@camstack/system 1.2.316 → 1.2.318

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as asNumber, Bt as looseSchema, C as METHOD_ACCESS_MAP, Dt as isCollectionArrayMethod, Et as isArrayOutputSchema, Ft as lifecycleJobSchema, Jn as DEVICE_STATUS_METHOD, Jt as objectInputDeclaresRequiredDeviceId, Kn as DATAPLANE_SECRET_HEADER$1, Mt as kebabToCamel, O as RUNTIME_DEFAULTS, Qn as asJsonObject$1, Qt as procedureAuthKey, Wn as errMsg$1, Xn as ReadinessTimeoutError, Yn as ReadinessRegistry, b as LOG_LEVEL_RANK, dr as readinessKey, er as asString$1, fr as resolveCapMount, hr as EventCategory$1, in as resolveMethodAuth, ir as expandCapMethods, jt as isVoidInput, kt as isObjectInput, lr as parseJsonObject, nr as emitDownForOwnedCaps, on as scopesAllowAddon, pr as scopeKey, qn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qt as objectInputDeclaresAddonId, sn as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tr as createEvent, ur as parseJsonUnknown, xt as extractNestedAddonId, z as addonSettingsCapability, zt as logLevelAtMost } from "./dist-BPvku43i.mjs";
+import { $n as asNumber, Bt as looseSchema, C as METHOD_ACCESS_MAP, Dt as isCollectionArrayMethod, Et as isArrayOutputSchema, Ft as lifecycleJobSchema, Jn as DEVICE_STATUS_METHOD, Jt as objectInputDeclaresRequiredDeviceId, Kn as DATAPLANE_SECRET_HEADER$1, Mt as kebabToCamel, O as RUNTIME_DEFAULTS, Qn as asJsonObject$1, Qt as procedureAuthKey, Wn as errMsg$1, Xn as ReadinessTimeoutError, Yn as ReadinessRegistry, b as LOG_LEVEL_RANK, dr as readinessKey, er as asString$1, fr as resolveCapMount, hr as EventCategory$1, in as resolveMethodAuth, ir as expandCapMethods, jt as isVoidInput, kt as isObjectInput, lr as parseJsonObject, nr as emitDownForOwnedCaps, on as scopesAllowAddon, pr as scopeKey, qn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qt as objectInputDeclaresAddonId, sn as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tr as createEvent, ur as parseJsonUnknown, xt as extractNestedAddonId, z as addonSettingsCapability, zt as logLevelAtMost } from "./dist-CQ9vXSUh.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { ComposerAddon } from "./builtins/composer/composer.addon.mjs";
@@ -13,7 +13,7 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, a as require_safe_buffer, i as require_ms, n as ScopedTokenManager, o as ApiKeyManager, r as AuthManager, t as UserManager } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, a as isSettingsReadUnavailable, c as ApiKeyManager, i as SettingsReadUnavailableError, n as ScopedTokenManager, o as require_ms, r as AuthManager, s as require_safe_buffer, t as UserManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
@@ -28,7 +28,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-IM-v7JV4.mjs";
-import { $ as classifyCapRoute, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as deviceOfGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as GET_STATUS_METHOD, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteError, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_SERVICE, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as AGENT_CAP_FWD_ACTION, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as CapRouteResolver, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as callWithServiceDiscovery, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as answerClaimedGetStatus, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as readMoleculerFanoutMode, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-AAltfBUH.mjs";
+import { $ as classifyCapRoute, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as deviceOfGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as GET_STATUS_METHOD, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteError, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_SERVICE, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as AGENT_CAP_FWD_ACTION, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as CapRouteResolver, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as callWithServiceDiscovery, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as answerClaimedGetStatus, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as readMoleculerFanoutMode, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-C2VINHu1.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B1v6E07R.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -2745,7 +2745,7 @@ async function ensureAddonNativePrebuilds(addonDir, options) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -2843,9 +2843,9 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function toAddonPackageManifest(value) {
-	if (!isRecord$2(value)) return void 0;
+	if (!isRecord$3(value)) return void 0;
 	if (!Array.isArray(value.addons)) return void 0;
-	if (!value.addons.every((a) => isRecord$2(a) && typeof a.id === "string")) return void 0;
+	if (!value.addons.every((a) => isRecord$3(a) && typeof a.id === "string")) return void 0;
 	return value;
 }
 /** Minimal no-op logger for default parameter */
@@ -2995,7 +2995,7 @@ var AddonLoader = class {
 		}
 		if (!fs$17.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$2(modUnknown) ? modUnknown : {};
+		const mod = isRecord$3(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -3011,7 +3011,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$2(modUnknown) ? modUnknown : {};
+		const mod = isRecord$3(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -6308,6 +6308,60 @@ var CapabilityRegistry = class CapabilityRegistry {
 			addonId
 		});
 	}
+	/**
+	* Re-apply the operator's PERSISTED preferences to providers that
+	* registered before those preferences could be read — once, when the boot
+	* read of them settles (D675).
+	*
+	* `registerProvider` consults the preference readers at the moment a
+	* provider registers. With the settings engine isolated (D231) the
+	* preferences arrive over an async door, so a provider can register before
+	* they are known; the readers then answer "no preference" and the default
+	* wins. This replays the answer the readers give NOW over every registered
+	* provider: a singleton whose persisted choice is registered and not active
+	* is switched to it, and a collection provider the operator disabled is
+	* disabled again. It is one pass, triggered by the read settling — not a
+	* wait, a poll or a retry (D3).
+	*
+	* `skip` names the capabilities that must not be switched live (infra caps
+	* need a restart — the same rule `capabilities.setPreference` applies).
+	*/
+	applyPersistedPreferences(skip) {
+		const singletons = [];
+		const disabled = [];
+		for (const [capability, state] of this.capabilities) {
+			if (skip(capability)) continue;
+			if (state.definition.mode === "singleton") {
+				const choice = this.configReader?.(capability);
+				if (choice === void 0 || !state.providers.has(choice)) continue;
+				if (state.activeAddonId === choice) continue;
+				state.activeAddonId = choice;
+				singletons.push({
+					capability,
+					addonId: choice
+				});
+				this.emitEvent("capability:singleton-changed", {
+					capability,
+					addonId: choice
+				});
+			} else if (state.definition.mode === "collection") for (const addonId of this.collectionConfigReader?.(capability) ?? []) {
+				if (!state.providers.has(addonId) || state.disabledProviders.has(addonId)) continue;
+				state.disabledProviders.add(addonId);
+				disabled.push({
+					capability,
+					addonId
+				});
+				this.emitEvent("capability:collection-provider-disabled", {
+					capability,
+					addonId
+				});
+			}
+		}
+		return {
+			singletons,
+			disabled
+		};
+	}
 	/** Enable a previously disabled collection provider. */
 	enableCollectionProvider(capability, addonId) {
 		const state = this.capabilities.get(capability);
@@ -7450,14 +7504,14 @@ async function runHubAddonBoot(steps) {
 }
 //#endregion
 //#region src/kernel/settings-door-view.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asBlob(value) {
-	return isRecord$1(value) ? value : {};
+	return isRecord$2(value) ? value : {};
 }
 function unwrapValue(parsed) {
-	if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
+	if (!isRecord$2(parsed) || !("value" in parsed)) return parsed;
 	return parsed.value;
 }
 /**
@@ -7507,7 +7561,7 @@ var PREFIX_PAGE_BUDGET = 512;
 *   A throw is the point: a caller that cannot be answered completely must not
 *   be handed something that looks like a complete answer.
 */
-async function loadPrefixed(door, collection, prefix) {
+async function loadPrefixed(door, collection, prefix, decode = unwrapValue) {
 	const range = prefixRange(prefix);
 	const result = {};
 	let cursor = range?.lo ?? null;
@@ -7527,7 +7581,7 @@ async function loadPrefixed(door, collection, prefix) {
 		for (const row of rows) {
 			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
 			if (!row.id.startsWith(prefix)) continue;
-			result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+			result[row.id.slice(prefix.length)] = decode(row.data);
 		}
 		if (rows.length < PREFIX_PAGE_ROWS) return result;
 		const last = rows[rows.length - 1];
@@ -7537,6 +7591,32 @@ async function loadPrefixed(door, collection, prefix) {
 		cursor = last.id;
 	}
 }
+/**
+* Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
+*
+* `system-settings` stores the value ITSELF (`setSystem` / `door.set` write
+* `JSON.stringify(value)`), mostly scalars. The engine's `query` hands a KV row
+* back parsed only when its text is an object or an array; a scalar comes back
+* as `{ value: <its JSON text> }` — `"12h"` arrives as `{ value: '"12h"' }`.
+* That is not a value anyone stored, and guessing it back would misread a
+* stored object that happens to be `{ value: … }`. So the range read only
+* ENUMERATES the keys (same keyset walk and refusal as every prefix read
+* here), and each value is taken from `get`, which parses the row exactly
+* (D675). These reads are small and rare: a section's handful of keys when a
+* form opens, and the capability preferences once at boot.
+*/
+async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
+	const listed = await loadPrefixed(door, "system-settings", prefix, () => null);
+	const result = {};
+	for (const suffix of Object.keys(listed).filter(mayRead)) {
+		const value = await door.get({
+			collection: "system-settings",
+			key: `${prefix}${suffix}`
+		});
+		if (value !== void 0) result[suffix] = value;
+	}
+	return result;
+}
 async function replacePrefixed(door, collection, prefix, values, wrap) {
 	const range = prefixRange(prefix);
 	if (range !== null) await door.deleteWhere({
@@ -7558,6 +7638,24 @@ function createDoorSettingsView(addonId, door, sections) {
 		async readAddonStore() {
 			return loadPrefixed(door, "addon-settings", addonPrefix);
 		},
+		async readAddonStoreKeyResult(key) {
+			try {
+				const row = await door.get({
+					collection: "addon-settings",
+					key: `${addonPrefix}${key}`
+				});
+				return row === void 0 ? { kind: "absent" } : {
+					kind: "present",
+					value: unwrapValue(row)
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					reason: "store-read-failed",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+		},
 		async writeAddonStore(patch) {
 			await replacePrefixed(door, "addon-settings", addonPrefix, {
 				...await loadPrefixed(door, "addon-settings", addonPrefix),
@@ -7636,6 +7734,121 @@ function createDoorSettingsView(addonId, door, sections) {
 	};
 }
 //#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
+var serverSchema = z.object({
+	port: z.number().default(4443),
+	host: z.string().default("0.0.0.0"),
+	dataPath: z.string().default(DEFAULT_DATA_PATH)
+});
+var authSchema = z.object({
+	jwtSecret: z.string().nullable().default(null),
+	adminUsername: z.string().default("admin"),
+	adminPassword: z.string().default("changeme")
+});
+var hubSchema = z.object({
+	url: z.string().default("ws://localhost:4443/agent"),
+	token: z.string().default("")
+});
+var agentSchema = z.object({
+	name: z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: z.number().default(4444)
+});
+var tlsSchema = z.object({
+	/** Enable HTTPS (default: true) */
+	enabled: z.boolean().default(true),
+	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
+	certPath: z.string().optional(),
+	/** Path to custom key file (PEM). Required if certPath is set. */
+	keyPath: z.string().optional()
+});
+/**
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
+*
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
+*/
+var bootstrapAddonsSchema = z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: z.array(z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: z.array(z.string()).default([])
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+});
+//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -9965,125 +10178,22 @@ var import_js_yaml = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((ex
 var { Type, Schema, FAILSAFE_SCHEMA, JSON_SCHEMA, CORE_SCHEMA, DEFAULT_SCHEMA, load: load$1, loadAll, dump, YAMLException, types: types$3, safeLoad, safeLoadAll, safeDump } = import_js_yaml.default;
 import_js_yaml.default;
 //#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-var serverSchema = z.object({
-	port: z.number().default(4443),
-	host: z.string().default("0.0.0.0"),
-	dataPath: z.string().default(DEFAULT_DATA_PATH)
-});
-var authSchema = z.object({
-	jwtSecret: z.string().nullable().default(null),
-	adminUsername: z.string().default("admin"),
-	adminPassword: z.string().default("changeme")
-});
-var hubSchema = z.object({
-	url: z.string().default("ws://localhost:4443/agent"),
-	token: z.string().default("")
-});
-var agentSchema = z.object({
-	name: z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: z.number().default(4444)
-});
-var tlsSchema = z.object({
-	/** Enable HTTPS (default: true) */
-	enabled: z.boolean().default(true),
-	/** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-	certPath: z.string().optional(),
-	/** Path to custom key file (PEM). Required if certPath is set. */
-	keyPath: z.string().optional()
-});
+//#region src/kernel/bootstrap-config.ts
 /**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
+* config.yaml + env: loading, the section writer and the legacy `raw` view —
+* `ConfigManager`'s bootstrap layer, split out of `config-manager.ts` (D675)
+* so that file stays one class. The `console.*` calls are the documented
+* residuals described on `ConfigManager` (no logger exists yet at boot).
 */
-var bootstrapAddonsSchema = z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: z.array(z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: z.array(z.string()).default([])
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
-});
-//#endregion
-//#region src/kernel/config-manager.ts
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Sections that live in config.yaml. Everything else goes to the settings-store. */
+var BOOTSTRAP_SECTIONS = new Set([
+	"server",
+	"auth",
+	"mode"
+]);
 /**
 * Maps environment variable names to dot-notation config paths.
 * Only bootstrap-level env vars -- runtime settings come from the
@@ -10097,17 +10207,360 @@ var ENV_VAR_MAP = {
 	CAMSTACK_ADMIN_USER: "auth.adminUsername",
 	CAMSTACK_ADMIN_PASS: "auth.adminPassword"
 };
-var ConfigManager = class ConfigManager {
+/** config.yaml, env overrides applied, parsed. */
+function loadBootstrapConfig(configPath) {
+	const merged = applyEnvOverrides(asJsonObject(loadYaml(configPath)) ?? {});
+	const config = bootstrapSchema.parse(merged);
+	warnDefaultCredentials(config);
+	return config;
+}
+function writeBootstrapSection(configPath, section, data) {
+	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
+	let raw = {};
+	if (fs$17.existsSync(configPath)) raw = asJsonObject(load$1(fs$17.readFileSync(configPath, "utf-8"))) ?? {};
+	const existing = asJsonObject(raw[section]) ?? {};
+	raw[section] = {
+		...existing,
+		...data
+	};
+	const validation = bootstrapSchema.safeParse(raw);
+	if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
+	const tmpPath = `${configPath}.tmp`;
+	fs$17.writeFileSync(tmpPath, dump(raw, {
+		lineWidth: 120,
+		indent: 2,
+		quotingType: "\""
+	}), "utf-8");
+	fs$17.renameSync(tmpPath, configPath);
+	return validation.data;
+}
+/**
+* Returns a merged view of bootstrap config + runtime defaults for backward compat.
+*/
+function buildRawAppConfig(bootstrapConfig) {
+	const features = {
+		streaming: RUNTIME_DEFAULTS["features.streaming"],
+		notifications: RUNTIME_DEFAULTS["features.notifications"],
+		objectDetection: RUNTIME_DEFAULTS["features.objectDetection"],
+		remoteAccess: RUNTIME_DEFAULTS["features.remoteAccess"],
+		agentCluster: RUNTIME_DEFAULTS["features.agentCluster"],
+		smartHome: RUNTIME_DEFAULTS["features.smartHome"],
+		recordings: RUNTIME_DEFAULTS["features.recordings"],
+		backup: RUNTIME_DEFAULTS["features.backup"],
+		repl: RUNTIME_DEFAULTS["features.repl"]
+	};
+	return {
+		...bootstrapConfig,
+		features,
+		storage: {
+			provider: RUNTIME_DEFAULTS["storage.provider"],
+			locations: { ...RUNTIME_DEFAULTS["storage.locations"] }
+		},
+		logging: {
+			level: RUNTIME_DEFAULTS["logging.level"],
+			retentionDays: RUNTIME_DEFAULTS["logging.retentionDays"]
+		},
+		eventBus: { ringBufferSize: RUNTIME_DEFAULTS["eventBus.ringBufferSize"] },
+		retention: {
+			detectionEventsDays: RUNTIME_DEFAULTS["retention.detectionEventsDays"],
+			audioLevelsDays: RUNTIME_DEFAULTS["retention.audioLevelsDays"]
+		},
+		providers: [...RUNTIME_DEFAULTS["providers"]]
+	};
+}
+/**
+* Deep-set a value in a nested plain object using a dot-notation path.
+* Returns a new object (immutable).
+*/
+function setNested(obj, configPath, value) {
+	const [head, ...rest] = configPath.split(".");
+	if (!head) return obj;
+	if (rest.length === 0) return {
+		...obj,
+		[head]: value
+	};
+	const existing = obj[head];
+	const child = isRecord$1(existing) ? existing : {};
+	return {
+		...obj,
+		[head]: setNested(child, rest.join("."), value)
+	};
+}
+/**
+* Apply env var overrides onto the raw YAML object.
+* Only bootstrap-level env vars are applied.
+*/
+function applyEnvOverrides(raw) {
+	let result = { ...raw };
+	for (const [envKey, configPath] of Object.entries(ENV_VAR_MAP)) {
+		const envValue = process.env[envKey];
+		if (envValue === void 0 || envValue === "") continue;
+		const coerced = configPath === "server.port" ? Number(envValue) : envValue;
+		result = setNested(result, configPath, coerced);
+		console.log(`[ConfigManager] Env override applied: ${envKey} → ${configPath}`);
+	}
+	return result;
+}
+function loadYaml(configPath) {
+	if (!fs$17.existsSync(configPath)) {
+		console.warn(`[ConfigManager] Config file not found at: ${configPath}\n  → Using built-in defaults. Set CONFIG_PATH env var or create the file.\n  → Example path from project root: ./server/backend/data/config.yaml`);
+		return {};
+	}
+	const parsed = load$1(fs$17.readFileSync(configPath, "utf-8")) ?? {};
+	console.log(`[ConfigManager] Loaded config from: ${configPath}`);
+	return parsed;
+}
+function warnDefaultCredentials(config) {
+	if (config.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
+}
+//#endregion
+//#region src/kernel/store-settings-view.ts
+function createStoreSettingsView(addonId, cm) {
+	const viewAddonConfig = () => !cm.hasSyncStore() ? asJsonObject(cm.getBootstrap(`addons.${addonId}`)) ?? {} : cm.getAddonConfig(addonId);
+	const viewAddonDevice = (deviceId) => !cm.hasSyncStore() ? {} : cm.getAddonDevice(addonId, deviceId);
+	return {
+		async readAddonStore() {
+			return viewAddonConfig();
+		},
+		async readAddonStoreKeyResult(key) {
+			if (!cm.hasSyncStore()) return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: "settings store not wired"
+			};
+			try {
+				const all = cm.getAddonConfig(addonId);
+				return key in all ? {
+					kind: "present",
+					value: all[key]
+				} : { kind: "absent" };
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					reason: "store-read-failed",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+		},
+		async writeAddonStore(patch) {
+			const existing = viewAddonConfig();
+			cm.setAddonConfig(addonId, {
+				...existing,
+				...patch
+			});
+		},
+		async readDeviceStore(deviceId) {
+			return viewAddonDevice(String(deviceId));
+		},
+		async readDeviceStoreBatch(deviceIds) {
+			const out = /* @__PURE__ */ new Map();
+			for (const deviceId of deviceIds) try {
+				out.set(deviceId, viewAddonDevice(String(deviceId)));
+			} catch {
+				out.set(deviceId, {});
+			}
+			return out;
+		},
+		async writeDeviceStore(deviceId, patch) {
+			const key = String(deviceId);
+			const existing = viewAddonDevice(key);
+			cm.setAddonDevice(addonId, key, {
+				...existing,
+				...patch
+			});
+		},
+		async clearDeviceStore(deviceId) {
+			cm.clearAddonDevice(addonId, String(deviceId));
+		},
+		async readDeviceRuntimeState(deviceId) {
+			return cm.getDeviceRuntimeState(String(deviceId));
+		},
+		async writeDeviceRuntimeState(deviceId, data) {
+			cm.setDeviceRuntimeState(String(deviceId), data);
+		},
+		async clearDeviceRuntimeState(deviceId) {
+			cm.clearDeviceRuntimeState(String(deviceId));
+		},
+		async getSection(section) {
+			return cm.getSection(section);
+		},
+		async setSection(section, patch) {
+			const existing = cm.getSection(section);
+			cm.setSection(section, {
+				...existing,
+				...patch
+			});
+		}
+	};
+}
+//#endregion
+//#region src/kernel/system-settings-policy.ts
+/**
+* Which `system-settings` keys the STORE may answer, and which the kernel
+* loads from the door into memory at boot — D675.
+*
+* ## The store never outranks env + config.yaml for a bootstrap section
+*
+* `system-settings` holds, among other things, `auth.jwtSecret`,
+* `auth.adminUsername` and `auth.adminPassword` — written there by
+* `local-auth` (and by older builds) next to `auth.tokenExpiry`. The live
+* container supplies the same three from env (`CAMSTACK_JWT_SECRET`,
+* `CAMSTACK_ADMIN_USER`, `CAMSTACK_ADMIN_PASS`). While the store layer was
+* skipped (every read since D231) env won by accident. Merging the store back
+* in "highest priority" would let a stale DB copy replace the JWT secret —
+* invalidating every token — and change the login password.
+*
+* So a bootstrap-owned section is answered from env + config.yaml ONLY, and
+* the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
+* today `auth.tokenExpiry`, the one value the operator edits in the UI
+* (System → Authentication). Widening this list is a security decision, not a
+* convenience.
+*/
+/** Top-level sections whose authority is env + config.yaml (`bootstrapSchema`). */
+var BOOTSTRAP_OWNED_SECTIONS = new Set([
+	"mode",
+	"server",
+	"auth",
+	"hub",
+	"agent",
+	"tls",
+	"bootstrap"
+]);
+/** The only keys under a bootstrap-owned section the store may answer. */
+var STORE_READABLE_BOOTSTRAP_KEYS = new Set(["auth.tokenExpiry"]);
+/** May the settings store answer `key`, or is it env + config.yaml only? */
+function storeMayAnswer(key) {
+	const dot = key.indexOf(".");
+	const section = dot === -1 ? key : key.slice(0, dot);
+	if (!BOOTSTRAP_OWNED_SECTIONS.has(section)) return true;
+	return STORE_READABLE_BOOTSTRAP_KEYS.has(key);
+}
+/**
+* Key prefixes loaded from the door into memory ONCE at boot, so the
+* synchronous readers that need them (the capability registry's preference
+* readers, `capabilities.getPreference`) answer the persisted value after a
+* reboot. Capability preferences are the only prefix: every other synchronous
+* caller of `ConfigManager.get` either reads a bootstrap key or runs before the
+* door exists.
+*/
+var PRELOADED_SYSTEM_PREFIXES = ["capabilities."];
+/**
+* Single keys loaded the same way. `auth.tokenExpiry` is read synchronously on
+* every mint by the hub's `AuthService` (`AuthManager.signToken`).
+*/
+var PRELOADED_SYSTEM_KEYS = ["auth.tokenExpiry"];
+/** Is `key` served from the boot-time mirror when the engine is isolated? */
+function isPreloadedSystemKey(key) {
+	if (PRELOADED_SYSTEM_KEYS.includes(key)) return true;
+	return PRELOADED_SYSTEM_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+/**
+* The stored keys of `section` the store may answer (`storeMayAnswer`,
+* D675): everything for an ordinary section, only the allow-listed keys for a
+* bootstrap-owned one.
+*/
+function filterStoreSection(section, stored) {
+	const out = {};
+	for (const [key, value] of Object.entries(stored)) if (storeMayAnswer(`${section}.${key}`)) out[key] = value;
+	return out;
+}
+//#endregion
+//#region src/kernel/system-settings-mirror.ts
+function errorText$1(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+var SystemSettingsMirror = class {
+	state = { kind: "pending" };
+	/** The door the current read belongs to; a replaced door owns the mirror. */
+	door = null;
+	preload = null;
+	/**
+	* Writes to preloaded keys made through THIS process. They win over the boot
+	* read (they are newer) and survive a failed one, so an operator's Save is
+	* reported back even when the boot read was lost.
+	*/
+	writes = /* @__PURE__ */ new Map();
+	/** Start the ONE read for `door`. Called by `ConfigManager.setSettingsDoor`. */
+	load(door) {
+		this.door = door;
+		this.state = { kind: "pending" };
+		this.preload = this.read(door);
+	}
+	/** The in-flight / settled boot read, or `null` before any door. */
+	whenLoaded() {
+		return this.preload;
+	}
+	/**
+	* A preloaded key's value: `undefined` when the store holds none, or a THROW
+	* (`preload-pending` / `preload-failed`) when it is not known.
+	*/
+	get(key) {
+		if (this.writes.has(key)) return this.writes.get(key);
+		const state = this.state;
+		switch (state.kind) {
+			case "loaded": return state.values.get(key);
+			case "pending": throw new SettingsReadUnavailableError("ConfigManager.get", "preload-pending", `"${key}" is read from the boot-time mirror, whose one read has not settled yet`);
+			case "failed": throw new SettingsReadUnavailableError("ConfigManager.get", "preload-failed", `"${key}" is unknown: the boot-time read of the settings store failed (${state.error})`);
+		}
+	}
+	/** Record a write to a preloaded key so the mirror reports it. */
+	noteWrite(key, value) {
+		if (isPreloadedSystemKey(key)) this.writes.set(key, value);
+	}
+	/** Every row under the preloaded prefixes plus each preloaded key. Never rejects. */
+	async read(door) {
+		try {
+			const values = /* @__PURE__ */ new Map();
+			for (const prefix of PRELOADED_SYSTEM_PREFIXES) {
+				const rows = await loadSystemSettingsPrefix(door, prefix);
+				for (const [suffix, value] of Object.entries(rows)) values.set(`${prefix}${suffix}`, value);
+			}
+			for (const key of PRELOADED_SYSTEM_KEYS) {
+				const value = await door.get({
+					collection: "system-settings",
+					key
+				});
+				if (value !== void 0) values.set(key, value);
+			}
+			if (this.door === door) this.state = {
+				kind: "loaded",
+				values
+			};
+			return {
+				kind: "loaded",
+				keyCount: values.size
+			};
+		} catch (err) {
+			const error = errorText$1(err);
+			if (this.door === door) this.state = {
+				kind: "failed",
+				error
+			};
+			return {
+				kind: "failed",
+				error
+			};
+		}
+	}
+};
+//#endregion
+//#region src/kernel/config-manager.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+var ConfigManager = class {
 	configPath;
 	bootstrapConfig;
 	settingsStore = null;
 	settingsDoor = null;
+	/** Boot-time mirror of the preloaded `system-settings` keys (door mode, D675). */
+	systemMirror = new SystemSettingsMirror();
 	constructor(configPath) {
 		this.configPath = configPath;
-		const rawYaml = this.loadYaml();
-		const merged = this.applyEnvOverrides(asJsonObject(rawYaml) ?? {});
-		this.bootstrapConfig = bootstrapSchema.parse(merged);
-		this.warnDefaultCredentials();
+		this.bootstrapConfig = loadBootstrapConfig(configPath);
 	}
 	/**
 	* Wire the settings-store backend. Called once, after the `settings-store`
@@ -10124,6 +10577,25 @@ var ConfigManager = class ConfigManager {
 	*/
 	setSettingsDoor(door) {
 		this.settingsDoor = door;
+		this.systemMirror.load(door);
+	}
+	/**
+	* Resolves once the boot read of the preloaded `system-settings` keys has
+	* settled — the hook the addon registry uses to log it and to replay the
+	* capability preferences onto providers that registered before it (D675).
+	* `null` when no door has been wired (a sync store needs no preload).
+	*/
+	whenSystemSettingsPreloaded() {
+		return this.systemMirror.whenLoaded();
+	}
+	backendMode() {
+		if (this.settingsStore !== null) return "store";
+		if (this.settingsDoor !== null) return "door";
+		return "unwired";
+	}
+	/** The refusal every sync addon-scoped reader raises without a sync store. */
+	refuseSyncRead(reader, subject) {
+		return this.backendMode() === "door" ? new SettingsReadUnavailableError(`ConfigManager.${reader}`, "door-only", `${subject}: the settings engine is isolated and has no synchronous handle — read it through the settings view (createSettingsView / readAddonStoreResult)`) : new SettingsReadUnavailableError(`ConfigManager.${reader}`, "not-wired", `${subject}: no settings backend is wired yet`);
 	}
 	get(configPath) {
 		return this.resolveConfigValue(configPath);
@@ -10131,35 +10603,52 @@ var ConfigManager = class ConfigManager {
 	resolveConfigValue(configPath) {
 		const bootstrapValue = this.getFromBootstrap(configPath);
 		if (bootstrapValue !== void 0) return bootstrapValue;
-		if (this.settingsStore !== null) {
-			const storeValue = this.settingsStore.getSystem(configPath);
-			if (storeValue !== void 0) return storeValue;
-			const nested = this.getNestedFromSystemSettings(configPath);
-			if (nested !== null) return nested;
-		}
+		const storeValue = this.readStoreLayer(configPath);
+		if (storeValue !== void 0) return storeValue;
 		if (configPath in RUNTIME_DEFAULTS) return RUNTIME_DEFAULTS[configPath];
 		return this.getFromRuntimeDefaults(configPath) ?? void 0;
 	}
 	/**
-	* Write a value to the settings-store.
-	* Throws if the settings store is not yet wired.
+	* The settings-store layer of {@link get}: the stored value, `undefined`
+	* when the store holds nothing (or may not answer this key), or a THROW
+	* when the store cannot be asked.
+	*/
+	readStoreLayer(configPath) {
+		if (!storeMayAnswer(configPath)) return void 0;
+		switch (this.backendMode()) {
+			case "store": {
+				const store = this.settingsStore;
+				if (store === null) return void 0;
+				const storeValue = store.getSystem(configPath);
+				if (storeValue !== void 0) return storeValue;
+				return this.getNestedFromSystemSettings(configPath) ?? void 0;
+			}
+			case "door":
+				if (isPreloadedSystemKey(configPath)) return this.systemMirror.get(configPath);
+				throw new SettingsReadUnavailableError("ConfigManager.get", "door-only", `"${configPath}" may be stored, and the isolated engine cannot be read synchronously — only ${[...PRELOADED_SYSTEM_PREFIXES, ...PRELOADED_SYSTEM_KEYS].join(", ")} are mirrored at boot`);
+			case "unwired": return;
+		}
+	}
+	/**
+	* Write a value to the settings-store. Resolves only once the write LANDED:
+	* on the isolated engine it awaits the door, and a failed write REJECTS and
+	* is not reported back by the mirror (D675 — it used to be fire-and-forget,
+	* so a lost write read as saved for the life of the process). Rejects when
+	* no store is wired.
 	*/
-	set(key, value) {
+	async set(key, value) {
 		if (this.settingsStore !== null) {
 			this.settingsStore.setSystem(key, value);
 			return;
 		}
-		if (this.settingsDoor !== null) {
-			this.settingsDoor.set({
-				collection: "system-settings",
-				key,
-				value
-			}).catch((err) => {
-				console.error("[ConfigManager] isolated settings-store write failed", err);
-			});
-			return;
-		}
-		throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+		const door = this.settingsDoor;
+		if (door === null) throw new SettingsReadUnavailableError("ConfigManager.set", "not-wired", `"${key}" cannot be written: no settings backend is wired yet`);
+		await door.set({
+			collection: "system-settings",
+			key,
+			value
+		});
+		this.systemMirror.noteWrite(key, value);
 	}
 	/**
 	* Bulk-read all keys that belong to a logical section.
@@ -10175,17 +10664,40 @@ var ConfigManager = class ConfigManager {
 	* shadowing the rest of the section that only lives in config.yaml.
 	* The kernel is agnostic about the store backend — any `ISettingsStore`
 	* implementation (sqlite, redis, in-memory, …) behaves identically here.
+	*
+	* D675: a bootstrap-owned section takes ONLY allow-listed keys from the
+	* store (a stored `auth.jwtSecret` never replaces env), and with only the
+	* door wired this sync read THROWS — the settings view's `getSection` reads
+	* the door.
 	*/
 	getSection(section) {
+		const mode = this.backendMode();
+		if (mode === "door") throw new SettingsReadUnavailableError("ConfigManager.getSection", "door-only", `section "${section}": the settings engine is isolated — read it through the settings view (ctx.settings.getSection)`);
+		const merged = this.sectionBase(section);
+		if (mode === "store") {
+			const nested = this.getNestedFromSystemSettings(section);
+			if (nested) Object.assign(merged, filterStoreSection(section, nested));
+		}
+		return merged;
+	}
+	/** Runtime defaults, then config.yaml + env — the layers under the store. */
+	sectionBase(section) {
 		const merged = {};
 		const defaults = asJsonObject(this.getFromRuntimeDefaults(section));
 		if (defaults) Object.assign(merged, defaults);
 		const bootstrapSection = asJsonObject({ ...this.bootstrapConfig }[section]);
 		if (bootstrapSection) Object.assign(merged, bootstrapSection);
-		if (this.settingsStore !== null) {
-			const nested = this.getNestedFromSystemSettings(section);
-			if (nested) Object.assign(merged, nested);
-		}
+		return merged;
+	}
+	/**
+	* {@link getSection} through the async door — what the door-backed settings
+	* view answers (D675). Same layers, same allow-list; a failed door read
+	* THROWS rather than handing back the defaults as if nothing were stored.
+	*/
+	async readSectionThroughDoor(door, section) {
+		const merged = this.sectionBase(section);
+		const stored = await loadSystemSettingsPrefix(door, `${section}.`, (key) => storeMayAnswer(`${section}.${key}`));
+		Object.assign(merged, filterStoreSection(section, stored));
 		return merged;
 	}
 	/**
@@ -10196,44 +10708,58 @@ var ConfigManager = class ConfigManager {
 		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
 		for (const [key, value] of Object.entries(data)) this.settingsStore.setSystem(`${section}.${key}`, value);
 	}
-	/** Read all config for an addon from addon_settings. */
+	/**
+	* Read all config for an addon — SYNC store only. THROWS without one: its
+	* old bootstrap fallback answered `{}` for every addon on every
+	* isolated-engine hub (D675). Async three-way: {@link readAddonGlobalStrict}.
+	*/
 	getAddonConfig(addonId) {
 		if (this.settingsStore !== null) return this.settingsStore.getAllAddon(addonId);
-		return asJsonObject(this.getFromBootstrap(`addons.${addonId}`)) ?? {};
+		throw this.refuseSyncRead("getAddonConfig", `addon "${addonId}"`);
+	}
+	/**
+	* One addon's global store, three-way (D675): the record, `{}` when the
+	* store ANSWERED with nothing, or a THROW when it could not be asked.
+	* Behind `addonSettingsRaw.getGlobal` and `$hub.getAddonConfig`.
+	*/
+	async readAddonGlobalStrict(addonId) {
+		const read = await this.createSettingsView(addonId).readAddonStoreResult();
+		switch (read.kind) {
+			case "value": return read.value;
+			case "missing": return {};
+			case "failed": throw new SettingsReadUnavailableError("ConfigManager.readAddonGlobalStrict", this.backendMode() === "unwired" ? "not-wired" : "read-failed", `addon "${addonId}": ${read.error}`);
+		}
+	}
+	/** One addon's per-device overrides, three-way like {@link readAddonGlobalStrict}. */
+	async readAddonDeviceStrict(addonId, deviceId) {
+		const door = this.settingsDoor;
+		switch (this.backendMode()) {
+			case "store": return this.getAddonDevice(addonId, String(deviceId));
+			case "door":
+				if (door === null) break;
+				try {
+					return await this.createDoorBackedSettingsView(addonId, door).readDeviceStore(deviceId);
+				} catch (err) {
+					throw new SettingsReadUnavailableError("ConfigManager.readAddonDeviceStrict", "read-failed", `addon "${addonId}" device ${deviceId}: ${errorText(err)}`);
+				}
+			case "unwired": break;
+		}
+		throw this.refuseSyncRead("readAddonDeviceStrict", `addon "${addonId}" device ${deviceId}`);
 	}
 	/** Write (bulk-replace) config for an addon to addon_settings. */
 	setAddonConfig(addonId, config) {
 		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
 		this.settingsStore.setAllAddon(addonId, config);
 	}
-	/** Read all config for a provider from provider_settings. */
-	getProviderConfig(providerId) {
-		if (this.settingsStore !== null) return this.settingsStore.getAllProvider(providerId);
-		return {};
-	}
-	/** Write (upsert) a single key for a provider to provider_settings. */
-	setProviderConfig(providerId, key, value) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setProvider(providerId, key, value);
-	}
-	/** Read all config for a device from device_settings. */
-	getDeviceConfig(deviceId) {
-		if (this.settingsStore !== null) return this.settingsStore.getAllDevice(deviceId);
-		return {};
-	}
-	/** Write (upsert) a single key for a device to device_settings. */
-	setDeviceConfig(deviceId, key, value) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setDevice(deviceId, key, value);
-	}
 	/**
 	* Read per-device overrides for a specific addon. Returns a flat record
 	* of field → value. Missing keys fall back to the addon-global value via
 	* `getAddonConfig(addonId)` — that composition is the resolver service's
 	* responsibility, not ConfigManager's.
+	* SYNC store only — THROWS without one (D675); async: {@link readAddonDeviceStrict}.
 	*/
 	getAddonDevice(addonId, deviceId) {
-		if (this.settingsStore === null) return {};
+		if (this.settingsStore === null) throw this.refuseSyncRead("getAddonDevice", `addon "${addonId}" device "${deviceId}"`);
 		return this.settingsStore.getAddonDevice(addonId, deviceId);
 	}
 	/**
@@ -10254,12 +10780,11 @@ var ConfigManager = class ConfigManager {
 		this.settingsStore.clearAddonDevice(addonId, deviceId);
 	}
 	/**
-	* The device's persisted runtime-state blob. `{}` before the settings store
-	* is wired — the same answer as "this device has never persisted a slice",
-	* which is what every caller already handles.
+	* The device's persisted runtime-state blob. THROWS before the store is
+	* wired: a store not asked is not an empty row (D677, D675).
 	*/
 	getDeviceRuntimeState(deviceId) {
-		if (this.settingsStore === null) return {};
+		if (this.settingsStore === null) throw this.refuseSyncRead("getDeviceRuntimeState", `runtime state of device ${deviceId}`);
 		return this.settingsStore.getDeviceRuntimeState(deviceId);
 	}
 	/**
@@ -10327,6 +10852,7 @@ var ConfigManager = class ConfigManager {
 					};
 				}
 			},
+			readAddonStoreKeyResult: (key) => active().readAddonStoreKeyResult(key),
 			writeAddonStore: (patch) => active().writeAddonStore(patch),
 			readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
 			readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
@@ -10342,81 +10868,39 @@ var ConfigManager = class ConfigManager {
 	/** The async-door backend of {@link createSettingsView}. */
 	createDoorBackedSettingsView(addonId, door) {
 		return createDoorSettingsView(addonId, door, {
-			getSection: (section) => this.getSection(section),
+			getSection: (section) => this.readSectionThroughDoor(door, section),
 			setSection: async (section, patch) => {
-				for (const [key, value] of Object.entries(patch)) await door.set({
-					collection: "system-settings",
-					key: `${section}.${key}`,
-					value
-				});
+				for (const [key, value] of Object.entries(patch)) {
+					const fullKey = `${section}.${key}`;
+					await door.set({
+						collection: "system-settings",
+						key: fullKey,
+						value
+					});
+					this.systemMirror.noteWrite(fullKey, value);
+				}
 			}
 		});
 	}
 	/** The sync-`ISettingsStore` backend of {@link createSettingsView}. */
 	createStoreSettingsView(addonId) {
-		const cm = this;
-		return {
-			async readAddonStore() {
-				return cm.getAddonConfig(addonId);
-			},
-			async writeAddonStore(patch) {
-				const existing = cm.getAddonConfig(addonId);
-				cm.setAddonConfig(addonId, {
-					...existing,
-					...patch
-				});
-			},
-			async readDeviceStore(deviceId) {
-				return cm.getAddonDevice(addonId, String(deviceId));
-			},
-			async readDeviceStoreBatch(deviceIds) {
-				const out = /* @__PURE__ */ new Map();
-				for (const deviceId of deviceIds) try {
-					out.set(deviceId, cm.getAddonDevice(addonId, String(deviceId)));
-				} catch {
-					out.set(deviceId, {});
-				}
-				return out;
-			},
-			async writeDeviceStore(deviceId, patch) {
-				const key = String(deviceId);
-				const existing = cm.getAddonDevice(addonId, key);
-				cm.setAddonDevice(addonId, key, {
-					...existing,
-					...patch
-				});
-			},
-			async clearDeviceStore(deviceId) {
-				cm.clearAddonDevice(addonId, String(deviceId));
-			},
-			async readDeviceRuntimeState(deviceId) {
-				return cm.getDeviceRuntimeState(String(deviceId));
-			},
-			async writeDeviceRuntimeState(deviceId, data) {
-				cm.setDeviceRuntimeState(String(deviceId), data);
-			},
-			async clearDeviceRuntimeState(deviceId) {
-				cm.clearDeviceRuntimeState(String(deviceId));
-			},
-			async getSection(section) {
-				return cm.getSection(section);
-			},
-			async setSection(section, patch) {
-				const existing = cm.getSection(section);
-				cm.setSection(section, {
-					...existing,
-					...patch
-				});
-			}
-		};
+		return createStoreSettingsView(addonId, this);
+	}
+	/** Is a SYNC `ISettingsStore` wired? (The store-backed view's D294-window test.) */
+	hasSyncStore() {
+		return this.settingsStore !== null;
 	}
 	getBootstrap(configPath) {
 		return this.getFromBootstrap(configPath);
 	}
-	/** Features accessor -- reads from settings-store when available, falls back to RUNTIME_DEFAULTS */
+	/**
+	* Features — the sync store when wired, else RUNTIME_DEFAULTS DELIBERATELY
+	* (not `get()`, which refuses in door mode, D675): nothing writes
+	* `features.*` beyond sqlite-settings' first-boot seed of these defaults.
+	*/
 	get features() {
 		const g = (key) => {
-			const storeValue = this.get(`features.${key}`);
+			const storeValue = this.settingsStore !== null ? this.get(`features.${key}`) : void 0;
 			if (typeof storeValue === "boolean") return storeValue;
 			return RUNTIME_DEFAULTS[`features.${key}`];
 		};
@@ -10432,115 +10916,16 @@ var ConfigManager = class ConfigManager {
 			repl: g("repl")
 		};
 	}
-	/**
-	* Returns a merged view of bootstrap config + runtime defaults for backward compat.
-	*/
+	/** Bootstrap config + runtime defaults, for backward compat. */
 	get raw() {
-		const features = {
-			streaming: RUNTIME_DEFAULTS["features.streaming"],
-			notifications: RUNTIME_DEFAULTS["features.notifications"],
-			objectDetection: RUNTIME_DEFAULTS["features.objectDetection"],
-			remoteAccess: RUNTIME_DEFAULTS["features.remoteAccess"],
-			agentCluster: RUNTIME_DEFAULTS["features.agentCluster"],
-			smartHome: RUNTIME_DEFAULTS["features.smartHome"],
-			recordings: RUNTIME_DEFAULTS["features.recordings"],
-			backup: RUNTIME_DEFAULTS["features.backup"],
-			repl: RUNTIME_DEFAULTS["features.repl"]
-		};
-		return {
-			...this.bootstrapConfig,
-			features,
-			storage: {
-				provider: RUNTIME_DEFAULTS["storage.provider"],
-				locations: { ...RUNTIME_DEFAULTS["storage.locations"] }
-			},
-			logging: {
-				level: RUNTIME_DEFAULTS["logging.level"],
-				retentionDays: RUNTIME_DEFAULTS["logging.retentionDays"]
-			},
-			eventBus: { ringBufferSize: RUNTIME_DEFAULTS["eventBus.ringBufferSize"] },
-			retention: {
-				detectionEventsDays: RUNTIME_DEFAULTS["retention.detectionEventsDays"],
-				audioLevelsDays: RUNTIME_DEFAULTS["retention.audioLevelsDays"]
-			},
-			providers: [...RUNTIME_DEFAULTS["providers"]]
-		};
+		return buildRawAppConfig(this.bootstrapConfig);
 	}
-	/** Sections that live in config.yaml. Everything else goes to the settings-store. */
-	static BOOTSTRAP_SECTIONS = new Set([
-		"server",
-		"auth",
-		"mode"
-	]);
 	/**
-	* Atomically update one top-level section of config.yaml and sync in-memory.
-	* Only bootstrap sections (server, auth, mode) are written to YAML.
-	* Runtime settings must use setSection() which writes to the settings-store.
+	* Atomically update one top-level bootstrap section (server, auth, mode) of
+	* config.yaml and sync in-memory. Runtime settings use setSection().
 	*/
 	update(section, data) {
-		if (!ConfigManager.BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
-		let raw = {};
-		if (fs$17.existsSync(this.configPath)) raw = asJsonObject(load$1(fs$17.readFileSync(this.configPath, "utf-8"))) ?? {};
-		const existing = asJsonObject(raw[section]) ?? {};
-		raw[section] = {
-			...existing,
-			...data
-		};
-		const validation = bootstrapSchema.safeParse(raw);
-		if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
-		const tmpPath = `${this.configPath}.tmp`;
-		fs$17.writeFileSync(tmpPath, dump(raw, {
-			lineWidth: 120,
-			indent: 2,
-			quotingType: "\""
-		}), "utf-8");
-		fs$17.renameSync(tmpPath, this.configPath);
-		this.bootstrapConfig = validation.data;
-	}
-	/**
-	* Deep-set a value in a nested plain object using a dot-notation path.
-	* Returns a new object (immutable).
-	*/
-	setNested(obj, configPath, value) {
-		const [head, ...rest] = configPath.split(".");
-		if (!head) return obj;
-		if (rest.length === 0) return {
-			...obj,
-			[head]: value
-		};
-		const existing = obj[head];
-		const child = isRecord(existing) ? existing : {};
-		return {
-			...obj,
-			[head]: this.setNested(child, rest.join("."), value)
-		};
-	}
-	/**
-	* Apply env var overrides onto the raw YAML object.
-	* Only bootstrap-level env vars are applied.
-	*/
-	applyEnvOverrides(raw) {
-		let result = { ...raw };
-		for (const [envKey, configPath] of Object.entries(ENV_VAR_MAP)) {
-			const envValue = process.env[envKey];
-			if (envValue === void 0 || envValue === "") continue;
-			const coerced = configPath === "server.port" ? Number(envValue) : envValue;
-			result = this.setNested(result, configPath, coerced);
-			console.log(`[ConfigManager] Env override applied: ${envKey} → ${configPath}`);
-		}
-		return result;
-	}
-	loadYaml() {
-		if (!fs$17.existsSync(this.configPath)) {
-			console.warn(`[ConfigManager] Config file not found at: ${this.configPath}\n  → Using built-in defaults. Set CONFIG_PATH env var or create the file.\n  → Example path from project root: ./server/backend/data/config.yaml`);
-			return {};
-		}
-		const parsed = load$1(fs$17.readFileSync(this.configPath, "utf-8")) ?? {};
-		console.log(`[ConfigManager] Loaded config from: ${this.configPath}`);
-		return parsed;
-	}
-	warnDefaultCredentials() {
-		if (this.bootstrapConfig.auth.adminPassword === "changeme") console.warn("[ConfigManager] Warning: Using default admin password \"changeme\". Set auth.adminPassword in your config.yaml or the CAMSTACK_ADMIN_PASS env var.");
+		this.bootstrapConfig = writeBootstrapSection(this.configPath, section, data);
 	}
 	getFromBootstrap(configPath) {
 		const keys = configPath.split(".");
@@ -96043,4 +96428,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };