One event, from a request context to the ingest buffer.

consent → bot filter → enrich → attribute → sessionise → validate → buffer

Every stage can drop the event and none of them can raise into the caller. That is not defensive style for its own sake: every call site is a page load, a booking, or a payment, and analytics is never allowed to be the reason one of those fails.

Each drop is counted under [:pixelex, :pipeline, :drop] with a reason, so "we are recording nothing" is a number on a dashboard rather than a discovery made three weeks later.

The context

A plain map, built by Pixelex.Plug, Pixelex.LiveView, or the host:

%{
  site_id:    "shop",            # required
  ip:         "197.55.10.3",
  user_agent: "Mozilla/5.0 …",
  url:        "https://shop.test/pricing?gclid=Cj0",
  referrer:   "https://www.google.com/",
  hostname:   "shop.test",       # the site's own host, for self-referrals
  country:    "EG", region: nil, city: nil,
  user_id:    "user-uuid",       # when signed in
  render:     :dead | :connected | :client | :server,
  consent:    %{decision: "granted", gpc: nil, dnt: nil}
}