@camstack/types 1.2.169 → 1.2.171

package/dist/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BVo6ta6_.js");
-const require_sleep = require("./sleep-BZtO-eFY.js");
+const require_sleep = require("./sleep-Bo9cUOXp.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import { t as EventCategory } from "./event-category-CnLqLOKs.mjs";
-import { D as adminUiCapability, E as DeviceType, G as scopeKey, H as ReadinessTimeoutError, M as expandCapMethods, R as nodePin, S as DEVICE_CHILDREN_BATCH_MAX, V as ReadinessRegistry, _t as DATAPLANE_SECRET_HEADER, a as asJsonObject, b as deviceOpsCapability, bt as BaseAddon, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, wt as emitReadiness, x as viewerUiCapability, xt as normalizeAddonInitResult, yt as DisposerChain, z as readNodePin } from "./sleep-Bd-Y4RUt.mjs";
+import { D as adminUiCapability, E as DeviceType, G as scopeKey, H as ReadinessTimeoutError, M as expandCapMethods, R as nodePin, S as DEVICE_CHILDREN_BATCH_MAX, V as ReadinessRegistry, _t as DATAPLANE_SECRET_HEADER, a as asJsonObject, b as deviceOpsCapability, bt as BaseAddon, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, wt as emitReadiness, x as viewerUiCapability, xt as normalizeAddonInitResult, yt as DisposerChain, z as readNodePin } from "./sleep-DMghvp8F.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
 /**

package/dist/capabilities/pipeline-analytics.cap.d.ts

@@ -2781,6 +2781,95 @@ export declare const pipelineAnalyticsCapability: {
                 trained: "trained";
             }>;
         }, z.core.$strip>, "mutation">;
+        /**
+         * The archived debug notes, newest first — the corpus of what operators
+         * have asked to be checked, across tracks that no longer exist (D405).
+         *
+         * `setTrackFlags` writes it: a patch carrying `debug: false` still clears
+         * the note off the track row in the same statement (D353's invariant is
+         * untouched), but the note is APPENDED here first. That is the whole point
+         * — before D405, finishing a review destroyed every note written during it,
+         * and the ones that survived aged out with their tracks. This method is the
+         * only way to read what was kept.
+         *
+         * `auth: 'protected'`, matching `setTrackFlags` next door and for the same
+         * reason: the notes are written from the viewer, by an authenticated
+         * non-admin session, and a corpus only an admin can read is a corpus the
+         * person who wrote it cannot use. It carries operator prose about cameras
+         * and nothing else — no media, no paths, no identities beyond a track's
+         * own display label.
+         *
+         * Newest-first, capped by `limit` (default
+         * {@link ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT}), optionally one camera. The
+         * table itself is bounded by row count, not by age — see
+         * {@link MAX_ARCHIVED_DEBUG_NOTES} for why an age clock would be the wrong
+         * bound for exactly this data.
+         */
+        readonly listArchivedDebugNotes: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodOptional<z.ZodNumber>;
+            limit: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            note: z.ZodString;
+            deviceId: z.ZodNumber;
+            sourceTrackId: z.ZodString;
+            archivedAt: z.ZodNumber;
+            trackStartedAt: z.ZodNullable<z.ZodNumber>;
+            trackClass: z.ZodNullable<z.ZodString>;
+            trackLabel: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>>, "query">;
+        /**
+         * Birth decisions — one row per resolved confirmation-gate verdict (D409).
+         *
+         * The READ half of a measurement, and only that: it gates nothing and no
+         * runtime path consults it. It exists because the two questions the
+         * operator's "traccia partita in ritardo" marks raised are both multi-day
+         * and `logs.query` holds under an hour of fleet traffic —
+         *   • how often is a birth DECIDED on a frame the subject was not observed
+         *     in (`decidedOnCoastedFrame`), and did D379's carried pixels make it a
+         *     real observation anyway (`decidedByBirthEvidence`);
+         *   • how long after the camera's motion onset does a track's `firstSeen`
+         *     land (`birthLatencyMs` — read its error bars in
+         *     `BirthDecisionRecordSchema` before quoting it).
+         *
+         * Newest-first, capped by `limit` (default
+         * {@link BIRTH_DECISION_DEFAULT_LIMIT}), optionally scoped to one camera,
+         * one verdict, or a `since`. The table is bounded by row count, not age —
+         * see {@link MAX_BIRTH_DECISION_RECORDS}.
+         */
+        readonly listBirthDecisions: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodOptional<z.ZodNumber>;
+            since: z.ZodOptional<z.ZodNumber>;
+            verdict: z.ZodOptional<z.ZodEnum<{
+                confirmed: "confirmed";
+                suppressed: "suppressed";
+                "exhausted-fallback": "exhausted-fallback";
+            }>>;
+            limit: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            at: z.ZodNumber;
+            deviceId: z.ZodNumber;
+            sourceTrackId: z.ZodString;
+            className: z.ZodString;
+            verdict: z.ZodEnum<{
+                confirmed: "confirmed";
+                suppressed: "suppressed";
+                "exhausted-fallback": "exhausted-fallback";
+            }>;
+            reason: z.ZodNullable<z.ZodString>;
+            attempts: z.ZodNumber;
+            deferredForMs: z.ZodNumber;
+            decidedOnCoastedFrame: z.ZodBoolean;
+            birthEvidenceAvailable: z.ZodBoolean;
+            decidedByBirthEvidence: z.ZodBoolean;
+            bestScore: z.ZodNullable<z.ZodNumber>;
+            appliedMinConfidence: z.ZodNullable<z.ZodNumber>;
+            firstSeen: z.ZodNullable<z.ZodNumber>;
+            motionOnsetAt: z.ZodNullable<z.ZodNumber>;
+            birthLatencyMs: z.ZodNullable<z.ZodNumber>;
+            birthIndexInBurst: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>>, "query">;
         /**
          * Durable event-store footprint for the management UI: event rows
          * (motion + object + audio) counted per camera + total, plus the

package/dist/generated/addon-api.d.ts

@@ -5201,6 +5201,20 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof pipelineAnalyticsCapability.methods.setTrackFlags.output>;
             meta: object;
         }>;
+        listArchivedDebugNotes: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof pipelineAnalyticsCapability.methods.listArchivedDebugNotes.input>;
+            output: z.infer<typeof pipelineAnalyticsCapability.methods.listArchivedDebugNotes.output>;
+            meta: object;
+        }>;
+        listBirthDecisions: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof pipelineAnalyticsCapability.methods.listBirthDecisions.input>;
+            output: z.infer<typeof pipelineAnalyticsCapability.methods.listBirthDecisions.output>;
+            meta: object;
+        }>;
         getEventStoreFootprint: TRPCQueryProcedure<{
             input: {
                 [x: string]: unknown;

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 1022 method paths across 129 capabilities.
+ * Coverage: 1024 method paths across 129 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/method-device-selectors.d.ts

@@ -6,7 +6,7 @@
  * system-scope cap that takes a deviceId was previously never device-filtered
  * — see the generator header).
  *
- * Coverage: 367 methods carry a device reference, of which
+ * Coverage: 369 methods carry a device reference, of which
  * 134 are on SYSTEM-scope caps.
  *
  * Top-level fields, number arrays, and one-level arrays of objects carrying

package/dist/index.d.ts

@@ -40,6 +40,8 @@ export type { HydratedFieldEntry } from './interfaces/config-ui.js';
 export { collectHydratedFieldEntries, collectHydratedFieldValues, hydrateSchema, resolveHydratedFieldValue, WELL_KNOWN_TAB_MAP, WELL_KNOWN_TABS, } from './interfaces/config-ui.js';
 export { collectSecretConfigKeys, isSecretConfigField, REDACTED_SECRET, schemaDeclaresAnyField, } from './interfaces/config-ui-secrets.js';
 export type * from './interfaces/context.js';
+export * from './interfaces/birth-decision-ledger.js';
+export * from './interfaces/debug-note-archive.js';
 export type * from './interfaces/decoder.js';
 export type * from './interfaces/detection-addon.js';
 export type { DeviceEvent, DeviceMetadata, DeviceState } from './interfaces/device.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BVo6ta6_.js");
-const require_sleep = require("./sleep-BZtO-eFY.js");
+const require_sleep = require("./sleep-Bo9cUOXp.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -1257,6 +1257,313 @@ function walkField(field, out) {
 	}
 }
 //#endregion
+//#region src/interfaces/birth-decision-ledger.ts
+/**
+* Birth-decision ledger — one durable row per track-birth VERDICT (D409).
+*
+* ── Why this exists ────────────────────────────────────────────────────────
+* On 2026-09-08 the operator marked eleven tracks for review and five of them
+* said "traccia partita in ritardo" — the track appears to begin long after the
+* subject entered the scene. Two causes were proposed and NEITHER was measured:
+*
+*  - the confirmation gate's deferral (`maxDeferralMs`, 2 s). This is now
+*    DISPROVEN as a cause of a late TIMELINE: a track's `firstSeen` and its
+*    first position are the CANDIDATE's first frame, not the confirmation's.
+*    Verified on `d035f251` (device 3829): first position == `firstSeen`, with
+*    confirmation 2 163 ms later.
+*  - the detector simply not firing until the subject is well into the scene.
+*    Unmeasured, and the reason this table exists.
+*
+* A second, real defect is also unquantified. The deferred-birth re-offer in
+* `index.ts` takes the track from `result.tracked` with NO `matchedThisFrame`
+* check, so a birth can be CONFIRMED on a frame the subject was never observed
+* in. D379's carried birth evidence means some of those confirmations rest on a
+* real observation of the birth instant anyway — and how often is exactly what
+* nobody knows. {@link BirthDecisionRecord.decidedOnCoastedFrame} and
+* {@link BirthDecisionRecord.decidedByBirthEvidence} are the two columns that
+* answer it together.
+*
+* ── Why a TABLE and not a log line ─────────────────────────────────────────
+* `logs.query` is an in-memory ring. Measured on the live hub on 2026-09-08 it
+* held 40 000 entries covering 38 minutes — the whole ring is under an hour of
+* fleet traffic. Every question this data is for ("how often, on camera 617,
+* over the week the operator complained about") outlives that ring by two
+* orders of magnitude, and a previous investigation in this repo was blocked
+* for precisely this reason. The gate ALREADY writes a log line per decision
+* (`confirmation gate: birth confirmed/suppressed/undecided`); adding a
+* fourteenth field to it would answer nothing a day later.
+*
+* This is a MEASUREMENT table. It changes no behaviour, gates nothing, and
+* nothing reads it on the frame path.
+*/
+/**
+* How many birth decisions the cluster keeps, across every camera.
+*
+* Sized off a MEASURED rate, not a guess. Fleet-wide on the live hub,
+* 2026-09-08 20:16 local, over the 38 minutes the log ring covered: 17 `track
+* started` + 14 `birth suppressed — track record retracted` = 31 decided
+* births, i.e. ~49/hour, ~1 200/day. Call a busy daytime hour five times that
+* and the fleet writes ~6 000 rows/day.
+*
+* 30 000 rows is therefore ~25 days at the measured rate and ~5 days at five
+* times it — comfortably past "a few days of traffic", which is the bar the
+* operator's week-long complaint sets. At ~200 bytes a row the ceiling is
+* ~6 MB, against a `tracks` table measured at 4.6 MB for a single 501-row page.
+*
+* A COUNT and not an age, for the same reason as the debug-note archive: the
+* denominator of a miss rate is only meaningful over whatever window the table
+* actually holds, and a quiet fleet should keep more of it, not less. Trimmed
+* oldest-first on append.
+*/
+var MAX_BIRTH_DECISION_RECORDS = 3e4;
+/** Default page size for `listBirthDecisions` when the caller omits one. */
+var BIRTH_DECISION_DEFAULT_LIMIT = 500;
+/**
+* How stale a motion onset may be and still be offered as the birth-latency
+* proxy. Beyond this the row records `null`, never a large number.
+*
+* 60 s is one order of magnitude above the latency being measured (the
+* complaint is "seconds late") and one below the duration of a busy scene's
+* continuous motion burst, where the onset is minutes old and says nothing
+* about THIS subject. See {@link BirthDecisionRecord.birthLatencyMs} for the
+* full error bars.
+*/
+var MAX_BIRTH_LATENCY_PROXY_MS = 6e4;
+/**
+* What the gate decided about a birth, from the CALLER's point of view.
+*
+* Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
+* at all — it is a deferral, and the row is written when the deferral ENDS.
+* The third member is the one the gate's own type cannot express, because
+* exhaustion is a property of how long the caller waited.
+*/
+var BirthDecisionVerdictSchema = zod.z.enum([
+	"confirmed",
+	"suppressed",
+	"exhausted-fallback"
+]);
+/** One birth decision, as it is kept. */
+var BirthDecisionRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	/** Epoch ms the VERDICT was taken (not the birth instant — see `firstSeen`). */
+	at: zod.z.number().int(),
+	/** The camera. Required: every question here is asked per-camera. */
+	deviceId: zod.z.number().int(),
+	/**
+	* The track the decision was about. PROVENANCE, not ownership — a suppressed
+	* birth has no track at all, and a confirmed one is expected to age out long
+	* before this row does. Named `sourceTrackId` so the retention model's
+	* ownership derivation (`collection-classification.ts`, which keys on a
+	* column literally called `trackId`) cannot reach it.
+	*/
+	sourceTrackId: zod.z.string(),
+	/** The candidate's claimed class. The miss rate is asked per class too. */
+	className: zod.z.string(),
+	verdict: BirthDecisionVerdictSchema,
+	/**
+	* The gate's own `ConfirmationReason` (`confirmed`, `suppressed`,
+	* `native-pass`, `no-crop`, `timeout`, `carried-inconclusive`, …), or `null`
+	* when the gate is DISABLED and every birth is waved through. `null` is not
+	* "unknown": it says the gate took no measurement because it was off, which
+	* is a different population and must never be averaged in with the rest.
+	*/
+	reason: zod.z.string().nullable(),
+	/** Deferral attempts this birth used. 0 = decided on its first look. */
+	attempts: zod.z.number().int(),
+	/** Ms from the FIRST undecided attempt to this verdict. 0 = never deferred. */
+	deferredForMs: zod.z.number().int(),
+	/**
+	* THE COLUMN THE RE-OFFER DEFECT IS COUNTED IN.
+	*
+	* `true` when the frame the verdict was taken on carried no matched
+	* detection for this track — the tracker was coasting a frozen box and the
+	* subject was not observed. The deferred-birth re-offer pulls the candidate
+	* straight out of `result.tracked` without checking, so this is reachable
+	* today; the question is the RATE, per camera, and whether refusing those
+	* frames would have cost real tracks (cross-read against `verdict` and
+	* `decidedByBirthEvidence`).
+	*/
+	decidedOnCoastedFrame: zod.z.boolean(),
+	/** Were D379 birth-instant pixels in hand when this candidate was submitted? */
+	birthEvidenceAvailable: zod.z.boolean(),
+	/**
+	* Did those pixels DECIDE it (`cropSource === 'carried'`)? Available and
+	* deciding are different: the carried crop is confirm-only, so a candidate
+	* can hold evidence, be found inconclusive on it, and be decided by a native
+	* crop of a later instant. A coasted decision backed by carried evidence is
+	* a real observation of the birth instant; one without it is not.
+	*/
+	decidedByBirthEvidence: zod.z.boolean(),
+	/** Best class-compatible crop score, or `null` when nothing compatible was
+	*  found — deliberately not 0, which would be a measurement that never was. */
+	bestScore: zod.z.number().nullable(),
+	/** The bar this candidate actually faced (the phantom-cell hook may raise it). */
+	appliedMinConfidence: zod.z.number().nullable(),
+	/**
+	* The track's own `firstSeen` — the candidate's first frame, which is where
+	* the timeline starts. `null` for a suppressed birth, which has no track.
+	*/
+	firstSeen: zod.z.number().int().nullable(),
+	/**
+	* The device's most recent motion RISING EDGE at the moment of the decision,
+	* or `null` when there is none, it is older than
+	* {@link MAX_BIRTH_LATENCY_PROXY_MS}, or this runner never saw one.
+	*/
+	motionOnsetAt: zod.z.number().int().nullable(),
+	/**
+	* `firstSeen − motionOnsetAt` — THE OPERATOR'S COMPLAINT, IN MILLISECONDS,
+	* AND THE WEAKEST NUMBER IN THIS ROW. Read the error bars before quoting it.
+	*
+	* **Why motion onset and not something else.** Two other proxies were
+	* considered and rejected:
+	*  - *the recording/pipeline session start*: for a camera on
+	*    `detectionMode: 'always'` the session opens at process start, hours
+	*    before any subject. It measures nothing.
+	*  - *the first detection on the device in this burst*: CIRCULAR. A track's
+	*    `firstSeen` IS the first detection of that object, so for the track that
+	*    OPENS a burst — the only one the operator is complaining about — the two
+	*    are the same instant and the latency is 0 by construction.
+	* Motion onset is the only in-process signal produced by a DIFFERENT
+	* mechanism from the object detector, so it is the only one that can precede
+	* it. It is also already maintained per-device at frame rate on this very
+	* node (`handleMotionAnalysis` / `handleOnboardMotion`), which is what makes
+	* it free — and, decisively, the frame path and the motion path are gated to
+	* the SAME designated post-processing node, so the mirror is never empty for
+	* a camera whose births land here.
+	*
+	* **Error bars, all of them.**
+	*  1. *Motion has no class.* A burst opened by rain, a headlight sweeping a
+	*     wall or a branch, and only later joined by the person, OVERSTATES the
+	*     latency without bound. Mitigated, never removed, by
+	*     {@link BirthDecisionRecord.birthIndexInBurst}: only index 0 is a
+	*     candidate for "this burst is this subject", and even then it is a
+	*     candidate, not a fact.
+	*  2. *The sign is not guaranteed.* The analyzer needs a pixel-count and
+	*     intensity threshold. A subject entering slowly at the far edge of the
+	*     frame can clear the detector's confidence floor BEFORE it clears the
+	*     motion floor, making this negative. Negatives are stored as-is and
+	*     never clamped — clamping would fabricate the distribution's left tail,
+	*     which is the half that says the proxy is unreliable.
+	*  3. *Onboard motion carries firmware latency of unknown, per-model offset*
+	*     (hundreds of ms), plus camera-vs-hub clock skew on top. Numbers are
+	*     therefore comparable WITHIN a camera and not across cameras of
+	*     different motion sources. The motion source is deliberately not copied
+	*     here — it belongs to the addon that owns the device (D224) and this is
+	*     a write on the frame path — so group by `deviceId`, which is how the
+	*     question is always asked anyway.
+	*  4. *Continuous motion.* On a busy scene the burst never closes and the
+	*     onset is minutes old. Bounded by {@link MAX_BIRTH_LATENCY_PROXY_MS};
+	*     past it this is `null`.
+	*  5. *No motion signal at all* — analyzer off, onboard-only camera not
+	*     reporting, or nothing since boot: `null`. Which is the truth about a
+	*     camera nobody has a reference instant for.
+	*
+	* So this is a per-camera DISTRIBUTION over index-0 births, and it is honest
+	* as such. It is not a per-track fact and must never be shown as one.
+	*/
+	birthLatencyMs: zod.z.number().int().nullable(),
+	/**
+	* How many births this device has already decided since that motion onset.
+	* 0 = the first, i.e. the only index at which the burst plausibly belongs to
+	* this subject. `null` when there is no usable onset.
+	*/
+	birthIndexInBurst: zod.z.number().int().nullable()
+});
+/** Query input for `listBirthDecisions` — newest first, one camera or all. */
+var BirthDecisionQueryInputSchema = zod.z.object({
+	/** Restrict to a single camera; omit for every row. */
+	deviceId: zod.z.number().int().optional(),
+	/** Only decisions at or after this epoch ms. */
+	since: zod.z.number().int().optional(),
+	/** Restrict to one verdict — the miss rate is read one population at a time. */
+	verdict: BirthDecisionVerdictSchema.optional(),
+	/** Max rows returned, newest-first. */
+	limit: zod.z.number().int().min(1).max(5e3).optional()
+});
+//#endregion
+//#region src/interfaces/debug-note-archive.ts
+/**
+* Debug-note archive — the durable corpus of what operators asked to be
+* checked, and the ONE thing about a debug note that outlives its track.
+*
+* D353 bound `debugNote` to the `debug` flag: turning the flag off clears the
+* note in the same statement, so a track can never present a question without
+* the flag that explains it. That invariant is right and stays. Its side
+* effect was not: the act of REVIEWING a debug set destroyed every note in it,
+* and the notes that survived a sweep aged out with their tracks anyway. On
+* 2026-09-08 the notes from one morning's review — 25 to 27 of them — were
+* already unreadable by the afternoon, leaving 11.
+*
+* So the clear now ARCHIVES first (D405). A row here is:
+*
+*  - written ONLY by the hub, from `applyTrackFlags`, immediately before the
+*    note is cleared off the track row;
+*  - keyed by ITS OWN id, derived from `(sourceTrackId, note)` so reviewing
+*    the same track twice cannot double the corpus;
+*  - NOT a track row, NOT subject to track retention, and NOT a durability pin
+*    on anything — the track it names is expected to be gone.
+*
+* `sourceTrackId` is deliberately not called `trackId`. The analytics
+* retention model derives track OWNERSHIP from a declared `trackId` column
+* (`collection-classification.ts`), and a row that the cascade would delete
+* with its track is exactly the row this table exists to keep. The name says
+* PROVENANCE — the same distinction the stationary registry draws for the same
+* reason.
+*/
+/**
+* How many archived notes the cluster keeps, across every camera.
+*
+* GLOBAL, not per-device, and a COUNT, not an age. Both halves are deliberate:
+*
+*  - A per-device bound multiplies by the fleet — 30 cameras at 500 each is
+*    15 000 rows to protect a corpus that only ever gets read fleet-wide (the
+*    thing being mined is "what keeps going wrong", not "what goes wrong on
+*    617"). One global ceiling is one number to reason about.
+*  - An AGE bound would delete the corpus for being old, which is the failure
+*    being fixed: a note from six months ago is the most valuable row in the
+*    table precisely because the pattern it describes has had time to repeat.
+*
+* The number is sized off the measured rate. The 2026-09-08 sweep produced
+* 25–27 notes; call a heavy day 100. 5 000 rows is roughly fifty such days,
+* and at the observed rate (a few sweeps a week) several years. The cost is
+* bounded by construction: a note is capped at `MAX_TRACK_DEBUG_NOTE_LEN`
+* (500 chars) and the metadata beside it is under 100 bytes, so the ceiling is
+* ~3 MB of text and the realistic occupancy is well under 1 MB — against a
+* `tracks` table measured at 4.6 MB for a single 501-row page.
+*/
+var MAX_ARCHIVED_DEBUG_NOTES = 5e3;
+/** Default page size for `listArchivedDebugNotes` when the caller omits one. */
+var ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT = 200;
+/** One archived note — the operator's words plus enough context to find what
+*  they were looking at, after the track itself is gone. */
+var ArchivedDebugNoteSchema = zod.z.object({
+	/** Archive row id. Derived from `(sourceTrackId, note)`, so re-archiving the
+	*  same sentence about the same track lands on the row already there. */
+	id: zod.z.string(),
+	/** The operator's own words, verbatim. */
+	note: zod.z.string(),
+	/** The camera. Required — every question here is asked per-camera. */
+	deviceId: zod.z.number().int(),
+	/** The track the note was written on. PROVENANCE, not ownership: the track
+	*  is expected to be gone, and this row is not a reference to it. */
+	sourceTrackId: zod.z.string(),
+	/** Epoch ms the note was moved here, i.e. when the operator reviewed it. */
+	archivedAt: zod.z.number().int(),
+	/** The track's `firstSeen`, when the row still knew it; `null` otherwise. */
+	trackStartedAt: zod.z.number().int().nullable(),
+	/** The track's detector class (`person`, `car`, …); `null` when unknown. */
+	trackClass: zod.z.string().nullable(),
+	/** The track's display label at review time; `null` when it had none. */
+	trackLabel: zod.z.string().nullable()
+});
+/** Query input for `listArchivedDebugNotes` — newest first, one camera or all. */
+var ArchivedDebugNoteQueryInputSchema = zod.z.object({
+	/** Restrict to a single camera; omit for every row. */
+	deviceId: zod.z.number().int().optional(),
+	/** Max rows returned, newest-first. */
+	limit: zod.z.number().int().min(1).max(1e3).optional()
+});
+//#endregion
 //#region src/interfaces/device-capabilities/camera.ts
 /** Friendly display labels for stream quality IDs. */
 var STREAM_QUALITY_LABELS = {
@@ -20186,6 +20493,51 @@ var pipelineAnalyticsCapability = {
 			flags: TrackFlagsPatchSchema
 		}), TrackFlagsSchema, { kind: "mutation" }),
 		/**
+		* The archived debug notes, newest first — the corpus of what operators
+		* have asked to be checked, across tracks that no longer exist (D405).
+		*
+		* `setTrackFlags` writes it: a patch carrying `debug: false` still clears
+		* the note off the track row in the same statement (D353's invariant is
+		* untouched), but the note is APPENDED here first. That is the whole point
+		* — before D405, finishing a review destroyed every note written during it,
+		* and the ones that survived aged out with their tracks. This method is the
+		* only way to read what was kept.
+		*
+		* `auth: 'protected'`, matching `setTrackFlags` next door and for the same
+		* reason: the notes are written from the viewer, by an authenticated
+		* non-admin session, and a corpus only an admin can read is a corpus the
+		* person who wrote it cannot use. It carries operator prose about cameras
+		* and nothing else — no media, no paths, no identities beyond a track's
+		* own display label.
+		*
+		* Newest-first, capped by `limit` (default
+		* {@link ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT}), optionally one camera. The
+		* table itself is bounded by row count, not by age — see
+		* {@link MAX_ARCHIVED_DEBUG_NOTES} for why an age clock would be the wrong
+		* bound for exactly this data.
+		*/
+		listArchivedDebugNotes: require_sleep.method(ArchivedDebugNoteQueryInputSchema, zod.z.array(ArchivedDebugNoteSchema).readonly(), { kind: "query" }),
+		/**
+		* Birth decisions — one row per resolved confirmation-gate verdict (D409).
+		*
+		* The READ half of a measurement, and only that: it gates nothing and no
+		* runtime path consults it. It exists because the two questions the
+		* operator's "traccia partita in ritardo" marks raised are both multi-day
+		* and `logs.query` holds under an hour of fleet traffic —
+		*   • how often is a birth DECIDED on a frame the subject was not observed
+		*     in (`decidedOnCoastedFrame`), and did D379's carried pixels make it a
+		*     real observation anyway (`decidedByBirthEvidence`);
+		*   • how long after the camera's motion onset does a track's `firstSeen`
+		*     land (`birthLatencyMs` — read its error bars in
+		*     `BirthDecisionRecordSchema` before quoting it).
+		*
+		* Newest-first, capped by `limit` (default
+		* {@link BIRTH_DECISION_DEFAULT_LIMIT}), optionally scoped to one camera,
+		* one verdict, or a `since`. The table is bounded by row count, not age —
+		* see {@link MAX_BIRTH_DECISION_RECORDS}.
+		*/
+		listBirthDecisions: require_sleep.method(BirthDecisionQueryInputSchema, zod.z.array(BirthDecisionRecordSchema).readonly(), { kind: "query" }),
+		/**
 		* Durable event-store footprint for the management UI: event rows
 		* (motion + object + audio) counted per camera + total, plus the
 		* event-owned media bytes on disk per camera + total. Stat/count-based,
@@ -44572,6 +44924,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listArchivedDebugNotes": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listBirthDecisions": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -48628,6 +48992,16 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "array",
 		optional: true
 	}],
+	"pipelineAnalytics.listArchivedDebugNotes": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.listBirthDecisions": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
 	"pipelineAnalytics.listEventKinds": [{
 		name: "deviceId",
 		form: "single",
@@ -54624,6 +54998,7 @@ exports.ACCESS_ROLES = ACCESS_ROLES;
 exports.ALEXA_EGRESS_PROFILE = ALEXA_EGRESS_PROFILE;
 exports.ALL_CAPABILITY_DEFINITIONS = ALL_CAPABILITY_DEFINITIONS;
 exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
+exports.ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT = ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
 exports.AUDIO_MACRO_LABELS = AUDIO_MACRO_LABELS;
@@ -54661,6 +55036,8 @@ exports.ApiKeyRecordSchema = ApiKeyRecordSchema;
 exports.ApiKeySummarySchema = ApiKeySummarySchema;
 exports.ArchiveEntrySchema = ArchiveEntrySchema;
 exports.ArchiveManifestSchema = ArchiveManifestSchema;
+exports.ArchivedDebugNoteQueryInputSchema = ArchivedDebugNoteQueryInputSchema;
+exports.ArchivedDebugNoteSchema = ArchivedDebugNoteSchema;
 exports.AttachmentMediaTypeSchema = AttachmentMediaTypeSchema;
 exports.AttachmentSchema = AttachmentSchema;
 exports.AudioAnalysisResultSchema = AudioAnalysisResultSchema;
@@ -54693,6 +55070,7 @@ exports.BACKEND_TO_FORMAT = BACKEND_TO_FORMAT;
 exports.BASE_LIVE_EGRESS_PROFILE = BASE_LIVE_EGRESS_PROFILE;
 exports.BATTERY_DEVICE_PROFILE = BATTERY_DEVICE_PROFILE;
 exports.BATTERY_UNREACHABLE_AFTER_MS = BATTERY_UNREACHABLE_AFTER_MS;
+exports.BIRTH_DECISION_DEFAULT_LIMIT = BIRTH_DECISION_DEFAULT_LIMIT;
 exports.BOOT_RECOVERY_BACKOFF_MS = require_sleep.BOOT_RECOVERY_BACKOFF_MS;
 exports.BacklightModeSchema = BacklightModeSchema;
 exports.BackupDestinationInfoSchema = BackupDestinationInfoSchema;
@@ -54706,6 +55084,9 @@ exports.BaseDevice = BaseDevice;
 exports.BaseDeviceProvider = BaseDeviceProvider;
 exports.BatteryStatusSchema = BatteryStatusSchema;
 exports.BinaryStatusSchema = BinaryStatusSchema;
+exports.BirthDecisionQueryInputSchema = BirthDecisionQueryInputSchema;
+exports.BirthDecisionRecordSchema = BirthDecisionRecordSchema;
+exports.BirthDecisionVerdictSchema = BirthDecisionVerdictSchema;
 exports.BoundingBoxSchema = BoundingBoxSchema;
 exports.BrightnessStatusSchema = BrightnessStatusSchema;
 exports.BrokerAddInputSchema = AddInputSchema;
@@ -55081,6 +55462,9 @@ exports.LoggingSettingsStateSchema = LoggingSettingsStateSchema;
 exports.LoginMethodContributionSchema = LoginMethodContributionSchema;
 exports.LoginStageEnum = LoginStageEnum;
 exports.MACRO_LABELS = MACRO_LABELS;
+exports.MAX_ARCHIVED_DEBUG_NOTES = MAX_ARCHIVED_DEBUG_NOTES;
+exports.MAX_BIRTH_DECISION_RECORDS = MAX_BIRTH_DECISION_RECORDS;
+exports.MAX_BIRTH_LATENCY_PROXY_MS = MAX_BIRTH_LATENCY_PROXY_MS;
 exports.MAX_CLIP_EVENT_IDS = MAX_CLIP_EVENT_IDS;
 exports.MAX_CLIP_LABELS = MAX_CLIP_LABELS;
 exports.MAX_CONDITION_DEPTH = MAX_CONDITION_DEPTH;