@camstack/addon-post-analysis 1.2.208 → 1.2.210

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as audioModeOf, $t as EventCategory, A as NcSnoozeSchema, At as vectorDimFromBase64, B as SCENE_DEFAULT_UNCOVERED_POLICY, Bt as nodePin, C as NcConditionDescriptorSchema, Ct as readTimelapseGeneratedAt, D as NcRuleTargetSchema, Dt as storageOccupancyCapability, E as NcRuleSchema, Et as sceneMonitorCapability, Ft as CamProfileSchema, G as TimelapseRulePatchSchema, Gt as discriminatedUnion, H as SceneMonitorSchema, Ht as _enum, I as RECORDING_EXPORT_MAX_READ_BYTES, It as DeviceType, J as VISIT_MERGE_GAP_MS, Jt as object, K as TimelapseRuleSchema, Kt as literal, L as RetrainStatusSchema, Lt as createEvent, M as NcSystemEventKindSchema, Mt as zoneAnalyticsCapability, N as NcTaxonomySchema, Nt as errMsg$1, O as NcScheduleSchema, Ot as subKindsOf, P as OpsLogEntrySchema, Pt as BaseAddon, Q as audioMetricsCapability, Qt as unknown, Rt as hydrateSchema, S as NC_TAXONOMY, St as readDeviceStateFrom, T as NcRulePatchSchema, U as TIMELAPSE_DENSE_FLOOR_SEC, Ut as array, V as SCENE_DIVERGED, Vt as sleep$1, W as TimelapseRuleInputSchema, Wt as boolean, X as alarmPanelCapability, Xt as record, Y as addonWidgetsSourceCapability, Yt as partialRecord, Z as assertTimelapseCadences, Zt as string, _ as MediaFileKindEnum, _t as notificationRulesCapability, a as DEFAULT_EVENT_COLOR, b as NC_DEFAULT_SNOOZE_MINUTES, bt as pipelineAnalyticsCapability, c as DETECTION_MACRO_CLASSES, ct as evictionPolicyOfLocation, d as EVENT_KIND_BY_CAP, et as buildEventKindDescriptor, f as EVENT_PAD_MS, ft as isDetectionMacroClass, g as MACRO_LABELS, gt as mayWriteToLocation, h as LabelAttributionSchema, ht as kebabToCamel, i as COCO_TO_MACRO, it as deriveRecordingMode, j as NcSnoozeSuppressedSchema, jt as videoclipsCapability, k as NcSnoozeInputSchema, kt as systemEventFilterApplies, lt as faceGalleryCapability, m as FailureCounters, mt as isSourceCap, n as BaseDevice, nt as customAction, ot as encodeVectorBase64, p as FULL_IMAGE_BBOX, pt as isScheduleActive, q as TrackSourceSchema, qt as number, r as CLUSTER_MODEL_SCOPED_STEPS, rt as defineCustomActions, st as evaluateSensorEdge, t as AUDIO_MACRO_LABELS, tt as cosineSimilarity$1, u as DeclaredDevices, ut as failureContributionCapability, v as NC_ALARM_SYSTEM_EVENT_KINDS, w as NcRuleInputSchema, wt as resolveLocationMode, xt as plateGalleryCapability, y as NC_CONDITION_CATALOG, yt as pickClusterStepModels, z as SCENE_DEFAULT_ANCHOR_THRESHOLD, zt as isDeviceScopedCap } from "../dist-WxrHfFRz.mjs";
+import { $ as assertTimelapseCadences, $t as string, A as NcScheduleSchema, At as subKindsOf, Bt as hydrateSchema, Ct as plateGalleryCapability, D as NcRulePatchSchema, E as NcRuleInputSchema, Et as resolveLocationMode, F as NcTaxonomySchema, Ft as errMsg$1, G as TIMELAPSE_DENSE_FLOOR_SEC, Gt as array, H as SCENE_DEFAULT_UNCOVERED_POLICY, Ht as nodePin, I as OpsLogEntrySchema, It as BaseAddon, J as TimelapseRuleSchema, Jt as literal, K as TimelapseRuleInputSchema, Kt as boolean, Lt as CamProfileSchema, M as NcSnoozeSchema, Mt as vectorDimFromBase64, N as NcSnoozeSuppressedSchema, Nt as videoclipsCapability, O as NcRuleSchema, Ot as sceneMonitorCapability, P as NcSystemEventKindSchema, Pt as zoneAnalyticsCapability, Q as alarmPanelCapability, Qt as record, R as RECORDING_EXPORT_MAX_READ_BYTES, Rt as DeviceType, S as NC_DEFAULT_SNOOZE_MINUTES, St as pipelineAnalyticsCapability, T as NcConditionDescriptorSchema, Tt as readTimelapseGeneratedAt, U as SCENE_DIVERGED, Ut as sleep$1, V as SCENE_DEFAULT_ANCHOR_THRESHOLD, Vt as isDeviceScopedCap, W as SceneMonitorSchema, Wt as _enum, X as VISIT_MERGE_GAP_MS, Xt as object, Y as TrackSourceSchema, Yt as number, Z as addonWidgetsSourceCapability, Zt as partialRecord, _ as MACRO_LABELS, _t as kebabToCamel, a as COCO_TO_MACRO, at as defineCustomActions, b as NC_ALARM_SYSTEM_EVENT_KINDS, ct as encodeVectorBase64, d as DeclaredDevices, dt as faceGalleryCapability, en as unknown, et as audioMetricsCapability, f as EVENT_KIND_BY_CAP, ft as failureContributionCapability, g as LabelAttributionSchema, gt as isSourceCap, h as FailureCounters, ht as isScheduleActive, i as CLUSTER_MODEL_SCOPED_STEPS, it as customAction, j as NcSnoozeInputSchema, jt as systemEventFilterApplies, k as NcRuleTargetSchema, kt as storageOccupancyCapability, l as DETECTION_MACRO_CLASSES, lt as evaluateSensorEdge, m as FULL_IMAGE_BBOX, mt as isDetectionMacroClass, n as ArchivedDebugNoteSchema, nt as buildEventKindDescriptor, o as DEFAULT_EVENT_COLOR, ot as deriveRecordingMode, p as EVENT_PAD_MS, q as TimelapseRulePatchSchema, qt as discriminatedUnion, r as BaseDevice, rt as cosineSimilarity$1, t as AUDIO_MACRO_LABELS, tn as EventCategory, tt as audioModeOf, ut as evictionPolicyOfLocation, v as MAX_ARCHIVED_DEBUG_NOTES, vt as mayWriteToLocation, w as NC_TAXONOMY, wt as readDeviceStateFrom, x as NC_CONDITION_CATALOG, xt as pickClusterStepModels, y as MediaFileKindEnum, yt as notificationRulesCapability, z as RetrainStatusSchema, zt as createEvent } from "../dist-D2rFaMex.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -3445,7 +3445,7 @@ var SceneConfirmGate = class {
 		};
 	}
 };
-function clamp$1(v, lo, hi) {
+function clamp$2(v, lo, hi) {
 	return Math.max(lo, Math.min(v, hi));
 }
 /**
@@ -3460,10 +3460,10 @@ async function cropSnapshotRoi(encoded, roi) {
 	const frameW = meta.width ?? 0;
 	const frameH = meta.height ?? 0;
 	if (frameW <= 0 || frameH <= 0) throw new Error("snapshot has no decodable dimensions");
-	const left = clamp$1(Math.round(roi.x * frameW), 0, frameW - 1);
-	const top = clamp$1(Math.round(roi.y * frameH), 0, frameH - 1);
-	const width = clamp$1(Math.round(roi.width * frameW), 1, frameW - left);
-	const height = clamp$1(Math.round(roi.height * frameH), 1, frameH - top);
+	const left = clamp$2(Math.round(roi.x * frameW), 0, frameW - 1);
+	const top = clamp$2(Math.round(roi.y * frameH), 0, frameH - 1);
+	const width = clamp$2(Math.round(roi.width * frameW), 1, frameW - left);
+	const height = clamp$2(Math.round(roi.height * frameH), 1, frameH - top);
 	return {
 		crop: await sharp(encoded).extract({
 			left,
@@ -7513,7 +7513,8 @@ function cooldownKey(rule, subject) {
 	const classKey = keysPerClass(rule, subject) && first !== void 0 ? `:c:${first}` : "";
 	const scopeRef = subject.systemEvent !== void 0 ? systemEventCooldownScope(subject.systemEvent) : `d:${subject.deviceId}`;
 	const kindKey = subject.systemEvent !== void 0 ? `:k:${subject.systemEvent.kind}` : "";
-	return rule.throttle.scope === "rule" ? `r:${rule.id}${kindKey}${classKey}` : `r:${rule.id}:${scopeRef}${classKey}`;
+	const phaseKey = subject.packagePhase !== void 0 ? `:p:${subject.packagePhase}` : "";
+	return rule.throttle.scope === "rule" ? `r:${rule.id}${kindKey}${phaseKey}${classKey}` : `r:${rule.id}:${scopeRef}${phaseKey}${classKey}`;
 }
 /** True when the rule fired within its cooldown window before `now`. */
 function isCoolingDown(rule, lastFiredAt, now) {
@@ -9950,6 +9951,10 @@ var en_default = {
 		"one": "{{count}} other {{classNoun}}",
 		"other": "{{count}} other {{classNoun}}"
 	},
+	"package.delivered.title": "Parcel delivered",
+	"package.delivered.body": "Delivered at {{camera}}{{inZones}}",
+	"package.picked-up.title": "Parcel collected",
+	"package.picked-up.body": "Collected from {{camera}}{{inZones}}",
 	"occupancy.body": "{{scope}} {{op}} ({{count}}/{{capacity}})",
 	"occupancy.op.occupied": "occupied",
 	"occupancy.op.free": "free",
@@ -10201,6 +10206,10 @@ var it_default = {
 		"one": "{{count}} altro {{classNoun}}",
 		"other": "{{count}} altri {{classNoun}}"
 	},
+	"package.delivered.title": "Pacco consegnato",
+	"package.delivered.body": "Consegnato su {{camera}}{{inZones}}",
+	"package.picked-up.title": "Pacco ritirato",
+	"package.picked-up.body": "Ritirato da {{camera}}{{inZones}}",
 	"occupancy.body": "{{scope}} {{op}} ({{count}}/{{capacity}})",
 	"occupancy.op.occupied": "occupata",
 	"occupancy.op.free": "libera",
@@ -12043,6 +12052,7 @@ function bodyKeyFor(entry) {
 	const subject = entry.payload.subject;
 	if (subject.systemEvent !== void 0) return subject.systemEvent.bodyKey ?? "";
 	if (subject.occupancy !== void 0) return "occupancy.body";
+	if (subject.packagePhase !== void 0) return `package.${subject.packagePhase}.body`;
 	if (entry.payload.enhancement === true) return "detection.body.enhanced";
 	return entry.recordKind === "track-end" ? "detection.body.trackEnd" : "detection.body";
 }
@@ -12050,6 +12060,8 @@ function bodyKeyFor(entry) {
 function titleKeyFor(entry) {
 	const systemEvent = entry.payload.subject.systemEvent;
 	if (systemEvent !== void 0) return systemEvent.titleKey ?? "";
+	const packagePhase = entry.payload.subject.packagePhase;
+	if (packagePhase !== void 0) return `package.${packagePhase}.title`;
 	return "detection.title";
 }
 /**
@@ -24834,6 +24846,7 @@ var NotificationCenter = class NotificationCenter {
 					zones: renderedZones,
 					timestamp: subject.timestamp,
 					...subject.occupancy !== void 0 ? { occupancy: frozenOccupancy(rule, subject.occupancy) } : {},
+					...subject.packagePhase !== void 0 ? { packagePhase: subject.packagePhase } : {},
 					...subject.systemEvent !== void 0 ? { systemEvent: subject.systemEvent } : {}
 				}
 			};
@@ -28598,6 +28611,37 @@ var MediaStore = class {
 		return newKey;
 	}
 	/**
+	* Exchange the bytes+instant held in the `firstFrame` and `lastFrame` slots
+	* (close-time ordering repair, see `pipeline/first-last-frame-order.ts`).
+	*
+	* Both are single-instance kinds, so each `putReplacing` overwrites the slot
+	* it names — the two rows end up holding each other's blob and timestamp.
+	* Nothing is deleted and nothing is re-encoded: both blobs are already the
+	* track's own stored pixels and the only thing wrong with them is which slot
+	* they sit in. The `lastFrame` write lands first so the "ultimo" tile is
+	* never momentarily the older view a viewer just refuted.
+	*/
+	async swapFirstAndLastFrame(input) {
+		await this.gated(async () => {
+			await this.putReplacingUnchecked({
+				deviceId: input.deviceId,
+				ownerKind: "track",
+				ownerId: input.trackId,
+				kind: "lastFrame",
+				timestamp: input.firstFrame.timestamp,
+				data: Buffer.from(input.firstFrame.base64, "base64")
+			});
+			await this.putReplacingUnchecked({
+				deviceId: input.deviceId,
+				ownerKind: "track",
+				ownerId: input.trackId,
+				kind: "firstFrame",
+				timestamp: input.lastFrame.timestamp,
+				data: Buffer.from(input.lastFrame.base64, "base64")
+			});
+		});
+	}
+	/**
 	* Fetch one media entry by its key (id). Returns null if the key is not
 	* found in the index or if the blob is missing from storage.
 	*/
@@ -30469,6 +30513,17 @@ function trackDurationMs(facts) {
 function hasKind(media, kind) {
 	return media.some((m) => m.kind === kind);
 }
+/** Newest instant stamped on a row of `kind`, or `null` when the track owns
+*  none. Single-instance kinds hold at most one row; the max guards a legacy
+*  duplicate, mirroring `decideFirstLastFrameOrder`. */
+function newestOfKind(media, kind) {
+	let newest = null;
+	for (const m of media) {
+		if (m.kind !== kind) continue;
+		if (newest === null || m.timestamp > newest) newest = m.timestamp;
+	}
+	return newest;
+}
 function latestMediaAt(media) {
 	let latest = null;
 	for (const m of media) if (latest === null || m.timestamp > latest) latest = m.timestamp;
@@ -30516,6 +30571,12 @@ function analyseDebugTrack(inventory) {
 		const lag = facts.lastSeen - lastFrameAt;
 		if (lag > 2e3) out.push(finding("LASTFRAME_STALE", "warn", `lastFrame is ${String(lag)} ms older than the track's end.`));
 	}
+	const firstFrameAt = newestOfKind(media, "firstFrame");
+	if (firstFrameAt !== null) {
+		const lastFrameAt = newestOfKind(media, "lastFrame");
+		if (lastFrameAt !== null && firstFrameAt > lastFrameAt) out.push(finding("FIRSTFRAME_AFTER_LASTFRAME", "error", `firstFrame is ${String(firstFrameAt - lastFrameAt)} ms NEWER than lastFrame — the "primo" tile post-dates the "ultimo" one. The first view is captured at the CONFIRMED birth, which the confirmation gate can defer by up to its maxDeferralMs, while keyFrame/thumbnail/lastFrame are stamped at the earlier frame they were cut from.`));
+		if (closed && firstFrameAt > facts.lastSeen) out.push(finding("FIRSTFRAME_AFTER_TRACK_END", "error", `firstFrame was captured ${String(firstFrameAt - facts.lastSeen)} ms AFTER the track's last observation — the tile shows a scene the subject had already left (a birth confirmed on a coasted frame).`));
+	}
 	if (closed && durationMs >= 1e4 && media.length > 0) {
 		const latest = latestMediaAt(media);
 		if (latest !== null) {
@@ -32746,9 +32807,14 @@ var FaceStore = class {
 *    with that person named. High means "this looks like someone we can name",
 *    which is what a mis-enrolment actually looks like.
 *
-* `suspicion` combines them so a sample that looks like somebody else outranks
-* one that merely looks like nobody: the first is a fixable error, the second
-* is often just a difficult photograph.
+* `suspicion` is the EXCESS — `bestForeign − selfMean` — because that is the
+* only one of the two that discriminates on real data. Measured on Roberta's
+* 106 samples, 2026-09-08: `selfMean` has a median of 0.188 and a p90 of 0.235,
+* so ANY absolute reading of "does not look like itself" fires on the whole
+* gallery. The first version of this module scored `(1 − selfMean) / 2` and
+* flagged 56 of 106 — a finding that fires on healthy samples means nothing.
+* `bestForeign` on the same gallery: median 0.283, p95 0.376, and one single
+* outlier at 0.612, which is the mis-enrolment.
 *
 * ## What it refuses to do
 *
@@ -32763,8 +32829,20 @@ var FaceStore = class {
 *
 * Pure — the caller loads the vectors and performs the removal.
 */
-/** Above this a row is worth the operator's attention. */
-var SUSPICION_FLAG = .5;
+/**
+* A row is FLAGGED when its best foreign match would auto-assign the face to
+* that other person — i.e. it reaches the recogniser's own
+* `similarityThreshold`.
+*
+* Tied to the live threshold rather than to a constant of its own, because
+* that is what the flag MEANS: this sample can steal a match. A second number
+* invented here would drift from the one the recogniser actually uses, and the
+* panel would accuse samples that cannot hurt anyone while staying quiet about
+* ones that can. On the live gallery (threshold 0.40) it flags 2 of 106.
+*/
+function flaggedCount(rows, autoAssignThreshold) {
+	return rows.filter((row) => (row.bestForeign?.score ?? 0) >= autoAssignThreshold).length;
+}
 /**
 * How far a foreign match has to stand OUT to count as looking like someone
 * else: `bestForeign - selfMean`. A sample that scores 0.6 against a stranger
@@ -32819,8 +32897,7 @@ function auditIdentitySamples(input) {
 		};
 		const selfMean = meanCosine(sample, comparable);
 		const foreign = bestForeignMatch(sample, input.others, input.modelId);
-		const excess = foreignExcess(selfMean, foreign);
-		const suspicion = selfMean === null ? 0 : (1 - selfMean) / 2 + excess;
+		const suspicion = foreignExcess(selfMean, foreign);
 		return {
 			sampleId: sample.sampleId,
 			enrolledAt: sample.enrolledAt,
@@ -32831,12 +32908,15 @@ function auditIdentitySamples(input) {
 			suspicion
 		};
 	});
-	rows.sort((a, b) => b.suspicion - a.suspicion);
+	rows.sort((a, b) => {
+		if (b.suspicion !== a.suspicion) return b.suspicion - a.suspicion;
+		return (a.selfMean ?? Number.POSITIVE_INFINITY) - (b.selfMean ?? Number.POSITIVE_INFINITY);
+	});
 	return {
 		identityId: input.identityId,
 		totalSamples: input.samples.length,
 		comparableSamples: comparable.length,
-		flagged: rows.filter((r) => r.suspicion >= SUSPICION_FLAG).length,
+		flagged: flaggedCount(rows, input.autoAssignThreshold),
 		rows
 	};
 }
@@ -32893,6 +32973,7 @@ var FaceGalleryProvider = class {
 	logger;
 	refreshGallery;
 	resolveClusterModelId;
+	resolveAutoAssignThreshold;
 	eventMediaBaseUrl;
 	eventMediaPathPrefix;
 	emitFaceGalleryChanged;
@@ -32905,6 +32986,7 @@ var FaceGalleryProvider = class {
 		this.logger = deps.logger;
 		this.refreshGallery = deps.refreshGallery;
 		this.resolveClusterModelId = deps.resolveClusterModelId;
+		this.resolveAutoAssignThreshold = deps.resolveAutoAssignThreshold;
 		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
 		this.eventMediaPathPrefix = deps.eventMediaPathPrefix;
 		this.emitFaceGalleryChanged = deps.emitFaceGalleryChanged;
@@ -32996,6 +33078,7 @@ var FaceGalleryProvider = class {
 	async auditIdentitySamples(input) {
 		const modelId = await this.resolveClusterModelId();
 		if (modelId === null) throw new Error("auditIdentitySamples: the cluster face-embedding model could not be resolved");
+		const autoAssignThreshold = await this.resolveAutoAssignThreshold();
 		const identities = await this.identityStore.listIdentities();
 		const target = identities.find((i) => i.id === input.identityId);
 		if (target === void 0) throw new Error(`auditIdentitySamples: no identity ${input.identityId}`);
@@ -33021,7 +33104,8 @@ var FaceGalleryProvider = class {
 				name: identity.name,
 				samples: inputsFor(identity.id)
 			})),
-			modelId
+			modelId,
+			autoAssignThreshold
 		});
 		const meta = new Map((samplesByIdentity.get(input.identityId) ?? []).map((sample) => [sample.id, sample]));
 		return {
@@ -33031,7 +33115,7 @@ var FaceGalleryProvider = class {
 			totalSamples: report.totalSamples,
 			comparableSamples: report.comparableSamples,
 			flagged: report.flagged,
-			flagThreshold: SUSPICION_FLAG,
+			flagThreshold: autoAssignThreshold,
 			rows: report.rows.map((row) => {
 				const sample = meta.get(row.sampleId);
 				return {
@@ -34090,6 +34174,29 @@ function firstFrameRetryBbox(current, birth) {
 	return { ...current };
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/birth-first-frame-gate.ts
+/**
+* Decide whether the confirmed-birth frame may be dispatched as this track's
+* `firstFrame` capture. Pure; the caller logs the refusal and keeps the
+* `firstFramePending` mark so a later frame retries.
+*
+* `coasted-frame` is reported ahead of `no-frame-handle` when both hold: a
+* handle-less coasted frame would have been refused for BEING coasted whatever
+* the decode plane did, and naming the decode is what would send the next
+* investigation at the wrong subsystem.
+*/
+function decideBirthFirstFrameCapture(input) {
+	if (input.matchedThisFrame === false) return {
+		capture: false,
+		refusedBecause: "coasted-frame"
+	};
+	if (!input.hasFrameHandle) return {
+		capture: false,
+		refusedBecause: "no-frame-handle"
+	};
+	return { capture: true };
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/events/event-filter.ts
 var DEFAULT_EVENT_EMITTER_CONFIG = {
 	minTrackAge: 3,
@@ -34698,7 +34805,7 @@ var DEFAULT_TRACKER_CONFIG = {
 var PERSON_CLASS = "person";
 var ANIMAL_CLASS = "animal";
 var MAX_PATH_LENGTH = 300;
-function clamp(value, min, max) {
+function clamp$1(value, min, max) {
 	return Math.max(min, Math.min(max, value));
 }
 function iou$3(a, b) {
@@ -35138,8 +35245,8 @@ var SortTracker = class SortTracker {
 			const perFrameX = t.velocity.dx * t.emitIntervalMs;
 			const perFrameY = t.velocity.dy * t.emitIntervalMs;
 			return {
-				x: t.bbox.x + clamp(perFrameX * f, -t.bbox.w, t.bbox.w),
-				y: t.bbox.y + clamp(perFrameY * f, -t.bbox.h, t.bbox.h),
+				x: t.bbox.x + clamp$1(perFrameX * f, -t.bbox.w, t.bbox.w),
+				y: t.bbox.y + clamp$1(perFrameY * f, -t.bbox.h, t.bbox.h),
 				w: t.bbox.w,
 				h: t.bbox.h
 			};
@@ -35148,8 +35255,8 @@ var SortTracker = class SortTracker {
 		const allowX = driftAllowancePx(t.bbox.w, elapsedMs);
 		const allowY = driftAllowancePx(t.bbox.h, elapsedMs);
 		return {
-			x: t.bbox.x + clamp(t.velocity.dx * elapsedMs, -allowX, allowX),
-			y: t.bbox.y + clamp(t.velocity.dy * elapsedMs, -allowY, allowY),
+			x: t.bbox.x + clamp$1(t.velocity.dx * elapsedMs, -allowX, allowX),
+			y: t.bbox.y + clamp$1(t.velocity.dy * elapsedMs, -allowY, allowY),
 			w: t.bbox.w,
 			h: t.bbox.h
 		};
@@ -37226,6 +37333,44 @@ function decideLastFramePromotion(media) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/first-last-frame-order.ts
+/**
+* Decide whether a closing track's `firstFrame` and `lastFrame` slots hold each
+* other's bytes. Pure — see the module header for the contract.
+*
+* Swap when BOTH slots are filled and the `firstFrame` is STRICTLY newer than
+* the `lastFrame`. Equal timestamps are not an inversion.
+*/
+function decideFirstLastFrameOrder(media) {
+	let firstFrame;
+	let lastFrame;
+	for (const m of media) if (m.kind === "firstFrame") {
+		if (firstFrame === void 0 || m.timestamp > firstFrame.timestamp) firstFrame = m;
+	} else if (m.kind === "lastFrame") {
+		if (lastFrame === void 0 || m.timestamp > lastFrame.timestamp) lastFrame = m;
+	}
+	if (firstFrame === void 0) return {
+		swap: false,
+		skippedBecause: "no-first-frame"
+	};
+	if (lastFrame === void 0) return {
+		swap: false,
+		skippedBecause: "no-last-frame"
+	};
+	if (firstFrame.timestamp <= lastFrame.timestamp) return {
+		swap: false,
+		skippedBecause: "ordered"
+	};
+	return {
+		swap: true,
+		firstFrameKey: firstFrame.key,
+		lastFrameKey: lastFrame.key,
+		firstFrameTimestamp: firstFrame.timestamp,
+		lastFrameTimestamp: lastFrame.timestamp,
+		inversionMs: firstFrame.timestamp - lastFrame.timestamp
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/static-track-gate.ts
 /**
 * Net displacement + path span for a track's centroid path, normalized to
@@ -37368,6 +37513,7 @@ var TrackCloser = class {
 			tile = "raster";
 		}
 		await this.maybePromoteLastFrame(t, ownedMedia);
+		await this.repairFirstLastFrameOrder(t);
 		const hasRasterFallback = closure?.rasterFallback !== void 0;
 		let deriveMiss;
 		if (!thumbnailLanded) {
@@ -37711,6 +37857,56 @@ var TrackCloser = class {
 		}
 	}
 	/**
+	* A track's "primo" tile is never newer than its "ultimo" tile
+	* (`first-last-frame-order.ts`). Filed by hand three times on device 3829,
+	* 2026-09-08 — `d035f251`, `448678bb`, `7628b19d`.
+	*
+	* The media list is RE-READ rather than reusing the caller's `ownedMedia`:
+	* `maybePromoteLastFrame` has just run and is precisely what may have put the
+	* older bytes in the `lastFrame` slot, so the caller's copy predates the pair
+	* being ordered here. Best-effort — a failure never blocks the close.
+	*/
+	async repairFirstLastFrameOrder(t) {
+		const store = this.deps.mediaStore();
+		if (!store) return;
+		const media = await store.listByOwner("track", t.trackId);
+		const decision = decideFirstLastFrameOrder(media);
+		if (!decision.swap) return;
+		const firstFrame = media.find((m) => m.key === decision.firstFrameKey);
+		const lastFrame = media.find((m) => m.key === decision.lastFrameKey);
+		if (!firstFrame || !lastFrame) return;
+		try {
+			await store.swapFirstAndLastFrame({
+				deviceId: t.deviceId,
+				trackId: t.trackId,
+				firstFrame,
+				lastFrame
+			});
+			this.deps.logger.warn("firstFrame/lastFrame were out of order — slots swapped", {
+				tags: { deviceId: t.deviceId },
+				meta: {
+					trackId: t.trackId,
+					className: t.className,
+					inversionMs: decision.inversionMs,
+					firstFrameAt: decision.firstFrameTimestamp,
+					lastFrameAt: decision.lastFrameTimestamp,
+					/** How far the late capture ran past the track itself. Positive means
+					*  it was cut from a frame the subject was no longer observed in. */
+					pastTrackEndMs: decision.firstFrameTimestamp - t.lastSeen,
+					durationMs: t.lastSeen - t.firstSeen
+				}
+			});
+		} catch (err) {
+			this.deps.logger.warn("firstFrame/lastFrame order repair failed", {
+				tags: { deviceId: t.deviceId },
+				meta: {
+					trackId: t.trackId,
+					error: String(err)
+				}
+			});
+		}
+	}
+	/**
 	* Key-event importance: score the just-expired track and persist. Peak
 	* confidence comes from the shared best-detection tracker; peak bbox area
 	* + the winning object-event id from one indexed queryObject(trackId) —
@@ -41526,7 +41722,10 @@ var TrackStore = class {
 			retrainStatus: active.retrainStatus ?? "none",
 			debug: active.debug === true,
 			debugNote: active.debugNote ?? "",
-			favourited: active.favourited === true
+			favourited: active.favourited === true,
+			startedAt: active.firstSeen,
+			className: active.className,
+			...displayLabel(active) !== void 0 ? { label: displayLabel(active) } : {}
 		};
 		const persisted = await this.getPersistedByTrackId(trackId);
 		if (!persisted) return null;
@@ -41534,7 +41733,10 @@ var TrackStore = class {
 			retrainStatus: persisted.retrainStatus ?? "none",
 			debug: persisted.debug === true,
 			debugNote: persisted.debugNote ?? "",
-			favourited: persisted.favourited === true
+			favourited: persisted.favourited === true,
+			startedAt: persisted.firstSeen,
+			className: persisted.className,
+			...displayLabel(persisted) !== void 0 ? { label: displayLabel(persisted) } : {}
 		};
 	}
 	/**
@@ -54913,7 +55115,7 @@ var PackageDropDetector = class {
 	async onStationaryChange(change) {
 		try {
 			if (change.phase === "appeared") await this.onAppeared(change.entry, change.timestamp);
-			else await this.onDeparted(change.entry, change.timestamp);
+			else await this.onDeparted(change);
 		} catch (err) {
 			this.deps.onError?.("onStationaryChange", err);
 			this.deps.logger.warn("package-drop detector failed on change", {
@@ -55091,7 +55293,9 @@ var PackageDropDetector = class {
 			}
 		});
 	}
-	async onDeparted(entry, timestamp) {
+	async onDeparted(change) {
+		const entry = change.entry;
+		const timestamp = change.timestamp;
 		if (!(await this.deps.resolveSettings(entry.deviceId)).packageDropPickupEnabled) {
 			this.deps.logger.debug("package pick-up skipped — packageDropPickupEnabled is false", {
 				tags: { deviceId: entry.deviceId },
@@ -55126,13 +55330,25 @@ var PackageDropDetector = class {
 			});
 			return;
 		}
+		const collector = change.collector;
+		const packageTrackId = entry.sourceTrackId ?? entry.id;
+		const mediaTrackId = collector?.trackId ?? packageTrackId;
+		if (collector === void 0) this.deps.logger.info("package pick-up has no collector track — the notification carries the parcel frame", {
+			tags: { deviceId: entry.deviceId },
+			meta: {
+				entryId: entry.id,
+				eventId: pickedUpId,
+				packageTrackId,
+				pickupAt: entry.lastConfirmedAt
+			}
+		});
 		const ev = {
 			id: pickedUpId,
 			kind: "object",
 			deviceId: entry.deviceId,
 			timestamp,
 			source: "pipeline",
-			trackId: entry.sourceTrackId ?? entry.id,
+			trackId: mediaTrackId,
 			className: PACKAGE_EVENT_CLASS,
 			...entry.label !== void 0 ? { label: entry.label } : {},
 			confidence: PACKAGE_IMPORTANCE,
@@ -55146,6 +55362,7 @@ var PackageDropDetector = class {
 			state: PICKED_UP_STATE,
 			frameWidth: entry.frameWidth,
 			frameHeight: entry.frameHeight,
+			...collector?.keyFrameMediaKey !== void 0 ? { mediaKey: collector.keyFrameMediaKey } : {},
 			importance: PACKAGE_IMPORTANCE
 		};
 		await this.deps.events.insertObject(ev);
@@ -55155,6 +55372,7 @@ var PackageDropDetector = class {
 			entryId: entry.id,
 			deliveredEventId: deliveredId,
 			className: entry.className,
+			...collector !== void 0 ? { collectorTrackId: collector.trackId } : {},
 			timestamp
 		});
 		this.deps.logger.info("package picked up", {
@@ -55162,11 +55380,139 @@ var PackageDropDetector = class {
 			meta: {
 				entryId: entry.id,
 				eventId: pickedUpId,
-				deliveredEventId: deliveredId
+				deliveredEventId: deliveredId,
+				mediaTrackId,
+				...collector !== void 0 ? {
+					collectorTrackId: collector.trackId,
+					collectorClassName: collector.className,
+					collectorSkewMs: collector.skewMs
+				} : { collectorTrackId: null }
 			}
 		});
 	}
 };
+/**
+* How long a presence survives in the mirror, in FRAME time.
+*
+* It must outlive the whole detection latency: a pick-up at T is concluded no
+* earlier than T + `PACKAGE_STILLNESS_TTL_MS` (5 min of observed time), and the
+* pick is made at conclusion time. 10 minutes is double that, so a collector
+* noted at the true instant is still there to be named — and a mirror that
+* expires the answer before the question is asked would be the same silent
+* hole in a different place.
+*/
+var PACKAGE_COLLECTOR_RETENTION_MS = 10 * 6e4;
+/** The pick-up instant a stationary entry implies. One derivation, named. */
+function pickupInstantOf(entry) {
+	return entry.lastConfirmedAt;
+}
+var PackageCollectorMirror = class {
+	/** Per device, per track. Every write replaces the record (immutable). */
+	byDevice = /* @__PURE__ */ new Map();
+	/**
+	* Record one sighting. Extends the track's presence span and refreshes its
+	* key-frame handle (a re-shot key frame is a better one, and the newest is
+	* also the nearest to the pick-up — the same trade as above).
+	*/
+	note(obs) {
+		const current = this.byDevice.get(obs.deviceId);
+		const next = /* @__PURE__ */ new Map();
+		const horizon = obs.at - PACKAGE_COLLECTOR_RETENTION_MS;
+		if (current !== void 0) for (const [id, p] of current) {
+			if (p.lastAt < horizon) continue;
+			next.set(id, p);
+		}
+		const prev = next.get(obs.trackId);
+		next.set(obs.trackId, {
+			trackId: obs.trackId,
+			className: obs.className,
+			firstAt: prev === void 0 ? obs.at : Math.min(prev.firstAt, obs.at),
+			lastAt: prev === void 0 ? obs.at : Math.max(prev.lastAt, obs.at),
+			...obs.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: obs.keyFrameMediaKey } : prev?.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: prev.keyFrameMediaKey } : {}
+		});
+		this.byDevice.set(obs.deviceId, evictOldest(next));
+	}
+	/**
+	* The track nearest the pick-up instant, or `null` when nobody qualifies.
+	*
+	* `null` is a real answer and not an error: a parcel can stop being seen
+	* because the light changed or the detector lost it, and naming a person who
+	* was not there would be worse than naming nobody. The caller degrades to the
+	* parcel's own owner and logs it.
+	*/
+	pickCollector(input) {
+		const presences = this.byDevice.get(input.deviceId);
+		if (presences === void 0 || presences.size === 0) return null;
+		const maxSkewMs = input.maxSkewMs ?? 3e4;
+		let best = null;
+		let bestLastAt = Number.NEGATIVE_INFINITY;
+		for (const p of presences.values()) {
+			const observedAt = clamp(input.pickupAt, p.firstAt, p.lastAt);
+			const skewMs = Math.abs(observedAt - input.pickupAt);
+			if (skewMs > maxSkewMs) continue;
+			if (best !== null && (skewMs > best.skewMs || skewMs === best.skewMs && p.lastAt <= bestLastAt)) continue;
+			best = {
+				trackId: p.trackId,
+				className: p.className,
+				observedAt,
+				skewMs,
+				...p.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: p.keyFrameMediaKey } : {}
+			};
+			bestLastAt = p.lastAt;
+		}
+		return best;
+	}
+	/**
+	* Fold one pipeline frame in. Returns how many presences it touched, so the
+	* caller can say "nobody was ever in the drop-off zone" with a number.
+	*
+	* This is the ONLY place the frame-shaped input is interpreted, so the
+	* production path and the test path read the same rules: a non-package class,
+	* inside a configured drop-off zone, on this frame.
+	*/
+	noteFrame(input) {
+		if (input.packageZoneIds.size === 0) return 0;
+		let noted = 0;
+		for (const t of input.tracked) {
+			if (input.packageClasses.has(t.className)) continue;
+			if (!isDelivererInPackageZone(t.zones, input.packageZoneIds)) continue;
+			const keyFrameMediaKey = input.keyFrameMediaKeyFor(t.trackId);
+			this.note({
+				deviceId: input.deviceId,
+				trackId: t.trackId,
+				className: t.className,
+				at: input.timestamp,
+				...keyFrameMediaKey !== void 0 ? { keyFrameMediaKey } : {}
+			});
+			noted += 1;
+		}
+		return noted;
+	}
+	/** Drop a camera's memory (unbind / step disabled / device removal). */
+	forgetDevice(deviceId) {
+		this.byDevice.delete(deviceId);
+	}
+	reset() {
+		this.byDevice.clear();
+	}
+	/** Retained presences for a camera — diagnostics and tests only. */
+	debugPresenceCount(deviceId) {
+		return this.byDevice.get(deviceId)?.size ?? 0;
+	}
+};
+function clamp(value, low, high) {
+	if (value < low) return low;
+	if (value > high) return high;
+	return value;
+}
+/** Keep the newest {@link PACKAGE_COLLECTOR_MAX_PRESENCES} by `lastAt`. */
+function evictOldest(presences) {
+	if (presences.size <= 32) return presences;
+	const ordered = [...presences.values()].sort((a, b) => b.lastAt - a.lastAt);
+	const kept = /* @__PURE__ */ new Map();
+	for (const p of ordered.slice(0, 32)) kept.set(p.trackId, p);
+	return kept;
+}
 //#endregion
 //#region src/pipeline-analytics/pipeline/person-over-vehicle.ts
 /**
@@ -56642,6 +56988,61 @@ function classifyTrackAppearance(input) {
 	if (input.inPrevActive) return "continuing";
 	return input.positionsCount > 1 ? "resurrection" : "birth";
 }
+//#endregion
+//#region src/pipeline-analytics/pipeline/archive-debug-note.ts
+/**
+* Archive the note a clear is about to destroy. Never throws.
+*
+* **Which way this fails, stated once.** The operator pressed a flag button;
+* the archive is this system's own bookkeeping. So a failing archive does NOT
+* block the flag write — the button must do what it says even when SQLite is
+* busy — and it does NOT retry, because the caller is a synchronous cap method
+* an operator is waiting on.
+*
+* What it must never do is lose the sentence quietly. The failure line carries
+* the NOTE TEXT verbatim, plus `tags: { deviceId }` and the trackId, so the
+* words are recoverable from the log by hand and the loss is attributable to
+* one camera. A branch that drops work silently reads as "never happened", and
+* the 3-hour media blackout produced not one line.
+*
+* An EMPTY note archives nothing: there is nothing to keep, and a row of `''`
+* would be a permanent entry in a corpus meant to be mined for sentences.
+*/
+async function archiveNoteBeforeClear(input) {
+	const note = input.current.debugNote;
+	if (note.trim() === "") return;
+	if (input.archive === void 0) {
+		input.logger.warn("debug note dropped — no archive is wired on this runner", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				deviceId: input.deviceId,
+				trackId: input.trackId,
+				note
+			}
+		});
+		return;
+	}
+	try {
+		await input.archive.append({
+			deviceId: input.deviceId,
+			sourceTrackId: input.trackId,
+			note,
+			...input.current.startedAt !== void 0 ? { trackStartedAt: input.current.startedAt } : {},
+			...input.current.className !== void 0 ? { trackClass: input.current.className } : {},
+			...input.current.label !== void 0 ? { trackLabel: input.current.label } : {}
+		});
+	} catch (err) {
+		input.logger.error("failed to archive a debug note — the text is in this line", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				deviceId: input.deviceId,
+				trackId: input.trackId,
+				note,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+	}
+}
 /** Thrown when the device is already holding its full staging budget. Distinct
 *  type so a surface can tell "you are out of room" from "that track is gone". */
 var StagingBudgetExceededError = class extends Error {
@@ -56682,7 +57083,10 @@ var TrackAlreadyTrainedError = class extends Error {
 *     caller sent with it. A note surviving the flag is a leftover that reads
 *     as a live request, and the invariant belongs here rather than in the
 *     three surfaces that write this patch — one of which is a browser grid
-*     that has no note UI at all and would never think to clear it.
+*     that has no note UI at all and would never think to clear it. Since
+*     D405 the clear is not a DELETE: `applyTrackFlags` ARCHIVES the note
+*     first, into a table that outlives the track. The invariant above is
+*     unchanged — only where the words go.
 *  2. **No note in the patch → nothing is written.** This is what makes a
 *     cancelled prompt free: the app turns debug on, the operator declines to
 *     type, and the flag still lands. Refusing to write a note must never cost
@@ -56776,6 +57180,13 @@ async function applyTrackFlags(deps, input) {
 		...input.flags.favourited !== void 0 ? { favourited: input.flags.favourited } : {},
 		...resolveNotePatch(deps, input, current)
 	};
+	if (patch.debugNote === "" && current.debugNote !== "") await archiveNoteBeforeClear({
+		deviceId: input.deviceId,
+		trackId: input.trackId,
+		logger,
+		archive: deps.noteArchive,
+		current
+	});
 	if (Object.keys(patch).length > 0) await store.setFlags(input.trackId, patch);
 	const retrainStatus = patch.markForTrain === void 0 ? current.retrainStatus : patch.markForTrain ? "staging" : "none";
 	return {
@@ -57858,6 +58269,9 @@ async function reconcileGallerySamples(deps, options) {
 	let keyless = 0;
 	let skippedGrace = 0;
 	let stoppedByCeiling = false;
+	let missed = 0;
+	/** Verdicts held until there are enough of them to tell rot from a move. */
+	const held = [];
 	const identities = await deps.listIdentities();
 	for (const identity of identities) {
 		const samples = await deps.listSamples(identity.id);
@@ -57902,6 +58316,43 @@ async function reconcileGallerySamples(deps, options) {
 			}
 			checked += 1;
 			if (state === "exists") continue;
+			missed += 1;
+			const minProbes = options.massMissMinProbes ?? 8;
+			const bar = options.massMissFraction ?? .5;
+			if (checked < minProbes) {
+				held.push({
+					identityId: identity.id,
+					sampleId: sample.id,
+					mediaKey: sample.mediaKey
+				});
+				continue;
+			}
+			if (missed / checked >= bar) {
+				const reason = `mass miss: ${String(missed)} of ${String(checked)} probes found no blob`;
+				deps.logger.warn("gallery reconcile: nearly every blob is missing — that is the volume, not the samples. Aborting and keeping every row; check where the gallery location points.", { meta: {
+					checked,
+					missed,
+					held: held.length,
+					identity: identity.name
+				} });
+				return {
+					checked,
+					reclaimed,
+					keyless,
+					skippedGrace,
+					stoppedByCeiling,
+					aborted: reason
+				};
+			}
+			for (const pending of held.splice(0, held.length)) {
+				await deps.removeSample(pending.identityId, pending.sampleId);
+				reclaimed += 1;
+				deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
+					sampleId: pending.sampleId,
+					mediaKey: pending.mediaKey,
+					state: "missing-blob"
+				} });
+			}
 			await deps.removeSample(identity.id, sample.id);
 			reclaimed += 1;
 			deps.logger.warn("gallery reconcile: sample blob is gone from the filesystem — reference removed", { meta: {
@@ -57912,6 +58363,14 @@ async function reconcileGallerySamples(deps, options) {
 			} });
 		}
 	}
+	for (const pending of held.splice(0, held.length)) {
+		if (reclaimed >= options.maxReclaimPerRun) {
+			stoppedByCeiling = true;
+			break;
+		}
+		await deps.removeSample(pending.identityId, pending.sampleId);
+		reclaimed += 1;
+	}
 	if (reclaimed > 0) deps.logger.info("gallery reconcile: dead references removed", { meta: {
 		checked,
 		reclaimed,
@@ -59409,6 +59868,261 @@ var IdentityStore = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/store/debug-note-archive-store.ts
+/**
+* DebugNoteArchiveStore — the durable corpus of what operators asked to be
+* checked (D405).
+*
+* A declared SQL-backed collection, like the events ops-log next door, and for
+* the same reason: pipeline-analytics already owns SQLite collections, and an
+* undeclared collection crash-loops the runner. MUST be declared in
+* `onInitialize` before the first write.
+*
+* Collection name: pipeline-analytics:debug-note-archive
+*
+* Two properties separate it from every other table in this addon:
+*
+*  - **It is not track-owned.** It names a track in `sourceTrackId` and that is
+*    PROVENANCE, never ownership — the whole point is that the row outlives the
+*    track, which `debug` deliberately never pinned (D353). It is classified
+*    `never-orphaned` by hand in `collection-classification.ts` so the
+*    ownership derivation cannot see the column and cascade it away.
+*  - **It is bounded by COUNT, not by age.** An age sweep would delete the
+*    corpus for being old, which is the failure this table exists to fix: a
+*    six-month-old note is the most valuable row in it, because the pattern it
+*    describes has had time to repeat. See {@link MAX_ARCHIVED_DEBUG_NOTES}.
+*/
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per debug note RETIRED by a review — appended by
+*     `applyTrackFlags` immediately before `debug: false` clears the note off
+*     the track row (D405). Idempotent per (sourceTrackId, note): the row id is
+*     derived from the pair, so reviewing the same track twice cannot double
+*     the corpus. An empty note writes nothing."
+*   retention="NOT track retention and NOT an age clock — deleting a note for
+*     being old is the failure this table fixes. Bounded by ROW COUNT
+*     (MAX_ARCHIVED_DEBUG_NOTES, 5000, fleet-wide), oldest `archivedAt` first,
+*     trimmed on append. ~3 MB of text at the ceiling."
+*/
+var DEBUG_NOTE_ARCHIVE_COLLECTION = "pipeline-analytics:debug-note-archive";
+var DEBUG_NOTE_ARCHIVE_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "archivedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "sourceTrackId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "note",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "trackStartedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "trackClass",
+		type: "TEXT"
+	},
+	{
+		name: "trackLabel",
+		type: "TEXT"
+	}
+];
+var DEBUG_NOTE_ARCHIVE_INDEXES = [{
+	name: "idx_debugnote_archived_at",
+	columns: ["archivedAt"]
+}, {
+	name: "idx_debugnote_device_at",
+	columns: ["deviceId", "archivedAt"]
+}];
+/**
+* The row id for one `(track, note)` pair.
+*
+* Deterministic on purpose: the idempotency the operator needs is "reviewing
+* twice does not double the row", and a derived primary key gets it from the
+* database rather than from a read-modify-write that two concurrent reviews
+* could interleave through. Truncated to 32 hex characters — 128 bits over a
+* table capped at 5 000 rows.
+*/
+function archiveRowId(sourceTrackId, note) {
+	return createHash("sha256").update(`${sourceTrackId}${note}`).digest("hex").slice(0, 32);
+}
+var DebugNoteArchiveStore = class {
+	store;
+	logger;
+	now;
+	maxRows;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.maxRows = deps.maxRows ?? 5e3;
+	}
+	/** The ceiling a store built without an override enforces. */
+	static defaultMaxRows() {
+		return MAX_ARCHIVED_DEBUG_NOTES;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: DEBUG_NOTE_ARCHIVE_COLLECTION,
+			columns: [...DEBUG_NOTE_ARCHIVE_COLUMNS],
+			indexes: [...DEBUG_NOTE_ARCHIVE_INDEXES]
+		});
+	}
+	/**
+	* Append one retired note. THROWS if the row cannot be written.
+	*
+	* Deliberately not best-effort, unlike the ops-log's `append`: this is the
+	* only copy of something a person typed, and the caller
+	* (`archiveNoteBeforeClear`) has both the text and the camera and is the
+	* right place to decide what a failure costs — it logs the note verbatim and
+	* lets the operator's flag write proceed. Swallowing here would hide the
+	* failure from the one caller able to preserve the words.
+	*
+	* The TRIM is the exception and is best-effort: the row has already landed,
+	* and failing the append because housekeeping could not run would make the
+	* caller report a note lost that is sitting in the table.
+	*/
+	async append(input) {
+		const note = input.note.trim() === "" ? "" : input.note;
+		if (note === "") return {
+			archived: false,
+			id: null
+		};
+		const id = archiveRowId(input.sourceTrackId, note);
+		if ((await this.store.query.query({
+			collection: "pipeline-analytics:debug-note-archive",
+			filter: {
+				where: { id },
+				limit: 1
+			}
+		})).length > 0) return {
+			archived: false,
+			id
+		};
+		const row = ArchivedDebugNoteSchema.parse({
+			id,
+			note,
+			deviceId: input.deviceId,
+			sourceTrackId: input.sourceTrackId,
+			archivedAt: this.now(),
+			trackStartedAt: input.trackStartedAt ?? null,
+			trackClass: input.trackClass ?? null,
+			trackLabel: input.trackLabel ?? null
+		});
+		await this.store.insert.mutate({
+			collection: DEBUG_NOTE_ARCHIVE_COLLECTION,
+			record: {
+				id: row.id,
+				data: {
+					note: row.note,
+					deviceId: row.deviceId,
+					sourceTrackId: row.sourceTrackId,
+					archivedAt: row.archivedAt,
+					trackStartedAt: row.trackStartedAt,
+					trackClass: row.trackClass,
+					trackLabel: row.trackLabel
+				}
+			}
+		});
+		await this.trim();
+		return {
+			archived: true,
+			id: row.id
+		};
+	}
+	/**
+	* Hold the table at its ceiling, oldest first. Best-effort by design — see
+	* {@link append}.
+	*
+	* NOT an age-keyed sweep and must never become one: the boundary below is
+	* computed from the POSITION of the excess rows, never from a clock, so a
+	* quiet fleet keeps its whole corpus for ever and a busy one drops its oldest
+	* questions. Rows sharing the boundary timestamp go together; at a
+	* one-per-review write rate that is a rounding error, and the alternative —
+	* deleting by id, one round trip per row — is the N+1 drain this store layer
+	* spent a release removing.
+	*/
+	async trim() {
+		try {
+			const held = await this.store.count.query({ collection: DEBUG_NOTE_ARCHIVE_COLLECTION });
+			const excess = held - this.maxRows;
+			if (excess <= 0) return;
+			const boundary = (await this.store.query.query({
+				collection: DEBUG_NOTE_ARCHIVE_COLLECTION,
+				filter: {
+					orderBy: {
+						field: "archivedAt",
+						direction: "asc"
+					},
+					limit: excess
+				},
+				columns: ["archivedAt"]
+			})).reduce((acc, r) => {
+				const at = r.data["archivedAt"];
+				return typeof at === "number" && at > acc ? at : acc;
+			}, 0);
+			if (boundary === 0) return;
+			const { deleted } = await this.store.deleteWhere.mutate({
+				collection: DEBUG_NOTE_ARCHIVE_COLLECTION,
+				filter: { whereBetween: { archivedAt: [0, boundary] } }
+			});
+			this.logger.info("debug-note archive trimmed to its ceiling", { meta: {
+				held,
+				ceiling: this.maxRows,
+				deleted
+			} });
+		} catch (err) {
+			this.logger.warn("debug-note archive trim failed — the archive will keep growing", { meta: {
+				ceiling: this.maxRows,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+	/** Archived notes, newest first, optionally scoped to one camera. */
+	async list(query) {
+		const filter = {
+			orderBy: {
+				field: "archivedAt",
+				direction: "desc"
+			},
+			limit: query.limit ?? 200
+		};
+		if (query.deviceId !== void 0) filter["where"] = { deviceId: query.deviceId };
+		const rows = await this.store.query.query({
+			collection: DEBUG_NOTE_ARCHIVE_COLLECTION,
+			filter
+		});
+		const out = [];
+		for (const r of rows) {
+			const parsed = ArchivedDebugNoteSchema.safeParse({
+				id: r.id,
+				...r.data
+			});
+			if (parsed.success) out.push(parsed.data);
+			else this.logger.debug("debug-note archive: skipped a malformed row", { meta: { id: r.id } });
+		}
+		return out;
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/store/ops-log-store.ts
 /**
 * OpsLogStore — the EVENTS-domain operations audit for pipeline-analytics.
@@ -60772,6 +61486,13 @@ var ANALYTICS_COLLECTIONS = [
 			why: "the drained predecessor of the row above, declared only so its rows can be read once and moved (`viewer-settings-legacy-adoption.ts`). Retention must never touch it: its rows go one way only, to the successor, gated on a re-read that confirms they landed. Delete this entry together with that module."
 		}
 	},
+	{
+		collection: DEBUG_NOTE_ARCHIVE_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "the archived operator notes (D405) — the ONE table here whose whole purpose is to outlive the track it names. `debug` never pinned a track against retention and D405 does not change that, so the track a note was written on IS expected to be evicted; deleting the note with it is the failure the archive was built to fix (25–27 notes from one sweep unreadable the same afternoon). Its column is called `sourceTrackId` and not `trackId` precisely so the ownership derivation cannot reach it, and its bound is a fleet-wide ROW COUNT trimmed on append — never an age sweep, which would delete the corpus for the one property that makes it valuable."
+		}
+	},
 	{
 		collection: STATIONARY_COLLECTION,
 		classification: {
@@ -68542,6 +69263,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	eventStore = null;
 	/** Events-domain ops-log (footprint/prune/manual-delete audit). Null until onInitialize. */
 	eventsOpsLog = null;
+	/**
+	* The archived operator debug notes (D405). Null until onInitialize — and
+	* `applyTrackFlags` treats null as "no archive wired": the flag write the
+	* operator asked for never depends on this addon's own bookkeeping.
+	*/
+	debugNoteArchive = null;
 	/** Event-media relocation engine (entity-routing Phase 4). */
 	mediaRelocate = null;
 	mediaLocationStorage = null;
@@ -69099,6 +69826,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	* which would let the streetlight wedge vouch for its own delivery.
 	*/
 	lastNonPackageActivityAt = /* @__PURE__ */ new Map();
+	/**
+	* WHO was in the drop-off zone, and when (D404). The pick-up is CONCLUDED
+	* minutes after the fact, so the collector must be remembered while it is
+	* still true — handles only, never pixels.
+	*/
+	packageCollectors = new PackageCollectorMirror();
 	/** Last time the oversize-sighting drop was logged per device — one line
 	*  per 5 minutes, not one per governor round (the wedge re-sights all
 	*  night; ~300 identical lines would bury the log it exists to serve). */
@@ -69524,6 +70257,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			logger: logger.child("ops-log"),
 			nodeId: ownNodeId
 		});
+		this.debugNoteArchive = new DebugNoteArchiveStore({
+			store: api.settingsStore,
+			logger: logger.child("debug-note-archive")
+		});
 		{
 			const designated = await step("postProcessingNodeState", () => this.postProcessingNodeState.get());
 			this.isPostProcessingNode = ownNodeId === designated;
@@ -69843,6 +70580,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			RetrainFrameStore.declare(api.settingsStore),
 			RetrainAnnotationStore.declare(api.settingsStore),
 			OpsLogStore.declare(api.settingsStore),
+			DebugNoteArchiveStore.declare(api.settingsStore),
 			AnalyticsLts.declare(api.settingsStore),
 			SceneStore.declare(api.settingsStore),
 			NotificationCenter.declare(api.settingsStore),
@@ -71481,6 +72219,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			this.packageStillness.forgetDevice(data.deviceId);
 			this.packageDropDetector?.forgetDevice(data.deviceId);
 			this.lastNonPackageActivityAt.delete(data.deviceId);
+			this.packageCollectors.forgetDevice(data.deviceId);
 			this.packageOversizeLogAt.delete(data.deviceId);
 			this.overlayState.clearDevice(data.deviceId);
 			this.overlaySynthesisWarnAt.delete(data.deviceId);
@@ -71500,6 +72239,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		this.packageStillness.forgetDevice(deviceId);
 		this.packageDropDetector?.forgetDevice(deviceId);
 		this.lastNonPackageActivityAt.delete(deviceId);
+		this.packageCollectors.forgetDevice(deviceId);
 		this.packageOversizeLogAt.delete(deviceId);
 		this.overlayState.clearDevice(deviceId);
 		this.overlaySynthesisWarnAt.delete(deviceId);
@@ -71890,6 +72630,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			eventStore: stores.eventStore,
 			logger: this.ctx.logger,
 			refreshGallery: () => this.faceRecognizer?.refreshGallery(),
+			resolveAutoAssignThreshold: async () => (await this.readDeviceSettings(0, resolveFaceSettings)).similarityThreshold,
 			resolveClusterModelId: async () => {
 				const api = this.ctx.api;
 				if (!api) return null;
@@ -72382,12 +73123,26 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				this.residents.markFirstFramePending(deviceId, id);
 				this.trackStore.seedSnapshotClock(id, result.timestamp, t.bbox);
 				this.residents.setLastFrameAt(deviceId, id, result.timestamp);
-				if (frameHandle) firstFrameTargets.push({
+				const birthCapture = decideBirthFirstFrameCapture({
+					hasFrameHandle: frameHandle !== void 0,
+					matchedThisFrame: t.matchedThisFrame
+				});
+				if (birthCapture.capture) firstFrameTargets.push({
 					trackId: id,
 					timestamp: result.timestamp,
 					bbox: { ...t.bbox },
 					...patchDisplayLabel(t.labelPatch) !== void 0 ? { label: patchDisplayLabel(t.labelPatch) } : {}
 				});
+				else log.info("birth firstFrame not captured — retry armed", {
+					tags: { deviceId },
+					meta: {
+						trackId: id,
+						className: t.className,
+						source,
+						refusedBecause: birthCapture.refusedBecause,
+						deferredMs: result.timestamp - (this.trackStore?.peekActive(id)?.firstSeen ?? result.timestamp)
+					}
+				});
 			}
 			this.ctx.eventBus.emit({
 				id: `pa-${randomUUID()}`,
@@ -75097,6 +75852,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			this.lastNonPackageActivityAt.set(input.deviceId, input.timestamp);
 			break;
 		}
+		this.packageCollectors.noteFrame({
+			deviceId: input.deviceId,
+			tracked: input.tracked,
+			packageClasses: input.packageClasses,
+			packageZoneIds: input.packageZoneIds,
+			timestamp: input.timestamp,
+			keyFrameMediaKeyFor: (trackId) => this.residents.keyFrameKey(trackId)
+		});
 		const sightings = [];
 		for (const t of input.tracked) {
 			if (!input.packageClasses.has(t.className)) continue;
@@ -75208,10 +75971,24 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 					meta: { entryId: entry.id }
 				});
 			}).catch(() => void 0);
+			const collector = this.packageCollectors.pickCollector({
+				deviceId: input.deviceId,
+				pickupAt: pickupInstantOf(entry)
+			});
+			if (collector === null) this.ctx.logger.info("package pick-up has no collector in the drop-off zone", {
+				tags,
+				meta: {
+					entryId: entry.id,
+					pickupAt: entry.lastConfirmedAt,
+					departedAt: input.timestamp,
+					presencesKnown: this.packageCollectors.debugPresenceCount(input.deviceId)
+				}
+			});
 			this.packageDropDetector.onStationaryChange({
 				phase: "departed",
 				entry,
-				timestamp: input.timestamp
+				timestamp: input.timestamp,
+				...collector !== null ? { collector } : {}
 			});
 		}
 		for (const entry of outcome.departedWithoutActivity) {
@@ -77336,7 +78113,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				setFlags: (trackId, patch) => trackStore.setFlags(trackId, patch),
 				countStaging: (query) => trackStore.countStaging(query)
 			},
-			logger: this.ctx.logger
+			logger: this.ctx.logger,
+			...this.debugNoteArchive !== null ? { noteArchive: this.debugNoteArchive } : {}
 		}, input);
 		this.ctx.logger.info("track operator flags set", {
 			tags: { deviceId: input.deviceId },
@@ -77467,6 +78245,18 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		return this.queryFacade.listOpsLog(input);
 	}
 	/**
+	* The archived debug notes, newest first (D405).
+	*
+	* Answers from the archive alone — never from the track rows. The point of
+	* the table is that the tracks these notes were written on are gone, so a
+	* read that joined them would return exactly the rows the archive exists to
+	* replace. An archive that has not been built yet answers EMPTY, which is
+	* true: nothing has been archived on this runner.
+	*/
+	async listArchivedDebugNotes(input) {
+		return await this.debugNoteArchive?.list(input) ?? [];
+	}
+	/**
 	* Track-centric time-based retention (design §5.1). Drains every persisted
 	* track for the device whose `lastSeen < cutoffMs`, page by page, through the
 	* widened cascade — enrolled faces/plates + identity media are exempt (design