@trillboards/edge-sdk 0.2.40 → 0.2.42

package/dist/localSensing.d.ts

@@ -5,7 +5,6 @@ import { SensingProfileClient } from './SensingProfileClient';
 import { type ResolvedFeed, type SensingClient, type SensingLoopDeps } from './CloudSensingManager';
 import type { SharedFrameSource } from './MosaicSource';
 import { type LocalSchemaFieldSet } from './localInferenceSchema';
-import { type CloudEscalationPolicyOptions, type CloudEscalationStats } from './CloudEscalationPolicy';
 import type { EdgeAgentConfig } from './config';
 /**
  * Map a deployed profile's SELF-DESCRIBING type to the on-device field set.
@@ -43,30 +42,6 @@ export interface LocalSensingClientOptions {
      * isAlertWorthy(). Default: true.
      */
     attachEvidenceFrame?: boolean;
-    /**
-     * Per-frame resilience: when ON-DEVICE inference THROWS for a single frame,
-     * POST that frame to the CLOUD VLM (uploadClient.analyze) instead of losing it.
-     * Reuses the SAME upload client (no new provider). Opt-in (default false) so
-     * the plain local-sense path is unchanged; auto-sense's local branch enables it.
-     */
-    cloudFallbackOnError?: boolean;
-    /**
-     * Confidence-based CLOUD ESCALATION (Phase 6d). When the on-device model
-     * flags a CANDIDATE — a frame carrying real signal, judged by the SAME
-     * `isAlertWorthy` gate that governs the evidence frame — send THAT ONE frame
-     * to the cloud VLM for adjudication instead of shipping the local verdict.
-     *
-     * Distinct from `cloudFallbackOnError` (a per-frame degrade when local
-     * inference THROWS) and from `EdgeAgentConfig.localSensing.allowCloudFallback`
-     * (a whole-mode switch when the local runtime is unavailable). Those two reach
-     * for the cloud because the local path is BROKEN; this one because the local
-     * path WORKED and its judgement is worth confirming.
-     *
-     * Off unless `enabled: true` — see CloudEscalationPolicy.
-     */
-    cloudEscalation?: CloudEscalationPolicyOptions;
-    /** Feed label used only in the escalation log line. */
-    feedName?: string;
 }
 /**
  * Decide whether an on-device result is potentially ALERT-WORTHY — the gate that
@@ -90,46 +65,30 @@ export interface LocalSensingClientOptions {
  * Non-discriminative keys (source, captured_at, confidence, scene_description)
  * are ignored — see NON_DISCRIMINATIVE_KEYS for why.
  *
- * KNOWN BOUNDARY (deliberate privacy tradeoff): a route that alerts on ABSENCE
- * — `person_count lte 0`, `people_present eq false`, `shelf_state eq "empty"` —
- * fires on a genuinely empty scene, which this gate suppresses by design (a
- * blank-room frame is exactly the privacy harm the gate exists to prevent). The
- * server owns the route predicates and can request a frame for those routes;
- * operators who want every frame can disable the gate (attachEvidenceFrame).
- */
-export declare function isAlertWorthy(result: Record<string, unknown>): boolean;
-/**
- * A stable fingerprint of the ALERT-BEARING state of one result — "has the
- * operator-visible situation changed?" in one comparable string.
+ * ABSENCE (`absenceWatchedFields`) — the empty-shelf half. The rule above answers
+ * "is anything HERE?", which is the right question for people and the WRONG one for
+ * stock: "the shelf is empty" is a positive finding about a subject that IS in frame,
+ * and the operator asked to be told about it. So a field named in `absenceWatchedFields`
+ * flips: its EMPTY reading (`shelf_state: 'empty'`, `stock_level: 0`,
+ * `product_available: false`, `[]`, `{}`) counts as signal.
  *
- * Built from EXACTLY the keys `isAlertWorthy` judges (NON_DISCRIMINATIVE_KEYS
- * excluded), so the two can never drift: the same fields that decide whether a
- * frame carries signal decide whether that signal is NEW. Keys are sorted so
- * the model's property order cannot manufacture a change, and values are
- * compared as emitted — a `queue_length` of 3 and of 4 are genuinely different
- * facts and an operator route may key on exactly that boundary, so this
- * deliberately does NOT bucket numbers into invented bands.
+ * That set is not guessed from the field's spelling and is not an allowlist of stock
+ * words. The server derives it per screen from the operator's OWN saved route
+ * conditions — a field is in it only when an enabled route would actually FIRE on that
+ * field's empty reading (`shelf_state eq 'empty'`). So `smoking_activity_detected: false`
+ * on an empty scene stays suppressed, because no route targets its absence, and a
+ * profile with no absence-targeting route behaves byte-for-byte as before.
  *
- * Used by CloudEscalationPolicy's novelty bound: an unchanged signature means a
- * verdict the cloud has already adjudicated, so the frame stays on-premises.
+ * The privacy FLOOR is unconditional: `DEFAULT_SCENE_FIELD_KEYS` — the presence
+ * primitives and the DOOH audience block, i.e. every field whose subject IS the people
+ * in front of the camera — can NEVER be unlocked this way, even by a route that
+ * explicitly targets them (`person_count lte 0`). Absence of PEOPLE is the blank-room
+ * frame the gate exists to prevent; absence of STOCK is the operator's finding. That is
+ * the whole distinction, and it is enforced structurally rather than by tuning.
+ * Operators who want every frame regardless can still disable the gate
+ * (attachEvidenceFrame).
  */
-export declare function alertSignature(result: Record<string, unknown>): string;
-/**
- * Is cloud escalation actually ON for this local-sensing configuration?
- *
- * TWO settings decide it, and this is the ONLY place that combines them:
- * `cloudEscalation.enabled` opts in, and `attachEvidenceFrame: false` — the
- * operator's "no frame ever leaves this machine" switch — outranks it, because
- * escalation sends a frame. `LocalSensingClient` enforces the rule and the
- * startup banner reports it; they must read the same expression or the banner
- * will one day claim an egress posture the client is not running.
- */
-export declare function isCloudEscalationEnabled(options: {
-    attachEvidenceFrame?: boolean;
-    cloudEscalation?: {
-        enabled?: boolean;
-    };
-} | null | undefined): boolean;
+export declare function isAlertWorthy(result: Record<string, unknown>, absenceWatchedFields?: ReadonlySet<string> | readonly string[]): boolean;
 /**
  * LocalSensingClient — the SensingClient the cadence loop uses in LOCAL mode.
  * It runs the VLM ON-DEVICE (LiteRtVlmProvider — Gemma 4 on LiteRT-LM via
@@ -153,33 +112,26 @@ export declare function isCloudEscalationEnabled(options: {
  * gating local-inferred data out of the sold bidstream while still firing the
  * operator's Sense-Anything routes.
  *
- * ── CLOUD ESCALATION (opt-in, Phase 6d) ─────────────────────────────────────
- * Local Gemma is the always-on gate; the CLOUD is the judge for the frames it
- * flags. When `cloudEscalation.enabled` and the policy admits this frame, the
- * SAME JPEG is POSTed through the SAME upload client's `analyze()` — the cloud
- * path the connector already owns — and the cloud VLM's verdict becomes the
- * observation. Three properties are load-bearing:
+ * ── THERE IS NO CLOUD PATH ─────────────────────────────────────────────────
+ * This client once had three doors to the cloud VLM: `cloudFallbackOnError` (a
+ * per-frame degrade when local inference threw), `cloudEscalation` (Phase 6d —
+ * local Gemma gates, the cloud adjudicates the candidates it flags), and the
+ * whole-mode `allowCloudFallback` in auto-sense. All three are gone, and this
+ * supersedes the escalation architecture from #11971 ("local Gemma decides
+ * *when* to look, the cloud decides *what* it saw").
  *
- *   1. ONE FRAME, ONE OBSERVATION. An escalated frame does NOT also post its
- *      local `preAnalyzed` result. Posting both would double-count the same
- *      physical frame and put two verdicts for one moment in the stream —
- *      exactly the dual write the codebase forbids. The cloud verdict
- *      supersedes; the local one was a sampling decision, not a datum.
- *   2. NO PROVENANCE LAUNDERING. What lands is what the CLOUD inferred from a
- *      real frame, so the server's normal cloud provenance is the truthful
- *      stamp — identical to `cloud-sense` and to the existing
- *      `cloudFallbackOnError` frame. Nothing the local model produced enters
- *      that record, so `ingest_source='local_connector'` (which exists to keep
- *      operator-forgeable structured input out of the sold bidstream) does not
- *      apply and is not evaded: there IS no local structured input on this path.
- *   3. THE PRIVACY GATE IS UNCHANGED. Escalation reuses `isAlertWorthy`, so the
- *      set of frames that can leave the premises is exactly the set that
- *      already leaves as evidence photos — and `attachEvidenceFrame: false`
- *      (the operator's "no frame ever leaves" switch) disables escalation
- *      outright. An empty scene never escalates.
+ * The reason is arithmetic, not architecture. Measured 2026-08-12 over 255,812
+ * image-bearing cloud VLM calls: $0.007008 per analyzed frame. At a 30s cadence
+ * that is ~$605/camera/month, so a 16-camera store cost ~$9,688/month against a
+ * $99-500 subscription — about 10x underwater. Escalation narrowed WHICH frames
+ * went, and the earlier plan (plans/cctv-byo-sensing-plan.md:26) narrowed HOW
+ * OFTEN; neither changes the sign. A path that meters per frame does not belong
+ * in a flat-rate product, so the path is removed rather than rate-limited.
  *
- * A failed cloud call falls back to posting the local result, so an escalation
- * can degrade the ACCURACY of one frame but can never LOSE it.
+ * What replaces it: nothing on the frame path. A frame the on-device runtime
+ * cannot analyze is dropped and the fault is surfaced (see the catch in
+ * `analyze`), and a connector with no usable runtime WAITS and beacons its
+ * `waiting` state rather than silently spending.
  */
 export declare class LocalSensingClient implements SensingClient {
     private readonly localProvider;
@@ -190,25 +142,22 @@ export declare class LocalSensingClient implements SensingClient {
     private readonly basePrompt;
     private cachedSchema;
     private cachedPrompt;
+    /**
+     * Fields whose ABSENT reading an operator route on this screen fires on, from the
+     * deployed profile (see SensingProfileClient.absenceWatchedFields). Refreshed on the
+     * SAME cadence as the schema, because a route saved after the last poll must not be
+     * able to change the gate before the model is even emitting its field. Empty until a
+     * profile fetch succeeds, so the gate's default is the strict pre-existing behavior.
+     */
+    private cachedAbsenceWatchedFields;
     private lastProfileFetchMs;
     /** Send the analyzed JPEG (gated to alert-worthy frames) as evidence. Default true. */
     private readonly attachEvidenceFrame;
-    /** On a local-inference throw, POST that one frame to the cloud VLM. Default false. */
-    private readonly cloudFallbackOnError;
-    /**
-     * Rate/novelty bound on cloud escalation for THIS feed. Per-client (not
-     * global) on purpose: the budget an operator reasons about is "per camera",
-     * and one busy camera must not spend a quiet one's confirmations.
-     */
-    private readonly escalationPolicy;
-    /** Feed label for the escalation log line. */
-    private readonly feedName;
     /**
      * Frames the ON-DEVICE runtime actually produced a result for.
      *
      * Counted at the one place that knows — immediately after `localProvider
-     * .analyze()` RETURNS — so a `cloudFallbackOnError` frame (local threw, the
-     * cloud answered) and an escalated frame are both excluded. `auto-sense`
+     * .analyze()` RETURNS. `auto-sense`
      * reads this through `getSensingHealth().localInferences` as the only
      * positive proof that a `litert-lm serve` too busy to answer `/v1/models` is
      * busy rather than dead; a counter that a cloud call could advance would make
@@ -244,14 +193,6 @@ export declare class LocalSensingClient implements SensingClient {
      * log-diving. See LiteRtVlmProvider.getAcceleratorHealth.
      */
     getAcceleratorHealth(): LiteRtAcceleratorHealth;
-    /**
-     * Cloud-escalation counters for this feed — how many candidate frames were
-     * adjudicated by the cloud VLM, and why the rest were not. Read by
-     * `CloudSensingManager.getSensingHealth()` so escalation shows up on the
-     * operator's periodic capacity line: sending frames off-premises must be
-     * VISIBLE, not merely documented.
-     */
-    getEscalationStats(): CloudEscalationStats;
     /** Frames the on-device runtime produced a result for. See the field docs. */
     getLocalInferenceStats(): {
         completed: number;

package/dist/localSensing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"localSensing.d.ts","sourceRoot":"","sources":["../src/localSensing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAehD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,CAElG;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwBtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAatE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACzC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,qBAAa,kBAAmB,YAAW,aAAa;IA0CpD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IA1C/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAK;IAC/B,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAC/C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD,8CAA8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,wBAAwB,CAAK;IACrC,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IACxC;;;;OAIG;IACH,cAAc,EAAE,mBAAmB,CAAc;gBAG9B,aAAa,EAAE,iBAAiB,EAChC,YAAY,EAAE,qBAAqB,EACpD,OAAO,GAAE,yBAA8B;IAwBzC,WAAW,IAAI,MAAM;IAIrB,kBAAkB,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAItF;;;;;;;;;OASG;YACW,qBAAqB;IAqBnC;;;;;OAKG;IACH,oBAAoB,IAAI,uBAAuB;IAI/C;;;;;;OAMG;IACH,kBAAkB,IAAI,oBAAoB;IAI1C,8EAA8E;IAC9E,sBAAsB,IAAI;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE;IAIzC,OAAO,CACX,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe,GAChE,OAAO,CAAC,uBAAuB,CAAC;CAkHpC;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc,CAAC;IAC7D,iBAAiB,CAAC,EAAE,CAClB,IAAI,EAAE,YAAY,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,iBAAiB,CAAC;IACjE,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,qBAAqB,CAAC;IACpE,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,oBAAoB,GAAG,SAAS,CAAC;IAChF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;mFAC+E;IAC/E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,IAAI,CAAC,EAAE,qBAAqB,GAC3B,eAAe,EAAE,CAmGnB"}
+{"version":3,"file":"localSensing.d.ts","sourceRoot":"","sources":["../src/localSensing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAehD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,mBAAmB,CAElG;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAE/B;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,GAC7D,OAAO,CAsCT;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,kBAAmB,YAAW,aAAa;IAuCpD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAvC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,YAAY,CAAS;IAC7B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B,CAA0C;IAC5E,OAAO,CAAC,kBAAkB,CAAK;IAC/B,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB,CAAK;IACrC,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IACxC;;;;OAIG;IACH,cAAc,EAAE,mBAAmB,CAAc;gBAG9B,aAAa,EAAE,iBAAiB,EAChC,YAAY,EAAE,qBAAqB,EACpD,OAAO,GAAE,yBAA8B;IAWzC,WAAW,IAAI,MAAM;IAIrB,kBAAkB,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAItF;;;;;;;;;OASG;YACW,qBAAqB;IAsBnC;;;;;OAKG;IACH,oBAAoB,IAAI,uBAAuB;IAK/C,8EAA8E;IAC9E,sBAAsB,IAAI;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE;IAIzC,OAAO,CACX,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe,GAChE,OAAO,CAAC,uBAAuB,CAAC;CAyDpC;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,cAAc,CAAC;IAC7D,iBAAiB,CAAC,EAAE,CAClB,IAAI,EAAE,YAAY,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,iBAAiB,CAAC;IACjE,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,qBAAqB,CAAC;IACpE,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,oBAAoB,GAAG,SAAS,CAAC;IAChF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;mFAC+E;IAC/E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,IAAI,CAAC,EAAE,qBAAqB,GAC3B,eAAe,EAAE,CA8FnB"}

package/dist/localSensing.js

@@ -3,15 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalSensingClient = void 0;
 exports.fieldSetForProfileType = fieldSetForProfileType;
 exports.isAlertWorthy = isAlertWorthy;
-exports.alertSignature = alertSignature;
-exports.isCloudEscalationEnabled = isCloudEscalationEnabled;
 exports.buildLocalSensingLoops = buildLocalSensingLoops;
 const AudienceAnalyzeClient_1 = require("./AudienceAnalyzeClient");
 const LiteRtVlmProvider_1 = require("./LiteRtVlmProvider");
 const SensingProfileClient_1 = require("./SensingProfileClient");
 const CloudSensingManager_1 = require("./CloudSensingManager");
 const localInferenceSchema_1 = require("./localInferenceSchema");
-const CloudEscalationPolicy_1 = require("./CloudEscalationPolicy");
 const legacyRecorderProfile_1 = require("./legacyRecorderProfile");
 /** How long a fetched profile is cached before the connector re-checks for a new alert. */
 const DEFAULT_PROFILE_TTL_MS = 5 * 60 * 1000;
@@ -85,92 +82,80 @@ const NON_DISCRIMINATIVE_KEYS = new Set(['source', 'captured_at', 'confidence',
  * Non-discriminative keys (source, captured_at, confidence, scene_description)
  * are ignored — see NON_DISCRIMINATIVE_KEYS for why.
  *
- * KNOWN BOUNDARY (deliberate privacy tradeoff): a route that alerts on ABSENCE
- * — `person_count lte 0`, `people_present eq false`, `shelf_state eq "empty"` —
- * fires on a genuinely empty scene, which this gate suppresses by design (a
- * blank-room frame is exactly the privacy harm the gate exists to prevent). The
- * server owns the route predicates and can request a frame for those routes;
- * operators who want every frame can disable the gate (attachEvidenceFrame).
+ * ABSENCE (`absenceWatchedFields`) — the empty-shelf half. The rule above answers
+ * "is anything HERE?", which is the right question for people and the WRONG one for
+ * stock: "the shelf is empty" is a positive finding about a subject that IS in frame,
+ * and the operator asked to be told about it. So a field named in `absenceWatchedFields`
+ * flips: its EMPTY reading (`shelf_state: 'empty'`, `stock_level: 0`,
+ * `product_available: false`, `[]`, `{}`) counts as signal.
+ *
+ * That set is not guessed from the field's spelling and is not an allowlist of stock
+ * words. The server derives it per screen from the operator's OWN saved route
+ * conditions — a field is in it only when an enabled route would actually FIRE on that
+ * field's empty reading (`shelf_state eq 'empty'`). So `smoking_activity_detected: false`
+ * on an empty scene stays suppressed, because no route targets its absence, and a
+ * profile with no absence-targeting route behaves byte-for-byte as before.
+ *
+ * The privacy FLOOR is unconditional: `DEFAULT_SCENE_FIELD_KEYS` — the presence
+ * primitives and the DOOH audience block, i.e. every field whose subject IS the people
+ * in front of the camera — can NEVER be unlocked this way, even by a route that
+ * explicitly targets them (`person_count lte 0`). Absence of PEOPLE is the blank-room
+ * frame the gate exists to prevent; absence of STOCK is the operator's finding. That is
+ * the whole distinction, and it is enforced structurally rather than by tuning.
+ * Operators who want every frame regardless can still disable the gate
+ * (attachEvidenceFrame).
  */
-function isAlertWorthy(result) {
+function isAlertWorthy(result, absenceWatchedFields) {
     if (!result || typeof result !== 'object')
         return false;
+    const watched = absenceWatchedFields instanceof Set
+        ? absenceWatchedFields
+        : new Set(Array.isArray(absenceWatchedFields) ? absenceWatchedFields : []);
     for (const [key, value] of Object.entries(result)) {
         if (NON_DISCRIMINATIVE_KEYS.has(key))
             continue;
+        // Absence is signal ONLY for an operator-declared subject the operator's own route
+        // watches for absence. Never for a scene-occupancy field — see the floor above.
+        const absenceIsSignal = watched.has(key) && !localInferenceSchema_1.DEFAULT_SCENE_FIELD_KEYS.has(key);
         if (value === true)
             return true;
+        if (value === false) {
+            if (absenceIsSignal)
+                return true;
+            continue;
+        }
         if (typeof value === 'number') {
             if (Number.isFinite(value) && value > 0)
                 return true;
+            if (absenceIsSignal && Number.isFinite(value) && value === 0)
+                return true;
             continue;
         }
         if (typeof value === 'string') {
             const v = value.trim().toLowerCase();
             if (v.length > 0 && !EMPTY_SCENE_SENTINELS.has(v))
                 return true;
+            if (absenceIsSignal)
+                return true; // '' / 'empty' / 'none' / 'unknown' IS the finding
             continue;
         }
         if (Array.isArray(value)) {
             if (value.length > 0)
                 return true;
+            if (absenceIsSignal)
+                return true;
             continue;
         }
         if (value && typeof value === 'object') {
             if (Object.keys(value).length > 0)
                 return true;
+            if (absenceIsSignal)
+                return true;
             continue;
         }
     }
     return false;
 }
-/**
- * A stable fingerprint of the ALERT-BEARING state of one result — "has the
- * operator-visible situation changed?" in one comparable string.
- *
- * Built from EXACTLY the keys `isAlertWorthy` judges (NON_DISCRIMINATIVE_KEYS
- * excluded), so the two can never drift: the same fields that decide whether a
- * frame carries signal decide whether that signal is NEW. Keys are sorted so
- * the model's property order cannot manufacture a change, and values are
- * compared as emitted — a `queue_length` of 3 and of 4 are genuinely different
- * facts and an operator route may key on exactly that boundary, so this
- * deliberately does NOT bucket numbers into invented bands.
- *
- * Used by CloudEscalationPolicy's novelty bound: an unchanged signature means a
- * verdict the cloud has already adjudicated, so the frame stays on-premises.
- */
-function alertSignature(result) {
-    if (!result || typeof result !== 'object')
-        return '';
-    const parts = [];
-    for (const key of Object.keys(result).sort()) {
-        if (NON_DISCRIMINATIVE_KEYS.has(key))
-            continue;
-        const value = result[key];
-        // Arrays/objects (a `list` / `distribution` custom field) serialize
-        // structurally; scalars stringify. Undefined is elided so an absent key and
-        // an explicitly-undefined key read the same.
-        if (value === undefined)
-            continue;
-        parts.push(`${key}=${typeof value === 'object' && value !== null ? JSON.stringify(value) : String(value)}`);
-    }
-    return parts.join('|');
-}
-/**
- * Is cloud escalation actually ON for this local-sensing configuration?
- *
- * TWO settings decide it, and this is the ONLY place that combines them:
- * `cloudEscalation.enabled` opts in, and `attachEvidenceFrame: false` — the
- * operator's "no frame ever leaves this machine" switch — outranks it, because
- * escalation sends a frame. `LocalSensingClient` enforces the rule and the
- * startup banner reports it; they must read the same expression or the banner
- * will one day claim an egress posture the client is not running.
- */
-function isCloudEscalationEnabled(options) {
-    if (!options)
-        return false;
-    return options.cloudEscalation?.enabled === true && options.attachEvidenceFrame !== false;
-}
 /**
  * LocalSensingClient — the SensingClient the cadence loop uses in LOCAL mode.
  * It runs the VLM ON-DEVICE (LiteRtVlmProvider — Gemma 4 on LiteRT-LM via
@@ -194,45 +179,45 @@ function isCloudEscalationEnabled(options) {
  * gating local-inferred data out of the sold bidstream while still firing the
  * operator's Sense-Anything routes.
  *
- * ── CLOUD ESCALATION (opt-in, Phase 6d) ─────────────────────────────────────
- * Local Gemma is the always-on gate; the CLOUD is the judge for the frames it
- * flags. When `cloudEscalation.enabled` and the policy admits this frame, the
- * SAME JPEG is POSTed through the SAME upload client's `analyze()` — the cloud
- * path the connector already owns — and the cloud VLM's verdict becomes the
- * observation. Three properties are load-bearing:
+ * ── THERE IS NO CLOUD PATH ─────────────────────────────────────────────────
+ * This client once had three doors to the cloud VLM: `cloudFallbackOnError` (a
+ * per-frame degrade when local inference threw), `cloudEscalation` (Phase 6d —
+ * local Gemma gates, the cloud adjudicates the candidates it flags), and the
+ * whole-mode `allowCloudFallback` in auto-sense. All three are gone, and this
+ * supersedes the escalation architecture from #11971 ("local Gemma decides
+ * *when* to look, the cloud decides *what* it saw").
  *
- *   1. ONE FRAME, ONE OBSERVATION. An escalated frame does NOT also post its
- *      local `preAnalyzed` result. Posting both would double-count the same
- *      physical frame and put two verdicts for one moment in the stream —
- *      exactly the dual write the codebase forbids. The cloud verdict
- *      supersedes; the local one was a sampling decision, not a datum.
- *   2. NO PROVENANCE LAUNDERING. What lands is what the CLOUD inferred from a
- *      real frame, so the server's normal cloud provenance is the truthful
- *      stamp — identical to `cloud-sense` and to the existing
- *      `cloudFallbackOnError` frame. Nothing the local model produced enters
- *      that record, so `ingest_source='local_connector'` (which exists to keep
- *      operator-forgeable structured input out of the sold bidstream) does not
- *      apply and is not evaded: there IS no local structured input on this path.
- *   3. THE PRIVACY GATE IS UNCHANGED. Escalation reuses `isAlertWorthy`, so the
- *      set of frames that can leave the premises is exactly the set that
- *      already leaves as evidence photos — and `attachEvidenceFrame: false`
- *      (the operator's "no frame ever leaves" switch) disables escalation
- *      outright. An empty scene never escalates.
+ * The reason is arithmetic, not architecture. Measured 2026-08-12 over 255,812
+ * image-bearing cloud VLM calls: $0.007008 per analyzed frame. At a 30s cadence
+ * that is ~$605/camera/month, so a 16-camera store cost ~$9,688/month against a
+ * $99-500 subscription — about 10x underwater. Escalation narrowed WHICH frames
+ * went, and the earlier plan (plans/cctv-byo-sensing-plan.md:26) narrowed HOW
+ * OFTEN; neither changes the sign. A path that meters per frame does not belong
+ * in a flat-rate product, so the path is removed rather than rate-limited.
  *
- * A failed cloud call falls back to posting the local result, so an escalation
- * can degrade the ACCURACY of one frame but can never LOSE it.
+ * What replaces it: nothing on the frame path. A frame the on-device runtime
+ * cannot analyze is dropped and the fault is surfaced (see the catch in
+ * `analyze`), and a connector with no usable runtime WAITS and beacons its
+ * `waiting` state rather than silently spending.
  */
 class LocalSensingClient {
     constructor(localProvider, uploadClient, options = {}) {
         this.localProvider = localProvider;
         this.uploadClient = uploadClient;
+        /**
+         * Fields whose ABSENT reading an operator route on this screen fires on, from the
+         * deployed profile (see SensingProfileClient.absenceWatchedFields). Refreshed on the
+         * SAME cadence as the schema, because a route saved after the last poll must not be
+         * able to change the gate before the model is even emitting its field. Empty until a
+         * profile fetch succeeds, so the gate's default is the strict pre-existing behavior.
+         */
+        this.cachedAbsenceWatchedFields = new Set();
         this.lastProfileFetchMs = 0;
         /**
          * Frames the ON-DEVICE runtime actually produced a result for.
          *
          * Counted at the one place that knows — immediately after `localProvider
-         * .analyze()` RETURNS — so a `cloudFallbackOnError` frame (local threw, the
-         * cloud answered) and an escalated frame are both excluded. `auto-sense`
+         * .analyze()` RETURNS. `auto-sense`
          * reads this through `getSensingHealth().localInferences` as the only
          * positive proof that a `litert-lm serve` too busy to answer `/v1/models` is
          * busy rather than dead; a counter that a cloud call could advance would make
@@ -254,19 +239,6 @@ class LocalSensingClient {
         this.cachedSchema = this.baseSchema;
         this.cachedPrompt = this.basePrompt;
         this.attachEvidenceFrame = options.attachEvidenceFrame !== false;
-        this.cloudFallbackOnError = options.cloudFallbackOnError === true;
-        this.feedName = options.feedName || 'local-sense';
-        // `attachEvidenceFrame: false` is the operator saying NO frame may ever
-        // leave this machine, and escalation sends a frame — isCloudEscalationEnabled
-        // is the one expression that resolves the pair (the startup banner reads the
-        // same one, so the two can never disagree).
-        this.escalationPolicy = new CloudEscalationPolicy_1.CloudEscalationPolicy({
-            ...(options.cloudEscalation || {}),
-            enabled: isCloudEscalationEnabled({
-                attachEvidenceFrame: this.attachEvidenceFrame,
-                cloudEscalation: options.cloudEscalation,
-            }),
-        });
     }
     getEndpoint() {
         return this.uploadClient.getEndpoint();
@@ -295,6 +267,7 @@ class LocalSensingClient {
         if (profile === null)
             return; // transient error — keep last-good schema
         this.activeProfileName = profile.profileName;
+        this.cachedAbsenceWatchedFields = new Set(profile.absenceWatchedFields || []);
         const fieldSet = fieldSetForProfileType(profile.profileType);
         this.activeFieldSet = fieldSet;
         if (fieldSet === 'operator' || profile.fields.length > 0) {
@@ -317,16 +290,6 @@ class LocalSensingClient {
     getAcceleratorHealth() {
         return this.localProvider.getAcceleratorHealth();
     }
-    /**
-     * Cloud-escalation counters for this feed — how many candidate frames were
-     * adjudicated by the cloud VLM, and why the rest were not. Read by
-     * `CloudSensingManager.getSensingHealth()` so escalation shows up on the
-     * operator's periodic capacity line: sending frames off-premises must be
-     * VISIBLE, not merely documented.
-     */
-    getEscalationStats() {
-        return this.escalationPolicy.getStats();
-    }
     /** Frames the on-device runtime produced a result for. See the field docs. */
     getLocalInferenceStats() {
         return { completed: this.localInferencesCompleted };
@@ -352,25 +315,17 @@ class LocalSensingClient {
             });
         }
         catch (err) {
-            if (!this.cloudFallbackOnError)
-                throw err;
-            // Per-frame degrade: on-device inference threw for THIS frame, so ship it
-            // to the cloud VLM instead of dropping it. Reuses the SAME upload client —
-            // the cloud path the connector already has — so no new provider/logic. The
-            // server provenance-gates a cloud-served frame exactly like cloud-sense.
-            // eslint-disable-next-line no-console
-            console.warn(`[local-sense] on-device inference failed for a frame (${err.message}) — ` +
-                'falling back to the cloud VLM for this frame');
-            return this.uploadClient.analyze({
-                jpeg: request.jpeg,
-                capturedAt: Date.now(),
-                captureMode: request.captureMode,
-                ...frameDimensions,
-            });
+            // LOCAL-INFERENCE ONLY: a frame the on-device runtime could not analyze is
+            // DROPPED, not metered. This branch used to POST the frame to the cloud
+            // VLM (`cloudFallbackOnError`) at $0.007008 each — the per-frame cost this
+            // whole change exists to remove. The capture loop's own cadence is the
+            // resilience: the next frame is seconds away, and a runtime that keeps
+            // throwing is a fault to surface, not a bill to pay.
+            throw err;
         }
         // The on-device runtime returned a result: the ONLY event that proves it is
-        // alive. Counted here, past every throw and before any cloud path below, so
-        // no cloud call can advance it.
+        // alive. Counted here, past every throw, so nothing but a real on-device
+        // inference can advance it.
         this.localInferencesCompleted += 1;
         // Connector-controlled provenance + time (don't trust the model for these).
         const capturedAtMs = Date.now();
@@ -379,48 +334,7 @@ class LocalSensingClient {
         // alert-worthy. Empty/uninteresting scenes send results only — no frame.
         // Evaluate over the raw model output (not the provenance-stamped `result`,
         // though both yield the same gate since source/captured_at are strings).
-        const hasSignal = isAlertWorthy(structured);
-        // ESCALATION: a candidate the local model flagged is adjudicated by the
-        // cloud VLM BEFORE it can fire an alert. Same gate as the evidence frame,
-        // so no frame leaves that would not already have left; the policy adds the
-        // novelty/pacing/budget bounds. On success this frame's observation is the
-        // CLOUD's — the local result is deliberately not also posted (one frame,
-        // one observation).
-        const canEscalate = this.escalationPolicy.isEnabled() && hasSignal;
-        if (this.escalationPolicy.tryEscalate({
-            hasSignal,
-            // Only computed when the frame could actually escalate. This runs on
-            // every frame of every camera and the common case — escalation off, or
-            // an empty scene — needs no signature at all (tryEscalate rejects on
-            // `disabled`/`no_signal` before it reads one).
-            signature: canEscalate ? alertSignature(structured) : '',
-        }).escalate) {
-            try {
-                const escalated = await this.uploadClient.analyze({
-                    jpeg: request.jpeg,
-                    capturedAt: capturedAtMs,
-                    captureMode: request.captureMode,
-                    ...frameDimensions,
-                });
-                // Rare by construction (bounded per feed per hour), so log every one:
-                // an operator must be able to see each frame that left the premises.
-                // eslint-disable-next-line no-console
-                console.log(`[${this.feedName}] local candidate escalated to the cloud VLM for confirmation ` +
-                    `→ HTTP ${escalated.statusCode}${escalated.ok ? '' : ' (NOT OK)'}`);
-                if (escalated.ok)
-                    return escalated;
-                // A non-2xx cloud verdict is no verdict at all — fall through and ship
-                // the local result rather than losing the observation.
-                // eslint-disable-next-line no-console
-                console.warn(`[${this.feedName}] cloud escalation returned HTTP ${escalated.statusCode} — ` +
-                    'keeping the on-device verdict for this frame');
-            }
-            catch (err) {
-                // eslint-disable-next-line no-console
-                console.warn(`[${this.feedName}] cloud escalation failed (${err.message}) — ` +
-                    'keeping the on-device verdict for this frame');
-            }
-        }
+        const hasSignal = isAlertWorthy(structured, this.cachedAbsenceWatchedFields);
         const result = {
             ...structured,
             source: 'vlm_edge',
@@ -463,11 +377,9 @@ function buildLocalSensingLoops(config, deps) {
     // Per-frame cloud fallback defaults OFF (opt-in) so the plain local-sense path
     // is unchanged. When true, a frame whose on-device inference throws is POSTed
     // to the cloud VLM (same upload client) rather than dropped.
-    const cloudFallbackOnError = config.localSensing?.cloudFallbackOnError === true;
     // Cloud escalation defaults OFF. Each feed gets its OWN policy instance so the
     // per-camera budget is per camera (a shared one would let a busy feed spend a
     // quiet feed's confirmations).
-    const cloudEscalation = config.localSensing?.cloudEscalation;
     const rtspFactory = deps?.rtspProviderFactory ??
         ((feed) => {
             // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -519,9 +431,6 @@ function buildLocalSensingLoops(config, deps) {
         client: new LocalSensingClient(localProviderFactory(feed), uploadClientFactory(feed), {
             profileClient: profileClientFactory(feed),
             attachEvidenceFrame,
-            cloudFallbackOnError,
-            feedName: feed.name,
-            ...(cloudEscalation ? { cloudEscalation } : {}),
         }),
     }));
 }