@camstack/addon-post-analysis 1.2.306 → 1.2.308

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as NC_AUDIO_CONFIRM_WINDOW_SEC_DEFAULT, $n as ruleDeviceCompatCapQueries, $t as TimelapseRuleInputSchema, A as EMBEDDING_REQUIREMENTS_FAILED, An as isDetectionMacroClass, Ar as ZodObject, At as NcTemplateVarDescriptorSchema, B as ListTrackRelationsInputSchema, Bn as memoizePinnedFfmpeg, Br as record, Bt as SCENE_DEFAULT_ANCHOR_THRESHOLD, C as DEFAULT_EVENT_COLOR, Cn as encodeVectorBase64, Cr as customAction, Ct as NcSnoozeInputSchema, D as DeclaredDevices, Dn as gifDeriveSpeed, Dr as nodePin, Dt as NcTaxonomySchema, E as DETECTION_PIPELINE_CAP_NAME, En as failureContributionCapability, Er as isDeviceScopedCap, Et as NcSystemEventKindSchema, F as EXPORT_DENSE_MAX_RANGES, Fn as isSystemDelivery, Fr as literal, Ft as RECORDING_SOURCE_CAMSTACK_ADDON, G as MAX_BIRTH_LATENCY_PROXY_MS, Gn as plateGalleryCapability, Gr as unknown, Gt as SCENE_DIVERGED, H as LockStateSchema, Hn as occupancyScope, Hr as string, Ht as SCENE_DEFAULT_OBSERVATION_SPACING_SEC, I as FIRST_LEVEL_MACRO_CLASSES, In as isSystemEventSummaryRule, Ir as looseObject, It as RebuildObjectEmbeddingsRefusalSchema, J as MOTION_CLOSE_AFTER_MS, Jn as readTimelapseGeneratedAt, Jt as SetTrackPurityInputSchema, K as MAX_TRACK_PURITIES, Kn as readDeviceStateFrom, Kr as EventCategory, Kt as SCENE_RESET_RECAPTURES, L as FULL_IMAGE_BBOX, Ln as isVectorIndexDimConflict, Lr as number, Lt as RetrainStatusSchema, M as EVENT_DENSITY_BATCH_MAX, Mn as isKnownTemplateVar, Mr as array, Mt as OpsLogEntrySchema, N as EVENT_KIND_BY_CAP, Nn as isMediaOwnerType, Nr as boolean, O as DetectionSourceSchema, On as gifFromMp4Args, Ot as NcTemplatePreviewInputSchema, P as EVENT_OWNER_TYPES, Pn as isScheduleActive, Pr as discriminatedUnion, Pt as RECORDING_EXPORT_MAX_READ_BYTES, Q as NC_AUDIO_CONFIRM_HITS_DEFAULT, Qn as ruleBelongsToAlarm$1, Qt as TRACK_RELATIONS_DEFAULT_LIMIT, R as FailureCounters, Rn as kebabToCamel, Rr as object, Rt as SCENE_CONFIRM_DEFAULT_MAX_IMAGE_PX, S as CoverStateSchema, Sr as createEvent, St as NcScheduleSchema, T as DETECTION_MACRO_CLASSES, Tn as faceGalleryCapability, Tr as hydrateSchema, Tt as NcSnoozeSuppressedSchema, U as MAX_ARCHIVED_DEBUG_NOTES, Ur as tuple, Ut as SCENE_DEFAULT_QUIET_SECONDS, V as ListTrackRelationsResultSchema, Vn as notificationRulesCapability, Vr as strictObject, Vt as SCENE_DEFAULT_CHECK_INTERVAL_SEC, W as MAX_BIRTH_DECISION_RECORDS, Wn as pipelineAnalyticsCapability, Wr as union, Wt as SCENE_DEFAULT_UNCOVERED_POLICY, X as MotionTriggeredBySchema, Xn as resolveLocationMode, Xt as SetTrackRelationInputSchema, Y as MediaFileKindEnum, Yn as resolveClipSearchMinScore, Yt as SetTrackPurityResultSchema, Z as NC_ALARM_SYSTEM_EVENT_KINDS, Zt as TIMELAPSE_DENSE_FLOOR_SEC, _ as BaseDevice, _n as describeSystemEventFamilyProblem, _r as isSourceCap, _t as NcRuleInputSchema, a as CLIP_EMBEDDING_STEP_ID, an as TrackSideSchema, ar as subKindsOf, at as NC_CONSUMABLE_SYSTEM_EVENT_KINDS, b as ClearTrackRelationInputSchema, bn as embeddingRefusalOf, br as BaseAddon, bt as NcRuleTargetSchema, c as resolveClusterModelPin, cn as alarmPanelCapability, cr as systemEventFilterApplies, ct as NC_SNOOZE_MAX_MINUTES, d as APPEARANCE_RESOLVES_AMBIGUITY_DEFAULT, dn as audioModeOf, dr as templateVarsFor, dt as NC_TAXONOMY, en as TimelapseRulePatchSchema, er as ruleKindOf, et as NC_CLIP_POST_ROLL_DEFAULT_SEC, f as ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT, fn as buildEventKindDescriptor, fr as vectorDimFromBase64, ft as NC_TEMPLATE_VARS, g as BIRTH_DECISION_DEFAULT_LIMIT, gn as describeSystemEventDeliveryProblem, gr as evaluateSensorEdge, gt as NcConditionsSchema, h as ArchivedDebugNoteSchema, hn as deriveRecordingMode, hr as canonicalHash, ht as NcConditionDescriptorSchema, in as TrackRelationSchema, ir as storageOccupancyCapability, it as NC_CONSUMABLE_LOW_PERCENT_DEFAULT, j as EMBEDDING_REQUIREMENTS_UNAVAILABLE, jn as isEventOwnerType, jr as _enum, jt as OPS_LOG_DEFAULT_LIMIT, k as EMBEDDING_MODEL_FAILED, kn as isAudioClassName, kr as sleep$1, kt as NcTemplatePreviewSchema, l as APPEARANCE_BIN_COUNT, ln as assertTimelapseCadences, lr as systemEventSummaryScheduleOf, lt as NC_SYSTEM_EVENT_KIND_GROUP_SPECS, m as AlarmArmModeSchema, mn as cosineSimilarity$1, mr as DEFAULT_FIRST_SIGHTING_FRESHNESS_MS, mt as NcAlarmSettingsPatchSchema, nn as TrackPuritySchema, nr as sensorRaisedOf, nt as NC_CLIP_RETENTION_MAX_SEC, o as FACE_EMBEDDING_STEP_ID, on as TrackSourceSchema, or as systemEventDeliveryProblems, ot as NC_DEFAULT_SNOOZE_MINUTES, p as AUDIO_MACRO_LABELS, pn as consumableLowPercentOf, pr as zoneAnalyticsCapability, pt as NcAlarmConfigSchema, q as MAX_TRACK_RELATIONS, qn as readMotionTriggeredBy, qt as SceneMonitorSchema, rn as TrackRelationKindSchema, rr as servedTemplateVars, rt as NC_CONDITION_CATALOG, s as readClusterModelPinStrict, sn as addonWidgetsSourceCapability, sr as systemEventFamilyProblems, st as NC_SENSOR_TRANSITION_KINDS, t as BUILTIN_CLIP_MODELS, tn as TimelapseRuleSchema, tr as sceneMonitorCapability, tt as NC_CLIP_PRE_ROLL_DEFAULT_SEC, u as APPEARANCE_BLOCKS, un as audioMetricsCapability, ur as templateCarriesSummary, ut as NC_TANK_SYSTEM_EVENT_KINDS, v as BirthDecisionRecordSchema, vr as DeviceType, vt as NcRulePatchSchema, w as DEFAULT_TIMELAPSE_PREVIEW_TEXT, wn as evictionPolicyOfLocation, wr as defineCustomActions, wt as NcSnoozeSchema, x as ClearTrackRelationResultSchema, xr as CamProfileSchema, xt as NcRuleUpdateInputSchema, y as COCO_TO_MACRO, yr as errMsg, yt as NcRuleSchema, z as LabelAttributionSchema, zn as mayWriteToLocation, zr as partialRecord, zt as SCENE_CONFIRM_DEFAULT_TIMEOUT_MS } from "../clip-model-registry-C9Aw4qkh.mjs";
+import { $ as NC_AUDIO_CONFIRM_WINDOW_SEC_DEFAULT, $n as ruleDeviceCompatCapQueries, $t as TimelapseRuleInputSchema, A as EMBEDDING_REQUIREMENTS_FAILED, An as isDetectionMacroClass, Ar as ZodObject, At as NcTemplateVarDescriptorSchema, B as ListTrackRelationsInputSchema, Bn as memoizePinnedFfmpeg, Br as record, Bt as SCENE_DEFAULT_ANCHOR_THRESHOLD, C as DEFAULT_EVENT_COLOR, Cn as encodeVectorBase64, Cr as customAction, Ct as NcSnoozeInputSchema, D as DeclaredDevices, Dn as gifDeriveSpeed, Dr as nodePin, Dt as NcTaxonomySchema, E as DETECTION_PIPELINE_CAP_NAME, En as failureContributionCapability, Er as isDeviceScopedCap, Et as NcSystemEventKindSchema, F as EXPORT_DENSE_MAX_RANGES, Fn as isSystemDelivery, Fr as literal, Ft as RECORDING_SOURCE_CAMSTACK_ADDON, G as MAX_BIRTH_LATENCY_PROXY_MS, Gn as plateGalleryCapability, Gr as unknown, Gt as SCENE_DIVERGED, H as LockStateSchema, Hn as occupancyScope, Hr as string, Ht as SCENE_DEFAULT_OBSERVATION_SPACING_SEC, I as FIRST_LEVEL_MACRO_CLASSES, In as isSystemEventSummaryRule, Ir as looseObject, It as RebuildObjectEmbeddingsRefusalSchema, J as MOTION_CLOSE_AFTER_MS, Jn as readTimelapseGeneratedAt, Jt as SetTrackPurityInputSchema, K as MAX_TRACK_PURITIES, Kn as readDeviceStateFrom, Kr as EventCategory, Kt as SCENE_RESET_RECAPTURES, L as FULL_IMAGE_BBOX, Ln as isVectorIndexDimConflict, Lr as number, Lt as RetrainStatusSchema, M as EVENT_DENSITY_BATCH_MAX, Mn as isKnownTemplateVar, Mr as array, Mt as OpsLogEntrySchema, N as EVENT_KIND_BY_CAP, Nn as isMediaOwnerType, Nr as boolean, O as DetectionSourceSchema, On as gifFromMp4Args, Ot as NcTemplatePreviewInputSchema, P as EVENT_OWNER_TYPES, Pn as isScheduleActive, Pr as discriminatedUnion, Pt as RECORDING_EXPORT_MAX_READ_BYTES, Q as NC_AUDIO_CONFIRM_HITS_DEFAULT, Qn as ruleBelongsToAlarm$1, Qt as TRACK_RELATIONS_DEFAULT_LIMIT, R as FailureCounters, Rn as kebabToCamel, Rr as object, Rt as SCENE_CONFIRM_DEFAULT_MAX_IMAGE_PX, S as CoverStateSchema, Sr as createEvent, St as NcScheduleSchema, T as DETECTION_MACRO_CLASSES, Tn as faceGalleryCapability, Tr as hydrateSchema, Tt as NcSnoozeSuppressedSchema, U as MAX_ARCHIVED_DEBUG_NOTES, Ur as tuple, Ut as SCENE_DEFAULT_QUIET_SECONDS, V as ListTrackRelationsResultSchema, Vn as notificationRulesCapability, Vr as strictObject, Vt as SCENE_DEFAULT_CHECK_INTERVAL_SEC, W as MAX_BIRTH_DECISION_RECORDS, Wn as pipelineAnalyticsCapability, Wr as union, Wt as SCENE_DEFAULT_UNCOVERED_POLICY, X as MotionTriggeredBySchema, Xn as resolveLocationMode, Xt as SetTrackRelationInputSchema, Y as MediaFileKindEnum, Yn as resolveClipSearchMinScore, Yt as SetTrackPurityResultSchema, Z as NC_ALARM_SYSTEM_EVENT_KINDS, Zt as TIMELAPSE_DENSE_FLOOR_SEC, _ as BaseDevice, _n as describeSystemEventFamilyProblem, _r as isSourceCap, _t as NcRuleInputSchema, a as CLIP_EMBEDDING_STEP_ID, an as TrackSideSchema, ar as subKindsOf, at as NC_CONSUMABLE_SYSTEM_EVENT_KINDS, b as ClearTrackRelationInputSchema, bn as embeddingRefusalOf, br as BaseAddon, bt as NcRuleTargetSchema, c as resolveClusterModelPin, cn as alarmPanelCapability, cr as systemEventFilterApplies, ct as NC_SNOOZE_MAX_MINUTES, d as APPEARANCE_RESOLVES_AMBIGUITY_DEFAULT, dn as audioModeOf, dr as templateVarsFor, dt as NC_TAXONOMY, en as TimelapseRulePatchSchema, er as ruleKindOf, et as NC_CLIP_POST_ROLL_DEFAULT_SEC, f as ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT, fn as buildEventKindDescriptor, fr as vectorDimFromBase64, ft as NC_TEMPLATE_VARS, g as BIRTH_DECISION_DEFAULT_LIMIT, gn as describeSystemEventDeliveryProblem, gr as evaluateSensorEdge, gt as NcConditionsSchema, h as ArchivedDebugNoteSchema, hn as deriveRecordingMode, hr as canonicalHash, ht as NcConditionDescriptorSchema, in as TrackRelationSchema, ir as storageOccupancyCapability, it as NC_CONSUMABLE_LOW_PERCENT_DEFAULT, j as EMBEDDING_REQUIREMENTS_UNAVAILABLE, jn as isEventOwnerType, jr as _enum, jt as OPS_LOG_DEFAULT_LIMIT, k as EMBEDDING_MODEL_FAILED, kn as isAudioClassName, kr as sleep$1, kt as NcTemplatePreviewSchema, l as APPEARANCE_BIN_COUNT, ln as assertTimelapseCadences, lr as systemEventSummaryScheduleOf, lt as NC_SYSTEM_EVENT_KIND_GROUP_SPECS, m as AlarmArmModeSchema, mn as cosineSimilarity$1, mr as DEFAULT_FIRST_SIGHTING_FRESHNESS_MS, mt as NcAlarmSettingsPatchSchema, nn as TrackPuritySchema, nr as sensorRaisedOf, nt as NC_CLIP_RETENTION_MAX_SEC, o as FACE_EMBEDDING_STEP_ID, on as TrackSourceSchema, or as systemEventDeliveryProblems, ot as NC_DEFAULT_SNOOZE_MINUTES, p as AUDIO_MACRO_LABELS, pn as consumableLowPercentOf, pr as zoneAnalyticsCapability, pt as NcAlarmConfigSchema, q as MAX_TRACK_RELATIONS, qn as readMotionTriggeredBy, qt as SceneMonitorSchema, rn as TrackRelationKindSchema, rr as servedTemplateVars, rt as NC_CONDITION_CATALOG, s as readClusterModelPinStrict, sn as addonWidgetsSourceCapability, sr as systemEventFamilyProblems, st as NC_SENSOR_TRANSITION_KINDS, t as BUILTIN_CLIP_MODELS, tn as TimelapseRuleSchema, tr as sceneMonitorCapability, tt as NC_CLIP_PRE_ROLL_DEFAULT_SEC, u as APPEARANCE_BLOCKS, un as audioMetricsCapability, ur as templateCarriesSummary, ut as NC_TANK_SYSTEM_EVENT_KINDS, v as BirthDecisionRecordSchema, vr as DeviceType, vt as NcRulePatchSchema, w as DEFAULT_TIMELAPSE_PREVIEW_TEXT, wn as evictionPolicyOfLocation, wr as defineCustomActions, wt as NcSnoozeSchema, x as ClearTrackRelationResultSchema, xr as CamProfileSchema, xt as NcRuleUpdateInputSchema, y as COCO_TO_MACRO, yr as errMsg, yt as NcRuleSchema, z as LabelAttributionSchema, zn as mayWriteToLocation, zr as partialRecord, zt as SCENE_CONFIRM_DEFAULT_TIMEOUT_MS } from "../clip-model-registry-FGOIz3PZ.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs$1 from "node:fs";
 import { createWriteStream, promises } from "node:fs";
@@ -20048,6 +20048,114 @@ function ncGroupSubjectText(texts, input) {
 	return texts.join([...names, ...others]);
 }
 //#endregion
+//#region src/notification-center/outbox-key.ts
+/**
+* The record kinds whose `recordId` is a per-table SQLite rowid (D474), and so
+* may be reused after a delete. `device-event` is NOT one: sensor events are
+* TEXT-keyed with a producer-minted id (`sensor-event-store.ts`).
+*/
+var ROWID_RECORD_KINDS = new Set([
+	"object-event",
+	"package-event",
+	"audio-event"
+]);
+/** Is this kind's record id a reusable rowid? See {@link ROWID_RECORD_KINDS}. */
+function isRowidRecordKind(kind) {
+	return ROWID_RECORD_KINDS.has(kind);
+}
+/** The record identity an outbox key input speaks for. */
+function outboxRecordIdentity(input) {
+	return {
+		recordId: input.recordId,
+		deviceId: input.deviceId,
+		recordAt: input.payload.subject.timestamp
+	};
+}
+/**
+* The record GENERATION ref — `<recordId>@<deviceId>:<recordAt>`. Exported for
+* the specs and for a caller that must name a rowid record outside the outbox
+* (none today); a key is always built through {@link outboxEntryId}.
+*/
+function recordGenerationRef(record) {
+	return `${record.recordId}@${String(record.deviceId)}:${String(record.recordAt)}`;
+}
+/**
+* The middle segment of the dedup id:
+*
+*  1. an explicit `dedupRef` (upgrade / burst revision);
+*  2. the track id — `maxPerTrack: 1` (a track id is random, never reused);
+*  3. for a rowid record, its generation ref;
+*  4. the record id as is (synthetic ids already carry device + instant).
+*/
+function outboxDedupRef(input) {
+	if (input.dedupRef !== void 0) return input.dedupRef;
+	if (input.trackId !== void 0) return input.trackId;
+	if (isRowidRecordKind(input.recordKind)) return recordGenerationRef(outboxRecordIdentity(input));
+	return input.recordId;
+}
+/** The outbox row id — the durable per-track / per-record fire guarantee. */
+function outboxEntryId(input) {
+	return `${input.ruleId}:${outboxDedupRef(input)}:${input.targetId}`;
+}
+/**
+* The id this input had BEFORE D694 — but only when it differs from today's,
+* i.e. for a rowid record keyed on its record id. `null` otherwise: there is no
+* older spelling to look for.
+*/
+function legacyOutboxEntryId(input) {
+	if (input.dedupRef !== void 0 || input.trackId !== void 0) return null;
+	if (!isRowidRecordKind(input.recordKind)) return null;
+	return `${input.ruleId}:${input.recordId}:${input.targetId}`;
+}
+/**
+* A STORED row's id as it would be built today, when the row was written under
+* the pre-D694 spelling; `null` when the stored id is already current (or was
+* built from an explicit dedup ref, which a row does not record and which never
+* involved the record id).
+*/
+function translatedLegacyEntryId(storedId, row) {
+	const legacy = legacyOutboxEntryId(row);
+	if (legacy === null || legacy !== storedId) return null;
+	return outboxEntryId(row);
+}
+/**
+* Does a STORED row's payload really carry its record timestamp?
+*
+* The type says it always does, but a stored payload is checked only as an
+* object on the way back from the store (`rowToEntry`), so a malformed or very
+* old row can lack `subject`. Every read of {@link outboxRecordIdentity} on a
+* STORED row is preceded by this check. Takes the payload as `unknown` on
+* purpose: the static type cannot answer the question.
+*/
+function hasRecordTimestamp(payload) {
+	if (typeof payload !== "object" || payload === null || !("subject" in payload)) return false;
+	const subject = payload.subject;
+	return typeof subject === "object" && subject !== null && "timestamp" in subject && typeof subject.timestamp === "number";
+}
+/** Do two rows speak for the same RECORD? Id, camera and record timestamp. */
+function isSameOutboxRecord(a, b) {
+	return a.recordId === b.recordId && a.deviceId === b.deviceId && a.recordAt === b.recordAt;
+}
+/**
+* The scope of the event a payload's `eventId` names.
+*
+* Usually the row's own subject. A COMBINED alarm row is the exception: its
+* subject is the alarm transition (its own instant), while its `eventId` is the
+* triggering rule's event — so the generation is the alarm SOURCE's camera and
+* timestamp (`NcRuleFireRef`), never the transition's.
+*/
+function eventMediaScopeOf(subject) {
+	const source = subject.systemEvent?.alarmSource;
+	if (source !== void 0) return {
+		deviceId: source.deviceId,
+		recordAt: source.timestamp
+	};
+	return {
+		deviceId: subject.deviceId,
+		recordAt: subject.timestamp
+	};
+}
+//#endregion
 //#region src/notification-center/footage-source.ts
 /**
 * Decide where this window must be cut from. Pure and total.
@@ -22013,7 +22121,7 @@ var NcDispatcher = class {
 		});
 		if (policy === "keyFrame" || frame === "full" || frame === "boxed") owners.reverse();
 		for (const owner of owners) try {
-			const files = await this.deps.getMediaForOwner(owner.kind, owner.id);
+			const files = owner.kind === "object" ? await this.deps.getMediaForOwner(owner.kind, owner.id, eventMediaScopeOf(subject)) : await this.deps.getMediaForOwner(owner.kind, owner.id);
 			if (files.length === 0) continue;
 			const preference = frame !== void 0 ? framePreference(frame, owner.kind) : policy === "best-matching" ? bestMatchingKindPreference(signal, owner.kind) : attachmentKindPreference(policy, owner.kind);
 			const ordered = [];
@@ -24298,11 +24406,6 @@ var DEFAULT_MAX_ATTEMPTS = 8;
 var DEFAULT_DRAIN_BATCH = 20;
 /** Dedup ids remembered at boot — bounded to recent rows (dedup horizon). */
 var DEDUP_HYDRATE_WINDOW_MS = 168 * 36e5;
-/** Stable dedup id — the durable per-track/per-record fire guarantee. */
-function outboxEntryId(input) {
-	const dedupRef = input.dedupRef ?? input.trackId ?? input.recordId;
-	return `${input.ruleId}:${dedupRef}:${input.targetId}`;
-}
 var NcOutbox = class {
 	pending = /* @__PURE__ */ new Map();
 	/** Every id ever enqueued within the dedup horizon (incl. sent/dead). */
@@ -24379,20 +24482,27 @@ var NcOutbox = class {
 				}
 			});
 			let superseded = 0;
+			let translated = 0;
 			for (const row of rows) {
-				if (this.knownIds.has(row.id)) {
+				const entry = rowToEntry$1(row.id, row.data);
+				const current = entry === null ? null : this.translateLegacy(row.id, entry);
+				if (this.knownIds.has(row.id) || current !== null && this.knownIds.has(current)) {
 					superseded += 1;
 					continue;
 				}
 				this.knownIds.add(row.id);
-				const entry = rowToEntry$1(row.id, row.data);
+				if (current !== null) {
+					this.knownIds.add(current);
+					translated += 1;
+				}
 				if (entry !== null && entry.status === "pending") this.pending.set(entry.id, entry);
 			}
 			this.horizonLoaded = true;
 			this.logger.info("notification outbox loaded", { meta: {
 				pending: this.pending.size,
 				known: this.knownIds.size,
-				superseded
+				superseded,
+				translated
 			} });
 		} catch (err) {
 			this.logger.warn("notification outbox load failed", { meta: { error: String(err) } });
@@ -24416,7 +24526,7 @@ var NcOutbox = class {
 		for (const input of inputs) {
 			const id = outboxEntryId(input);
 			if (this.knownIds.has(id)) continue;
-			if (!this.horizonLoaded && await this.rowExists(id)) {
+			if (!this.horizonLoaded && await this.alreadyStored(id, input)) {
 				this.knownIds.add(id);
 				this.logger.info("outbox enqueue deduped against the store — the horizon is still cold", {
 					tags: { deviceId: input.deviceId },
@@ -24633,7 +24743,7 @@ var NcOutbox = class {
 	*/
 	async supersede(input) {
 		const wanted = new Set(input.targetIds);
-		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && e.recordId === input.recordId && wanted.has(e.targetId));
+		const victims = [...this.pending.values()].filter((e) => e.ruleId === input.ruleId && wanted.has(e.targetId) && hasRecordTimestamp(e.payload) && isSameOutboxRecord(outboxRecordIdentity(e), input));
 		let dropped = 0;
 		for (const entry of victims) try {
 			await this.store.delete.mutate({
@@ -24749,6 +24859,81 @@ var NcOutbox = class {
 		await this.mutate(retry);
 	}
 	/**
+	* Cold-horizon dedup: is this intent already a row in the store?
+	*
+	* Today's id first. Then, for a rowid record, the pre-D694 spelling — which
+	* is accepted ONLY when the row found speaks for the SAME record (camera and
+	* record timestamp too). A legacy row of a different record that reused the
+	* rowid is exactly the collision D694 removes, and must not swallow this one.
+	*/
+	async alreadyStored(id, input) {
+		if (await this.rowExists(id)) return true;
+		const legacy = legacyOutboxEntryId(input);
+		if (legacy === null) return false;
+		const row = await this.readRow(legacy);
+		if (row === null) return false;
+		if (!hasRecordTimestamp(row.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — not used for dedup", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					id,
+					legacyId: legacy,
+					ruleId: input.ruleId
+				}
+			});
+			return false;
+		}
+		if (isSameOutboxRecord(outboxRecordIdentity(row), outboxRecordIdentity(input))) return true;
+		this.logger.info("outbox: a pre-D694 row shares this rowid but is a different record — not a duplicate", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				id,
+				legacyId: legacy,
+				legacyDeviceId: row.deviceId,
+				ruleId: input.ruleId
+			}
+		});
+		return false;
+	}
+	/**
+	* The id a stored pre-D694 row would have today, or `null`.
+	*
+	* Guarded per row: a stored payload is validated only as an object
+	* (`rowToEntry`), and a row with no `subject.timestamp` would otherwise throw
+	* inside {@link load} and leave the WHOLE dedup horizon cold. Such a row is
+	* still loaded under its stored id; it just gets no translated twin.
+	*/
+	translateLegacy(storedId, entry) {
+		if (legacyOutboxEntryId(entry) !== storedId) return null;
+		if (!hasRecordTimestamp(entry.payload)) {
+			this.logger.warn("outbox: a pre-D694 row carries no record timestamp — loaded without translation", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					id: storedId,
+					ruleId: entry.ruleId
+				}
+			});
+			return null;
+		}
+		return translatedLegacyEntryId(storedId, entry);
+	}
+	/** One stored row by id, or `null` (absent, unreadable, or a failed read). */
+	async readRow(id) {
+		try {
+			const row = await this.store.get.query({
+				collection: NC_OUTBOX_COLLECTION,
+				key: id
+			});
+			return isStoredRow(row) ? rowToEntry$1(id, row) : null;
+		} catch (err) {
+			this.logger.debug("outbox cold-horizon dedup read failed", { meta: {
+				id,
+				error: String(err)
+			} });
+			return null;
+		}
+	}
+	/**
 	* Does a row already exist under this dedup id?
 	*
 	* Asked ONLY while {@link horizonLoaded} is false. {@link persist} writes
@@ -24842,6 +25027,10 @@ var OUTBOX_RECORD_KINDS = new Set([
 function isOutboxRecordKind(x) {
 	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
 }
+/** `settingsStore.get` answers `unknown` — a guard, never a cast. */
+function isStoredRow(x) {
+	return typeof x === "object" && x !== null && !Array.isArray(x);
+}
 /** A stored row back to an entry — a guard, never a cast. Exported for the
 *  specs that read the store a centre wrote to. */
 function rowToEntry$1(id, data) {
@@ -33208,7 +33397,7 @@ var NotificationCenter = class NotificationCenter {
 			...deps.dispatcher,
 			logger: this.logger.child("dispatch"),
 			texts: this.texts,
-			getMediaForOwner: async (ownerKind, ownerId) => {
+			getMediaForOwner: async (ownerKind, ownerId, eventScope) => {
 				const held = isSyntheticId(ownerId) ? this.syntheticMedia.get(ownerId) : void 0;
 				if (held !== void 0) return held.files;
 				const shelved = isStillShelfId(ownerId) ? this.stills?.get(ownerId) : void 0;
@@ -33217,7 +33406,7 @@ var NotificationCenter = class NotificationCenter {
 				if (linked !== void 0) return linked;
 				const departed = ownerKind === "track" && this.departureFallbacks.has(ownerId);
 				const owner = departed ? await this.resolveDepartedTrack(ownerId) : ownerId;
-				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner);
+				const files = await deps.dispatcher.getMediaForOwner(ownerKind, owner, eventScope);
 				if (files.length > 0 || !departed) return files;
 				return this.departureFallbackMedia(ownerId) ?? files;
 			},
@@ -35364,6 +35553,8 @@ var NotificationCenter = class NotificationCenter {
 		const dropped = await this.outbox.supersede({
 			ruleId: source.ruleId,
 			recordId: source.recordId,
+			deviceId: source.deviceId,
+			recordAt: source.timestamp,
 			targetIds: [...combined]
 		});
 		this.logger.info("alarm notification combined with the rule that triggered it", {
@@ -42387,6 +42578,280 @@ function parseDebugDeviceIds(url) {
 	return out;
 }
 //#endregion
+//#region src/pipeline-analytics/store/tracking-tape-index-store.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per PROMOTED tracking-tape window (`debug.tape.promote`);
+*     updated when the operator marks it reviewed or releases its pins;
+*     deleted together with its file by `debug.tape.delete`."
+*   retention="NOT an age clock and NOT track retention — a promoted window is
+*     history being labelled (D681). Bounded by the promotion budget
+*     (MAX_PROMOTED_TAPES = 60, 1 GiB): a promotion beyond it is REFUSED,
+*     never satisfied by evicting another row."
+*/
+var TRACKING_TAPES_COLLECTION = "pipeline-analytics:tracking-tapes";
+var TRACKING_TAPES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "scenario",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "note",
+		type: "TEXT"
+	},
+	{
+		name: "lighting",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fromMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "toMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "state",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "frames",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "skips",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "gaps",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "bytes",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "reviewed",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "trackIds",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "releasedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "pinsSettled",
+		type: "BOOLEAN",
+		notNull: true
+	}
+];
+var TrackingTapeRowSchema = object({
+	id: string(),
+	deviceId: number().int(),
+	scenario: string(),
+	note: string().nullable(),
+	lighting: TapeLightingSchema,
+	fromMs: number().int(),
+	toMs: number().int(),
+	state: _enum(["complete", "incomplete"]),
+	frames: number().int(),
+	skips: number().int(),
+	gaps: number().int(),
+	bytes: number().int(),
+	reviewed: boolean(),
+	trackIds: array(string()),
+	createdAt: number().int(),
+	releasedAt: number().int().nullable(),
+	pinsSettled: boolean()
+});
+var TrackIdsSchema = array(string());
+/**
+* True when the SQLite settings backend would hand `text` back DECODED: it
+* parses any TEXT that starts with `[` or `{` and is valid JSON
+* (`decodeColumnValue` decodes by content, not by declared type). Free text
+* like that cannot round-trip through a TEXT column (follow-up 617, review M2).
+*/
+function decodesAsJson(text) {
+	if (!(text.startsWith("[") || text.startsWith("{"))) return false;
+	try {
+		JSON.parse(text);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Free text (`scenario`, `note`) as the column hands it back: a value the
+* backend decoded is re-encoded, so a row written before `debug.tape.promote`
+* refused such text never vanishes (its whitespace may differ). Anything else
+* goes to the schema as it came.
+*/
+function freeText(raw) {
+	return raw !== null && typeof raw === "object" ? JSON.stringify(raw) : raw;
+}
+/**
+* `trackIds` as the column hands it back. The SQLite backend decodes a TEXT
+* that starts with `[` on read (`decodeColumnValue`), so the store sees the
+* ARRAY it wrote; a string is parsed here only for a backend (or an old row)
+* that hands the text back as written. `JSON.parse(String(array))` threw on the
+* decoded array and every promoted row was skipped as malformed (follow-up 617).
+* `null` = unreadable, absent included (the column is NOT NULL, so absence is
+* corruption) — the row is reported, never repaired.
+*/
+function decodeTrackIds(raw) {
+	if (raw === void 0 || raw === null) return null;
+	if (typeof raw !== "string") return raw;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+var TrackingTapeIndexStore = class {
+	store;
+	logger;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			columns: [...TRACKING_TAPES_COLUMNS],
+			indexes: [{
+				name: "idx_trackingtapes_device_created",
+				columns: ["deviceId", "createdAt"]
+			}]
+		});
+	}
+	async insert(row) {
+		const { id, trackIds, ...rest } = TrackingTapeRowSchema.parse(row);
+		await this.store.insert.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			record: {
+				id,
+				data: {
+					...rest,
+					trackIds: JSON.stringify(trackIds)
+				}
+			}
+		});
+	}
+	async get(id) {
+		const first = (await this.store.query.query({
+			collection: TRACKING_TAPES_COLLECTION,
+			filter: {
+				where: { id },
+				limit: 1
+			}
+		}))[0];
+		return first === void 0 ? null : this.parse(first.id, first.data);
+	}
+	async list(deviceId) {
+		const rows = await this.store.query.query({
+			collection: TRACKING_TAPES_COLLECTION,
+			filter: {
+				...deviceId !== void 0 ? { where: { deviceId } } : {},
+				orderBy: {
+					field: "createdAt",
+					direction: "desc"
+				},
+				limit: 1e3
+			}
+		});
+		const out = [];
+		for (const r of rows) {
+			const parsed = this.parse(r.id, r.data);
+			if (parsed !== null) out.push(parsed);
+		}
+		return out;
+	}
+	async setReviewed(id, reviewed) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: { reviewed }
+		});
+	}
+	/** Release AND unsettle in one row write: the unpins the release implies
+	*  are owed from this moment, whether or not the caller lives to make them. */
+	async setReleased(id, atMs) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: {
+				releasedAt: atMs,
+				pinsSettled: false
+			}
+		});
+	}
+	async setPinsSettled(id, settled) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: { pinsSettled: settled }
+		});
+	}
+	async remove(id) {
+		await this.store.delete.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			key: id
+		});
+	}
+	parse(id, data) {
+		const ids = TrackIdsSchema.safeParse(decodeTrackIds(data["trackIds"]));
+		const parsed = TrackingTapeRowSchema.safeParse({
+			id,
+			...data,
+			scenario: freeText(data["scenario"]),
+			note: freeText(data["note"] ?? null),
+			releasedAt: data["releasedAt"] ?? null,
+			trackIds: ids.success ? ids.data : null
+		});
+		if (parsed.success) return parsed.data;
+		this.logger.warn("tracking tape index: skipped a malformed row", {
+			meta: {
+				id,
+				issues: parsed.error.issues.map((i) => i.path.join(".")),
+				trackIdsType: typeof data["trackIds"]
+			},
+			...typeof data["deviceId"] === "number" ? { tags: { deviceId: data["deviceId"] } } : {}
+		});
+		return null;
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/debug/tape-actions.ts
 /**
 * `debug.tape.*` — the tracking-tape surface (D681, spec §3.3). Admin,
@@ -42417,12 +42882,19 @@ var TapeStatusRowSchema = object({
 var TapeStatusInputSchema = object({ deviceIds: array(number().int()).optional() });
 var TapeStatusOutputSchema = object({ cameras: array(TapeStatusRowSchema).readonly() });
 var TapeLightingInputSchema = _enum(["day", "ir"]);
+/**
+* Free text the settings store would hand back decoded is refused by name
+* (follow-up 617, review M2): whole JSON array/object text in a TEXT column
+* comes back as an array or object, and the index could not read the row.
+*/
+var NOT_JSON_TEXT = "must not be JSON array/object text — the settings store would hand it back decoded";
+var notJsonText = (s) => !decodesAsJson(s);
 var PromoteInputSchema = object({
 	deviceId: number().int().positive(),
 	fromMs: number().int(),
 	toMs: number().int(),
-	scenario: string(),
-	note: string().max(500).optional(),
+	scenario: string().refine(notJsonText, { message: NOT_JSON_TEXT }),
+	note: string().max(500).refine(notJsonText, { message: NOT_JSON_TEXT }).optional(),
 	lighting: TapeLightingInputSchema.optional()
 });
 var PromoteOutputSchema = discriminatedUnion("ok", [object({
@@ -50883,6 +51355,17 @@ function pairRiders(detections) {
 * (D438) no frame did, and a newcomer on the stale prediction took the id.
 */
 var MAX_PREDICTION_MS = 1e3;
+/**
+* A frame more than `maxMissedMs` behind the latest is a CLOCK STEP only as
+* the K-th such frame in a row, each in order with the one before (follow-up
+* 617, fix round 3; D49: a read that would destroy work needs another to
+* agree). A step ends every track on the camera; one stray timestamp — a
+* backlog spike 4.5 s late — or two runner clocks delivering interleaved
+* (a camera migrating between runners) must not. Three is the least that a
+* single late frame plus an interleaved partner cannot reach by chance; the
+* cost of a real step is K−1 dropped frames (~260 ms at 7.7 fps).
+*/
+var CLOCK_STEP_CONFIRM_FRAMES = 3;
 /** Confident boxes kept on a tracklet's path (the old tracker's bound). */
 var MAX_PATH_LENGTH = 300;
 /** Swap test: crossed pairs cheaper than this over the chosen pairs are doubt. */
@@ -51688,6 +52171,35 @@ function linkReach(from, gapMs) {
 	return diag * Math.min(LINK_REACH_MAX_DIAGONALS, Math.max(LINK_REACH_MIN_DIAGONALS, LINK_REACH_DIAGONALS_PER_SEC * gapMs / 1e3));
 }
 var arcKey = (from, to) => `${from}\u0000${to}`;
+/**
+* The rejections that mean "geometry or appearance said no to a plausible
+* continuation" of a confirmed predecessor — a track the operator sees break
+* (follow-up 617, F5). Every one of them is past `hardRejection`, so the
+* predecessor is confirmed. NOT here (fix round 1): `unconfirmed`;
+* `has-successor` (continued elsewhere); `concurrent` and `identity-conflict`
+* (two subjects — the normal case, and the most frequent); `dropped` (an
+* operator delete or a refused chain).
+*/
+var BREAK_REJECTIONS = new Set([
+	"reach",
+	"area",
+	"appearance",
+	"contested",
+	"cost"
+]);
+/** The confirmed predecessors whose link a decision rejected as a break (F5). */
+function confirmedPredecessorRejections(candidates) {
+	const out = [];
+	for (const c of candidates ?? []) {
+		if (c.rejected === void 0 || !BREAK_REJECTIONS.has(c.rejected)) continue;
+		out.push({
+			from: c.from,
+			rejected: c.rejected,
+			gapMs: c.gapMs
+		});
+	}
+	return out;
+}
 function arcFacts(a) {
 	return {
 		from: a.from.id,
@@ -51765,6 +52277,26 @@ var DeferredLinker = class {
 		if (seen === void 0) this.names.set(p.id, new Set([p.identity]));
 		else seen.add(p.identity);
 	}
+	/**
+	* A clock step (follow-up 617, fix round 2): every piece still undecided is
+	* decided `new`, so nothing that existed before the step can be absorbed
+	* across it — whatever was ready was committed just before. The facade
+	* rebases its clock past `LINK_MAX_GAP_MS`, so no later piece can continue
+	* one of these either. An extra id, never a mix-up.
+	*/
+	closeUndecided(now, pieces) {
+		for (const p of pieces) this.accept(p, now);
+		for (const p of this.pieces.values()) {
+			if (this.outcomes.has(p.id)) continue;
+			this.decide(p.id, "new");
+			this.observer?.({
+				t: now,
+				kind: "new",
+				to: p.id,
+				reason: "clock-step"
+			});
+		}
+	}
 	isTailFinal(id, now, isLive) {
 		const root = this.rootOf(id);
 		if (this.pieces.has(root) && !this.outcomes.has(root)) return false;
@@ -52515,7 +53047,15 @@ var Tracklet = class {
 			h: this.assocBox.h
 		};
 	}
+	/**
+	* A confident sighting. One OLDER than the last (`t < lastSeenAt` — ~1 % of
+	* frames reach the tracker out of capture order, up to 1.2 s back) is
+	* `stale`: it changes nothing. A rewound tracklet would be measured from a
+	* box its subject left a second ago, and L2 refused a link by reach on
+	* exactly that (follow-up 617, F1). The caller reports it.
+	*/
 	observeConfident(det, t, faceBearing) {
+		if (t < this.lastSeenAt) return "stale";
 		const dt = t - this.lastSeenAt;
 		if (dt > 0) {
 			const from = centreOf(this.lastBox);
@@ -52527,6 +53067,7 @@ var Tracklet = class {
 			this.emitIntervalMs = dt;
 		}
 		this.recordConfident(det, t, faceBearing);
+		return "recorded";
 	}
 	observeLowScore(box, t) {
 		this.assocBox = box;
@@ -52628,6 +53169,15 @@ var TrackletTracker = class {
 	demoteSilent(t) {
 		for (const tr of this.live.values()) if (tr.mode === "active" && t - tr.lastSeenAt > MAX_PREDICTION_MS) tr.mode = "coasting";
 	}
+	/** Ends every live tracklet at its own last sighting (a clock step); the ids it ended. */
+	endAll(reason) {
+		const ended = [];
+		for (const tr of [...this.live.values()]) {
+			ended.push(tr.id);
+			this.finish(tr, tr.lastSeenAt, reason);
+		}
+		return ended;
+	}
 	/** Silence: end what the coast budget no longer covers. */
 	expire(now) {
 		for (const tr of [...this.live.values()]) if (now - tr.lastSeenAt > this.config.maxMissedMs) this.finish(tr, tr.lastSeenAt, "missed");
@@ -52718,12 +53268,12 @@ var TrackletTracker = class {
 		const d = frame.detections[pair.detection];
 		if (tr === void 0 || d === void 0) return;
 		frame.used.add(pair.detection);
+		if (tr.observeConfident(d, frame.t, frame.ctx.faceBearing?.has(d.bbox) === true) === "stale") return;
 		tr.mode = "active";
 		if (d.class !== tr.klass) this.refuse({
 			reason: "cross-class-absorbed",
 			against: tr
 		}, d);
-		tr.observeConfident(d, frame.t, frame.ctx.faceBearing?.has(d.bbox) === true);
 		if (pair.contested) {
 			tr.contestedHits += 1;
 			tr.contestedSince ??= frame.t;
@@ -52912,27 +53462,151 @@ var TrackerV2 = class {
 	l1;
 	l2;
 	pending = [];
+	/**
+	* Internal time = the caller's frame time + `offset`. Zero until a clock
+	* step; each step moves it so the internal clock never goes back and
+	* resumes past `LINK_MAX_GAP_MS` of silence (fix round 2, C1). L1, L2, their
+	* facts and prunes run on internal time; fusions and `frameClock()` are
+	* handed back in the caller's clock.
+	*/
+	offset = 0;
 	lastT = 0;
+	/** The latest FRAME time taken (internal) — never the sweep's extrapolated `now`. */
+	lastFrameT = Number.NEGATIVE_INFINITY;
+	observers;
+	/** Caller times of the consecutive frames past the stale bound so far — the
+	*  run a clock step needs `CLOCK_STEP_CONFIRM_FRAMES` of (fix round 3). */
+	stepRun = [];
 	constructor(config, deps) {
 		this.config = config;
-		this.l1 = new TrackletTracker(config, deps.mintTrackId, deps.observers ?? {});
+		this.observers = deps.observers ?? {};
+		const out = this.observers;
+		const internal = {
+			...out.refusal !== void 0 ? { refusal: out.refusal } : {},
+			ended: (f) => out.ended?.({
+				...f,
+				at: f.at - this.offset
+			}),
+			split: (f) => out.split?.({
+				...f,
+				t: f.t - this.offset
+			})
+		};
+		this.l1 = new TrackletTracker(config, deps.mintTrackId, internal);
 		this.l2 = new DeferredLinker({
 			maxMissedMs: config.maxMissedMs,
 			appearanceResolvesAmbiguity: config.appearanceResolvesAmbiguity
-		}, deps.observers?.link);
+		}, (f) => out.link?.({
+			...f,
+			t: f.t - this.offset
+		}));
 	}
-	update(detections, t, ctx) {
+	update(detections, frameT, ctx) {
+		const order = this.classifyFrame(frameT);
+		if (order === "out-of-order") return this.drop(frameT, detections.length);
+		let t = frameT + this.offset;
+		if (order === "clock-step") t = this.clockStep(frameT, this.lastFrameT - t);
+		this.stepRun = [];
+		this.lastFrameT = t;
 		this.lastT = Math.max(this.lastT, t);
 		const step = this.l1.step(detections, t, ctx);
 		this.link(this.lastT);
 		return step.emissions.map((e) => this.emit(e, t));
 	}
 	/**
+	* A frame stamped before the latest one already taken (follow-up 617, F1;
+	* ~1 % of frames, up to 1.2 s back). It is decided ONCE, for the whole
+	* frame (fix round 1, H1): matched against the tracklets' NEWEST boxes, a
+	* stale box can land on another subject — a walker's old box on the walker
+	* behind — and be emitted under that id. So nothing binds, spawns, splits or
+	* is demoted on it; the confirmed tracklets are emitted as on a frame that
+	* matched nothing (no sighting), and one fact says the frame was dropped.
+	*/
+	/**
+	* How `update` will take a frame at `frameT` — without taking it. The
+	* processor asks first (fix round 3, MEDIUM-2), so a dropped frame never
+	* reaches the stationary gate, the zones or the event path.
+	*  - `in-order`: not behind the latest frame taken;
+	*  - `out-of-order`: behind it — within `maxMissedMs` (disorder, ≤ 1.2 s
+	*    measured), or further back but not yet the `CLOCK_STEP_CONFIRM_FRAMES`-th
+	*    such frame in a row;
+	*  - `clock-step`: the K-th consecutive frame past the bound, each in order
+	*    with the one before (within `maxMissedMs`).
+	*/
+	classifyFrame(frameT) {
+		const behindMs = this.lastFrameT - (frameT + this.offset);
+		if (!(behindMs > 0)) return "in-order";
+		if (behindMs <= this.config.maxMissedMs) return "out-of-order";
+		return this.runLength(frameT) >= CLOCK_STEP_CONFIRM_FRAMES ? "clock-step" : "out-of-order";
+	}
+	/** The past-bound run this frame would make, itself included. */
+	runLength(frameT) {
+		const prev = this.stepRun.at(-1);
+		return (prev !== void 0 && frameT >= prev && frameT - prev <= this.config.maxMissedMs ? this.stepRun.length : 0) + 1;
+	}
+	/**
+	* Drops a frame `classifyFrame` called `out-of-order`. A frame past the
+	* bound extends (or restarts) the run a clock step needs; any other breaks
+	* it. One fact per frame.
+	*/
+	drop(frameT, detections) {
+		const behindMs = this.lastFrameT - (frameT + this.offset);
+		let pendingClockStep = 0;
+		if (behindMs > this.config.maxMissedMs) {
+			pendingClockStep = this.runLength(frameT);
+			this.stepRun = pendingClockStep === 1 ? [frameT] : [...this.stepRun, frameT];
+		} else this.stepRun = [];
+		this.observers.outOfOrder?.({
+			t: frameT,
+			lastFrameT: this.frameClock(),
+			behindMs,
+			detections,
+			pendingClockStep
+		});
+		return this.l1.liveTracklets().filter((tr) => tr.confirmed).map((tracklet) => this.emit({
+			tracklet,
+			detection: void 0,
+			matched: false
+		}, this.lastFrameT));
+	}
+	/**
+	* The frame clock stepped back further than `maxMissedMs` (fix round 2, C1):
+	* not disorder — an NTP correction, or a camera moved to a runner whose clock
+	* is behind. An unbounded gate dropped every frame until the new clock passed
+	* the old high mark (60 s back: 461 frames, a new subject never tracked, the
+	* departed one coasting on). Instead: commit what L2 has decided, end every
+	* live tracklet at its own last sighting, decide every piece still undecided
+	* `new` (no fusion crosses the step), and resume the internal clock past
+	* `LINK_MAX_GAP_MS` of silence, so nothing later can continue anything
+	* earlier. Returns the frame's internal time.
+	*/
+	clockStep(frameT, behindMs) {
+		const lastFrameT = this.frameClock();
+		this.link(this.lastT);
+		const ended = this.l1.endAll("clock-step");
+		this.l2.closeUndecided(this.lastT, this.pieces());
+		const resumeAt = Math.max(this.lastT, this.lastFrameT) + LINK_MAX_GAP_MS + 1;
+		this.offset = resumeAt - frameT;
+		this.lastT = resumeAt;
+		this.observers.clockStep?.({
+			t: frameT,
+			lastFrameT,
+			behindMs,
+			ended
+		});
+		return resumeAt;
+	}
+	/** The latest frame time taken, in the caller's clock (rebased by a clock step). */
+	frameClock() {
+		return this.lastFrameT - this.offset;
+	}
+	/**
 	* The close sweep's entry on a camera whose frames stopped (D438): end the
 	* tracklets the coast budget no longer covers, THEN run L2 (review C2).
 	* `now` is FRAME time (the processor converts wall clock, Task 11).
 	*/
-	advance(now) {
+	advance(frameNow) {
+		const now = frameNow + this.offset;
 		this.lastT = Math.max(this.lastT, now);
 		this.l1.expire(now);
 		this.link(now);
@@ -52948,6 +53622,7 @@ var TrackerV2 = class {
 	markSuppressed(id) {
 		this.l1.markSuppressed(id);
 	}
+	/** In the caller's clock (translated when each was committed, LOW-5). */
 	drainFusions() {
 		const out = this.pending;
 		this.pending = [];
@@ -52960,8 +53635,8 @@ var TrackerV2 = class {
 	isLive(id) {
 		return this.l2.membersOf(this.l2.rootOf(id)).some((m) => this.isLiveTracklet(m));
 	}
-	isTailFinal(id, now) {
-		return this.l2.isTailFinal(id, now, (m) => this.isLiveTracklet(m));
+	isTailFinal(id, frameNow) {
+		return this.l2.isTailFinal(id, frameNow + this.offset, (m) => this.isLiveTracklet(m));
 	}
 	/**
 	* Ends every live member of the chain. `stationary` (round 4): the
@@ -52977,9 +53652,15 @@ var TrackerV2 = class {
 		const tr = this.l1.get(id);
 		return tr !== void 0 && tr.endedAt === null;
 	}
+	pieces() {
+		return [...this.l1.liveTracklets(), ...this.l1.endedTracklets()].map(toPiece);
+	}
 	link(now) {
-		const pieces = [...this.l1.liveTracklets(), ...this.l1.endedTracklets()].map(toPiece);
-		this.pending.push(...this.l2.step(now, pieces));
+		const offset = this.offset;
+		for (const f of this.l2.step(now, this.pieces())) this.pending.push({
+			...f,
+			t: f.t - offset
+		});
 		this.l1.prune(now);
 		this.l2.prune(now);
 	}
@@ -53042,7 +53723,8 @@ var NO_ENDS = {
 	missed: 0,
 	ambiguous: 0,
 	dropped: 0,
-	stationary: 0
+	stationary: 0,
+	"clock-step": 0
 };
 function emptyStats() {
 	return {
@@ -53055,16 +53737,28 @@ function emptyStats() {
 		linksRefused: 0,
 		linksNew: 0,
 		linksDisagreed: 0,
-		lowScoreHolds: 0
+		lowScoreHolds: 0,
+		outOfOrderFrames: 0,
+		clockSteps: 0
 	};
 }
 /** Nothing happened in the window: no tracklet ended, no split, no L2
 *  decision, no low-score hold (review LOW-N1 — what the sweep stays quiet about). */
 function isIdleTrackerStats(stats) {
-	return [stats.tracklets.confirmed, stats.tracklets.unconfirmed].flatMap((c) => Object.values(c)).every((n) => n === 0) && stats.splits === 0 && stats.linksCommitted === 0 && stats.linksRefused === 0 && stats.linksNew === 0 && stats.linksDisagreed === 0 && stats.lowScoreHolds === 0;
+	return [stats.tracklets.confirmed, stats.tracklets.unconfirmed].flatMap((c) => Object.values(c)).every((n) => n === 0) && stats.splits === 0 && stats.linksCommitted === 0 && stats.linksRefused === 0 && stats.linksNew === 0 && stats.linksDisagreed === 0 && stats.lowScoreHolds === 0 && stats.outOfOrderFrames === 0 && stats.clockSteps === 0;
 }
 /** Shared empty — a fold is rare and every other frame would allocate. */
 var EMPTY_RIDER_FOLDS = [];
+/** The tape observation of a dropped frame: no gate verdict, nothing bound. */
+var DROPPED_FRAME_OBSERVATION = {
+	gate: {
+		strong: [],
+		weak: [],
+		confirmed: [],
+		woken: []
+	},
+	live: []
+};
 /** Mapping from StateAnalyzer's `ObjectState.state` values to the
 *  canonical TrackState enum used on tracks + events. */
 function mapObjectStateToTrackState(s) {
@@ -53243,6 +53937,14 @@ var FrameProcessor = class {
 					else if (f.kind === "new") this.stats.linksNew += 1;
 					else if (f.kind === "disagreed") this.stats.linksDisagreed += 1;
 					this.trackerObservers.link?.(f);
+				},
+				outOfOrder: (f) => {
+					this.stats.outOfOrderFrames += 1;
+					this.trackerObservers.outOfOrder?.(f);
+				},
+				clockStep: (f) => {
+					this.stats.clockSteps += 1;
+					this.trackerObservers.clockStep?.(f);
 				}
 			}
 		});
@@ -53526,6 +54228,37 @@ var FrameProcessor = class {
 	*  Zero is the expected reading; a rising one means two people stand close
 	*  together on this camera, which is worth knowing per-camera rather than
 	*  per-fleet. */
+	/**
+	* A frame `classifyFrame` called out of order: the tracker records the drop
+	* (and any clock-step run it extends) and nothing else reads the frame. The
+	* per-frame side tables a reader asks for afterwards are emptied, so it never
+	* re-reads the previous frame's.
+	*/
+	droppedFrame(input) {
+		this.tracker.drop(input.timestamp, input.frame.detections.length);
+		this.lastZoneOverlaps = /* @__PURE__ */ new Map();
+		this.lastZoneRejections = /* @__PURE__ */ new Map();
+		this.lastLabelWriteRefusals = [];
+		const fusions = this.tracker.drainFusions();
+		this.applyFusions(fusions);
+		return {
+			deviceId: this.deviceId,
+			timestamp: input.timestamp,
+			frameWidth: input.frame.width,
+			frameHeight: input.frame.height,
+			tracked: [],
+			objectEvents: [],
+			appearanceEvents: [],
+			rawTrackedDetections: [],
+			stationaryConfirmed: [],
+			stationaryWoken: [],
+			stationaryContinued: 0,
+			riderFolds: [],
+			...input.observe === true ? { observation: DROPPED_FRAME_OBSERVATION } : {},
+			fusions,
+			droppedOutOfOrder: true
+		};
+	}
 	facesRefusedOutsideParent() {
 		return this.faceOutsideParentCount;
 	}
@@ -53548,6 +54281,7 @@ var FrameProcessor = class {
 	}
 	process(input) {
 		const { timestamp, frame } = input;
+		if (this.tracker.classifyFrame(timestamp) === "out-of-order") return this.droppedFrame(input);
 		this.lastFrameT = timestamp;
 		this.lastFrameWallAt = this.wallClock();
 		const frameWidth = frame.width;
@@ -56299,239 +57033,6 @@ async function promoteTapeWindow(deps, input, signal) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/store/tracking-tape-index-store.ts
-/**
-* @durable class=ledger owner=pipeline-analytics
-*   write="one row per PROMOTED tracking-tape window (`debug.tape.promote`);
-*     updated when the operator marks it reviewed or releases its pins;
-*     deleted together with its file by `debug.tape.delete`."
-*   retention="NOT an age clock and NOT track retention — a promoted window is
-*     history being labelled (D681). Bounded by the promotion budget
-*     (MAX_PROMOTED_TAPES = 60, 1 GiB): a promotion beyond it is REFUSED,
-*     never satisfied by evicting another row."
-*/
-var TRACKING_TAPES_COLLECTION = "pipeline-analytics:tracking-tapes";
-var TRACKING_TAPES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "scenario",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "note",
-		type: "TEXT"
-	},
-	{
-		name: "lighting",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fromMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "toMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "state",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "frames",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "skips",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "gaps",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "bytes",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "reviewed",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "trackIds",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "releasedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "pinsSettled",
-		type: "BOOLEAN",
-		notNull: true
-	}
-];
-var TrackingTapeRowSchema = object({
-	id: string(),
-	deviceId: number().int(),
-	scenario: string(),
-	note: string().nullable(),
-	lighting: TapeLightingSchema,
-	fromMs: number().int(),
-	toMs: number().int(),
-	state: _enum(["complete", "incomplete"]),
-	frames: number().int(),
-	skips: number().int(),
-	gaps: number().int(),
-	bytes: number().int(),
-	reviewed: boolean(),
-	trackIds: array(string()),
-	createdAt: number().int(),
-	releasedAt: number().int().nullable(),
-	pinsSettled: boolean()
-});
-var TrackIdsSchema = array(string());
-var TrackingTapeIndexStore = class {
-	store;
-	logger;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			columns: [...TRACKING_TAPES_COLUMNS],
-			indexes: [{
-				name: "idx_trackingtapes_device_created",
-				columns: ["deviceId", "createdAt"]
-			}]
-		});
-	}
-	async insert(row) {
-		const { id, trackIds, ...rest } = TrackingTapeRowSchema.parse(row);
-		await this.store.insert.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			record: {
-				id,
-				data: {
-					...rest,
-					trackIds: JSON.stringify(trackIds)
-				}
-			}
-		});
-	}
-	async get(id) {
-		const first = (await this.store.query.query({
-			collection: TRACKING_TAPES_COLLECTION,
-			filter: {
-				where: { id },
-				limit: 1
-			}
-		}))[0];
-		return first === void 0 ? null : this.parse(first.id, first.data);
-	}
-	async list(deviceId) {
-		const rows = await this.store.query.query({
-			collection: TRACKING_TAPES_COLLECTION,
-			filter: {
-				...deviceId !== void 0 ? { where: { deviceId } } : {},
-				orderBy: {
-					field: "createdAt",
-					direction: "desc"
-				},
-				limit: 1e3
-			}
-		});
-		const out = [];
-		for (const r of rows) {
-			const parsed = this.parse(r.id, r.data);
-			if (parsed !== null) out.push(parsed);
-		}
-		return out;
-	}
-	async setReviewed(id, reviewed) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: { reviewed }
-		});
-	}
-	/** Release AND unsettle in one row write: the unpins the release implies
-	*  are owed from this moment, whether or not the caller lives to make them. */
-	async setReleased(id, atMs) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: {
-				releasedAt: atMs,
-				pinsSettled: false
-			}
-		});
-	}
-	async setPinsSettled(id, settled) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: { pinsSettled: settled }
-		});
-	}
-	async remove(id) {
-		await this.store.delete.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			key: id
-		});
-	}
-	parse(id, data) {
-		let trackIds = [];
-		try {
-			trackIds = JSON.parse(String(data["trackIds"] ?? "[]"));
-		} catch {
-			trackIds = null;
-		}
-		const ids = TrackIdsSchema.safeParse(trackIds);
-		const parsed = TrackingTapeRowSchema.safeParse({
-			id,
-			...data,
-			note: data["note"] ?? null,
-			releasedAt: data["releasedAt"] ?? null,
-			trackIds: ids.success ? ids.data : null
-		});
-		if (parsed.success) return parsed.data;
-		this.logger.warn("tracking tape index: skipped a malformed row", {
-			meta: { id },
-			...typeof data["deviceId"] === "number" ? { tags: { deviceId: data["deviceId"] } } : {}
-		});
-		return null;
-	}
-};
-//#endregion
 //#region src/pipeline-analytics/tracking-bench/recorder/tape-status.ts
 /** The one node that may hold tapes: sqlite and bulk state are hub-only, and
 *  an agent persists nothing (spec §3.1). */
@@ -96033,6 +96534,30 @@ async function encodeClipQuery(encode, text, modelId, warn) {
 	}
 }
 //#endregion
+//#region src/pipeline-analytics/nc-owner-media-reader.ts
+/** Keep only the rows written for THIS generation of the event id. */
+function ofGeneration(files, scope) {
+	return files.filter((f) => f.timestamp === scope.recordAt);
+}
+function makeNcOwnerMediaReader(deps) {
+	return async (ownerKind, ownerId, eventScope) => {
+		if (ownerKind === "track") return deps.media.listByOwner("track", await deps.resolveTrackOwnerId(ownerId));
+		if (eventScope === void 0) return deps.media.listByOwner("object", ownerId);
+		const onCamera = await deps.media.listByOwner("object", ownerId, eventScope.deviceId);
+		const kept = ofGeneration(onCamera, eventScope);
+		if (kept.length < onCamera.length) deps.logger.warn("event media of another record on a reused event id — not used", {
+			tags: { deviceId: eventScope.deviceId },
+			meta: {
+				ownerId,
+				recordAt: eventScope.recordAt,
+				refused: onCamera.length - kept.length,
+				kept: kept.length
+			}
+		});
+		return kept;
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/store/settings-raw-mirror.ts
 /** How long a mirrored entry is served before a refresh is started behind the
 *  next reader. See the module doc for why this matches the per-kind caches'
@@ -97387,6 +97912,12 @@ var TRACKER_FACT_LOG_SAMPLE_EVERY = 10;
 *  positive spawns (review M1: ~1 750 `new` decisions per camera per hour) —
 *  are sampled harder; the per-minute summary carries their exact counts. */
 var TRACKER_PIECE_LOG_SAMPLE_EVERY = 50;
+/** Out-of-order frames (follow-up 617, F1: ~1 % of frames) log the first N,
+*  then one in this many — every line carries the count; the per-minute
+*  summary carries the exact `outOfOrderFrames`. */
+var TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY = 50;
+/** Clock-step WARNs past the first ten (fix round 3, MEDIUM-1). */
+var TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY = 50;
 /** First N, then one in `every` — the refusal stream's cadence (D391). */
 function sampledTrackerFact(count, every = TRACKER_FACT_LOG_SAMPLE_EVERY) {
 	return count <= TRACKER_FACT_LOG_ALWAYS_FIRST || count % every === 0;
@@ -100357,7 +100888,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						}
 					});
 				},
-				getMediaForOwner: async (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, await resolveMediaOwnerId(ownerKind, ownerId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner")),
+				getMediaForOwner: makeNcOwnerMediaReader({
+					media: stores.mediaStore,
+					resolveTrackOwnerId: (trackId) => resolveMediaOwnerId("track", trackId, (id) => this.trackAliasStore?.resolve(id) ?? Promise.resolve(null), (failure) => this.aliasResolveFailureLogger?.(failure), "getMediaForOwner"),
+					logger: this.ctx.logger.child("nc-media")
+				}),
 				getSubjectTrail: async (deviceId, trackId) => {
 					const dims = this.lastFrameDimsByDevice.get(deviceId);
 					if (dims === void 0 || dims.w <= 0 || dims.h <= 0) return [];
@@ -102030,9 +102565,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 		let splitCount = 0;
 		let ignoredCount = 0;
 		let newCount = 0;
+		let outOfOrderCount = 0;
+		let clockStepCount = 0;
 		const endedCounts = /* @__PURE__ */ new Map();
 		const logLink = (f) => {
-			const meta = {
+			const decision = {
 				source,
 				t: f.t,
 				kind: f.kind,
@@ -102041,7 +102578,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				cost: f.cost,
 				gapMs: f.gapMs,
 				reason: f.reason,
-				recognition: f.recognition,
+				recognition: f.recognition
+			};
+			const meta = {
+				...decision,
 				candidates: f.candidates
 			};
 			switch (f.kind) {
@@ -102079,7 +102619,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						meta
 					});
 					return;
-				case "new":
+				case "new": {
+					if (f.reason === "clock-step") {
+						trackerLog.debug("tracker: piece decided new — closed by a frame clock step", {
+							tags: { deviceId },
+							meta
+						});
+						return;
+					}
 					if (f.reason === "unconfirmed") {
 						trackerLog.debug("tracker: piece decided new — never confirmed", {
 							tags: { deviceId },
@@ -102087,6 +102634,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						});
 						return;
 					}
+					const rejectedPredecessors = confirmedPredecessorRejections(f.candidates);
+					if (rejectedPredecessors.length > 0) {
+						trackerLog.info("tracker: piece decided new — a confirmed predecessor was rejected", {
+							tags: { deviceId },
+							meta: {
+								...decision,
+								rejectedPredecessors
+							}
+						});
+						return;
+					}
 					newCount += 1;
 					if (!sampledTrackerFact(newCount, TRACKER_PIECE_LOG_SAMPLE_EVERY)) return;
 					trackerLog.info("tracker: piece decided new — no predecessor", {
@@ -102097,6 +102655,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 						}
 					});
 					return;
+				}
 			}
 		};
 		p.setTrackerObservers({
@@ -102117,6 +102676,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 				});
 			},
 			link: logLink,
+			clockStep: (f) => {
+				clockStepCount += 1;
+				if (!sampledTrackerFact(clockStepCount, TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY)) return;
+				trackerLog.warn("tracker: frame clock stepped back — tracklets ended, clock rebased", {
+					tags: { deviceId },
+					meta: {
+						source,
+						t: f.t,
+						lastFrameT: f.lastFrameT,
+						behindMs: f.behindMs,
+						ended: f.ended,
+						clockStepCount,
+						sampledEvery: TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY
+					}
+				});
+			},
+			outOfOrder: (f) => {
+				outOfOrderCount += 1;
+				if (!sampledTrackerFact(outOfOrderCount, TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY)) return;
+				trackerLog.info("tracker: out-of-order frame dropped — older than the latest frame", {
+					tags: { deviceId },
+					meta: {
+						source,
+						t: f.t,
+						lastFrameT: f.lastFrameT,
+						behindMs: f.behindMs,
+						detections: f.detections,
+						pendingClockStep: f.pendingClockStep,
+						outOfOrderCount,
+						sampledEvery: TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY
+					}
+				});
+			},
 			ended: (f) => {
 				const k = `${f.reason}:${String(f.confirmed)}`;
 				const n = (endedCounts.get(k) ?? 0) + 1;
@@ -102258,6 +102850,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 			});
 		});
 		this.reportTrackerSummary(deviceId, key, processor, "frame");
+		if (result.droppedOutOfOrder === true) return;
 		for (const r of processor.getLastLabelWriteRefusals()) {
 			const message = r.reason.kind === "macro-class" ? "label tier collapse refused" : "label write refused";
 			this.ctx.logger.info(message, {