feat: add mask tool

Fix live CAN feedback with CH0-only asynchronous risk transmission
Send 0x1F6 risk updates through a bounded latest-result worker on CH0 and disable CH1 initialization, reception, transmission and live display. Preserve the four actual-position bytes from 0x391 and recorded-session compatibility. Include regression coverage, Orin camera/TensorRT/CAN validation, and the verified standalone binary with refreshed checksums.
2026-09-30 17:04:29 +08:00 · 2026-09-28 13:59:26 +08:00 · 2026-09-24 15:41:49 +08:00 · 2026-09-24 15:15:51 +08:00 · 2026-09-24 15:05:44 +08:00
67 changed files with 2773 additions and 179 deletions
@@ -7,17 +7,33 @@ set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CUDA_STANDARD 17)
 find_package(CUDAToolkit REQUIRED)
-find_package(OpenCV REQUIRED COMPONENTS core imgproc imgcodecs highgui)
+find_package(OpenCV REQUIRED COMPONENTS core imgproc imgcodecs highgui videoio)
 find_package(Threads REQUIRED)
 find_path(TENSORRT_INCLUDE_DIR NvInfer.h PATH_SUFFIXES aarch64-linux-gnu x86_64-linux-gnu REQUIRED)
 find_library(TENSORRT_LIBRARY nvinfer REQUIRED)
 add_library(camera_risk_core
  src/trt_engine.cpp src/pose_engine.cu src/gpu_preprocess.cu src/uyvy_converter.cu
-  src/detector.cpp src/door_risk.cpp src/camera.cpp src/camera_pipeline.cpp src/serialization.cpp src/output_writer.cpp src/result_renderer.cpp src/config.cpp)
+  src/can_bus.cpp src/detector.cpp src/door_risk.cpp src/camera.cpp src/camera_pipeline.cpp src/inference_session.cpp src/serialization.cpp src/output_writer.cpp src/result_renderer.cpp src/config.cpp)
 target_include_directories(camera_risk_core PUBLIC include third_party ${TENSORRT_INCLUDE_DIR} ${OpenCV_INCLUDE_DIRS})
 target_link_libraries(camera_risk_core PUBLIC ${TENSORRT_LIBRARY} ${OpenCV_LIBS} Threads::Threads CUDA::cudart CUDA::nppc CUDA::nppig CUDA::nppidei CUDA::nppicc)
+target_include_directories(camera_risk_core SYSTEM PRIVATE third_party/zlg)
 target_compile_options(camera_risk_core PRIVATE $<$<COMPILE_LANGUAGE:CXX>:-Wall;-Wextra;-Wpedantic>)
 add_library(camera_risk_visualizer src/visualizer.cpp)
 target_link_libraries(camera_risk_visualizer PUBLIC camera_risk_core)
+add_library(camera_risk_mask_annotator src/door_mask_annotator.cpp)
+target_include_directories(camera_risk_mask_annotator PUBLIC include third_party ${OpenCV_INCLUDE_DIRS})
+target_link_libraries(camera_risk_mask_annotator PUBLIC ${OpenCV_LIBS})
+target_compile_options(camera_risk_mask_annotator PRIVATE -Wall -Wextra -Wpedantic)
 add_executable(camera_risk src/main.cpp)
 target_link_libraries(camera_risk PRIVATE camera_risk_visualizer)
+add_executable(door_mask_tool src/door_mask_tool.cpp)
+target_link_libraries(door_mask_tool PRIVATE camera_risk_core camera_risk_mask_annotator)
+target_compile_options(door_mask_tool PRIVATE -Wall -Wextra -Wpedantic)
+
+# Reference USBCANFD SDK is shipped with the standalone Orin package.
+target_link_libraries(camera_risk_core PUBLIC "${CMAKE_SOURCE_DIR}/orin/lib/libusbcanfd.so"
+  "-Wl,--no-as-needed" "${CMAKE_SOURCE_DIR}/orin/lib/libusb-1.0.so" "-Wl,--as-needed")
+set_target_properties(camera_risk door_mask_tool PROPERTIES BUILD_WITH_INSTALL_RPATH TRUE INSTALL_RPATH "$ORIGIN/../lib;$ORIGIN/../orin/lib;/usr/local/cuda/lib64")
+# Keep the bundled SDK/libusb pair together even with a desktop LD_LIBRARY_PATH.
+target_link_options(camera_risk PRIVATE "-Wl,--disable-new-dtags")
+target_link_options(door_mask_tool PRIVATE "-Wl,--disable-new-dtags")
@@ -1,7 +1,7 @@
 # Vision Anti-Pinch

 C++ / TensorRT 实时摄像头风险推理，算法来自最新 run_risk.py。
-持续取图、推理并更新内存中的 FrameResult；可视化可选。
+持续取图、推理并更新内存中的 FrameResult；实时推理、录制和回灌默认开启可视化。

 相机每次取帧默认等待 **2000 ms**，连续超时 **6 次**才停止流水线（纯超时约 **12 秒**）；成功取得有效帧后清零超时计数。单次等待时间由 `config/camera.json` 的 `camera.timeout_ms` 配置。运行中的坏帧、取流错误共用该重试期限；设备失效时尝试重新打开相机，恢复有效帧后继续推理。GPU 错误仍按原有异常处理退出。

@@ -14,21 +14,55 @@ C++ / TensorRT 实时摄像头风险推理，算法来自最新 run_risk.py。
 git clone https://git.kendeji.fun/zmv/vision-anti-pinch.git
 cd vision-anti-pinch/orin
 ./scripts/initialize_camera.sh  # 开机后初始化 /dev/video5 摄像头链路
-./run.sh                      # 持续推理，结果只保存在内存
+./run.sh                      # 持续推理并显示预览，结果只保存在内存
 ```

-可选板端本地可视化：
+默认显示本地预览，叠加门区、检测框、手臂/手部关键点及风险信息。需要关闭预览时：

 ```bash
-./run.sh --visualize
+./run.sh --no-visualize
 ```

+`--visualize` 仍可显式开启；没有 DISPLAY / WAYLAND_DISPLAY 时自动跳过窗口并继续推理。
+
 Ctrl+C / SIGTERM 停止程序。
 关闭预览窗口或按 q/Esc 只关闭预览，推理继续。

 摄像头为 /dev/video5，1920×1536 UYVY，30 FPS。
 当前 door mask 是指定的 constant_door_mask.json 副本，标定状态为 false；装车后应更换与实际画面匹配的门区并更新标定状态。

+## Door mask 标注工具
+
+先停止正在占用摄像头的推理程序，再运行：
+
+```bash
+./annotate_door_mask.sh --camera --output config/door_masks/driver-side.json
+```
+
+工具按 `config/camera.json` 抓取一张参考画面并打开标注窗口。左键依次添加门区多边形顶点，右键或 `U` 撤销一个点，`R` 清空，`S` 或 Enter 保存，Esc 或 `Q` 取消。保存时生成 x-anylabeling JSON，并在同一目录保存 `<名称>_reference.jpg`；已有文件默认不会覆盖，需要覆盖时显式添加 `--force`。
+
+也可以使用已有图片，不打开摄像头：
+
+```bash
+./annotate_door_mask.sh --image /path/to/frame.jpg --output config/door_masks/driver-side.json
+```
+
+输入已经采集的视频时，工具会先打开帧选择窗口。可拖动滑块，使用 `A/D` 逐帧移动，或使用 `J/L` 前后跳过 30 帧；按 `S` 或 Enter 选择当前帧并进入标注：
+
+```bash
+./annotate_door_mask.sh --video /path/to/video.mp4 --output config/door_masks/driver-side.json
+```
+
+已知帧号时可以跳过帧选择窗口，帧号从 0 开始：
+
+```bash
+./annotate_door_mask.sh --video /path/to/video.mp4 --frame 244 --output config/door_masks/driver-side.json
+```
+
+`--image` 和 `--video` 模式不会打开或检查摄像头。视频生成的 JSON 会额外记录 `sourceVideo` 和 `sourceFrameIndex`。
+
+该工具仅生成 mask 文件，暂不改变 `camera.json` 或推理程序当前使用的默认 mask。
+
 ## 下游获取结果

 main.cpp 注释中也包含以下示例。下游通过自己的调用位置或线程读取：
@@ -96,3 +130,91 @@ NPP 用于 UYVY 转换、YOLO 缩放填充、RTMW 仿射裁剪；CUDA 用于通
 相机超时回归测试：`./tests/run_camera_timeout.sh`；加 `--wall-clock` 验证默认 6 次超时约 12 秒。测试直接编译实际相机代码，使用模拟采集和转换器，无需摄像头、GPU 或 OpenCV；不覆盖视频回放路径。

 板端真实摄像头 / TensorRT 恢复与停止测试记录见 [Orin 测试报告](tests/ORIN_TEST_REPORT.md)。
+
+## 推理过程录制与视频回灌
+
+当前 `inference-only` 分支支持 H.264/MP4 会话；默认关闭，不再为会话逐帧保存图片。
+
+```bash
+# 录制实际完成推理的帧，Ctrl+C / SIGTERM 正常停止并封装视频
+./run_camera.sh --record-session output/sessions/drive-001
+
+# 视频解码后重新运行 YOLO、RTMW、融合与风险推理；文件结束自动退出
+./run_camera.sh --replay-session output/sessions/drive-001 --save-results
+
+# 同时保存回灌后的新视频及推理过程，便于对比
+./run_camera.sh --replay-session output/sessions/drive-001 \
+  --record-session output/sessions/drive-001-replay
+```
+
+独立包使用同样参数，例如 `./orin/run.sh --record-session output/sessions/drive-001`。
+会话路径相对于当前工作目录；录制目录必须尚不存在，避免覆盖原始记录。
+
+会话内容：
+
+- `frames.mp4`：H.264 有损压缩视频，按完成推理的顺序编码，尺寸与原图一致。
+- `frames/*.json`：对应视频帧序号、原推理帧号、完整采集元数据、检测框、原始/隔离关键点、融合记录、最终结果与耗时。
+- `frames.txt`：视频帧与 JSON 的顺序索引。
+- `session.json`、`door_mask.json`：录制时的推理参数、分辨率、名义帧率、门区副本、模型路径与大小。
+- `complete.json`：正常停止后写入的帧数与视频大小，用于检查会话是否完成。
+
+回灌不打开摄像头。它恢复会话中的分辨率、检测阈值、人数上限、风险阈值和门区，使用 `--config` 指定的当前 TensorRT 引擎，按顺序尽快推理，不按墙钟时间限速。视频使用配置的固定名义帧率；真实采集间隔和断流间隔以 JSON 中的纳秒时间戳为准。原始采集时间在再次录制时保存为 `source_capture`，回灌耗时使用本次运行的单调时钟。
+
+编码使用 OpenCV 的 FFmpeg H.264 编码器；需 OpenCV `videoio` 与可用的 H.264 编码支持，宽高必须为正偶数。不支持时明确报错。当前使用软件编解码，会增加 CPU、编码延迟和磁盘开销；保存对象是完成推理的帧，并非相机全部原始帧。H.264 有损压缩和不同引擎可能改变检测、关键点与风险结果，不承诺逐位一致。模型只记录来源和大小，不复制引擎，也不保证大小相同即模型相同；精确对比应使用同一组引擎。
+
+Ctrl+C / SIGTERM 会封装已写入的视频，`CameraPipeline::join()` 返回前完成收尾。强制杀进程、断电或写入失败可能留下 `frames.pending.mp4`；缺少完成标记的会话拒绝回灌。编码器封装后检查帧数，回灌遇到缺帧、缺失 JSON、损坏索引或解码错误会报错，不静默跳帧。录制没有自动限时或磁盘轮转，请按可用空间控制录制时长。
+
+编解码及会话回归：`./tests/run_session.sh`，无需摄像头或 TensorRT。真实摄像头与 TensorRT 验证脚本：`python3 tests/orin_session_test.py --binary build/camera_risk --config config/camera.json --output /tmp/new-session-test`；输出目录必须不存在，脚本不会停止已有部署进程。
+
+本次实机结果与未覆盖范围见 [H.264 会话测试报告](tests/ORIN_SESSION_REPORT.md)。
+
+## CAN/CANFD 收发与四门位置显示
+
+实时运行默认打开参考工程 `/home/orin/vision-anti-pinch` 使用的 USBCANFD（设备类型 33、设备索引 0），启用 CH0 和 CH1：60 MHz 时钟、仲裁域 500 kbps、数据域 2 Mbps。一个接收线程只接收 CH0，所有发送只使用 CH1；两个通道默认启用终端电阻。可在 `config/camera.json` 的 `can` 中设置 `enabled`、`device_index`、`timeout_ms`（默认 1000 ms）和 `termination`；`--no-can` 显式关闭实时 CAN。设备不可用时显示 UNAVAILABLE，摄像头推理继续；接收 API 失败显示 ERROR，需检查设备后重启程序。
+
+首次使用 USB-CAN 时，若节点为 root:root 且普通用户不可写，可运行 `./scripts/enable_can_access.sh`（需要 sudo）。它只为 `3068:0009` 适配器安装 `plugdev` 组读写规则并刷新设备权限；运行用户须属于 `plugdev`，新加组后需重新登录。无需以 root 运行整个推理程序。
+
+`0x391` 四个信号按参考工程注释中的四个连续字节解析：
+
+| 字节（从 0 开始） | 预览标签 | 信号 |
+|---|---|---|
+| 0 | LF | 左前门实际位置反馈 |
+| 1 | RF | 右前门实际位置反馈 |
+| 2 | LR | 左后门实际位置反馈 |
+| 3 | RR | 右后门实际位置反馈 |
+
+显示值是无符号原始字节 0–255，尚无物理单位、缩放或无效值定义，因此不标为百分比、不把 255 擅自视为无效。CH0 接收 CAN/CANFD 数据帧，过滤远程帧、错误帧和发送回显；少于 4 字节的 `0x391` 不更新信号。修正了参考代码 `get_bit_value(0/1/2/3, 8)` 导致的位域重叠，字节起始位应为 0/8/16/24。
+
+默认预览显示 CH0 四门实际位置反馈、LIVE/STALE/WAIT、新鲜度及帧数，并显示总 RX/TX 和错误计数。尚未接收到值时显示 `--`，超时保留最后值但标记 STALE；CH1 专用于发送，不接收也不在实时预览中显示。即使相机正在重试或暂无新推理帧，CAN 预览仍约每 100 ms 刷新。CAN 只提供状态显示和下游数据，本次没有新增基于门位置的推理启停或风险门控。
+
+下游通过 `pipeline.canStatus()` 读取当前状态；`pipeline.latest()->can` 是该推理结果生成时的快照。按需发送使用线程安全的 `pipeline.sendCan()`：
+
+```cpp
+cms::CanFrame frame;
+frame.channel = 1;          // 发送仅使用 CH1
+frame.id = 0x123;            // 按实际协议设置
+frame.data = {0x01, 0x02};   // 示例数据，应替换为实际报文
+bool sent = pipeline.sendCan(frame);
+
+// CANFD：frame.fd = true；可按协议设置 extended、bitrate_switch。
+// CAN 数据长度 0–8；CANFD 长度 0–8、12、16、20、24、32、48、64。
+// 标准 ID 最大 0x7FF，扩展 ID 最大 0x1FFFFFFF。
+```
+
+发送通道不是 CH1，或 ID/长度/标志非法时抛出 `std::invalid_argument`；设备未就绪或 SDK 发送失败返回 false，发送计数以 SDK 返回为准。`sendCan()` 接口不自动填充/截断数据。发送调用与设备关闭互斥；CH0 接收保持独立线程运行。
+
+实时推理首次取得风险状态时发送一次，此后仅在二值风险发生变化时，由后台 CAN 发送线程通过 CH1 发送一帧标准 CAN 数据报文 `0x1F6`，DLC 固定为 8。`data[0]` 的低四位（bit0–3）和高四位（bit4–7）同时填写相同的二值风险：`risk_level` 为 `clear`、`watch` 或 `unavailable` 时各为 0，`warning`、`danger` 以及未知状态时各为 1；后七字节全部为 0。即 `clear`、`watch` 和无人或证据不足导致的 `unavailable` 发送 `00 00 00 00 00 00 00 00`，其余发送 `11 00 00 00 00 00 00 00`（十六进制）。
+
+发送按报文二值状态变化触发：`clear/watch/unavailable ↔ warning/danger/未知状态` 才产生新报文；相同编码的等级切换不重复发送。没有独立周期，风险不变时不重发；发送失败计数后也不因后续相同状态自动重试，等待新的二值状态变化。SDK 发送等待不占用推理线程；后台最多保留一个待发结果，发送变慢时用最新结果替换尚未发送的结果，避免积压旧风险；等待期间若从 A 变为 B 又回到正在发送的 A，会取消冗余待发报文，因此不保证每个短暂中间状态都上总线。CH1 发送失败通过现有 TX 错误计数呈现；结果中的 CAN 快照记录采样时已完成的发送计数，不保证包含当前帧的发送。停止时丢弃待发结果，并等待已经进入 SDK 的调用返回后释放设备。`--no-can` 或 `can.enabled=false` 禁用自动发送，视频回灌始终不发送。按需 `sendCan()` 仍为同步 API。
+
+结果 JSON 和录制会话自动包含每帧 `can` 快照。视频回灌不打开 USB-CAN，不发送报文，直接恢复录制时的状态并标记 `source=replay`；旧会话没有 CAN 字段时显示 NOT_RECORDED。回灌调用 `sendCan()` 会明确拒绝。
+
+依赖 `third_party/zlg/zcan.h` 和 `orin/lib/` 中的参考工程 SDK 库（含 SONAME 链接），独立包已包含它们。纯模拟收发回归：`./tests/run_can.sh`；会话回归同时覆盖 CAN 快照保存。模拟测试不代表物理总线收发验证。
+
+本次检查范围与延期项目见 [CAN 实现记录](tests/ORIN_CAN_REPORT.md)；CH0 实机排查与单通道修复见 [0x391 实际位置反馈检查](tests/ORIN_391_REPORT.md)。
+
+新增 `0x1F6` 二值风险发送的检查范围及部署状态见 [风险发送检查记录](tests/RISK_CAN_REPORT.md)。
+
+风险发送现已改为首次发送及二值变化触发，验证结果见 [风险变化触发发送检查](tests/ORIN_RISK_CHANGE_REPORT.md)。
+
+CAN 通道现为 CH0 接收、CH1 发送，板端检查与未覆盖项目见 [CH1 发送切换检查](tests/ORIN_CH1_TX_REPORT.md)。
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+exec "$root/build/door_mask_tool" --config "$root/config/camera.json" "$@"
@@ -18,5 +18,11 @@
    "warning_relative": 0.3,
    "release_relative": 0.45,
    "calibration_verified": false
+  },
+  "can": {
+    "enabled": true,
+    "device_index": 0,
+    "timeout_ms": 1000,
+    "termination": true
  }
 }
@@ -1,77 +1,51 @@
-{
-  "version": "x-anylabeling",
-  "flags": {},
-  "shapes": [
-    {
-      "label": "door",
-      "points": [
-        [
-          212.86,
-          145.919
-        ],
-        [
-          378.891,
-          851.857
-        ],
-        [
-          468.293,
-          996.446
-        ],
-        [
-          536.408,
-          1294.131
-        ],
-        [
-          553.437,
-          1404.7
-        ],
-        [
-          561.951,
-          1532.279
-        ],
-        [
-          51.086,
-          1532.279
-        ],
-        [
-          8.514,
-          1515.268
-        ],
-        [
-          0.0,
-          1468.489
-        ],
-        [
-          8.514,
-          26.845
-        ],
-        [
-          25.543,
-          5.582
-        ],
-        [
-          131.973,
-          -2.924
-        ],
-        [
-          191.574,
-          1.329
-        ],
-        [
-          208.603,
-          145.919
-        ]
-      ],
-      "group_id": null,
-      "shape_type": "polygon",
-      "flags": {}
-    }
-  ],
-  "imagePath": "constant_door_mask_reference.jpg",
-  "imageData": null,
-  "imageHeight": 1536,
-  "imageWidth": 1920,
-  "sourceVideo": "D:\\huang.xuewei\\CMS\\video\\20260921104502\\segment_009.mp4",
-  "sourceFrameIndex": 244,
-  "constantDoorMask": true
-}
+{
+  "version": "x-anylabeling",
+  "flags": {},
+  "shapes": [
+    {
+      "label": "door",
+      "points": [
+        [
+          1908,
+          235
+        ],
+        [
+          1874,
+          267
+        ],
+        [
+          1787,
+          803
+        ],
+        [
+          1735,
+          873
+        ],
+        [
+          1716,
+          944
+        ],
+        [
+          1682,
+          1275
+        ],
+        [
+          1654,
+          1531
+        ],
+        [
+          1919,
+          1533
+        ]
+      ],
+      "group_id": null,
+      "shape_type": "polygon",
+      "flags": {}
+    }
+  ],
+  "imagePath": "driver-side-2_reference.jpg",
+  "imageData": null,
+  "imageHeight": 1536,
+  "imageWidth": 1920,
+  "constantDoorMask": true
+}
@@ -0,0 +1,51 @@
+{
+  "version": "x-anylabeling",
+  "flags": {},
+  "shapes": [
+    {
+      "label": "door",
+      "points": [
+        [
+          314,
+          4
+        ],
+        [
+          425,
+          572
+        ],
+        [
+          495,
+          713
+        ],
+        [
+          534,
+          822
+        ],
+        [
+          542,
+          1138
+        ],
+        [
+          538,
+          1522
+        ],
+        [
+          6,
+          1535
+        ],
+        [
+          0,
+          9
+        ]
+      ],
+      "group_id": null,
+      "shape_type": "polygon",
+      "flags": {}
+    }
+  ],
+  "imagePath": "driver-side-1_reference.jpg",
+  "imageData": null,
+  "imageHeight": 1536,
+  "imageWidth": 1920,
+  "constantDoorMask": true
+}
@@ -0,0 +1,51 @@
+{
+  "version": "x-anylabeling",
+  "flags": {},
+  "shapes": [
+    {
+      "label": "door",
+      "points": [
+        [
+          1908,
+          235
+        ],
+        [
+          1874,
+          267
+        ],
+        [
+          1787,
+          803
+        ],
+        [
+          1735,
+          873
+        ],
+        [
+          1716,
+          944
+        ],
+        [
+          1682,
+          1275
+        ],
+        [
+          1654,
+          1531
+        ],
+        [
+          1919,
+          1533
+        ]
+      ],
+      "group_id": null,
+      "shape_type": "polygon",
+      "flags": {}
+    }
+  ],
+  "imagePath": "driver-side-2_reference.jpg",
+  "imageData": null,
+  "imageHeight": 1536,
+  "imageWidth": 1920,
+  "constantDoorMask": true
+}
@@ -0,0 +1,55 @@
+{
+  "version": "x-anylabeling",
+  "flags": {},
+  "shapes": [
+    {
+      "label": "door",
+      "points": [
+        [
+          1426,
+          0
+        ],
+        [
+          1257,
+          489
+        ],
+        [
+          1195,
+          615
+        ],
+        [
+          1155,
+          636
+        ],
+        [
+          1108,
+          813
+        ],
+        [
+          1106,
+          1097
+        ],
+        [
+          1097,
+          1529
+        ],
+        [
+          1917,
+          1535
+        ],
+        [
+          1915,
+          9
+        ]
+      ],
+      "group_id": null,
+      "shape_type": "polygon",
+      "flags": {}
+    }
+  ],
+  "imagePath": "driver-side1_reference.jpg",
+  "imageData": null,
+  "imageHeight": 1536,
+  "imageWidth": 1920,
+  "constantDoorMask": true
+}
@@ -4,6 +4,7 @@
 #include <memory>
 #include <optional>
 #include <string>
+#include <nlohmann/json.hpp>

 namespace cms {
 struct CameraConfig {
@@ -13,6 +14,8 @@ struct CameraConfig {
 struct CapturedFrame {
    CaptureMetadata metadata;
    std::shared_ptr<const BgrImage> image;
+    // Present only for offline replay; keeps original timestamps and context.
+    std::shared_ptr<const nlohmann::json> replay_record;
 };
 // The capture thread exclusively owns read(); requestStop() is thread safe.
 class Camera {
@@ -7,8 +7,11 @@

 namespace cms {
 struct PipelineConfig {
+    static constexpr char const* session_variant="inference-only";
    CameraConfig camera;
+    CanConfig can;
    OutputOptions output;
+    std::filesystem::path record_session,replay_session;
    std::filesystem::path engines,door_mask;
    double detector_confidence{0.30};
    int max_people{3};
@@ -34,6 +37,8 @@ public:
    CameraPipeline& operator=(CameraPipeline const&)=delete;
    void start();
    FrameResultPtr latest() const;
+    CanSnapshot canStatus() const;
+    bool sendCan(CanFrame const& frame);
    bool running() const noexcept;
    void requestStop() noexcept;
    void join();
@@ -0,0 +1,37 @@
+#pragma once
+#include "can_types.hpp"
+#include <memory>
+#include <string_view>
+
+namespace cms {
+// One lifecycle per instance; only one owner per device index in a process.
+// start() must run after StopSignals so the receiver inherits its signal mask.
+// Missing hardware is reported by snapshot(), and does not stop inference.
+class CanBus {
+public:
+    explicit CanBus(CanConfig config);
+    ~CanBus();
+    CanBus(CanBus const&)=delete;
+    CanBus& operator=(CanBus const&)=delete;
+    void start();
+    void requestStop() noexcept;
+    void join() noexcept;
+    CanSnapshot snapshot() const;
+    // Thread-safe on-demand data-frame send; invalid frames throw, SDK failure
+    // returns false. Never generates periodic or inference-triggered messages.
+    bool send(CanFrame const& frame);
+    // Send one standard 8-byte 0x1F6 frame on CH1. Both nibbles of
+    // data[0] contain 0 for "clear", "watch" and "unavailable", 1 for every
+    // other level: 0x00 or 0x11. Bytes 1-7 are zero. Returns {false, CH1 result}.
+    std::array<bool,2> sendRisk(std::string_view riskLevel);
+    // Nonblocking live-inference path. Attempts the initial binary risk once,
+    // then only encoded 0/1 changes. Latest pending state wins while busy;
+    // returning to the in-flight state cancels a redundant pending transition.
+    // True means accepted (including unchanged), not delivered. No periodic
+    // retransmission or retry of a failed state without a new binary change.
+    bool queueRisk(std::string_view riskLevel);
+private:
+    struct Impl;
+    std::unique_ptr<Impl> impl_;
+};
+}
@@ -0,0 +1,39 @@
+#pragma once
+#include <array>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace cms {
+inline constexpr unsigned canReceiveChannel=0;
+inline constexpr unsigned canTransmitChannel=1;
+inline constexpr unsigned canHardwareChannelCount=2;
+inline constexpr unsigned liveCanChannelCount=1; // Only CH0 contributes live receive data.
+struct CanConfig {
+    bool enabled{true};
+    int device_index{0};
+    int timeout_ms{1000};
+    bool termination{true};
+};
+struct CanDoorSignals {
+    // Raw unsigned bytes: left front, right front, left rear, right rear.
+    // No scale/unit is specified in the reference protocol.
+    std::array<int,4> positions{{-1,-1,-1,-1}};
+    bool valid{},fd{},extended{};
+    std::uint64_t received{},received_monotonic_ns{};
+    std::uint32_t device_timestamp_us{};
+    double age_ms{-1};
+};
+struct CanSnapshot {
+    std::string source{"live"},status{"DISABLED"};
+    // Keep two slots for existing recorded sessions; live CH1 stays unset.
+    std::array<CanDoorSignals,2> channels;
+    std::uint64_t received{},transmitted{},transmit_errors{},receive_errors{};
+};
+struct CanFrame {
+    int channel{};
+    std::uint32_t id{};
+    bool fd{},extended{},bitrate_switch{};
+    std::vector<std::uint8_t> data;
+};
+}
@@ -0,0 +1,22 @@
+#pragma once
+
+#include <opencv2/core.hpp>
+#include <cstdint>
+#include <filesystem>
+#include <optional>
+#include <string>
+
+namespace cms {
+
+struct DoorMaskAnnotationOptions {
+    std::filesystem::path output_json;
+    std::filesystem::path reference_image;
+    bool overwrite{};
+    std::optional<std::string> source_video;
+    std::optional<std::int64_t> source_frame_index;
+};
+
+// Returns false when the user cancels without writing any annotation files.
+bool annotateDoorMask(cv::Mat const& image, DoorMaskAnnotationOptions const& options);
+
+}
@@ -1,6 +1,7 @@
 #pragma once
 // Public downstream contract. Owns its data; no GPU, JSON or network handles.
 #include "image.hpp"
+#include "can_types.hpp"
 #include <array>
 #include <cstdint>
 #include <memory>
@@ -67,6 +68,7 @@ struct FrameResult {
    std::vector<int> track_ids;
    std::vector<std::array<double,4>> boxes;
    RiskResult risk;
+    CanSnapshot can;
    CaptureMetadata capture;
    StageTiming timing;
    std::vector<PersonResult> persons;
@@ -0,0 +1,38 @@
+#pragma once
+#include "camera.hpp"
+#include "frame_result.hpp"
+#include <nlohmann/json.hpp>
+#include <filesystem>
+#include <fstream>
+#include <opencv2/videoio.hpp>
+
+namespace cms {
+struct PipelineConfig;
+// H.264/MP4 plus a matching frame index and per-frame inference records.
+// finish() flushes the encoder and marks the session replayable.
+class SessionWriter {
+public:
+    explicit SessionWriter(PipelineConfig const& config);
+    void write(FrameResult const& result, nlohmann::json const& stages,
+               nlohmann::json const* source = nullptr);
+    void finish();
+private:
+    std::filesystem::path directory_;
+    std::ofstream index_;
+    cv::VideoWriter video_;
+    int width_{},height_{};
+    std::uint64_t count_{};
+    bool finished_{};
+};
+class SessionReader {
+public:
+    explicit SessionReader(PipelineConfig& config);
+    std::optional<CapturedFrame> read();
+private:
+    std::filesystem::path directory_;
+    std::ifstream index_;
+    cv::VideoCapture video_;
+    int width_{},height_{};
+    std::uint64_t count_{},lastFrame_{},expectedCount_{};
+};
+}
@@ -1,4 +1,8 @@
 #pragma once
 #include "frame_result.hpp"
 #include "door_risk.hpp"
-namespace cms { Json serializeResult(FrameResult const& result); }
+namespace cms {
+Json serializeCan(CanSnapshot const& can);
+CanSnapshot deserializeCan(Json const& value);
+Json serializeResult(FrameResult const& result);
+}
@@ -5,7 +5,8 @@
 namespace cms {
 class CameraPipeline;
 // Pure drawing from the immutable result. Never re-runs inference.
-cv::Mat renderResult(FrameResult const& result);
+cv::Mat renderResult(FrameResult const& result,CanSnapshot const* liveCan=nullptr);
+void renderCanOverlay(cv::Mat& image,CanSnapshot const& can);
 // Optional observer: closing the window returns without stopping the pipeline.
 void runLocalVisualization(CameraPipeline const& pipeline);
 }
@@ -14,7 +14,7 @@ sha256sum -c SHA256SUMS
 ./run.sh
 ```

-可视化可选：`./run.sh --visualize`，需要板端本地桌面 DISPLAY。
+实时推理、录制和回灌默认开启可视化，显示门区、检测框、手臂/手部关键点及风险信息。使用 `./run.sh --no-visualize` 关闭；`--visualize` 仍可显式开启。需要板端桌面 DISPLAY / WAYLAND_DISPLAY，没有显示环境时自动跳过窗口并继续推理。
 默认持续推理直到 Ctrl+C / SIGTERM；正常退出没有统计输出。
 预览窗口关闭后推理继续。结果通过 C++ CameraPipeline::latest() 获取，不通过端口或结果文件传递。

@@ -24,6 +24,26 @@ sha256sum -c SHA256SUMS
 bin/drivers 中 GMSL 模块对应内核 5.10.120-tegra。初始化脚本检查内核版本；加载模块需要 root 或现有 sudo 权限。
 门区保留当前室内联调设置，door.calibration_verified=false。

+## Door mask 标注工具
+
+停止正在占用摄像头的推理程序后运行：
+
+```bash
+./annotate_door_mask.sh --camera --output config/door_masks/driver-side.json
+```
+
+左键添加多边形顶点，右键或 `U` 撤销，`R` 清空，`S` 或 Enter 保存，Esc 或 `Q` 取消。工具输出 x-anylabeling JSON 及同目录参考 JPEG。
+
+已有图像和视频模式不会打开摄像头：
+
+```bash
+./annotate_door_mask.sh --image /path/to/frame.jpg --output config/door_masks/driver-side.json
+./annotate_door_mask.sh --video /path/to/video.mp4 --output config/door_masks/driver-side.json
+./annotate_door_mask.sh --video /path/to/video.mp4 --frame 244 --output config/door_masks/driver-side.json
+```
+
+视频未指定 `--frame` 时先通过滑块或 `A/D`、`J/L` 选择参考帧；帧号从 0 开始。
+
 ## 可选保存（默认全部关闭）

 三个独立参数可以单独使用，也可以组合：
@@ -41,3 +61,23 @@ bin/drivers 中 GMSL 模块对应内核 5.10.120-tegra。初始化脚本检查
 同一帧三类文件同名（扩展名不同），文件名包含运行标识和帧号，多次运行不覆盖。JSON 的 `images` 提供相对于 `output/` 的图片路径，未选择保存的图片为 null。源码入口写入工程 `output/`；独立包入口写入 `orin/output/`。默认不创建目录、不保存文件。

 保存对象是完成推理的帧；惰性分支暂停时不新增文件。开启保存会增加编码和磁盘 I/O 开销。写入失败时报告错误并停止，不静默丢失文件。
+
+## H.264 推理过程录制与回灌
+
+```bash
+./run.sh --record-session output/sessions/drive-001
+# Ctrl+C 正常停止，完成 MP4 封装后再回灌
+./run.sh --replay-session output/sessions/drive-001 --save-results
+```
+
+录制目录必须不存在。会话保存一份 H.264 视频、逐帧过程 JSON、推理配置与门区副本；回灌解码视频并重新执行 TensorRT 推理，不打开摄像头，结束后自动退出。使用当前配置指向的引擎；有损压缩会引起推理结果差异。需要 OpenCV FFmpeg 的 H.264 编码支持。强制退出或断电导致未封装完成的会话不可回灌；正常 Ctrl+C / SIGTERM 会完成封装。详细格式与限制见工程 README。
+
+## CAN 状态与发送接口
+
+实时运行默认从 USBCANFD CH0 接收、从 CH1 发送（两个通道均为 500 kbps / 2 Mbps）。预览显示 `0x391` 的 LF/RF/LR/RR 四门实际位置反馈原始值，仅显示 CH0，并标记新鲜度和收发计数。`--no-can` 可关闭；设备缺失不停止推理。`config/camera.json` 的 `can.termination` 同时控制两个通道的终端电阻，默认沿用参考工程的开启设置。
+
+`lib/` 包含 SDK 与 libusb 及其 SONAME 链接。回灌使用录制的 CAN 快照，不访问总线；旧会话显示 NOT_RECORDED。按需发送通过 C++ `CameraPipeline::sendCan()`，参数与完整示例见工程 README。
+
+首个实时推理风险状态发送一次，此后仅在二值风险变化时，由后台线程在 CH1 发送一帧标准 CAN `0x1F6`，长度 8 字节：首字节高、低四位同时填写相同风险值，`clear`、`watch` 和 `unavailable` 时各为 0，`warning`、`danger` 及未知状态各为 1，即首字节为 `0x00` 或 `0x11`，后七字节清零。CH0 仅接收，CH1 仅发送。发送等待不阻塞推理，最多保留一个待发结果，忙时由最新结果替换；发送失败计入 TX 错误。仅在报文编码 0 与 1 之间变化时触发发送，相同编码的等级切换不重发。状态不变及发送失败时均不自动重试，等待新的二值变化。等待期间回到正在发送的状态会取消冗余待发报文。`--no-can` 和视频回灌禁用发送。停止时清空待发结果，等待正在执行的 SDK 调用结束后释放设备。
+
+USB-CAN 首次接入如出现权限不足，运行 `./scripts/enable_can_access.sh`（需要 sudo，运行用户属于 plugdev），仅为 `3068:0009` 适配器安装设备访问规则。
@@ -1,11 +1,19 @@
-49a272525082edf5ef4619efc57bc2509c06653af262fc8a8d257d138f9206fb  ./README.md
+6e54ad1474a8a00a93bb5e1ffe9362eb31beab41a5b9c4b2e17baa5051932e27  ./annotate_door_mask.sh
 6d5e874fd27fcfd75d303d7e35d9672028af71041f52dcc82a1e83676faefa65  ./bin/drivers/max9295.ko
 8a78d04ef8be44e9b62a5e4ee315d3d6d679e34aedff02a234bbf4d40e222933  ./bin/drivers/max9296.ko
 3da628587477cc35d5e3f8aee86e718e2ddf16808e893e00ba6e164b2307e843  ./bin/drivers/sgx-yuv-gmsl2.ko
-3a984e1e4c0fa12285967085e3359a5b7c698d744e9c2deb2480a312eb637c1c  ./build/camera_risk
-8a572f661e056e3916758a442e73212842bfe89361dd1b07b87de8f6ae523cf8  ./config/camera.json
-9ba768d559fd3b64e833b50c62c70f2adfd6c169620aea5fba32cfb1b4c5b0e9  ./config/door_mask.json
+1744ec8a2c584aa5306cdf975fb7f01ec9ee6cec524a447dfc85e179b270ffc3  ./build/camera_risk
+12ebf1d21a967cc4d7620636352fc5779a697a0fb9feaa8bdb339927292a3517  ./build/door_mask_tool
+d44dcf10df43c7bcd73b7f2b64e4117d207435a5218c2146bfb659566cb320ba  ./config/camera.json
+7808f4ae27de49a02fe51f8e6b60ae8454ff775ea3e98fa0a7c633ee85027fb4  ./config/door_mask.json
 ebcd09e8c2e35008adbb0c1d222e580b17e0df1c8093df3481ba3374cd9a8174  ./engines/rtmw_l_384.engine
 f6a65b926ac1144484f4aa93cd26d7997d32d62310ab93fe867f2bd4412222e9  ./engines/yolo11s.engine
+8dae8c557deadbe6bd7241c0dcd7025cb007077ee39a79b115e953a2b22cd9c1  ./lib/libusb-1.0.so
+8dae8c557deadbe6bd7241c0dcd7025cb007077ee39a79b115e953a2b22cd9c1  ./lib/libusb-1.0.so.0
+ab8b7f7249d5fb73d1d33d14fa7532a522088ffb6c25f37ba334daf4c6b4d313  ./lib/libusbcanfd.so
+ab8b7f7249d5fb73d1d33d14fa7532a522088ffb6c25f37ba334daf4c6b4d313  ./lib/libusbcanfd.so.1.0.12
+73e6be03ec983fe6c14b0923c69cad7ec816ed4260257e6aecaf7fe341686cfc  ./README.md
 7f42b0e7f9396e0d82313a892fc62c153261dab1206a206a466bce6376f58a36  ./run.sh
+41ebe2dcf57674232ca137d024e99447b467049cb1c63a284daae274296cb78c  ./scripts/99-usbcanfd.rules
+920102fc5e91bde9b78f6f7c5cb2ff8761a0c39b63c7a28b3347d5de5fe7c60a  ./scripts/enable_can_access.sh
 54e1d63e3aa72ad9b056a224d55968d4947ca6703a8d1c405570de5707a7e7ef  ./scripts/initialize_camera.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+exec "$root/build/door_mask_tool" --config "$root/config/camera.json" "$@"
@@ -18,5 +18,11 @@
    "warning_relative": 0.3,
    "release_relative": 0.45,
    "calibration_verified": false
+  },
+  "can": {
+    "enabled": true,
+    "device_index": 0,
+    "timeout_ms": 1000,
+    "termination": true
  }
 }
@@ -1,77 +1,55 @@
-{
-  "version": "x-anylabeling",
-  "flags": {},
-  "shapes": [
-    {
-      "label": "door",
-      "points": [
-        [
-          212.86,
-          145.919
-        ],
-        [
-          378.891,
-          851.857
-        ],
-        [
-          468.293,
-          996.446
-        ],
-        [
-          536.408,
-          1294.131
-        ],
-        [
-          553.437,
-          1404.7
-        ],
-        [
-          561.951,
-          1532.279
-        ],
-        [
-          51.086,
-          1532.279
-        ],
-        [
-          8.514,
-          1515.268
-        ],
-        [
-          0.0,
-          1468.489
-        ],
-        [
-          8.514,
-          26.845
-        ],
-        [
-          25.543,
-          5.582
-        ],
-        [
-          131.973,
-          -2.924
-        ],
-        [
-          191.574,
-          1.329
-        ],
-        [
-          208.603,
-          145.919
-        ]
-      ],
-      "group_id": null,
-      "shape_type": "polygon",
-      "flags": {}
-    }
-  ],
-  "imagePath": "constant_door_mask_reference.jpg",
-  "imageData": null,
-  "imageHeight": 1536,
-  "imageWidth": 1920,
-  "sourceVideo": "D:\\huang.xuewei\\CMS\\video\\20260921104502\\segment_009.mp4",
-  "sourceFrameIndex": 244,
-  "constantDoorMask": true
-}
+{
+  "version": "x-anylabeling",
+  "flags": {},
+  "shapes": [
+    {
+      "label": "door",
+      "points": [
+        [
+          1426,
+          0
+        ],
+        [
+          1257,
+          489
+        ],
+        [
+          1195,
+          615
+        ],
+        [
+          1155,
+          636
+        ],
+        [
+          1108,
+          813
+        ],
+        [
+          1106,
+          1097
+        ],
+        [
+          1097,
+          1529
+        ],
+        [
+          1917,
+          1535
+        ],
+        [
+          1915,
+          9
+        ]
+      ],
+      "group_id": null,
+      "shape_type": "polygon",
+      "flags": {}
+    }
+  ],
+  "imagePath": "driver-side1_reference.jpg",
+  "imageData": null,
+  "imageHeight": 1536,
+  "imageWidth": 1920,
+  "constantDoorMask": true
+}
@@ -0,0 +1 @@
+libusb-1.0.so
@@ -0,0 +1 @@
+libusbcanfd.so
@@ -0,0 +1,2 @@
+# USBCANFD adapter used by the reference project. Grant the plugdev group access.
+SUBSYSTEM=="usb", ATTR{idVendor}=="3068", ATTR{idProduct}=="0009", MODE="0660", GROUP="plugdev", TAG+="uaccess"
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+root_command() { if [[ $EUID -eq 0 ]]; then "$@"; else sudo -n "$@"; fi; }
+getent group plugdev >/dev/null || { echo 'Create a plugdev group and add the runtime user before running this script.' >&2; exit 1; }
+root_command install -m 0644 "$root/99-usbcanfd.rules" /etc/udev/rules.d/99-usbcanfd.rules
+root_command udevadm control --reload-rules
+root_command udevadm trigger --subsystem-match=usb --attr-match=idVendor=3068 --attr-match=idProduct=0009 --action=add
+root_command udevadm settle
+printf '%s\n' 'USBCANFD 3068:0009 access enabled for plugdev. Newly added group members must log in again.'
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+exec "$root/orin/scripts/enable_can_access.sh" "$@"
@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 root="$(cd "$(dirname "$0")/.." && pwd)"
-[[ -x "$root/build/camera_risk" ]] || { echo 'Build on Orin first.' >&2; exit 1; }
+[[ -x "$root/build/camera_risk" && -x "$root/build/door_mask_tool" ]] || { echo 'Build on Orin first.' >&2; exit 1; }
 cp -p "$root/build/camera_risk" "$root/orin/build/"
+cp -p "$root/build/door_mask_tool" "$root/orin/build/"
+cp -p "$root/annotate_door_mask.sh" "$root/orin/"
 cp -p "$root/config/door_mask.json" "$root/orin/config/"
 sed 's|../orin/engines|../engines|' "$root/config/camera.json" > "$root/orin/config/camera.json"
 (
  cd "$root/orin"
-  find . -type f ! -path './output/*' ! -path './outputs/*' ! -path './logs/*' ! -name SHA256SUMS -print0 |
+  find . \( -type f -o -type l \) ! -path './output/*' ! -path './outputs/*' ! -path './logs/*' ! -name SHA256SUMS -print0 |
    sort -z | xargs -0 sha256sum > SHA256SUMS
 )
@@ -4,6 +4,9 @@
 #include "detector.hpp"
 #include "door_risk.hpp"
 #include "records.hpp"
+#include "inference_session.hpp"
+#include "can_bus.hpp"
+#include "serialization.hpp"
 #include "result_conversion.hpp"
 #include <opencv2/core.hpp>
 #include <atomic>
@@ -51,12 +54,15 @@ struct CameraPipeline::Impl {
    BoundedQueue<Detected> detections;
    LatestResult results;
    std::unique_ptr<OutputWriter> outputWriter;
+    std::unique_ptr<SessionWriter> sessionWriter;
+    std::unique_ptr<SessionReader> sessionReader;
    fangjia::TrtLogger logger;
    std::unique_ptr<Detector> detector;
    std::unique_ptr<fangjia::RtmwEngine> pose;
    std::unique_ptr<DoorRisk> risk;
    std::shared_ptr<const BinaryMask> doorPixels;
    std::unique_ptr<Camera> camera;
+    std::unique_ptr<CanBus> can;
    std::thread captureThread,detectorThread,inferenceThread;
    mutable std::mutex stateMutex;
    std::exception_ptr failure;
@@ -66,6 +72,9 @@ struct CameraPipeline::Impl {
    double totalLatency{};

    explicit Impl(PipelineConfig c):config(std::move(c)),captures(config.queue_capacity),detections(config.queue_capacity) {
+        if(!config.replay_session.empty())sessionReader=std::make_unique<SessionReader>(config);
+        auto canConfig=config.can;if(sessionReader)canConfig.enabled=false;
+        can=std::make_unique<CanBus>(canConfig);
        if(config.queue_capacity>8)throw std::invalid_argument("Queue capacity must be between 1 and 8");
        if(config.max_people<1||config.max_people>16||!std::isfinite(config.detector_confidence)||config.detector_confidence<=0||config.detector_confidence>=1)
            throw std::invalid_argument("Invalid detector configuration");
@@ -76,9 +85,11 @@ struct CameraPipeline::Impl {
        if(captureThread.joinable())captureThread.join();
        if(detectorThread.joinable())detectorThread.join();
        if(inferenceThread.joinable())inferenceThread.join();
+        can->join();
    }
    void stop() noexcept {
        stopped=true;active=false;
+        can->requestStop();
        // Camera stays alive until all threads have joined. start()/destruction
        // are owner-thread operations; requestStop() only interrupts existing work.
        {std::lock_guard<std::mutex> lock(stateMutex);if(camera)camera->requestStop();}
@@ -94,7 +105,9 @@ struct CameraPipeline::Impl {
    void start() {
        {std::lock_guard<std::mutex> lock(stateMutex);if(started||stopped)throw std::logic_error("CameraPipeline can only be started once");started=true;}
        try {
+            can->start();
            outputWriter=std::make_unique<OutputWriter>(config.output);
+            sessionWriter=std::make_unique<SessionWriter>(config);
            detector=std::make_unique<Detector>(config.engines/"yolo11s.engine",logger,config.detector_confidence,config.max_people);
            pose=std::make_unique<fangjia::RtmwEngine>(config.engines/"rtmw_l_384.engine",logger,config.camera.width,config.camera.height,config.max_people);
            DoorOptions options;options.constant=config.door_mask;options.warning=config.warning_relative;options.release=config.release_relative;
@@ -107,7 +120,7 @@ struct CameraPipeline::Impl {
            Stream warmup;
            pose->warmup(warmup.value);
            detector->infer(cv::Mat(config.camera.height,config.camera.width,CV_8UC3,cv::Scalar()),warmup.value);
-            {std::lock_guard<std::mutex> lock(stateMutex);camera=std::make_unique<Camera>(config.camera);if(stopped)camera->requestStop();}
+            {std::lock_guard<std::mutex> lock(stateMutex);if(!sessionReader)camera=std::make_unique<Camera>(config.camera);if(stopped&&camera)camera->requestStop();}
            active=!stopped.load();
            captureThread=std::thread([this]{try{captureLoop();}catch(...){fail();}});
            detectorThread=std::thread([this]{try{detectorLoop();}catch(...){fail();}});
@@ -116,7 +129,7 @@ struct CameraPipeline::Impl {
    }
    void captureLoop() {
        while(!stopped) {
-            auto frame=camera->read();if(!frame)break;
+            auto frame=sessionReader?sessionReader->read():camera->read();if(!frame)break;
            gaps+=frame->metadata.skipped_driver_frames;
            errorFrames+=frame->metadata.discarded_error_frames;
            if(!captures.push(std::move(*frame)))break;
@@ -152,9 +165,18 @@ struct CameraPipeline::Impl {
            }
            auto poseElapsed=elapsedMs(poseStart);auto fusionStart=monotonicNs();
            auto fused=fusion.update(raw,isolated,index);
-            auto record=makeRecord(index,raw,isolated,fused,false,false);
+            auto record=makeRecord(index,raw,isolated,fused,!config.record_session.empty(),false);
            auto riskData=risk->evaluate(index,record);
            auto result=std::make_shared<FrameResult>(makeFrameResult(record,riskData,detected->frame.metadata));
+            if(detected->frame.replay_record) {
+                auto const& recorded=detected->frame.replay_record->at("result");
+                if(recorded.contains("can"))result->can=deserializeCan(recorded.at("can"));
+                else result->can.status="NOT_RECORDED";
+                result->can.source="replay";
+            }else {
+                if(!sessionReader&&config.can.enabled)can->queueRisk(result->risk.risk_level);
+                result->can=can->snapshot();
+            }
            attachPoses(*result,fused);
            result->image=std::move(detected->frame.image);result->door_mask_pixels=doorPixels;
            result->door_mask_calibration_verified=config.door_mask_calibration_verified;
@@ -162,8 +184,10 @@ struct CameraPipeline::Impl {
            FrameResultPtr immutable=result;
            results.publish(std::move(immutable));
            {std::lock_guard<std::mutex> lock(stateMutex);totalLatency+=result->timing.capture_to_result_ms;++published;}
+            if(!config.record_session.empty())sessionWriter->write(*result,record,detected->frame.replay_record.get());
            outputWriter->write(*result);
        }
+        sessionWriter->finish();
        active=false;
    }
 };
@@ -171,6 +195,17 @@ CameraPipeline::CameraPipeline(PipelineConfig config):impl_(std::make_unique<Imp
 CameraPipeline::~CameraPipeline()=default;
 void CameraPipeline::start(){impl_->start();}
 FrameResultPtr CameraPipeline::latest()const{return impl_->results.load();}
+CanSnapshot CameraPipeline::canStatus()const {
+    if(impl_->sessionReader) {
+        auto result=impl_->results.load();if(result)return result->can;
+        CanSnapshot s;s.source="replay";s.status="WAITING";return s;
+    }
+    return impl_->can->snapshot();
+}
+bool CameraPipeline::sendCan(CanFrame const& frame) {
+    if(impl_->sessionReader)throw std::logic_error("CAN transmission is disabled during replay");
+    return impl_->can->send(frame);
+}
 bool CameraPipeline::running()const noexcept{return impl_->active.load();}
 void CameraPipeline::requestStop()noexcept{impl_->stop();}
 void CameraPipeline::join(){impl_->joinWorkers();{std::lock_guard<std::mutex> lock(impl_->stateMutex);impl_->camera.reset();}impl_->rethrowFailure();}
@@ -0,0 +1,225 @@
+#include "can_bus.hpp"
+#include "zcan.h"
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <iostream>
+#include <mutex>
+#include <optional>
+#include <set>
+#include <stdexcept>
+#include <thread>
+
+namespace cms {
+namespace {
+constexpr unsigned deviceType=33,receiveCapacity=128;
+std::mutex ownersMutex;
+std::set<int> owners;
+std::uint64_t nowNs() {
+    return std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now().time_since_epoch()).count();
+}
+bool assertedRisk(std::string_view level) {
+    return level!="clear"&&level!="watch"&&level!="unavailable";
+}
+void validate(CanFrame const& f) {
+    if(f.channel!=static_cast<int>(canTransmitChannel)||f.id>(f.extended?0x1fffffffu:0x7ffu)||(!f.fd&&f.bitrate_switch))
+        throw std::invalid_argument("Invalid CAN channel, identifier or BRS flag");
+    auto size=f.data.size();
+    if((!f.fd&&size>8)||(f.fd&&!(size<=8||size==12||size==16||size==20||size==24||size==32||size==48||size==64)))
+        throw std::invalid_argument("Invalid CAN/CANFD payload length");
+}
+}
+struct CanBus::Impl {
+    CanConfig config;
+    mutable std::mutex stateMutex;
+    std::mutex lifecycleMutex,waitMutex,riskMutex;
+    std::condition_variable wake,riskWake;
+    std::optional<bool> pendingRisk,lastQueuedRisk;
+    CanSnapshot state;
+    std::atomic<bool> stopped{false};
+    bool started{},opened{},owned{};
+    std::array<bool,2> initialized{};
+    std::thread receiver,riskSender;
+    explicit Impl(CanConfig c):config(c) {
+        if(c.device_index<0||c.timeout_ms<=0)throw std::invalid_argument("Invalid CAN configuration");
+        state.status=c.enabled?"STARTING":"DISABLED";
+    }
+    ~Impl(){requestStop();join();}
+    void setStatus(char const* value) {std::lock_guard<std::mutex> lock(stateMutex);state.status=value;}
+    void releaseDevice() noexcept {
+        if(opened) {
+            for(unsigned i=0;i<canHardwareChannelCount;++i)if(initialized[i])VCI_ResetCAN(deviceType,config.device_index,i);
+            VCI_CloseDevice(deviceType,config.device_index);
+            opened=false;initialized.fill(false);
+        }
+        if(owned){std::lock_guard<std::mutex> lock(ownersMutex);owners.erase(config.device_index);owned=false;}
+    }
+    void start() {
+        std::lock_guard<std::mutex> lock(lifecycleMutex);
+        if(started)throw std::logic_error("CAN bus can only be started once");
+        started=true;
+        if(!config.enabled||stopped)return;
+        {
+            std::lock_guard<std::mutex> ownerLock(ownersMutex);
+            if(!owners.insert(config.device_index).second)throw std::logic_error("CAN device already owned by another pipeline");
+            owned=true;
+        }
+        try {
+            if(VCI_OpenDevice(deviceType,config.device_index,0)!=1)throw std::runtime_error("VCI_OpenDevice failed");
+            opened=true;
+            // Reference USBCANFD: 60 MHz clock, arbitration 500 kbps, data 2 Mbps.
+            for(unsigned i=0;i<canHardwareChannelCount;++i) {
+                ZCAN_INIT init{};init.clk=60000000;init.mode=0;
+                init.aset.tseg1=14;init.aset.tseg2=3;init.aset.sjw=2;init.aset.brp=5;
+                init.dset.tseg1=10;init.dset.tseg2=2;init.dset.sjw=2;init.dset.brp=1;
+                if(VCI_InitCAN(deviceType,config.device_index,i,&init)!=1)throw std::runtime_error("VCI_InitCAN failed");
+                initialized[i]=true;
+                U32 termination=config.termination?1:0;
+                if(VCI_SetReference(deviceType,config.device_index,i,CMD_CAN_TRES,&termination)!=1)
+                    throw std::runtime_error("CAN termination configuration failed");
+            }
+            U32 merge=1;
+            if(VCI_SetReference(deviceType,config.device_index,canReceiveChannel,ZCAN_CMD_SET_CHNL_RECV_MERGE,&merge)!=1)
+                throw std::runtime_error("CAN merged receive configuration failed");
+            for(unsigned i=0;i<canHardwareChannelCount;++i)if(VCI_StartCAN(deviceType,config.device_index,i)!=1)
+                throw std::runtime_error("VCI_StartCAN failed");
+            setStatus("OPEN");
+            // Exactly one reader; merged CH1 input is deliberately ignored.
+            receiver=std::thread([this]{receiveLoop();});
+            riskSender=std::thread([this]{riskLoop();});
+            std::cout<<"CAN device "<<config.device_index<<": CH0 receive, CH1 transmit, 500 kbps / 2 Mbps"<<std::endl;
+        }catch(std::exception const& e) {
+            requestStop();
+            if(receiver.joinable())receiver.join();
+            releaseDevice();setStatus("UNAVAILABLE");
+            std::cerr<<"CAN unavailable; inference continues: "<<e.what()<<std::endl;
+        }
+    }
+    void requestStop() noexcept {
+        stopped=true;wake.notify_all();
+        {std::lock_guard<std::mutex> lock(riskMutex);pendingRisk.reset();}
+        riskWake.notify_all();
+    }
+    void join() noexcept {
+        requestStop();
+        // A sender may be inside send() holding lifecycleMutex. Join it before
+        // taking that mutex or closing the device.
+        if(riskSender.joinable())riskSender.join();
+        std::lock_guard<std::mutex> lock(lifecycleMutex);
+        if(receiver.joinable())receiver.join();
+        releaseDevice();
+        if(config.enabled&&started)setStatus("STOPPED");
+    }
+    void receiveFrame(ZCAN_MSG_HDR const& header,std::uint8_t const* data,bool fd,unsigned channel) {
+        std::lock_guard<std::mutex> lock(stateMutex);
+        // Ignore remote, error and transmit-echo frames; they are not input.
+        if(header.inf.sdf||header.inf.err||header.inf.tx)return;
+        if(channel>=liveCanChannelCount)return;
+        if(channel>1||header.len>(fd?64:8)||header.id>(header.inf.sef?0x1fffffffu:0x7ffu)) {
+            ++state.receive_errors;return;
+        }
+        ++state.received;
+        if(header.id!=0x391)return;
+        if(header.len<4){++state.receive_errors;return;}
+        auto& s=state.channels[channel];
+        for(unsigned i=0;i<4;++i)s.positions[i]=data[i];
+        ++s.received;s.received_monotonic_ns=nowNs();s.device_timestamp_us=header.ts;
+        s.fd=fd;s.extended=header.inf.sef;
+    }
+    void receiveLoop() noexcept {
+        try {
+            std::array<ZCANDataObj,receiveCapacity> frames{};
+            while(!stopped) {
+                auto count=VCI_ReceiveData(deviceType,config.device_index,canReceiveChannel,frames.data(),receiveCapacity,100);
+                if(count>receiveCapacity) {
+                    {std::lock_guard<std::mutex> lock(stateMutex);++state.receive_errors;state.status="ERROR";}
+                    std::cerr<<"CAN receive failed; inference continues without live CAN"<<std::endl;
+                    break;
+                }
+                for(unsigned i=0;i<count&&!stopped;++i) {
+                    auto const& item=frames[i];
+                    if(item.chnl>=liveCanChannelCount)continue;
+                    if(item.dataType==ZCAN_DT_ZCAN_CAN_DATA)receiveFrame(item.data.zcanCANData.hdr,item.data.zcanCANData.dat,false,item.chnl);
+                    else if(item.dataType==ZCAN_DT_ZCAN_CANFD_DATA)receiveFrame(item.data.zcanCANFDData.hdr,item.data.zcanCANFDData.dat,true,item.chnl);
+                    else if(item.dataType==ZCAN_DT_ZCAN_ERROR_DATA){std::lock_guard<std::mutex> lock(stateMutex);++state.receive_errors;}
+                }
+                if(!count){std::unique_lock<std::mutex> lock(waitMutex);wake.wait_for(lock,std::chrono::milliseconds(5),[this]{return stopped.load();});}
+            }
+        }catch(...) {setStatus("ERROR");}
+    }
+    CanSnapshot snapshot() const {
+        std::lock_guard<std::mutex> lock(stateMutex);auto result=state;auto now=nowNs();
+        for(auto& c:result.channels) {
+            c.age_ms=c.received?(now-c.received_monotonic_ns)*1e-6:-1;
+            c.valid=state.status=="OPEN"&&!stopped&&c.received&&c.age_ms<=config.timeout_ms;
+        }
+        return result;
+    }
+    bool queueRisk(std::string_view level) {
+        std::lock_guard<std::mutex> lock(riskMutex);
+        {std::lock_guard<std::mutex> stateLock(stateMutex);
+            if(stopped||state.status!="OPEN")return false;
+        }
+        bool risk=assertedRisk(level);
+        if(lastQueuedRisk&&*lastQueuedRisk==risk)return true;
+        lastQueuedRisk=risk;pendingRisk=risk;riskWake.notify_one();return true;
+    }
+    void riskLoop() noexcept {
+        try {
+            CanFrame frame;frame.id=0x1f6;frame.data.assign(8,0);
+            std::optional<bool> lastAttemptedRisk;
+            while(!stopped) {
+                {
+                    std::unique_lock<std::mutex> lock(riskMutex);
+                    riskWake.wait(lock,[this]{return stopped||pendingRisk.has_value();});
+                    if(stopped)break;
+                    bool risk=*pendingRisk;pendingRisk.reset();
+                    // Coalesce A -> B -> A while A is being sent. Repeated
+                    // inference results and failed sends do not trigger retries.
+                    if(lastAttemptedRisk&&*lastAttemptedRisk==risk)continue;
+                    lastAttemptedRisk=risk;
+                    frame.data[0]=risk?0x11:0x00;
+                }
+                if(!stopped){frame.channel=canTransmitChannel;send(frame);}
+            }
+        }catch(...) {setStatus("ERROR");}
+    }
+    bool send(CanFrame const& f) {
+        validate(f);
+        std::lock_guard<std::mutex> lock(lifecycleMutex);
+        bool ready;
+        {std::lock_guard<std::mutex> stateLock(stateMutex);ready=state.status=="OPEN";}
+        unsigned sent=0;
+        if(opened&&!stopped&&ready) {
+            ZCAN_MSG_HDR header{};header.id=f.id;header.chn=f.channel;header.len=f.data.size();
+            header.inf.fmt=f.fd?1:0;header.inf.sef=f.extended;header.inf.brs=f.bitrate_switch;
+            if(f.fd) {
+                ZCAN_FD_MSG message{};message.hdr=header;std::copy(f.data.begin(),f.data.end(),message.dat);
+                sent=VCI_TransmitFD(deviceType,config.device_index,f.channel,&message,1);
+            }else {
+                ZCAN_20_MSG message{};message.hdr=header;std::copy(f.data.begin(),f.data.end(),message.dat);
+                sent=VCI_Transmit(deviceType,config.device_index,f.channel,&message,1);
+            }
+        }
+        std::lock_guard<std::mutex> stateLock(stateMutex);
+        if(sent==1)++state.transmitted;else ++state.transmit_errors;
+        return sent==1;
+    }
+};
+CanBus::CanBus(CanConfig c):impl_(std::make_unique<Impl>(c)){}
+CanBus::~CanBus()=default;
+void CanBus::start(){impl_->start();}
+void CanBus::requestStop()noexcept{impl_->requestStop();}
+void CanBus::join()noexcept{impl_->join();}
+CanSnapshot CanBus::snapshot()const{return impl_->snapshot();}
+bool CanBus::send(CanFrame const& f){return impl_->send(f);}
+bool CanBus::queueRisk(std::string_view level){return impl_->queueRisk(level);}
+std::array<bool,2> CanBus::sendRisk(std::string_view riskLevel) {
+    CanFrame frame;frame.id=0x1f6;frame.data.assign(8,0);
+    frame.data[0]=assertedRisk(riskLevel)?0x11:0x00;
+    std::array<bool,2> sent{};
+    frame.channel=canTransmitChannel;sent[canTransmitChannel]=send(frame);
+    return sent;
+}
+}
@@ -19,6 +19,11 @@ PipelineConfig loadConfig(std::filesystem::path const& path) {
    auto const& door=j.at("door");config.door_mask=resolve(door.at("mask"));
    config.warning_relative=door.at("warning_relative");config.release_relative=door.at("release_relative");
    config.door_mask_calibration_verified=door.at("calibration_verified");
+    if(j.contains("can")) {
+        auto const& can=j.at("can");config.can.enabled=can.value("enabled",true);
+        config.can.device_index=can.value("device_index",0);config.can.timeout_ms=can.value("timeout_ms",1000);
+        config.can.termination=can.value("termination",true);
+    }
    return config;
 }
 }
@@ -0,0 +1,137 @@
+#include "door_mask_annotator.hpp"
+
+#include <nlohmann/json.hpp>
+#include <opencv2/highgui.hpp>
+#include <opencv2/highgui/highgui_c.h>
+#include <opencv2/imgcodecs.hpp>
+#include <opencv2/imgproc.hpp>
+#include <algorithm>
+#include <cmath>
+#include <fstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace cms {
+namespace {
+using Json = nlohmann::ordered_json;
+constexpr char windowName[]="Door Mask Annotator";
+constexpr int maxDisplayWidth=1280;
+constexpr int maxDisplayHeight=720;
+constexpr int footerHeight=72;
+
+struct EditorState {
+    cv::Mat image;
+    std::vector<cv::Point> points;
+    int displayWidth{};
+    int displayHeight{};
+    std::string message="Left click: add point   Right click/U: undo   R: reset   S/Enter: save   Esc/Q: cancel";
+
+    cv::Point toOriginal(int x,int y) const {
+        auto ox=static_cast<int>(std::lround(double(x)*(image.cols-1)/std::max(displayWidth-1,1)));
+        auto oy=static_cast<int>(std::lround(double(y)*(image.rows-1)/std::max(displayHeight-1,1)));
+        return {std::clamp(ox,0,image.cols-1),std::clamp(oy,0,image.rows-1)};
+    }
+    cv::Point toDisplay(cv::Point const& p) const {
+        return {static_cast<int>(std::lround(double(p.x)*(displayWidth-1)/std::max(image.cols-1,1))),
+                static_cast<int>(std::lround(double(p.y)*(displayHeight-1)/std::max(image.rows-1,1)))};
+    }
+};
+
+void onMouse(int event,int x,int y,int,void* opaque) {
+    auto& state=*static_cast<EditorState*>(opaque);
+    if(x<0||y<0||x>=state.displayWidth||y>=state.displayHeight)return;
+    if(event==cv::EVENT_LBUTTONDOWN) {
+        state.points.push_back(state.toOriginal(x,y));
+        state.message="Point added. Add at least 3 points, then press S or Enter.";
+    } else if(event==cv::EVENT_RBUTTONDOWN&&!state.points.empty()) {
+        state.points.pop_back();state.message="Last point removed.";
+    }
+}
+
+cv::Mat render(EditorState const& state) {
+    cv::Mat scaled;
+    cv::resize(state.image,scaled,{state.displayWidth,state.displayHeight},0,0,cv::INTER_AREA);
+    std::vector<cv::Point> displayed;
+    displayed.reserve(state.points.size());
+    for(auto const& point:state.points)displayed.push_back(state.toDisplay(point));
+    if(displayed.size()>=3) {
+        auto overlay=scaled.clone();
+        cv::fillPoly(overlay,std::vector<std::vector<cv::Point>>{displayed},cv::Scalar(30,180,255));
+        cv::addWeighted(overlay,0.25,scaled,0.75,0,scaled);
+        cv::polylines(scaled,std::vector<std::vector<cv::Point>>{displayed},true,cv::Scalar(20,230,255),2,cv::LINE_AA);
+    } else if(displayed.size()>=2) {
+        cv::polylines(scaled,std::vector<std::vector<cv::Point>>{displayed},false,cv::Scalar(20,230,255),2,cv::LINE_AA);
+    }
+    for(std::size_t i=0;i<displayed.size();++i) {
+        cv::circle(scaled,displayed[i],5,cv::Scalar(20,20,255),-1,cv::LINE_AA);
+        cv::putText(scaled,std::to_string(i+1),displayed[i]+cv::Point(7,-7),cv::FONT_HERSHEY_SIMPLEX,.45,cv::Scalar(255,255,255),1,cv::LINE_AA);
+    }
+    cv::Mat canvas(state.displayHeight+footerHeight,state.displayWidth,CV_8UC3,cv::Scalar(24,27,32));
+    scaled.copyTo(canvas(cv::Rect(0,0,state.displayWidth,state.displayHeight)));
+    cv::putText(canvas,"Door polygon points: "+std::to_string(state.points.size()),{12,state.displayHeight+25},cv::FONT_HERSHEY_SIMPLEX,.62,cv::Scalar(235,235,235),1,cv::LINE_AA);
+    cv::putText(canvas,state.message,{12,state.displayHeight+54},cv::FONT_HERSHEY_SIMPLEX,.48,cv::Scalar(180,220,255),1,cv::LINE_AA);
+    return canvas;
+}
+
+bool usablePolygon(std::vector<cv::Point> const& points) {
+    return points.size()>=3&&std::abs(cv::contourArea(points))>=10.0;
+}
+
+void writeFiles(EditorState const& state,DoorMaskAnnotationOptions const& options) {
+    auto const output=std::filesystem::absolute(options.output_json);
+    auto const reference=std::filesystem::absolute(options.reference_image);
+    if(output.extension()!=".json")throw std::invalid_argument("Door mask output must use the .json extension");
+    if(!options.overwrite&&(std::filesystem::exists(output)||std::filesystem::exists(reference)))
+        throw std::runtime_error("Output already exists; use --force to replace it: "+output.string());
+    if(!output.parent_path().empty())std::filesystem::create_directories(output.parent_path());
+    if(!reference.parent_path().empty())std::filesystem::create_directories(reference.parent_path());
+
+    auto imageTmp=reference;imageTmp.replace_filename(reference.stem().string()+".tmp"+reference.extension().string());
+    if(!cv::imwrite(imageTmp.string(),state.image,{cv::IMWRITE_JPEG_QUALITY,95}))
+        throw std::runtime_error("Cannot write reference image: "+reference.string());
+    std::error_code error;
+    if(options.overwrite)std::filesystem::remove(reference,error);
+    std::filesystem::rename(imageTmp,reference);
+
+    Json shape={{"label","door"},{"points",Json::array()},{"group_id",nullptr},{"shape_type","polygon"},{"flags",Json::object()}};
+    for(auto const& point:state.points)shape["points"].push_back({point.x,point.y});
+    Json document={{"version","x-anylabeling"},{"flags",Json::object()},{"shapes",Json::array({shape})},
+        {"imagePath",reference.filename().string()},{"imageData",nullptr},{"imageHeight",state.image.rows},{"imageWidth",state.image.cols},
+        {"constantDoorMask",true}};
+    if(options.source_video)document["sourceVideo"]=*options.source_video;
+    if(options.source_frame_index)document["sourceFrameIndex"]=*options.source_frame_index;
+    auto text=document.dump(2)+"\n";
+    auto jsonTmp=output;jsonTmp+=".tmp";
+    std::ofstream stream;stream.exceptions(std::ios::failbit|std::ios::badbit);
+    stream.open(jsonTmp,std::ios::binary|std::ios::trunc);stream.write(text.data(),static_cast<std::streamsize>(text.size()));stream.close();
+    if(options.overwrite)std::filesystem::remove(output,error);
+    std::filesystem::rename(jsonTmp,output);
+}
+}
+
+bool annotateDoorMask(cv::Mat const& image,DoorMaskAnnotationOptions const& options) {
+    if(image.empty()||image.type()!=CV_8UC3)throw std::invalid_argument("Door mask annotation requires a non-empty BGR image");
+    if(options.output_json.empty()||options.reference_image.empty())throw std::invalid_argument("Door mask output paths cannot be empty");
+    auto scale=std::min({1.0,double(maxDisplayWidth)/image.cols,double(maxDisplayHeight)/image.rows});
+    EditorState state{image.clone(),{},std::max(1,static_cast<int>(std::lround(image.cols*scale))),
+        std::max(1,static_cast<int>(std::lround(image.rows*scale)))};
+    cv::namedWindow(windowName,cv::WINDOW_AUTOSIZE);
+    cv::setMouseCallback(windowName,onMouse,&state);
+    try {
+        while(true) {
+            cv::imshow(windowName,render(state));
+            auto raw=cv::waitKeyEx(20),key=raw&0xff;
+            if(cvGetWindowHandle(windowName)==nullptr) {cv::destroyWindow(windowName);return false;}
+            if(key==27||key=='q'||key=='Q') {cv::destroyWindow(windowName);return false;}
+            if(key=='r'||key=='R') {state.points.clear();state.message="Polygon cleared.";continue;}
+            if((key=='u'||key=='U'||key==8||key==127)&&!state.points.empty()) {state.points.pop_back();state.message="Last point removed.";continue;}
+            if(key=='s'||key=='S'||key==10||key==13) {
+                if(!usablePolygon(state.points)) {state.message="A valid door polygon needs at least 3 non-collinear points.";continue;}
+                writeFiles(state,options);cv::destroyWindow(windowName);return true;
+            }
+        }
+    } catch(...) {cv::destroyWindow(windowName);throw;}
+}
+
+}
@@ -0,0 +1,160 @@
+#include "camera.hpp"
+#include "config.hpp"
+#include "door_mask_annotator.hpp"
+
+#include <opencv2/highgui.hpp>
+#include <opencv2/highgui/highgui_c.h>
+#include <opencv2/imgcodecs.hpp>
+#include <opencv2/imgproc.hpp>
+#include <opencv2/videoio.hpp>
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <filesystem>
+#include <iostream>
+#include <limits>
+#include <optional>
+#include <stdexcept>
+#include <string>
+
+namespace {
+constexpr char videoWindowName[]="Select Door Mask Reference Frame";
+
+cv::Mat captureReference(std::filesystem::path const& configPath) {
+    auto config=cms::loadConfig(configPath);
+    cms::Camera camera(config.camera);
+    std::optional<cms::CapturedFrame> frame;
+    // Let exposure and the camera link settle while retaining the newest frame.
+    for(int i=0;i<5;++i)frame=camera.read();
+    camera.requestStop();
+    if(!frame||!frame->image)throw std::runtime_error("Camera stopped before an annotation frame was captured");
+    auto const& image=*frame->image;
+    return cv::Mat(image.height,image.width,CV_8UC3,const_cast<std::uint8_t*>(image.pixels.data()),image.stride).clone();
+}
+
+cv::Mat readVideoFrame(cv::VideoCapture& video,int index) {
+    if(!video.set(cv::CAP_PROP_POS_FRAMES,index))throw std::runtime_error("Cannot seek to video frame "+std::to_string(index));
+    cv::Mat frame;
+    if(!video.read(frame)||frame.empty())throw std::runtime_error("Cannot decode video frame "+std::to_string(index));
+    return frame;
+}
+
+std::optional<std::pair<cv::Mat,std::int64_t>> selectVideoFrame(std::filesystem::path const& path,std::optional<std::int64_t> requested) {
+    cv::VideoCapture video(path.string(),cv::CAP_FFMPEG);
+    if(!video.isOpened())throw std::runtime_error("Cannot open annotation video: "+path.string());
+    auto countValue=video.get(cv::CAP_PROP_FRAME_COUNT);
+    if(!std::isfinite(countValue)||countValue<1||countValue>std::numeric_limits<int>::max())
+        throw std::runtime_error("Annotation video does not report a usable frame count: "+path.string());
+    auto count=static_cast<int>(std::llround(countValue));
+    if(requested) {
+        if(*requested<0||*requested>=count)throw std::out_of_range("--frame is outside the video: "+std::to_string(*requested));
+        return std::pair<cv::Mat,std::int64_t>{readVideoFrame(video,static_cast<int>(*requested)),*requested};
+    }
+    if(count==1)return std::pair<cv::Mat,std::int64_t>{readVideoFrame(video,0),0};
+
+    int position=0,current=-1;
+    cv::Mat selected;
+    cv::namedWindow(videoWindowName,cv::WINDOW_AUTOSIZE);
+    cv::createTrackbar("Frame",videoWindowName,&position,count-1,[](int,void*){},nullptr);
+    try {
+        while(true) {
+            if(position!=current) {selected=readVideoFrame(video,position);current=position;}
+            auto scale=std::min({1.0,1280.0/selected.cols,680.0/selected.rows});
+            auto width=std::max(1,static_cast<int>(std::lround(selected.cols*scale)));
+            auto height=std::max(1,static_cast<int>(std::lround(selected.rows*scale)));
+            cv::Mat preview,canvas(height+58,width,CV_8UC3,cv::Scalar(24,27,32));
+            cv::resize(selected,preview,{width,height},0,0,cv::INTER_AREA);
+            preview.copyTo(canvas(cv::Rect(0,0,width,height)));
+            auto timeMs=video.get(cv::CAP_PROP_POS_MSEC);
+            cv::putText(canvas,"Frame "+std::to_string(position)+" / "+std::to_string(count-1)+"   "+
+                std::to_string(static_cast<std::int64_t>(std::llround(timeMs)))+" ms",{12,height+23},cv::FONT_HERSHEY_SIMPLEX,.6,cv::Scalar(235,235,235),1,cv::LINE_AA);
+            cv::putText(canvas,"Trackbar or A/D: previous/next   J/L: -/+30   S/Enter: select   Esc/Q: cancel",
+                {12,height+47},cv::FONT_HERSHEY_SIMPLEX,.45,cv::Scalar(180,220,255),1,cv::LINE_AA);
+            cv::imshow(videoWindowName,canvas);
+            auto raw=cv::waitKeyEx(20),key=raw&0xff,next=position;
+            if(cvGetWindowHandle(videoWindowName)==nullptr) {cv::destroyWindow(videoWindowName);return std::nullopt;}
+            if(key==27||key=='q'||key=='Q') {cv::destroyWindow(videoWindowName);return std::nullopt;}
+            if(key=='a'||key=='A'||raw==65361||raw==2424832)next=position-1;
+            else if(key=='d'||key=='D'||raw==65363||raw==2555904)next=position+1;
+            else if(key=='j'||key=='J')next=position-30;
+            else if(key=='l'||key=='L')next=position+30;
+            else if(key=='s'||key=='S'||key==10||key==13) {
+                auto result=std::pair<cv::Mat,std::int64_t>{selected.clone(),position};
+                cv::destroyWindow(videoWindowName);return result;
+            }
+            next=std::clamp(next,0,count-1);
+            if(next!=position) {position=next;cv::setTrackbarPos("Frame",videoWindowName,position);}
+        }
+    } catch(...) {cv::destroyWindow(videoWindowName);throw;}
+}
+
+void printHelp() {
+    std::cout<<
+        "door_mask_tool --output MASK.json [--camera | --image IMAGE | --video VIDEO [--frame N]] [--config CAMERA.json] [--force]\n"
+        "\n"
+        "With no input option, --camera is used. Image and video modes never open the camera.\n"
+        "Video mode opens a frame selector unless --frame selects a zero-based frame directly.\n"
+        "The reference JPEG is stored beside MASK.json. Existing files are preserved unless --force is used.\n"
+        "\n"
+        "Mouse/keys: left click adds a point; right click or U undoes; R resets;\n"
+        "S or Enter saves; Esc or Q cancels without writing files.\n";
+}
+}
+
+int main(int argc,char** argv)try {
+    auto root=std::filesystem::canonical("/proc/self/exe").parent_path().parent_path();
+    std::filesystem::path configPath=root/"config/camera.json",imagePath,videoPath,outputPath;
+    std::optional<std::int64_t> requestedFrame;
+    bool force=false,cameraInput=false;
+    for(int i=1;i<argc;++i) {
+        std::string argument=argv[i];
+        auto value=[&](char const* name) {if(++i>=argc)throw std::invalid_argument(std::string(name)+" needs a path");return std::filesystem::path(argv[i]);};
+        if(argument=="--output")outputPath=value("--output");
+        else if(argument=="--camera")cameraInput=true;
+        else if(argument=="--image")imagePath=value("--image");
+        else if(argument=="--video")videoPath=value("--video");
+        else if(argument=="--frame") {
+            if(++i>=argc)throw std::invalid_argument("--frame needs a zero-based frame number");
+            std::size_t consumed{};auto text=std::string(argv[i]);auto parsed=std::stoll(text,&consumed);
+            if(consumed!=text.size()||parsed<0)throw std::invalid_argument("--frame must be a non-negative integer");
+            requestedFrame=parsed;
+        }
+        else if(argument=="--config")configPath=value("--config");
+        else if(argument=="--force")force=true;
+        else if(argument=="--help"||argument=="-h") {printHelp();return 0;}
+        else throw std::invalid_argument("Unknown option: "+argument);
+    }
+    if(outputPath.empty())throw std::invalid_argument("--output MASK.json is required");
+    auto inputs=int(cameraInput)+int(!imagePath.empty())+int(!videoPath.empty());
+    if(inputs>1)throw std::invalid_argument("Choose exactly one input: --camera, --image, or --video");
+    if(inputs==0)cameraInput=true;
+    if(requestedFrame&&videoPath.empty())throw std::invalid_argument("--frame can only be used with --video");
+    if(outputPath.extension()!=".json")throw std::invalid_argument("Door mask output must use the .json extension");
+    auto reference=outputPath.parent_path()/(outputPath.stem().string()+"_reference.jpg");
+    if(!force&&(std::filesystem::exists(outputPath)||std::filesystem::exists(reference)))
+        throw std::runtime_error("Output already exists; use --force to replace it: "+outputPath.string());
+    auto display=std::getenv("DISPLAY"),wayland=std::getenv("WAYLAND_DISPLAY");
+    if((!display||!*display)&&(!wayland||!*wayland))throw std::runtime_error("No graphical display is available for annotation");
+
+    cv::Mat image;std::optional<std::int64_t> selectedFrame;
+    if(cameraInput) {
+        std::cout<<"Capturing annotation frame using "<<std::filesystem::absolute(configPath)<<std::endl;
+        image=captureReference(configPath);
+    } else if(!imagePath.empty()) {
+        image=cv::imread(imagePath.string(),cv::IMREAD_COLOR);
+        if(image.empty())throw std::runtime_error("Cannot read annotation image: "+imagePath.string());
+    } else {
+        auto selected=selectVideoFrame(videoPath,requestedFrame);
+        if(!selected) {std::cout<<"Video frame selection cancelled; no files written.\n";return 2;}
+        image=std::move(selected->first);selectedFrame=selected->second;
+    }
+    cms::DoorMaskAnnotationOptions options;options.output_json=outputPath;options.reference_image=reference;options.overwrite=force;
+    if(!videoPath.empty()) {options.source_video=std::filesystem::absolute(videoPath).string();options.source_frame_index=selectedFrame;}
+    if(!cms::annotateDoorMask(image,options)) {std::cout<<"Annotation cancelled; no files written.\n";return 2;}
+    std::cout<<"Door mask saved: "<<std::filesystem::absolute(outputPath)<<"\n"
+             <<"Reference image saved: "<<std::filesystem::absolute(reference)<<std::endl;
+    return 0;
+} catch(std::exception const& e) {
+    std::cerr<<"Door mask tool failed: "<<e.what()<<std::endl;return 1;
+}
@@ -0,0 +1,151 @@
+#include "inference_session.hpp"
+#include "camera_pipeline.hpp"
+#include "serialization.hpp"
+
+#include <cstring>
+#include <iomanip>
+#include <iostream>
+#include <limits>
+#include <sstream>
+
+namespace cms {
+namespace {
+using Json = nlohmann::json;
+Json readJson(std::filesystem::path const& path) {
+    std::ifstream input(path);
+    if(!input)throw std::runtime_error("Cannot read session file: "+path.string());
+    return Json::parse(input);
+}
+void atomicWrite(std::filesystem::path const& path,char const* data,std::size_t size) {
+    auto tmp=path;tmp+=".tmp";
+    std::ofstream out;out.exceptions(std::ios::failbit|std::ios::badbit);
+    out.open(tmp,std::ios::binary|std::ios::trunc);
+    out.write(data,static_cast<std::streamsize>(size));out.close();
+    std::filesystem::rename(tmp,path);
+}
+void writeJson(std::filesystem::path const& path,Json const& value) {
+    auto text=value.dump(2)+"\n";atomicWrite(path,text.data(),text.size());
+}
+std::string frameName(std::uint64_t index) {
+    std::ostringstream name;name<<std::setw(12)<<std::setfill('0')<<index;return name.str();
+}
+Json captureJson(CaptureMetadata const& c) {
+    return {{"frame_index",c.frame_index},{"driver_sequence",c.driver_sequence},
+        {"driver_timestamp_ns",c.driver_timestamp_ns},{"received_monotonic_ns",c.received_monotonic_ns},
+        {"capture_monotonic_ns",c.capture_monotonic_ns},{"driver_timestamp_monotonic",c.driver_timestamp_monotonic},
+        {"skipped_driver_frames",c.skipped_driver_frames},{"discarded_error_frames",c.discarded_error_frames}};
+}
+}
+SessionWriter::SessionWriter(PipelineConfig const& c):directory_(c.record_session) {
+    if(directory_.empty())return;
+    width_=c.camera.width;height_=c.camera.height;
+    if(width_<=0||height_<=0||width_>16384||height_>16384||width_%2||height_%2||c.camera.fps<=0)
+        throw std::invalid_argument("H.264 recording requires positive even dimensions and positive FPS");
+    // Exclusive creation: never append to or overwrite another session.
+    if(!directory_.parent_path().empty())std::filesystem::create_directories(directory_.parent_path());
+    if(!std::filesystem::create_directory(directory_))throw std::runtime_error("Recording directory already exists: "+directory_.string());
+    std::filesystem::create_directory(directory_/"frames");
+    Json config={{"width",c.camera.width},{"height",c.camera.height},{"fps",c.camera.fps},
+        {"detector_confidence",c.detector_confidence},{"max_people",c.max_people},
+        {"warning_relative",c.warning_relative},{"release_relative",c.release_relative},
+        {"calibration_verified",c.door_mask_calibration_verified},
+        {"can",{{"enabled",c.can.enabled},{"device_index",c.can.device_index},{"timeout_ms",c.can.timeout_ms},{"termination",c.can.termination}}}};
+    Json models=Json::object();
+    for(auto name:{"yolo11s.engine","rtmw_l_384.engine"})
+        models[name]={{"path",(c.engines/name).string()},{"bytes",std::filesystem::file_size(c.engines/name)}};
+    writeJson(directory_/"door_mask.json",readJson(c.door_mask));
+    if(!video_.open((directory_/"frames.pending.mp4").string(),cv::CAP_FFMPEG,
+                   cv::VideoWriter::fourcc('a','v','c','1'),c.camera.fps,cv::Size(width_,height_)))
+        throw std::runtime_error("Cannot open H.264 encoder; OpenCV FFmpeg with an H.264 encoder is required");
+    writeJson(directory_/"session.json",{{"schema_version",2},{"format","cms-inference-session"},
+        {"video",{{"file","frames.mp4"},{"codec","h264"},{"lossy",true}}},{"variant",PipelineConfig::session_variant},{"config",config},{"models",models},{"source_session",c.replay_session.string()}});
+    index_.exceptions(std::ios::failbit|std::ios::badbit);index_.open(directory_/"frames.txt");
+    std::cout<<"Recording inference session: "<<directory_<<std::endl;
+}
+void SessionWriter::write(FrameResult const& r,Json const& stages,Json const* source) {
+    if(directory_.empty())return;
+    if(finished_)throw std::logic_error("Session is already finalized");
+    if(!r.image)throw std::runtime_error("Session frame has no image");
+    auto const& im=*r.image;
+    if(im.width!=width_||im.height!=height_||im.stride<im.width*3||im.pixels.size()<std::size_t(im.stride)*im.height)
+        throw std::runtime_error("Invalid session image");
+    auto stem=frameName(count_);
+    cv::Mat view(im.height,im.width,CV_8UC3,const_cast<std::uint8_t*>(im.pixels.data()),im.stride);
+    video_.write(view);
+    Json record={{"video_frame_index",count_},{"frame_index",r.frame_index},{"capture",captureJson(r.capture)},
+        {"stages",stages},{"result",serializeResult(r)}};
+    // Preserve original acquisition timestamps across replay -> record cycles.
+    if(source)record["source_capture"]=source->contains("source_capture")?source->at("source_capture"):source->at("capture");
+    writeJson(directory_/"frames"/(stem+".json"),record);
+    index_<<stem<<'\n';index_.flush();++count_;
+}
+void SessionWriter::finish() {
+    if(directory_.empty()||finished_)return;
+    video_.release();index_.close();
+    // MP4 stores the encoded packet count. Check it after flushing delayed
+    // frames; OpenCV's write() itself cannot report encoder/disk errors.
+    if(count_) {
+        cv::VideoCapture check((directory_/"frames.pending.mp4").string(),cv::CAP_FFMPEG);
+        if(!check.isOpened()||check.get(cv::CAP_PROP_FRAME_COUNT)!=double(count_))
+            throw std::runtime_error("H.264 recording is incomplete; session not finalized");
+    }
+    std::filesystem::rename(directory_/"frames.pending.mp4",directory_/"frames.mp4");
+    writeJson(directory_/"complete.json",{{"frame_count",count_},{"video_bytes",std::filesystem::file_size(directory_/"frames.mp4")}});
+    finished_=true;
+    std::cout<<"Inference session finalized: "<<count_<<" H.264 frames"<<std::endl;
+}
+SessionReader::SessionReader(PipelineConfig& c):directory_(c.replay_session) {
+    auto manifest=readJson(directory_/"session.json");
+    if(manifest.at("schema_version")!=2||manifest.at("format")!="cms-inference-session")
+        throw std::runtime_error("Unsupported inference session format");
+    if(manifest.at("variant")!=PipelineConfig::session_variant)throw std::runtime_error("Session belongs to a different pipeline variant");
+    auto completion=readJson(directory_/"complete.json");
+    expectedCount_=completion.at("frame_count").get<std::uint64_t>();
+    if(completion.at("video_bytes")!=std::filesystem::file_size(directory_/"frames.mp4"))
+        throw std::runtime_error("Session video size does not match finalized recording");
+    auto const& j=manifest.at("config");
+    width_=j.at("width");height_=j.at("height");
+    if(width_<=0||height_<=0||width_>16384||height_>16384||width_%2||height_%2)throw std::runtime_error("Invalid session dimensions");
+    c.camera.width=width_;c.camera.height=height_;c.camera.fps=j.at("fps");
+    c.detector_confidence=j.at("detector_confidence");c.max_people=j.at("max_people");
+    c.warning_relative=j.at("warning_relative");c.release_relative=j.at("release_relative");
+    c.door_mask_calibration_verified=j.at("calibration_verified");
+    c.door_mask=directory_/"door_mask.json";
+    index_.open(directory_/"frames.txt");
+    if(!index_)throw std::runtime_error("Cannot open session frame index");
+    std::cout<<"Replaying inference session: "<<directory_<<" (recorded inference settings, current engines)"<<std::endl;
+}
+std::optional<CapturedFrame> SessionReader::read() {
+    std::string stem;
+    if(!std::getline(index_,stem)) {
+        if(!index_.eof()||count_!=expectedCount_)throw std::runtime_error("Truncated session index");
+        return {};
+    }
+    // No path strings from the archive are used as filenames. Check sequence,
+    // including its newline, so corruption cannot silently skip a frame.
+    if(index_.eof()||count_>=expectedCount_||stem!=frameName(count_))throw std::runtime_error("Invalid or truncated session frame index");
+    auto record=std::make_shared<Json>(readJson(directory_/"frames"/(stem+".json")));
+    if(record->at("video_frame_index")!=count_)throw std::runtime_error("Video/record frame index mismatch");
+    auto frameIndex=record->at("frame_index").get<std::int64_t>();
+    if(frameIndex<0||frameIndex>std::numeric_limits<int>::max()||(count_&&std::uint64_t(frameIndex)<=lastFrame_))
+        throw std::runtime_error("Session frame indices must increase and fit int");
+    // Opening FFmpeg can create decoder threads. Do this in the capture
+    // worker, after StopSignals has installed the inherited signal mask.
+    if(!video_.isOpened()&&(!video_.open((directory_/"frames.mp4").string(),cv::CAP_FFMPEG)||
+        video_.get(cv::CAP_PROP_FRAME_COUNT)!=double(expectedCount_)))
+        throw std::runtime_error("Cannot open complete session video");
+    cv::Mat im;
+    if(!video_.read(im)||im.empty()||im.cols!=width_||im.rows!=height_||im.type()!=CV_8UC3)throw std::runtime_error("Missing or malformed session video frame: "+stem);
+    auto image=std::make_shared<BgrImage>();image->width=width_;image->height=height_;image->stride=width_*3;
+    image->pixels.resize(std::size_t(image->stride)*height_);
+    for(int y=0;y<height_;++y)std::memcpy(image->pixels.data()+std::size_t(y)*image->stride,im.ptr(y),image->stride);
+    auto const& c=record->at("capture");CaptureMetadata metadata;
+    metadata.frame_index=frameIndex;metadata.driver_sequence=c.at("driver_sequence");
+    metadata.driver_timestamp_ns=c.at("driver_timestamp_ns");metadata.driver_timestamp_monotonic=c.at("driver_timestamp_monotonic");
+    metadata.skipped_driver_frames=c.at("skipped_driver_frames");metadata.discarded_error_frames=c.at("discarded_error_frames");
+    // Old monotonic clocks cannot measure current replay latency.
+    metadata.received_monotonic_ns=metadata.capture_monotonic_ns=monotonicNs();
+    lastFrame_=frameIndex;++count_;
+    return CapturedFrame{metadata,std::move(image),std::move(record)};
+}
+}
@@ -2,6 +2,7 @@
 #include "config.hpp"
 #include "stop_signals.hpp"
 #include "visualizer.hpp"
+#include <cstdlib>
 #include <functional>
 #include <iostream>
 #include <map>
@@ -10,18 +11,24 @@ int main(int argc,char** argv)try {
    auto root=std::filesystem::canonical("/proc/self/exe").parent_path().parent_path();
    auto configPath=root/"config/camera.json";
    cms::OutputOptions output;output.directory=root/"output";
-    bool visualize=false;
+    bool visualize=true,disableCan=false;
+    std::filesystem::path recordSession,replaySession;
    std::map<std::string,std::function<void(int&)>> arguments{
+        {"--record-session",[&](int&i){if(++i>=argc)throw std::invalid_argument("--record-session needs a directory");recordSession=argv[i];}},
+        {"--replay-session",[&](int&i){if(++i>=argc)throw std::invalid_argument("--replay-session needs a directory");replaySession=argv[i];}},
        {"--save-original",[&](int&){output.original=true;}},
        {"--save-annotated",[&](int&){output.annotated=true;}},
        {"--save-results",[&](int&){output.results=true;}},
+        {"--no-can",[&](int&){disableCan=true;}},
        {"--visualize",[&](int&){visualize=true;}},
+        {"--no-visualize",[&](int&){visualize=false;}},
        {"--config",[&](int&i){if(++i>=argc)throw std::invalid_argument("--config needs a file");configPath=argv[i];}},
-        {"--help",[](int&){std::cout<<"camera_risk [--save-original] [--save-annotated] [--save-results] [--config FILE] [--visualize]\nContinuous camera inference; latest FrameResult stays in memory. Stop with Ctrl+C or SIGTERM.\n";std::exit(0);}}
+        {"--help",[](int&){std::cout<<"camera_risk [--record-session NEW_DIR] [--replay-session DIR] [--save-original] [--save-annotated] [--save-results] [--config FILE] [--no-can] [--visualize|--no-visualize]\nLive CAN/CANFD reception on CH0 and change-triggered 0x1F6 binary risk transmission on CH1 are enabled by default.\nRisk: clear/watch/unavailable=0, warning/danger/unknown=1; send initial state once, then only binary changes. No automatic retries. --no-can disables reception and transmission.\nReplay uses recorded CAN only and never transmits.\nVisualization is enabled by default for live inference, recording and replay.\nContinuous camera inference; replay runs to EOF without a camera.\nH.264 sessions require a new recording directory. Stop with Ctrl+C or SIGTERM to finalize video.\n";std::exit(0);}}
    };
    for(int i=1;i<argc;++i){auto handler=arguments.find(argv[i]);if(handler==arguments.end())throw std::invalid_argument("Unknown option: "+std::string(argv[i]));handler->second(i);}

-    auto config=cms::loadConfig(configPath);config.output=output;
+    auto config=cms::loadConfig(configPath);config.output=output;config.record_session=recordSession;config.replay_session=replaySession;
+    if(disableCan)config.can.enabled=false;
    cms::CameraPipeline pipeline(config);
    cms::StopSignals signals(pipeline);
    pipeline.start();
@@ -40,7 +47,9 @@ int main(int argc,char** argv)try {
     */
    // Optional observer. Closing/failing the window never requests inference stop.
    if(visualize) {
-        try {cms::runLocalVisualization(pipeline);}
+        auto display=std::getenv("DISPLAY");auto wayland=std::getenv("WAYLAND_DISPLAY");
+        if((!display||!*display)&&(!wayland||!*wayland))std::cerr<<"No display session; inference continues without visualization.\n";
+        else try {cms::runLocalVisualization(pipeline);}
        catch(std::exception const& e){std::cerr<<"Visualization unavailable; inference continues: "<<e.what()<<std::endl;}
    }
    pipeline.join();
@@ -22,7 +22,26 @@ void segment(cv::Mat& image,cv::Point a,cv::Point b,cv::Scalar c,int thickness,b
    for(double x=0;x<length;x+=14)cv::line(image,cv::Point2d(a)+d*x,cv::Point2d(a)+d*std::min(x+8,length),c,thickness,cv::LINE_AA);
 }
 }
-cv::Mat renderResult(FrameResult const& r) {
+void renderCanOverlay(cv::Mat& canvas,CanSnapshot const& can) {
+    cv::rectangle(canvas,{0,148},{canvas.cols,262},{20,24,30},-1);
+    std::ostringstream header;
+    header<<"CAN 0x391 ACTUAL POSITION | "<<can.source<<" "<<can.status<<" | RX "<<can.received
+          <<" TX "<<can.transmitted<<" | errors RX "<<can.receive_errors<<" TX "<<can.transmit_errors;
+    cv::putText(canvas,header.str(),{24,174},cv::FONT_HERSHEY_SIMPLEX,.65,{235,235,235},2,cv::LINE_AA);
+    constexpr char const* labels[]={"LF","RF","LR","RR"};
+    auto channels=can.source=="replay"?can.channels.size():liveCanChannelCount;
+    for(std::size_t channel=0;channel<channels;++channel) {
+        auto const& s=can.channels[channel];std::ostringstream line;
+        line<<"CH"<<channel<<" "<<(s.valid?"LIVE":s.received?"STALE":"WAIT")<<"  ";
+        for(std::size_t i=0;i<4;++i) {
+            line<<labels[i]<<": ";if(s.positions[i]<0)line<<"--";else line<<s.positions[i];line<<"   ";
+        }
+        if(s.received)line<<"age "<<std::fixed<<std::setprecision(0)<<s.age_ms<<" ms  "<<(s.fd?"CANFD":"CAN")<<" #"<<s.received;
+        auto color=s.valid?cv::Scalar(80,220,90):cv::Scalar(0,190,255);
+        cv::putText(canvas,line.str(),{24,210+int(channel)*34},cv::FONT_HERSHEY_SIMPLEX,.72,color,2,cv::LINE_AA);
+    }
+}
+cv::Mat renderResult(FrameResult const& r,CanSnapshot const* liveCan) {
    if(!r.image)throw std::invalid_argument("Result has no frame image");
    auto const& image=*r.image;
    if(image.width<=0||image.height<=0||image.stride<image.width*3||image.pixels.size()<std::size_t(image.stride)*image.height)
@@ -75,6 +94,7 @@ cv::Mat renderResult(FrameResult const& r) {
    cv::putText(canvas,status.str(),{24,82},cv::FONT_HERSHEY_SIMPLEX,.72,{235,235,235},2,cv::LINE_AA);
    std::string calibration=r.door_mask_calibration_verified?"door calibration verified":"door calibration NOT verified (bring-up)";
    cv::putText(canvas,calibration+" | q/Esc: close preview",{24,123},cv::FONT_HERSHEY_SIMPLEX,.70,{0,190,255},2,cv::LINE_AA);
+    renderCanOverlay(canvas,liveCan?*liveCan:r.can);
    return canvas;
 }
 }
@@ -20,6 +20,30 @@ Json riskJson(RiskResult const& r) {
    return out;
 }
 }
+Json serializeCan(CanSnapshot const& s) {
+    Json out={{"source",s.source},{"status",s.status},{"received",s.received},{"transmitted",s.transmitted},
+        {"transmit_errors",s.transmit_errors},{"receive_errors",s.receive_errors},{"channels",Json::array()}};
+    for(auto const& c:s.channels)out["channels"].push_back({{"positions",c.positions},{"valid",c.valid},
+        {"received",c.received},{"received_monotonic_ns",c.received_monotonic_ns},{"device_timestamp_us",c.device_timestamp_us},
+        {"age_ms",c.age_ms},{"fd",c.fd},{"extended",c.extended}});
+    return out;
+}
+CanSnapshot deserializeCan(Json const& j) {
+    CanSnapshot s;s.source=j.at("source");s.status=j.at("status");
+    s.received=j.at("received");s.transmitted=j.at("transmitted");
+    s.transmit_errors=j.at("transmit_errors");s.receive_errors=j.at("receive_errors");
+    auto const& channels=j.at("channels");
+    if(!channels.is_array()||channels.size()!=2)throw std::runtime_error("Invalid recorded CAN channels");
+    for(std::size_t i=0;i<2;++i) {
+        auto const& v=channels[i];auto& c=s.channels[i];
+        if(!v.at("positions").is_array()||v.at("positions").size()!=4)throw std::runtime_error("Invalid recorded CAN positions");
+        c.positions=v.at("positions").get<std::array<int,4>>();
+        for(auto raw:c.positions)if(raw < -1||raw>255)throw std::runtime_error("Recorded CAN position out of range");
+        c.valid=v.at("valid");c.received=v.at("received");c.received_monotonic_ns=v.at("received_monotonic_ns");
+        c.device_timestamp_us=v.at("device_timestamp_us");c.age_ms=v.at("age_ms");c.fd=v.at("fd");c.extended=v.at("extended");
+    }
+    return s;
+}
 Json serializeResult(FrameResult const& r) {
    Json out={{"frame_index",r.frame_index},{"track_ids",r.track_ids},{"boxes",r.boxes},{"skeletons",Json::array()},{"risk",riskJson(r.risk)}};
    for(std::size_t i=0;i<r.persons.size();++i) {
@@ -38,6 +62,7 @@ Json serializeResult(FrameResult const& r) {
            skeleton["temporal_keypoints"].push_back({b.x,b.y,b.score});
        }
    }
+    out["can"]=serializeCan(r.can);
    out["timing"]={{"detector_ms",r.timing.detector_ms},{"pose_ms",r.timing.pose_ms},{"fusion_risk_ms",r.timing.fusion_risk_ms},{"capture_to_result_ms",r.timing.capture_to_result_ms}};
    out["capture"]={{"sequence",r.capture.driver_sequence},{"capture_monotonic_ms",r.capture.capture_monotonic_ns*1e-6},{"driver_timestamp_ms",r.capture.driver_timestamp_ns*1e-6}};
    out["capture_to_result_ms"]=rounded(r.timing.capture_to_result_ms,3);out["calibration_verified"]=r.door_mask_calibration_verified;return out;
@@ -3,6 +3,7 @@
 #include <opencv2/highgui.hpp>
 #include <opencv2/highgui/highgui_c.h>
 #include <opencv2/imgproc.hpp>
+#include <chrono>
 namespace cms {
 namespace { constexpr char windowName[]="CMS Camera Risk"; }
 void runLocalVisualization(CameraPipeline const& pipeline) {
@@ -11,9 +12,21 @@ void runLocalVisualization(CameraPipeline const& pipeline) {
        ~Window(){try{if(cvGetWindowHandle(windowName))cv::destroyWindow(windowName);}catch(...) {}}
    } window;
    FrameResultPtr shown;
+    auto nextRefresh=std::chrono::steady_clock::now();
    while(pipeline.running()) {
        auto result=pipeline.latest();
-        if(result&&result!=shown){cv::imshow(windowName,renderResult(*result));shown=std::move(result);}
+        auto now=std::chrono::steady_clock::now();
+        if(result!=shown||now>=nextRefresh) {
+            auto can=pipeline.canStatus();cv::Mat image;
+            if(result)image=renderResult(*result,&can);
+            else {
+                image=cv::Mat(800,1000,CV_8UC3,cv::Scalar(20,24,30));
+                cv::putText(image,"Waiting for inference...",{24,64},cv::FONT_HERSHEY_SIMPLEX,.8,{235,235,235},2);
+                renderCanOverlay(image,can);
+            }
+            cv::imshow(windowName,image);shown=std::move(result);
+            nextRefresh=now+std::chrono::milliseconds(100);
+        }
        int key=cv::waitKey(16)&0xff;
        if(key==27||key=='q'||key=='Q'||cvGetWindowHandle(windowName)==nullptr)return;
    }
@@ -0,0 +1,33 @@
+# 0x391 实际位置反馈与 CH0 单通道修复（2026-09-28）
+
+用户要求显示四门实际位置反馈，并明确不使用 CH1。本次保留 `0x391` 第 0/1/2/3 字节到 LF/RF/LR/RR 的无符号原始值映射，不改为门状态、不引入未经确认的百分比或角度换算。
+
+实时模式仅初始化、启动、接收和发送 CH0；拒绝向 CH1 调用发送 API，忽略合并接收中的 CH1 数据，画面仅显示 CH0，并标明 ACTUAL POSITION。历史会话的双通道快照结构与回灌显示保持兼容，`sendRisk()` 返回值第二槽固定为 false。
+
+## 实机现象与修复结果
+
+用户第一次确认左前门打开后，原始接收工具取得 CH0、CANFD、64 字节的 `0x391`，前四字节为 `1F 00 00 00`，即左前门反馈 31。由此确认实际位置字段映射有真实报文依据。
+
+修复前，真实摄像头/TensorRT 与原双通道风险发送同时运行时，接收计数长时间停顿；反馈年龄最高观察到约 5.84 秒。CH0 发送成功、CH1 发送失败，接收在发送等待期间停顿。仅将发送移到后台线程不能消除适配器发送等待对接收的影响。
+
+最终仅 CH0 版本在同一硬件上运行：10 秒采样内 RX 持续增长，TX 到 299、TX 错误为 0，各采样点保持 LIVE。用户再次确认左前门打开后，最终版同一进程显示实际位置 `26,0,0,0`，末次采样更新为 `25,0,0,0`，0x391 计数从 4 增至 33。显示层由相同 `renderResult()` 绘制，已检查 [CAN 画面裁剪](orin_391_overlay.png)，可见 LF 26，CH1 未显示。
+
+详细结果与运行二进制校验见 [实机结果](orin_391_results.json)。原始日志为 `/tmp/vap_391_open.log`，对照采样为 `/tmp/vap_391_after.log`，采样源码为 `/tmp/vap_391_pipeline.cpp`。
+
+## 本机模拟、板端故障注入、硬件覆盖
+
+- 本机模拟：`tests/run_can.sh`（UBSan、模拟 SDK）通过。检查 CH1 不初始化/配置/启动/重置/发送、CH1 输入不覆盖 CH0、实际位置更新、CAN/CANFD、过期恢复、单通道风险报文、发送失败与恢复、后台最新值覆盖、停止清理。
+- 本机模拟：`tests/run_session.sh` 通过，保持已有会话 CAN 快照兼容；构建与 `git diff --check` 通过。
+- 板端故障注入：未执行。本次未修改共享摄像头采集、停止或恢复逻辑。
+- 真实硬件：Orin 上使用既有 `/dev/video5`、TensorRT 引擎、USBCANFD-200U 与配置；用户操作左前门，验证实际位置进入推理期间的实时显示。采样程序调用画面绘制，未运行 GUI 事件循环；正式程序另按原命令 `./run_camera.sh` 启动验证。
+- 未覆盖：其余三扇门逐一动作、长期运行、CH0 断开/缺失 ACK、独立总线分析仪验证风险报文。接收错误计数仍增长（画面记录 RX errors 5801），本次未确定该总线错误的原因，不能宣称总线无错误。
+
+## 部署与版本
+
+最终运行 `/proc/<pid>/exe`、`build/camera_risk` 和 `orin/build/camera_risk` SHA256 一致：
+
+`418637a35f6ad05441578db1333e15714262a9c0ee088f10c2dd84923471cd0f`
+
+独立包可执行文件已更新，`orin/SHA256SUMS` 已刷新并完整校验。正式程序使用原命令 `./run_camera.sh`，SIGTERM 后约 0.868 秒退出、退出码 0。测试前未发现常驻 camera_risk，测试后没有保留临时采样进程；没有修改原启动参数。
+
+硬件验证时，本机即 Orin 工作区，检出 `inference-only`，HEAD 为 `515a9f32d8c0ebf83503d4d240ffe917dc09950c`；本次联网读取 Git 远端 `inference-only` 为 `0192fccbf06cb928eac098b3dfad32abf0fc370d`。上述硬件验证在未提交工作区进行。经用户要求，最终修复、后台风险发送、部署产物及验证记录一并纳入本报告所在提交；Git 远端尚未推送同步。以上二进制哈希标识已验证的本地部署产物。
@@ -0,0 +1,32 @@
+# CAN 收发与 0x391 显示实现记录（2026-09-24）
+
+范围：仅当前 `inference-only` 分支。用户明确当前并非真实 CAN 环境，接收实测暂不验证；真实 CAN 接收和发送均未验收。
+
+## 已完成的模拟和离线检查
+
+- `tests/run_can.sh`：UBSan + 模拟 SDK，无硬件访问。覆盖四个连续字节独立解析、双通道隔离、CAN/CANFD 数据帧、过期与恢复、无关 ID / 短报文不刷新状态、按需发送编码、非法 ID/通道/长度/BRS、发送失败、接收错误、缺失适配器、部分初始化失败清理、设备单一所有权和停止后拒绝发送。
+- `tests/run_session.sh`：人工图像 H.264 往返与过程记录，新增 CAN 快照保存/读取检查，四门值、有效状态与年龄保持不变。
+- 静态可视化检查：人工构造 CH0 LIVE、CH1 STALE 快照，四门不同值均可见，显示收发计数和报文年龄，未读取任何 CAN 设备。临时图 `/tmp/vap_can_overlay.png`。
+- 源码构建通过，SDK 和 libusb 从独立包加载，配置和 `--no-can` 接入完成。
+
+以上均不能代替真实 CAN 总线验证。
+
+## 已执行的 Orin 摄像头 / TensorRT 检查
+
+在用户要求暂停 CAN 实测前执行过 `tests/orin_session_test.py`，测试目录 `/tmp/vap-can-hardware-20260924/`。当时 USB 节点为 `root:root 0664`，SDK 打开失败，状态为 UNAVAILABLE，实际接收数为 0。
+
+在这一缺失 CAN 的回退条件下，真实 `/dev/video5` 与 TensorRT 完成 13 帧 H.264 录制、13 帧完整回灌，CAN UNAVAILABLE 快照在回灌中保持一致并标记 `source=replay`。13 帧检测到人员；跟踪 ID 一致 13/13，风险决策一致 8/13。有损视频产生姿态/风险差异，不能把视频回灌解释为算法输出逐位相同。SIGTERM 退出 1.317 秒，回灌 SIGINT 退出 0.916 秒。完整原始结果在 `orin_can_results.json`。
+
+此项仅证明真实摄像头/TensorRT、无 CAN 回退、状态录制/回灌及停止，不证明 CAN 收发。
+
+## 设备访问准备与延期项目
+
+已读取 USB 描述确认 `3068:0009` 为 ZLG USBCANFD-200U。经批准安装仅针对该 VID/PID 的 udev 规则，将设备设为 `root:plugdev 0660`；orin 原已属于 plugdev。规则及安装脚本均纳入独立包。权限修复后的接收测试被用户取消，未启动；后续没有再打开适配器接收或发送报文。
+
+未验证实际总线 `0x391` 布局/物理单位、CAN/CANFD 真实发送或 ACK、双通道接线、波特率/终端电阻与实车匹配、硬件断开重连、长时间运行。没有新增板端故障注入或物理拔插操作。发送仅提供按需 C++ API，未定义或自动发送任何业务控制报文。
+
+## 部署校验
+
+本次程序 SHA256：`e8788d22fd6db0e3b9edc95a02322a51ca7951e1df81fea10f34db7da3143461`。
+
+权限修复前的板端测试核对过 `/proc/<pid>/exe` 与源码构建文件一致。更新独立包时核对源码构建与 `orin/build/camera_risk` 哈希一致，并刷新 `orin/SHA256SUMS`（包含 SDK 库及 SONAME 链接）。用户要求暂不验证接收后，仅做文件和依赖校验，不再启动 CAN 测试进程。测试前没有常驻推理进程，没有修改既有启动参数。
@@ -0,0 +1,25 @@
+# CAN CH1 发送切换（2026-09-29）
+
+实时 CAN 改为 CH0 只接收、CH1 只发送。CH0 与 CH1 都使用 60 MHz 时钟、仲裁域 500 kbps、数据域 2 Mbps，并随设备生命周期一同初始化、启动和复位；合并接收仍由 CH0 的单一接收线程执行，收到的 CH1 数据被忽略。自动风险报文和按需 `sendCan()` 均只允许 CH1，CH0 发送参数会抛出 `std::invalid_argument`。
+
+风险协议未改变：标准 CAN `0x1F6`、DLC 8，首字节 `clear=0x00`，其余状态 `0x11`，后七字节清零；首次状态发送一次，之后仅在二值状态变化时发送。摄像头采集、停止恢复、0x391 解析和实时画面只显示 CH0 的行为未改动。
+
+## 本机模拟回归
+
+`tests/run_can.sh` 通过（模拟 SDK + UBSan）。测试桩强制要求 CH0/CH1 均完成初始化、终端电阻配置、启动和复位，所有经典 CAN/CANFD 发送调用必须使用 CH1；覆盖 CH0 接收及 CH1 输入忽略、按需发送校验、风险变化触发、发送失败、阻塞合并和停止清理。`tests/run_session.sh` 通过，会话兼容性未受影响；完整 CMake 构建和 `git diff --check` 通过。
+
+## Orin 真实硬件验证
+
+使用当前 Orin 的 `/dev/video5`、TensorRT 引擎、USBCANFD-200U 和原 `config/camera.json`，以 `./run_camera.sh --no-visualize --save-results` 运行 12 秒。SDK 识别到双通道适配器并打印 `CH0 receive, CH1 transmit`；产生 260 个结果 JSON，末次快照为 CAN `OPEN`、CH1 成功发送 1 帧、发送错误 0，CH0 的 `0x391` 计数为 11，证明摄像头/TensorRT 推理、CH0 接收和 CH1 SDK 发送可在同一进程继续运行。
+
+本次未进行板端故障注入或物理拔插，没有人为触发风险 0/1 变化，也未使用独立总线分析仪或 CH1 接收节点核验线上 `0x1F6` 的电气载荷与 ACK。因此“CH1 线上报文已被对端接收”仍未覆盖，不能由 SDK 成功计数替代。测试前无常驻 `camera_risk`，测试结束恢复为无常驻进程；原配置和启动脚本未修改。
+
+详细计数与版本见 [实机结果](orin_ch1_tx_results.json)。
+
+## 部署核对
+
+源码构建 `build/camera_risk` 与独立包 `orin/build/camera_risk` SHA256 一致：
+
+`feca0b7f476171f45489c22f11a51ba1fe0dabe2d9a17bfcdc50110d1afdb276`
+
+独立包已运行 `sha256sum -c orin/SHA256SUMS` 并全部通过。当前检出分支为 `inference-only`，HEAD `f87e5aad40478824da16eb42c76b40383de3a9a1`；修改位于未提交工作区。联网只读核对远端 `inference-only` 为 `0192fccbf06cb928eac098b3dfad32abf0fc370d`，本次未创建提交或推送远端。
@@ -0,0 +1,41 @@
+# 实时摄像头 FPS 修复（2026-09-28）
+
+> 以下为后台双通道发送与 FPS 修复阶段的历史验证记录，通道、二进制哈希与 Git 状态均指当时版本。最终 CH0 单通道实现和实机结果见 [0x391 修复记录](ORIN_391_REPORT.md)。
+
+用户通过默认 `./run_camera.sh` 运行实时摄像头时卡顿。原因已在宿主 Orin 复现：`inferenceLoop()` 同步发送 CH0、CH1 的 `0x1F6`，SDK 发送失败路径两通道合计等待约 3 秒，使结果发布和后续推理一起停顿。
+
+## 真实硬件对照
+
+设备：Jetson AGX Orin、`/dev/video5` 1920×1536 30 FPS、现有 YOLO/RTMW TensorRT 引擎、ZLG USBCANFD-200U。保留配置、模型、CAN 波特率和终端电阻设置；未调整功耗或时钟。
+
+使用链接相应版本 `camera_risk_core` 的临时采样程序，各运行约 15 秒，按实际 published 结果增量计算 FPS，并调用 `renderResult()` 绘制。该指标为真实推理输出吞吐，非相机配置 FPS；采样程序不调用 GUI 的 imshow/waitKey，不录制、不保存图片。
+
+| 路径 | 稳定输出 | 风险融合及发送阶段 | 结果延迟 | CAN 状态 |
+|---|---|---|---|---|
+| 修复前，同步双通道 CAN | 约 0.33 FPS | 3016–3019 ms/帧 | 随积压升至约 12 秒 | OPEN，TX=0，发送错误递增 |
+| 修复前，仅对照关闭 CAN | 29.93–30.00 FPS | 约 5–6.6 ms/帧 | 约 42–46 ms | DISABLED |
+| 修复后，后台双通道 CAN | 29.97–30.00 FPS | 约 6–6.9 ms/帧 | 约 46–50 ms | OPEN，TX=0，发送错误递增 |
+
+首秒包含启动过渡，后两组约 27 FPS，不纳入稳定区间。画面绘制约 19 ms/帧。另做真实 TensorRT 视频回灌参考采样约 43–48 FPS，不能代替实时摄像头验证。
+
+## 修改与模拟回归
+
+实时推理改用 `queueRisk()`，不等待 SDK。独立发送线程处理一对双通道帧，最多保留一个待发风险，新的覆盖尚未发送的旧结果；没有无限队列或定时旧值重发。`0x1F6`、DLC 8、`clear→0x00`/其他→`0x11` 和后七字节清零的协议保持不变。按需 `sendCan()` 仍是同步接口。
+
+停止时清空待发风险，唤醒后台线程，等待正在执行的 SDK 调用返回，再释放设备；不持有 SDK 生命周期锁等待发送线程，避免死锁。CAN 快照反映已完成的发送，不保证包括当前推理帧。
+
+`tests/run_can.sh`（模拟 SDK + UBSan）通过，新增阻塞发送期间 1000 次提交、最新结果替换、双通道、失败和停止清理覆盖；构建及 `git diff --check` 通过。未进行板端故障注入。
+
+## 正式程序和文件核对
+
+经宿主进程检查确认测试前没有 `camera_risk`，最后按原命令 `./run_camera.sh` 启动正式程序，运行约 12 秒后 SIGTERM，退出码 0、停止约 1.267 秒。未改启动参数；测试后确认没有遗留进程。记录位于 `/tmp/vap-fps-default-verification.json` 和 `/tmp/vap-fps-default-run.log`；临时采样源码为 `/tmp/vap_fps_probe.cpp`。
+
+实际 `/proc/<pid>/exe`、`build/camera_risk`、`orin/build/camera_risk` SHA256 均为：
+
+`a84680513aa61fb2af353f97e6369bbef80c9f12521ecd88454e72fcecab447f`
+
+独立包 SHA256SUMS 已刷新并完整校验。修改留在本地工作区，未提交/推送；版本引用详情见 [风险发送记录](RISK_CAN_REPORT.md)。
+
+## 未覆盖项
+
+物理 CAN 发送依然失败，本次只确认该等待已与推理解耦，未确认 ACK、线缆、接收端或总线配置的故障原因。未使用独立总线分析仪验收线上载荷，也未测试物理断连重连或长期耐久。当前场景约 30 FPS 不代表任意人数/场景都能达到同样吞吐。
@@ -0,0 +1,27 @@
+# CAN 风险变化触发发送（2026-09-28）
+
+实时自动发送仍仅使用 CH0、标准 CAN `0x1F6`、8 字节；首字节 `clear=0x00`，其余状态 `0x11`，后七字节清零。首个风险状态尝试发送一次，之后仅在报文的二值风险变化时发送。`watch/warning/danger/unavailable` 间切换不重复发送。
+
+后台最多保留最新待发状态。发送 A 期间若状态 A→B→A，取消冗余的待发 A；短暂中间状态可能被合并。发送失败计入错误，不随后续相同状态重试，也无周期重发；发生新的二值变化才触发后续发送。显式按需 `sendCan()` / `sendRisk()` 保持调用即尝试发送的接口语义。摄像头采集、停止恢复和 0x391 解析未改动。
+
+## 本机模拟回归
+
+`tests/run_can.sh` 通过（模拟 SDK + UBSan）。新增首次 clear、首次非 clear、1000 次相同状态去重、不同非 clear 等级去重、0/1 往返、失败后相同状态不重试、新变化恢复发送、发送阻塞期间回到原状态不重复发帧，以及后续 clear 不丢失。原有收发、CH0 限制、过期恢复、最新状态合并和停止回归通过。构建与 `git diff --check` 通过。
+
+## 真实硬件验证
+
+使用 Orin 现有摄像头、TensorRT 引擎、USBCANFD 和原配置。12 秒产生 357 个推理结果，观测风险始终为 `unavailable`（二值 1），CH0 成功发送 1 帧，发送错误为 0；0x391 接收计数持续增长至 15。证明稳定风险不会随每个推理结果重复发送，推理与位置反馈接收持续工作。
+
+本次未进行板端故障注入或物理拔插，未人为向实车注入伪造风险状态。实机场景没有发生风险 0/1 切换，变化载荷和失败路径由本机模拟回归覆盖；尚未以独立总线分析仪核验线上报文，未覆盖长期运行或接收端重启后状态重新同步。不能把模拟切换测试当作真实场景风险切换验证。
+
+采样源码 `/tmp/vap_risk_change_probe.cpp`，原始日志 `/tmp/vap_risk_change_probe.log`。详细计数与版本见 [实机结果](orin_risk_change_results.json)。
+
+## 部署核对
+
+另按原命令 `./run_camera.sh` 启动正式程序；SIGTERM 后约 0.919 秒退出，退出码 0。测试前无常驻 camera_risk，测试结束恢复无常驻进程状态，未修改启动参数。
+
+运行中 `/proc/<pid>/exe`、源码构建 `build/camera_risk`、独立包 `orin/build/camera_risk` SHA256 一致：
+
+`5fa01c08baf73b1e044288b5e85f753c10f10d7cc9559ff25952bc4618f01899`
+
+独立包已更新并刷新 `orin/SHA256SUMS`。硬件验证时本机即 Orin，检出 `inference-only`，HEAD 为 `f87e5aad40478824da16eb42c76b40383de3a9a1`，当时修复位于未提交工作区。经用户要求，最终修改和验证记录纳入本报告所在本地提交。验证时联网核对远端 `inference-only` 为 `0192fccbf06cb928eac098b3dfad32abf0fc370d`，未推送本次修改。
@@ -0,0 +1,45 @@
+# H.264 推理过程录制与回灌验证（2026-09-24）
+
+范围：按本次要求，仅修改 `inference-only`。测试直接在当前 `orin-desktop` 的 Jetson Orin 上执行；真实 `/dev/video5`，1920×1536 UYVY，L4T R35.4.1，CUDA 11.4，TensorRT，OpenCV 4.5.4 / FFmpeg H.264。未使用 SSH。
+
+## 本机模拟与编解码回归
+
+- `tests/run_session.sh`：实际 H.264 编码/解码，使用人工图像及模拟结果，不加载 TensorRT。覆盖有步长的 BGR 输入、视频帧顺序、帧号间隔、配置恢复、原始时间戳保留、编码器刷新、正常 EOF、空会话、拒绝覆盖、缺失 JSON、非法/截断索引、不完整会话和奇数尺寸。启用 UBSan。
+- `tests/run_camera_timeout.sh`：模拟 V4L2 采集；通过超时重试、有效帧后重新计数、第六次超时失败与主动停止回归。此项不是本次真实硬件故障恢复的证明。
+
+## 真实摄像头与 TensorRT
+
+脚本：`tests/orin_session_test.py`。完整数据见 `orin_session_results.json`。
+
+| 项目 | 结果 |
+|---|---|
+| 摄像头录制 | 13 个完成推理的帧，H.264 / MP4，1920×1536 |
+| 视频体积 | 303,989 字节；同帧数未压缩 BGR 为 115,015,680 字节，约缩小 378 倍，仅代表本次静态场景 |
+| 完整回灌 | 13/13 帧，顺序与原帧号一致，原始采集元数据保留，EOF 正常退出 |
+| 结果检查 | 13/13 跟踪 ID 与风险决策一致；本次无检测到的人员 |
+| 录制期间 SIGTERM | 1.417 秒完整退出，视频封装成功 |
+| 回灌期间 SIGINT | 0.865 秒完整退出，保存 2 帧后停止，视频封装成功 |
+| 实际运行程序核对 | `/proc/<pid>/exe` 与源码构建二进制 SHA256 相同 |
+
+实机首次测试发现：若在 `CameraPipeline` 构造期间打开视频解码器，FFmpeg 工作线程可能在 `StopSignals` 安装前创建，SIGINT 可直接终止进程。已将解码器打开操作移至继承信号掩码的采集线程，修复后重跑上述实机测试全部通过。
+
+测试前没有 `camera_risk` 进程，未更改既有启动参数；测试脚本仅管理自己启动的进程，测试后不留下常驻进程。原始视频、逐帧记录与日志在 `/tmp/vap-video-session-hardware-20260924-fixed/`，不提交摄像头图像。
+
+## 板端故障注入与范围限制
+
+本次未做板端 V4L2 故障注入或物理拔线操作；共享相机恢复实现保持原样，其既有硬件报告见 `ORIN_TEST_REPORT.md`，不能视作本次新增功能的实测覆盖。当前实机画面没有检测到人员，RTMW 完成初始化/预热，但未覆盖有人员的逐帧姿态推理、遮挡隔离推理或风险变化；报告中的关键点差异为 0 不代表有人员场景的精度结论。
+
+未覆盖 GUI 预览、GPU 故障、磁盘写满、断电/强杀后的媒体恢复、长时间录制与 NVENC/NVDEC 硬件编解码。当前为软件 H.264 编解码；强杀留下的未完成会话按设计拒绝回灌。
+
+## 经测试的程序 SHA256
+
+`0f178057529eb8be44bb9a639504dfe57a1e353a84d2351fd907304f6d951c11`
+
+独立包 `orin/build/camera_risk` 已更新，`orin/SHA256SUMS` 全部校验通过。使用独立包实际运行并完整回灌 13 帧，再次核对 `/proc/<pid>/exe` 与上述哈希一致；部署检查日志位于 `/tmp/vap-video-session-deployment-20260924/`。测试结束恢复原来的无常驻进程状态。
+
+
+## 默认开启可视化补充验证（2026-09-24）
+
+实时推理、录制和回灌默认显示全部现有叠加；新增 `--no-visualize`，无显示环境自动跳过预览。已在 Orin 的真实桌面上通过 X11 窗口列表确认默认创建 `CMS Camera Risk` 窗口，并使用更新后的独立包完成真实摄像头 13 帧录制、13 帧完整回灌、录制 SIGTERM（1.267 秒）及回灌 SIGINT（0.916 秒）检查。另验证 `--no-visualize` 和清除 DISPLAY / WAYLAND_DISPLAY 后均能正常完成 TensorRT 回灌。
+
+新二进制 SHA256：`cd9711d71c6d04f40adf9434f893abe1744e9e2013f1459ddf736a80dcbbfd64`。源码构建文件、独立包文件及 `/proc/<pid>/exe` 一致；`orin/SHA256SUMS` 已刷新。完整数据在 `orin_session_results.json` 的 `default_visualization` 中，日志位于 `/tmp/vap-default-preview-20260924/`。此次未重复模拟采集和板端故障注入；仍未覆盖有人员时的关键点显示、窗口按钮/键盘关闭操作。测试前后均无常驻推理进程。
@@ -0,0 +1,27 @@
+# 0x1F6 二值风险发送检查（2026-09-28）
+
+> 以下为双通道风险发送阶段的历史验证记录，通道、二进制哈希与 Git 状态均指当时版本。最终 CH0 单通道实现和实机结果见 [0x391 修复记录](ORIN_391_REPORT.md)。
+
+实现位于当前 `inference-only` 工作区：每个新的实时推理结果提交给后台 CAN 发送线程，在 CH0、CH1 各尝试发送一帧标准 CAN 数据报文，ID `0x1F6`、DLC 8。首字节 bit0–3 和 bit4–7 同时填写相同风险值，`clear` 时各为 0，其他状态（含无人或证据不足时的 `unavailable`）各为 1，即首字节为 `0x00` 或 `0x11`，后七字节清零。最多保留一个待发结果，忙时由最新结果替换，不保证每个推理帧都上总线。回灌和禁用 CAN 时不自动发送，没有独立周期或旧结果重发。
+
+## 本机模拟与构建
+
+- `./tests/run_can.sh` 通过（UBSan、模拟 ZLG SDK）：覆盖 clear/watch/warning/danger/unavailable/未知/空状态、高低四位相同赋值、恢复 clear 后两者同时清零、标准帧标志、ID、DLC、完整载荷、每结果双通道各一帧、任一通道失败不影响另一通道尝试、收发计数、停止和禁用后不访问发送 API。
+- 后台发送补充回归通过：模拟 SDK 阻塞时可连续提交 1000 个新风险并读取快照；释放阻塞后仅发送正在处理及最新待发的两对报文，没有旧结果积压；停止时丢弃待发结果，等待 SDK 返回后释放设备。单通道失败不抑制另一通道发送。
+- `./tests/run_session.sh` 通过：人工图像的 H.264 编解码、录制/回灌顺序、CAN 快照保存、停止收尾与损坏数据检查。这不是摄像头/TensorRT 验证，也不证明实际推理循环的总线发送。
+- `cmake --build build -j2` 通过；`git diff --check` 通过。
+- `--help` 显示新的发送规则并返回 0；SDK 初始化同时报告 NvRmMem/Nvmap 设备不可用，不能据此声称 GPU 推理可运行。
+
+## 板端故障注入与真实硬件操作
+
+后续经授权在宿主 Orin 上完成真实摄像头、TensorRT 和 USB-CAN 性能对照。原同步发送路径约 0.33 FPS，SDK 双通道等待约 3 秒且均失败；改为后台发送后约 30 FPS，CAN 仍报告发送失败。详见 [FPS 修复记录](ORIN_FPS_REPORT.md)。未进行板端故障注入或物理拔插。未修改启动配置和参数，测试前后均无常驻程序。
+
+未覆盖：真实总线成功发送与 ACK、双通道线上载荷、回灌时物理总线无发送、断连重连、长期运行。模拟通过及 FPS 恢复不代表这些项目已验收。
+
+## 文件同步与版本状态
+
+已更新工作区独立包 `orin/build/camera_risk`，刷新 `orin/SHA256SUMS`，完整清单校验通过；源码构建文件与独立包二进制 SHA256 相同：
+
+`a84680513aa61fb2af353f97e6369bbef80c9f12521ecd88454e72fcecab447f`
+
+本次改动未提交、未推送，未进行 Git 发布。当前本地 HEAD 为 `515a9f32d8c0ebf83503d4d240ffe917dc09950c`；本地保存的 `origin/inference-only` 引用为 `0192fccbf06cb928eac098b3dfad32abf0fc370d`，未联网核对远端最新值。未修改共享采集、相机停止或恢复逻辑；其他两分支没有本次修改的 `src/can_bus.cpp`，未同步。已按原命令 `./run_camera.sh` 启动正式程序，核对 `/proc/<pid>/exe`、构建文件和独立包哈希一致，SIGTERM 约 1.267 秒正常退出，恢复测试前无常驻进程状态。
@@ -0,0 +1,249 @@
+#include "can_bus.hpp"
+#include "zcan.h"
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <deque>
+#include <iostream>
+#include <mutex>
+#include <stdexcept>
+#include <thread>
+#include <limits>
+
+namespace {
+using namespace std::chrono_literals;
+std::mutex mutex;
+std::condition_variable changed;
+std::deque<ZCANDataObj> incoming;
+std::atomic<int> opens{0},closes{0},initializations{0},starts{0},resets{0},terminationCalls{0},mergeCalls{0},txCalls{0},rxCalls{0};
+std::atomic<bool> unavailable{false},initFailure{false},receiveFailure{false},txFailure{false};
+ZCAN_20_MSG sentCan{};ZCAN_FD_MSG sentFd{};
+std::vector<ZCAN_20_MSG> sentCanFrames;
+int failedTxChannel=-1;
+std::mutex txMutex;
+std::condition_variable txWake;
+std::atomic<bool> blockTx{false},txBlocked{false};
+void check(bool ok,char const* message){if(!ok)throw std::runtime_error(message);}
+template<class F> void waitFor(F f) {
+    auto deadline=std::chrono::steady_clock::now()+2s;
+    while(!f()){check(std::chrono::steady_clock::now()<deadline,"Asynchronous CAN condition timed out");std::this_thread::sleep_for(1ms);}
+}
+template<class F> void rejects(F f){bool failed=false;try{f();}catch(std::exception const&){failed=true;}check(failed,"Expected rejection");}
+void reset() {
+    opens=closes=initializations=starts=resets=terminationCalls=mergeCalls=txCalls=rxCalls=0;
+    unavailable=initFailure=receiveFailure=txFailure=false;
+    sentCanFrames.clear();failedTxChannel=-1;
+    blockTx=false;txBlocked=false;
+    std::lock_guard<std::mutex> lock(mutex);incoming.clear();
+}
+void inject(unsigned channel,bool fd,std::uint32_t id,std::initializer_list<std::uint8_t> bytes,unsigned stamp=123) {
+    ZCANDataObj obj{};obj.chnl=channel;obj.dataType=fd?ZCAN_DT_ZCAN_CANFD_DATA:ZCAN_DT_ZCAN_CAN_DATA;
+    auto& hdr=fd?obj.data.zcanCANFDData.hdr:obj.data.zcanCANData.hdr;
+    hdr.id=id;hdr.chn=channel;hdr.len=bytes.size();hdr.ts=stamp;
+    auto* data=fd?obj.data.zcanCANFDData.dat:obj.data.zcanCANData.dat;
+    std::copy(bytes.begin(),bytes.end(),data);
+    {std::lock_guard<std::mutex> lock(mutex);incoming.push_back(obj);}changed.notify_all();
+}
+}
+extern "C" {
+U32 VCI_OpenDevice(U32 type,U32,U32){check(type==33,"Device type changed");++opens;return unavailable?0:1;}
+U32 VCI_CloseDevice(U32,U32){++closes;return 1;}
+U32 VCI_InitCAN(U32,U32,U32 port,ZCAN_INIT* init){
+    check(port<2,"Unexpected CAN channel initialized");++initializations;
+    check(init->clk==60000000&&init->mode==0&&init->aset.brp==5&&init->dset.brp==1,"Reference timing not retained");
+    return initFailure?0:1;
+}
+U32 VCI_SetReference(U32,U32,U32 port,U32 ref,void* data){
+    check(port<2,"Unexpected CAN channel configured");
+    if(ref==CMD_CAN_TRES){check(*static_cast<U32*>(data)==1,"Invalid termination configuration");++terminationCalls;}
+    else if(ref==ZCAN_CMD_SET_CHNL_RECV_MERGE){check(port==0&&*static_cast<U32*>(data)==1,"Invalid merged receive configuration");++mergeCalls;}
+    else check(false,"Unexpected CAN reference configuration");
+    return 1;
+}
+U32 VCI_StartCAN(U32,U32,U32 port){check(port<2,"Unexpected CAN channel started");++starts;return 1;}
+U32 VCI_ResetCAN(U32,U32,U32 port){check(port<2,"Unexpected CAN channel reset");++resets;return 1;}
+U32 VCI_ReceiveData(U32,U32,U32 port,ZCANDataObj* out,U32 capacity,U32){
+    check(port==0,"Multiple merged receive readers");++rxCalls;
+    if(receiveFailure)return std::numeric_limits<U32>::max();
+    std::unique_lock<std::mutex> lock(mutex);
+    changed.wait_for(lock,10ms,[]{return !incoming.empty();});
+    U32 count=0;while(!incoming.empty()&&count<capacity){out[count++]=incoming.front();incoming.pop_front();}return count;
+}
+U32 VCI_Transmit(U32,U32,U32 port,ZCAN_20_MSG* message,U32 count){
+    check(port==1&&count==1&&port==message->hdr.chn,"CAN send did not use CH1");++txCalls;sentCan=*message;
+    {
+        std::unique_lock<std::mutex> lock(txMutex);sentCanFrames.push_back(*message);
+        if(blockTx) {
+            txBlocked=true;txWake.notify_all();
+            if(!txWake.wait_for(lock,2s,[]{return !blockTx.load();}))throw std::runtime_error("Test send gate timed out");
+        }
+    }
+    return txFailure||int(port)==failedTxChannel?0:1;
+}
+U32 VCI_TransmitFD(U32,U32,U32 port,ZCAN_FD_MSG* message,U32 count){
+    check(port==1&&count==1&&port==message->hdr.chn,"CANFD send did not use CH1");++txCalls;sentFd=*message;return txFailure?0:1;
+}
+}
+int main()try {
+    using namespace cms;
+    reset();{
+        CanConfig c;c.enabled=false;CanBus bus(c);bus.start();
+        check(bus.snapshot().status=="DISABLED"&&!bus.send({1,0x123,false,false,false,{1,2}}),"Disabled CAN used hardware");
+    }check(opens==0,"Disabled CAN opened device");
+    reset();unavailable=true;{
+        CanBus bus({});bus.start();check(bus.snapshot().status=="UNAVAILABLE","Missing adapter not reported");
+    }check(closes==0,"Closed unopened device");
+    reset();initFailure=true;{
+        CanBus bus({});bus.start();check(bus.snapshot().status=="UNAVAILABLE","Partial failure not reported");
+    }check(closes==1&&resets==0,"Partial initialization leaked device");
+    reset();{
+        CanConfig c;c.timeout_ms=150;CanBus bus(c);bus.start();
+        check(initializations==2&&starts==2&&terminationCalls==2&&mergeCalls==1,
+              "CH0/CH1 initialization or merged receive configuration is wrong");
+        CanBus duplicate(c);rejects([&]{duplicate.start();});
+        inject(0,false,0x391,{1,37,128,255},123);
+        waitFor([&]{return bus.snapshot().received==1;});
+        check(bus.snapshot().channels[0].positions==std::array<int,4>{1,37,128,255},"Four byte positions overlap");
+        inject(1,true,0x391,{99,99,99,99},789);
+        inject(0,true,0x391,{31,25,76,100},456);
+        waitFor([&]{return bus.snapshot().received==2;});
+        auto s=bus.snapshot();
+        check(s.channels[0].positions==std::array<int,4>{31,25,76,100},"Actual positions not refreshed");
+        check(s.channels[1].received==0&&!s.channels[1].valid&&s.channels[1].positions==std::array<int,4>{-1,-1,-1,-1},"CH1 input accepted");
+        check(s.channels[0].valid&&s.channels[0].fd&&s.channels[0].device_timestamp_us==456,"Freshness/frame metadata wrong");
+        auto timestamp=s.channels[0].received_monotonic_ns;
+        inject(0,false,0x390,{9,9,9,9});inject(0,false,0x391,{99,99,99});
+        waitFor([&]{return bus.snapshot().received==4;});
+        s=bus.snapshot();check(s.channels[0].received_monotonic_ns==timestamp&&s.receive_errors==1,"Invalid input refreshed signal");
+        waitFor([&]{return !bus.snapshot().channels[0].valid;});
+        inject(0,false,0x391,{0,1,2,3});waitFor([&]{return bus.snapshot().channels[0].valid;});
+        check(bus.send({1,0x321,false,false,false,{1,2,3}}),"CAN send failed");
+        check(sentCan.hdr.len==3&&!sentCan.hdr.inf.sef&&sentCan.dat[2]==3,"CAN encoding incorrect");
+        CanFrame fd{1,0x12345,true,true,true,std::vector<std::uint8_t>(64,0xa5)};
+        check(bus.send(fd)&&sentFd.hdr.len==64&&sentFd.hdr.inf.brs&&sentFd.hdr.inf.sef&&sentFd.dat[63]==0xa5,"CANFD encoding incorrect");
+        fd.data.resize(9);rejects([&]{bus.send(fd);});
+        rejects([&]{bus.send({0,0x391,false,false,false,{}});});
+        rejects([&]{bus.send({1,0x800,false,false,false,{}});});
+        rejects([&]{bus.send({1,0x391,false,false,true,{}});});
+        txFailure=true;check(!bus.send({1,0,false,false,false,{}}),"SDK send failure ignored");
+        check(bus.snapshot().transmitted==2&&bus.snapshot().transmit_errors==1,"TX counters wrong");
+        receiveFailure=true;waitFor([&]{return bus.snapshot().status=="ERROR";});
+        check(!bus.snapshot().channels[0].valid&&!bus.send({1,0,false,false,false,{}}),"Receive error left bus live");
+        bus.requestStop();bus.join();check(closes==1&&resets==2,"Shutdown did not release CH0 and CH1");
+        check(!bus.send({1,0,false,false,false,{}}),"Transmission after stop");
+    }check(closes==1,"Device closed twice");
+    reset();{
+        CanBus bus({});bus.start();
+        for(auto level:{"clear","watch","warning","danger","unavailable","unknown","","clear"}) {
+            auto sent=bus.sendRisk(level);
+            check(sent==std::array<bool,2>{false,true},"Risk must use CH1 only");
+        }
+        check(sentCanFrames.size()==8,"Risk must send exactly once per channel per result");
+        for(std::size_t i=0;i<sentCanFrames.size();++i) {
+            auto const& message=sentCanFrames[i];
+            check(message.hdr.id==0x1f6&&message.hdr.len==8&&message.hdr.chn==1,
+                  "Risk ID, DLC or channel incorrect");
+            check(!message.hdr.inf.fmt&&!message.hdr.inf.sef&&!message.hdr.inf.brs&&!message.hdr.inf.sdf,
+                  "Risk must use a standard classic CAN data frame");
+            check(message.dat[0]==(i==0||i==1||i==4||i==7?0x00:0x11),
+                  "Risk must encode clear, watch and unavailable as zero in both nibbles");
+            for(int byte=1;byte<8;++byte)check(message.dat[byte]==0,"Risk reserved bits not zero");
+        }
+        failedTxChannel=1;
+        check(bus.sendRisk("danger")==std::array<bool,2>{false,false},"CH1 failure reported success");
+        failedTxChannel=-1;
+        check(bus.sendRisk("clear")==std::array<bool,2>{false,true},"CH1 did not recover after send failure");
+        check(bus.snapshot().transmitted==9&&bus.snapshot().transmit_errors==1,"Risk TX counters wrong");
+        auto calls=txCalls.load();bus.requestStop();
+        check(bus.sendRisk("danger")==std::array<bool,2>{false,false}&&txCalls==calls,"Risk sent after stop");
+    }
+    reset();{
+        CanConfig c;c.enabled=false;CanBus bus(c);bus.start();
+        check(bus.sendRisk("danger")==std::array<bool,2>{false,false}&&txCalls==0&&opens==0,
+              "Disabled risk send accessed hardware");
+        check(!bus.queueRisk("danger"),"Disabled bus accepted asynchronous risk");
+    }
+    reset();{
+        CanBus bus({});check(!bus.queueRisk("danger"),"Unstarted bus accepted risk");bus.start();
+        // A blocked hardware SDK call must not stall inference submission or snapshots.
+        blockTx=true;check(bus.queueRisk("danger"),"Risk queue rejected ready bus");
+        waitFor([]{return txBlocked.load();});
+        auto start=std::chrono::steady_clock::now();
+        for(int i=0;i<1000;++i)check(bus.queueRisk(i%2?"clear":"warning"),"Risk queue stalled/rejected update");
+        check(bus.snapshot().transmitted==0,"Blocked SDK falsely reported delivery");
+        check(std::chrono::steady_clock::now()-start<250ms,"Risk submission waited for the SDK");
+        {std::lock_guard<std::mutex> lock(txMutex);blockTx=false;}txWake.notify_all();
+        waitFor([&]{return bus.snapshot().transmitted==2;});
+        {
+            std::lock_guard<std::mutex> lock(txMutex);
+            check(sentCanFrames.size()==2,"Stale pending results accumulated");
+            for(int i=0;i<2;++i)check(sentCanFrames[i].hdr.chn==1&&
+                sentCanFrames[i].dat[0]==(i==0?0x11:0x00),"Async risk or latest result incorrect");
+        }
+        failedTxChannel=1;
+        check(bus.queueRisk("danger"),"Ready queue rejected changed risk");
+        waitFor([&]{auto s=bus.snapshot();return s.transmitted==2&&s.transmit_errors==1;});
+        failedTxChannel=-1;txBlocked=false;blockTx=true;
+        check(bus.queueRisk("clear"),"Ready queue rejected clear risk");waitFor([]{return txBlocked.load();});
+        check(bus.queueRisk("danger"),"Queue rejected pending stop fixture");
+        auto calls=txCalls.load();bus.requestStop();
+        check(!bus.queueRisk("danger"),"Stopped bus accepted risk");
+        {std::lock_guard<std::mutex> lock(txMutex);blockTx=false;}txWake.notify_all();
+        bus.join();check(txCalls==calls,"Stop sent a pending result");
+        check(closes==1&&resets==2,"Async shutdown leaked hardware");
+    }
+    reset();{
+        CanBus bus({});bus.start();
+        check(bus.queueRisk("clear"),"Initial clear rejected");
+        waitFor([&]{return bus.snapshot().transmitted==1;});
+        for(int i=0;i<1000;++i)check(bus.queueRisk("clear"),"Unchanged risk rejected");
+        std::this_thread::sleep_for(30ms);
+        check(txCalls==1,"Repeated clear sent redundant frames");
+        check(bus.queueRisk("watch"),"Watch risk rejected");
+        std::this_thread::sleep_for(30ms);
+        check(txCalls==1,"Watch resent clear's zero value");
+        check(bus.queueRisk("warning"),"Risk change rejected");
+        waitFor([&]{return bus.snapshot().transmitted==2;});
+        for(auto level:{"warning","danger","unknown",""})
+            check(bus.queueRisk(level),"Equivalent binary risk rejected");
+        std::this_thread::sleep_for(30ms);
+        check(txCalls==2,"Equivalent non-clear levels resent binary risk");
+        check(bus.queueRisk("unavailable"),"Unavailable transition rejected");
+        waitFor([&]{return bus.snapshot().transmitted==3;});
+        check(sentCanFrames.back().dat[0]==0,"Unavailable risk must send zero");
+        check(bus.queueRisk("clear")&&bus.queueRisk("watch"),"Zero-risk transition rejected");
+        std::this_thread::sleep_for(30ms);
+        check(bus.snapshot().transmitted==3,"Clear/watch resent unavailable's zero value");
+        failedTxChannel=1;
+        check(bus.queueRisk("danger"),"Failed-send fixture rejected");
+        waitFor([&]{return bus.snapshot().transmit_errors==1;});
+        for(int i=0;i<1000;++i)check(bus.queueRisk("warning"),"Unchanged failed state rejected");
+        std::this_thread::sleep_for(30ms);
+        check(txCalls==4,"Unchanged failed state retried automatically");
+        failedTxChannel=-1;
+        check(bus.queueRisk("clear"),"Recovery transition rejected");
+        waitFor([&]{return bus.snapshot().transmitted==4;});
+        check(bus.queueRisk("danger"),"Second danger transition rejected");
+        waitFor([&]{return bus.snapshot().transmitted==5;});
+        bus.join();
+        check(sentCanFrames.size()==6,"Unexpected change-triggered frame count");
+        for(std::size_t i=0;i<sentCanFrames.size();++i)
+            check(sentCanFrames[i].dat[0]==(i%2?0x11:0),"Risk transition payload incorrect");
+    }
+    reset();{
+        CanBus bus({});bus.start();blockTx=true;
+        check(bus.queueRisk("danger"),"Initial non-clear rejected");
+        waitFor([]{return txBlocked.load();});
+        check(bus.queueRisk("clear")&&bus.queueRisk("warning"),"Busy transitions rejected");
+        {std::lock_guard<std::mutex> lock(txMutex);blockTx=false;}txWake.notify_all();
+        waitFor([&]{return bus.snapshot().transmitted==1;});
+        std::this_thread::sleep_for(30ms);
+        check(txCalls==1,"Returning to in-flight risk sent redundant frame");
+        check(bus.queueRisk("clear"),"Later clear change lost");
+        waitFor([&]{return bus.snapshot().transmitted==2;});
+        bus.join();
+        check(sentCanFrames.size()==2&&sentCanFrames[0].dat[0]==0x11&&sentCanFrames[1].dat[0]==0,
+              "Latest-state coalescing lost final clear");
+    }
+    std::cout<<"PASS CAN/CANFD CH0 reception, CH1 transmission, expiry/recovery, TX validation, change-triggered binary risk 0x1F6, errors and lifecycle cleanup\n";
+}catch(std::exception const& e){std::cerr<<e.what()<<'\n';return 1;}
@@ -0,0 +1,58 @@
+{
+  "running_sha256": "418637a35f6ad05441578db1333e15714262a9c0ee088f10c2dd84923471cd0f",
+  "build_sha256": "418637a35f6ad05441578db1333e15714262a9c0ee088f10c2dd84923471cd0f",
+  "stop_seconds": 0.8675570619998325,
+  "exit_code": 0,
+  "command": "./run_camera.sh",
+  "first_sample": {
+    "seconds": 0.25,
+    "rx": 8833,
+    "tx": 5,
+    "tx_errors": 0,
+    "valid": true,
+    "received_391": 4,
+    "age_ms": 147.083,
+    "positions": [
+      26,
+      0,
+      0,
+      0
+    ]
+  },
+  "last_sample": {
+    "seconds": 10.0,
+    "rx": 35669,
+    "tx": 299,
+    "tx_errors": 0,
+    "valid": true,
+    "received_391": 33,
+    "age_ms": 84.5888,
+    "positions": [
+      25,
+      0,
+      0,
+      0
+    ]
+  },
+  "sample_count": 40,
+  "max_observed_age_ms": 913.11,
+  "observed_positions": [
+    [
+      25,
+      0,
+      0,
+      0
+    ],
+    [
+      26,
+      0,
+      0,
+      0
+    ]
+  ],
+  "checks": "real camera/TensorRT/CH0/renderer; not CAN fault injection",
+  "local_head": "515a9f32d8c0ebf83503d4d240ffe917dc09950c",
+  "remote_inference_only": "0192fccbf06cb928eac098b3dfad32abf0fc370d",
+  "source_state": "uncommitted workspace at hardware verification",
+  "package_sha256": "418637a35f6ad05441578db1333e15714262a9c0ee088f10c2dd84923471cd0f"
+}
@@ -0,0 +1,25 @@
+{
+  "platform": "orin-desktop",
+  "binary": "/home/orin/vision-anti-pinch-0923/build/camera_risk",
+  "binary_sha256": "e8788d22fd6db0e3b9edc95a02322a51ca7951e1df81fea10f34db7da3143461",
+  "running_binary_sha256": "e8788d22fd6db0e3b9edc95a02322a51ca7951e1df81fea10f34db7da3143461",
+  "recorded_frames": 13,
+  "replayed_frames": 13,
+  "frames_with_people": 13,
+  "max_raw_pose_error_px": 938.180541992,
+  "matching_track_frames": 13,
+  "matching_decision_frames": 8,
+  "video_bytes": 322966,
+  "uncompressed_bgr_bytes": 115015680,
+  "sigterm_seconds": 1.3167834819996642,
+  "replay_sigint_seconds": 0.9158224279999558,
+  "interrupted_frames": 2,
+  "can_statuses": [
+    "UNAVAILABLE"
+  ],
+  "can_received": 0,
+  "can_0x391_by_channel": [
+    0,
+    0
+  ]
+}
@@ -0,0 +1,23 @@
+{
+  "command": "./run_camera.sh --no-visualize --save-results",
+  "duration_seconds": 12,
+  "published_results": 260,
+  "observed_risk_levels": [
+    "unavailable"
+  ],
+  "can_status": "OPEN",
+  "transmit_channel": 1,
+  "transmitted": 1,
+  "transmit_errors": 0,
+  "receive_channel": 0,
+  "received_391": 11,
+  "received_total": 31811,
+  "receive_errors": 4965,
+  "running_sha256": "feca0b7f476171f45489c22f11a51ba1fe0dabe2d9a17bfcdc50110d1afdb276",
+  "build_sha256": "feca0b7f476171f45489c22f11a51ba1fe0dabe2d9a17bfcdc50110d1afdb276",
+  "package_sha256": "feca0b7f476171f45489c22f11a51ba1fe0dabe2d9a17bfcdc50110d1afdb276",
+  "local_branch": "inference-only",
+  "local_head": "f87e5aad40478824da16eb42c76b40383de3a9a1",
+  "remote_inference_only": "0192fccbf06cb928eac098b3dfad32abf0fc370d",
+  "source_state": "uncommitted workspace at hardware verification"
+}
@@ -0,0 +1,21 @@
+{
+  "running_sha256": "5fa01c08baf73b1e044288b5e85f753c10f10d7cc9559ff25952bc4618f01899",
+  "build_sha256": "5fa01c08baf73b1e044288b5e85f753c10f10d7cc9559ff25952bc4618f01899",
+  "stop_seconds": 0.9191952890005268,
+  "exit_code": 0,
+  "command": "./run_camera.sh",
+  "published_results": 357,
+  "observed_results": 357,
+  "observed_risk_levels": [
+    "unavailable"
+  ],
+  "observed_binary_states": 1,
+  "transmitted": 1,
+  "transmit_errors": 0,
+  "received_391": 15,
+  "duration_seconds": 12,
+  "local_head": "f87e5aad40478824da16eb42c76b40383de3a9a1",
+  "remote_inference_only": "0192fccbf06cb928eac098b3dfad32abf0fc370d",
+  "source_state": "uncommitted workspace at hardware verification",
+  "package_sha256": "5fa01c08baf73b1e044288b5e85f753c10f10d7cc9559ff25952bc4618f01899"
+}
@@ -0,0 +1,43 @@
+{
+  "platform": "orin-desktop",
+  "binary": "/home/orin/vision-anti-pinch-0923/build/camera_risk",
+  "binary_sha256": "0f178057529eb8be44bb9a639504dfe57a1e353a84d2351fd907304f6d951c11",
+  "running_binary_sha256": "0f178057529eb8be44bb9a639504dfe57a1e353a84d2351fd907304f6d951c11",
+  "recorded_frames": 13,
+  "replayed_frames": 13,
+  "frames_with_people": 0,
+  "max_raw_pose_error_px": 0.0,
+  "matching_track_frames": 13,
+  "matching_decision_frames": 13,
+  "video_bytes": 303989,
+  "uncompressed_bgr_bytes": 115015680,
+  "sigterm_seconds": 1.4174426249992393,
+  "replay_sigint_seconds": 0.8654193540005508,
+  "interrupted_frames": 2,
+  "standalone_deployment": {
+    "binary": "/home/orin/vision-anti-pinch-0923/orin/build/camera_risk",
+    "binary_sha256": "0f178057529eb8be44bb9a639504dfe57a1e353a84d2351fd907304f6d951c11",
+    "running_binary_sha256": "0f178057529eb8be44bb9a639504dfe57a1e353a84d2351fd907304f6d951c11",
+    "replayed_frames": 13
+  },
+  "default_visualization": {
+    "platform": "orin-desktop",
+    "binary": "/home/orin/vision-anti-pinch-0923/orin/build/camera_risk",
+    "binary_sha256": "cd9711d71c6d04f40adf9434f893abe1744e9e2013f1459ddf736a80dcbbfd64",
+    "running_binary_sha256": "cd9711d71c6d04f40adf9434f893abe1744e9e2013f1459ddf736a80dcbbfd64",
+    "recorded_frames": 13,
+    "replayed_frames": 13,
+    "frames_with_people": 0,
+    "max_raw_pose_error_px": 0.0,
+    "matching_track_frames": 13,
+    "matching_decision_frames": 13,
+    "video_bytes": 317961,
+    "uncompressed_bgr_bytes": 115015680,
+    "sigterm_seconds": 1.266686278000634,
+    "replay_sigint_seconds": 0.9155338489999849,
+    "interrupted_frames": 2,
+    "default_window_observed": true,
+    "no_visualize_replay_passed": true,
+    "headless_replay_passed": true
+  }
+}
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Real camera + TensorRT record/replay check. Runs only explicitly on Orin.
+Records to a new test directory; never stops an existing deployment process.
+"""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import time
+
+
+def rows(session):
+    index = session / 'frames.txt'
+    return index.read_text().splitlines() if index.exists() else []
+
+
+def wait_frames(process, session, count, timeout=90):
+    deadline = time.monotonic() + timeout
+    while len(rows(session)) < count:
+        if process.poll() is not None:
+            raise RuntimeError(f'Inference exited early: {process.returncode}')
+        if time.monotonic() > deadline:
+            raise RuntimeError('Timed out awaiting real inference frames')
+        time.sleep(.05)
+
+
+def stop(process, signum=signal.SIGTERM):
+    start = time.monotonic()
+    process.send_signal(signum)
+    code = process.wait(timeout=15)
+    if code:
+        raise RuntimeError(f'Nonzero stop exit: {code}')
+    return time.monotonic() - start
+
+
+def run_record(command, session, log, count, signum=signal.SIGTERM):
+    with log.open('w') as output:
+        process = subprocess.Popen(command + ['--record-session', str(session)], stdout=output, stderr=subprocess.STDOUT)
+        try:
+            wait_frames(process, session, count)
+            return stop(process, signum)
+        finally:
+            if process.poll() is None:
+                process.terminate()
+                process.wait(timeout=15)
+
+
+def load(session):
+    return [json.loads((session / 'frames' / f'{stem}.json').read_text()) for stem in rows(session)]
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--binary', type=Path, required=True)
+    parser.add_argument('--config', type=Path, required=True)
+    parser.add_argument('--output', type=Path, required=True)
+    parser.add_argument('--replay-input', type=Path, help='Verify deployment with an existing session; no camera access')
+    args = parser.parse_args()
+    args.output.mkdir(parents=True, exist_ok=False)
+    binary = args.binary.resolve()
+    config = args.config.resolve()
+    command = [str(binary), '--config', str(config)]
+    # Refuse camera contention rather than alter an existing deployment.
+    if subprocess.run(['pgrep', '-x', 'camera_risk'], stdout=subprocess.DEVNULL).returncode == 0:
+        raise RuntimeError('An existing camera_risk process is running; preserve its launch parameters first')
+    if args.replay_input:
+        replayed = args.output / 'replayed'
+        with (args.output/'replay.log').open('w') as log:
+            process = subprocess.Popen(command + ['--replay-session', str(args.replay_input.resolve()), '--record-session', str(replayed)], stdout=log, stderr=subprocess.STDOUT)
+            try:
+                running_hash = hashlib.sha256(Path(f'/proc/{process.pid}/exe').read_bytes()).hexdigest()
+                assert process.wait(timeout=120) == 0, 'Deployment replay failed'
+            finally:
+                if process.poll() is None:
+                    process.terminate()
+                    process.wait(timeout=15)
+        original, restored = load(args.replay_input), load(replayed)
+        assert [r['frame_index'] for r in original] == [r['frame_index'] for r in restored]
+        result = {'binary': str(binary), 'binary_sha256': hashlib.sha256(binary.read_bytes()).hexdigest(),
+                  'running_binary_sha256': running_hash, 'replayed_frames': len(restored)}
+        assert result['binary_sha256'] == running_hash
+        (args.output/'report.json').write_text(json.dumps(result, indent=2)+'\n')
+        print(json.dumps(result, indent=2))
+        return
+    recorded, replayed = args.output / 'recorded', args.output / 'replayed'
+    term_seconds = run_record(command, recorded, args.output / 'record.log', 12)
+    original = load(recorded)
+    with (args.output / 'replay.log').open('w') as log:
+        process = subprocess.Popen(command + ['--replay-session', str(recorded), '--record-session', str(replayed)], stdout=log, stderr=subprocess.STDOUT)
+        try:
+            # Verify the running executable, not just the file on disk.
+            running_hash = hashlib.sha256(Path(f'/proc/{process.pid}/exe').read_bytes()).hexdigest()
+            if process.wait(timeout=120):
+                raise RuntimeError('Replay failed')
+        finally:
+            if process.poll() is None:
+                process.terminate()
+                process.wait(timeout=15)
+    restored = load(replayed)
+    assert len(original) == len(restored) >= 12, 'EOF dropped frames'
+    max_pose_error = 0.0
+    matching_tracks = matching_decisions = 0
+    for before, after, stem in zip(original, restored, rows(recorded)):
+        assert before['frame_index'] == after['frame_index']
+        assert before['capture'] == after['source_capture']
+        if 'can' in before['result']:
+            expected_can = dict(before['result']['can'], source='replay')
+            assert expected_can == after['result']['can'], 'Recorded CAN state changed during replay'
+        assert before['video_frame_index'] == after['video_frame_index']
+        matching_tracks += before['result']['track_ids'] == after['result']['track_ids']
+        matching_decisions += before['result']['risk']['decision'] == after['result']['risk']['decision']
+        for stage in ('raw_keypoints', 'isolated_keypoints'):
+            for a, b in zip(before['stages'][stage], after['stages'][stage]):
+                for ka, kb in zip(a, b):
+                    max_pose_error = max(max_pose_error, *(abs(x-y) for x, y in zip(ka, kb)))
+    # H.264 is lossy: report algorithm differences, do not require bitwise equality.
+    probe = json.loads(subprocess.check_output(['ffprobe', '-v', 'error', '-select_streams', 'v:0', '-show_entries', 'stream=codec_name,nb_frames,width,height', '-of', 'json', str(recorded/'frames.mp4')]))['streams'][0]
+    assert probe['codec_name'] == 'h264' and int(probe['nb_frames']) == len(original)
+    # Exercise cancellation while replay has queued input, and reuse afterwards.
+    interrupt_seconds = run_record(command + ['--replay-session', str(recorded)], args.output/'interrupted', args.output/'interrupt.log', 1, signal.SIGINT)
+    interrupted_count = json.loads((args.output/'interrupted/complete.json').read_text())['frame_count']
+    assert 0 < interrupted_count < len(original), 'Cancellation did not stop before EOF'
+    result = {'platform': os.uname().nodename, 'binary': str(binary), 'binary_sha256': hashlib.sha256(binary.read_bytes()).hexdigest(),
+              'running_binary_sha256': running_hash, 'recorded_frames': len(original), 'replayed_frames': len(restored),
+              'frames_with_people': sum(bool(row['result']['track_ids']) for row in original),
+              'max_raw_pose_error_px': max_pose_error, 'matching_track_frames': matching_tracks, 'matching_decision_frames': matching_decisions,
+              'video_bytes': (recorded/'frames.mp4').stat().st_size, 'uncompressed_bgr_bytes': len(original)*int(probe['width'])*int(probe['height'])*3, 'sigterm_seconds': term_seconds, 'replay_sigint_seconds': interrupt_seconds, 'interrupted_frames': interrupted_count,
+              'can_statuses': sorted({r['result'].get('can', {}).get('status', 'NOT_RECORDED') for r in original}),
+              'can_received': max(r['result'].get('can', {}).get('received', 0) for r in original),
+              'can_0x391_by_channel': [max((r['result'].get('can', {}).get('channels', [{}, {}])[ch].get('received', 0) for r in original)) for ch in range(2)]}
+    assert result['binary_sha256'] == running_hash
+    (args.output/'report.json').write_text(json.dumps(result, indent=2)+'\n')
+    print(json.dumps(result, indent=2))
+
+
+if __name__ == '__main__':
+    main()
@@ -3,7 +3,7 @@ set -euo pipefail
 root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 test_dir="$(mktemp -d)"
 trap 'rm -rf "$test_dir"' EXIT
-flags=(-std=c++17 -O1 -g -Wall -Wextra -Wpedantic -pthread -fsanitize=undefined -fno-sanitize-recover=all -I"$root/include")
+flags=(-std=c++17 -O1 -g -Wall -Wextra -Wpedantic -pthread -fsanitize=undefined -fno-sanitize-recover=all -I"$root/include" -I"$root/third_party")
 links=()
 if [[ -f "$root/include/v4l2_capture.h" ]]; then
  flags+=(-DTEST_V4L2_CAPTURE -I"$root/tests/stubs")
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+test_dir="$(mktemp -d)"
+trap 'rm -rf "$test_dir"' EXIT
+"${CXX:-g++}" -std=c++17 -O1 -g -Wall -Wextra -Wpedantic -pthread \
+  -fsanitize=undefined -fno-sanitize-recover=all -I"$root/include" -isystem "$root/third_party/zlg" \
+  "$root/src/can_bus.cpp" "$root/tests/can_bus_test.cpp" -o "$test_dir/can_bus_test"
+"$test_dir/can_bus_test"
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+test_dir="$(mktemp -d)"
+trap 'rm -rf "$test_dir"' EXIT
+read -ra opencv_flags <<< "$(pkg-config --cflags --libs opencv4)"
+"${CXX:-g++}" -std=c++17 -O1 -g -Wall -Wextra -Wpedantic -fsanitize=undefined -fno-sanitize-recover=all \
+  -I"$root/include" -I"$root/third_party" "$root/tests/session_test.cpp" \
+  "$root/src/inference_session.cpp" "$root/src/serialization.cpp" "$root/src/door_risk.cpp" \
+  "${opencv_flags[@]}" -o "$test_dir/session_test"
+"$test_dir/session_test" "$test_dir"
@@ -0,0 +1,71 @@
+#include "inference_session.hpp"
+#include "camera_pipeline.hpp"
+#include "serialization.hpp"
+#include <chrono>
+#include <cmath>
+#include <iostream>
+#include <stdexcept>
+
+namespace cms {
+std::uint64_t monotonicNs() {
+    return std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now().time_since_epoch()).count();
+}
+}
+using namespace cms;
+void check(bool condition,char const* message){if(!condition)throw std::runtime_error(message);}
+template<class F> void rejects(F f){bool failed=false;try{f();}catch(std::exception const&){failed=true;}check(failed,"Expected rejection");}
+int main(int argc,char** argv)try {
+    if(argc!=2)return 2;
+    std::filesystem::path root=argv[1];
+    PipelineConfig c;c.record_session=root/"recorded";c.engines=root;c.door_mask=root/"mask.json";
+    c.camera.width=64;c.camera.height=48;c.detector_confidence=.42;
+    std::ofstream(c.door_mask)<<"{}";
+    for(auto name:{"yolo11s.engine","rtmw_l_384.engine"})std::ofstream(root/name)<<"fixture";
+    auto im=std::make_shared<BgrImage>();im->width=64;im->height=48;im->stride=200;
+    im->pixels.resize(9600);
+    for(int y=0;y<48;++y)for(int x=0;x<192;++x)im->pixels[y*200+x]=32+x/3+y%4;
+    FrameResult r;r.image=im;r.frame_index=3;r.capture.frame_index=3;r.capture.driver_sequence=42;
+    r.can.status="OPEN";r.can.received=7;r.can.channels[0].positions={0,25,100,255};
+    r.can.channels[0].valid=true;r.can.channels[0].received=7;r.can.channels[0].age_ms=12.5;
+    r.capture.capture_monotonic_ns=123;r.capture.received_monotonic_ns=124;
+    {
+        SessionWriter writer(c);writer.write(r,{{"raw_keypoints",{1,2,3}}});
+        r.frame_index=9;r.capture.frame_index=9;
+        for(auto& pixel:im->pixels)pixel+=80;
+        writer.write(r,{{"raw_keypoints",{4,5,6}}});
+        writer.finish();writer.finish();
+        rejects([&]{writer.write(r,{});});
+    }
+    rejects([&]{SessionWriter duplicate(c);});
+    PipelineConfig replay;replay.replay_session=c.record_session;
+    SessionReader reader(replay);check(replay.camera.width==64&&replay.detector_confidence==.42,"Settings not restored");
+    auto first=reader.read();check(first&&first->metadata.frame_index==3,"First index mismatch");
+    auto can=deserializeCan(first->replay_record->at("result").at("can"));
+    check(can.channels[0].positions==r.can.channels[0].positions&&can.channels[0].valid&&can.channels[0].age_ms==12.5,"Recorded CAN snapshot changed");
+    check(first->metadata.driver_sequence==42&&first->metadata.capture_monotonic_ns!=123,"Capture metadata mismatch");
+    check(first->replay_record->at("capture").at("capture_monotonic_ns")==123,"Original clock lost");
+    for(int y=0;y<48;++y)for(int x=0;x<192;++x)check(std::abs(int(first->image->pixels[y*192+x])-(32+x/3+y%4))<12,"Decoded first frame mismatch");
+    auto second=reader.read();check(second&&second->metadata.frame_index==9,"Gap/order lost");
+    check(second->image->pixels[0]>first->image->pixels[0]+60,"Video frame order lost");
+    check(!reader.read(),"EOF not drained");
+    // Unindexed temporary metadata must not become input.
+    std::ofstream(c.record_session/"frames/000000000002.json.tmp")<<"incomplete";
+    SessionReader prefix(replay);check(prefix.read()&&prefix.read()&&!prefix.read(),"Uncommitted data replayed");
+    std::filesystem::remove(c.record_session/"frames/000000000001.json");
+    SessionReader missing(replay);missing.read();rejects([&]{missing.read();});
+    std::ofstream(c.record_session/"frames.txt",std::ios::trunc)<<"../bad\n";
+    SessionReader invalid(replay);rejects([&]{invalid.read();});
+    std::ofstream(c.record_session/"frames.txt",std::ios::trunc)<<"000000000000";
+    SessionReader truncated(replay);rejects([&]{truncated.read();});
+    std::ofstream(c.record_session/"frames.txt",std::ios::trunc)<<"000000000000\n";
+    SessionReader shortIndex(replay);shortIndex.read();rejects([&]{shortIndex.read();});
+    std::filesystem::remove(c.record_session/"complete.json");
+    rejects([&]{SessionReader incomplete(replay);});
+    c.record_session=root/"empty";
+    {SessionWriter empty(c);empty.finish();}
+    replay.replay_session=c.record_session;
+    SessionReader empty(replay);check(!empty.read(),"Empty recording has frames");
+    c.camera.width=63;c.record_session=root/"odd";
+    rejects([&]{SessionWriter odd(c);});
+    std::cout<<"H.264 encode/decode, settings, order, EOF, stop finalization and corruption checks passed\n";
+}catch(std::exception const& e){std::cerr<<e.what()<<'\n';return 1;}
@@ -0,0 +1,5 @@
+# USBCANFD SDK
+
+`zcan.h` and the runtime libraries in `orin/lib/` were copied unchanged from the user-specified reference project `/home/orin/vision-anti-pinch` on 2026-09-24. The runtime libraries are aarch64 `libusbcanfd.so` (SONAME `libusbcanfd.so.1.0.12`) and `libusb-1.0.so` (SONAME `libusb-1.0.so.0`). Symlinks retain these SONAMEs in the standalone package.
+
+`src/can_bus.cpp` uses the reference device type and 500 kbps / 2 Mbps initialization settings. It implements one merged receive worker, per-channel state, explicit data-frame transmission, and lifecycle cleanup instead of importing the reference global callback/receive-thread implementation.
@@ -0,0 +1,443 @@
+#pragma once
+
+#ifdef __cplusplus
+#define EXTERN_C  extern "C"
+#else
+#define EXTERN_C
+#endif
+
+#define ZCAN_API
+#define INVALID_HANDLE_VALUE  ((HANDLE)(-1))
+
+#define CMD_CAN_FILTER      0x14    // 滤波
+#define CMD_CAN_TTX         0x16    // 定时发送
+#define CMD_CAN_TTX_CTL     0x17    // 使能定时发送
+#define CMD_CAN_TRES        0x18    // CAN终端电阻
+
+#define ZCAN_CMD_SET_CHNL_RECV_MERGE    0x32    // 设置合并接收 0:不合并接收;1:合并接收
+#define ZCAN_CMD_GET_CHNL_RECV_MERGE    0x33    // 获取是否开启合并接收 0:不合并接收;1:合并接收
+
+#define CMD_SET_SN          0x42    // 获取SN号
+#define CMD_GET_SN          0x43    // 设置SN号
+#define CMD_CAN_TX_TIMEOUT  0x44    // 发送超时
+
+#define ZCAN_CMD_GET_SEND_QUEUE_SIZE    0x100   // 获取队列大小，uint32_t
+#define ZCAN_CMD_GET_SEND_QUEUE_SPACE   0x101   // 获取队列剩余空间, uint32_t
+#define ZCAN_CMD_SET_SEND_QUEUE_CLR     0x102   // 清空发送队列,1：清空 
+#define ZCAN_CMD_SET_SEND_QUEUE_EN      0x103   // 开启发送队列,1：使能 
+
+typedef unsigned char U8;
+typedef unsigned short U16;
+typedef unsigned int U32;
+typedef unsigned long long U64;
+
+enum eZCANDataDEF
+{
+    //数据类型
+    ZCAN_DT_ZCAN_CAN_DATA           = 1,    // CAN/CANFD数据
+    ZCAN_DT_ZCAN_CANFD_DATA         = 2,    // CAN/CANFD数据
+    ZCAN_DT_ZCAN_ERROR_DATA         = 3,    // CAN/CANFD错误数据
+    ZCAN_DT_ZCAN_LIN_DATA           = 4,    // LIN数据
+    ZCAN_DT_ZCAN_LIN_ERROR_DATA     = 5,    // LIN错误数据
+};
+#pragma pack(push, 1)
+
+typedef enum {
+    ZCAN_TX_NORM = 0, /**< normal transmission */
+    ZCAN_TX_ONCE = 1, /**< single-shot transmission */
+    ZCAN_SR_NORM = 2, /**< self reception */
+    ZCAN_SR_ONCE = 3, /**< single-shot transmission & self reception */
+} ZCAN_TX_MODE;
+
+/** CAN filter configuration */
+typedef struct {
+    U8 type;    /**< 0-std_frame, 1-ext_frame */
+    U8 pad[3];
+    U32 sid;    /**< start-id */
+    U32 eid;    /**< end-id */
+} ZCAN_FILTER;
+
+typedef struct {
+    U32 size;
+    ZCAN_FILTER table[64];
+} ZCAN_FILTER_TABLE;
+
+/** controller initialization */
+typedef struct {
+    U32 clk;    // 时钟频率
+    U32 mode;   /**< bit0-normal/listen_only, bit1-ISO/BOSCH */
+    struct {
+        U8 tseg1;
+        U8 tseg2;
+        U8 sjw;
+        U8 smp;
+        U16 brp;
+    } aset;
+    struct {
+        U8 tseg1;
+        U8 tseg2;
+        U8 sjw;
+        U8 smp;
+        U16 brp;
+    } dset;
+} ZCAN_INIT;
+
+/** CAN message info */
+typedef struct {
+    U32 txm : 4; /**< TX-mode, @see ZCAN_TX_MODE */
+    U32 fmt : 4; /**< 0-CAN2.0, 1-CANFD */
+    U32 sdf : 1; /**< 0-data_frame, 1-remote_frame */
+    U32 sef : 1; /**< 0-std_frame, 1-ext_frame */
+    U32 err : 1; /**< error flag */
+    U32 brs : 1; /**< bit-rate switch */
+    U32 est : 1; /**< error state */
+    U32 tx  : 1; /**< received valid, tx frame */
+    U32 echo : 1; /**< tx valid, echo frame */
+    U32 qsend_100us:1; /**< queue send delay unit, 1-100us, 0-ms */
+    U32 qsend:1; /**< send valid, queue send frame */
+    U32 pad : 15;
+} ZCAN_MSG_INF;
+
+/** CAN message header */
+typedef struct {
+    U32 ts; /**< timestamp */
+    U32 id; /**< CAN-ID */
+    ZCAN_MSG_INF inf; /**< @see ZCAN_MSG_INF */
+    U16 pad; /**< send queue delay */
+    U8 chn; /**< channel */
+    U8 len; /**< data length */
+} ZCAN_MSG_HDR;
+
+/** CAN2.0-frame */
+typedef struct {
+    ZCAN_MSG_HDR hdr;
+    U8 dat[8];
+} ZCAN_20_MSG;
+
+/** CANFD-frame */
+typedef struct {
+    ZCAN_MSG_HDR hdr;
+    U8 dat[64];
+} ZCAN_FD_MSG;
+
+// 错误帧
+typedef struct {
+    ZCAN_MSG_HDR hdr;
+    U8 dat[8];
+} ZCAN_ERR_MSG;
+
+// 定时发送结构体
+typedef struct {
+    U32 interval;       // 定时发送周期，单位 100us
+    U16 repeat;         // 发送次数，0等于循环发
+    U8 index;           // 定时发送列表的帧索引号，也就是第几条定时发送报文
+    U8 flags;           // 0-此帧禁用定时发送，1-此帧使能定时发送
+    ZCAN_FD_MSG msg;    // CANFD帧结构体
+} ZCAN_TTX;
+
+typedef struct {
+    U32 size;           // 实际生效的数组的长度（用来控制实际生效多少条定时发送帧结构体）
+    ZCAN_TTX table[8];  // 最大设置8条
+} ZCAN_TTX_CFG;
+
+// 设备信息
+typedef struct {
+    U16 hwv;    /**< hardware version */
+    U16 fwv;    /**< firmware version */
+    U16 drv;    /**< driver version */
+    U16 api;    /**< API version */
+    U16 irq;    /**< IRQ */
+    U8 chn;     /**< channels */
+    U8 sn[20];  /**< serial number */
+    U8 id[40];  /**< card id */
+    U16 pad[4]; 
+} ZCAN_DEV_INF;
+
+/** controller status */
+typedef struct {
+    U8 IR;      /**< not used(for backward compatibility) */
+    U8 MOD;     /**< not used */
+    U8 SR;      /**< not used */
+    U8 ALC;     /**< not used */
+    U8 ECC;     /**< not used */
+    U8 EWL;     /**< not used */
+    U8 RXE;     /**< RX errors */
+    U8 TXE;     /**< TX errors */
+    U32 PAD;
+} ZCAN_STAT;
+
+//lin begin
+typedef struct _VCI_LIN_INIT_CONFIG
+{
+	U8    linMode;                       // 是否作为主机，0-从机，1-主机
+	U8    chkSumMode;                    // 校验方式，1-经典校验 2-增强校验 3-自动(对应eZLINChkSumMode的模式)
+	U16   reserved;					     // 保留
+	U32   linBaud;                       // 波特率，取值1000~20000
+}ZCAN_LIN_INIT_CONFIG, *PZCAN_LIN_INIT_CONFIG;
+
+typedef struct tagZCANLINData
+{
+    union{
+        struct {
+            U8 ID : 6;          // 帧ID
+            U8 Parity : 2;      // 帧ID校验
+        }unionVal;
+        U8 rawVal;          // 受保护的ID原始值
+    } PID;                  // 受保护的ID
+    struct
+    {
+        U64  timeStamp;         // 时间戳，单位微秒(us)
+        U8    dataLen;          // 数据长度
+        U8    dir;              // 传输方向，0-接收 1-发送
+        U8    chkSum;           // 数据校验, 部分设备不支持校验数据的获取
+        U8    reserved[13];     // 保留
+        U8    data[8];          // 数据
+    }RxData;                // 仅接收数据时有效
+	U8 reserved[7];         // 保留
+}ZCANLINData;
+
+typedef struct tagZCANLINErrData
+{
+	U64  timeStamp;             // 时间戳, 单位微秒(us)
+	union {
+		struct {
+			U8    ID : 6;       // 帧ID
+			U8    Parity : 2;   // 帧ID校验
+		}unionVal;
+		U8    rawVal;           // 受保护的ID原始值
+	}       PID;                // 受保护的ID
+	U8    dataLen;
+	U8    data[8];
+	union
+	{
+		struct
+		{
+			U16 errStage : 4;   // 错误阶段
+			U16 errReason : 4;  // 错误原因
+			U16 reserved : 8;   // 保留
+		};
+		U16 unionErrData;
+	}errData;
+	U8    dir;              // 传输方向 
+	U8    chkSum;           // 数据校验, 部分设备不支持校验数据的获取
+	U8    reserved[10];     // 保留
+}ZCANLINErrData;
+
+typedef struct _VCI_LIN_MSG{
+	U8        chnl;         // 数据通道
+	U8        dataType;     // 数据类型, 0-LIN数据 1-LIN错误数据
+	union
+	{
+		ZCANLINData             zcanLINData;        // LIN数据
+		ZCANLINErrData          zcanLINErrData;     // LIN错误数据
+		U8                    raw[46];              // RAW数据
+	} data;                                         // 实际数据, 联合体，有效成员根据 dataType 字段而定
+}ZCAN_LIN_MSG, *PZCAN_LIN_MSG;
+
+enum eZLINChkSumMode
+{
+	DEFAULT = 0,        // 默认，启动时配置
+	CLASSIC_CHKSUM,     // 经典校验
+	ENHANCE_CHKSUM,     // 增强校验 
+	AUTOMATIC,          // 自动，设备自动识别校验方式（仅ZCAN_SetLINSubscribe时有效）
+};
+enum
+{
+	MAX_LIN_ID_COUNT = 63,
+	MIN_LIN_DLC = 1,
+	MAX_LIN_DLC = 8,
+	AUTO_LIN_DLC = 255,
+};
+typedef struct _VCI_LIN_PUBLISH_CFG
+{
+	U8    ID;               // 受保护的ID（ID取值范围为0-63）
+	U8    dataLen;          // dataLen范围为1-8
+	U8    data[8];
+	U8    chkSumMode;       // 校验方式，0-默认，启动时配置 1-经典校验 2-增强校验(对应eZLINChkSumMode的模式)
+	U8    reserved[5];      // 保留
+}ZCAN_LIN_PUBLISH_CFG, *PZCAN_LIN_PUBLISH_CFG;
+
+typedef struct _VCI_LIN_SUBSCIBE_CFG
+{
+	U8    ID;               // 受保护的ID（ID取值范围为0-63）
+	U8    dataLen;          // dataLen范围为1-8 当为255（0xff）则表示设备自动识别报文长度
+	U8    chkSumMode;       // 校验方式，0-默认，启动时配置 1-经典校验 2-增强校验 3-自动(对应eZLINChkSumMode的模式)
+	U8    reserved[5];      // 保留
+}ZCAN_LIN_SUBSCIBE_CFG, *PZCAN_LIN_SUBSCIBE_CFG;
+
+// 合并接收数据数据结构，支持CAN/CANFD/LIN/错误等不同类型数据
+typedef struct tagZCANDataObj
+{
+    U8        dataType;         // 数据类型, 参考eZCANDataDEF中 数据类型 部分定义
+    U8        chnl;             // 数据通道
+    union{
+        struct{
+            U16 reserved : 16;                      // 保留
+        }unionVal;
+        U16 rawVal;
+    }flag;                                          // 标志信息, 暂未使用
+    U8        extraData[4];                         // 额外数据, 暂未使用
+    union
+    {
+        ZCAN_20_MSG             zcanCANData;        // CAN数据
+        ZCAN_FD_MSG             zcanCANFDData;      // CANFD数据
+        ZCAN_ERR_MSG            zcanErrData;        // 错误数据
+        ZCANLINData             zcanLINData;        // LIN数据
+        ZCANLINErrData          zcanLINErrData;     // LIN错误数据
+        U8                      raw[92];            // RAW数据
+    } data;                                         // 实际数据, 联合体，有效成员根据 dataType 字段而定
+}ZCANDataObj;
+
+
+// UDS传输协议版本
+typedef U8 ZCAN_UDS_TRANS_VER;
+#define ZCAN_UDS_TRANS_VER_0        0       // ISO15765-2(2004版本)
+#define ZCAN_UDS_TRANS_VER_1        1       // ISO15765-2(2016版本)
+
+// 帧类型
+typedef U8 ZCAN_UDS_FRAME_TYPE;
+#define ZCAN_UDS_FRAME_CAN          0       // CAN帧
+#define ZCAN_UDS_FRAME_CANFD        1       // CANFD帧
+#define ZCAN_UDS_FRAME_CANFD_BRS    2       // CANFD加速帧
+
+// UDS填充模式
+#define FILL_MODE_SHORT    0    // 小于8字节填充至8字节，大于8字节时按DLC就近填充
+#define FILL_MODE_NONE     1    // 不填充
+#define FILL_MODE_MAX      2    // 填充至最大数据长度 (不建议)
+
+// CAN UDS请求数据
+typedef struct _ZCAN_UDS_REQUEST
+{
+    U32 req_id;                             // 请求事务ID，范围0~65535，本次请求的唯一标识
+    U8 channel;                             // 设备通道索引 0~255
+    ZCAN_UDS_FRAME_TYPE frame_type;         // 帧类型
+    U8 reserved0[2];                        // 保留
+    U32 src_addr;                           // 请求地址
+    U32 dst_addr;                           // 响应地址
+    U8 suppress_response;                   // 1:抑制响应
+    U8 sid;                                 // 请求服务id
+    U8 reserved1[6];                        // 保留
+    struct {
+        U32 timeout;                        // 响应超时时间(ms)。因PC定时器误差，建议设置不小于200ms
+        U32 enhanced_timeout;               // 收到消极响应错误码为0x78后的超时时间(ms)。因PC定时器误差，建议设置不小于200ms
+        U8 check_any_negative_response:1;   // 接收到非本次请求服务的消极响应时是否需要判定为响应错误
+        U8 wait_if_suppress_response:1;     // 抑制响应时是否需要等待消极响应，等待时长为响应超时时间
+        U8 flag:6;                          // 保留
+        U8 reserved0[7];                    // 保留
+    } session_param;                        // 会话层参数
+    struct {
+        ZCAN_UDS_TRANS_VER version;       // 传输协议版本, VERSION_0, VERSION_1
+        U8 max_data_len;                  // 单帧最大数据长度, can:8, canfd:64
+        U8 local_st_min;                  // 本程序发送流控时用，连续帧之间的最小间隔, 0x00-0x7F(0ms~127ms), 0xF1-0xF9(100us~900us)
+        U8 block_size;                    // 流控帧的块大小
+        U8 fill_byte;                     // 无效字节的填充数据
+        U8 ext_frame;                     // 0:标准帧 1:扩展帧
+        U8 is_modify_ecu_st_min;          // 是否忽略ECU返回流控的STmin，强制使用本程序设置的 remote_st_min
+        U8 remote_st_min;                 // 发送多帧时用, is_ignore_ecu_st_min = 1 时有效, 0x00-0x7F(0ms~127ms), 0xF1-0xF9(100us~900us)
+        U32 fc_timeout;                   // 接收流控超时时间(ms), 如发送首帧后需要等待回应流控帧
+        U8 fill_mode;                     // 数据长度填充模式, FILL_MODE_SHORT, FILL_MODE_NONE, FILL_MODE_MAX
+        U8 reserved0[3];                  // 保留
+    } trans_param;                        // 传输层参数
+    U8 *data;           // 数据数组(不包含SID)
+    U32 data_len;       // 数据数组的长度
+    U32 reserved2;      // 保留
+} ZCAN_UDS_REQUEST;
+
+// UDS错误码
+typedef U8 ZCAN_UDS_ERROR;
+#define ZCAN_UDS_ERROR_OK                   0    // 没错误
+#define ZCAN_UDS_ERROR_TIMEOUT              1    // 响应超时
+#define ZCAN_UDS_ERROR_TRANSPORT            2    // 发送数据失败
+#define ZCAN_UDS_ERROR_CANCEL               3    // 取消请求
+#define ZCAN_UDS_ERROR_SUPPRESS_RESPONSE    4    // 抑制响应
+#define ZCAN_UDS_ERROR_BUSY                 5    // 忙碌中
+#define ZCAN_UDS_ERROR_REQ_PARAM            6    // 请求参数错误
+#define ZCAN_UDS_ERROR_OTHTER               100
+
+typedef U8 ZCAN_UDS_RESPONSE_TYPE;
+#define ZCAN_UDS_RT_NEGATIVE 0              // 消极响应
+#define ZCAN_UDS_RT_POSITIVE 1              // 积极响应
+
+// UDS响应数据
+typedef struct _ZCAN_UDS_RESPONSE
+{
+    ZCAN_UDS_ERROR status;              // 响应状态
+    U8 reserved[6];                     // 保留
+    ZCAN_UDS_RESPONSE_TYPE type;        // 响应类型
+    union {
+        struct {
+            U8 sid;             // 响应服务id
+            U32 data_len;       // 数据长度(不包含SID), 数据存放在接口传入的dataBuf中
+        } positive;
+        struct {
+            U8  neg_code;       // 固定为0x7F
+            U8  sid;            // 请求服务id
+            U8  error_code;     // 错误码
+        } negative;
+        U8 raw[8]; 
+    };
+} ZCAN_UDS_RESPONSE;
+
+// UDS控制类型
+typedef U32 ZCAN_UDS_CTRL_CODE;
+#define ZCAN_UDS_CTRL_STOP_REQ 0            // 停止UDS请求
+
+// UDS控制请求
+typedef struct _ZCAN_UDS_CTRL_REQ
+{
+    U32 reqID;                      // 请求事务ID，指明要操作哪一条请求
+	ZCAN_UDS_CTRL_CODE cmd;         // 控制类型
+    U8 reserved[8];                 // 保留
+} ZCAN_UDS_CTRL_REQ;
+
+// UDS控制结果
+typedef U32 ZCAN_UDS_CTRL_RESULT;
+#define ZCAN_UDS_CTRL_RESULT_OK  0      // 成功
+#define ZCAN_UDS_CTRL_RESULT_ERR 1      // 失败
+
+// UDS控制响应数据
+typedef struct _ZCAN_UDS_CTRL_RESP
+{
+    ZCAN_UDS_CTRL_RESULT result;    // 操作结果
+    U8 reserved[8];                 // 保留
+} ZCAN_UDS_CTRL_RESP;
+
+#pragma pack(pop)
+
+// 
+EXTERN_C U32 ZCAN_API VCI_OpenDevice(U32 Type, U32 Card, U32 Reserved);
+EXTERN_C U32 ZCAN_API VCI_CloseDevice(U32 Type, U32 Card);
+EXTERN_C U32 ZCAN_API VCI_InitCAN(U32 Type, U32 Card, U32 Port, ZCAN_INIT *pInit);
+EXTERN_C U32 ZCAN_API VCI_ReadBoardInfo(U32 Type, U32 Card, ZCAN_DEV_INF *pInfo);
+EXTERN_C U32 ZCAN_API VCI_ReadErrInfo(U32 Type, U32 Card, U32 Port, ZCAN_ERR_MSG *pErr);
+EXTERN_C U32 ZCAN_API VCI_ReadCANStatus(U32 Type, U32 Card, U32 Port, ZCAN_STAT *pStat);
+EXTERN_C U32 ZCAN_API VCI_GetReference(U32 Type, U32 Card, U32 Port, U32 Ref, void *pData);
+EXTERN_C U32 ZCAN_API VCI_SetReference(U32 Type, U32 Card, U32 Port, U32 Ref, void *pData);
+EXTERN_C U32 ZCAN_API VCI_GetReceiveNum(U32 Type, U32 Card, U32 Port);
+EXTERN_C U32 ZCAN_API VCI_ClearBuffer(U32 Type, U32 Card, U32 Port);
+EXTERN_C U32 ZCAN_API VCI_StartCAN(U32 Type, U32 Card, U32 Port);
+EXTERN_C U32 ZCAN_API VCI_ResetCAN(U32 Type, U32 Card, U32 Port);
+EXTERN_C U32 ZCAN_API VCI_Transmit(U32 Type, U32 Card, U32 Port, ZCAN_20_MSG *pData, U32 Count);
+EXTERN_C U32 ZCAN_API VCI_TransmitFD(U32 Type, U32 Card, U32 Port, ZCAN_FD_MSG *pData, U32 Count);
+EXTERN_C U32 ZCAN_API VCI_Receive(U32 Type, U32 Card, U32 Port, ZCAN_20_MSG *pData, U32 Count, U32 Time);
+EXTERN_C U32 ZCAN_API VCI_ReceiveFD(U32 Type, U32 Card, U32 Port, ZCAN_FD_MSG *pData, U32 Count, U32 Time);
+EXTERN_C U32 ZCAN_API VCI_Debug(U32 Debug);
+
+// LIN
+EXTERN_C U32 VCI_InitLIN(U32 Type, U32 Card, U32 LinChn, PZCAN_LIN_INIT_CONFIG pLINInitConfig);
+EXTERN_C U32 VCI_StartLIN(U32 Type, U32 Card, U32 LinChn);
+EXTERN_C U32 VCI_ResetLIN(U32 Type, U32 Card, U32 LinChn);
+EXTERN_C U32 VCI_TransmitLIN(U32 Type, U32 Card, U32 LinChn, PZCAN_LIN_MSG pSend, U32 Len);
+EXTERN_C U32 VCI_GetLINReceiveNum(U32 Type, U32 Card, U32 LinChn);
+EXTERN_C U32 VCI_ClearLINBuffer(U32 Type, U32 Card, U32 LinChn);
+EXTERN_C U32 VCI_ReceiveLIN(U32 Type, U32 Card, U32 LinChn, PZCAN_LIN_MSG pReceive, U32 Len,int WaitTime);
+EXTERN_C U32 VCI_SetLINSubscribe(U32 Type, U32 Card, U32 LinChn, PZCAN_LIN_SUBSCIBE_CFG pSend, U32 nSubscribeCount);
+EXTERN_C U32 VCI_SetLINPublish(U32 Type, U32 Card, U32 LinChn, PZCAN_LIN_PUBLISH_CFG pSend, U32 nPublishCount);
+
+// 合并接收
+EXTERN_C U32 VCI_TransmitData(unsigned Type, unsigned Card, unsigned Port, ZCANDataObj *pData, unsigned Count);
+EXTERN_C U32 VCI_ReceiveData(unsigned Type, unsigned Card, unsigned Port, ZCANDataObj *pData, unsigned Count, unsigned Time);
+
+// UDS
+EXTERN_C U32 VCI_UDS_Request(unsigned Type, unsigned Card, const ZCAN_UDS_REQUEST *req, ZCAN_UDS_RESPONSE *resp, U8 *dataBuf, U32 dataBufSize);
+EXTERN_C U32 VCI_UDS_Control(unsigned Type, unsigned Card, const ZCAN_UDS_CTRL_REQ *ctrl, ZCAN_UDS_CTRL_RESP *resp);
Author	SHA1	Message	Date
zmv	4eff3825be	feat: add mask tool	2026-09-30 17:04:29 +08:00
zmv	f87e5aad40	Fix live CAN feedback with CH0-only asynchronous risk transmission Send 0x1F6 risk updates through a bounded latest-result worker on CH0 and disable CH1 initialization, reception, transmission and live display. Preserve the four actual-position bytes from 0x391 and recorded-session compatibility. Include regression coverage, Orin camera/TensorRT/CAN validation, and the verified standalone binary with refreshed checksums.	2026-09-28 13:59:26 +08:00
zmv	515a9f32d8	Add USBCANFD transport and visualize 0x391 door feedback	2026-09-24 15:41:49 +08:00
zmv	475fe2440b	Enable visualization by default for inference and replay	2026-09-24 15:15:51 +08:00
zmv	daab1db58f	Add H.264 inference session recording and replay	2026-09-24 15:05:44 +08:00