Safety invariants

These rules are invariants: the code enforces them, and any contribution that would weaken them is rejected.

1. A sensor outage produces an explicit system alert, never an inactivity claim.
2. A learning result only counts with confidence, persistence and a Core policy gate.
3. Cold start uses only family-confirmed rules; the learned score stays informational for at least 14 complete days.
4. A replayed event cannot create duplicate observations or SOS alerts.
5. Alert changes are append-only transitions and can be audited.
6. An unknown Home Assistant capability is visible but joins no alert until it is explicitly mapped.
7. A push notification carries only a generic status and an identifier; details stay behind the authenticated local or Tailscale API.
8. A negative camera detection never proves absence. Only positive person detections count as presence evidence.
9. Camera credentials, stream URLs, images and audio never enter events, learning, notifications or logs.
10. Camera access is authenticated and audited; the microphone only opens while deliberately held.