
-	*
-	* COLD awaits — the first settings kind to touch a device has to get the
-	* real answer. WARM returns immediately, stale or not, and starts the
-	* refresh behind the caller.
-	*/
-	async resolve(deviceId) {
-		const entry = this.entries.get(deviceId);
-		if (entry === void 0) return this.load(deviceId);
-		if (this.now() - entry.fetchedAt >= this.staleMs) this.load(deviceId);
-		return entry.value;
-	}
-	/** Drop a device's entry. Called by every in-process writer of this
-	*  device's row, so an operator's own change is never served stale. */
-	invalidate(deviceId) {
-		this.entries.delete(deviceId);
-	}
-	invalidateAll() {
-		this.entries.clear();
-	}
-	async load(deviceId) {
-		const pending = this.inFlight.get(deviceId);
-		if (pending !== void 0) return pending;
-		const run = this.deps.read(deviceId).then((value) => {
-			this.entries.set(deviceId, {
-				value,
-				fetchedAt: this.now()
-			});
-			return value;
-		}).catch((err) => {
-			this.deps.onRefreshFailed?.(deviceId, err);
-			const existing = this.entries.get(deviceId);
-			if (existing !== void 0) {
-				existing.fetchedAt = this.now() - this.staleMs + this.missCooldownMs;
-				return existing.value;
-			}
-			return {};
-		}).finally(() => {
-			this.inFlight.delete(deviceId);
-		});
-		this.inFlight.set(deviceId, run);
-		return run;
-	}
-};
-/**
-* The addon's ONE `addon_settings` row (`pipeline-analytics:addon-settings`),
-* kept fresh OFF every per-kind settings cache's hot path. Same shape as
-* {@link RawDeviceBlobMirror}, singleton rather than keyed — there is exactly
-* one addon store per process.
-*/
-var RawGlobalStoreMirror = class {
-	deps;
-	staleMs;
-	missCooldownMs;
-	entry = null;
-	inFlight = null;
-	now;
-	constructor(deps, staleMs = RAW_SETTINGS_STALE_MS, missCooldownMs = RAW_SETTINGS_MISS_COOLDOWN_MS) {
-		this.deps = deps;
-		this.staleMs = staleMs;
-		this.missCooldownMs = missCooldownMs;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	async resolve() {
-		const entry = this.entry;
-		if (entry === null) return this.load();
-		if (this.now() - entry.fetchedAt >= this.staleMs) this.load();
-		return entry.value;
-	}
-	/** Drop the mirrored store. Called by every in-process global-settings
-	*  writer (`onConfigChanged`), so an operator's own change is never served
-	*  stale. */
-	invalidate() {
-		this.entry = null;
-	}
-	async load() {
-		if (this.inFlight !== null) return this.inFlight;
-		const run = this.deps.read().then((value) => {
-			this.entry = {
-				value,
-				fetchedAt: this.now()
-			};
-			return value;
-		}).catch((err) => {
-			this.deps.onRefreshFailed?.(err);
-			const existing = this.entry;
-			if (existing !== null) {
-				this.entry = {
-					value: existing.value,
-					fetchedAt: this.now() - this.staleMs + this.missCooldownMs
-				};
-				return existing.value;
-			}
-			return {};
-		}).finally(() => {
-			this.inFlight = null;
-		});
-		this.inFlight = run;
-		return run;
-	}
-};
-//#endregion
 //#region src/pipeline-analytics/track-retention-sweep.ts
 /**
 * Sweep every device with persisted tracks: skip retention-disabled devices,
@@ -67380,6 +67529,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	suppressedBirths = new SuppressedBirthRegistry();
 	/** Births the gate could not MEASURE, awaiting another look on a later frame. */
 	deferredBirths = new DeferredBirthRegistry();
+	/**
+	* Subjects the confirmation gate found in a birth's crop BESIDES the birth
+	* itself (a dog in a person's crop), waiting to ride the next frame of the
+	* same (device, source) as detections — `pipeline/secondary-subjects.ts`.
+	*/
+	secondarySubjects = new SecondarySubjectQueue();
 	lastFrameDimsByDevice = /* @__PURE__ */ new Map();
 	lastAudioInsertByDevice = /* @__PURE__ */ new Map();
 	lastMotionInsertByDevice = /* @__PURE__ */ new Map();
@@ -70476,9 +70631,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		processor.setZones(liveZones);
 		processor.setDetectionRules(liveRules);
 		processor.setZoneMembershipMinOverlap(trk.zoneMembershipMinOverlap);
+		const injection = injectSecondarySubjects(frame, this.secondarySubjects.take(key, Date.now()));
+		for (const id of injection.covered) this.secondarySubjects.drop(key, id);
+		const trackerFrame = injection.frame;
+		if (trackerFrame !== frame) this.ctx.logger.info("secondary subjects ride this frame as detections", {
+			tags: { deviceId },
+			meta: {
+				source,
+				added: trackerFrame.detections.length - frame.detections.length,
+				classes: trackerFrame.detections.slice(frame.detections.length).map((d) => d.macroClass)
+			}
+		});
 		const result = processor.process({
 			timestamp: frame.timestamp,
-			frame
+			frame: trackerFrame
 		});
 		for (const r of processor.getLastLabelWriteRefusals()) {
 			const message = r.reason.kind === "macro-class" ? "label tier collapse refused" : "label write refused";
@@ -70621,6 +70787,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			bbox: t.bbox
 		})), {
 			deviceId,
+			source,
 			frameHandle,
 			frameWidth: result.frameWidth,
 			frameHeight: result.frameHeight
@@ -71265,16 +71432,25 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const executor = this.pipelineExecutorApi();
 		if (!executor?.runPipeline) return null;
 		try {
-			const detections = (await executor.runPipeline.mutate({
+			const result = await executor.runPipeline.mutate({
 				steps: [step],
 				image: new Uint8Array(cropJpeg),
 				deviceId,
 				plane: "frame"
-			}, require_dist.nodePin(nodeId)))?.detections;
+			}, require_dist.nodePin(nodeId));
+			const detections = result?.detections;
 			if (!detections) return null;
+			const cropWidth = result.width ?? 0;
+			const cropHeight = result.height ?? 0;
 			return detections.map((d) => ({
 				macroClass: d.macroClass,
-				score: d.score
+				score: d.score,
+				...d.bbox !== void 0 && cropWidth > 0 && cropHeight > 0 ? { bbox: {
+					x: d.bbox.x / cropWidth,
+					y: d.bbox.y / cropHeight,
+					w: d.bbox.width / cropWidth,
+					h: d.bbox.height / cropHeight
+				} } : {}
 			}));
 		} catch (err) {
 			this.ctx.logger.debug("confirmation gate: re-detection failed — fail-open", {
@@ -71300,7 +71476,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		if (candidates.length === 0) return allConfirmed();
 		const config = await this.resolveDeviceConfirmationGateSettings(params.deviceId);
 		if (!config.enabled) return allConfirmed();
-		const { frameHandle, frameWidth, frameHeight, deviceId } = params;
+		const { frameHandle, frameWidth, frameHeight, deviceId, source } = params;
 		const captureCrop = this.captureCrop;
 		if (!frameHandle || !captureCrop || frameWidth <= 0 || frameHeight <= 0) {
 			this.ctx.logger.info("confirmation gate: no crop path — births allowed unmeasured", {
@@ -71340,6 +71516,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, 320);
 			},
 			redetect: (cropJpeg) => this.redetectCropForConfirmation(nodeId, deviceId, cropJpeg),
+			cropRectFor: (candidate) => captureCropFrameRect({
+				x: candidate.bbox.x,
+				y: candidate.bbox.y,
+				w: candidate.bbox.w,
+				h: candidate.bbox.h
+			}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING),
 			minConfidenceFor: (candidate) => this.phantomCells?.spawnBar({
 				deviceId,
 				className: candidate.className,
@@ -71384,6 +71566,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 						});
 						break;
 				}
+				if (decision.secondary !== void 0) {
+					this.secondarySubjects.add(this.procKey(deviceId, source), decision.secondary, decision.trackId, Date.now());
+					this.ctx.logger.info("confirmation gate: secondary subject promoted from the crop", {
+						tags: { deviceId },
+						meta: {
+							trackId: decision.trackId,
+							className: decision.className,
+							secondaryClass: decision.secondary.className,
+							secondaryScore: decision.secondary.score,
+							secondaryBbox: decision.secondary.bbox,
+							verdict: decision.verdict
+						}
+					});
+				}
 			}
 		}, exhaustedIds);
 	}
@@ -73260,6 +73456,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const prefix = `${deviceId}:`;
 		for (const k of this.processors.keys()) if (k.startsWith(prefix)) this.processors.delete(k);
 		for (const k of this.lastActiveTrackIds.keys()) if (k.startsWith(prefix)) this.lastActiveTrackIds.delete(k);
+		for (const source of ["pipeline", "onboard"]) this.secondarySubjects.forget(this.procKey(deviceId, source));
 		for (const k of this.dropoutSkipsByKey.keys()) if (k.startsWith(prefix)) this.dropoutSkipsByKey.delete(k);
 		this.lastFrameDimsByDevice.delete(deviceId);
 	}