camstack 1.2.22 → 1.2.24

package/dist/{chunk-2OGTDEYC.js → chunk-XWIQP3BN.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-BxjBLp3L.mjs
+// ../types/dist/sleep-CSgK0rNX.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -18749,7 +18749,14 @@ var cameraStreamsCapability = {
       low: external_exports.string().optional()
     }),
     lastChangedAt: external_exports.number()
-  })
+  }),
+  /**
+  * Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var CoreBlockPlacementSchema = external_exports.union([external_exports.literal("hub"), external_exports.string().min(1)]);
 var CoreBlockStatusSchema = external_exports.enum([
@@ -19323,6 +19330,13 @@ var deviceDiscoveryCapability = {
     kind: "poll"
   },
   runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: external_exports.number().int().nonnegative() }),
+  /**
+  * Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session",
   methods: {
     /**
     * Snapshot of the current `discovered` list. Returns the
@@ -21551,7 +21565,23 @@ var NotificationActionSchema = external_exports.object({
   * else — see `notification-center/action-token.ts` for what that does and
   * does not buy.
   */
-  destructive: external_exports.boolean().optional()
+  destructive: external_exports.boolean().optional(),
+  /**
+  * How the tap should REACH the url.
+  *
+  * `navigate` (absent, and every button authored before this field) opens it:
+  * the phone leaves the notification and shows whatever the callback returns.
+  * That is right for a button whose answer the operator wants to read.
+  *
+  * `background` fires it as a POST and stays put. It exists for the buttons
+  * whose whole point is not to interrupt — "silence this for 30 minutes" is
+  * an answer to the notification, and being thrown into a browser tab to
+  * confirm it costs more attention than the notification did. A backend that
+  * cannot do a background call renders it as an ordinary link (the adapters
+  * fall back rather than dropping the button), so this is a preference, never
+  * a requirement.
+  */
+  mode: external_exports.enum(["navigate", "background"]).optional()
 });
 var NotificationSchema = external_exports.object({
   body: external_exports.string(),
@@ -22329,7 +22359,17 @@ var alarmPanelCapability = {
   * full slice; renders an arm button per `availableModes` entry and
   * a PIN field iff `requiresCode === true`.
   */
-  runtimeState: AlarmPanelStatusSchema
+  runtimeState: AlarmPanelStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var MaskPointSchema = external_exports.object({
   x: external_exports.number(),
@@ -22427,6 +22467,7 @@ var NcSystemEventConditionSchema = external_exports.object({
   nodeIds: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   packageNames: external_exports.array(external_exports.string().min(1)).min(1).optional()
 });
+var NC_SNOOZE_MAX_MINUTES = 1440;
 var NcScheduleWindowSchema = external_exports.object({
   /** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
   days: external_exports.array(external_exports.number().int().min(0).max(6)).min(1),
@@ -22683,15 +22724,15 @@ var NcConditionsSchema = external_exports.object({
   * (an `immediate` rule naming an `audio-*` class, one notification per
   * classified sample) stays exactly as it was for rules that already use it.
   *
-  * NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-  * rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-  * (`camstack/src/data/notification-center.ts`, guarded by
-  * `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+  * In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+  * rule rather than an accident: the viewer mirrors the descriptor enums BY
+  * HAND (`camstack/src/data/notification-center.ts`, guarded by
+  * `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
   * condition fields it does not know when a rule is saved from the phone.
   * Publishing an editor for a condition the app cannot round-trip is how an
-  * operator loses a rule's conditions by opening it — so the descriptor, the
-  * admin widget and the viewer mirror land together (P2 + P3), and only then
-  * does an audio rule become authorable.
+  * operator loses a rule's conditions by opening it — so the viewer mirror
+  * (P3, shipped) went FIRST, and the descriptor an editor renders from
+  * follows here.
   */
   audio: NcAudioConditionSchema.optional()
 });
@@ -22860,6 +22901,30 @@ var NcRuleInputSchema = external_exports.object({
   */
   snoozeAllowGlobal: external_exports.boolean().optional(),
   /**
+  * The snooze durations THIS rule's notification offers as buttons, in
+  * minutes.
+  *
+  * Three states, and all three are distinct — which is exactly why this is
+  * `.optional()` and never `.default()`. A Zod default does not run on the
+  * addon cap path (three production failures in one day), so a schema default
+  * would collapse the first two:
+  *
+  * | value | meaning |
+  * | --- | --- |
+  * | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+  * | `[]` | **no snooze buttons on this rule** — the explicit override |
+  * | a list | these choices, de-duplicated and sorted, at most four |
+  *
+  * `.max(4)` because the notifier's own action budget is small (ntfy allows
+  * three buttons in total) and a rule that spent it all on snooze choices
+  * would push its own tap-through actions off the notification.
+  *
+  * An empty list is NOT an alarm exemption: a rule the alarm is about, or
+  * that arms the panel, is exempt automatically and cannot be silenced by a
+  * window from anywhere (D133).
+  */
+  snoozeOptions: external_exports.array(external_exports.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+  /**
   * Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
   *
   * This is what makes the rule set the alarm's trigger set without the alarm
@@ -22949,6 +23014,7 @@ var NcConditionDescriptorSchema = external_exports.object({
     "device",
     "package",
     "occupancy",
+    "audio",
     "system"
   ]),
   label: external_exports.string(),
@@ -22967,6 +23033,7 @@ var NcConditionDescriptorSchema = external_exports.object({
     "crossingSelect",
     "polygonDraw",
     "occupancy",
+    "audio",
     "deviceState",
     "systemEvent"
   ]),
@@ -23070,7 +23137,6 @@ var NcSnoozeScopeSchema = external_exports.enum([
   "device",
   "all"
 ]);
-var NC_SNOOZE_MAX_MINUTES = 1440;
 var NcSnoozeInputSchema = external_exports.object({
   scope: NcSnoozeScopeSchema,
   /** Required when `scope: 'rule'` — a scoped snooze with no id matches
@@ -23078,6 +23144,19 @@ var NcSnoozeInputSchema = external_exports.object({
   ruleId: external_exports.string().optional(),
   /** Required when `scope: 'device'`. */
   deviceId: external_exports.number().int().optional(),
+  /**
+  * Narrow the window to these subject classes — "the cat, not the person".
+  *
+  * ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+  * what every window authored before this field meant, so no persisted row
+  * changes meaning and no client has to learn anything to keep working.
+  *
+  * It is what makes the window's real key `(deviceId, classes[])` and lets it
+  * cross rules (D133): the operator points at a camera and a kind of thing,
+  * not at whichever of their four rules happened to produce the notification
+  * they are dismissing.
+  */
+  classes: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   durationMinutes: external_exports.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
   /**
   * Silence this for EVERY recipient, not just the caller. Permission is
@@ -23102,6 +23181,10 @@ var NcSnoozeSchema = external_exports.object({
   scope: NcSnoozeScopeSchema,
   ruleId: external_exports.string().optional(),
   deviceId: external_exports.number().int().optional(),
+  /** Subject classes this window covers. ABSENT = every class — see
+  *  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+  *  no SQLite column: nothing queries a window by class. */
+  classes: external_exports.array(external_exports.string().min(1)).min(1).optional(),
   startedAt: external_exports.number(),
   /** Exclusive: at exactly this instant the snooze is over. Expiry is a
   *  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -25374,7 +25457,14 @@ var zonesCapability = {
   * handle. Slice shape is `{ zones: Zone[] }` so future extensions
   * (e.g. zone groupings) can sit alongside the polygon list.
   */
-  runtimeState: external_exports.object({ zones: external_exports.array(ZoneSchema).readonly() })
+  runtimeState: external_exports.object({ zones: external_exports.array(ZoneSchema).readonly() }),
+  /**
+  * Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored"
 };
 var NativeCropBboxSchema = external_exports.object({
   x: external_exports.number(),
@@ -28802,7 +28892,17 @@ var airQualitySensorCapability = {
     schema: AirQualitySensorStatusSchema,
     kind: "push"
   },
-  runtimeState: AirQualitySensorStatusSchema
+  runtimeState: AirQualitySensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var AmbientLightSensorStatusSchema = external_exports.object({
   /** Current illuminance in lux (lx). */
@@ -28830,7 +28930,17 @@ var ambientLightSensorCapability = {
     schema: AmbientLightSensorStatusSchema,
     kind: "push"
   },
-  runtimeState: AmbientLightSensorStatusSchema
+  runtimeState: AmbientLightSensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var AudioClassSummarySchema = external_exports.object({
   className: external_exports.string(),
@@ -28920,7 +29030,14 @@ var audioMetricsCapability = {
     }), AudioMetricsHistorySchema)
   },
   /** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-  runtimeState: AudioMetricsSnapshotSchema
+  runtimeState: AudioMetricsSnapshotSchema,
+  /**
+  * Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var AutomationControlStatusSchema = external_exports.object({
   /** Whether the automation is currently enabled. Disabled automations
@@ -28971,7 +29088,14 @@ var automationControlCapability = {
   * reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
   * (badge) directly.
   */
-  runtimeState: AutomationControlStatusSchema
+  runtimeState: AutomationControlStatusSchema,
+  /**
+  * Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var BatteryStatusSchema = external_exports.object({
   /** 0..100 inclusive. Firmware-reported. */
@@ -29072,7 +29196,17 @@ var batteryCapability = {
   * via `device.runtimeState.getCapState('battery')` regardless of
   * the underlying driver.
   */
-  runtimeState: BatteryStatusSchema
+  runtimeState: BatteryStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastUpdated"]
 };
 var BinaryStatusSchema = external_exports.object({
   on: external_exports.boolean(),
@@ -29090,7 +29224,17 @@ var binaryCapability = {
     schema: BinaryStatusSchema,
     kind: "push"
   },
-  runtimeState: BinaryStatusSchema
+  runtimeState: BinaryStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var BrightnessStatusSchema = external_exports.object({
   /** Current level as 0..100 inclusive. Firmware-reported. */
@@ -29132,7 +29276,14 @@ var brightnessCapability = {
   * by the kernel. Read via `device.state.brightness.value` so UI
   * sliders surface the current level without polling the provider.
   */
-  runtimeState: BrightnessStatusSchema
+  runtimeState: BrightnessStatusSchema,
+  /**
+  * Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var buttonCapability = {
   name: "button",
@@ -29212,7 +29363,17 @@ var carbonMonoxideCapability = {
     schema: CarbonMonoxideStatusSchema,
     kind: "push"
   },
-  runtimeState: CarbonMonoxideStatusSchema
+  runtimeState: CarbonMonoxideStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `smoke`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var HvacModeSchema = external_exports.enum([
   "off",
@@ -29341,7 +29502,14 @@ var climateControlCapability = {
   * the full slice via `device.state.climate-control.value` and refresh
   * on every push without re-querying the provider.
   */
-  runtimeState: ClimateControlStatusSchema
+  runtimeState: ClimateControlStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var RgbTripletSchema = external_exports.object({
   r: external_exports.number().int().min(0).max(255),
@@ -29428,7 +29596,14 @@ var colorCapability = {
   * kernel. Read via `device.state.color.value` so UI pickers surface
   * the current chromaticity without polling the provider.
   */
-  runtimeState: ColorStatusSchema
+  runtimeState: ColorStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `brightness`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var ConnectionTestOutcomeSchema = external_exports.discriminatedUnion("outcome", [
   external_exports.object({
@@ -29482,7 +29657,17 @@ var connectivityCapability = {
     schema: ConnectivityStatusSchema,
     kind: "push"
   },
-  runtimeState: ConnectivityStatusSchema
+  runtimeState: ConnectivityStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var ConsumableItemSchema = external_exports.object({
   /** Stable id, e.g. 'main-brush'. */
@@ -29549,7 +29734,14 @@ var consumablesCapability = {
       }
     }
   },
-  runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: external_exports.number() })
+  runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: external_exports.number() }),
+  /**
+  * Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var ContactStatusSchema = external_exports.object({
   /** True when the entry is open; false when closed. */
@@ -29568,7 +29760,17 @@ var contactCapability = {
     schema: ContactStatusSchema,
     kind: "push"
   },
-  runtimeState: ContactStatusSchema
+  runtimeState: ContactStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — a door left open across a restart must still read open.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var ControlKindSchema = external_exports.enum([
   "numeric",
@@ -29655,7 +29857,14 @@ var controlCapability = {
   * dropdown / text field / date picker) read the slice's discriminant
   * and value directly without polling the provider.
   */
-  runtimeState: ControlStatusSchema
+  runtimeState: ControlStatusSchema,
+  /**
+  * Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var CoverStateSchema = external_exports.enum([
   "open",
@@ -29717,7 +29926,17 @@ var coverCapability = {
   * Runtime-state slice — mirrored by the kernel. UI controls watch
   * the slice for live position changes during a move.
   */
-  runtimeState: CoverStatusSchema
+  runtimeState: CoverStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var DayNightModeSchema = external_exports.enum([
   "auto",
@@ -29778,7 +29997,17 @@ var dayNightCapability = {
     schema: DayNightStatusSchema,
     kind: "poll"
   },
-  runtimeState: DayNightStatusSchema
+  runtimeState: DayNightStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var DeviceStatusSchema = external_exports.object({
   /**
@@ -29811,7 +30040,17 @@ var deviceStatusCapability = {
     schema: DeviceStatusSchema,
     kind: "push"
   },
-  runtimeState: DeviceStatusSchema
+  runtimeState: DeviceStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var DoorbellStatusSchema = external_exports.object({
   /** Ms epoch of the last press. null = never observed since this provider started. */
@@ -29851,7 +30090,14 @@ var doorbellCapability = {
   * `device.state.doorbell.value`. UIs can show "last ring 5m ago"
   * without subscribing.
   */
-  runtimeState: DoorbellStatusSchema
+  runtimeState: DoorbellStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored"
 };
 var EnumSensorDateTimeFormatSchema = external_exports.enum([
   "date",
@@ -29881,7 +30127,17 @@ var enumSensorCapability = {
     schema: EnumSensorStatusSchema,
     kind: "push"
   },
-  runtimeState: EnumSensorStatusSchema
+  runtimeState: EnumSensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var EventFireSchema = external_exports.object({
   deviceId: external_exports.number(),
@@ -29907,7 +30163,14 @@ var eventEmitterCapability = {
     schema: EventEmitterStatusSchema,
     kind: "push"
   },
-  runtimeState: EventEmitterStatusSchema
+  runtimeState: EventEmitterStatusSchema,
+  /**
+  * Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var EventItemSchema = external_exports.object({
   id: external_exports.string(),
@@ -30206,7 +30469,14 @@ var fanControlCapability = {
   * Runtime-state slice — mirrored by the kernel. UI fan speed
   * sliders read `percentage` for live updates.
   */
-  runtimeState: FanControlStatusSchema
+  runtimeState: FanControlStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `brightness`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var FeatureProbeStatusSchema = external_exports.object({
   /**
@@ -30259,7 +30529,14 @@ var featureProbeCapability = {
     schema: FeatureProbeStatusSchema,
     kind: "push"
   },
-  runtimeState: FeatureProbeStatusSchema
+  runtimeState: FeatureProbeStatusSchema,
+  /**
+  * Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var FloodStatusSchema = external_exports.object({
   /** True when leak is currently detected. */
@@ -30278,7 +30555,17 @@ var floodCapability = {
     schema: FloodStatusSchema,
     kind: "push"
   },
-  runtimeState: FloodStatusSchema
+  runtimeState: FloodStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `smoke`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var GasStatusSchema = external_exports.object({
   detected: external_exports.boolean(),
@@ -30296,7 +30583,17 @@ var gasCapability = {
     schema: GasStatusSchema,
     kind: "push"
   },
-  runtimeState: GasStatusSchema
+  runtimeState: GasStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `smoke`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var HumidifierStatusSchema = external_exports.object({
   /** Whether the humidifier is currently on. */
@@ -30357,7 +30654,14 @@ var humidifierCapability = {
   * Runtime-state slice — mirrored by the kernel. UI controls watch the
   * slice for live humidity / mode changes.
   */
-  runtimeState: HumidifierStatusSchema
+  runtimeState: HumidifierStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `climate-control`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var HumiditySensorStatusSchema = external_exports.object({
   /** Current relative humidity, 0..100. */
@@ -30385,7 +30689,17 @@ var humiditySensorCapability = {
     schema: HumiditySensorStatusSchema,
     kind: "push"
   },
-  runtimeState: HumiditySensorStatusSchema
+  runtimeState: HumiditySensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var ImageStatusSchema = external_exports.object({
   /** Absolute signed URL the browser loads directly. Null when the
@@ -30409,7 +30723,14 @@ var imageCapability = {
   * Runtime-state slice — mirrored by the kernel. The UI reads `url`
   * directly and renders the still image.
   */
-  runtimeState: ImageStatusSchema
+  runtimeState: ImageStatusSchema,
+  /**
+  * Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var ImageRotateSchema = external_exports.enum([
   "0",
@@ -30510,7 +30831,17 @@ var imageSettingsCapability = {
     schema: ImageSettingsStatusSchema,
     kind: "poll"
   },
-  runtimeState: ImageSettingsStatusSchema
+  runtimeState: ImageSettingsStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var IntegrationWithStateSchema = external_exports.object({
   id: external_exports.string(),
@@ -30841,7 +31172,14 @@ var lawnMowerControlCapability = {
   * Runtime-state slice — mirrored by the kernel. UI controls watch the
   * slice for live activity + battery changes.
   */
-  runtimeState: LawnMowerControlStatusSchema
+  runtimeState: LawnMowerControlStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `vacuum-control`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var InterfaceKindEnum = external_exports.enum([
   "lan",
@@ -31090,7 +31428,17 @@ var lockControlCapability = {
   * read `state` and disable themselves during `locking`/`unlocking`
   * transitions.
   */
-  runtimeState: LockControlStatusSchema
+  runtimeState: LockControlStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — a lock left locked must still read locked.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var MediaPlayerStateSchema = external_exports.enum([
   "off",
@@ -31240,7 +31588,14 @@ var mediaPlayerCapability = {
   * full slice for live now-playing, volume, and progress updates
   * without polling.
   */
-  runtimeState: MediaPlayerStatusSchema
+  runtimeState: MediaPlayerStatusSchema,
+  /**
+  * Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var MeshEndpointSchema = external_exports.object({
   /** Stable identifier within the provider (e.g. `mesh-ipv4`, `magicdns`, `funnel`). */
@@ -31524,7 +31879,14 @@ var motionCapability = {
   * `device.state.motion.value`. Reads never invoke the provider, so
   * UIs and other addons can poll the cached state safely.
   */
-  runtimeState: MotionStatusSchema
+  runtimeState: MotionStatusSchema,
+  /**
+  * Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var MotionTriggerStatusSchema = external_exports.object({
   enabled: external_exports.boolean(),
@@ -31561,7 +31923,14 @@ var motionTriggerCapability = {
     schema: MotionTriggerStatusSchema,
     kind: "command-driven"
   },
-  runtimeState: MotionTriggerRuntimeStateSchema
+  runtimeState: MotionTriggerRuntimeStateSchema,
+  /**
+  * Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var MotionZoneRegionSchema = external_exports.object({
   id: external_exports.number(),
@@ -31616,7 +31985,17 @@ var motionZonesCapability = {
     schema: MotionZoneStatusSchema,
     kind: "poll"
   },
-  runtimeState: MotionZoneStatusSchema
+  runtimeState: MotionZoneStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var NativeObjectClassEnum = external_exports.enum([
   "person",
@@ -31679,7 +32058,17 @@ var nativeObjectDetectionCapability = {
     schema: NativeObjectDetectionStatusSchema,
     kind: "push"
   },
-  runtimeState: NativeObjectDetectionRuntimeStateSchema
+  runtimeState: NativeObjectDetectionRuntimeStateSchema,
+  /**
+  * Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var StreamNetworkStatsSchema = external_exports.object({
   nominalBitrateKbps: external_exports.number(),
@@ -32002,7 +32391,14 @@ var notifierCapability = {
   * form reads `supports` to gate optional fields; history pane reads
   * `lastSentAt` / `lastError` / `queueDepth`.
   */
-  runtimeState: NotifierStatusSchema
+  runtimeState: NotifierStatusSchema,
+  /**
+  * Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var NumericSensorStatusSchema = external_exports.object({
   value: external_exports.number(),
@@ -32028,7 +32424,17 @@ var numericSensorCapability = {
     schema: NumericSensorStatusSchema,
     kind: "push"
   },
-  runtimeState: NumericSensorStatusSchema
+  runtimeState: NumericSensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var OsdOverlayKindEnum = external_exports.enum([
   "text",
@@ -32451,7 +32857,14 @@ var petFeederCapability = {
   * the full slice via `device.state.petFeeder.value` and refresh on
   * every poll without re-querying the provider.
   */
-  runtimeState: PetFeederStatusSchema
+  runtimeState: PetFeederStatusSchema,
+  /**
+  * Runtime-state durability: **session** — live appliance state re-published on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var VehicleSchema = external_exports.object({
   id: external_exports.string(),
@@ -32785,7 +33198,17 @@ var powerMeterCapability = {
     schema: PowerMeterStatusSchema,
     kind: "push"
   },
-  runtimeState: PowerMeterStatusSchema
+  runtimeState: PowerMeterStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var GpsLocationSchema = external_exports.object({
   /** Latitude in decimal degrees, -90..90. */
@@ -32826,7 +33249,17 @@ var presenceCapability = {
   * the map pin is rendered (use `DeviceFeature.PresenceGps` for the
   * pre-fetch fast-path check).
   */
-  runtimeState: PresenceStatusSchema
+  runtimeState: PresenceStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var PressureSensorStatusSchema = external_exports.object({
   /** Current pressure in hPa. */
@@ -32854,7 +33287,17 @@ var pressureSensorCapability = {
     schema: PressureSensorStatusSchema,
     kind: "push"
   },
-  runtimeState: PressureSensorStatusSchema
+  runtimeState: PressureSensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var PrivacyMaskShapeSchema = external_exports.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
 var PrivacyMaskRegionSchema = external_exports.object({
@@ -32953,7 +33396,17 @@ var privacyMaskCapability = {
     schema: PrivacyMaskStatusSchema,
     kind: "poll"
   },
-  runtimeState: PrivacyMaskStatusSchema
+  runtimeState: PrivacyMaskStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var PtzPresetSchema = external_exports.object({
   id: external_exports.string(),
@@ -33139,7 +33592,14 @@ var ptzAutotrackCapability = {
   * fetch / cache / fallback logic out of the four cap methods —
   * they become trampolines over `runtimeState`.
   */
-  runtimeState: PtzAutotrackRuntimeStateSchema
+  runtimeState: PtzAutotrackRuntimeStateSchema,
+  /**
+  * Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var rebootCapability = {
   name: "reboot",
@@ -33808,7 +34268,14 @@ var sceneMonitorCapability = {
     schema: SceneMonitorStatusSchema,
     kind: "push"
   },
-  runtimeState: SceneMonitorStatusSchema
+  runtimeState: SceneMonitorStatusSchema,
+  /**
+  * Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var ZoneRuleModeEnum = external_exports.enum(["include", "exclude"]);
 var ZoneRuleSchema = external_exports.object({
@@ -33910,7 +34377,14 @@ var scriptRunnerCapability = {
   * `isRunning` to render a spinner during execution and surfaces
   * `lastError` / `lastRunSuccess` in the recent-runs panel.
   */
-  runtimeState: ScriptRunnerStatusSchema
+  runtimeState: ScriptRunnerStatusSchema,
+  /**
+  * Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var SmokeStatusSchema = external_exports.object({
   detected: external_exports.boolean(),
@@ -33928,7 +34402,17 @@ var smokeCapability = {
     schema: SmokeStatusSchema,
     kind: "push"
   },
-  runtimeState: SmokeStatusSchema
+  runtimeState: SmokeStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var CamStreamDescriptorSchema = external_exports.object({
   camStreamId: external_exports.string().min(1),
@@ -34079,7 +34563,17 @@ var streamParamsCapability = {
     schema: StreamParamsStatusSchema,
     kind: "poll"
   },
-  runtimeState: StreamParamsStatusSchema
+  runtimeState: StreamParamsStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var SwitchStatusSchema = external_exports.object({
   on: external_exports.boolean(),
@@ -34118,6 +34612,16 @@ var switchCapability = {
   * not need to re-query the provider after a setState mutation.
   */
   runtimeState: SwitchStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"],
   settings: { bindings: [{
     kind: "scalar",
     statusPath: "on",
@@ -34190,7 +34694,17 @@ var tamperCapability = {
     schema: TamperStatusSchema,
     kind: "push"
   },
-  runtimeState: TamperStatusSchema
+  runtimeState: TamperStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `smoke`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var TemperatureSensorStatusSchema = external_exports.object({
   /** Current temperature in Celsius. */
@@ -34219,7 +34733,17 @@ var temperatureSensorCapability = {
     schema: TemperatureSensorStatusSchema,
     kind: "push"
   },
-  runtimeState: TemperatureSensorStatusSchema
+  runtimeState: TemperatureSensorStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastFetchedAt"]
 };
 var ToastSchema = external_exports.object({
   title: external_exports.string(),
@@ -34270,7 +34794,14 @@ var updateCapability = {
     schema: UpdateStatusSchema,
     kind: "poll"
   },
-  runtimeState: UpdateStatusSchema
+  runtimeState: UpdateStatusSchema,
+  /**
+  * Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var UserSummarySchema = external_exports.object({
   id: external_exports.string(),
@@ -34604,7 +35135,14 @@ var vacuumControlCapability = {
   * Runtime-state slice — mirrored by the kernel. UI controls watch the
   * slice for live state + battery + fan-speed changes.
   */
-  runtimeState: VacuumControlStatusSchema
+  runtimeState: VacuumControlStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var ValveStateSchema = external_exports.enum([
   "open",
@@ -34657,7 +35195,14 @@ var valveCapability = {
   * Runtime-state slice — mirrored by the kernel. UI controls watch the
   * slice for live position changes during a move.
   */
-  runtimeState: ValveStatusSchema
+  runtimeState: ValveStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `brightness`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var VibrationStatusSchema = external_exports.object({
   detected: external_exports.boolean(),
@@ -34675,7 +35220,17 @@ var vibrationCapability = {
     schema: VibrationStatusSchema,
     kind: "push"
   },
-  runtimeState: VibrationStatusSchema
+  runtimeState: VibrationStatusSchema,
+  /**
+  * Runtime-state durability: **restored** — as `smoke`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored",
+  /** Clock fields: written, but excluded from the compare that decides
+  *  whether persisting is worth a SQLite commit. */
+  volatileStateFields: ["lastChangedAt"]
 };
 var WaterHeaterStatusSchema = external_exports.object({
   /** Current measured temperature. Null when not reported. */
@@ -34735,7 +35290,14 @@ var waterHeaterCapability = {
   * Runtime-state slice — mirrored by the kernel. UI controls watch the
   * slice for live temperature / mode / away changes.
   */
-  runtimeState: WaterHeaterStatusSchema
+  runtimeState: WaterHeaterStatusSchema,
+  /**
+  * Runtime-state durability: **session** — as `climate-control`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var WeatherStatusSchema = external_exports.object({
   /** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
@@ -34775,7 +35337,14 @@ var weatherCapability = {
   * Runtime-state slice — mirrored by the kernel. The UI reads the
   * current conditions directly from the slice on each weather push.
   */
-  runtimeState: WeatherStatusSchema
+  runtimeState: WeatherStatusSchema,
+  /**
+  * Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var PerScopeBreakdownSchema = external_exports.object({
   /** Total tracked objects in this scope (frame / zone / unzoned). */
@@ -34884,7 +35453,14 @@ var zoneAnalyticsCapability = {
   * automatically; the explicit `getCurrentSnapshot` cap method is
   * still useful for one-off polls without a subscription.
   */
-  runtimeState: CameraOccupancySnapshotSchema
+  runtimeState: CameraOccupancySnapshotSchema,
+  /**
+  * Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "session"
 };
 var ZoneRuleStageEnum = external_exports.enum([
   "motion",
@@ -34936,7 +35512,14 @@ var zoneRulesCapability = {
     motion: external_exports.array(ZoneRuleSchema).readonly(),
     detection: external_exports.array(ZoneRuleSchema).readonly(),
     package: external_exports.array(ZoneRuleSchema).readonly()
-  })
+  }),
+  /**
+  * Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored"
 };
 var PIPELINE_FLOW_CAPABILITY_NAMES = [
   "decoder",
@@ -40626,6 +41209,7 @@ var CAP_PROVIDER_KIND_MAP = Object.freeze({
   "network-access": "ingress",
   "smtp-provider": "email"
 });
+var ICON_BY_ID = new Map(AUDIO_MACRO_LABELS.flatMap((macro2) => macro2.icon === void 0 ? [] : [[macro2.id, macro2.icon]]));
 var NC_BASE_CONDITION_KEYS = ["devices", "classes"];
 var BASE_CONDITION_SET = new Set(NC_BASE_CONDITION_KEYS);
 var TimelapseTemplateSchema = external_exports.object({
@@ -40771,25 +41355,32 @@ var DETAIL_CROP_PADDING_FIELD = {
 var NativeLeaseAdmissionSchema = external_exports.enum(["all", "inferred"]);
 var NativeLeaseSettingsSchema = external_exports.object({
   /**
-  * How long a retained native frame is served before it counts as a miss.
+  * How many delivered frames the worker HOLDS at once, waiting for each one's
+  * detection result.
+  *
+  * This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+  * a time window was never related to the event the pixels were waiting for.
+  * A held frame now lives from delivery until the runner has its `FrameResult`
+  * — at which moment the runner cuts the subject tiles it actually wanted and
+  * releases the frame. The bound exists only so a runner that stops answering
+  * cannot pin RAM: above it the OLDEST held frame is dropped and counted.
   *
-  * Must cover the FULL late-crop horizon: detection inference + the
-  * cross-process inference-result hop to hub post-analysis + tracking + the
-  * tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-  * outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-  * RAM per busy camera grows linearly with no measured hit-rate gain.
+  * Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+  * 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+  * without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+  * Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+  * `holdOverflow` on the metrics line is what says you need it.
   */
-  ttlMs: external_exports.number().int().min(250).max(1e4),
+  holdFrames: external_exports.number().int().min(1).max(64),
   /**
   * Hard per-decode-worker RAM ceiling for retained native frames, in MB.
   *
-  * Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-  * which one is actually binding before reasoning from that. At the shipped
-  * 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-  * at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-  * `leaseFrames` on the metrics line say which. When the ceiling binds, a
-  * change that admits fewer frames buys retention WINDOW at constant RAM
-  * rather than giving RAM back — lower this knob if RAM is what you wanted.
+  * Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+  * is what decides how much is held, and the ceiling is the number above which
+  * something is wrong. Before that it was the effective cap — at 1024 MB with
+  * a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+  * with the TTL expiring nothing, which is exactly the confusion the hold
+  * removes. `leaseMb` / `leaseFrames` still say what is resident.
   * `0` DISABLES the lease entirely and falls the worker back to the tiny
   * leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
   * to replace).
@@ -40815,19 +41406,37 @@ var NativeLeaseSettingsSchema = external_exports.object({
   * there is the signal that some caller names frames outside the inference set
   * and that this must go back to `all`.
   */
-  admission: NativeLeaseAdmissionSchema
+  admission: NativeLeaseAdmissionSchema,
+  /**
+  * RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+  * compressed native crops the worker cuts at the moment a frame's detection
+  * result arrives, and keeps long after the frame itself is freed.
+  *
+  * This is the knob that replaced the old retention window, and it buys about
+  * three orders of magnitude more of it: a tile is one subject at native
+  * resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+  * the frame it was cut from. A frame on which nothing was detected costs
+  * nothing at all, which is the real change — the old lease paid per FRAME and
+  * was interrogated per SUBJECT.
+  *
+  * `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+  * fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+  * reproduce that.
+  */
+  tileBudgetMb: external_exports.number().int().min(0).max(1024)
 });
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-  ttlMs: 1200,
+  holdFrames: 8,
   budgetMb: 1024,
   activityMs: 15e3,
+  tileBudgetMb: 64,
   admission: "inferred"
 };
-var NATIVE_LEASE_TTL_FIELD = {
-  min: 250,
-  max: 1e4,
-  step: 50,
-  default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+var NATIVE_LEASE_HOLD_FIELD = {
+  min: 1,
+  max: 64,
+  step: 1,
+  default: DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames
 };
 var NATIVE_LEASE_BUDGET_FIELD = {
   min: 0,
@@ -40841,6 +41450,12 @@ var NATIVE_LEASE_ACTIVITY_FIELD = {
   step: 1e3,
   default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
 };
+var NATIVE_LEASE_TILE_BUDGET_FIELD = {
+  min: 0,
+  max: 1024,
+  step: 16,
+  default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
+};
 var NATIVE_LEASE_ADMISSION_FIELD = {
   options: [{
     value: "all",