I'm sorry I just don't understand what could be doing this.
I manually disarmed a couple HSM custom rules, one at 11:09am, and another at 3:29 pm.
At 11:30pm HSM intrusion was set to armed-home by an RM rule. Nothing happened to the HSM custom alerts armed status at this time, which is as I would expect (the RM rule is not configured to do anything to HSM custom rules).
At 11:39pm I manually set HSM intrusion to disarmed on the HSM app settings page, and it appears as though these two custom HSM rules re-armed at the same time. Looking at the hub's logs, there don't seem to be any other apps that ran around this time that could have re-armed the HSM custom rule.
Here are the app events from the two custom rules and HSM.
I can reproduce this behavior if I arm and disarm HSM intrusion alerts again.
If I have an automation running that causes HSM custom rules to arm when HSM intrusion alerts are disarmed, I'm not sure how to track that down.
edit: my mistake, it's not actually an RM rule that set HSM intrusion to armed-home at 11:30pm. HSM is configured to arm-home when the hub is in night mode; I set mode manager to change to night mode at 11:30pm.
