@camstack/addon-post-analysis 1.2.307 → 1.2.308

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-C67UM_q_.js");
+const require_clip_model_registry = require("../clip-model-registry-BqrTKyUe.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -42620,6 +42620,280 @@ function parseDebugDeviceIds(url) {
 	return out;
 }
 //#endregion
+//#region src/pipeline-analytics/store/tracking-tape-index-store.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per PROMOTED tracking-tape window (`debug.tape.promote`);
+*     updated when the operator marks it reviewed or releases its pins;
+*     deleted together with its file by `debug.tape.delete`."
+*   retention="NOT an age clock and NOT track retention — a promoted window is
+*     history being labelled (D681). Bounded by the promotion budget
+*     (MAX_PROMOTED_TAPES = 60, 1 GiB): a promotion beyond it is REFUSED,
+*     never satisfied by evicting another row."
+*/
+var TRACKING_TAPES_COLLECTION = "pipeline-analytics:tracking-tapes";
+var TRACKING_TAPES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "scenario",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "note",
+		type: "TEXT"
+	},
+	{
+		name: "lighting",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fromMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "toMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "state",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "frames",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "skips",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "gaps",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "bytes",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "reviewed",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "trackIds",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "releasedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "pinsSettled",
+		type: "BOOLEAN",
+		notNull: true
+	}
+];
+var TrackingTapeRowSchema = require_clip_model_registry.object({
+	id: require_clip_model_registry.string(),
+	deviceId: require_clip_model_registry.number().int(),
+	scenario: require_clip_model_registry.string(),
+	note: require_clip_model_registry.string().nullable(),
+	lighting: TapeLightingSchema,
+	fromMs: require_clip_model_registry.number().int(),
+	toMs: require_clip_model_registry.number().int(),
+	state: require_clip_model_registry._enum(["complete", "incomplete"]),
+	frames: require_clip_model_registry.number().int(),
+	skips: require_clip_model_registry.number().int(),
+	gaps: require_clip_model_registry.number().int(),
+	bytes: require_clip_model_registry.number().int(),
+	reviewed: require_clip_model_registry.boolean(),
+	trackIds: require_clip_model_registry.array(require_clip_model_registry.string()),
+	createdAt: require_clip_model_registry.number().int(),
+	releasedAt: require_clip_model_registry.number().int().nullable(),
+	pinsSettled: require_clip_model_registry.boolean()
+});
+var TrackIdsSchema = require_clip_model_registry.array(require_clip_model_registry.string());
+/**
+* True when the SQLite settings backend would hand `text` back DECODED: it
+* parses any TEXT that starts with `[` or `{` and is valid JSON
+* (`decodeColumnValue` decodes by content, not by declared type). Free text
+* like that cannot round-trip through a TEXT column (follow-up 617, review M2).
+*/
+function decodesAsJson(text) {
+	if (!(text.startsWith("[") || text.startsWith("{"))) return false;
+	try {
+		JSON.parse(text);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Free text (`scenario`, `note`) as the column hands it back: a value the
+* backend decoded is re-encoded, so a row written before `debug.tape.promote`
+* refused such text never vanishes (its whitespace may differ). Anything else
+* goes to the schema as it came.
+*/
+function freeText(raw) {
+	return raw !== null && typeof raw === "object" ? JSON.stringify(raw) : raw;
+}
+/**
+* `trackIds` as the column hands it back. The SQLite backend decodes a TEXT
+* that starts with `[` on read (`decodeColumnValue`), so the store sees the
+* ARRAY it wrote; a string is parsed here only for a backend (or an old row)
+* that hands the text back as written. `JSON.parse(String(array))` threw on the
+* decoded array and every promoted row was skipped as malformed (follow-up 617).
+* `null` = unreadable, absent included (the column is NOT NULL, so absence is
+* corruption) — the row is reported, never repaired.
+*/
+function decodeTrackIds(raw) {
+	if (raw === void 0 || raw === null) return null;
+	if (typeof raw !== "string") return raw;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+var TrackingTapeIndexStore = class {
+	store;
+	logger;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			columns: [...TRACKING_TAPES_COLUMNS],
+			indexes: [{
+				name: "idx_trackingtapes_device_created",
+				columns: ["deviceId", "createdAt"]
+			}]
+		});
+	}
+	async insert(row) {
+		const { id, trackIds, ...rest } = TrackingTapeRowSchema.parse(row);
+		await this.store.insert.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			record: {
+				id,
+				data: {
+					...rest,
+					trackIds: JSON.stringify(trackIds)
+				}
+			}
+		});
+	}
+	async get(id) {
+		const first = (await this.store.query.query({
+			collection: TRACKING_TAPES_COLLECTION,
+			filter: {
+				where: { id },
+				limit: 1
+			}
+		}))[0];
+		return first === void 0 ? null : this.parse(first.id, first.data);
+	}
+	async list(deviceId) {
+		const rows = await this.store.query.query({
+			collection: TRACKING_TAPES_COLLECTION,
+			filter: {
+				...deviceId !== void 0 ? { where: { deviceId } } : {},
+				orderBy: {
+					field: "createdAt",
+					direction: "desc"
+				},
+				limit: 1e3
+			}
+		});
+		const out = [];
+		for (const r of rows) {
+			const parsed = this.parse(r.id, r.data);
+			if (parsed !== null) out.push(parsed);
+		}
+		return out;
+	}
+	async setReviewed(id, reviewed) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: { reviewed }
+		});
+	}
+	/** Release AND unsettle in one row write: the unpins the release implies
+	*  are owed from this moment, whether or not the caller lives to make them. */
+	async setReleased(id, atMs) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: {
+				releasedAt: atMs,
+				pinsSettled: false
+			}
+		});
+	}
+	async setPinsSettled(id, settled) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: { pinsSettled: settled }
+		});
+	}
+	async remove(id) {
+		await this.store.delete.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			key: id
+		});
+	}
+	parse(id, data) {
+		const ids = TrackIdsSchema.safeParse(decodeTrackIds(data["trackIds"]));
+		const parsed = TrackingTapeRowSchema.safeParse({
+			id,
+			...data,
+			scenario: freeText(data["scenario"]),
+			note: freeText(data["note"] ?? null),
+			releasedAt: data["releasedAt"] ?? null,
+			trackIds: ids.success ? ids.data : null
+		});
+		if (parsed.success) return parsed.data;
+		this.logger.warn("tracking tape index: skipped a malformed row", {
+			meta: {
+				id,
+				issues: parsed.error.issues.map((i) => i.path.join(".")),
+				trackIdsType: typeof data["trackIds"]
+			},
+			...typeof data["deviceId"] === "number" ? { tags: { deviceId: data["deviceId"] } } : {}
+		});
+		return null;
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/debug/tape-actions.ts
 /**
 * `debug.tape.*` — the tracking-tape surface (D681, spec §3.3). Admin,
@@ -42650,12 +42924,19 @@ var TapeStatusRowSchema = require_clip_model_registry.object({
 var TapeStatusInputSchema = require_clip_model_registry.object({ deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int()).optional() });
 var TapeStatusOutputSchema = require_clip_model_registry.object({ cameras: require_clip_model_registry.array(TapeStatusRowSchema).readonly() });
 var TapeLightingInputSchema = require_clip_model_registry._enum(["day", "ir"]);
+/**
+* Free text the settings store would hand back decoded is refused by name
+* (follow-up 617, review M2): whole JSON array/object text in a TEXT column
+* comes back as an array or object, and the index could not read the row.
+*/
+var NOT_JSON_TEXT = "must not be JSON array/object text — the settings store would hand it back decoded";
+var notJsonText = (s) => !decodesAsJson(s);
 var PromoteInputSchema = require_clip_model_registry.object({
 	deviceId: require_clip_model_registry.number().int().positive(),
 	fromMs: require_clip_model_registry.number().int(),
 	toMs: require_clip_model_registry.number().int(),
-	scenario: require_clip_model_registry.string(),
-	note: require_clip_model_registry.string().max(500).optional(),
+	scenario: require_clip_model_registry.string().refine(notJsonText, { message: NOT_JSON_TEXT }),
+	note: require_clip_model_registry.string().max(500).refine(notJsonText, { message: NOT_JSON_TEXT }).optional(),
 	lighting: TapeLightingInputSchema.optional()
 });
 var PromoteOutputSchema = require_clip_model_registry.discriminatedUnion("ok", [require_clip_model_registry.object({
@@ -51118,6 +51399,17 @@ function pairRiders(detections) {
 * (D438) no frame did, and a newcomer on the stale prediction took the id.
 */
 var MAX_PREDICTION_MS = 1e3;
+/**
+* A frame more than `maxMissedMs` behind the latest is a CLOCK STEP only as
+* the K-th such frame in a row, each in order with the one before (follow-up
+* 617, fix round 3; D49: a read that would destroy work needs another to
+* agree). A step ends every track on the camera; one stray timestamp — a
+* backlog spike 4.5 s late — or two runner clocks delivering interleaved
+* (a camera migrating between runners) must not. Three is the least that a
+* single late frame plus an interleaved partner cannot reach by chance; the
+* cost of a real step is K−1 dropped frames (~260 ms at 7.7 fps).
+*/
+var CLOCK_STEP_CONFIRM_FRAMES = 3;
 /** Confident boxes kept on a tracklet's path (the old tracker's bound). */
 var MAX_PATH_LENGTH = 300;
 /** Swap test: crossed pairs cheaper than this over the chosen pairs are doubt. */
@@ -51923,6 +52215,35 @@ function linkReach(from, gapMs) {
 	return diag * Math.min(LINK_REACH_MAX_DIAGONALS, Math.max(LINK_REACH_MIN_DIAGONALS, LINK_REACH_DIAGONALS_PER_SEC * gapMs / 1e3));
 }
 var arcKey = (from, to) => `${from}\u0000${to}`;
+/**
+* The rejections that mean "geometry or appearance said no to a plausible
+* continuation" of a confirmed predecessor — a track the operator sees break
+* (follow-up 617, F5). Every one of them is past `hardRejection`, so the
+* predecessor is confirmed. NOT here (fix round 1): `unconfirmed`;
+* `has-successor` (continued elsewhere); `concurrent` and `identity-conflict`
+* (two subjects — the normal case, and the most frequent); `dropped` (an
+* operator delete or a refused chain).
+*/
+var BREAK_REJECTIONS = new Set([
+	"reach",
+	"area",
+	"appearance",
+	"contested",
+	"cost"
+]);
+/** The confirmed predecessors whose link a decision rejected as a break (F5). */
+function confirmedPredecessorRejections(candidates) {
+	const out = [];
+	for (const c of candidates ?? []) {
+		if (c.rejected === void 0 || !BREAK_REJECTIONS.has(c.rejected)) continue;
+		out.push({
+			from: c.from,
+			rejected: c.rejected,
+			gapMs: c.gapMs
+		});
+	}
+	return out;
+}
 function arcFacts(a) {
 	return {
 		from: a.from.id,
@@ -52000,6 +52321,26 @@ var DeferredLinker = class {
 		if (seen === void 0) this.names.set(p.id, new Set([p.identity]));
 		else seen.add(p.identity);
 	}
+	/**
+	* A clock step (follow-up 617, fix round 2): every piece still undecided is
+	* decided `new`, so nothing that existed before the step can be absorbed
+	* across it — whatever was ready was committed just before. The facade
+	* rebases its clock past `LINK_MAX_GAP_MS`, so no later piece can continue
+	* one of these either. An extra id, never a mix-up.
+	*/
+	closeUndecided(now, pieces) {
+		for (const p of pieces) this.accept(p, now);
+		for (const p of this.pieces.values()) {
+			if (this.outcomes.has(p.id)) continue;
+			this.decide(p.id, "new");
+			this.observer?.({
+				t: now,
+				kind: "new",
+				to: p.id,
+				reason: "clock-step"
+			});
+		}
+	}
 	isTailFinal(id, now, isLive) {
 		const root = this.rootOf(id);
 		if (this.pieces.has(root) && !this.outcomes.has(root)) return false;
@@ -52750,7 +53091,15 @@ var Tracklet = class {
 			h: this.assocBox.h
 		};
 	}
+	/**
+	* A confident sighting. One OLDER than the last (`t < lastSeenAt` — ~1 % of
+	* frames reach the tracker out of capture order, up to 1.2 s back) is
+	* `stale`: it changes nothing. A rewound tracklet would be measured from a
+	* box its subject left a second ago, and L2 refused a link by reach on
+	* exactly that (follow-up 617, F1). The caller reports it.
+	*/
 	observeConfident(det, t, faceBearing) {
+		if (t < this.lastSeenAt) return "stale";
 		const dt = t - this.lastSeenAt;
 		if (dt > 0) {
 			const from = centreOf(this.lastBox);
@@ -52762,6 +53111,7 @@ var Tracklet = class {
 			this.emitIntervalMs = dt;
 		}
 		this.recordConfident(det, t, faceBearing);
+		return "recorded";
 	}
 	observeLowScore(box, t) {
 		this.assocBox = box;
@@ -52863,6 +53213,15 @@ var TrackletTracker = class {
 	demoteSilent(t) {
 		for (const tr of this.live.values()) if (tr.mode === "active" && t - tr.lastSeenAt > MAX_PREDICTION_MS) tr.mode = "coasting";
 	}
+	/** Ends every live tracklet at its own last sighting (a clock step); the ids it ended. */
+	endAll(reason) {
+		const ended = [];
+		for (const tr of [...this.live.values()]) {
+			ended.push(tr.id);
+			this.finish(tr, tr.lastSeenAt, reason);
+		}
+		return ended;
+	}
 	/** Silence: end what the coast budget no longer covers. */
 	expire(now) {
 		for (const tr of [...this.live.values()]) if (now - tr.lastSeenAt > this.config.maxMissedMs) this.finish(tr, tr.lastSeenAt, "missed");
@@ -52953,12 +53312,12 @@ var TrackletTracker = class {
 		const d = frame.detections[pair.detection];
 		if (tr === void 0 || d === void 0) return;
 		frame.used.add(pair.detection);
+		if (tr.observeConfident(d, frame.t, frame.ctx.faceBearing?.has(d.bbox) === true) === "stale") return;
 		tr.mode = "active";
 		if (d.class !== tr.klass) this.refuse({
 			reason: "cross-class-absorbed",
 			against: tr
 		}, d);
-		tr.observeConfident(d, frame.t, frame.ctx.faceBearing?.has(d.bbox) === true);
 		if (pair.contested) {
 			tr.contestedHits += 1;
 			tr.contestedSince ??= frame.t;
@@ -53147,27 +53506,151 @@ var TrackerV2 = class {
 	l1;
 	l2;
 	pending = [];
+	/**
+	* Internal time = the caller's frame time + `offset`. Zero until a clock
+	* step; each step moves it so the internal clock never goes back and
+	* resumes past `LINK_MAX_GAP_MS` of silence (fix round 2, C1). L1, L2, their
+	* facts and prunes run on internal time; fusions and `frameClock()` are
+	* handed back in the caller's clock.
+	*/
+	offset = 0;
 	lastT = 0;
+	/** The latest FRAME time taken (internal) — never the sweep's extrapolated `now`. */
+	lastFrameT = Number.NEGATIVE_INFINITY;
+	observers;
+	/** Caller times of the consecutive frames past the stale bound so far — the
+	*  run a clock step needs `CLOCK_STEP_CONFIRM_FRAMES` of (fix round 3). */
+	stepRun = [];
 	constructor(config, deps) {
 		this.config = config;
-		this.l1 = new TrackletTracker(config, deps.mintTrackId, deps.observers ?? {});
+		this.observers = deps.observers ?? {};
+		const out = this.observers;
+		const internal = {
+			...out.refusal !== void 0 ? { refusal: out.refusal } : {},
+			ended: (f) => out.ended?.({
+				...f,
+				at: f.at - this.offset
+			}),
+			split: (f) => out.split?.({
+				...f,
+				t: f.t - this.offset
+			})
+		};
+		this.l1 = new TrackletTracker(config, deps.mintTrackId, internal);
 		this.l2 = new DeferredLinker({
 			maxMissedMs: config.maxMissedMs,
 			appearanceResolvesAmbiguity: config.appearanceResolvesAmbiguity
-		}, deps.observers?.link);
+		}, (f) => out.link?.({
+			...f,
+			t: f.t - this.offset
+		}));
 	}
-	update(detections, t, ctx) {
+	update(detections, frameT, ctx) {
+		const order = this.classifyFrame(frameT);
+		if (order === "out-of-order") return this.drop(frameT, detections.length);
+		let t = frameT + this.offset;
+		if (order === "clock-step") t = this.clockStep(frameT, this.lastFrameT - t);
+		this.stepRun = [];
+		this.lastFrameT = t;
 		this.lastT = Math.max(this.lastT, t);
 		const step = this.l1.step(detections, t, ctx);
 		this.link(this.lastT);
 		return step.emissions.map((e) => this.emit(e, t));
 	}
 	/**
+	* A frame stamped before the latest one already taken (follow-up 617, F1;
+	* ~1 % of frames, up to 1.2 s back). It is decided ONCE, for the whole
+	* frame (fix round 1, H1): matched against the tracklets' NEWEST boxes, a
+	* stale box can land on another subject — a walker's old box on the walker
+	* behind — and be emitted under that id. So nothing binds, spawns, splits or
+	* is demoted on it; the confirmed tracklets are emitted as on a frame that
+	* matched nothing (no sighting), and one fact says the frame was dropped.
+	*/
+	/**
+	* How `update` will take a frame at `frameT` — without taking it. The
+	* processor asks first (fix round 3, MEDIUM-2), so a dropped frame never
+	* reaches the stationary gate, the zones or the event path.
+	*  - `in-order`: not behind the latest frame taken;
+	*  - `out-of-order`: behind it — within `maxMissedMs` (disorder, ≤ 1.2 s
+	*    measured), or further back but not yet the `CLOCK_STEP_CONFIRM_FRAMES`-th
+	*    such frame in a row;
+	*  - `clock-step`: the K-th consecutive frame past the bound, each in order
+	*    with the one before (within `maxMissedMs`).
+	*/
+	classifyFrame(frameT) {
+		const behindMs = this.lastFrameT - (frameT + this.offset);
+		if (!(behindMs > 0)) return "in-order";
+		if (behindMs <= this.config.maxMissedMs) return "out-of-order";
+		return this.runLength(frameT) >= CLOCK_STEP_CONFIRM_FRAMES ? "clock-step" : "out-of-order";
+	}
+	/** The past-bound run this frame would make, itself included. */
+	runLength(frameT) {
+		const prev = this.stepRun.at(-1);
+		return (prev !== void 0 && frameT >= prev && frameT - prev <= this.config.maxMissedMs ? this.stepRun.length : 0) + 1;
+	}
+	/**
+	* Drops a frame `classifyFrame` called `out-of-order`. A frame past the
+	* bound extends (or restarts) the run a clock step needs; any other breaks
+	* it. One fact per frame.
+	*/
+	drop(frameT, detections) {
+		const behindMs = this.lastFrameT - (frameT + this.offset);
+		let pendingClockStep = 0;
+		if (behindMs > this.config.maxMissedMs) {
+			pendingClockStep = this.runLength(frameT);
+			this.stepRun = pendingClockStep === 1 ? [frameT] : [...this.stepRun, frameT];
+		} else this.stepRun = [];
+		this.observers.outOfOrder?.({
+			t: frameT,
+			lastFrameT: this.frameClock(),
+			behindMs,
+			detections,
+			pendingClockStep
+		});
+		return this.l1.liveTracklets().filter((tr) => tr.confirmed).map((tracklet) => this.emit({
+			tracklet,
+			detection: void 0,
+			matched: false
+		}, this.lastFrameT));
+	}
+	/**
+	* The frame clock stepped back further than `maxMissedMs` (fix round 2, C1):
+	* not disorder — an NTP correction, or a camera moved to a runner whose clock
+	* is behind. An unbounded gate dropped every frame until the new clock passed
+	* the old high mark (60 s back: 461 frames, a new subject never tracked, the
+	* departed one coasting on). Instead: commit what L2 has decided, end every
+	* live tracklet at its own last sighting, decide every piece still undecided
+	* `new` (no fusion crosses the step), and resume the internal clock past
+	* `LINK_MAX_GAP_MS` of silence, so nothing later can continue anything
+	* earlier. Returns the frame's internal time.
+	*/
+	clockStep(frameT, behindMs) {
+		const lastFrameT = this.frameClock();
+		this.link(this.lastT);
+		const ended = this.l1.endAll("clock-step");
+		this.l2.closeUndecided(this.lastT, this.pieces());
+		const resumeAt = Math.max(this.lastT, this.lastFrameT) + LINK_MAX_GAP_MS + 1;
+		this.offset = resumeAt - frameT;
+		this.lastT = resumeAt;
+		this.observers.clockStep?.({
+			t: frameT,
+			lastFrameT,
+			behindMs,
+			ended
+		});
+		return resumeAt;
+	}
+	/** The latest frame time taken, in the caller's clock (rebased by a clock step). */
+	frameClock() {
+		return this.lastFrameT - this.offset;
+	}
+	/**
 	* The close sweep's entry on a camera whose frames stopped (D438): end the
 	* tracklets the coast budget no longer covers, THEN run L2 (review C2).
 	* `now` is FRAME time (the processor converts wall clock, Task 11).
 	*/
-	advance(now) {
+	advance(frameNow) {
+		const now = frameNow + this.offset;
 		this.lastT = Math.max(this.lastT, now);
 		this.l1.expire(now);
 		this.link(now);
@@ -53183,6 +53666,7 @@ var TrackerV2 = class {
 	markSuppressed(id) {
 		this.l1.markSuppressed(id);
 	}
+	/** In the caller's clock (translated when each was committed, LOW-5). */
 	drainFusions() {
 		const out = this.pending;
 		this.pending = [];
@@ -53195,8 +53679,8 @@ var TrackerV2 = class {
 	isLive(id) {
 		return this.l2.membersOf(this.l2.rootOf(id)).some((m) => this.isLiveTracklet(m));
 	}
-	isTailFinal(id, now) {
-		return this.l2.isTailFinal(id, now, (m) => this.isLiveTracklet(m));
+	isTailFinal(id, frameNow) {
+		return this.l2.isTailFinal(id, frameNow + this.offset, (m) => this.isLiveTracklet(m));
 	}
 	/**
 	* Ends every live member of the chain. `stationary` (round 4): the
@@ -53212,9 +53696,15 @@ var TrackerV2 = class {
 		const tr = this.l1.get(id);
 		return tr !== void 0 && tr.endedAt === null;
 	}
+	pieces() {
+		return [...this.l1.liveTracklets(), ...this.l1.endedTracklets()].map(toPiece);
+	}
 	link(now) {
-		const pieces = [...this.l1.liveTracklets(), ...this.l1.endedTracklets()].map(toPiece);
-		this.pending.push(...this.l2.step(now, pieces));
+		const offset = this.offset;
+		for (const f of this.l2.step(now, this.pieces())) this.pending.push({
+			...f,
+			t: f.t - offset
+		});
 		this.l1.prune(now);
 		this.l2.prune(now);
 	}
@@ -53277,7 +53767,8 @@ var NO_ENDS = {
 	missed: 0,
 	ambiguous: 0,
 	dropped: 0,
-	stationary: 0
+	stationary: 0,
+	"clock-step": 0
 };
 function emptyStats() {
 	return {
@@ -53290,16 +53781,28 @@ function emptyStats() {
 		linksRefused: 0,
 		linksNew: 0,
 		linksDisagreed: 0,
-		lowScoreHolds: 0
+		lowScoreHolds: 0,
+		outOfOrderFrames: 0,
+		clockSteps: 0
 	};
 }
 /** Nothing happened in the window: no tracklet ended, no split, no L2
 *  decision, no low-score hold (review LOW-N1 — what the sweep stays quiet about). */
 function isIdleTrackerStats(stats) {
-	return [stats.tracklets.confirmed, stats.tracklets.unconfirmed].flatMap((c) => Object.values(c)).every((n) => n === 0) && stats.splits === 0 && stats.linksCommitted === 0 && stats.linksRefused === 0 && stats.linksNew === 0 && stats.linksDisagreed === 0 && stats.lowScoreHolds === 0;
+	return [stats.tracklets.confirmed, stats.tracklets.unconfirmed].flatMap((c) => Object.values(c)).every((n) => n === 0) && stats.splits === 0 && stats.linksCommitted === 0 && stats.linksRefused === 0 && stats.linksNew === 0 && stats.linksDisagreed === 0 && stats.lowScoreHolds === 0 && stats.outOfOrderFrames === 0 && stats.clockSteps === 0;
 }
 /** Shared empty — a fold is rare and every other frame would allocate. */
 var EMPTY_RIDER_FOLDS = [];
+/** The tape observation of a dropped frame: no gate verdict, nothing bound. */
+var DROPPED_FRAME_OBSERVATION = {
+	gate: {
+		strong: [],
+		weak: [],
+		confirmed: [],
+		woken: []
+	},
+	live: []
+};
 /** Mapping from StateAnalyzer's `ObjectState.state` values to the
 *  canonical TrackState enum used on tracks + events. */
 function mapObjectStateToTrackState(s) {
@@ -53478,6 +53981,14 @@ var FrameProcessor = class {
 					else if (f.kind === "new") this.stats.linksNew += 1;
 					else if (f.kind === "disagreed") this.stats.linksDisagreed += 1;
 					this.trackerObservers.link?.(f);
+				},
+				outOfOrder: (f) => {
+					this.stats.outOfOrderFrames += 1;
+					this.trackerObservers.outOfOrder?.(f);
+				},
+				clockStep: (f) => {
+					this.stats.clockSteps += 1;
+					this.trackerObservers.clockStep?.(f);
 				}
 			}
 		});
@@ -53761,6 +54272,37 @@ var FrameProcessor = class {
 	*  Zero is the expected reading; a rising one means two people stand close
 	*  together on this camera, which is worth knowing per-camera rather than
 	*  per-fleet. */
+	/**
+	* A frame `classifyFrame` called out of order: the tracker records the drop
+	* (and any clock-step run it extends) and nothing else reads the frame. The
+	* per-frame side tables a reader asks for afterwards are emptied, so it never
+	* re-reads the previous frame's.
+	*/
+	droppedFrame(input) {
+		this.tracker.drop(input.timestamp, input.frame.detections.length);
+		this.lastZoneOverlaps = /* @__PURE__ */ new Map();
+		this.lastZoneRejections = /* @__PURE__ */ new Map();
+		this.lastLabelWriteRefusals = [];
+		const fusions = this.tracker.drainFusions();
+		this.applyFusions(fusions);
+		return {
+			deviceId: this.deviceId,
+			timestamp: input.timestamp,
+			frameWidth: input.frame.width,
+			frameHeight: input.frame.height,
+			tracked: [],
+			objectEvents: [],
+			appearanceEvents: [],
+			rawTrackedDetections: [],
+			stationaryConfirmed: [],
+			stationaryWoken: [],
+			stationaryContinued: 0,
+			riderFolds: [],
+			...input.observe === true ? { observation: DROPPED_FRAME_OBSERVATION } : {},
+			fusions,
+			droppedOutOfOrder: true
+		};
+	}
 	facesRefusedOutsideParent() {
 		return this.faceOutsideParentCount;
 	}
@@ -53783,6 +54325,7 @@ var FrameProcessor = class {
 	}
 	process(input) {
 		const { timestamp, frame } = input;
+		if (this.tracker.classifyFrame(timestamp) === "out-of-order") return this.droppedFrame(input);
 		this.lastFrameT = timestamp;
 		this.lastFrameWallAt = this.wallClock();
 		const frameWidth = frame.width;
@@ -56534,239 +57077,6 @@ async function promoteTapeWindow(deps, input, signal) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/store/tracking-tape-index-store.ts
-/**
-* @durable class=ledger owner=pipeline-analytics
-*   write="one row per PROMOTED tracking-tape window (`debug.tape.promote`);
-*     updated when the operator marks it reviewed or releases its pins;
-*     deleted together with its file by `debug.tape.delete`."
-*   retention="NOT an age clock and NOT track retention — a promoted window is
-*     history being labelled (D681). Bounded by the promotion budget
-*     (MAX_PROMOTED_TAPES = 60, 1 GiB): a promotion beyond it is REFUSED,
-*     never satisfied by evicting another row."
-*/
-var TRACKING_TAPES_COLLECTION = "pipeline-analytics:tracking-tapes";
-var TRACKING_TAPES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "scenario",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "note",
-		type: "TEXT"
-	},
-	{
-		name: "lighting",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fromMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "toMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "state",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "frames",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "skips",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "gaps",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "bytes",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "reviewed",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "trackIds",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "releasedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "pinsSettled",
-		type: "BOOLEAN",
-		notNull: true
-	}
-];
-var TrackingTapeRowSchema = require_clip_model_registry.object({
-	id: require_clip_model_registry.string(),
-	deviceId: require_clip_model_registry.number().int(),
-	scenario: require_clip_model_registry.string(),
-	note: require_clip_model_registry.string().nullable(),
-	lighting: TapeLightingSchema,
-	fromMs: require_clip_model_registry.number().int(),
-	toMs: require_clip_model_registry.number().int(),
-	state: require_clip_model_registry._enum(["complete", "incomplete"]),
-	frames: require_clip_model_registry.number().int(),
-	skips: require_clip_model_registry.number().int(),
-	gaps: require_clip_model_registry.number().int(),
-	bytes: require_clip_model_registry.number().int(),
-	reviewed: require_clip_model_registry.boolean(),
-	trackIds: require_clip_model_registry.array(require_clip_model_registry.string()),
-	createdAt: require_clip_model_registry.number().int(),
-	releasedAt: require_clip_model_registry.number().int().nullable(),
-	pinsSettled: require_clip_model_registry.boolean()
-});
-var TrackIdsSchema = require_clip_model_registry.array(require_clip_model_registry.string());
-var TrackingTapeIndexStore = class {
-	store;
-	logger;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			columns: [...TRACKING_TAPES_COLUMNS],
-			indexes: [{
-				name: "idx_trackingtapes_device_created",
-				columns: ["deviceId", "createdAt"]
-			}]
-		});
-	}
-	async insert(row) {
-		const { id, trackIds, ...rest } = TrackingTapeRowSchema.parse(row);
-		await this.store.insert.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			record: {
-				id,
-				data: {
-					...rest,
-					trackIds: JSON.stringify(trackIds)
-				}
-			}
-		});
-	}
-	async get(id) {
-		const first = (await this.store.query.query({
-			collection: TRACKING_TAPES_COLLECTION,
-			filter: {
-				where: { id },
-				limit: 1
-			}
-		}))[0];
-		return first === void 0 ? null : this.parse(first.id, first.data);
-	}
-	async list(deviceId) {
-		const rows = await this.store.query.query({
-			collection: TRACKING_TAPES_COLLECTION,
-			filter: {
-				...deviceId !== void 0 ? { where: { deviceId } } : {},
-				orderBy: {
-					field: "createdAt",
-					direction: "desc"
-				},
-				limit: 1e3
-			}
-		});
-		const out = [];
-		for (const r of rows) {
-			const parsed = this.parse(r.id, r.data);
-			if (parsed !== null) out.push(parsed);
-		}
-		return out;
-	}
-	async setReviewed(id, reviewed) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: { reviewed }
-		});
-	}
-	/** Release AND unsettle in one row write: the unpins the release implies
-	*  are owed from this moment, whether or not the caller lives to make them. */
-	async setReleased(id, atMs) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: {
-				releasedAt: atMs,
-				pinsSettled: false
-			}
-		});
-	}
-	async setPinsSettled(id, settled) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: { pinsSettled: settled }
-		});
-	}
-	async remove(id) {
-		await this.store.delete.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			key: id
-		});
-	}
-	parse(id, data) {
-		let trackIds = [];
-		try {
-			trackIds = JSON.parse(String(data["trackIds"] ?? "[]"));
-		} catch {
-			trackIds = null;
-		}
-		const ids = TrackIdsSchema.safeParse(trackIds);
-		const parsed = TrackingTapeRowSchema.safeParse({
-			id,
-			...data,
-			note: data["note"] ?? null,
-			releasedAt: data["releasedAt"] ?? null,
-			trackIds: ids.success ? ids.data : null
-		});
-		if (parsed.success) return parsed.data;
-		this.logger.warn("tracking tape index: skipped a malformed row", {
-			meta: { id },
-			...typeof data["deviceId"] === "number" ? { tags: { deviceId: data["deviceId"] } } : {}
-		});
-		return null;
-	}
-};
-//#endregion
 //#region src/pipeline-analytics/tracking-bench/recorder/tape-status.ts
 /** The one node that may hold tapes: sqlite and bulk state are hub-only, and
 *  an agent persists nothing (spec §3.1). */
@@ -97697,6 +98007,12 @@ var TRACKER_FACT_LOG_SAMPLE_EVERY = 10;
 *  positive spawns (review M1: ~1 750 `new` decisions per camera per hour) —
 *  are sampled harder; the per-minute summary carries their exact counts. */
 var TRACKER_PIECE_LOG_SAMPLE_EVERY = 50;
+/** Out-of-order frames (follow-up 617, F1: ~1 % of frames) log the first N,
+*  then one in this many — every line carries the count; the per-minute
+*  summary carries the exact `outOfOrderFrames`. */
+var TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY = 50;
+/** Clock-step WARNs past the first ten (fix round 3, MEDIUM-1). */
+var TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY = 50;
 /** First N, then one in `every` — the refusal stream's cadence (D391). */
 function sampledTrackerFact(count, every = TRACKER_FACT_LOG_SAMPLE_EVERY) {
 	return count <= TRACKER_FACT_LOG_ALWAYS_FIRST || count % every === 0;
@@ -102344,9 +102660,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		let splitCount = 0;
 		let ignoredCount = 0;
 		let newCount = 0;
+		let outOfOrderCount = 0;
+		let clockStepCount = 0;
 		const endedCounts = /* @__PURE__ */ new Map();
 		const logLink = (f) => {
-			const meta = {
+			const decision = {
 				source,
 				t: f.t,
 				kind: f.kind,
@@ -102355,7 +102673,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				cost: f.cost,
 				gapMs: f.gapMs,
 				reason: f.reason,
-				recognition: f.recognition,
+				recognition: f.recognition
+			};
+			const meta = {
+				...decision,
 				candidates: f.candidates
 			};
 			switch (f.kind) {
@@ -102393,7 +102714,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						meta
 					});
 					return;
-				case "new":
+				case "new": {
+					if (f.reason === "clock-step") {
+						trackerLog.debug("tracker: piece decided new — closed by a frame clock step", {
+							tags: { deviceId },
+							meta
+						});
+						return;
+					}
 					if (f.reason === "unconfirmed") {
 						trackerLog.debug("tracker: piece decided new — never confirmed", {
 							tags: { deviceId },
@@ -102401,6 +102729,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						});
 						return;
 					}
+					const rejectedPredecessors = confirmedPredecessorRejections(f.candidates);
+					if (rejectedPredecessors.length > 0) {
+						trackerLog.info("tracker: piece decided new — a confirmed predecessor was rejected", {
+							tags: { deviceId },
+							meta: {
+								...decision,
+								rejectedPredecessors
+							}
+						});
+						return;
+					}
 					newCount += 1;
 					if (!sampledTrackerFact(newCount, TRACKER_PIECE_LOG_SAMPLE_EVERY)) return;
 					trackerLog.info("tracker: piece decided new — no predecessor", {
@@ -102411,6 +102750,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						}
 					});
 					return;
+				}
 			}
 		};
 		p.setTrackerObservers({
@@ -102431,6 +102771,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				});
 			},
 			link: logLink,
+			clockStep: (f) => {
+				clockStepCount += 1;
+				if (!sampledTrackerFact(clockStepCount, TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY)) return;
+				trackerLog.warn("tracker: frame clock stepped back — tracklets ended, clock rebased", {
+					tags: { deviceId },
+					meta: {
+						source,
+						t: f.t,
+						lastFrameT: f.lastFrameT,
+						behindMs: f.behindMs,
+						ended: f.ended,
+						clockStepCount,
+						sampledEvery: TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY
+					}
+				});
+			},
+			outOfOrder: (f) => {
+				outOfOrderCount += 1;
+				if (!sampledTrackerFact(outOfOrderCount, TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY)) return;
+				trackerLog.info("tracker: out-of-order frame dropped — older than the latest frame", {
+					tags: { deviceId },
+					meta: {
+						source,
+						t: f.t,
+						lastFrameT: f.lastFrameT,
+						behindMs: f.behindMs,
+						detections: f.detections,
+						pendingClockStep: f.pendingClockStep,
+						outOfOrderCount,
+						sampledEvery: TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY
+					}
+				});
+			},
 			ended: (f) => {
 				const k = `${f.reason}:${String(f.confirmed)}`;
 				const n = (endedCounts.get(k) ?? 0) + 1;
@@ -102572,6 +102945,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			});
 		});
 		this.reportTrackerSummary(deviceId, key, processor, "frame");
+		if (result.droppedOutOfOrder === true) return;
 		for (const r of processor.getLastLabelWriteRefusals()) {
 			const message = r.reason.kind === "macro-class" ? "label tier collapse refused" : "label write refused";
 			this.ctx.logger.info(message, {