@camstack/addon-post-analysis 1.2.20 → 1.2.22

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-uZ5AHBEf.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DM0rHYe_.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.7",
+		version: "1.2.9",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.18",
+		version: "1.2.20",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.14",
+		version: "1.2.16",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",

package/dist/pipeline-analytics/{hostInit-BzSezYSo.mjs → hostInit-CJueft6_.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.18",
+				version: "1.2.20",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.7",
+				version: "1.2.9",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.14",
+				version: "1.2.16",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/pipeline-analytics/index.js

@@ -8268,6 +8268,80 @@ var SuppressedBirthRegistry = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/deferred-births.ts
+var DeferredBirthRegistry = class {
+	byDevice = /* @__PURE__ */ new Map();
+	/** Record an undecided attempt. The first call registers; later calls count. */
+	defer(deviceKey, trackId, nowMs) {
+		let ids = this.byDevice.get(deviceKey);
+		if (!ids) {
+			ids = /* @__PURE__ */ new Map();
+			this.byDevice.set(deviceKey, ids);
+		}
+		const existing = ids.get(trackId);
+		if (existing) existing.attempts += 1;
+		else ids.set(trackId, {
+			firstSeenMs: nowMs,
+			attempts: 1
+		});
+	}
+	isDeferred(deviceKey, trackId) {
+		return this.byDevice.get(deviceKey)?.has(trackId) === true;
+	}
+	attemptsFor(deviceKey, trackId) {
+		return this.byDevice.get(deviceKey)?.get(trackId)?.attempts ?? 0;
+	}
+	/** Ms since the FIRST attempt, or 0 for an id this registry never saw. */
+	elapsedMs(deviceKey, trackId, nowMs) {
+		const entry = this.byDevice.get(deviceKey)?.get(trackId);
+		return entry ? nowMs - entry.firstSeenMs : 0;
+	}
+	/** A verdict finally arrived — stop tracking it. */
+	resolve(deviceKey, trackId) {
+		const ids = this.byDevice.get(deviceKey);
+		if (!ids) return;
+		ids.delete(trackId);
+		if (ids.size === 0) this.byDevice.delete(deviceKey);
+	}
+	/**
+	* True when this birth has had enough tries, or waited long enough.
+	*
+	* Either bound ends the deferral: attempts alone would let a camera whose
+	* frames arrive slowly hold a birth for minutes, and elapsed alone would let
+	* a fast camera burn dozens of inference calls on one hopeless box.
+	*/
+	exhausted(deviceKey, trackId, nowMs, maxAttempts, maxDeferralMs) {
+		const entry = this.byDevice.get(deviceKey)?.get(trackId);
+		if (!entry) return false;
+		return entry.attempts >= maxAttempts || nowMs - entry.firstSeenMs >= maxDeferralMs;
+	}
+	/** Every id awaiting a verdict on this device. */
+	deferredIds(deviceKey) {
+		const ids = this.byDevice.get(deviceKey);
+		return ids ? [...ids.keys()] : [];
+	}
+	/**
+	* Forget every deferred id the tracker is no longer carrying.
+	*
+	* Called once per frame with the ids present THIS frame — the same contract
+	* as the suppressed registry's `retain`.
+	*/
+	retain(deviceKey, currentTrackIds) {
+		const ids = this.byDevice.get(deviceKey);
+		if (!ids) return;
+		for (const id of [...ids.keys()]) if (!currentTrackIds.has(id)) ids.delete(id);
+		if (ids.size === 0) this.byDevice.delete(deviceKey);
+	}
+	/** Deferred ids currently held for a device — diagnostics and tests. */
+	size(deviceKey) {
+		return this.byDevice.get(deviceKey)?.size ?? 0;
+	}
+	/** Drop a device's memory wholesale (device removed / pipeline reset). */
+	clearDevice(deviceKey) {
+		this.byDevice.delete(deviceKey);
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/key-event-query.ts
 async function rankKeyEvents(candidates, options, peakLookup) {
 	const scored = [];
@@ -8796,7 +8870,7 @@ function padBbox(bbox, padding) {
 //#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
-	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth) => {
+	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
 		const paddedNorm = padBbox({
 			x: bbox.x / frameWidth,
 			y: bbox.y / frameHeight,
@@ -8809,7 +8883,10 @@ function createCaptureCrop(deps) {
 			return nativeCrop;
 		}
 		deps.bumpCropMetric(false);
-		deps.logger.debug("enrichment crop native miss — detail scheduler will re-run", { meta: { nodeId: frameHandle.nodeId } });
+		deps.logger.debug("enrichment crop native miss — detail scheduler will re-run", {
+			...deviceId !== void 0 ? { tags: { deviceId } } : {},
+			meta: { nodeId: frameHandle.nodeId }
+		});
 		return null;
 	};
 }
@@ -14540,11 +14617,15 @@ function resolveTrackingSettings(raw) {
 * said "Ships DORMANT: `enabled` defaults to `false`" — that was stale, and on
 * 2026-07-30 it nearly produced the conclusion that the gate was not running at
 * all. It is: it suppressed several phantom births on device 615 that same day.
-* Read the schema, not this paragraph. Historically the intent was byte-identical
-* to today until an operator opts in per camera. The gate is fail-OPEN — any
-* missing frame handle, unavailable inference cap, crop-fetch miss, re-detection
-* error, or timeout ALLOWS the birth (a real track is never suppressed because
-* confirmation was unavailable).
+* Read the schema, not this paragraph.
+*
+* The gate is fail-DEFERRED, not fail-open (changed 2026-08-01). Anything that
+* prevents a MEASUREMENT — a missing frame handle, an unavailable inference
+* cap, a crop-fetch miss, a re-detection error, a timeout — leaves the birth
+* UNDECIDED and re-tried on later frames. Only an exhausted deferral with no
+* crop at all falls open, and that is logged at `warn`. Fail-open on every one
+* of those paths is what let a brick wall onto camera 636's track feed as a
+* `vehicle`, and left 45% of births unmeasured over twelve hours.
 *
 * Every field is independently overridable per camera; an unknown/invalid value
 * falls back to the field default (never throws on a bad blob) — mirrors
@@ -14561,7 +14642,9 @@ var CONFIRMATION_GATE_KEYS = {
 	enabled: "confirmationGateEnabled",
 	minConfidence: "confirmationGateMinConfidence",
 	minCropPx: "confirmationGateMinCropPx",
-	timeoutMs: "confirmationGateTimeoutMs"
+	timeoutMs: "confirmationGateTimeoutMs",
+	maxDeferralMs: "confirmationGateMaxDeferralMs",
+	maxAttempts: "confirmationGateMaxAttempts"
 };
 var ConfirmationGateSettingsSchema = require_dist.object({
 	/** Master switch. DEFAULT ON (2026-07-20 rollout) — the gate is FAIL-OPEN (any
@@ -14583,11 +14666,21 @@ var ConfirmationGateSettingsSchema = require_dist.object({
 	*/
 	minCropPx: require_dist.number().int().min(0).default(48),
 	/**
-	* Per-birth confirmation budget (ms). If the crop fetch + re-detection does
-	* not resolve within this window the gate fails open (confirms the birth) so
-	* the synchronous frame path never stalls on inference.
+	* Per-ATTEMPT confirmation budget (ms). If the crop fetch + re-detection does
+	* not resolve within this window the attempt ends UNDECIDED, so the
+	* synchronous frame path never stalls on inference.
 	*/
-	timeoutMs: require_dist.number().int().min(1).default(300)
+	timeoutMs: require_dist.number().int().min(1).default(300),
+	/**
+	* How long a birth may stay UNDECIDED before the gate stops waiting for a
+	* native crop and decides on the sub-native fallback.
+	*
+	* Measured from the FIRST attempt, so retries cannot push it out. 0 = decide
+	* on the first attempt (the pre-2026-08-01 cadence, without the fail-open).
+	*/
+	maxDeferralMs: require_dist.number().int().min(0).default(2e3),
+	/** How many gate attempts one birth may have, the first included. */
+	maxAttempts: require_dist.number().int().min(1).default(4)
 });
 var CONFIRMATION_GATE_DEFAULTS = ConfirmationGateSettingsSchema.parse({});
 /**
@@ -14604,7 +14697,9 @@ function resolveConfirmationGateSettings(raw) {
 		enabled: s.enabled.catch(CONFIRMATION_GATE_DEFAULTS.enabled).parse(raw[CONFIRMATION_GATE_KEYS.enabled]),
 		minConfidence: s.minConfidence.catch(CONFIRMATION_GATE_DEFAULTS.minConfidence).parse(raw[CONFIRMATION_GATE_KEYS.minConfidence]),
 		minCropPx: s.minCropPx.catch(CONFIRMATION_GATE_DEFAULTS.minCropPx).parse(raw[CONFIRMATION_GATE_KEYS.minCropPx]),
-		timeoutMs: s.timeoutMs.catch(CONFIRMATION_GATE_DEFAULTS.timeoutMs).parse(raw[CONFIRMATION_GATE_KEYS.timeoutMs])
+		timeoutMs: s.timeoutMs.catch(CONFIRMATION_GATE_DEFAULTS.timeoutMs).parse(raw[CONFIRMATION_GATE_KEYS.timeoutMs]),
+		maxDeferralMs: s.maxDeferralMs.catch(CONFIRMATION_GATE_DEFAULTS.maxDeferralMs).parse(raw[CONFIRMATION_GATE_KEYS.maxDeferralMs]),
+		maxAttempts: s.maxAttempts.catch(CONFIRMATION_GATE_DEFAULTS.maxAttempts).parse(raw[CONFIRMATION_GATE_KEYS.maxAttempts])
 	};
 }
 //#endregion
@@ -14636,9 +14731,9 @@ function isConfirmationCompatible(trackClassName, detectionMacroClass) {
 	if (track === "other" || det === "other") return true;
 	return track === det;
 }
-var failOpen = (candidate, reason) => ({
+var undecided = (candidate, reason) => ({
 	trackId: candidate.trackId,
-	confirmed: true,
+	verdict: "undecided",
 	reason,
 	className: candidate.className
 });
@@ -14654,11 +14749,12 @@ function withTimeout(promise, timeoutMs) {
 		});
 	});
 }
-async function runConfirmation(candidate, config, deps) {
-	const crop = await deps.fetchCrop(candidate);
-	if (!crop) return failOpen(candidate, "no-crop");
+async function runConfirmation(candidate, config, deps, exhausted) {
+	let crop = await deps.fetchCrop(candidate);
+	if (!crop && exhausted && deps.fetchFallbackCrop) crop = await deps.fetchFallbackCrop(candidate);
+	if (!crop) return undecided(candidate, "no-crop");
 	const detections = await deps.redetect(crop);
-	if (detections === null) return failOpen(candidate, "redetect-error");
+	if (detections === null) return undecided(candidate, "redetect-error");
 	let best;
 	let bestIncompatible;
 	for (const d of detections) if (isConfirmationCompatible(candidate.className, d.macroClass)) {
@@ -14667,7 +14763,7 @@ async function runConfirmation(candidate, config, deps) {
 	const confirmed = best !== void 0 && best.score >= config.minConfidence;
 	return {
 		trackId: candidate.trackId,
-		confirmed,
+		verdict: confirmed ? "confirmed" : "suppressed",
 		reason: confirmed ? "confirmed" : "suppressed",
 		className: candidate.className,
 		...best ? { bestScore: best.score } : {},
@@ -14677,31 +14773,40 @@ async function runConfirmation(candidate, config, deps) {
 		} : {}
 	};
 }
-async function confirmOne(candidate, config, deps) {
+async function confirmOne(candidate, config, deps, exhausted) {
 	const cropPx = Math.max(candidate.bbox.w, candidate.bbox.h);
-	if (config.minCropPx > 0 && cropPx < config.minCropPx) return failOpen(candidate, "below-min-crop");
+	if (config.minCropPx > 0 && cropPx < config.minCropPx) return undecided(candidate, "below-min-crop");
 	try {
-		return await withTimeout(runConfirmation(candidate, config, deps), config.timeoutMs);
+		return await withTimeout(runConfirmation(candidate, config, deps, exhausted), config.timeoutMs);
 	} catch {
-		return failOpen(candidate, "timeout");
+		return undecided(candidate, "timeout");
 	}
 }
 /**
-* Confirm a batch of birth candidates CONCURRENTLY and return the set of
-* trackIds whose births may PROCEED. When the gate is disabled (or there are no
-* candidates) every candidate is confirmed — byte-identical to no gate. The
-* caller runs this once, then processes only the confirmed births, preserving
-* the original birth-loop ordering.
+* Confirm a batch of birth candidates CONCURRENTLY. When the gate is disabled
+* (or there are no candidates) every candidate is confirmed — byte-identical to
+* no gate. The caller runs this once, then processes the confirmed births,
+* defers the undecided ones, and retracts the rest, preserving the original
+* birth-loop ordering.
 */
-async function confirmBirths(candidates, config, deps) {
-	if (!config.enabled || candidates.length === 0) return new Set(candidates.map((c) => c.trackId));
-	const decisions = await Promise.all(candidates.map((c) => confirmOne(c, config, deps)));
+async function confirmBirths(candidates, config, deps, exhaustedIds = /* @__PURE__ */ new Set()) {
+	if (!config.enabled || candidates.length === 0) return {
+		confirmed: new Set(candidates.map((c) => c.trackId)),
+		undecided: /* @__PURE__ */ new Set()
+	};
+	const decisions = await Promise.all(candidates.map((c) => confirmOne(c, config, deps, exhaustedIds.has(c.trackId))));
 	const confirmed = /* @__PURE__ */ new Set();
+	const pending = /* @__PURE__ */ new Set();
 	for (const decision of decisions) {
 		deps.onDecision?.(decision);
-		if (decision.confirmed) confirmed.add(decision.trackId);
+		if (decision.verdict === "confirmed") confirmed.add(decision.trackId);
+		else if (decision.verdict === "undecided") if (exhaustedIds.has(decision.trackId)) confirmed.add(decision.trackId);
+		else pending.add(decision.trackId);
 	}
-	return confirmed;
+	return {
+		confirmed,
+		undecided: pending
+	};
 }
 //#endregion
 //#region src/pipeline-analytics/face-settings.ts
@@ -15320,7 +15425,7 @@ function buildDetectionSettingsSections() {
 		{
 			id: "confirmation-gate",
 			title: "Confirmation gate",
-			description: "Before a NEW track is born, optionally re-run object detection on the hi-res native crop of the detection box. If the crop does not confirm a compatible object above the threshold, the birth is suppressed as a false positive. Fail-OPEN: any crop-fetch miss, unavailable inference, error, or timeout confirms the birth (a real track is never dropped because confirmation was unavailable).",
+			description: "Before a NEW track is born, re-run object detection on the hi-res native crop of the detection box. If the crop does not confirm a compatible object above the threshold, the birth is suppressed as a false positive. Fail-DEFERRED: a crop miss, unavailable inference, or a timeout leaves the birth UNDECIDED and looks again on later frames — it is not confirmed by default. Only an exhausted deferral with no crop at all lets a birth through unmeasured.",
 			columns: 2,
 			fields: [
 				{
@@ -15345,7 +15450,7 @@ function buildDetectionSettingsSections() {
 					type: "slider",
 					key: CONFIRMATION_GATE_KEYS.minCropPx,
 					label: "Min crop size",
-					description: "Subject boxes smaller than this (longest side, detection-frame px) are too tiny to confirm reliably — the gate skips them and confirms the birth. 0 = confirm every birth regardless of size.",
+					description: "Subject boxes smaller than this (longest side, detection-frame px) are too tiny to confirm reliably — the gate defers them and looks again as the subject approaches and the box grows. 0 = confirm every birth regardless of size.",
 					min: 0,
 					max: 256,
 					step: 8,
@@ -15357,13 +15462,36 @@ function buildDetectionSettingsSections() {
 					type: "slider",
 					key: CONFIRMATION_GATE_KEYS.timeoutMs,
 					label: "Confirmation timeout",
-					description: "Per-birth budget for crop fetch + re-detection. If it does not resolve in time the gate fails open (confirms the birth) so the frame path never stalls on inference.",
+					description: "Per-ATTEMPT budget for crop fetch + re-detection. If it does not resolve in time the attempt ends undecided, so the frame path never stalls on inference.",
 					min: 50,
 					max: 2e3,
 					step: 50,
 					default: CONFIRMATION_GATE_DEFAULTS.timeoutMs,
 					showValue: true,
 					unit: "ms"
+				},
+				{
+					type: "slider",
+					key: CONFIRMATION_GATE_KEYS.maxDeferralMs,
+					label: "Max deferral",
+					description: "How long an undecided birth may wait for a native crop before the gate decides on the sub-native fallback. Measured from the first attempt, so retries cannot push it out. 0 = decide on the first attempt.",
+					min: 0,
+					max: 1e4,
+					step: 250,
+					default: CONFIRMATION_GATE_DEFAULTS.maxDeferralMs,
+					showValue: true,
+					unit: "ms"
+				},
+				{
+					type: "slider",
+					key: CONFIRMATION_GATE_KEYS.maxAttempts,
+					label: "Max gate attempts",
+					description: "How many times one birth may be put through the gate, the first attempt included. The deferral ends on this or on the max deferral, whichever comes first.",
+					min: 1,
+					max: 12,
+					step: 1,
+					default: CONFIRMATION_GATE_DEFAULTS.maxAttempts,
+					showValue: true
 				}
 			]
 		},
@@ -20295,6 +20423,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	/** See `pipeline/suppressed-births.ts` — rejected births must not be
 	*  re-upserted, and must be forgotten when the tracker drops the id. */
 	suppressedBirths = new SuppressedBirthRegistry();
+	/** Births the gate could not MEASURE, awaiting another look on a later frame. */
+	deferredBirths = new DeferredBirthRegistry();
 	lastFrameDimsByDevice = /* @__PURE__ */ new Map();
 	lastAudioInsertByDevice = /* @__PURE__ */ new Map();
 	lastMotionInsertByDevice = /* @__PURE__ */ new Map();
@@ -20380,6 +20510,15 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  the same live-frame window as the face/plate/event-media captures. The
 	*  optional `maxWidth` caps the native crop width (used for the full-frame key
 	*  frame so a 4K native surface never floods the transport). */
+	/**
+	* The BOUNDED fallback `captureCrop` refuses — same padded ROI out of the
+	* retained full frame (keyframe-native tier, or the runner's ≤640 RAM tier;
+	* honest sub-native, NEVER upscaled). Built for the gallery tiles; the
+	* confirmation gate borrows it on an EXHAUSTED deferral only. See
+	* `docs/decisions/` — the gate is a model input, so this is a deliberate
+	* exception to "model-input crops keep captureCrop".
+	*/
+	captureDisplayCropFn = null;
 	captureCrop = null;
 	/** Full NATIVE frame by handle (downscaled worker-side to `maxWidth`), routed
 	*  to the owning runner, PLUS the source `tier`. Captured in the async init
@@ -20778,6 +20917,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  route through the CaptureScheduler at the injection point (S4). */
 	buildRecognizers(api, logger, stores, transport) {
 		const captureDisplayCrop = transport.captureDisplayCrop;
+		this.captureDisplayCropFn = captureDisplayCrop;
 		this.faceRecognizer = new FaceRecognizer({
 			identityStore: stores.identityStore,
 			faceStore: stores.faceStore,
@@ -21436,7 +21576,19 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				t
 			});
 		}
-		const confirmedBirths = await this.confirmTrackBirths(bornCandidates.map(({ id, t }) => ({
+		for (const id of this.deferredBirths.deferredIds(key)) {
+			if (bornCandidates.some((c) => c.id === id)) continue;
+			const t = result.tracked.find((x) => x.trackId === id);
+			if (t) bornCandidates.push({
+				id,
+				t
+			});
+		}
+		const gateSettings = await this.resolveDeviceConfirmationGateSettings(deviceId);
+		const exhaustionNowMs = Date.now();
+		const exhaustedIds = /* @__PURE__ */ new Set();
+		for (const { id } of bornCandidates) if (this.deferredBirths.exhausted(key, id, exhaustionNowMs, gateSettings.maxAttempts, gateSettings.maxDeferralMs)) exhaustedIds.add(id);
+		const outcome = await this.confirmTrackBirths(bornCandidates.map(({ id, t }) => ({
 			trackId: id,
 			className: t.className,
 			bbox: t.bbox
@@ -21445,18 +21597,53 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			frameHandle,
 			frameWidth: result.frameWidth,
 			frameHeight: result.frameHeight
-		});
+		}, exhaustedIds);
+		const gateNowMs = Date.now();
 		for (const { id, t } of bornCandidates) {
-			if (!confirmedBirths.has(id)) {
+			if (outcome.undecided.has(id)) {
+				this.deferredBirths.defer(key, id, gateNowMs);
+				log.info("birth undecided — deferred for another look", { meta: {
+					trackId: id,
+					className: t.className,
+					attempts: this.deferredBirths.attemptsFor(key, id),
+					elapsedMs: this.deferredBirths.elapsedMs(key, id, gateNowMs),
+					source
+				} });
+				continue;
+			}
+			const wasDeferred = this.deferredBirths.isDeferred(key, id);
+			const deferredForMs = this.deferredBirths.elapsedMs(key, id, gateNowMs);
+			const deferredAttempts = this.deferredBirths.attemptsFor(key, id);
+			this.deferredBirths.resolve(key, id);
+			if (!outcome.confirmed.has(id)) {
 				this.suppressedBirths.reject(key, id);
 				this.trackStore?.dropActive(id);
 				log.info("birth suppressed — track record retracted", { meta: {
 					trackId: id,
 					className: t.className,
-					source
+					source,
+					...wasDeferred ? {
+						wasDeferred,
+						deferredForMs,
+						deferredAttempts
+					} : {}
 				} });
 				continue;
 			}
+			if (wasDeferred && exhaustedIds.has(id)) log.warn("birth allowed unmeasured — deferral exhausted, no crop available", { meta: {
+				trackId: id,
+				className: t.className,
+				source,
+				deferredForMs,
+				deferredAttempts
+			} });
+			else if (wasDeferred) log.info("birth decided late — confirmed after deferral", { meta: {
+				trackId: id,
+				className: t.className,
+				source,
+				deferredForMs,
+				deferredAttempts
+			} });
 			newTrackCount += 1;
 			log.info("track started", { meta: {
 				trackId: id,
@@ -21518,6 +21705,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			} });
 		}
 		this.suppressedBirths.retain(key, currentTrackIds);
+		this.deferredBirths.retain(key, currentTrackIds);
 		this.lastActiveTrackIds.set(key, currentTrackIds);
 		const stationarySettings = this.stationarySettingsFromCache(deviceId);
 		if (source === "pipeline" && this.stationaryRegistry && stationarySettings.enabled) {
@@ -21946,19 +22134,25 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	* candidate) and each failure path fails OPEN, so the synchronous frame path
 	* is never blocked or reordered by a slow/failed re-detection.
 	*/
-	async confirmTrackBirths(candidates, params) {
-		const allConfirmed = () => new Set(candidates.map((c) => c.trackId));
+	async confirmTrackBirths(candidates, params, exhaustedIds = /* @__PURE__ */ new Set()) {
+		const allConfirmed = () => ({
+			confirmed: new Set(candidates.map((c) => c.trackId)),
+			undecided: /* @__PURE__ */ new Set()
+		});
 		if (candidates.length === 0) return allConfirmed();
 		const config = await this.resolveDeviceConfirmationGateSettings(params.deviceId);
 		if (!config.enabled) return allConfirmed();
 		const { frameHandle, frameWidth, frameHeight, deviceId } = params;
 		const captureCrop = this.captureCrop;
 		if (!frameHandle || !captureCrop || frameWidth <= 0 || frameHeight <= 0) {
-			this.ctx.logger.debug("confirmation gate: no crop path — births allowed (fail-open)", {
+			this.ctx.logger.info("confirmation gate: no crop path — births allowed unmeasured", {
 				tags: { deviceId },
 				meta: {
 					candidates: candidates.length,
-					hasHandle: Boolean(frameHandle)
+					hasHandle: Boolean(frameHandle),
+					hasCaptureCrop: Boolean(captureCrop),
+					frameWidth,
+					frameHeight
 				}
 			});
 			return allConfirmed();
@@ -21974,8 +22168,18 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					y: candidate.bbox.y,
 					w: candidate.bbox.w,
 					h: candidate.bbox.h
-				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, CONFIRMATION_CROP_MAX_WIDTH)
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, CONFIRMATION_CROP_MAX_WIDTH, deviceId)
 			}),
+			fetchFallbackCrop: (candidate) => {
+				const displayCrop = this.captureDisplayCropFn;
+				if (!displayCrop) return Promise.resolve(null);
+				return displayCrop(frameHandle, {
+					x: candidate.bbox.x,
+					y: candidate.bbox.y,
+					w: candidate.bbox.w,
+					h: candidate.bbox.h
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, CONFIRMATION_CROP_MAX_WIDTH);
+			},
 			redetect: (cropJpeg) => this.redetectCropForConfirmation(nodeId, deviceId, cropJpeg),
 			onDecision: (decision) => {
 				const meta = {
@@ -21989,20 +22193,28 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					} : {},
 					minConfidence: config.minConfidence
 				};
-				if (!decision.confirmed) this.ctx.logger.info("confirmation gate: birth suppressed (false positive)", {
-					tags: { deviceId },
-					meta
-				});
-				else if (decision.reason !== "confirmed") this.ctx.logger.debug("confirmation gate: birth allowed (fail-open)", {
-					tags: { deviceId },
-					meta
-				});
-				else this.ctx.logger.info("confirmation gate: birth confirmed", {
-					tags: { deviceId },
-					meta
-				});
+				switch (decision.verdict) {
+					case "suppressed":
+						this.ctx.logger.info("confirmation gate: birth suppressed (false positive)", {
+							tags: { deviceId },
+							meta
+						});
+						break;
+					case "undecided":
+						this.ctx.logger.info("confirmation gate: birth undecided", {
+							tags: { deviceId },
+							meta
+						});
+						break;
+					case "confirmed":
+						this.ctx.logger.info("confirmation gate: birth confirmed", {
+							tags: { deviceId },
+							meta
+						});
+						break;
+				}
 			}
-		});
+		}, exhaustedIds);
 	}
 	async resolveGlobalFaceEnabled() {
 		return this.faceGlobalEnabledCache.get(() => this.faceGlobalEnabledState.get());

package/dist/pipeline-analytics/index.mjs

@@ -8262,6 +8262,80 @@ var SuppressedBirthRegistry = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/deferred-births.ts
+var DeferredBirthRegistry = class {
+	byDevice = /* @__PURE__ */ new Map();
+	/** Record an undecided attempt. The first call registers; later calls count. */
+	defer(deviceKey, trackId, nowMs) {
+		let ids = this.byDevice.get(deviceKey);
+		if (!ids) {
+			ids = /* @__PURE__ */ new Map();
+			this.byDevice.set(deviceKey, ids);
+		}
+		const existing = ids.get(trackId);
+		if (existing) existing.attempts += 1;
+		else ids.set(trackId, {
+			firstSeenMs: nowMs,
+			attempts: 1
+		});
+	}
+	isDeferred(deviceKey, trackId) {
+		return this.byDevice.get(deviceKey)?.has(trackId) === true;
+	}
+	attemptsFor(deviceKey, trackId) {
+		return this.byDevice.get(deviceKey)?.get(trackId)?.attempts ?? 0;
+	}
+	/** Ms since the FIRST attempt, or 0 for an id this registry never saw. */
+	elapsedMs(deviceKey, trackId, nowMs) {
+		const entry = this.byDevice.get(deviceKey)?.get(trackId);
+		return entry ? nowMs - entry.firstSeenMs : 0;
+	}
+	/** A verdict finally arrived — stop tracking it. */
+	resolve(deviceKey, trackId) {
+		const ids = this.byDevice.get(deviceKey);
+		if (!ids) return;
+		ids.delete(trackId);
+		if (ids.size === 0) this.byDevice.delete(deviceKey);
+	}
+	/**
+	* True when this birth has had enough tries, or waited long enough.
+	*
+	* Either bound ends the deferral: attempts alone would let a camera whose
+	* frames arrive slowly hold a birth for minutes, and elapsed alone would let
+	* a fast camera burn dozens of inference calls on one hopeless box.
+	*/
+	exhausted(deviceKey, trackId, nowMs, maxAttempts, maxDeferralMs) {
+		const entry = this.byDevice.get(deviceKey)?.get(trackId);
+		if (!entry) return false;
+		return entry.attempts >= maxAttempts || nowMs - entry.firstSeenMs >= maxDeferralMs;
+	}
+	/** Every id awaiting a verdict on this device. */
+	deferredIds(deviceKey) {
+		const ids = this.byDevice.get(deviceKey);
+		return ids ? [...ids.keys()] : [];
+	}
+	/**
+	* Forget every deferred id the tracker is no longer carrying.
+	*
+	* Called once per frame with the ids present THIS frame — the same contract
+	* as the suppressed registry's `retain`.
+	*/
+	retain(deviceKey, currentTrackIds) {
+		const ids = this.byDevice.get(deviceKey);
+		if (!ids) return;
+		for (const id of [...ids.keys()]) if (!currentTrackIds.has(id)) ids.delete(id);
+		if (ids.size === 0) this.byDevice.delete(deviceKey);
+	}
+	/** Deferred ids currently held for a device — diagnostics and tests. */
+	size(deviceKey) {
+		return this.byDevice.get(deviceKey)?.size ?? 0;
+	}
+	/** Drop a device's memory wholesale (device removed / pipeline reset). */
+	clearDevice(deviceKey) {
+		this.byDevice.delete(deviceKey);
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/key-event-query.ts
 async function rankKeyEvents(candidates, options, peakLookup) {
 	const scored = [];
@@ -8790,7 +8864,7 @@ function padBbox(bbox, padding) {
 //#endregion
 //#region src/pipeline-analytics/pipeline/capture-crop.ts
 function createCaptureCrop(deps) {
-	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth) => {
+	return async (frameHandle, bbox, frameWidth, frameHeight, padding, maxWidth, deviceId) => {
 		const paddedNorm = padBbox({
 			x: bbox.x / frameWidth,
 			y: bbox.y / frameHeight,
@@ -8803,7 +8877,10 @@ function createCaptureCrop(deps) {
 			return nativeCrop;
 		}
 		deps.bumpCropMetric(false);
-		deps.logger.debug("enrichment crop native miss — detail scheduler will re-run", { meta: { nodeId: frameHandle.nodeId } });
+		deps.logger.debug("enrichment crop native miss — detail scheduler will re-run", {
+			...deviceId !== void 0 ? { tags: { deviceId } } : {},
+			meta: { nodeId: frameHandle.nodeId }
+		});
 		return null;
 	};
 }
@@ -14534,11 +14611,15 @@ function resolveTrackingSettings(raw) {
 * said "Ships DORMANT: `enabled` defaults to `false`" — that was stale, and on
 * 2026-07-30 it nearly produced the conclusion that the gate was not running at
 * all. It is: it suppressed several phantom births on device 615 that same day.
-* Read the schema, not this paragraph. Historically the intent was byte-identical
-* to today until an operator opts in per camera. The gate is fail-OPEN — any
-* missing frame handle, unavailable inference cap, crop-fetch miss, re-detection
-* error, or timeout ALLOWS the birth (a real track is never suppressed because
-* confirmation was unavailable).
+* Read the schema, not this paragraph.
+*
+* The gate is fail-DEFERRED, not fail-open (changed 2026-08-01). Anything that
+* prevents a MEASUREMENT — a missing frame handle, an unavailable inference
+* cap, a crop-fetch miss, a re-detection error, a timeout — leaves the birth
+* UNDECIDED and re-tried on later frames. Only an exhausted deferral with no
+* crop at all falls open, and that is logged at `warn`. Fail-open on every one
+* of those paths is what let a brick wall onto camera 636's track feed as a
+* `vehicle`, and left 45% of births unmeasured over twelve hours.
 *
 * Every field is independently overridable per camera; an unknown/invalid value
 * falls back to the field default (never throws on a bad blob) — mirrors
@@ -14555,7 +14636,9 @@ var CONFIRMATION_GATE_KEYS = {
 	enabled: "confirmationGateEnabled",
 	minConfidence: "confirmationGateMinConfidence",
 	minCropPx: "confirmationGateMinCropPx",
-	timeoutMs: "confirmationGateTimeoutMs"
+	timeoutMs: "confirmationGateTimeoutMs",
+	maxDeferralMs: "confirmationGateMaxDeferralMs",
+	maxAttempts: "confirmationGateMaxAttempts"
 };
 var ConfirmationGateSettingsSchema = object({
 	/** Master switch. DEFAULT ON (2026-07-20 rollout) — the gate is FAIL-OPEN (any
@@ -14577,11 +14660,21 @@ var ConfirmationGateSettingsSchema = object({
 	*/
 	minCropPx: number().int().min(0).default(48),
 	/**
-	* Per-birth confirmation budget (ms). If the crop fetch + re-detection does
-	* not resolve within this window the gate fails open (confirms the birth) so
-	* the synchronous frame path never stalls on inference.
+	* Per-ATTEMPT confirmation budget (ms). If the crop fetch + re-detection does
+	* not resolve within this window the attempt ends UNDECIDED, so the
+	* synchronous frame path never stalls on inference.
 	*/
-	timeoutMs: number().int().min(1).default(300)
+	timeoutMs: number().int().min(1).default(300),
+	/**
+	* How long a birth may stay UNDECIDED before the gate stops waiting for a
+	* native crop and decides on the sub-native fallback.
+	*
+	* Measured from the FIRST attempt, so retries cannot push it out. 0 = decide
+	* on the first attempt (the pre-2026-08-01 cadence, without the fail-open).
+	*/
+	maxDeferralMs: number().int().min(0).default(2e3),
+	/** How many gate attempts one birth may have, the first included. */
+	maxAttempts: number().int().min(1).default(4)
 });
 var CONFIRMATION_GATE_DEFAULTS = ConfirmationGateSettingsSchema.parse({});
 /**
@@ -14598,7 +14691,9 @@ function resolveConfirmationGateSettings(raw) {
 		enabled: s.enabled.catch(CONFIRMATION_GATE_DEFAULTS.enabled).parse(raw[CONFIRMATION_GATE_KEYS.enabled]),
 		minConfidence: s.minConfidence.catch(CONFIRMATION_GATE_DEFAULTS.minConfidence).parse(raw[CONFIRMATION_GATE_KEYS.minConfidence]),
 		minCropPx: s.minCropPx.catch(CONFIRMATION_GATE_DEFAULTS.minCropPx).parse(raw[CONFIRMATION_GATE_KEYS.minCropPx]),
-		timeoutMs: s.timeoutMs.catch(CONFIRMATION_GATE_DEFAULTS.timeoutMs).parse(raw[CONFIRMATION_GATE_KEYS.timeoutMs])
+		timeoutMs: s.timeoutMs.catch(CONFIRMATION_GATE_DEFAULTS.timeoutMs).parse(raw[CONFIRMATION_GATE_KEYS.timeoutMs]),
+		maxDeferralMs: s.maxDeferralMs.catch(CONFIRMATION_GATE_DEFAULTS.maxDeferralMs).parse(raw[CONFIRMATION_GATE_KEYS.maxDeferralMs]),
+		maxAttempts: s.maxAttempts.catch(CONFIRMATION_GATE_DEFAULTS.maxAttempts).parse(raw[CONFIRMATION_GATE_KEYS.maxAttempts])
 	};
 }
 //#endregion
@@ -14630,9 +14725,9 @@ function isConfirmationCompatible(trackClassName, detectionMacroClass) {
 	if (track === "other" || det === "other") return true;
 	return track === det;
 }
-var failOpen = (candidate, reason) => ({
+var undecided = (candidate, reason) => ({
 	trackId: candidate.trackId,
-	confirmed: true,
+	verdict: "undecided",
 	reason,
 	className: candidate.className
 });
@@ -14648,11 +14743,12 @@ function withTimeout(promise, timeoutMs) {
 		});
 	});
 }
-async function runConfirmation(candidate, config, deps) {
-	const crop = await deps.fetchCrop(candidate);
-	if (!crop) return failOpen(candidate, "no-crop");
+async function runConfirmation(candidate, config, deps, exhausted) {
+	let crop = await deps.fetchCrop(candidate);
+	if (!crop && exhausted && deps.fetchFallbackCrop) crop = await deps.fetchFallbackCrop(candidate);
+	if (!crop) return undecided(candidate, "no-crop");
 	const detections = await deps.redetect(crop);
-	if (detections === null) return failOpen(candidate, "redetect-error");
+	if (detections === null) return undecided(candidate, "redetect-error");
 	let best;
 	let bestIncompatible;
 	for (const d of detections) if (isConfirmationCompatible(candidate.className, d.macroClass)) {
@@ -14661,7 +14757,7 @@ async function runConfirmation(candidate, config, deps) {
 	const confirmed = best !== void 0 && best.score >= config.minConfidence;
 	return {
 		trackId: candidate.trackId,
-		confirmed,
+		verdict: confirmed ? "confirmed" : "suppressed",
 		reason: confirmed ? "confirmed" : "suppressed",
 		className: candidate.className,
 		...best ? { bestScore: best.score } : {},
@@ -14671,31 +14767,40 @@ async function runConfirmation(candidate, config, deps) {
 		} : {}
 	};
 }
-async function confirmOne(candidate, config, deps) {
+async function confirmOne(candidate, config, deps, exhausted) {
 	const cropPx = Math.max(candidate.bbox.w, candidate.bbox.h);
-	if (config.minCropPx > 0 && cropPx < config.minCropPx) return failOpen(candidate, "below-min-crop");
+	if (config.minCropPx > 0 && cropPx < config.minCropPx) return undecided(candidate, "below-min-crop");
 	try {
-		return await withTimeout(runConfirmation(candidate, config, deps), config.timeoutMs);
+		return await withTimeout(runConfirmation(candidate, config, deps, exhausted), config.timeoutMs);
 	} catch {
-		return failOpen(candidate, "timeout");
+		return undecided(candidate, "timeout");
 	}
 }
 /**
-* Confirm a batch of birth candidates CONCURRENTLY and return the set of
-* trackIds whose births may PROCEED. When the gate is disabled (or there are no
-* candidates) every candidate is confirmed — byte-identical to no gate. The
-* caller runs this once, then processes only the confirmed births, preserving
-* the original birth-loop ordering.
+* Confirm a batch of birth candidates CONCURRENTLY. When the gate is disabled
+* (or there are no candidates) every candidate is confirmed — byte-identical to
+* no gate. The caller runs this once, then processes the confirmed births,
+* defers the undecided ones, and retracts the rest, preserving the original
+* birth-loop ordering.
 */
-async function confirmBirths(candidates, config, deps) {
-	if (!config.enabled || candidates.length === 0) return new Set(candidates.map((c) => c.trackId));
-	const decisions = await Promise.all(candidates.map((c) => confirmOne(c, config, deps)));
+async function confirmBirths(candidates, config, deps, exhaustedIds = /* @__PURE__ */ new Set()) {
+	if (!config.enabled || candidates.length === 0) return {
+		confirmed: new Set(candidates.map((c) => c.trackId)),
+		undecided: /* @__PURE__ */ new Set()
+	};
+	const decisions = await Promise.all(candidates.map((c) => confirmOne(c, config, deps, exhaustedIds.has(c.trackId))));
 	const confirmed = /* @__PURE__ */ new Set();
+	const pending = /* @__PURE__ */ new Set();
 	for (const decision of decisions) {
 		deps.onDecision?.(decision);
-		if (decision.confirmed) confirmed.add(decision.trackId);
+		if (decision.verdict === "confirmed") confirmed.add(decision.trackId);
+		else if (decision.verdict === "undecided") if (exhaustedIds.has(decision.trackId)) confirmed.add(decision.trackId);
+		else pending.add(decision.trackId);
 	}
-	return confirmed;
+	return {
+		confirmed,
+		undecided: pending
+	};
 }
 //#endregion
 //#region src/pipeline-analytics/face-settings.ts
@@ -15314,7 +15419,7 @@ function buildDetectionSettingsSections() {
 		{
 			id: "confirmation-gate",
 			title: "Confirmation gate",
-			description: "Before a NEW track is born, optionally re-run object detection on the hi-res native crop of the detection box. If the crop does not confirm a compatible object above the threshold, the birth is suppressed as a false positive. Fail-OPEN: any crop-fetch miss, unavailable inference, error, or timeout confirms the birth (a real track is never dropped because confirmation was unavailable).",
+			description: "Before a NEW track is born, re-run object detection on the hi-res native crop of the detection box. If the crop does not confirm a compatible object above the threshold, the birth is suppressed as a false positive. Fail-DEFERRED: a crop miss, unavailable inference, or a timeout leaves the birth UNDECIDED and looks again on later frames — it is not confirmed by default. Only an exhausted deferral with no crop at all lets a birth through unmeasured.",
 			columns: 2,
 			fields: [
 				{
@@ -15339,7 +15444,7 @@ function buildDetectionSettingsSections() {
 					type: "slider",
 					key: CONFIRMATION_GATE_KEYS.minCropPx,
 					label: "Min crop size",
-					description: "Subject boxes smaller than this (longest side, detection-frame px) are too tiny to confirm reliably — the gate skips them and confirms the birth. 0 = confirm every birth regardless of size.",
+					description: "Subject boxes smaller than this (longest side, detection-frame px) are too tiny to confirm reliably — the gate defers them and looks again as the subject approaches and the box grows. 0 = confirm every birth regardless of size.",
 					min: 0,
 					max: 256,
 					step: 8,
@@ -15351,13 +15456,36 @@ function buildDetectionSettingsSections() {
 					type: "slider",
 					key: CONFIRMATION_GATE_KEYS.timeoutMs,
 					label: "Confirmation timeout",
-					description: "Per-birth budget for crop fetch + re-detection. If it does not resolve in time the gate fails open (confirms the birth) so the frame path never stalls on inference.",
+					description: "Per-ATTEMPT budget for crop fetch + re-detection. If it does not resolve in time the attempt ends undecided, so the frame path never stalls on inference.",
 					min: 50,
 					max: 2e3,
 					step: 50,
 					default: CONFIRMATION_GATE_DEFAULTS.timeoutMs,
 					showValue: true,
 					unit: "ms"
+				},
+				{
+					type: "slider",
+					key: CONFIRMATION_GATE_KEYS.maxDeferralMs,
+					label: "Max deferral",
+					description: "How long an undecided birth may wait for a native crop before the gate decides on the sub-native fallback. Measured from the first attempt, so retries cannot push it out. 0 = decide on the first attempt.",
+					min: 0,
+					max: 1e4,
+					step: 250,
+					default: CONFIRMATION_GATE_DEFAULTS.maxDeferralMs,
+					showValue: true,
+					unit: "ms"
+				},
+				{
+					type: "slider",
+					key: CONFIRMATION_GATE_KEYS.maxAttempts,
+					label: "Max gate attempts",
+					description: "How many times one birth may be put through the gate, the first attempt included. The deferral ends on this or on the max deferral, whichever comes first.",
+					min: 1,
+					max: 12,
+					step: 1,
+					default: CONFIRMATION_GATE_DEFAULTS.maxAttempts,
+					showValue: true
 				}
 			]
 		},
@@ -20289,6 +20417,8 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	/** See `pipeline/suppressed-births.ts` — rejected births must not be
 	*  re-upserted, and must be forgotten when the tracker drops the id. */
 	suppressedBirths = new SuppressedBirthRegistry();
+	/** Births the gate could not MEASURE, awaiting another look on a later frame. */
+	deferredBirths = new DeferredBirthRegistry();
 	lastFrameDimsByDevice = /* @__PURE__ */ new Map();
 	lastAudioInsertByDevice = /* @__PURE__ */ new Map();
 	lastMotionInsertByDevice = /* @__PURE__ */ new Map();
@@ -20374,6 +20504,15 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  the same live-frame window as the face/plate/event-media captures. The
 	*  optional `maxWidth` caps the native crop width (used for the full-frame key
 	*  frame so a 4K native surface never floods the transport). */
+	/**
+	* The BOUNDED fallback `captureCrop` refuses — same padded ROI out of the
+	* retained full frame (keyframe-native tier, or the runner's ≤640 RAM tier;
+	* honest sub-native, NEVER upscaled). Built for the gallery tiles; the
+	* confirmation gate borrows it on an EXHAUSTED deferral only. See
+	* `docs/decisions/` — the gate is a model input, so this is a deliberate
+	* exception to "model-input crops keep captureCrop".
+	*/
+	captureDisplayCropFn = null;
 	captureCrop = null;
 	/** Full NATIVE frame by handle (downscaled worker-side to `maxWidth`), routed
 	*  to the owning runner, PLUS the source `tier`. Captured in the async init
@@ -20772,6 +20911,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	*  route through the CaptureScheduler at the injection point (S4). */
 	buildRecognizers(api, logger, stores, transport) {
 		const captureDisplayCrop = transport.captureDisplayCrop;
+		this.captureDisplayCropFn = captureDisplayCrop;
 		this.faceRecognizer = new FaceRecognizer({
 			identityStore: stores.identityStore,
 			faceStore: stores.faceStore,
@@ -21430,7 +21570,19 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				t
 			});
 		}
-		const confirmedBirths = await this.confirmTrackBirths(bornCandidates.map(({ id, t }) => ({
+		for (const id of this.deferredBirths.deferredIds(key)) {
+			if (bornCandidates.some((c) => c.id === id)) continue;
+			const t = result.tracked.find((x) => x.trackId === id);
+			if (t) bornCandidates.push({
+				id,
+				t
+			});
+		}
+		const gateSettings = await this.resolveDeviceConfirmationGateSettings(deviceId);
+		const exhaustionNowMs = Date.now();
+		const exhaustedIds = /* @__PURE__ */ new Set();
+		for (const { id } of bornCandidates) if (this.deferredBirths.exhausted(key, id, exhaustionNowMs, gateSettings.maxAttempts, gateSettings.maxDeferralMs)) exhaustedIds.add(id);
+		const outcome = await this.confirmTrackBirths(bornCandidates.map(({ id, t }) => ({
 			trackId: id,
 			className: t.className,
 			bbox: t.bbox
@@ -21439,18 +21591,53 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			frameHandle,
 			frameWidth: result.frameWidth,
 			frameHeight: result.frameHeight
-		});
+		}, exhaustedIds);
+		const gateNowMs = Date.now();
 		for (const { id, t } of bornCandidates) {
-			if (!confirmedBirths.has(id)) {
+			if (outcome.undecided.has(id)) {
+				this.deferredBirths.defer(key, id, gateNowMs);
+				log.info("birth undecided — deferred for another look", { meta: {
+					trackId: id,
+					className: t.className,
+					attempts: this.deferredBirths.attemptsFor(key, id),
+					elapsedMs: this.deferredBirths.elapsedMs(key, id, gateNowMs),
+					source
+				} });
+				continue;
+			}
+			const wasDeferred = this.deferredBirths.isDeferred(key, id);
+			const deferredForMs = this.deferredBirths.elapsedMs(key, id, gateNowMs);
+			const deferredAttempts = this.deferredBirths.attemptsFor(key, id);
+			this.deferredBirths.resolve(key, id);
+			if (!outcome.confirmed.has(id)) {
 				this.suppressedBirths.reject(key, id);
 				this.trackStore?.dropActive(id);
 				log.info("birth suppressed — track record retracted", { meta: {
 					trackId: id,
 					className: t.className,
-					source
+					source,
+					...wasDeferred ? {
+						wasDeferred,
+						deferredForMs,
+						deferredAttempts
+					} : {}
 				} });
 				continue;
 			}
+			if (wasDeferred && exhaustedIds.has(id)) log.warn("birth allowed unmeasured — deferral exhausted, no crop available", { meta: {
+				trackId: id,
+				className: t.className,
+				source,
+				deferredForMs,
+				deferredAttempts
+			} });
+			else if (wasDeferred) log.info("birth decided late — confirmed after deferral", { meta: {
+				trackId: id,
+				className: t.className,
+				source,
+				deferredForMs,
+				deferredAttempts
+			} });
 			newTrackCount += 1;
 			log.info("track started", { meta: {
 				trackId: id,
@@ -21512,6 +21699,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 			} });
 		}
 		this.suppressedBirths.retain(key, currentTrackIds);
+		this.deferredBirths.retain(key, currentTrackIds);
 		this.lastActiveTrackIds.set(key, currentTrackIds);
 		const stationarySettings = this.stationarySettingsFromCache(deviceId);
 		if (source === "pipeline" && this.stationaryRegistry && stationarySettings.enabled) {
@@ -21940,19 +22128,25 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 	* candidate) and each failure path fails OPEN, so the synchronous frame path
 	* is never blocked or reordered by a slow/failed re-detection.
 	*/
-	async confirmTrackBirths(candidates, params) {
-		const allConfirmed = () => new Set(candidates.map((c) => c.trackId));
+	async confirmTrackBirths(candidates, params, exhaustedIds = /* @__PURE__ */ new Set()) {
+		const allConfirmed = () => ({
+			confirmed: new Set(candidates.map((c) => c.trackId)),
+			undecided: /* @__PURE__ */ new Set()
+		});
 		if (candidates.length === 0) return allConfirmed();
 		const config = await this.resolveDeviceConfirmationGateSettings(params.deviceId);
 		if (!config.enabled) return allConfirmed();
 		const { frameHandle, frameWidth, frameHeight, deviceId } = params;
 		const captureCrop = this.captureCrop;
 		if (!frameHandle || !captureCrop || frameWidth <= 0 || frameHeight <= 0) {
-			this.ctx.logger.debug("confirmation gate: no crop path — births allowed (fail-open)", {
+			this.ctx.logger.info("confirmation gate: no crop path — births allowed unmeasured", {
 				tags: { deviceId },
 				meta: {
 					candidates: candidates.length,
-					hasHandle: Boolean(frameHandle)
+					hasHandle: Boolean(frameHandle),
+					hasCaptureCrop: Boolean(captureCrop),
+					frameWidth,
+					frameHeight
 				}
 			});
 			return allConfirmed();
@@ -21968,8 +22162,18 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					y: candidate.bbox.y,
 					w: candidate.bbox.w,
 					h: candidate.bbox.h
-				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, CONFIRMATION_CROP_MAX_WIDTH)
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, CONFIRMATION_CROP_MAX_WIDTH, deviceId)
 			}),
+			fetchFallbackCrop: (candidate) => {
+				const displayCrop = this.captureDisplayCropFn;
+				if (!displayCrop) return Promise.resolve(null);
+				return displayCrop(frameHandle, {
+					x: candidate.bbox.x,
+					y: candidate.bbox.y,
+					w: candidate.bbox.w,
+					h: candidate.bbox.h
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, CONFIRMATION_CROP_MAX_WIDTH);
+			},
 			redetect: (cropJpeg) => this.redetectCropForConfirmation(nodeId, deviceId, cropJpeg),
 			onDecision: (decision) => {
 				const meta = {
@@ -21983,20 +22187,28 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 					} : {},
 					minConfidence: config.minConfidence
 				};
-				if (!decision.confirmed) this.ctx.logger.info("confirmation gate: birth suppressed (false positive)", {
-					tags: { deviceId },
-					meta
-				});
-				else if (decision.reason !== "confirmed") this.ctx.logger.debug("confirmation gate: birth allowed (fail-open)", {
-					tags: { deviceId },
-					meta
-				});
-				else this.ctx.logger.info("confirmation gate: birth confirmed", {
-					tags: { deviceId },
-					meta
-				});
+				switch (decision.verdict) {
+					case "suppressed":
+						this.ctx.logger.info("confirmation gate: birth suppressed (false positive)", {
+							tags: { deviceId },
+							meta
+						});
+						break;
+					case "undecided":
+						this.ctx.logger.info("confirmation gate: birth undecided", {
+							tags: { deviceId },
+							meta
+						});
+						break;
+					case "confirmed":
+						this.ctx.logger.info("confirmation gate: birth confirmed", {
+							tags: { deviceId },
+							meta
+						});
+						break;
+				}
 			}
-		});
+		}, exhaustedIds);
 	}
 	async resolveGlobalFaceEnabled() {
 		return this.faceGlobalEnabledCache.get(() => this.faceGlobalEnabledState.get());

package/dist/pipeline-analytics/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-uZ5AHBEf.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DM0rHYe_.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.20",
+  "version": "1.2.22",
   "description": "CamStack Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",