@camstack/types 1.2.65 → 1.2.67

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-DxZbWydC.js");
-const require_sleep = require("./sleep-BszXLEvP.js");
+const require_sleep = require("./sleep-Dh1EJSqF.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -6664,7 +6664,14 @@ var cameraStreamsCapability = {
 			low: zod.z.string().optional()
 		}),
 		lastChangedAt: zod.z.number()
-	})
+	}),
+	/**
+	* Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/cap-router-predicates.ts
@@ -7831,6 +7838,13 @@ var deviceDiscoveryCapability = {
 		kind: "poll"
 	},
 	runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: zod.z.number().int().nonnegative() }),
+	/**
+	* Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
 	methods: {
 		/**
 		* Snapshot of the current `discovered` list. Returns the
@@ -10453,11 +10467,33 @@ var NotificationFormatSchema = zod.z.enum([
 * Named by INTENT, never by glyph. "check" would tie the vocabulary to one
 * renderer's icon set; "acknowledge" survives an adapter that draws it
 * differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
 */
 var NotificationActionIconSchema = zod.z.enum([
 	"acknowledge",
 	"dismiss",
 	"silence",
+	"snooze",
 	"view",
 	"play",
 	"open",
@@ -10465,9 +10501,13 @@ var NotificationActionIconSchema = zod.z.enum([
 	"lock",
 	"unlock",
 	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
 	"disarm",
 	"light",
-	"alert"
+	"alert",
+	"camera"
 ]);
 /** A single tap-through action button. */
 var NotificationActionSchema = zod.z.object({
@@ -10483,7 +10523,23 @@ var NotificationActionSchema = zod.z.object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: zod.z.boolean().optional()
+	destructive: zod.z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: zod.z.enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -11009,6 +11065,29 @@ var MACRO_LABELS = [
 		name: "Package"
 	}
 ];
+/**
+* The class names a per-class COUNT can ever be keyed on — the macro ids, and
+* only those.
+*
+* `preserveOriginal: false` below is the whole reason this set exists: the
+* executor maps each raw COCO label onto its macro and DROPS everything else,
+* so a tracked detection's `className` is always one of {@link MACRO_LABELS}.
+* Any surface that indexes counts by class name — the ZoneAnalytics occupancy
+* snapshot's `byClass`, and therefore every occupancy rule — can match nothing
+* else. Derived from the catalog, never hand-listed, so a new macro joins it by
+* being declared once.
+*
+* Cost of not having it, 2026-08-12: the notification rule editor offered the
+* full taxonomy for an occupancy class (occupancy is the one condition that
+* does not go through the engine's macro-expanding `expandClassSelector`), two
+* live rules were authored on `car`, and both counters read 0 forever.
+*/
+var DETECTION_MACRO_CLASSES = new Set(MACRO_LABELS.map((l) => l.id));
+/** True when `className` is a macro the detector can actually emit (and hence a
+*  class a count can be keyed on) — see {@link DETECTION_MACRO_CLASSES}. */
+function isDetectionMacroClass(className) {
+	return DETECTION_MACRO_CLASSES.has(className.trim().toLowerCase());
+}
 var COCO_TO_MACRO = {
 	mapping: {
 		person: "person",
@@ -11726,7 +11805,17 @@ var alarmPanelCapability = {
 	* full slice; renders an arm button per `availableModes` entry and
 	* a PIN field iff `requiresCode === true`.
 	*/
-	runtimeState: AlarmPanelStatusSchema
+	runtimeState: AlarmPanelStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/mask-shape.ts
@@ -11874,6 +11963,8 @@ var NcSystemEventKindSchema = zod.z.enum([
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -11893,16 +11984,22 @@ var NC_LEGACY_SYSTEM_EVENT_KINDS = new Set([
 */
 var NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 /**
-* The panel's three transitions, as ONE list.
+* The panel's transitions, as ONE list.
 *
 * Named here rather than spelled out at each of the four sites that need them
 * (the emitter, the intake, the editor group, the combined-notification gate),
-* because a fourth transition added to the enum and forgotten at one of them is
-* an alarm state nobody can be notified about.
+* because a transition added to the enum and forgotten at one of them is an
+* alarm state nobody can be notified about. That is exactly what this list
+* failed to prevent while it held three: `alarm-arming` was the fourth.
+*
+* In LIFECYCLE order, which is the order an editor lists them in and the order
+* a person experiences them — not the order they were added.
 */
 var NC_ALARM_SYSTEM_EVENT_KINDS = [
-	"alarm-triggered",
+	"alarm-arm-refused",
+	"alarm-arming",
 	"alarm-armed",
+	"alarm-triggered",
 	"alarm-disarmed"
 ];
 /**
@@ -11934,6 +12031,26 @@ var NcSystemEventConditionSchema = zod.z.object({
 * unique key `(ruleId, trackId, targetId)`. Not a rule field in P1.
 */
 var NC_MAX_PER_TRACK_IMMEDIATE = 1;
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
+/**
+* The durations a notification offers when its rule does not say otherwise.
+*
+* MINUTES, and short ones: a snooze button is answered on a lock screen, and
+* the three choices that fit there are "the next few minutes", "the next half
+* hour" and "the next hour". Anything longer is a decision somebody sits down
+* to make, which is what the app's own snooze surface is for.
+*
+* Resolved in CODE (`snoozeChoices`), never as a Zod default — see
+* {@link NcRuleInputSchema.shape.snoozeOptions} for why the distinction is
+* load-bearing.
+*/
+var NC_DEFAULT_SNOOZE_MINUTES = [
+	10,
+	30,
+	60
+];
 /** One weekly activation window. `startMinute > endMinute` crosses midnight. */
 var NcScheduleWindowSchema = zod.z.object({
 	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
@@ -12335,15 +12452,15 @@ var NcConditionsSchema = zod.z.object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -12580,6 +12697,30 @@ var NcRuleInputSchema = zod.z.object({
 	*/
 	snoozeAllowGlobal: zod.z.boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: zod.z.array(zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -12679,6 +12820,7 @@ var NcConditionDescriptorSchema = zod.z.object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: zod.z.string(),
@@ -12697,6 +12839,7 @@ var NcConditionDescriptorSchema = zod.z.object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -12787,13 +12930,17 @@ var NC_CONDITION_CATALOG = [
 				label: "Server update available"
 			},
 			{
-				value: "alarm-triggered",
-				label: "Alarm triggered"
+				value: "alarm-arming",
+				label: "Alarm arming (exit delay)"
 			},
 			{
 				value: "alarm-armed",
 				label: "Alarm armed"
 			},
+			{
+				value: "alarm-triggered",
+				label: "Alarm triggered"
+			},
 			{
 				value: "alarm-disarmed",
 				label: "Alarm disarmed"
@@ -13094,6 +13241,16 @@ var NC_CONDITION_CATALOG = [
 		phase: "P1",
 		description: "ZoneAnalytics occupancy edge (optionally zone/class-scoped): count crosses the threshold and holds for sustainSeconds. Fail-closed on a missing snapshot."
 	},
+	{
+		id: "audio",
+		group: "audio",
+		label: "Sound",
+		valueType: "audio",
+		operator: "anyOf",
+		appliesTo: ["immediate"],
+		phase: "P2",
+		description: "Fires when at least hitPercent% of the samples in a samplingSeconds window are hits — a hit clears the dBFS floor AND carries one of the chosen sounds. Both filters are optional and independent, but naming NEITHER never matches: every sample would be a hit, so the engine refuses rather than notifying on silence. dBFS is negative-going (0 = full scale, -96 = silence)."
+	},
 	{
 		id: "customZones",
 		group: "zones",
@@ -13229,9 +13386,6 @@ var NcSnoozeScopeSchema = zod.z.enum([
 	"device",
 	"all"
 ]);
-/** Hard ceiling on a window (24h). A snooze that could not expire would be an
-*  outage the operator asked for once and forgot. */
-var NC_SNOOZE_MAX_MINUTES = 1440;
 /**
 * Client-authored snooze. The server stamps `userId`, `startedAt` and
 * `expiresAt` — a DURATION is sent rather than an instant so a client with a
@@ -13244,6 +13398,19 @@ var NcSnoozeInputSchema = zod.z.object({
 	ruleId: zod.z.string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: zod.z.number().int().optional(),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
 	durationMinutes: zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
@@ -13269,6 +13436,10 @@ var NcSnoozeSchema = zod.z.object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: zod.z.string().optional(),
 	deviceId: zod.z.number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
 	startedAt: zod.z.number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -16061,7 +16232,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() })
+	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 //#endregion
 //#region src/capabilities/pipeline-runner.cap.ts
@@ -16233,6 +16411,22 @@ var detectionFpsField = {
 	default: 10,
 	step: 1
 };
+/**
+* The occupancy re-check interval. DEFAULT 300 s (2026-08-13 — was 30 s).
+*
+* The recheck is now on by default (a parked car is invisible to occupancy
+* rules until the stationary registry has been rebuilt by motion, which after a
+* restart may be never on a quiet camera). Each cycle re-subscribes a detection
+* session — an RTSP re-dial — so the switch is only affordable at a WIDE
+* interval: 300 s is ~12 re-dials an hour per camera, against 120 at the old
+* 30 s. A parked car is therefore counted within 5 minutes of a restart.
+*
+* Why not wider: `max` is 300 and raising it is TRAIN-BOUND, not addon-bound —
+* the host validates `attachCamera` against ITS copy of this schema, so a
+* runner asked for 600 would be rejected by the hub until a `@camstack/server`
+* carrying the wider bound is installed everywhere. 300 is the widest value
+* that ships with an addon deploy.
+*/
 var occupancyRecheckSecField = {
 	min: 0,
 	max: 300,
@@ -16434,15 +16628,21 @@ var RunnerCameraConfigSchema = zod.z.object({
 	*/
 	onboardMotionDrivesAnalyzer: zod.z.boolean().default(true),
 	/**
-	* Master toggle for the occupancy re-check. When `false` (DEFAULT) the runner
-	* never arms the periodic recheck timer, regardless of `occupancyRecheckSec` —
-	* this is off by default because the recheck re-subscribes a detection session
-	* every N seconds while `watching`, a major source of pull-decoder re-dial
-	* churn (each cycle creates+tears a session → RTSP re-dial → latency). The
+	* Master toggle for the occupancy re-check. When `false` the runner never arms
+	* the periodic recheck timer, regardless of `occupancyRecheckSec`; the
 	* `occupancyRecheckSec` / `occupancyRecheckFrames` sliders only take effect
 	* (and only render) when this is enabled.
-	*/
-	occupancyRecheckEnabled: zod.z.boolean().default(false),
+	*
+	* DEFAULT `true` since 2026-08-13 (was `false`). It was off because the
+	* recheck re-subscribes a detection session every N seconds while `watching`
+	* — each cycle creates+tears a session ⇒ an RTSP re-dial ⇒ latency, a major
+	* pull-decoder churn source. What that bought was a blind spot: a STATIONARY
+	* object is counted only while the stationary registry holds it, and the
+	* registry rebuilds from motion, so after a restart a parked car was invisible
+	* to every occupancy rule until something moved in front of it. The churn is
+	* now paid on the interval instead — see `occupancyRecheckSecField`.
+	*/
+	occupancyRecheckEnabled: zod.z.boolean().default(true),
 	occupancyRecheckSec: zod.z.number().min(occupancyRecheckSecField.min).max(occupancyRecheckSecField.max).default(occupancyRecheckSecField.default),
 	occupancyRecheckFrames: zod.z.number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default),
 	/**
@@ -16575,8 +16775,8 @@ var RunnerCameraDeviceUIFields = [
 		type: "boolean",
 		style: "checkbox",
 		label: "Occupancy re-check",
-		description: "Periodically re-sample a few frames during the watching phase to confirm the scene is truly empty (catches stationary objects motion-gating would miss). Off by default — it adds decoder re-dial churn.",
-		default: false
+		description: "Periodically re-sample a few frames during the watching phase, so objects that are simply parked are still counted (motion gating alone loses them after a restart). On by default at a wide interval; turn it off on cameras where the extra decoder re-dial is expensive.",
+		default: true
 	},
 	{
 		key: "occupancyRecheckSec",
@@ -20268,7 +20468,17 @@ var airQualitySensorCapability = {
 		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AirQualitySensorStatusSchema
+	runtimeState: AirQualitySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/ambient-light-sensor.cap.ts
@@ -20302,7 +20512,17 @@ var ambientLightSensorCapability = {
 		schema: AmbientLightSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AmbientLightSensorStatusSchema
+	runtimeState: AmbientLightSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/audio-metrics.cap.ts
@@ -20431,7 +20651,14 @@ var audioMetricsCapability = {
 		}), AudioMetricsHistorySchema)
 	},
 	/** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-	runtimeState: AudioMetricsSnapshotSchema
+	runtimeState: AudioMetricsSnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/automation-control.cap.ts
@@ -20495,7 +20722,14 @@ var automationControlCapability = {
 	* reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
 	* (badge) directly.
 	*/
-	runtimeState: AutomationControlStatusSchema
+	runtimeState: AutomationControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/battery.cap.ts
@@ -20603,7 +20837,17 @@ onStatusChanged: { data: zod.z.object({
 	* via `device.runtimeState.getCapState('battery')` regardless of
 	* the underlying driver.
 	*/
-	runtimeState: BatteryStatusSchema
+	runtimeState: BatteryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastUpdated"]
 };
 //#endregion
 //#region src/capabilities/binary.cap.ts
@@ -20634,7 +20878,17 @@ var binaryCapability = {
 		schema: BinaryStatusSchema,
 		kind: "push"
 	},
-	runtimeState: BinaryStatusSchema
+	runtimeState: BinaryStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/brightness.cap.ts
@@ -20689,7 +20943,14 @@ onBrightnessChanged: { data: zod.z.object({
 	* by the kernel. Read via `device.state.brightness.value` so UI
 	* sliders surface the current level without polling the provider.
 	*/
-	runtimeState: BrightnessStatusSchema
+	runtimeState: BrightnessStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/button.cap.ts
@@ -20824,7 +21085,17 @@ var carbonMonoxideCapability = {
 		schema: CarbonMonoxideStatusSchema,
 		kind: "push"
 	},
-	runtimeState: CarbonMonoxideStatusSchema
+	runtimeState: CarbonMonoxideStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/climate-control.cap.ts
@@ -20986,7 +21257,14 @@ var climateControlCapability = {
 	* the full slice via `device.state.climate-control.value` and refresh
 	* on every push without re-querying the provider.
 	*/
-	runtimeState: ClimateControlStatusSchema
+	runtimeState: ClimateControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/color.cap.ts
@@ -21098,7 +21376,14 @@ onColorChanged: { data: zod.z.object({
 	* kernel. Read via `device.state.color.value` so UI pickers surface
 	* the current chromaticity without polling the provider.
 	*/
-	runtimeState: ColorStatusSchema
+	runtimeState: ColorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/connection-test.cap.ts
@@ -21222,7 +21507,17 @@ var connectivityCapability = {
 		schema: ConnectivityStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ConnectivityStatusSchema
+	runtimeState: ConnectivityStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/consumables.cap.ts
@@ -21306,7 +21601,14 @@ reset: require_sleep.method(zod.z.object({
 			}
 		}
 	},
-	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() })
+	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() }),
+	/**
+	* Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/contact.cap.ts
@@ -21339,7 +21641,17 @@ var contactCapability = {
 		schema: ContactStatusSchema,
 		kind: "push"
 	},
-	runtimeState: ContactStatusSchema
+	runtimeState: ContactStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a door left open across a restart must still read open.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/control.cap.ts
@@ -21471,7 +21783,14 @@ var controlCapability = {
 	* dropdown / text field / date picker) read the slice's discriminant
 	* and value directly without polling the provider.
 	*/
-	runtimeState: ControlStatusSchema
+	runtimeState: ControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/cover.cap.ts
@@ -21556,7 +21875,17 @@ var coverCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch
 	* the slice for live position changes during a move.
 	*/
-	runtimeState: CoverStatusSchema
+	runtimeState: CoverStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/day-night.cap.ts
@@ -21652,7 +21981,17 @@ var dayNightCapability = {
 		schema: DayNightStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: DayNightStatusSchema
+	runtimeState: DayNightStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/device-status.cap.ts
@@ -21701,7 +22040,17 @@ onStatusChanged: { data: zod.z.object({
 		schema: DeviceStatusSchema,
 		kind: "push"
 	},
-	runtimeState: DeviceStatusSchema
+	runtimeState: DeviceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/doorbell.cap.ts
@@ -21765,7 +22114,14 @@ onPressed: { data: DoorbellPressEventSchema } },
 	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
 	* without subscribing.
 	*/
-	runtimeState: DoorbellStatusSchema
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 //#endregion
 //#region src/capabilities/enum-sensor.cap.ts
@@ -21807,7 +22163,17 @@ var enumSensorCapability = {
 		schema: EnumSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EnumSensorStatusSchema
+	runtimeState: EnumSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/event-emitter.cap.ts
@@ -21845,7 +22211,14 @@ var eventEmitterCapability = {
 		schema: EventEmitterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: EventEmitterStatusSchema
+	runtimeState: EventEmitterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/events.cap.ts
@@ -22168,7 +22541,14 @@ var fanControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI fan speed
 	* sliders read `percentage` for live updates.
 	*/
-	runtimeState: FanControlStatusSchema
+	runtimeState: FanControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/feature-probe.cap.ts
@@ -22246,7 +22626,14 @@ onProbeChanged: { data: zod.z.object({
 		schema: FeatureProbeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FeatureProbeStatusSchema
+	runtimeState: FeatureProbeStatusSchema,
+	/**
+	* Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/flood.cap.ts
@@ -22275,7 +22662,17 @@ var floodCapability = {
 		schema: FloodStatusSchema,
 		kind: "push"
 	},
-	runtimeState: FloodStatusSchema
+	runtimeState: FloodStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/gas.cap.ts
@@ -22300,7 +22697,17 @@ var gasCapability = {
 		schema: GasStatusSchema,
 		kind: "push"
 	},
-	runtimeState: GasStatusSchema
+	runtimeState: GasStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/humidifier.cap.ts
@@ -22378,7 +22785,14 @@ var humidifierCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live humidity / mode changes.
 	*/
-	runtimeState: HumidifierStatusSchema
+	runtimeState: HumidifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/humidity-sensor.cap.ts
@@ -22416,7 +22830,17 @@ var humiditySensorCapability = {
 		schema: HumiditySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: HumiditySensorStatusSchema
+	runtimeState: HumiditySensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/image.cap.ts
@@ -22456,7 +22880,14 @@ var imageCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads `url`
 	* directly and renders the still image.
 	*/
-	runtimeState: ImageStatusSchema
+	runtimeState: ImageStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/image-settings.cap.ts
@@ -22607,7 +23038,17 @@ var imageSettingsCapability = {
 		schema: ImageSettingsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: ImageSettingsStatusSchema
+	runtimeState: ImageSettingsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/integrations.cap.ts
@@ -23022,7 +23463,14 @@ var lawnMowerControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live activity + battery changes.
 	*/
-	runtimeState: LawnMowerControlStatusSchema
+	runtimeState: LawnMowerControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `vacuum-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/local-network.cap.ts
@@ -23329,7 +23777,17 @@ var lockControlCapability = {
 	* read `state` and disable themselves during `locking`/`unlocking`
 	* transitions.
 	*/
-	runtimeState: LockControlStatusSchema
+	runtimeState: LockControlStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a lock left locked must still read locked.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/media-player.cap.ts
@@ -23493,7 +23951,14 @@ var mediaPlayerCapability = {
 	* full slice for live now-playing, volume, and progress updates
 	* without polling.
 	*/
-	runtimeState: MediaPlayerStatusSchema
+	runtimeState: MediaPlayerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/mesh-network.cap.ts
@@ -23822,7 +24287,14 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	* `device.state.motion.value`. Reads never invoke the provider, so
 	* UIs and other addons can poll the cached state safely.
 	*/
-	runtimeState: MotionStatusSchema
+	runtimeState: MotionStatusSchema,
+	/**
+	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/motion-trigger.cap.ts
@@ -23889,7 +24361,14 @@ var motionTriggerCapability = {
 		schema: MotionTriggerStatusSchema,
 		kind: "command-driven"
 	},
-	runtimeState: MotionTriggerRuntimeStateSchema
+	runtimeState: MotionTriggerRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/motion-zones.cap.ts
@@ -23958,7 +24437,17 @@ var motionZonesCapability = {
 		schema: MotionZoneStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: MotionZoneStatusSchema
+	runtimeState: MotionZoneStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/native-object-detection.cap.ts
@@ -24034,7 +24523,17 @@ var nativeObjectDetectionCapability = {
 		schema: NativeObjectDetectionStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NativeObjectDetectionRuntimeStateSchema
+	runtimeState: NativeObjectDetectionRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/network-quality.cap.ts
@@ -24427,7 +24926,14 @@ onSent: { data: zod.z.object({
 	* form reads `supports` to gate optional fields; history pane reads
 	* `lastSentAt` / `lastError` / `queueDepth`.
 	*/
-	runtimeState: NotifierStatusSchema
+	runtimeState: NotifierStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/numeric-sensor.cap.ts
@@ -24472,7 +24978,17 @@ var numericSensorCapability = {
 		schema: NumericSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: NumericSensorStatusSchema
+	runtimeState: NumericSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/osd.cap.ts
@@ -24989,7 +25505,14 @@ var petFeederCapability = {
 	* the full slice via `device.state.petFeeder.value` and refresh on
 	* every poll without re-querying the provider.
 	*/
-	runtimeState: PetFeederStatusSchema
+	runtimeState: PetFeederStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/plate-gallery.cap.ts
@@ -25352,7 +25875,17 @@ var powerMeterCapability = {
 		schema: PowerMeterStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PowerMeterStatusSchema
+	runtimeState: PowerMeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/presence.cap.ts
@@ -25411,7 +25944,17 @@ var presenceCapability = {
 	* the map pin is rendered (use `DeviceFeature.PresenceGps` for the
 	* pre-fetch fast-path check).
 	*/
-	runtimeState: PresenceStatusSchema
+	runtimeState: PresenceStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/pressure-sensor.cap.ts
@@ -25449,7 +25992,17 @@ var pressureSensorCapability = {
 		schema: PressureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: PressureSensorStatusSchema
+	runtimeState: PressureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/privacy-mask.cap.ts
@@ -25581,7 +26134,17 @@ var privacyMaskCapability = {
 		schema: PrivacyMaskStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: PrivacyMaskStatusSchema
+	runtimeState: PrivacyMaskStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 /**
 * Collapse a camera's PER-PROFILE audio flags into the one answer
@@ -25848,7 +26411,14 @@ var ptzAutotrackCapability = {
 	* fetch / cache / fallback logic out of the four cap methods —
 	* they become trampolines over `runtimeState`.
 	*/
-	runtimeState: PtzAutotrackRuntimeStateSchema
+	runtimeState: PtzAutotrackRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/reboot.cap.ts
@@ -26693,7 +27263,14 @@ var sceneMonitorCapability = {
 		schema: SceneMonitorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SceneMonitorStatusSchema
+	runtimeState: SceneMonitorStatusSchema,
+	/**
+	* Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/schemas/zone-rule.ts
@@ -26845,7 +27422,14 @@ var scriptRunnerCapability = {
 	* `isRunning` to render a spinner during execution and surfaces
 	* `lastError` / `lastRunSuccess` in the recent-runs panel.
 	*/
-	runtimeState: ScriptRunnerStatusSchema
+	runtimeState: ScriptRunnerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/smoke.cap.ts
@@ -26874,7 +27458,17 @@ var smokeCapability = {
 		schema: SmokeStatusSchema,
 		kind: "push"
 	},
-	runtimeState: SmokeStatusSchema
+	runtimeState: SmokeStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/stream-catalog.cap.ts
@@ -27064,7 +27658,17 @@ var streamParamsCapability = {
 		schema: StreamParamsStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: StreamParamsStatusSchema
+	runtimeState: StreamParamsStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/stream-params-config-schema.ts
@@ -27371,6 +27975,16 @@ var switchCapability = {
 	* not need to re-query the provider after a setState mutation.
 	*/
 	runtimeState: SwitchStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"],
 	settings: { bindings: [{
 		kind: "scalar",
 		statusPath: "on",
@@ -27469,7 +28083,17 @@ var tamperCapability = {
 		schema: TamperStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TamperStatusSchema
+	runtimeState: TamperStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/temperature-sensor.cap.ts
@@ -27516,7 +28140,17 @@ var temperatureSensorCapability = {
 		schema: TemperatureSensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: TemperatureSensorStatusSchema
+	runtimeState: TemperatureSensorStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
 };
 //#endregion
 //#region src/capabilities/toast.cap.ts
@@ -27596,7 +28230,14 @@ var updateCapability = {
 		schema: UpdateStatusSchema,
 		kind: "poll"
 	},
-	runtimeState: UpdateStatusSchema
+	runtimeState: UpdateStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/user-management.cap.ts
@@ -27976,7 +28617,14 @@ var vacuumControlCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live state + battery + fan-speed changes.
 	*/
-	runtimeState: VacuumControlStatusSchema
+	runtimeState: VacuumControlStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/valve.cap.ts
@@ -28048,7 +28696,14 @@ var valveCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live position changes during a move.
 	*/
-	runtimeState: ValveStatusSchema
+	runtimeState: ValveStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `brightness`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/vibration.cap.ts
@@ -28072,7 +28727,17 @@ var vibrationCapability = {
 		schema: VibrationStatusSchema,
 		kind: "push"
 	},
-	runtimeState: VibrationStatusSchema
+	runtimeState: VibrationStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — as `smoke`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
 //#region src/capabilities/water-heater.cap.ts
@@ -28148,7 +28813,14 @@ var waterHeaterCapability = {
 	* Runtime-state slice — mirrored by the kernel. UI controls watch the
 	* slice for live temperature / mode / away changes.
 	*/
-	runtimeState: WaterHeaterStatusSchema
+	runtimeState: WaterHeaterStatusSchema,
+	/**
+	* Runtime-state durability: **session** — as `climate-control`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/weather.cap.ts
@@ -28209,7 +28881,14 @@ var weatherCapability = {
 	* Runtime-state slice — mirrored by the kernel. The UI reads the
 	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: WeatherStatusSchema
+	runtimeState: WeatherStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/zone-analytics.cap.ts
@@ -28373,7 +29052,14 @@ var zoneAnalyticsCapability = {
 	* automatically; the explicit `getCurrentSnapshot` cap method is
 	* still useful for one-off polls without a subscription.
 	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
 };
 //#endregion
 //#region src/capabilities/zone-rules.cap.ts
@@ -28453,7 +29139,14 @@ var zoneRulesCapability = {
 		motion: zod.z.array(ZoneRuleSchema).readonly(),
 		detection: zod.z.array(ZoneRuleSchema).readonly(),
 		package: zod.z.array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 //#endregion
 //#region src/capabilities/index.ts
@@ -31047,11 +31740,40 @@ var SystemMirror = class {
 			cb(deviceId, lastInfo);
 		} catch {}
 	}
+	/**
+	* ONE device's bindings, not the fleet's.
+	*
+	* This runs on every `capability.binding-changed` AND on every
+	* `device.registered`, per mirror. It used to answer that with
+	* `getAllBindings` and `.find()` the one row — measured on the live
+	* hub (524 devices): 903 ms and 373 KB per call, against 21 ms and
+	* 613 bytes for `getBindings({deviceId})`.
+	*
+	* Adopting 20 Home Assistant devices registers 166 devices (parents +
+	* accessories), so an operator with the admin UI open bought 166
+	* full-fleet binding sweeps: ~150 s of hub main-thread time inside a
+	* 219 s adoption, with every other RPC — including the adoption's own —
+	* queued behind them. Same defect, same fix, as `refreshDeviceMetadata`
+	* below (`listAll` → `getDevice`).
+	*
+	* Removal is the destructive direction (every proxy handle a consumer
+	* holds goes inert), and an EMPTY binding list is not a claim that the
+	* device is gone — a device can legitimately bind nothing. So it needs
+	* a second read to agree (D49); `device.unregistered` remains the
+	* primary removal path.
+	*/
 	async refreshBinding(deviceId) {
 		try {
-			const fresh = (await this.api.deviceManager.getAllBindings.query({})).find((b) => b.deviceId === deviceId);
-			if (fresh) this.bindings.set(deviceId, fresh);
-			else this.applyDeviceRemoval(deviceId);
+			const fresh = await this.api.deviceManager.getBindings.query({ deviceId });
+			if (fresh.entries.length > 0) {
+				this.bindings.set(deviceId, fresh);
+				return;
+			}
+			if (await this.api.deviceManager.getDevice.query({ deviceId }) === null) {
+				this.applyDeviceRemoval(deviceId);
+				return;
+			}
+			this.bindings.set(deviceId, fresh);
 		} catch {}
 	}
 	async refreshDeviceMetadata(deviceId, kind) {
@@ -38071,6 +38793,320 @@ function getCapsByProviderKind(kind) {
 	return out;
 }
 //#endregion
+//#region src/generated/runtime-state-durability.ts
+/**
+* Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
+* `runtimeState`. 62 caps: 33 `restored`, 29 `session`.
+*
+* A cap absent from this map has no runtime-state slice at all. A cap PRESENT
+* with `durability: 'session'` has one and has decided not to keep it.
+*/
+var RUNTIME_STATE_POLICY = {
+	"air-quality-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"alarm-panel": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"ambient-light-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"audio-metrics": {
+		durability: "session",
+		volatileFields: []
+	},
+	"automation-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"battery": {
+		durability: "restored",
+		volatileFields: ["lastUpdated"]
+	},
+	"binary": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"brightness": {
+		durability: "session",
+		volatileFields: []
+	},
+	"camera-streams": {
+		durability: "session",
+		volatileFields: []
+	},
+	"carbon-monoxide": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"climate-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"color": {
+		durability: "session",
+		volatileFields: []
+	},
+	"connectivity": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"consumables": {
+		durability: "session",
+		volatileFields: []
+	},
+	"contact": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"cover": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"day-night": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"device-discovery": {
+		durability: "session",
+		volatileFields: []
+	},
+	"device-status": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"doorbell": {
+		durability: "restored",
+		volatileFields: []
+	},
+	"enum-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"event-emitter": {
+		durability: "session",
+		volatileFields: []
+	},
+	"fan-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"feature-probe": {
+		durability: "session",
+		volatileFields: []
+	},
+	"flood": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"gas": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"humidifier": {
+		durability: "session",
+		volatileFields: []
+	},
+	"humidity-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"image": {
+		durability: "session",
+		volatileFields: []
+	},
+	"image-settings": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"lawn-mower-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"lock-control": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"media-player": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion-trigger": {
+		durability: "session",
+		volatileFields: []
+	},
+	"motion-zones": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"native-object-detection": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"notifier": {
+		durability: "session",
+		volatileFields: []
+	},
+	"numeric-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"pet-feeder": {
+		durability: "session",
+		volatileFields: []
+	},
+	"power-meter": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"presence": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"pressure-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"privacy-mask": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"ptz-autotrack": {
+		durability: "session",
+		volatileFields: []
+	},
+	"scene-monitor": {
+		durability: "session",
+		volatileFields: []
+	},
+	"script-runner": {
+		durability: "session",
+		volatileFields: []
+	},
+	"smoke": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"stream-params": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"switch": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"tamper": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"temperature-sensor": {
+		durability: "restored",
+		volatileFields: ["lastFetchedAt"]
+	},
+	"update": {
+		durability: "session",
+		volatileFields: []
+	},
+	"vacuum-control": {
+		durability: "session",
+		volatileFields: []
+	},
+	"valve": {
+		durability: "session",
+		volatileFields: []
+	},
+	"vibration": {
+		durability: "restored",
+		volatileFields: ["lastChangedAt"]
+	},
+	"water-heater": {
+		durability: "session",
+		volatileFields: []
+	},
+	"weather": {
+		durability: "session",
+		volatileFields: []
+	},
+	"zone-analytics": {
+		durability: "session",
+		volatileFields: []
+	},
+	"zone-rules": {
+		durability: "restored",
+		volatileFields: []
+	},
+	"zones": {
+		durability: "restored",
+		volatileFields: []
+	}
+};
+/**
+* The policy for `capName`. An UNKNOWN cap resolves to `'session'` — an
+* addon-private slice the codegen has never seen is not persisted until its
+* capability says so, which is the safe direction: the cost of a lost session
+* value is a cold window, the cost of an unasked-for persist is a commit per
+* second on the fleet's busiest write path.
+*/
+function runtimeStatePolicyFor(capName) {
+	return RUNTIME_STATE_POLICY[capName] ?? SESSION_ONLY_POLICY;
+}
+/** Shared fallback instance — see {@link runtimeStatePolicyFor}. */
+var SESSION_ONLY_POLICY = {
+	durability: "session",
+	volatileFields: []
+};
+/** True when this cap's slice is written to disk. */
+function isRestoredCap(capName) {
+	return runtimeStatePolicyFor(capName).durability === "restored";
+}
+/** Cap names whose slice survives a restart, sorted. */
+var RESTORED_CAP_NAMES = [
+	"air-quality-sensor",
+	"alarm-panel",
+	"ambient-light-sensor",
+	"battery",
+	"binary",
+	"carbon-monoxide",
+	"connectivity",
+	"contact",
+	"cover",
+	"day-night",
+	"device-status",
+	"doorbell",
+	"enum-sensor",
+	"flood",
+	"gas",
+	"humidity-sensor",
+	"image-settings",
+	"lock-control",
+	"motion-zones",
+	"native-object-detection",
+	"numeric-sensor",
+	"power-meter",
+	"presence",
+	"pressure-sensor",
+	"privacy-mask",
+	"smoke",
+	"stream-params",
+	"switch",
+	"tamper",
+	"temperature-sensor",
+	"vibration",
+	"zone-rules",
+	"zones"
+];
+//#endregion
 //#region src/generated/scope-presets.ts
 var SCOPE_PRESETS = [
 	{
@@ -38733,11 +39769,197 @@ function createSystemProxy(api) {
 	};
 }
 //#endregion
+//#region src/notification/audio-condition.ts
+/**
+* audio-condition — the authoring logic behind the sustained-sound condition
+* (`NcConditions.audio`), pure and UI-framework-free.
+*
+* WHY IT LIVES HERE
+* ─────────────────
+* Same reason as `condition-taxonomy.ts` next door: two editors author this
+* condition (the admin UI and the viewer), the vocabulary it offers is already
+* in this package (`AUDIO_MACRO_LABELS`), and a second copy of "what a cleared
+* threshold writes" is a mirror free to drift. The viewer keeps its own copy
+* because it is a separate app with its own toolchain; every surface that CAN
+* import `@camstack/types` uses this one.
+*
+* Four behaviours here are not cosmetic:
+*
+*  1. **dBFS is negative-going.** `0` is full scale; digital silence reads
+*     {@link NC_AUDIO_DBFS_FLOOR}. A control that let an operator author `60`
+*     meaning "loud" would write a threshold no sample can reach, and the rule
+*     would look broken rather than mis-configured. Every write is clamped.
+*  2. **Neither filter given = the engine REFUSES.** With no level floor and no
+*     labels every sample is trivially a hit, so the window would fire on
+*     silence. {@link audioIsFailClosed} is how an editor says that BEFORE the
+*     save instead of shipping a rule that never notifies and never says why.
+*  3. **Both label spellings are the same label.** The hub's taxonomy serves
+*     `audio-dog`; the macro catalog and an operator both say `dog`, and the
+*     matcher normalizes the prefix away on both sides. Selection therefore
+*     compares NORMALIZED ids — a rule authored in the admin UI must not read
+*     as "nothing selected" on the phone.
+*  4. **A stored label the build does not know stays visible.** It is offered
+*     as an explicitly-unknown, removable choice, never silently dropped:
+*     rewriting the rule the operator is looking at is worse than showing a
+*     stale id.
+*/
+/** The `audio-` namespace the NC taxonomy uses for these same macro ids. */
+var AUDIO_KIND_PREFIX = "audio-";
+/** Strip the taxonomy's `audio-` namespace: `audio-dog` and `dog` are one label. */
+function normalizeAudioLabel(value) {
+	return value.startsWith(AUDIO_KIND_PREFIX) ? value.slice(6) : value;
+}
+/** Level bounds, in dBFS. Negative-going: the ceiling is full scale. */
+var NC_AUDIO_DB_MIN = -96;
+var NC_AUDIO_DB_MAX = 0;
+/** Step of the level control — 3 dB is one perceptual notch, not one unit. */
+var NC_AUDIO_DB_STEP = 3;
+/**
+* Offered when the operator turns the level filter ON. NOT a schema default:
+* an absent `dbThreshold` means "any level" and stays absent until asked for,
+* and a stepper seeded at the -96 floor would need thirty taps to reach a
+* threshold that can actually fire.
+*/
+var NC_AUDIO_DB_OFFERED = -30;
+var NC_AUDIO_HIT_PERCENT_MIN = 1;
+var NC_AUDIO_HIT_PERCENT_MAX = 100;
+var NC_AUDIO_SAMPLING_MIN_SEC = 1;
+var NC_AUDIO_SAMPLING_MAX_SEC = 300;
+/** Schema defaults — an untouched sub-field must author exactly these. */
+var NC_AUDIO_DEFAULTS = {
+	hitPercent: 60,
+	samplingSeconds: 10
+};
+/** What an editor SHOWS for an unset condition — without authoring it. */
+function audioOrDefaults(value) {
+	return value ?? NC_AUDIO_DEFAULTS;
+}
+/**
+* True when the condition names NEITHER a level floor NOR any label. The engine
+* refuses such a rule (every sample is a hit, so the window fires on silence) —
+* an editor warns instead of letting the operator ship a rule that never
+* notifies and says nothing about why.
+*
+* An ABSENT condition is not flagged: a rule with no `audio` key is not an
+* audio rule at all.
+*/
+function audioIsFailClosed(value) {
+	if (value === void 0) return false;
+	return value.dbThreshold === void 0 && (value.labels === void 0 || value.labels.length === 0);
+}
+function clampInt(value, min, max) {
+	if (!Number.isFinite(value)) return min;
+	return Math.min(max, Math.max(min, Math.round(value)));
+}
+function has(patch, key) {
+	return Object.prototype.hasOwnProperty.call(patch, key);
+}
+/**
+* Apply a sub-field edit, seeding from the defaults when nothing is stored yet.
+* The result is always in-bounds for `NcAudioConditionSchema`, and a cleared
+* filter is OMITTED rather than written as an explicit `undefined` (which
+* survives a merge patch as a deliberate erase and reads as authored).
+*/
+function patchAudio(current, patch) {
+	const base = audioOrDefaults(current);
+	const labels = has(patch, "labels") ? patch.labels : base.labels;
+	const dbThreshold = has(patch, "dbThreshold") ? patch.dbThreshold : base.dbThreshold;
+	return {
+		...labels !== void 0 && labels.length > 0 ? { labels: [...labels] } : {},
+		...dbThreshold !== void 0 ? { dbThreshold: clampInt(dbThreshold, NC_AUDIO_DB_MIN, 0) } : {},
+		hitPercent: clampInt(patch.hitPercent ?? base.hitPercent, 1, 100),
+		samplingSeconds: clampInt(patch.samplingSeconds ?? base.samplingSeconds, 1, 300)
+	};
+}
+/** The icon glyph for a stored label the catalogue does not know. */
+var UNKNOWN_LABEL_ICON = "🔈";
+var ICON_BY_ID = new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
+/**
+* The label choices: the hub's `audioKinds` when it serves them (its WORDS, the
+* local EMOJI, keyed by the normalized id), else the local macro catalog — plus
+* any stored label neither side knows, marked unknown.
+*
+* The hub's list wins on membership because it knows which macros this cluster
+* actually classifies; the icons stay local because the taxonomy carries none.
+*/
+function audioLabelChoices(taxonomy, selected) {
+	const fromHub = taxonomy?.audioKinds ?? [];
+	const choices = fromHub.length > 0 ? fromHub.map((entry) => {
+		const id = normalizeAudioLabel(entry.kind);
+		return {
+			value: id,
+			label: entry.label,
+			icon: ICON_BY_ID.get(id) ?? UNKNOWN_LABEL_ICON,
+			unknown: false
+		};
+	}) : AUDIO_MACRO_LABELS.map((macro) => ({
+		value: macro.id,
+		label: macro.name,
+		icon: macro.icon ?? UNKNOWN_LABEL_ICON,
+		unknown: false
+	}));
+	const known = new Set(choices.map((choice) => choice.value));
+	const unknownLabels = [];
+	for (const stored of selected ?? []) {
+		const id = normalizeAudioLabel(stored);
+		if (known.has(id) || unknownLabels.includes(id)) continue;
+		unknownLabels.push(id);
+		choices.push({
+			value: id,
+			label: id,
+			icon: UNKNOWN_LABEL_ICON,
+			unknown: true
+		});
+	}
+	return {
+		choices,
+		unknownLabels
+	};
+}
+/**
+* Is this macro id selected? Compares NORMALIZED ids, so a rule authored with
+* the taxonomy spelling (`audio-dog`) reads as selected here.
+*/
+function isAudioLabelSelected(labels, id) {
+	const wanted = normalizeAudioLabel(id);
+	return (labels ?? []).some((stored) => normalizeAudioLabel(stored) === wanted);
+}
+/**
+* Toggle one macro id. Removing drops EVERY stored spelling of it; adding
+* appends the bare macro id. Returns `undefined` when the last label goes — the
+* field is optional and absent means "any sound", never an empty array (which
+* `NcAudioConditionSchema` rejects outright).
+*/
+function toggleAudioLabel(labels, id) {
+	const wanted = normalizeAudioLabel(id);
+	const current = labels ?? [];
+	if (isAudioLabelSelected(current, wanted)) {
+		const next = current.filter((stored) => normalizeAudioLabel(stored) !== wanted);
+		return next.length > 0 ? next : void 0;
+	}
+	return [...current, wanted];
+}
+//#endregion
 //#region src/notification/condition-taxonomy.ts
 /** Condition ids that render the class picker (video macros/subs + audio). */
 var CLASS_CONDITION_IDS = new Set(["classes", "classesExclude"]);
 /** Condition ids that render the sensor/control label picker. */
 var LABEL_CONDITION_IDS = new Set(["sensorKinds"]);
+/**
+* Condition ids whose class scope is a COUNT, not a match — they get the
+* MACRO-ONLY vocabulary.
+*
+* Every other class condition goes through the engine's `expandClassSelector`,
+* which expands a macro to its subs and matches a sub against the detection's
+* own class. Occupancy does not: it reads `byClass[className]` out of the
+* ZoneAnalytics snapshot, and that record is keyed on MACROS only (the executor
+* maps COCO onto the macro and drops the rest). A sub-type therefore names a key
+* that does not exist — the counter is 0 forever and the rule cannot fire.
+*
+* Live cost, 2026-08-12: two rules on device 617 were authored with `car`
+* because this picker offered the whole taxonomy. They were silent for a day.
+*/
+var COUNT_CLASS_CONDITION_IDS = new Set(["occupancy"]);
 function toOption(entry) {
 	return {
 		value: entry.kind,
@@ -38815,6 +40037,14 @@ function pickerForCondition(conditionId, taxonomy) {
 		});
 		return groups.length > 0 ? { groups } : null;
 	}
+	if (COUNT_CLASS_CONDITION_IDS.has(conditionId)) {
+		const options = taxonomy.videoClasses.filter((e) => e.parentKind === null).map(toOption);
+		return options.length > 0 ? { groups: [{
+			key: "macro",
+			fallbackLabel: "Classes",
+			options
+		}] } : null;
+	}
 	if (LABEL_CONDITION_IDS.has(conditionId)) {
 		const groups = groupLabels(taxonomy.labels);
 		return groups.length > 0 ? { groups } : null;
@@ -41410,12 +42640,14 @@ exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
 exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
+exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
 exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
 exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
 exports.DETAIL_CROP_SECTION_ID = DETAIL_CROP_SECTION_ID;
 exports.DETAIL_CROP_SQUARE_KEY = DETAIL_CROP_SQUARE_KEY;
+exports.DETECTION_MACRO_CLASSES = DETECTION_MACRO_CLASSES;
 exports.DETECTION_PIPELINE_CAP_NAME = DETECTION_PIPELINE_CAP_NAME;
 exports.DEVICE_BACKEND_TO_FORMAT = DEVICE_BACKEND_TO_FORMAT;
 exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
@@ -41659,6 +42891,15 @@ exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
 exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
 exports.NC_ALARM_SYSTEM_EVENT_KINDS = NC_ALARM_SYSTEM_EVENT_KINDS;
 exports.NC_AUDIO_DBFS_FLOOR = NC_AUDIO_DBFS_FLOOR;
+exports.NC_AUDIO_DB_MAX = NC_AUDIO_DB_MAX;
+exports.NC_AUDIO_DB_MIN = NC_AUDIO_DB_MIN;
+exports.NC_AUDIO_DB_OFFERED = NC_AUDIO_DB_OFFERED;
+exports.NC_AUDIO_DB_STEP = NC_AUDIO_DB_STEP;
+exports.NC_AUDIO_DEFAULTS = NC_AUDIO_DEFAULTS;
+exports.NC_AUDIO_HIT_PERCENT_MAX = NC_AUDIO_HIT_PERCENT_MAX;
+exports.NC_AUDIO_HIT_PERCENT_MIN = NC_AUDIO_HIT_PERCENT_MIN;
+exports.NC_AUDIO_SAMPLING_MAX_SEC = NC_AUDIO_SAMPLING_MAX_SEC;
+exports.NC_AUDIO_SAMPLING_MIN_SEC = NC_AUDIO_SAMPLING_MIN_SEC;
 exports.NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NC_AUTHORABLE_SYSTEM_EVENT_KINDS;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
@@ -41666,6 +42907,7 @@ exports.NC_CONFIRM_DEFAULT_MAX_IMAGE_PX = NC_CONFIRM_DEFAULT_MAX_IMAGE_PX;
 exports.NC_CONFIRM_DEFAULT_TIMEOUT_MS = NC_CONFIRM_DEFAULT_TIMEOUT_MS;
 exports.NC_CONFIRM_MAX_TIMEOUT_MS = NC_CONFIRM_MAX_TIMEOUT_MS;
 exports.NC_CONFIRM_MIN_TIMEOUT_MS = NC_CONFIRM_MIN_TIMEOUT_MS;
+exports.NC_DEFAULT_SNOOZE_MINUTES = NC_DEFAULT_SNOOZE_MINUTES;
 exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
 exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
 exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
@@ -41812,7 +43054,9 @@ exports.REACHABILITY_PROBE_TIMEOUT_MS = REACHABILITY_PROBE_TIMEOUT_MS;
 exports.RECOGNITION_TYPES = RECOGNITION_TYPES;
 exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
 exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
+exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
 exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
+exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
 exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
 exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
 exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
@@ -42084,7 +43328,10 @@ exports.assertTimelapseCadences = assertTimelapseCadences;
 exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
+exports.audioIsFailClosed = audioIsFailClosed;
+exports.audioLabelChoices = audioLabelChoices;
 exports.audioMetricsCapability = audioMetricsCapability;
+exports.audioOrDefaults = audioOrDefaults;
 exports.audioPlanFromEncodeProfile = require_canonical_hash.audioPlanFromEncodeProfile;
 exports.authProviderCapability = authProviderCapability;
 exports.autoAssignProfiles = autoAssignProfiles;
@@ -42222,15 +43469,18 @@ exports.intercomCapability = intercomCapability;
 exports.invocationFromEncodeProfile = require_canonical_hash.invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
+exports.isAudioLabelSelected = isAudioLabelSelected;
 exports.isBaseConditionKey = isBaseConditionKey;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
 exports.isDeployableToAgent = isDeployableToAgent;
+exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
 exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
+exports.isRestoredCap = isRestoredCap;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
 exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
@@ -42279,6 +43529,7 @@ exports.networkQualityCapability = networkQualityCapability;
 exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
+exports.normalizeAudioLabel = normalizeAudioLabel;
 exports.normalizeUnit = normalizeUnit;
 exports.notificationOutputCapability = notificationOutputCapability;
 exports.notificationRulesCapability = notificationRulesCapability;
@@ -42295,6 +43546,7 @@ exports.parseJsonObject = require_sleep.parseJsonObject;
 exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
 exports.parseProfileBrokerId = require_sleep.parseProfileBrokerId;
 exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
+exports.patchAudio = patchAudio;
 exports.petFeederCapability = petFeederCapability;
 exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickDetailCropConvention = pickDetailCropConvention;
@@ -42347,6 +43599,7 @@ exports.resolveScrubThumbnailGeometry = resolveScrubThumbnailGeometry;
 exports.resolveVariantModelId = resolveVariantModelId;
 exports.runInferenceStep = runInferenceStep;
 exports.runtimeDevices = runtimeDevices;
+exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
 exports.sceneMonitorCapability = sceneMonitorCapability;
 exports.scopeKey = require_sleep.scopeKey;
 exports.scopesAllowAddon = scopesAllowAddon;
@@ -42393,6 +43646,7 @@ exports.toExpressionValue = toExpressionValue;
 exports.toNodeId = require_sleep.toNodeId;
 exports.toStreamSourceEntry = toStreamSourceEntry;
 exports.toastCapability = toastCapability;
+exports.toggleAudioLabel = toggleAudioLabel;
 exports.tokenize = tokenize;
 exports.transcodeBody = transcodeBody;
 exports.tryConvertUnit = tryConvertUnit;