@camstack/addon-provider-hikvision 1.2.17 → 1.2.19

package/dist/addon.mjs

@@ -10928,7 +10928,14 @@ var cameraStreamsCapability = {
 			low: string().optional()
 		}),
 		lastChangedAt: number()
-	})
+	}),
+	/**
+	* Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
@@ -11501,6 +11508,13 @@ var deviceDiscoveryCapability = {
 		kind: "poll"
 	},
 	runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: number().int().nonnegative() }),
+	/**
+	* Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -13400,7 +13414,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14252,7 +14282,17 @@ var alarmPanelCapability = {
 	* full slice; renders an arm button per `availableModes` entry and
 	* a PIN field iff `requiresCode === true`.
 	*/
-	runtimeState: AlarmPanelStatusSchema
+	runtimeState: AlarmPanelStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
@@ -14429,6 +14469,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14805,15 +14848,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -15049,6 +15092,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -15148,6 +15215,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -15166,6 +15234,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15317,7 +15386,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15342,6 +15424,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -17442,7 +17528,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() })
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -20336,7 +20429,17 @@ var airQualitySensorCapability = {
 		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AirQualitySensorStatusSchema
+	runtimeState: AirQualitySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Ambient illuminance reading in lux. Drives Home Assistant `sensor`
@@ -20368,7 +20471,17 @@ var ambientLightSensorCapability = {
 		schema: AmbientLightSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AmbientLightSensorStatusSchema
+	runtimeState: AmbientLightSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Per-class audio metrics aggregated over a sliding window.
@@ -20486,7 +20599,14 @@ var audioMetricsCapability = {
 		}), AudioMetricsHistorySchema)
 	},
 	/** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-	runtimeState: AudioMetricsSnapshotSchema
+	runtimeState: AudioMetricsSnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -20548,7 +20668,14 @@ var automationControlCapability = {
 	* reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
 	* (badge) directly.
 	*/
-	runtimeState: AutomationControlStatusSchema
+	runtimeState: AutomationControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Battery status snapshot. Emitted by providers whose device is
@@ -20654,7 +20781,17 @@ onStatusChanged: { data: object({
 	* via `device.runtimeState.getCapState('battery')` regardless of
 	* the underlying driver.
 	*/
-	runtimeState: BatteryStatusSchema
+	runtimeState: BatteryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastUpdated"]
 };
 /**
 * Generic boolean sensor — last-resort fallback when no domain-
@@ -20683,7 +20820,17 @@ var binaryCapability = {
 		schema: BinaryStatusSchema,
 		kind: "push"
 	},
-	runtimeState: BinaryStatusSchema
+	runtimeState: BinaryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Dimmable-light brightness control. Co-exists with `switch` on the
@@ -20736,7 +20883,14 @@ onBrightnessChanged: { data: object({
 	* by the kernel. Read via `device.state.brightness.value` so UI
 	* sliders surface the current level without polling the provider.
 	*/
-	runtimeState: BrightnessStatusSchema
+	runtimeState: BrightnessStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 DeviceType.Button, method(object({ deviceId: number().int().nonnegative() }), _void(), {
 	kind: "mutation",
@@ -20824,7 +20978,17 @@ var carbonMonoxideCapability = {
 		schema: CarbonMonoxideStatusSchema,
 		kind: "push"
 	},
-	runtimeState: CarbonMonoxideStatusSchema
+	runtimeState: CarbonMonoxideStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * HVAC / climate control cap. Models the full surface of a HA
@@ -20984,7 +21148,14 @@ var climateControlCapability = {
 	* the full slice via `device.state.climate-control.value` and refresh
 	* on every push without re-querying the provider.
 	*/
-	runtimeState: ClimateControlStatusSchema
+	runtimeState: ClimateControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -21094,7 +21265,14 @@ onColorChanged: { data: object({
 	* kernel. Read via `device.state.color.value` so UI pickers surface
 	* the current chromaticity without polling the provider.
 	*/
-	runtimeState: ColorStatusSchema
+	runtimeState: ColorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
 	object({
@@ -21152,7 +21330,17 @@ var connectivityCapability = {
 		schema: ConnectivityStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ConnectivityStatusSchema
+	runtimeState: ConnectivityStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Generic device-consumables capability — surfaces a device's
@@ -21234,7 +21422,14 @@ reset: method(object({
 			}
 		}
 	},
-	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: number() })
+	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: number() }),
+	/**
+	* Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Door / window / opening / garage / valve contact sensor. Boolean
@@ -21265,7 +21460,17 @@ var contactCapability = {
 		schema: ContactStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ContactStatusSchema
+	runtimeState: ContactStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a door left open across a restart must still read open.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Status slice — flat object (the framework's `runtimeState` contract
@@ -21371,7 +21576,14 @@ var controlCapability = {
 	* dropdown / text field / date picker) read the slice's discriminant
 	* and value directly without polling the provider.
 	*/
-	runtimeState: ControlStatusSchema
+	runtimeState: ControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var CoverStatusSchema = object({
 	/** Lifecycle state of the cover. */
@@ -21432,7 +21644,17 @@ var coverCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch
 	* the slice for live position changes during a move.
 	*/
-	runtimeState: CoverStatusSchema
+	runtimeState: CoverStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Vendor-neutral day/night (IR-cut) control — the per-camera config cap
@@ -21526,7 +21748,17 @@ var dayNightCapability = {
 		schema: DayNightStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: DayNightStatusSchema
+	runtimeState: DayNightStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
@@ -21573,7 +21805,17 @@ onStatusChanged: { data: object({
 		schema: DeviceStatusSchema,
 		kind: "push"
 	},
-	runtimeState: DeviceStatusSchema
+	runtimeState: DeviceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Doorbell button cap. Two kinds of providers coexist behind this cap
@@ -21635,7 +21877,14 @@ onPressed: { data: DoorbellPressEventSchema } },
 	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
 	* without subscribing.
 	*/
-	runtimeState: DoorbellStatusSchema
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Enum-state sensor — a string value picked from a finite option set.
@@ -21675,7 +21924,17 @@ var enumSensorCapability = {
 		schema: EnumSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EnumSensorStatusSchema
+	runtimeState: EnumSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic stateless event emitter. Installed on a `DeviceType.EventEmitter`
@@ -21711,7 +21970,14 @@ var eventEmitterCapability = {
 		schema: EventEmitterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EventEmitterStatusSchema
+	runtimeState: EventEmitterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var EventItemSchema = object({
 	id: string(),
@@ -21992,7 +22258,14 @@ var fanControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI fan speed
 	* sliders read `percentage` for live updates.
 	*/
-	runtimeState: FanControlStatusSchema
+	runtimeState: FanControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -22068,7 +22341,14 @@ onProbeChanged: { data: object({
 		schema: FeatureProbeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FeatureProbeStatusSchema
+	runtimeState: FeatureProbeStatusSchema,
+	/**
+	* Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Water leak / moisture sensor. Boolean "is liquid currently
@@ -22095,7 +22375,17 @@ var floodCapability = {
 		schema: FloodStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FloodStatusSchema
+	runtimeState: FloodStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Combustible-gas (LPG / methane / hydrogen) alarm sensor. Drives
@@ -22118,7 +22408,17 @@ var gasCapability = {
 		schema: GasStatusSchema,
 		kind: "push"
 	},
-	runtimeState: GasStatusSchema
+	runtimeState: GasStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Humidifier / dehumidifier cap. Models HA `humidifier.*` entities —
@@ -22194,7 +22494,14 @@ var humidifierCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live humidity / mode changes.
 	*/
-	runtimeState: HumidifierStatusSchema
+	runtimeState: HumidifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Single-metric humidity reading. Drives Home Assistant `sensor`
@@ -22230,7 +22537,17 @@ var humiditySensorCapability = {
 		schema: HumiditySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: HumiditySensorStatusSchema
+	runtimeState: HumiditySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Image display cap. Models a single still image exposed by an integration —
@@ -22268,7 +22585,14 @@ var imageCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads `url`
 	* directly and renders the still image.
 	*/
-	runtimeState: ImageStatusSchema
+	runtimeState: ImageStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Vendor-neutral image / picture-adjustment cap — the per-camera config
@@ -22417,7 +22741,17 @@ var imageSettingsCapability = {
 		schema: ImageSettingsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: ImageSettingsStatusSchema
+	runtimeState: ImageSettingsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * integrations — system-scoped singleton capability for integration
@@ -22808,7 +23142,14 @@ var lawnMowerControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live activity + battery changes.
 	*/
-	runtimeState: LawnMowerControlStatusSchema
+	runtimeState: LawnMowerControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `vacuum-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * local-network — hub-only singleton.
@@ -23014,7 +23355,17 @@ var lockControlCapability = {
 	* read `state` and disable themselves during `locking`/`unlocking`
 	* transitions.
 	*/
-	runtimeState: LockControlStatusSchema
+	runtimeState: LockControlStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a lock left locked must still read locked.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
@@ -23176,7 +23527,14 @@ var mediaPlayerCapability = {
 	* full slice for live now-playing, volume, and progress updates
 	* without polling.
 	*/
-	runtimeState: MediaPlayerStatusSchema
+	runtimeState: MediaPlayerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -23440,7 +23798,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* `device.state.motion.value`. Reads never invoke the provider, so
 	* UIs and other addons can poll the cached state safely.
 	*/
-	runtimeState: MotionStatusSchema
+	runtimeState: MotionStatusSchema,
+	/**
+	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Motion-trigger toggle for accessory devices.
@@ -23505,7 +23870,14 @@ var motionTriggerCapability = {
 		schema: MotionTriggerStatusSchema,
 		kind: "command-driven"
 	},
-	runtimeState: MotionTriggerRuntimeStateSchema
+	runtimeState: MotionTriggerRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
@@ -23572,7 +23944,17 @@ var motionZonesCapability = {
 		schema: MotionZoneStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: MotionZoneStatusSchema
+	runtimeState: MotionZoneStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * On-camera AI object detection cap. Surfaces per-device the classes
@@ -23646,7 +24028,17 @@ var nativeObjectDetectionCapability = {
 		schema: NativeObjectDetectionStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NativeObjectDetectionRuntimeStateSchema
+	runtimeState: NativeObjectDetectionRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * network-quality — system-scoped singleton capability tracking RTT,
@@ -23980,7 +24372,14 @@ onSent: { data: object({
 	* form reads `supports` to gate optional fields; history pane reads
 	* `lastSentAt` / `lastError` / `queueDepth`.
 	*/
-	runtimeState: NotifierStatusSchema
+	runtimeState: NotifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Generic numeric sensor — last-resort fallback when no typed numeric
@@ -24023,7 +24422,17 @@ var numericSensorCapability = {
 		schema: NumericSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NumericSensorStatusSchema
+	runtimeState: NumericSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
@@ -24454,7 +24863,14 @@ var petFeederCapability = {
 	* the full slice via `device.state.petFeeder.value` and refresh on
 	* every poll without re-querying the provider.
 	*/
-	runtimeState: PetFeederStatusSchema
+	runtimeState: PetFeederStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var VehicleSchema = object({
 	id: string(),
@@ -24766,7 +25182,17 @@ var powerMeterCapability = {
 		schema: PowerMeterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PowerMeterStatusSchema
+	runtimeState: PowerMeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
@@ -24823,7 +25249,17 @@ var presenceCapability = {
 	* the map pin is rendered (use `DeviceFeature.PresenceGps` for the
 	* pre-fetch fast-path check).
 	*/
-	runtimeState: PresenceStatusSchema
+	runtimeState: PresenceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Atmospheric pressure reading in hectopascals. Drives Home Assistant
@@ -24859,7 +25295,17 @@ var pressureSensorCapability = {
 		schema: PressureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PressureSensorStatusSchema
+	runtimeState: PressureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * PRIVACY — what the camera deliberately does not capture. Two planes:
@@ -24989,7 +25435,17 @@ var privacyMaskCapability = {
 		schema: PrivacyMaskStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: PrivacyMaskStatusSchema
+	runtimeState: PrivacyMaskStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Collapse a camera's PER-PROFILE audio flags into the one answer
@@ -25217,7 +25673,14 @@ var ptzAutotrackCapability = {
 	* fetch / cache / fallback logic out of the four cap methods —
 	* they become trampolines over `runtimeState`.
 	*/
-	runtimeState: PtzAutotrackRuntimeStateSchema
+	runtimeState: PtzAutotrackRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * reboot — device-scoped capability for "soft" device reboots (firmware
@@ -25589,13 +26052,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -25881,7 +26355,14 @@ var sceneMonitorCapability = {
 		schema: SceneMonitorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SceneMonitorStatusSchema
+	runtimeState: SceneMonitorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-stage gating mode applied to the zones a rule references.
@@ -26025,7 +26506,14 @@ var scriptRunnerCapability = {
 	* `isRunning` to render a spinner during execution and surfaces
 	* `lastError` / `lastRunSuccess` in the recent-runs panel.
 	*/
-	runtimeState: ScriptRunnerStatusSchema
+	runtimeState: ScriptRunnerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Smoke alarm sensor — boolean "is smoke currently detected" with
@@ -26052,7 +26540,17 @@ var smokeCapability = {
 		schema: SmokeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SmokeStatusSchema
+	runtimeState: SmokeStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * One publishable camera stream as its OWNING PROVIDER describes it — the same
@@ -26238,7 +26736,17 @@ var streamParamsCapability = {
 		schema: StreamParamsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: StreamParamsStatusSchema
+	runtimeState: StreamParamsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * The three well-known stream profiles in render order. Exported so the
@@ -26482,6 +26990,16 @@ var switchCapability = {
 	* not need to re-query the provider after a setState mutation.
 	*/
 	runtimeState: SwitchStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"],
 	settings: { bindings: [{
 		kind: "scalar",
 		statusPath: "on",
@@ -26561,7 +27079,17 @@ var tamperCapability = {
 		schema: TamperStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TamperStatusSchema
+	runtimeState: TamperStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Single-metric temperature reading. Drives Home Assistant `sensor`
@@ -26606,7 +27134,17 @@ var temperatureSensorCapability = {
 		schema: TemperatureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TemperatureSensorStatusSchema
+	runtimeState: TemperatureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * toast — system-scoped singleton capability that streams toast
@@ -26675,7 +27213,14 @@ var updateCapability = {
 		schema: UpdateStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: UpdateStatusSchema
+	runtimeState: UpdateStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var UserSummarySchema = object({
 	id: string(),
@@ -27009,7 +27554,14 @@ var vacuumControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live state + battery + fan-speed changes.
 	*/
-	runtimeState: VacuumControlStatusSchema
+	runtimeState: VacuumControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var ValveStatusSchema = object({
 	/** Lifecycle state of the valve. */
@@ -27061,7 +27613,14 @@ var valveCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live position changes during a move.
 	*/
-	runtimeState: ValveStatusSchema
+	runtimeState: ValveStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Vibration / shake / impact sensor. Drives Home Assistant
@@ -27083,7 +27642,17 @@ var vibrationCapability = {
 		schema: VibrationStatusSchema,
 		kind: "push"
 	},
-	runtimeState: VibrationStatusSchema
+	runtimeState: VibrationStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Water heater / boiler cap. Models HA `water_heater.*` entities — a
@@ -27157,7 +27726,14 @@ var waterHeaterCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live temperature / mode / away changes.
 	*/
-	runtimeState: WaterHeaterStatusSchema
+	runtimeState: WaterHeaterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Weather provider cap. Models HA `weather.*` entities — a read-only
@@ -27216,7 +27792,14 @@ var weatherCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads the
 	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: WeatherStatusSchema
+	runtimeState: WeatherStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-zone occupancy aggregation produced by the analytics frame
@@ -27378,7 +27961,14 @@ var zoneAnalyticsCapability = {
 	* automatically; the explicit `getCurrentSnapshot` cap method is
 	* still useful for one-off polls without a subscription.
 	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Stages a {@link ZoneRule} can apply to. Discriminator on the rules
@@ -27456,7 +28046,14 @@ var zoneRulesCapability = {
 		motion: array(ZoneRuleSchema).readonly(),
 		detection: array(ZoneRuleSchema).readonly(),
 		package: array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Accessory device helpers — shared across drivers.
@@ -34289,6 +34886,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -34566,25 +35164,32 @@ object({
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -34610,22 +35215,45 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 //#endregion
 //#region src/accessories/base.ts