@camstack/system 1.2.85 → 1.2.87

package/dist/{dist-DWuNENzg.mjs → dist-CuAaqtdt.mjs}

@@ -2353,19 +2353,6 @@ function toNodeId(idOrRunnerId) {
 	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
 }
 /**
-* Generic types for capability definitions.
-*
-* A capability is defined with Zod schemas for methods, events, and settings.
-* TypeScript types are inferred via z.infer<> — zero duplication.
-*
-* Pattern:
-*   1. Define Zod schemas for data, methods, settings
-*   2. Export const capabilityDef = { ... } satisfies CapabilityDefinition
-*   3. Export type IProvider = InferProvider<typeof capabilityDef>
-*   4. Addon implements IProvider
-*   5. Registry auto-mounts tRPC router from definition.methods
-*/
-/**
 * Resolve the EFFECTIVE mount hint for a cap — the explicit `mount` when
 * present, else the scope/mode/deviceNative-derived default. Single source
 * of truth shared by the runtime builder and any codegen that needs the
@@ -7501,7 +7488,14 @@ var cameraStreamsCapability = {
 			low: z.string().optional()
 		}),
 		lastChangedAt: z.number()
-	})
+	}),
+	/**
+	* Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /** `z.void()` — input carries no data. */
 function isVoidInput(schema) {
@@ -8494,6 +8488,13 @@ var deviceDiscoveryCapability = {
 		kind: "poll"
 	},
 	runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: z.number().int().nonnegative() }),
+	/**
+	* Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -11094,7 +11095,23 @@ var NotificationActionSchema = z.object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: z.boolean().optional()
+	destructive: z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: z.enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -11962,7 +11979,17 @@ var alarmPanelCapability = {
 	* full slice; renders an arm button per `availableModes` entry and
 	* a PIN field iff `requiresCode === true`.
 	*/
-	runtimeState: AlarmPanelStatusSchema
+	runtimeState: AlarmPanelStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
@@ -12141,6 +12168,9 @@ var NcSystemEventConditionSchema = z.object({
 	nodeIds: z.array(z.string().min(1)).min(1).optional(),
 	packageNames: z.array(z.string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** One weekly activation window. `startMinute > endMinute` crosses midnight. */
 var NcScheduleWindowSchema = z.object({
 	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
@@ -12530,15 +12560,15 @@ var NcConditionsSchema = z.object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -12774,6 +12804,30 @@ var NcRuleInputSchema = z.object({
 	*/
 	snoozeAllowGlobal: z.boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: z.array(z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -12873,6 +12927,7 @@ var NcConditionDescriptorSchema = z.object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: z.string(),
@@ -12891,6 +12946,7 @@ var NcConditionDescriptorSchema = z.object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -13042,7 +13098,20 @@ var NcSnoozeInputSchema = z.object({
 	ruleId: z.string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: z.number().int().optional(),
-	durationMinutes: z.number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: z.array(z.string().min(1)).min(1).optional(),
+	durationMinutes: z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -13067,6 +13136,10 @@ var NcSnoozeSchema = z.object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: z.string().optional(),
 	deviceId: z.number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: z.array(z.string().min(1)).min(1).optional(),
 	startedAt: z.number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -15829,7 +15902,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: z.object({ zones: z.array(ZoneSchema).readonly() })
+	runtimeState: z.object({ zones: z.array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -19823,7 +19903,17 @@ var airQualitySensorCapability = {
 		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AirQualitySensorStatusSchema
+	runtimeState: AirQualitySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Ambient illuminance reading in lux. Drives Home Assistant `sensor`
@@ -19855,7 +19945,17 @@ var ambientLightSensorCapability = {
 		schema: AmbientLightSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AmbientLightSensorStatusSchema
+	runtimeState: AmbientLightSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Per-class audio metrics aggregated over a sliding window.
@@ -19982,7 +20082,14 @@ var audioMetricsCapability = {
 		}), AudioMetricsHistorySchema)
 	},
 	/** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-	runtimeState: AudioMetricsSnapshotSchema
+	runtimeState: AudioMetricsSnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -20044,7 +20151,14 @@ var automationControlCapability = {
 	* reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
 	* (badge) directly.
 	*/
-	runtimeState: AutomationControlStatusSchema
+	runtimeState: AutomationControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Battery status snapshot. Emitted by providers whose device is
@@ -20150,7 +20264,17 @@ onStatusChanged: { data: z.object({
 	* via `device.runtimeState.getCapState('battery')` regardless of
 	* the underlying driver.
 	*/
-	runtimeState: BatteryStatusSchema
+	runtimeState: BatteryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastUpdated"]
 };
 /**
 * Generic boolean sensor — last-resort fallback when no domain-
@@ -20179,7 +20303,17 @@ var binaryCapability = {
 		schema: BinaryStatusSchema,
 		kind: "push"
 	},
-	runtimeState: BinaryStatusSchema
+	runtimeState: BinaryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Dimmable-light brightness control. Co-exists with `switch` on the
@@ -20232,7 +20366,14 @@ onBrightnessChanged: { data: z.object({
 	* by the kernel. Read via `device.state.brightness.value` so UI
 	* sliders surface the current level without polling the provider.
 	*/
-	runtimeState: BrightnessStatusSchema
+	runtimeState: BrightnessStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * button — device-scoped capability for HA `button.*` / `input_button.*`
@@ -20361,7 +20502,17 @@ var carbonMonoxideCapability = {
 		schema: CarbonMonoxideStatusSchema,
 		kind: "push"
 	},
-	runtimeState: CarbonMonoxideStatusSchema
+	runtimeState: CarbonMonoxideStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * HVAC / climate control cap. Models the full surface of a HA
@@ -20521,7 +20672,14 @@ var climateControlCapability = {
 	* the full slice via `device.state.climate-control.value` and refresh
 	* on every push without re-querying the provider.
 	*/
-	runtimeState: ClimateControlStatusSchema
+	runtimeState: ClimateControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
@@ -20631,7 +20789,14 @@ onColorChanged: { data: z.object({
 	* kernel. Read via `device.state.color.value` so UI pickers surface
 	* the current chromaticity without polling the provider.
 	*/
-	runtimeState: ColorStatusSchema
+	runtimeState: ColorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var ConnectionTestOutcomeSchema = z.discriminatedUnion("outcome", [
 	z.object({
@@ -20697,7 +20862,17 @@ var connectivityCapability = {
 		schema: ConnectivityStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ConnectivityStatusSchema
+	runtimeState: ConnectivityStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Generic device-consumables capability — surfaces a device's
@@ -20779,7 +20954,14 @@ reset: method(z.object({
 			}
 		}
 	},
-	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: z.number() })
+	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: z.number() }),
+	/**
+	* Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Door / window / opening / garage / valve contact sensor. Boolean
@@ -20810,7 +20992,17 @@ var contactCapability = {
 		schema: ContactStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ContactStatusSchema
+	runtimeState: ContactStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a door left open across a restart must still read open.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Unified user-settable input cap. Models HA's `number` /
@@ -20940,7 +21132,14 @@ var controlCapability = {
 	* dropdown / text field / date picker) read the slice's discriminant
 	* and value directly without polling the provider.
 	*/
-	runtimeState: ControlStatusSchema
+	runtimeState: ControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Window covering / blinds / garage door / valve cap. Models HA
@@ -21023,7 +21222,17 @@ var coverCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch
 	* the slice for live position changes during a move.
 	*/
-	runtimeState: CoverStatusSchema
+	runtimeState: CoverStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Vendor-neutral day/night (IR-cut) control — the per-camera config cap
@@ -21117,7 +21326,17 @@ var dayNightCapability = {
 		schema: DayNightStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: DayNightStatusSchema
+	runtimeState: DayNightStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic device-level status snapshot. Auto-registered by `BaseDevice`
@@ -21164,7 +21383,17 @@ onStatusChanged: { data: z.object({
 		schema: DeviceStatusSchema,
 		kind: "push"
 	},
-	runtimeState: DeviceStatusSchema
+	runtimeState: DeviceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Doorbell button cap. Two kinds of providers coexist behind this cap
@@ -21226,7 +21455,14 @@ onPressed: { data: DoorbellPressEventSchema } },
 	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
 	* without subscribing.
 	*/
-	runtimeState: DoorbellStatusSchema
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Enum-state sensor — a string value picked from a finite option set.
@@ -21266,7 +21502,17 @@ var enumSensorCapability = {
 		schema: EnumSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EnumSensorStatusSchema
+	runtimeState: EnumSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic stateless event emitter. Installed on a `DeviceType.EventEmitter`
@@ -21302,7 +21548,14 @@ var eventEmitterCapability = {
 		schema: EventEmitterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EventEmitterStatusSchema
+	runtimeState: EventEmitterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var EventItemSchema = z.object({
 	id: z.string(),
@@ -21619,7 +21872,14 @@ var fanControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI fan speed
 	* sliders read `percentage` for live updates.
 	*/
-	runtimeState: FanControlStatusSchema
+	runtimeState: FanControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
@@ -21695,7 +21955,14 @@ onProbeChanged: { data: z.object({
 		schema: FeatureProbeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FeatureProbeStatusSchema
+	runtimeState: FeatureProbeStatusSchema,
+	/**
+	* Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Water leak / moisture sensor. Boolean "is liquid currently
@@ -21722,7 +21989,17 @@ var floodCapability = {
 		schema: FloodStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FloodStatusSchema
+	runtimeState: FloodStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Combustible-gas (LPG / methane / hydrogen) alarm sensor. Drives
@@ -21745,7 +22022,17 @@ var gasCapability = {
 		schema: GasStatusSchema,
 		kind: "push"
 	},
-	runtimeState: GasStatusSchema
+	runtimeState: GasStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Humidifier / dehumidifier cap. Models HA `humidifier.*` entities —
@@ -21821,7 +22108,14 @@ var humidifierCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live humidity / mode changes.
 	*/
-	runtimeState: HumidifierStatusSchema
+	runtimeState: HumidifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Single-metric humidity reading. Drives Home Assistant `sensor`
@@ -21857,7 +22151,17 @@ var humiditySensorCapability = {
 		schema: HumiditySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: HumiditySensorStatusSchema
+	runtimeState: HumiditySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Image display cap. Models a single still image exposed by an integration —
@@ -21895,7 +22199,14 @@ var imageCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads `url`
 	* directly and renders the still image.
 	*/
-	runtimeState: ImageStatusSchema
+	runtimeState: ImageStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Vendor-neutral image / picture-adjustment cap — the per-camera config
@@ -22044,7 +22355,17 @@ var imageSettingsCapability = {
 		schema: ImageSettingsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: ImageSettingsStatusSchema
+	runtimeState: ImageSettingsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * integrations — system-scoped singleton capability for integration
@@ -22453,7 +22774,14 @@ var lawnMowerControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live activity + battery changes.
 	*/
-	runtimeState: LawnMowerControlStatusSchema
+	runtimeState: LawnMowerControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `vacuum-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * local-network — hub-only singleton.
@@ -22756,7 +23084,17 @@ var lockControlCapability = {
 	* read `state` and disable themselves during `locking`/`unlocking`
 	* transitions.
 	*/
-	runtimeState: LockControlStatusSchema
+	runtimeState: LockControlStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a lock left locked must still read locked.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
@@ -22918,7 +23256,14 @@ var mediaPlayerCapability = {
 	* full slice for live now-playing, volume, and progress updates
 	* without polling.
 	*/
-	runtimeState: MediaPlayerStatusSchema
+	runtimeState: MediaPlayerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * mesh-network — collection cap for mesh-VPN providers.
@@ -23243,7 +23588,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* `device.state.motion.value`. Reads never invoke the provider, so
 	* UIs and other addons can poll the cached state safely.
 	*/
-	runtimeState: MotionStatusSchema
+	runtimeState: MotionStatusSchema,
+	/**
+	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Motion-trigger toggle for accessory devices.
@@ -23308,7 +23660,14 @@ var motionTriggerCapability = {
 		schema: MotionTriggerStatusSchema,
 		kind: "command-driven"
 	},
-	runtimeState: MotionTriggerRuntimeStateSchema
+	runtimeState: MotionTriggerRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
@@ -23375,7 +23734,17 @@ var motionZonesCapability = {
 		schema: MotionZoneStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: MotionZoneStatusSchema
+	runtimeState: MotionZoneStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * On-camera AI object detection cap. Surfaces per-device the classes
@@ -23449,7 +23818,17 @@ var nativeObjectDetectionCapability = {
 		schema: NativeObjectDetectionStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NativeObjectDetectionRuntimeStateSchema
+	runtimeState: NativeObjectDetectionRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * network-quality — system-scoped singleton capability tracking RTT,
@@ -23836,7 +24215,14 @@ onSent: { data: z.object({
 	* form reads `supports` to gate optional fields; history pane reads
 	* `lastSentAt` / `lastError` / `queueDepth`.
 	*/
-	runtimeState: NotifierStatusSchema
+	runtimeState: NotifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Generic numeric sensor — last-resort fallback when no typed numeric
@@ -23879,7 +24265,17 @@ var numericSensorCapability = {
 		schema: NumericSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NumericSensorStatusSchema
+	runtimeState: NumericSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
@@ -24358,7 +24754,14 @@ var petFeederCapability = {
 	* the full slice via `device.state.petFeeder.value` and refresh on
 	* every poll without re-querying the provider.
 	*/
-	runtimeState: PetFeederStatusSchema
+	runtimeState: PetFeederStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var VehicleSchema = z.object({
 	id: z.string(),
@@ -24715,7 +25118,17 @@ var powerMeterCapability = {
 		schema: PowerMeterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PowerMeterStatusSchema
+	runtimeState: PowerMeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
@@ -24772,7 +25185,17 @@ var presenceCapability = {
 	* the map pin is rendered (use `DeviceFeature.PresenceGps` for the
 	* pre-fetch fast-path check).
 	*/
-	runtimeState: PresenceStatusSchema
+	runtimeState: PresenceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Atmospheric pressure reading in hectopascals. Drives Home Assistant
@@ -24808,7 +25231,17 @@ var pressureSensorCapability = {
 		schema: PressureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PressureSensorStatusSchema
+	runtimeState: PressureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * PRIVACY — what the camera deliberately does not capture. Two planes:
@@ -24938,7 +25371,17 @@ var privacyMaskCapability = {
 		schema: PrivacyMaskStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: PrivacyMaskStatusSchema
+	runtimeState: PrivacyMaskStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 var PtzPresetSchema = z.object({
 	id: z.string(),
@@ -25181,7 +25624,14 @@ var ptzAutotrackCapability = {
 	* fetch / cache / fallback logic out of the four cap methods —
 	* they become trampolines over `runtimeState`.
 	*/
-	runtimeState: PtzAutotrackRuntimeStateSchema
+	runtimeState: PtzAutotrackRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * reboot — device-scoped capability for "soft" device reboots (firmware
@@ -25651,13 +26101,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = z.number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = z.object({
 	fromSec: z.number().nonnegative(),
@@ -25978,7 +26439,14 @@ var sceneMonitorCapability = {
 		schema: SceneMonitorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SceneMonitorStatusSchema
+	runtimeState: SceneMonitorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-stage gating mode applied to the zones a rule references.
@@ -26122,7 +26590,14 @@ var scriptRunnerCapability = {
 	* `isRunning` to render a spinner during execution and surfaces
 	* `lastError` / `lastRunSuccess` in the recent-runs panel.
 	*/
-	runtimeState: ScriptRunnerStatusSchema
+	runtimeState: ScriptRunnerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Smoke alarm sensor — boolean "is smoke currently detected" with
@@ -26149,7 +26624,17 @@ var smokeCapability = {
 		schema: SmokeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SmokeStatusSchema
+	runtimeState: SmokeStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * One publishable camera stream as its OWNING PROVIDER describes it — the same
@@ -26335,7 +26820,17 @@ var streamParamsCapability = {
 		schema: StreamParamsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: StreamParamsStatusSchema
+	runtimeState: StreamParamsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * The three well-known stream profiles in render order. Exported so the
@@ -26638,6 +27133,16 @@ var switchCapability = {
 	* not need to re-query the provider after a setState mutation.
 	*/
 	runtimeState: SwitchStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"],
 	settings: { bindings: [{
 		kind: "scalar",
 		statusPath: "on",
@@ -26732,7 +27237,17 @@ var tamperCapability = {
 		schema: TamperStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TamperStatusSchema
+	runtimeState: TamperStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Single-metric temperature reading. Drives Home Assistant `sensor`
@@ -26777,7 +27292,17 @@ var temperatureSensorCapability = {
 		schema: TemperatureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TemperatureSensorStatusSchema
+	runtimeState: TemperatureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * toast — system-scoped singleton capability that streams toast
@@ -26853,7 +27378,14 @@ var updateCapability = {
 		schema: UpdateStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: UpdateStatusSchema
+	runtimeState: UpdateStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 var UserSummarySchema = z.object({
 	id: z.string(),
@@ -27229,7 +27761,14 @@ var vacuumControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live state + battery + fan-speed changes.
 	*/
-	runtimeState: VacuumControlStatusSchema
+	runtimeState: VacuumControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Pipe / water / gas valve cap. Models HA `valve.*` entities — anything
@@ -27299,7 +27838,14 @@ var valveCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live position changes during a move.
 	*/
-	runtimeState: ValveStatusSchema
+	runtimeState: ValveStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Vibration / shake / impact sensor. Drives Home Assistant
@@ -27321,7 +27867,17 @@ var vibrationCapability = {
 		schema: VibrationStatusSchema,
 		kind: "push"
 	},
-	runtimeState: VibrationStatusSchema
+	runtimeState: VibrationStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 /**
 * Water heater / boiler cap. Models HA `water_heater.*` entities — a
@@ -27395,7 +27951,14 @@ var waterHeaterCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live temperature / mode / away changes.
 	*/
-	runtimeState: WaterHeaterStatusSchema
+	runtimeState: WaterHeaterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Weather provider cap. Models HA `weather.*` entities — a read-only
@@ -27454,7 +28017,14 @@ var weatherCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads the
 	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: WeatherStatusSchema
+	runtimeState: WeatherStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Per-zone occupancy aggregation produced by the analytics frame
@@ -27616,7 +28186,14 @@ var zoneAnalyticsCapability = {
 	* automatically; the explicit `getCurrentSnapshot` cap method is
 	* still useful for one-off polls without a subscription.
 	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 /**
 * Stages a {@link ZoneRule} can apply to. Discriminator on the rules
@@ -27694,7 +28271,14 @@ var zoneRulesCapability = {
 		motion: z.array(ZoneRuleSchema).readonly(),
 		detection: z.array(ZoneRuleSchema).readonly(),
 		package: z.array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Runtime defaults -- used by ConfigManager.get() for backward compatibility
@@ -33911,6 +34495,279 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+/**
+* Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
+* `runtimeState`. 62 caps: 33 `restored`, 29 `session`.
+*
+* A cap absent from this map has no runtime-state slice at all. A cap PRESENT
+* with `durability: 'session'` has one and has decided not to keep it.
+*/
+var RUNTIME_STATE_POLICY = {
+	"air-quality-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"alarm-panel": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"ambient-light-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"audio-metrics": {
+		durability: "session",
+		volatileFields: []
+	},
+	"automation-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"battery": {
+		durability: "restored",
+		volatileFields: ["lastUpdated"]
+	},
+	"binary": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"brightness": {
+		durability: "session",
+		volatileFields: []
+	},
+	"camera-streams": {
+		durability: "session",
+		volatileFields: []
+	},
+	"carbon-monoxide": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"climate-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"color": {
+		durability: "session",
+		volatileFields: []
+	},
+	"connectivity": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"consumables": {
+		durability: "session",
+		volatileFields: []
+	},
+	"contact": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"cover": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"day-night": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"device-discovery": {
+		durability: "session",
+		volatileFields: []
+	},
+	"device-status": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"doorbell": {
+		durability: "restored",
+		volatileFields: []
+	},
+	"enum-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"event-emitter": {
+		durability: "session",
+		volatileFields: []
+	},
+	"fan-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"feature-probe": {
+		durability: "session",
+		volatileFields: []
+	},
+	"flood": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"gas": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"humidifier": {
+		durability: "session",
+		volatileFields: []
+	},
+	"humidity-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"image": {
+		durability: "session",
+		volatileFields: []
+	},
+	"image-settings": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"lawn-mower-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"lock-control": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"media-player": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion-trigger": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion-zones": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"native-object-detection": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"notifier": {
+		durability: "session",
+		volatileFields: []
+	},
+	"numeric-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"pet-feeder": {
+		durability: "session",
+		volatileFields: []
+	},
+	"power-meter": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"presence": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"pressure-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"privacy-mask": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"ptz-autotrack": {
+		durability: "session",
+		volatileFields: []
+	},
+	"scene-monitor": {
+		durability: "session",
+		volatileFields: []
+	},
+	"script-runner": {
+		durability: "session",
+		volatileFields: []
+	},
+	"smoke": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"stream-params": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"switch": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"tamper": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"temperature-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"update": {
+		durability: "session",
+		volatileFields: []
+	},
+	"vacuum-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"valve": {
+		durability: "session",
+		volatileFields: []
+	},
+	"vibration": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"water-heater": {
+		durability: "session",
+		volatileFields: []
+	},
+	"weather": {
+		durability: "session",
+		volatileFields: []
+	},
+	"zone-analytics": {
+		durability: "session",
+		volatileFields: []
+	},
+	"zone-rules": {
+		durability: "restored",
+		volatileFields: []
+	},
+	"zones": {
+		durability: "restored",
+		volatileFields: []
+	}
+};
+/**
+* The policy for `capName`. An UNKNOWN cap resolves to `'session'` — an
+* addon-private slice the codegen has never seen is not persisted until its
+* capability says so, which is the safe direction: the cost of a lost session
+* value is a cold window, the cost of an unasked-for persist is a commit per
+* second on the fleet's busiest write path.
+*/
+function runtimeStatePolicyFor(capName) {
+	return RUNTIME_STATE_POLICY[capName] ?? SESSION_ONLY_POLICY;
+}
+/** Shared fallback instance — see {@link runtimeStatePolicyFor}. */
+var SESSION_ONLY_POLICY = {
+	durability: "session",
+	volatileFields: []
+};
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -34188,25 +35045,32 @@ z.object({
 var NativeLeaseAdmissionSchema = z.enum(["all", "inferred"]);
 z.object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: z.number().int().min(250).max(1e4),
+	holdFrames: z.number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -34232,22 +35096,45 @@ z.object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: z.number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * The addon id as the REGISTRY, the wire and the durable stores spell it.
@@ -34417,4 +35304,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { objectInputDeclaresAddonId as $, decodeVectorBase64 as A, emitDownForOwnedCaps as At, isArrayOutputSchema as B, scopeKey as Bt, backupCapability as C, ReadinessRegistry as Ct, coreBlockIdFromAddonId as D, asNumber as Dt, coreBlockAddonId as E, asJsonObject as Et, enumerateInferenceDevices as F, nodePin as Ft, kebabToCamel as G, isObjectInput as H, EventCategory as Ht, enumerateItemArrayFields as I, parseJsonObject as It, logDestinationCapability as J, lifecycleJobSchema as K, enumerateSchemaFields as L, parseJsonUnknown as Lt, deviceStateCapability as M, expandCapMethods as Mt, deviceStatusCapability as N, hydrateSchema as Nt, coreBlocksCapability as O, asString as Ot, doorbellCapability as P, isDeviceConfigCap as Pt, normalizeUnit as Q, extractNestedAddonId as R, readinessKey as Rt, authProviderCapability as S, DeviceType as St, buildStreamParamsConfigSchema as T, WELL_KNOWN_TAB_MAP as Tt, isSameAddonId as U, isCollectionArrayMethod as V, sleep as Vt, isVoidInput as W, looseSchema as X, logLevelAtMost as Y, metricsProviderCapability as Z, UserRecordSchema as _, DATAPLANE_SECRET_HEADER as _t, CAP_NAMES_WITH_STATUS as a, scoreRuntimes as at, addonWidgetsCapability as b, DeviceFeature as bt, CoreBlockSchema as c, storageCapability as ct, METHOD_ACCESS_MAP as d, streamQualityLabel as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, userManagementCapability as ft, StorageMigrationJobSchema as g, BaseAddon as gt, StorageLocationTypeSchema as h, errMsg as ht, BatteryStatusSchema as i, scopesAllowDeviceCap as it, deviceManagerCapability as j, emitReadiness as jt, dataStoreProviderCapability as k, createEvent as kt, DeclaredDevices as l, storageMigrationCapability as lt, ScopedTokenSchema as m, vectorStoreCapability as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, settingsStoreCapability as ot, STREAM_PROFILE_META as p, vectorDimFromBase64 as pt, localNetworkCapability as q, ApiKeyRecordSchema as r, scopesAllowAddon as rt, CORE_BLOCK_ADDON_PREFIX as s, snapshotCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, storageProviderCapability as ut, addonPagesCapability as v, DEVICE_SETTINGS_CONTRIBUTION_METHODS as vt, bareAddonId as w, ReadinessTimeoutError as wt, alertsCapability as x, DeviceRole as xt, addonSettingsCapability as y, DEVICE_STATUS_METHOD as yt, filesystemBrowseCapability as z, resolveCapMount as zt };
+export { objectInputDeclaresAddonId as $, decodeVectorBase64 as A, createEvent as At, isArrayOutputSchema as B, resolveCapMount as Bt, backupCapability as C, DeviceType as Ct, coreBlockIdFromAddonId as D, asJsonObject as Dt, coreBlockAddonId as E, WELL_KNOWN_TAB_MAP as Et, enumerateInferenceDevices as F, isDeviceConfigCap as Ft, kebabToCamel as G, isObjectInput as H, sleep as Ht, enumerateItemArrayFields as I, nodePin as It, logDestinationCapability as J, lifecycleJobSchema as K, enumerateSchemaFields as L, parseJsonObject as Lt, deviceStateCapability as M, emitReadiness as Mt, deviceStatusCapability as N, expandCapMethods as Nt, coreBlocksCapability as O, asNumber as Ot, doorbellCapability as P, hydrateSchema as Pt, normalizeUnit as Q, extractNestedAddonId as R, parseJsonUnknown as Rt, authProviderCapability as S, DeviceRole as St, buildStreamParamsConfigSchema as T, ReadinessTimeoutError as Tt, isSameAddonId as U, EventCategory as Ut, isCollectionArrayMethod as V, scopeKey as Vt, isVoidInput as W, looseSchema as X, logLevelAtMost as Y, metricsProviderCapability as Z, UserRecordSchema as _, BaseAddon as _t, CAP_NAMES_WITH_STATUS as a, scopesAllowDeviceCap as at, addonWidgetsCapability as b, DEVICE_STATUS_METHOD as bt, CoreBlockSchema as c, snapshotCapability as ct, METHOD_ACCESS_MAP as d, storageProviderCapability as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, streamQualityLabel as ft, StorageMigrationJobSchema as g, errMsg as gt, StorageLocationTypeSchema as h, vectorStoreCapability as ht, BatteryStatusSchema as i, scopesAllowAddon as it, deviceManagerCapability as j, emitDownForOwnedCaps as jt, dataStoreProviderCapability as k, asString as kt, DeclaredDevices as l, storageCapability as lt, ScopedTokenSchema as m, vectorDimFromBase64 as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, scoreRuntimes as ot, STREAM_PROFILE_META as p, userManagementCapability as pt, localNetworkCapability as q, ApiKeyRecordSchema as r, runtimeStatePolicyFor as rt, CORE_BLOCK_ADDON_PREFIX as s, settingsStoreCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, storageMigrationCapability as ut, addonPagesCapability as v, DATAPLANE_SECRET_HEADER as vt, bareAddonId as w, ReadinessRegistry as wt, alertsCapability as x, DeviceFeature as xt, addonSettingsCapability as y, DEVICE_SETTINGS_CONTRIBUTION_METHODS as yt, filesystemBrowseCapability as z, readinessKey as zt };