The house decides, and no clock does
The smart home in this flat has no “leave” button and no bedtime on a wall clock. It derives five house states from a door, a phone and the presence sensors, and every other behaviour hangs off that one variable: the welcome light when someone comes home after dark, the lock, the air conditioning and the cameras when nobody is left, a vacuum that cleans only while the flat is empty, a bathroom fan that knows why it is running, a party that stays sound-reactive when the hub is down. This note goes through the rules and the reasons — a clock that cut a real daytime sleep short, a reminder that lit the bedroom seven times around a sleeping body, a fan stuck on boost for a day because a timer never fired — and is plain about what is not yet proven: the lock and the air conditioner have never been caught actually reacting to a real departure, and a lighting bridge still runs its own behaviours beside the hub in two rooms. As of 2026-09-08.
The goal is written down in one sentence: the flat is in the right state without being operated. Bright when someone comes home after dark, dark and quiet while someone sleeps, everything off and locked when nobody is left. The house derives all of that from sensors and the phone. Buttons exist only for intent that cannot be sensed — going to sleep now, cameras on or off. Nothing runs on a wall clock except the two things that genuinely are about the time of day: sunset, and how warm a welcome light should be.
Two facts, not a clock
The derivation. Four inputs, two facts, three outcomes — and no clock anywhere in it.
Two facts are derived independently, and neither is a timer.
I left is the phone leaving the home zone, or dropping out of Bluetooth range of the flat, while the front door has been closed for two minutes. Someone is still here is any room-presence sensor firing in the last ten minutes. The two combine into a table:
| I left | Someone still here | The house |
|---|---|---|
| yes | no | Away: lights off, air conditioning off, door locked, cameras armed |
| yes | yes | Home without me: nothing global changes |
| no | — | Day, Evening or Sleep |
Neither input alone would do. The door also opens for a guest or a parcel, and the phone also leaves the zone on a two-hundred-metre walk; both together, in order, describe a person leaving. And presence is checked over ten minutes rather than instantly because the room sensors let go of a person at very different speeds: the infrared ones after about ten seconds, the radars after a few minutes. A person sitting still in the living room can be invisible to all of them for a while.
One radar is deliberately not on that list. Its moving-target channel flapped tens of thousands of times a day in an empty flat, which kept “last movement” permanently under ten minutes and made Away unreachable. It was dropped from the presence inputs rather than thresholded, because its still channel cannot be thresholded either.
The calendar feeds the same decision. An all-day vacation entry is one more departure signal; a running home-office event refuses Away altogether, so a quiet afternoon at the desk does not lock the door and kill the air conditioning behind someone who is still there.
The five states and every event that moves between them. Party is the one with no way out, which is the open decision at the end of this note.
Arriving
The door opening on an empty flat, or the phone’s zone flipping to home, triggers the welcome — but only if it is dark, by sun or by a light sensor. The welcome is time-tiered: warm until nine in the evening, dimmed until eleven, a night light after that. If the bedroom is already asleep, only the hallway night scene runs. A restore-safe thirty-minute timer stops a second door cycle from firing it again.
The first cut of this lit the whole flat at full brightness at one in the morning. The cause was a Bluetooth “not home” reading that turned out to be false — the phone had never left — and the fix was not a better Bluetooth threshold but a different question: was any presence sensor quiet for the last ten minutes? Bluetooth is one leg of arrival and departure; it may not decide anything on its own.
The air conditioner joins on the way in: when the phone enters the home zone while the house is Away and the living room is above a threshold, cooling starts before the door opens. That one has been seen working on a real homecoming.
Sleep has a way out
Sleep is the one state a sensor cannot derive, so it has buttons: a long press on the button by the bed puts the bedroom to sleep while the living room stays awake. A button on the wall pad puts the whole house to sleep. The bedroom has its own override — asleep, awake, or following the house — so one person can sleep while another is up.
What the mode actually does is deliberately narrow. Exactly one automation derives a single flag from it, and that flag is the only night guard on the bedroom’s motion light: by day, motion lights the room; at night it does not. The rule written beside it is that the flag must always have exactly one writer — with none, the feature is silently dead.
The exit is where the design shows. Sleep ends when the bedroom stands empty for forty-five minutes, or five minutes after the phone’s alarm has rung. There is no clock exit, because a noon clear-out cut a real daytime sleep short on 2026-08-25. And the alarm only arms the exit; it does not perform it. An alarm ringing means an alarm rang, not that anyone got up. A recurring late-evening reminder on the phone cleared the flag every night. On 2026-09-06 the radar then lit the whole bedroom seven times between roughly half past five and a quarter to nine, around a body that had never left the bed. Since then a body the radar loses for a moment keeps the room asleep; only an empty bedroom decides.
What Away means
Away turns the lights off, the air conditioning off, locks the door and arms the cameras. Two of those legs have never been caught in the act: on the first real departure the lock was already locked and the air conditioner already off, so the automation had nothing to do. The derivation is proven from the recorder — a real departure produced Away correctly and no false Away has followed — but the actuators are, as of this writing, untested on a real evening.
What Away actually drives. The two dashed legs are the ones that have never been caught in the act.
The vacuum cleans on Away, once a day, in daylight hours, and only if it is docked and both of its own error sensors read clean — a fault is never a reason to send it out again. Anyone coming home, or the house going to Sleep, sends it back to the dock from wherever it is. Its do-not-disturb window is the house’s, too: on Sleep the automation saves the device’s own begin and end times, moves the window to now, and restores the saved window on exit. The vendor’s switch only arms a schedule — it does not silence the dock emptying itself in the night. Faults reach the phone once per class, silent while the house is Away and said once on the way back in if they outlasted the trip.
The cameras are the split described in the tour note: the recorder on the storage box keeps recording, an object detector in its own guest watches the same streams, and the hub decides what a detection means. That deciding half is small and has three rules.
- A camera whose smart plug is about to open is disabled in the detector first, and re-enabled two minutes after the plug closes, so a power cycle never reads as a lost stream. Which plug powers which camera was measured, not read off the names — one plug labelled “kitchen” in the interface sits under a dining-table camera. One camera has no plug and cannot be gated.
- A person detected while the house is Away raises one push and one mail with the recorder’s frame attached and, where the detector recognised a face, the name leads the text. The alert fires off the detector’s raw event stream rather than its reviewed alerts, because reviewed alerts exist only for cameras the detector records, and it records nothing here. One push per tracked object falls out of the payload itself — the zone list an object has entered only ever grows, so the condition has exactly one edge.
- The balcony camera alerts only for a person inside a drawn zone along the parapet; the street beyond it is masked. Before the re-aim that camera raised three quarters of all detections in the fleet, most of them a fingernail of frame for eight seconds. After it: a handful a day, and a walk onto the balcony raises exactly one push.
The recorder’s own Home Mode is left alone. It arms nothing on this installation, and the writer the hub was racing turned out to be the vendor app’s geofence on the same phone, which won every transition by minutes. Mirroring the house state onto it bought nothing, so the mirror was dropped rather than defended.
The robot vacuum, for the record, is never detected as a person. Across an hour of cleaning the cameras raised seventy-odd events and every one of them was taller than wide — people. A disc on the floor is not.
Air
The bathroom’s two-stage exhaust fan is two relays. The radio stack had created them as lights, because the relay advertises itself as one. They are now overridden to switches and wrapped into a single fan entity with two levels — base ventilation, which is meant to run always, and boost. Boost has named causes: the dryer drawing power, the bathroom light on, or the humidity sensor above a threshold. A thirty-minute timer releases it, re-armed every five minutes while a cause holds, and the timer survives a restart of the hub, so a shower run that spans one resumes its countdown instead of losing it.
That last property is why the package exists. On 2026-09-06 boost was found to have been on since the previous night’s restart, for no reason at all. The interface-built automation that released it used a “condition true for thirty minutes” trigger, which never fires when the condition is already true at start — so every restart that landed mid-quiet left the boost on for good. The hub restarts about twice a day when it pulls its own configuration; every timer in the house has to survive that, or it is not a timer.
Two more relays that were “lights” went the same way: an amplifier’s mains relay and a momentary relay that pulses a PC’s power button, which is now a button rather than a light that switches itself off after a second.
The rest of the air story is measurement before action. Every room’s carbon dioxide, particulate and humidity sensor sits on a floor-plan dashboard. Two air purifiers run firmware written here after the vendor’s servers went dark; one stands on the balcony and blows through the wall, so it is the bedroom’s supply air and the only mechanical air exchange the flat has. The humidity channel on the built sensor nodes is not consumed by any rule: a paired comparison put it well off a reference in the same room, and until that is understood, humidity logic reads the other instruments. Demand control of the supply fan on the bedroom’s carbon dioxide is the next step, and it is not built.
The purifier whose manufacturer went dark, running firmware built in the flat. The readings on its face are the ones it publishes to the house broker.
Alarms that may not be missed
Two leak sensors sit where a leak costs the most: under the kitchen sink and under a water-cooled PC. A leak speaks on the phone at alarm volume through silent mode, leaves a sticky notification, announces on the voice satellite and mails as the record. It repeats every two minutes until the sensor is dry, for about an hour of repeats at most, then clears its own notification. A sensor that stops reporting is its own alert. The PC’s power is deliberately not cut: a forced power-off of a running machine is a person’s call.
Two soil probes guard two plants. A dry reading has to hold for an hour before it alerts — one low sample after watering must not undo a fresh reading — and then it reminds once a day. The probes sleep and report only on a meaningful change, so a value can sit unchanged for days. The staleness alert therefore keys on when the probe last reported, not when the value last changed — a forced resend proved those are two different things. One probe needed a fix to the device library that had not shipped upstream yet; it is carried locally.
Entity health is counted the same way: unavailable entities only, never “unknown”, per integration rather than as one flat number, because a flat count is deaf to a mid-sized integration going dark. And the nightly off-box backup reports its outcome from the two entities the hub maintains about it, never from “the call returned” — the backup note has the thirteen silent days that rule comes from.
A party that works without the hub
The fifth house state had a button and no behaviour for weeks. What it does now rests on one fact read from the devices: every lamp in the room that can react to sound has its own microphone. The dodecahedron lamps and the moon lamp run a sound-reactive firmware effect on their own; the curtain of lights has seven microphone modes of its own; the two sculptural lamps sit in a mode where music sync is forced on. Arming a party sets each device to its own sound-reactive mode and leaves it alone. No audio is streamed anywhere, nothing analyses the room centrally, and a party keeps going if the hub falls over mid-song.
The one device class that cannot hear is the lighting bridge, and the hub drives it — carefully. The bridge holds the room; it does not keep the beat: a deep dim wash that never changes across the living room, and colour moving with crossfades across six accent fixtures only. The first cut switched every ceiling light to a new saturated colour every second and a half and looked like cheap blinking RGB; the beat belongs to the devices that can actually hear it. The bridge’s own “dynamic” scenes were measured live and do not move, so they are not used.
Four things run around that. Every touched light is snapshotted on arm and restored on disarm, per lamp rather than per group. The door-open alert and the device-offline notifiers go quiet, because guests are in and out. The television’s light-sync box switches off: the bridge streams one session at a time, and the party wins. And the fog machine gets power on a hard two-hour cap — the hub can switch it on, it cannot make fog.
A keep-alive re-enters the colour loop every half hour because the hub aborts a loop at ten thousand iterations, which at party pace is under three hours — an ordinary evening.
Party has no automatic exit, and that is recorded as a decision the house still owes rather than a bug. Every other mode here has a deterministic way out, and this house’s own rule is that a mode needs one. Whether the exit is “flat empty for half an hour” or “sunrise” is a decision about the house, not about the code.
Buttons that say when they are wrong
The dual-mode wireless buttons and knobs in the flat can each run in two firmware modes, and a hidden triple-click flips them. In the wrong mode a knob sends one event every second and a half instead of a command in a quarter of one. Command mode is the standard. An announcer watches for event-mode traffic from any of the six units, spares included, and says so out loud — so a knob that was flipped in a drawer announces itself rather than feeling broken for a week.
The desk knob is the volume of the room’s audio processor: a scaled step per detent into a target, an immediate first write and a quarter-second follow cadence, so a fast twist does not collapse into one step. Press is play/pause, double-press is mute.
What is not proven, and what is planned
- The actuator leg of Away — the lock and the air conditioner reacting to a real departure. Both were already in their target state on the departures logged so far.
- A late arrival lighting the flat before the door closes on a real evening; the one logged arrival found the lights already on.
- The Bluetooth walk-through that would qualify room-level presence as more than a corroborating input.
- The lighting bridge’s own behaviours still run on a wall clock in the hallway and the bathroom while the hub drives the same lamps on arrival — the one arrangement this house rules out. Retiring them is a step inside the vendor’s app, tied to one pass over every button, dial and pad.
- A power cycle of each camera plug with a person watching, to confirm the measured plug-to-camera binding against the interlock.
- Party’s exit, above.
- The hub’s own sleep signal from the watch, which needs a permission granted on the phone.
What those items have in common is the distance between a rule and a sighting. The derivation itself is proven on a real departure. Most of what hangs off it has so far only been reasoned about — and a house that is right in the recorder is not yet a house that has been seen being right.
Every automation named here was read from the running hub’s automation list on 2026-09-08 and its rules from the smart-home configuration repository on the same date; the incidents carry the dates recorded beside the rules they changed. Planned items are marked as planned.