A construction site theft alert is five fields and 90 seconds. Everything else is decoration.

Five fields. Camera identifier, the zone the trigger fired in, the dwell in seconds (how long the subject has been in that zone), the threat level (low_threat or high_threat), and a path to a 10-second clip the on-call can scrub on the phone. Anything less and the on-call cannot decide whether to call dispatch in the 90 seconds before the truck pulls away. Anything more and the text is too long to read on a glance. On a Cyrano unit those five fields are the literal contents of one JSON line in /var/lib/cyrano/meta/outbox.ndjson, written before any network call leaves the device, so the alert exists locally even if the cellular link is down.

Because most events at a construction site are not trespassers. They are wind moving a tarp across the lay-down yard, a stray dog walking the perimeter, a city worker checking a fire hydrant from the sidewalk side of the fence. Without dwell, every one of those becomes a 2 AM phone call, and the on-call stops answering by week two. Dwell turns the alert from 'something moved' into 'something has been inside the fenced area for 18 seconds and is still there.' On a typical retrofit deployment, fence-line zones use a 6 to 10 second dwell, lay-down yard zones use 12 to 20 seconds, and the fuel storage zone fires on the first frame because nothing legitimate happens there after dark.

Site-wide arm/disarm is what alarm panels do. You set the system to 'armed away' when the last person leaves and 'disarmed' when the first crew arrives. Construction sites do not work that way. The trades arrive in waves between 0530 and 0700. Concrete shows up at 0430 some days. Inspectors come at 1500 on a Tuesday. The fuel area is hands-off all the time. The crane operator sleeps in the trailer. A site-wide arm flag is wrong every 90 minutes. A per-zone schedule says fence-line is armed 1900 to 0600, lay-down yard is armed 1730 to 0700, fuel storage is armed 24 hours, gate is armed 1700 to 0600, and the office trailer is armed 2000 to 0530 with a separate weekend rule. Each zone has its own polygon and its own clock, and zone_polygon_lookup decides per event whether to even consider the dwell counter.

The dispatch tree on a typical small-GC retrofit is three deep. Primary is a phone call to the on-call site superintendent. Secondary is an SMS to the same number plus the project manager, fired 25 to 30 seconds after the call rings unanswered. Tertiary is an email to a shared ops inbox plus a webhook into the contractor's central dashboard. If a clip is attached the on-call can decide whether to call the local police non-emergency line or to drive over. The whole tree fires off the same outbox.ndjson row; if the cellular link is down at the device the row stays in the file and the same tree replays in order when the link comes back. The replay is in-order because the file is append-only and each line has its own line_no field.

Three steps that have to fit inside a phone-on-nightstand reach. First, read the text and decide if the threat level is high_threat or low_threat. High_threat means the subject is in a critical zone (fuel, copper coil pile, generator) or has been dwelling long enough that a casual explanation is unlikely. Second, open the attached 10-second clip and confirm the subject is human, not a tarp, not a dog. Third, if confirmed, call the local non-emergency police line, give the address, the alert id, and the clip url. The on-call does not drive to the site. The on-call dispatches. Most theft attempts on a job site are exploratory and the subject leaves the moment a flashlight or a siren shows up at the gate. The whole sequence is designed to fit in 90 seconds because past 90 seconds the truck is already loaded.

Tune three knobs in this order. First, raise dwell on any zone where the on-call confirms more than two false-positive clips in a week; the lay-down yard often needs 18 to 25 seconds. Second, narrow the polygon. A zone drawn around the entire fenced perimeter will fire on every taxi that pulls up to the gate. A zone drawn around the inside of the fence with a 2-meter buffer ignores the sidewalk side. Third, fix the arming clock. If your concrete trucks routinely show up at 0430, push the lay-down yard arming start to 0445 and let the fence-line and fuel zones pick up anything truly anomalous. Properly tuned, a small GC's on-call on a 10-site portfolio gets one or two alerts per week per site, not per day.

No, because the alert is written to /var/lib/cyrano/meta/outbox.ndjson on the device before any network call. The file is append-only and lives on the device's local disk. The detection pipeline and the dwell counters do not care whether the cellular modem is up; they keep writing rows. When the link comes back, an outbound worker walks the file from the last acked line_no forward and replays every unsent row in order. The on-call can also pull the file directly with a USB keyboard if they need to. There is no scenario where a real event during an outage simply disappears, which is the failure mode every cloud-only product has by default.

Locally. Object detection, tracking, the per-zone polygon lookup, and the dwell counter all run on the Cyrano unit at the property. No video frame ever leaves the device unless the on-call clicks the clip url and the device serves the clip directly to the phone. This matters for alerts because cloud-based products have a frame-to-cloud-to-back round trip that adds 1 to 4 seconds of latency on a good cellular link and is unbounded on a bad one. On a construction site with a 4G hotspot mounted to the trailer, that round trip is the difference between a 7-second alert and a 35-second alert. 35 seconds past the start of an event is too late.

Two: low_threat and high_threat. The decision is a function of zone, dwell, time-of-day, and the object class the perception tier returned. A person inside the lay-down yard at 14:00 with a 6-second dwell is low_threat (route to email, no phone call, log it) because trades are on site. The same person at 02:00 with the same dwell is high_threat (phone call, SMS, clip attached). A person inside the fuel storage zone is high_threat at any hour. A vehicle stopped on the access road for more than 30 seconds at any hour is low_threat unless it is also blocking a gate, in which case it is high_threat. The exact rule grammar is per-property and the on-call team can tune any rule from the dashboard without a redeploy because the rules are JSON files on the device.

Yes, that is the primary deployment shape. A Cyrano device taps the existing DVR's HDMI multiview output (the same composite the on-site monitor in the trailer is already showing), runs the perception, state, and planner tiers on every camera tile in real time, and writes alerts to its own outbox. The CCTV trailer keeps doing what it was doing. The DVR still records. The cameras stay where they are. The only change is one HDMI cable, one power outlet, and a network drop. Install is in the 2 to 5 minute range on most trailers, and rule tuning takes another 30 minutes on the first day.