diff --git a/audit/tracker.go b/audit/tracker.go
new file mode 100644
index 0000000..df34cee
--- /dev/null
+++ b/audit/tracker.go
@@ -0,0 +1,20 @@
+package audit
+
+import "strings"
+
+type Tracker struct { windows map[string]*Window }
+
+func NewTracker() *Tracker { return &Tracker{windows: make(map[string]*Window)} }
+
+func (t *Tracker) Accept(frame Frame) string {
+    if strings.TrimSpace(frame.Device) == "" { return "missing device" }
+    window := t.windows[frame.Device]
+    if window == nil { window = &Window{}; t.windows[frame.Device] = window }
+    return window.Observe(frame.Sequence)
+}
+
+func (t *Tracker) Snapshot() map[string]Summary {
+    result := make(map[string]Summary, len(t.windows))
+    for device, window := range t.windows { result[device] = window.Summary }
+    return result
+}