@camstack/addon-post-analysis 1.2.218 → 1.2.220

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as VISIT_MERGE_GAP_MS, $t as object, A as NcRulePatchSchema, Bt as CamProfileSchema, C as NC_ALARM_SYSTEM_EVENT_KINDS, D as NC_TAXONOMY, Dt as readDeviceStateFrom, Et as plateGalleryCapability, F as NcSnoozeSchema, Ft as vectorDimFromBase64, G as SCENE_DEFAULT_UNCOVERED_POLICY, Gt as nodePin, H as RetrainStatusSchema, Ht as createEvent, I as NcSnoozeSuppressedSchema, It as videoclipsCapability, J as TIMELAPSE_DENSE_FLOOR_SEC, Jt as array, K as SCENE_DIVERGED, Kt as sleep$1, L as NcSystemEventKindSchema, Lt as zoneAnalyticsCapability, M as NcRuleTargetSchema, Mt as storageOccupancyCapability, N as NcScheduleSchema, Nt as subKindsOf, O as NcConditionDescriptorSchema, Ot as readTimelapseGeneratedAt, P as NcSnoozeInputSchema, Pt as systemEventFilterApplies, Q as TrackSourceSchema, Qt as number, R as NcTaxonomySchema, Rt as errMsg$1, S as MediaFileKindEnum, St as notificationRulesCapability, T as NC_DEFAULT_SNOOZE_MINUTES, Tt as pipelineAnalyticsCapability, Ut as hydrateSchema, V as RECORDING_EXPORT_MAX_READ_BYTES, Vt as DeviceType, W as SCENE_DEFAULT_ANCHOR_THRESHOLD, Wt as isDeviceScopedCap, X as TimelapseRulePatchSchema, Xt as discriminatedUnion, Y as TimelapseRuleInputSchema, Yt as boolean, Z as TimelapseRuleSchema, Zt as literal, _ as LabelAttributionSchema, _t as isDetectionMacroClass, a as CLUSTER_MODEL_SCOPED_STEPS, at as buildEventKindDescriptor, b as MAX_BIRTH_DECISION_RECORDS, bt as kebabToCamel, ct as defineCustomActions, dt as encodeVectorBase64, en as partialRecord, et as addonWidgetsSourceCapability, f as DeclaredDevices, ft as evaluateSensorEdge, g as FailureCounters, h as FULL_IMAGE_BBOX, ht as failureContributionCapability, i as BirthDecisionRecordSchema, in as EventCategory, it as audioModeOf, j as NcRuleSchema, jt as sceneMonitorCapability, k as NcRuleInputSchema, kt as resolveLocationMode, lt as deriveRecordingMode, m as EVENT_PAD_MS, mt as faceGalleryCapability, n as ArchivedDebugNoteSchema, nn as string, nt as assertTimelapseCadences, o as COCO_TO_MACRO, ot as cosineSimilarity$1, p as EVENT_KIND_BY_CAP, pt as evictionPolicyOfLocation, q as SceneMonitorSchema, qt as _enum, r as BaseDevice, rn as unknown, rt as audioMetricsCapability, s as DEFAULT_EVENT_COLOR, st as customAction, t as AUDIO_MACRO_LABELS, tn as record, tt as alarmPanelCapability, u as DETECTION_MACRO_CLASSES, v as MACRO_LABELS, vt as isScheduleActive, w as NC_CONDITION_CATALOG, wt as pickClusterStepModels, xt as mayWriteToLocation, y as MAX_ARCHIVED_DEBUG_NOTES, yt as isSourceCap, z as OpsLogEntrySchema, zt as BaseAddon } from "../dist-BqkhuC85.mjs";
+import { $ as VISIT_MERGE_GAP_MS, $t as object, A as NcRulePatchSchema, Bt as CamProfileSchema, C as NC_ALARM_SYSTEM_EVENT_KINDS, D as NC_TAXONOMY, Dt as readDeviceStateFrom, Et as plateGalleryCapability, F as NcSnoozeSchema, Ft as vectorDimFromBase64, G as SCENE_DEFAULT_UNCOVERED_POLICY, Gt as nodePin, H as RetrainStatusSchema, Ht as createEvent, I as NcSnoozeSuppressedSchema, It as videoclipsCapability, J as TIMELAPSE_DENSE_FLOOR_SEC, Jt as array, K as SCENE_DIVERGED, Kt as sleep$1, L as NcSystemEventKindSchema, Lt as zoneAnalyticsCapability, M as NcRuleTargetSchema, Mt as storageOccupancyCapability, N as NcScheduleSchema, Nt as subKindsOf, O as NcConditionDescriptorSchema, Ot as readTimelapseGeneratedAt, P as NcSnoozeInputSchema, Pt as systemEventFilterApplies, Q as TrackSourceSchema, Qt as number, R as NcTaxonomySchema, Rt as errMsg$1, S as MediaFileKindEnum, St as notificationRulesCapability, T as NC_DEFAULT_SNOOZE_MINUTES, Tt as pipelineAnalyticsCapability, Ut as hydrateSchema, V as RECORDING_EXPORT_MAX_READ_BYTES, Vt as DeviceType, W as SCENE_DEFAULT_ANCHOR_THRESHOLD, Wt as isDeviceScopedCap, X as TimelapseRulePatchSchema, Xt as discriminatedUnion, Y as TimelapseRuleInputSchema, Yt as boolean, Z as TimelapseRuleSchema, Zt as literal, _ as FailureCounters, _t as isDetectionMacroClass, a as CLUSTER_MODEL_SCOPED_STEPS, at as buildEventKindDescriptor, b as MAX_BIRTH_DECISION_RECORDS, bt as kebabToCamel, ct as defineCustomActions, dt as encodeVectorBase64, en as partialRecord, et as addonWidgetsSourceCapability, f as DeclaredDevices, ft as evaluateSensorEdge, g as FULL_IMAGE_BBOX, h as FIRST_LEVEL_MACRO_CLASSES, ht as failureContributionCapability, i as BirthDecisionRecordSchema, in as EventCategory, it as audioModeOf, j as NcRuleSchema, jt as sceneMonitorCapability, k as NcRuleInputSchema, kt as resolveLocationMode, lt as deriveRecordingMode, m as EVENT_PAD_MS, mt as faceGalleryCapability, n as ArchivedDebugNoteSchema, nn as string, nt as assertTimelapseCadences, o as COCO_TO_MACRO, ot as cosineSimilarity$1, p as EVENT_KIND_BY_CAP, pt as evictionPolicyOfLocation, q as SceneMonitorSchema, qt as _enum, r as BaseDevice, rn as unknown, rt as audioMetricsCapability, s as DEFAULT_EVENT_COLOR, st as customAction, t as AUDIO_MACRO_LABELS, tn as record, tt as alarmPanelCapability, u as DETECTION_MACRO_CLASSES, v as LabelAttributionSchema, vt as isScheduleActive, w as NC_CONDITION_CATALOG, wt as pickClusterStepModels, xt as mayWriteToLocation, y as MAX_ARCHIVED_DEBUG_NOTES, yt as isSourceCap, z as OpsLogEntrySchema, zt as BaseAddon } from "../dist-DWXR9KNe.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -8334,8 +8334,55 @@ function incomingFromSystemEvent(event, lookup) {
 		default: return null;
 	}
 }
+/** The shells whose update has its own sentence. Anything else gets the plain
+*  one: a body that names a shell nobody observed is worse than a vague body. */
+var WRAPPER_BODY_KINDS = new Set([
+	"docker",
+	"electron",
+	"native"
+]);
+/**
+* The SHELL announcement (D437) — the container / app bundle a node runs
+* inside is behind the release contract.
+*
+* It is deliberately NOT folded into `server-update-available`: the versions
+* here are the shell's (a seed closure, an app bundle), not the running code's,
+* and on 2026-08-02 the running code was perfectly current on a hub whose image
+* was 13 days old from a repository nothing rebuilt. It also mints no button —
+* no process can replace the shell it is running inside — so the BODY is the
+* whole delivery, and it is chosen by `wrapperKind` so a docker operator is
+* handed the exact command instead of a button that cannot exist.
+*/
+function incomingFromWrapperUpdate(facts, data) {
+	const packages = updatePackages(data);
+	if (packages.length === 0) return null;
+	const head = packages[0];
+	const nodeId = head.nodeId ?? stringField(data, "nodeId");
+	const wrapperKind = stringField(data, "wrapperKind");
+	const bodySuffix = wrapperKind !== void 0 && WRAPPER_BODY_KINDS.has(wrapperKind) ? wrapperKind : null;
+	return systemSubject({
+		facts,
+		kind: "wrapper-update-available",
+		subject: `wrapper:${nodeId ?? "hub"}`,
+		titleKey: "system.wrapper-update-available.title",
+		bodyKey: bodySuffix === null ? "system.wrapper-update-available.body" : `system.wrapper-update-available.body.${bodySuffix}`,
+		textParams: {
+			currentVersion: head.currentVersion,
+			latestVersion: head.latestVersion,
+			...nodeId !== void 0 ? { nodeId } : {}
+		},
+		textCount: 1,
+		packageName: head.packageName,
+		packageNames: [head.packageName],
+		...nodeId !== void 0 ? {
+			nodeId,
+			nodeIds: [nodeId]
+		} : {}
+	});
+}
 function incomingFromUpdateAvailable(facts, data) {
 	const target = stringField(data, "target");
+	if (target === "wrapper") return incomingFromWrapperUpdate(facts, data);
 	if (target !== "addon" && target !== "server") return null;
 	const packages = updatePackages(data);
 	if (packages.length === 0) return null;
@@ -9445,7 +9492,7 @@ var CAMERA_DEVICE_TYPE = "camera";
 /** Kinds whose action is "go and apply an ADDON update". */
 var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
 /** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
-var NODE_UPDATE_KINDS = new Set(["server-update-available"]);
+var NODE_UPDATE_KINDS = new Set(["server-update-available", "wrapper-update-available"]);
 /**
 * Kinds whose action is "go and look at this device's stream".
 *
@@ -10010,6 +10057,11 @@ var en_default = {
 	"system.server-update-available.body": "{{packageName}} {{latestVersion}} is available (current {{currentVersion}})",
 	"system.server-update-available.body.onNode": "{{packageName}} {{latestVersion}} is available (current {{currentVersion}}) on node {{nodeId}}",
 	"system.server-update-available.body.onNodes": "{{packageName}} {{latestVersion}} is available (current {{currentVersion}}) on {{nodes}}",
+	"system.wrapper-update-available.title": "The container or app on {{nodeId}} is out of date",
+	"system.wrapper-update-available.body": "The shell this node runs inside carries {{currentVersion}}; the release contract delivers {{latestVersion}}. Updating the server keeps the code current but never replaces the shell.",
+	"system.wrapper-update-available.body.docker": "This node's image carries seed {{currentVersion}}; the release contract delivers {{latestVersion}}. A container cannot replace its own image — recreate it from the contract image: docker compose pull && docker compose up -d",
+	"system.wrapper-update-available.body.electron": "The desktop app on {{nodeId}} carries {{currentVersion}}; the release contract delivers {{latestVersion}}. The app downloads the new build on its own and installs it the next time it quits.",
+	"system.wrapper-update-available.body.native": "The installed app on {{nodeId}} carries {{currentVersion}}; the release contract delivers {{latestVersion}}. Reinstall it from the current release to converge.",
 	"system.addon-updated.title": {
 		"one": "{{count}} addon updated",
 		"other": "{{count}} addons updated"
@@ -10265,6 +10317,11 @@ var it_default = {
 	"system.server-update-available.body": "{{packageName}} {{latestVersion}} è disponibile (attuale {{currentVersion}})",
 	"system.server-update-available.body.onNode": "{{packageName}} {{latestVersion}} è disponibile (attuale {{currentVersion}}) sul nodo {{nodeId}}",
 	"system.server-update-available.body.onNodes": "{{packageName}} {{latestVersion}} è disponibile (attuale {{currentVersion}}) su {{nodes}}",
+	"system.wrapper-update-available.title": "Il contenitore o l'app di {{nodeId}} è indietro",
+	"system.wrapper-update-available.body": "Il guscio in cui gira questo nodo porta {{currentVersion}}; il contratto di rilascio consegna {{latestVersion}}. Aggiornare il server tiene il codice aggiornato ma non sostituisce mai il guscio.",
+	"system.wrapper-update-available.body.docker": "L'immagine di questo nodo porta il seed {{currentVersion}}; il contratto di rilascio consegna {{latestVersion}}. Un container non può sostituire la propria immagine — ricrealo dall'immagine del contratto: docker compose pull && docker compose up -d",
+	"system.wrapper-update-available.body.electron": "L'app desktop su {{nodeId}} porta {{currentVersion}}; il contratto di rilascio consegna {{latestVersion}}. L'app scarica da sola la nuova build e la installa alla prossima chiusura.",
+	"system.wrapper-update-available.body.native": "L'app installata su {{nodeId}} porta {{currentVersion}}; il contratto di rilascio consegna {{latestVersion}}. Reinstallala dal rilascio corrente per allinearla.",
 	"system.addon-updated.title": {
 		"one": "{{count}} addon aggiornato",
 		"other": "{{count}} addon aggiornati"
@@ -19923,6 +19980,14 @@ function checkTimelapsePacing(input) {
 		unservedWindows: []
 	};
 }
+//#endregion
+//#region src/notification-center/timelapse/timelapse-renderer.ts
+/** `part / whole` to two decimals — the shape a log line is read in. An empty
+*  whole is 0, never NaN: a ratio nobody can compare is not a measurement. */
+function ratio(part, whole) {
+	if (whole <= 0) return 0;
+	return Math.round(part / whole * 100) / 100;
+}
 /** Bound on the post-render pacing check. The check is best-effort by charter:
 *  a byte read that hangs must delay delivery by at most this, never sink it. */
 var PACING_CHECK_TIMEOUT_MS = 2e4;
@@ -19946,25 +20011,6 @@ function profileCost(profile) {
 	const i = PROFILE_BY_COST.indexOf(profile);
 	return i === -1 ? PROFILE_BY_COST.length : i;
 }
-/**
-* The CHEAPEST profile that has footage over the window.
-*
-* It used to be the profile with the MOST coverage, ties broken by name — and
-* that is a rule which picks `high` almost every time, because the high band is
-* the one that records continuously. On 2026-09-03 it did: a test render of a
-* ten-hour window chose `profile=high` at 97% coverage, which on this hub means
-* 4K read from a USB spinning disk. Decoding it made the machine stop answering
-* SSH and its own web UI for half an hour, and it had to be power-cycled.
-*
-* A timelapse is watched accelerated. Resolution buys nothing at 12 fps over a
-* night, and the cost difference between the bands is one to two orders of
-* magnitude in both bytes read and frames decoded. So there is no trade to
-* weigh: take the cheapest band that has anything, every time.
-*
-* Coverage no longer decides WHICH — only whether a band qualifies at all. A
-* band with less footage is still the right source; the gaps show as a shorter
-* video, not as a reason to read twenty times the bytes.
-*/
 function pickProfile(ranges, window) {
 	const byProfile = /* @__PURE__ */ new Map();
 	for (const r of ranges) {
@@ -20211,18 +20257,20 @@ var TimelapseRenderer = class {
 		const finished = await this.awaitReady(queued, tags);
 		const published = await this.publish(finished.id, request, tags);
 		const downloadUrl = await this.ports.resolveDownloadUrl?.({ exportId: finished.id }).catch(() => null);
+		const archive = await this.measureArchive(finished.id, request, chosen, tags);
+		const deliveredRows = archive?.rows ?? availability.filter((r) => r.profile === chosen.profile);
 		await this.verifyPacing({
 			exportId: finished.id,
 			request,
 			dense,
 			subjects,
-			availability: availability.filter((r) => r.profile === chosen.profile),
+			availability: deliveredRows,
 			tags
 		});
 		return {
 			exportId: finished.id,
 			profile: chosen.profile,
-			coverage: chosen.coverage,
+			coverage: archive?.coverage ?? chosen.coverage,
 			plan,
 			detections,
 			artifact: published.video,
@@ -20330,6 +20378,96 @@ var TimelapseRenderer = class {
 		throw new TimelapseRenderError("export-timeout", `export ${queued.id} timed out after ${this.timeoutMs}ms` + (pollFailures > 0 ? ` (${pollFailures} poll failures, last: ${lastPollError})` : ""));
 	}
 	/**
+	* The window against the archive, measured AFTER the export and always said.
+	*
+	* Three figures, one line: the window's length, what the PLAN was cut from
+	* (the availability read before the export) and what the ARCHIVE holds (the
+	* same read after it — the export's verified walk has repaired the index the
+	* calendar serves from by then). `plannedOfArchive` is the ratio D445 found
+	* at 0.20 on camera 4374 and nothing reported; a healthy night reads 1.00
+	* because both reads return the same rows.
+	*
+	* WHY THE THRESHOLD IS A SLACK AND NOT A RATIO. The two reads are the SAME
+	* query against the SAME index, so on a healthy night they return the same
+	* rows and the shortfall is exactly 0 — there is no distribution to pick a
+	* percentile out of. It is non-zero only when something CHANGED the index
+	* between them, and the export's verified walk is the only thing that does.
+	* So the bar is not "how short is too short" (the robot's night was 0.20 and
+	* a milder one would be just as wrong); it is only "is this a real change or
+	* a boundary artefact". One artefact exists: the window is closed, but a
+	* segment straddling its end can finalize while the export runs and extend
+	* the last range by its own length. {@link COVERAGE_COMPLETE_SLACK_MS} (30 s)
+	* is the slack the coverage figure already allows at exactly those edges,
+	* and it is several segments wide. No second constant, and nothing between
+	* "unchanged" and "the planner rendered from a short answer".
+	*
+	* Never throws. A re-read that fails is SAID, the plan's figure stands, and
+	* every figure that needed the archive is `null` rather than a stand-in.
+	*/
+	async measureArchive(exportId, request, chosen, tags) {
+		const { window } = request;
+		const windowSec = Math.round((window.endMs - window.startMs) / 1e3);
+		const plannedSec = Math.round(chosen.coverage.coveredMs / 1e3);
+		let rows;
+		try {
+			rows = (await this.ports.getAvailability({
+				deviceId: request.deviceId,
+				fromMs: window.startMs,
+				toMs: window.endMs,
+				profile: chosen.profile
+			})).ranges.filter((r) => r.profile === chosen.profile);
+		} catch (err) {
+			this.ports.logger.warn("timelapse coverage: archive re-read failed — the window is reported against the plan only", {
+				tags,
+				meta: {
+					exportId,
+					ruleId: request.ruleId,
+					profile: chosen.profile,
+					windowSec,
+					plannedSec,
+					plannedOfWindow: ratio(chosen.coverage.coveredMs, window.endMs - window.startMs),
+					archiveSec: null,
+					plannedOfArchive: null,
+					archiveOfWindow: null,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+		const coverage = footageCoverage(rows, window.startMs, window.endMs);
+		const shortfallMs = coverage.coveredMs - chosen.coverage.coveredMs;
+		const meta = {
+			exportId,
+			ruleId: request.ruleId,
+			profile: chosen.profile,
+			windowSec,
+			plannedSec,
+			archiveSec: Math.round(coverage.coveredMs / 1e3),
+			/** What the operator ASKED for against what the file HOLDS — the ratio
+			*  the robot's night made someone file a report over: ten hours in,
+			*  6.4 s of video out. Low is not by itself a defect (a lazy source is
+			*  legitimately idle most of a night), which is why it never gates. */
+			plannedOfWindow: ratio(chosen.coverage.coveredMs, window.endMs - window.startMs),
+			archiveOfWindow: ratio(coverage.coveredMs, window.endMs - window.startMs),
+			/** The one that IS a defect: what the planner saw against what the
+			*  export's verified walk found. 0.20 on camera 4374, 1.00 when healthy. */
+			plannedOfArchive: ratio(chosen.coverage.coveredMs, coverage.coveredMs),
+			shortfallSec: Math.round(shortfallMs / 1e3)
+		};
+		if (shortfallMs > 3e4) this.ports.logger.warn("timelapse coverage: the plan was cut from less footage than the archive holds", {
+			tags,
+			meta
+		});
+		else this.ports.logger.info("timelapse coverage: the window against the archive", {
+			tags,
+			meta
+		});
+		return {
+			rows,
+			coverage
+		};
+	}
+	/**
 	* Run the pacing check against the finished file, and SAY what it found.
 	*
 	* Never throws and never blocks past its bound: the check is telemetry about
@@ -25802,6 +25940,7 @@ function systemEventSubject(kind, scope) {
 	if (kind === "detection-blind") return `detection-blind:${scope.deviceId ?? 0}`;
 	if (kind === "addon-crash-loop") return `addon-crash:${scope.nodeId ?? "hub"}:${TEST_CRASHED_RUNNER}`;
 	if (kind === "addon-update-available" || kind === "server-update-available") return `package:${scope.packageName ?? "@camstack/server"}`;
+	if (kind === "wrapper-update-available") return `wrapper:${scope.nodeId ?? "hub"}`;
 	if (kind === "addon-updated") return `packages:addon-updated:${scope.packageName ?? "pkg"}`;
 	if (kind === "server-updated") return `server-updated:${scope.nodeId ?? "hub"}`;
 	if (kind === "export-completed") return `export:${scope.deviceId ?? 0}`;
@@ -28351,6 +28490,34 @@ var MEDIA_INDEXES = [
 			"deviceId",
 			"sizeBytes"
 		]
+	}),
+	(
+	/**
+	* The per-LOCATION footprint — `COUNT(*)`/`SUM(sizeBytes) WHERE locationId
+	* = ?`, and the legacy `locationId IS NULL` half of the same question. See
+	* {@link MediaStore.footprintByLocation} (D388) and D447.
+	*
+	* **Why not `idx_media_location`.** It leads with `locationId`, so it finds
+	* the range — and then, exactly as the `idx_media_device_size` note above
+	* describes for `deviceId`, fetches the table row behind every entry to read
+	* `sizeBytes`. Every row of the store is on SOME location, so the range is
+	* the table: measured 2026-09-10/11 on `hub/sqlite-settings`, 4 128–6 962 ms
+	* per statement, every five minutes (the occupancy refresh), all night —
+	* `plan=["SEARCH … USING INDEX idx_media_location (locationId=?)"]` on every
+	* WARN. That thread is synchronous, so every configuration read in the
+	* cluster queued behind it: the orchestrator's `configMs=6640` at 23:26:11
+	* is this statement's 6 002 ms at 23:26:10.
+	*
+	* With `sizeBytes` in the index the planner never touches the table
+	* (`USING COVERING INDEX idx_media_location_size`), and the seal gate keeps
+	* its own narrower index. Same shape, same one-off caveat as its two
+	* siblings: ~30 bytes a row, one more b-tree per insert, and the first
+	* `declareCollection` after this ships builds it over every existing row —
+	* do not deploy it beside a running drain or seal.
+	*/
+	{
+		name: "idx_media_location_size",
+		columns: ["locationId", "sizeBytes"]
 	})
 ];
 /** The storage location of a media row/record: its stamped `locationId`, or
@@ -33403,7 +33570,12 @@ var FaceGalleryProvider = class {
 				identityId: input.identityId
 			});
 			assigned += 1;
-		} catch {
+		} catch (err) {
+			this.logger.error("assignFaces refused a face", { meta: {
+				faceId,
+				identityId: input.identityId,
+				error: err instanceof Error ? `${err.name}: ${err.message}` : String(err)
+			} });
 			failed.push(faceId);
 		}
 		return {
@@ -34785,6 +34957,21 @@ var SpawnBesideCoastingSampler = class {
 		this.counts.clear();
 	}
 };
+/** Per-cause counter + sampling decision. One instance per tracker, so the
+*  counts are per camera and per detection source. */
+var TrackLossSampler = class {
+	counts = /* @__PURE__ */ new Map();
+	/** The running count when this loss should be emitted, else `undefined`. */
+	next(cause) {
+		const count = (this.counts.get(cause) ?? 0) + 1;
+		this.counts.set(cause, count);
+		if (count <= 10) return count;
+		return count % 50 === 0 ? count : void 0;
+	}
+	reset() {
+		this.counts.clear();
+	}
+};
 /** Per-reason counter + sampling decision. One instance per tracker, so the
 *  counts are per camera and per detection source. */
 var SpawnRefusalSampler = class {
@@ -34893,6 +35080,16 @@ var SortTracker = class SortTracker {
 	refusalSink = null;
 	/** Per-reason counters behind the sampled spawn-beside-coasting diagnostics. */
 	spawnBesideSampler = new SpawnBesideCoastingSampler();
+	/**
+	* Deliveries to {@link update} since this tracker was constructed. One per
+	* frame the pipeline actually hands over — which is exactly what "the camera
+	* was looking" means, and is NOT derivable from wall clock: a quiet camera
+	* and a busy one span the same seconds (D438).
+	*/
+	frameSeq = 0;
+	/** Sink for track deaths — see {@link setTrackLossObserver}. */
+	trackLossObserver = null;
+	trackLossSampler = new TrackLossSampler();
 	/** Sink for fragmentation diagnostics — see {@link setSpawnBesideCoastingObserver}. */
 	spawnBesideObserver = null;
 	constructor(config = {}) {
@@ -34925,6 +35122,13 @@ var SortTracker = class SortTracker {
 	* Same contract as the other two sinks — the tracker has no `deviceId`, the
 	* caller stamps it, and nothing is computed when no observer is wired.
 	*/
+	/**
+	* Wire the sink for {@link TrackLossRecord}. Nothing is computed when no
+	* observer is attached.
+	*/
+	setTrackLossObserver(observer) {
+		this.trackLossObserver = observer;
+	}
 	setSpawnBesideCoastingObserver(observer) {
 		this.spawnBesideObserver = observer;
 	}
@@ -34939,13 +35143,13 @@ var SortTracker = class SortTracker {
 	reportSpawnBesideCoasting(spawnedId, det, coasting, detections, frameArea, timestamp) {
 		const observer = this.spawnBesideObserver;
 		if (!observer) return;
-		const group = this.assocGroup(det.class);
+		const family = SortTracker.spawnBesideFamily(det.class);
 		const dc = bboxCentroid(det.bbox);
 		let best;
 		let bestDist = Number.POSITIVE_INFINITY;
 		let bestReach = 0;
 		for (const track of coasting) {
-			if (this.assocGroup(track.class) !== group) continue;
+			if (SortTracker.spawnBesideFamily(track.class) !== family) continue;
 			const tc = bboxCentroid(track.bbox);
 			const dist = Math.hypot(tc.x - dc.x, tc.y - dc.y);
 			const reach = this.reacquireReach(track, timestamp, true);
@@ -34960,6 +35164,7 @@ var SortTracker = class SortTracker {
 		const declinedBy = this.explainDecline(best, det, detections, frameArea, timestamp, bestDist);
 		const spawnCount = this.spawnBesideSampler.next(declinedBy);
 		if (spawnCount === void 0) return;
+		const crowd = declinedBy === "crowd-guard" ? this.crowdAround(best, det, detections) : void 0;
 		observer({
 			spawnedTrackId: spawnedId,
 			spawnedClass: det.class,
@@ -34976,6 +35181,8 @@ var SortTracker = class SortTracker {
 			gapMs: timestamp - best.lastSeen,
 			trackAgeMs: timestamp - best.firstSeen,
 			declinedBy,
+			...crowd === void 0 ? {} : { competitorCount: crowd.count },
+			...crowd?.nearestPx === void 0 ? {} : { nearestCompetitorPx: crowd.nearestPx },
 			spawnCount,
 			sampledEvery: 10
 		});
@@ -34990,8 +35197,7 @@ var SortTracker = class SortTracker {
 	* `already-claimed` means.
 	*/
 	explainDecline(track, det, detections, frameArea, timestamp, centroidDist) {
-		if (!this.sameGroupAsMeasured(track.class, det)) return "native-measured-class";
-		if (this.assocGroup(track.class) !== this.assocGroup(det.class)) return "assoc-group";
+		if (track.class !== det.class) return det.nativeRecovery !== void 0 ? "native-measured-class" : "cross-class";
 		if (iou$3(track.bbox, det.bbox) >= this.config.rescueIouThreshold) return "already-claimed";
 		if (centroidDist <= this.reacquireReach(track, timestamp, true)) {
 			if (!this.isPlausibleBirth(det, frameArea)) return "already-claimed";
@@ -35050,14 +35256,44 @@ var SortTracker = class SortTracker {
 	* come back — a graveyarded track may still resurrect, and a line about work
 	* that was not lost is worse than no line.
 	*/
+	/**
+	* Report one track that ended with nothing taking over (D438).
+	*
+	* Deliberately separate from {@link reportTrackLoss}, which speaks only for
+	* spawns that never reached `minHits`. The population under investigation —
+	* animal tracks dying mid-frame after six frames — had all EMITTED, so that
+	* path never saw a single one of them.
+	*
+	* `timestamp` is the frame doing the sweeping, not the track's own clock: the
+	* question is how much passed while nobody was looking.
+	*/
+	reportTrackDeath(track, cause, timestamp) {
+		const observer = this.trackLossObserver;
+		if (!observer) return;
+		const lossCount = this.trackLossSampler.next(cause);
+		if (lossCount === void 0) return;
+		observer({
+			trackId: track.id,
+			trackClass: track.class,
+			cause,
+			framesSinceLastSeen: this.frameSeq - track.lastSeenFrameSeq,
+			msSinceLastSeen: timestamp - track.lastSeen,
+			lifeMs: track.lastSeen - track.firstSeen,
+			positions: track.hits,
+			emitted: track.emitted,
+			lossCount,
+			sampledEvery: 50
+		});
+	}
 	reportTrackLoss(track) {
 		if (track.emitted || track.lossReported) return;
 		track.lossReported = true;
 		this.reportRefusal("unconfirmed-spawn-lost", {
-			class: track.class,
+			class: track.frameClass,
 			originalClass: track.originalClass,
 			score: track.score,
-			bbox: track.bbox
+			bbox: track.bbox,
+			...track.lastNativeRecovery !== void 0 ? { nativeRecovery: track.lastNativeRecovery } : {}
 		}, {
 			threshold: this.config.minHits,
 			measured: track.hits,
@@ -35112,43 +35348,73 @@ var SortTracker = class SortTracker {
 	static pairKey(a, b) {
 		return a < b ? `${a}|${b}` : `${b}|${a}`;
 	}
-	/** Association-gating group of a class. When `classGroupAssoc` is on the
-	*  {person,animal} pair collapses to one group so a per-frame class flip
-	*  (crouch person → animal) re-matches the existing track instead of spawning a
-	*  concurrent id. Every other class is its own group. */
-	assocGroup(cls) {
-		if (this.config.classGroupAssoc && (cls === PERSON_CLASS || cls === ANIMAL_CLASS)) return `${PERSON_CLASS}|${ANIMAL_CLASS}`;
+	/** The two macro-classes a coarse pass confuses on a non-upright person. */
+	static isPersonAnimalPair(a, b) {
+		return a === PERSON_CLASS && b === ANIMAL_CLASS || a === ANIMAL_CLASS && b === PERSON_CLASS;
+	}
+	/**
+	* The family a spawn-beside-coasting line is reported AGAINST — {person,
+	* animal} as one, every other class its own. Reporting only, never a binding
+	* rule: a cross-class pair is exactly what that line exists to name (the
+	* D378 veto, the D439 salvage rule), so a pair the tracker refused must still
+	* be reportable. Independent of `classGroupAssoc` for the same reason.
+	*/
+	static spawnBesideFamily(cls) {
+		if (cls === PERSON_CLASS || cls === ANIMAL_CLASS) return `${PERSON_CLASS}|${ANIMAL_CLASS}`;
 		return cls;
 	}
-	/** Whether a detection may associate to a track under the current class gate:
-	*  exact class when `classGating` is off (no gate at all) — matching the legacy
-	*  contract — otherwise same association group (group == exact class unless
-	*  `classGroupAssoc` widened it to {person,animal}). */
+	/**
+	* A CROSS-CLASS BIND IS A FLIP CLAIM, AND A FLIP IS WEAK (D439).
+	*
+	* `classGroupAssoc` exists for one failure of the COARSE full-frame pass: a
+	* bending person re-labelled `animal` for a frame, over the person's own
+	* box, at the 0.4-0.6 the coarse pass gives a shape it half recognises. That
+	* claim has three parts, and this predicate is all three:
+	*
+	*   - the box was measured by the coarse pass — never `nativeRecovery`. The
+	*     runner's second pass measures the OPPOSITE thing: a 640-800 px native
+	*     square around a motion region the full-frame boxes do NOT account for,
+	*     which is by construction not the subject the full pass already has.
+	*     2026-09-07 07:51:33, an `animal` at `nativeRecoveryScore=0.833`
+	*     absorbed into a person: the D378 half of this rule;
+	*   - it is a {person, animal} pair;
+	*   - it is WEAK — below {@link TrackerConfig.animalOverPersonMaxScore}, the
+	*     same bar the spawn gate uses for the same claim. A `person` at 0.86 or
+	*     an `animal` at 0.92 is not a half-recognised shape, it is a subject,
+	*     and binding it to the other class's track hands one subject's id to
+	*     another (camera 615, 17:11:01: person 0.8616 → animal track
+	*     `a28c1557`, which was then born as a person).
+	*
+	* Where the caller may use it is the fourth part, and it is the caller's:
+	* only the predicted-box passes ({@link greedyAssociate}), where "same place"
+	* is measured against a prediction on the strict `iouThreshold`. The salvage
+	* passes ({@link looseMatch}) never cross classes — their whole premise is
+	* weak overlap, and a weak-overlap cross-class bind is a dog beside its
+	* owner, every time.
+	*/
+	crossClassFlip(trackClass, det) {
+		if (!this.config.classGroupAssoc) return false;
+		if (det.nativeRecovery !== void 0) return false;
+		if (!SortTracker.isPersonAnimalPair(trackClass, det.class)) return false;
+		return det.score < this.config.animalOverPersonMaxScore;
+	}
+	/** Whether a detection may associate to a track on a PREDICTED-BOX pass:
+	*  its own class, or — with `classGroupAssoc` — a weak coarse flip of the
+	*  {person, animal} pair ({@link crossClassFlip}). `classGating` off means no
+	*  gate at all, matching the legacy contract, except that a native-measured
+	*  box still binds only its own class (D378). */
 	associable(trackClass, det) {
-		if (!this.sameGroupAsMeasured(trackClass, det)) return false;
+		if (trackClass === det.class) return true;
+		if (det.nativeRecovery !== void 0) return false;
 		if (!this.config.classGating) return true;
-		return this.assocGroup(trackClass) === this.assocGroup(det.class);
+		return this.crossClassFlip(trackClass, det);
 	}
 	/**
-	* A NATIVE-MEASURED BOX IS ITS OWN SUBJECT ACROSS CLASSES (D378).
-	*
-	* `classGroupAssoc` collapses {person, animal} into one association group for
-	* one failure of the COARSE full-frame pass: a bending person re-labelled
-	* `animal` for a frame, over the person's own box. Letting that box re-match
-	* the person track is strictly better than minting a concurrent id.
-	*
-	* The runner's second pass makes the opposite measurement — the same detector
-	* on a 640-800 px native square around a motion region the full-frame boxes
-	* do NOT account for. Such a box is, by construction, not the subject the
-	* full pass already has; absorbing it into a person track means the animal is
-	* never seen at all, which on 2026-09-07 07:51:33 is exactly what happened to
-	* an `animal` at `nativeRecoveryScore=0.833`.
-	*
-	* So the widening does not apply to a detection carrying `nativeRecovery`:
-	* it associates to its OWN class or it spawns. Every other guard on that
-	* spawn still runs — the per-class score floor, the area floor, the
-	* `dedupSpawnIou` overlap, and `resolveDuplicates` afterwards, where a person
-	* still beats a cross-class animal.
+	* A NATIVE-MEASURED BOX IS ITS OWN SUBJECT ACROSS CLASSES (D378) — the
+	* occlusion gate's copy of the first clause of {@link crossClassFlip}. A
+	* cross-class occluder is not a same-subject claim for a box the native
+	* pass measured: a dog at its owner's knee is 100% contained in the person's
+	* box and is not the person.
 	*/
 	sameGroupAsMeasured(trackClass, det) {
 		if (det.nativeRecovery === void 0) return true;
@@ -35321,9 +35587,16 @@ var SortTracker = class SortTracker {
 		};
 	}
 	/**
-	* How many same-association-group subjects OTHER than `corpse` share the
-	* scene with it: every track LIVE on this frame, plus any other resurrectable
-	* corpse whose lifetime OVERLAPPED the candidate's.
+	* How many SAME-CLASS subjects OTHER than `corpse` share the scene with it:
+	* every track LIVE on this frame, plus any other resurrectable corpse whose
+	* lifetime OVERLAPPED the candidate's.
+	*
+	* Exact class, not the {person, animal} family (D439): a competitor is a
+	* subject the id could actually be handed to, and since a salvage pass binds
+	* its own class only, a person cannot take a dog's id there. Counting the
+	* owner as the dog's competitor split one dog's id 12 times on camera 615 in
+	* 6.6 h — every bind the reach clause accepted, the guard then refused
+	* because the person was on screen.
 	*
 	* The overlap clause on the graveyard half is what keeps this guard off the
 	* case the resurrection pass exists for. A single flickering subject leaves a
@@ -35337,30 +35610,30 @@ var SortTracker = class SortTracker {
 	* steals an id is very often one whose OWN track was born after the corpse
 	* died (camera 618 — the toddler's track post-dates the older boy's).
 	*/
-	sameGroupPeerCount(corpse, live) {
-		const group = this.assocGroup(corpse.class);
+	sameClassPeerCount(corpse, live) {
 		let peers = 0;
-		for (const t of live) if (t !== corpse && this.assocGroup(t.class) === group) peers++;
+		for (const t of live) if (t !== corpse && t.class === corpse.class) peers++;
 		for (const other of this.lostTracks) {
 			if (other === corpse) continue;
 			if (!other.resurrectable) continue;
-			if (this.assocGroup(other.class) !== group) continue;
+			if (other.class !== corpse.class) continue;
 			if (other.firstSeen <= corpse.lastSeen && corpse.firstSeen <= other.lastSeen) peers++;
 		}
 		return peers;
 	}
 	/**
-	* Loose same-group gate used by the rescue and resurrection passes: accept
-	* when the detection overlaps the track's LAST-KNOWN bbox by `rescueIou`, or
-	* its centroid is within `rescueCentroidFactor × bbox-diagonal`. Always group-
-	* gated (a rescue must never cross association groups) independent of
-	* `classGating`, so a coasting person track can be rescued by its own
-	* crouch→animal flip when `classGroupAssoc` is on, but never by an unrelated
-	* class.
+	* Loose gate used by the rescue and resurrection passes: accept when the
+	* detection overlaps the track's LAST-KNOWN bbox by `rescueIou`, or its
+	* centroid is within reach. EXACT-class, always, independent of
+	* `classGating` and of `classGroupAssoc` (D439): a salvage pass binds on
+	* weak overlap by definition, and a weak-overlap bind across {person,
+	* animal} is not a crouch flip — a flip sits on the subject's own box — it
+	* is a dog beside its owner, or the owner beside the dog. Until 2026-09-10
+	* this gate crossed the group, and it is where a `person` at 0.86 took over
+	* an animal's id (camera 615, 17:11:01).
 	*/
 	looseMatch(track, det, timestamp, timeScaled = true) {
-		if (!this.sameGroupAsMeasured(track.class, det)) return null;
-		if (this.assocGroup(track.class) !== this.assocGroup(det.class)) return null;
+		if (track.class !== det.class) return null;
 		if (iou$3(track.bbox, det.bbox) >= this.config.rescueIouThreshold) return "iou";
 		const tc = bboxCentroid(track.bbox);
 		const dc = bboxCentroid(det.bbox);
@@ -35406,12 +35679,41 @@ var SortTracker = class SortTracker {
 	* bind time and at report time — the spawn-beside-coasting line has to be able
 	* to say which gate declined without re-running the greedy competition.
 	*/
+	/**
+	* WHO the crowd was, for the record only — this changes no decision.
+	*
+	* {@link isUnambiguousReach} refuses on PRESENCE, with no distance in the
+	* question, so a person at the far corner of a room splits a track as surely
+	* as one standing beside it. Counting them, and measuring the nearest, is
+	* what makes narrowing that rule a decision rather than a guess (D436).
+	*/
+	crowdAround(track, det, detections) {
+		const cx = det.bbox.x + det.bbox.w / 2;
+		const cy = det.bbox.y + det.bbox.h / 2;
+		const counted = [];
+		let nearest;
+		const consider = (bbox) => {
+			counted.push(bbox);
+			const d = Math.hypot(bbox.x + bbox.w / 2 - cx, bbox.y + bbox.h / 2 - cy);
+			if (nearest === void 0 || d < nearest) nearest = d;
+		};
+		for (const t of this.tracks) if (t !== track && t.class === track.class) consider(t.bbox);
+		for (const other of detections) {
+			if (other === det) continue;
+			if (other.class !== track.class) continue;
+			if (counted.some((b) => iou$3(b, other.bbox) > 0)) continue;
+			consider(other.bbox);
+		}
+		return {
+			count: counted.length,
+			nearestPx: nearest
+		};
+	}
 	isUnambiguousReach(track, det, detections) {
-		if (this.sameGroupPeerCount(track, this.tracks) > 0) return false;
-		const group = this.assocGroup(track.class);
+		if (this.sameClassPeerCount(track, this.tracks) > 0) return false;
 		for (const other of detections) {
 			if (other === det) continue;
-			if (this.assocGroup(other.class) === group) return false;
+			if (other.class === track.class) return false;
 		}
 		return true;
 	}
@@ -35448,8 +35750,8 @@ var SortTracker = class SortTracker {
 	* weight; otherwise the latest-frame class (ambiguous vote or voting off).
 	*/
 	resolveReportedClass(t) {
-		if (!this.config.classVotingEnabled || t.classVotes.size === 0) return t.class;
-		let bestClass = t.class;
+		if (!this.config.classVotingEnabled || t.classVotes.size === 0) return t.frameClass;
+		let bestClass = t.frameClass;
 		let bestVote = -1;
 		let total = 0;
 		for (const [cls, v] of t.classVotes) {
@@ -35459,8 +35761,8 @@ var SortTracker = class SortTracker {
 				bestClass = cls;
 			}
 		}
-		if (total <= 0) return t.class;
-		return bestVote / total >= this.config.classVoteMinFraction ? bestClass : t.class;
+		if (total <= 0) return t.frameClass;
+		return bestVote / total >= this.config.classVoteMinFraction ? bestClass : t.frameClass;
 	}
 	/** Whether a detection clears its per-class spawn score floor. Only gates NEW
 	*  spawns — an established track still matches below its floor. */
@@ -35476,16 +35778,67 @@ var SortTracker = class SortTracker {
 		return this.config.confirmBypassEnabled && t.score >= this.config.confirmBypassScore;
 	}
 	/**
+	* The live tracks split into the two tiers that claim a box in a fixed
+	* order (D442, see {@link update}): those already confirmed for emission,
+	* and the provisional ones still under `minHits`. Decided on the state at
+	* the start of the frame, as ByteTrack does. With `minHits: 1` the second
+	* tier is always empty and every pass over it is a no-op.
+	*/
+	associationTiers() {
+		const established = [];
+		const provisional = [];
+		for (const track of this.tracks) if (this.isConfirmedForEmit(track)) established.push(track);
+		else provisional.push(track);
+		return [established, provisional];
+	}
+	/**
+	* The rescue pass. HIGH-score detections the greedy pass left unmatched get
+	* a second, looser chance against the still-unmatched (coasting) tracks of
+	* `tracks` — measured on the track's LAST-KNOWN bbox, never the drifted
+	* prediction. Recovers half-box re-acquisition and small-drift flicker
+	* without spawning a duplicate. Best (highest last-known IoU) pairs first;
+	* LOW detections are reserved for the ByteTrack low stage.
+	*/
+	rescueAssociate(tracks, gates, detections, lowSet, frameArea, timestamp, used, matchedTracks, matched, continuationOnly) {
+		const rescuePairs = [];
+		for (const track of tracks) {
+			if (matchedTracks.has(track)) continue;
+			for (let di = 0; di < detections.length; di++) {
+				if (used.has(di) || lowSet.has(di) || continuationOnly.has(di)) continue;
+				const det = detections[di];
+				const gate = this.looseMatch(track, det, timestamp);
+				if (gate === null || !gates.has(gate)) continue;
+				if (gate === "centroid" && this.isPlausibleBirth(det, frameArea) && !(this.config.reacquireTimeScaled && this.isUnambiguousReach(track, det, detections))) continue;
+				rescuePairs.push({
+					track,
+					detIdx: di,
+					score: iou$3(track.bbox, det.bbox),
+					gate
+				});
+			}
+		}
+		rescuePairs.sort((a, b) => b.score - a.score);
+		for (const pair of rescuePairs) {
+			if (matchedTracks.has(pair.track) || used.has(pair.detIdx)) continue;
+			const det = detections[pair.detIdx];
+			matched.set(pair.track, det);
+			matchedTracks.add(pair.track);
+			used.add(pair.detIdx);
+			this.reportBind("rescue", pair.gate, pair.track, det, timestamp);
+		}
+	}
+	/**
 	* One greedy IoU association pass over a candidate detection subset against the
-	* currently-UNMATCHED tracks, on each track's PREDICTED box. Highest-IoU pairs
+	* still-UNMATCHED tracks of `tracks` (one association tier — see
+	* {@link associationTiers}), on each track's PREDICTED box. Highest-IoU pairs
 	* bind first; a track/detection binds at most once. Shared by the high-score
 	* first stage and the low-score second stage (different candidate sets + IoU
 	* gates) so the two-tier ByteTrack association stays a single implementation.
 	* Mutates `used` / `matchedTracks` / `matched` in place.
 	*/
-	greedyAssociate(detections, candidateIdxs, iouThreshold, timestamp, used, matchedTracks, matched, continuationOnly) {
+	greedyAssociate(tracks, detections, candidateIdxs, iouThreshold, timestamp, used, matchedTracks, matched, continuationOnly) {
 		const pairs = [];
-		for (const track of this.tracks) {
+		for (const track of tracks) {
 			if (matchedTracks.has(track)) continue;
 			const pbox = this.predicted(track, timestamp);
 			const confirmed = this.isConfirmedForEmit(track);
@@ -35511,6 +35864,7 @@ var SortTracker = class SortTracker {
 		}
 	}
 	update(detections, timestamp, frameContext) {
+		this.frameSeq++;
 		const frameArea = frameContext ? frameContext.frameWidth * frameContext.frameHeight : 0;
 		const continuationOnly = frameContext?.continuationOnly ?? EMPTY_INDEX_SET;
 		const resurrectedScene = /* @__PURE__ */ new Map();
@@ -35521,6 +35875,7 @@ var SortTracker = class SortTracker {
 				track.lostAt = timestamp;
 				track.resurrectable = false;
 				this.reportTrackLoss(track);
+				this.reportTrackDeath(track, "lifetime-cap", timestamp);
 				this.lostTracks.push(track);
 			} else alive.push(track);
 			this.tracks = alive;
@@ -35533,13 +35888,17 @@ var SortTracker = class SortTracker {
 				track.lostAt = track.lastSeen;
 				track.resurrectable = false;
 				this.reportTrackLoss(track);
+				this.reportTrackDeath(track, "stale-beyond-budgets", timestamp);
 				this.lostTracks.push(track);
 			} else alive.push(track);
 			this.tracks = alive;
 		}
 		const stillResurrectable = [];
 		for (const t of this.lostTracks) if (timestamp - t.lostAt <= this.config.resurrectionWindowMs) stillResurrectable.push(t);
-		else this.reportTrackLoss(t);
+		else {
+			this.reportTrackLoss(t);
+			this.reportTrackDeath(t, "graveyard-expired", timestamp);
+		}
 		this.lostTracks = stillResurrectable;
 		const used = /* @__PURE__ */ new Set();
 		const matchedTracks = /* @__PURE__ */ new Set();
@@ -35549,36 +35908,21 @@ var SortTracker = class SortTracker {
 		for (let di = 0; di < detections.length; di++) if (this.config.byteTrackEnabled && detections[di].score < this.config.byteTrackHighThreshold) lowIdxs.push(di);
 		else highIdxs.push(di);
 		const lowSet = new Set(lowIdxs);
-		this.greedyAssociate(detections, highIdxs, this.config.iouThreshold, timestamp, used, matchedTracks, matched, continuationOnly);
-		const rescuePairs = [];
-		for (const track of this.tracks) {
-			if (matchedTracks.has(track)) continue;
-			for (let di = 0; di < detections.length; di++) {
-				if (used.has(di) || lowSet.has(di) || continuationOnly.has(di)) continue;
-				const det = detections[di];
-				const gate = this.looseMatch(track, det, timestamp);
-				if (gate === null) continue;
-				if (gate === "centroid" && this.isPlausibleBirth(det, frameArea) && !(this.config.reacquireTimeScaled && this.isUnambiguousReach(track, det, detections))) continue;
-				rescuePairs.push({
-					track,
-					detIdx: di,
-					score: iou$3(track.bbox, det.bbox),
-					gate
-				});
-			}
-		}
-		rescuePairs.sort((a, b) => b.score - a.score);
-		for (const pair of rescuePairs) {
-			if (matchedTracks.has(pair.track) || used.has(pair.detIdx)) continue;
-			const det = detections[pair.detIdx];
-			matched.set(pair.track, det);
-			matchedTracks.add(pair.track);
-			used.add(pair.detIdx);
-			this.reportBind("rescue", pair.gate, pair.track, det, timestamp);
-		}
-		if (this.config.byteTrackEnabled && lowIdxs.length > 0) this.greedyAssociate(detections, lowIdxs, this.config.byteTrackLowIouThreshold, timestamp, used, matchedTracks, matched, continuationOnly);
+		const [established, provisional] = this.associationTiers();
+		const OVERLAP = new Set(["iou"]);
+		const PROXIMITY = new Set(["centroid", "growth"]);
+		this.greedyAssociate(established, detections, highIdxs, this.config.iouThreshold, timestamp, used, matchedTracks, matched, continuationOnly);
+		this.rescueAssociate(established, OVERLAP, detections, lowSet, frameArea, timestamp, used, matchedTracks, matched, continuationOnly);
+		this.greedyAssociate(provisional, detections, highIdxs, this.config.iouThreshold, timestamp, used, matchedTracks, matched, continuationOnly);
+		this.rescueAssociate(established, PROXIMITY, detections, lowSet, frameArea, timestamp, used, matchedTracks, matched, continuationOnly);
+		this.rescueAssociate(provisional, new Set([...OVERLAP, ...PROXIMITY]), detections, lowSet, frameArea, timestamp, used, matchedTracks, matched, continuationOnly);
+		if (this.config.byteTrackEnabled && lowIdxs.length > 0) for (const tier of [established, provisional]) this.greedyAssociate(tier, detections, lowIdxs, this.config.byteTrackLowIouThreshold, timestamp, used, matchedTracks, matched, continuationOnly);
 		for (const [track, det] of matched) {
-			if (track.class !== det.class) this.reportRefusal("cross-class-absorbed", det, { against: track });
+			if (track.class !== det.class) this.reportRefusal("cross-class-absorbed", det, {
+				against: track,
+				measured: iou$3(this.predicted(track, timestamp), det.bbox),
+				threshold: this.config.animalOverPersonMaxScore
+			});
 			const prevCenter = bboxCentroid({
 				x: track.bbox.x,
 				y: track.bbox.y,
@@ -35594,12 +35938,15 @@ var SortTracker = class SortTracker {
 			const frames = track.age + 1;
 			const dtMs = timestamp - track.lastSeen;
 			track.bbox = det.bbox;
-			track.class = det.class;
+			if (!this.crossClassFlip(track.class, det)) track.class = det.class;
+			track.frameClass = det.class;
 			track.originalClass = det.originalClass;
 			track.score = det.score;
+			track.lastNativeRecovery = det.nativeRecovery;
 			track.age = 0;
 			track.hits++;
 			track.lastSeen = timestamp;
+			track.lastSeenFrameSeq = this.frameSeq;
 			if (dtMs > 0) {
 				track.velocity = {
 					dx: (newCenter.x - prevCenter.x) / dtMs,
@@ -35648,7 +35995,7 @@ var SortTracker = class SortTracker {
 				if (gate === null) continue;
 				if (gate === "centroid" && this.isPlausibleBirth(det, frameArea)) continue;
 				const score = iou$3(lost.bbox, det.bbox);
-				const peers = this.sameGroupPeerCount(lost, surviving);
+				const peers = this.sameClassPeerCount(lost, surviving);
 				if (this.config.resurrectionCrowdGuard && peers > 0 && score < this.config.resurrectionCrowdedIouThreshold) {
 					if (score > refusedScore) {
 						refused = lost;
@@ -35673,12 +36020,15 @@ var SortTracker = class SortTracker {
 			this.lostTracks = this.lostTracks.filter((t) => t !== best);
 			best.bbox = det.bbox;
 			best.class = det.class;
+			best.frameClass = det.class;
 			best.originalClass = det.originalClass;
 			best.score = det.score;
+			best.lastNativeRecovery = det.nativeRecovery;
 			best.age = 0;
 			best.hits++;
 			best.lost = false;
 			best.lastSeen = timestamp;
+			best.lastSeenFrameSeq = this.frameSeq;
 			best.velocity = {
 				dx: 0,
 				dy: 0
@@ -35735,6 +36085,7 @@ var SortTracker = class SortTracker {
 				id: spawnedId,
 				bbox: det.bbox,
 				class: det.class,
+				frameClass: det.class,
 				originalClass: det.originalClass,
 				score: det.score,
 				age: 0,
@@ -35742,6 +36093,7 @@ var SortTracker = class SortTracker {
 				path: [det.bbox],
 				firstSeen: timestamp,
 				lastSeen: timestamp,
+				lastSeenFrameSeq: this.frameSeq,
 				velocity: {
 					dx: 0,
 					dy: 0
@@ -35752,7 +36104,8 @@ var SortTracker = class SortTracker {
 				resurrectable: true,
 				classVotes: new Map([[det.class, det.score > 0 ? det.score : Number.EPSILON]]),
 				emitted: false,
-				lossReported: false
+				lossReported: false,
+				lastNativeRecovery: det.nativeRecovery
 			});
 		}
 		this.tracks = surviving;
@@ -36282,6 +36635,10 @@ var FrameProcessor = class {
 	/** Wire (or clear) the tracker's fragmentation sink — a new id minted beside a
 	*  live coasting track that could have claimed it (D399). Same `deviceId`
 	*  contract as the two sinks above. */
+	/** Wire the sink for track deaths (D438) — pure passthrough to the tracker. */
+	setTrackLossObserver(observer) {
+		this.tracker.setTrackLossObserver(observer);
+	}
 	setSpawnBesideCoastingObserver(observer) {
 		this.tracker.setSpawnBesideCoastingObserver(observer);
 	}
@@ -64961,6 +65318,44 @@ function buildAudioLabels(input) {
 	}];
 }
 //#endregion
+//#region src/pipeline-analytics/services/event-kinds-config.ts
+/** The honest answer for a pipeline that could not be read: nothing advertised. */
+var NO_EMITTABLE = {
+	macroClasses: [],
+	audioEnabled: false
+};
+/** Depth-first walk of the step tree; the detector is a root today, but the
+*  question is "is it enabled anywhere", not "is it a root". */
+function* walkSteps(steps) {
+	for (const step of steps) {
+		yield step;
+		if (step.children !== void 0) yield* walkSteps(step.children);
+	}
+}
+/**
+* The macro classes an enabled `object-detection` step emits. Order follows
+* the authority, not the stored array, so two cameras narrowed to the same
+* set render the same lanes in the same order.
+*/
+function macroClassesOf(step) {
+	const stored = step.settings?.["enabledMacroClasses"];
+	if (!Array.isArray(stored) || stored.length === 0) return [...FIRST_LEVEL_MACRO_CLASSES];
+	const chosen = new Set(stored.filter((v) => typeof v === "string"));
+	return FIRST_LEVEL_MACRO_CLASSES.filter((macro) => chosen.has(macro));
+}
+function emittableFromPipelineConfig(config) {
+	let macroClasses = [];
+	for (const step of walkSteps(config.steps)) {
+		if (step.addonId !== "object-detection" || step.enabled === false) continue;
+		macroClasses = macroClassesOf(step);
+		break;
+	}
+	return {
+		macroClasses,
+		audioEnabled: config.audio?.enabled === true
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/services/event-kinds.ts
 /**
 * Extensible per-device event kinds (Part B).
@@ -66622,10 +67017,12 @@ var TrackingSettingsSchema = object({
 	minSpawnAreaFracAnimal: number().min(0).max(1).default(0),
 	/** Min spawn bbox area for `vehicle` as a fraction of the frame (0 = ungated). */
 	minSpawnAreaFracVehicle: number().min(0).max(1).default(0),
-	/** Gate association on a class GROUP ({person,animal}) instead of the exact
-	*  per-frame class, so a person that flips to `animal` for a frame re-matches
-	*  its existing track (no concurrent animal id). Reported label stays via the
-	*  class vote. Off = exact per-frame class gating. */
+	/** Let a person that flips to `animal` for a frame re-match its existing
+	*  track (no concurrent animal id). A flip is the same subject in the same
+	*  place, weakly read (D439): the bind is allowed only on the predicted-box
+	*  passes, only for a coarse box below `animalOverPersonMaxScore`, never on
+	*  the rescue / resurrection passes. Reported label stays via the class
+	*  vote. Off = exact per-frame class gating. */
 	classGroupAssoc: boolean().default(true)
 });
 var TRACKING_DEFAULTS = TrackingSettingsSchema.parse({});
@@ -67215,7 +67612,7 @@ function buildDetectionSettingsSections() {
 					type: "boolean",
 					key: "classGroupAssoc",
 					label: "Person/animal group matching",
-					description: "Let a detection that flips between person and animal for a frame (a crouching / bending person is often read as an animal) re-match its existing track instead of spawning a concurrent animal track. The reported class is still decided by the per-track class vote.",
+					description: "Let a detection that flips between person and animal for a frame (a crouching / bending person is often read as an animal) re-match its existing track instead of spawning a concurrent animal track. A flip is the same subject in the same place, weakly read: the cross-class match happens only on the strict predicted-box pass and only for a full-frame box below the \"animal over person max score\" bar — a confident animal beside a person, or a person beside an animal, is its own subject and keeps its own track. The reported class is still decided by the per-track class vote.",
 					default: TRACKING_DEFAULTS.classGroupAssoc
 				},
 				{
@@ -77686,6 +78083,15 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 					}
 				});
 			});
+			p.setTrackLossObserver((record) => {
+				this.ctx.logger.info("tracker: a track ended and nothing took over", {
+					tags: { deviceId },
+					meta: {
+						source,
+						...record
+					}
+				});
+			});
 			p.setSpawnBesideCoastingObserver((record) => {
 				this.ctx.logger.info("tracker: new id minted beside a live coasting track", {
 					tags: { deviceId },
@@ -77857,28 +78263,26 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		};
 	}
 	/**
-	* Every event kind the device can produce: built-ins (motion + audio),
-	* detection classes actually observed on the device, and sensor kinds
-	* from LINKED devices (device-manager `getLinkedDevices`, binding-driven
-	* per linked device). Degrades to the built-ins on error.
+	* Every event kind the device can produce: built-ins (motion + audio), the
+	* detection classes its CONFIGURED pipeline can emit, and sensor kinds from
+	* LINKED devices (device-manager `getLinkedDevices`, binding-driven per
+	* linked device). Degrades to the built-ins on error.
+	*
+	* The detection and audio facts are read from `resolvePipeline` — the
+	* configuration — and never from `getCameraStatus`, which is RUNTIME: an
+	* on-motion camera holds no session between motion events
+	* (`reasons.detection: 'armed:on-motion'`, `detection: null`) and was being
+	* advertised as detecting nothing while its tracks said person / vehicle /
+	* animal ([D449](../../../../docs/decisions/adr-0449-the-timeline-taxonomy-is-the-configured-one-raw-forward-has-no-switch-and-a-one-row-write-waits-on-the-disk.md)).
 	*/
 	async listEventKinds(input) {
 		const api = this.ctx.api;
-		const status = await api.pipelineOrchestrator.getCameraStatus.query({ deviceId: input.deviceId }).catch((err) => {
-			this.ctx.logger.warn("listEventKinds: getCameraStatus failed", {
-				tags: { deviceId: input.deviceId },
-				meta: { error: errMsg$1(err) }
-			});
-			return null;
-		});
-		const detectionOn = status?.detection != null;
-		const audioOn = status?.audio?.enabled === true;
-		const detectionMacros = MACRO_LABELS.map((l) => l.id).filter((id) => id !== "package");
+		const emittable = await this.emittableFromConfig(input.deviceId, "listEventKinds");
 		return composeEventKinds({
 			linkedDevices: { getLinkedDevices: (i) => api.deviceManager.getLinkedDevices.query(i) },
 			bindings: { getBindings: (i) => api.deviceManager.getBindings.query(i) },
-			enabledMacroClasses: async () => detectionOn ? detectionMacros : [],
-			audioEnabled: async () => audioOn,
+			enabledMacroClasses: async () => emittable.macroClasses,
+			audioEnabled: async () => emittable.audioEnabled,
 			packageZonesEnabled: async (deviceId) => {
 				return (await this.resolveDevicePackageRules(deviceId)).some((r) => r.enabled !== false);
 			},
@@ -77892,6 +78296,24 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		}, input.deviceId);
 	}
 	/**
+	* What one camera's configured pipeline can emit (`resolvePipeline`), or
+	* the honest fallback when the orchestrator could not answer: nothing
+	* advertised, and a WARN saying so. The cap's answer is a plain list, so it
+	* has no room for "unknown" — that residual of D315 is named in D449; the
+	* steady state (an armed camera with no session) is no longer in it.
+	*/
+	async emittableFromConfig(deviceId, scope) {
+		try {
+			return emittableFromPipelineConfig(await this.ctx.api.pipelineOrchestrator.resolvePipeline.query({ deviceId }));
+		} catch (err) {
+			this.ctx.logger.warn(`${scope}: resolvePipeline failed — no ML kinds advertised`, {
+				tags: { deviceId },
+				meta: { error: errMsg$1(err) }
+			});
+			return NO_EMITTABLE;
+		}
+	}
+	/**
 	* `listEventKinds` for many cameras, in one call.
 	*
 	* The saving is not the round-trips the CALLER avoids — it is the fan-out
@@ -77903,11 +78325,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	* `getLinkedDevices` alone took 4110 ms — each one runs a full-fleet
 	* `listAll` inside device-manager and thirty of them QUEUE.
 	*
-	* Now three calls for the whole set, whatever N is: one
-	* `getCameraStatuses`, then `prefetchDeviceTopology`'s
-	* `getLinkedDevicesBatch` + `getBindingsBatch`. `composeEventKinds` is
-	* unchanged — it is handed the same per-device client interfaces, backed by
-	* maps instead of RPC.
+	* Now two calls for the whole topology, whatever N is —
+	* `prefetchDeviceTopology`'s `getLinkedDevicesBatch` + `getBindingsBatch` —
+	* plus one `resolvePipeline` per camera, all in flight at once (D449; there
+	* is no batch form of it). `composeEventKinds` is unchanged — it is handed
+	* the same per-device client interfaces, backed by maps instead of RPC.
 	*
 	* A camera whose composition fails yields an EMPTY list rather than dropping
 	* out of the response: a caller that asked for twelve and got eleven cannot
@@ -77916,15 +78338,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	async listEventKindsBatch(input) {
 		const api = this.ctx.api;
 		const deviceIds = [...new Set(input.deviceIds)];
-		const statuses = await api.pipelineOrchestrator.getCameraStatuses.query({ deviceIds }).catch((err) => {
-			this.ctx.logger.warn("listEventKindsBatch: getCameraStatuses failed", { meta: {
-				deviceCount: deviceIds.length,
-				error: errMsg$1(err)
-			} });
-			return [];
-		});
-		const statusByDevice = new Map(statuses.map((st) => [st.deviceId, st]));
-		const detectionMacros = MACRO_LABELS.map((l) => l.id).filter((id) => id !== "package");
+		const emittableByDevice = new Map(await Promise.all(deviceIds.map(async (deviceId) => [deviceId, await this.emittableFromConfig(deviceId, "listEventKindsBatch")])));
 		const topology = await prefetchDeviceTopology({
 			getLinkedDevicesBatch: (i) => api.deviceManager.getLinkedDevicesBatch.query(i),
 			getBindingsBatch: (i) => api.deviceManager.getBindingsBatch.query(i)
@@ -77936,14 +78350,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			return null;
 		});
 		return composeEventKindsForDevices(deviceIds, async (deviceId) => {
-			const status = statusByDevice.get(deviceId) ?? null;
-			const detectionOn = status?.detection != null;
-			const audioOn = status?.audio?.enabled === true;
+			const emittable = emittableByDevice.get(deviceId) ?? NO_EMITTABLE;
 			return composeEventKinds({
 				linkedDevices: topology?.linkedDevices ?? { getLinkedDevices: (i) => api.deviceManager.getLinkedDevices.query(i) },
 				bindings: topology?.bindings ?? { getBindings: (i) => api.deviceManager.getBindings.query(i) },
-				enabledMacroClasses: async () => detectionOn ? detectionMacros : [],
-				audioEnabled: async () => audioOn,
+				enabledMacroClasses: async () => emittable.macroClasses,
+				audioEnabled: async () => emittable.audioEnabled,
 				packageZonesEnabled: async (id) => {
 					return (await this.resolveDevicePackageRules(id)).some((r) => r.enabled !== false);
 				},