DomSentry motion events
This is the parked motion-event part of Sentry. Galaxy can list local event
metadata at #/cameras/events. Camera capture, image galleries, notifications
and remote access are not implemented here. Motion detection has
not yet been qualified on a physical device or vehicle.
The manager runs it only on device hardware when both
STARPILOT_SENTRY_DEVELOPMENT=1 and a valid enabled SentryMotionPreferences
document are present. Ordinary startup is unchanged. The same manager-owned
sensord supplies acceleration onroad and, under that explicit opt-in, while
parked. Sentry never starts another sensor, camera or power service.
The optional version-1 document contains enabled, sensitivity (0.005–1.0)
and warningTimeSeconds (0.1–10.0). Missing, unreadable or malformed settings
disable observation without replacing the saved bytes. There is no automatic
adoption of historical Sentry settings. Galaxy exposes the saved choices at
#/cameras/sentry-settings, through Cameras. Each edit requires a one-time
confirmation and fresh parked evidence, then compares the complete saved source
again before replacement. Invalid readable settings require an explicit reset
to Off and defaults; unreadable settings remain untouched. Saving preferences
does not bypass development opt-in. The shared settings page shows runtime
configuration blocks, a live arming countdown and motion-owner evidence failures.
Status expires after 1.5 seconds, is bound to the exact saved settings and boot,
and never grants sensor, camera or power authority. Heartbeats use namespace-local
shared memory on device hardware, not persistent event storage.
Arming requires 90 seconds of continuously fresh parked, ignition-off, power and motion evidence. Observation runs at 10 Hz, preserving the magnitude-delta threshold and warning-count behavior. An alarm requires more than 25 qualifying deltas and at least 30 seconds within a 60-second motion window. A stale or repeated sample, sensor loss, owner-loop gap, system resume, settings change, ignition or shutdown request disarms the policy. Recovery requires rearming. Hardwared retains battery accounting and shutdown authority; Sentry neither extends parked runtime nor clears shutdown requests.
Warning and alarm records contain only kind, generated event/session IDs and monotonic/system-clock timestamps. System time is not proof of an accurate wall clock. Storage uses a private namespace-specific directory, at most 512 bounded records, and atomic publication without overwriting an existing event. Full or unavailable storage stops recording new events; it does not delete old evidence. There are no image paths, location data or network requests. Authority and saved settings are checked again immediately before publication. A publication whose directory sync fails reports uncertain durability and is never blindly retried.
Tests cover continuous arming and thresholds, corrupt preferences, serialized message timing, resume and power/ignition revocation, process selection, bounded storage and interrupted writes. They do not establish physical motion sensitivity, parked battery endurance, device wake behavior or complete Sentry parity.