@camstack/system 1.2.142 → 1.2.144

package/dist/index.d.ts

@@ -57,6 +57,9 @@ export type { ILogDestination } from './logging/log-manager.js';
 export { LogManager } from './logging/log-manager.js';
 export type { LogEntry, LogFilter, LogLevel } from './logging/log-ring-buffer.js';
 export { LogRingBuffer } from './logging/log-ring-buffer.js';
+export type { LevelBearing } from './logging/logging-gate.js';
+export { DEFAULT_LOG_LEVEL, LoggingGate } from './logging/logging-gate.js';
+export { __resetLoggingGateForTests, getLoggingGate, } from './logging/logging-gate.singleton.js';
 export type { IScopedLogger } from './logging/scoped-logger.js';
 export { ScopedLogger } from './logging/scoped-logger.js';
 export type { ClientNetworkStats, DeviceNetworkStats, INetworkQualityTracker, StreamNetworkStats, } from './network/network-quality.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-jRSrzoXr.js");
+const require_dist = require("./dist-D3lqzV40.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DBQarwp9.js");
+const require_manifest_python_deps = require("./manifest-python-deps-B_mCU6gz.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -696,6 +696,109 @@ var LogRingBuffer = class {
 	}
 };
 //#endregion
+//#region src/logging/logging-gate.ts
+/**
+* The in-memory MIRROR of the logging settings document, read on the log path.
+*
+* ## Why a mirror and not the settings store
+*
+* The document (`system.getLoggingSettings` / `setLoggingSettings`) is the
+* durable AUTHORITY. It is a row in `system-settings`, reachable only through
+* an async cap call — and this gate is consulted once per emitted log line. A
+* hot path cannot await a store, so the store is mirrored here and the mirror
+* is refreshed OFF the hot path, on a write and once at boot.
+*
+* ## Cost when nothing is set
+*
+* {@link LoggingGate.restrictsDestinations} is a plain boolean FIELD, and it is
+* the FIRST statement of {@link LoggingGate.allowsDestination} — before the
+* entry is touched at all. A default hub sets no level, the field stays
+* `false`, and every line costs one boolean read and a return: no rank lookup,
+* no property access, no allocation. `logging-gate.spec.ts` pins this with an
+* entry whose `level` getter THROWS, so moving the guard below a field access
+* fails the spec instead of taxing every line the hub emits.
+*
+* ## A failed read changes nothing (D49)
+*
+* Nothing here reads the store. The only way the mirror moves is an explicit
+* {@link LoggingGate.setDestinationFloor}, and the service that owns the
+* document calls it ONLY with a value it actually read. A store read that
+* fails leaves the mirror exactly as it was: it neither raises a level nor
+* lowers one, and a diagnostic armed before the failure stays armed.
+*
+* ## What the floor governs, and what it deliberately does not
+*
+* The floor gates the fan-out to DESTINATIONS (console, rotated files, Loki,
+* the hub forwarder). It does NOT gate the in-memory ring buffer: the ring
+* keeps everything it has room for and prunes by level only under pressure,
+* which the plan
+* (`docs/design/plans/2026-08-26-logging-per-componente.md`) settles as the
+* better policy — an admission level for the ring would make the log viewer go
+* blind exactly when an operator raises the level to quieten a disk.
+*
+* A destination's own level still applies on top. The two compose as
+* "most restrictive wins", which is a hierarchy and not a second authority:
+* the floor is node-wide, the destination level is that destination's own, and
+* neither can be read as overriding the other.
+*/
+/** What a hub emits when nothing is configured anywhere. */
+var DEFAULT_LOG_LEVEL = "debug";
+var LoggingGate = class {
+	/** The ONLY field an unrestricted log path reads. */
+	restricted = false;
+	floorRank = require_dist.LOG_LEVEL_RANK[DEFAULT_LOG_LEVEL];
+	floor = DEFAULT_LOG_LEVEL;
+	/** The effective node-wide level currently mirrored. */
+	get destinationFloor() {
+		return this.floor;
+	}
+	/** True only when the mirrored level is stricter than the default. */
+	get restrictsDestinations() {
+		return this.restricted;
+	}
+	/**
+	* May this entry be fanned out to the log destinations?
+	*
+	* The boolean field is read FIRST. Do not move it below anything.
+	*/
+	allowsDestination(entry) {
+		if (!this.restricted) return true;
+		return require_dist.LOG_LEVEL_RANK[entry.level] >= this.floorRank;
+	}
+	/**
+	* Refresh the mirror. Called off the hot path — on an operator write and
+	* once at boot — and never with a value that was not actually read.
+	*/
+	setDestinationFloor(level) {
+		this.floor = level;
+		this.floorRank = require_dist.LOG_LEVEL_RANK[level];
+		this.restricted = this.floorRank > require_dist.LOG_LEVEL_RANK[DEFAULT_LOG_LEVEL];
+	}
+};
+//#endregion
+//#region src/logging/logging-gate.singleton.ts
+/**
+* Process-wide holder for the {@link LoggingGate}.
+*
+* Two call sites that never meet need the SAME instance: `LogManager` reads it
+* on every emitted line, and the `system` cap provider — which `trpc.router.ts`
+* rebuilds PER REQUEST — refreshes it whenever the document is written. A gate
+* built inside that per-request factory would be refreshed and collected,
+* which is the shape of a knob that never does anything.
+*
+* Same idiom as `http-request-census.singleton.ts`.
+*/
+var instance = null;
+/** The process-wide logging gate. Created unrestricted on first use. */
+function getLoggingGate() {
+	instance ??= new LoggingGate();
+	return instance;
+}
+/** Test-only: drop the instance so a spec starts from an unrestricted gate. */
+function __resetLoggingGateForTests() {
+	instance = null;
+}
+//#endregion
 //#region src/logging/partitioned-log-buffer.ts
 /** Bucket key for entries that carry no resolvable `addonId` tag. */
 var NO_ADDON_KEY = "";
@@ -1036,6 +1139,16 @@ var LogManager = class {
 	*/
 	bootstrapConsole = null;
 	/**
+	* The node-wide level floor, mirrored from the logging settings document.
+	*
+	* Consulted on EVERY emitted line, so it is a boolean field read and nothing
+	* else while nothing is configured — see {@link LoggingGate}. It gates the
+	* DESTINATIONS only: the ring buffer keeps the line either way, because a
+	* floor that also blinded the log viewer would make raising the level to
+	* quieten a disk cost the operator the one window they read incidents from.
+	*/
+	gate = getLoggingGate();
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -1070,7 +1183,7 @@ var LogManager = class {
 		return new ScopedLogger(scope, (entry) => {
 			const enriched = this.enrichDeviceName(entry);
 			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
-			for (const entry of this.destinations) {
+			if (this.gate.allowsDestination(enriched)) for (const entry of this.destinations) {
 				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
 				entry.dest.write(enriched);
 			}
@@ -1135,6 +1248,13 @@ var LogManager = class {
 	reconfigureBuffer(options) {
 		this.ringBuffer.reconfigure(options);
 	}
+	/**
+	* Swap the node-wide level gate. Production uses the process singleton;
+	* a spec passes its own so two suites cannot arm each other's floor.
+	*/
+	setLoggingGate(gate) {
+		this.gate = gate;
+	}
 	/** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
 	setDestinationEnabledCheck(check) {
 		this.isDestinationEnabled = check ?? void 0;
@@ -93315,13 +93435,23 @@ function createCoreCapService(options) {
 	const actions = {};
 	for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
 		const raw = require_manifest_python_deps.deserializeTypedArrays(ctx.params);
-		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw);
+		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
 	} };
 	return {
 		name: options.serviceName ?? "$core-caps",
 		actions
 	};
 }
+/** Structural read of the calling node/action. Anything unrecognised is `null`. */
+function readOrigin(ctx) {
+	return {
+		nodeId: asName(ctx.nodeID),
+		caller: asName(ctx.caller)
+	};
+}
+function asName(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
 //#endregion
 //#region src/kernel/moleculer/hub-log-forwarder.ts
 /**
@@ -95154,6 +95284,7 @@ exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlo
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
+exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -95193,6 +95324,7 @@ exports.LocalChildClient = require_manifest_python_deps.LocalChildClient;
 exports.LocalChildRegistry = require_manifest_python_deps.LocalChildRegistry;
 exports.LogManager = LogManager;
 exports.LogRingBuffer = LogRingBuffer;
+exports.LoggingGate = LoggingGate;
 exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
 exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
 exports.MAX_LEAF_VALIDITY_DAYS = require_tls$1.MAX_LEAF_VALIDITY_DAYS;
@@ -95243,6 +95375,7 @@ exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
 exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
 exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
 exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
+exports.__resetLoggingGateForTests = __resetLoggingGateForTests;
 exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
 exports.addonSettingsCapability = require_dist.addonSettingsCapability;
 exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
@@ -95364,6 +95497,7 @@ Object.defineProperty(exports, "getFfmpegDownloadUrl", {
 		return _camstack_types_node.getFfmpegDownloadUrl;
 	}
 });
+exports.getLoggingGate = getLoggingGate;
 exports.getModelFilePath = require_file_data_plane.getModelFilePath;
 exports.getMoleculerEventStats = require_manifest_python_deps.getMoleculerEventStats;
 exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asJsonObject$1, B as extractNestedAddonId, Bt as parseJsonObject, Ct as DEVICE_STATUS_METHOD, Dt as ReadinessRegistry, H as isArrayOutputSchema, Ht as readinessKey, It as expandCapMethods, J as lifecycleJobSchema, K as isVoidInput, Kt as EventCategory$1, Mt as asString$1, Nt as createEvent, Ot as ReadinessTimeoutError, Pt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_SETTINGS_CONTRIBUTION_METHODS, U as isCollectionArrayMethod, Ut as resolveCapMount, Vt as parseJsonUnknown$1, W as isObjectInput, Wt as scopeKey, Z as logLevelAtMost, at as resolveMethodAuth, ct as scopesAllowDeviceCap, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asNumber, q as kebabToCamel, st as scopesAllowAddon, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, xt as DATAPLANE_SECRET_HEADER$1, y as addonSettingsCapability, yt as errMsg$1 } from "./dist-XjWZZYr9.mjs";
+import { $ as kebabToCamel, Bt as emitDownForOwnedCaps, C as addonSettingsCapability, Dt as DATAPLANE_SECRET_HEADER$1, G as extractNestedAddonId, Ht as expandCapMethods, It as asJsonObject$1, J as isCollectionArrayMethod, Jt as readinessKey, Kt as parseJsonObject, Lt as asNumber, Nt as ReadinessRegistry, Ot as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Pt as ReadinessTimeoutError, Q as isVoidInput, Qt as EventCategory$1, Rt as asString$1, Tt as errMsg$1, Xt as scopeKey, Y as isObjectInput, Yt as resolveCapMount, dt as resolveMethodAuth, et as lifecycleJobSchema, f as LOG_LEVEL_RANK, it as looseSchema, kt as DEVICE_STATUS_METHOD, m as RUNTIME_DEFAULTS, mt as scopesAllowDeviceCap, p as METHOD_ACCESS_MAP, pt as scopesAllowAddon, q as isArrayOutputSchema, qt as parseJsonUnknown$1, rt as logLevelAtMost, st as objectInputDeclaresAddonId, t as ALL_CAPABILITY_DEFINITIONS, ut as procedureAuthKey, zt as createEvent } from "./dist-6rM7chzb.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as createV8Reclaimer, B as AGENT_CAP_FWD_SERVICE, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, Mt as startHeapWatch, N as udsChildLogToWorkerEntry, Nt as startRunnerHeapWatch, O as HUB_CAP_FWD_SERVICE, Ot as RUNNER_HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as strandedMb, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as shouldReclaim, k as createHubCapForwardService, kt as buildHeapSample, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-D3zYlMEa.mjs";
+import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as createV8Reclaimer, B as AGENT_CAP_FWD_SERVICE, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, Mt as startHeapWatch, N as udsChildLogToWorkerEntry, Nt as startRunnerHeapWatch, O as HUB_CAP_FWD_SERVICE, Ot as RUNNER_HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as strandedMb, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as shouldReclaim, k as createHubCapForwardService, kt as buildHeapSample, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-BuhBXCg0.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -689,6 +689,109 @@ var LogRingBuffer = class {
 	}
 };
 //#endregion
+//#region src/logging/logging-gate.ts
+/**
+* The in-memory MIRROR of the logging settings document, read on the log path.
+*
+* ## Why a mirror and not the settings store
+*
+* The document (`system.getLoggingSettings` / `setLoggingSettings`) is the
+* durable AUTHORITY. It is a row in `system-settings`, reachable only through
+* an async cap call — and this gate is consulted once per emitted log line. A
+* hot path cannot await a store, so the store is mirrored here and the mirror
+* is refreshed OFF the hot path, on a write and once at boot.
+*
+* ## Cost when nothing is set
+*
+* {@link LoggingGate.restrictsDestinations} is a plain boolean FIELD, and it is
+* the FIRST statement of {@link LoggingGate.allowsDestination} — before the
+* entry is touched at all. A default hub sets no level, the field stays
+* `false`, and every line costs one boolean read and a return: no rank lookup,
+* no property access, no allocation. `logging-gate.spec.ts` pins this with an
+* entry whose `level` getter THROWS, so moving the guard below a field access
+* fails the spec instead of taxing every line the hub emits.
+*
+* ## A failed read changes nothing (D49)
+*
+* Nothing here reads the store. The only way the mirror moves is an explicit
+* {@link LoggingGate.setDestinationFloor}, and the service that owns the
+* document calls it ONLY with a value it actually read. A store read that
+* fails leaves the mirror exactly as it was: it neither raises a level nor
+* lowers one, and a diagnostic armed before the failure stays armed.
+*
+* ## What the floor governs, and what it deliberately does not
+*
+* The floor gates the fan-out to DESTINATIONS (console, rotated files, Loki,
+* the hub forwarder). It does NOT gate the in-memory ring buffer: the ring
+* keeps everything it has room for and prunes by level only under pressure,
+* which the plan
+* (`docs/design/plans/2026-08-26-logging-per-componente.md`) settles as the
+* better policy — an admission level for the ring would make the log viewer go
+* blind exactly when an operator raises the level to quieten a disk.
+*
+* A destination's own level still applies on top. The two compose as
+* "most restrictive wins", which is a hierarchy and not a second authority:
+* the floor is node-wide, the destination level is that destination's own, and
+* neither can be read as overriding the other.
+*/
+/** What a hub emits when nothing is configured anywhere. */
+var DEFAULT_LOG_LEVEL = "debug";
+var LoggingGate = class {
+	/** The ONLY field an unrestricted log path reads. */
+	restricted = false;
+	floorRank = LOG_LEVEL_RANK[DEFAULT_LOG_LEVEL];
+	floor = DEFAULT_LOG_LEVEL;
+	/** The effective node-wide level currently mirrored. */
+	get destinationFloor() {
+		return this.floor;
+	}
+	/** True only when the mirrored level is stricter than the default. */
+	get restrictsDestinations() {
+		return this.restricted;
+	}
+	/**
+	* May this entry be fanned out to the log destinations?
+	*
+	* The boolean field is read FIRST. Do not move it below anything.
+	*/
+	allowsDestination(entry) {
+		if (!this.restricted) return true;
+		return LOG_LEVEL_RANK[entry.level] >= this.floorRank;
+	}
+	/**
+	* Refresh the mirror. Called off the hot path — on an operator write and
+	* once at boot — and never with a value that was not actually read.
+	*/
+	setDestinationFloor(level) {
+		this.floor = level;
+		this.floorRank = LOG_LEVEL_RANK[level];
+		this.restricted = this.floorRank > LOG_LEVEL_RANK[DEFAULT_LOG_LEVEL];
+	}
+};
+//#endregion
+//#region src/logging/logging-gate.singleton.ts
+/**
+* Process-wide holder for the {@link LoggingGate}.
+*
+* Two call sites that never meet need the SAME instance: `LogManager` reads it
+* on every emitted line, and the `system` cap provider — which `trpc.router.ts`
+* rebuilds PER REQUEST — refreshes it whenever the document is written. A gate
+* built inside that per-request factory would be refreshed and collected,
+* which is the shape of a knob that never does anything.
+*
+* Same idiom as `http-request-census.singleton.ts`.
+*/
+var instance = null;
+/** The process-wide logging gate. Created unrestricted on first use. */
+function getLoggingGate() {
+	instance ??= new LoggingGate();
+	return instance;
+}
+/** Test-only: drop the instance so a spec starts from an unrestricted gate. */
+function __resetLoggingGateForTests() {
+	instance = null;
+}
+//#endregion
 //#region src/logging/partitioned-log-buffer.ts
 /** Bucket key for entries that carry no resolvable `addonId` tag. */
 var NO_ADDON_KEY = "";
@@ -1029,6 +1132,16 @@ var LogManager = class {
 	*/
 	bootstrapConsole = null;
 	/**
+	* The node-wide level floor, mirrored from the logging settings document.
+	*
+	* Consulted on EVERY emitted line, so it is a boolean field read and nothing
+	* else while nothing is configured — see {@link LoggingGate}. It gates the
+	* DESTINATIONS only: the ring buffer keeps the line either way, because a
+	* floor that also blinded the log viewer would make raising the level to
+	* quieten a disk cost the operator the one window they read incidents from.
+	*/
+	gate = getLoggingGate();
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -1063,7 +1176,7 @@ var LogManager = class {
 		return new ScopedLogger(scope, (entry) => {
 			const enriched = this.enrichDeviceName(entry);
 			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
-			for (const entry of this.destinations) {
+			if (this.gate.allowsDestination(enriched)) for (const entry of this.destinations) {
 				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
 				entry.dest.write(enriched);
 			}
@@ -1128,6 +1241,13 @@ var LogManager = class {
 	reconfigureBuffer(options) {
 		this.ringBuffer.reconfigure(options);
 	}
+	/**
+	* Swap the node-wide level gate. Production uses the process singleton;
+	* a spec passes its own so two suites cannot arm each other's floor.
+	*/
+	setLoggingGate(gate) {
+		this.gate = gate;
+	}
 	/** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
 	setDestinationEnabledCheck(check) {
 		this.isDestinationEnabled = check ?? void 0;
@@ -93308,13 +93428,23 @@ function createCoreCapService(options) {
 	const actions = {};
 	for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
 		const raw = deserializeTypedArrays(ctx.params);
-		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw);
+		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
 	} };
 	return {
 		name: options.serviceName ?? "$core-caps",
 		actions
 	};
 }
+/** Structural read of the calling node/action. Anything unrecognised is `null`. */
+function readOrigin(ctx) {
+	return {
+		nodeId: asName(ctx.nodeID),
+		caller: asName(ctx.caller)
+	};
+}
+function asName(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
 //#endregion
 //#region src/kernel/moleculer/hub-log-forwarder.ts
 /**
@@ -95113,4 +95243,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -37,7 +37,7 @@ export type { BrokerConfig } from './moleculer/broker-factory.js';
 export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-deploy-source.js';
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';
-export type { CoreCapAction, CoreCapServiceOptions } from './moleculer/core-cap-service.js';
+export type { CoreCapAction, CoreCapCallOrigin, CoreCapServiceOptions, } from './moleculer/core-cap-service.js';
 export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, clusterEventTopic, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
 export type { MoleculerEventStats } from './moleculer/addon-context-factory.js';
 export { HubLogForwarder } from './moleculer/hub-log-forwarder.js';

package/dist/kernel/moleculer/core-cap-service.d.ts

@@ -1,4 +1,13 @@
 import { ServiceSchema } from 'moleculer';
+/**
+ * Who issued a `$core-caps` action. Both fields are `null` when Moleculer did
+ * not carry the information — never blank, so an absent origin reads as absent
+ * rather than as a formatting defect.
+ */
+export interface CoreCapCallOrigin {
+    readonly nodeId: string | null;
+    readonly caller: string | null;
+}
 /**
  * Default Moleculer service name for the hub core-capability bridge.
  *
@@ -22,8 +31,14 @@ export declare const CORE_CAP_SERVICE_NAME = "$core-caps";
 export interface CoreCapAction {
     /** Kebab-cased `<capName>.<method>` — e.g. `system.info`, `addon-settings-raw.getGlobal`. */
     readonly actionName: string;
-    /** Invoke the underlying tRPC procedure with a trusted mesh context. */
-    readonly invoke: (input: unknown) => Promise<unknown> | unknown;
+    /**
+     * Invoke the underlying tRPC procedure with a trusted mesh context.
+     *
+     * `origin` is diagnostics only — the transport census uses it to name the
+     * caller of an in-process call, which has no request and therefore no other
+     * identity. No implementation may gate on it.
+     */
+    readonly invoke: (input: unknown, origin: CoreCapCallOrigin) => Promise<unknown> | unknown;
 }
 export interface CoreCapServiceOptions {
     /** Moleculer service name. Defaults to {@link CORE_CAP_SERVICE_NAME}. */

package/dist/logging/log-manager.d.ts

@@ -1,4 +1,5 @@
 import { LogEntry, LogFilter, LogLevel } from './log-ring-buffer.js';
+import { LoggingGate } from './logging-gate.js';
 import { PartitionedLogBufferOptions } from './partitioned-log-buffer.js';
 import { IScopedLogger } from './scoped-logger.js';
 export interface ILogDestination {
@@ -50,6 +51,16 @@ export declare class LogManager {
      * replay suppressed — when {@link STDOUT_DESTINATION_ADDON_ID} registers.
      */
     private bootstrapConsole;
+    /**
+     * The node-wide level floor, mirrored from the logging settings document.
+     *
+     * Consulted on EVERY emitted line, so it is a boolean field read and nothing
+     * else while nothing is configured — see {@link LoggingGate}. It gates the
+     * DESTINATIONS only: the ring buffer keeps the line either way, because a
+     * floor that also blinded the log viewer would make raising the level to
+     * quieten a disk cost the operator the one window they read incidents from.
+     */
+    private gate;
     /**
      * `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
      * evicts only its own lines, so quiet addons keep their sparse history.
@@ -94,6 +105,11 @@ export declare class LogManager {
         readonly maxTotalEntries?: number | null;
         readonly pruneLevel?: LogLevel;
     }): void;
+    /**
+     * Swap the node-wide level gate. Production uses the process singleton;
+     * a spec passes its own so two suites cannot arm each other's floor.
+     */
+    setLoggingGate(gate: LoggingGate): void;
     /** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
     setDestinationEnabledCheck(check: ((addonId: string) => boolean) | null): void;
     /**

package/dist/logging/logging-gate.d.ts

@@ -0,0 +1,32 @@
+import { LogLevel } from '@camstack/types';
+/** What a hub emits when nothing is configured anywhere. */
+export declare const DEFAULT_LOG_LEVEL: LogLevel;
+/**
+ * The only thing the gate needs off an entry — and it must not read it while
+ * the gate is unrestricted. Deliberately structural so the spec can hand in an
+ * object whose getter throws.
+ */
+export interface LevelBearing {
+    readonly level: LogLevel;
+}
+export declare class LoggingGate {
+    /** The ONLY field an unrestricted log path reads. */
+    private restricted;
+    private floorRank;
+    private floor;
+    /** The effective node-wide level currently mirrored. */
+    get destinationFloor(): LogLevel;
+    /** True only when the mirrored level is stricter than the default. */
+    get restrictsDestinations(): boolean;
+    /**
+     * May this entry be fanned out to the log destinations?
+     *
+     * The boolean field is read FIRST. Do not move it below anything.
+     */
+    allowsDestination(entry: LevelBearing): boolean;
+    /**
+     * Refresh the mirror. Called off the hot path — on an operator write and
+     * once at boot — and never with a value that was not actually read.
+     */
+    setDestinationFloor(level: LogLevel): void;
+}

package/dist/logging/logging-gate.singleton.d.ts

@@ -0,0 +1,5 @@
+import { LoggingGate } from './logging-gate.js';
+/** The process-wide logging gate. Created unrestricted on first use. */
+export declare function getLoggingGate(): LoggingGate;
+/** Test-only: drop the instance so a spec starts from an unrestricted gate. */
+export declare function __resetLoggingGateForTests(): void;

package/dist/{manifest-python-deps-DBQarwp9.js → manifest-python-deps-B_mCU6gz.js}

@@ -7893,11 +7893,34 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 	};
 	/**
 	* Soft read for CONSUMERS: a failure reads as empty so a boot path degrades
-	* to defaults instead of throwing. Safe here precisely because the result is
-	* never written back — {@link readBlobResult} is what the write paths use.
+	* to defaults instead of throwing. The degradation is never SILENT — a
+	* consumer that got `{}` because the store did not answer looks identical to
+	* one whose store is genuinely empty, and downstream that difference decides
+	* whether an addon runs on the operator's configuration or on its
+	* constructor defaults.
+	*
+	* "Safe because the result is never written back" is what this docblock used
+	* to claim, and it was a leftover that read as verification.
+	* `BaseAddon.resolveConfig` reads THIS function through
+	* `ctx.settings.readAddonStore()`; the defaults it falls back to then become
+	* the values the addon's next `updateGlobalSettings` patch carries into the
+	* store. That is how the Home Assistant export lost its membership on
+	* 2026-08-24 — see `brokerRefreshPatch` in the ha-export addon for the other
+	* half of that story. The line below is the only warning that this window is
+	* open at all.
 	*/
 	const readBlob = async (coll, key, namespace) => {
 		const r = await readBlobResult(coll, key, namespace);
+		if (r.kind === "failed") {
+			scopedLogger.error(`settings read FAILED (${coll}/${key}) — answering empty, this caller now sees DEFAULTS`, { meta: {
+				addonId,
+				collection: coll,
+				key,
+				namespace,
+				error: r.error
+			} });
+			return {};
+		}
 		return r.kind === "value" ? r.value : {};
 	};
 	/** Read-modify-write that REFUSES to write when the read failed. */

package/dist/{manifest-python-deps-D3zYlMEa.mjs → manifest-python-deps-BuhBXCg0.mjs}

@@ -7889,11 +7889,34 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 	};
 	/**
 	* Soft read for CONSUMERS: a failure reads as empty so a boot path degrades
-	* to defaults instead of throwing. Safe here precisely because the result is
-	* never written back — {@link readBlobResult} is what the write paths use.
+	* to defaults instead of throwing. The degradation is never SILENT — a
+	* consumer that got `{}` because the store did not answer looks identical to
+	* one whose store is genuinely empty, and downstream that difference decides
+	* whether an addon runs on the operator's configuration or on its
+	* constructor defaults.
+	*
+	* "Safe because the result is never written back" is what this docblock used
+	* to claim, and it was a leftover that read as verification.
+	* `BaseAddon.resolveConfig` reads THIS function through
+	* `ctx.settings.readAddonStore()`; the defaults it falls back to then become
+	* the values the addon's next `updateGlobalSettings` patch carries into the
+	* store. That is how the Home Assistant export lost its membership on
+	* 2026-08-24 — see `brokerRefreshPatch` in the ha-export addon for the other
+	* half of that story. The line below is the only warning that this window is
+	* open at all.
 	*/
 	const readBlob = async (coll, key, namespace) => {
 		const r = await readBlobResult(coll, key, namespace);
+		if (r.kind === "failed") {
+			scopedLogger.error(`settings read FAILED (${coll}/${key}) — answering empty, this caller now sees DEFAULTS`, { meta: {
+				addonId,
+				collection: coll,
+				key,
+				namespace,
+				error: r.error
+			} });
+			return {};
+		}
 		return r.kind === "value" ? r.value : {};
 	};
 	/** Read-modify-write that REFUSES to write when the read failed. */