homebridge-mynest 2.0.2 → 2.1.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project are documented here. From the first release onward, [release-please](https://github.com/googleapis/release-please) owns this file — do not hand-edit version headings after `0.1.0` ships.
 
+## [2.1.0](https://github.com/tbaur/homebridge-mynest/compare/v2.0.2...v2.1.0) (2026-10-26)
+
+
+### Features
+
+* page through homebridge-pagerduty for smoke, CO and a stopped plugin ([#67](https://github.com/tbaur/homebridge-mynest/issues/67)) ([95d7afb](https://github.com/tbaur/homebridge-mynest/commit/95d7afbc719a68be874382ca7476735c398726f6))
+
 ## [2.0.2](https://github.com/tbaur/homebridge-mynest/compare/v2.0.1...v2.0.2) (2026-10-05)
 
 

package/README.md

@@ -15,7 +15,7 @@ Expose Nest thermostats, Nest Protect smoke/CO alarms, and Nest Temperature Sens
 - **Thermostats:** temperature, mode, activity, setpoints, humidity when Nest reports it, plus an Eco Mode switch per thermostat
 - **Optional house-wide Eco switch:** `exposeGlobalEcoSwitch`
 - **Thermostat writes:** mode, setpoints, and Eco only when **Allow thermostat control** is on (off by default)
-- **Nest Protect:** smoke and CO from REST when available; battery and online from REST and/or Observe
+- **Nest Protect:** smoke and CO sensors on every Protect. A missing REST reading is a fault, not a missing tile. Battery-low status can still come from Observe. The smoke and CO tiles stay inactive while that sensor has no REST number or the REST feed is stale, including when Observe says the Protect is online
 - **Optional Protect occupancy and temperature**
 - **Temperature Sensors:** Nest Temperature Sensor (kryptonite) pucks
 - **Dual transport:** Nest REST subscribe merged with HTTP/2 Observe, so Observe-only devices still appear
@@ -24,10 +24,10 @@ Expose Nest thermostats, Nest Protect smoke/CO alarms, and Nest Temperature Sens
 - **No accessory churn** on a cloud blip or expired token. Devices leave HomeKit only after Nest-confirmed drops
 - **Circuit breakers** on REST and Observe so a dead Nest edge fails fast
 - **Diagnostics** *(optional):* health heartbeats in the Homebridge log, with one warning when health becomes degraded
+- **PagerDuty** *(optional, off by default):* page when a Protect detects smoke or CO, the Protect alarm feed has been stale for 5 minutes, or the plugin has stopped because Nest rejected the token. Needs Node 22.13 or later. On an older Node 22 the plugin still runs and skips the page. See [PagerDuty](docs/README-DETAILED.md#pagerduty)
 
 ### Quality
-<!-- Canonical test count lives here only; keep other docs number-free to avoid multi-place updates. -->
-- **576 tests** with a per-area coverage floor, and a CI step that fails if the suite leaks an open handle
+- A per-area test coverage floor, and a CI step that fails if the suite leaks an open handle
 - **Built for Homebridge 2:** stored getters and `updateValue(...)`, not the removed `getValue()`
 - **Secret hygiene:** access tokens are redacted from logs
 - **No analytics**
@@ -68,7 +68,7 @@ Use the Homebridge UI, or add the platform to `config.json`:
 
 ### 4. Restart Homebridge
 
-Thermostats, Protects, and temperature sensors appear in the Home app as Nest reports them. The log should show `Connected to Nest (REST up; Observe connecting)`, then device adds, then `Platform ready`.
+Thermostats, Protects, and temperature sensors appear in the Home app as Nest reports them. The log should show `Connected to Nest`, then one `Adding ...` line per device, then `Platform ready`.
 
 Thermostat control stays off until you enable **Allow thermostat control**. Optionally enable **Expose global Eco switch**.
 
@@ -77,8 +77,8 @@ Thermostat control stays off until you enable **Allow thermostat control**. Opti
 | Nest device | HomeKit accessory | Notes |
 | --- | --- | --- |
 | Thermostat | Thermostat + Eco Mode switch | Observe is source of truth. Writes need `allowThermostatControl`. |
-| Nest Protect | Smoke + CO (+ optional occupancy / temp) | Smoke/CO require REST `topaz`. Occupancy is ~10-minute presence, not motion. |
-| Temperature Sensor | Temperature Sensor | Battery + temperature |
+| Nest Protect | Smoke + CO (+ optional occupancy / temp) | Smoke and CO stay published. A missing REST number faults that sensor. Occupancy is ~10-minute presence, not motion. |
+| Temperature Sensor | Temperature Sensor | Battery + temperature. A missing temperature faults the sensor. |
 
 Cameras, doorbells, Yale locks, Home/Away structure switches, and Google-account-only homes are out of scope.
 
@@ -92,12 +92,13 @@ Cameras, doorbells, Yale locks, Home/Away structure switches, and Google-account
 | `accessToken` | — | Required. Nest Account `access_token`. See [docs/AUTH.md](docs/AUTH.md). |
 | `allowThermostatControl` | `false` | Send mode/setpoint/Eco changes to Nest. |
 | `exposeGlobalEcoSwitch` | `false` | One switch that sets Eco on every thermostat. Writes still need `allowThermostatControl`. |
-| `exposeProtectOccupancy` | `true` | Occupancy from REST `auto_away` on a mains-powered Protect. |
+| `exposeProtectOccupancy` | `true` | Occupancy from REST `auto_away` when that field is a boolean and the Protect is not reported as battery-powered. Unknown power does not hide a boolean Nest already sent. |
 | `exposeProtectTemperature` | `false` | Temperature/humidity measured by each Protect. |
 | `ignoredDeviceIds` | `[]` | Device IDs or serials to leave out of HomeKit. |
 | `fieldTest` | `false` | Use Nest field-test hosts. |
 | `diagnosticsInterval` | `0` | Seconds between health heartbeats; `0` off, else `30`–`86400`. |
 | `structuredLogs` | `false` | With diagnostics, also emit a JSON line. |
+| `pagerdutySignals` | `false` | Page through homebridge-pagerduty. Off until turned on. See [PagerDuty](docs/README-DETAILED.md#pagerduty). |
 | `debug` | `false` | Verbose logging; tokens are redacted. |
 
 The [detailed documentation](docs/README-DETAILED.md#full-configuration-reference) explains each option and what happens when REST or Observe is down.
@@ -107,8 +108,8 @@ The [detailed documentation](docs/README-DETAILED.md#full-configuration-referenc
 1. **Authentication error:** token missing, truncated, Google JWT/`ya29.`, or revoked. Capture a fresh Nest Account token ([docs/AUTH.md](docs/AUTH.md)).
 2. **Thermostat missing:** modern thermostats are Observe-only on some accounts. Enable `debug` for stream detail.
 3. **Eco / setpoint changes snap back:** enable **Allow thermostat control**.
-4. **Protect without smoke/CO:** likely Observe-only. The accessory still appears; alarm tiles wait for REST.
-5. **No occupancy:** battery Protect, power unknown, Observe-only, or `exposeProtectOccupancy` off. Occupancy is not motion.
+4. **Protect smoke/CO shows a fault:** REST has not supplied that sensor's number, or the REST feed is stale. The tile stays. A line `REST topaz auto_away=... smoke_status=... co_status=...` is the raw reading, including when the summary sentence did not change.
+5. **No occupancy, or a room that stays Occupied:** occupancy is Nest's `auto_away` inverted (false means Occupied), not motion. It is omitted for a battery Protect, when `auto_away` is missing, or when `exposeProtectOccupancy` is off. A stuck Occupied is that boolean staying false. The `REST topaz` line shows the raw value each time a Protect object arrives.
 
 The [full troubleshooting list](docs/README-DETAILED.md#troubleshooting) covers more cases, including a stuck Home app tile.
 
@@ -120,8 +121,8 @@ See [SECURITY.md](SECURITY.md) and [docs/AUTH.md](docs/AUTH.md).
 
 ## Requirements
 
-- **Homebridge 2.x** (Homebridge 1.x is not supported)
-- **Node.js 22, 24, or 26**
+- **Homebridge 2.x**
+- **Node.js 22, 24, or 26.** PagerDuty signals need 22.13 or later; the rest of the plugin does not
 - A Nest Account (not Google-only) with an `access_token` from [home.nest.com/session](https://home.nest.com/session)
 
 ## More Info
@@ -135,6 +136,10 @@ See [SECURITY.md](SECURITY.md) and [docs/AUTH.md](docs/AUTH.md).
 - [Changelog](CHANGELOG.md)
 - [Report issues](https://github.com/tbaur/homebridge-mynest/issues)
 
+## Trademarks
+
+homebridge-mynest is an independent project. It is not affiliated with or endorsed by Google. Nest, Nest Protect, and Nest Temperature Sensor are trademarks of Google LLC.
+
 ## License
 
 Copyright 2026 tbaur

package/SECURITY.md

@@ -9,7 +9,7 @@ Only the latest published release is supported. Fixes are shipped forward rather
 | Latest release | ✅ Active support |
 | Anything older | ❌ Unsupported — upgrade |
 
-The next release requires **Homebridge 2.x and Node.js 22 or newer**; Homebridge 1.x is no longer supported.
+Requires **Homebridge 2.x** and **Node.js 22, 24, or 26**.
 
 ## Reporting a Vulnerability
 
@@ -51,4 +51,4 @@ This plugin implements:
 
 Out-of-scope devices are listed in the [README](README.md#supported-devices): cameras, doorbells, Yale locks, Home/Away structure switches, and Google-account-only homes.
 
-Life-safety alarm state for Protects is only published while Nest REST can refresh it; Observe-only units and Protects whose REST feed is down do not keep a frozen all-clear.
+Life-safety alarm state for Protects is only treated as live while Nest REST can refresh it. A missing number or a stale REST feed leaves the smoke and CO sensors published, inactive, and faulted, so HomeKit does not keep a frozen all-clear. An `app_launch` that is empty or under half the previous object count still merges the objects it contains, and it does not refresh that clock.

package/config.schema.json

@@ -39,7 +39,7 @@
         "title": "Expose Protect occupancy",
         "type": "boolean",
         "default": true,
-        "description": "Publish an occupancy sensor for mains-powered Protects that report Nest auto_away. This is ~10-minute presence, not motion."
+        "description": "Publish an occupancy sensor when Nest auto_away is a boolean and the Protect is not reported as battery-powered. Unknown power does not hide a boolean Nest already sent. This is ~10-minute presence, not motion."
       },
       "exposeProtectTemperature": {
         "title": "Expose Protect temperature",
@@ -55,7 +55,7 @@
         "items": {
           "type": "string",
           "title": "Device ID",
-          "placeholder": "e.g. 18B4300000ACBFBD"
+          "placeholder": "e.g. 18B4300000000002"
         }
       },
       "fieldTest": {
@@ -81,6 +81,12 @@
         "default": false,
         "description": "When diagnostics are enabled, also emit a machine-readable JSON line alongside each human-readable health report."
       },
+      "pagerdutySignals": {
+        "title": "Send Signals to PagerDuty",
+        "type": "boolean",
+        "default": false,
+        "description": "Write this plugin's alert conditions to homebridge-pagerduty's signal store. Then allow homebridge-mynest to page in homebridge-pagerduty's settings. Needs Node 22.13 or later."
+      },
       "debug": {
         "title": "Debug logging",
         "type": "boolean",
@@ -125,6 +131,7 @@
           "type": "number"
         },
         "structuredLogs",
+        "pagerdutySignals",
         "debug"
       ]
     }

package/dist/accessories/base.d.ts

@@ -39,11 +39,30 @@ export declare abstract class NestAccessory<TState> {
     protected readonly binder: CharacteristicBinder;
     protected identity: DeviceIdentity;
     protected state: TState;
+    /**
+     * True after Nest dropped this device from its inventory while HomeKit
+     * still shows it (removal is waiting on its own guards). Readings are then
+     * last-known only, so subclasses mark them inactive or faulted.
+     */
+    protected isUnreported: boolean;
     constructor(platform: MyNestPlatform, accessory: PlatformAccessory, device: {
         identity: DeviceIdentity;
         state: TState;
     }, log: Logger);
     get deviceId(): string;
+    get kind(): DeviceKind;
+    /**
+     * Nest no longer reports this device, but HomeKit cannot drop it yet.
+     *
+     * Pushes the current readers again so subclasses that consult
+     * {@link isUnreported} stop presenting the last values as live.
+     */
+    markUnreported(): void;
+    /**
+     * Remove every service this accessory published, before another kind of
+     * accessory takes over the same HomeKit accessory.
+     */
+    removeAllServices(): void;
     /**
      * Take new state and push it to HomeKit.
      *

package/dist/accessories/base.js

@@ -34,6 +34,12 @@ class NestAccessory {
     binder;
     identity;
     state;
+    /**
+     * True after Nest dropped this device from its inventory while HomeKit
+     * still shows it (removal is waiting on its own guards). Readings are then
+     * last-known only, so subclasses mark them inactive or faulted.
+     */
+    isUnreported = false;
     /** Last summary emitted, so an unchanged one stays at debug. */
     #lastSummary = null;
     constructor(platform, accessory, device, log) {
@@ -49,6 +55,37 @@ class NestAccessory {
     get deviceId() {
         return this.identity.id;
     }
+    get kind() {
+        return this.identity.kind;
+    }
+    /**
+     * Nest no longer reports this device, but HomeKit cannot drop it yet.
+     *
+     * Pushes the current readers again so subclasses that consult
+     * {@link isUnreported} stop presenting the last values as live.
+     */
+    markUnreported() {
+        if (this.isUnreported) {
+            return;
+        }
+        this.isUnreported = true;
+        this.log.warn(`${this.identity.name}: no longer reported by Nest, marked inactive`);
+        this.binder.refresh();
+    }
+    /**
+     * Remove every service this accessory published, before another kind of
+     * accessory takes over the same HomeKit accessory.
+     */
+    removeAllServices() {
+        const { Service: HapService } = this.platform;
+        for (const service of [...this.accessory.services]) {
+            if (service.UUID === HapService.AccessoryInformation.UUID) {
+                continue;
+            }
+            this.binder.unbindService(service);
+            this.accessory.removeService(service);
+        }
+    }
     /**
      * Take new state and push it to HomeKit.
      *
@@ -60,6 +97,10 @@ class NestAccessory {
         const previousIdentity = this.identity;
         this.identity = device.identity;
         this.state = device.state;
+        if (this.isUnreported) {
+            this.isUnreported = false;
+            this.log.info(`${this.identity.name}: reported by Nest again`);
+        }
         // Only when it actually changed. These four values essentially never do, and
         // re-applying them ran HAP's full value-validation path four times per
         // device per refresh on the hot update path.

package/dist/accessories/global-eco.d.ts

@@ -7,7 +7,9 @@
  * @fileoverview House-wide Eco Mode switch (all Nest thermostats).
  *
  * HomeKit has no Eco thermostat mode, so Eco is a Switch. This accessory turns
- * Eco on or off for every published thermostat at once.
+ * Eco on or off for every published thermostat at once. What the switch shows
+ * is decided by `state/global-eco-state.ts`; this class owns HomeKit, the
+ * expiry timer, and the log lines.
  */
 import type { PlatformAccessory } from 'homebridge';
 import type { Logger } from '../utils/logger';
@@ -16,13 +18,7 @@ import type { MyNestPlatform } from '../platform';
 export declare class GlobalEcoAccessory {
     #private;
     constructor(platform: MyNestPlatform, accessory: PlatformAccessory, log: Logger);
-    /**
-     * Reflect whether every Nest thermostat is currently in Eco.
-     *
-     * While a HomeKit write is pending confirmation, ignore Nest aggregates that
-     * do not yet match the desired value (partial Eco reports). If Nest never
-     * matches within {@link PENDING_ECO_MAX_MS}, take Nest truth.
-     */
+    /** Reflect whether every Nest thermostat is currently in Eco. */
     updateAllEco(allEco: boolean): void;
     /**
      * Release the pending-write backstop.

package/dist/accessories/global-eco.js

@@ -8,38 +8,28 @@
  * @fileoverview House-wide Eco Mode switch (all Nest thermostats).
  *
  * HomeKit has no Eco thermostat mode, so Eco is a Switch. This accessory turns
- * Eco on or off for every published thermostat at once.
+ * Eco on or off for every published thermostat at once. What the switch shows
+ * is decided by `state/global-eco-state.ts`; this class owns HomeKit, the
+ * expiry timer, and the log lines.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GlobalEcoAccessory = void 0;
 const settings_1 = require("../settings");
+const global_eco_state_1 = require("../state/global-eco-state");
 const bound_characteristics_1 = require("../utils/bound-characteristics");
 const sanitizers_1 = require("../utils/sanitizers");
-/**
- * How long a successful HomeKit Eco write may ignore Nest aggregates that have
- * not yet matched. After this, Nest truth wins (Nest app / failed Observe).
- */
-const PENDING_ECO_MAX_MS = 45_000;
 /** Optional Switch that drives Eco on every thermostat. */
 class GlobalEcoAccessory {
     #platform;
     #accessory;
     #log;
     #binder;
-    #allEco = false;
-    /**
-     * Desired aggregate after a successful HomeKit write. While set, Nest sync
-     * must not push a partial aggregate (staggered Eco confirms) or unrelated
-     * inventory traffic will snap the switch back.
-     */
-    #pendingAllEco = null;
-    #pendingSinceMs = null;
+    #state;
     /**
      * Backstop for {@link PENDING_ECO_MAX_MS}.
      *
-     * The age check in {@link updateAllEco} only runs when Nest sends another
-     * update. If Observe dies right after a successful write, nothing would ever
-     * clear the optimistic value and the switch would hold it indefinitely.
+     * The age check on a Nest report only runs when Nest sends another one. If
+     * Observe goes quiet right after a write, nothing else would expire it.
      */
     #pendingTimer = null;
     constructor(platform, accessory, log) {
@@ -48,30 +38,15 @@ class GlobalEcoAccessory {
         this.#log = log;
         this.#binder = new bound_characteristics_1.CharacteristicBinder(log, settings_1.GLOBAL_ECO_DISPLAY_NAME);
         this.#applyAccessoryInformation();
+        const cachedOn = this.#accessory.getService(this.#platform.Service.Switch)
+            ?.getCharacteristic(this.#platform.Characteristic.On).value;
+        this.#state = (0, global_eco_state_1.initialGlobalEcoState)(cachedOn === true);
         this.#bindSwitch();
         this.#binder.refresh();
     }
-    /**
-     * Reflect whether every Nest thermostat is currently in Eco.
-     *
-     * While a HomeKit write is pending confirmation, ignore Nest aggregates that
-     * do not yet match the desired value (partial Eco reports). If Nest never
-     * matches within {@link PENDING_ECO_MAX_MS}, take Nest truth.
-     */
+    /** Reflect whether every Nest thermostat is currently in Eco. */
     updateAllEco(allEco) {
-        if (this.#pendingAllEco !== null) {
-            if (allEco === this.#pendingAllEco) {
-                this.#clearPending();
-            }
-            else if (this.#pendingSinceMs !== null
-                && Date.now() - this.#pendingSinceMs >= PENDING_ECO_MAX_MS) {
-                this.#expirePending();
-            }
-            else {
-                return;
-            }
-        }
-        this.#allEco = allEco;
+        this.#dispatch({ type: 'nest_report', allEco, nowMs: Date.now() });
         this.#binder.refresh();
     }
     /**
@@ -82,37 +57,53 @@ class GlobalEcoAccessory {
      * still fire up to 45s later and refresh a torn-down accessory.
      */
     dispose() {
-        this.#clearPending();
+        this.#clearTimer();
     }
-    #clearPending() {
-        this.#pendingAllEco = null;
-        this.#pendingSinceMs = null;
-        if (this.#pendingTimer) {
-            clearTimeout(this.#pendingTimer);
-            this.#pendingTimer = null;
+    #dispatch(event) {
+        const { state, outcome } = (0, global_eco_state_1.reduceGlobalEco)(this.#state, event);
+        this.#state = state;
+        this.#logOutcome(outcome);
+        if (state.pending === null) {
+            this.#clearTimer();
+        }
+        else if (event.type === 'write_sent') {
+            this.#armTimer();
         }
     }
-    /** Give up on an unconfirmed write and let Nest's own value stand. */
-    #expirePending() {
-        this.#log.warn(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: Nest did not confirm Eco change within ${PENDING_ECO_MAX_MS / 1000}s — following Nest`);
-        this.#clearPending();
+    #logOutcome(outcome) {
+        const prefix = `${settings_1.GLOBAL_ECO_DISPLAY_NAME}: Eco change not confirmed in ${global_eco_state_1.PENDING_ECO_MAX_MS / 1000}s`;
+        if (outcome === 'expired_to_nest') {
+            this.#log.warn(`${prefix}, showing Nest state`);
+        }
+        else if (outcome === 'expired_without_report') {
+            this.#log.warn(prefix);
+        }
     }
-    /** Start the backstop that gives Nest the last word even if it goes quiet. */
-    #armPending(ecoOn) {
-        this.#clearPending();
-        this.#pendingAllEco = ecoOn;
-        this.#pendingSinceMs = Date.now();
+    #armTimer() {
+        this.#clearTimer();
         this.#pendingTimer = setTimeout(() => {
             this.#pendingTimer = null;
-            if (this.#pendingAllEco === null) {
-                return;
-            }
-            this.#expirePending();
+            this.#dispatch({ type: 'expire' });
             this.#binder.refresh();
-        }, PENDING_ECO_MAX_MS);
+        }, global_eco_state_1.PENDING_ECO_MAX_MS);
         // Homebridge owns the process lifetime; this must not hold Node open.
         this.#pendingTimer.unref?.();
     }
+    #clearTimer() {
+        if (this.#pendingTimer) {
+            clearTimeout(this.#pendingTimer);
+            this.#pendingTimer = null;
+        }
+    }
+    /**
+     * Push the switch after `onSet` returns.
+     *
+     * HAP writes the requested On value after the setter resolves, so a refresh
+     * inside the setter is overwritten.
+     */
+    #refreshSwitch = () => {
+        this.#binder.refresh();
+    };
     #bindSwitch() {
         const { Characteristic, Service: HapService } = this.#platform;
         const service = this.#accessory.getService(HapService.Switch)
@@ -120,41 +111,39 @@ class GlobalEcoAccessory {
         service.setCharacteristic(Characteristic.Name, settings_1.GLOBAL_ECO_DISPLAY_NAME);
         this.#accessory
             .setPrimaryService?.(service);
-        this.#binder.bind(service, Characteristic.On, () => this.#allEco, {
+        this.#binder.bind(service, Characteristic.On, () => this.#state.shown, {
             write: async (value) => {
                 await this.#setEco(value === true || value === 1);
             },
         });
     }
     async #setEco(ecoOn) {
+        const startedAtMs = Date.now();
+        let sent;
         try {
-            const sent = await this.#platform.applyGlobalEcoWrite(ecoOn);
-            if (!sent) {
-                this.#clearPending();
-                if (!this.#platform.resolvedConfig.allowThermostatControl) {
-                    this.#log.warn(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: ignoring HomeKit change — enable Allow thermostat control in config.`);
-                }
-                // HAP assigns On after onSet; revert to Nest-derived `#allEco`.
-                setImmediate(() => this.#binder.refresh());
-                return;
-            }
-            this.#log.info(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: ${ecoOn ? 'Updating all thermostats to Eco' : 'Clearing Eco on all thermostats'}`);
-            // Optimistic until Nest's all-Eco aggregate matches; do not refresh here
-            // or HAP's post-onSet value is overwritten by a stale read.
-            this.#armPending(ecoOn);
-            this.#allEco = ecoOn;
+            sent = await this.#platform.applyGlobalEcoWrite(ecoOn);
         }
         catch (error) {
-            this.#clearPending();
-            this.#log.warn(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: Eco update failed: ${(0, sanitizers_1.sanitizeError)(error)}`);
-            setImmediate(() => this.#binder.refresh());
-            // Same distinction the thermostat draws: a refusal above resolves, but a
-            // write that reached Nest and failed is reported so the user is not left
+            // Same distinction the thermostat draws: a refusal resolves, but a write
+            // that reached Nest and failed is reported so the user is not left
             // watching a switch flip back with no stated reason. The deferred refresh
             // clears HAP's error status a tick later, so it cannot stick.
+            this.#log.warn(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: Eco update failed: ${(0, sanitizers_1.sanitizeError)(error)}`);
+            setImmediate(this.#refreshSwitch);
             const { HAPStatus, HapStatusError } = this.#platform.api.hap;
             throw new HapStatusError(-70402 /* HAPStatus.SERVICE_COMMUNICATION_FAILURE */);
         }
+        if (!sent) {
+            if (!this.#platform.resolvedConfig.allowThermostatControl) {
+                this.#log.warn(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: thermostat control is off, change ignored`);
+            }
+            setImmediate(this.#refreshSwitch);
+            return;
+        }
+        this.#log.info(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: Eco ${ecoOn ? 'on' : 'off'} for all thermostats`);
+        // Optimistic until Nest's aggregate matches. No refresh here: HAP is about
+        // to write the same value.
+        this.#dispatch({ type: 'write_sent', ecoOn, startedAtMs, nowMs: Date.now() });
     }
     #applyAccessoryInformation() {
         const { Characteristic, Service: HapService } = this.#platform;

package/dist/accessories/protect.d.ts

@@ -10,8 +10,8 @@
  * a PIR sensor, but neither Nest API publishes motion events: a 12.5-hour
  * capture of both transports on an occupied house recorded zero motion events
  * and zero occupancy changes. What is available is `auto_away`, Nest's own
- * verdict that nobody has been seen for roughly ten minutes, and only on
- * mains-powered units.
+ * verdict that nobody has been seen for roughly ten minutes, and omitted for
+ * a battery-powered Protect. Unknown power does not hide a boolean `auto_away`.
  *
  * So this accessory publishes occupancy only where that verdict exists, and
  * says why in the log when it does not. Presenting a ten-minute presence
@@ -19,10 +19,11 @@
  * automation built on it wrong.
  *
  * Smoke and CO come from REST `topaz` only. Observe streams safety traits, but
- * no public schema maps them and every captured sample reads all-clear, so an
- * Observe-only Protect deliberately gets no smoke/CO tiles. When REST later
- * goes stale, tiles stay published (so HomeKit rooms/automations survive) but
- * are marked inactive/faulted — never a live frozen all-clear. See `docs/PROTOCOL.md`.
+ * no public schema maps them and every captured sample reads all-clear, so
+ * those fields are not read. Every Protect still publishes both sensors. A
+ * missing number faults the sensor and does not write a clear. When REST later
+ * goes stale, tiles stay published (so HomeKit rooms and automations survive)
+ * but are marked inactive and faulted. See `docs/PROTOCOL.md`.
  */
 import type { PlatformAccessory } from 'homebridge';
 import type { NestDevice, ProtectState } from '../types/device';