Video evidence with privacy, provenance and failure states built in.
Move from an immutable trigger proposal to a protected evidence window, representation-specific access, accountable human review, custody preparation and revisioned device lifecycle. Then exercise denied media, masking, drift, obstruction, thermal derating, storage pressure, interrupted upload, corruption and legal hold.
A trigger is a proposal.
Sensor, rule and model lineage remain immutable. Duplicate sources correlate without disappearing; only an accountable human can append a disposition.
Media access is representation-specific.
Metadata, thumbnail, road, masked cabin and audio have separate role, purpose and expiry decisions. Denied, corrupt or missing content stays explicit.
Custody is not an export claim.
A reference manifest can bind segments, hashes, trigger, policy and review. It does not imply that a file, external receipt or legal outcome exists.
Evaluate the dashcam, two edge runtimes, evidence service and native tablet together.
Each module is independently scopeable. Their clocks, identities, versions, privacy policy, storage, update state, review evidence and custody lineage must remain coherent.