@camstack/server 1.2.407 → 1.2.409

package/dist/api/capabilities.router.js

@@ -47,26 +47,52 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
             }));
         }),
         // ─── Get current preference for a capability ──────────────────────
+        //
+        // `state` separates "the operator set nothing" (`known`, `preference`
+        // null / no disabled ids) from "the persisted preference cannot be read"
+        // (`unknown` — the boot read of the settings store is pending or failed,
+        // D675). The latter used to be reported as `null`: an unset preference.
         getPreference: trpc_middleware_1.adminProcedure.input(zod_1.z.object({ capability: zod_1.z.string() })).query(({ input }) => {
             const registry = addonRegistry.getCapabilityRegistry();
             const mode = registry.getMode(input.capability);
             if (!mode)
                 return null;
+            let raw;
+            try {
+                raw = configService.get(mode === 'singleton'
+                    ? `capabilities.singleton.${input.capability}`
+                    : (0, collection_preference_1.collectionPreferenceKey)(input.capability));
+            }
+            catch (err) {
+                if (!(0, system_1.isSettingsReadUnavailable)(err))
+                    throw err;
+                return {
+                    capability: input.capability,
+                    mode,
+                    state: 'unknown',
+                    reason: err.reason,
+                    preference: null,
+                };
+            }
             if (mode === 'singleton') {
-                const addonId = configService.get(`capabilities.singleton.${input.capability}`);
                 return {
                     capability: input.capability,
-                    mode: mode,
-                    preference: addonId ? { addonId } : null,
+                    mode: 'singleton',
+                    state: 'known',
+                    preference: raw ? { addonId: raw } : null,
                 };
             }
             // collection
-            const raw = configService.get((0, collection_preference_1.collectionPreferenceKey)(input.capability));
             let disabled = [];
             if (raw) {
                 try {
                     const parsed = JSON.parse(raw);
-                    disabled = Array.isArray(parsed.disabled) ? parsed.disabled : [];
+                    if (typeof parsed === 'object' && parsed !== null && 'disabled' in parsed) {
+                        const list = parsed.disabled;
+                        disabled = Array.isArray(list)
+                            ? list.filter((id) => typeof id === 'string')
+                            : [];
+                    }
                 }
                 catch {
                     /* ignore malformed */
@@ -74,7 +100,8 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
             }
             return {
                 capability: input.capability,
-                mode: mode,
+                mode: 'collection',
+                state: 'known',
                 preference: { disabled },
             };
         }),
@@ -104,7 +131,7 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
                     await registry.setActiveSingleton(capability, addonId);
                 }
                 // Persist preference
-                configService.set(`capabilities.singleton.${capability}`, addonId);
+                await configService.set(`capabilities.singleton.${capability}`, addonId);
                 logger.info('Singleton preference set', {
                     tags: { addonId },
                     meta: { capability, requiresRestart },
@@ -133,7 +160,7 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
             }
             // Persist disabled list via the shared canonical writer.
             const updatedCap = registry.listCapabilities().find((c) => c.name === capability);
-            (0, collection_preference_1.persistCollectionDisabled)(configService, capability, updatedCap?.disabledProviders ?? []);
+            await (0, collection_preference_1.persistCollectionDisabled)(configService, capability, updatedCap?.disabledProviders ?? []);
             logger.info('Collection provider toggled', {
                 tags: { addonId },
                 meta: { capability, enabled },
@@ -143,7 +170,7 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
         // ─── Reset preference to default ──────────────────────────────────
         resetPreference: trpc_middleware_1.adminProcedure
             .input(zod_1.z.object({ capability: zod_1.z.string() }))
-            .mutation(({ input }) => {
+            .mutation(async ({ input }) => {
             const registry = addonRegistry.getCapabilityRegistry();
             const mode = registry.getMode(input.capability);
             if (!mode)
@@ -152,7 +179,7 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
                     message: `Unknown capability: ${input.capability}`,
                 });
             if (mode === 'singleton') {
-                configService.set(`capabilities.singleton.${input.capability}`, null);
+                await configService.set(`capabilities.singleton.${input.capability}`, null);
                 logger.info('Singleton preference reset (takes effect on restart)', {
                     meta: { capability: input.capability },
                 });
@@ -166,7 +193,7 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
                     registry.enableCollectionProvider(input.capability, addonId);
                 }
             }
-            configService.set(`capabilities.collection.${input.capability}`, null);
+            await configService.set(`capabilities.collection.${input.capability}`, null);
             logger.info('Collection preference reset (all providers re-enabled)', {
                 meta: { capability: input.capability },
             });

package/dist/api/core/addon-settings.router.js

@@ -2,153 +2,107 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAddonSettingsRouter = createAddonSettingsRouter;
 /**
- * Addon settings router — raw DB proxy for the common settings API.
+ * `addonSettingsRaw` — admin read of an addon's RAW stored settings.
  *
- * ## ⚠️ This is NOT the store `ctx.settings.readAddonStore()` reads
+ * ## It reads the same rows `ctx.settings` does — through the same door
  *
- * Two different physical stores wear the name "addon-settings", and mistaking
- * one for the other costs a whole debugging session — it did on 2026-08-13,
- * where a per-node inference override was written here, read back here
- * (looking perfectly correct), and was invisible to the addon forever:
+ * There is ONE store: the `addon-settings` collection, one row per key,
+ * `id = "<addonId>.<key>"`, `data = {addonId, key, value}` (and
+ * `addon-device-settings`, `id = "<addonId>:<deviceId>.<key>"`, for the
+ * per-device overrides). An in-process addon's `ctx.settings` reads exactly
+ * those rows.
  *
- * | Surface | Physical shape | Read by |
- * | --- | --- | --- |
- * | THIS router (`ConfigService.getAddonConfig` → `getAllAddon`) | the `addon-settings` table, **one row per key**, `id = "<addonId>.<key>"`, `data = {addonId, key, value}` | `buildAddonConfig` → `ctx.addonConfig`, and `virtual-doorbell` |
- * | `settings-store` cap (`ctx.settings.readAddonStore()`) | **ONE blob row**, namespace `<addonId>`, collection `addon-settings`, key `root` | `BaseAddon.resolveConfig` / every addon's global settings |
+ * Until D675 this router read them through `ConfigManager.getAddonConfig`, a
+ * SYNCHRONOUS reader that needs an in-process `ISettingsStore`. Since D231
+ * isolated `sqlite-settings`, hub-main never has one — only the async door — so
+ * `getAddonConfig` fell back to the bootstrap file, which holds no addon key,
+ * and every `getGlobal` answered `{}` as a success. That `{}` was once
+ * explained here as "two different physical stores wear the name
+ * addon-settings". That diagnosis was wrong: the rows were exactly where this
+ * router looked; the reader simply had no backend. It sent at least one
+ * session hunting for a key mismatch that did not exist.
  *
- * Nothing bridges them. To write an addon's global setting — including a
- * `perNode: true` key — go through the `addonSettings` CAP
- * (`updateGlobalSettings`, which applies the schema's per-node scoping), or
- * read it back with
- * `settingsStore.get {namespace:<addonId>, collection:'addon-settings', key:'root'}`.
- * `addonSettingsRaw.getGlobal` answering `{}` for an addon that plainly has
- * settings is the tell.
+ * Now both reads go through the settings door, THREE-WAY:
+ *   - the stored record, when there is one;
+ *   - `{}` when the store ANSWERED and holds nothing for this addon/device;
+ *   - a `SERVICE_UNAVAILABLE` error when the store could not be read — never
+ *     `{}`, which would be "never written" to a caller that asked (D315, D393).
  *
- * `setAllAddon` is also a **bulk replace**: `updateGlobal` read-modify-writes
- * the whole per-key set, so a write here deletes every other row of that addon
- * in this table.
+ * A forked addon's settings live in its own namespaced blob (`namespace
+ * <addonId>`, collection `addon-settings`, key `root`), which this router does
+ * not read — use the `addonSettings` cap (`getGlobalSettings`) for an addon's
+ * hydrated settings, whichever process it runs in.
+ *
+ * The write methods (`updateGlobal` / `updateDevice` / `replaceGlobal`) are
+ * GONE (D675): they had no callers, threw `SettingsStore not initialized` on
+ * every isolated-engine hub, and bypassed the schema gate. Write an addon's
+ * settings through the `addonSettings` cap (`updateGlobalSettings`, which also
+ * applies per-node scoping).
  *
  * ## ⚠️ ADMIN-ONLY — every method here is `adminProcedure`
  *
- * Reads (`getGlobal` / `getDeviceOverrides`) return RAW, un-redacted addon
- * config — the same blob that holds notifier tokens, webhook secrets and API
- * keys; writes (`updateGlobal` / `updateDevice` / `replaceGlobal`) overwrite it
- * with no schema gate. Before 2026-08-13 these were `protectedProcedure`, so
- * any authenticated non-admin token could read and rewrite every addon's
- * config. The `:139` comment claimed "only workers with valid hub tokens can
- * call this" but nothing enforced it.
+ * Both reads return RAW, un-redacted addon config — the same rows that hold
+ * notifier tokens, webhook secrets and API keys. Before 2026-08-13 they were
+ * `protectedProcedure`, so any authenticated non-admin token could read every
+ * addon's config.
  *
  * Gating with `adminProcedure` costs the legitimate callers NOTHING: this
  * router is in `CORE_NAMESPACES` (`core-cap-bridge.ts`), so a forked addon's
  * `ctx.api.addonSettingsRaw.*` arrives over the trusted core-cap/UDS mesh whose
  * context is `createMeshTrpcContext` (`isAdmin: true`), and the admin UI is an
- * admin session. The two consumers:
- *   1. Forked addons (via `ctx.api` over the mesh) reading/writing their
- *      3-level settings chain from the worker process.
- *   2. Admin UI flows inspecting/mutating addon settings.
- *
- * The router is deliberately thin — it does NOT perform schema-based
- * resolver merging (defaults → global → per-device). That happens on the
- * consumer side where the addon's `ConfigUISchema` is available:
- *   - In-process addons: handled by `SettingsResolverService.createView()`
- *     wired into `AddonContext.settings` during `createAddonContext()`.
- *   - Forked addons: handled by the `AddonSettingsView` constructed inside
- *     `WorkerBootstrapService`, which has access to the worker's local
- *     addon schema.
+ * admin session.
  *
- * Introduced in session 5 Sprint 3a (worker-bootstrap cap-aware wiring).
+ * The router is deliberately thin — it does NOT perform schema-based resolver
+ * merging (defaults → global → per-device). That happens on the consumer side
+ * where the addon's `ConfigUISchema` is available.
  */
+const server_1 = require("@trpc/server");
+const system_1 = require("@camstack/system");
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const AddonSettingsRecordSchema = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown());
 const AddonIdInputSchema = zod_1.z.object({
-    addonId: zod_1.z.string(),
+    addonId: zod_1.z.string().min(1),
 });
+/**
+ * `deviceId` stays a STRING on the wire (the shape callers already send) but
+ * must be a numeric device id: the per-device rows are keyed by the numeric id.
+ */
 const AddonDeviceInputSchema = zod_1.z.object({
-    addonId: zod_1.z.string(),
-    deviceId: zod_1.z.string(),
-});
-const UpdateGlobalInputSchema = zod_1.z.object({
-    addonId: zod_1.z.string(),
-    field: zod_1.z.string(),
-    value: zod_1.z.unknown(),
-});
-const UpdateDeviceInputSchema = zod_1.z.object({
-    addonId: zod_1.z.string(),
-    deviceId: zod_1.z.string(),
-    field: zod_1.z.string(),
-    value: zod_1.z.unknown(),
-});
-const SuccessSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
-const ReplaceGlobalInputSchema = zod_1.z.object({
-    addonId: zod_1.z.string(),
-    config: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    addonId: zod_1.z.string().min(1),
+    deviceId: zod_1.z.string().regex(/^\d+$/, 'deviceId must be a numeric device id'),
 });
+/** A settings read that could not be answered is an error, never `{}`. */
+async function answerOrRefuse(read) {
+    try {
+        return await read();
+    }
+    catch (err) {
+        if ((0, system_1.isSettingsReadUnavailable)(err)) {
+            throw new server_1.TRPCError({ code: 'SERVICE_UNAVAILABLE', message: err.message, cause: err });
+        }
+        throw err;
+    }
+}
 function createAddonSettingsRouter(cfg) {
     return (0, trpc_middleware_js_1.trpcRouter)({
         /**
-         * Read the addon-global settings record for the given addon.
-         * Returns the raw stored values (no defaults, no device overrides).
+         * The addon-global stored record for the given addon — raw values, no
+         * defaults, no device overrides. `{}` only when the store answered with no
+         * row for this addon; a failed read is `SERVICE_UNAVAILABLE`.
          */
         getGlobal: trpc_middleware_js_1.adminProcedure
             .input(AddonIdInputSchema)
             .output(AddonSettingsRecordSchema)
-            .query(({ input }) => cfg.getAddonConfig(input.addonId)),
+            .query(({ input }) => answerOrRefuse(() => cfg.readAddonGlobalStrict(input.addonId))),
         /**
-         * Read the per-device override record for the given addon × device.
-         * Returns the raw stored values (schema filtering happens on the
-         * consumer side at merge time).
+         * The per-device override record for the given addon × device — raw
+         * values. `{}` only when the store answered with none; a failed read is
+         * `SERVICE_UNAVAILABLE`.
          */
         getDeviceOverrides: trpc_middleware_js_1.adminProcedure
             .input(AddonDeviceInputSchema)
             .output(AddonSettingsRecordSchema)
-            .query(({ input }) => cfg.getAddonDevice(input.addonId, input.deviceId)),
-        /**
-         * Update a single field in the addon-global settings record.
-         * Reads the current record, merges the new value, and writes back
-         * via `setAddonConfig` (bulk replace). Intended for small per-field
-         * writes from addon code; bulk updates should use a dedicated admin
-         * endpoint (not exposed here).
-         */
-        updateGlobal: trpc_middleware_js_1.adminProcedure
-            .input(UpdateGlobalInputSchema)
-            .output(SuccessSchema)
-            .mutation(({ input }) => {
-            const current = cfg.getAddonConfig(input.addonId);
-            cfg.setAddonConfig(input.addonId, { ...current, [input.field]: input.value });
-            return { success: true };
-        }),
-        /**
-         * Update a single field in the per-device override record for the
-         * given addon × device. Merges with the existing overrides and
-         * writes back via `setAddonDevice`. Scope enforcement (dropping
-         * fields not declared as `scope: 'device'`) is the consumer's
-         * responsibility — we preserve the raw shape at this layer so the
-         * resolver contract remains symmetric with `getDeviceOverrides`.
-         */
-        updateDevice: trpc_middleware_js_1.adminProcedure
-            .input(UpdateDeviceInputSchema)
-            .output(SuccessSchema)
-            .mutation(({ input }) => {
-            const current = cfg.getAddonDevice(input.addonId, input.deviceId);
-            cfg.setAddonDevice(input.addonId, input.deviceId, {
-                ...current,
-                [input.field]: input.value,
-            });
-            return { success: true };
-        }),
-        /**
-         * Replace the entire addon-global settings record in one call.
-         * Used by forked workers for `context.config.setAll()`. Unlike
-         * `updateGlobal` (single-field merge), this overwrites the full record.
-         * Admin-level write: only workers with valid hub tokens can call this.
-         */
-        replaceGlobal: trpc_middleware_js_1.adminProcedure
-            .input(ReplaceGlobalInputSchema)
-            .output(SuccessSchema)
-            .mutation(({ input }) => {
-            cfg.setAddonConfig(input.addonId, input.config);
-            return { success: true };
-        }),
+            .query(({ input }) => answerOrRefuse(() => cfg.readAddonDeviceStrict(input.addonId, Number(input.deviceId)))),
     });
 }

package/dist/api/core/cap-providers.js

@@ -1475,7 +1475,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             // Reuses the same `capabilities.collection.<cap>` key/format the
             // `capabilities` core router writes — via the shared canonical writer.
             const updated = registry.listCapabilities().find((c) => c.name === input.capName);
-            (0, collection_preference_js_1.persistCollectionDisabled)(configService, input.capName, updated?.disabledProviders ?? []);
+            await (0, collection_preference_js_1.persistCollectionDisabled)(configService, input.capName, updated?.disabledProviders ?? []);
             return { success: true };
         },
         getVersions: async (input) => ps.getPackageVersions(input.name),

package/dist/api/core/capabilities.router.js

@@ -33,24 +33,24 @@ function createCapabilitiesRouter(registry, config) {
             if (input.nodeId !== undefined) {
                 // Per-node override: persist under the node-qualified key so the boot
                 // restorer (`setNodeConfigReader`) replays it on restart.
-                config.set(`capabilities.singletonNode.${input.capability}.${input.nodeId}`, input.addonId);
+                await config.set(`capabilities.singletonNode.${input.capability}.${input.nodeId}`, input.addonId);
             }
             else {
                 // Cluster-global default: persist to the SAME key the boot restorer reads
                 // (addon-registry `setConfigReader` → `capabilities.singleton.<cap>`).
-                config.set(`capabilities.singleton.${input.capability}`, input.addonId);
+                await config.set(`capabilities.singleton.${input.capability}`, input.addonId);
             }
         }),
         clearSingletonNodeOverride: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ capability: zod_1.z.string(), nodeId: zod_1.z.string() }))
             .output(zod_1.z.void())
-            .mutation(({ input }) => {
+            .mutation(async ({ input }) => {
             if (!registry)
                 throw new Error('Capability registry unavailable');
             registry.clearSingletonNodeOverride(input.capability, input.nodeId);
             // Persist the cleared state as null so the boot restorer doesn't re-apply
             // a stale override on restart.
-            config.set(`capabilities.singletonNode.${input.capability}.${input.nodeId}`, null);
+            await config.set(`capabilities.singletonNode.${input.capability}.${input.nodeId}`, null);
         }),
         /**
          * Set the enabled set of providers for a collection capability in

package/dist/api/core/collection-preference.js

@@ -12,6 +12,6 @@ function collectionPreferenceKey(capability) {
  * enable/disable mutation so the stored value always mirrors the live
  * registry state.
  */
-function persistCollectionDisabled(configService, capability, disabled) {
-    configService.set(collectionPreferenceKey(capability), JSON.stringify({ disabled: [...disabled] }));
+async function persistCollectionDisabled(configService, capability, disabled) {
+    await configService.set(collectionPreferenceKey(capability), JSON.stringify({ disabled: [...disabled] }));
 }

package/dist/api/trpc/generated-cap-routers.js

@@ -3247,6 +3247,15 @@ function createCapRouter_deviceManager(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.setWrapperActive(methodInput);
         }),
+        getWrapperActivation: trpc_middleware_js_1.protectedProcedure
+            .input(types_45.deviceManagerCapability.methods.getWrapperActivation.input.loose())
+            .output(types_45.deviceManagerCapability.methods.getWrapperActivation.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('device-manager', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.getWrapperActivation(methodInput);
+        }),
         listWrappersForCap: trpc_middleware_js_1.protectedProcedure
             .input(types_45.deviceManagerCapability.methods.listWrappersForCap.input.loose())
             .output(types_45.deviceManagerCapability.methods.listWrappersForCap.output)

package/dist/core/addon/addon-registry.service.js

@@ -48,6 +48,7 @@ const types_1 = require("@camstack/types");
 const client_1 = require("@trpc/client");
 const addon_call_gateway_js_1 = require("./addon-call-gateway.js");
 const addon_row_manifest_1 = require("./addon-row-manifest");
+const settings_door_wiring_js_1 = require("./settings-door-wiring.js");
 const addon_settings_provider_js_1 = require("./addon-settings-provider.js");
 const device_meta_mirror_js_1 = require("./device-meta-mirror.js");
 const integration_visibility_js_1 = require("./integration-visibility.js");
@@ -409,12 +410,18 @@ class AddonRegistryService {
         });
         // Create capability registry with config reader for singleton preferences
         this.capabilityRegistry = new system_1.CapabilityRegistry(this.loggingService.createLogger('CapabilityRegistry'), this.eventBusService);
+        // The preference readers answer "no preference" while the persisted
+        // preferences cannot be read yet — before the settings door exists, or
+        // while its one boot read is in flight (D675: `get` then THROWS rather
+        // than answering "unset"). The default wins meanwhile, and
+        // `wireSettingsDoor` re-applies the persisted choice
+        // the moment the read settles.
         this.capabilityRegistry.setConfigReader((capability) => {
             try {
                 return this.configService.get(`capabilities.singleton.${capability}`) ?? undefined;
             }
             catch (err) {
-                this.logger.debug('settings-store not wired yet during early boot', {
+                this.logger.debug('capability preference not readable yet — default applies until replay', {
                     meta: { capability, error: (0, types_1.errMsg)(err) },
                 });
                 return undefined;
@@ -426,8 +433,9 @@ class AddonRegistryService {
                     undefined);
             }
             catch (err) {
-                this.logger.debug('settings-store not wired yet during early boot', {
-                    meta: { capability, nodeId, error: (0, types_1.errMsg)(err) },
+                this.logger.debug('capability preference not readable yet — default applies', {
+                    tags: { nodeId },
+                    meta: { capability, error: (0, types_1.errMsg)(err) },
                 });
                 return undefined;
             }
@@ -452,7 +460,7 @@ class AddonRegistryService {
                 return undefined;
             }
             catch (err) {
-                this.logger.debug('settings-store not wired yet or malformed collection preference', {
+                this.logger.debug('collection preference not readable yet, or malformed', {
                     meta: { capability, error: (0, types_1.errMsg)(err) },
                 });
                 return undefined;
@@ -2498,7 +2506,11 @@ class AddonRegistryService {
                     const store = this.capabilityRegistry.getProviderByAddon('settings-store', addonId);
                     if (!store)
                         return;
-                    this.configService.setSettingsDoor(store);
+                    void (0, settings_door_wiring_js_1.wireSettingsDoor)({
+                        configService: this.configService,
+                        registry: this.capabilityRegistry,
+                        logger: this.logger,
+                    }, store);
                     this.integrationRegistry = new system_1.IntegrationRegistry(store);
                     void this.integrationRegistry.initialize().then(() => {
                         this.logger.info('IntegrationRegistry initialized', { meta: { phase: 'v2' } });
@@ -2770,42 +2782,6 @@ class AddonRegistryService {
         }
         return null;
     }
-    /**
-     * Build the addonConfig for a given addon — strictly per-addon now.
-     *
-     * The legacy cross-addon merge (hardcoded `ADDON_SYSTEM_SETTINGS` map
-     * copying `system_settings.<section>.*` into the bootstrap config) has
-     * been removed. Addons that need to read shared system settings
-     * sections (`ffmpeg`, `logging`, `recording`, …) do so at runtime via
-     * `ctx.settings.getGlobal({ section: '<name>' })`, which delegates to
-     * `ConfigManager.getSection()` and covers the full SQL → YAML →
-     * RUNTIME_DEFAULTS fallback chain.
-     *
-     * This keeps the kernel agnostic: every addon declares its own needs
-     * in its own `initialize(ctx)` code, with zero kernel-side addon id
-     * special-casing. The only remaining exception is `sqlite-settings`,
-     * which receives `_runtimeDefaults` for first-boot seeding (tracked
-     * separately under the kernel-cleanup roadmap — Point 3d).
-     */
-    buildAddonConfig(addonId) {
-        // Start with per-addon SQL settings (may be empty for most addons)
-        let addonSpecific = {};
-        try {
-            addonSpecific = this.configService.getAddonConfig(addonId);
-        }
-        catch (err) {
-            this.logger.debug('ConfigManager not ready for addon', {
-                tags: { addonId },
-                meta: { error: (0, types_1.errMsg)(err) },
-            });
-        }
-        // No addon id special-casing here anymore. Bootstrap-level
-        // concerns (e.g. first-boot seeding from RUNTIME_DEFAULTS) are
-        // owned by the addon itself — sqlite-settings imports the
-        // constant directly from `@camstack/types` instead of relying on
-        // a kernel-injected bootstrap field.
-        return addonSpecific;
-    }
     async createAddonContext(addon) {
         const addonId = addon.manifest.id;
         const brokerNodeId = this.broker.nodeID;
@@ -2816,7 +2792,6 @@ class AddonRegistryService {
         const logger = this.loggingService
             .createLogger()
             .withTags({ addonId, nodeId: brokerNodeId, agentId });
-        const bootstrapConfig = this.buildAddonConfig(addonId);
         // Per-addon private data directory — resolved from active storage
         // provider if available, otherwise falls back to a deterministic
         // hardcoded path. Addons that need the full storage provider now
@@ -2920,7 +2895,12 @@ class AddonRegistryService {
             id: `addon:${addonId}`,
             logger,
             eventBus: this.eventBusService,
-            addonConfig: bootstrapConfig,
+            // No store data (D675). An in-process addon reads its persisted settings
+            // through `ctx.settings`; `addonConfig` used to be filled from the sync
+            // `getAddonConfig`, which has no backend on an isolated engine and handed
+            // every addon `{}`. Nothing in production reads it — the same empty
+            // record a forked runner's context carries (`addon-context-factory`).
+            addonConfig: {},
             dataDir,
             nodeDataDir,
             dataPlane: dataPlaneFacility.dataPlane,

package/dist/core/addon/settings-door-wiring.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wireSettingsDoor = wireSettingsDoor;
+/**
+ * Wiring the async `settings-store` door into `ConfigService` — and replaying
+ * the operator's persisted capability preferences once its boot read settles
+ * (D675).
+ *
+ * One function, so the replay cannot be dropped from the wiring without a
+ * spec noticing: `setSettingsDoor` starts the ONE boot read of the preloaded
+ * `system-settings` keys, and that read's own promise drives a single
+ * `applyPersistedPreferences` pass over the providers that registered before
+ * it. No timer, no retry (D3). A failed read is logged at error and leaves
+ * every preference UNKNOWN until the next boot.
+ */
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+/**
+ * Wire `door` and schedule the one preference replay. Returns the replay's
+ * promise (it never rejects) so a caller — or a spec — can await it.
+ */
+function wireSettingsDoor(deps, door) {
+    deps.configService.setSettingsDoor(door);
+    const preload = deps.configService.whenSystemSettingsPreloaded();
+    if (preload === null)
+        return Promise.resolve();
+    return preload
+        .then((result) => {
+        if (result.kind === 'failed') {
+            deps.logger.error('capability preferences could not be read at boot — every persisted preference is UNKNOWN until the next boot, and the defaults apply', { meta: { error: result.error } });
+            return;
+        }
+        const replay = deps.registry.applyPersistedPreferences((capability) => (0, system_1.isInfraCapability)(capability));
+        deps.logger.info('capability preferences loaded from the settings store', {
+            meta: {
+                keyCount: result.keyCount,
+                singletonsApplied: replay.singletons.map((s) => `${s.capability}=${s.addonId}`),
+                collectionProvidersDisabled: replay.disabled.map((d) => `${d.capability}/${d.addonId}`),
+            },
+        });
+    })
+        .catch((err) => {
+        deps.logger.error('capability preference replay failed', { meta: { error: (0, types_1.errMsg)(err) } });
+    });
+}

package/dist/core/moleculer/moleculer.service.js

@@ -205,9 +205,14 @@ class MoleculerService {
     async onModuleInit() {
         const logger = this.logging.createLogger('moleculer');
         const hubDeps = {
-            getAddonConfig: (addonId) => {
-                return this.config.getAddonConfig(addonId);
-            },
+            // Through the settings door, three-way (D675): the stored record, `{}`
+            // when the store answered with none, a THROW when it could not be read.
+            // The sync `getAddonConfig` has no backend on an isolated engine and
+            // answered `{}` for every addon.
+            getAddonConfig: (addonId) => this.config.readAddonGlobalStrict(addonId),
+            // `ConfigManager.get` REFUSES (throws) a key the isolated engine may hold
+            // but cannot read synchronously (D675) — the caller gets that error over
+            // Moleculer rather than a default dressed as the stored value.
             getSettings: (scope, key) => {
                 return this.config.get(key ? `${scope}.${key}` : scope);
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.407",
+  "version": "1.2.409",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.284",
-    "@camstack/addon-agent-ui": "1.2.154",
+    "@camstack/addon-admin-ui": "1.2.286",
+    "@camstack/addon-agent-ui": "1.2.155",
     "@camstack/addon-auth": "1.2.123",
     "@camstack/addon-decoder-nodeav": "1.2.115",
     "@camstack/addon-notifiers": "1.2.121",
     "@camstack/addon-pipeline": "1.2.305",
-    "@camstack/addon-pipeline-orchestrator": "1.2.261",
-    "@camstack/addon-post-analysis": "1.2.294",
+    "@camstack/addon-pipeline-orchestrator": "1.2.262",
+    "@camstack/addon-post-analysis": "1.2.296",
     "@camstack/sdk": "1.2.118",
-    "@camstack/system": "1.2.316",
-    "@camstack/types": "1.2.270",
-    "@camstack/ui-library": "1.2.212",
+    "@camstack/system": "1.2.318",
+    "@camstack/types": "1.2.272",
+    "@camstack/ui-library": "1.2.213",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",