How faces are blurred, and what happens when blurring cannot run

What runs

Redaction is the first stage a Recording walks: a Recording job runs BLUR, then SEGMENT, the stage that cuts it into Clips. Each Clip that SEGMENT mints enters the queue already held — hand tracking, captioning and export are deferred until somebody releases that cohort by name, so they do not begin on arrival. Nothing that runs after BLUR reads the original file: each later stage takes the redacted copy and raises when it is absent rather than reaching past it.

Which detector runs depends on the host. YuNet — a small OpenCV face-detection network — runs when the installed OpenCV exposes FaceDetectorYN and the weights file sits in the models directory. When either condition fails, a Haar cascade runs: OpenCV's older classical detector, available when the library still ships CascadeClassifier and the frontal-face XML exists where OpenCV points.

A detected box is padded outward by 15% before the blur lands, because a hairline, a jaw and an ear carry identity as a face does. The blur is a 99×99 Gaussian at sigma 30 — large and odd on purpose, since a small kernel over a face-sized region decorates rather than removes.

Each pass returns a record: which detector ran, how many frames it decoded, how many regions it blurred, and what it covers. The pipeline stores the redacted copy's SHA-256, its byte size and its path against the capture the file came from, and refuses to store any of it when no capture record exists. The detector name, the frame count and the region count go back to the stage that asked for them.

A caller cannot switch this off. The two annotation routes accept a form field asking to skip redaction, and the server redacts anyway and logs the refusal. Only the deployment can honour a skip, through a setting that ships false and exists so a local batch run can spend its CPU elsewhere. The upload path a Capture Partner's app uses carries no such field at all.

What it covers

Coverage means one thing: a face detector ran over every decoded frame, and every box it returned was blurred, padded as described above. Nothing else in the frame is blurred, and the original upload is kept as recorded, sound included.

• Human faces, in every decoded frame of the video track.
• The whole file. The pass decodes and re-encodes each frame, so what leaves this stage is a new file rather than an edited original.
• Sound, by removal rather than by blurring. The encoder writes video only, and the service then reads the written file's own track table and raises if it finds an audio track — so the absence is checked, not inherited from whichever encoder happens to be installed.

What happens when redaction cannot run

The detector is built before anything is opened or written, so a host carrying neither one produces no output file at all, and the error names the OpenCV version it found, the path it searched, and the script that fetches the weights. Five conditions stop this pass, and each one raises rather than returning a path:

A stage that fails retries, and stops at its fourth attempt. Nothing advances behind it either: the cut refuses to run without the redacted copy, the tracker refuses to fall back to the original, and the captioner checks for the redacted file again before any frame leaves this machine for an external model.

• No detector. When neither YuNet nor the cascade loads, the stage raises before a frame is read.
• A source that will not open. If the decoder cannot open the recording, the stage raises rather than reporting a pass over a file it never read.
• A writer that will not open. OpenCV's video writer returns a working-looking object when the codec is missing and silently drops every frame it is given. It is checked, so a missing encoder stops the stage rather than producing a zero-byte file described as redacted.
• Nothing decoded. If the pass reaches the end of the file having read no frames, it raises instead of reporting a redaction over zero of them.
• Sound in the output. The written file is read back for an audio track, and the stage raises if it finds one.