@camstack/system 1.2.275 → 1.2.276

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CYXhwfDf.js");
+const require_dist = require("./dist-D_OlSf31.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -5892,8 +5892,23 @@ var CapabilityRegistry = class CapabilityRegistry {
 	singletonNodeOverrides = /* @__PURE__ */ new Map();
 	/** Optional reader for persisted per-node overrides: (cap, nodeId) → addonId. */
 	nodeConfigReader = null;
-	/** Per-device collection filters: deviceId → (capability → addonIds[]) */
-	deviceCollectionFilters = /* @__PURE__ */ new Map();
+	/**
+	* Per-device SOURCE deactivations: deviceId → (capability → disabled addon ids).
+	*
+	* The in-memory PROJECTION of the persisted wrapper activation
+	* (`deviceBindings[deviceId][capName].disabledSourceAddonIds`, written by
+	* `setWrapperActive`), and never an authority of its own —
+	* [D556](../../../../docs/decisions/adr-0556-a-per-device-source-switch-is-the-wrapper-activation-and-the-registry-holds-only-its-projection.md).
+	* Nothing but `device-source-activation.ts` writes it: the operator's verb
+	* is `deviceManager.setWrapperActive`, and a second writable surface here is
+	* exactly the two-authorities defect D62 exists for.
+	*
+	* A DENY list, not an allow list, and that is the deliberate answer to what
+	* "unset" means: a source nobody has ruled out is a source. An untouched
+	* camera keeps every provider it has today, and a provider that registers
+	* after the operator's last toggle needs no second write to be seen.
+	*/
+	deviceDisabledSources = /* @__PURE__ */ new Map();
 	/** autoActivate flags per (capability, addonId) — from addon manifests */
 	autoActivateFlags = /* @__PURE__ */ new Map();
 	/**
@@ -6789,54 +6804,73 @@ var CapabilityRegistry = class CapabilityRegistry {
 		for (const [addonId, provider] of state.providers) if (this.isActiveForSystem(capability, addonId)) return asProvider(provider);
 		return null;
 	}
-	/** Set a per-device collection filter. */
-	setDeviceCollectionFilter(deviceId, capability, addonIds) {
-		if (!this.capabilities.get(capability)) {
-			this.logger.warn("Cannot set device collection filter for undeclared capability", { meta: { capability } });
+	/**
+	* Mirror ONE device's persisted source deactivations for `capability` into
+	* the projection (D556). The authority is the device-manager's
+	* `deviceBindings` store; this is the read side of that write and the only
+	* way the set changes.
+	*
+	* No check that `capability` is declared, and none that the addons are
+	* registered: a persisted operator decision is a fact about the fleet, not a
+	* reference to a live object, and replaying it at boot must not depend on
+	* which addon happened to register first. An empty list drops the entry
+	* (unset = every source).
+	*/
+	setDeviceDisabledSources(deviceId, capability, addonIds) {
+		let deviceMap = this.deviceDisabledSources.get(deviceId);
+		if (addonIds.length === 0) {
+			if (!deviceMap) return;
+			deviceMap.delete(capability);
+			if (deviceMap.size === 0) this.deviceDisabledSources.delete(deviceId);
+			this.logger.debug("Device source deactivations cleared", {
+				tags: { deviceId: Number(deviceId) },
+				meta: { capability }
+			});
 			return;
 		}
-		let deviceMap = this.deviceCollectionFilters.get(deviceId);
 		if (!deviceMap) {
 			deviceMap = /* @__PURE__ */ new Map();
-			this.deviceCollectionFilters.set(deviceId, deviceMap);
+			this.deviceDisabledSources.set(deviceId, deviceMap);
 		}
-		deviceMap.set(capability, [...addonIds]);
-		this.logger.info("Device collection filter set", {
+		deviceMap.set(capability, new Set(addonIds));
+		this.logger.debug("Device source deactivations mirrored", {
 			tags: { deviceId: Number(deviceId) },
 			meta: {
 				capability,
-				addonIds
+				disabledAddonIds: [...addonIds]
 			}
 		});
 	}
-	/** Clear a per-device collection filter. */
-	clearDeviceCollectionFilter(deviceId, capability) {
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (!deviceMap) return;
-		deviceMap.delete(capability);
-		if (deviceMap.size === 0) this.deviceCollectionFilters.delete(deviceId);
-		this.logger.info("Device collection filter cleared", {
-			tags: { deviceId: Number(deviceId) },
-			meta: { capability }
-		});
+	/**
+	* The addon ids the operator switched OFF as sources of this device for
+	* `capability`. Empty means every source — never "none".
+	*/
+	getDeviceDisabledSources(deviceId, capability) {
+		const disabled = this.deviceDisabledSources.get(deviceId)?.get(capability);
+		return disabled === void 0 ? [] : [...disabled];
+	}
+	/** Is `addonId` switched off as a source of this device for `capability`? */
+	isDeviceSourceDisabled(deviceId, capability, addonId) {
+		return this.deviceDisabledSources.get(deviceId)?.get(capability)?.has(addonId) === true;
 	}
 	/**
 	* Resolve collection providers for a specific device.
-	* Filters by activation (the manifest's autoActivate) and optional collection filter.
-	*/
-	resolveCollectionForDevice(capability, deviceId) {
+	* Filters by activation (the manifest's autoActivate) and by the per-device
+	* source deactivations the operator persisted (D556).
+	*
+	* `includeSwitchedOff` keeps the providers the operator switched off for this
+	* device. It exists for ONE caller — the source LISTING path — because a
+	* switched-off source must still produce a row to be switched back on from
+	* (D554 decision 4, D556 as amended), and only its own provider can name it.
+	* Every other path takes the default and sees the SERVING set: the sources
+	* that may actually contribute.
+	*/
+	resolveCollectionForDevice(capability, deviceId, options) {
 		const state = this.capabilities.get(capability);
 		if (!state || state.definition.mode !== "collection") return [];
-		let entries = [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId));
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (deviceMap) {
-			const filterAddonIds = deviceMap.get(capability);
-			if (filterAddonIds) {
-				const filterSet = new Set(filterAddonIds);
-				entries = entries.filter(([addonId]) => filterSet.has(addonId));
-			}
-		}
-		return entries.map(([, provider]) => asProvider(provider));
+		const disabledForDevice = this.deviceDisabledSources.get(deviceId)?.get(capability);
+		const keepSwitchedOff = options?.includeSwitchedOff === true;
+		return [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId)).filter(([addonId]) => keepSwitchedOff || disabledForDevice?.has(addonId) !== true).map(([, provider]) => asProvider(provider));
 	}
 	/** Check if all dependencies for a capability are satisfied. */
 	areDependenciesMet(capabilityName) {
@@ -7000,6 +7034,35 @@ var CapabilityRegistry = class CapabilityRegistry {
 function systemMountKindFor(def) {
 	return def.mode === "collection" ? "collection" : "singleton";
 }
+/**
+* The mount kind ONE method resolves through — the cap's mount, except where
+* the method cannot be dispatched per device.
+*
+* Two ways a method leaves a per-device mount for the cap's SYSTEM provider:
+*
+*  - `systemOnly: true` — declared via the `systemMethod()` factory. The
+*    author said so; it wins everywhere, including on a `device-native` cap
+*    (`snapshot.getSnapshotOverview`).
+*  - a `device-scoped` cap's method whose input declares no top-level REQUIRED
+*    numeric `deviceId`. The per-device dispatcher demands one on every call
+*    (`requireDeviceScoped`), so such a method would answer BAD_REQUEST
+*    "input must carry numeric deviceId" for every caller — unreachable. It
+*    names no device, so there is no per-device provider to resolve: the cap's
+*    hub-resident system/wrapper provider is the only honest destination, and
+*    it is where that method already resolved before the mount was fixed.
+*
+* NOT applied to `device-native`, deliberately: there the native IS the device
+* and a deviceId-less method is a definition error the author must resolve
+* with `systemMethod()` — which is what `snapshot` does. This rule exists for
+* the mount kind that was DERIVED under caps that never opted in, where a
+* silent 400 would be a regression introduced by the derivation itself.
+*/
+function methodMountKindFor(def, mountKind, method) {
+	if (method.schema.systemOnly === true) return systemMountKindFor(def);
+	if (mountKind !== "device-scoped") return mountKind;
+	if (require_dist.objectInputDeclaresRequiredDeviceId(method.schema.input)) return mountKind;
+	return systemMountKindFor(def);
+}
 function methodsFor(def) {
 	const effective = require_dist.expandCapMethods(def);
 	return Object.entries(effective).map(([name, schema]) => {
@@ -7126,12 +7189,11 @@ function requireLocal(capName, getLocal, services) {
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
 	const mount = require_dist.resolveCapMount(def);
-	const systemMountKind = systemMountKindFor(def);
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
 		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
-		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
+		const effectiveMountKind = methodMountKindFor(def, mount.kind, method);
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
 		const base = primitives.procedures[require_dist.procedureAuthKey(method.auth)];
@@ -96177,12 +96239,14 @@ exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_event_loop_stall_monitor.isModelDownloaded;
+exports.isSourceDenied = require_builtins_device_manager_device_manager_addon.isSourceDenied;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
 exports.loadTlsCert = require_tls$1.loadTlsCert;
 exports.localEndpointPath = require_manifest_system_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_system_deps.localProviderLink;
 exports.mountNativeCapService = require_manifest_system_deps.mountNativeCapService;
+exports.nextDisabledSources = require_builtins_device_manager_device_manager_addon.nextDisabledSources;
 exports.nextRssBudgetState = require_manifest_system_deps.nextRssBudgetState;
 exports.parseCapAction = require_manifest_system_deps.parseCapAction;
 exports.parseRangeHeader = require_event_loop_stall_monitor.parseRangeHeader;
@@ -96208,6 +96272,7 @@ exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
 exports.resolveFilePath = require_event_loop_stall_monitor.resolveFilePath;
 exports.resolveHwAccel = require_manifest_system_deps.resolveHwAccel;
 exports.resolveNpmInvocation = require_manifest_system_deps.resolveNpmInvocation;
+exports.restoreDeviceSourceActivations = require_builtins_device_manager_device_manager_addon.restoreDeviceSourceActivations;
 exports.runHubAddonBoot = runHubAddonBoot;
 exports.runNpm = require_manifest_system_deps.runNpm;
 exports.sampleSocketDirection = require_manifest_system_deps.sampleSocketDirection;
@@ -96220,6 +96285,7 @@ exports.selectReportedSpaces = require_manifest_system_deps.selectReportedSpaces
 exports.serializeTypedArrays = require_manifest_system_deps.serializeTypedArrays;
 exports.setHubConnected = require_manifest_system_deps.setHubConnected;
 exports.setNodeEventInterest = require_manifest_system_deps.setNodeEventInterest;
+exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_manifest_system_deps.shouldReclaim;
 exports.socketDirectionBytes = require_manifest_system_deps.socketDirectionBytes;
 exports.socketDirectionMessages = require_manifest_system_deps.socketDirectionMessages;

package/dist/index.mjs

@@ -1,12 +1,12 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { An as readinessKey, Cn as expandCapMethods, F as addonSettingsCapability, Ft as procedureAuthKey, Mn as scopeKey, Mt as objectInputDeclaresAddonId, On as parseJsonObject, Pn as EventCategory$1, S as RUNTIME_DEFAULTS, Tt as looseSchema, Ut as scopesAllowAddon, Vt as resolveMethodAuth, Wt as scopesAllowDeviceCap, _n as asJsonObject$1, _t as isVoidInput, an as errMsg$1, bn as createEvent, bt as lifecycleJobSchema, cn as DATAPLANE_SECRET_HEADER$1, dt as isArrayOutputSchema, ft as isCollectionArrayMethod, g as LOG_LEVEL_RANK, hn as ReadinessTimeoutError, jn as resolveCapMount, kn as parseJsonUnknown, ln as DEVICE_SETTINGS_CONTRIBUTION_METHODS, mn as ReadinessRegistry, mt as isObjectInput, st as extractNestedAddonId, t as ALL_CAPABILITY_DEFINITIONS, un as DEVICE_STATUS_METHOD, vn as asNumber, vt as kebabToCamel, wt as logLevelAtMost, xn as emitDownForOwnedCaps, y as METHOD_ACCESS_MAP, yn as asString$1 } from "./dist-DWSJVcZe.mjs";
+import { An as parseJsonUnknown, F as addonSettingsCapability, Fn as EventCategory$1, Gt as scopesAllowDeviceCap, Ht as resolveMethodAuth, It as procedureAuthKey, Mn as resolveCapMount, Mt as objectInputDeclaresAddonId, Nn as scopeKey, Nt as objectInputDeclaresRequiredDeviceId, S as RUNTIME_DEFAULTS, Sn as emitDownForOwnedCaps, Tt as looseSchema, Wt as scopesAllowAddon, _t as isVoidInput, bn as asString$1, bt as lifecycleJobSchema, dn as DEVICE_STATUS_METHOD, dt as isArrayOutputSchema, ft as isCollectionArrayMethod, g as LOG_LEVEL_RANK, gn as ReadinessTimeoutError, hn as ReadinessRegistry, jn as readinessKey, kn as parseJsonObject, ln as DATAPLANE_SECRET_HEADER$1, mt as isObjectInput, on as errMsg$1, st as extractNestedAddonId, t as ALL_CAPABILITY_DEFINITIONS, un as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vn as asJsonObject$1, vt as kebabToCamel, wn as expandCapMethods, wt as logLevelAtMost, xn as createEvent, y as METHOD_ACCESS_MAP, yn as asNumber } from "./dist-AHdiIdJH.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
 import { ConsoleDestination, ConsoleLoggingAddon } from "./builtins/console-logging/index.mjs";
 import { CoreBlocksAddon } from "./builtins/core-blocks/core-blocks.addon.mjs";
 import "./builtins/core-blocks/index.mjs";
-import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
+import { DeviceManagerAddon, i as setWrapperActive, n as nextDisabledSources, r as restoreDeviceSourceActivations, t as isSourceDenied } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
@@ -5885,8 +5885,23 @@ var CapabilityRegistry = class CapabilityRegistry {
 	singletonNodeOverrides = /* @__PURE__ */ new Map();
 	/** Optional reader for persisted per-node overrides: (cap, nodeId) → addonId. */
 	nodeConfigReader = null;
-	/** Per-device collection filters: deviceId → (capability → addonIds[]) */
-	deviceCollectionFilters = /* @__PURE__ */ new Map();
+	/**
+	* Per-device SOURCE deactivations: deviceId → (capability → disabled addon ids).
+	*
+	* The in-memory PROJECTION of the persisted wrapper activation
+	* (`deviceBindings[deviceId][capName].disabledSourceAddonIds`, written by
+	* `setWrapperActive`), and never an authority of its own —
+	* [D556](../../../../docs/decisions/adr-0556-a-per-device-source-switch-is-the-wrapper-activation-and-the-registry-holds-only-its-projection.md).
+	* Nothing but `device-source-activation.ts` writes it: the operator's verb
+	* is `deviceManager.setWrapperActive`, and a second writable surface here is
+	* exactly the two-authorities defect D62 exists for.
+	*
+	* A DENY list, not an allow list, and that is the deliberate answer to what
+	* "unset" means: a source nobody has ruled out is a source. An untouched
+	* camera keeps every provider it has today, and a provider that registers
+	* after the operator's last toggle needs no second write to be seen.
+	*/
+	deviceDisabledSources = /* @__PURE__ */ new Map();
 	/** autoActivate flags per (capability, addonId) — from addon manifests */
 	autoActivateFlags = /* @__PURE__ */ new Map();
 	/**
@@ -6782,54 +6797,73 @@ var CapabilityRegistry = class CapabilityRegistry {
 		for (const [addonId, provider] of state.providers) if (this.isActiveForSystem(capability, addonId)) return asProvider(provider);
 		return null;
 	}
-	/** Set a per-device collection filter. */
-	setDeviceCollectionFilter(deviceId, capability, addonIds) {
-		if (!this.capabilities.get(capability)) {
-			this.logger.warn("Cannot set device collection filter for undeclared capability", { meta: { capability } });
+	/**
+	* Mirror ONE device's persisted source deactivations for `capability` into
+	* the projection (D556). The authority is the device-manager's
+	* `deviceBindings` store; this is the read side of that write and the only
+	* way the set changes.
+	*
+	* No check that `capability` is declared, and none that the addons are
+	* registered: a persisted operator decision is a fact about the fleet, not a
+	* reference to a live object, and replaying it at boot must not depend on
+	* which addon happened to register first. An empty list drops the entry
+	* (unset = every source).
+	*/
+	setDeviceDisabledSources(deviceId, capability, addonIds) {
+		let deviceMap = this.deviceDisabledSources.get(deviceId);
+		if (addonIds.length === 0) {
+			if (!deviceMap) return;
+			deviceMap.delete(capability);
+			if (deviceMap.size === 0) this.deviceDisabledSources.delete(deviceId);
+			this.logger.debug("Device source deactivations cleared", {
+				tags: { deviceId: Number(deviceId) },
+				meta: { capability }
+			});
 			return;
 		}
-		let deviceMap = this.deviceCollectionFilters.get(deviceId);
 		if (!deviceMap) {
 			deviceMap = /* @__PURE__ */ new Map();
-			this.deviceCollectionFilters.set(deviceId, deviceMap);
+			this.deviceDisabledSources.set(deviceId, deviceMap);
 		}
-		deviceMap.set(capability, [...addonIds]);
-		this.logger.info("Device collection filter set", {
+		deviceMap.set(capability, new Set(addonIds));
+		this.logger.debug("Device source deactivations mirrored", {
 			tags: { deviceId: Number(deviceId) },
 			meta: {
 				capability,
-				addonIds
+				disabledAddonIds: [...addonIds]
 			}
 		});
 	}
-	/** Clear a per-device collection filter. */
-	clearDeviceCollectionFilter(deviceId, capability) {
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (!deviceMap) return;
-		deviceMap.delete(capability);
-		if (deviceMap.size === 0) this.deviceCollectionFilters.delete(deviceId);
-		this.logger.info("Device collection filter cleared", {
-			tags: { deviceId: Number(deviceId) },
-			meta: { capability }
-		});
+	/**
+	* The addon ids the operator switched OFF as sources of this device for
+	* `capability`. Empty means every source — never "none".
+	*/
+	getDeviceDisabledSources(deviceId, capability) {
+		const disabled = this.deviceDisabledSources.get(deviceId)?.get(capability);
+		return disabled === void 0 ? [] : [...disabled];
+	}
+	/** Is `addonId` switched off as a source of this device for `capability`? */
+	isDeviceSourceDisabled(deviceId, capability, addonId) {
+		return this.deviceDisabledSources.get(deviceId)?.get(capability)?.has(addonId) === true;
 	}
 	/**
 	* Resolve collection providers for a specific device.
-	* Filters by activation (the manifest's autoActivate) and optional collection filter.
-	*/
-	resolveCollectionForDevice(capability, deviceId) {
+	* Filters by activation (the manifest's autoActivate) and by the per-device
+	* source deactivations the operator persisted (D556).
+	*
+	* `includeSwitchedOff` keeps the providers the operator switched off for this
+	* device. It exists for ONE caller — the source LISTING path — because a
+	* switched-off source must still produce a row to be switched back on from
+	* (D554 decision 4, D556 as amended), and only its own provider can name it.
+	* Every other path takes the default and sees the SERVING set: the sources
+	* that may actually contribute.
+	*/
+	resolveCollectionForDevice(capability, deviceId, options) {
 		const state = this.capabilities.get(capability);
 		if (!state || state.definition.mode !== "collection") return [];
-		let entries = [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId));
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (deviceMap) {
-			const filterAddonIds = deviceMap.get(capability);
-			if (filterAddonIds) {
-				const filterSet = new Set(filterAddonIds);
-				entries = entries.filter(([addonId]) => filterSet.has(addonId));
-			}
-		}
-		return entries.map(([, provider]) => asProvider(provider));
+		const disabledForDevice = this.deviceDisabledSources.get(deviceId)?.get(capability);
+		const keepSwitchedOff = options?.includeSwitchedOff === true;
+		return [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId)).filter(([addonId]) => keepSwitchedOff || disabledForDevice?.has(addonId) !== true).map(([, provider]) => asProvider(provider));
 	}
 	/** Check if all dependencies for a capability are satisfied. */
 	areDependenciesMet(capabilityName) {
@@ -6993,6 +7027,35 @@ var CapabilityRegistry = class CapabilityRegistry {
 function systemMountKindFor(def) {
 	return def.mode === "collection" ? "collection" : "singleton";
 }
+/**
+* The mount kind ONE method resolves through — the cap's mount, except where
+* the method cannot be dispatched per device.
+*
+* Two ways a method leaves a per-device mount for the cap's SYSTEM provider:
+*
+*  - `systemOnly: true` — declared via the `systemMethod()` factory. The
+*    author said so; it wins everywhere, including on a `device-native` cap
+*    (`snapshot.getSnapshotOverview`).
+*  - a `device-scoped` cap's method whose input declares no top-level REQUIRED
+*    numeric `deviceId`. The per-device dispatcher demands one on every call
+*    (`requireDeviceScoped`), so such a method would answer BAD_REQUEST
+*    "input must carry numeric deviceId" for every caller — unreachable. It
+*    names no device, so there is no per-device provider to resolve: the cap's
+*    hub-resident system/wrapper provider is the only honest destination, and
+*    it is where that method already resolved before the mount was fixed.
+*
+* NOT applied to `device-native`, deliberately: there the native IS the device
+* and a deviceId-less method is a definition error the author must resolve
+* with `systemMethod()` — which is what `snapshot` does. This rule exists for
+* the mount kind that was DERIVED under caps that never opted in, where a
+* silent 400 would be a regression introduced by the derivation itself.
+*/
+function methodMountKindFor(def, mountKind, method) {
+	if (method.schema.systemOnly === true) return systemMountKindFor(def);
+	if (mountKind !== "device-scoped") return mountKind;
+	if (objectInputDeclaresRequiredDeviceId(method.schema.input)) return mountKind;
+	return systemMountKindFor(def);
+}
 function methodsFor(def) {
 	const effective = expandCapMethods(def);
 	return Object.entries(effective).map(([name, schema]) => {
@@ -7119,12 +7182,11 @@ function requireLocal(capName, getLocal, services) {
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
 	const mount = resolveCapMount(def);
-	const systemMountKind = systemMountKindFor(def);
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
 		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
-		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
+		const effectiveMountKind = methodMountKindFor(def, mount.kind, method);
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
 		const base = primitives.procedures[procedureAuthKey(method.auth)];
@@ -95817,4 +95879,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceDenied, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextDisabledSources, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, restoreDeviceSourceActivations, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/capability-registry.d.ts

@@ -30,6 +30,17 @@ export type CollectionConfigReader = (capability: string) => readonly string[] |
  * cannot present it. See docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md.
  */
 export type ProviderOwnerToken = string;
+/**
+ * How much of a device's COLLECTION a caller is asking for.
+ *
+ * The default — and every caller that intends to USE the providers — is the
+ * serving set: the sources that may contribute. The source LISTING path asks
+ * for the whole set instead, because a source the operator switched off must
+ * still produce a row to be switched back on from (D556 as amended).
+ */
+export interface DeviceCollectionResolution {
+    readonly includeSwitchedOff: boolean;
+}
 export declare class CapabilityRegistry {
     private readonly capabilities;
     private readonly logger;
@@ -59,8 +70,23 @@ export declare class CapabilityRegistry {
     private readonly singletonNodeOverrides;
     /** Optional reader for persisted per-node overrides: (cap, nodeId) → addonId. */
     private nodeConfigReader;
-    /** Per-device collection filters: deviceId → (capability → addonIds[]) */
-    private readonly deviceCollectionFilters;
+    /**
+     * Per-device SOURCE deactivations: deviceId → (capability → disabled addon ids).
+     *
+     * The in-memory PROJECTION of the persisted wrapper activation
+     * (`deviceBindings[deviceId][capName].disabledSourceAddonIds`, written by
+     * `setWrapperActive`), and never an authority of its own —
+     * [D556](../../../../docs/decisions/adr-0556-a-per-device-source-switch-is-the-wrapper-activation-and-the-registry-holds-only-its-projection.md).
+     * Nothing but `device-source-activation.ts` writes it: the operator's verb
+     * is `deviceManager.setWrapperActive`, and a second writable surface here is
+     * exactly the two-authorities defect D62 exists for.
+     *
+     * A DENY list, not an allow list, and that is the deliberate answer to what
+     * "unset" means: a source nobody has ruled out is a source. An untouched
+     * camera keeps every provider it has today, and a provider that registers
+     * after the operator's last toggle needs no second write to be seen.
+     */
+    private readonly deviceDisabledSources;
     /** autoActivate flags per (capability, addonId) — from addon manifests */
     private readonly autoActivateFlags;
     /**
@@ -465,15 +491,39 @@ export declare class CapabilityRegistry {
      * singleton override — the in-memory provider pin, not a persisted flag.
      */
     resolveForDevice<T = unknown>(capability: string, deviceId: string): T | null;
-    /** Set a per-device collection filter. */
-    setDeviceCollectionFilter(deviceId: string, capability: string, addonIds: string[]): void;
-    /** Clear a per-device collection filter. */
-    clearDeviceCollectionFilter(deviceId: string, capability: string): void;
     /**
-     * Resolve collection providers for a specific device.
-     * Filters by activation (the manifest's autoActivate) and optional collection filter.
+     * Mirror ONE device's persisted source deactivations for `capability` into
+     * the projection (D556). The authority is the device-manager's
+     * `deviceBindings` store; this is the read side of that write and the only
+     * way the set changes.
+     *
+     * No check that `capability` is declared, and none that the addons are
+     * registered: a persisted operator decision is a fact about the fleet, not a
+     * reference to a live object, and replaying it at boot must not depend on
+     * which addon happened to register first. An empty list drops the entry
+     * (unset = every source).
+     */
+    setDeviceDisabledSources(deviceId: string, capability: string, addonIds: readonly string[]): void;
+    /**
+     * The addon ids the operator switched OFF as sources of this device for
+     * `capability`. Empty means every source — never "none".
      */
-    resolveCollectionForDevice<T = unknown>(capability: string, deviceId: string): readonly T[];
+    getDeviceDisabledSources(deviceId: string, capability: string): readonly string[];
+    /** Is `addonId` switched off as a source of this device for `capability`? */
+    isDeviceSourceDisabled(deviceId: string, capability: string, addonId: string): boolean;
+    /**
+     * Resolve collection providers for a specific device.
+     * Filters by activation (the manifest's autoActivate) and by the per-device
+     * source deactivations the operator persisted (D556).
+     *
+     * `includeSwitchedOff` keeps the providers the operator switched off for this
+     * device. It exists for ONE caller — the source LISTING path — because a
+     * switched-off source must still produce a row to be switched back on from
+     * (D554 decision 4, D556 as amended), and only its own provider can name it.
+     * Every other path takes the default and sees the SERVING set: the sources
+     * that may actually contribute.
+     */
+    resolveCollectionForDevice<T = unknown>(capability: string, deviceId: string, options?: DeviceCollectionResolution): readonly T[];
     /** Check if all dependencies for a capability are satisfied. */
     areDependenciesMet(capabilityName: string): boolean;
     /** Get topologically sorted boot order based on dependsOn. */

package/dist/kernel/index.d.ts

@@ -13,6 +13,7 @@ export { RESTART_MARKER_FILE, clearPendingRestart, getRestartMarkerPath, readPen
 export type { PendingRestartMarker, RestartKind, ScheduleSelfRestartOptions, } from './restart-coordinator.js';
 export { CapabilityHandle, CapabilityUnavailableError } from './capability-handle.js';
 export { CapabilityRegistry } from './capability-registry.js';
+export type { DeviceCollectionResolution } from './capability-registry.js';
 export { buildCapRouters, builderMountedCapNames } from './cap-router-builder.js';
 export type { CapRouterPrimitives, CapRouterServices, CapProviderGetter, RemoteProxyFactory, ProcedureBuilder, ProcedureResolverArgs, } from './cap-router-builder.js';
 export { describeProviderKindDrift } from './provider-kind-drift.js';

package/dist/{retired-settings-keys-BHGnCLW0.mjs → retired-settings-keys-Cp3oG_aH.mjs}

@@ -1,4 +1,4 @@
-import { _n as asJsonObject } from "./dist-DWSJVcZe.mjs";
+import { vn as asJsonObject } from "./dist-AHdiIdJH.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-DEFtUH8o.js → retired-settings-keys-LwFyTKun.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CYXhwfDf.js");
+const require_dist = require("./dist-D_OlSf31.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.275",
+  "version": "1.2.276",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -392,7 +392,6 @@
     "@camstack/sdk": "*",
     "@camstack/types": "*",
     "@msgpack/msgpack": "^3.1.3",
-    "@peculiar/x509": "^1.14.3",
     "@trpc/client": "^11.16.0",
     "@trpc/server": "^11.16.0",
     "bcryptjs": "^3.0.3",
@@ -416,6 +415,7 @@
   },
   "devDependencies": {
     "@camstack/types": "*",
+    "@peculiar/x509": "^1.14.3",
     "@types/bcryptjs": "^2.4.6",
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",