Designing a Tire-Wear Image Evidence Pipeline: Capture Protocols, Metadata Schemas, Quality Scoring, and Audit Trails

Photographs of tire wear often enter an operations system as informal attachments: a few phone images, a vehicle identifier, and perhaps a short note. That is enough for a human who was present, but it is weak evidence for someone reviewing the record weeks later. The image may be sharp yet show the wrong wheel. A useful close-up may have lost its relationship to the vehicle overview. Compression may erase small cracks. A file timestamp may describe an export rather than capture. If a computer-vision project later consumes that archive, hidden inconsistency becomes labelled-data debt.

This article designs a photographic evidence pipeline rather than a tread-depth measurement system. Its job is to establish what was photographed, when and how it was captured, whether the pixels are usable, who changed each interpretation, and which facts remain uncertain. The design deliberately keeps image observations separate from service decisions. KMJ Tire performs tire services and oil changes; a photograph suggesting a non-tire mechanical concern should be documented and referred to an appropriate mechanical provider rather than represented as work KMJ performs.

Calgary makes this problem interesting. Chinook-driven thaw and refreeze cycles change what is visible on a tire. Road salt leaves pale films. Gravel season adds dust and small stones. A vehicle arriving from Deerfoot Trail may carry wet spray, while one returning from Highway 1 west can arrive with packed snow or mountain-road grime. An evidence pipeline must record these conditions instead of pretending every image came from a clean laboratory.

Start With an Evidence Contract, Not a Camera App

The first engineering artifact should be a short evidence contract. It states what the pipeline can prove and what it cannot. A defensible contract might promise that every accepted image is attached to one inspection session, retains the original bytes, records capture context, receives automated quality measurements, and preserves reviewer actions. It should not promise that a photo alone determines tire safety, proves a root cause, or substitutes for an in-person assessment.

Model the session as the unit of work. A session belongs to a vehicle or fleet asset, but the identifier should be internal and minimally revealing. Within it, create wheel-position records, capture attempts, accepted originals, derived assets, automated checks, observations, and review events. That hierarchy prevents the familiar folder problem in which IMG_4832.jpg sits beside a note saying “rear tire” with no reliable indication of which rear position was intended.

The capture protocol needs required views. An operational baseline can include a vehicle-context frame, one wheel-context frame for each inspected position, a straight-on tread overview, and focused detail frames for notable areas. The protocol should allow extra images without treating quantity as quality. Ten nearly identical blurry frames are worse than four deliberate views with clear relationships.

Document exclusions too. Faces, house numbers, unrelated license plates, papers on a seat, and personal items have no evidentiary value for tire wear. The interface should help the operator avoid them before capture. Redaction is a fallback, not a reason to collect broadly. For driver education about tire condition, Be Tire Smart supplies useful background without turning an image record into a diagnosis.

Acceptance is a state transition, not a feeling. A frame can be captured, uploaded, validated, needs_recapture, accepted, redacted, superseded, or rejected. Only accepted originals and approved derivatives should reach review datasets. Raw attempts can have a shorter retention policy, provided the policy is explicit and legal requirements are respected.

Give Every Capture a Stable Identity

Never use a filename as the primary key. Mobile operating systems reuse names, messaging apps rewrite names, and exports reorder sequences. Generate a cryptographically random capture ID before the shutter action if the client permits it, then include that ID in the upload envelope. The server separately computes a content digest from the received bytes. Identity answers “which record?” while the digest answers “are these exact bytes already known?”

A useful naming convention is only a convenience:

{session_id}_{position}_{view_role}_{capture_id}.{ext}
01J4..._LR_TREAD_OVERVIEW_01J5....jpg

Do not embed customer names, phone numbers, addresses, or full vehicle identification numbers in object keys. Object-storage paths leak into logs, caches, support screenshots, and access reports. A random tenant-scoped prefix plus opaque IDs provides enough organization. Human-readable labels belong in authorized application views.

Capture identity also needs lineage. The original is immutable. Rotation, colour normalization, redaction, thumbnails, and annotation overlays are derivatives with their own digests and parent references. A reviewer must always be able to reach the untouched original, subject to access controls, and see which transformation produced the displayed asset.

The digest should be computed server-side using SHA-256 or a similarly appropriate contemporary algorithm. A client digest can accelerate resumable upload checks, but it is an assertion until the server verifies it. Store byte length, detected media type, decoder result, dimensions, colour profile, and digest in the same ingestion transaction. Reject polyglot or malformed files rather than trusting the extension.

Idempotency matters on weak connections. A phone moving between a service bay network and mobile data may repeat a request. An idempotency key scoped to the session and capture ID lets the server return the existing record instead of creating twins. Exact-byte duplicate detection should warn about repeated content while still preserving the attempted relationship for audit purposes.

Define a Calgary-Ready Capture Protocol

An effective protocol guides behaviour in seconds. Begin with a context frame showing enough of the vehicle and wheel location to establish position without collecting unrelated surroundings. Then move to the wheel context, tread overview, and any detail. The app should display a silhouette with LF, RF, LR, and RR positions; trailers and dual-wheel assets need an extensible position vocabulary rather than four hard-coded buttons.

Lighting instructions must respond to reality. Direct sun can make tread valleys black while washing out raised rubber. Indoor LEDs can flicker or create bands. Snow glare shifts exposure. A chinook afternoon can place one side of a vehicle in bright sun and the other in deep shade. The protocol should ask the operator to seek diffuse light, avoid flash reflections on wet rubber, and move the light source rather than digitally brightening a failed frame.

Surface condition deserves a required field with controlled values such as dry_clean, wet, salt_film, dust, snow, ice, mud, and unknown. Multiple values may apply. These are not cosmetic notes: they influence quality scoring and later model training. A network trained mainly on cleaned tires may fail on the slushy conditions common after a Calgary temperature swing.

Angle guidance should be role-specific. A tread overview needs the optical axis close to perpendicular to the local tread surface. A sidewall record needs lettering in focus and a frame broad enough to retain context; tire sidewall information helps operators understand which markings matter. Damage-detail frames can be oblique when the angle reveals depth, but they should follow a perpendicular establishing frame.

Highway context belongs in session metadata, not inferred from wear. An operator may record that an asset normally runs Deerfoot, Stoney Trail, urban deliveries, gravel approaches, or Highway 1 west when that fact is supplied by the fleet. The pipeline must not manufacture route history from pixels. Likewise, load context should reference verified operational data. Load-index guidance explains the marking, but an image of the marking does not prove the vehicle’s actual carried load.

Use a Metadata Schema That Admits Uncertainty

Metadata should distinguish observed, supplied, measured, inferred, and unknown values. Without provenance at the field level, a reviewer cannot tell whether wheel_position: LR came from the operator’s selection, a barcode association, or a vision model guess. Every material fact should carry a source and, where applicable, confidence.

Here is a compact upload envelope:

{
  "schema_version": "1.2",
  "session_id": "01J4Z8Q7KRF0Y2M5N8D3",
  "capture_id": "01J4Z9A2XQJ7C6H1P4TT",
  "asset_ref": "fleet_asset_8f42",
  "wheel_position": {"value": "LR", "source": "operator"},
  "view_role": "tread_overview",
  "captured_at": "2026-08-04T15:42:18.221Z",
  "timezone_offset_minutes": -360,
  "surface_conditions": ["wet", "salt_film"],
  "environment": {"location_class": "service_bay", "temperature_c": 7.0},
  "device": {"app_build": "2026.08.1", "camera_facing": "rear"},
  "operator_note": "Spray remained after Deerfoot arrival",
  "consent_basis": "fleet_service_record"
}

Treat device-generated EXIF as untrusted input. Preserve it in a quarantined metadata document, then normalize selected fields after validation. GPS should be removed unless it has a documented operational need. Device serial numbers and owner names should not enter analytics tables. Capture time can be compared with server receipt time, but clock drift means disagreement should create a flag rather than silently rewrite history.

Schema evolution must be intentional. Store a version on every envelope and write deterministic migrators. Never reinterpret an old enum in place. If wet later splits into standing_water and surface_damp, old records remain wet unless a human or reproducible process adds a new derived classification. That discipline is essential when image corpora outlive application releases.

Separate Transactional Records From Binary Objects

Large image bytes belong in object storage; relational records belong in a database. The database should retain the object key, version ID where supported, byte digest, size, media characteristics, ownership boundary, and retention class. A signed URL is a temporary access mechanism, never the stored identity of an image.

One PostgreSQL sketch looks like this:

create table evidence_image (
  image_id uuid primary key,
  session_id uuid not null references inspection_session(session_id),
  capture_id uuid not null,
  wheel_position text not null,
  view_role text not null,
  object_key text not null unique,
  object_version text,
  sha256 char(64) not null,
  byte_length bigint not null check (byte_length > 0),
  width_px integer not null,
  height_px integer not null,
  captured_at timestamptz,
  received_at timestamptz not null default now(),
  evidence_state text not null,
  schema_version text not null,
  metadata jsonb not null,
  unique (session_id, capture_id)
);

create index evidence_by_session_position
  on evidence_image(session_id, wheel_position, view_role);

The database transaction can reserve an image record before upload, but it should not mark the record accepted until object verification completes. A reconciliation worker finds abandoned reservations and orphaned objects. Use an outbox table to publish image.verified events only after the state change commits; this avoids a message announcing data that the database later rolls back.

Object policies should prevent overwriting an original key. If storage supports versioning and retention locks, configure them according to policy rather than relying only on application promises. Encryption at rest, tenant-scoped authorization, narrow service roles, and access logging are baseline controls. Backups need restore tests that reconnect database records with matching object versions.

Validate Pixels Before Asking a Human to Interpret Them

Ingestion validation should be fast, deterministic, and explainable. First decode the entire image, not merely its header. Enforce permitted formats, dimensions, pixel count, and file-size bounds. Normalize orientation for display as a derivative while retaining the original bytes and EXIF orientation. Reject decompression bombs and files whose detected content disagrees with their declared type.

Then calculate technical signals: Laplacian variance or another focus proxy, motion-blur directionality, clipped-shadow ratio, clipped-highlight ratio, local contrast, colour cast, glare area, obstruction estimate, and subject occupancy. None is universally meaningful by itself. Wet black rubber naturally produces highlights, while deep tread valleys naturally contain shadows. Thresholds need calibration by view role and surface condition.

Angle validation can use a lightweight segmentation model or geometric cues. For a tread overview, estimate the visible tread region, its principal axis, and perspective convergence. The system need not claim an exact camera angle. It can classify acceptable, borderline, or recapture with reasons such as “tread occupies too little of frame” or “perspective hides shoulder region.” A transparent reason is more useful than a mysterious score of 0.61.

Run these checks before upload completion when possible, but repeat them server-side. Client validation provides immediate coaching; server validation provides consistency and cannot be bypassed by an old app. Keep algorithm versions beside outputs so a later calibration does not rewrite history.

Build a Quality Score Without Hiding Failure Reasons

A composite score is convenient for queues, yet it should never replace component values. Suppose focus, exposure, framing, angle, and obstruction each range from zero to one. A weighted sum may be appropriate for ranking:

Q = 0.28F + 0.18E + 0.22R + 0.22A + 0.10O

Here O means visibility after accounting for obstruction, not the obstruction amount. The numbers are illustrative calibration weights, not safety thresholds. A hard rule sits alongside the sum: if subject occupancy is below the minimum for the selected view, the frame requires recapture regardless of Q. This prevents excellent lighting from compensating for a tire that occupies a tiny corner.

Store raw metrics, normalized components, calibration version, decision, and human-readable reasons. A result might say needs_recapture because focus is below the tread-overview threshold and the centre grooves are clipped. Avoid claims such as “bad tire.” The automated system is judging photographic fitness, not tire fitness.

Quality drift needs monitoring. Track distributions by device family, app version, bay, capture role, surface condition, and time of day. If a release suddenly raises shadow clipping, perhaps orientation or colour conversion changed. If one bay produces glare failures, the operational fix may be moving a lamp. Aggregate metrics should not become employee surveillance; define access and use boundaries before collection.

When a frame documents a potential puncture area, route the person to a tire-service assessment rather than issuing a pixel-based verdict. KMJ’s tire repair information provides service context, while the evidence record preserves what was visible at capture.

Detect Blur, Glare, Lighting, and Framing Carefully

Blur detection is frequently oversimplified. Laplacian variance drops for defocused images, but it also drops on smooth sidewall regions. Compute it over the detected tread or lettering region, not the whole frame. Add edge orientation analysis to distinguish directional motion blur from soft focus. Compare multiple scales so aggressive phone sharpening does not fool the metric.

Exposure validation should examine spatial maps. A global histogram can look healthy while the tread is nearly black and the concrete floor is bright. Segment the tire region first, then calculate clipped pixels and usable tonal range inside it. For wet tires, specular highlights can be acceptable when they do not obscure the feature of interest. Large continuous glare masks are more concerning than scattered points.

Framing uses the declared role. A wheel-context frame should include the full wheel and enough vehicle structure to support position. A tread-detail frame should fill more of the image but must not lose all orientation cues. The pipeline can request a paired overview rather than rejecting a valuable close-up solely for lacking context.

Lighting colour matters less than visibility, but extreme casts can harm later CV work. Preserve the original, estimate white balance only as a metric, and create a normalized derivative if the use case justifies it. Never replace the original with a cosmetically improved file. Road salt may resemble cracking or residue to a naive model; condition metadata and diverse training examples are the defence.

Treat Privacy and Redaction as Data Engineering

Privacy begins with minimization. Configure the capture UI so operators aim tightly, and explain why a wider neighbourhood scene is unnecessary. If the vehicle-context view includes a license plate, decide whether the operational record truly requires it. Often an internal asset reference already establishes identity, making visible plate text redundant.

Automated detectors can flag faces, plates, documents, QR codes, and screen content. Their output should create a privacy-review task, not silently destroy pixels. Redaction produces a derivative with a mask manifest describing detector version, reviewer, regions, method, and parent digest. Access to the original is narrower than access to the redacted working asset.

{
  "derivative_type": "privacy_redacted",
  "parent_sha256": "6a8d...e21c",
  "transform_version": "redact-2.3.0",
  "regions": [
    {"kind": "plate", "box": [122, 88, 284, 143], "method": "solid_fill"}
  ],
  "review_state": "approved",
  "reviewer_role": "privacy_reviewer"
}

Do not put sensitive content into free-text logs. Operator notes require length limits, clear guidance, and restricted visibility. Structured route classes are preferable to precise trip narratives. Retention should differ among originals, operational derivatives, temporary uploads, audit events, and model-training exports. A legal or contractual hold must override routine deletion through an explicit workflow.

Training exports deserve special scrutiny. Consent to maintain a fleet record does not automatically imply permission to train models. Build a dataset eligibility view that considers consent basis, retention, redaction, tenant policy, review status, and exclusions. Export manifests should list immutable digests so researchers cannot quietly substitute files.

Preserve an Append-Only Audit Story

Auditability does not require a fashionable ledger. It requires immutable source objects, append-only events, controlled corrections, reliable clocks, and verifiable relationships. A reviewer changing wheel position from LR to RR should create a correction event containing the old value, new value, reason, actor, time, and referenced image digest. The current projection can show RR, while history remains visible.

Create a hash chain within each session if tamper evidence is important. Each event includes the previous event hash, canonical payload hash, timestamp, and signer identity. Periodically anchor batch roots in a separately controlled system. This does not prove the original observation was true; it helps reveal later alteration.

event_hash = SHA256(
  canonical_json(payload) || previous_event_hash || actor_id || occurred_at
)

Canonicalization rules must be fixed and tested. JSON key order, Unicode normalization, decimal representation, and timestamp precision can otherwise change hashes without changing meaning. Key rotation and service-account identity also belong in the design. “System” is not a useful actor if five workers share it.

Audit logs must record reads of sensitive originals as well as writes. Alerts can flag bulk access, unusual export volume, or access outside a role’s normal scope. Keep operational monitoring separate from evidence interpretation: a download anomaly is a security concern, not information about tire condition.

Design Human Review Around Disagreement

The review interface should present context, not just a gallery. Show vehicle asset reference, wheel map, image role, surface conditions, original-versus-derivative status, quality reasons, and linked views. Let reviewers zoom into original resolution without forcing a lossy screenshot workflow. A side-by-side view is valuable when checking a redaction or comparing paired angles.

Use structured observations such as visible_irregularity, possible_foreign_object, sidewall_marking_legible, area_obscured, and no_observation_due_to_quality. These labels describe pixels. They should not be phrased as conclusive causes or service promises. A human can add a note explaining why in-person inspection is needed.

Disagreement is training data. If two reviewers differ, preserve both labels and route the item to adjudication. Do not overwrite the first interpretation. Measure agreement by label and condition; low agreement may reveal an ambiguous rubric rather than careless people. Gravel, salt residue, shadow, and water can each create systematic confusion.

Mechanical concerns outside tire service must be handled plainly. If the visible evidence raises a concern that would require alignment, brake, suspension, steering, diagnostic, or other mechanical work, the record should recommend assessment by an appropriate mechanical provider. It must not imply that KMJ offers that work. Wheel-balance symptoms are within tire-service context, and wheel balancing guidance can support a separate, properly scoped service discussion.

Prepare for Computer Vision Without Polluting Ground Truth

Computer-vision readiness begins with dataset governance, not model selection. Define the prediction target, unit of analysis, exclusion criteria, and label provenance. Split datasets by vehicle or fleet asset, not random images, or nearly identical views from one session can leak across training and test sets. Consider temporal splits to test whether a model survives new devices, seasons, and road residue.

Store annotations in an open, versioned representation. Bounding boxes may be adequate for foreign-object candidates; segmentation masks may be necessary for tread-region visibility or privacy regions. Each annotation references an image digest, ontology version, annotator role, and adjudication state. Model-generated prelabels must remain distinguishable from human labels.

Balance includes environments, not just classes. Seek coverage across dry summer rubber, wet shoulder-season conditions, winter snow residue, gravel dust, salt film, indoor bays, outdoor shade, and different phone cameras. Calgary’s seasons can create shortcuts: if every positive example comes from winter, a model may learn snow texture instead of the intended feature.

Do not normalize away operational reality. Keep originals and produce reproducible training transforms. Record resize method, crop, colour conversion, augmentation seed, and code version in an experiment manifest. A model card should state which capture roles and conditions were evaluated, known failure modes, and that photographic classification does not replace physical tire assessment.

For seasonal operational context, seasonal tire changes, all-weather tire guidance, and winter tire information can inform user education. Those pages are references, not labels for an image dataset.

Operate the Pipeline With Queues and Service-Level Signals

An ingestion pipeline should expose state counts and age, not merely request latency. Useful signals include uploads awaiting verification, images stuck in decoding, recapture requests without a replacement, privacy flags awaiting review, accepted sessions missing a required view, and derivatives whose parent cannot be resolved. Alert on backlog age and error-rate changes rather than every single expected rejection.

Use dead-letter handling with replay controls. A malformed image is a terminal validation result, while a transient object-store timeout is retryable. Classify errors explicitly so exponential backoff does not repeatedly decode malicious or impossible input. Replay must be idempotent and should retain the original algorithm version unless a deliberate reprocessing job is launched.

Capacity planning should use pixel volume and derivative work, not image count alone. A panoramic frame can cost far more than a normal phone image. Place upper bounds before decode, stream uploads, and isolate expensive CV tasks from the transactional API. Backpressure should coach the client to pause without losing capture identities.

Observability also needs trace boundaries. Propagate a session-safe trace ID through reservation, upload, verification, quality analysis, redaction, and review events. Do not place personal or vehicle-sensitive fields into metric labels. High-cardinality identifiers belong in secured logs or traces with appropriate retention, not in public dashboards.

Fleet operators can use commercial tire service information and fleet management context to understand the human service workflow around evidence. The pipeline itself should remain tenant-aware, policy-driven, and explicit about who can view which fleet records.

Walk Through a Calgary Fleet Capture

Consider a delivery asset returning from Stoney Trail after a cold morning followed by a warm chinook afternoon. The operator starts session S-204, selects the left-rear position, and records wet plus salt_film. A wheel-context image passes framing but contains a distant plate from another vehicle. The privacy detector flags it. The tread overview is sharp, although glare covers one shoulder. A focused second angle makes that shoulder visible.

The server verifies all three byte digests and retains originals. Quality analysis accepts the context frame for evidentiary linkage, requests redaction for general review use, marks the first tread frame borderline, and accepts the paired angle. The workflow does not average the two tread frames into a fictional certainty. It records that one region was obscured in one view and visible in another.

A reviewer notices a visible irregular area and labels its location without declaring a cause. The record routes the asset for an in-person tire assessment. If a separate observation suggests a non-tire mechanical issue, the note directs the fleet to an appropriate mechanical provider. Each action becomes an audit event.

Weeks later, a dataset curator queries only privacy-approved, accepted tread views with adjudicated labels and compatible consent. The export manifest pins digests and excludes the borderline frame. A researcher can reproduce the selection without seeing fleet names. That is what CV readiness looks like: careful operational provenance before clever modelling.

Test Failure Modes, Not Just Happy Paths

Automated tests should submit truncated JPEGs, misleading extensions, oversized dimensions, duplicated bytes under new names, rotated EXIF, missing timestamps, future timestamps, repeated idempotency keys, and invalid wheel positions. Verify that originals cannot be overwritten and that derivatives cannot point to nonexistent parents. Property-based tests are particularly useful for schema migrators and canonical event hashing.

Run visual test fixtures for glare, motion blur, defocus, shadow clipping, snow obstruction, salt film, and perspective. Threshold tests need boundary cases on both sides. Maintain device-specific fixtures when camera processing changes. A quality model that passes curated examples but fails after a phone update is not production-ready.

Exercise privacy failures: a detector misses a small face, a reviewer rejects an incomplete mask, an export attempts to include an unapproved original, and a deletion request intersects a retention hold. Confirm least-privilege roles by attempting forbidden reads. Restore an archived session from backup and recalculate digests.

Chaos tests can interrupt upload finalization between object write and database commit. Reconciliation should either reconnect a verified object to its reservation or quarantine it. Event consumers must tolerate duplicates and out-of-order delivery. A projection can be rebuilt from the append-only stream and compared with the live state.

Use a Deployment Checklist With Explicit Owners

Before rollout, assign owners for capture protocol, schema, storage policy, privacy review, quality calibration, security response, dataset governance, and user support. Write a data-flow diagram showing trust boundaries. Complete a privacy impact assessment appropriate to the organization. Document deletion, hold, export, correction, and breach-response procedures.

Pilot across different Calgary conditions and device families. Sample failures manually instead of watching only averages. Ask operators whether the guidance is understandable while their hands are cold or wet. Measure recapture burden by reason. Revise thresholds when evidence supports it, and version every revision.

A compact release checklist is:

• original bytes are immutable and digest-verified;
• required views and wheel positions are enforced;
• privacy collection is minimized and redaction is reviewable;
• quality components and reasons remain visible;
• uncertain observations are labelled as uncertain;
• non-tire mechanical concerns are referred elsewhere;
• audit events survive corrections and reprocessing;
• dataset exports require policy eligibility;
• restore, replay, and deletion workflows have been tested;
• dashboards reveal backlog age without exposing personal data.

Drivers seeking local service-area context can review KMJ Tire’s service areas. That operational reference should remain separate from technical evidence: geography may explain capture conditions, but it must not become a proxy label for tire condition.

Keep the Evidence Honest From Shutter to Archive

Model Recapture as a First-Class Operational Loop

Recapture should not be a generic rejection banner. It is a linked workflow connecting the failed attempt, the reason, the replacement, and the final disposition. A request needs a reason code such as focus_tread_region, missing_position_context, glare_obscures_subject, incorrect_view_role, or privacy_avoidance. Pair that code with one short instruction written for the operator: move closer, steady the device, step out of direct reflection, or add a context view. Avoid vague advice such as “take a better photo.”

The replacement carries a supersedes_capture_id relationship but does not erase the first attempt. This link enables useful analysis: which prompts solve failures, which reasons recur by device, and where the protocol itself causes confusion. Keep failed pixels out of normal reviewer screens after replacement unless an authorized audit view is opened. Operational visibility and clutter control can coexist.

Set loop limits deliberately. An app that demands six retries in blowing snow may encourage unsafe behaviour or fabricated compliance. After a small number of failed attempts, allow an exception state with a structured reason such as environmental obstruction, accessibility constraint, or device malfunction. A supervisor can decide whether another capture setting is appropriate. The exception is evidence about process limitations, not permission to mark the missing view as successful.

Offline capture adds another wrinkle. Validate locally with the bundled algorithm version, queue encrypted files, and display upload state clearly. Once connectivity returns, the server repeats validation and may disagree because its calibration is newer. Preserve both results. If server policy requires another frame, explain that the original passed an older on-device check. Silent contradictions destroy operator trust.

Measure recapture yield rather than rejection alone. If an instruction frequently produces an accepted replacement, it is useful. If “angle too steep” leads to another angle failure, improve the on-screen overlay or examples. Break results down by view role and environment, while maintaining fair-use limits around worker analytics. The objective is better evidence design, not a leaderboard of people working in different conditions.

Govern Reprocessing and Algorithm Change

Quality algorithms, privacy detectors, and CV models will evolve. Reprocessing should create new assessment records tied to the same immutable original, never update old outputs in place. Each assessment includes algorithm name, model digest, configuration digest, runtime environment, start time, completion time, and status. The application chooses which version is current through policy, while an auditor can compare generations.

A reprocessing plan should answer why the run exists. Perhaps a glare detector was recalibrated for wet winter tires, a privacy model gained better plate recognition, or a decoder vulnerability required fresh validation. Define the eligible population with a saved query and manifest before execution. Record counts selected, skipped, succeeded, and quarantined. A resumable job cursor prevents a partial run from producing an unknowable corpus.

Do not automatically promote every new score. Run shadow evaluation on representative Calgary conditions, compare false recapture and missed-obstruction rates, and inspect disagreements. A detector that improves on clean indoor images but worsens on salt film may not be ready for winter operations. Promotion needs an approval event referencing evaluation artifacts.

Rollback means switching policy to a prior approved assessment version; it does not mean deleting the new results. Downstream exports pin versions so a model-training experiment remains reproducible after production policy changes. Cache keys must include algorithm and transform versions, otherwise a thumbnail or score generated under one policy can masquerade as another.

Finally, budget reprocessing like any batch system. Bound concurrency, isolate queues from live ingestion, watch object-read costs, and pause when customer-facing capture latency rises. Security patches may justify priority, but routine experimentation should never destabilize the active evidence path. Operational discipline protects both the archive and the people depending on it.

A trustworthy tire-wear image pipeline is less about a sophisticated classifier than disciplined boundaries. The camera client establishes intent. The ingestion layer preserves exact bytes. Metadata admits its sources and uncertainty. Quality checks judge whether pixels are usable, not whether a tire is safe. Privacy controls minimize and redact unrelated information. Human review preserves disagreement. Immutable lineage makes later transformation visible.

These choices turn a pile of phone photos into an evidence system that can support operations today and carefully governed computer vision later. They also make failure useful. A blurred frame becomes a specific recapture reason. A salt-covered surface becomes documented context. A corrected wheel position becomes an auditable event. A model’s weak performance in snow becomes a known coverage gap rather than a surprise.

For Calgary fleets, the practical goal is not laboratory perfection. It is repeatable capture across chinooks, road spray, gravel, deep cold, and dramatic day-night temperature swings while retaining enough context for a competent person to review the record. Keep service decisions with qualified people, keep mechanical referrals within their proper scope, and let the pipeline do what software does well: preserve identity, enforce process, expose uncertainty, and make every transformation traceable.