@camstack/addon-post-analysis 1.2.270 → 1.2.272

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-C-nKNO5A.js");
+const require_dist = require("../dist-BkBZcyAK.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -30055,10 +30055,31 @@ var MediaStore = class {
 	* was simply never returned, which is why every retention ops-log row this
 	* addon has ever written says `bytesReclaimed: 0` (D161).
 	*/
-	async deleteForOwnerCounted(ownerKind, ownerIds) {
-		return this.gated(() => this.deleteForOwnerUnchecked(ownerKind, ownerIds));
+	async deleteForOwnerCounted(ownerKind, ownerIds, spare) {
+		return this.gated(() => this.deleteForOwnerUnchecked(ownerKind, ownerIds, spare));
 	}
-	async deleteForOwnerUnchecked(ownerKind, ownerIds) {
+	/**
+	* Who owns a media row — kind and id — or `null` for an unknown id. The
+	* stationary registry asks this before releasing an entry's key frame
+	* (D547): the row is still `track`-owned by a track whose row is gone, and
+	* only when no track row owns it is the entry the last thing vouching for it.
+	*/
+	async ownerOf(mediaId) {
+		const row = await this.store.get.query({
+			collection: MEDIA_COLLECTION,
+			key: String(mediaId)
+		});
+		if (!row) return null;
+		const data = row;
+		const ownerKind = String(data["ownerKind"] ?? "");
+		const ownerId = String(data["ownerId"] ?? "");
+		if (!isMediaOwnerKind(ownerKind) || ownerId === "") return null;
+		return {
+			ownerKind,
+			ownerId
+		};
+	}
+	async deleteForOwnerUnchecked(ownerKind, ownerIds, spare) {
 		let rows = 0;
 		let bytes = 0;
 		for (const ownerId of ownerIds) {
@@ -30070,6 +30091,7 @@ var MediaStore = class {
 				} }
 			});
 			for (const row of found) {
+				if (spare !== void 0 && spare.has(Number(row.id))) continue;
 				const rowData = row.data;
 				const path = String(rowData["path"] ?? "");
 				const sizeBytes = Number(rowData["sizeBytes"]);
@@ -30388,16 +30410,17 @@ var MediaStore = class {
 	* `deleteForOwner` is best-effort per row, so one bad row can't abort the
 	* batch.
 	*/
-	async deleteByTracks(trackIds) {
+	async deleteByTracks(trackIds, opts) {
+		const spare = opts?.spare;
 		const own = await this.gated(async () => {
-			const tracks = await this.deleteForOwnerUnchecked("track", trackIds);
-			const faces = await this.deleteForOwnerUnchecked("face", trackIds.map((id) => FACE_MEDIA_OWNER_PREFIX + id));
+			const tracks = await this.deleteForOwnerUnchecked("track", trackIds, spare);
+			const faces = await this.deleteForOwnerUnchecked("face", trackIds.map((id) => FACE_MEDIA_OWNER_PREFIX + id), spare);
 			return {
 				rows: tracks.rows + faces.rows,
 				bytes: tracks.bytes + faces.bytes
 			};
 		});
-		const plates = await this.deleteForOwnerCounted("plate", trackIds.map((id) => PLATE_MEDIA_OWNER_PREFIX + id));
+		const plates = await this.deleteForOwnerCounted("plate", trackIds.map((id) => PLATE_MEDIA_OWNER_PREFIX + id), spare);
 		return [{
 			family: "media",
 			rows: own.rows + plates.rows,
@@ -39386,7 +39409,9 @@ var FrameProcessor = class {
 		const refusals = [];
 		const labelPatchByTrack = /* @__PURE__ */ new Map();
 		const tracked = trackedDetections.map((td) => {
-			const state = mapObjectStateToTrackState(objectStates.find((o) => o.trackId === td.trackId)?.state);
+			const objectState = objectStates.find((o) => o.trackId === td.trackId);
+			const state = mapObjectStateToTrackState(objectState?.state);
+			const settling = objectState?.stationarySince !== void 0 && state !== "idle";
 			const candidate = resolveDetectionLabelCandidate({
 				className: td.class,
 				originalClass: td.originalClass,
@@ -39424,6 +39449,7 @@ var FrameProcessor = class {
 				zones: zonesByTrack.get(td.trackId) ?? [],
 				state,
 				matchedThisFrame: td.matchedThisFrame !== false,
+				settling,
 				...td.resurrectionScene !== void 0 ? { resurrectionScene: td.resurrectionScene } : {},
 				...labelPatch !== void 0 ? { labelPatch } : {},
 				...emb !== void 0 ? {
@@ -40419,8 +40445,16 @@ var TrackCloser = class {
 		try {
 			const trackStore = this.deps.trackStore();
 			if (!trackStore) return;
-			const expired = await trackStore.expireStale(this.now(), this.deps.isKnownParked !== void 0 ? { isKnownParked: this.deps.isKnownParked } : void 0);
+			const discarded = [];
+			const discardTracks = this.deps.discardTracks;
+			const expired = await trackStore.expireStale(this.now(), {
+				...this.deps.isKnownParked !== void 0 ? { isKnownParked: this.deps.isKnownParked } : {},
+				...discardTracks !== void 0 ? { onDiscard: (t) => {
+					discarded.push(t);
+				} } : {}
+			});
 			for (const t of expired) await this.closeExpired(t);
+			if (discardTracks !== void 0 && discarded.length > 0) await discardTracks(discarded);
 		} catch (err) {
 			if (this.deps.isShuttingDown()) return;
 			this.deps.logger.debug("sweepExpiredTracks failed", { meta: { error: String(err) } });
@@ -44118,6 +44152,19 @@ var VEHICLE_CLASSES$1 = new Set([
 	"truck",
 	"bus"
 ]);
+/**
+* A short motionless PERSON is stamped and persisted, never discarded (D547).
+*
+* The discard exists for re-sightings of an OBJECT an entity represents — a
+* parked car the registry censuses in two sessions, a plate flash on it. No
+* entity ever represents a person who stood still for ten seconds (the person
+* policy needs thirty minutes of agreement, on purpose), and the face read
+* such a track holds is the only record of who was there. Deleting the track
+* would delete that; hiding the row from the feed was always the whole rule.
+*/
+function isDiscardExemptClass(className) {
+	return className.toLowerCase() === "person";
+}
 function motionlessMaxPxForClass(className) {
 	return VEHICLE_CLASSES$1.has(className.toLowerCase()) ? 8 : 40;
 }
@@ -44875,7 +44922,30 @@ var TrackStore = class {
 		for (const [trackId, t] of this.active) {
 			if (nowMs - t.lastSeen < this.config.ttlMs) continue;
 			t.active = false;
-			if (t.positions.length > 0 && (opts?.isKnownParked?.(t) === true || isShortMotionlessTrack(t.lastSeen - t.firstSeen, netDisplacementPx(t.positions), t.className))) t.closedReason = "stationary-promotion";
+			const knownParked = t.positions.length > 0 && opts?.isKnownParked?.(t) === true;
+			const shortMotionless = t.positions.length > 0 && isShortMotionlessTrack(t.lastSeen - t.firstSeen, netDisplacementPx(t.positions), t.className);
+			const stillObject = knownParked || shortMotionless;
+			const discardable = knownParked || shortMotionless && !isDiscardExemptClass(t.className);
+			const onDiscard = opts?.onDiscard;
+			if (discardable && onDiscard !== void 0) {
+				const record = cloneTrack(t);
+				this.active.delete(trackId);
+				this.noteRowClosed(trackId, nowMs);
+				this.logger.debug("track discarded on expiry — a still object is an entity, not a track", {
+					tags: { deviceId: t.deviceId },
+					meta: {
+						deviceId: t.deviceId,
+						trackId,
+						className: t.className,
+						lifeMs: t.lastSeen - t.firstSeen,
+						netDisplacementPx: Math.round(netDisplacementPx(t.positions)),
+						knownParked
+					}
+				});
+				onDiscard(record);
+				continue;
+			}
+			if (stillObject) t.closedReason = "stationary-promotion";
 			const record = cloneTrack(t);
 			try {
 				await this.persistCompleted(record);
@@ -47798,6 +47868,8 @@ function visitsToClips(visits, events, pad, vouched) {
 * injected fetch/resolve deps so the compose logic is testable without I/O.
 */
 var SOURCE = "analytics";
+/** The addon that registers this provider — stamped on its source row. */
+var ANALYTICS_ADDON_ID = "pipeline-analytics";
 /**
 * Backstop on the ANNOTATION read — never on the clip list.
 *
@@ -47959,14 +48031,34 @@ function createVideoclipsProvider(deps) {
 			reportUnvouchedClips(deps, deviceId, answer);
 			return answer;
 		},
+		/**
+		* The one source this provider serves, on every camera: the hub's own
+		* analytics visits over recorded footage.
+		*
+		* Always `ok`, and that is not optimism — this source IS the process
+		* answering the call, so there is no reachability question to report. A
+		* read that fails INSIDE `listClips` degrades that list (and logs it); a
+		* source that cannot be reached at all is reported by the collection
+		* dispatcher, which is the only layer that can tell the difference.
+		* `label` is what the picker draws.
+		*/
+		listSources: async () => [{
+			source: SOURCE,
+			addonId: ANALYTICS_ADDON_ID,
+			label: "CamStack recordings",
+			availability: { state: "ok" }
+		}],
 		getClipPlayback: async ({ deviceId, clipId }) => {
 			const parsed = parseClipId(clipId);
 			if (!parsed) throw new Error(`videoclips: unrecognized clipId "${clipId}"`);
-			return deps.resolvePlayback({
-				deviceId,
-				startMs: parsed.startMs,
-				endMs: parsed.endMs
-			});
+			return {
+				...await deps.resolvePlayback({
+					deviceId,
+					startMs: parsed.startMs,
+					endMs: parsed.endMs
+				}),
+				format: "hls"
+			};
 		}
 	};
 }
@@ -53487,6 +53579,7 @@ var FaceRecognizer = class {
 			zones: [],
 			state: "moving",
 			matchedThisFrame: true,
+			settling: false,
 			embedding: input.embedding,
 			embeddingModelId: modelId,
 			...input.faceBbox !== void 0 ? { faceBbox: input.faceBbox } : {},
@@ -60881,64 +60974,53 @@ function stillnessVerdictFor(source, trackState) {
 	return source === "burst" ? void 0 : trackState;
 }
 /**
-* Does this observation count as EVIDENCE that the object is parked?
-*
-* Two questions, deliberately kept apart:
-*
-*  - IDENTITY — is this the same object in the same place? That is the IoU,
-*    and it is the only notion of sameness in this module.
-*  - STILLNESS — is it going anywhere? On a session frame that is the
-*    TRACKER's verdict, and nothing here re-derives it. On a burst frame it is
-*    the OCCASION: the runner rechecks a still scene and nothing else (see
-*    {@link stillnessVerdictFor}).
+* What one observation is worth to a candidate: `agree` (N and M), `disagree`
+* (M only) or `undecided` (neither).
 *
-* ## The tracker's verdict is `idle`, and `idle` costs the dwell
+* ## Why a third answer exists (D547)
 *
-* `idle` used to be reachable in five frames: the analyzer's never-moved
-* shortcut called a track stationary the moment its net travel was ~0 after
-* the entering window, without waiting `stationaryThresholdSec`. That is how
-* the 617 phantom voted — tiny vehicle detections at the top of the frame
-* living 1 to 6 seconds, identical boxes under different ids, which tipped the
-* ledger into an entry on 10 agreements (the real cars carried 773 and 1565).
-* The first answer was a second clock in this module (`MIN_STILL_FOR_EVIDENCE_MS`,
-* 10 s) — a copy of the tracker's own dwell, kept in step by hand. The
-* shortcut is gone instead: `idle` now means the per-device
-* `stationaryThresholdSec` has elapsed, on every camera, and this module has
-* no number of its own.
+* The ratio N/M exists to dilute a car that merely drove through the spot.
+* It was also diluting a car that had not yet had the CHANCE to be called
+* still: the five `entered` frames every track begins with, and every frame
+* on which the analyzer's settled test already passed but
+* `stationaryThresholdSec` had not elapsed — `moving` in name only. On a
+* session-dispatched camera those frames are a third of every 36 s track, and
+* a session cut short by a passer-by is made of nothing else. Measured on
+* device 617 (DNRG309, 2026-09-19 20:32 → 09-20 07:53): 13 of the 21 tracks
+* bound to the candidate never reached `idle`, the ledger's ratio was 0.493
+* against 0.6, and a parked car took 11.3 h and 19 tracks to be censused.
 *
-* ## A verdict, not the absence of one
-*
-* `entered` — the five-frame warm-up every track begins with — does not agree
-* on a session frame. Measured on 617 over 12 h (2026-09-15): a car merely
-* passing the edge is gone in ~8 frames, five of them `entered`, and 5/8 = 0.62
-* cleared the 0.6 ratio unaided — an entry born on an empty spot, retired 24
-* absent readings later, one "parked" and one "departed" notification for a
-* passage. A parked car's re-detection loses five observations of ~280.
-*
-* A session observation with NO verdict at all does not agree either. There
-* is no trackless producer any more (the hydrated baseline sampler is gone),
-* so an absent verdict on a session frame is a producer that forgot the
-* field — the one way D494 said this could rot — and it must read as a miss,
-* never as the old geometry-only rule.
+* "Not yet decided" is not evidence either way, so it counts as neither. A
+* subject that is TRAVELLING — `moving` with the settled test failing — still
+* dilutes, so the drive-through case D508 measured (5 `entered` of 8 frames)
+* now scores 0/3 instead of the 5/8 that once minted an entry on an empty spot.
 */
-function observationAgrees(overlap, agreeIou, source, movementState) {
-	if (overlap < agreeIou) return false;
-	if (source === "burst") return true;
-	return movementState === "idle";
+function observationVote(overlap, agreeIou, source, movementState, settling) {
+	if (overlap < agreeIou) return "disagree";
+	if (source === "burst") return "agree";
+	if (movementState === "idle") return "agree";
+	if (movementState === "entered") return "undecided";
+	if (movementState === "moving" && settling) return "undecided";
+	return "disagree";
 }
 /**
 * Fold one observation into a candidate.
 *
-* `agrees` is decided by the CALLER, because M is what makes the ratio mean
+* The `vote` is decided by the CALLER, because M is what makes the ratio mean
 * anything: once a track has bound to a candidate, every later observation of
 * that track counts toward M whether it agrees or not. That is what dilutes a
 * car that merely drove through the spot, and it is why this function cannot
 * re-derive agreement from the box alone.
 */
-function foldObservation(row, observation, agrees, overlap) {
-	const seen = row.seen + 1;
+function foldObservation(row, observation, vote, overlap) {
 	const rotated = rotateWindow(row, observation.timestamp);
-	if (!agrees) return {
+	if (vote === "undecided") return {
+		...rotated,
+		undecided: row.undecided + 1,
+		updatedAt: observation.timestamp
+	};
+	const seen = row.seen + 1;
+	if (vote === "disagree") return {
 		...rotated,
 		seen,
 		windowSeen: rotated.windowSeen + 1,
@@ -60986,6 +61068,7 @@ function newEvidenceRow(observation, anchorId) {
 		...observation.label !== void 0 ? { label: observation.label } : {},
 		sessionAgreed: observation.source === "session" ? 1 : 0,
 		burstAgreed: observation.source === "burst" ? 1 : 0,
+		undecided: 0,
 		updatedAt: observation.timestamp
 	};
 }
@@ -61058,6 +61141,10 @@ var STATIONARY_EVIDENCE_COLUMNS = [
 		name: "burstAgreed",
 		type: "INTEGER"
 	},
+	{
+		name: "undecided",
+		type: "INTEGER"
+	},
 	{
 		name: "updatedAt",
 		type: "INTEGER"
@@ -61105,6 +61192,9 @@ var StationaryEvidenceLedger = class {
 	*  every observation of a box that never changes (3836's jacket is seen five
 	*  times a second in a session), so the line is said once per candidate. */
 	implausibleReported = /* @__PURE__ */ new Set();
+	/** `<deviceId>:<trackId>` of tracks whose first undecided fold was logged
+	*  (D547). Pruned with the bindings in {@link retainTracks}. */
+	undecidedReported = /* @__PURE__ */ new Set();
 	anchorSeq = 0;
 	constructor(deps) {
 		this.logger = deps.logger;
@@ -61133,6 +61223,7 @@ var StationaryEvidenceLedger = class {
 				...row.label !== void 0 ? { label: row.label } : {},
 				sessionAgreed: row.sessionAgreed,
 				burstAgreed: row.burstAgreed,
+				undecided: row.undecided,
 				updatedAt: row.updatedAt
 			}),
 			fromRecord: (key, data) => {
@@ -61166,6 +61257,7 @@ var StationaryEvidenceLedger = class {
 					...label !== void 0 ? { label } : {},
 					sessionAgreed: numberOr(data.sessionAgreed, 0),
 					burstAgreed: numberOr(data.burstAgreed, 0),
+					undecided: numberOr(data.undecided, 0),
 					updatedAt
 				};
 			},
@@ -61300,8 +61392,10 @@ var StationaryEvidenceLedger = class {
 			}
 			if (bindKey !== void 0) this.binding.set(bindKey, row.key);
 		}
-		const agrees = observationAgrees(overlap, policy.agreeIou, observation.source, observation.movementState);
-		const next = foldObservation(row, observation, agrees, overlap);
+		const vote = observationVote(overlap, policy.agreeIou, observation.source, observation.movementState, observation.settling === true);
+		const agrees = vote === "agree";
+		if (vote === "undecided") this.noteUndecided(row, observation);
+		const next = foldObservation(row, observation, vote, overlap);
 		this.ledger.stage(next);
 		this.dirty.add(next.key);
 		if (created) this.capDevice(observation.deviceId);
@@ -61351,6 +61445,10 @@ var StationaryEvidenceLedger = class {
 			if (!bindKey.startsWith(prefix)) continue;
 			if (!liveTrackIds.has(bindKey.slice(prefix.length))) this.binding.delete(bindKey);
 		}
+		for (const key of [...this.undecidedReported]) {
+			if (!key.startsWith(prefix)) continue;
+			if (!liveTrackIds.has(key.slice(prefix.length))) this.undecidedReported.delete(key);
+		}
 	}
 	forgetKey(key) {
 		this.forgetKeyDurable(key);
@@ -61363,6 +61461,32 @@ var StationaryEvidenceLedger = class {
 	* work is never silent (D391), and one that refuses it five times a second
 	* is never loud.
 	*/
+	/**
+	* An undecided observation is dropped from the tally on purpose (D547), and
+	* a branch that drops work says so — once per track, at debug: the same
+	* track offers one every frame until it decides, and a line per frame would
+	* bury what it reports. The lifetime count rides the row (`undecided`).
+	*/
+	noteUndecided(row, observation) {
+		const trackId = observation.trackId;
+		if (trackId === void 0) return;
+		const key = `${observation.deviceId}:${trackId}`;
+		if (this.undecidedReported.has(key)) return;
+		this.undecidedReported.add(key);
+		this.logger.debug("stationary evidence: undecided observation — counted as neither N nor M", {
+			tags: { deviceId: observation.deviceId },
+			meta: {
+				deviceId: observation.deviceId,
+				trackId,
+				candidateKey: row.key,
+				movementState: observation.movementState ?? null,
+				settling: observation.settling === true,
+				agreed: row.agreed,
+				seen: row.seen,
+				undecided: row.undecided
+			}
+		});
+	}
 	noteImplausible(row, frame) {
 		if (this.implausibleReported.has(row.key)) return;
 		this.implausibleReported.add(row.key);
@@ -61435,6 +61559,65 @@ var StationaryEvidenceLedger = class {
 		for (const row of excess) this.forgetKey(row.key);
 	}
 };
+//#endregion
+//#region src/pipeline-analytics/pipeline/stationary/stationary-track-disposal.ts
+function planStationaryTrackDisposal(input) {
+	const trackIds = [input.liveTrackId];
+	if (input.sourceTrackId !== void 0 && input.sourceTrackId !== input.liveTrackId) trackIds.push(input.sourceTrackId);
+	const keepMediaIds = /* @__PURE__ */ new Set();
+	if (input.entryKeyFrameMediaId !== void 0) keepMediaIds.add(input.entryKeyFrameMediaId);
+	return {
+		trackIds,
+		keepMediaIds
+	};
+}
+/**
+* Run the plan. The live track is dropped from RAM FIRST so it can never be
+* persisted by a sweep racing this call; the cascade then removes what every
+* track owned, sparing the entry's key frame, and deletes the row (a no-op for
+* the never-persisted live track).
+*
+* Never silent: the line names the entity, what went and what was kept — a
+* deleted track is dropped work, and the operator asked for it by name.
+*/
+async function disposeStationaryTracks(deps, plan) {
+	const [liveTrackId] = plan.trackIds;
+	if (liveTrackId !== void 0) deps.trackStore.dropActive(liveTrackId);
+	const sparingMedia = { deleteByTracks: (trackIds) => deps.media.deleteByTracks(trackIds, { spare: plan.keepMediaIds }) };
+	const result = await runTrackCascadeBatch({
+		registry: [...deps.leaves, sparingMedia],
+		trackStore: deps.trackStore,
+		deviceId: deps.deviceId,
+		onTrackCleanup: deps.onTrackCleanup,
+		onFailure: (trackId, err) => {
+			deps.logger.warn("stationary promotion: a source track could not be disposed of", {
+				tags: { deviceId: deps.deviceId },
+				meta: {
+					deviceId: deps.deviceId,
+					entryId: deps.entryId,
+					trackId,
+					error: String(err)
+				}
+			});
+		}
+	}, plan.trackIds);
+	deps.logger.info("stationary promotion: source tracks discarded — the entity keeps its key frame", {
+		tags: { deviceId: deps.deviceId },
+		meta: {
+			deviceId: deps.deviceId,
+			entryId: deps.entryId,
+			trackIds: plan.trackIds,
+			keptMediaIds: [...plan.keepMediaIds],
+			deleted: result.deleted,
+			failed: result.failed,
+			mediaRows: result.tally.media
+		}
+	});
+	return {
+		deleted: result.deleted,
+		failed: result.failed
+	};
+}
 /**
 * How long the same weak box must keep being seen before it may re-anchor.
 *
@@ -61614,6 +61797,7 @@ var StationaryObjectRegistry = class {
 	sessionGapMs;
 	warmUpMs;
 	ttlForDevice;
+	onEntryDropped;
 	onChange;
 	requestConfirmationLook;
 	/**
@@ -61707,6 +61891,7 @@ var StationaryObjectRegistry = class {
 		this.sessionGapMs = deps.sessionGapMs ?? 5e3;
 		this.warmUpMs = deps.warmUpMs ?? 2e3;
 		this.ttlForDevice = deps.ttlForDevice;
+		this.onEntryDropped = deps.onEntryDropped;
 		this.onChange = deps.onChange;
 		this.requestConfirmationLook = deps.requestConfirmationLook;
 	}
@@ -62316,6 +62501,7 @@ var StationaryObjectRegistry = class {
 		return at !== void 0 && at > entry.lastConfirmedAt;
 	}
 	dropEntry(deviceId, id) {
+		const dropped = this.ledger.get(id);
 		this.idsByDevice.get(deviceId)?.delete(id);
 		this.dirty.delete(id);
 		this.weakRuns.delete(id);
@@ -62325,6 +62511,7 @@ var StationaryObjectRegistry = class {
 			if (armed.size === 0) this.departureStrikes.delete(deviceId);
 		}
 		this.ledger.forget(id);
+		if (dropped !== void 0) this.onEntryDropped?.(dropped);
 	}
 };
 /** The persisted column map for an entry (the `id` PK is passed separately). */
@@ -68257,8 +68444,10 @@ async function auditScope(scope, deps, limits, cursor) {
 		let liveTracks;
 		const liveEvents = /* @__PURE__ */ new Map();
 		let liveSummaries;
+		let keptMedia = /* @__PURE__ */ new Set();
 		try {
 			liveTracks = trackIds.length > 0 ? await deps.liveTrackIds(trackIds) : /* @__PURE__ */ new Set();
+			if (deps.keptMediaKeys !== void 0 && scope.collection === "pipeline-analytics:media") keptMedia = await deps.keptMediaKeys(rows.map((row) => row.key));
 			for (const [table, ids] of eventIdsByTable) {
 				if (ids.length === 0) continue;
 				liveEvents.set(table, await deps.liveEventIds(table, ids));
@@ -68291,7 +68480,7 @@ async function auditScope(scope, deps, limits, cursor) {
 				tally.unresolvable += 1;
 				continue;
 			}
-			if (ref.kind === "track" ? liveTracks.has(ref.trackId) : ref.kind === "event" ? liveEvents.get(ref.table)?.has(ref.eventId) ?? false : ref.kind === "summary" ? liveSummaries.has(ref.summaryId) : false) continue;
+			if (ref.kind === "track" ? liveTracks.has(ref.trackId) || keptMedia.has(row.key) : ref.kind === "event" ? liveEvents.get(ref.table)?.has(ref.eventId) ?? false : ref.kind === "summary" ? liveSummaries.has(ref.summaryId) : false) continue;
 			const ts = num(row.data, scope.timestampField);
 			if (ts !== null && ts > graceFloor) {
 				tally.withinGrace += 1;
@@ -78025,10 +78214,149 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				const last = track.positions.at(-1)?.bbox;
 				if (!last) return false;
 				return bboxMatchesParkedEntry(last, track.className, this.stationaryRegistry?.listViews(track.deviceId) ?? []);
-			}
+			},
+			discardTracks: (tracks) => this.cascadeDiscardedTracks(tracks)
 		});
 		return this._trackCloser;
 	}
+	/**
+	* Cascade what `expireStale` refused to persist (D547): scenery re-fires and
+	* re-sightings of a censused object. Per device, per track, through the
+	* shipped registry — never a raw delete — so the vector, the crops and the
+	* events go with the media. A track whose cascade fails is named.
+	*/
+	async cascadeDiscardedTracks(tracks) {
+		const cascade = this.buildTrackCascadeRegistry();
+		if (!cascade) {
+			this.ctx.logger.warn("discarded tracks could not be cascaded — stores not ready", { meta: { trackIds: tracks.map((t) => t.trackId) } });
+			return;
+		}
+		const byDevice = /* @__PURE__ */ new Map();
+		for (const t of tracks) {
+			const ids = byDevice.get(t.deviceId) ?? [];
+			ids.push(t.trackId);
+			byDevice.set(t.deviceId, ids);
+		}
+		for (const [deviceId, trackIds] of byDevice) {
+			const result = await runTrackCascadeBatch({
+				registry: cascade.registry,
+				trackStore: cascade.trackStore,
+				deviceId,
+				onTrackCleanup: (id, trackId) => this.clearLiveTrackState(id, trackId),
+				onFailure: (trackId, err) => {
+					this.ctx.logger.warn("discarded track could not be cascaded", {
+						tags: { deviceId },
+						meta: {
+							deviceId,
+							trackId,
+							error: String(err)
+						}
+					});
+				}
+			}, trackIds);
+			this.ctx.logger.info("tracks discarded on expiry — still objects are entities, not tracks", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					trackIds,
+					deleted: result.deleted,
+					failed: result.failed,
+					mediaRows: result.tally.media
+				}
+			});
+		}
+	}
+	/**
+	* Dispose of the tracks that carried a promoted candidate's evidence (D547):
+	* the one alive on the tipping frame and the persisted source of the entry's
+	* best box. The entry's key frame is spared — it is the one row the entity
+	* vouches for, and `keptStationaryMediaKeys` keeps the orphan audit off it.
+	*/
+	async disposePromotedTracks(deviceId, entry, liveTrackId, sourceTrackId) {
+		const cascade = this.buildTrackCascadeRegistry();
+		const mediaStore = this.mediaStore;
+		if (!cascade || !mediaStore) {
+			this.ctx.logger.warn("stationary promotion: source tracks could not be disposed of — stores not ready", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					entryId: entry.id,
+					liveTrackId,
+					sourceTrackId: sourceTrackId ?? null
+				}
+			});
+			return;
+		}
+		const plan = planStationaryTrackDisposal({
+			liveTrackId,
+			...sourceTrackId !== void 0 ? { sourceTrackId } : {},
+			...entry.keyFrameMediaId !== void 0 ? { entryKeyFrameMediaId: entry.keyFrameMediaId } : {}
+		});
+		await disposeStationaryTracks({
+			deviceId,
+			entryId: entry.id,
+			leaves: cascade.registry.filter((leaf) => leaf !== mediaStore),
+			media: mediaStore,
+			trackStore: cascade.trackStore,
+			onTrackCleanup: (id, trackId) => this.clearLiveTrackState(id, trackId),
+			logger: this.ctx.logger
+		}, plan);
+	}
+	/**
+	* Media row keys a live stationary entry vouches for (D547) — the orphan
+	* audit's probe. Answered from the registry's RAM index, which is the
+	* authority on which entries are alive.
+	*/
+	keptStationaryMediaKeys(keys) {
+		const registry = this.stationaryRegistry;
+		if (!registry) return /* @__PURE__ */ new Set();
+		const held = /* @__PURE__ */ new Set();
+		for (const deviceId of registry.deviceIds()) for (const entry of registry.list(deviceId)) if (entry.keyFrameMediaId !== void 0) held.add(String(entry.keyFrameMediaId));
+		return new Set(keys.filter((key) => held.has(key)));
+	}
+	/**
+	* An entry left the registry: free the key frame it vouched for (D547),
+	* unless another live entry still holds it or a track row still owns it
+	* (then retention's cascade will). Never silent either way.
+	*/
+	async releaseStationaryKeyFrame(entry) {
+		const mediaId = entry.keyFrameMediaId;
+		if (mediaId === void 0) return;
+		const deviceId = entry.deviceId;
+		const registry = this.stationaryRegistry;
+		const mediaStore = this.mediaStore;
+		const trackStore = this.trackStore;
+		if (!registry || !mediaStore || !trackStore) return;
+		if (registry.list(deviceId).some((e) => e.keyFrameMediaId === mediaId)) return;
+		try {
+			const owner = await mediaStore.ownerOf(mediaId);
+			if (owner === null) return;
+			if (owner.ownerKind === "track") {
+				if ((await trackStore.existingTrackIds([owner.ownerId])).has(owner.ownerId)) return;
+			}
+			await mediaStore.deleteById(mediaId);
+			this.ctx.logger.info("stationary entry released its key frame", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					entryId: entry.id,
+					mediaId,
+					ownerKind: owner.ownerKind,
+					ownerId: owner.ownerId
+				}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("stationary entry key frame could not be released", {
+				tags: { deviceId },
+				meta: {
+					deviceId,
+					entryId: entry.id,
+					mediaId,
+					error: String(err)
+				}
+			});
+		}
+	}
 	/** Master toggle for the migrated object/face EmbeddingDispatcher. Read at
 	*  init; a change takes effect on addon restart (same convention as
 	*  `postProcessingNodeId`).
@@ -78754,6 +79082,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			store: api.settingsStore,
 			logger: logger.child("StationaryRegistry"),
 			ttlForDevice: (deviceId) => this.stationarySettingsFromCache(deviceId).entryTtlMs,
+			onEntryDropped: (entry) => {
+				this.releaseStationaryKeyFrame(entry);
+			},
 			requestConfirmationLook: (ask) => this.requestConfirmationLook(ask),
 			onChange: ({ phase, entry, timestamp, observedAt }) => {
 				this.ctx.eventBus.emit({
@@ -80142,6 +80473,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 							anchor: { ...row.anchor },
 							agreed: row.agreed,
 							seen: row.seen,
+							undecided: row.undecided,
 							ratio: row.seen > 0 ? row.agreed / row.seen : 0,
 							spanMs: row.lastAgreedAt - row.firstAgreedAt,
 							firstAgreedAt: row.firstAgreedAt,
@@ -81542,7 +81874,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					frameHeight: result.frameHeight,
 					...observedKeyFrame !== void 0 ? { keyFrameMediaId: observedKeyFrame } : {},
 					...observedLabel !== void 0 ? { label: observedLabel } : {},
-					...movementState !== void 0 ? { movementState } : {}
+					...movementState !== void 0 ? { movementState } : {},
+					settling: t.settling
 				};
 				const outcome = evidence.observe(observation);
 				if (outcome === void 0 || !outcome.promoted) continue;
@@ -84692,17 +85025,6 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			wakeAssocIou: gate.wakeAssocIou
 		});
 		processor.dropTrack(track.trackId);
-		this.trackStore?.closeActive(track.trackId, "stationary-promotion").catch((err) => {
-			this.ctx.logger.warn("stationary promotion: closing the source track failed — its media, events and vector are now unowned", {
-				tags: { deviceId },
-				meta: {
-					deviceId,
-					trackId: track.trackId,
-					entryId: entry.id,
-					error: String(err)
-				}
-			});
-		});
 		const faceEnd = this.faceRecognizer?.onTrackEnd(deviceId, track.trackId);
 		const dropKeyFrame = () => {
 			this.residents.dropKeyFrameMediaId(track.trackId);
@@ -84710,7 +85032,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		if (faceEnd) faceEnd.finally(dropKeyFrame);
 		else dropKeyFrame();
 		const promotedPath = this.trackStore?.getActiveByTrack(track.trackId)?.positions;
-		this.plateRecognizer?.onTrackEnd(deviceId, track.trackId, promotedPath);
+		const plateEnd = this.plateRecognizer?.onTrackEnd(deviceId, track.trackId, promotedPath);
+		Promise.allSettled([faceEnd, plateEnd]).then(() => this.disposePromotedTracks(deviceId, entry, track.trackId, row.sourceTrackId));
 		this.residents.close(track.trackId, "stationary");
 		this.detailDispatcher?.onTrackEnded(deviceId, track.trackId);
 		this.overlayState.onTrackEnded(deviceId, track.trackId);
@@ -85653,6 +85976,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					if (!summaries) throw new Error("summary store not built — probe unavailable");
 					return summaries.existingIds(ids);
 				},
+				keptMediaKeys: async (keys) => this.keptStationaryMediaKeys(keys),
 				reclaim: buildOrphanReclaimer({
 					deleteFace: async (faceId) => {
 						await this.faceStore?.delete(faceId);