@camstack/system 1.2.316 → 1.2.317

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-RAl10EfG.js");
+const require_dist = require("./dist-a6p0V-IL.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_composer_composer_addon = require("./builtins/composer/composer.addon.js");
@@ -29,7 +29,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-D_wUeOTD.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-DzcUd_ct.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-C8uts1P4.js");
 const require_resource_monitor = require("./resource-monitor-DzNn_IZK.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -2752,7 +2752,7 @@ async function ensureAddonNativePrebuilds(addonDir, options) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -2850,9 +2850,9 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function toAddonPackageManifest(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	if (!Array.isArray(value.addons)) return void 0;
-	if (!value.addons.every((a) => isRecord$2(a) && typeof a.id === "string")) return void 0;
+	if (!value.addons.every((a) => isRecord$3(a) && typeof a.id === "string")) return void 0;
 	return value;
 }
 /** Minimal no-op logger for default parameter */
@@ -3002,7 +3002,7 @@ var AddonLoader = class {
 		}
 		if (!node_fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$2(modUnknown) ? modUnknown : {};
+		const mod = isRecord$3(modUnknown) ? modUnknown : {};
 		const AddonClass = require_child_cap_dispatch.resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -3018,7 +3018,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$2(modUnknown) ? modUnknown : {};
+		const mod = isRecord$3(modUnknown) ? modUnknown : {};
 		const AddonClass = require_child_cap_dispatch.resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -6315,6 +6315,60 @@ var CapabilityRegistry = class CapabilityRegistry {
 			addonId
 		});
 	}
+	/**
+	* Re-apply the operator's PERSISTED preferences to providers that
+	* registered before those preferences could be read — once, when the boot
+	* read of them settles (D675).
+	*
+	* `registerProvider` consults the preference readers at the moment a
+	* provider registers. With the settings engine isolated (D231) the
+	* preferences arrive over an async door, so a provider can register before
+	* they are known; the readers then answer "no preference" and the default
+	* wins. This replays the answer the readers give NOW over every registered
+	* provider: a singleton whose persisted choice is registered and not active
+	* is switched to it, and a collection provider the operator disabled is
+	* disabled again. It is one pass, triggered by the read settling — not a
+	* wait, a poll or a retry (D3).
+	*
+	* `skip` names the capabilities that must not be switched live (infra caps
+	* need a restart — the same rule `capabilities.setPreference` applies).
+	*/
+	applyPersistedPreferences(skip) {
+		const singletons = [];
+		const disabled = [];
+		for (const [capability, state] of this.capabilities) {
+			if (skip(capability)) continue;
+			if (state.definition.mode === "singleton") {
+				const choice = this.configReader?.(capability);
+				if (choice === void 0 || !state.providers.has(choice)) continue;
+				if (state.activeAddonId === choice) continue;
+				state.activeAddonId = choice;
+				singletons.push({
+					capability,
+					addonId: choice
+				});
+				this.emitEvent("capability:singleton-changed", {
+					capability,
+					addonId: choice
+				});
+			} else if (state.definition.mode === "collection") for (const addonId of this.collectionConfigReader?.(capability) ?? []) {
+				if (!state.providers.has(addonId) || state.disabledProviders.has(addonId)) continue;
+				state.disabledProviders.add(addonId);
+				disabled.push({
+					capability,
+					addonId
+				});
+				this.emitEvent("capability:collection-provider-disabled", {
+					capability,
+					addonId
+				});
+			}
+		}
+		return {
+			singletons,
+			disabled
+		};
+	}
 	/** Enable a previously disabled collection provider. */
 	enableCollectionProvider(capability, addonId) {
 		const state = this.capabilities.get(capability);
@@ -7457,14 +7511,14 @@ async function runHubAddonBoot(steps) {
 }
 //#endregion
 //#region src/kernel/settings-door-view.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asBlob(value) {
-	return isRecord$1(value) ? value : {};
+	return isRecord$2(value) ? value : {};
 }
 function unwrapValue(parsed) {
-	if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
+	if (!isRecord$2(parsed) || !("value" in parsed)) return parsed;
 	return parsed.value;
 }
 /**
@@ -7514,7 +7568,7 @@ var PREFIX_PAGE_BUDGET = 512;
 *   A throw is the point: a caller that cannot be answered completely must not
 *   be handed something that looks like a complete answer.
 */
-async function loadPrefixed(door, collection, prefix) {
+async function loadPrefixed(door, collection, prefix, decode = unwrapValue) {
 	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
 	const result = {};
 	let cursor = range?.lo ?? null;
@@ -7534,7 +7588,7 @@ async function loadPrefixed(door, collection, prefix) {
 		for (const row of rows) {
 			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
 			if (!row.id.startsWith(prefix)) continue;
-			result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+			result[row.id.slice(prefix.length)] = decode(row.data);
 		}
 		if (rows.length < PREFIX_PAGE_ROWS) return result;
 		const last = rows[rows.length - 1];
@@ -7544,6 +7598,32 @@ async function loadPrefixed(door, collection, prefix) {
 		cursor = last.id;
 	}
 }
+/**
+* Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
+*
+* `system-settings` stores the value ITSELF (`setSystem` / `door.set` write
+* `JSON.stringify(value)`), mostly scalars. The engine's `query` hands a KV row
+* back parsed only when its text is an object or an array; a scalar comes back
+* as `{ value: <its JSON text> }` — `"12h"` arrives as `{ value: '"12h"' }`.
+* That is not a value anyone stored, and guessing it back would misread a
+* stored object that happens to be `{ value: … }`. So the range read only
+* ENUMERATES the keys (same keyset walk and refusal as every prefix read
+* here), and each value is taken from `get`, which parses the row exactly
+* (D675). These reads are small and rare: a section's handful of keys when a
+* form opens, and the capability preferences once at boot.
+*/
+async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
+	const listed = await loadPrefixed(door, "system-settings", prefix, () => null);
+	const result = {};
+	for (const suffix of Object.keys(listed).filter(mayRead)) {
+		const value = await door.get({
+			collection: "system-settings",
+			key: `${prefix}${suffix}`
+		});
+		if (value !== void 0) result[suffix] = value;
+	}
+	return result;
+}
 async function replacePrefixed(door, collection, prefix, values, wrap) {
 	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
 	if (range !== null) await door.deleteWhere({
@@ -7565,6 +7645,24 @@ function createDoorSettingsView(addonId, door, sections) {
 		async readAddonStore() {
 			return loadPrefixed(door, "addon-settings", addonPrefix);
 		},
+		async readAddonStoreKeyResult(key) {
+			try {
+				const row = await door.get({
+					collection: "addon-settings",
+					key: `${addonPrefix}${key}`
+				});
+				return row === void 0 ? { kind: "absent" } : {
+					kind: "present",
+					value: unwrapValue(row)
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					reason: "store-read-failed",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+		},
 		async writeAddonStore(patch) {
 			await replacePrefixed(door, "addon-settings", addonPrefix, {
 				...await loadPrefixed(door, "addon-settings", addonPrefix),
@@ -7643,6 +7741,121 @@ function createDoorSettingsView(addonId, door, sections) {
 	};
 }
 //#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
+var serverSchema = zod.z.object({
+	port: zod.z.number().default(4443),
+	host: zod.z.string().default("0.0.0.0"),
+	dataPath: zod.z.string().default(DEFAULT_DATA_PATH)
+});
+var authSchema = zod.z.object({
+	jwtSecret: zod.z.string().nullable().default(null),
+	adminUsername: zod.z.string().default("admin"),
+	adminPassword: zod.z.string().default("changeme")
+});
+var hubSchema = zod.z.object({
+	url: zod.z.string().default("ws://localhost:4443/agent"),
+	token: zod.z.string().default("")
+});
+var agentSchema = zod.z.object({
+	name: zod.z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: zod.z.number().default(4444)
+});
+var tlsSchema = zod.z.object({
+	/** Enable HTTPS (default: true) */
+	enabled: zod.z.boolean().default(true),
+	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
+	certPath: zod.z.string().optional(),
+	/** Path to custom key file (PEM). Required if certPath is set. */
+	keyPath: zod.z.string().optional()
+});
+/**
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
+*
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
+*/
+var bootstrapAddonsSchema = zod.z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: zod.z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: zod.z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: zod.z.array(zod.z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: zod.z.array(zod.z.string()).default([])
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = zod.z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: zod.z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+});
+//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -9972,125 +10185,22 @@ var import_js_yaml = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((ex
 var { Type, Schema, FAILSAFE_SCHEMA, JSON_SCHEMA, CORE_SCHEMA, DEFAULT_SCHEMA, load: load$1, loadAll, dump, YAMLException, types: types$3, safeLoad, safeLoadAll, safeDump } = import_js_yaml.default;
 import_js_yaml.default;
 //#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-var serverSchema = zod.z.object({
-	port: zod.z.number().default(4443),
-	host: zod.z.string().default("0.0.0.0"),
-	dataPath: zod.z.string().default(DEFAULT_DATA_PATH)
-});
-var authSchema = zod.z.object({
-	jwtSecret: zod.z.string().nullable().default(null),
-	adminUsername: zod.z.string().default("admin"),
-	adminPassword: zod.z.string().default("changeme")
-});
-var hubSchema = zod.z.object({
-	url: zod.z.string().default("ws://localhost:4443/agent"),
-	token: zod.z.string().default("")
-});
-var agentSchema = zod.z.object({
-	name: zod.z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: zod.z.number().default(4444)
-});
-var tlsSchema = zod.z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: zod.z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: zod.z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: zod.z.string().optional()
-});
+//#region src/kernel/bootstrap-config.ts
 /**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
+* config.yaml + env: loading, the section writer and the legacy `raw` view —
+* `ConfigManager`'s bootstrap layer, split out of `config-manager.ts` (D675)
+* so that file stays one class. The `console.*` calls are the documented
+* residuals described on `ConfigManager` (no logger exists yet at boot).
 */
-var bootstrapAddonsSchema = zod.z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: zod.z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: zod.z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: zod.z.array(zod.z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: zod.z.array(zod.z.string()).default([])
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = zod.z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: zod.z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
-});
-//#endregion
-//#region src/kernel/config-manager.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Sections that live in config.yaml. Everything else goes to the settings-store. */
+var BOOTSTRAP_SECTIONS = new Set([
+	"server",
+	"auth",
+	"mode"
+]);
 /**
 * Maps environment variable names to dot-notation config paths.
 * Only bootstrap-level env vars -- runtime settings come from the
@@ -10104,17 +10214,360 @@ var ENV_VAR_MAP = {
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
 	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
 };
-var ConfigManager = class ConfigManager {
+/** config.yaml, env overrides applied, parsed. */
+function loadBootstrapConfig(configPath) {
+	const merged = applyEnvOverrides((0, _camstack_types_addon.asJsonObject)(loadYaml(configPath)) ?? {});
+	const config = bootstrapSchema.parse(merged);
+	warnDefaultCredentials(config);
+	return config;
+}
+function writeBootstrapSection(configPath, section, data) {
+	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
+	let raw = {};
+	if (node_fs.existsSync(configPath)) raw = (0, _camstack_types_addon.asJsonObject)(load$1(node_fs.readFileSync(configPath, "utf-8"))) ?? {};
+	const existing = (0, _camstack_types_addon.asJsonObject)(raw[section]) ?? {};
+	raw[section] = {
+		...existing,
+		...data
+	};
+	const validation = bootstrapSchema.safeParse(raw);
+	if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
+	const tmpPath = `${configPath}.tmp`;
+	node_fs.writeFileSync(tmpPath, dump(raw, {
+		lineWidth: 120,
+		indent: 2,
+		quotingType: "\""
+	}), "utf-8");
+	node_fs.renameSync(tmpPath, configPath);
+	return validation.data;
+}
+/**
+* Returns a merged view of bootstrap config + runtime defaults for backward compat.
+*/
+function buildRawAppConfig(bootstrapConfig) {
+	const features = {
+		streaming: require_dist.RUNTIME_DEFAULTS["features.streaming"],
+		notifications: require_dist.RUNTIME_DEFAULTS["features.notifications"],
+		objectDetection: require_dist.RUNTIME_DEFAULTS["features.objectDetection"],
+		remoteAccess: require_dist.RUNTIME_DEFAULTS["features.remoteAccess"],
+		agentCluster: require_dist.RUNTIME_DEFAULTS["features.agentCluster"],
+		smartHome: require_dist.RUNTIME_DEFAULTS["features.smartHome"],
+		recordings: require_dist.RUNTIME_DEFAULTS["features.recordings"],
+		backup: require_dist.RUNTIME_DEFAULTS["features.backup"],
+		repl: require_dist.RUNTIME_DEFAULTS["features.repl"]
+	};
+	return {
+		...bootstrapConfig,
+		features,
+		storage: {
+			provider: require_dist.RUNTIME_DEFAULTS["storage.provider"],
+			locations: { ...require_dist.RUNTIME_DEFAULTS["storage.locations"] }
+		},
+		logging: {
+			level: require_dist.RUNTIME_DEFAULTS["logging.level"],
+			retentionDays: require_dist.RUNTIME_DEFAULTS["logging.retentionDays"]
+		},
+		eventBus: { ringBufferSize: require_dist.RUNTIME_DEFAULTS["eventBus.ringBufferSize"] },
+		retention: {
+			detectionEventsDays: require_dist.RUNTIME_DEFAULTS["retention.detectionEventsDays"],
+			audioLevelsDays: require_dist.RUNTIME_DEFAULTS["retention.audioLevelsDays"]
+		},
+		providers: [...require_dist.RUNTIME_DEFAULTS["providers"]]
+	};
+}
+/**
+* Deep-set a value in a nested plain object using a dot-notation path.
+* Returns a new object (immutable).
+*/
+function setNested(obj, configPath, value) {
+	const [head, ...rest] = configPath.split(".");
+	if (!head) return obj;
+	if (rest.length === 0) return {
+		...obj,
+		[head]: value
+	};
+	const existing = obj[head];
+	const child = isRecord$1(existing) ? existing : {};
+	return {
+		...obj,
+		[head]: setNested(child, rest.join("."), value)
+	};
+}
+/**
+* Apply env var overrides onto the raw YAML object.
+* Only bootstrap-level env vars are applied.
+*/
+function applyEnvOverrides(raw) {
+	let result = { ...raw };
+	for (const [envKey, configPath] of Object.entries(ENV_VAR_MAP)) {
+		const envValue = process.env[envKey];
+		if (envValue === void 0 || envValue === "") continue;
+		const coerced = configPath === "server.port" ? Number(envValue) : envValue;
+		result = setNested(result, configPath, coerced);
+		console.log(`[ConfigManager] Env override applied: ${envKey} → ${configPath}`);
+	}
+	return result;
+}
+function loadYaml(configPath) {
+	if (!node_fs.existsSync(configPath)) {
+		console.warn(`[ConfigManager] Config file not found at: ${configPath}\n  → Using built-in defaults. Set CONFIG_PATH env var or create the file.\n  → Example path from project root: ./server/backend/data/config.yaml`);
+		return {};
+	}
+	const parsed = load$1(node_fs.readFileSync(configPath, "utf-8")) ?? {};
+	console.log(`[ConfigManager] Loaded config from: ${configPath}`);
+	return parsed;
+}
+function warnDefaultCredentials(config) {
+	if (config.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
+}
+//#endregion
+//#region src/kernel/store-settings-view.ts
+function createStoreSettingsView(addonId, cm) {
+	const viewAddonConfig = () => !cm.hasSyncStore() ? (0, _camstack_types_addon.asJsonObject)(cm.getBootstrap(`addons.${addonId}`)) ?? {} : cm.getAddonConfig(addonId);
+	const viewAddonDevice = (deviceId) => !cm.hasSyncStore() ? {} : cm.getAddonDevice(addonId, deviceId);
+	return {
+		async readAddonStore() {
+			return viewAddonConfig();
+		},
+		async readAddonStoreKeyResult(key) {
+			if (!cm.hasSyncStore()) return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: "settings store not wired"
+			};
+			try {
+				const all = cm.getAddonConfig(addonId);
+				return key in all ? {
+					kind: "present",
+					value: all[key]
+				} : { kind: "absent" };
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					reason: "store-read-failed",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+		},
+		async writeAddonStore(patch) {
+			const existing = viewAddonConfig();
+			cm.setAddonConfig(addonId, {
+				...existing,
+				...patch
+			});
+		},
+		async readDeviceStore(deviceId) {
+			return viewAddonDevice(String(deviceId));
+		},
+		async readDeviceStoreBatch(deviceIds) {
+			const out = /* @__PURE__ */ new Map();
+			for (const deviceId of deviceIds) try {
+				out.set(deviceId, viewAddonDevice(String(deviceId)));
+			} catch {
+				out.set(deviceId, {});
+			}
+			return out;
+		},
+		async writeDeviceStore(deviceId, patch) {
+			const key = String(deviceId);
+			const existing = viewAddonDevice(key);
+			cm.setAddonDevice(addonId, key, {
+				...existing,
+				...patch
+			});
+		},
+		async clearDeviceStore(deviceId) {
+			cm.clearAddonDevice(addonId, String(deviceId));
+		},
+		async readDeviceRuntimeState(deviceId) {
+			return cm.getDeviceRuntimeState(String(deviceId));
+		},
+		async writeDeviceRuntimeState(deviceId, data) {
+			cm.setDeviceRuntimeState(String(deviceId), data);
+		},
+		async clearDeviceRuntimeState(deviceId) {
+			cm.clearDeviceRuntimeState(String(deviceId));
+		},
+		async getSection(section) {
+			return cm.getSection(section);
+		},
+		async setSection(section, patch) {
+			const existing = cm.getSection(section);
+			cm.setSection(section, {
+				...existing,
+				...patch
+			});
+		}
+	};
+}
+//#endregion
+//#region src/kernel/system-settings-policy.ts
+/**
+* Which `system-settings` keys the STORE may answer, and which the kernel
+* loads from the door into memory at boot — D675.
+*
+* ## The store never outranks env + config.yaml for a bootstrap section
+*
+* `system-settings` holds, among other things, `auth.jwtSecret`,
+* `auth.adminUsername` and `auth.adminPassword` — written there by
+* `local-auth` (and by older builds) next to `auth.tokenExpiry`. The live
+* container supplies the same three from env (`CAMSTACK_JWT_SECRET`,
+* `CAMSTACK_ADMIN_USER`, `CAMSTACK_ADMIN_PASS`). While the store layer was
+* skipped (every read since D231) env won by accident. Merging the store back
+* in "highest priority" would let a stale DB copy replace the JWT secret —
+* invalidating every token — and change the login password.
+*
+* So a bootstrap-owned section is answered from env + config.yaml ONLY, and
+* the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
+* today `auth.tokenExpiry`, the one value the operator edits in the UI
+* (System → Authentication). Widening this list is a security decision, not a
+* convenience.
+*/
+/** Top-level sections whose authority is env + config.yaml (`bootstrapSchema`). */
+var BOOTSTRAP_OWNED_SECTIONS = new Set([
+	"mode",
+	"server",
+	"auth",
+	"hub",
+	"agent",
+	"tls",
+	"bootstrap"
+]);
+/** The only keys under a bootstrap-owned section the store may answer. */
+var STORE_READABLE_BOOTSTRAP_KEYS = new Set(["auth.tokenExpiry"]);
+/** May the settings store answer `key`, or is it env + config.yaml only? */
+function storeMayAnswer(key) {
+	const dot = key.indexOf(".");
+	const section = dot === -1 ? key : key.slice(0, dot);
+	if (!BOOTSTRAP_OWNED_SECTIONS.has(section)) return true;
+	return STORE_READABLE_BOOTSTRAP_KEYS.has(key);
+}
+/**
+* Key prefixes loaded from the door into memory ONCE at boot, so the
+* synchronous readers that need them (the capability registry's preference
+* readers, `capabilities.getPreference`) answer the persisted value after a
+* reboot. Capability preferences are the only prefix: every other synchronous
+* caller of `ConfigManager.get` either reads a bootstrap key or runs before the
+* door exists.
+*/
+var PRELOADED_SYSTEM_PREFIXES = ["capabilities."];
+/**
+* Single keys loaded the same way. `auth.tokenExpiry` is read synchronously on
+* every mint by the hub's `AuthService` (`AuthManager.signToken`).
+*/
+var PRELOADED_SYSTEM_KEYS = ["auth.tokenExpiry"];
+/** Is `key` served from the boot-time mirror when the engine is isolated? */
+function isPreloadedSystemKey(key) {
+	if (PRELOADED_SYSTEM_KEYS.includes(key)) return true;
+	return PRELOADED_SYSTEM_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+/**
+* The stored keys of `section` the store may answer (`storeMayAnswer`,
+* D675): everything for an ordinary section, only the allow-listed keys for a
+* bootstrap-owned one.
+*/
+function filterStoreSection(section, stored) {
+	const out = {};
+	for (const [key, value] of Object.entries(stored)) if (storeMayAnswer(`${section}.${key}`)) out[key] = value;
+	return out;
+}
+//#endregion
+//#region src/kernel/system-settings-mirror.ts
+function errorText$1(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+var SystemSettingsMirror = class {
+	state = { kind: "pending" };
+	/** The door the current read belongs to; a replaced door owns the mirror. */
+	door = null;
+	preload = null;
+	/**
+	* Writes to preloaded keys made through THIS process. They win over the boot
+	* read (they are newer) and survive a failed one, so an operator's Save is
+	* reported back even when the boot read was lost.
+	*/
+	writes = /* @__PURE__ */ new Map();
+	/** Start the ONE read for `door`. Called by `ConfigManager.setSettingsDoor`. */
+	load(door) {
+		this.door = door;
+		this.state = { kind: "pending" };
+		this.preload = this.read(door);
+	}
+	/** The in-flight / settled boot read, or `null` before any door. */
+	whenLoaded() {
+		return this.preload;
+	}
+	/**
+	* A preloaded key's value: `undefined` when the store holds none, or a THROW
+	* (`preload-pending` / `preload-failed`) when it is not known.
+	*/
+	get(key) {
+		if (this.writes.has(key)) return this.writes.get(key);
+		const state = this.state;
+		switch (state.kind) {
+			case "loaded": return state.values.get(key);
+			case "pending": throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.get", "preload-pending", `"${key}" is read from the boot-time mirror, whose one read has not settled yet`);
+			case "failed": throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.get", "preload-failed", `"${key}" is unknown: the boot-time read of the settings store failed (${state.error})`);
+		}
+	}
+	/** Record a write to a preloaded key so the mirror reports it. */
+	noteWrite(key, value) {
+		if (isPreloadedSystemKey(key)) this.writes.set(key, value);
+	}
+	/** Every row under the preloaded prefixes plus each preloaded key. Never rejects. */
+	async read(door) {
+		try {
+			const values = /* @__PURE__ */ new Map();
+			for (const prefix of PRELOADED_SYSTEM_PREFIXES) {
+				const rows = await loadSystemSettingsPrefix(door, prefix);
+				for (const [suffix, value] of Object.entries(rows)) values.set(`${prefix}${suffix}`, value);
+			}
+			for (const key of PRELOADED_SYSTEM_KEYS) {
+				const value = await door.get({
+					collection: "system-settings",
+					key
+				});
+				if (value !== void 0) values.set(key, value);
+			}
+			if (this.door === door) this.state = {
+				kind: "loaded",
+				values
+			};
+			return {
+				kind: "loaded",
+				keyCount: values.size
+			};
+		} catch (err) {
+			const error = errorText$1(err);
+			if (this.door === door) this.state = {
+				kind: "failed",
+				error
+			};
+			return {
+				kind: "failed",
+				error
+			};
+		}
+	}
+};
+//#endregion
+//#region src/kernel/config-manager.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+var ConfigManager = class {
 	configPath;
 	bootstrapConfig;
 	settingsStore = null;
 	settingsDoor = null;
+	/** Boot-time mirror of the preloaded `system-settings` keys (door mode, D675). */
+	systemMirror = new SystemSettingsMirror();
 	constructor(configPath) {
 		this.configPath = configPath;
-		const rawYaml = this.loadYaml();
-		const merged = this.applyEnvOverrides((0, _camstack_types_addon.asJsonObject)(rawYaml) ?? {});
-		this.bootstrapConfig = bootstrapSchema.parse(merged);
-		this.warnDefaultCredentials();
+		this.bootstrapConfig = loadBootstrapConfig(configPath);
 	}
 	/**
 	* Wire the settings-store backend. Called once, after the `settings-store`
@@ -10131,6 +10584,25 @@ var ConfigManager = class ConfigManager {
 	*/
 	setSettingsDoor(door) {
 		this.settingsDoor = door;
+		this.systemMirror.load(door);
+	}
+	/**
+	* Resolves once the boot read of the preloaded `system-settings` keys has
+	* settled — the hook the addon registry uses to log it and to replay the
+	* capability preferences onto providers that registered before it (D675).
+	* `null` when no door has been wired (a sync store needs no preload).
+	*/
+	whenSystemSettingsPreloaded() {
+		return this.systemMirror.whenLoaded();
+	}
+	backendMode() {
+		if (this.settingsStore !== null) return "store";
+		if (this.settingsDoor !== null) return "door";
+		return "unwired";
+	}
+	/** The refusal every sync addon-scoped reader raises without a sync store. */
+	refuseSyncRead(reader, subject) {
+		return this.backendMode() === "door" ? new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError(`ConfigManager.${reader}`, "door-only", `${subject}: the settings engine is isolated and has no synchronous handle — read it through the settings view (createSettingsView / readAddonStoreResult)`) : new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError(`ConfigManager.${reader}`, "not-wired", `${subject}: no settings backend is wired yet`);
 	}
 	get(configPath) {
 		return this.resolveConfigValue(configPath);
@@ -10138,35 +10610,52 @@ var ConfigManager = class ConfigManager {
 	resolveConfigValue(configPath) {
 		const bootstrapValue = this.getFromBootstrap(configPath);
 		if (bootstrapValue !== void 0) return bootstrapValue;
-		if (this.settingsStore !== null) {
-			const storeValue = this.settingsStore.getSystem(configPath);
-			if (storeValue !== void 0) return storeValue;
-			const nested = this.getNestedFromSystemSettings(configPath);
-			if (nested !== null) return nested;
-		}
+		const storeValue = this.readStoreLayer(configPath);
+		if (storeValue !== void 0) return storeValue;
 		if (configPath in require_dist.RUNTIME_DEFAULTS) return require_dist.RUNTIME_DEFAULTS[configPath];
 		return this.getFromRuntimeDefaults(configPath) ?? void 0;
 	}
 	/**
-	* Write a value to the settings-store.
-	* Throws if the settings store is not yet wired.
+	* The settings-store layer of {@link get}: the stored value, `undefined`
+	* when the store holds nothing (or may not answer this key), or a THROW
+	* when the store cannot be asked.
+	*/
+	readStoreLayer(configPath) {
+		if (!storeMayAnswer(configPath)) return void 0;
+		switch (this.backendMode()) {
+			case "store": {
+				const store = this.settingsStore;
+				if (store === null) return void 0;
+				const storeValue = store.getSystem(configPath);
+				if (storeValue !== void 0) return storeValue;
+				return this.getNestedFromSystemSettings(configPath) ?? void 0;
+			}
+			case "door":
+				if (isPreloadedSystemKey(configPath)) return this.systemMirror.get(configPath);
+				throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.get", "door-only", `"${configPath}" may be stored, and the isolated engine cannot be read synchronously — only ${[...PRELOADED_SYSTEM_PREFIXES, ...PRELOADED_SYSTEM_KEYS].join(", ")} are mirrored at boot`);
+			case "unwired": return;
+		}
+	}
+	/**
+	* Write a value to the settings-store. Resolves only once the write LANDED:
+	* on the isolated engine it awaits the door, and a failed write REJECTS and
+	* is not reported back by the mirror (D675 — it used to be fire-and-forget,
+	* so a lost write read as saved for the life of the process). Rejects when
+	* no store is wired.
 	*/
-	set(key, value) {
+	async set(key, value) {
 		if (this.settingsStore !== null) {
 			this.settingsStore.setSystem(key, value);
 			return;
 		}
-		if (this.settingsDoor !== null) {
-			this.settingsDoor.set({
-				collection: "system-settings",
-				key,
-				value
-			}).catch((err) => {
-				console.error("[ConfigManager] isolated settings-store write failed", err);
-			});
-			return;
-		}
-		throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+		const door = this.settingsDoor;
+		if (door === null) throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.set", "not-wired", `"${key}" cannot be written: no settings backend is wired yet`);
+		await door.set({
+			collection: "system-settings",
+			key,
+			value
+		});
+		this.systemMirror.noteWrite(key, value);
 	}
 	/**
 	* Bulk-read all keys that belong to a logical section.
@@ -10182,17 +10671,40 @@ var ConfigManager = class ConfigManager {
 	* shadowing the rest of the section that only lives in config.yaml.
 	* The kernel is agnostic about the store backend — any `ISettingsStore`
 	* implementation (sqlite, redis, in-memory, …) behaves identically here.
+	*
+	* D675: a bootstrap-owned section takes ONLY allow-listed keys from the
+	* store (a stored `auth.jwtSecret` never replaces env), and with only the
+	* door wired this sync read THROWS — the settings view's `getSection` reads
+	* the door.
 	*/
 	getSection(section) {
+		const mode = this.backendMode();
+		if (mode === "door") throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.getSection", "door-only", `section "${section}": the settings engine is isolated — read it through the settings view (ctx.settings.getSection)`);
+		const merged = this.sectionBase(section);
+		if (mode === "store") {
+			const nested = this.getNestedFromSystemSettings(section);
+			if (nested) Object.assign(merged, filterStoreSection(section, nested));
+		}
+		return merged;
+	}
+	/** Runtime defaults, then config.yaml + env — the layers under the store. */
+	sectionBase(section) {
 		const merged = {};
 		const defaults = (0, _camstack_types_addon.asJsonObject)(this.getFromRuntimeDefaults(section));
 		if (defaults) Object.assign(merged, defaults);
 		const bootstrapSection = (0, _camstack_types_addon.asJsonObject)({ ...this.bootstrapConfig }[section]);
 		if (bootstrapSection) Object.assign(merged, bootstrapSection);
-		if (this.settingsStore !== null) {
-			const nested = this.getNestedFromSystemSettings(section);
-			if (nested) Object.assign(merged, nested);
-		}
+		return merged;
+	}
+	/**
+	* {@link getSection} through the async door — what the door-backed settings
+	* view answers (D675). Same layers, same allow-list; a failed door read
+	* THROWS rather than handing back the defaults as if nothing were stored.
+	*/
+	async readSectionThroughDoor(door, section) {
+		const merged = this.sectionBase(section);
+		const stored = await loadSystemSettingsPrefix(door, `${section}.`, (key) => storeMayAnswer(`${section}.${key}`));
+		Object.assign(merged, filterStoreSection(section, stored));
 		return merged;
 	}
 	/**
@@ -10203,44 +10715,58 @@ var ConfigManager = class ConfigManager {
 		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
 		for (const [key, value] of Object.entries(data)) this.settingsStore.setSystem(`${section}.${key}`, value);
 	}
-	/** Read all config for an addon from addon_settings. */
+	/**
+	* Read all config for an addon — SYNC store only. THROWS without one: its
+	* old bootstrap fallback answered `{}` for every addon on every
+	* isolated-engine hub (D675). Async three-way: {@link readAddonGlobalStrict}.
+	*/
 	getAddonConfig(addonId) {
 		if (this.settingsStore !== null) return this.settingsStore.getAllAddon(addonId);
-		return (0, _camstack_types_addon.asJsonObject)(this.getFromBootstrap(`addons.${addonId}`)) ?? {};
+		throw this.refuseSyncRead("getAddonConfig", `addon "${addonId}"`);
+	}
+	/**
+	* One addon's global store, three-way (D675): the record, `{}` when the
+	* store ANSWERED with nothing, or a THROW when it could not be asked.
+	* Behind `addonSettingsRaw.getGlobal` and `$hub.getAddonConfig`.
+	*/
+	async readAddonGlobalStrict(addonId) {
+		const read = await this.createSettingsView(addonId).readAddonStoreResult();
+		switch (read.kind) {
+			case "value": return read.value;
+			case "missing": return {};
+			case "failed": throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.readAddonGlobalStrict", this.backendMode() === "unwired" ? "not-wired" : "read-failed", `addon "${addonId}": ${read.error}`);
+		}
+	}
+	/** One addon's per-device overrides, three-way like {@link readAddonGlobalStrict}. */
+	async readAddonDeviceStrict(addonId, deviceId) {
+		const door = this.settingsDoor;
+		switch (this.backendMode()) {
+			case "store": return this.getAddonDevice(addonId, String(deviceId));
+			case "door":
+				if (door === null) break;
+				try {
+					return await this.createDoorBackedSettingsView(addonId, door).readDeviceStore(deviceId);
+				} catch (err) {
+					throw new require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError("ConfigManager.readAddonDeviceStrict", "read-failed", `addon "${addonId}" device ${deviceId}: ${errorText(err)}`);
+				}
+			case "unwired": break;
+		}
+		throw this.refuseSyncRead("readAddonDeviceStrict", `addon "${addonId}" device ${deviceId}`);
 	}
 	/** Write (bulk-replace) config for an addon to addon_settings. */
 	setAddonConfig(addonId, config) {
 		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
 		this.settingsStore.setAllAddon(addonId, config);
 	}
-	/** Read all config for a provider from provider_settings. */
-	getProviderConfig(providerId) {
-		if (this.settingsStore !== null) return this.settingsStore.getAllProvider(providerId);
-		return {};
-	}
-	/** Write (upsert) a single key for a provider to provider_settings. */
-	setProviderConfig(providerId, key, value) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setProvider(providerId, key, value);
-	}
-	/** Read all config for a device from device_settings. */
-	getDeviceConfig(deviceId) {
-		if (this.settingsStore !== null) return this.settingsStore.getAllDevice(deviceId);
-		return {};
-	}
-	/** Write (upsert) a single key for a device to device_settings. */
-	setDeviceConfig(deviceId, key, value) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setDevice(deviceId, key, value);
-	}
 	/**
 	* Read per-device overrides for a specific addon. Returns a flat record
 	* of field → value. Missing keys fall back to the addon-global value via
 	* `getAddonConfig(addonId)` — that composition is the resolver service's
 	* responsibility, not ConfigManager's.
+	* SYNC store only — THROWS without one (D675); async: {@link readAddonDeviceStrict}.
 	*/
 	getAddonDevice(addonId, deviceId) {
-		if (this.settingsStore === null) return {};
+		if (this.settingsStore === null) throw this.refuseSyncRead("getAddonDevice", `addon "${addonId}" device "${deviceId}"`);
 		return this.settingsStore.getAddonDevice(addonId, deviceId);
 	}
 	/**
@@ -10261,12 +10787,11 @@ var ConfigManager = class ConfigManager {
 		this.settingsStore.clearAddonDevice(addonId, deviceId);
 	}
 	/**
-	* The device's persisted runtime-state blob. `{}` before the settings store
-	* is wired — the same answer as "this device has never persisted a slice",
-	* which is what every caller already handles.
+	* The device's persisted runtime-state blob. THROWS before the store is
+	* wired: a store not asked is not an empty row (D677, D675).
 	*/
 	getDeviceRuntimeState(deviceId) {
-		if (this.settingsStore === null) return {};
+		if (this.settingsStore === null) throw this.refuseSyncRead("getDeviceRuntimeState", `runtime state of device ${deviceId}`);
 		return this.settingsStore.getDeviceRuntimeState(deviceId);
 	}
 	/**
@@ -10334,6 +10859,7 @@ var ConfigManager = class ConfigManager {
 					};
 				}
 			},
+			readAddonStoreKeyResult: (key) => active().readAddonStoreKeyResult(key),
 			writeAddonStore: (patch) => active().writeAddonStore(patch),
 			readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
 			readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
@@ -10349,81 +10875,39 @@ var ConfigManager = class ConfigManager {
 	/** The async-door backend of {@link createSettingsView}. */
 	createDoorBackedSettingsView(addonId, door) {
 		return createDoorSettingsView(addonId, door, {
-			getSection: (section) => this.getSection(section),
+			getSection: (section) => this.readSectionThroughDoor(door, section),
 			setSection: async (section, patch) => {
-				for (const [key, value] of Object.entries(patch)) await door.set({
-					collection: "system-settings",
-					key: `${section}.${key}`,
-					value
-				});
+				for (const [key, value] of Object.entries(patch)) {
+					const fullKey = `${section}.${key}`;
+					await door.set({
+						collection: "system-settings",
+						key: fullKey,
+						value
+					});
+					this.systemMirror.noteWrite(fullKey, value);
+				}
 			}
 		});
 	}
 	/** The sync-`ISettingsStore` backend of {@link createSettingsView}. */
 	createStoreSettingsView(addonId) {
-		const cm = this;
-		return {
-			async readAddonStore() {
-				return cm.getAddonConfig(addonId);
-			},
-			async writeAddonStore(patch) {
-				const existing = cm.getAddonConfig(addonId);
-				cm.setAddonConfig(addonId, {
-					...existing,
-					...patch
-				});
-			},
-			async readDeviceStore(deviceId) {
-				return cm.getAddonDevice(addonId, String(deviceId));
-			},
-			async readDeviceStoreBatch(deviceIds) {
-				const out = /* @__PURE__ */ new Map();
-				for (const deviceId of deviceIds) try {
-					out.set(deviceId, cm.getAddonDevice(addonId, String(deviceId)));
-				} catch {
-					out.set(deviceId, {});
-				}
-				return out;
-			},
-			async writeDeviceStore(deviceId, patch) {
-				const key = String(deviceId);
-				const existing = cm.getAddonDevice(addonId, key);
-				cm.setAddonDevice(addonId, key, {
-					...existing,
-					...patch
-				});
-			},
-			async clearDeviceStore(deviceId) {
-				cm.clearAddonDevice(addonId, String(deviceId));
-			},
-			async readDeviceRuntimeState(deviceId) {
-				return cm.getDeviceRuntimeState(String(deviceId));
-			},
-			async writeDeviceRuntimeState(deviceId, data) {
-				cm.setDeviceRuntimeState(String(deviceId), data);
-			},
-			async clearDeviceRuntimeState(deviceId) {
-				cm.clearDeviceRuntimeState(String(deviceId));
-			},
-			async getSection(section) {
-				return cm.getSection(section);
-			},
-			async setSection(section, patch) {
-				const existing = cm.getSection(section);
-				cm.setSection(section, {
-					...existing,
-					...patch
-				});
-			}
-		};
+		return createStoreSettingsView(addonId, this);
+	}
+	/** Is a SYNC `ISettingsStore` wired? (The store-backed view's D294-window test.) */
+	hasSyncStore() {
+		return this.settingsStore !== null;
 	}
 	getBootstrap(configPath) {
 		return this.getFromBootstrap(configPath);
 	}
-	/** Features accessor -- reads from settings-store when available, falls back to RUNTIME_DEFAULTS */
+	/**
+	* Features — the sync store when wired, else RUNTIME_DEFAULTS DELIBERATELY
+	* (not `get()`, which refuses in door mode, D675): nothing writes
+	* `features.*` beyond sqlite-settings' first-boot seed of these defaults.
+	*/
 	get features() {
 		const g = (key) => {
-			const storeValue = this.get(`features.${key}`);
+			const storeValue = this.settingsStore !== null ? this.get(`features.${key}`) : void 0;
 			if (typeof storeValue === "boolean") return storeValue;
 			return require_dist.RUNTIME_DEFAULTS[`features.${key}`];
 		};
@@ -10439,115 +10923,16 @@ var ConfigManager = class ConfigManager {
 			repl: g("repl")
 		};
 	}
-	/**
-	* Returns a merged view of bootstrap config + runtime defaults for backward compat.
-	*/
+	/** Bootstrap config + runtime defaults, for backward compat. */
 	get raw() {
-		const features = {
-			streaming: require_dist.RUNTIME_DEFAULTS["features.streaming"],
-			notifications: require_dist.RUNTIME_DEFAULTS["features.notifications"],
-			objectDetection: require_dist.RUNTIME_DEFAULTS["features.objectDetection"],
-			remoteAccess: require_dist.RUNTIME_DEFAULTS["features.remoteAccess"],
-			agentCluster: require_dist.RUNTIME_DEFAULTS["features.agentCluster"],
-			smartHome: require_dist.RUNTIME_DEFAULTS["features.smartHome"],
-			recordings: require_dist.RUNTIME_DEFAULTS["features.recordings"],
-			backup: require_dist.RUNTIME_DEFAULTS["features.backup"],
-			repl: require_dist.RUNTIME_DEFAULTS["features.repl"]
-		};
-		return {
-			...this.bootstrapConfig,
-			features,
-			storage: {
-				provider: require_dist.RUNTIME_DEFAULTS["storage.provider"],
-				locations: { ...require_dist.RUNTIME_DEFAULTS["storage.locations"] }
-			},
-			logging: {
-				level: require_dist.RUNTIME_DEFAULTS["logging.level"],
-				retentionDays: require_dist.RUNTIME_DEFAULTS["logging.retentionDays"]
-			},
-			eventBus: { ringBufferSize: require_dist.RUNTIME_DEFAULTS["eventBus.ringBufferSize"] },
-			retention: {
-				detectionEventsDays: require_dist.RUNTIME_DEFAULTS["retention.detectionEventsDays"],
-				audioLevelsDays: require_dist.RUNTIME_DEFAULTS["retention.audioLevelsDays"]
-			},
-			providers: [...require_dist.RUNTIME_DEFAULTS["providers"]]
-		};
+		return buildRawAppConfig(this.bootstrapConfig);
 	}
-	/** Sections that live in config.yaml. Everything else goes to the settings-store. */
-	static BOOTSTRAP_SECTIONS = new Set([
-		"server",
-		"auth",
-		"mode"
-	]);
 	/**
-	* Atomically update one top-level section of config.yaml and sync in-memory.
-	* Only bootstrap sections (server, auth, mode) are written to YAML.
-	* Runtime settings must use setSection() which writes to the settings-store.
+	* Atomically update one top-level bootstrap section (server, auth, mode) of
+	* config.yaml and sync in-memory. Runtime settings use setSection().
 	*/
 	update(section, data) {
-		if (!ConfigManager.BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
-		let raw = {};
-		if (node_fs.existsSync(this.configPath)) raw = (0, _camstack_types_addon.asJsonObject)(load$1(node_fs.readFileSync(this.configPath, "utf-8"))) ?? {};
-		const existing = (0, _camstack_types_addon.asJsonObject)(raw[section]) ?? {};
-		raw[section] = {
-			...existing,
-			...data
-		};
-		const validation = bootstrapSchema.safeParse(raw);
-		if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
-		const tmpPath = `${this.configPath}.tmp`;
-		node_fs.writeFileSync(tmpPath, dump(raw, {
-			lineWidth: 120,
-			indent: 2,
-			quotingType: "\""
-		}), "utf-8");
-		node_fs.renameSync(tmpPath, this.configPath);
-		this.bootstrapConfig = validation.data;
-	}
-	/**
-	* Deep-set a value in a nested plain object using a dot-notation path.
-	* Returns a new object (immutable).
-	*/
-	setNested(obj, configPath, value) {
-		const [head, ...rest] = configPath.split(".");
-		if (!head) return obj;
-		if (rest.length === 0) return {
-			...obj,
-			[head]: value
-		};
-		const existing = obj[head];
-		const child = isRecord(existing) ? existing : {};
-		return {
-			...obj,
-			[head]: this.setNested(child, rest.join("."), value)
-		};
-	}
-	/**
-	* Apply env var overrides onto the raw YAML object.
-	* Only bootstrap-level env vars are applied.
-	*/
-	applyEnvOverrides(raw) {
-		let result = { ...raw };
-		for (const [envKey, configPath] of Object.entries(ENV_VAR_MAP)) {
-			const envValue = process.env[envKey];
-			if (envValue === void 0 || envValue === "") continue;
-			const coerced = configPath === "server.port" ? Number(envValue) : envValue;
-			result = this.setNested(result, configPath, coerced);
-			console.log(`[ConfigManager] Env override applied: ${envKey} → ${configPath}`);
-		}
-		return result;
-	}
-	loadYaml() {
-		if (!node_fs.existsSync(this.configPath)) {
-			console.warn(`[ConfigManager] Config file not found at: ${this.configPath}\n  → Using built-in defaults. Set CONFIG_PATH env var or create the file.\n  → Example path from project root: ./server/backend/data/config.yaml`);
-			return {};
-		}
-		const parsed = load$1(node_fs.readFileSync(this.configPath, "utf-8")) ?? {};
-		console.log(`[ConfigManager] Loaded config from: ${this.configPath}`);
-		return parsed;
-	}
-	warnDefaultCredentials() {
-		if (this.bootstrapConfig.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
+		this.bootstrapConfig = writeBootstrapSection(this.configPath, section, data);
 	}
 	getFromBootstrap(configPath) {
 		const keys = configPath.split(".");
@@ -96187,8 +96572,10 @@ exports.SOCKET_PLANE_TOP_N = require_child_cap_dispatch.SOCKET_PLANE_TOP_N;
 exports.SOCKET_QUEUE_TOP_N = require_child_cap_dispatch.SOCKET_QUEUE_TOP_N;
 exports.STALL_REPORT_MS = require_event_loop_stall_monitor.STALL_REPORT_MS;
 exports.STALL_TICK_MS = require_event_loop_stall_monitor.STALL_TICK_MS;
+exports.STORE_READABLE_BOOTSTRAP_KEYS = STORE_READABLE_BOOTSTRAP_KEYS;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
+exports.SettingsReadUnavailableError = require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError;
 exports.SocketChannel = require_child_cap_dispatch.SocketChannel;
 exports.SqliteSettingsAddon = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsAddon;
 exports.SqliteSettingsBackend = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsBackend;
@@ -96411,6 +96798,7 @@ exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_event_loop_stall_monitor.isModelDownloaded;
+exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
 exports.loadTlsCert = require_tls$1.loadTlsCert;
@@ -96463,6 +96851,7 @@ exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMess
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;
 exports.startHeapWatch = require_child_cap_dispatch.startHeapWatch;
 exports.startRunnerHeapWatch = require_child_cap_dispatch.startRunnerHeapWatch;
+exports.storeMayAnswer = storeMayAnswer;
 exports.strandedMb = require_child_cap_dispatch.strandedMb;
 exports.stripCamstackDeps = stripCamstackDeps;
 exports.subscribePassthrough = require_child_cap_dispatch.subscribePassthrough;