@camstack/system 1.2.390 → 1.2.391

package/dist/builtins/device-manager/device-state-mirror.d.ts

@@ -1,271 +1,263 @@
-import { AddonContext, ClaimOutcome } from '@camstack/types';
-import { DeviceManagerSettings } from './device-meta-store.js';
-import { RuntimeStateSchemaLookup } from './device-state-claim-views.js';
-import { MergedSlice, OwnedCap, OwnedCaps } from './field-ownership.js';
-import { MirrorWriteHold } from './mirror-row-writer.js';
-import { RuntimeStatePolicyLookup } from './runtime-state-persist-gate.js';
+import type { AddonContext, ClaimOutcome } from "@camstack/types";
+import type { DeviceManagerSettings } from "./device-meta-store.js";
+import { type RuntimeStateSchemaLookup } from "./device-state-claim-views.js";
+import { type MergedSlice, type OwnedCap, type OwnedCaps } from "./field-ownership.js";
+import { type MirrorWriteHold } from "./mirror-row-writer.js";
+import { type RuntimeStatePolicyLookup } from "./runtime-state-persist-gate.js";
 /**
- * What the seed consults first: the claims index (Task 6). It is written
- * BEFORE the row, so a loaded index is a superset of the rows' claims and a
- * device it does not name has nothing to merge — no row read (D447).
- */
+* What the seed consults first: the claims index (Task 6). It is written
+* BEFORE the row, so a loaded index is a superset of the rows' claims and a
+* device it does not name has nothing to merge — no row read (D447).
+*/
 export type ClaimsIndexView = {
-    readonly state: 'loaded';
-    hasClaims(deviceId: number): boolean;
+	readonly state: "loaded";
+	hasClaims(deviceId: number): boolean;
 } | {
-    readonly state: 'not-loaded';
+	readonly state: "not-loaded";
 };
 /**
- * How `seedMirror` treats what memory already holds. `fill` (boot, first
- * write) only adds caps memory lacks — memory is never behind the row.
- * `replace` (the migration reseed) drops the device's slices, claims and views
- * first: the row now describes different hardware, so everything memory held
- * under that number is the wrong device's state.
- */
-export type SeedMode = 'fill' | 'replace';
+* How `seedMirror` treats what memory already holds. `fill` (boot, first
+* write) only adds caps memory lacks — memory is never behind the row.
+* `replace` (the migration reseed) drops the device's slices, claims and views
+* first: the row now describes different hardware, so everything memory held
+* under that number is the wrong device's state.
+*/
+export type SeedMode = "fill" | "replace";
 export declare class DeviceStateMirror {
-    private readonly ctx;
-    /**
-     * Per-cap durability + volatile-field policy. Defaults to the codegen'd
-     * projection of every `*.cap.ts` (D4: the cap declares, the kernel reads).
-     * Injectable so a spec can exercise the gate without the real cap set.
-     */
-    private readonly policyFor;
-    /**
-     * Hub-side mirror of every device's cap-keyed NATIVE runtime state — what the
-     * provider wrote. Key: deviceId. Value: per-cap slice map. Empty by default —
-     * slices show up as `setCapSlice` calls trickle in.
-     */
-    private readonly stateMirror;
-    /** The claims and the merged view of every claimed cap (D663). */
-    private readonly claims;
-    /**
-     * Devices whose CLAIMS are known: the row was read, or a loaded claims index
-     * vouched that it names none (D447). This is a READ-path fact — what a
-     * status read may answer from. It never licenses a row write (D677).
-     */
-    private readonly seeded;
-    /**
-     * Devices whose row was actually READ into memory in THIS process. Every row
-     * write of a device requires it (D677): the write replaces the whole row, so
-     * memory must hold what the row held — an index that vouches for the claims
-     * says nothing about the native slices beside them.
-     */
-    private readonly rowRead;
-    /** One row read per device, however many writes arrive during it. */
-    private readonly seeding;
-    /** Devices whose seed refusal is already logged — once per transition. */
-    private readonly seedRefusalLogged;
-    /** Every write of a device's row, and what is believed to be on it. */
-    private readonly writer;
-    constructor(ctx: AddonContext, 
-    /**
-     * Per-cap durability + volatile-field policy. Defaults to the codegen'd
-     * projection of every `*.cap.ts` (D4: the cap declares, the kernel reads).
-     * Injectable so a spec can exercise the gate without the real cap set.
-     */
-    policyFor?: RuntimeStatePolicyLookup, 
-    /** The cap's `runtimeState` schema a merged slice is parsed with (D663). */
-    schemaFor?: RuntimeStateSchemaLookup);
-    /**
-     * Single-cap mirror update — diff against the current mirror,
-     * persist the new slice in-memory, emit `DeviceStateChanged` for
-     * this cap. No-op on identical writes (both same shape and same
-     * values). Called by `setCapSlice` provider.
-     *
-     * This is the NATIVE path, unchanged for every writer. Under a claim the
-     * native slice is stored as the shadow and what is emitted is the merge.
-     *
-     * @returns whether the mirror actually changed. The caller uses this to
-     *   decide whether the (synchronous, disk-blocking) runtime-state write is
-     *   worth scheduling — see `scheduleRuntimeStateDiskWrite`. Returning void
-     *   here and scheduling unconditionally is what made an unchanged poll cost
-     *   a SQLite commit.
-     */
-    applySingleCapUpdate(deviceId: number, capName: string, slice: Record<string, unknown>): boolean;
-    /**
-     * Claim `cap.fields` of `capName` on `deviceId` for `cap.owner`. Written
-     * through: resolves after the row write. A re-claim by the same owner
-     * replaces `fields`; values of fields no longer claimed are dropped and the
-     * native shows for them (ruling S1b). An empty `fields` is what the composer
-     * never sends — it releases — and is refused.
-     */
-    claim(deviceId: number, capName: string, cap: OwnedCap, settings: DeviceManagerSettings): Promise<ClaimOutcome>;
-    /** Is this exact claim what the row carries, per `lastPersisted`? */
-    private isClaimPersisted;
-    /**
-     * Write owned values. Partial patches MERGE into `values` (ruling S5); a key
-     * outside `fields` is refused. Debounced like a native slice.
-     */
-    patchOwned(deviceId: number, capName: string, owner: string, values: Readonly<Record<string, unknown>>, settings: DeviceManagerSettings): Promise<ClaimOutcome>;
-    /**
-     * Remove the claim. A `replace` hands the cap back: the native slice is
-     * emitted exactly as last written. An `add` had no native — the cap leaves
-     * the mirror and nothing is emitted (consumer mirrors keep the last value
-     * until they re-read; recorded for Task 15). Written through.
-     */
-    release(deviceId: number, capName: string, owner: string, settings: DeviceManagerSettings): Promise<ClaimOutcome>;
-    /** The claims on a device; empty for every device without one. */
-    ownedCaps(deviceId: number): OwnedCaps;
-    /** The NATIVE shadow of one cap — for the owner-side mechanism only (D224). */
-    nativeSlice(deviceId: number, cap: string): Record<string, unknown> | null;
-    /** What the merge says for a claimed cap; null when the cap is not claimed. */
-    effectiveIfClaimed(deviceId: number, cap: string): MergedSlice | null;
-    isSeeded(deviceId: number): boolean;
-    /**
-     * Forget a removed device (D677): its armed row write is cancelled and one
-     * in flight awaited BEFORE its memory goes, so nothing writes its row back
-     * after `removeDevice` clears it.
-     */
-    forgetDevice(deviceId: number): Promise<void>;
-    /** The device's row was read in this process — the precondition of every row write (D677). */
-    isRowRead(deviceId: number): boolean;
-    /**
-     * The SYNCHRONOUS half of {@link ensureSeeded}, branch (c): a LOADED claims
-     * index that does not name the device vouches for its CLAIMS — seeded, no
-     * read. That is all it vouches for: the device is still not `rowRead`, and
-     * the writer reads the row before its first write (D677).
-     * Refused (false) while a read is in flight, because that read may be
-     * landing a claim the index does not know yet; refused when the index cannot
-     * vouch. The overlay's `peek` calls this instead of `ensureSeeded`: a sync
-     * path must never hold a promise that can reject (D391 — an unhandled
-     * rejection is an untagged line on hub-main).
-     */
-    seedIfIndexClears(deviceId: number, index: ClaimsIndexView): boolean;
-    /**
-     * Make sure the device's CLAIMS are known before a status read is answered
-     * or a native slice applied (D49). Index first, single-flight (ruling S6):
-     *   (a) already seeded → nothing;
-     *   (b) a seed in flight → await it;
-     *   (c) a LOADED index that does not name the device → seeded, no read;
-     *   (d) otherwise read the row once and seed it.
-     * A read that throws propagates and is logged once per device transition
-     * (D391).
-     *
-     * Also the native-write RPC's gate: a slice may be APPLIED once its claims
-     * are known. Never the ROW write's: branch (c) knows the claims and nothing
-     * about the native slices on the row; a writer that trusted it replaced a
-     * row it never read with the one slice it held, and every restored cap
-     * nobody re-wrote soon after boot was erased (D677, superseding S6(c) for
-     * writes). The writer calls {@link ensureRowRead}.
-     */
-    ensureSeeded(deviceId: number, settings: DeviceManagerSettings, index: ClaimsIndexView): Promise<void>;
-    /**
-     * A row write replaces the whole row: memory must hold what the row held
-     * (D677). Reads the row once, single-flight, and fills memory's gaps from it
-     * (`seedMirror('fill')`: a slice memory already holds is newer and wins).
-     * A read that throws propagates — nothing is written — and is logged once
-     * per device transition (D49, D391).
-     */
-    ensureRowRead(deviceId: number, settings: DeviceManagerSettings): Promise<void>;
-    /** An unreadable row is a NAMED refusal (D49): the answer is unknown — a
-     *  throw could be read as "gone", `not-claimed` as "never was". Logged by `readRowOnce`. */
-    private readRowOrRefuse;
-    private readRowOnce;
-    private nativeOf;
-    /**
-     * Write the row now — a claim is atomic with the row — and refresh the
-     * baseline. Queued behind any write in flight for the device (one row write
-     * at a time, N-4), and the blob is taken when the write RUNS, so it carries
-     * whatever memory holds by then. A failed write is rolled back in memory IF
-     * what this op put there is still there (the two never disagree); when a
-     * newer same-owner state landed in the window it stands, and the debounced
-     * writer converges the row to it. Either way the failure is logged hub-side
-     * (D391) and rethrown; a repeat of the same claim is then a real write, never
-     * `changed: false`, and consumers are handed the truth that stands.
-     */
-    private writeThrough;
-    /** After a rollback, re-emit what is true now: the restored claim's merge, or the native. */
-    private reemitAfterRollback;
-    /** Arm the debounced writer for a change to `changedCap` — see `MirrorRowWriter.schedule`. */
-    scheduleRuntimeStateDiskWrite(deviceId: number, settings: DeviceManagerSettings, changedCap: string): void;
-    /** Hold the writer off these rows for a migration — see `MirrorRowWriter.holdDiskWrites`. */
-    holdDiskWrites(deviceIds: readonly number[], settings: DeviceManagerSettings): Promise<MirrorWriteHold>;
-    /** Flush every pending debounced disk write (graceful shutdown). */
-    flushPendingWrites(settings: DeviceManagerSettings | undefined): Promise<void>;
-    /** The device's row as it may reach disk: NATIVE slices plus `$owned`, restricted by durability. */
-    private persistableForDevice;
-    /**
-     * One-shot mirror seed used by `loadRuntimeState` at boot so the hub knows
-     * every persisted slice before the first `setCapSlice`. No events emitted —
-     * population, not a transition. `fill` (default) fills GAPS and never
-     * overwrites memory (ruling S6: a slice in memory is at least as new as the
-     * row, a claim in memory was written through); `replace` (the migration
-     * reseed) drops the device's memory first — the row now belongs to different
-     * hardware. Malformed `$owned` entries are dropped by name and logged once.
-     * Callers pass the blob through `withResetSessionProbe` first.
-     */
-    seedMirror(deviceId: number, blob: Record<string, unknown>, mode?: SeedMode): void;
-    /**
-     * The hub mirror's `feature-probe.lastProbedAt` is a PER-SESSION liveness
-     * signal — it means "this worker process completed a probe THIS session".
-     * Persisted runtime state carries the PRE-RESTART timestamp, which is stale
-     * after a hub or worker restart: the device has not re-probed yet. Seeding it
-     * verbatim makes `resolveDeviceProbed` report `probed:true` during the
-     * restart→reprobe window, which defeats the export carry-forward gate
-     * (`resolveExportFingerprint`, gated on `device.probed`) and posts a spurious
-     * partial `AddOrUpdateReport` to Alexa/HAP before the real probe lands.
-     *
-     * Reset `lastProbedAt` to 0 for the MIRROR seed only — `probed:false` carries
-     * the last-advertised fingerprint forward until the worker republishes a
-     * fresh probe (its post-probe `setCapSlice` raises `lastProbedAt` again, which
-     * also fires `DeviceReady`). The worker's returned `initialRuntimeState` blob
-     * is untouched, and every non-probe slice (e.g. `device-status`/online) is
-     * preserved.
-     */
-    withResetSessionProbe(blob: Record<string, unknown>): Record<string, unknown>;
-    /**
-     * Resolve a device's REAL `online` flag for the persisted/forked-worker
-     * list branch. Forked workers own the live `IDevice` in their own process,
-     * so the hub registry can't read `device.online` directly. The owning
-     * driver instead publishes its liveness through the auto-registered
-     * `device-status` runtime-state slice (`markOnline` → `setCapState`), which
-     * the canonical `deviceState.setCapSlice` write entrypoint mirrors into the
-     * hub-side `stateMirror`. We read that mirrored slice here so the list
-     * payload reflects the device's actual reachability instead of a constant.
-     *
-     * Fallback (`fallbackOnline`) preserves the legacy behaviour when no slice
-     * has been published yet: a persisted device with a live registry is
-     * assumed online (it was successfully registered by its owning process),
-     * and the null-registry "offline view" keeps reporting offline. We never
-     * regress a device to offline merely because its mirror is empty.
-     */
-    resolveDeviceOnline(deviceId: number, fallbackOnline: boolean): boolean;
-    /**
-     * Derive the `probed` flag for an offline-view (forked-worker, not
-     * live in the hub registry) device projection. Reads the mirrored
-     * `feature-probe` slice the owning worker publishes. Mirrors the
-     * `toDeviceInfo` rule: no mirrored slice → ready (`true`, no probe seen);
-     * slice present → ready iff `lastProbedAt` has advanced past 0. The
-     * mirror is populated when the worker's first `setCapSlice` RPC arrives
-     * (BaseDevice seeds `feature-probe` `lastProbedAt:0` at construction, but
-     * cross-process delivery is async); until then the no-entry path returns
-     * `true` — a brief transient window, same as `resolveDeviceOnline`.
-     */
-    resolveDeviceProbed(deviceId: number): boolean;
-    /** The EFFECTIVE slices of a device: native for an unclaimed cap, the merge
-     *  for a claimed one (a held cap is not reported). */
-    snapshotForDevice(deviceId: number): Record<string, Record<string, unknown>>;
-    /** One cap's EFFECTIVE slice, cloned. Null when the device has never written
-     *  it — callers read that as "the cap has no state", never as an empty slice —
-     *  and null while a claim holds it. */
-    capSlice(deviceId: number, cap: string): Record<string, unknown> | null;
-    /** The device's NATIVE slices — what the row stores under the cap names. */
-    private nativeSnapshotForDevice;
-    /** Whole-system mirror dump. Backs `deviceState.getAllSnapshots` — one
-     *  round-trip for a warm boot instead of N per-device calls. */
-    allSnapshots(): Record<string, Record<string, Record<string, unknown>>>;
-    /**
-     * The PUBLIC event: exactly `{ deviceId, capName, slice }` for every device,
-     * claimed or not. The native shadow never rides here (D224) — see
-     * `emitNativeShadow`.
-     */
-    private emitStateChanged;
-    /**
-     * The owner-only event (D224, D663): the native slice as the provider wrote
-     * it, for the composer's native self-reads. Its category is refused by the
-     * public event routers (`isOwnerOnlyEventCategory`), so no UI or share-scope
-     * subscriber ever sees a second truth beside the merged slice.
-     */
-    private emitNativeShadow;
+	private readonly ctx;
+	/**
+	* Per-cap durability + volatile-field policy. Defaults to the codegen'd
+	* projection of every `*.cap.ts` (D4: the cap declares, the kernel reads).
+	* Injectable so a spec can exercise the gate without the real cap set.
+	*/
+	private readonly policyFor;
+	/**
+	* Hub-side mirror of every device's cap-keyed NATIVE runtime state — what the
+	* provider wrote. Key: deviceId. Value: per-cap slice map. Empty by default —
+	* slices show up as `setCapSlice` calls trickle in.
+	*/
+	private readonly stateMirror;
+	/** The claims and the merged view of every claimed cap (D663). */
+	private readonly claims;
+	/**
+	* Devices whose CLAIMS are known: the row was read, or a loaded claims index
+	* vouched that it names none (D447). This is a READ-path fact — what a
+	* status read may answer from. It never licenses a row write (D677).
+	*/
+	private readonly seeded;
+	/**
+	* Devices whose row was actually READ into memory in THIS process. Every row
+	* write of a device requires it (D677): the write replaces the whole row, so
+	* memory must hold what the row held — an index that vouches for the claims
+	* says nothing about the native slices beside them.
+	*/
+	private readonly rowRead;
+	/** One row read per device, however many writes arrive during it. */
+	private readonly seeding;
+	/** Devices whose seed refusal is already logged — once per transition. */
+	private readonly seedRefusalLogged;
+	/** Every write of a device's row, and what is believed to be on it. */
+	private readonly writer;
+	constructor(ctx: AddonContext, policyFor?: RuntimeStatePolicyLookup, schemaFor?: RuntimeStateSchemaLookup);
+	/**
+	* Single-cap mirror update — diff against the current mirror,
+	* persist the new slice in-memory, emit `DeviceStateChanged` for
+	* this cap. No-op on identical writes (both same shape and same
+	* values). Called by `setCapSlice` provider.
+	*
+	* This is the NATIVE path, unchanged for every writer. Under a claim the
+	* native slice is stored as the shadow and what is emitted is the merge.
+	*
+	* @returns whether the mirror actually changed. The caller uses this to
+	*   decide whether the (synchronous, disk-blocking) runtime-state write is
+	*   worth scheduling — see `scheduleRuntimeStateDiskWrite`. Returning void
+	*   here and scheduling unconditionally is what made an unchanged poll cost
+	*   a SQLite commit.
+	*/
+	applySingleCapUpdate(deviceId: number, capName: string, slice: Record<string, unknown>): boolean;
+	/**
+	* Claim `cap.fields` of `capName` on `deviceId` for `cap.owner`. Written
+	* through: resolves after the row write. A re-claim by the same owner
+	* replaces `fields`; values of fields no longer claimed are dropped and the
+	* native shows for them (ruling S1b). An empty `fields` is what the composer
+	* never sends — it releases — and is refused.
+	*/
+	claim(deviceId: number, capName: string, cap: OwnedCap, settings: DeviceManagerSettings): Promise<ClaimOutcome>;
+	/** Is this exact claim what the row carries, per `lastPersisted`? */
+	private isClaimPersisted;
+	/**
+	* Write owned values. Partial patches MERGE into `values` (ruling S5); a key
+	* outside `fields` is refused. Debounced like a native slice.
+	*/
+	patchOwned(deviceId: number, capName: string, owner: string, values: Readonly<Record<string, unknown>>, settings: DeviceManagerSettings): Promise<ClaimOutcome>;
+	/**
+	* Remove the claim. A `replace` hands the cap back: the native slice is
+	* emitted exactly as last written. An `add` had no native — the cap leaves
+	* the mirror and nothing is emitted (consumer mirrors keep the last value
+	* until they re-read; recorded for Task 15). Written through.
+	*/
+	release(deviceId: number, capName: string, owner: string, settings: DeviceManagerSettings): Promise<ClaimOutcome>;
+	/** The claims on a device; empty for every device without one. */
+	ownedCaps(deviceId: number): OwnedCaps;
+	/** The NATIVE shadow of one cap — for the owner-side mechanism only (D224). */
+	nativeSlice(deviceId: number, cap: string): Record<string, unknown> | null;
+	/** What the merge says for a claimed cap; null when the cap is not claimed. */
+	effectiveIfClaimed(deviceId: number, cap: string): MergedSlice | null;
+	isSeeded(deviceId: number): boolean;
+	/**
+	* Forget a removed device (D677): its armed row write is cancelled and one
+	* in flight awaited BEFORE its memory goes, so nothing writes its row back
+	* after `removeDevice` clears it.
+	*/
+	forgetDevice(deviceId: number): Promise<void>;
+	/** The device's row was read in this process — the precondition of every row write (D677). */
+	isRowRead(deviceId: number): boolean;
+	/**
+	* The SYNCHRONOUS half of {@link ensureSeeded}, branch (c): a LOADED claims
+	* index that does not name the device vouches for its CLAIMS — seeded, no
+	* read. That is all it vouches for: the device is still not `rowRead`, and
+	* the writer reads the row before its first write (D677).
+	* Refused (false) while a read is in flight, because that read may be
+	* landing a claim the index does not know yet; refused when the index cannot
+	* vouch. The overlay's `peek` calls this instead of `ensureSeeded`: a sync
+	* path must never hold a promise that can reject (D391 — an unhandled
+	* rejection is an untagged line on hub-main).
+	*/
+	seedIfIndexClears(deviceId: number, index: ClaimsIndexView): boolean;
+	/**
+	* Make sure the device's CLAIMS are known before a status read is answered
+	* or a native slice applied (D49). Index first, single-flight (ruling S6):
+	*   (a) already seeded → nothing;
+	*   (b) a seed in flight → await it;
+	*   (c) a LOADED index that does not name the device → seeded, no read;
+	*   (d) otherwise read the row once and seed it.
+	* A read that throws propagates and is logged once per device transition
+	* (D391).
+	*
+	* Also the native-write RPC's gate: a slice may be APPLIED once its claims
+	* are known. Never the ROW write's: branch (c) knows the claims and nothing
+	* about the native slices on the row; a writer that trusted it replaced a
+	* row it never read with the one slice it held, and every restored cap
+	* nobody re-wrote soon after boot was erased (D677, superseding S6(c) for
+	* writes). The writer calls {@link ensureRowRead}.
+	*/
+	ensureSeeded(deviceId: number, settings: DeviceManagerSettings, index: ClaimsIndexView): Promise<void>;
+	/**
+	* A row write replaces the whole row: memory must hold what the row held
+	* (D677). Reads the row once, single-flight, and fills memory's gaps from it
+	* (`seedMirror('fill')`: a slice memory already holds is newer and wins).
+	* A read that throws propagates — nothing is written — and is logged once
+	* per device transition (D49, D391).
+	*/
+	ensureRowRead(deviceId: number, settings: DeviceManagerSettings): Promise<void>;
+	/** An unreadable row is a NAMED refusal (D49): the answer is unknown — a
+	*  throw could be read as "gone", `not-claimed` as "never was". Logged by `readRowOnce`. */
+	private readRowOrRefuse;
+	private readRowOnce;
+	private nativeOf;
+	/**
+	* Write the row now — a claim is atomic with the row — and refresh the
+	* baseline. Queued behind any write in flight for the device (one row write
+	* at a time, N-4), and the blob is taken when the write RUNS, so it carries
+	* whatever memory holds by then. A failed write is rolled back in memory IF
+	* what this op put there is still there (the two never disagree); when a
+	* newer same-owner state landed in the window it stands, and the debounced
+	* writer converges the row to it. Either way the failure is logged hub-side
+	* (D391) and rethrown; a repeat of the same claim is then a real write, never
+	* `changed: false`, and consumers are handed the truth that stands.
+	*/
+	private writeThrough;
+	/** After a rollback, re-emit what is true now: the restored claim's merge, or the native. */
+	private reemitAfterRollback;
+	/** Arm the debounced writer for a change to `changedCap` — see `MirrorRowWriter.schedule`. */
+	scheduleRuntimeStateDiskWrite(deviceId: number, settings: DeviceManagerSettings, changedCap: string): void;
+	/** Hold the writer off these rows for a migration — see `MirrorRowWriter.holdDiskWrites`. */
+	holdDiskWrites(deviceIds: readonly number[], settings: DeviceManagerSettings): Promise<MirrorWriteHold>;
+	/** Flush every pending debounced disk write (graceful shutdown). */
+	flushPendingWrites(settings: DeviceManagerSettings | undefined): Promise<void>;
+	/** The device's row as it may reach disk: NATIVE slices plus `$owned`, restricted by durability. */
+	private persistableForDevice;
+	/**
+	* One-shot mirror seed used by `loadRuntimeState` at boot so the hub knows
+	* every persisted slice before the first `setCapSlice`. No events emitted —
+	* population, not a transition. `fill` (default) fills GAPS and never
+	* overwrites memory (ruling S6: a slice in memory is at least as new as the
+	* row, a claim in memory was written through); `replace` (the migration
+	* reseed) drops the device's memory first — the row now belongs to different
+	* hardware. Malformed `$owned` entries are dropped by name and logged once.
+	* Callers pass the blob through `withResetSessionProbe` first.
+	*/
+	seedMirror(deviceId: number, blob: Record<string, unknown>, mode?: SeedMode): void;
+	/**
+	* The hub mirror's `feature-probe.lastProbedAt` is a PER-SESSION liveness
+	* signal — it means "this worker process completed a probe THIS session".
+	* Persisted runtime state carries the PRE-RESTART timestamp, which is stale
+	* after a hub or worker restart: the device has not re-probed yet. Seeding it
+	* verbatim makes `resolveDeviceProbed` report `probed:true` during the
+	* restart→reprobe window, which defeats the export carry-forward gate
+	* (`resolveExportFingerprint`, gated on `device.probed`) and posts a spurious
+	* partial `AddOrUpdateReport` to Alexa/HAP before the real probe lands.
+	*
+	* Reset `lastProbedAt` to 0 for the MIRROR seed only — `probed:false` carries
+	* the last-advertised fingerprint forward until the worker republishes a
+	* fresh probe (its post-probe `setCapSlice` raises `lastProbedAt` again, which
+	* also fires `DeviceReady`). The worker's returned `initialRuntimeState` blob
+	* is untouched, and every non-probe slice (e.g. `device-status`/online) is
+	* preserved.
+	*/
+	withResetSessionProbe(blob: Record<string, unknown>): Record<string, unknown>;
+	/**
+	* Resolve a device's REAL `online` flag for the persisted/forked-worker
+	* list branch. Forked workers own the live `IDevice` in their own process,
+	* so the hub registry can't read `device.online` directly. The owning
+	* driver instead publishes its liveness through the auto-registered
+	* `device-status` runtime-state slice (`markOnline` → `setCapState`), which
+	* the canonical `deviceState.setCapSlice` write entrypoint mirrors into the
+	* hub-side `stateMirror`. We read that mirrored slice here so the list
+	* payload reflects the device's actual reachability instead of a constant.
+	*
+	* Fallback (`fallbackOnline`) preserves the legacy behaviour when no slice
+	* has been published yet: a persisted device with a live registry is
+	* assumed online (it was successfully registered by its owning process),
+	* and the null-registry "offline view" keeps reporting offline. We never
+	* regress a device to offline merely because its mirror is empty.
+	*/
+	resolveDeviceOnline(deviceId: number, fallbackOnline: boolean): boolean;
+	/**
+	* Derive the `probed` flag for an offline-view (forked-worker, not
+	* live in the hub registry) device projection. Reads the mirrored
+	* `feature-probe` slice the owning worker publishes. Mirrors the
+	* `toDeviceInfo` rule: no mirrored slice → ready (`true`, no probe seen);
+	* slice present → ready iff `lastProbedAt` has advanced past 0. The
+	* mirror is populated when the worker's first `setCapSlice` RPC arrives
+	* (BaseDevice seeds `feature-probe` `lastProbedAt:0` at construction, but
+	* cross-process delivery is async); until then the no-entry path returns
+	* `true` — a brief transient window, same as `resolveDeviceOnline`.
+	*/
+	resolveDeviceProbed(deviceId: number): boolean;
+	/** The EFFECTIVE slices of a device: native for an unclaimed cap, the merge
+	*  for a claimed one (a held cap is not reported). */
+	snapshotForDevice(deviceId: number): Record<string, Record<string, unknown>>;
+	/** One cap's EFFECTIVE slice, cloned. Null when the device has never written
+	*  it — callers read that as "the cap has no state", never as an empty slice —
+	*  and null while a claim holds it. */
+	capSlice(deviceId: number, cap: string): Record<string, unknown> | null;
+	/** The device's NATIVE slices — what the row stores under the cap names. */
+	private nativeSnapshotForDevice;
+	/** Whole-system mirror dump. Backs `deviceState.getAllSnapshots` — one
+	*  round-trip for a warm boot instead of N per-device calls. */
+	allSnapshots(): Record<string, Record<string, Record<string, unknown>>>;
+	/**
+	* The PUBLIC event: exactly `{ deviceId, capName, slice }` for every device,
+	* claimed or not. The native shadow never rides here (D224) — see
+	* `emitNativeShadow`.
+	*/
+	private emitStateChanged;
+	/**
+	* The owner-only event (D224, D663): the native slice as the provider wrote
+	* it, for the composer's native self-reads. Its category is refused by the
+	* public event routers (`isOwnerOnlyEventCategory`), so no UI or share-scope
+	* subscriber ever sees a second truth beside the merged slice.
+	*/
+	private emitNativeShadow;
 }