camstack 1.2.22 → 1.2.24

package/dist/{launcher-AG7EDMPV.js → launcher-CZIVQSEW.js}

@@ -6378,62 +6378,30 @@ var require_first_boot_addon_plan = __commonJS({
   "../../server/backend/dist/first-boot-addon-plan.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.resolveWantedVersion = resolveWantedVersion;
-    exports.compareVersions = compareVersions;
-    exports.bootstrapPinsFrom = bootstrapPinsFrom;
     exports.planFirstBootAddons = planFirstBootAddons;
     exports.formatFirstBootPlan = formatFirstBootPlan;
-    var EXACT_VERSION = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/;
-    function resolveWantedVersion(raw) {
-      if (raw !== void 0 && EXACT_VERSION.test(raw))
-        return { spec: raw, pinned: true };
-      return { spec: "latest", pinned: false };
-    }
-    function compareVersions(a, b) {
-      if (!EXACT_VERSION.test(a) || !EXACT_VERSION.test(b))
-        return null;
-      const parse4 = (v) => v.split(/[-+]/)[0].split(".").map((n) => Number.parseInt(n, 10));
-      const left = parse4(a);
-      const right = parse4(b);
-      for (let i = 0; i < 3; i++) {
-        const l = left[i] ?? 0;
-        const r = right[i] ?? 0;
-        if (l !== r)
-          return l > r ? 1 : -1;
-      }
-      return 0;
-    }
-    function bootstrapPinsFrom(manifest) {
-      const out = {};
-      for (const [name, spec] of Object.entries(manifest.dependencies ?? {})) {
-        if (name.startsWith("@camstack/"))
-          out[name] = spec;
-      }
-      return out;
-    }
     function planFirstBootAddons(input) {
       const provided = new Set(input.closureProvided);
-      const decisions = input.required.map((pkg) => decide(pkg, input.closurePins[pkg], input.installed, provided));
+      const decisions = input.required.map((pkg) => decide(pkg, input.installed, input.closureVersions, provided));
       const wouldInstall = decisions.filter((d) => d.action === "install-npm").map((d) => d.pkg);
       return {
         decisions,
         wouldInstall,
-        unpinned: decisions.filter((d) => d.action === "install-npm" && !d.want.pinned).map((d) => d.pkg),
-        divergent: decisions.filter((d) => d.divergent).map((d) => d.pkg),
+        twoVersions: decisions.filter((d) => d.twoVersions).map((d) => d.pkg),
         needsRegistry: wouldInstall.length > 0
       };
     }
-    function decide(pkg, pin, installed, closureProvided) {
-      const want = resolveWantedVersion(pin);
+    function decide(pkg, installed, closureVersions, closureProvided) {
       const hasEntry = Object.hasOwn(installed, pkg);
       const version = installed[pkg] ?? null;
+      const closureVersion = closureVersions[pkg] ?? null;
       if (closureProvided.has(pkg)) {
         return {
           pkg,
           action: "skip-closure-provided",
-          want,
           installedVersion: version,
-          divergent: false,
+          closureVersion,
+          twoVersions: false,
           reason: "provided by the server closure \u2014 a copy here would shadow it (D15)"
         };
       }
@@ -6441,59 +6409,33 @@ var require_first_boot_addon_plan = __commonJS({
         return {
           pkg,
           action: "install-npm",
-          want,
           installedVersion: null,
-          divergent: false,
-          reason: hasEntry ? `installed copy has an unreadable package.json \u2014 fetching ${want.spec}` : want.pinned ? `absent \u2014 fetch ${want.spec}, the version the running closure pins` : "absent, and the closure carries no pin \u2014 fetching latest"
+          closureVersion,
+          twoVersions: false,
+          reason: hasEntry ? "installed copy has an unreadable package.json \u2014 fetching latest" : "absent \u2014 fetching latest, which is the whole version contract (addons-agnostic)"
         };
       }
+      const twoVersions = closureVersion !== null && closureVersion !== version;
       return {
         pkg,
         action: "adopt-installed",
-        want,
         installedVersion: version,
-        ...adoptionVerdict(version, want)
-      };
-    }
-    function adoptionVerdict(version, want) {
-      if (!want.pinned) {
-        return { divergent: false, reason: `installed ${version}; the closure carries no pin to check` };
-      }
-      const order = compareVersions(version, want.spec);
-      if (order === null) {
-        return { divergent: true, reason: `installed ${version} is not comparable to pin ${want.spec}` };
-      }
-      if (order === 0)
-        return { divergent: false, reason: `installed ${version} matches the pin` };
-      const sameMajor = version.split(".")[0] === want.spec.split(".")[0];
-      if (!sameMajor) {
-        return {
-          divergent: true,
-          reason: `installed ${version} is a different major from the pinned ${want.spec} \u2014 a framework contract, not a version gap`
-        };
-      }
-      if (order > 0) {
-        return {
-          divergent: false,
-          reason: `installed ${version} is ahead of the pinned ${want.spec} \u2014 a deploy outranks the image (D90)`
-        };
-      }
-      return {
-        divergent: true,
-        reason: `installed ${version} is BEHIND the pinned ${want.spec} \u2014 kept, because replacing it is an un-deploy`
+        closureVersion,
+        twoVersions,
+        reason: twoVersions ? `installed ${version}; this closure carries ${closureVersion} \u2014 the installed copy is what runs (D90)` : `installed ${version} \u2014 kept`
       };
     }
     function formatFirstBootPlan(plan, mode) {
-      const header = `first-boot addon plan (${mode}) \u2014 ${plan.decisions.length} package(s), ${plan.wouldInstall.length} to install, ${plan.divergent.length} divergent`;
+      const header = `first-boot addon plan (${mode}) \u2014 ${plan.decisions.length} package(s), ${plan.wouldInstall.length} to install`;
       const lines = [
         mode === "observe" ? `${header}; nothing was installed from this plan` : header
       ];
       for (const d of plan.decisions) {
-        const target = d.action === "install-npm" ? `@${d.want.spec}` : "";
+        const target = d.action === "install-npm" ? "@latest" : "";
         lines.push(`  ${d.pkg}${target} \u2014 ${d.action}: ${d.reason}`);
       }
-      if (plan.unpinned.length > 0) {
-        lines.push(`  unpinned (would resolve the registry's latest): ${plan.unpinned.join(", ")} \u2014 the running closure declares no exact version for these, so what a node ends up with depends on when it booted`);
+      if (plan.twoVersions.length > 0) {
+        lines.push(`  two versions on this node (installed vs this closure's own copy): ${plan.twoVersions.join(", ")} \u2014 INFO: the installed copy is the one that runs`);
       }
       if (!plan.needsRegistry) {
         lines.push("  no registry access needed \u2014 every required addon is already on disk");
@@ -23689,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-DiScsb8j.js
-var require_dist_DiScsb8j = __commonJS({
-  "../system/dist/dist-DiScsb8j.js"(exports) {
+// ../system/dist/dist-D4nuaPdd.js
+var require_dist_D4nuaPdd = __commonJS({
+  "../system/dist/dist-D4nuaPdd.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -29149,7 +29091,14 @@ var require_dist_DiScsb8j = __commonJS({
           low: zod.z.string().optional()
         }),
         lastChangedAt: zod.z.number()
-      })
+      }),
+      /**
+      * Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     function isVoidInput(schema) {
       const def = schema._def;
@@ -29819,6 +29768,13 @@ var require_dist_DiScsb8j = __commonJS({
         kind: "poll"
       },
       runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: zod.z.number().int().nonnegative() }),
+      /**
+      * Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session",
       methods: {
         /**
         * Snapshot of the current `discovered` list. Returns the
@@ -32043,7 +31999,23 @@ var require_dist_DiScsb8j = __commonJS({
       * else — see `notification-center/action-token.ts` for what that does and
       * does not buy.
       */
-      destructive: zod.z.boolean().optional()
+      destructive: zod.z.boolean().optional(),
+      /**
+      * How the tap should REACH the url.
+      *
+      * `navigate` (absent, and every button authored before this field) opens it:
+      * the phone leaves the notification and shows whatever the callback returns.
+      * That is right for a button whose answer the operator wants to read.
+      *
+      * `background` fires it as a POST and stays put. It exists for the buttons
+      * whose whole point is not to interrupt — "silence this for 30 minutes" is
+      * an answer to the notification, and being thrown into a browser tab to
+      * confirm it costs more attention than the notification did. A backend that
+      * cannot do a background call renders it as an ordinary link (the adapters
+      * fall back rather than dropping the button), so this is a preference, never
+      * a requirement.
+      */
+      mode: zod.z.enum(["navigate", "background"]).optional()
     });
     var NotificationSchema = zod.z.object({
       body: zod.z.string(),
@@ -32821,7 +32793,17 @@ var require_dist_DiScsb8j = __commonJS({
       * full slice; renders an arm button per `availableModes` entry and
       * a PIN field iff `requiresCode === true`.
       */
-      runtimeState: AlarmPanelStatusSchema
+      runtimeState: AlarmPanelStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var MaskPointSchema = zod.z.object({
       x: zod.z.number(),
@@ -32919,6 +32901,7 @@ var require_dist_DiScsb8j = __commonJS({
       nodeIds: zod.z.array(zod.z.string().min(1)).min(1).optional(),
       packageNames: zod.z.array(zod.z.string().min(1)).min(1).optional()
     });
+    var NC_SNOOZE_MAX_MINUTES = 1440;
     var NcScheduleWindowSchema = zod.z.object({
       /** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
       days: zod.z.array(zod.z.number().int().min(0).max(6)).min(1),
@@ -33175,15 +33158,15 @@ var require_dist_DiScsb8j = __commonJS({
       * (an `immediate` rule naming an `audio-*` class, one notification per
       * classified sample) stays exactly as it was for rules that already use it.
       *
-      * NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-      * rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-      * (`camstack/src/data/notification-center.ts`, guarded by
-      * `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+      * In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+      * rule rather than an accident: the viewer mirrors the descriptor enums BY
+      * HAND (`camstack/src/data/notification-center.ts`, guarded by
+      * `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
       * condition fields it does not know when a rule is saved from the phone.
       * Publishing an editor for a condition the app cannot round-trip is how an
-      * operator loses a rule's conditions by opening it — so the descriptor, the
-      * admin widget and the viewer mirror land together (P2 + P3), and only then
-      * does an audio rule become authorable.
+      * operator loses a rule's conditions by opening it — so the viewer mirror
+      * (P3, shipped) went FIRST, and the descriptor an editor renders from
+      * follows here.
       */
       audio: NcAudioConditionSchema.optional()
     });
@@ -33352,6 +33335,30 @@ var require_dist_DiScsb8j = __commonJS({
       */
       snoozeAllowGlobal: zod.z.boolean().optional(),
       /**
+      * The snooze durations THIS rule's notification offers as buttons, in
+      * minutes.
+      *
+      * Three states, and all three are distinct — which is exactly why this is
+      * `.optional()` and never `.default()`. A Zod default does not run on the
+      * addon cap path (three production failures in one day), so a schema default
+      * would collapse the first two:
+      *
+      * | value | meaning |
+      * | --- | --- |
+      * | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+      * | `[]` | **no snooze buttons on this rule** — the explicit override |
+      * | a list | these choices, de-duplicated and sorted, at most four |
+      *
+      * `.max(4)` because the notifier's own action budget is small (ntfy allows
+      * three buttons in total) and a rule that spent it all on snooze choices
+      * would push its own tap-through actions off the notification.
+      *
+      * An empty list is NOT an alarm exemption: a rule the alarm is about, or
+      * that arms the panel, is exempt automatically and cannot be silenced by a
+      * window from anywhere (D133).
+      */
+      snoozeOptions: zod.z.array(zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+      /**
       * Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
       *
       * This is what makes the rule set the alarm's trigger set without the alarm
@@ -33441,6 +33448,7 @@ var require_dist_DiScsb8j = __commonJS({
         "device",
         "package",
         "occupancy",
+        "audio",
         "system"
       ]),
       label: zod.z.string(),
@@ -33459,6 +33467,7 @@ var require_dist_DiScsb8j = __commonJS({
         "crossingSelect",
         "polygonDraw",
         "occupancy",
+        "audio",
         "deviceState",
         "systemEvent"
       ]),
@@ -33569,7 +33578,20 @@ var require_dist_DiScsb8j = __commonJS({
       ruleId: zod.z.string().optional(),
       /** Required when `scope: 'device'`. */
       deviceId: zod.z.number().int().optional(),
-      durationMinutes: zod.z.number().int().min(1).max(1440),
+      /**
+      * Narrow the window to these subject classes — "the cat, not the person".
+      *
+      * ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+      * what every window authored before this field meant, so no persisted row
+      * changes meaning and no client has to learn anything to keep working.
+      *
+      * It is what makes the window's real key `(deviceId, classes[])` and lets it
+      * cross rules (D133): the operator points at a camera and a kind of thing,
+      * not at whichever of their four rules happened to produce the notification
+      * they are dismissing.
+      */
+      classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
+      durationMinutes: zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
       /**
       * Silence this for EVERY recipient, not just the caller. Permission is
       * checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -33593,6 +33615,10 @@ var require_dist_DiScsb8j = __commonJS({
       scope: NcSnoozeScopeSchema,
       ruleId: zod.z.string().optional(),
       deviceId: zod.z.number().int().optional(),
+      /** Subject classes this window covers. ABSENT = every class — see
+      *  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+      *  no SQLite column: nothing queries a window by class. */
+      classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
       startedAt: zod.z.number(),
       /** Exclusive: at exactly this instant the snooze is over. Expiry is a
       *  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -35865,7 +35891,14 @@ var require_dist_DiScsb8j = __commonJS({
       * handle. Slice shape is `{ zones: Zone[] }` so future extensions
       * (e.g. zone groupings) can sit alongside the polygon list.
       */
-      runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() })
+      runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
+      /**
+      * Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored"
     };
     var NativeCropBboxSchema = zod.z.object({
       x: zod.z.number(),
@@ -39168,7 +39201,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: AirQualitySensorStatusSchema,
         kind: "push"
       },
-      runtimeState: AirQualitySensorStatusSchema
+      runtimeState: AirQualitySensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var AmbientLightSensorStatusSchema = zod.z.object({
       /** Current illuminance in lux (lx). */
@@ -39196,7 +39239,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: AmbientLightSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: AmbientLightSensorStatusSchema
+      runtimeState: AmbientLightSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var AudioClassSummarySchema = zod.z.object({
       className: zod.z.string(),
@@ -39286,7 +39339,14 @@ var require_dist_DiScsb8j = __commonJS({
         }), AudioMetricsHistorySchema)
       },
       /** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-      runtimeState: AudioMetricsSnapshotSchema
+      runtimeState: AudioMetricsSnapshotSchema,
+      /**
+      * Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var AutomationControlStatusSchema = zod.z.object({
       /** Whether the automation is currently enabled. Disabled automations
@@ -39337,7 +39397,14 @@ var require_dist_DiScsb8j = __commonJS({
       * reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
       * (badge) directly.
       */
-      runtimeState: AutomationControlStatusSchema
+      runtimeState: AutomationControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var BatteryStatusSchema = zod.z.object({
       /** 0..100 inclusive. Firmware-reported. */
@@ -39438,7 +39505,17 @@ var require_dist_DiScsb8j = __commonJS({
       * via `device.runtimeState.getCapState('battery')` regardless of
       * the underlying driver.
       */
-      runtimeState: BatteryStatusSchema
+      runtimeState: BatteryStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastUpdated"]
     };
     var BinaryStatusSchema = zod.z.object({
       on: zod.z.boolean(),
@@ -39456,7 +39533,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: BinaryStatusSchema,
         kind: "push"
       },
-      runtimeState: BinaryStatusSchema
+      runtimeState: BinaryStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var BrightnessStatusSchema = zod.z.object({
       /** Current level as 0..100 inclusive. Firmware-reported. */
@@ -39498,7 +39585,14 @@ var require_dist_DiScsb8j = __commonJS({
       * by the kernel. Read via `device.state.brightness.value` so UI
       * sliders surface the current level without polling the provider.
       */
-      runtimeState: BrightnessStatusSchema
+      runtimeState: BrightnessStatusSchema,
+      /**
+      * Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var buttonCapability = {
       name: "button",
@@ -39578,7 +39672,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: CarbonMonoxideStatusSchema,
         kind: "push"
       },
-      runtimeState: CarbonMonoxideStatusSchema
+      runtimeState: CarbonMonoxideStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var HvacModeSchema = zod.z.enum([
       "off",
@@ -39707,7 +39811,14 @@ var require_dist_DiScsb8j = __commonJS({
       * the full slice via `device.state.climate-control.value` and refresh
       * on every push without re-querying the provider.
       */
-      runtimeState: ClimateControlStatusSchema
+      runtimeState: ClimateControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var RgbTripletSchema = zod.z.object({
       r: zod.z.number().int().min(0).max(255),
@@ -39794,7 +39905,14 @@ var require_dist_DiScsb8j = __commonJS({
       * kernel. Read via `device.state.color.value` so UI pickers surface
       * the current chromaticity without polling the provider.
       */
-      runtimeState: ColorStatusSchema
+      runtimeState: ColorStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ConnectionTestOutcomeSchema = zod.z.discriminatedUnion("outcome", [
       zod.z.object({
@@ -39848,7 +39966,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: ConnectivityStatusSchema,
         kind: "push"
       },
-      runtimeState: ConnectivityStatusSchema
+      runtimeState: ConnectivityStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var ConsumableItemSchema = zod.z.object({
       /** Stable id, e.g. 'main-brush'. */
@@ -39915,7 +40043,14 @@ var require_dist_DiScsb8j = __commonJS({
           }
         }
       },
-      runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() })
+      runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() }),
+      /**
+      * Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ContactStatusSchema = zod.z.object({
       /** True when the entry is open; false when closed. */
@@ -39934,7 +40069,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: ContactStatusSchema,
         kind: "push"
       },
-      runtimeState: ContactStatusSchema
+      runtimeState: ContactStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a door left open across a restart must still read open.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var ControlKindSchema = zod.z.enum([
       "numeric",
@@ -40021,7 +40166,14 @@ var require_dist_DiScsb8j = __commonJS({
       * dropdown / text field / date picker) read the slice's discriminant
       * and value directly without polling the provider.
       */
-      runtimeState: ControlStatusSchema
+      runtimeState: ControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var CoverStateSchema = zod.z.enum([
       "open",
@@ -40083,7 +40235,17 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI controls watch
       * the slice for live position changes during a move.
       */
-      runtimeState: CoverStatusSchema
+      runtimeState: CoverStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var DayNightModeSchema = zod.z.enum([
       "auto",
@@ -40144,7 +40306,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: DayNightStatusSchema,
         kind: "poll"
       },
-      runtimeState: DayNightStatusSchema
+      runtimeState: DayNightStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var DeviceStatusSchema = zod.z.object({
       /**
@@ -40177,7 +40349,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: DeviceStatusSchema,
         kind: "push"
       },
-      runtimeState: DeviceStatusSchema
+      runtimeState: DeviceStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var DoorbellStatusSchema = zod.z.object({
       /** Ms epoch of the last press. null = never observed since this provider started. */
@@ -40217,7 +40399,14 @@ var require_dist_DiScsb8j = __commonJS({
       * `device.state.doorbell.value`. UIs can show "last ring 5m ago"
       * without subscribing.
       */
-      runtimeState: DoorbellStatusSchema
+      runtimeState: DoorbellStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored"
     };
     var EnumSensorDateTimeFormatSchema = zod.z.enum([
       "date",
@@ -40247,7 +40436,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: EnumSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: EnumSensorStatusSchema
+      runtimeState: EnumSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var EventFireSchema = zod.z.object({
       deviceId: zod.z.number(),
@@ -40273,7 +40472,14 @@ var require_dist_DiScsb8j = __commonJS({
         schema: EventEmitterStatusSchema,
         kind: "push"
       },
-      runtimeState: EventEmitterStatusSchema
+      runtimeState: EventEmitterStatusSchema,
+      /**
+      * Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var EventItemSchema = zod.z.object({
       id: zod.z.string(),
@@ -40572,7 +40778,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI fan speed
       * sliders read `percentage` for live updates.
       */
-      runtimeState: FanControlStatusSchema
+      runtimeState: FanControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var FeatureProbeStatusSchema = zod.z.object({
       /**
@@ -40625,7 +40838,14 @@ var require_dist_DiScsb8j = __commonJS({
         schema: FeatureProbeStatusSchema,
         kind: "push"
       },
-      runtimeState: FeatureProbeStatusSchema
+      runtimeState: FeatureProbeStatusSchema,
+      /**
+      * Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var FloodStatusSchema = zod.z.object({
       /** True when leak is currently detected. */
@@ -40644,7 +40864,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: FloodStatusSchema,
         kind: "push"
       },
-      runtimeState: FloodStatusSchema
+      runtimeState: FloodStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var GasStatusSchema = zod.z.object({
       detected: zod.z.boolean(),
@@ -40662,7 +40892,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: GasStatusSchema,
         kind: "push"
       },
-      runtimeState: GasStatusSchema
+      runtimeState: GasStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var HumidifierStatusSchema = zod.z.object({
       /** Whether the humidifier is currently on. */
@@ -40723,7 +40963,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live humidity / mode changes.
       */
-      runtimeState: HumidifierStatusSchema
+      runtimeState: HumidifierStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `climate-control`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var HumiditySensorStatusSchema = zod.z.object({
       /** Current relative humidity, 0..100. */
@@ -40751,7 +40998,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: HumiditySensorStatusSchema,
         kind: "push"
       },
-      runtimeState: HumiditySensorStatusSchema
+      runtimeState: HumiditySensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var ImageStatusSchema = zod.z.object({
       /** Absolute signed URL the browser loads directly. Null when the
@@ -40775,7 +41032,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. The UI reads `url`
       * directly and renders the still image.
       */
-      runtimeState: ImageStatusSchema
+      runtimeState: ImageStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ImageRotateSchema = zod.z.enum([
       "0",
@@ -40876,7 +41140,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: ImageSettingsStatusSchema,
         kind: "poll"
       },
-      runtimeState: ImageSettingsStatusSchema
+      runtimeState: ImageSettingsStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var IntegrationWithStateSchema = zod.z.object({
       id: zod.z.string(),
@@ -41207,7 +41481,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live activity + battery changes.
       */
-      runtimeState: LawnMowerControlStatusSchema
+      runtimeState: LawnMowerControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `vacuum-control`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var InterfaceKindEnum = zod.z.enum([
       "lan",
@@ -41456,7 +41737,17 @@ var require_dist_DiScsb8j = __commonJS({
       * read `state` and disable themselves during `locking`/`unlocking`
       * transitions.
       */
-      runtimeState: LockControlStatusSchema
+      runtimeState: LockControlStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a lock left locked must still read locked.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var MediaPlayerStateSchema = zod.z.enum([
       "off",
@@ -41606,7 +41897,14 @@ var require_dist_DiScsb8j = __commonJS({
       * full slice for live now-playing, volume, and progress updates
       * without polling.
       */
-      runtimeState: MediaPlayerStatusSchema
+      runtimeState: MediaPlayerStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var MeshEndpointSchema = zod.z.object({
       /** Stable identifier within the provider (e.g. `mesh-ipv4`, `magicdns`, `funnel`). */
@@ -41890,7 +42188,14 @@ var require_dist_DiScsb8j = __commonJS({
       * `device.state.motion.value`. Reads never invoke the provider, so
       * UIs and other addons can poll the cached state safely.
       */
-      runtimeState: MotionStatusSchema
+      runtimeState: MotionStatusSchema,
+      /**
+      * Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var MotionTriggerStatusSchema = zod.z.object({
       enabled: zod.z.boolean(),
@@ -41927,7 +42232,14 @@ var require_dist_DiScsb8j = __commonJS({
         schema: MotionTriggerStatusSchema,
         kind: "command-driven"
       },
-      runtimeState: MotionTriggerRuntimeStateSchema
+      runtimeState: MotionTriggerRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var MotionZoneRegionSchema = zod.z.object({
       id: zod.z.number(),
@@ -41982,7 +42294,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: MotionZoneStatusSchema,
         kind: "poll"
       },
-      runtimeState: MotionZoneStatusSchema
+      runtimeState: MotionZoneStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var NativeObjectClassEnum = zod.z.enum([
       "person",
@@ -42045,7 +42367,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: NativeObjectDetectionStatusSchema,
         kind: "push"
       },
-      runtimeState: NativeObjectDetectionRuntimeStateSchema
+      runtimeState: NativeObjectDetectionRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var StreamNetworkStatsSchema = zod.z.object({
       nominalBitrateKbps: zod.z.number(),
@@ -42368,7 +42700,14 @@ var require_dist_DiScsb8j = __commonJS({
       * form reads `supports` to gate optional fields; history pane reads
       * `lastSentAt` / `lastError` / `queueDepth`.
       */
-      runtimeState: NotifierStatusSchema
+      runtimeState: NotifierStatusSchema,
+      /**
+      * Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var NumericSensorStatusSchema = zod.z.object({
       value: zod.z.number(),
@@ -42394,7 +42733,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: NumericSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: NumericSensorStatusSchema
+      runtimeState: NumericSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var OsdOverlayKindEnum = zod.z.enum([
       "text",
@@ -42817,7 +43166,14 @@ var require_dist_DiScsb8j = __commonJS({
       * the full slice via `device.state.petFeeder.value` and refresh on
       * every poll without re-querying the provider.
       */
-      runtimeState: PetFeederStatusSchema
+      runtimeState: PetFeederStatusSchema,
+      /**
+      * Runtime-state durability: **session** — live appliance state re-published on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var VehicleSchema = zod.z.object({
       id: zod.z.string(),
@@ -43151,7 +43507,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: PowerMeterStatusSchema,
         kind: "push"
       },
-      runtimeState: PowerMeterStatusSchema
+      runtimeState: PowerMeterStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var GpsLocationSchema = zod.z.object({
       /** Latitude in decimal degrees, -90..90. */
@@ -43192,7 +43558,17 @@ var require_dist_DiScsb8j = __commonJS({
       * the map pin is rendered (use `DeviceFeature.PresenceGps` for the
       * pre-fetch fast-path check).
       */
-      runtimeState: PresenceStatusSchema
+      runtimeState: PresenceStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var PressureSensorStatusSchema = zod.z.object({
       /** Current pressure in hPa. */
@@ -43220,7 +43596,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: PressureSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: PressureSensorStatusSchema
+      runtimeState: PressureSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var PrivacyMaskShapeSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
     var PrivacyMaskRegionSchema = zod.z.object({
@@ -43319,7 +43705,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: PrivacyMaskStatusSchema,
         kind: "poll"
       },
-      runtimeState: PrivacyMaskStatusSchema
+      runtimeState: PrivacyMaskStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var PtzPresetSchema = zod.z.object({
       id: zod.z.string(),
@@ -43505,7 +43901,14 @@ var require_dist_DiScsb8j = __commonJS({
       * fetch / cache / fallback logic out of the four cap methods —
       * they become trampolines over `runtimeState`.
       */
-      runtimeState: PtzAutotrackRuntimeStateSchema
+      runtimeState: PtzAutotrackRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var rebootCapability = {
       name: "reboot",
@@ -44173,7 +44576,14 @@ var require_dist_DiScsb8j = __commonJS({
         schema: SceneMonitorStatusSchema,
         kind: "push"
       },
-      runtimeState: SceneMonitorStatusSchema
+      runtimeState: SceneMonitorStatusSchema,
+      /**
+      * Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ZoneRuleModeEnum = zod.z.enum(["include", "exclude"]);
     var ZoneRuleSchema = zod.z.object({
@@ -44275,7 +44685,14 @@ var require_dist_DiScsb8j = __commonJS({
       * `isRunning` to render a spinner during execution and surfaces
       * `lastError` / `lastRunSuccess` in the recent-runs panel.
       */
-      runtimeState: ScriptRunnerStatusSchema
+      runtimeState: ScriptRunnerStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var SmokeStatusSchema = zod.z.object({
       detected: zod.z.boolean(),
@@ -44293,7 +44710,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: SmokeStatusSchema,
         kind: "push"
       },
-      runtimeState: SmokeStatusSchema
+      runtimeState: SmokeStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var CamStreamDescriptorSchema = zod.z.object({
       camStreamId: zod.z.string().min(1),
@@ -44444,7 +44871,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: StreamParamsStatusSchema,
         kind: "poll"
       },
-      runtimeState: StreamParamsStatusSchema
+      runtimeState: StreamParamsStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var STREAM_PROFILE_META = [
       {
@@ -44715,6 +45152,16 @@ var require_dist_DiScsb8j = __commonJS({
       * not need to re-query the provider after a setState mutation.
       */
       runtimeState: SwitchStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"],
       settings: { bindings: [{
         kind: "scalar",
         statusPath: "on",
@@ -44787,7 +45234,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: TamperStatusSchema,
         kind: "push"
       },
-      runtimeState: TamperStatusSchema
+      runtimeState: TamperStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var TemperatureSensorStatusSchema = zod.z.object({
       /** Current temperature in Celsius. */
@@ -44816,7 +45273,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: TemperatureSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: TemperatureSensorStatusSchema
+      runtimeState: TemperatureSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var ToastSchema = zod.z.object({
       title: zod.z.string(),
@@ -44867,7 +45334,14 @@ var require_dist_DiScsb8j = __commonJS({
         schema: UpdateStatusSchema,
         kind: "poll"
       },
-      runtimeState: UpdateStatusSchema
+      runtimeState: UpdateStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var UserSummarySchema = zod.z.object({
       id: zod.z.string(),
@@ -45201,7 +45675,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live state + battery + fan-speed changes.
       */
-      runtimeState: VacuumControlStatusSchema
+      runtimeState: VacuumControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ValveStateSchema = zod.z.enum([
       "open",
@@ -45254,7 +45735,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live position changes during a move.
       */
-      runtimeState: ValveStatusSchema
+      runtimeState: ValveStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var VibrationStatusSchema = zod.z.object({
       detected: zod.z.boolean(),
@@ -45272,7 +45760,17 @@ var require_dist_DiScsb8j = __commonJS({
         schema: VibrationStatusSchema,
         kind: "push"
       },
-      runtimeState: VibrationStatusSchema
+      runtimeState: VibrationStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var WaterHeaterStatusSchema = zod.z.object({
       /** Current measured temperature. Null when not reported. */
@@ -45332,7 +45830,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live temperature / mode / away changes.
       */
-      runtimeState: WaterHeaterStatusSchema
+      runtimeState: WaterHeaterStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `climate-control`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var WeatherStatusSchema = zod.z.object({
       /** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
@@ -45372,7 +45877,14 @@ var require_dist_DiScsb8j = __commonJS({
       * Runtime-state slice — mirrored by the kernel. The UI reads the
       * current conditions directly from the slice on each weather push.
       */
-      runtimeState: WeatherStatusSchema
+      runtimeState: WeatherStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var PerScopeBreakdownSchema = zod.z.object({
       /** Total tracked objects in this scope (frame / zone / unzoned). */
@@ -45481,7 +45993,14 @@ var require_dist_DiScsb8j = __commonJS({
       * automatically; the explicit `getCurrentSnapshot` cap method is
       * still useful for one-off polls without a subscription.
       */
-      runtimeState: CameraOccupancySnapshotSchema
+      runtimeState: CameraOccupancySnapshotSchema,
+      /**
+      * Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ZoneRuleStageEnum = zod.z.enum([
       "motion",
@@ -45533,7 +46052,14 @@ var require_dist_DiScsb8j = __commonJS({
         motion: zod.z.array(ZoneRuleSchema).readonly(),
         detection: zod.z.array(ZoneRuleSchema).readonly(),
         package: zod.z.array(ZoneRuleSchema).readonly()
-      })
+      }),
+      /**
+      * Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored"
     };
     var RUNTIME_DEFAULTS = {
       "features.streaming": true,
@@ -51676,6 +52202,264 @@ var require_dist_DiScsb8j = __commonJS({
       "network-access": "ingress",
       "smtp-provider": "email"
     });
+    var RUNTIME_STATE_POLICY = {
+      "air-quality-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "alarm-panel": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "ambient-light-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "audio-metrics": {
+        durability: "session",
+        volatileFields: []
+      },
+      "automation-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "battery": {
+        durability: "restored",
+        volatileFields: ["lastUpdated"]
+      },
+      "binary": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "brightness": {
+        durability: "session",
+        volatileFields: []
+      },
+      "camera-streams": {
+        durability: "session",
+        volatileFields: []
+      },
+      "carbon-monoxide": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "climate-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "color": {
+        durability: "session",
+        volatileFields: []
+      },
+      "connectivity": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "consumables": {
+        durability: "session",
+        volatileFields: []
+      },
+      "contact": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "cover": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "day-night": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "device-discovery": {
+        durability: "session",
+        volatileFields: []
+      },
+      "device-status": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "doorbell": {
+        durability: "restored",
+        volatileFields: []
+      },
+      "enum-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "event-emitter": {
+        durability: "session",
+        volatileFields: []
+      },
+      "fan-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "feature-probe": {
+        durability: "session",
+        volatileFields: []
+      },
+      "flood": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "gas": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "humidifier": {
+        durability: "session",
+        volatileFields: []
+      },
+      "humidity-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "image": {
+        durability: "session",
+        volatileFields: []
+      },
+      "image-settings": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "lawn-mower-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "lock-control": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "media-player": {
+        durability: "session",
+        volatileFields: []
+      },
+      "motion": {
+        durability: "session",
+        volatileFields: []
+      },
+      "motion-trigger": {
+        durability: "session",
+        volatileFields: []
+      },
+      "motion-zones": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "native-object-detection": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "notifier": {
+        durability: "session",
+        volatileFields: []
+      },
+      "numeric-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "pet-feeder": {
+        durability: "session",
+        volatileFields: []
+      },
+      "power-meter": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "presence": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "pressure-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "privacy-mask": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "ptz-autotrack": {
+        durability: "session",
+        volatileFields: []
+      },
+      "scene-monitor": {
+        durability: "session",
+        volatileFields: []
+      },
+      "script-runner": {
+        durability: "session",
+        volatileFields: []
+      },
+      "smoke": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "stream-params": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "switch": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "tamper": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "temperature-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "update": {
+        durability: "session",
+        volatileFields: []
+      },
+      "vacuum-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "valve": {
+        durability: "session",
+        volatileFields: []
+      },
+      "vibration": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "water-heater": {
+        durability: "session",
+        volatileFields: []
+      },
+      "weather": {
+        durability: "session",
+        volatileFields: []
+      },
+      "zone-analytics": {
+        durability: "session",
+        volatileFields: []
+      },
+      "zone-rules": {
+        durability: "restored",
+        volatileFields: []
+      },
+      "zones": {
+        durability: "restored",
+        volatileFields: []
+      }
+    };
+    function runtimeStatePolicyFor(capName) {
+      return RUNTIME_STATE_POLICY[capName] ?? SESSION_ONLY_POLICY;
+    }
+    var SESSION_ONLY_POLICY = {
+      durability: "session",
+      volatileFields: []
+    };
+    new Map(AUDIO_MACRO_LABELS.flatMap((macro2) => macro2.icon === void 0 ? [] : [[macro2.id, macro2.icon]]));
     var TimelapseTemplateSchema = zod.z.object({
       title: zod.z.string().max(500).optional(),
       body: zod.z.string().max(2e3).optional()
@@ -51812,25 +52596,32 @@ var require_dist_DiScsb8j = __commonJS({
     var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
     zod.z.object({
       /**
-      * How long a retained native frame is served before it counts as a miss.
+      * How many delivered frames the worker HOLDS at once, waiting for each one's
+      * detection result.
+      *
+      * This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+      * a time window was never related to the event the pixels were waiting for.
+      * A held frame now lives from delivery until the runner has its `FrameResult`
+      * — at which moment the runner cuts the subject tiles it actually wanted and
+      * releases the frame. The bound exists only so a runner that stops answering
+      * cannot pin RAM: above it the OLDEST held frame is dropped and counted.
       *
-      * Must cover the FULL late-crop horizon: detection inference + the
-      * cross-process inference-result hop to hub post-analysis + tracking + the
-      * tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-      * outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-      * RAM per busy camera grows linearly with no measured hit-rate gain.
+      * Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+      * 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+      * without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+      * Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+      * `holdOverflow` on the metrics line is what says you need it.
       */
-      ttlMs: zod.z.number().int().min(250).max(1e4),
+      holdFrames: zod.z.number().int().min(1).max(64),
       /**
       * Hard per-decode-worker RAM ceiling for retained native frames, in MB.
       *
-      * Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-      * which one is actually binding before reasoning from that. At the shipped
-      * 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-      * at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-      * `leaseFrames` on the metrics line say which. When the ceiling binds, a
-      * change that admits fewer frames buys retention WINDOW at constant RAM
-      * rather than giving RAM back — lower this knob if RAM is what you wanted.
+      * Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+      * is what decides how much is held, and the ceiling is the number above which
+      * something is wrong. Before that it was the effective cap — at 1024 MB with
+      * a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+      * with the TTL expiring nothing, which is exactly the confusion the hold
+      * removes. `leaseMb` / `leaseFrames` still say what is resident.
       * `0` DISABLES the lease entirely and falls the worker back to the tiny
       * leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
       * to replace).
@@ -51856,17 +52647,36 @@ var require_dist_DiScsb8j = __commonJS({
       * there is the signal that some caller names frames outside the inference set
       * and that this must go back to `all`.
       */
-      admission: NativeLeaseAdmissionSchema
+      admission: NativeLeaseAdmissionSchema,
+      /**
+      * RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+      * compressed native crops the worker cuts at the moment a frame's detection
+      * result arrives, and keeps long after the frame itself is freed.
+      *
+      * This is the knob that replaced the old retention window, and it buys about
+      * three orders of magnitude more of it: a tile is one subject at native
+      * resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+      * the frame it was cut from. A frame on which nothing was detected costs
+      * nothing at all, which is the real change — the old lease paid per FRAME and
+      * was interrogated per SUBJECT.
+      *
+      * `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+      * fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+      * reproduce that.
+      */
+      tileBudgetMb: zod.z.number().int().min(0).max(1024)
     });
     var DEFAULT_NATIVE_LEASE_SETTINGS = {
-      ttlMs: 1200,
+      holdFrames: 8,
       budgetMb: 1024,
       activityMs: 15e3,
+      tileBudgetMb: 64,
       admission: "inferred"
     };
-    DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+    DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
     DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
     DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+    DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
     DEFAULT_NATIVE_LEASE_SETTINGS.admission;
     var ADDON_ID_PREFIX = "addon:";
     function bareAddonId(id) {
@@ -52467,6 +53277,12 @@ var require_dist_DiScsb8j = __commonJS({
         return resolveCapMount;
       }
     });
+    Object.defineProperty(exports, "runtimeStatePolicyFor", {
+      enumerable: true,
+      get: function() {
+        return runtimeStatePolicyFor;
+      }
+    });
     Object.defineProperty(exports, "scopeKey", {
       enumerable: true,
       get: function() {
@@ -52563,7 +53379,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -53376,7 +54192,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -53470,7 +54286,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -56168,7 +56984,7 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -59364,8 +60180,60 @@ var require_device_manager_addon = __commonJS({
         return current;
       };
     };
+    function persistableBlob(blob, policyFor) {
+      const out = {};
+      for (const [capName, slice] of Object.entries(blob)) {
+        if (policyFor(capName).durability !== "restored") continue;
+        out[capName] = { ...slice };
+      }
+      return out;
+    }
+    function sliceEffectivelyEqual(a, b, volatileFields) {
+      const skip = new Set(volatileFields);
+      const keys = /* @__PURE__ */ new Set();
+      for (const k of Object.keys(a)) if (!skip.has(k)) keys.add(k);
+      for (const k of Object.keys(b)) if (!skip.has(k)) keys.add(k);
+      for (const k of keys) {
+        if (!deepEqual(a[k], b[k])) return false;
+        if (Object.hasOwn(a, k) !== Object.hasOwn(b, k)) return false;
+      }
+      return true;
+    }
+    function effectivelyEqual(before, after, policyFor) {
+      const caps = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+      for (const capName of caps) {
+        const a = before[capName];
+        const b = after[capName];
+        if (a === void 0 || b === void 0) return false;
+        if (!sliceEffectivelyEqual(a, b, policyFor(capName).volatileFields)) return false;
+      }
+      return true;
+    }
+    function deepEqual(a, b) {
+      if (a === b) return true;
+      if (typeof a === "number" && typeof b === "number") return Number.isNaN(a) && Number.isNaN(b);
+      if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+      const aIsArray = Array.isArray(a);
+      if (aIsArray !== Array.isArray(b)) return false;
+      if (aIsArray) {
+        const bArr = b;
+        if (a.length !== bArr.length) return false;
+        for (let i = 0; i < a.length; i += 1) if (!deepEqual(a[i], bArr[i])) return false;
+        return true;
+      }
+      const aRec = a;
+      const bRec = b;
+      const aKeys = Object.keys(aRec);
+      if (aKeys.length !== Object.keys(bRec).length) return false;
+      for (const k of aKeys) {
+        if (!Object.hasOwn(bRec, k)) return false;
+        if (!deepEqual(aRec[k], bRec[k])) return false;
+      }
+      return true;
+    }
     var DeviceStateMirror = class DeviceStateMirror2 {
       ctx;
+      policyFor;
       /**
       * Hub-side mirror of every device's cap-keyed runtime state.
       * Key: deviceId. Value: per-cap slice map. Empty by default —
@@ -59379,8 +60247,24 @@ var require_device_manager_addon = __commonJS({
       */
       runtimeStateDebounce = /* @__PURE__ */ new Map();
       static RUNTIME_STATE_DEBOUNCE_MS = 1e3;
-      constructor(ctx) {
+      /**
+      * What is believed to be ON DISK for each device — the persistable projection
+      * of the last blob actually written (or seeded at boot). The effective-change
+      * gate compares against THIS, not against the previous mirror state: two
+      * clock-only ticks in a row must not add up to a write just because each was
+      * compared with its immediate predecessor.
+      */
+      lastPersisted = /* @__PURE__ */ new Map();
+      /**
+      * Per-device count of writes the effective-change gate skipped since the last
+      * real one. Reported on the next write that DOES happen, so the log says how
+      * much churn the gate absorbed instead of saying nothing at all — a branch
+      * that drops work silently reads as "never happened".
+      */
+      skippedSinceWrite = /* @__PURE__ */ new Map();
+      constructor(ctx, policyFor = require_dist10.runtimeStatePolicyFor) {
         this.ctx = ctx;
+        this.policyFor = policyFor;
       }
       /**
       * Single-cap mirror update — diff against the current mirror,
@@ -59407,13 +60291,23 @@ var require_device_manager_addon = __commonJS({
         return true;
       }
       /**
-      * Debounced disk writer. Coalesces frequent writes (motion phase
-      * transitions, battery pushes) into one `writeDeviceRuntimeState`
-      * per `RUNTIME_STATE_DEBOUNCE_MS` window. Reads the per-device
-      * blob from the live mirror at flush time so the disk picture is
+      * Debounced disk writer, behind two gates.
+      *
+      * GATE — DURABILITY: a change to a `durability: 'session'` cap never even
+      * arms the timer. That is where the fleet's write rate goes: `audio-metrics`
+      * and `zone-analytics` are ~90 % of the offered 12–19 writes/s, they change
+      * genuinely every second, and their restored value is worthless.
+      *
+      * GATE — EFFECTIVE CHANGE (at flush): the persistable blob is compared with
+      * what is believed to be on disk, ignoring the clock fields each cap declared
+      * volatile. `battery` wrote its blob 526 times in 25 minutes without one
+      * percentage moving; this is the gate that turns those into one write.
+      *
+      * The blob is read from the live mirror at flush time, so the disk picture is
       * always the latest state — no risk of writing a stale snapshot.
       */
-      scheduleRuntimeStateDiskWrite(deviceId, settings) {
+      scheduleRuntimeStateDiskWrite(deviceId, settings, changedCap) {
+        if (this.policyFor(changedCap).durability !== "restored") return;
         let slot = this.runtimeStateDebounce.get(deviceId);
         if (!slot) {
           slot = {
@@ -59425,10 +60319,21 @@ var require_device_manager_addon = __commonJS({
         if (slot.timer) return;
         slot.timer = setTimeout(() => {
           slot.timer = null;
-          const blob = this.snapshotForDevice(deviceId);
+          const blob = this.persistableForDevice(deviceId);
+          if (this.isAlreadyPersisted(deviceId, blob)) return;
+          const skipped = this.skippedSinceWrite.get(deviceId) ?? 0;
+          this.skippedSinceWrite.delete(deviceId);
           const write = (async () => {
             try {
               await settings.writeDeviceRuntimeState(deviceId, blob);
+              this.lastPersisted.set(deviceId, blob);
+              if (skipped > 0) this.ctx.logger.debug("runtime state persisted", {
+                tags: { deviceId },
+                meta: {
+                  caps: Object.keys(blob).length,
+                  skippedSinceLastWrite: skipped
+                }
+              });
             } catch (err) {
               this.ctx.logger.warn("writeDeviceRuntimeState failed", {
                 tags: { deviceId },
@@ -59442,6 +60347,22 @@ var require_device_manager_addon = __commonJS({
         }, DeviceStateMirror2.RUNTIME_STATE_DEBOUNCE_MS);
       }
       /**
+      * True when `blob` differs from what is believed to be on disk only in fields
+      * the owning caps declared volatile. Counts the skip so the next real write
+      * can report how much churn was absorbed.
+      */
+      isAlreadyPersisted(deviceId, blob) {
+        const onDisk = this.lastPersisted.get(deviceId);
+        if (!onDisk) return false;
+        if (!effectivelyEqual(onDisk, blob, this.policyFor)) return false;
+        this.skippedSinceWrite.set(deviceId, (this.skippedSinceWrite.get(deviceId) ?? 0) + 1);
+        return true;
+      }
+      /** The device's mirror, restricted to the slices that may reach disk. */
+      persistableForDevice(deviceId) {
+        return persistableBlob(this.snapshotForDevice(deviceId), this.policyFor);
+      }
+      /**
       * One-shot mirror seed used by `loadRuntimeState` at boot so the
       * hub knows about every persisted slice without waiting for the
       * first `setCapSlice` call. No events emitted — this is
@@ -59461,6 +60382,7 @@ var require_device_manager_addon = __commonJS({
           if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
           perCap.set(capName, { ...raw });
         }
+        this.lastPersisted.set(deviceId, persistableBlob(this.snapshotForDevice(deviceId), this.policyFor));
       }
       /**
       * The hub mirror's `feature-probe.lastProbedAt` is a PER-SESSION liveness
@@ -59574,15 +60496,15 @@ var require_device_manager_addon = __commonJS({
           if (slot.timer) {
             clearTimeout(slot.timer);
             slot.timer = null;
-            if (settings) {
-              const blob = this.snapshotForDevice(deviceId);
-              pending.push(settings.writeDeviceRuntimeState(deviceId, blob).catch((err) => {
-                this.ctx.logger.warn("shutdown writeDeviceRuntimeState failed", {
-                  tags: { deviceId },
-                  meta: { error: err instanceof Error ? err.message : String(err) }
-                });
-              }));
-            }
+            const blob = settings ? this.persistableForDevice(deviceId) : null;
+            if (settings && blob !== null && !this.isAlreadyPersisted(deviceId, blob)) pending.push(settings.writeDeviceRuntimeState(deviceId, blob).then(() => {
+              this.lastPersisted.set(deviceId, blob);
+            }).catch((err) => {
+              this.ctx.logger.warn("shutdown writeDeviceRuntimeState failed", {
+                tags: { deviceId },
+                meta: { error: err instanceof Error ? err.message : String(err) }
+              });
+            }));
           }
           if (slot.inFlight) pending.push(slot.inFlight);
         }
@@ -60009,7 +60931,7 @@ var require_device_manager_addon = __commonJS({
             setCapSlice: async (input) => {
               const { deviceId, capName, slice } = input;
               if (!await resolvePersistedById(deviceId)) throw new Error(`[device-manager] setCapSlice: unknown device id=${deviceId}`);
-              if (stateMirror.applySingleCapUpdate(deviceId, capName, slice)) stateMirror.scheduleRuntimeStateDiskWrite(deviceId, settings);
+              if (stateMirror.applySingleCapUpdate(deviceId, capName, slice)) stateMirror.scheduleRuntimeStateDiskWrite(deviceId, settings, capName);
             }
           }
         }];
@@ -60050,7 +60972,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -60187,7 +61109,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -60377,7 +61299,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -68061,7 +68983,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -68626,7 +69548,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -69568,7 +70490,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -70684,7 +71606,7 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -71356,6 +72278,42 @@ var require_sqlite_settings_addon = __commonJS({
         const where = this.prefixWhere(`${addonId}:${deviceId}.`);
         this.getDb().prepare(`DELETE FROM "addon-device-settings" WHERE ${where.sql}`).run(...where.params);
       }
+      static LEGACY_RUNTIME_STATE_ADDON_ID = "__device-state";
+      /**
+      * The device's whole cap-slice map. Canonical row first, legacy prefix as the
+      * fallback. `{}` — never null — when the device has never persisted a slice,
+      * because every caller treats the result as a cap map to iterate.
+      */
+      getDeviceRuntimeState(deviceId) {
+        this.requireDeclared("device-runtime-state");
+        const row = this.getDb().prepare('SELECT data FROM "device-runtime-state" WHERE id = ?').get(deviceId);
+        if (row) return parseRowData(row.data);
+        return this.getAddonDevice(SqliteSettingsBackend2.LEGACY_RUNTIME_STATE_ADDON_ID, deviceId);
+      }
+      /**
+      * Replace the device's whole cap-slice map. Replace, not merge — the caller
+      * always hands over the full persistable blob, and merging would resurrect a
+      * slice the durability policy has since stopped persisting.
+      */
+      setDeviceRuntimeState(deviceId, blob) {
+        this.requireDeclared("device-runtime-state");
+        this.requireDeclared("addon-device-settings");
+        const db = this.getDb();
+        const upsert = db.prepare(`INSERT INTO "device-runtime-state" (id, data) VALUES (?, ?)
+       ON CONFLICT(id) DO UPDATE SET data = excluded.data`);
+        const legacy = this.prefixWhere(`${SqliteSettingsBackend2.LEGACY_RUNTIME_STATE_ADDON_ID}:${deviceId}.`);
+        const retire = db.prepare(`DELETE FROM "addon-device-settings" WHERE ${legacy.sql}`);
+        db.transaction(() => {
+          upsert.run(deviceId, JSON.stringify(blob));
+          retire.run(...legacy.params);
+        })();
+      }
+      /** Forget the device's runtime state in BOTH stores (device removal). */
+      clearDeviceRuntimeState(deviceId) {
+        this.requireDeclared("device-runtime-state");
+        this.getDb().prepare('DELETE FROM "device-runtime-state" WHERE id = ?').run(deviceId);
+        this.clearAddonDevice(SqliteSettingsBackend2.LEGACY_RUNTIME_STATE_ADDON_ID, deviceId);
+      }
       /** Seed system-settings with runtime defaults (first boot) */
       async seedDefaults() {
         this.requireDeclared("system-settings");
@@ -72199,7 +73157,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -74040,7 +74998,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -92101,7 +93059,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -93252,9 +94210,9 @@ var require_event_category_DxZbWydC = __commonJS({
   }
 });
 
-// ../types/dist/sleep-BszXLEvP.js
-var require_sleep_BszXLEvP = __commonJS({
-  "../types/dist/sleep-BszXLEvP.js"(exports) {
+// ../types/dist/sleep-Dh1EJSqF.js
+var require_sleep_Dh1EJSqF = __commonJS({
+  "../types/dist/sleep-Dh1EJSqF.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_DxZbWydC();
     var zod = require_zod();
@@ -94862,6 +95820,7 @@ var require_sleep_BszXLEvP = __commonJS({
       const value = Reflect.get(context, CAP_NODE_PIN_CONTEXT_KEY);
       return typeof value === "string" ? value : void 0;
     }
+    var DEFAULT_RUNTIME_STATE_DURABILITY = "session";
     function resolveCapMount(def) {
       if (def.mount) return def.mount;
       if (def.deviceNative === true) return { kind: "device-native" };
@@ -96247,6 +97206,12 @@ var require_sleep_BszXLEvP = __commonJS({
         return DATAPLANE_SECRET_HEADER;
       }
     });
+    Object.defineProperty(exports, "DEFAULT_RUNTIME_STATE_DURABILITY", {
+      enumerable: true,
+      get: function() {
+        return DEFAULT_RUNTIME_STATE_DURABILITY;
+      }
+    });
     Object.defineProperty(exports, "DEVICE_SCOPED_CAPS", {
       enumerable: true,
       get: function() {
@@ -96670,7 +97635,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_DxZbWydC();
-    var require_sleep = require_sleep_BszXLEvP();
+    var require_sleep = require_sleep_Dh1EJSqF();
     var require_err_msg = require_err_msg_COpsHMw2();
     var COLLECTION_ARRAY_METHODS = Object.freeze({
       "addon-pages-source": ["listPages"],
@@ -114114,7 +115079,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_DiScsb8j();
+    var require_dist10 = require_dist_D4nuaPdd();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -117666,23 +118631,15 @@ var require_dist3 = __commonJS({
       * installs from the admin UI go through `install()` instead, which
       * defaults to npm in production.
       *
-      * @param packages — optional custom package list (default: REQUIRED_PACKAGES)
-      * @param pins — optional `name → exact version` map. A named package is
-      *   fetched at THAT version instead of the registry's `latest`.
+      * There is no version argument and there is deliberately no pin: the system is
+      * addons-agnostic and `latest` is the whole contract at first boot (operator,
+      * 2026-08-13). A copy already under the addon root is never replaced either —
+      * bootstrap is seed-only, and overwriting a deployed bundle would be an
+      * un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
       *
-      *   Preparation for [D45](../../../../docs/decisions/adr-0045.md) task 32: the
-      *   image seed answers first today, so `latest` has never been the version a
-      *   node actually got. Once the image stops baking an addon tree under `/opt`
-      *   this call IS the answer, and it has to be the version the running closure was
-      *   published with — otherwise a node fetches latest-of-everything and its
-      *   addon set depends on the minute it first booted. Passing nothing keeps
-      *   exactly today's behaviour, and `launcher.ts` passes nothing yet.
-      *
-      *   A pin never triggers a re-install: bootstrap stays seed-only, so a copy
-      *   already under the addon root is left alone whatever its version. Replacing
-      *   it would be an un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
+      * @param packages — optional custom package list (default: REQUIRED_PACKAGES)
       */
-      async ensureRequiredPackages(packages, pins) {
+      async ensureRequiredPackages(packages) {
         const pkgList = packages ?? AddonInstaller2.REQUIRED_PACKAGES;
         ensureDir(this.addonsDir);
         const isLocal = this.installSource !== "npm" && this.workspaceDir != null;
@@ -117710,7 +118667,7 @@ var require_dist3 = __commonJS({
               }
               this.logger.info(`${packageName} \u2014 not found locally, trying npm`);
             }
-            await this.installFromNpm(packageName, pins?.[packageName]);
+            await this.installFromNpm(packageName);
           } catch (err) {
             const msg = require_dist10.errMsg(err);
             if (packageName === "@camstack/system") throw new Error(`Required package ${packageName} failed to install: ${msg}`, { cause: err });
@@ -122833,6 +123790,32 @@ var require_dist3 = __commonJS({
         if (this.settingsStore === null) return;
         this.settingsStore.clearAddonDevice(addonId, deviceId);
       }
+      /**
+      * The device's persisted runtime-state blob. `{}` before the settings store
+      * is wired — the same answer as "this device has never persisted a slice",
+      * which is what every caller already handles.
+      */
+      getDeviceRuntimeState(deviceId) {
+        if (this.settingsStore === null) return {};
+        return this.settingsStore.getDeviceRuntimeState(deviceId);
+      }
+      /**
+      * Replace the device's persisted runtime-state blob.
+      *
+      * THROWS when the store is not wired, and that is deliberate: the caller
+      * (`DeviceStateMirror.scheduleRuntimeStateDiskWrite`) catches and logs, so a
+      * persist that cannot happen leaves a line naming the device. A silent no-op
+      * here is the shape that let a whole collection read zero for months.
+      */
+      setDeviceRuntimeState(deviceId, blob) {
+        if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+        this.settingsStore.setDeviceRuntimeState(deviceId, blob);
+      }
+      /** Forget the device's runtime state. No-op before the store is wired. */
+      clearDeviceRuntimeState(deviceId) {
+        if (this.settingsStore === null) return;
+        this.settingsStore.clearDeviceRuntimeState(deviceId);
+      }
       createSettingsView(addonId) {
         const cm = this;
         return {
@@ -122861,13 +123844,13 @@ var require_dist3 = __commonJS({
             cm.clearAddonDevice(addonId, String(deviceId));
           },
           async readDeviceRuntimeState(deviceId) {
-            return cm.getAddonDevice("__device-state", String(deviceId));
+            return cm.getDeviceRuntimeState(String(deviceId));
           },
           async writeDeviceRuntimeState(deviceId, data) {
-            cm.setAddonDevice("__device-state", String(deviceId), data);
+            cm.setDeviceRuntimeState(String(deviceId), data);
           },
           async clearDeviceRuntimeState(deviceId) {
-            cm.clearAddonDevice("__device-state", String(deviceId));
+            cm.clearDeviceRuntimeState(String(deviceId));
           },
           async getSection(section) {
             return cm.getSection(section);
@@ -233137,6 +234120,271 @@ var require_agent_http = __commonJS({
   }
 });
 
+// ../../server/backend/dist/single-copy-cleanup.js
+var require_single_copy_cleanup = __commonJS({
+  "../../server/backend/dist/single-copy-cleanup.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.CLOSURE_PROVIDED_PACKAGES = void 0;
+    exports.planSingleCopyCleanup = planSingleCopyCleanup;
+    exports.executeSingleCopyCleanup = executeSingleCopyCleanup;
+    exports.formatCleanupPlan = formatCleanupPlan;
+    exports.discoverRedundantCopies = discoverRedundantCopies;
+    exports.isCleanupEnabled = isCleanupEnabled;
+    var IMAGE_PREFIX = "/opt/";
+    function planSingleCopyCleanup(input) {
+      const blockedReason = nodeWideBlock(input);
+      if (blockedReason !== null) {
+        return {
+          remove: [],
+          keep: input.candidates.map((candidate) => ({ candidate, reason: blockedReason })),
+          blocked: true,
+          blockedReason
+        };
+      }
+      const remove = [];
+      const keep = [];
+      for (const candidate of input.candidates) {
+        const refusal = perCandidateRefusal(candidate, input);
+        if (refusal === null)
+          remove.push(candidate);
+        else
+          keep.push({ candidate, reason: refusal });
+      }
+      return { remove, keep, blocked: false, blockedReason: null };
+    }
+    function nodeWideBlock(input) {
+      if (!input.bootHealthy) {
+        return "this boot is not confirmed healthy \u2014 the redundant copies are the recovery path and stay";
+      }
+      if (input.activeRoot === null) {
+        return "baked mode: there is no active closure, so the node is running FROM the fallback tree";
+      }
+      if (input.closureResolvedFrom === null) {
+        return "the process resolved no @camstack/system at all \u2014 nothing here is safe to remove";
+      }
+      if (!isInside(input.closureResolvedFrom, input.activeRoot)) {
+        return `@camstack/system resolved from ${input.closureResolvedFrom}, which is OUTSIDE the active closure \u2014 the copy being removed could be the one in memory`;
+      }
+      return null;
+    }
+    function perCandidateRefusal(candidate, input) {
+      if (input.activeRoot !== null && isInside(candidate.path, input.activeRoot)) {
+        return "inside the active closure \u2014 this is the copy that runs, not a redundant one";
+      }
+      if (candidate.path.startsWith(IMAGE_PREFIX)) {
+        return "an image tree \u2014 the operator keeps it as the first-boot and fallback source";
+      }
+      const onNodePath = input.nodePathEntries.some((entry) => entry === candidate.path || isInside(entry, candidate.path));
+      if (onNodePath) {
+        return "still on NODE_PATH \u2014 a live resolution path, whatever the boot mode says";
+      }
+      return null;
+    }
+    function isInside(child, parent) {
+      const normalise = (p2) => p2.endsWith("/") ? p2.slice(0, -1) : p2;
+      const c = normalise(child);
+      const p = normalise(parent);
+      return c === p || c.startsWith(`${p}/`);
+    }
+    async function executeSingleCopyCleanup(plan, fs, log) {
+      if (plan.blocked) {
+        log(`single-copy cleanup REFUSED \u2014 ${plan.blockedReason ?? "blocked"}`);
+        return { removed: [], failed: [], refused: true };
+      }
+      const removed = [];
+      const failed = [];
+      for (const candidate of plan.remove) {
+        if (!fs.exists(candidate.path))
+          continue;
+        const label = `${candidate.pkg ?? candidate.kind} ${candidate.version ?? "<unknown version>"}`;
+        const aside = `${candidate.path}.removing-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+        try {
+          await fs.rename(candidate.path, aside);
+        } catch (err) {
+          failed.push(candidate.path);
+          log(`single-copy cleanup \u2014 could NOT remove ${candidate.path} (${label}): ${errMsg(err)}`);
+          continue;
+        }
+        removed.push(candidate.path);
+        log(`single-copy cleanup \u2014 removed ${candidate.path} (${label})`);
+        try {
+          await fs.remove(aside);
+        } catch (err) {
+          log(`single-copy cleanup \u2014 ${aside} still on disk (held open?): ${errMsg(err)}`);
+        }
+      }
+      return { removed, failed, refused: false };
+    }
+    function errMsg(err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+    function formatCleanupPlan(plan) {
+      const lines = [];
+      if (plan.blocked) {
+        lines.push(`single-copy cleanup blocked \u2014 ${plan.blockedReason ?? "unknown reason"}; ${plan.keep.length} copy(ies) kept`);
+      } else {
+        lines.push(`single-copy cleanup \u2014 ${plan.remove.length} copy(ies) to remove`);
+      }
+      for (const c of plan.remove) {
+        lines.push(`  remove ${c.path} \u2014 ${c.pkg ?? c.kind} ${c.version ?? "<unknown version>"}`);
+      }
+      for (const k of plan.keep) {
+        lines.push(`  keep   ${k.candidate.path} \u2014 ${k.candidate.pkg ?? k.candidate.kind} ${k.candidate.version ?? "<unknown version>"}: ${k.reason}`);
+      }
+      return lines;
+    }
+    exports.CLOSURE_PROVIDED_PACKAGES = [
+      "@camstack/system",
+      "@camstack/types",
+      "@camstack/sdk",
+      "@camstack/shm-ring",
+      "@camstack/ui-library"
+    ];
+    function discoverRedundantCopies(input, fs) {
+      const found = [];
+      const legacyFramework = `${trimSlash(input.dataDir)}/framework`;
+      if (fs.exists(legacyFramework)) {
+        found.push({
+          kind: "legacy-framework-tree",
+          path: legacyFramework,
+          pkg: null,
+          version: fs.readVersion(`${legacyFramework}/node_modules/@camstack/system`)
+        });
+      }
+      for (const pkg of exports.CLOSURE_PROVIDED_PACKAGES) {
+        if (!input.closureProvides(pkg))
+          continue;
+        const dir = `${trimSlash(input.addonRoot)}/${pkg}`;
+        if (!fs.exists(dir))
+          continue;
+        found.push({
+          kind: "addon-root-closure-copy",
+          path: dir,
+          pkg,
+          version: fs.readVersion(dir)
+        });
+      }
+      return found;
+    }
+    function trimSlash(p) {
+      return p.endsWith("/") ? p.slice(0, -1) : p;
+    }
+    function isCleanupEnabled(env) {
+      const raw = env["CAMSTACK_SINGLE_COPY_CLEANUP"]?.trim().toLowerCase();
+      return raw !== "off" && raw !== "0" && raw !== "false";
+    }
+  }
+});
+
+// ../../server/backend/dist/single-copy-cleanup-runner.js
+var require_single_copy_cleanup_runner = __commonJS({
+  "../../server/backend/dist/single-copy-cleanup-runner.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.runSingleCopyCleanup = runSingleCopyCleanup;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var single_copy_cleanup_js_1 = require_single_copy_cleanup();
+    var EMPTY_RESULT = { removed: [], failed: [], refused: true };
+    async function runSingleCopyCleanup(opts) {
+      try {
+        if (!(0, single_copy_cleanup_js_1.isCleanupEnabled)(process.env)) {
+          opts.log("single-copy cleanup disabled by CAMSTACK_SINGLE_COPY_CLEANUP \u2014 nothing removed");
+          return EMPTY_RESULT;
+        }
+        const candidates = (0, single_copy_cleanup_js_1.discoverRedundantCopies)({
+          dataDir: opts.dataDir,
+          addonRoot: opts.addonRoot,
+          closureProvides: (pkg) => {
+            try {
+              __require.resolve(`${pkg}/package.json`);
+              return true;
+            } catch {
+              return false;
+            }
+          }
+        }, {
+          exists: (p) => fs.existsSync(p),
+          readVersion: (dir) => readVersion(dir)
+        });
+        const plan = (0, single_copy_cleanup_js_1.planSingleCopyCleanup)({
+          activeRoot: process.env["CAMSTACK_SERVER_ACTIVE_ROOT"] ?? null,
+          closureResolvedFrom: resolveSystemPath(),
+          bootHealthy: true,
+          nodePathEntries: (process.env["NODE_PATH"] ?? "").split(process.platform === "win32" ? ";" : ":").map((entry) => entry.trim()).filter((entry) => entry.length > 0),
+          candidates
+        });
+        for (const line of (0, single_copy_cleanup_js_1.formatCleanupPlan)(plan))
+          opts.log(line);
+        return await (0, single_copy_cleanup_js_1.executeSingleCopyCleanup)(plan, {
+          exists: (p) => fs.existsSync(p),
+          rename: (from, to) => fs.renameSync(from, to),
+          remove: async (p) => {
+            await fs.promises.rm(p, { recursive: true, force: true });
+          }
+        }, opts.log);
+      } catch (err) {
+        opts.log(`single-copy cleanup failed: ${err instanceof Error ? err.message : String(err)} \u2014 nothing was removed`);
+        return EMPTY_RESULT;
+      }
+    }
+    function resolveSystemPath() {
+      try {
+        return __require.resolve("@camstack/system/package.json");
+      } catch {
+        return null;
+      }
+    }
+    function readVersion(packageDir) {
+      try {
+        const raw = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf-8"));
+        const version = typeof raw === "object" && raw !== null ? raw.version : void 0;
+        return typeof version === "string" ? version : null;
+      } catch {
+        return null;
+      }
+    }
+  }
+});
+
 // ../types/dist/enums.js
 var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
@@ -233163,7 +234411,7 @@ var require_dist9 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_DxZbWydC();
-    var require_sleep = require_sleep_BszXLEvP();
+    var require_sleep = require_sleep_Dh1EJSqF();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -238254,7 +239502,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           low: zod.z.string().optional()
         }),
         lastChangedAt: zod.z.number()
-      })
+      }),
+      /**
+      * Runtime-state durability: **session** — a restored `slotStatuses: streaming` for a camera that has been dark for two hours is a lie the UI renders as truth.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     function isVoidInput(schema) {
       const def2 = schema._def;
@@ -239033,6 +240288,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         kind: "poll"
       },
       runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: zod.z.number().int().nonnegative() }),
+      /**
+      * Runtime-state durability: **session** — 5.7 KB of scan output on the largest device, fully re-derivable by re-scanning.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session",
       methods: {
         /**
         * Snapshot of the current `discovered` list. Returns the
@@ -241261,7 +242523,23 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * else — see `notification-center/action-token.ts` for what that does and
       * does not buy.
       */
-      destructive: zod.z.boolean().optional()
+      destructive: zod.z.boolean().optional(),
+      /**
+      * How the tap should REACH the url.
+      *
+      * `navigate` (absent, and every button authored before this field) opens it:
+      * the phone leaves the notification and shows whatever the callback returns.
+      * That is right for a button whose answer the operator wants to read.
+      *
+      * `background` fires it as a POST and stays put. It exists for the buttons
+      * whose whole point is not to interrupt — "silence this for 30 minutes" is
+      * an answer to the notification, and being thrown into a browser tab to
+      * confirm it costs more attention than the notification did. A backend that
+      * cannot do a background call renders it as an ordinary link (the adapters
+      * fall back rather than dropping the button), so this is a preference, never
+      * a requirement.
+      */
+      mode: zod.z.enum(["navigate", "background"]).optional()
     });
     var NotificationSchema = zod.z.object({
       body: zod.z.string(),
@@ -242397,7 +243675,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * full slice; renders an arm button per `availableModes` entry and
       * a PIN field iff `requiresCode === true`.
       */
-      runtimeState: AlarmPanelStatusSchema
+      runtimeState: AlarmPanelStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — armed state is the one thing a panel must not lose across a restart.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var MaskPointSchema = zod.z.object({
       x: zod.z.number(),
@@ -242501,6 +243789,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       packageNames: zod.z.array(zod.z.string().min(1)).min(1).optional()
     });
     var NC_MAX_PER_TRACK_IMMEDIATE = 1;
+    var NC_SNOOZE_MAX_MINUTES = 1440;
+    var NC_DEFAULT_SNOOZE_MINUTES = [
+      10,
+      30,
+      60
+    ];
     var NcScheduleWindowSchema = zod.z.object({
       /** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
       days: zod.z.array(zod.z.number().int().min(0).max(6)).min(1),
@@ -242758,15 +244052,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * (an `immediate` rule naming an `audio-*` class, one notification per
       * classified sample) stays exactly as it was for rules that already use it.
       *
-      * NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-      * rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-      * (`camstack/src/data/notification-center.ts`, guarded by
-      * `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+      * In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+      * rule rather than an accident: the viewer mirrors the descriptor enums BY
+      * HAND (`camstack/src/data/notification-center.ts`, guarded by
+      * `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
       * condition fields it does not know when a rule is saved from the phone.
       * Publishing an editor for a condition the app cannot round-trip is how an
-      * operator loses a rule's conditions by opening it — so the descriptor, the
-      * admin widget and the viewer mirror land together (P2 + P3), and only then
-      * does an audio rule become authorable.
+      * operator loses a rule's conditions by opening it — so the viewer mirror
+      * (P3, shipped) went FIRST, and the descriptor an editor renders from
+      * follows here.
       */
       audio: NcAudioConditionSchema.optional()
     });
@@ -242936,6 +244230,30 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       snoozeAllowGlobal: zod.z.boolean().optional(),
       /**
+      * The snooze durations THIS rule's notification offers as buttons, in
+      * minutes.
+      *
+      * Three states, and all three are distinct — which is exactly why this is
+      * `.optional()` and never `.default()`. A Zod default does not run on the
+      * addon cap path (three production failures in one day), so a schema default
+      * would collapse the first two:
+      *
+      * | value | meaning |
+      * | --- | --- |
+      * | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+      * | `[]` | **no snooze buttons on this rule** — the explicit override |
+      * | a list | these choices, de-duplicated and sorted, at most four |
+      *
+      * `.max(4)` because the notifier's own action budget is small (ntfy allows
+      * three buttons in total) and a rule that spent it all on snooze choices
+      * would push its own tap-through actions off the notification.
+      *
+      * An empty list is NOT an alarm exemption: a rule the alarm is about, or
+      * that arms the panel, is exempt automatically and cannot be silenced by a
+      * window from anywhere (D133).
+      */
+      snoozeOptions: zod.z.array(zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+      /**
       * Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
       *
       * This is what makes the rule set the alarm's trigger set without the alarm
@@ -243025,6 +244343,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         "device",
         "package",
         "occupancy",
+        "audio",
         "system"
       ]),
       label: zod.z.string(),
@@ -243043,6 +244362,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         "crossingSelect",
         "polygonDraw",
         "occupancy",
+        "audio",
         "deviceState",
         "systemEvent"
       ]),
@@ -243436,6 +244756,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         phase: "P1",
         description: "ZoneAnalytics occupancy edge (optionally zone/class-scoped): count crosses the threshold and holds for sustainSeconds. Fail-closed on a missing snapshot."
       },
+      {
+        id: "audio",
+        group: "audio",
+        label: "Sound",
+        valueType: "audio",
+        operator: "anyOf",
+        appliesTo: ["immediate"],
+        phase: "P2",
+        description: "Fires when at least hitPercent% of the samples in a samplingSeconds window are hits \u2014 a hit clears the dBFS floor AND carries one of the chosen sounds. Both filters are optional and independent, but naming NEITHER never matches: every sample would be a hit, so the engine refuses rather than notifying on silence. dBFS is negative-going (0 = full scale, -96 = silence)."
+      },
       {
         id: "customZones",
         group: "zones",
@@ -243534,7 +244864,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "device",
       "all"
     ]);
-    var NC_SNOOZE_MAX_MINUTES = 1440;
     var NcSnoozeInputSchema = zod.z.object({
       scope: NcSnoozeScopeSchema,
       /** Required when `scope: 'rule'` — a scoped snooze with no id matches
@@ -243542,6 +244871,19 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       ruleId: zod.z.string().optional(),
       /** Required when `scope: 'device'`. */
       deviceId: zod.z.number().int().optional(),
+      /**
+      * Narrow the window to these subject classes — "the cat, not the person".
+      *
+      * ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+      * what every window authored before this field meant, so no persisted row
+      * changes meaning and no client has to learn anything to keep working.
+      *
+      * It is what makes the window's real key `(deviceId, classes[])` and lets it
+      * cross rules (D133): the operator points at a camera and a kind of thing,
+      * not at whichever of their four rules happened to produce the notification
+      * they are dismissing.
+      */
+      classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
       durationMinutes: zod.z.number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
       /**
       * Silence this for EVERY recipient, not just the caller. Permission is
@@ -243566,6 +244908,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       scope: NcSnoozeScopeSchema,
       ruleId: zod.z.string().optional(),
       deviceId: zod.z.number().int().optional(),
+      /** Subject classes this window covers. ABSENT = every class — see
+      *  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+      *  no SQLite column: nothing queries a window by class. */
+      classes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
       startedAt: zod.z.number(),
       /** Exclusive: at exactly this instant the snooze is over. Expiry is a
       *  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -245838,7 +247184,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * handle. Slice shape is `{ zones: Zone[] }` so future extensions
       * (e.g. zone groupings) can sit alongside the polygon list.
       */
-      runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() })
+      runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
+      /**
+      * Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored"
     };
     var NativeCropBboxSchema = zod.z.object({
       x: zod.z.number(),
@@ -249285,7 +250638,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: AirQualitySensorStatusSchema,
         kind: "push"
       },
-      runtimeState: AirQualitySensorStatusSchema
+      runtimeState: AirQualitySensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var AmbientLightSensorStatusSchema = zod.z.object({
       /** Current illuminance in lux (lx). */
@@ -249313,7 +250676,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: AmbientLightSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: AmbientLightSensorStatusSchema
+      runtimeState: AmbientLightSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var AudioClassSummarySchema = zod.z.object({
       className: zod.z.string(),
@@ -249403,7 +250776,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }), AudioMetricsHistorySchema)
       },
       /** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
-      runtimeState: AudioMetricsSnapshotSchema
+      runtimeState: AudioMetricsSnapshotSchema,
+      /**
+      * Runtime-state durability: **session** — 1 Hz per camera at the mirror and ~63 % of the fleet's whole runtime-state write rate. `avgDbfs` is a rolling 60 s mean that genuinely moves every second, so no equality fix reclaims it — and a two-hour-old dB reading rendered as current is worse than no reading.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var AutomationControlStatusSchema = zod.z.object({
       /** Whether the automation is currently enabled. Disabled automations
@@ -249454,7 +250834,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
       * (badge) directly.
       */
-      runtimeState: AutomationControlStatusSchema
+      runtimeState: AutomationControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — the authority for an automation being enabled is the automation store; a restored `isRunning` would be a lie. D62: one authority per switch.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var BatteryStatusSchema = zod.z.object({
       /** 0..100 inclusive. Firmware-reported. */
@@ -249555,7 +250942,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * via `device.runtimeState.getCapState('battery')` regardless of
       * the underlying driver.
       */
-      runtimeState: BatteryStatusSchema
+      runtimeState: BatteryStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a sleeping battery camera may not report for hours; the restored percentage is the only thing the UI and the sleep gate have. Zero churn once `lastUpdated` is excluded — 526 writes, 0 value changes, in 25 minutes.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastUpdated"]
     };
     var BinaryStatusSchema = zod.z.object({
       on: zod.z.boolean(),
@@ -249573,7 +250970,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: BinaryStatusSchema,
         kind: "push"
       },
-      runtimeState: BinaryStatusSchema
+      runtimeState: BinaryStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — transition-driven sensor state; the restored value gives the boot comparison.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var BrightnessStatusSchema = zod.z.object({
       /** Current level as 0..100 inclusive. Firmware-reported. */
@@ -249615,7 +251022,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * by the kernel. Read via `device.state.brightness.value` so UI
       * sliders surface the current level without polling the provider.
       */
-      runtimeState: BrightnessStatusSchema
+      runtimeState: BrightnessStatusSchema,
+      /**
+      * Runtime-state durability: **session** — live lamp state, re-published by the provider on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var buttonCapability = {
       name: "button",
@@ -249695,7 +251109,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: CarbonMonoxideStatusSchema,
         kind: "push"
       },
-      runtimeState: CarbonMonoxideStatusSchema
+      runtimeState: CarbonMonoxideStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var HvacModeSchema = zod.z.enum([
       "off",
@@ -249824,7 +251248,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * the full slice via `device.state.climate-control.value` and refresh
       * on every push without re-querying the provider.
       */
-      runtimeState: ClimateControlStatusSchema
+      runtimeState: ClimateControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`; `currentTemp` moves continuously and is re-published on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var RgbTripletSchema = zod.z.object({
       r: zod.z.number().int().min(0).max(255),
@@ -249911,7 +251342,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * kernel. Read via `device.state.color.value` so UI pickers surface
       * the current chromaticity without polling the provider.
       */
-      runtimeState: ColorStatusSchema
+      runtimeState: ColorStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var CONNECTION_TEST_TIMEOUT_MS = 2e4;
     var ConnectionTestOutcomeSchema = zod.z.discriminatedUnion("outcome", [
@@ -249966,7 +251404,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: ConnectivityStatusSchema,
         kind: "push"
       },
-      runtimeState: ConnectivityStatusSchema
+      runtimeState: ConnectivityStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — same shape and same argument as `device-status`, for links rather than devices.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var ConsumableItemSchema = zod.z.object({
       /** Stable id, e.g. 'main-brush'. */
@@ -250033,7 +251481,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           }
         }
       },
-      runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() })
+      runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: zod.z.number() }),
+      /**
+      * Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ContactStatusSchema = zod.z.object({
       /** True when the entry is open; false when closed. */
@@ -250052,7 +251507,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: ContactStatusSchema,
         kind: "push"
       },
-      runtimeState: ContactStatusSchema
+      runtimeState: ContactStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a door left open across a restart must still read open.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var ControlKindSchema = zod.z.enum([
       "numeric",
@@ -250139,7 +251604,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * dropdown / text field / date picker) read the slice's discriminant
       * and value directly without polling the provider.
       */
-      runtimeState: ControlStatusSchema
+      runtimeState: ControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a generic control mirrors an external entity that re-publishes on connect; the options array is re-derived with it.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var CoverStateSchema = zod.z.enum([
       "open",
@@ -250201,7 +251673,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI controls watch
       * the slice for live position changes during a move.
       */
-      runtimeState: CoverStatusSchema
+      runtimeState: CoverStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — position survives a restart on the device; the mirror should agree at boot rather than read blank.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var DayNightModeSchema = zod.z.enum([
       "auto",
@@ -250262,7 +251744,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: DayNightStatusSchema,
         kind: "poll"
       },
-      runtimeState: DayNightStatusSchema
+      runtimeState: DayNightStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-set IR-cut behaviour; mutation-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var DeviceStatusSchema = zod.z.object({
       /**
@@ -250295,7 +251787,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: DeviceStatusSchema,
         kind: "push"
       },
-      runtimeState: DeviceStatusSchema
+      runtimeState: DeviceStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — the previous observation is what makes the first reading after a restart a COMPARISON instead of a phantom transition (D130). 32 real flips across 16 devices in 25 min — the busiest slice in the cold half.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var DoorbellStatusSchema = zod.z.object({
       /** Ms epoch of the last press. null = never observed since this provider started. */
@@ -250335,7 +251837,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * `device.state.doorbell.value`. UIs can show "last ring 5m ago"
       * without subscribing.
       */
-      runtimeState: DoorbellStatusSchema
+      runtimeState: DoorbellStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored"
     };
     var EnumSensorDateTimeFormatSchema = zod.z.enum([
       "date",
@@ -250365,7 +251874,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: EnumSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: EnumSensorStatusSchema
+      runtimeState: EnumSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`; 80 devices.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var EventFireSchema = zod.z.object({
       deviceId: zod.z.number(),
@@ -250391,7 +251910,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: EventEmitterStatusSchema,
         kind: "push"
       },
-      runtimeState: EventEmitterStatusSchema
+      runtimeState: EventEmitterStatusSchema,
+      /**
+      * Runtime-state durability: **session** — `eventCountSinceStart` names its own scope.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var EventItemSchema = zod.z.object({
       id: zod.z.string(),
@@ -250690,7 +252216,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI fan speed
       * sliders read `percentage` for live updates.
       */
-      runtimeState: FanControlStatusSchema
+      runtimeState: FanControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var FeatureProbeStatusSchema = zod.z.object({
       /**
@@ -250743,7 +252276,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: FeatureProbeStatusSchema,
         kind: "push"
       },
-      runtimeState: FeatureProbeStatusSchema
+      runtimeState: FeatureProbeStatusSchema,
+      /**
+      * Runtime-state durability: **session** — per-session by definition — `lastProbedAt` means "this worker completed a probe THIS session", which is why the mirror seed already blanks it. Persisting it only creates something to blank.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var FloodStatusSchema = zod.z.object({
       /** True when leak is currently detected. */
@@ -250762,7 +252302,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: FloodStatusSchema,
         kind: "push"
       },
-      runtimeState: FloodStatusSchema
+      runtimeState: FloodStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var GasStatusSchema = zod.z.object({
       detected: zod.z.boolean(),
@@ -250780,7 +252330,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: GasStatusSchema,
         kind: "push"
       },
-      runtimeState: GasStatusSchema
+      runtimeState: GasStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var HumidifierStatusSchema = zod.z.object({
       /** Whether the humidifier is currently on. */
@@ -250841,7 +252401,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live humidity / mode changes.
       */
-      runtimeState: HumidifierStatusSchema
+      runtimeState: HumidifierStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `climate-control`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var HumiditySensorStatusSchema = zod.z.object({
       /** Current relative humidity, 0..100. */
@@ -250869,7 +252436,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: HumiditySensorStatusSchema,
         kind: "push"
       },
-      runtimeState: HumiditySensorStatusSchema
+      runtimeState: HumiditySensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor` (67 of 75 writes were the clock alone).
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var ImageStatusSchema = zod.z.object({
       /** Absolute signed URL the browser loads directly. Null when the
@@ -250893,7 +252470,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. The UI reads `url`
       * directly and renders the still image.
       */
-      runtimeState: ImageStatusSchema
+      runtimeState: ImageStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a snapshot URL is a session-scoped handle; a restored one points at nothing.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ImageRotateSchema = zod.z.enum([
       "0",
@@ -250994,7 +252578,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: ImageSettingsStatusSchema,
         kind: "poll"
       },
-      runtimeState: ImageSettingsStatusSchema
+      runtimeState: ImageSettingsStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-set camera imaging; mutation-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var IntegrationWithStateSchema = zod.z.object({
       id: zod.z.string(),
@@ -251325,7 +252919,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live activity + battery changes.
       */
-      runtimeState: LawnMowerControlStatusSchema
+      runtimeState: LawnMowerControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `vacuum-control`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var InterfaceKindEnum = zod.z.enum([
       "lan",
@@ -251574,7 +253175,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * read `state` and disable themselves during `locking`/`unlocking`
       * transitions.
       */
-      runtimeState: LockControlStatusSchema
+      runtimeState: LockControlStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a lock left locked must still read locked.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var MediaPlayerStateSchema = zod.z.enum([
       "off",
@@ -251724,7 +253335,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * full slice for live now-playing, volume, and progress updates
       * without polling.
       */
-      runtimeState: MediaPlayerStatusSchema
+      runtimeState: MediaPlayerStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var MeshEndpointSchema = zod.z.object({
       /** Stable identifier within the provider (e.g. `mesh-ipv4`, `magicdns`, `funnel`). */
@@ -252008,7 +253626,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * `device.state.motion.value`. Reads never invoke the provider, so
       * UIs and other addons can poll the cached state safely.
       */
-      runtimeState: MotionStatusSchema
+      runtimeState: MotionStatusSchema,
+      /**
+      * Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var MotionTriggerStatusSchema = zod.z.object({
       enabled: zod.z.boolean(),
@@ -252045,7 +253670,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: MotionTriggerStatusSchema,
         kind: "command-driven"
       },
-      runtimeState: MotionTriggerRuntimeStateSchema
+      runtimeState: MotionTriggerRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var MotionZoneRegionSchema = zod.z.object({
       id: zod.z.number(),
@@ -252100,7 +253732,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: MotionZoneStatusSchema,
         kind: "poll"
       },
-      runtimeState: MotionZoneStatusSchema
+      runtimeState: MotionZoneStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var NativeObjectClassEnum = zod.z.enum([
       "person",
@@ -252163,7 +253805,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: NativeObjectDetectionStatusSchema,
         kind: "push"
       },
-      runtimeState: NativeObjectDetectionRuntimeStateSchema
+      runtimeState: NativeObjectDetectionRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var StreamNetworkStatsSchema = zod.z.object({
       nominalBitrateKbps: zod.z.number(),
@@ -252486,7 +254138,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * form reads `supports` to gate optional fields; history pane reads
       * `lastSentAt` / `lastError` / `queueDepth`.
       */
-      runtimeState: NotifierStatusSchema
+      runtimeState: NotifierStatusSchema,
+      /**
+      * Runtime-state durability: **session** — live queue depth and last-send state; a restored queue depth describes a queue that no longer exists.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var NumericSensorStatusSchema = zod.z.object({
       value: zod.z.number(),
@@ -252512,7 +254171,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: NumericSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: NumericSensorStatusSchema
+      runtimeState: NumericSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — polled value, low churn once the clock is excluded (251 of 669 writes were the clock alone); restoring it removes the cold window before the first poll.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var OsdOverlayKindEnum = zod.z.enum([
       "text",
@@ -252937,7 +254606,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * the full slice via `device.state.petFeeder.value` and refresh on
       * every poll without re-querying the provider.
       */
-      runtimeState: PetFeederStatusSchema
+      runtimeState: PetFeederStatusSchema,
+      /**
+      * Runtime-state durability: **session** — live appliance state re-published on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var VehicleSchema = zod.z.object({
       id: zod.z.string(),
@@ -253271,7 +254947,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: PowerMeterStatusSchema,
         kind: "push"
       },
-      runtimeState: PowerMeterStatusSchema
+      runtimeState: PowerMeterStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`; `kwhTotal` is an accumulator whose restored value is the baseline.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var GpsLocationSchema = zod.z.object({
       /** Latitude in decimal degrees, -90..90. */
@@ -253312,7 +254998,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * the map pin is rendered (use `DeviceFeature.PresenceGps` for the
       * pre-fetch fast-path check).
       */
-      runtimeState: PresenceStatusSchema
+      runtimeState: PresenceStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — occupancy-relevant: the restored state is what an occupancy rule compares the first post-restart observation against.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var PressureSensorStatusSchema = zod.z.object({
       /** Current pressure in hPa. */
@@ -253340,7 +255036,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: PressureSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: PressureSensorStatusSchema
+      runtimeState: PressureSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var PrivacyMaskShapeSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
     var PrivacyMaskRegionSchema = zod.z.object({
@@ -253439,7 +255145,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: PrivacyMaskStatusSchema,
         kind: "poll"
       },
-      runtimeState: PrivacyMaskStatusSchema
+      runtimeState: PrivacyMaskStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-drawn regions, zero real churn — 22 writes in 25 minutes, every one of them the clock.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     function summarisePrivacyAudio(profiles) {
       if (profiles.length === 0) return null;
@@ -253629,7 +255345,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * fetch / cache / fallback logic out of the four cap methods —
       * they become trampolines over `runtimeState`.
       */
-      runtimeState: PtzAutotrackRuntimeStateSchema
+      runtimeState: PtzAutotrackRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **session** — mirrors the camera's own autotrack config, re-read on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var rebootCapability = {
       name: "reboot",
@@ -254299,7 +256022,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: SceneMonitorStatusSchema,
         kind: "push"
       },
-      runtimeState: SceneMonitorStatusSchema
+      runtimeState: SceneMonitorStatusSchema,
+      /**
+      * Runtime-state durability: **session** — re-derived from the current scene on the next evaluation.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ZoneRuleModeEnum = zod.z.enum(["include", "exclude"]);
     var ZoneRuleSchema = zod.z.object({
@@ -254401,7 +256131,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * `isRunning` to render a spinner during execution and surfaces
       * `lastError` / `lastRunSuccess` in the recent-runs panel.
       */
-      runtimeState: ScriptRunnerStatusSchema
+      runtimeState: ScriptRunnerStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a restored `isRunning: true` describes a process that died with the previous hub.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var SmokeStatusSchema = zod.z.object({
       detected: zod.z.boolean(),
@@ -254419,7 +256156,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: SmokeStatusSchema,
         kind: "push"
       },
-      runtimeState: SmokeStatusSchema
+      runtimeState: SmokeStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a safety sensor must not read "clear" merely because the hub restarted.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var CamStreamDescriptorSchema = zod.z.object({
       camStreamId: zod.z.string().min(1),
@@ -254570,7 +256317,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: StreamParamsStatusSchema,
         kind: "poll"
       },
-      runtimeState: StreamParamsStatusSchema
+      runtimeState: StreamParamsStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — operator-set encoder profile; mutation-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var STREAM_PROFILE_META = [
       {
@@ -254841,6 +256598,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * not need to re-query the provider after a setState mutation.
       */
       runtimeState: SwitchStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — device state an operator reads as authoritative; 55 devices, transition-driven.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"],
       settings: { bindings: [{
         kind: "scalar",
         statusPath: "on",
@@ -254913,7 +256680,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: TamperStatusSchema,
         kind: "push"
       },
-      runtimeState: TamperStatusSchema
+      runtimeState: TamperStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var TemperatureSensorStatusSchema = zod.z.object({
       /** Current temperature in Celsius. */
@@ -254942,7 +256719,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: TemperatureSensorStatusSchema,
         kind: "push"
       },
-      runtimeState: TemperatureSensorStatusSchema
+      runtimeState: TemperatureSensorStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `numeric-sensor` (69 of 125 writes were the clock alone).
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastFetchedAt"]
     };
     var ToastSchema = zod.z.object({
       title: zod.z.string(),
@@ -254993,7 +256780,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: UpdateStatusSchema,
         kind: "poll"
       },
-      runtimeState: UpdateStatusSchema
+      runtimeState: UpdateStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a restored `inProgress: true` describes an update that is no longer running; versions are re-probed at boot.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var UserSummarySchema = zod.z.object({
       id: zod.z.string(),
@@ -255327,7 +257121,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live state + battery + fan-speed changes.
       */
-      runtimeState: VacuumControlStatusSchema
+      runtimeState: VacuumControlStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `media-player` — a restored `state: cleaning` is a robot that is not cleaning.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ValveStateSchema = zod.z.enum([
       "open",
@@ -255380,7 +257181,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live position changes during a move.
       */
-      runtimeState: ValveStatusSchema
+      runtimeState: ValveStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `brightness`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var VibrationStatusSchema = zod.z.object({
       detected: zod.z.boolean(),
@@ -255398,7 +257206,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         schema: VibrationStatusSchema,
         kind: "push"
       },
-      runtimeState: VibrationStatusSchema
+      runtimeState: VibrationStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — as `smoke`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastChangedAt"]
     };
     var WaterHeaterStatusSchema = zod.z.object({
       /** Current measured temperature. Null when not reported. */
@@ -255458,7 +257276,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. UI controls watch the
       * slice for live temperature / mode / away changes.
       */
-      runtimeState: WaterHeaterStatusSchema
+      runtimeState: WaterHeaterStatusSchema,
+      /**
+      * Runtime-state durability: **session** — as `climate-control`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var WeatherStatusSchema = zod.z.object({
       /** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
@@ -255498,7 +257323,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Runtime-state slice — mirrored by the kernel. The UI reads the
       * current conditions directly from the slice on each weather push.
       */
-      runtimeState: WeatherStatusSchema
+      runtimeState: WeatherStatusSchema,
+      /**
+      * Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var PerScopeBreakdownSchema = zod.z.object({
       /** Total tracked objects in this scope (frame / zone / unzoned). */
@@ -255607,7 +257439,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * automatically; the explicit `getCurrentSnapshot` cap method is
       * still useful for one-off polls without a subscription.
       */
-      runtimeState: CameraOccupancySnapshotSchema
+      runtimeState: CameraOccupancySnapshotSchema,
+      /**
+      * Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
     };
     var ZoneRuleStageEnum = zod.z.enum([
       "motion",
@@ -255659,7 +257498,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         motion: zod.z.array(ZoneRuleSchema).readonly(),
         detection: zod.z.array(ZoneRuleSchema).readonly(),
         package: zod.z.array(ZoneRuleSchema).readonly()
-      })
+      }),
+      /**
+      * Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored"
     };
     var PIPELINE_FLOW_CAPABILITY_NAMES = [
       "decoder",
@@ -264909,6 +266755,301 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       for (const [capName, capKind] of Object.entries(CAP_PROVIDER_KIND_MAP)) if (capKind === kind) out.push(capName);
       return out;
     }
+    var RUNTIME_STATE_POLICY = {
+      "air-quality-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "alarm-panel": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "ambient-light-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "audio-metrics": {
+        durability: "session",
+        volatileFields: []
+      },
+      "automation-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "battery": {
+        durability: "restored",
+        volatileFields: ["lastUpdated"]
+      },
+      "binary": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "brightness": {
+        durability: "session",
+        volatileFields: []
+      },
+      "camera-streams": {
+        durability: "session",
+        volatileFields: []
+      },
+      "carbon-monoxide": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "climate-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "color": {
+        durability: "session",
+        volatileFields: []
+      },
+      "connectivity": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "consumables": {
+        durability: "session",
+        volatileFields: []
+      },
+      "contact": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "cover": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "day-night": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "device-discovery": {
+        durability: "session",
+        volatileFields: []
+      },
+      "device-status": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "doorbell": {
+        durability: "restored",
+        volatileFields: []
+      },
+      "enum-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "event-emitter": {
+        durability: "session",
+        volatileFields: []
+      },
+      "fan-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "feature-probe": {
+        durability: "session",
+        volatileFields: []
+      },
+      "flood": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "gas": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "humidifier": {
+        durability: "session",
+        volatileFields: []
+      },
+      "humidity-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "image": {
+        durability: "session",
+        volatileFields: []
+      },
+      "image-settings": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "lawn-mower-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "lock-control": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "media-player": {
+        durability: "session",
+        volatileFields: []
+      },
+      "motion": {
+        durability: "session",
+        volatileFields: []
+      },
+      "motion-trigger": {
+        durability: "session",
+        volatileFields: []
+      },
+      "motion-zones": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "native-object-detection": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "notifier": {
+        durability: "session",
+        volatileFields: []
+      },
+      "numeric-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "pet-feeder": {
+        durability: "session",
+        volatileFields: []
+      },
+      "power-meter": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "presence": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "pressure-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "privacy-mask": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "ptz-autotrack": {
+        durability: "session",
+        volatileFields: []
+      },
+      "scene-monitor": {
+        durability: "session",
+        volatileFields: []
+      },
+      "script-runner": {
+        durability: "session",
+        volatileFields: []
+      },
+      "smoke": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "stream-params": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "switch": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "tamper": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "temperature-sensor": {
+        durability: "restored",
+        volatileFields: ["lastFetchedAt"]
+      },
+      "update": {
+        durability: "session",
+        volatileFields: []
+      },
+      "vacuum-control": {
+        durability: "session",
+        volatileFields: []
+      },
+      "valve": {
+        durability: "session",
+        volatileFields: []
+      },
+      "vibration": {
+        durability: "restored",
+        volatileFields: ["lastChangedAt"]
+      },
+      "water-heater": {
+        durability: "session",
+        volatileFields: []
+      },
+      "weather": {
+        durability: "session",
+        volatileFields: []
+      },
+      "zone-analytics": {
+        durability: "session",
+        volatileFields: []
+      },
+      "zone-rules": {
+        durability: "restored",
+        volatileFields: []
+      },
+      "zones": {
+        durability: "restored",
+        volatileFields: []
+      }
+    };
+    function runtimeStatePolicyFor(capName) {
+      return RUNTIME_STATE_POLICY[capName] ?? SESSION_ONLY_POLICY;
+    }
+    var SESSION_ONLY_POLICY = {
+      durability: "session",
+      volatileFields: []
+    };
+    function isRestoredCap(capName) {
+      return runtimeStatePolicyFor(capName).durability === "restored";
+    }
+    var RESTORED_CAP_NAMES = [
+      "air-quality-sensor",
+      "alarm-panel",
+      "ambient-light-sensor",
+      "battery",
+      "binary",
+      "carbon-monoxide",
+      "connectivity",
+      "contact",
+      "cover",
+      "day-night",
+      "device-status",
+      "doorbell",
+      "enum-sensor",
+      "flood",
+      "gas",
+      "humidity-sensor",
+      "image-settings",
+      "lock-control",
+      "motion-zones",
+      "native-object-detection",
+      "numeric-sensor",
+      "power-meter",
+      "presence",
+      "pressure-sensor",
+      "privacy-mask",
+      "smoke",
+      "stream-params",
+      "switch",
+      "tamper",
+      "temperature-sensor",
+      "vibration",
+      "zone-rules",
+      "zones"
+    ];
     var SCOPE_PRESETS = [
       {
         id: "camera-viewer",
@@ -265552,6 +267693,96 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }
       };
     }
+    var AUDIO_KIND_PREFIX = "audio-";
+    function normalizeAudioLabel(value) {
+      return value.startsWith(AUDIO_KIND_PREFIX) ? value.slice(6) : value;
+    }
+    var NC_AUDIO_DB_MIN = -96;
+    var NC_AUDIO_DB_MAX = 0;
+    var NC_AUDIO_DB_STEP = 3;
+    var NC_AUDIO_DB_OFFERED = -30;
+    var NC_AUDIO_HIT_PERCENT_MIN = 1;
+    var NC_AUDIO_HIT_PERCENT_MAX = 100;
+    var NC_AUDIO_SAMPLING_MIN_SEC = 1;
+    var NC_AUDIO_SAMPLING_MAX_SEC = 300;
+    var NC_AUDIO_DEFAULTS = {
+      hitPercent: 60,
+      samplingSeconds: 10
+    };
+    function audioOrDefaults(value) {
+      return value ?? NC_AUDIO_DEFAULTS;
+    }
+    function audioIsFailClosed(value) {
+      if (value === void 0) return false;
+      return value.dbThreshold === void 0 && (value.labels === void 0 || value.labels.length === 0);
+    }
+    function clampInt(value, min, max) {
+      if (!Number.isFinite(value)) return min;
+      return Math.min(max, Math.max(min, Math.round(value)));
+    }
+    function has(patch, key) {
+      return Object.prototype.hasOwnProperty.call(patch, key);
+    }
+    function patchAudio(current, patch) {
+      const base = audioOrDefaults(current);
+      const labels = has(patch, "labels") ? patch.labels : base.labels;
+      const dbThreshold = has(patch, "dbThreshold") ? patch.dbThreshold : base.dbThreshold;
+      return {
+        ...labels !== void 0 && labels.length > 0 ? { labels: [...labels] } : {},
+        ...dbThreshold !== void 0 ? { dbThreshold: clampInt(dbThreshold, NC_AUDIO_DB_MIN, 0) } : {},
+        hitPercent: clampInt(patch.hitPercent ?? base.hitPercent, 1, 100),
+        samplingSeconds: clampInt(patch.samplingSeconds ?? base.samplingSeconds, 1, 300)
+      };
+    }
+    var UNKNOWN_LABEL_ICON = "\u{1F508}";
+    var ICON_BY_ID = new Map(AUDIO_MACRO_LABELS.flatMap((macro2) => macro2.icon === void 0 ? [] : [[macro2.id, macro2.icon]]));
+    function audioLabelChoices(taxonomy, selected) {
+      const fromHub = taxonomy?.audioKinds ?? [];
+      const choices = fromHub.length > 0 ? fromHub.map((entry) => {
+        const id = normalizeAudioLabel(entry.kind);
+        return {
+          value: id,
+          label: entry.label,
+          icon: ICON_BY_ID.get(id) ?? UNKNOWN_LABEL_ICON,
+          unknown: false
+        };
+      }) : AUDIO_MACRO_LABELS.map((macro2) => ({
+        value: macro2.id,
+        label: macro2.name,
+        icon: macro2.icon ?? UNKNOWN_LABEL_ICON,
+        unknown: false
+      }));
+      const known = new Set(choices.map((choice) => choice.value));
+      const unknownLabels = [];
+      for (const stored of selected ?? []) {
+        const id = normalizeAudioLabel(stored);
+        if (known.has(id) || unknownLabels.includes(id)) continue;
+        unknownLabels.push(id);
+        choices.push({
+          value: id,
+          label: id,
+          icon: UNKNOWN_LABEL_ICON,
+          unknown: true
+        });
+      }
+      return {
+        choices,
+        unknownLabels
+      };
+    }
+    function isAudioLabelSelected(labels, id) {
+      const wanted = normalizeAudioLabel(id);
+      return (labels ?? []).some((stored) => normalizeAudioLabel(stored) === wanted);
+    }
+    function toggleAudioLabel(labels, id) {
+      const wanted = normalizeAudioLabel(id);
+      const current = labels ?? [];
+      if (isAudioLabelSelected(current, wanted)) {
+        const next = current.filter((stored) => normalizeAudioLabel(stored) !== wanted);
+        return next.length > 0 ? next : void 0;
+      }
+      return [...current, wanted];
+    }
     var CLASS_CONDITION_IDS = /* @__PURE__ */ new Set(["classes", "classesExclude"]);
     var LABEL_CONDITION_IDS = /* @__PURE__ */ new Set(["sensorKinds"]);
     function toOption(entry) {
@@ -266086,32 +268317,40 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       };
     }
     var NATIVE_LEASE_SECTION_ID = "native-lease";
-    var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+    var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
     var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
     var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
     var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+    var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
     var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
     var NativeLeaseSettingsSchema = zod.z.object({
       /**
-      * How long a retained native frame is served before it counts as a miss.
+      * How many delivered frames the worker HOLDS at once, waiting for each one's
+      * detection result.
       *
-      * Must cover the FULL late-crop horizon: detection inference + the
-      * cross-process inference-result hop to hub post-analysis + tracking + the
-      * tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-      * outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-      * RAM per busy camera grows linearly with no measured hit-rate gain.
+      * This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+      * a time window was never related to the event the pixels were waiting for.
+      * A held frame now lives from delivery until the runner has its `FrameResult`
+      * — at which moment the runner cuts the subject tiles it actually wanted and
+      * releases the frame. The bound exists only so a runner that stops answering
+      * cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+      *
+      * Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+      * 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+      * without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+      * Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+      * `holdOverflow` on the metrics line is what says you need it.
       */
-      ttlMs: zod.z.number().int().min(250).max(1e4),
+      holdFrames: zod.z.number().int().min(1).max(64),
       /**
       * Hard per-decode-worker RAM ceiling for retained native frames, in MB.
       *
-      * Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-      * which one is actually binding before reasoning from that. At the shipped
-      * 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-      * at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-      * `leaseFrames` on the metrics line say which. When the ceiling binds, a
-      * change that admits fewer frames buys retention WINDOW at constant RAM
-      * rather than giving RAM back — lower this knob if RAM is what you wanted.
+      * Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+      * is what decides how much is held, and the ceiling is the number above which
+      * something is wrong. Before that it was the effective cap — at 1024 MB with
+      * a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+      * with the TTL expiring nothing, which is exactly the confusion the hold
+      * removes. `leaseMb` / `leaseFrames` still say what is resident.
       * `0` DISABLES the lease entirely and falls the worker back to the tiny
       * leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
       * to replace).
@@ -266137,19 +268376,37 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * there is the signal that some caller names frames outside the inference set
       * and that this must go back to `all`.
       */
-      admission: NativeLeaseAdmissionSchema
+      admission: NativeLeaseAdmissionSchema,
+      /**
+      * RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+      * compressed native crops the worker cuts at the moment a frame's detection
+      * result arrives, and keeps long after the frame itself is freed.
+      *
+      * This is the knob that replaced the old retention window, and it buys about
+      * three orders of magnitude more of it: a tile is one subject at native
+      * resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+      * the frame it was cut from. A frame on which nothing was detected costs
+      * nothing at all, which is the real change — the old lease paid per FRAME and
+      * was interrogated per SUBJECT.
+      *
+      * `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+      * fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+      * reproduce that.
+      */
+      tileBudgetMb: zod.z.number().int().min(0).max(1024)
     });
     var DEFAULT_NATIVE_LEASE_SETTINGS = {
-      ttlMs: 1200,
+      holdFrames: 8,
       budgetMb: 1024,
       activityMs: 15e3,
+      tileBudgetMb: 64,
       admission: "inferred"
     };
-    var NATIVE_LEASE_TTL_FIELD = {
-      min: 250,
-      max: 1e4,
-      step: 50,
-      default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+    var NATIVE_LEASE_HOLD_FIELD = {
+      min: 1,
+      max: 64,
+      step: 1,
+      default: DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames
     };
     var NATIVE_LEASE_BUDGET_FIELD = {
       min: 0,
@@ -266163,6 +268420,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       step: 1e3,
       default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
     };
+    var NATIVE_LEASE_TILE_BUDGET_FIELD = {
+      min: 0,
+      max: 1024,
+      step: 16,
+      default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
+    };
     var NATIVE_LEASE_ADMISSION_FIELD = {
       options: [{
         value: "all",
@@ -266184,25 +268447,28 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
     }
     function readNativeLeaseOverride(config) {
-      const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+      const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
       const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
       const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
       const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+      const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
       return {
-        ...ttlMs === null ? {} : { ttlMs },
+        ...holdFrames === null ? {} : { holdFrames },
         ...budgetMb === null ? {} : { budgetMb },
         ...activityMs === null ? {} : { activityMs },
-        ...admission === null ? {} : { admission }
+        ...admission === null ? {} : { admission },
+        ...tileBudgetMb === null ? {} : { tileBudgetMb }
       };
     }
     function isHydratedField(entry) {
       return typeof entry === "object" && entry !== null && "key" in entry;
     }
     var LEASE_KEYS = [
-      NATIVE_LEASE_TTL_KEY,
+      NATIVE_LEASE_HOLD_KEY,
       NATIVE_LEASE_BUDGET_KEY,
       NATIVE_LEASE_ACTIVITY_KEY,
-      NATIVE_LEASE_ADMISSION_KEY
+      NATIVE_LEASE_ADMISSION_KEY,
+      NATIVE_LEASE_TILE_BUDGET_KEY
     ];
     function pickNativeLeaseOverride(view) {
       if (view === null) return {};
@@ -267369,6 +269635,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
     exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
     exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
+    exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
     exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
     exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
     exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
@@ -267611,11 +269878,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NATIVE_LEASE_ADMISSION_KEY = NATIVE_LEASE_ADMISSION_KEY;
     exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
     exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
+    exports.NATIVE_LEASE_HOLD_FIELD = NATIVE_LEASE_HOLD_FIELD;
+    exports.NATIVE_LEASE_HOLD_KEY = NATIVE_LEASE_HOLD_KEY;
     exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
-    exports.NATIVE_LEASE_TTL_FIELD = NATIVE_LEASE_TTL_FIELD;
-    exports.NATIVE_LEASE_TTL_KEY = NATIVE_LEASE_TTL_KEY;
+    exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
+    exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
     exports.NC_ALARM_SYSTEM_EVENT_KINDS = NC_ALARM_SYSTEM_EVENT_KINDS;
     exports.NC_AUDIO_DBFS_FLOOR = NC_AUDIO_DBFS_FLOOR;
+    exports.NC_AUDIO_DB_MAX = NC_AUDIO_DB_MAX;
+    exports.NC_AUDIO_DB_MIN = NC_AUDIO_DB_MIN;
+    exports.NC_AUDIO_DB_OFFERED = NC_AUDIO_DB_OFFERED;
+    exports.NC_AUDIO_DB_STEP = NC_AUDIO_DB_STEP;
+    exports.NC_AUDIO_DEFAULTS = NC_AUDIO_DEFAULTS;
+    exports.NC_AUDIO_HIT_PERCENT_MAX = NC_AUDIO_HIT_PERCENT_MAX;
+    exports.NC_AUDIO_HIT_PERCENT_MIN = NC_AUDIO_HIT_PERCENT_MIN;
+    exports.NC_AUDIO_SAMPLING_MAX_SEC = NC_AUDIO_SAMPLING_MAX_SEC;
+    exports.NC_AUDIO_SAMPLING_MIN_SEC = NC_AUDIO_SAMPLING_MIN_SEC;
     exports.NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NC_AUTHORABLE_SYSTEM_EVENT_KINDS;
     exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
     exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
@@ -267623,6 +269901,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NC_CONFIRM_DEFAULT_TIMEOUT_MS = NC_CONFIRM_DEFAULT_TIMEOUT_MS;
     exports.NC_CONFIRM_MAX_TIMEOUT_MS = NC_CONFIRM_MAX_TIMEOUT_MS;
     exports.NC_CONFIRM_MIN_TIMEOUT_MS = NC_CONFIRM_MIN_TIMEOUT_MS;
+    exports.NC_DEFAULT_SNOOZE_MINUTES = NC_DEFAULT_SNOOZE_MINUTES;
     exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
     exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
     exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
@@ -267769,7 +270048,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RECOGNITION_TYPES = RECOGNITION_TYPES;
     exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
     exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
+    exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
     exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
+    exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
     exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
     exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
     exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
@@ -268041,7 +270322,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.audioAnalysisCapability = audioAnalysisCapability;
     exports.audioAnalyzerCapability = audioAnalyzerCapability;
     exports.audioCodecCapability = audioCodecCapability;
+    exports.audioIsFailClosed = audioIsFailClosed;
+    exports.audioLabelChoices = audioLabelChoices;
     exports.audioMetricsCapability = audioMetricsCapability;
+    exports.audioOrDefaults = audioOrDefaults;
     exports.audioPlanFromEncodeProfile = require_canonical_hash.audioPlanFromEncodeProfile;
     exports.authProviderCapability = authProviderCapability;
     exports.autoAssignProfiles = autoAssignProfiles;
@@ -268179,6 +270463,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.invocationFromEncodeProfile = require_canonical_hash.invocationFromEncodeProfile;
     exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
     exports.isArrayOutputSchema = isArrayOutputSchema;
+    exports.isAudioLabelSelected = isAudioLabelSelected;
     exports.isBaseConditionKey = isBaseConditionKey;
     exports.isCollectionArrayMethod = isCollectionArrayMethod;
     exports.isDeployableToAgent = isDeployableToAgent;
@@ -268188,6 +270473,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isIsolatedBuiltin = isIsolatedBuiltin;
     exports.isNode = isNode;
     exports.isObjectInput = isObjectInput;
+    exports.isRestoredCap = isRestoredCap;
     exports.isSameAddonId = isSameAddonId;
     exports.isScheduleActive = isScheduleActive;
     exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
@@ -268236,6 +270522,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.nodePin = require_sleep.nodePin;
     exports.nodesCapability = nodesCapability;
     exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
+    exports.normalizeAudioLabel = normalizeAudioLabel;
     exports.normalizeUnit = normalizeUnit;
     exports.notificationOutputCapability = notificationOutputCapability;
     exports.notificationRulesCapability = notificationRulesCapability;
@@ -268252,6 +270539,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
     exports.parseProfileBrokerId = require_sleep.parseProfileBrokerId;
     exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
+    exports.patchAudio = patchAudio;
     exports.petFeederCapability = petFeederCapability;
     exports.pickAccessoryControl = pickAccessoryControl;
     exports.pickDetailCropConvention = pickDetailCropConvention;
@@ -268304,6 +270592,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.resolveVariantModelId = resolveVariantModelId;
     exports.runInferenceStep = runInferenceStep;
     exports.runtimeDevices = runtimeDevices;
+    exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
     exports.sceneMonitorCapability = sceneMonitorCapability;
     exports.scopeKey = require_sleep.scopeKey;
     exports.scopesAllowAddon = scopesAllowAddon;
@@ -268350,6 +270639,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.toNodeId = require_sleep.toNodeId;
     exports.toStreamSourceEntry = toStreamSourceEntry;
     exports.toastCapability = toastCapability;
+    exports.toggleAudioLabel = toggleAudioLabel;
     exports.tokenize = tokenize;
     exports.transcodeBody = transcodeBody;
     exports.tryConvertUnit = tryConvertUnit;
@@ -362585,6 +364875,7 @@ var require_main2 = __commonJS({
     var fs = __importStar(__require("fs"));
     var path = __importStar(__require("path"));
     var agent_http_js_1 = require_agent_http();
+    var single_copy_cleanup_runner_js_1 = require_single_copy_cleanup_runner();
     var derive_hub_url_js_1 = require_derive_hub_url();
     var system_1 = require_dist3();
     var types_1 = require_dist9();
@@ -362805,6 +365096,11 @@ var require_main2 = __commonJS({
         } catch (err) {
           consoleLogger.warn(`agent root boot confirmation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        void (0, single_copy_cleanup_runner_js_1.runSingleCopyCleanup)({
+          dataDir: config.dataDir,
+          addonRoot: config.addonsDir,
+          log: (line) => consoleLogger.info(line)
+        });
       };
       const loggerFactory = (addonId) => agentLogManager.createLogger().withTags({ addonId });
       const agentServiceSchema = (0, agent_service_js_1.createAgentService)({
@@ -389476,7 +391772,10 @@ var require_addon_registry_service = __commonJS({
         "setDevice",
         "getAddonDevice",
         "setAddonDevice",
-        "clearAddonDevice"
+        "clearAddonDevice",
+        "getDeviceRuntimeState",
+        "setDeviceRuntimeState",
+        "clearDeviceRuntimeState"
       ];
       for (const key of required) {
         if (typeof Reflect.get(backend, key) !== "function")
@@ -396933,6 +399232,18 @@ var require_cluster_node_history_store = __commonJS({
       descriptor: DescriptorSchema
     });
     var COLLECTION = "cluster-node-history";
+    var LAST_ACTIVE_HEARTBEAT_MS = 5 * 6e4;
+    function descriptorsEqual(a, b) {
+      return a.id === b.id && a.name === b.name && a.hostname === b.hostname && a.platform === b.platform && a.arch === b.arch && a.cpuModel === b.cpuModel && a.cpuCores === b.cpuCores && a.memoryMB === b.memoryMB && a.isHub === b.isHub && sameStrings(a.engines, b.engines) && sameStrings(a.localIps, b.localIps) && sameStrings(a.addonIds, b.addonIds) && samePackages(a.packages, b.packages);
+    }
+    function sameStrings(a, b) {
+      return a.length === b.length && a.every((v, i) => v === b[i]);
+    }
+    function samePackages(a, b) {
+      if (a === void 0 || b === void 0)
+        return a === b;
+      return a.length === b.length && a.every((p, i) => p.name === b[i]?.name && p.version === b[i]?.version);
+    }
     var ClusterNodeHistoryStore = class _ClusterNodeHistoryStore {
       resolveSettingsStore;
       logger;
@@ -396974,6 +399285,19 @@ var require_cluster_node_history_store = __commonJS({
        * Upsert a node's descriptor + addon roster while it is ONLINE, stamping
        * `lastActive = Date.now()`. Called on each `listNodes()` refresh for every
        * live node (R2 capture point).
+       *
+       * WRITES ONLY ON A CHANGE, OR ONCE PER {@link LAST_ACTIVE_HEARTBEAT_MS}.
+       * `listNodes()` runs off the 30 s topology heartbeat, so the unconditional
+       * upsert this used to be was the worst write:row ratio in the whole system —
+       * measured on the live hub at ~6 upserts/minute = **8,640 a day to maintain
+       * three rows**, i.e. 40 % of every ledger write on the hub, on the same shfs
+       * SQLite file whose WAL checkpoint can stall hub-main for seconds (D96).
+       *
+       * Nothing is lost. `lastActive` exists to answer "when was this node last
+       * seen", which only matters at OFFLINE resolution — and the disconnect edge
+       * is written by {@link touch}, which is unbounded. The bound costs at most
+       * five minutes of precision on a node that then disappeared without a
+       * `$node.disconnected`, and buys 288 writes/day/node instead of 2,880.
        */
       async snapshot(descriptor) {
         const store = await this.ensureDeclared();
@@ -396982,13 +399306,13 @@ var require_cluster_node_history_store = __commonJS({
         try {
           const existing = await this.readRow(store, descriptor.id);
           const packages = descriptor.packages ?? existing?.descriptor.packages;
+          const next = packages === void 0 ? descriptor : { ...descriptor, packages };
+          if (existing !== null && !this.worthWriting(existing, next))
+            return;
           await store.set({
             collection: COLLECTION,
             key: descriptor.id,
-            value: {
-              lastActive: Date.now(),
-              descriptor: packages === void 0 ? descriptor : { ...descriptor, packages }
-            }
+            value: { lastActive: Date.now(), descriptor: next }
           });
         } catch (err) {
           this.logger.warn("snapshot upsert failed (best-effort)", {
@@ -396997,6 +399321,16 @@ var require_cluster_node_history_store = __commonJS({
           });
         }
       }
+      /**
+       * Is this snapshot worth a commit? Yes when the descriptor CHANGED, or when
+       * the stored `lastActive` has aged past the heartbeat bound. A read that
+       * fails never reaches here — `snapshot` writes when there is no existing row.
+       */
+      worthWriting(existing, next) {
+        if (Date.now() - existing.lastActive >= LAST_ACTIVE_HEARTBEAT_MS)
+          return true;
+        return !descriptorsEqual(existing.descriptor, next);
+      }
       /** Read one node's row, validated. `null` when absent or malformed. */
       async readRow(store, nodeId) {
         const raw = await store.get({ collection: COLLECTION, key: nodeId });
@@ -397832,6 +400166,7 @@ var require_main4 = __commonJS({
     var fs = __importStar(__require("fs"));
     var path = __importStar(__require("path"));
     var node_child_process_1 = __require("child_process");
+    var single_copy_cleanup_runner_js_1 = require_single_copy_cleanup_runner();
     var logging_service_1 = require_logging_service();
     var event_bus_service_1 = require_event_bus_service();
     var config_service_1 = require_config_service();
@@ -398684,6 +401019,11 @@ var require_main4 = __commonJS({
           meta: { error: err instanceof Error ? err.message : String(err) }
         });
       }
+      void (0, single_copy_cleanup_runner_js_1.runSingleCopyCleanup)({
+        dataDir: dataPath,
+        addonRoot: process.env["CAMSTACK_ADDONS_DIR"] ?? path.join(dataPath, "addons"),
+        log: (line) => logger.info(line)
+      });
       try {
         const dmForBackfill = capabilityRegistry.getSingleton("device-manager");
         const integrationRegistry = addonRegistry.getIntegrationRegistry();
@@ -398982,11 +401322,11 @@ var require_launcher = __commonJS({
       const bootstrapRequired = readBootstrapRequiredAddons(dataDir, bootstrapSchema) ?? roleDefaultBootstrap;
       console.log(`[launcher] bootstrap (${role}): ${bootstrapRequired.length} required package(s)`);
       try {
-        const ownManifest = readOwnManifest();
+        const closureNodeModules = path.resolve(__dirname, "..", "node_modules");
         const plan = (0, first_boot_addon_plan_js_1.planFirstBootAddons)({
           required: bootstrapRequired,
-          closurePins: ownManifest === null ? {} : (0, first_boot_addon_plan_js_1.bootstrapPinsFrom)(ownManifest),
           installed: readInstalledAddonVersions(addonsDir, bootstrapRequired),
+          closureVersions: readInstalledAddonVersions(closureNodeModules, bootstrapRequired),
           // Mirrors `shouldSkipClosureProvidedSeed`: only `@camstack/system`, and
           // only while it actually resolves.
           closureProvided: (() => {