@trillboards/edge-sdk 0.2.140 → 0.2.150

package/dist/CloudSensingManager.js

@@ -6,7 +6,14 @@ exports.buildSensingLoops = buildSensingLoops;
 exports.buildTiledCameras = buildTiledCameras;
 exports.resolveFeeds = resolveFeeds;
 const events_1 = require("events");
+const crypto_1 = require("crypto");
+const FrameGroupingShadow_1 = require("./FrameGroupingShadow");
+const ProfileReviewWork_1 = require("./ProfileReviewWork");
+const ReviewPriority_1 = require("./ReviewPriority");
+const continuousReview_1 = require("./continuousReview");
 const localNetworkAccess_1 = require("./localNetworkAccess");
+const LocalDetectorClient_1 = require("./LocalDetectorClient");
+const UrgentReviewTriage_1 = require("./UrgentReviewTriage");
 const MosaicSource_1 = require("./MosaicSource");
 const runtimePaths_1 = require("./runtimePaths");
 const legacyRecorderProfile_1 = require("./legacyRecorderProfile");
@@ -265,6 +272,15 @@ class CloudSensingManager extends events_1.EventEmitter {
          */
         this.localNetworkVerdict = null;
         this.localNetworkProbeInFlight = false;
+        this.urgentTriageClients = new Map();
+        this.urgentTriageBusy = false;
+        this.frameGroupers = new Map();
+        this.reviewsInFlight = new Set();
+        // Physical reservations outlive lease expiry and manager stop/start until
+        // the original promise settles, including the original feed identity.
+        this.modelReviewsInFlight = new Set();
+        this.uploadsInFlight = new Set();
+        this.deliveryRetryAtMs = 0;
         this.candidatePumpTimer = null;
         /**
          * What the ARMED gate actually did, connector-wide.
@@ -365,12 +381,14 @@ class CloudSensingManager extends events_1.EventEmitter {
         // cloud path (a genuinely concurrent backend) exactly as it is today; the
         // local path passes 1 because its backend is single-conversation.
         this.admissionGate = new VlmAdmissionGate_1.VlmAdmissionGate({
-            maxInFlight: Math.max(1, Math.trunc(options.maxConcurrentAnalyses ?? this.loops.length)),
+            maxInFlight: Math.max(1, Math.trunc(options.candidateBuffer?.continuousReview?.parallelModelReview === true ? 2 : options.maxConcurrentAnalyses ??
+                (options.candidateBuffer?.continuousReview?.enabled ? 1 : this.loops.length))),
             maxInFlightMs: options.maxAnalysisInFlightMs,
             // Fairness only matters when feeds actually compete, which is exactly the
             // single-slot local path. With a slot per loop nobody is starved and the
             // policy would only add a hold window for nothing.
-            fairShareAcrossFeeds: Math.max(1, Math.trunc(options.maxConcurrentAnalyses ?? this.loops.length)) < this.loops.length,
+            fairShareAcrossFeeds: options.candidateBuffer?.continuousReview?.enabled !== true &&
+                Math.max(1, Math.trunc(options.maxConcurrentAnalyses ?? this.loops.length)) < this.loops.length,
             // Forwarded, NOT defaulted here: the gate owns both defaults, so an
             // omitted option leaves its behaviour byte-for-byte unchanged.
             fairShareGraceMs: options.fairShareGraceMs,
@@ -438,11 +456,58 @@ class CloudSensingManager extends events_1.EventEmitter {
         // without a classifier, because that is the queue the gate refuses.
         const candidateBufferEnabled = motionGateEnabled && options.candidateBuffer?.enabled !== false;
         const diskSpool = options.candidateBuffer?.diskSpool;
+        const review = options.candidateBuffer?.continuousReview;
+        const urgentTriage = (0, UrgentReviewTriage_1.freezeUrgentTriage)(review?.urgentTriage, options.loops.map(loop => loop.name), review?.enabled === true && review.independentUploads === true);
+        if (urgentTriage)
+            for (const [name, policy] of Object.entries(urgentTriage.byFeed)) {
+                this.urgentTriageClients.set(name, new LocalDetectorClient_1.LocalDetectorClient({ baseUrl: urgentTriage.baseUrl,
+                    timeoutMs: urgentTriage.timeoutMs, classes: [policy.label], minConfidence: policy.minConfidence,
+                    expectedModel: { modelId: policy.modelId, sha256: policy.modelSha256 } }));
+            }
+        this.reviewPriorities = (0, ReviewPriority_1.freezeReviewPriorities)(review?.priorityByFeed, options.loops.map(loop => loop.name), review?.enabled === true);
+        this.separateProfileWork = review?.enabled === true && review.frameGrouping?.separateProfileWork === true;
+        this.continuousReview = review?.enabled === true ? {
+            enabled: true,
+            reviewWindowMs: review.reviewWindowMs ?? continuousReview_1.DEFAULT_REVIEW_WINDOW_MS,
+            retentionMs: review.retentionMs ?? continuousReview_1.DEFAULT_REVIEW_RETENTION_MS,
+            reuseExactPendingImages: review.reuseExactPendingImages === true,
+            reuseExactRecentImages: review.reuseExactRecentImages === true,
+            independentUploads: review.independentUploads === true,
+            parallelModelReview: review.parallelModelReview === true,
+        } : null;
+        if (this.continuousReview && review?.frameGrouping) {
+            for (const loop of options.loops)
+                this.frameGroupers.set(loop.name, new FrameGroupingShadow_1.FrameGroupingShadow(review.frameGrouping));
+        }
+        if (this.continuousReview && (!candidateBufferEnabled || diskSpool?.enabled === false || !diskSpool?.directory ||
+            [this.continuousReview.reviewWindowMs, this.continuousReview.retentionMs]
+                .some(v => !Number.isFinite(v) || v < 1) ||
+            this.continuousReview.retentionMs < this.continuousReview.reviewWindowMs))
+            throw new Error('Continuous review requires durable storage and valid separate freshness/retention limits');
+        if (this.continuousReview) {
+            const pairedApi = review?.deliveryTarget === 'configured-api' ? options.retainedApiBaseUrl : undefined;
+            if (review?.deliveryTarget === 'configured-api' && !pairedApi)
+                throw Error('Configured API review requires the paired API');
+            for (const loop of options.loops)
+                (0, continuousReview_1.assertRetainedReviewReceiver)(loop.client.getEndpoint(), pairedApi);
+        }
+        if (this.continuousReview?.independentUploads &&
+            options.loops.some(loop => typeof loop.client.reviewCandidate !== 'function')) {
+            throw new Error('Independent uploads require a local client with durable review support');
+        }
+        if (options.loops.some(loop => loop.client.retainOrderedCapture)
+            && (!this.continuousReview?.independentUploads || !candidateBufferEnabled || !diskSpool?.directory))
+            throw Error('Ordered capture requires the continuous durable review workflow');
+        if (review?.parallelModelReview && (!this.continuousReview?.independentUploads
+            || (options.maxConcurrentAnalyses ?? 1) !== 1 || urgentTriage
+            || options.detectorShadow?.isEnabled())) {
+            throw Error('Parallel model review requires one slot per model, independent uploads, and no auxiliary inference');
+        }
         const candidateTtlMs = Math.max(1, Math.trunc(options.candidateBuffer?.ttlMs ?? VlmCandidateBuffer_1.DEFAULT_CANDIDATE_TTL_MS));
         // Disk durability must never widen the alert-freshness window. Operators
         // may narrow it, but a legacy 24-hour diskSpool.retentionMs is clamped to
         // the same TTL the in-memory hold would have enforced.
-        const durableRetentionMs = Math.min(candidateTtlMs, Math.max(1, Math.trunc(diskSpool?.retentionMs ?? candidateTtlMs)));
+        const durableRetentionMs = this.continuousReview?.retentionMs ?? Math.min(candidateTtlMs, Math.max(1, Math.trunc(diskSpool?.retentionMs ?? candidateTtlMs)));
         this.candidates = !candidateBufferEnabled
             ? null
             : diskSpool?.enabled !== false && diskSpool?.directory
@@ -450,6 +515,15 @@ class CloudSensingManager extends events_1.EventEmitter {
                     ...diskSpool,
                     directory: diskSpool.directory,
                     retentionMs: durableRetentionMs,
+                    // Do not allow the lower-level disk option to bypass the manager's
+                    // explicit captured profile/feed policy and loopback review guard.
+                    priorityScheduling: this.continuousReview !== null,
+                    urgentTriagePolicies: urgentTriage?.byFeed,
+                    ...(this.continuousReview ? {
+                        reviewWindowMs: this.continuousReview.reviewWindowMs,
+                        reuseExactPendingImages: this.continuousReview.reuseExactPendingImages,
+                        reuseExactRecentImages: this.continuousReview.reuseExactRecentImages,
+                    } : {}),
                     now: this.now,
                 })
                 : new VlmCandidateBuffer_1.VlmCandidateBuffer({ ...options.candidateBuffer, now: this.now });
@@ -723,6 +797,11 @@ class CloudSensingManager extends events_1.EventEmitter {
                 writeFailed: candidateStats?.writeFailed ?? 0,
                 readFailed: candidateStats?.readFailed ?? 0,
                 deleteFailed: candidateStats?.deleteFailed ?? 0,
+                ...(this.continuousReview ? {
+                    reviewWindowMs: this.continuousReview.reviewWindowMs,
+                    delayed: candidateStats?.delayed ?? 0,
+                    capacityRejected: candidateStats?.capacityRejected ?? 0,
+                } : {}),
             },
             accelerator: foldAcceleratorHealth(this.loops.map((s) => acceleratorHealthFor(s)).filter((a) => a !== null)),
             detectorShadow: this.detectorShadow?.getStats() ?? EMPTY_DETECTOR_SHADOW_STATS,
@@ -758,6 +837,8 @@ class CloudSensingManager extends events_1.EventEmitter {
         // in-memory implementation resets here, preserving its historical clean
         // stop/start semantics.
         this.candidates?.startRun();
+        for (const grouper of this.frameGroupers.values())
+            grouper.reset();
         this.healthOnlyMode = opts.healthOnly === true;
         this.running = true;
         this.runStartedAtMs = this.now();
@@ -1016,6 +1097,10 @@ class CloudSensingManager extends events_1.EventEmitter {
         if (startupDelayMs > 0) {
             await sleep(startupDelayMs);
         }
+        if (!this.isCurrentStart(generation))
+            return;
+        if (this.continuousReview)
+            await s.deps.client.prepareReview?.();
         if (!this.isCurrentStart(generation))
             return;
         needsOpen = !s.deps.camera.isOpen();
@@ -1099,7 +1184,7 @@ class CloudSensingManager extends events_1.EventEmitter {
         // A health-only run is not sensing, so neither the face-triggered cadence
         // nor the motion scan interval applies — it beats on the camera-health
         // heartbeat, which is exactly the clock the portal ages a feed against.
-        if (this.healthOnlyMode)
+        if (this.healthOnlyMode || s.deps.client.isReviewActive?.() === false)
             return this.cameraHealthHeartbeatIntervalMs;
         const scan = this.motionScanIntervalMs;
         if (scan !== null) {
@@ -1482,7 +1567,8 @@ class CloudSensingManager extends events_1.EventEmitter {
                 frameProven: true,
                 // Two different reasons a proven frame is not being analyzed: the gate
                 // is full (sensing IS running), or there is no model to analyze with.
-                sensingState: this.healthOnlyMode ? 'unavailable' : 'waiting_for_capacity',
+                sensingState: this.healthOnlyMode ? 'unavailable'
+                    : s.deps.client.isReviewActive?.() === false ? 'idle' : 'waiting_for_capacity',
                 force: true,
             });
             this.emit('frameCaptured', {
@@ -1530,10 +1616,19 @@ class CloudSensingManager extends events_1.EventEmitter {
      * cheaper to hold than the argument about whether the delta mattered.
      */
     captureAndPost(s) {
+        if (s.deps.client.isReviewActive?.() === false) {
+            // Refresh in the background so saving a profile on the website arms this
+            // feed without restarting the connector. Saved pending evidence keeps its
+            // own old contract and is still drained by the independent review pump.
+            void s.deps.client.prepareReview?.().catch(error => this.emitLoopError(s, error));
+            return this.captureHealthFrame(s).then(() => null);
+        }
         if (!s.deps.camera.isOpen()) {
             return Promise.reject(new Error(`CloudSensingManager: camera "${s.deps.name}" is not open`));
         }
         if (this.candidates && s.motionGate) {
+            if (this.continuousReview)
+                return this.lookAndRetain(s);
             return this.lookThenAdmit(s, this.candidates, s.motionGate);
         }
         return this.admitThenLook(s);
@@ -1546,6 +1641,100 @@ class CloudSensingManager extends events_1.EventEmitter {
      * goes into the bounded hold instead of onto the floor; anything the cascade
      * rejected is dropped exactly as before and is never offered.
      */
+    async lookAndRetain(s) {
+        const generation = this.startGeneration;
+        const frame = await this.captureCameraFrame(s);
+        const capturedAtMs = this.now();
+        const res = safeGetResolution(s.deps.camera);
+        const jpeg = await this.toJpeg(frame, res?.width, res?.height);
+        if (!this.isCurrentStart(generation))
+            return null;
+        s.captureCount++;
+        this.reportCameraOpen(s, { frameProven: true, sensingState: 'waiting_for_capacity' });
+        this.emit('frameCaptured', { name: s.deps.name, faceDetected: s.faceDetected });
+        // The gate still classifies motion/calibration, but completed analyses do
+        // not veto new evidence. All expensive work runs in the shared pump.
+        const grouper = this.frameGroupers.get(s.deps.name);
+        let groupingFrame;
+        let backgroundCalibrating = false;
+        const verdict = await s.motionGate.evaluate(jpeg, undefined, true, grouper ? (grey, motion) => {
+            groupingFrame = grey;
+            backgroundCalibrating = motion.calibrating;
+        } : undefined);
+        if (!this.isCurrentStart(generation))
+            return null;
+        const reviewContext = s.deps.client.captureReviewContext?.();
+        if (reviewContext?.profileState === 'inactive') {
+            // A website refresh can finish during decode/motion evaluation. Do not
+            // archive or infer a frame under the now-empty/default profile snapshot.
+            this.reportCameraOpen(s, { frameProven: true, sensingState: 'idle' });
+            return null;
+        }
+        // The explicit local temporal adapter needs observations while a scene is
+        // still (e.g. an open freezer). Motion alone cannot prove elapsed state.
+        const temporalObservation = !!reviewContext?.temporalReviewContract || !!reviewContext?.orderedCaptureContract || !!s.deps.client.retainOrderedCapture;
+        let groupingShadow;
+        let profileWork;
+        if (grouper) {
+            try {
+                groupingShadow = grouper.observe(groupingFrame, (0, FrameGroupingShadow_1.groupingScopes)(reviewContext), reviewContext, capturedAtMs, (0, crypto_1.createHash)('sha256').update(jpeg).digest('hex'), 
+                // Background calibration does not invalidate these decoded raw pixels.
+                // Grouping owns its reference; the first view and visible changes select.
+                verdict.reason === 'audio_onset' || verdict.reason === 'undecodable');
+            }
+            catch (error) {
+                // An optional experiment must never stop the current evidence path.
+                grouper.reset();
+                this.emit('frameGroupingError', { name: s.deps.name, capturedAtMs, error: String(error) });
+            }
+            if (groupingShadow)
+                this.emit('frameGroupingShadow', {
+                    name: s.deps.name, currentAdmission: verdict.analyze, currentReason: verdict.reason,
+                    backgroundCalibrating, ...groupingShadow,
+                });
+            if (this.separateProfileWork && groupingShadow) {
+                profileWork = (0, ProfileReviewWork_1.planProfileReview)(reviewContext, groupingShadow);
+                this.emit('frameProfileWork', { name: s.deps.name, currentAdmission: verdict.analyze,
+                    planned: !!profileWork, work: profileWork });
+            }
+        }
+        if (this.motionDrivesCadence)
+            this.applyMotionCadence(s, verdict.motion);
+        // An explicit raw-capture archive must retain quiet originals too.
+        if (!verdict.analyze && !temporalObservation && !s.deps.client.retainOrderedCapture) {
+            s.motionSkipCount++;
+            s.runMotionSkipped++;
+            this.emit('motionSkipped', { name: s.deps.name, reason: verdict.reason,
+                pctMotion: verdict.pctMotion, regions: verdict.boxes.length });
+            return null;
+        }
+        const capturedPolicy = (0, ReviewPriority_1.parseReviewPolicy)(reviewContext?.reviewPolicy);
+        const reviewPriority = capturedPolicy && 'priority' in capturedPolicy
+            ? capturedPolicy.priority : this.reviewPriorities?.get(s.deps.name) ?? 'normal';
+        if (capturedPolicy && 'invalid' in capturedPolicy) {
+            this.emit('profileReviewPolicyError', { name: s.deps.name, capturedAtMs, reason: 'invalid_profile_review_policy' });
+        }
+        const capturedCandidate = {
+            name: s.deps.name, jpeg, enqueuedAtMs: capturedAtMs,
+            captureMode: s.faceDetected ? 'face_triggered' : 'periodic',
+            reason: verdict.reason, signature: verdict.signature,
+            reviewKind: verdict.reason === 'calibrating' || (0, SceneChangeDetector_1.isChangeCandidate)(verdict) ? 'event' : 'sample',
+            reviewContext, groupingShadow, profileWork,
+            reviewPriority,
+            imageWidth: res?.width, imageHeight: res?.height,
+        };
+        if (s.deps.client.retainOrderedCapture) {
+            s.deps.client.retainOrderedCapture(capturedCandidate);
+            this.emit('orderedEvidenceRetained', { name: s.deps.name, capturedAtMs });
+            this.pumpCandidates(generation);
+            return null;
+        }
+        const offered = this.candidates.offer(capturedCandidate);
+        this.emit('evidenceOffered', { name: s.deps.name, capturedAtMs, outcome: offered,
+            reviewPriority });
+        this.pumpCandidates(generation);
+        return null;
+    }
     async lookThenAdmit(s, candidates, motionGate) {
         const frame = await this.captureCameraFrame(s);
         const capturedAtMs = this.now();
@@ -1886,7 +2075,7 @@ class CloudSensingManager extends events_1.EventEmitter {
      * try/catch around the call stays at each site, where its `unavailable`
      * report is visible next to the thing that can fail.
      */
-    recordAnalysis(s, response, signature) {
+    recordAnalysis(s, response, signature, historical = false) {
         s.postCount++;
         // A RESOLVED POST IS NOT AN ACCEPTED ONE.
         //
@@ -1958,9 +2147,11 @@ class CloudSensingManager extends events_1.EventEmitter {
         // actually landed, so a frame lost to the network, to an eviction or to the
         // freshness bound cannot silence a feed for a heartbeat window or suppress
         // the rest of its event as `stationary`.
-        s.motionGate?.markAnalyzed(undefined, signature);
-        this.reportCameraOpen(s, { sensingState: 'active' });
-        this.emit('analyzed', { name: s.deps.name, response });
+        if (!historical) {
+            s.motionGate?.markAnalyzed(undefined, signature);
+            this.reportCameraOpen(s, { sensingState: 'active' });
+        }
+        this.emit('analyzed', { name: s.deps.name, response, ...(historical ? { delayed: true } : {}) });
         return 'accepted';
     }
     /**
@@ -1990,6 +2181,49 @@ class CloudSensingManager extends events_1.EventEmitter {
         if (typeof this.candidatePumpTimer.unref === 'function')
             this.candidatePumpTimer.unref();
     }
+    /** A single CPU detector request can overlap Gemma; capture never awaits it. */
+    pumpUrgentTriage(generation) {
+        if (this.urgentTriageBusy || !this.urgentTriageClients.size || !this.isCurrentStart(generation)
+            || !(this.candidates instanceof DurableVlmCandidateSpool_1.DurableVlmCandidateSpool))
+            return;
+        const spool = this.candidates;
+        let work;
+        try {
+            work = spool.nextTriage();
+        }
+        catch (error) {
+            this.emit('urgentTriageError', { error: String(error) });
+            return;
+        }
+        if (!work)
+            return;
+        const { candidate, policy } = work;
+        const client = this.urgentTriageClients.get(candidate.name);
+        if (!client)
+            return;
+        this.urgentTriageBusy = true;
+        const startedAtMs = this.now();
+        void (async () => {
+            let result;
+            const identity = { version: 1, evidenceId: candidate.spoolId,
+                jpegSha256: candidate.jpegSha256, capturedAtMs: candidate.enqueuedAtMs,
+                policySha256: (0, UrgentReviewTriage_1.triageHash)(policy), startedAtMs };
+            try {
+                const detected = await client.detect(candidate.jpeg);
+                const confidence = Math.max(0, ...detected.detections.filter(d => d.label === policy.label).map(d => d.confidence));
+                result = { ...identity, completedAtMs: this.now(), confidence,
+                    status: confidence >= policy.minConfidence ? 'positive' : 'negative' };
+            }
+            catch (error) {
+                result = { ...identity, completedAtMs: this.now(), status: 'error', error: String(error).slice(0, 200) };
+            }
+            // A late result must neither resurrect a deleted item nor cross stop/start.
+            const current = this.isCurrentStart(generation);
+            const persisted = current && spool.checkpointTriage(result);
+            this.emit('urgentTriageResult', { name: candidate.name, policy, ...result, persisted, current });
+        })().catch(error => this.emit('urgentTriageError', { name: candidate.name, error: String(error) }))
+            .finally(() => { this.urgentTriageBusy = false; });
+    }
     /**
      * Offer the hold to every slot that is free right now.
      *
@@ -2000,19 +2234,45 @@ class CloudSensingManager extends events_1.EventEmitter {
      * capacity.
      */
     pumpCandidates(generation) {
+        if (!this.isCurrentStart(generation))
+            return;
         const buffer = this.candidates;
         if (!buffer)
             return;
+        // Re-offer durable sequence jobs even if the camera is currently offline.
+        // Stable IDs make the capture/archive -> spool boundary idempotent.
+        for (const s of this.loops) {
+            if (!s.deps.client.pendingOrderedCandidates)
+                continue;
+            try {
+                if (!(buffer instanceof DurableVlmCandidateSpool_1.DurableVlmCandidateSpool) || !this.continuousReview?.independentUploads)
+                    throw Error('Ordered review requires independent uploads and a durable spool');
+                for (const candidate of s.deps.client.pendingOrderedCandidates()) {
+                    if (buffer.offer(candidate) === 'rejected')
+                        break;
+                }
+            }
+            catch (error) {
+                this.emitLoopError(s, error);
+            }
+        }
         // Age out first: a candidate past its TTL must never win a slot from one
         // that is still current.
         buffer.expire();
+        this.pumpUrgentTriage(generation);
+        if (this.continuousReview?.independentUploads)
+            this.pumpDeliveries(generation);
         // Bounded by the slot count — this loop can hand out capacity, never spin.
         for (let guard = this.admissionGate.getMaxInFlight(); guard > 0; guard--) {
+            // A lease timeout or stop/start cannot create a second real model call.
+            if (this.continuousReview && this.reviewsInFlight.size >= this.admissionGate.getMaxInFlight())
+                return;
             if (buffer.size() === 0)
                 return;
             if (this.admissionGate.getInFlight() >= this.admissionGate.getMaxInFlight())
                 return;
-            const next = buffer.peek();
+            const next = this.continuousReview?.independentUploads
+                ? buffer.peek(undefined, 'review', this.continuousReview.parallelModelReview ? candidate => this.canReviewModels(candidate) : undefined) : buffer.peek();
             if (!next)
                 return;
             const s = this.loops.find((l) => l.deps.name === next.name);
@@ -2024,12 +2284,17 @@ class CloudSensingManager extends events_1.EventEmitter {
                 // lands in the buffer's `served` counter, which would be a lie, and a
                 // quiet lie in the accounting is the exact defect this buffer exists to
                 // remove; the event is what makes it findable.
-                const dropped = buffer.take();
-                if (dropped)
-                    buffer.complete?.(dropped);
+                const dropped = this.continuousReview?.independentUploads
+                    ? buffer.take(undefined, 'review') : buffer.take();
+                if (dropped) {
+                    if (this.continuousReview)
+                        buffer.retry?.(dropped);
+                    else
+                        buffer.complete?.(dropped);
+                }
                 this.emit('error', {
                     name: next.name,
-                    error: new Error(`CloudSensingManager: held candidate for unknown feed "${next.name}" — dropped`),
+                    error: new Error(`CloudSensingManager: held candidate for unknown feed "${next.name}" — ${this.continuousReview ? 'retained for retry' : 'dropped'}`),
                 });
                 continue;
             }
@@ -2037,25 +2302,92 @@ class CloudSensingManager extends events_1.EventEmitter {
             if (!ticket)
                 return; // lost the slot to a live tick — try again next pump
             // Nothing above awaited, so this is the candidate `peek()` named.
-            const candidate = buffer.take();
+            const candidate = this.continuousReview?.independentUploads
+                ? buffer.take(undefined, 'review', this.continuousReview.parallelModelReview ? item => item.spoolId === next.spoolId : undefined) : buffer.take();
             if (!candidate) {
                 this.admissionGate.release(ticket);
                 return;
             }
-            void this.serveCandidate(s, candidate, ticket, generation);
+            const reservation = { feed: candidate.name, use: this.continuousReview?.parallelModelReview
+                    ? this.reviewModelUse(candidate) : 'both' };
+            this.modelReviewsInFlight.add(reservation);
+            const work = this.serveCandidate(s, candidate, ticket, generation);
+            this.reviewsInFlight.add(work);
+            void work.finally(() => {
+                this.reviewsInFlight.delete(work);
+                this.modelReviewsInFlight.delete(reservation);
+            });
+        }
+    }
+    reviewModelUse(candidate) {
+        try {
+            const client = this.loops.find(loop => loop.deps.name === candidate.name)?.deps.client;
+            const use = client?.getReviewModelUse?.(candidate.reviewContext);
+            return use === 'detector' || use === 'vlm' ? use : 'both';
+        }
+        catch {
+            return 'both';
+        }
+    }
+    canReviewModels(candidate) {
+        const use = this.reviewModelUse(candidate);
+        return [...this.modelReviewsInFlight].every(active => active.feed !== candidate.name
+            && active.use !== 'both' && use !== 'both' && active.use !== use);
+    }
+    /** One bounded upload worker, independent of the actual model-call limit. */
+    pumpDeliveries(generation) {
+        if (!this.isCurrentStart(generation) || this.uploadsInFlight.size > 0 ||
+            this.now() < this.deliveryRetryAtMs)
+            return;
+        const spool = this.candidates;
+        const candidate = spool.take(undefined, 'delivery');
+        if (!candidate)
+            return;
+        const s = this.loops.find(loop => loop.deps.name === candidate.name);
+        if (!s) {
+            spool.retry(candidate);
+            this.emit('reviewDeferred', { name: candidate.name, reason: 'delivery_feed_unavailable' });
+            return;
         }
+        const work = this.serveCandidate(s, candidate, null, generation);
+        this.uploadsInFlight.add(work);
+        void work.finally(() => this.uploadsInFlight.delete(work));
     }
     /** Analyze one held candidate and give the slot back. Never throws. */
     async serveCandidate(s, candidate, ticket, generation) {
         const waitedMs = Math.max(0, this.now() - candidate.enqueuedAtMs);
         try {
+            let detectorShadow = candidate.detectorShadow;
+            if (this.continuousReview && !candidate.cachedAnalysis && this.detectorShadow) {
+                const observed = await this.detectorShadow.observe(candidate.jpeg, s.deps.name);
+                detectorShadow = observed ? DetectorShadowProbe_1.DetectorShadowProbe.toWire(observed) : undefined;
+                const cascade = (0, detectorCascadeGate_1.decideCascadeGate)({
+                    armed: s.cascadeArmed, verdict: observed?.verdict ?? null,
+                    motion: { reason: candidate.reason, motion: candidate.reviewKind === 'event' },
+                });
+                (0, detectorCascadeGate_1.foldCascadeGateStats)(this.cascadeGateStats, cascade);
+                if (cascade.outcome === 'suppress' && !candidate.reviewContext?.temporalReviewContract && !candidate.reviewContext?.orderedSequence && !candidate.reviewContext?.retainedCapture) {
+                    s.cascadeSuppressedCount++;
+                    s.runCascadeSuppressed++;
+                    this.candidates?.complete?.(candidate);
+                    return;
+                }
+            }
             let response;
             try {
-                response = await s.deps.client.analyze({
+                const request = {
                     jpeg: candidate.jpeg,
                     capturedAt: candidate.enqueuedAtMs,
                     evidenceId: candidate.spoolId,
                     evidenceSha256: candidate.jpegSha256,
+                    ...(this.continuousReview ? {
+                        reviewWindowMs: this.continuousReview.reviewWindowMs,
+                        cachedAnalysis: candidate.cachedAnalysis,
+                        scopedVlmProgress: candidate.scopedVlmProgress,
+                        reviewContext: candidate.reviewContext,
+                        checkpointAnalysis: (result) => this.candidates.checkpoint(candidate, result),
+                        checkpointScopedReview: progress => this.candidates.checkpointScopedReview(candidate, progress),
+                    } : {}),
                     captureMode: candidate.captureMode,
                     // The dimensions recorded when this frame was CAPTURED, not whatever
                     // the camera reports now — the frame may have waited in the buffer.
@@ -2066,23 +2398,58 @@ class CloudSensingManager extends events_1.EventEmitter {
                     // here: shadow mode measures one detector call per analyzed frame,
                     // and a second call would both double the cost and describe a frame
                     // that is no longer the one being analyzed.
-                    ...(candidate.detectorShadow ? { extra: { detectorShadow: candidate.detectorShadow } } : {}),
-                });
+                    ...(detectorShadow ? { extra: { detectorShadow } } : {}),
+                };
+                if (this.continuousReview?.independentUploads && ticket) {
+                    await s.deps.client.reviewCandidate(request);
+                    this.candidates.readyForDelivery(candidate);
+                    this.emit('candidateReviewed', {
+                        name: candidate.name, evidenceId: candidate.spoolId,
+                        capturedAtMs: candidate.enqueuedAtMs,
+                    });
+                    return;
+                }
+                // The independent upload lane only takes checkpointed answers. The
+                // local client's cached path validates their image identity and skips models.
+                if (!ticket && !candidate.cachedAnalysis)
+                    throw new Error('Upload has no saved model result');
+                response = await s.deps.client.analyze(request);
             }
             catch (err) {
-                this.emit('inferenceError', {
+                this.emit(ticket ? 'inferenceError' : 'deliveryError', {
                     name: s.deps.name,
                     error: err instanceof Error ? err : new Error(String(err)),
                     path: 'buffered',
                 });
-                this.reportCameraOpen(s, { sensingState: 'unavailable' });
+                if (ticket)
+                    this.reportCameraOpen(s, { sensingState: 'unavailable' });
                 throw err;
             }
-            const outcome = this.recordAnalysis(s, response, candidate.signature);
+            // Older servers may acknowledge stale captures as a terminal drop.
+            // Continuous review keeps those results for retry instead of deleting evidence.
+            const acknowledgedReview = response.body?.evidenceReview;
+            if (this.continuousReview && (response.body?.accepted !== true ||
+                response.body?.evidenceId !== candidate.spoolId ||
+                acknowledgedReview?.version !== 1 ||
+                acknowledgedReview.capturedAtMs !== candidate.enqueuedAtMs)) {
+                this.deferCandidate(candidate, ticket === null &&
+                    (response.statusCode === 408 || response.statusCode >= 500));
+                this.emit('reviewDeferred', { name: s.deps.name, reason: response.body?.reason ?? 'review_not_acknowledged' });
+                return;
+            }
+            const delayed = !!this.continuousReview &&
+                this.now() - candidate.enqueuedAtMs > this.continuousReview.reviewWindowMs;
+            const outcome = this.isCurrentStart(generation)
+                ? this.recordAnalysis(s, response, candidate.signature, delayed)
+                : response.ok && response.body !== null && typeof response.body === 'object'
+                    ? 'accepted' : 'rejected';
             if (outcome === 'rejected')
                 this.candidates?.retry?.(candidate);
-            else
+            else {
                 this.candidates?.complete?.(candidate);
+                if (!ticket && this.isCurrentStart(generation))
+                    this.deliveryRetryAtMs = 0;
+            }
             if (outcome === 'accepted' && this.isCurrentStart(generation)) {
                 const body = response.body;
                 const observationId = body && (typeof body.observationId === 'string'
@@ -2098,16 +2465,27 @@ class CloudSensingManager extends events_1.EventEmitter {
                     evidenceId: candidate.spoolId ?? null,
                     jpegSha256: candidate.jpegSha256 ?? null,
                     observationId,
+                    ...(candidate.reviewPriority ? { reviewPriority: candidate.reviewPriority } : {}),
+                    ...(this.continuousReview ? { delayed } : {}),
                 });
             }
         }
         catch (err) {
-            this.candidates?.retry?.(candidate);
+            this.deferCandidate(candidate, ticket === null);
             this.emitLoopError(s, err);
         }
         finally {
-            this.admissionGate.release(ticket);
+            if (ticket)
+                this.admissionGate.release(ticket);
+        }
+    }
+    deferCandidate(candidate, deliveryUnavailable) {
+        if (deliveryUnavailable && this.continuousReview?.independentUploads && candidate.cachedAnalysis) {
+            this.deliveryRetryAtMs = this.candidates
+                .retryDelivery(candidate);
         }
+        else
+            this.candidates?.retry?.(candidate);
     }
     /**
      * Convert a camera frame to JPEG bytes for the POST.