I think you are asking for help from a knowledgeable integrator for approaches that can be implemented in the field, and sorry, I'm of no help there. This is also an exciting thread for "the rest of us" end users, because it points to the sorts of functionality we would like to see but that seem to be lacking in the professional offerings.
The basic functionality requested seems widely relevant to any business during unoccupied periods such as after hours, when the assumption that motion equals trouble would be most relevant.
Although lacking specificity, IPVM's recent vms_mapping_shootout article provided a good high-level feature summary. The report indicated that most VMSs can support map alerts. Camera fields-of-view associated with alerts can be highlighted in most VMS' map views. One would expect that motion alerts traversing a geographic display could support global situational awareness and improve incident responses. However, it's unclear from the high-level overview whether this mapped alert capability can even be limited to display only the video motion detection events and not other alerts which would otherwise detract from a clear unambiguous view of unfolding events.
That same vms_mapping_shootout also briefly addressed suspect tracking options, which seemed quite limited (only two VMSs appeared to have meaningful capability). Would I be out of line to suggest that the sparsity of capability in this area is a reflection of complacency and lack of innovation in the field, considering that suspect tracking seems to be one of the core uses of video surveillance? Similarly, video motion detection is actually getting quite reliable for many indoor and some outdoor applications, so a VMS probably has the information needed to meet your customer's desires. Unfortunately, it's not that accessible or configurable, or I'm sure you would not be considering a PIR work-around, which agains suggests that the developers haven't "got it right" even to support standard industry use cases.
Businesses need tools for active suspect tracking in both bustling and inactive facilities. These may be two different but overlapping sets of tools. Even if the human is likely to be needed in any busy environment, hopefully the inactive case can reasonably be automated.
Given the sparsity of options, this might be a good area for industry growth and differentiation. My sense is, while facility motion mapping can be helpful, the customer also wants automated selection and display of corresponding video views. Since the inactive facility is the most benign and achievable case, automated suspect tracking tools for this environment should be (but aren't?) readily achievable.
To a layman, the field of video surveillance is non-trivial, complex, and confusing, similar in some ways to personal computers of the Apple II and Commodore 64 time frame. Once a business makes a VMS choice, in many ways they are now locked into that vendor technology set. The complexity even puts many integrators into the same category, since it takes time to achieve competence across the complexity of a manufacturer's capabilities. Yet what is needed is a wider view of the field, integrating core capabilities that are bigger than video. IPVM is already expanding into access control. I think by the time IPVM is done, it will look across the holistic fields of video, alarms, and access and perhaps provide valuable insight and ideas across these industries.
There is a decent breadth of capabilities available from a wide range of IP cameras, including motion detection, line crossing, area penetration, "leave behind" object detection, loitering, license plate readers, face detection, etc.
Even achieving an industry standard for digital video transfer and PTZ control has taken time, and many proprietary detectable events have no open standard to communicate such detections.
Similarly there appears to be no standard for integration and control across other related fields such as access control and physical security, yet we can envision ways in which integrated approaches can provide a signifcant payoff. For example, ADT had installed and charged us for monthly monitoring of both video and access control at one of our facilities, yet whenever there's an alarm, why aren't they rousing us out of bed with a description of both the alarm and whatever is seen on the video? It's like these very related fields are in separate divisions and never the twain shall meet. So now I climb out of bed, boot the computer, ... ... ... eventually make a decision based on information which was already accessible within the company to whom I've outsourced those functions. While so far no crime has been in progress, response time would be MOST critical when something IS happening. 10 minutes later, I am finally reviewing and notifying the authorities?
The complexity of these fields argues against some magical standards for integration and scalability, yet ultimately that is where these related fields should go to provide best customer value. I wonder who might ultimately have the knowledge, interest, and clout to move things in this direction?
Bringing this back around to the subject, yes, it seems very reasonable to expect that every major VMS of consequence should be capable of supporting automated motion trajectory tracking, by map and by dynamic video feeds, at the push of a button, on those occasions when a facility is unoccupied or quiet. Why don't they?