Power theft detection is a 60-second intervention window. Smart-meter ML runs at 15-minute reads. The window closes before the model sees anything.

Because the window in which the theft is still interruptible is 60 to 180 seconds long. Watch any surveillance recording of power theft, from exterior pedestal taps to transformer-pad copper cuts to cord drops through a garage wall, and the segment from vehicle stop to tools touching power is almost always inside that band. If the detection arrives 30 seconds after the first frame of a person in the zone, a voice-down, a dispatched patrol, or a live operator call can still prevent the act. If it arrives 15 minutes later (the typical AMI smart-meter aggregation window) it cannot. The top-ranked academic papers on this keyword all score themselves on classification accuracy over smart-meter time series. None of them even report end-to-end latency, because smart-meter data physically cannot arrive inside the approach window. That is the unbridgeable gap between meter-side ML and camera-side zone events.

Stage 1, camera frame capture: a frame is exposed and delivered to the DVR. Stage 2, DVR HDMI multiview: the DVR mosaics up to 25 tiles into one HDMI frame and drives the guard monitor. Stage 3, edge inference: Cyrano taps the HDMI output, masks DVR chrome (clock digits, channel bug, camera-label strip) via the overlay_mask, and runs per-tile person detection locally. Stage 4, zone plus dwell pass: the detection is checked against the armed polygon and the dwell counter is incremented per inference tick while the subject remains in the zone. Stage 5, event queue: once dwell threshold trips, the payload is serialised (tile thumbnail, zone name, dwell_seconds, ISO 8601 timestamp, overlay_mask, latency_ms) and pushed to the event queue. Stage 6, WhatsApp delivery: the payload lands in the property's WhatsApp group or SMS fallback. The combined end-to-end path from tile capture to delivered message is under 60 seconds on properties running the shipped Cyrano build.

Three structural reasons. First, Advanced Metering Infrastructure (AMI) reads at 15-minute or hourly intervals. A consumption anomaly cannot appear on the dashboard until the next read cycle closes, which is typically multiple 15-minute buckets after the event so the averaging does not mute the signature. Second, the ML itself runs in batch over rolling windows of telemetry, not streaming. Third, and most importantly, the approach itself, the pre-tap phase in which the subject is standing at the pedestal or panel with tools in hand but has not yet drawn load, produces zero signal in any meter. No kWh has been consumed yet. There is nothing for the ML to classify. The camera zone event fires on the approach. The meter ML cannot fire until after the load has already been drawn.

pre_action_zone_entry is the event class Cyrano emits when a human is detected inside an armed polygon and has dwelled past the configured threshold. Motion detection fires on any change in pixels anywhere in the frame and fires on wildlife, weather, light changes, and delivery vehicles. pre_action_zone_entry fires only when a person-class detection lands inside the polygon and persists for the dwell threshold, with DVR chrome masked out of the inference so clock digits and camera labels cannot produce false fires. The dwell_seconds integer is included in the payload so the operator receives not just the existence of an event but the elapsed standstill time, which is the single best indicator that the person is about to act rather than walking through.

DVR multiview output has several persistent overlays: a running digital clock, a channel-bug identifier in the corner, a camera-label text strip at the bottom of each tile, often a recording-active icon, and on some Hikvision and Dahua layouts a timecode ribbon across the top. Those overlays contain small, structured, high-contrast regions that general person-detection models can latch onto in unexpected ways. Cyrano masks each one out of the tile before running inference, and it records which overlays were masked in the overlay_mask field of every event payload. This serves two purposes: it prevents the detection from being triggered by its own watermark, and it pre-empts the courtroom question of whether the model was fooled by on-screen text. The same mask applies on Hikvision DS-7xxx, Dahua XVR, Lorex, Amcrest, Reolink, Uniview, Swann, and most rebranded recorders.

Yes, because the capture point is the DVR HDMI multiview output, which is already a mosaic of up to 25 tiles in 4x4, 5x5, 6x6, or 9x9 standard layouts. That single HDMI frame is the input. The per-tile inference runs on every tile in every frame, and every tile carries its own armed polygon and dwell counter. One Cyrano unit tapped off one DVR covers the full camera count of that recorder. A 400-unit garden property with two 16-channel recorders uses two Cyrano units and gets 32 independent zone contexts. There is no camera-firmware coupling and no ONVIF negotiation because the HDMI multiview is already composited by the DVR itself.

event.class = pre_action_zone_entry, property identifier, tile.label (camera name from DVR strip, also masked from inference), zone name (for power theft, typically exterior_pedestal_bay_N, service_panel_room, transformer_pad_side, genset_fuel_cap, ev_stall_240v, submeter_closet), zone.armed_window, dwell_seconds (integer, increments per inference tick), timestamp in ISO 8601 with timezone offset, tile thumbnail URL (480x270 crop), overlay_mask identifier (which DVR layout was applied), delivery channel (WhatsApp group or SMS), and latency_ms (capture to delivery). The payload is deliberately minimal and machine-parseable so it can drop into a case file, a utility investigation, or an ops-automation pipeline without re-parsing.

Three forks, each designed to complete inside the approach window. Fork one, live voice-down: the operator opens a two-way audio channel through the camera or a nearby speaker and speaks to the subject (many thefts end here). Fork two, dispatch: the operator calls the on-duty responder or the local non-emergency police line with the tile thumbnail and zone name. Fork three, preventive signalling: lights come on, a siren arms, the front-gate access is flagged. The key timing constraint: each fork has to start inside the remaining portion of the 60 to 180 second window. With a 60-second detection budget, that leaves anywhere from zero to two minutes of intervention time before the physical act begins.

Yes. The HDMI multiview is the standardising layer. Whether the recorder is a 2018 Hikvision DS-7216 driving sixteen analog 1080p cameras or a 2024 Reolink NVR driving 4K IP cameras, the HDMI output to the guard monitor is a uniform composite that Cyrano taps into. Physical install is under 2 minutes: HDMI in from the DVR, HDMI out to the monitor (passthrough), network, power. No camera firmware work, no credential exchange, no ONVIF plumbing.

Six archetypes cover most deployments. Exterior 30A or 50A pedestals for pool or courtyard or RV hookups. Service panel room doors. Submeter closet doors. House-panel common-area outlets in hallways, mechanical rooms, trash rooms, and garages. Laundry 240V outlets (used after-hours as ad-hoc Level 2 EV charging). Transformer-pad and meter-can exteriors for utility-side taps and copper pulls. Each zone is a tight polygon drawn on the DVR tile, with an armed window (often overnight, sometimes 24-hour for interior rooms), and a dwell threshold typically between 8 and 30 seconds depending on how long the approach phase of that specific tap takes.

Yes, as the second half of the evidence pair. After the camera fires and the operator intervenes or records, the meter eventually closes a read cycle and reports its kWh delta. That delta, paired with the timestamped zone event, becomes the two-source chain that converts an attempted or completed theft into a recoverable and prosecutable case. Neither half alone is enough: the meter delta does not name the actor, and the camera event does not quantify the loss. Together they form a case file. The camera fires first in time, the meter closes the record second. Think of meter-side ML as the accountant and camera-side zone events as the dispatcher: both are useful, but only the dispatcher can stop the act.

Armed windows and zone specificity cut this to near-zero in practice. A submeter closet at 02:14 on a Tuesday is not a legitimate-worker context. A service panel room during business hours on a weekday is. Properties configure the armed_window on each zone individually: after-hours only for exterior pedestals, 24-hour for an unmanned transformer pad, business-hours masked for the electrical room if maintenance is routine there. The dwell threshold also filters out pass-throughs. A cleaner walking past the submeter closet to the mop sink does not dwell long enough to fire. A person standing in front of the submeter cabinet for 14 seconds does.