@camstack/addon-post-analysis 1.2.67 → 1.2.69

package/dist/{dist-DJC4JrMD.mjs → dist-CU_FWCL9.mjs}

@@ -10990,7 +10990,14 @@ var cameraStreamsCapability = {
 			low: string().optional()
 		}),
 		lastChangedAt: number()
-	})
+	}),
+	/**
+	* Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /** kebab-case cap name → camelCase router-map key. */
 function kebabToCamel(s) {
@@ -11577,6 +11584,13 @@ var deviceDiscoveryCapability = {
 		kind: "poll"
 	},
 	runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: number().int().nonnegative() }),
+	/**
+	* Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -13431,7 +13445,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14310,7 +14340,17 @@ var alarmPanelCapability = {
 	* full slice; renders an arm button per `availableModes` entry and
 	* a PIN field iff `requiresCode === true`.
 	*/
-	runtimeState: AlarmPanelStatusSchema
+	runtimeState: AlarmPanelStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
@@ -14465,6 +14505,19 @@ var NC_LEGACY_SYSTEM_EVENT_KINDS = new Set([
 ]);
 NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 /**
+* The panel's three transitions, as ONE list.
+*
+* Named here rather than spelled out at each of the four sites that need them
+* (the emitter, the intake, the editor group, the combined-notification gate),
+* because a fourth transition added to the enum and forgotten at one of them is
+* an alarm state nobody can be notified about.
+*/
+var NC_ALARM_SYSTEM_EVENT_KINDS = [
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed"
+];
+/**
 * One coherent system-event condition. `kinds` is the required opt-in safety
 * gate; the remaining lists are optional narrowing filters relevant to the
 * selected kinds.
@@ -14487,6 +14540,26 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
+/**
+* The durations a notification offers when its rule does not say otherwise.
+*
+* MINUTES, and short ones: a snooze button is answered on a lock screen, and
+* the three choices that fit there are "the next few minutes", "the next half
+* hour" and "the next hour". Anything longer is a decision somebody sits down
+* to make, which is what the app's own snooze surface is for.
+*
+* Resolved in CODE (`snoozeChoices`), never as a Zod default — see
+* {@link NcRuleInputSchema.shape.snoozeOptions} for why the distinction is
+* load-bearing.
+*/
+var NC_DEFAULT_SNOOZE_MINUTES = [
+	10,
+	30,
+	60
+];
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14863,15 +14936,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -15107,6 +15180,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -15206,6 +15303,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -15224,6 +15322,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15621,6 +15720,16 @@ var NC_CONDITION_CATALOG = [
 		phase: "P1",
 		description: "ZoneAnalytics occupancy edge (optionally zone/class-scoped): count crosses the threshold and holds for sustainSeconds. Fail-closed on a missing snapshot."
 	},
+	{
+		id: "audio",
+		group: "audio",
+		label: "Sound",
+		valueType: "audio",
+		operator: "anyOf",
+		appliesTo: ["immediate"],
+		phase: "P2",
+		description: "Fires when at least hitPercent% of the samples in a samplingSeconds window are hits — a hit clears the dBFS floor AND carries one of the chosen sounds. Both filters are optional and independent, but naming NEITHER never matches: every sample would be a hit, so the engine refuses rather than notifying on silence. dBFS is negative-going (0 = full scale, -96 = silence)."
+	},
 	{
 		id: "customZones",
 		group: "zones",
@@ -15765,7 +15874,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15790,6 +15912,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -18386,7 +18512,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() })
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -21229,7 +21362,17 @@ var airQualitySensorCapability = {
 		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AirQualitySensorStatusSchema
+	runtimeState: AirQualitySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Ambient illuminance reading in lux. Drives Home Assistant `sensor`
@@ -21261,7 +21404,17 @@ var ambientLightSensorCapability = {
 		schema: AmbientLightSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AmbientLightSensorStatusSchema
+	runtimeState: AmbientLightSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Per-class audio metrics aggregated over a sliding window.
@@ -21379,7 +21532,14 @@ var audioMetricsCapability = {
 		}), AudioMetricsHistorySchema)
 	},
 	/** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-	runtimeState: AudioMetricsSnapshotSchema
+	runtimeState: AudioMetricsSnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -21441,7 +21601,14 @@ var automationControlCapability = {
 	* reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
 	* (badge) directly.
 	*/
-	runtimeState: AutomationControlStatusSchema
+	runtimeState: AutomationControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Battery status snapshot. Emitted by providers whose device is
@@ -21547,7 +21714,17 @@ onStatusChanged: { data: object({
 	* via `device.runtimeState.getCapState('battery')` regardless of
 	* the underlying driver.
 	*/
-	runtimeState: BatteryStatusSchema
+	runtimeState: BatteryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastUpdated"]
 };
 /**
 * Generic boolean sensor — last-resort fallback when no domain-
@@ -21576,7 +21753,17 @@ var binaryCapability = {
 		schema: BinaryStatusSchema,
 		kind: "push"
 	},
-	runtimeState: BinaryStatusSchema
+	runtimeState: BinaryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Dimmable-light brightness control. Co-exists with `switch` on the
@@ -21629,7 +21816,14 @@ onBrightnessChanged: { data: object({
 	* by the kernel. Read via `device.state.brightness.value` so UI
 	* sliders surface the current level without polling the provider.
 	*/
-	runtimeState: BrightnessStatusSchema
+	runtimeState: BrightnessStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 DeviceType.Button, method(object({ deviceId: number().int().nonnegative() }), _void(), {
 	kind: "mutation",
@@ -21717,7 +21911,17 @@ var carbonMonoxideCapability = {
 		schema: CarbonMonoxideStatusSchema,
 		kind: "push"
 	},
-	runtimeState: CarbonMonoxideStatusSchema
+	runtimeState: CarbonMonoxideStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * HVAC / climate control cap. Models the full surface of a HA
@@ -21877,7 +22081,14 @@ var climateControlCapability = {
 	* the full slice via `device.state.climate-control.value` and refresh
 	* on every push without re-querying the provider.
 	*/
-	runtimeState: ClimateControlStatusSchema
+	runtimeState: ClimateControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -21987,7 +22198,14 @@ onColorChanged: { data: object({
 	* kernel. Read via `device.state.color.value` so UI pickers surface
 	* the current chromaticity without polling the provider.
 	*/
-	runtimeState: ColorStatusSchema
+	runtimeState: ColorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
 	object({
@@ -22045,7 +22263,17 @@ var connectivityCapability = {
 		schema: ConnectivityStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ConnectivityStatusSchema
+	runtimeState: ConnectivityStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Generic device-consumables capability — surfaces a device's
@@ -22127,7 +22355,14 @@ reset: method(object({
 			}
 		}
 	},
-	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: number() })
+	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: number() }),
+	/**
+	* Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Door / window / opening / garage / valve contact sensor. Boolean
@@ -22158,7 +22393,17 @@ var contactCapability = {
 		schema: ContactStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ContactStatusSchema
+	runtimeState: ContactStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a door left open across a restart must still read open.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Status slice — flat object (the framework's `runtimeState` contract
@@ -22264,7 +22509,14 @@ var controlCapability = {
 	* dropdown / text field / date picker) read the slice's discriminant
 	* and value directly without polling the provider.
 	*/
-	runtimeState: ControlStatusSchema
+	runtimeState: ControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var CoverStatusSchema = object({
 	/** Lifecycle state of the cover. */
@@ -22325,7 +22577,17 @@ var coverCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch
 	* the slice for live position changes during a move.
 	*/
-	runtimeState: CoverStatusSchema
+	runtimeState: CoverStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Vendor-neutral day/night (IR-cut) control — the per-camera config cap
@@ -22419,7 +22681,17 @@ var dayNightCapability = {
 		schema: DayNightStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: DayNightStatusSchema
+	runtimeState: DayNightStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
@@ -22466,7 +22738,17 @@ onStatusChanged: { data: object({
 		schema: DeviceStatusSchema,
 		kind: "push"
 	},
-	runtimeState: DeviceStatusSchema
+	runtimeState: DeviceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Doorbell button cap. Two kinds of providers coexist behind this cap
@@ -22528,7 +22810,14 @@ onPressed: { data: DoorbellPressEventSchema } },
 	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
 	* without subscribing.
 	*/
-	runtimeState: DoorbellStatusSchema
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Enum-state sensor — a string value picked from a finite option set.
@@ -22568,7 +22857,17 @@ var enumSensorCapability = {
 		schema: EnumSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EnumSensorStatusSchema
+	runtimeState: EnumSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic stateless event emitter. Installed on a `DeviceType.EventEmitter`
@@ -22604,7 +22903,14 @@ var eventEmitterCapability = {
 		schema: EventEmitterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EventEmitterStatusSchema
+	runtimeState: EventEmitterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var EventItemSchema = object({
 	id: string(),
@@ -22911,7 +23217,14 @@ var fanControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI fan speed
 	* sliders read `percentage` for live updates.
 	*/
-	runtimeState: FanControlStatusSchema
+	runtimeState: FanControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -22987,7 +23300,14 @@ onProbeChanged: { data: object({
 		schema: FeatureProbeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FeatureProbeStatusSchema
+	runtimeState: FeatureProbeStatusSchema,
+	/**
+	* Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Water leak / moisture sensor. Boolean "is liquid currently
@@ -23014,7 +23334,17 @@ var floodCapability = {
 		schema: FloodStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FloodStatusSchema
+	runtimeState: FloodStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Combustible-gas (LPG / methane / hydrogen) alarm sensor. Drives
@@ -23037,7 +23367,17 @@ var gasCapability = {
 		schema: GasStatusSchema,
 		kind: "push"
 	},
-	runtimeState: GasStatusSchema
+	runtimeState: GasStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Humidifier / dehumidifier cap. Models HA `humidifier.*` entities —
@@ -23113,7 +23453,14 @@ var humidifierCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live humidity / mode changes.
 	*/
-	runtimeState: HumidifierStatusSchema
+	runtimeState: HumidifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Single-metric humidity reading. Drives Home Assistant `sensor`
@@ -23149,7 +23496,17 @@ var humiditySensorCapability = {
 		schema: HumiditySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: HumiditySensorStatusSchema
+	runtimeState: HumiditySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Image display cap. Models a single still image exposed by an integration —
@@ -23187,7 +23544,14 @@ var imageCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads `url`
 	* directly and renders the still image.
 	*/
-	runtimeState: ImageStatusSchema
+	runtimeState: ImageStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Vendor-neutral image / picture-adjustment cap — the per-camera config
@@ -23336,7 +23700,17 @@ var imageSettingsCapability = {
 		schema: ImageSettingsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: ImageSettingsStatusSchema
+	runtimeState: ImageSettingsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * integrations — system-scoped singleton capability for integration
@@ -23676,7 +24050,14 @@ var lawnMowerControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live activity + battery changes.
 	*/
-	runtimeState: LawnMowerControlStatusSchema
+	runtimeState: LawnMowerControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `vacuum-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * local-network — hub-only singleton.
@@ -23882,7 +24263,17 @@ var lockControlCapability = {
 	* read `state` and disable themselves during `locking`/`unlocking`
 	* transitions.
 	*/
-	runtimeState: LockControlStatusSchema
+	runtimeState: LockControlStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a lock left locked must still read locked.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
@@ -24044,7 +24435,14 @@ var mediaPlayerCapability = {
 	* full slice for live now-playing, volume, and progress updates
 	* without polling.
 	*/
-	runtimeState: MediaPlayerStatusSchema
+	runtimeState: MediaPlayerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -24308,7 +24706,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* `device.state.motion.value`. Reads never invoke the provider, so
 	* UIs and other addons can poll the cached state safely.
 	*/
-	runtimeState: MotionStatusSchema
+	runtimeState: MotionStatusSchema,
+	/**
+	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Motion-trigger toggle for accessory devices.
@@ -24373,7 +24778,14 @@ var motionTriggerCapability = {
 		schema: MotionTriggerStatusSchema,
 		kind: "command-driven"
 	},
-	runtimeState: MotionTriggerRuntimeStateSchema
+	runtimeState: MotionTriggerRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
@@ -24440,7 +24852,17 @@ var motionZonesCapability = {
 		schema: MotionZoneStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: MotionZoneStatusSchema
+	runtimeState: MotionZoneStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * On-camera AI object detection cap. Surfaces per-device the classes
@@ -24514,7 +24936,17 @@ var nativeObjectDetectionCapability = {
 		schema: NativeObjectDetectionStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NativeObjectDetectionRuntimeStateSchema
+	runtimeState: NativeObjectDetectionRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * network-quality — system-scoped singleton capability tracking RTT,
@@ -24848,7 +25280,14 @@ onSent: { data: object({
 	* form reads `supports` to gate optional fields; history pane reads
 	* `lastSentAt` / `lastError` / `queueDepth`.
 	*/
-	runtimeState: NotifierStatusSchema
+	runtimeState: NotifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Generic numeric sensor — last-resort fallback when no typed numeric
@@ -24891,7 +25330,17 @@ var numericSensorCapability = {
 		schema: NumericSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NumericSensorStatusSchema
+	runtimeState: NumericSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
@@ -25276,7 +25725,14 @@ var petFeederCapability = {
 	* the full slice via `device.state.petFeeder.value` and refresh on
 	* every poll without re-querying the provider.
 	*/
-	runtimeState: PetFeederStatusSchema
+	runtimeState: PetFeederStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var VehicleSchema = object({
 	id: string(),
@@ -25622,7 +26078,17 @@ var powerMeterCapability = {
 		schema: PowerMeterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PowerMeterStatusSchema
+	runtimeState: PowerMeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
@@ -25679,7 +26145,17 @@ var presenceCapability = {
 	* the map pin is rendered (use `DeviceFeature.PresenceGps` for the
 	* pre-fetch fast-path check).
 	*/
-	runtimeState: PresenceStatusSchema
+	runtimeState: PresenceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Atmospheric pressure reading in hectopascals. Drives Home Assistant
@@ -25715,7 +26191,17 @@ var pressureSensorCapability = {
 		schema: PressureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PressureSensorStatusSchema
+	runtimeState: PressureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * PRIVACY — what the camera deliberately does not capture. Two planes:
@@ -25845,7 +26331,17 @@ var privacyMaskCapability = {
 		schema: PrivacyMaskStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: PrivacyMaskStatusSchema
+	runtimeState: PrivacyMaskStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 var PtzPresetSchema = object({
 	id: string(),
@@ -26011,7 +26507,14 @@ var ptzAutotrackCapability = {
 	* fetch / cache / fallback logic out of the four cap methods —
 	* they become trampolines over `runtimeState`.
 	*/
-	runtimeState: PtzAutotrackRuntimeStateSchema
+	runtimeState: PtzAutotrackRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceId: number().int().nonnegative() }), object({ success: literal(true) }), {
 	kind: "mutation",
@@ -26358,13 +26861,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -26669,7 +27183,14 @@ var sceneMonitorCapability = {
 		schema: SceneMonitorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SceneMonitorStatusSchema
+	runtimeState: SceneMonitorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-stage gating mode applied to the zones a rule references.
@@ -26813,7 +27334,14 @@ var scriptRunnerCapability = {
 	* `isRunning` to render a spinner during execution and surfaces
 	* `lastError` / `lastRunSuccess` in the recent-runs panel.
 	*/
-	runtimeState: ScriptRunnerStatusSchema
+	runtimeState: ScriptRunnerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Smoke alarm sensor — boolean "is smoke currently detected" with
@@ -26840,7 +27368,17 @@ var smokeCapability = {
 		schema: SmokeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SmokeStatusSchema
+	runtimeState: SmokeStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * One publishable camera stream as its OWNING PROVIDER describes it — the same
@@ -27013,7 +27551,17 @@ var streamParamsCapability = {
 		schema: StreamParamsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: StreamParamsStatusSchema
+	runtimeState: StreamParamsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic on/off switch cap for accessory children (siren, floodlight,
@@ -27059,6 +27607,16 @@ var switchCapability = {
 	* not need to re-query the provider after a setState mutation.
 	*/
 	runtimeState: SwitchStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"],
 	settings: { bindings: [{
 		kind: "scalar",
 		statusPath: "on",
@@ -27138,7 +27696,17 @@ var tamperCapability = {
 		schema: TamperStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TamperStatusSchema
+	runtimeState: TamperStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Single-metric temperature reading. Drives Home Assistant `sensor`
@@ -27183,7 +27751,17 @@ var temperatureSensorCapability = {
 		schema: TemperatureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TemperatureSensorStatusSchema
+	runtimeState: TemperatureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * toast — system-scoped singleton capability that streams toast
@@ -27252,7 +27830,14 @@ var updateCapability = {
 		schema: UpdateStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: UpdateStatusSchema
+	runtimeState: UpdateStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var UserSummarySchema = object({
 	id: string(),
@@ -27586,7 +28171,14 @@ var vacuumControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live state + battery + fan-speed changes.
 	*/
-	runtimeState: VacuumControlStatusSchema
+	runtimeState: VacuumControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var ValveStatusSchema = object({
 	/** Lifecycle state of the valve. */
@@ -27638,7 +28230,14 @@ var valveCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live position changes during a move.
 	*/
-	runtimeState: ValveStatusSchema
+	runtimeState: ValveStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Vibration / shake / impact sensor. Drives Home Assistant
@@ -27660,7 +28259,17 @@ var vibrationCapability = {
 		schema: VibrationStatusSchema,
 		kind: "push"
 	},
-	runtimeState: VibrationStatusSchema
+	runtimeState: VibrationStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Water heater / boiler cap. Models HA `water_heater.*` entities — a
@@ -27734,7 +28343,14 @@ var waterHeaterCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live temperature / mode / away changes.
 	*/
-	runtimeState: WaterHeaterStatusSchema
+	runtimeState: WaterHeaterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Weather provider cap. Models HA `weather.*` entities — a read-only
@@ -27793,7 +28409,14 @@ var weatherCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads the
 	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: WeatherStatusSchema
+	runtimeState: WeatherStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-zone occupancy aggregation produced by the analytics frame
@@ -27955,7 +28578,14 @@ var zoneAnalyticsCapability = {
 	* automatically; the explicit `getCurrentSnapshot` cap method is
 	* still useful for one-off polls without a subscription.
 	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Stages a {@link ZoneRule} can apply to. Discriminator on the rules
@@ -28033,7 +28663,14 @@ var zoneRulesCapability = {
 		motion: array(ZoneRuleSchema).readonly(),
 		detection: array(ZoneRuleSchema).readonly(),
 		package: array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Most specific first. Extending this list is how a new device kind becomes
@@ -34773,6 +35410,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 var WEEKDAY_TO_DAY = {
 	Sun: 0,
@@ -35179,25 +35817,32 @@ object({
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
+	*
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -35223,22 +35868,45 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /** Cosine similarity between two embedding vectors */
 function cosineSimilarity(a, b) {
@@ -35286,4 +35954,4 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { BaseAddon as $, assertTimelapseCadences as A, hfModelUrl as B, TIMELAPSE_DENSE_FLOOR_SEC as C, TrackSourceSchema as D, TimelapseRuleSchema as E, defineCustomActions as F, plateGalleryCapability as G, kebabToCamel as H, deriveRecordingMode as I, subKindsOf as J, readDeviceStateFrom as K, embeddingEncoderCapability as L, buildEventKindDescriptor as M, cosineSimilarity as N, addonWidgetsSourceCapability as O, customAction as P, errMsg as Q, encodeVectorBase64 as R, RetrainStatusSchema as S, TimelapseRulePatchSchema as T, notificationRulesCapability as U, isScheduleActive as V, pipelineAnalyticsCapability as W, videoclipsCapability as X, vectorDimFromBase64 as Y, zoneAnalyticsCapability as Z, NcSnoozeSchema as _, DeclaredDevices as a, sleep as at, OpsLogEntrySchema as b, LabelAttributionSchema as c, boolean as ct, NC_TAXONOMY as d, object as dt, DeviceType as et, NcConditionDescriptorSchema as f, partialRecord as ft, NcSnoozeInputSchema as g, EventCategory as gt, NcRuleSchema as h, unknown as ht, DETECTION_PIPELINE_CAP_NAME as i, nodePin as it, audioMetricsCapability as j, alarmPanelCapability as k, MACRO_LABELS as l, literal as lt, NcRulePatchSchema as m, string as mt, DEFAULT_EVENT_COLOR as n, hydrateSchema as nt, EVENT_KIND_BY_CAP as o, _enum as ot, NcRuleInputSchema as p, record as pt, readTimelapseGeneratedAt as q, DEFAULT_TIMELAPSE_PREVIEW_TEXT as r, isDeviceScopedCap as rt, EVENT_PAD_MS as s, array as st, BaseDevice as t, createEvent as tt, NC_CONDITION_CATALOG as u, number as ut, NcSnoozeSuppressedSchema as v, TimelapseRuleInputSchema as w, RECORDING_EXPORT_MAX_READ_BYTES as x, NcTaxonomySchema as y, faceGalleryCapability as z };
+export { subKindsOf as $, TimelapseRulePatchSchema as A, defineCustomActions as B, NcSnoozeSuppressedSchema as C, RetrainStatusSchema as D, RECORDING_EXPORT_MAX_READ_BYTES as E, assertTimelapseCadences as F, hfModelUrl as G, embeddingEncoderCapability as H, audioMetricsCapability as I, notificationRulesCapability as J, isScheduleActive as K, buildEventKindDescriptor as L, TrackSourceSchema as M, addonWidgetsSourceCapability as N, TIMELAPSE_DENSE_FLOOR_SEC as O, alarmPanelCapability as P, readTimelapseGeneratedAt as Q, cosineSimilarity as R, NcSnoozeSchema as S, EventCategory as St, OpsLogEntrySchema as T, encodeVectorBase64 as U, deriveRecordingMode as V, faceGalleryCapability as W, plateGalleryCapability as X, pipelineAnalyticsCapability as Y, readDeviceStateFrom as Z, NcRulePatchSchema as _, object as _t, DeclaredDevices as a, DeviceType as at, NcScheduleSchema as b, string as bt, LabelAttributionSchema as c, isDeviceScopedCap as ct, NC_CONDITION_CATALOG as d, _enum as dt, vectorDimFromBase64 as et, NC_DEFAULT_SNOOZE_MINUTES as f, array as ft, NcRuleInputSchema as g, number as gt, NcConditionDescriptorSchema as h, literal as ht, DETECTION_PIPELINE_CAP_NAME as i, BaseAddon as it, TimelapseRuleSchema as j, TimelapseRuleInputSchema as k, MACRO_LABELS as l, nodePin as lt, NC_TAXONOMY as m, discriminatedUnion as mt, DEFAULT_EVENT_COLOR as n, zoneAnalyticsCapability as nt, EVENT_KIND_BY_CAP as o, createEvent as ot, NC_SNOOZE_MAX_MINUTES as p, boolean as pt, kebabToCamel as q, DEFAULT_TIMELAPSE_PREVIEW_TEXT as r, errMsg as rt, EVENT_PAD_MS as s, hydrateSchema as st, BaseDevice as t, videoclipsCapability as tt, NC_ALARM_SYSTEM_EVENT_KINDS as u, sleep as ut, NcRuleSchema as v, partialRecord as vt, NcTaxonomySchema as w, NcSnoozeInputSchema as x, unknown as xt, NcRuleTargetSchema as y, record as yt, customAction as z };