@camstack/addon-post-analysis 1.2.307 → 1.2.309

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-C67UM_q_.js");
+const require_clip_model_registry = require("../clip-model-registry-B3M4ZI17.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -13492,6 +13492,8 @@ var en_default = {
 	"summary.body.empty": "nothing was seen in this window",
 	"system.state-summary.title": "{{rule}}",
 	"system.state-summary.body": "{{summaryText}}",
+	"system.state-summary.section.title": "{{rule}} — {{summarySection}}",
+	"system.state-summary.section.body": "{{summaryText}}",
 	"summary.section.device-state": "Devices offline or switched off",
 	"summary.section.streams": "Streams offline",
 	"summary.section.battery": "Low batteries",
@@ -13820,6 +13822,8 @@ var it_default = {
 	"summary.body.empty": "nessun evento in questa finestra",
 	"system.state-summary.title": "{{rule}}",
 	"system.state-summary.body": "{{summaryText}}",
+	"system.state-summary.section.title": "{{rule}} — {{summarySection}}",
+	"system.state-summary.section.body": "{{summaryText}}",
 	"summary.section.device-state": "Dispositivi offline o spenti",
 	"summary.section.streams": "Stream offline",
 	"summary.section.battery": "Batterie scariche",
@@ -15765,6 +15769,38 @@ function planRuleTest(input) {
 	};
 }
 //#endregion
+//#region src/notification-center/state-summary/state-summary-test.ts
+/**
+* What TESTING a state-summary rule answers (D698, `nc.testRule`).
+*
+* A summary rule sends nothing per event (D647), so the per-event test the
+* other rules get — one synthetic event, injected — can never deliver for it.
+* Its test builds the summary NOW and enqueues it; this is the report: the
+* rows it enqueued (one, or one per section) and every section's read, so
+* "nothing to report" is an answer with its reason per section, never a
+* silence.
+*/
+var NcStateSummaryTestSchema = require_clip_model_registry.object({
+	/** The test's record id — a per-section row appends `:<sectionId>`. */
+	recordId: require_clip_model_registry.string(),
+	split: require_clip_model_registry._enum(["rule", "section"]),
+	/** Nothing open and every section read: nothing was enqueued. */
+	nothingToReport: require_clip_model_registry.boolean(),
+	sections: require_clip_model_registry.array(require_clip_model_registry.object({
+		id: require_clip_model_registry.string(),
+		status: require_clip_model_registry._enum(["read", "unavailable"]),
+		items: require_clip_model_registry.number().int().nonnegative(),
+		reason: require_clip_model_registry.string().optional()
+	})),
+	rows: require_clip_model_registry.array(require_clip_model_registry.object({
+		recordId: require_clip_model_registry.string(),
+		/** The section of a per-section row. */
+		section: require_clip_model_registry.string().optional(),
+		enqueued: require_clip_model_registry.number().int().nonnegative(),
+		targetIds: require_clip_model_registry.array(require_clip_model_registry.string())
+	}))
+});
+//#endregion
 //#region src/notification-center/clock-text.ts
 /**
 * `{{time}}` — hours and minutes in the NOTIFICATION language.
@@ -17132,13 +17168,18 @@ var ncActions = require_clip_model_registry.defineCustomActions({
 		deviceId: require_clip_model_registry.number().int().optional()
 	}), NcTestEventResultSchema.extend({
 		/** The subject kind the rule was tested with — the answer to "why was my
-		*  rule not a candidate". */
+		*  rule not a candidate". `state-summary` for a summary rule (D698). */
 		trigger: require_clip_model_registry.string(),
 		/** What the plan could not reproduce (a device-state gate, a polygon). */
 		planNotes: require_clip_model_registry.array(require_clip_model_registry.object({
 			conditionId: require_clip_model_registry.string(),
 			note: require_clip_model_registry.string()
-		}))
+		})),
+		/**
+		* A STATE-SUMMARY rule's test (D698): the summary built now and the rows
+		* it enqueued, or why nothing was — absent on every other rule.
+		*/
+		stateSummary: NcStateSummaryTestSchema.optional()
 	}), {
 		kind: "mutation",
 		auth: "admin",
@@ -17497,6 +17538,48 @@ function makeNcActionHandlers(deps) {
 		if (rule.ownerUserId !== void 0 && rule.ownerUserId !== caller.userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
 		return rule;
 	};
+	/**
+	* TEST a STATE-SUMMARY rule (D698). The per-event injection cannot deliver
+	* for it — a summary rule sends nothing per event (D647), and that test used
+	* to be dropped without a word — so the summary is built NOW and enqueued.
+	* The answer is shaped like every rule test's, plus the summary's own report.
+	*/
+	const testSummaryRule = async (rule, by) => {
+		const test = deps.testStateSummary;
+		if (test === void 0) throw new Error("this node does not host the notification centre — test on the hub");
+		deps.logger.info("rule test requested", { meta: {
+			by,
+			ruleId: rule.id,
+			ruleName: rule.name,
+			trigger: "state-summary",
+			bypassMute: true
+		} });
+		const report = await test(rule);
+		const enqueued = report.rows.reduce((sum, row) => sum + row.enqueued, 0);
+		const notes = ["per-camera notification mute bypassed"];
+		if (report.nothingToReport) notes.push(`nothing to report — ${report.sections.map((section) => `${section.id}: ${section.status === "read" ? `${String(section.items)} open` : "unavailable"}`).join(", ")} — nothing was sent, as the scheduled summary would send nothing`);
+		else if (enqueued === 0) notes.push("the summary was built but no row was enqueued — the rule reaches no target");
+		return {
+			recordId: report.recordId,
+			origin: "synthetic",
+			delivery: rule.delivery,
+			candidates: 1,
+			outcomes: [{
+				ruleId: rule.id,
+				ruleName: rule.name,
+				matched: !report.nothingToReport,
+				cooldown: "bypassed",
+				enqueued,
+				targetIds: [...new Set(report.rows.flatMap((row) => row.targetIds))]
+			}],
+			still: "unattachable",
+			notes,
+			...report.nothingToReport ? { droppedBy: "nothing-to-report" } : {},
+			trigger: "state-summary",
+			planNotes: [],
+			stateSummary: report
+		};
+	};
 	/** The producer half, or an honest refusal. */
 	const requireTimelapse = () => {
 		const tl = deps.timelapse;
@@ -17831,6 +17914,7 @@ function makeNcActionHandlers(deps) {
 			const inject = deps.injectTestEvent;
 			if (inject === void 0) throw new Error("this node does not host the notification centre — test on the hub");
 			const rule = assertRuleVisible(input.ruleId, c);
+			if (require_clip_model_registry.isSystemEventSummaryRule(rule)) return testSummaryRule(rule, c.userId);
 			const plan = planRuleTest({
 				rule,
 				now: Date.now(),
@@ -19665,6 +19749,77 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/state-summary/state-model.ts
+/**
+* The STATE SUMMARY's vocabulary (D647): its sections, and what one reported
+* item is.
+*
+* A section is one of the D637 kind GROUPS (`NC_SYSTEM_EVENT_KIND_GROUP_SPECS`)
+* — the same grouping both editors list kinds under — so "the rule selected a
+* battery kind" and "the summary has a battery section" are the same fact.
+* `backups-exports` is the one group with no section: a backup or an export is
+* a job that COMPLETED, and the state it leaves behind is not a condition that
+* is still true. The ADR records why it is excluded rather than approximated.
+*/
+var NC_STATE_SUMMARY_SECTION_IDS = [
+	"device-state",
+	"streams",
+	"battery",
+	"consumables",
+	"tanks",
+	"detection-blind",
+	"nodes",
+	"addons",
+	"updates"
+];
+/** The kind groups that have no section, and why — said on the preview. */
+var NC_STATE_SUMMARY_EXCLUDED_GROUPS = { "backups-exports": "a backup or an export is a completed job, not a state that is still true" };
+function isStateSectionId(value) {
+	return NC_STATE_SUMMARY_SECTION_IDS.some((id) => id === value);
+}
+/** The template variable that carries one section's lines (`template-vars.ts`). */
+var NC_STATE_SECTION_VAR = {
+	"device-state": "summaryDevices",
+	streams: "summaryStreams",
+	battery: "summaryBattery",
+	consumables: "summaryConsumables",
+	tanks: "summaryTanks",
+	"detection-blind": "summaryDetection",
+	nodes: "summaryNodes",
+	addons: "summaryAddons",
+	updates: "summaryUpdates"
+};
+/** The kinds of a section — its kind group. */
+function sectionKinds(section) {
+	return require_clip_model_registry.NC_SYSTEM_EVENT_KIND_GROUP_SPECS.find((group) => group.id === section)?.kinds ?? [];
+}
+/**
+* The sections a rule reports, in section order: every section whose kind
+* group shares a kind with the rule. A rule that selected only
+* `device-battery-low` still reports the battery STATE — the state has no
+* direction, only the event did.
+*/
+function sectionsOfRule(condition) {
+	return NC_STATE_SUMMARY_SECTION_IDS.filter((section) => sectionKinds(section).some((kind) => condition.kinds.includes(kind)));
+}
+/** The kind groups the rule selected that have no section. */
+function excludedGroupsOfRule(condition) {
+	return require_clip_model_registry.NC_SYSTEM_EVENT_KIND_GROUP_SPECS.filter((group) => NC_STATE_SUMMARY_EXCLUDED_GROUPS[group.id] !== void 0 && group.kinds.some((kind) => condition.kinds.includes(kind))).map((group) => group.id);
+}
+/**
+* The condition the summary judges its items with: the rule's own, with its
+* kinds widened to every kind of every section it reports — so a rule that
+* named the raise is not told "not my kind" about the state the raise left
+* behind. Every FILTER is the rule's, untouched.
+*/
+function summaryCondition(condition) {
+	const kinds = sectionsOfRule(condition).flatMap((section) => sectionKinds(section));
+	return {
+		...condition,
+		kinds: [...new Set([...condition.kinds, ...kinds])]
+	};
+}
+//#endregion
 //#region src/notification-center/state-summary/state-summary-delivery.ts
 /**
 * A state summary as an ORDINARY system-event subject (D647), so it reaches the
@@ -19673,7 +19828,9 @@ var NcDeviceStateCache = class {
 * which renders the rule's own template with the summary's variables.
 *
 * - `recordId` is `state-summary:<ruleId>:<windowEndMs>` — the outbox dedup
-*   key, so a restart can never enqueue one window twice.
+*   key, so a restart can never enqueue one window twice. Split per SECTION
+*   (D698), each row is `state-summary:<ruleId>:<windowEndMs>:<sectionId>`:
+*   the same guarantee, per section.
 * - The row files under the system device (0): a summary spans devices.
 *   `targetUsers` therefore reach admins only — a user whose grant is
 *   narrower than the whole installation must not be sent the names of
@@ -19687,20 +19844,37 @@ var NcDeviceStateCache = class {
 */
 var NC_STATE_SUMMARY_TITLE_KEY = "system.state-summary.title";
 var NC_STATE_SUMMARY_BODY_KEY = "system.state-summary.body";
+/** A per-section row's title and body (D698): the rule's name and the section's. */
+var NC_STATE_SUMMARY_SECTION_TITLE_KEY = "system.state-summary.section.title";
+var NC_STATE_SUMMARY_SECTION_BODY_KEY = "system.state-summary.section.body";
 function stateSummaryRecordId(ruleId, windowEndMs) {
 	return `state-summary:${ruleId}:${String(windowEndMs)}`;
 }
+/**
+* The record id of a TEST of the rule (D698, `nc.testRule`): its own prefix,
+* so a test can never take — or be swallowed by — a real window's dedup key.
+*/
+function stateSummaryTestRecordId(ruleId, nowMs) {
+	return `state-summary-test:${ruleId}:${String(nowMs)}`;
+}
+/** One section's row: the record id of the whole, plus `:<sectionId>` — the per-section dedup key. */
+function sectionRecordId(base, sectionId) {
+	return `${base}:${sectionId}`;
+}
 /** Is this system-event data the data of a state-summary row? */
 function isStateSummaryData(data) {
 	return data["stateSummary"] === true;
 }
+function recordBaseOf(input) {
+	return input.recordBase ?? stateSummaryRecordId(input.rule.id, input.window.endMs);
+}
 /** `null` when the rule has no system-event condition (the guard refuses that). */
 function stateSummarySubject(input) {
 	const kind = input.rule.conditions.systemEvent?.kinds[0];
 	if (kind === void 0) return null;
 	return {
 		kind: "system-event",
-		recordId: stateSummaryRecordId(input.rule.id, input.window.endMs),
+		recordId: recordBaseOf(input),
 		deviceId: NC_SYSTEM_DEVICE_ID$1,
 		timestamp: input.window.endMs,
 		classNames: [],
@@ -19713,6 +19887,7 @@ function stateSummarySubject(input) {
 			textParams: {
 				summaryText: input.text.text,
 				summaryCount: String(input.text.count),
+				summarySection: input.text.sections.map((section) => section.title).join(", "),
 				...input.text.sectionVars
 			},
 			textCount: input.text.count,
@@ -19730,13 +19905,82 @@ function stateSummarySubject(input) {
 	};
 }
 /**
+* The rows one summary window sends. `rule`: the one D647 row. `section`: one
+* row per section with something to say — its items, or the sentence that it
+* is UNAVAILABLE, exactly as the combined text words it. A section with
+* nothing open sends nothing; neither does a summary with nothing at all.
+*/
+function stateSummarySubjects(input) {
+	if (input.split === "rule") {
+		const subject = stateSummarySubject(input);
+		return subject === null ? [] : [subject];
+	}
+	const kind = input.rule.conditions.systemEvent?.kinds[0];
+	if (kind === void 0) return [];
+	return input.text.sections.map((section) => sectionSubject(input, kind, section));
+}
+function sectionSubject(input, kind, section) {
+	const sectionVars = {};
+	for (const name of Object.keys(input.text.sectionVars)) sectionVars[name] = "";
+	sectionVars[NC_STATE_SECTION_VAR[section.id]] = section.text;
+	return {
+		kind: "system-event",
+		recordId: sectionRecordId(recordBaseOf(input), section.id),
+		deviceId: NC_SYSTEM_DEVICE_ID$1,
+		timestamp: input.window.endMs,
+		classNames: [],
+		zones: [],
+		systemEvent: {
+			kind,
+			subject: `state-summary:${input.rule.id}:${section.id}`,
+			titleKey: NC_STATE_SUMMARY_SECTION_TITLE_KEY,
+			bodyKey: NC_STATE_SUMMARY_SECTION_BODY_KEY,
+			textParams: {
+				summaryText: section.body,
+				summaryCount: String(section.count),
+				summarySection: section.title,
+				...sectionVars
+			},
+			textCount: section.count,
+			data: {
+				stateSummary: true,
+				section: section.id,
+				windowStartMs: input.window.startMs,
+				windowEndMs: input.window.endMs,
+				sections: [{
+					id: section.id,
+					status: section.status,
+					items: section.count
+				}]
+			}
+		}
+	};
+}
+/** The section a per-section row is about (`data.section`), or `undefined` on a combined row. */
+function stateSummarySectionOf(subject) {
+	const section = subject.systemEvent?.data["section"];
+	return typeof section === "string" && isStateSectionId(section) ? section : void 0;
+}
+/** Does a body name `{{summaryText}}` or this section's own variable? */
+function bodyCarriesSection(body, section) {
+	return new RegExp(`\\{\\{\\s*(?:summaryText|${NC_STATE_SECTION_VAR[section]})\\s*\\}\\}`).test(body);
+}
+/**
 * The rule as its summary is ENQUEUED: a custom body that carries none of the
 * summary's content gets `{{summaryText}}` appended on its own line, so an
 * operator's body never sends an empty summary (review M3). `null` = unchanged.
+*
+* On a per-SECTION row (D698 review M3) the content is THIS section's: a body
+* naming only `{{summaryBattery}}` carries the battery row and nothing on the
+* streams row, so every other section's row gets `{{summaryText}}` — its own
+* lines — appended.
 */
-function withSummaryBody(rule) {
+function withSummaryBody(rule, section) {
 	const body = rule.template?.body;
-	if (require_clip_model_registry.templateCarriesSummary(body)) return null;
+	if (require_clip_model_registry.templateCarriesSummary(body)) {
+		if (section === void 0 || body === void 0 || body.trim().length === 0) return null;
+		if (bodyCarriesSection(body, section)) return null;
+	}
 	return {
 		...rule,
 		template: {
@@ -23785,6 +24029,120 @@ function withTimeout$3(promise, ms, what) {
 	});
 }
 //#endregion
+//#region src/notification-center/boot-window-rows.ts
+var BootWindowRows = class {
+	deps;
+	window = /* @__PURE__ */ new Map();
+	/** Deferred closes, keyed so a repeat (one per detection) replaces rather than grows. */
+	deferred = /* @__PURE__ */ new Map();
+	settled = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Is the ledger still inside its boot window (not settled after an answered load)? */
+	open() {
+		return !this.settled;
+	}
+	/** Stage a row that would be CREATED inside the window — mirror only, never persisted. */
+	stageProvisional(row) {
+		this.deps.ledger.stage(row);
+		this.window.set(this.deps.keyOf(row), {
+			kind: "provisional",
+			row
+		});
+	}
+	/** A row the ledger persisted inside the window: the load must not regress it. */
+	noteWritten(row) {
+		this.window.set(this.deps.keyOf(row), {
+			kind: "written",
+			row
+		});
+	}
+	/** A key the ledger removed inside the window: the load must not resurrect it. */
+	noteRemoved(key) {
+		this.window.set(key, { kind: "removed" });
+	}
+	/**
+	* While the window is open, keep `replay` to run against the LOADED rows at
+	* the settle; once settled, nothing — the caller's own pass already saw every
+	* row (review LOW-5: no allocation per detection after boot). `key` names the
+	* close: the same key deferred twice runs once, at the place it was first
+	* deferred. `replay` answers how many rows it closed.
+	*/
+	deferWhileOpen(key, replay) {
+		if (this.open()) this.deferred.set(key, replay);
+	}
+	/**
+	* Close the window — call right after the ledger's `load`. A load that did
+	* not answer leaves the window open and returns `null`.
+	*/
+	settle() {
+		if (this.settled) return null;
+		if (!this.deps.ledger.hasAnswered()) {
+			this.deps.logger.warn("boot window NOT settled — the load did not answer", { meta: {
+				collection: this.deps.ledger.collection,
+				pendingCloses: this.deferred.size,
+				provisionalRows: this.window.size
+			} });
+			return null;
+		}
+		this.settled = true;
+		const ledger = this.deps.ledger;
+		let replayed = 0;
+		for (const replay of this.deferred.values()) replayed += replay();
+		this.deferred.clear();
+		let keptStored = 0;
+		let written = 0;
+		for (const [key, entry] of this.window) {
+			if (entry.kind === "removed") {
+				ledger.forget(key);
+				continue;
+			}
+			if (entry.kind === "written") {
+				ledger.stage(entry.row);
+				continue;
+			}
+			const mirrored = ledger.get(key);
+			const stored = mirrored === entry.row ? void 0 : mirrored;
+			const held = this.deps.merge(stored, entry.row);
+			const deviceId = this.deps.deviceIdOf(entry.row);
+			const tags = deviceId !== void 0 ? { tags: { deviceId } } : {};
+			if (stored !== void 0 && held === stored) {
+				keptStored += 1;
+				this.deps.logger.debug("boot-window row kept as stored — the restart learned nothing new", {
+					...tags,
+					meta: {
+						collection: ledger.collection,
+						key
+					}
+				});
+				continue;
+			}
+			ledger.put(held);
+			written += 1;
+			this.deps.logger.debug("boot-window row written at load", {
+				...tags,
+				meta: {
+					collection: ledger.collection,
+					key,
+					stored: stored !== void 0
+				}
+			});
+		}
+		this.window.clear();
+		const merge = {
+			keptStored,
+			written,
+			replayed
+		};
+		this.deps.logger.info("boot window settled", { meta: {
+			collection: ledger.collection,
+			...merge
+		} });
+		return merge;
+	}
+};
+//#endregion
 //#region src/notification-center/liveness-ledger.ts
 /**
 * @durable class=ledger owner=notification-center
@@ -23895,12 +24253,26 @@ var NC_LIVENESS_SPEC = {
 };
 var NcLivenessLedger = class {
 	ledger;
+	/**
+	* What was observed before the boot load answered (D698) — see
+	* `boot-window-rows.ts`. A stored row holding the same STATE keeps its own
+	* `updatedAt`: a restart that re-hears "offline" learned nothing about WHEN
+	* the device went offline, and `updatedAt` is the state summary's "since".
+	*/
+	bootWindow;
 	constructor(deps) {
 		this.ledger = new DurableLedger({
 			spec: NC_LIVENESS_SPEC,
 			store: deps.store,
 			logger: deps.logger
 		});
+		this.bootWindow = new BootWindowRows({
+			ledger: this.ledger,
+			keyOf: (row) => row.subject,
+			deviceIdOf: (row) => row.deviceId,
+			logger: deps.logger,
+			merge: (stored, provisional) => stored !== void 0 && stored.state === provisional.state ? stored : provisional
+		});
 	}
 	static declare(store) {
 		return DurableLedger.declare(store, NC_LIVENESS_SPEC);
@@ -23915,7 +24287,9 @@ var NcLivenessLedger = class {
 	* flood, so no error path may do it on purpose.
 	*/
 	async load() {
-		return (await this.ledger.load()).length;
+		const loaded = (await this.ledger.load()).length;
+		this.bootWindow.settle();
+		return loaded;
 	}
 	/** Has a load READ the store once? Until then the mirror is not the truth (D647 reads it). */
 	hasAnswered() {
@@ -24008,13 +24382,21 @@ var NcLivenessLedger = class {
 	* spoke". That is the timestamp anyone reading the table wants.
 	*/
 	observe(observation, now) {
-		return this.ledger.observe({
+		const row = {
 			subject: observation.subject,
 			state: observation.state,
 			kind: observation.kind,
 			...observation.deviceId !== void 0 ? { deviceId: observation.deviceId } : {},
 			updatedAt: now
-		});
+		};
+		if (!this.bootWindow.open()) return this.ledger.observe(row);
+		if (this.ledger.get(row.subject) === void 0) {
+			this.bootWindow.stageProvisional(row);
+			return "seeded";
+		}
+		const verdict = this.ledger.observe(row);
+		if (verdict === "flip") this.bootWindow.noteWritten(row);
+		return verdict;
 	}
 };
 /** The persisted column map (the `subject` PK is passed separately). */
@@ -30549,74 +30931,6 @@ function stateSources(ports) {
 	return { read: (section, nowMs) => readSection(section, ports, nowMs) };
 }
 //#endregion
-//#region src/notification-center/state-summary/state-model.ts
-/**
-* The STATE SUMMARY's vocabulary (D647): its sections, and what one reported
-* item is.
-*
-* A section is one of the D637 kind GROUPS (`NC_SYSTEM_EVENT_KIND_GROUP_SPECS`)
-* — the same grouping both editors list kinds under — so "the rule selected a
-* battery kind" and "the summary has a battery section" are the same fact.
-* `backups-exports` is the one group with no section: a backup or an export is
-* a job that COMPLETED, and the state it leaves behind is not a condition that
-* is still true. The ADR records why it is excluded rather than approximated.
-*/
-var NC_STATE_SUMMARY_SECTION_IDS = [
-	"device-state",
-	"streams",
-	"battery",
-	"consumables",
-	"tanks",
-	"detection-blind",
-	"nodes",
-	"addons",
-	"updates"
-];
-/** The kind groups that have no section, and why — said on the preview. */
-var NC_STATE_SUMMARY_EXCLUDED_GROUPS = { "backups-exports": "a backup or an export is a completed job, not a state that is still true" };
-/** The template variable that carries one section's lines (`template-vars.ts`). */
-var NC_STATE_SECTION_VAR = {
-	"device-state": "summaryDevices",
-	streams: "summaryStreams",
-	battery: "summaryBattery",
-	consumables: "summaryConsumables",
-	tanks: "summaryTanks",
-	"detection-blind": "summaryDetection",
-	nodes: "summaryNodes",
-	addons: "summaryAddons",
-	updates: "summaryUpdates"
-};
-/** The kinds of a section — its kind group. */
-function sectionKinds(section) {
-	return require_clip_model_registry.NC_SYSTEM_EVENT_KIND_GROUP_SPECS.find((group) => group.id === section)?.kinds ?? [];
-}
-/**
-* The sections a rule reports, in section order: every section whose kind
-* group shares a kind with the rule. A rule that selected only
-* `device-battery-low` still reports the battery STATE — the state has no
-* direction, only the event did.
-*/
-function sectionsOfRule(condition) {
-	return NC_STATE_SUMMARY_SECTION_IDS.filter((section) => sectionKinds(section).some((kind) => condition.kinds.includes(kind)));
-}
-/** The kind groups the rule selected that have no section. */
-function excludedGroupsOfRule(condition) {
-	return require_clip_model_registry.NC_SYSTEM_EVENT_KIND_GROUP_SPECS.filter((group) => NC_STATE_SUMMARY_EXCLUDED_GROUPS[group.id] !== void 0 && group.kinds.some((kind) => condition.kinds.includes(kind))).map((group) => group.id);
-}
-/**
-* The condition the summary judges its items with: the rule's own, with its
-* kinds widened to every kind of every section it reports — so a rule that
-* named the raise is not told "not my kind" about the state the raise left
-* behind. Every FILTER is the rule's, untouched.
-*/
-function summaryCondition(condition) {
-	const kinds = sectionsOfRule(condition).flatMap((section) => sectionKinds(section));
-	return {
-		...condition,
-		kinds: [...new Set([...condition.kinds, ...kinds])]
-	};
-}
-//#endregion
 //#region src/notification-center/state-summary/state-summary.ts
 /** Nothing to say: no item, and every section READ. Such a summary is not sent. */
 function isEmptyStateSummary(summary) {
@@ -30717,28 +31031,50 @@ function lineOf(input, item) {
 		}
 	});
 }
-function blockOf(input, section) {
-	const title = input.texts.text({ key: `summary.section.${section.id}` });
-	if (section.status === "unavailable") return input.texts.text({
-		key: "summary.section.unavailable",
-		vars: { section: title }
-	});
+function sectionTitle(input, section) {
+	return input.texts.text({ key: `summary.section.${section.id}` });
+}
+/** A section's words: its block, and the body a per-section row sends. `null` = nothing to say. */
+function wordsOf(input, section) {
+	const title = sectionTitle(input, section);
+	if (section.status === "unavailable") {
+		const sentence = input.texts.text({
+			key: "summary.section.unavailable",
+			vars: { section: title }
+		});
+		return {
+			block: sentence,
+			body: sentence
+		};
+	}
 	if (section.items.length === 0) return null;
-	const lines = section.items.map((item) => `• ${lineOf(input, item)}`);
-	return [`${title}:`, ...lines].join("\n");
+	const lines = section.items.map((item) => `• ${lineOf(input, item)}`).join("\n");
+	return {
+		block: `${title}:\n${lines}`,
+		body: lines
+	};
 }
 function stateSummaryText(input) {
 	const sectionVars = {};
-	const blocks = [];
+	const sections = [];
 	for (const section of input.summary.sections) {
-		const block = blockOf(input, section);
-		sectionVars[NC_STATE_SECTION_VAR[section.id]] = block ?? "";
-		if (block !== null) blocks.push(block);
+		const words = wordsOf(input, section);
+		sectionVars[NC_STATE_SECTION_VAR[section.id]] = words?.block ?? "";
+		if (words === null) continue;
+		sections.push({
+			id: section.id,
+			title: sectionTitle(input, section),
+			text: words.block,
+			body: words.body,
+			count: section.items.length,
+			status: section.status
+		});
 	}
 	return {
-		text: blocks.join("\n"),
+		text: sections.map((section) => section.text).join("\n"),
 		count: input.summary.itemCount,
-		sectionVars
+		sectionVars,
+		sections
 	};
 }
 //#endregion
@@ -31175,6 +31511,40 @@ var NcStateSummaryStampStore = class {
 //#endregion
 //#region src/notification-center/state-summary/system-state-ledger.ts
 /**
+* NcSystemStateLedger — what is STILL TRUE among the event-driven system facts
+* no other ledger holds (D647).
+*
+* Battery, consumable and tank episodes already have a durable row
+* (`alert-store.ts`), and device/node liveness has its own
+* (`liveness-ledger.ts`). The rest of the summarisable kinds are EVENTS the
+* centre hears once — a stream going offline, a device switched off, a camera
+* detecting nothing, an update becoming available — and nothing remembered
+* that they were still true. A state summary is a claim about now, so this
+* ledger keeps one row per OPEN state, fed by the same intake the instant
+* rules read, and removes it when the closing event arrives:
+*
+* | opens | closes |
+* | --- | --- |
+* | `stream-offline` | `stream-online` (same subject) |
+* | `device-disabled` | `device-enabled` (same subject) |
+* | `detection-blind` | a DETECTION on that camera — the only evidence of recovery there is |
+* | `node-inference-unavailable`, `addon-crash-loop` | the node's next liveness edge, or a server update on it |
+* | `addon-update-available` (per package, per node) | `addon.updated` for that package on that node |
+* | `server-` / `wrapper-update-available` | `server-updated` on that node |
+*
+* Two kinds have no recovery event at all (`node-inference-unavailable`,
+* `addon-crash-loop`): the orchestrator drops such a node until it comes back,
+* and a crash-looped runner stays down until something respawns it — a node
+* restart or an update. The closing edges above are those respawns. A newer
+* `update-available` for the same package REPLACES the row.
+*
+* Durable (write-behind), so a restart does not forget an outage it heard
+* about. It is fed only on the evaluating node, like the liveness ledger. The
+* summary reads the RAM mirror only — never SQLite on its schedule (D447) —
+* and a mirror that has not loaded answers `null`: the sections it feeds say
+* "unavailable", never "none" (D49).
+*/
+/**
 * @durable class=ledger owner=notification-center
 *   write="a system state the centre accepted OPENING (a stream offline, a device switched off, a camera detecting nothing, an update available, a node that cannot infer, a crash-looped runner); its closing event deletes the row"
 *   retention="none — a row lives exactly as long as its state is open. Bounded by the installation: streams, devices, nodes and installed packages."
@@ -31336,9 +31706,7 @@ var NcSystemStateLedger = class {
 	}
 	/** A detection on a camera: it is not blind. Called for every detection — a Map lookup. */
 	observeDetection(deviceId) {
-		const key = `detection-blind:${String(deviceId)}`;
-		if (this.deps.rows.get(key) === void 0) return;
-		this.close(key, "detection");
+		this.close(`detection-blind:${String(deviceId)}`, "detection");
 	}
 	/**
 	* Any `stream.online`, whatever its reason (D647 review I1). The intake gate
@@ -31353,7 +31721,7 @@ var NcSystemStateLedger = class {
 		const keep = new Set(list.rows.map((pkg) => updateStateKey(list.target, pkg.nodeId, pkg.packageName)));
 		for (const nodeId of list.nodeIds) {
 			const prefix = `update:${list.target}:${nodeId}:`;
-			for (const row of this.deps.rows.all()) if (row.key.startsWith(prefix) && !keep.has(row.key)) this.close(row.key, "update-list");
+			this.closeWhere(`update-list:${list.target}:${nodeId}`, (row) => row.key.startsWith(prefix) && !keep.has(row.key), "update-list");
 		}
 		for (const pkg of list.rows) this.openUpdate(list.target, pkg, atMs);
 	}
@@ -31363,11 +31731,7 @@ var NcSystemStateLedger = class {
 	* on that node.
 	*/
 	observeAddonStarted(addonId, nodeId) {
-		for (const row of this.deps.rows.all()) {
-			if (row.kind !== "addon-crash-loop") continue;
-			if (row.nodeId !== nodeId) continue;
-			if ((row.params["addons"] ?? "").split(",").map((id) => id.trim()).includes(addonId)) this.close(row.key, "addon-started");
-		}
+		this.closeWhere(`addon-started:${nodeId}:${addonId}`, (row) => row.kind === "addon-crash-loop" && row.nodeId === nodeId && (row.params["addons"] ?? "").split(",").map((id) => id.trim()).includes(addonId), "addon-started");
 	}
 	/**
 	* The balancer placed a camera on a node (not pinned): placement skips a
@@ -31423,11 +31787,31 @@ var NcSystemStateLedger = class {
 			}
 		});
 	}
+	/**
+	* Close one state: the row held now (a loaded one, or one opened in the boot
+	* window), and — deferred while the boot window is open — the STORED row
+	* the window cannot see yet (D698 review H1).
+	*/
 	close(key, by) {
+		this.closeIfHeld(key, by, false);
+		this.deps.rows.deferWhileOpen(`close:${key}`, () => this.closeIfHeld(key, by, true) ? 1 : 0);
+	}
+	/** {@link close} for every row a predicate names — now, and against the loaded rows. */
+	closeWhere(key, names, by) {
+		const run = (replayed) => {
+			let closed = 0;
+			for (const row of this.deps.rows.all()) if (names(row) && this.closeIfHeld(row.key, by, replayed)) closed += 1;
+			return closed;
+		};
+		run(false);
+		this.deps.rows.deferWhileOpen(`where:${key}`, () => run(true));
+	}
+	/** Close the row if one is held; `true` when it was. */
+	closeIfHeld(key, by, replayed) {
 		const held = this.deps.rows.get(key);
-		if (held === void 0) return;
+		if (held === void 0) return false;
 		this.deps.rows.remove(key);
-		this.deps.logger?.debug("system state closed", {
+		const line = {
 			...held.deviceId !== void 0 ? { tags: { deviceId: held.deviceId } } : {},
 			meta: {
 				key,
@@ -31435,49 +31819,78 @@ var NcSystemStateLedger = class {
 				by,
 				since: held.since
 			}
-		});
+		};
+		if (replayed) {
+			this.deps.logger?.info("system state closed by an event heard before the load", line);
+			return true;
+		}
+		this.deps.logger?.debug("system state closed", line);
+		return true;
 	}
 	closeNodeFaults(nodeId, by) {
-		for (const row of this.deps.rows.all()) {
-			if (row.nodeId !== nodeId) continue;
-			if (row.kind === "node-inference-unavailable" || row.kind === "addon-crash-loop") this.close(row.key, by);
-		}
+		this.closeWhere(`node-faults:${nodeId}`, (row) => row.nodeId === nodeId && (row.kind === "node-inference-unavailable" || row.kind === "addon-crash-loop"), by);
 	}
 	closeServerUpdate(nodeId) {
-		for (const row of this.deps.rows.all()) {
-			if ((row.nodeId ?? HUB_NODE) !== nodeId) continue;
-			if (row.kind === "server-update-available" || row.kind === "wrapper-update-available" || row.kind === "addon-crash-loop" || row.kind === "node-inference-unavailable") this.close(row.key, "server-updated");
-		}
+		this.closeWhere(`server-update:${nodeId}`, (row) => (row.nodeId ?? HUB_NODE) === nodeId && (row.kind === "server-update-available" || row.kind === "wrapper-update-available" || row.kind === "addon-crash-loop" || row.kind === "node-inference-unavailable"), "server-updated");
 	}
 };
 /** The durable home of the rows. */
 var NcSystemStateStore = class {
 	ledger;
+	/**
+	* What the intake opened or closed before the boot load answered (D698,
+	* `boot-window-rows.ts`). A stored row of the same KIND keeps its own
+	* `since`: a stream re-announced offline at boot was not offline "since the
+	* restart".
+	*/
+	bootWindow;
 	constructor(deps) {
 		this.ledger = new DurableLedger({
 			spec: NC_SYSTEM_STATE_SPEC,
 			store: deps.store,
 			logger: deps.logger
 		});
+		this.bootWindow = new BootWindowRows({
+			ledger: this.ledger,
+			keyOf: (row) => row.key,
+			deviceIdOf: (row) => row.deviceId,
+			logger: deps.logger,
+			merge: (stored, provisional) => {
+				if (stored === void 0 || stored.kind !== provisional.kind) return provisional;
+				const merged = {
+					...provisional,
+					since: stored.since
+				};
+				return (0, node_util.isDeepStrictEqual)(merged, stored) ? stored : merged;
+			}
+		});
 	}
 	static declare(store) {
 		return DurableLedger.declare(store, NC_SYSTEM_STATE_SPEC);
 	}
 	/** Boot reseed. A failed load keeps the mirror and leaves `answered` false. */
 	async load() {
-		return (await this.ledger.load()).length;
+		const loaded = (await this.ledger.load()).length;
+		this.bootWindow.settle();
+		return loaded;
 	}
 	port() {
 		return {
 			get: (key) => this.ledger.get(key),
 			put: (row) => {
+				if (this.bootWindow.open()) {
+					this.bootWindow.stageProvisional(row);
+					return;
+				}
 				this.ledger.put(row).catch(() => void 0);
 			},
 			remove: (key) => {
+				if (this.bootWindow.open()) this.bootWindow.noteRemoved(key);
 				this.ledger.forget(key);
 			},
 			all: () => this.ledger.snapshot(),
-			answered: () => this.ledger.hasAnswered()
+			answered: () => this.ledger.hasAnswered(),
+			deferWhileOpen: (key, replay) => this.bootWindow.deferWhileOpen(key, replay)
 		};
 	}
 };
@@ -31602,8 +32015,21 @@ var NcStateSummaryService = class {
 		const nowMs = this.deps.now();
 		const summary = await this.collect(rule, nowMs);
 		const text = this.word(summary, nowMs);
+		const split = require_clip_model_registry.systemEventSummarySplitOf(rule);
+		const empty = isEmptyStateSummary(summary);
 		return {
-			empty: summary.itemCount === 0 && summary.unavailableCount === 0,
+			empty,
+			split,
+			rows: empty ? [] : split === "section" ? text.sections.map((section) => ({
+				section: section.id,
+				title: section.title,
+				text: section.body,
+				count: section.count
+			})) : [{
+				title: text.sections.map((section) => section.title).join(", "),
+				text: text.text,
+				count: text.count
+			}],
 			count: text.count,
 			text: text.text,
 			sections: summary.sections.map((section) => ({
@@ -31616,12 +32042,84 @@ var NcStateSummaryService = class {
 			excludedGroups: [...summary.excludedGroups]
 		};
 	}
-	async collect(rule, nowMs) {
+	/**
+	* TEST the rule (D698, `nc.testRule`): the summary it would send NOW,
+	* ENQUEUED through the ordinary outbox under a test record id — split as the
+	* rule is. The per-camera mute is bypassed, as every rule test bypasses it,
+	* and a summary has no cooldown to bypass. Nothing to report sends nothing
+	* and SAYS so, per section.
+	*/
+	async test(rule) {
+		const nowMs = this.deps.now();
+		const summary = await this.collect(rule, nowMs, () => false);
+		const split = require_clip_model_registry.systemEventSummarySplitOf(rule);
+		const recordId = stateSummaryTestRecordId(rule.id, nowMs);
+		const sections = summary.sections.map((section) => ({
+			id: section.id,
+			status: section.status,
+			items: section.items.length,
+			...section.reason !== void 0 ? { reason: section.reason } : {}
+		}));
+		const meta = {
+			ruleId: rule.id,
+			rule: rule.name,
+			split,
+			bypassMute: true
+		};
+		if (isEmptyStateSummary(summary)) {
+			this.deps.logger.info("state summary TEST has nothing to report — not sent", { meta: {
+				...meta,
+				dropped: summary.dropped
+			} });
+			return {
+				recordId,
+				split,
+				nothingToReport: true,
+				sections,
+				rows: []
+			};
+		}
+		const subjects = stateSummarySubjects({
+			rule,
+			summary,
+			text: this.word(summary, nowMs),
+			window: {
+				startMs: nowMs,
+				endMs: nowMs
+			},
+			split,
+			recordBase: recordId
+		});
+		const rows = [];
+		for (const subject of subjects) {
+			const enqueued = await this.deps.enqueue(rule, subject, "synthetic");
+			const section = subject.systemEvent?.data["section"];
+			rows.push({
+				recordId: subject.recordId,
+				...typeof section === "string" ? { section } : {},
+				enqueued: enqueued.inserted,
+				targetIds: [...enqueued.targetIds]
+			});
+		}
+		this.deps.logger.info("state summary TEST enqueued", { meta: {
+			...meta,
+			items: summary.itemCount,
+			rows: rows.map((row) => `${row.recordId}:${String(row.enqueued)}`)
+		} });
+		return {
+			recordId,
+			split,
+			nothingToReport: false,
+			sections,
+			rows
+		};
+	}
+	async collect(rule, nowMs, isMuted = this.deps.isMuted) {
 		const nodes = await this.nodeView();
 		return collectStateSummary({
 			rule,
 			nowMs,
-			isMuted: this.deps.isMuted,
+			isMuted,
 			sources: stateSources({
 				alerts: this.deps.alerts,
 				liveness: this.deps.liveness,
@@ -31657,17 +32155,24 @@ var NcStateSummaryService = class {
 		});
 	}
 	async deliver(rule, summary, window) {
-		const subject = stateSummarySubject({
+		const text = this.word(summary, window.endMs);
+		const subjects = stateSummarySubjects({
 			rule,
 			summary,
-			text: this.word(summary, window.endMs),
-			window
+			text,
+			window,
+			split: require_clip_model_registry.systemEventSummarySplitOf(rule)
 		});
-		if (subject === null) {
-			this.deps.logger.warn("state summary rule has no system-event condition — not sent", { meta: { ruleId: rule.id } });
+		if (subjects.length === 0) {
+			this.deps.logger.warn("state summary produced no row — not sent", { meta: {
+				ruleId: rule.id,
+				sections: text.sections.length
+			} });
 			return 0;
 		}
-		return this.deps.enqueue(rule, subject);
+		let inserted = 0;
+		for (const subject of subjects) inserted += (await this.deps.enqueue(rule, subject, "system")).inserted;
+		return inserted;
 	}
 };
 //#endregion
@@ -33393,7 +33898,7 @@ var NotificationCenter = class NotificationCenter {
 			livenessHoldoffMs: deps.livenessHoldoffMs ?? DEVICE_LIVENESS_HOLDOFF_MS,
 			isMuted: (deviceId) => this.deviceMutes.isMuted(deviceId),
 			texts: () => this.texts,
-			enqueue: (rule, subject) => this.enqueueStateSummary(rule, subject)
+			enqueue: (rule, subject, origin) => this.enqueueStateSummary(rule, subject, origin)
 		});
 		this.confirmGate = deps.generateVision !== void 0 ? new NcConfirmGate({
 			logger: this.logger.child("confirm"),
@@ -35934,30 +36439,42 @@ var NotificationCenter = class NotificationCenter {
 		await this.enqueuePickerTargets(event, reached, outcomes);
 		return report({ candidates: candidates.length });
 	}
+	/** TEST a state-summary rule (D698, `nc.testRule`) — see `NcStateSummaryService.test`. */
+	testStateSummary(rule) {
+		return this.stateSummary.test(rule);
+	}
 	/**
-	* Enqueue ONE state summary (D647) through the rule's ordinary rows: its
+	* Enqueue ONE state summary row (D647) through the rule's ordinary rows: its
 	* targets, its users (admins only — the row files under the system device),
 	* its template, and the drain's snooze gate and retries. The record id is
-	* the dedup key, so a window is enqueued once whatever the restarts.
+	* the dedup key, so a window — or each section of it (D698) — is enqueued
+	* once whatever the restarts. A TEST's rows carry the `synthetic` origin, so
+	* they are marked as a test exactly like every other rule test's.
 	*/
-	async enqueueStateSummary(rule, subject) {
-		const appended = withSummaryBody(rule);
+	async enqueueStateSummary(rule, subject, origin) {
+		const appended = withSummaryBody(rule, stateSummarySectionOf(subject));
 		if (appended !== null) this.logger.warn("state summary rule body names no summary content — {{summaryText}} appended", { meta: {
 			ruleId: rule.id,
 			rule: rule.name
 		} });
 		const sent = appended ?? rule;
 		const userTargets = await this.resolveUserTargets(sent, subject.deviceId);
-		const entries = this.buildEntries(sent, subject, "system-event", ["systemEvent"], userTargets, "system");
+		const entries = this.buildEntries(sent, subject, "system-event", ["systemEvent"], userTargets, origin);
 		if (entries.length === 0) {
 			this.logger.warn("state summary reached NO target — its users are not admins, and it has no targets", { meta: {
 				ruleId: rule.id,
 				rule: rule.name,
 				targetUsers: rule.targetUsers ?? []
 			} });
-			return 0;
+			return {
+				inserted: 0,
+				targetIds: []
+			};
 		}
-		return this.outbox.enqueue(entries);
+		return {
+			inserted: await this.outbox.enqueue(entries),
+			targetIds: entries.map((entry) => entry.targetId)
+		};
 	}
 	/**
 	* The rules a trigger may fire, which is `listEnabled(delivery)` plus and
@@ -36671,9 +37188,11 @@ var NotificationCenter = class NotificationCenter {
 	*
 	* A seed is INFO and a repeat is DEBUG on purpose: seeding happens once per
 	* subject per lifetime of the ledger, and it is exactly what an operator
-	* reading the logs after a restart needs to see ("it recorded them, it did
-	* not announce them"). A no-flip is ordinary bus chatter — two categories
-	* describing one edge — and would be noise at info.
+	* reading the logs after a restart needs to see ("it did not announce
+	* them"). A seed heard BEFORE the boot load is provisional (D698): the load
+	* keeps the stored row when it holds the same state, and its `boot window
+	* settled` line says how many it kept and wrote. A no-flip is ordinary bus
+	* chatter — two categories describing one edge — and would be noise at info.
 	*/
 	reportLivenessDrop(incoming, verdict) {
 		const dropped = discardedLivenessEvent(incoming, verdict);
@@ -42620,6 +43139,280 @@ function parseDebugDeviceIds(url) {
 	return out;
 }
 //#endregion
+//#region src/pipeline-analytics/store/tracking-tape-index-store.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per PROMOTED tracking-tape window (`debug.tape.promote`);
+*     updated when the operator marks it reviewed or releases its pins;
+*     deleted together with its file by `debug.tape.delete`."
+*   retention="NOT an age clock and NOT track retention — a promoted window is
+*     history being labelled (D681). Bounded by the promotion budget
+*     (MAX_PROMOTED_TAPES = 60, 1 GiB): a promotion beyond it is REFUSED,
+*     never satisfied by evicting another row."
+*/
+var TRACKING_TAPES_COLLECTION = "pipeline-analytics:tracking-tapes";
+var TRACKING_TAPES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "scenario",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "note",
+		type: "TEXT"
+	},
+	{
+		name: "lighting",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fromMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "toMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "state",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "frames",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "skips",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "gaps",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "bytes",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "reviewed",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "trackIds",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "releasedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "pinsSettled",
+		type: "BOOLEAN",
+		notNull: true
+	}
+];
+var TrackingTapeRowSchema = require_clip_model_registry.object({
+	id: require_clip_model_registry.string(),
+	deviceId: require_clip_model_registry.number().int(),
+	scenario: require_clip_model_registry.string(),
+	note: require_clip_model_registry.string().nullable(),
+	lighting: TapeLightingSchema,
+	fromMs: require_clip_model_registry.number().int(),
+	toMs: require_clip_model_registry.number().int(),
+	state: require_clip_model_registry._enum(["complete", "incomplete"]),
+	frames: require_clip_model_registry.number().int(),
+	skips: require_clip_model_registry.number().int(),
+	gaps: require_clip_model_registry.number().int(),
+	bytes: require_clip_model_registry.number().int(),
+	reviewed: require_clip_model_registry.boolean(),
+	trackIds: require_clip_model_registry.array(require_clip_model_registry.string()),
+	createdAt: require_clip_model_registry.number().int(),
+	releasedAt: require_clip_model_registry.number().int().nullable(),
+	pinsSettled: require_clip_model_registry.boolean()
+});
+var TrackIdsSchema = require_clip_model_registry.array(require_clip_model_registry.string());
+/**
+* True when the SQLite settings backend would hand `text` back DECODED: it
+* parses any TEXT that starts with `[` or `{` and is valid JSON
+* (`decodeColumnValue` decodes by content, not by declared type). Free text
+* like that cannot round-trip through a TEXT column (follow-up 617, review M2).
+*/
+function decodesAsJson(text) {
+	if (!(text.startsWith("[") || text.startsWith("{"))) return false;
+	try {
+		JSON.parse(text);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Free text (`scenario`, `note`) as the column hands it back: a value the
+* backend decoded is re-encoded, so a row written before `debug.tape.promote`
+* refused such text never vanishes (its whitespace may differ). Anything else
+* goes to the schema as it came.
+*/
+function freeText(raw) {
+	return raw !== null && typeof raw === "object" ? JSON.stringify(raw) : raw;
+}
+/**
+* `trackIds` as the column hands it back. The SQLite backend decodes a TEXT
+* that starts with `[` on read (`decodeColumnValue`), so the store sees the
+* ARRAY it wrote; a string is parsed here only for a backend (or an old row)
+* that hands the text back as written. `JSON.parse(String(array))` threw on the
+* decoded array and every promoted row was skipped as malformed (follow-up 617).
+* `null` = unreadable, absent included (the column is NOT NULL, so absence is
+* corruption) — the row is reported, never repaired.
+*/
+function decodeTrackIds(raw) {
+	if (raw === void 0 || raw === null) return null;
+	if (typeof raw !== "string") return raw;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+var TrackingTapeIndexStore = class {
+	store;
+	logger;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			columns: [...TRACKING_TAPES_COLUMNS],
+			indexes: [{
+				name: "idx_trackingtapes_device_created",
+				columns: ["deviceId", "createdAt"]
+			}]
+		});
+	}
+	async insert(row) {
+		const { id, trackIds, ...rest } = TrackingTapeRowSchema.parse(row);
+		await this.store.insert.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			record: {
+				id,
+				data: {
+					...rest,
+					trackIds: JSON.stringify(trackIds)
+				}
+			}
+		});
+	}
+	async get(id) {
+		const first = (await this.store.query.query({
+			collection: TRACKING_TAPES_COLLECTION,
+			filter: {
+				where: { id },
+				limit: 1
+			}
+		}))[0];
+		return first === void 0 ? null : this.parse(first.id, first.data);
+	}
+	async list(deviceId) {
+		const rows = await this.store.query.query({
+			collection: TRACKING_TAPES_COLLECTION,
+			filter: {
+				...deviceId !== void 0 ? { where: { deviceId } } : {},
+				orderBy: {
+					field: "createdAt",
+					direction: "desc"
+				},
+				limit: 1e3
+			}
+		});
+		const out = [];
+		for (const r of rows) {
+			const parsed = this.parse(r.id, r.data);
+			if (parsed !== null) out.push(parsed);
+		}
+		return out;
+	}
+	async setReviewed(id, reviewed) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: { reviewed }
+		});
+	}
+	/** Release AND unsettle in one row write: the unpins the release implies
+	*  are owed from this moment, whether or not the caller lives to make them. */
+	async setReleased(id, atMs) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: {
+				releasedAt: atMs,
+				pinsSettled: false
+			}
+		});
+	}
+	async setPinsSettled(id, settled) {
+		await this.store.update.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			id,
+			data: { pinsSettled: settled }
+		});
+	}
+	async remove(id) {
+		await this.store.delete.mutate({
+			collection: TRACKING_TAPES_COLLECTION,
+			key: id
+		});
+	}
+	parse(id, data) {
+		const ids = TrackIdsSchema.safeParse(decodeTrackIds(data["trackIds"]));
+		const parsed = TrackingTapeRowSchema.safeParse({
+			id,
+			...data,
+			scenario: freeText(data["scenario"]),
+			note: freeText(data["note"] ?? null),
+			releasedAt: data["releasedAt"] ?? null,
+			trackIds: ids.success ? ids.data : null
+		});
+		if (parsed.success) return parsed.data;
+		this.logger.warn("tracking tape index: skipped a malformed row", {
+			meta: {
+				id,
+				issues: parsed.error.issues.map((i) => i.path.join(".")),
+				trackIdsType: typeof data["trackIds"]
+			},
+			...typeof data["deviceId"] === "number" ? { tags: { deviceId: data["deviceId"] } } : {}
+		});
+		return null;
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/debug/tape-actions.ts
 /**
 * `debug.tape.*` — the tracking-tape surface (D681, spec §3.3). Admin,
@@ -42650,12 +43443,19 @@ var TapeStatusRowSchema = require_clip_model_registry.object({
 var TapeStatusInputSchema = require_clip_model_registry.object({ deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int()).optional() });
 var TapeStatusOutputSchema = require_clip_model_registry.object({ cameras: require_clip_model_registry.array(TapeStatusRowSchema).readonly() });
 var TapeLightingInputSchema = require_clip_model_registry._enum(["day", "ir"]);
+/**
+* Free text the settings store would hand back decoded is refused by name
+* (follow-up 617, review M2): whole JSON array/object text in a TEXT column
+* comes back as an array or object, and the index could not read the row.
+*/
+var NOT_JSON_TEXT = "must not be JSON array/object text — the settings store would hand it back decoded";
+var notJsonText = (s) => !decodesAsJson(s);
 var PromoteInputSchema = require_clip_model_registry.object({
 	deviceId: require_clip_model_registry.number().int().positive(),
 	fromMs: require_clip_model_registry.number().int(),
 	toMs: require_clip_model_registry.number().int(),
-	scenario: require_clip_model_registry.string(),
-	note: require_clip_model_registry.string().max(500).optional(),
+	scenario: require_clip_model_registry.string().refine(notJsonText, { message: NOT_JSON_TEXT }),
+	note: require_clip_model_registry.string().max(500).refine(notJsonText, { message: NOT_JSON_TEXT }).optional(),
 	lighting: TapeLightingInputSchema.optional()
 });
 var PromoteOutputSchema = require_clip_model_registry.discriminatedUnion("ok", [require_clip_model_registry.object({
@@ -51118,6 +51918,17 @@ function pairRiders(detections) {
 * (D438) no frame did, and a newcomer on the stale prediction took the id.
 */
 var MAX_PREDICTION_MS = 1e3;
+/**
+* A frame more than `maxMissedMs` behind the latest is a CLOCK STEP only as
+* the K-th such frame in a row, each in order with the one before (follow-up
+* 617, fix round 3; D49: a read that would destroy work needs another to
+* agree). A step ends every track on the camera; one stray timestamp — a
+* backlog spike 4.5 s late — or two runner clocks delivering interleaved
+* (a camera migrating between runners) must not. Three is the least that a
+* single late frame plus an interleaved partner cannot reach by chance; the
+* cost of a real step is K−1 dropped frames (~260 ms at 7.7 fps).
+*/
+var CLOCK_STEP_CONFIRM_FRAMES = 3;
 /** Confident boxes kept on a tracklet's path (the old tracker's bound). */
 var MAX_PATH_LENGTH = 300;
 /** Swap test: crossed pairs cheaper than this over the chosen pairs are doubt. */
@@ -51923,6 +52734,35 @@ function linkReach(from, gapMs) {
 	return diag * Math.min(LINK_REACH_MAX_DIAGONALS, Math.max(LINK_REACH_MIN_DIAGONALS, LINK_REACH_DIAGONALS_PER_SEC * gapMs / 1e3));
 }
 var arcKey = (from, to) => `${from}\u0000${to}`;
+/**
+* The rejections that mean "geometry or appearance said no to a plausible
+* continuation" of a confirmed predecessor — a track the operator sees break
+* (follow-up 617, F5). Every one of them is past `hardRejection`, so the
+* predecessor is confirmed. NOT here (fix round 1): `unconfirmed`;
+* `has-successor` (continued elsewhere); `concurrent` and `identity-conflict`
+* (two subjects — the normal case, and the most frequent); `dropped` (an
+* operator delete or a refused chain).
+*/
+var BREAK_REJECTIONS = new Set([
+	"reach",
+	"area",
+	"appearance",
+	"contested",
+	"cost"
+]);
+/** The confirmed predecessors whose link a decision rejected as a break (F5). */
+function confirmedPredecessorRejections(candidates) {
+	const out = [];
+	for (const c of candidates ?? []) {
+		if (c.rejected === void 0 || !BREAK_REJECTIONS.has(c.rejected)) continue;
+		out.push({
+			from: c.from,
+			rejected: c.rejected,
+			gapMs: c.gapMs
+		});
+	}
+	return out;
+}
 function arcFacts(a) {
 	return {
 		from: a.from.id,
@@ -52000,6 +52840,26 @@ var DeferredLinker = class {
 		if (seen === void 0) this.names.set(p.id, new Set([p.identity]));
 		else seen.add(p.identity);
 	}
+	/**
+	* A clock step (follow-up 617, fix round 2): every piece still undecided is
+	* decided `new`, so nothing that existed before the step can be absorbed
+	* across it — whatever was ready was committed just before. The facade
+	* rebases its clock past `LINK_MAX_GAP_MS`, so no later piece can continue
+	* one of these either. An extra id, never a mix-up.
+	*/
+	closeUndecided(now, pieces) {
+		for (const p of pieces) this.accept(p, now);
+		for (const p of this.pieces.values()) {
+			if (this.outcomes.has(p.id)) continue;
+			this.decide(p.id, "new");
+			this.observer?.({
+				t: now,
+				kind: "new",
+				to: p.id,
+				reason: "clock-step"
+			});
+		}
+	}
 	isTailFinal(id, now, isLive) {
 		const root = this.rootOf(id);
 		if (this.pieces.has(root) && !this.outcomes.has(root)) return false;
@@ -52750,7 +53610,15 @@ var Tracklet = class {
 			h: this.assocBox.h
 		};
 	}
+	/**
+	* A confident sighting. One OLDER than the last (`t < lastSeenAt` — ~1 % of
+	* frames reach the tracker out of capture order, up to 1.2 s back) is
+	* `stale`: it changes nothing. A rewound tracklet would be measured from a
+	* box its subject left a second ago, and L2 refused a link by reach on
+	* exactly that (follow-up 617, F1). The caller reports it.
+	*/
 	observeConfident(det, t, faceBearing) {
+		if (t < this.lastSeenAt) return "stale";
 		const dt = t - this.lastSeenAt;
 		if (dt > 0) {
 			const from = centreOf(this.lastBox);
@@ -52762,6 +53630,7 @@ var Tracklet = class {
 			this.emitIntervalMs = dt;
 		}
 		this.recordConfident(det, t, faceBearing);
+		return "recorded";
 	}
 	observeLowScore(box, t) {
 		this.assocBox = box;
@@ -52863,6 +53732,15 @@ var TrackletTracker = class {
 	demoteSilent(t) {
 		for (const tr of this.live.values()) if (tr.mode === "active" && t - tr.lastSeenAt > MAX_PREDICTION_MS) tr.mode = "coasting";
 	}
+	/** Ends every live tracklet at its own last sighting (a clock step); the ids it ended. */
+	endAll(reason) {
+		const ended = [];
+		for (const tr of [...this.live.values()]) {
+			ended.push(tr.id);
+			this.finish(tr, tr.lastSeenAt, reason);
+		}
+		return ended;
+	}
 	/** Silence: end what the coast budget no longer covers. */
 	expire(now) {
 		for (const tr of [...this.live.values()]) if (now - tr.lastSeenAt > this.config.maxMissedMs) this.finish(tr, tr.lastSeenAt, "missed");
@@ -52953,12 +53831,12 @@ var TrackletTracker = class {
 		const d = frame.detections[pair.detection];
 		if (tr === void 0 || d === void 0) return;
 		frame.used.add(pair.detection);
+		if (tr.observeConfident(d, frame.t, frame.ctx.faceBearing?.has(d.bbox) === true) === "stale") return;
 		tr.mode = "active";
 		if (d.class !== tr.klass) this.refuse({
 			reason: "cross-class-absorbed",
 			against: tr
 		}, d);
-		tr.observeConfident(d, frame.t, frame.ctx.faceBearing?.has(d.bbox) === true);
 		if (pair.contested) {
 			tr.contestedHits += 1;
 			tr.contestedSince ??= frame.t;
@@ -53147,27 +54025,151 @@ var TrackerV2 = class {
 	l1;
 	l2;
 	pending = [];
+	/**
+	* Internal time = the caller's frame time + `offset`. Zero until a clock
+	* step; each step moves it so the internal clock never goes back and
+	* resumes past `LINK_MAX_GAP_MS` of silence (fix round 2, C1). L1, L2, their
+	* facts and prunes run on internal time; fusions and `frameClock()` are
+	* handed back in the caller's clock.
+	*/
+	offset = 0;
 	lastT = 0;
+	/** The latest FRAME time taken (internal) — never the sweep's extrapolated `now`. */
+	lastFrameT = Number.NEGATIVE_INFINITY;
+	observers;
+	/** Caller times of the consecutive frames past the stale bound so far — the
+	*  run a clock step needs `CLOCK_STEP_CONFIRM_FRAMES` of (fix round 3). */
+	stepRun = [];
 	constructor(config, deps) {
 		this.config = config;
-		this.l1 = new TrackletTracker(config, deps.mintTrackId, deps.observers ?? {});
+		this.observers = deps.observers ?? {};
+		const out = this.observers;
+		const internal = {
+			...out.refusal !== void 0 ? { refusal: out.refusal } : {},
+			ended: (f) => out.ended?.({
+				...f,
+				at: f.at - this.offset
+			}),
+			split: (f) => out.split?.({
+				...f,
+				t: f.t - this.offset
+			})
+		};
+		this.l1 = new TrackletTracker(config, deps.mintTrackId, internal);
 		this.l2 = new DeferredLinker({
 			maxMissedMs: config.maxMissedMs,
 			appearanceResolvesAmbiguity: config.appearanceResolvesAmbiguity
-		}, deps.observers?.link);
+		}, (f) => out.link?.({
+			...f,
+			t: f.t - this.offset
+		}));
 	}
-	update(detections, t, ctx) {
+	update(detections, frameT, ctx) {
+		const order = this.classifyFrame(frameT);
+		if (order === "out-of-order") return this.drop(frameT, detections.length);
+		let t = frameT + this.offset;
+		if (order === "clock-step") t = this.clockStep(frameT, this.lastFrameT - t);
+		this.stepRun = [];
+		this.lastFrameT = t;
 		this.lastT = Math.max(this.lastT, t);
 		const step = this.l1.step(detections, t, ctx);
 		this.link(this.lastT);
 		return step.emissions.map((e) => this.emit(e, t));
 	}
 	/**
+	* A frame stamped before the latest one already taken (follow-up 617, F1;
+	* ~1 % of frames, up to 1.2 s back). It is decided ONCE, for the whole
+	* frame (fix round 1, H1): matched against the tracklets' NEWEST boxes, a
+	* stale box can land on another subject — a walker's old box on the walker
+	* behind — and be emitted under that id. So nothing binds, spawns, splits or
+	* is demoted on it; the confirmed tracklets are emitted as on a frame that
+	* matched nothing (no sighting), and one fact says the frame was dropped.
+	*/
+	/**
+	* How `update` will take a frame at `frameT` — without taking it. The
+	* processor asks first (fix round 3, MEDIUM-2), so a dropped frame never
+	* reaches the stationary gate, the zones or the event path.
+	*  - `in-order`: not behind the latest frame taken;
+	*  - `out-of-order`: behind it — within `maxMissedMs` (disorder, ≤ 1.2 s
+	*    measured), or further back but not yet the `CLOCK_STEP_CONFIRM_FRAMES`-th
+	*    such frame in a row;
+	*  - `clock-step`: the K-th consecutive frame past the bound, each in order
+	*    with the one before (within `maxMissedMs`).
+	*/
+	classifyFrame(frameT) {
+		const behindMs = this.lastFrameT - (frameT + this.offset);
+		if (!(behindMs > 0)) return "in-order";
+		if (behindMs <= this.config.maxMissedMs) return "out-of-order";
+		return this.runLength(frameT) >= CLOCK_STEP_CONFIRM_FRAMES ? "clock-step" : "out-of-order";
+	}
+	/** The past-bound run this frame would make, itself included. */
+	runLength(frameT) {
+		const prev = this.stepRun.at(-1);
+		return (prev !== void 0 && frameT >= prev && frameT - prev <= this.config.maxMissedMs ? this.stepRun.length : 0) + 1;
+	}
+	/**
+	* Drops a frame `classifyFrame` called `out-of-order`. A frame past the
+	* bound extends (or restarts) the run a clock step needs; any other breaks
+	* it. One fact per frame.
+	*/
+	drop(frameT, detections) {
+		const behindMs = this.lastFrameT - (frameT + this.offset);
+		let pendingClockStep = 0;
+		if (behindMs > this.config.maxMissedMs) {
+			pendingClockStep = this.runLength(frameT);
+			this.stepRun = pendingClockStep === 1 ? [frameT] : [...this.stepRun, frameT];
+		} else this.stepRun = [];
+		this.observers.outOfOrder?.({
+			t: frameT,
+			lastFrameT: this.frameClock(),
+			behindMs,
+			detections,
+			pendingClockStep
+		});
+		return this.l1.liveTracklets().filter((tr) => tr.confirmed).map((tracklet) => this.emit({
+			tracklet,
+			detection: void 0,
+			matched: false
+		}, this.lastFrameT));
+	}
+	/**
+	* The frame clock stepped back further than `maxMissedMs` (fix round 2, C1):
+	* not disorder — an NTP correction, or a camera moved to a runner whose clock
+	* is behind. An unbounded gate dropped every frame until the new clock passed
+	* the old high mark (60 s back: 461 frames, a new subject never tracked, the
+	* departed one coasting on). Instead: commit what L2 has decided, end every
+	* live tracklet at its own last sighting, decide every piece still undecided
+	* `new` (no fusion crosses the step), and resume the internal clock past
+	* `LINK_MAX_GAP_MS` of silence, so nothing later can continue anything
+	* earlier. Returns the frame's internal time.
+	*/
+	clockStep(frameT, behindMs) {
+		const lastFrameT = this.frameClock();
+		this.link(this.lastT);
+		const ended = this.l1.endAll("clock-step");
+		this.l2.closeUndecided(this.lastT, this.pieces());
+		const resumeAt = Math.max(this.lastT, this.lastFrameT) + LINK_MAX_GAP_MS + 1;
+		this.offset = resumeAt - frameT;
+		this.lastT = resumeAt;
+		this.observers.clockStep?.({
+			t: frameT,
+			lastFrameT,
+			behindMs,
+			ended
+		});
+		return resumeAt;
+	}
+	/** The latest frame time taken, in the caller's clock (rebased by a clock step). */
+	frameClock() {
+		return this.lastFrameT - this.offset;
+	}
+	/**
 	* The close sweep's entry on a camera whose frames stopped (D438): end the
 	* tracklets the coast budget no longer covers, THEN run L2 (review C2).
 	* `now` is FRAME time (the processor converts wall clock, Task 11).
 	*/
-	advance(now) {
+	advance(frameNow) {
+		const now = frameNow + this.offset;
 		this.lastT = Math.max(this.lastT, now);
 		this.l1.expire(now);
 		this.link(now);
@@ -53183,6 +54185,7 @@ var TrackerV2 = class {
 	markSuppressed(id) {
 		this.l1.markSuppressed(id);
 	}
+	/** In the caller's clock (translated when each was committed, LOW-5). */
 	drainFusions() {
 		const out = this.pending;
 		this.pending = [];
@@ -53195,8 +54198,8 @@ var TrackerV2 = class {
 	isLive(id) {
 		return this.l2.membersOf(this.l2.rootOf(id)).some((m) => this.isLiveTracklet(m));
 	}
-	isTailFinal(id, now) {
-		return this.l2.isTailFinal(id, now, (m) => this.isLiveTracklet(m));
+	isTailFinal(id, frameNow) {
+		return this.l2.isTailFinal(id, frameNow + this.offset, (m) => this.isLiveTracklet(m));
 	}
 	/**
 	* Ends every live member of the chain. `stationary` (round 4): the
@@ -53212,9 +54215,15 @@ var TrackerV2 = class {
 		const tr = this.l1.get(id);
 		return tr !== void 0 && tr.endedAt === null;
 	}
+	pieces() {
+		return [...this.l1.liveTracklets(), ...this.l1.endedTracklets()].map(toPiece);
+	}
 	link(now) {
-		const pieces = [...this.l1.liveTracklets(), ...this.l1.endedTracklets()].map(toPiece);
-		this.pending.push(...this.l2.step(now, pieces));
+		const offset = this.offset;
+		for (const f of this.l2.step(now, this.pieces())) this.pending.push({
+			...f,
+			t: f.t - offset
+		});
 		this.l1.prune(now);
 		this.l2.prune(now);
 	}
@@ -53277,7 +54286,8 @@ var NO_ENDS = {
 	missed: 0,
 	ambiguous: 0,
 	dropped: 0,
-	stationary: 0
+	stationary: 0,
+	"clock-step": 0
 };
 function emptyStats() {
 	return {
@@ -53290,16 +54300,28 @@ function emptyStats() {
 		linksRefused: 0,
 		linksNew: 0,
 		linksDisagreed: 0,
-		lowScoreHolds: 0
+		lowScoreHolds: 0,
+		outOfOrderFrames: 0,
+		clockSteps: 0
 	};
 }
 /** Nothing happened in the window: no tracklet ended, no split, no L2
 *  decision, no low-score hold (review LOW-N1 — what the sweep stays quiet about). */
 function isIdleTrackerStats(stats) {
-	return [stats.tracklets.confirmed, stats.tracklets.unconfirmed].flatMap((c) => Object.values(c)).every((n) => n === 0) && stats.splits === 0 && stats.linksCommitted === 0 && stats.linksRefused === 0 && stats.linksNew === 0 && stats.linksDisagreed === 0 && stats.lowScoreHolds === 0;
+	return [stats.tracklets.confirmed, stats.tracklets.unconfirmed].flatMap((c) => Object.values(c)).every((n) => n === 0) && stats.splits === 0 && stats.linksCommitted === 0 && stats.linksRefused === 0 && stats.linksNew === 0 && stats.linksDisagreed === 0 && stats.lowScoreHolds === 0 && stats.outOfOrderFrames === 0 && stats.clockSteps === 0;
 }
 /** Shared empty — a fold is rare and every other frame would allocate. */
 var EMPTY_RIDER_FOLDS = [];
+/** The tape observation of a dropped frame: no gate verdict, nothing bound. */
+var DROPPED_FRAME_OBSERVATION = {
+	gate: {
+		strong: [],
+		weak: [],
+		confirmed: [],
+		woken: []
+	},
+	live: []
+};
 /** Mapping from StateAnalyzer's `ObjectState.state` values to the
 *  canonical TrackState enum used on tracks + events. */
 function mapObjectStateToTrackState(s) {
@@ -53478,6 +54500,14 @@ var FrameProcessor = class {
 					else if (f.kind === "new") this.stats.linksNew += 1;
 					else if (f.kind === "disagreed") this.stats.linksDisagreed += 1;
 					this.trackerObservers.link?.(f);
+				},
+				outOfOrder: (f) => {
+					this.stats.outOfOrderFrames += 1;
+					this.trackerObservers.outOfOrder?.(f);
+				},
+				clockStep: (f) => {
+					this.stats.clockSteps += 1;
+					this.trackerObservers.clockStep?.(f);
 				}
 			}
 		});
@@ -53761,6 +54791,37 @@ var FrameProcessor = class {
 	*  Zero is the expected reading; a rising one means two people stand close
 	*  together on this camera, which is worth knowing per-camera rather than
 	*  per-fleet. */
+	/**
+	* A frame `classifyFrame` called out of order: the tracker records the drop
+	* (and any clock-step run it extends) and nothing else reads the frame. The
+	* per-frame side tables a reader asks for afterwards are emptied, so it never
+	* re-reads the previous frame's.
+	*/
+	droppedFrame(input) {
+		this.tracker.drop(input.timestamp, input.frame.detections.length);
+		this.lastZoneOverlaps = /* @__PURE__ */ new Map();
+		this.lastZoneRejections = /* @__PURE__ */ new Map();
+		this.lastLabelWriteRefusals = [];
+		const fusions = this.tracker.drainFusions();
+		this.applyFusions(fusions);
+		return {
+			deviceId: this.deviceId,
+			timestamp: input.timestamp,
+			frameWidth: input.frame.width,
+			frameHeight: input.frame.height,
+			tracked: [],
+			objectEvents: [],
+			appearanceEvents: [],
+			rawTrackedDetections: [],
+			stationaryConfirmed: [],
+			stationaryWoken: [],
+			stationaryContinued: 0,
+			riderFolds: [],
+			...input.observe === true ? { observation: DROPPED_FRAME_OBSERVATION } : {},
+			fusions,
+			droppedOutOfOrder: true
+		};
+	}
 	facesRefusedOutsideParent() {
 		return this.faceOutsideParentCount;
 	}
@@ -53783,6 +54844,7 @@ var FrameProcessor = class {
 	}
 	process(input) {
 		const { timestamp, frame } = input;
+		if (this.tracker.classifyFrame(timestamp) === "out-of-order") return this.droppedFrame(input);
 		this.lastFrameT = timestamp;
 		this.lastFrameWallAt = this.wallClock();
 		const frameWidth = frame.width;
@@ -56534,239 +57596,6 @@ async function promoteTapeWindow(deps, input, signal) {
 	};
 }
 //#endregion
-//#region src/pipeline-analytics/store/tracking-tape-index-store.ts
-/**
-* @durable class=ledger owner=pipeline-analytics
-*   write="one row per PROMOTED tracking-tape window (`debug.tape.promote`);
-*     updated when the operator marks it reviewed or releases its pins;
-*     deleted together with its file by `debug.tape.delete`."
-*   retention="NOT an age clock and NOT track retention — a promoted window is
-*     history being labelled (D681). Bounded by the promotion budget
-*     (MAX_PROMOTED_TAPES = 60, 1 GiB): a promotion beyond it is REFUSED,
-*     never satisfied by evicting another row."
-*/
-var TRACKING_TAPES_COLLECTION = "pipeline-analytics:tracking-tapes";
-var TRACKING_TAPES_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "scenario",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "note",
-		type: "TEXT"
-	},
-	{
-		name: "lighting",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fromMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "toMs",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "state",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "frames",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "skips",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "gaps",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "bytes",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "reviewed",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "trackIds",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "releasedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "pinsSettled",
-		type: "BOOLEAN",
-		notNull: true
-	}
-];
-var TrackingTapeRowSchema = require_clip_model_registry.object({
-	id: require_clip_model_registry.string(),
-	deviceId: require_clip_model_registry.number().int(),
-	scenario: require_clip_model_registry.string(),
-	note: require_clip_model_registry.string().nullable(),
-	lighting: TapeLightingSchema,
-	fromMs: require_clip_model_registry.number().int(),
-	toMs: require_clip_model_registry.number().int(),
-	state: require_clip_model_registry._enum(["complete", "incomplete"]),
-	frames: require_clip_model_registry.number().int(),
-	skips: require_clip_model_registry.number().int(),
-	gaps: require_clip_model_registry.number().int(),
-	bytes: require_clip_model_registry.number().int(),
-	reviewed: require_clip_model_registry.boolean(),
-	trackIds: require_clip_model_registry.array(require_clip_model_registry.string()),
-	createdAt: require_clip_model_registry.number().int(),
-	releasedAt: require_clip_model_registry.number().int().nullable(),
-	pinsSettled: require_clip_model_registry.boolean()
-});
-var TrackIdsSchema = require_clip_model_registry.array(require_clip_model_registry.string());
-var TrackingTapeIndexStore = class {
-	store;
-	logger;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			columns: [...TRACKING_TAPES_COLUMNS],
-			indexes: [{
-				name: "idx_trackingtapes_device_created",
-				columns: ["deviceId", "createdAt"]
-			}]
-		});
-	}
-	async insert(row) {
-		const { id, trackIds, ...rest } = TrackingTapeRowSchema.parse(row);
-		await this.store.insert.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			record: {
-				id,
-				data: {
-					...rest,
-					trackIds: JSON.stringify(trackIds)
-				}
-			}
-		});
-	}
-	async get(id) {
-		const first = (await this.store.query.query({
-			collection: TRACKING_TAPES_COLLECTION,
-			filter: {
-				where: { id },
-				limit: 1
-			}
-		}))[0];
-		return first === void 0 ? null : this.parse(first.id, first.data);
-	}
-	async list(deviceId) {
-		const rows = await this.store.query.query({
-			collection: TRACKING_TAPES_COLLECTION,
-			filter: {
-				...deviceId !== void 0 ? { where: { deviceId } } : {},
-				orderBy: {
-					field: "createdAt",
-					direction: "desc"
-				},
-				limit: 1e3
-			}
-		});
-		const out = [];
-		for (const r of rows) {
-			const parsed = this.parse(r.id, r.data);
-			if (parsed !== null) out.push(parsed);
-		}
-		return out;
-	}
-	async setReviewed(id, reviewed) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: { reviewed }
-		});
-	}
-	/** Release AND unsettle in one row write: the unpins the release implies
-	*  are owed from this moment, whether or not the caller lives to make them. */
-	async setReleased(id, atMs) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: {
-				releasedAt: atMs,
-				pinsSettled: false
-			}
-		});
-	}
-	async setPinsSettled(id, settled) {
-		await this.store.update.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			id,
-			data: { pinsSettled: settled }
-		});
-	}
-	async remove(id) {
-		await this.store.delete.mutate({
-			collection: TRACKING_TAPES_COLLECTION,
-			key: id
-		});
-	}
-	parse(id, data) {
-		let trackIds = [];
-		try {
-			trackIds = JSON.parse(String(data["trackIds"] ?? "[]"));
-		} catch {
-			trackIds = null;
-		}
-		const ids = TrackIdsSchema.safeParse(trackIds);
-		const parsed = TrackingTapeRowSchema.safeParse({
-			id,
-			...data,
-			note: data["note"] ?? null,
-			releasedAt: data["releasedAt"] ?? null,
-			trackIds: ids.success ? ids.data : null
-		});
-		if (parsed.success) return parsed.data;
-		this.logger.warn("tracking tape index: skipped a malformed row", {
-			meta: { id },
-			...typeof data["deviceId"] === "number" ? { tags: { deviceId: data["deviceId"] } } : {}
-		});
-		return null;
-	}
-};
-//#endregion
 //#region src/pipeline-analytics/tracking-bench/recorder/tape-status.ts
 /** The one node that may hold tapes: sqlite and bulk state are hub-only, and
 *  an agent persists nothing (spec §3.1). */
@@ -87918,6 +88747,18 @@ function isRecord(x) {
 }
 //#endregion
 //#region src/pipeline-analytics/store/track-alias-store.ts
+/**
+* The alias collection.
+*
+* @durable class=ledger owner=pipeline-analytics
+*   write="one row per fused piece (D683): aliasId = the absorbed provisional
+*     id, trackId = its survivor; rewritten when the survivor is itself
+*     absorbed by a later fusion"
+*   retention="TRACK-OWNED by its survivor through the declared `trackId`
+*     column: aliases leave with the survivor in the retention cascade, and
+*     widen that cascade (`expandLeafIds`) to rows still keyed by an
+*     absorbed id"
+*/
 var TRACK_ALIASES_COLLECTION = "pipeline-analytics:track-aliases";
 var TRACK_ALIAS_COLUMNS = [
 	{
@@ -88100,6 +88941,20 @@ var TrackAliasStore = class {
 			dropped: 0
 		}];
 	}
+	/**
+	* The orphan audit's reclaim of ONE alias row: the row AND the `recent`
+	* entry that would otherwise keep resolving it for up to an hour. `true`
+	* only when a row was actually deleted. (`misses` needs nothing: a deleted
+	* alias IS a non-alias, which is what a miss records.)
+	*/
+	async deleteAlias(aliasId) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: TRACK_ALIASES_COLLECTION,
+			filter: { where: { id: aliasId } }
+		});
+		this.recent.delete(aliasId);
+		return deleted > 0;
+	}
 	async deleteByTracks(trackIds) {
 		const { deleted } = await this.store.deleteWhere.mutate({
 			collection: TRACK_ALIASES_COLLECTION,
@@ -89026,7 +89881,8 @@ async function auditScope(scope, deps, limits, cursor) {
 		stoppedBy,
 		nextCursor: offset
 	} });
-	if (limits.mode === "reclaim" && tally.orphans > 0 && tally.bytesReclaimed === 0) deps.logger.warn("orphan audit: reclaim pass freed no bytes against a standing backlog", { meta: {
+	const freedNothing = scope.sizeField === null ? tally.reclaimed === 0 : tally.bytesReclaimed === 0;
+	if (limits.mode === "reclaim" && tally.orphans > 0 && freedNothing) deps.logger.warn("orphan audit: reclaim pass freed no bytes against a standing backlog", { meta: {
 		collection: scope.collection,
 		shard: scope.shard?.value ?? null,
 		orphans: tally.orphans,
@@ -89140,6 +89996,40 @@ var ORPHAN_AUDIT_DEFAULTS = {
 	pageSize: OrphanAuditPageSizeSchema.parse(void 0)
 };
 var RAW_DELETE_COLLECTIONS = new Set(["pipeline-analytics:object-events", "pipeline-analytics:plates"]);
+/**
+* The `deleteRow` port: ONE row by its primary key `id` (what every
+* raw-delete collection above declares), answering whether a row went.
+*
+* Through `deleteWhere`, because it is the delete that SAYS: `delete`'s output
+* is `z.void()`, and reading it as `!== undefined` answered `false` for every
+* row it really deleted — the audit counted every plates/object-events reclaim
+* as "found nothing", and the per-scope reclaim ceiling never tripped.
+*/
+function settingsRowDeleter(store) {
+	return async (collection, key) => {
+		const { deleted } = await store.deleteWhere.mutate({
+			collection,
+			filter: { where: { id: key } }
+		});
+		return deleted > 0;
+	};
+}
+/**
+* The `deleteRow` port AS PRODUCTION WIRES IT: {@link settingsRowDeleter} over
+* a store that may not be bound yet. Unbound THROWS — the engine counts that as
+* `reclaimFailed` and keeps the row — rather than answering "nothing deleted",
+* which is indistinguishable from a row already gone. A named factory so the
+* wiring itself is under test (D695 T7 review M1: the inline wiring could be
+* reverted to the original bug with every spec green);
+* `scripts/check-orphan-reclaimers.ts` checks `index.ts` uses it.
+*/
+function settingsRowDeleterOf(getStore) {
+	return async (collection, key) => {
+		const store = getStore();
+		if (store === null) throw new Error("orphan audit: settings store not bound");
+		return await settingsRowDeleter(store)(collection, key);
+	};
+}
 function buildOrphanReclaimer(ports) {
 	return async (collection, key) => {
 		if (collection === MEDIA_COLLECTION) {
@@ -89163,6 +90053,10 @@ function buildOrphanReclaimer(ports) {
 				bytes: null
 			};
 		}
+		if (collection === TRACK_ALIASES_COLLECTION) return {
+			rows: await ports.deleteTrackAlias(key) ? 1 : 0,
+			bytes: null
+		};
 		if (RAW_DELETE_COLLECTIONS.has(collection)) return {
 			rows: await ports.deleteRow(collection, key) ? 1 : 0,
 			bytes: null
@@ -97697,6 +98591,12 @@ var TRACKER_FACT_LOG_SAMPLE_EVERY = 10;
 *  positive spawns (review M1: ~1 750 `new` decisions per camera per hour) —
 *  are sampled harder; the per-minute summary carries their exact counts. */
 var TRACKER_PIECE_LOG_SAMPLE_EVERY = 50;
+/** Out-of-order frames (follow-up 617, F1: ~1 % of frames) log the first N,
+*  then one in this many — every line carries the count; the per-minute
+*  summary carries the exact `outOfOrderFrames`. */
+var TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY = 50;
+/** Clock-step WARNs past the first ten (fix round 3, MEDIUM-1). */
+var TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY = 50;
 /** First N, then one in `every` — the refusal stream's cadence (D391). */
 function sampledTrackerFact(count, every = TRACKER_FACT_LOG_SAMPLE_EVERY) {
 	return count <= TRACKER_FACT_LOG_ALWAYS_FIRST || count % every === 0;
@@ -99526,6 +100426,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			},
 			listTrackGroups: (query) => center.listTrackGroups(query),
 			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) }),
+			testStateSummary: (rule) => center.testStateSummary(rule),
 			timelapse: {
 				store: center.timelapseStore,
 				getRecordingConfig: (deviceId) => api.recordingArchive.getDeviceConfig.query({ deviceId }).catch(() => null),
@@ -102344,9 +103245,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 		let splitCount = 0;
 		let ignoredCount = 0;
 		let newCount = 0;
+		let outOfOrderCount = 0;
+		let clockStepCount = 0;
 		const endedCounts = /* @__PURE__ */ new Map();
 		const logLink = (f) => {
-			const meta = {
+			const decision = {
 				source,
 				t: f.t,
 				kind: f.kind,
@@ -102355,7 +103258,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				cost: f.cost,
 				gapMs: f.gapMs,
 				reason: f.reason,
-				recognition: f.recognition,
+				recognition: f.recognition
+			};
+			const meta = {
+				...decision,
 				candidates: f.candidates
 			};
 			switch (f.kind) {
@@ -102393,7 +103299,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						meta
 					});
 					return;
-				case "new":
+				case "new": {
+					if (f.reason === "clock-step") {
+						trackerLog.debug("tracker: piece decided new — closed by a frame clock step", {
+							tags: { deviceId },
+							meta
+						});
+						return;
+					}
 					if (f.reason === "unconfirmed") {
 						trackerLog.debug("tracker: piece decided new — never confirmed", {
 							tags: { deviceId },
@@ -102401,6 +103314,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						});
 						return;
 					}
+					const rejectedPredecessors = confirmedPredecessorRejections(f.candidates);
+					if (rejectedPredecessors.length > 0) {
+						trackerLog.info("tracker: piece decided new — a confirmed predecessor was rejected", {
+							tags: { deviceId },
+							meta: {
+								...decision,
+								rejectedPredecessors
+							}
+						});
+						return;
+					}
 					newCount += 1;
 					if (!sampledTrackerFact(newCount, TRACKER_PIECE_LOG_SAMPLE_EVERY)) return;
 					trackerLog.info("tracker: piece decided new — no predecessor", {
@@ -102411,6 +103335,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 						}
 					});
 					return;
+				}
 			}
 		};
 		p.setTrackerObservers({
@@ -102431,6 +103356,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 				});
 			},
 			link: logLink,
+			clockStep: (f) => {
+				clockStepCount += 1;
+				if (!sampledTrackerFact(clockStepCount, TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY)) return;
+				trackerLog.warn("tracker: frame clock stepped back — tracklets ended, clock rebased", {
+					tags: { deviceId },
+					meta: {
+						source,
+						t: f.t,
+						lastFrameT: f.lastFrameT,
+						behindMs: f.behindMs,
+						ended: f.ended,
+						clockStepCount,
+						sampledEvery: TRACKER_CLOCK_STEP_LOG_SAMPLE_EVERY
+					}
+				});
+			},
+			outOfOrder: (f) => {
+				outOfOrderCount += 1;
+				if (!sampledTrackerFact(outOfOrderCount, TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY)) return;
+				trackerLog.info("tracker: out-of-order frame dropped — older than the latest frame", {
+					tags: { deviceId },
+					meta: {
+						source,
+						t: f.t,
+						lastFrameT: f.lastFrameT,
+						behindMs: f.behindMs,
+						detections: f.detections,
+						pendingClockStep: f.pendingClockStep,
+						outOfOrderCount,
+						sampledEvery: TRACKER_OUT_OF_ORDER_LOG_SAMPLE_EVERY
+					}
+				});
+			},
 			ended: (f) => {
 				const k = `${f.reason}:${String(f.confirmed)}`;
 				const n = (endedCounts.get(k) ?? 0) + 1;
@@ -102572,6 +103530,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			});
 		});
 		this.reportTrackerSummary(deviceId, key, processor, "frame");
+		if (result.droppedOutOfOrder === true) return;
 		for (const r of processor.getLastLabelWriteRefusals()) {
 			const message = r.reason.kind === "macro-class" ? "label tier collapse refused" : "label write refused";
 			this.ctx.logger.info(message, {
@@ -107226,10 +108185,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 							bytes: count.bytes
 						};
 					},
-					deleteRow: async (collection, key) => await this.settingsStore?.delete.mutate({
-						collection,
-						key
-					}) !== void 0,
+					deleteTrackAlias: async (aliasId) => {
+						const aliasStore = this.trackAliasStore;
+						if (aliasStore === null) throw new Error("track alias store not bound");
+						return await aliasStore.deleteAlias(aliasId);
+					},
+					deleteRow: settingsRowDeleterOf(() => this.settingsStore),
 					logger: this.ctx.logger
 				}),
 				now: () => Date.now(),