@camstack/types 1.2.64 → 1.2.66

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-DxZbWydC.js");
-const require_sleep = require("./sleep-BszXLEvP.js");
+const require_sleep = require("./sleep-Dh1EJSqF.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -6664,7 +6664,14 @@ var cameraStreamsCapability = {
 			low: zod.z.string().optional()
 		}),
 		lastChangedAt: zod.z.number()
-	})
+	}),
+	/**
+	* Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/cap-router-predicates.ts
@@ -7831,6 +7838,13 @@ var deviceDiscoveryCapability = {
 		kind: "poll"
 	},
 	runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: zod.z.number().int().nonnegative() }),
+	/**
+	* Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -10483,7 +10497,23 @@ var NotificationActionSchema = zod.z.object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: zod.z.boolean().optional()
+	destructive: zod.z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: zod.z.enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -11726,7 +11756,17 @@ var alarmPanelCapability = {
 	* full slice; renders an arm button per `availableModes` entry and
 	* a PIN field iff `requiresCode === true`.
 	*/
-	runtimeState: AlarmPanelStatusSchema
+	runtimeState: AlarmPanelStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/mask-shape.ts
@@ -11934,6 +11974,26 @@ var NcSystemEventConditionSchema = zod.z.object({
 * unique key `(ruleId, trackId, targetId)`. Not a rule field in P1.
 */
 var NC_MAX_PER_TRACK_IMMEDIATE = 1;
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
+/**
+* The durations a notification offers when its rule does not say otherwise.
+*
+* MINUTES, and short ones: a snooze button is answered on a lock screen, and
+* the three choices that fit there are "the next few minutes", "the next half
+* hour" and "the next hour". Anything longer is a decision somebody sits down
+* to make, which is what the app's own snooze surface is for.
+*
+* Resolved in CODE (`snoozeChoices`), never as a Zod default — see
+* {@link NcRuleInputSchema.shape.snoozeOptions} for why the distinction is
+* load-bearing.
+*/
+var NC_DEFAULT_SNOOZE_MINUTES = [
+	10,
+	30,
+	60
+];
 /** One weekly activation window. `startMinute > endMinute` crosses midnight. */
 var NcScheduleWindowSchema = zod.z.object({
 	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
@@ -12335,15 +12395,15 @@ var NcConditionsSchema = zod.z.object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -12580,6 +12640,30 @@ var NcRuleInputSchema = zod.z.object({
 	*/
 	snoozeAllowGlobal: zod.z.boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: zod.z.array(zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -12679,6 +12763,7 @@ var NcConditionDescriptorSchema = zod.z.object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: zod.z.string(),
@@ -12697,6 +12782,7 @@ var NcConditionDescriptorSchema = zod.z.object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -13094,6 +13180,16 @@ var NC_CONDITION_CATALOG = [
 		phase: "P1",
 		description: "ZoneAnalytics occupancy edge (optionally zone/class-scoped): count crosses the threshold and holds for sustainSeconds. Fail-closed on a missing snapshot."
 	},
+	{
+		id: "audio",
+		group: "audio",
+		label: "Sound",
+		valueType: "audio",
+		operator: "anyOf",
+		appliesTo: ["immediate"],
+		phase: "P2",
+		description: "Fires when at least hitPercent% of the samples in a samplingSeconds window are hits — a hit clears the dBFS floor AND carries one of the chosen sounds. Both filters are optional and independent, but naming NEITHER never matches: every sample would be a hit, so the engine refuses rather than notifying on silence. dBFS is negative-going (0 = full scale, -96 = silence)."
+	},
 	{
 		id: "customZones",
 		group: "zones",
@@ -13229,9 +13325,6 @@ var NcSnoozeScopeSchema = zod.z.enum([
 	"device",
 	"all"
 ]);
-/** Hard ceiling on a window (24h). A snooze that could not expire would be an
-*  outage the operator asked for once and forgot. */
-var NC_SNOOZE_MAX_MINUTES = 1440;
 /**
 * Client-authored snooze. The server stamps `userId`, `startedAt` and
 * `expiresAt` — a DURATION is sent rather than an instant so a client with a
@@ -13244,6 +13337,19 @@ var NcSnoozeInputSchema = zod.z.object({
 	ruleId: zod.z.string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: zod.z.number().int().optional(),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
 	durationMinutes: zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
@@ -13269,6 +13375,10 @@ var NcSnoozeSchema = zod.z.object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: zod.z.string().optional(),
 	deviceId: zod.z.number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
 	startedAt: zod.z.number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -16061,7 +16171,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() })
+	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 //#endregion
 //#region src/capabilities/pipeline-runner.cap.ts
@@ -20268,7 +20385,17 @@ var airQualitySensorCapability = {
 		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AirQualitySensorStatusSchema
+	runtimeState: AirQualitySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/ambient-light-sensor.cap.ts
@@ -20302,7 +20429,17 @@ var ambientLightSensorCapability = {
 		schema: AmbientLightSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AmbientLightSensorStatusSchema
+	runtimeState: AmbientLightSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/audio-metrics.cap.ts
@@ -20431,7 +20568,14 @@ var audioMetricsCapability = {
 		}), AudioMetricsHistorySchema)
 	},
 	/** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-	runtimeState: AudioMetricsSnapshotSchema
+	runtimeState: AudioMetricsSnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/automation-control.cap.ts
@@ -20495,7 +20639,14 @@ var automationControlCapability = {
 	* reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
 	* (badge) directly.
 	*/
-	runtimeState: AutomationControlStatusSchema
+	runtimeState: AutomationControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/battery.cap.ts
@@ -20603,7 +20754,17 @@ onStatusChanged: { data: zod.z.object({
 	* via `device.runtimeState.getCapState('battery')` regardless of
 	* the underlying driver.
 	*/
-	runtimeState: BatteryStatusSchema
+	runtimeState: BatteryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastUpdated"]
 };
 //#endregion
 //#region src/capabilities/binary.cap.ts
@@ -20634,7 +20795,17 @@ var binaryCapability = {
 		schema: BinaryStatusSchema,
 		kind: "push"
 	},
-	runtimeState: BinaryStatusSchema
+	runtimeState: BinaryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/brightness.cap.ts
@@ -20689,7 +20860,14 @@ onBrightnessChanged: { data: zod.z.object({
 	* by the kernel. Read via `device.state.brightness.value` so UI
 	* sliders surface the current level without polling the provider.
 	*/
-	runtimeState: BrightnessStatusSchema
+	runtimeState: BrightnessStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/button.cap.ts
@@ -20824,7 +21002,17 @@ var carbonMonoxideCapability = {
 		schema: CarbonMonoxideStatusSchema,
 		kind: "push"
 	},
-	runtimeState: CarbonMonoxideStatusSchema
+	runtimeState: CarbonMonoxideStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/climate-control.cap.ts
@@ -20986,7 +21174,14 @@ var climateControlCapability = {
 	* the full slice via `device.state.climate-control.value` and refresh
 	* on every push without re-querying the provider.
 	*/
-	runtimeState: ClimateControlStatusSchema
+	runtimeState: ClimateControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/color.cap.ts
@@ -21098,7 +21293,14 @@ onColorChanged: { data: zod.z.object({
 	* kernel. Read via `device.state.color.value` so UI pickers surface
 	* the current chromaticity without polling the provider.
 	*/
-	runtimeState: ColorStatusSchema
+	runtimeState: ColorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/connection-test.cap.ts
@@ -21222,7 +21424,17 @@ var connectivityCapability = {
 		schema: ConnectivityStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ConnectivityStatusSchema
+	runtimeState: ConnectivityStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/consumables.cap.ts
@@ -21306,7 +21518,14 @@ reset: require_sleep.method(zod.z.object({
 			}
 		}
 	},
-	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() })
+	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() }),
+	/**
+	* Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/contact.cap.ts
@@ -21339,7 +21558,17 @@ var contactCapability = {
 		schema: ContactStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ContactStatusSchema
+	runtimeState: ContactStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a door left open across a restart must still read open.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/control.cap.ts
@@ -21471,7 +21700,14 @@ var controlCapability = {
 	* dropdown / text field / date picker) read the slice's discriminant
 	* and value directly without polling the provider.
 	*/
-	runtimeState: ControlStatusSchema
+	runtimeState: ControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/cover.cap.ts
@@ -21556,7 +21792,17 @@ var coverCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch
 	* the slice for live position changes during a move.
 	*/
-	runtimeState: CoverStatusSchema
+	runtimeState: CoverStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/day-night.cap.ts
@@ -21652,7 +21898,17 @@ var dayNightCapability = {
 		schema: DayNightStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: DayNightStatusSchema
+	runtimeState: DayNightStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/device-status.cap.ts
@@ -21701,7 +21957,17 @@ onStatusChanged: { data: zod.z.object({
 		schema: DeviceStatusSchema,
 		kind: "push"
 	},
-	runtimeState: DeviceStatusSchema
+	runtimeState: DeviceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/doorbell.cap.ts
@@ -21765,7 +22031,14 @@ onPressed: { data: DoorbellPressEventSchema } },
 	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
 	* without subscribing.
 	*/
-	runtimeState: DoorbellStatusSchema
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 //#endregion
 //#region src/capabilities/enum-sensor.cap.ts
@@ -21807,7 +22080,17 @@ var enumSensorCapability = {
 		schema: EnumSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EnumSensorStatusSchema
+	runtimeState: EnumSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/event-emitter.cap.ts
@@ -21845,7 +22128,14 @@ var eventEmitterCapability = {
 		schema: EventEmitterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EventEmitterStatusSchema
+	runtimeState: EventEmitterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/events.cap.ts
@@ -22168,7 +22458,14 @@ var fanControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI fan speed
 	* sliders read `percentage` for live updates.
 	*/
-	runtimeState: FanControlStatusSchema
+	runtimeState: FanControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/feature-probe.cap.ts
@@ -22246,7 +22543,14 @@ onProbeChanged: { data: zod.z.object({
 		schema: FeatureProbeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FeatureProbeStatusSchema
+	runtimeState: FeatureProbeStatusSchema,
+	/**
+	* Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/flood.cap.ts
@@ -22275,7 +22579,17 @@ var floodCapability = {
 		schema: FloodStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FloodStatusSchema
+	runtimeState: FloodStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/gas.cap.ts
@@ -22300,7 +22614,17 @@ var gasCapability = {
 		schema: GasStatusSchema,
 		kind: "push"
 	},
-	runtimeState: GasStatusSchema
+	runtimeState: GasStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/humidifier.cap.ts
@@ -22378,7 +22702,14 @@ var humidifierCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live humidity / mode changes.
 	*/
-	runtimeState: HumidifierStatusSchema
+	runtimeState: HumidifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/humidity-sensor.cap.ts
@@ -22416,7 +22747,17 @@ var humiditySensorCapability = {
 		schema: HumiditySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: HumiditySensorStatusSchema
+	runtimeState: HumiditySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/image.cap.ts
@@ -22456,7 +22797,14 @@ var imageCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads `url`
 	* directly and renders the still image.
 	*/
-	runtimeState: ImageStatusSchema
+	runtimeState: ImageStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/image-settings.cap.ts
@@ -22607,7 +22955,17 @@ var imageSettingsCapability = {
 		schema: ImageSettingsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: ImageSettingsStatusSchema
+	runtimeState: ImageSettingsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/integrations.cap.ts
@@ -23022,7 +23380,14 @@ var lawnMowerControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live activity + battery changes.
 	*/
-	runtimeState: LawnMowerControlStatusSchema
+	runtimeState: LawnMowerControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `vacuum-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/local-network.cap.ts
@@ -23329,7 +23694,17 @@ var lockControlCapability = {
 	* read `state` and disable themselves during `locking`/`unlocking`
 	* transitions.
 	*/
-	runtimeState: LockControlStatusSchema
+	runtimeState: LockControlStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a lock left locked must still read locked.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/media-player.cap.ts
@@ -23493,7 +23868,14 @@ var mediaPlayerCapability = {
 	* full slice for live now-playing, volume, and progress updates
 	* without polling.
 	*/
-	runtimeState: MediaPlayerStatusSchema
+	runtimeState: MediaPlayerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/mesh-network.cap.ts
@@ -23822,7 +24204,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* `device.state.motion.value`. Reads never invoke the provider, so
 	* UIs and other addons can poll the cached state safely.
 	*/
-	runtimeState: MotionStatusSchema
+	runtimeState: MotionStatusSchema,
+	/**
+	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/motion-trigger.cap.ts
@@ -23889,7 +24278,14 @@ var motionTriggerCapability = {
 		schema: MotionTriggerStatusSchema,
 		kind: "command-driven"
 	},
-	runtimeState: MotionTriggerRuntimeStateSchema
+	runtimeState: MotionTriggerRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/motion-zones.cap.ts
@@ -23958,7 +24354,17 @@ var motionZonesCapability = {
 		schema: MotionZoneStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: MotionZoneStatusSchema
+	runtimeState: MotionZoneStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/native-object-detection.cap.ts
@@ -24034,7 +24440,17 @@ var nativeObjectDetectionCapability = {
 		schema: NativeObjectDetectionStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NativeObjectDetectionRuntimeStateSchema
+	runtimeState: NativeObjectDetectionRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/network-quality.cap.ts
@@ -24427,7 +24843,14 @@ onSent: { data: zod.z.object({
 	* form reads `supports` to gate optional fields; history pane reads
 	* `lastSentAt` / `lastError` / `queueDepth`.
 	*/
-	runtimeState: NotifierStatusSchema
+	runtimeState: NotifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/numeric-sensor.cap.ts
@@ -24472,7 +24895,17 @@ var numericSensorCapability = {
 		schema: NumericSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NumericSensorStatusSchema
+	runtimeState: NumericSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/osd.cap.ts
@@ -24989,7 +25422,14 @@ var petFeederCapability = {
 	* the full slice via `device.state.petFeeder.value` and refresh on
 	* every poll without re-querying the provider.
 	*/
-	runtimeState: PetFeederStatusSchema
+	runtimeState: PetFeederStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/plate-gallery.cap.ts
@@ -25352,7 +25792,17 @@ var powerMeterCapability = {
 		schema: PowerMeterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PowerMeterStatusSchema
+	runtimeState: PowerMeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/presence.cap.ts
@@ -25411,7 +25861,17 @@ var presenceCapability = {
 	* the map pin is rendered (use `DeviceFeature.PresenceGps` for the
 	* pre-fetch fast-path check).
 	*/
-	runtimeState: PresenceStatusSchema
+	runtimeState: PresenceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/pressure-sensor.cap.ts
@@ -25449,7 +25909,17 @@ var pressureSensorCapability = {
 		schema: PressureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PressureSensorStatusSchema
+	runtimeState: PressureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/privacy-mask.cap.ts
@@ -25581,7 +26051,17 @@ var privacyMaskCapability = {
 		schema: PrivacyMaskStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: PrivacyMaskStatusSchema
+	runtimeState: PrivacyMaskStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Collapse a camera's PER-PROFILE audio flags into the one answer
@@ -25848,7 +26328,14 @@ var ptzAutotrackCapability = {
 	* fetch / cache / fallback logic out of the four cap methods —
 	* they become trampolines over `runtimeState`.
 	*/
-	runtimeState: PtzAutotrackRuntimeStateSchema
+	runtimeState: PtzAutotrackRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/reboot.cap.ts
@@ -26324,13 +26811,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = zod.z.number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = zod.z.object({
 	fromSec: zod.z.number().nonnegative(),
@@ -26682,7 +27180,14 @@ var sceneMonitorCapability = {
 		schema: SceneMonitorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SceneMonitorStatusSchema
+	runtimeState: SceneMonitorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/schemas/zone-rule.ts
@@ -26834,7 +27339,14 @@ var scriptRunnerCapability = {
 	* `isRunning` to render a spinner during execution and surfaces
 	* `lastError` / `lastRunSuccess` in the recent-runs panel.
 	*/
-	runtimeState: ScriptRunnerStatusSchema
+	runtimeState: ScriptRunnerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/smoke.cap.ts
@@ -26863,7 +27375,17 @@ var smokeCapability = {
 		schema: SmokeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SmokeStatusSchema
+	runtimeState: SmokeStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/stream-catalog.cap.ts
@@ -27053,7 +27575,17 @@ var streamParamsCapability = {
 		schema: StreamParamsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: StreamParamsStatusSchema
+	runtimeState: StreamParamsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/stream-params-config-schema.ts
@@ -27360,6 +27892,16 @@ var switchCapability = {
 	* not need to re-query the provider after a setState mutation.
 	*/
 	runtimeState: SwitchStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"],
 	settings: { bindings: [{
 		kind: "scalar",
 		statusPath: "on",
@@ -27458,7 +28000,17 @@ var tamperCapability = {
 		schema: TamperStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TamperStatusSchema
+	runtimeState: TamperStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/temperature-sensor.cap.ts
@@ -27505,7 +28057,17 @@ var temperatureSensorCapability = {
 		schema: TemperatureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TemperatureSensorStatusSchema
+	runtimeState: TemperatureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/toast.cap.ts
@@ -27585,7 +28147,14 @@ var updateCapability = {
 		schema: UpdateStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: UpdateStatusSchema
+	runtimeState: UpdateStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/user-management.cap.ts
@@ -27965,7 +28534,14 @@ var vacuumControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live state + battery + fan-speed changes.
 	*/
-	runtimeState: VacuumControlStatusSchema
+	runtimeState: VacuumControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/valve.cap.ts
@@ -28037,7 +28613,14 @@ var valveCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live position changes during a move.
 	*/
-	runtimeState: ValveStatusSchema
+	runtimeState: ValveStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/vibration.cap.ts
@@ -28061,7 +28644,17 @@ var vibrationCapability = {
 		schema: VibrationStatusSchema,
 		kind: "push"
 	},
-	runtimeState: VibrationStatusSchema
+	runtimeState: VibrationStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/water-heater.cap.ts
@@ -28137,7 +28730,14 @@ var waterHeaterCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live temperature / mode / away changes.
 	*/
-	runtimeState: WaterHeaterStatusSchema
+	runtimeState: WaterHeaterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/weather.cap.ts
@@ -28198,7 +28798,14 @@ var weatherCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads the
 	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: WeatherStatusSchema
+	runtimeState: WeatherStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/zone-analytics.cap.ts
@@ -28362,7 +28969,14 @@ var zoneAnalyticsCapability = {
 	* automatically; the explicit `getCurrentSnapshot` cap method is
 	* still useful for one-off polls without a subscription.
 	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/zone-rules.cap.ts
@@ -28442,7 +29056,14 @@ var zoneRulesCapability = {
 		motion: zod.z.array(ZoneRuleSchema).readonly(),
 		detection: zod.z.array(ZoneRuleSchema).readonly(),
 		package: zod.z.array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 //#endregion
 //#region src/capabilities/index.ts
@@ -38060,6 +38681,320 @@ function getCapsByProviderKind(kind) {
 	return out;
 }
 //#endregion
+//#region src/generated/runtime-state-durability.ts
+/**
+* Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
+* `runtimeState`. 62 caps: 33 `restored`, 29 `session`.
+*
+* A cap absent from this map has no runtime-state slice at all. A cap PRESENT
+* with `durability: 'session'` has one and has decided not to keep it.
+*/
+var RUNTIME_STATE_POLICY = {
+	"air-quality-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"alarm-panel": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"ambient-light-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"audio-metrics": {
+		durability: "session",
+		volatileFields: []
+	},
+	"automation-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"battery": {
+		durability: "restored",
+		volatileFields: ["lastUpdated"]
+	},
+	"binary": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"brightness": {
+		durability: "session",
+		volatileFields: []
+	},
+	"camera-streams": {
+		durability: "session",
+		volatileFields: []
+	},
+	"carbon-monoxide": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"climate-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"color": {
+		durability: "session",
+		volatileFields: []
+	},
+	"connectivity": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"consumables": {
+		durability: "session",
+		volatileFields: []
+	},
+	"contact": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"cover": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"day-night": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"device-discovery": {
+		durability: "session",
+		volatileFields: []
+	},
+	"device-status": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"doorbell": {
+		durability: "restored",
+		volatileFields: []
+	},
+	"enum-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"event-emitter": {
+		durability: "session",
+		volatileFields: []
+	},
+	"fan-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"feature-probe": {
+		durability: "session",
+		volatileFields: []
+	},
+	"flood": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"gas": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"humidifier": {
+		durability: "session",
+		volatileFields: []
+	},
+	"humidity-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"image": {
+		durability: "session",
+		volatileFields: []
+	},
+	"image-settings": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"lawn-mower-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"lock-control": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"media-player": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion-trigger": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion-zones": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"native-object-detection": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"notifier": {
+		durability: "session",
+		volatileFields: []
+	},
+	"numeric-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"pet-feeder": {
+		durability: "session",
+		volatileFields: []
+	},
+	"power-meter": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"presence": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"pressure-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"privacy-mask": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"ptz-autotrack": {
+		durability: "session",
+		volatileFields: []
+	},
+	"scene-monitor": {
+		durability: "session",
+		volatileFields: []
+	},
+	"script-runner": {
+		durability: "session",
+		volatileFields: []
+	},
+	"smoke": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"stream-params": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"switch": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"tamper": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"temperature-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"update": {
+		durability: "session",
+		volatileFields: []
+	},
+	"vacuum-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"valve": {
+		durability: "session",
+		volatileFields: []
+	},
+	"vibration": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"water-heater": {
+		durability: "session",
+		volatileFields: []
+	},
+	"weather": {
+		durability: "session",
+		volatileFields: []
+	},
+	"zone-analytics": {
+		durability: "session",
+		volatileFields: []
+	},
+	"zone-rules": {
+		durability: "restored",
+		volatileFields: []
+	},
+	"zones": {
+		durability: "restored",
+		volatileFields: []
+	}
+};
+/**
+* The policy for `capName`. An UNKNOWN cap resolves to `'session'` — an
+* addon-private slice the codegen has never seen is not persisted until its
+* capability says so, which is the safe direction: the cost of a lost session
+* value is a cold window, the cost of an unasked-for persist is a commit per
+* second on the fleet's busiest write path.
+*/
+function runtimeStatePolicyFor(capName) {
+	return RUNTIME_STATE_POLICY[capName] ?? SESSION_ONLY_POLICY;
+}
+/** Shared fallback instance — see {@link runtimeStatePolicyFor}. */
+var SESSION_ONLY_POLICY = {
+	durability: "session",
+	volatileFields: []
+};
+/** True when this cap's slice is written to disk. */
+function isRestoredCap(capName) {
+	return runtimeStatePolicyFor(capName).durability === "restored";
+}
+/** Cap names whose slice survives a restart, sorted. */
+var RESTORED_CAP_NAMES = [
+	"air-quality-sensor",
+	"alarm-panel",
+	"ambient-light-sensor",
+	"battery",
+	"binary",
+	"carbon-monoxide",
+	"connectivity",
+	"contact",
+	"cover",
+	"day-night",
+	"device-status",
+	"doorbell",
+	"enum-sensor",
+	"flood",
+	"gas",
+	"humidity-sensor",
+	"image-settings",
+	"lock-control",
+	"motion-zones",
+	"native-object-detection",
+	"numeric-sensor",
+	"power-meter",
+	"presence",
+	"pressure-sensor",
+	"privacy-mask",
+	"smoke",
+	"stream-params",
+	"switch",
+	"tamper",
+	"temperature-sensor",
+	"vibration",
+	"zone-rules",
+	"zones"
+];
+//#endregion
 //#region src/generated/scope-presets.ts
 var SCOPE_PRESETS = [
 	{
@@ -38722,6 +39657,177 @@ function createSystemProxy(api) {
 	};
 }
 //#endregion
+//#region src/notification/audio-condition.ts
+/**
+* audio-condition — the authoring logic behind the sustained-sound condition
+* (`NcConditions.audio`), pure and UI-framework-free.
+*
+* WHY IT LIVES HERE
+* ─────────────────
+* Same reason as `condition-taxonomy.ts` next door: two editors author this
+* condition (the admin UI and the viewer), the vocabulary it offers is already
+* in this package (`AUDIO_MACRO_LABELS`), and a second copy of "what a cleared
+* threshold writes" is a mirror free to drift. The viewer keeps its own copy
+* because it is a separate app with its own toolchain; every surface that CAN
+* import `@camstack/types` uses this one.
+*
+* Four behaviours here are not cosmetic:
+*
+*  1. **dBFS is negative-going.** `0` is full scale; digital silence reads
+*     {@link NC_AUDIO_DBFS_FLOOR}. A control that let an operator author `60`
+*     meaning "loud" would write a threshold no sample can reach, and the rule
+*     would look broken rather than mis-configured. Every write is clamped.
+*  2. **Neither filter given = the engine REFUSES.** With no level floor and no
+*     labels every sample is trivially a hit, so the window would fire on
+*     silence. {@link audioIsFailClosed} is how an editor says that BEFORE the
+*     save instead of shipping a rule that never notifies and never says why.
+*  3. **Both label spellings are the same label.** The hub's taxonomy serves
+*     `audio-dog`; the macro catalog and an operator both say `dog`, and the
+*     matcher normalizes the prefix away on both sides. Selection therefore
+*     compares NORMALIZED ids — a rule authored in the admin UI must not read
+*     as "nothing selected" on the phone.
+*  4. **A stored label the build does not know stays visible.** It is offered
+*     as an explicitly-unknown, removable choice, never silently dropped:
+*     rewriting the rule the operator is looking at is worse than showing a
+*     stale id.
+*/
+/** The `audio-` namespace the NC taxonomy uses for these same macro ids. */
+var AUDIO_KIND_PREFIX = "audio-";
+/** Strip the taxonomy's `audio-` namespace: `audio-dog` and `dog` are one label. */
+function normalizeAudioLabel(value) {
+	return value.startsWith(AUDIO_KIND_PREFIX) ? value.slice(6) : value;
+}
+/** Level bounds, in dBFS. Negative-going: the ceiling is full scale. */
+var NC_AUDIO_DB_MIN = -96;
+var NC_AUDIO_DB_MAX = 0;
+/** Step of the level control — 3 dB is one perceptual notch, not one unit. */
+var NC_AUDIO_DB_STEP = 3;
+/**
+* Offered when the operator turns the level filter ON. NOT a schema default:
+* an absent `dbThreshold` means "any level" and stays absent until asked for,
+* and a stepper seeded at the -96 floor would need thirty taps to reach a
+* threshold that can actually fire.
+*/
+var NC_AUDIO_DB_OFFERED = -30;
+var NC_AUDIO_HIT_PERCENT_MIN = 1;
+var NC_AUDIO_HIT_PERCENT_MAX = 100;
+var NC_AUDIO_SAMPLING_MIN_SEC = 1;
+var NC_AUDIO_SAMPLING_MAX_SEC = 300;
+/** Schema defaults — an untouched sub-field must author exactly these. */
+var NC_AUDIO_DEFAULTS = {
+	hitPercent: 60,
+	samplingSeconds: 10
+};
+/** What an editor SHOWS for an unset condition — without authoring it. */
+function audioOrDefaults(value) {
+	return value ?? NC_AUDIO_DEFAULTS;
+}
+/**
+* True when the condition names NEITHER a level floor NOR any label. The engine
+* refuses such a rule (every sample is a hit, so the window fires on silence) —
+* an editor warns instead of letting the operator ship a rule that never
+* notifies and says nothing about why.
+*
+* An ABSENT condition is not flagged: a rule with no `audio` key is not an
+* audio rule at all.
+*/
+function audioIsFailClosed(value) {
+	if (value === void 0) return false;
+	return value.dbThreshold === void 0 && (value.labels === void 0 || value.labels.length === 0);
+}
+function clampInt(value, min, max) {
+	if (!Number.isFinite(value)) return min;
+	return Math.min(max, Math.max(min, Math.round(value)));
+}
+function has(patch, key) {
+	return Object.prototype.hasOwnProperty.call(patch, key);
+}
+/**
+* Apply a sub-field edit, seeding from the defaults when nothing is stored yet.
+* The result is always in-bounds for `NcAudioConditionSchema`, and a cleared
+* filter is OMITTED rather than written as an explicit `undefined` (which
+* survives a merge patch as a deliberate erase and reads as authored).
+*/
+function patchAudio(current, patch) {
+	const base = audioOrDefaults(current);
+	const labels = has(patch, "labels") ? patch.labels : base.labels;
+	const dbThreshold = has(patch, "dbThreshold") ? patch.dbThreshold : base.dbThreshold;
+	return {
+		...labels !== void 0 && labels.length > 0 ? { labels: [...labels] } : {},
+		...dbThreshold !== void 0 ? { dbThreshold: clampInt(dbThreshold, NC_AUDIO_DB_MIN, 0) } : {},
+		hitPercent: clampInt(patch.hitPercent ?? base.hitPercent, 1, 100),
+		samplingSeconds: clampInt(patch.samplingSeconds ?? base.samplingSeconds, 1, 300)
+	};
+}
+/** The icon glyph for a stored label the catalogue does not know. */
+var UNKNOWN_LABEL_ICON = "🔈";
+var ICON_BY_ID = new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
+/**
+* The label choices: the hub's `audioKinds` when it serves them (its WORDS, the
+* local EMOJI, keyed by the normalized id), else the local macro catalog — plus
+* any stored label neither side knows, marked unknown.
+*
+* The hub's list wins on membership because it knows which macros this cluster
+* actually classifies; the icons stay local because the taxonomy carries none.
+*/
+function audioLabelChoices(taxonomy, selected) {
+	const fromHub = taxonomy?.audioKinds ?? [];
+	const choices = fromHub.length > 0 ? fromHub.map((entry) => {
+		const id = normalizeAudioLabel(entry.kind);
+		return {
+			value: id,
+			label: entry.label,
+			icon: ICON_BY_ID.get(id) ?? UNKNOWN_LABEL_ICON,
+			unknown: false
+		};
+	}) : AUDIO_MACRO_LABELS.map((macro) => ({
+		value: macro.id,
+		label: macro.name,
+		icon: macro.icon ?? UNKNOWN_LABEL_ICON,
+		unknown: false
+	}));
+	const known = new Set(choices.map((choice) => choice.value));
+	const unknownLabels = [];
+	for (const stored of selected ?? []) {
+		const id = normalizeAudioLabel(stored);
+		if (known.has(id) || unknownLabels.includes(id)) continue;
+		unknownLabels.push(id);
+		choices.push({
+			value: id,
+			label: id,
+			icon: UNKNOWN_LABEL_ICON,
+			unknown: true
+		});
+	}
+	return {
+		choices,
+		unknownLabels
+	};
+}
+/**
+* Is this macro id selected? Compares NORMALIZED ids, so a rule authored with
+* the taxonomy spelling (`audio-dog`) reads as selected here.
+*/
+function isAudioLabelSelected(labels, id) {
+	const wanted = normalizeAudioLabel(id);
+	return (labels ?? []).some((stored) => normalizeAudioLabel(stored) === wanted);
+}
+/**
+* Toggle one macro id. Removing drops EVERY stored spelling of it; adding
+* appends the bare macro id. Returns `undefined` when the last label goes — the
+* field is optional and absent means "any sound", never an empty array (which
+* `NcAudioConditionSchema` rejects outright).
+*/
+function toggleAudioLabel(labels, id) {
+	const wanted = normalizeAudioLabel(id);
+	const current = labels ?? [];
+	if (isAudioLabelSelected(current, wanted)) {
+		const next = current.filter((stored) => normalizeAudioLabel(stored) !== wanted);
+		return next.length > 0 ? next : void 0;
+	}
+	return [...current, wanted];
+}
+//#endregion
 //#region src/notification/condition-taxonomy.ts
 /** Condition ids that render the class picker (video macros/subs + audio). */
 var CLASS_CONDITION_IDS = new Set(["classes", "classesExclude"]);
@@ -39603,8 +40709,8 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 //#endregion
 //#region src/pipeline/native-lease.ts
 /**
-* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
-* decode worker's native-resolution frame retention.
+* THE native-frame **lease** knobs — hold depth, RAM budget, demand window and
+* subject-tile budget for the decode worker's native-resolution retention.
 *
 * ## Why they live here and not in the addon that reads them
 *
@@ -39620,20 +40726,25 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 * The lease is a per-decode-worker RAM window. Its purpose — the late
 * cross-process native crop landing on a full-resolution frame rather than the
 * ≤640 detection fallback — is a property of the PIPELINE, not of a node's
-* hardware: a per-node TTL would mean the same camera produces different crop
+* hardware: a per-node window would mean the same camera produces different crop
 * quality depending on which node the balancer placed it on, and nobody could
 * tell that from the stored media. Node-level RAM pressure is already handled
 * by the per-session budget ceiling, which is itself one of these knobs.
 *
 * ## What each knob costs
 *
-* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* A HELD frame is a full NATIVE-resolution copy in system RAM. With the
 * default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
 * 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
 * for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
-* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
-* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
-* admission" for what actually gets admitted.
+* resident RAM for ONE busy camera is now `frameBytes × holdFrames`, clamped by
+* the budget ceiling — bounded by a COUNT because a held frame is waiting for
+* one specific event (its own detection result), not for a clock.
+*
+* A TILE is one subject at native resolution, JPEG-encoded: ~60-120 KB on 4K,
+* and nothing at all on a frame that detected nothing. That is the asymmetry
+* this whole shape exists for — see
+* `docs/design/2026-08-13-native-lease-two-tier-redesign.md`.
 */
 /**
 * Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
@@ -39641,10 +40752,11 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 * the reader can walk every section instead of trusting the section id.
 */
 var NATIVE_LEASE_SECTION_ID = "native-lease";
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -39671,25 +40783,32 @@ var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
 */
 var NativeLeaseSettingsSchema = zod.z.object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
+	*
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: zod.z.number().int().min(250).max(1e4),
+	holdFrames: zod.z.number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -39715,25 +40834,47 @@ var NativeLeaseSettingsSchema = zod.z.object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: zod.z.number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
 /** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
-var NATIVE_LEASE_TTL_FIELD = {
-	min: 250,
-	max: 1e4,
-	step: 50,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+var NATIVE_LEASE_HOLD_FIELD = {
+	min: 1,
+	max: 64,
+	step: 1,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames
 };
 var NATIVE_LEASE_BUDGET_FIELD = {
 	min: 0,
@@ -39747,6 +40888,12 @@ var NATIVE_LEASE_ACTIVITY_FIELD = {
 	step: 1e3,
 	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
 };
+var NATIVE_LEASE_TILE_BUDGET_FIELD = {
+	min: 0,
+	max: 1024,
+	step: 16,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
+};
 /** Select options for the admission knob (orchestrator settings UI). */
 var NATIVE_LEASE_ADMISSION_FIELD = {
 	options: [{
@@ -39766,7 +40913,7 @@ var NATIVE_LEASE_ADMISSION_FIELD = {
 * precedence being true and being a lie. `addon-settings.getGlobalSettings`
 * returns a HYDRATED payload, and `hydrateField` fills an unstored field with
 * the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* opened the form still reports `nativeLeaseHoldFrames = 8`). A reader that took
 * that at face value would report all three knobs as "set" on every cluster on
 * the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
 * emergency override that the precedence promises. There is no raw-store read on
@@ -39800,25 +40947,28 @@ function readAdmissionKnob(raw) {
 * {@link readKnob} for why the default counts as unset.
 */
 function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
 	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
 	return {
-		...ttlMs === null ? {} : { ttlMs },
+		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
+		...admission === null ? {} : { admission },
+		...tileBudgetMb === null ? {} : { tileBudgetMb }
 	};
 }
 function isHydratedField(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_HOLD_KEY,
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
+	NATIVE_LEASE_ADMISSION_KEY,
+	NATIVE_LEASE_TILE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an
@@ -41355,6 +42505,7 @@ exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
 exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
+exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
 exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
@@ -41597,11 +42748,22 @@ exports.NATIVE_LEASE_ADMISSION_FIELD = NATIVE_LEASE_ADMISSION_FIELD;
 exports.NATIVE_LEASE_ADMISSION_KEY = NATIVE_LEASE_ADMISSION_KEY;
 exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
 exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
+exports.NATIVE_LEASE_HOLD_FIELD = NATIVE_LEASE_HOLD_FIELD;
+exports.NATIVE_LEASE_HOLD_KEY = NATIVE_LEASE_HOLD_KEY;
 exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
-exports.NATIVE_LEASE_TTL_FIELD = NATIVE_LEASE_TTL_FIELD;
-exports.NATIVE_LEASE_TTL_KEY = NATIVE_LEASE_TTL_KEY;
+exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
+exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
 exports.NC_ALARM_SYSTEM_EVENT_KINDS = NC_ALARM_SYSTEM_EVENT_KINDS;
 exports.NC_AUDIO_DBFS_FLOOR = NC_AUDIO_DBFS_FLOOR;
+exports.NC_AUDIO_DB_MAX = NC_AUDIO_DB_MAX;
+exports.NC_AUDIO_DB_MIN = NC_AUDIO_DB_MIN;
+exports.NC_AUDIO_DB_OFFERED = NC_AUDIO_DB_OFFERED;
+exports.NC_AUDIO_DB_STEP = NC_AUDIO_DB_STEP;
+exports.NC_AUDIO_DEFAULTS = NC_AUDIO_DEFAULTS;
+exports.NC_AUDIO_HIT_PERCENT_MAX = NC_AUDIO_HIT_PERCENT_MAX;
+exports.NC_AUDIO_HIT_PERCENT_MIN = NC_AUDIO_HIT_PERCENT_MIN;
+exports.NC_AUDIO_SAMPLING_MAX_SEC = NC_AUDIO_SAMPLING_MAX_SEC;
+exports.NC_AUDIO_SAMPLING_MIN_SEC = NC_AUDIO_SAMPLING_MIN_SEC;
 exports.NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NC_AUTHORABLE_SYSTEM_EVENT_KINDS;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
@@ -41609,6 +42771,7 @@ exports.NC_CONFIRM_DEFAULT_MAX_IMAGE_PX = NC_CONFIRM_DEFAULT_MAX_IMAGE_PX;
 exports.NC_CONFIRM_DEFAULT_TIMEOUT_MS = NC_CONFIRM_DEFAULT_TIMEOUT_MS;
 exports.NC_CONFIRM_MAX_TIMEOUT_MS = NC_CONFIRM_MAX_TIMEOUT_MS;
 exports.NC_CONFIRM_MIN_TIMEOUT_MS = NC_CONFIRM_MIN_TIMEOUT_MS;
+exports.NC_DEFAULT_SNOOZE_MINUTES = NC_DEFAULT_SNOOZE_MINUTES;
 exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
 exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
 exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
@@ -41755,7 +42918,9 @@ exports.REACHABILITY_PROBE_TIMEOUT_MS = REACHABILITY_PROBE_TIMEOUT_MS;
 exports.RECOGNITION_TYPES = RECOGNITION_TYPES;
 exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
 exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
+exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
 exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
+exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
 exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
 exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
 exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
@@ -42027,7 +43192,10 @@ exports.assertTimelapseCadences = assertTimelapseCadences;
 exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
+exports.audioIsFailClosed = audioIsFailClosed;
+exports.audioLabelChoices = audioLabelChoices;
 exports.audioMetricsCapability = audioMetricsCapability;
+exports.audioOrDefaults = audioOrDefaults;
 exports.audioPlanFromEncodeProfile = require_canonical_hash.audioPlanFromEncodeProfile;
 exports.authProviderCapability = authProviderCapability;
 exports.autoAssignProfiles = autoAssignProfiles;
@@ -42165,6 +43333,7 @@ exports.intercomCapability = intercomCapability;
 exports.invocationFromEncodeProfile = require_canonical_hash.invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
+exports.isAudioLabelSelected = isAudioLabelSelected;
 exports.isBaseConditionKey = isBaseConditionKey;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
 exports.isDeployableToAgent = isDeployableToAgent;
@@ -42174,6 +43343,7 @@ exports.isEvent = require_sleep.isEvent;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
+exports.isRestoredCap = isRestoredCap;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
 exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
@@ -42222,6 +43392,7 @@ exports.networkQualityCapability = networkQualityCapability;
 exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
+exports.normalizeAudioLabel = normalizeAudioLabel;
 exports.normalizeUnit = normalizeUnit;
 exports.notificationOutputCapability = notificationOutputCapability;
 exports.notificationRulesCapability = notificationRulesCapability;
@@ -42238,6 +43409,7 @@ exports.parseJsonObject = require_sleep.parseJsonObject;
 exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
 exports.parseProfileBrokerId = require_sleep.parseProfileBrokerId;
 exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
+exports.patchAudio = patchAudio;
 exports.petFeederCapability = petFeederCapability;
 exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickDetailCropConvention = pickDetailCropConvention;
@@ -42290,6 +43462,7 @@ exports.resolveScrubThumbnailGeometry = resolveScrubThumbnailGeometry;
 exports.resolveVariantModelId = resolveVariantModelId;
 exports.runInferenceStep = runInferenceStep;
 exports.runtimeDevices = runtimeDevices;
+exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
 exports.sceneMonitorCapability = sceneMonitorCapability;
 exports.scopeKey = require_sleep.scopeKey;
 exports.scopesAllowAddon = scopesAllowAddon;
@@ -42336,6 +43509,7 @@ exports.toExpressionValue = toExpressionValue;
 exports.toNodeId = require_sleep.toNodeId;
 exports.toStreamSourceEntry = toStreamSourceEntry;
 exports.toastCapability = toastCapability;
+exports.toggleAudioLabel = toggleAudioLabel;
 exports.tokenize = tokenize;
 exports.transcodeBody = transcodeBody;
 exports.tryConvertUnit = tryConvertUnit;