@camstack/addon-post-analysis 1.2.211 → 1.2.212

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-FHSaZkf_.js");
+const require_dist = require("../dist-IE6UOohI.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -53432,6 +53432,95 @@ var BirthEvidenceStore = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/birth-decision-record.ts
+/**
+* birth-decision-record — turn one resolved birth verdict into the row that is
+* kept (D409).
+*
+* PURE, and separated from the store for the usual reason: the two rules worth
+* getting right — what counts as the fail-open, and when the latency proxy is
+* allowed to report a number — are decisions, not I/O, and a decision that only
+* exists inside a SQLite call cannot be tested or argued with.
+*
+* MEASUREMENT ONLY. Nothing here gates a birth, changes a verdict, or feeds
+* back into the frame path. The caller writes the row after the verdict is
+* already taken.
+*/
+/**
+* The verdict as the ledger reports it.
+*
+* `exhausted-fallback` is a CONFIRMATION and is counted apart from one, because
+* a birth nobody ever looked at and a birth measured and passed are the same
+* row in every existing aggregate — which is what made "the gate stopped
+* failing open" and "the gate now suppresses everything it cannot measure"
+* indistinguishable. Exhaustion attached to a SUPPRESSION is meaningless
+* (exhaustion only ever waves a birth through) and is discarded rather than
+* inventing a fourth member.
+*/
+function verdictFor(input) {
+	if (!input.confirmed) return "suppressed";
+	return input.exhaustedFallback ? "exhausted-fallback" : "confirmed";
+}
+/**
+* The latency proxy, and the three ways it declines to produce a number.
+*
+* It reports `null` — never a fabricated or clamped value — when there is no
+* track (a suppressed birth), no motion reference on this runner, or a
+* reference older than {@link MAX_BIRTH_LATENCY_PROXY_MS}. That last case is
+* the one that matters: on a busy scene the burst never closes and the onset is
+* minutes old, and a minutes-long "birth latency" would be read as the
+* detector's fault when it is the proxy's. When the reference is refused, the
+* onset and the burst index go with it — reporting an index against a reference
+* this row does not carry would be an invitation to join them back up.
+*
+* A NEGATIVE result is returned as measured. The analyzer's pixel-count floor
+* can be crossed after the detector's confidence floor for a subject entering
+* slowly at the frame edge, and clamping that away would delete precisely the
+* evidence that the proxy is unreliable. See `BirthDecisionRecordSchema` for
+* the full error bars.
+*/
+function latencyFor(input, firstSeen) {
+	const onset = input.motionOnsetAtMs;
+	if (firstSeen === null || onset === null) return {
+		motionOnsetAt: null,
+		birthLatencyMs: null,
+		birthIndexInBurst: null
+	};
+	if (firstSeen - onset > 6e4) return {
+		motionOnsetAt: null,
+		birthLatencyMs: null,
+		birthIndexInBurst: null
+	};
+	return {
+		motionOnsetAt: onset,
+		birthLatencyMs: firstSeen - onset,
+		birthIndexInBurst: input.birthIndexInBurst
+	};
+}
+/** Build the durable row for one resolved birth decision. */
+function buildBirthDecisionRecord(input) {
+	const verdict = verdictFor(input);
+	const firstSeen = verdict === "suppressed" ? null : input.firstSeen;
+	const latency = latencyFor(input, firstSeen);
+	return {
+		at: input.decidedAtMs,
+		deviceId: input.deviceId,
+		sourceTrackId: input.trackId,
+		className: input.className,
+		verdict,
+		reason: input.reason ?? null,
+		attempts: input.attempts,
+		deferredForMs: input.deferredForMs,
+		decidedOnCoastedFrame: input.matchedThisFrame === false,
+		birthEvidenceAvailable: input.birthEvidenceAvailable,
+		decidedByBirthEvidence: input.decidedByBirthEvidence,
+		bestScore: input.bestScore ?? null,
+		appliedMinConfidence: input.appliedMinConfidence ?? null,
+		firstSeen,
+		...latency
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/pipeline/deferred-births.ts
 var DeferredBirthRegistry = class {
 	byDevice = /* @__PURE__ */ new Map();
@@ -53506,6 +53595,44 @@ var DeferredBirthRegistry = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/pipeline/motion-onset-registry.ts
+var MotionOnsetRegistry = class {
+	byDevice = /* @__PURE__ */ new Map();
+	/**
+	* Motion went off→on at `atMs`. Opens a new burst, discarding the previous
+	* one's birth count — a new burst is a new subject population.
+	*/
+	noteRisingEdge(deviceId, atMs) {
+		this.byDevice.set(deviceId, {
+			onsetAtMs: atMs,
+			births: 0
+		});
+	}
+	/** The open burst's onset, or `null` for a device with no reference. */
+	onsetFor(deviceId) {
+		return this.byDevice.get(deviceId)?.onsetAtMs ?? null;
+	}
+	/**
+	* Count one birth decision against this device's burst and return its 0-based
+	* index — `null` when there is no burst to count it against.
+	*
+	* Index 0 is the only index at which the burst plausibly belongs to the same
+	* subject as the birth; the ledger records the index rather than filtering
+	* here, so the reader can see how often it is not 0.
+	*/
+	noteBirth(deviceId) {
+		const burst = this.byDevice.get(deviceId);
+		if (burst === void 0) return null;
+		const index = burst.births;
+		burst.births += 1;
+		return index;
+	}
+	/** Drop a device's reference (device removed / pipeline reset). */
+	forgetDevice(deviceId) {
+		this.byDevice.delete(deviceId);
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/pipeline/detail-semantic-gate.ts
 /** The detail `className` whose result IS the recognition. */
 var PLATE_CLASS = "plate";
@@ -60034,6 +60161,332 @@ var IdentityStore = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/store/birth-decision-ledger-store.ts
+/**
+* BirthDecisionLedgerStore — the durable record of every track-birth verdict
+* (D409).
+*
+* A declared SQL-backed collection, like the events ops-log and the debug-note
+* archive next door, and for the same reason: pipeline-analytics already owns
+* SQLite collections, and an undeclared collection crash-loops the runner. MUST
+* be declared in `onInitialize` before the first write.
+*
+* Collection name: pipeline-analytics:birth-decision-ledger
+*
+* ── Why a table rather than a log line ─────────────────────────────────────
+* The gate ALREADY logs every decision. `logs.query` is an in-memory ring that
+* measured 40 000 entries covering 38 MINUTES of fleet traffic on 2026-09-08 —
+* so a fourteenth field on that line answers nothing the next morning, and the
+* questions this data exists for ("what fraction of births on 617 were decided
+* on a coasted frame, over the week the operator complained about") are all
+* multi-day. A previous investigation in this repo was blocked for exactly
+* this.
+*
+* ── Why it is safe on the write path ──────────────────────────────────────
+* ONE INSERT PER BIRTH DECISION. Not per frame, not periodic, and never an
+* update of an existing row. Measured fleet-wide on the live hub, 2026-09-08:
+* 31 decided births in 38 minutes = ~49/hour = 0.014 writes/s. The write
+* amplification the runtime-state guard exists to prevent
+* (`scripts/check-runtime-state-durability.ts`: 12-19 writes/s rewriting
+* ~2.6-5 GB/day to maintain 161 KB) is three orders of magnitude above this and
+* is a different shape entirely — that one is a periodic REWRITE of a slice
+* whose values do not change. Nothing here advances a clock under an unchanged
+* value, because every row is new.
+*
+* ── Two properties, stated once ───────────────────────────────────────────
+*  - **It is not track-owned.** A SUPPRESSED birth never had a track; a
+*    confirmed one is expected to age out long before this row. The column is
+*    `sourceTrackId` and not `trackId` so the ownership derivation in
+*    `collection-classification.ts` cannot see it and cascade it away.
+*  - **It is bounded by COUNT, not by age.** A miss rate needs a denominator
+*    over whatever window the table holds; a quiet fleet should keep more of
+*    that window, not less. See {@link MAX_BIRTH_DECISION_RECORDS}.
+*
+* MEASUREMENT ONLY. Nothing reads this on the frame path; nothing gates on it.
+*/
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per track-birth VERDICT — appended by the birth loop in
+*     `processFrame` the instant the confirmation gate's verdict resolves
+*     (confirmed / suppressed / exhausted fail-open). Per BIRTH, never per
+*     frame: measured at ~49 rows/hour fleet-wide on 2026-09-08. Append-only,
+*     never updated. BEST-EFFORT — it logs and swallows, because a failed
+*     measurement must not fail the birth it measures."
+*   retention="NOT track retention and NOT an age clock — a miss rate needs
+*     whatever window the table holds, and an age sweep would shorten it on a
+*     quiet fleet exactly when more history is affordable. Bounded by ROW
+*     COUNT (MAX_BIRTH_DECISION_RECORDS, 30000, fleet-wide), oldest `at`
+*     first, trimmed on append. ~6 MB at the ceiling."
+*/
+var BIRTH_DECISION_LEDGER_COLLECTION = "pipeline-analytics:birth-decision-ledger";
+var BIRTH_DECISION_LEDGER_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "sourceTrackId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "className",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "verdict",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "reason",
+		type: "TEXT"
+	},
+	{
+		name: "attempts",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "deferredForMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "decidedOnCoastedFrame",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "birthEvidenceAvailable",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "decidedByBirthEvidence",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "bestScore",
+		type: "REAL"
+	},
+	{
+		name: "appliedMinConfidence",
+		type: "REAL"
+	},
+	{
+		name: "firstSeen",
+		type: "INTEGER"
+	},
+	{
+		name: "motionOnsetAt",
+		type: "INTEGER"
+	},
+	{
+		name: "birthLatencyMs",
+		type: "INTEGER"
+	},
+	{
+		name: "birthIndexInBurst",
+		type: "INTEGER"
+	}
+];
+var BIRTH_DECISION_LEDGER_INDEXES = [{
+	name: "idx_birthdecision_at",
+	columns: ["at"]
+}, {
+	name: "idx_birthdecision_device_at",
+	columns: ["deviceId", "at"]
+}];
+var BirthDecisionLedgerStore = class {
+	store;
+	logger;
+	newId;
+	maxRows;
+	trimEvery;
+	/** Rows appended since the last trim — see {@link trim}. */
+	sinceTrim = 0;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.newId = deps.newId ?? (() => globalThis.crypto.randomUUID());
+		this.maxRows = deps.maxRows ?? 3e4;
+		this.trimEvery = deps.trimEvery ?? DEFAULT_TRIM_EVERY;
+	}
+	/** The ceiling a store built without an override enforces. */
+	static defaultMaxRows() {
+		return require_dist.MAX_BIRTH_DECISION_RECORDS;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: BIRTH_DECISION_LEDGER_COLLECTION,
+			columns: [...BIRTH_DECISION_LEDGER_COLUMNS],
+			indexes: [...BIRTH_DECISION_LEDGER_INDEXES]
+		});
+	}
+	/**
+	* Append one birth decision. NEVER THROWS.
+	*
+	* Best-effort, unlike the debug-note archive and deliberately so: that table
+	* holds the only copy of something a PERSON typed, and this one holds a
+	* measurement the system takes ~49 times an hour. A birth must not fail — nor
+	* be delayed by a retry — because bookkeeping could not be written. The
+	* failure is logged with `tags: { deviceId }` so a camera whose rows are
+	* silently missing is attributable rather than an unexplained hole in the
+	* denominator.
+	*/
+	async append(draft) {
+		try {
+			const row = require_dist.BirthDecisionRecordSchema.parse({
+				id: this.newId(),
+				...draft
+			});
+			await this.store.insert.mutate({
+				collection: BIRTH_DECISION_LEDGER_COLLECTION,
+				record: {
+					id: row.id,
+					data: {
+						at: row.at,
+						deviceId: row.deviceId,
+						sourceTrackId: row.sourceTrackId,
+						className: row.className,
+						verdict: row.verdict,
+						reason: row.reason,
+						attempts: row.attempts,
+						deferredForMs: row.deferredForMs,
+						decidedOnCoastedFrame: row.decidedOnCoastedFrame,
+						birthEvidenceAvailable: row.birthEvidenceAvailable,
+						decidedByBirthEvidence: row.decidedByBirthEvidence,
+						bestScore: row.bestScore,
+						appliedMinConfidence: row.appliedMinConfidence,
+						firstSeen: row.firstSeen,
+						motionOnsetAt: row.motionOnsetAt,
+						birthLatencyMs: row.birthLatencyMs,
+						birthIndexInBurst: row.birthIndexInBurst
+					}
+				}
+			});
+			this.sinceTrim += 1;
+			await this.trim();
+		} catch (err) {
+			this.logger.warn("birth-decision ledger append failed — this decision is not counted", {
+				tags: { deviceId: draft.deviceId },
+				meta: {
+					trackId: draft.sourceTrackId,
+					verdict: draft.verdict,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+	/**
+	* Hold the table at its ceiling, oldest first.
+	*
+	* NOT an age-keyed sweep and must never become one: the boundary is computed
+	* from the POSITION of the excess rows, never from a clock. Rows sharing the
+	* boundary timestamp go together, which at this write rate is a rounding
+	* error against a 30 000-row ceiling.
+	*
+	* AMORTISED. The debug-note archive counts on every append because it writes
+	* a few rows a week; this one writes ~49 an hour, and a `count` round trip per
+	* birth would triple the ledger's own store traffic to answer a question whose
+	* answer only changes on the row that crosses the ceiling. Checking once per
+	* {@link DEFAULT_TRIM_EVERY} appends bounds the overshoot at that many rows —
+	* 0.3% of the ceiling — for two hours' delay in enforcing it.
+	*/
+	async trim() {
+		if (this.sinceTrim < this.trimEvery) return;
+		this.sinceTrim = 0;
+		try {
+			const held = await this.store.count.query({ collection: BIRTH_DECISION_LEDGER_COLLECTION });
+			const excess = held - this.maxRows;
+			if (excess <= 0) return;
+			const boundary = (await this.store.query.query({
+				collection: BIRTH_DECISION_LEDGER_COLLECTION,
+				filter: {
+					orderBy: {
+						field: "at",
+						direction: "asc"
+					},
+					limit: excess
+				},
+				columns: ["at"]
+			})).reduce((acc, r) => {
+				const at = r.data["at"];
+				return typeof at === "number" && at > acc ? at : acc;
+			}, 0);
+			if (boundary === 0) return;
+			const { deleted } = await this.store.deleteWhere.mutate({
+				collection: BIRTH_DECISION_LEDGER_COLLECTION,
+				filter: { whereBetween: { at: [0, boundary] } }
+			});
+			this.logger.info("birth-decision ledger trimmed to its ceiling", { meta: {
+				held,
+				ceiling: this.maxRows,
+				deleted
+			} });
+		} catch (err) {
+			this.logger.warn("birth-decision ledger trim failed — the ledger will keep growing", { meta: {
+				ceiling: this.maxRows,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+	/** Birth decisions, newest first, optionally scoped by camera / verdict / age. */
+	async list(query) {
+		const where = {};
+		if (query.deviceId !== void 0) where["deviceId"] = query.deviceId;
+		if (query.verdict !== void 0) where["verdict"] = query.verdict;
+		const filter = {
+			orderBy: {
+				field: "at",
+				direction: "desc"
+			},
+			limit: query.limit ?? 500
+		};
+		if (Object.keys(where).length > 0) filter["where"] = where;
+		if (query.since !== void 0) filter["whereBetween"] = { at: [query.since, Number.MAX_SAFE_INTEGER] };
+		const rows = await this.store.query.query({
+			collection: BIRTH_DECISION_LEDGER_COLLECTION,
+			filter
+		});
+		const out = [];
+		for (const r of rows) {
+			const parsed = require_dist.BirthDecisionRecordSchema.safeParse({
+				id: r.id,
+				...r.data
+			});
+			if (parsed.success) out.push(parsed.data);
+			else this.logger.debug("birth-decision ledger: skipped a malformed row", { meta: { id: r.id } });
+		}
+		return out;
+	}
+};
+/**
+* How many appends between ceiling checks, by default. See
+* {@link BirthDecisionLedgerStore.trim}.
+*
+* 100 rows is two hours of measured fleet traffic and 0.3% of the ceiling —
+* small enough that the table's real size never meaningfully exceeds its stated
+* bound, large enough that the ledger costs one `count` per two hours instead of
+* one per birth.
+*/
+var DEFAULT_TRIM_EVERY = 100;
+//#endregion
 //#region src/pipeline-analytics/store/debug-note-archive-store.ts
 /**
 * DebugNoteArchiveStore — the durable corpus of what operators asked to be
@@ -61659,6 +62112,13 @@ var ANALYTICS_COLLECTIONS = [
 			why: "the archived operator notes (D405) — the ONE table here whose whole purpose is to outlive the track it names. `debug` never pinned a track against retention and D405 does not change that, so the track a note was written on IS expected to be evicted; deleting the note with it is the failure the archive was built to fix (25–27 notes from one sweep unreadable the same afternoon). Its column is called `sourceTrackId` and not `trackId` precisely so the ownership derivation cannot reach it, and its bound is a fleet-wide ROW COUNT trimmed on append — never an age sweep, which would delete the corpus for the one property that makes it valuable."
 		}
 	},
+	{
+		collection: BIRTH_DECISION_LEDGER_COLLECTION,
+		classification: {
+			kind: "never-orphaned",
+			why: "the birth-decision ledger (D409) — a measurement of what the confirmation gate decided, not analytics data about a track. Most of its rows describe births that were SUPPRESSED and therefore never had a track at all, and the confirmed ones are expected to outlive theirs: a miss rate needs its denominator for as long as the table holds, and cascading rows away with their tracks would silently shorten the window while leaving the numerator behind. Its column is called `sourceTrackId` and not `trackId` precisely so the ownership derivation cannot reach it, and its bound is a fleet-wide ROW COUNT trimmed on append — never an age sweep."
+		}
+	},
 	{
 		collection: STATIONARY_COLLECTION,
 		classification: {
@@ -69435,6 +69895,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* operator asked for never depends on this addon's own bookkeeping.
 	*/
 	debugNoteArchive = null;
+	/** The durable birth-decision ledger (D409) — measurement, never a gate. */
+	birthDecisionLedger = null;
+	/** Has the "no ledger on this runner" warning already been said? Once per
+	*  process: the condition is a property of the runner, not of the birth. */
+	birthLedgerAbsenceLogged = false;
 	/** Event-media relocation engine (entity-routing Phase 4). */
 	mediaRelocate = null;
 	mediaLocationStorage = null;
@@ -69873,6 +70338,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	/** Births the gate could not MEASURE, awaiting another look on a later frame. */
 	deferredBirths = new DeferredBirthRegistry();
 	/**
+	* The last motion RISING EDGE per device — the reference instant the
+	* birth-latency proxy is measured from (D409). Measurement only; nothing
+	* gates on it. Fed by the two motion handlers, which are subscribed on the
+	* SAME designated post-processing node as the frame path, so a camera whose
+	* births land here always has its motion mirror here too.
+	*/
+	motionOnsets = new MotionOnsetRegistry();
+	/**
 	* The pixels each deferred birth arrived with — a RESERVE per camera, evicted
 	* by age inside that camera's own quota (D379).
 	*
@@ -70427,6 +70900,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			store: api.settingsStore,
 			logger: logger.child("debug-note-archive")
 		});
+		this.birthDecisionLedger = new BirthDecisionLedgerStore({
+			store: api.settingsStore,
+			logger: logger.child("birth-decision-ledger")
+		});
 		{
 			const designated = await step("postProcessingNodeState", () => this.postProcessingNodeState.get());
 			this.isPostProcessingNode = ownNodeId === designated;
@@ -70747,6 +71224,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			RetrainAnnotationStore.declare(api.settingsStore),
 			OpsLogStore.declare(api.settingsStore),
 			DebugNoteArchiveStore.declare(api.settingsStore),
+			BirthDecisionLedgerStore.declare(api.settingsStore),
 			AnalyticsLts.declare(api.settingsStore),
 			SceneStore.declare(api.settingsStore),
 			NotificationCenter.declare(api.settingsStore),
@@ -72411,6 +72889,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.overlaySynthesisWarnAt.delete(deviceId);
 		this.forgetDeviceProcessors(deviceId);
 		this.levelStateByDevice.delete(deviceId);
+		this.motionOnsets.forgetDevice(deviceId);
 		this.audioConfirmByDevice.delete(deviceId);
 		this.lastTrackActivityMs.delete(deviceId);
 		this.motionEventSnapshots?.forgetDevice(deviceId);
@@ -73197,8 +73676,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			if (t.birthEvidence === void 0) continue;
 			this.birthEvidence.remember(key, id, Buffer.from(t.birthEvidence.jpegBase64, "base64"), exhaustionNowMs);
 		}
-		const outcome = await this.confirmTrackBirths(bornCandidates.map(({ id, t }) => {
+		const withBirthEvidence = /* @__PURE__ */ new Set();
+		const run = await this.confirmTrackBirths(bornCandidates.map(({ id, t }) => {
 			const evidenceCrop = this.birthEvidence.get(key, id, exhaustionNowMs);
+			if (evidenceCrop !== null) withBirthEvidence.add(id);
 			return {
 				trackId: id,
 				className: t.className,
@@ -73213,6 +73694,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			frameWidth: result.frameWidth,
 			frameHeight: result.frameHeight
 		}, exhaustedIds);
+		const outcome = run.outcome;
 		const gateNowMs = Date.now();
 		for (const { id, t } of bornCandidates) {
 			if (outcome.undecided.has(id)) {
@@ -73241,6 +73723,20 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				} });
 				continue;
 			}
+			this.recordBirthDecision({
+				deviceId,
+				trackId: id,
+				className: t.className,
+				confirmed: outcome.confirmed.has(id),
+				exhaustedFallback: wasDeferred && exhaustedIds.has(id),
+				attempts: deferredAttempts,
+				deferredForMs,
+				matchedThisFrame: t.matchedThisFrame,
+				birthEvidenceAvailable: withBirthEvidence.has(id),
+				decision: run.decisions.get(id),
+				decidedAtMs: gateNowMs,
+				firstSeen: this.trackStore?.peekActive(id)?.firstSeen ?? null
+			});
 			if (!outcome.confirmed.has(id)) {
 				this.suppressedBirths.reject(key, id);
 				this.trackStore?.dropActive(id);
@@ -73939,10 +74435,64 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* candidate) and each failure path fails OPEN, so the synchronous frame path
 	* is never blocked or reordered by a slow/failed re-detection.
 	*/
+	/**
+	* Record ONE resolved birth verdict in the durable ledger (D409).
+	*
+	* Synchronous up to the append, which is fired and forgotten: the frame path
+	* awaits `confirmTrackBirths` already, and a measurement must never add a
+	* store round trip to the latency of a birth. `BirthDecisionLedgerStore.append`
+	* never throws, so the un-awaited promise cannot reject.
+	*
+	* Cost, per BIRTH and not per frame: one `Map.get`, one `Set.has`, a counter
+	* bump and one INSERT. Measured fleet-wide on the live hub 2026-09-08 at ~49
+	* births/hour, i.e. 0.014 writes/s — three orders of magnitude below the
+	* 12-19/s the runtime-state guard was written for, and a different shape
+	* (append-only, never a periodic rewrite of an unchanged slice).
+	*
+	* A runner with no ledger (construction failed) records nothing and says so
+	* exactly once per process, rather than per birth: a measurement that cannot
+	* be taken must be visible, but it must not become the noisiest line in Loki.
+	*/
+	recordBirthDecision(input) {
+		const ledger = this.birthDecisionLedger;
+		if (ledger === null) {
+			if (!this.birthLedgerAbsenceLogged) {
+				this.birthLedgerAbsenceLogged = true;
+				this.ctx.logger.warn("birth decisions are NOT being measured — no ledger on this runner", { tags: { deviceId: input.deviceId } });
+			}
+			return;
+		}
+		const motionOnsetAtMs = this.motionOnsets.onsetFor(input.deviceId);
+		const birthIndexInBurst = this.motionOnsets.noteBirth(input.deviceId);
+		const decision = input.decision;
+		ledger.append(buildBirthDecisionRecord({
+			deviceId: input.deviceId,
+			trackId: input.trackId,
+			className: input.className,
+			confirmed: input.confirmed,
+			exhaustedFallback: input.exhaustedFallback,
+			attempts: input.attempts,
+			deferredForMs: input.deferredForMs,
+			...input.matchedThisFrame !== void 0 ? { matchedThisFrame: input.matchedThisFrame } : {},
+			birthEvidenceAvailable: input.birthEvidenceAvailable,
+			decidedByBirthEvidence: decision?.cropSource === "carried",
+			reason: decision?.reason ?? null,
+			bestScore: decision?.bestScore ?? null,
+			appliedMinConfidence: decision?.appliedMinConfidence ?? null,
+			decidedAtMs: input.decidedAtMs,
+			firstSeen: input.firstSeen,
+			motionOnsetAtMs,
+			birthIndexInBurst
+		}));
+	}
 	async confirmTrackBirths(candidates, params, exhaustedIds = /* @__PURE__ */ new Set()) {
+		const decisions = /* @__PURE__ */ new Map();
 		const allConfirmed = () => ({
-			confirmed: new Set(candidates.map((c) => c.trackId)),
-			undecided: /* @__PURE__ */ new Set()
+			outcome: {
+				confirmed: new Set(candidates.map((c) => c.trackId)),
+				undecided: /* @__PURE__ */ new Set()
+			},
+			decisions
 		});
 		if (candidates.length === 0) return allConfirmed();
 		const config = await this.resolveDeviceConfirmationGateSettings(params.deviceId);
@@ -73965,101 +74515,105 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const nodeId = frameHandle.nodeId;
 		const candidateNativeRecovery = /* @__PURE__ */ new Map();
 		for (const c of candidates) if (c.nativeRecovery !== void 0) candidateNativeRecovery.set(c.trackId, c.nativeRecovery);
-		return confirmBirths(candidates, config, {
-			fetchCrop: (candidate) => this.captureScheduler.request({
-				deviceId,
-				trackId: candidate.trackId,
-				kind: "confirm",
-				staleAfterMs: config.timeoutMs,
-				exec: () => captureCrop(frameHandle, {
+		return {
+			outcome: await confirmBirths(candidates, config, {
+				fetchCrop: (candidate) => this.captureScheduler.request({
+					deviceId,
+					trackId: candidate.trackId,
+					kind: "confirm",
+					staleAfterMs: config.timeoutMs,
+					exec: () => captureCrop(frameHandle, {
+						x: candidate.bbox.x,
+						y: candidate.bbox.y,
+						w: candidate.bbox.w,
+						h: candidate.bbox.h
+					}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, 320, deviceId)
+				}),
+				fetchFallbackCrop: (candidate) => {
+					const displayCrop = this.captureDisplayCropFn;
+					if (!displayCrop) return Promise.resolve(null);
+					return displayCrop(frameHandle, {
+						x: candidate.bbox.x,
+						y: candidate.bbox.y,
+						w: candidate.bbox.w,
+						h: candidate.bbox.h
+					}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, 320);
+				},
+				redetect: (cropJpeg) => this.redetectCropForConfirmation(nodeId, deviceId, cropJpeg),
+				cropRectFor: (candidate) => captureCropFrameRect({
 					x: candidate.bbox.x,
 					y: candidate.bbox.y,
 					w: candidate.bbox.w,
 					h: candidate.bbox.h
-				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, 320, deviceId)
-			}),
-			fetchFallbackCrop: (candidate) => {
-				const displayCrop = this.captureDisplayCropFn;
-				if (!displayCrop) return Promise.resolve(null);
-				return displayCrop(frameHandle, {
+				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING),
+				minConfidenceFor: (candidate) => this.phantomCells?.spawnBar({
+					deviceId,
+					className: candidate.className,
 					x: candidate.bbox.x,
 					y: candidate.bbox.y,
-					w: candidate.bbox.w,
-					h: candidate.bbox.h
-				}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING, candidate.trackId, 320);
-			},
-			redetect: (cropJpeg) => this.redetectCropForConfirmation(nodeId, deviceId, cropJpeg),
-			cropRectFor: (candidate) => captureCropFrameRect({
-				x: candidate.bbox.x,
-				y: candidate.bbox.y,
-				w: candidate.bbox.w,
-				h: candidate.bbox.h
-			}, frameWidth, frameHeight, CONFIRMATION_CROP_PADDING),
-			minConfidenceFor: (candidate) => this.phantomCells?.spawnBar({
-				deviceId,
-				className: candidate.className,
-				x: candidate.bbox.x,
-				y: candidate.bbox.y,
-				base: config.minConfidence,
-				now: Date.now()
-			}).bar ?? config.minConfidence,
-			onDecision: (decision) => {
-				const meta = {
-					trackId: decision.trackId,
-					reason: decision.reason,
-					className: decision.className,
-					...decision.bestScore !== void 0 ? { bestScore: decision.bestScore } : {},
-					...decision.bestIncompatibleClass !== void 0 ? {
-						bestIncompatibleClass: decision.bestIncompatibleClass,
-						bestIncompatibleScore: decision.bestIncompatibleScore
-					} : {},
-					minConfidence: config.minConfidence,
-					...decision.cropSource !== void 0 ? { cropSource: decision.cropSource } : {},
-					...decision.reason === "native-pass" ? {
-						nativeRecoveryCropSidePx: candidateNativeRecovery.get(decision.trackId)?.cropSidePx,
-						nativeRecoveryViewPx: candidateNativeRecovery.get(decision.trackId)?.viewPx
-					} : {},
-					...decision.appliedMinConfidence !== void 0 && decision.appliedMinConfidence > config.minConfidence ? {
-						appliedMinConfidence: decision.appliedMinConfidence,
-						barRaisedByPhantomCell: true
-					} : {}
-				};
-				switch (decision.verdict) {
-					case "suppressed":
-						this.ctx.logger.info("confirmation gate: birth suppressed (false positive)", {
-							tags: { deviceId },
-							meta
-						});
-						break;
-					case "undecided":
-						this.ctx.logger.info("confirmation gate: birth undecided", {
-							tags: { deviceId },
-							meta
-						});
-						break;
-					case "confirmed":
-						this.ctx.logger.info("confirmation gate: birth confirmed", {
+					base: config.minConfidence,
+					now: Date.now()
+				}).bar ?? config.minConfidence,
+				onDecision: (decision) => {
+					decisions.set(decision.trackId, decision);
+					const meta = {
+						trackId: decision.trackId,
+						reason: decision.reason,
+						className: decision.className,
+						...decision.bestScore !== void 0 ? { bestScore: decision.bestScore } : {},
+						...decision.bestIncompatibleClass !== void 0 ? {
+							bestIncompatibleClass: decision.bestIncompatibleClass,
+							bestIncompatibleScore: decision.bestIncompatibleScore
+						} : {},
+						minConfidence: config.minConfidence,
+						...decision.cropSource !== void 0 ? { cropSource: decision.cropSource } : {},
+						...decision.reason === "native-pass" ? {
+							nativeRecoveryCropSidePx: candidateNativeRecovery.get(decision.trackId)?.cropSidePx,
+							nativeRecoveryViewPx: candidateNativeRecovery.get(decision.trackId)?.viewPx
+						} : {},
+						...decision.appliedMinConfidence !== void 0 && decision.appliedMinConfidence > config.minConfidence ? {
+							appliedMinConfidence: decision.appliedMinConfidence,
+							barRaisedByPhantomCell: true
+						} : {}
+					};
+					switch (decision.verdict) {
+						case "suppressed":
+							this.ctx.logger.info("confirmation gate: birth suppressed (false positive)", {
+								tags: { deviceId },
+								meta
+							});
+							break;
+						case "undecided":
+							this.ctx.logger.info("confirmation gate: birth undecided", {
+								tags: { deviceId },
+								meta
+							});
+							break;
+						case "confirmed":
+							this.ctx.logger.info("confirmation gate: birth confirmed", {
+								tags: { deviceId },
+								meta
+							});
+							break;
+					}
+					if (decision.secondary !== void 0) {
+						this.secondarySubjects.add(this.procKey(deviceId, source), decision.secondary, decision.trackId, Date.now());
+						this.ctx.logger.info("confirmation gate: secondary subject promoted from the crop", {
 							tags: { deviceId },
-							meta
+							meta: {
+								trackId: decision.trackId,
+								className: decision.className,
+								secondaryClass: decision.secondary.className,
+								secondaryScore: decision.secondary.score,
+								secondaryBbox: decision.secondary.bbox,
+								verdict: decision.verdict
+							}
 						});
-						break;
-				}
-				if (decision.secondary !== void 0) {
-					this.secondarySubjects.add(this.procKey(deviceId, source), decision.secondary, decision.trackId, Date.now());
-					this.ctx.logger.info("confirmation gate: secondary subject promoted from the crop", {
-						tags: { deviceId },
-						meta: {
-							trackId: decision.trackId,
-							className: decision.className,
-							secondaryClass: decision.secondary.className,
-							secondaryScore: decision.secondary.score,
-							secondaryBbox: decision.secondary.bbox,
-							verdict: decision.verdict
-						}
-					});
+					}
 				}
-			}
-		}, exhaustedIds);
+			}, exhaustedIds),
+			decisions
+		};
 	}
 	async resolveGlobalFaceEnabled() {
 		return this.faceGlobalEnabledCache.get(() => this.faceGlobalEnabledState.get());
@@ -75391,6 +75945,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			detected,
 			atMs: timestamp
 		});
+		if (transitionedOn) this.motionOnsets.noteRisingEdge(deviceId, timestamp);
 		this.sceneEngine?.noteMotion(deviceId, timestamp);
 		await this.eventStore.insertMotion(ev);
 		this.ctx.eventBus.emit({
@@ -75466,6 +76021,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			detected,
 			atMs: timestamp
 		});
+		if (transitionedOn) this.motionOnsets.noteRisingEdge(deviceId, timestamp);
 		this.sceneEngine?.noteMotion(deviceId, timestamp);
 		await this.eventStore.insertMotion(ev);
 		this.ctx.eventBus.emit({
@@ -78425,6 +78981,18 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		return await this.debugNoteArchive?.list(input) ?? [];
 	}
 	/**
+	* The birth-decision ledger, newest first (D409).
+	*
+	* A READ of a measurement table and nothing else — no join back to the
+	* tracks, deliberately: a SUPPRESSED birth never had a track row and a
+	* confirmed one is expected to have aged out, so a join would return exactly
+	* the rows the ledger exists to preserve. A runner with no ledger answers
+	* EMPTY, which is true: nothing has been measured here.
+	*/
+	async listBirthDecisions(input) {
+		return await this.birthDecisionLedger?.list(input) ?? [];
+	}
+	/**
 	* Track-centric time-based retention (design §5.1). Drains every persisted
 	* track for the device whose `lastSeen < cutoffMs`, page by page, through the
 	* widened cascade — enrolled faces/plates + identity media are exempt (design