User Journey

An operator sweeps the North Perimeter camera. Sample reads the loop; the change-gate skips the static frames at $0 and forwards the few that changed to the metered detector. Detection recovers a person above the confidence floor; the class filter lets person through (staff and animals are dropped); the zone-test rules a person in a perimeter zone an intrusion candidate. Track measures the dwell streak, and because it crosses the three-frame confirm window, the event is confirmed — critical severity, with its dwell seconds and confidence — and the camera ring turns red.

The confirmed event is raised to the control-room queue and emitted as `security_event.raised` on the shared bus — App 09's outbound coupling and C5's security spine. Downstream operations and the property's incident/analytics views read that event stream; the operator acknowledges or dismisses from the queue, and the action is written to the audit trail. A benign sweep — only staff crossing, or a track too brief to confirm — raises nothing, which is the point.