@camstack/system 1.2.390 → 1.2.392

package/dist/kernel/outbound-queue-watch.d.ts

@@ -1,94 +1,94 @@
 /**
- * outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
- * release is timestamped (D446).
- *
- * ## The blind spot this closes
- *
- * On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
- * (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
- * forced compaction, with ~4 % of JS heap alongside, and each time released in
- * one instant with no line from any owner. The investigation excluded "every
- * socket write queue" by summing `writableLength` over
- * `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
- *
- * `_getActiveHandles()` lists only handles that keep the loop alive. An
- * UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
- * unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
- * `socket.unref()`). So the one outbound plane that writes to another MACHINE
- * — where a reader that stops draining is the ordinary failure — was never in
- * the sum. The UDS children were in it, but only as a total, at one instant,
- * by hand.
- *
- * ## What this is
- *
- * A pure gate over per-peer queue depths the heartbeat reads on every probe:
- * the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
- * the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
- * nothing else:
- *
- *  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
- *    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
- *    depth and how long it has held — at most once per
- *    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
- *  - a named peer whose queue then falls under half the threshold, or that
- *    vanishes from the readings (its socket died — which is how a queue is
- *    dropped in one instant), is reported as RELEASED with its peak and the
- *    hold, so the release the episodes never logged has a line and a peer;
- *  - a burst that drains inside the sustain window says nothing. Backpressure
- *    measures LIVENESS, not identity (D444): a peer momentarily behind is
- *    coming back.
- *
- * ## What it is NOT
- *
- * Not a bound. It terminates nothing: a UDS child whose channel is destroyed
- * loses every in-flight call, and a mesh socket Moleculer reconnects on its
- * own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
- * whose client is expendable. Here the line is the deliverable; what to do
- * about a peer that holds is decided with the peer named, not before.
- */
+* outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
+* release is timestamped (D446).
+*
+* ## The blind spot this closes
+*
+* On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
+* (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
+* forced compaction, with ~4 % of JS heap alongside, and each time released in
+* one instant with no line from any owner. The investigation excluded "every
+* socket write queue" by summing `writableLength` over
+* `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
+*
+* `_getActiveHandles()` lists only handles that keep the loop alive. An
+* UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
+* unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
+* `socket.unref()`). So the one outbound plane that writes to another MACHINE
+* — where a reader that stops draining is the ordinary failure — was never in
+* the sum. The UDS children were in it, but only as a total, at one instant,
+* by hand.
+*
+* ## What this is
+*
+* A pure gate over per-peer queue depths the heartbeat reads on every probe:
+* the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
+* the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
+* nothing else:
+*
+*  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
+*    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
+*    depth and how long it has held — at most once per
+*    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
+*  - a named peer whose queue then falls under half the threshold, or that
+*    vanishes from the readings (its socket died — which is how a queue is
+*    dropped in one instant), is reported as RELEASED with its peak and the
+*    hold, so the release the episodes never logged has a line and a peer;
+*  - a burst that drains inside the sustain window says nothing. Backpressure
+*    measures LIVENESS, not identity (D444): a peer momentarily behind is
+*    coming back.
+*
+* ## What it is NOT
+*
+* Not a bound. It terminates nothing: a UDS child whose channel is destroyed
+* loses every in-flight call, and a mesh socket Moleculer reconnects on its
+* own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
+* whose client is expendable. Here the line is the deliverable; what to do
+* about a peer that holds is decided with the peer named, not before.
+*/
 /** 64 MiB. Below this a queue is a burst on a busy peer (the orchestrator's
- *  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
- *  retention with a name. */
+*  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
+*  retention with a name. */
 export declare const OUTBOUND_QUEUE_THRESHOLD_BYTES: number;
 /** Matches the ArrayBuffer census sustain: a minute above the bound. */
-export declare const OUTBOUND_QUEUE_SUSTAIN_MS = 60000;
+export declare const OUTBOUND_QUEUE_SUSTAIN_MS = 6e4;
 /** A held queue is re-named every ten minutes, not every probe. */
 export declare const OUTBOUND_QUEUE_COOLDOWN_MS: number;
 /** One outbound channel's queue depth at one probe. `peerId` carries its
- *  plane as a prefix (`uds:<childId>`, `mesh:<nodeId>`). */
+*  plane as a prefix (`uds:<childId>`, `mesh:<nodeId>`). */
 export interface OutboundQueueReading {
-    readonly peerId: string;
-    readonly bytes: number;
+	readonly peerId: string;
+	readonly bytes: number;
 }
 export type OutboundQueueVerdict = {
-    readonly kind: 'sustained';
-    readonly peerId: string;
-    readonly bytes: number;
-    readonly peakBytes: number;
-    readonly heldForMs: number;
+	readonly kind: "sustained";
+	readonly peerId: string;
+	readonly bytes: number;
+	readonly peakBytes: number;
+	readonly heldForMs: number;
 } | {
-    readonly kind: 'released';
-    readonly peerId: string;
-    readonly peakBytes: number;
-    readonly toBytes: number;
-    readonly heldForMs: number;
-    /** The peer left the readings altogether — its socket is gone. */
-    readonly gone: boolean;
+	readonly kind: "released";
+	readonly peerId: string;
+	readonly peakBytes: number;
+	readonly toBytes: number;
+	readonly heldForMs: number;
+	/** The peer left the readings altogether — its socket is gone. */
+	readonly gone: boolean;
 };
 export interface OutboundQueueGateOptions {
-    readonly thresholdBytes?: number;
-    readonly sustainMs?: number;
-    readonly cooldownMs?: number;
+	readonly thresholdBytes?: number;
+	readonly sustainMs?: number;
+	readonly cooldownMs?: number;
 }
 export interface OutboundQueueGate {
-    /** Judge one probe's readings. Every peer is judged on its own. */
-    readonly observe: (readings: readonly OutboundQueueReading[], at: number) => readonly OutboundQueueVerdict[];
+	/** Judge one probe's readings. Every peer is judged on its own. */
+	readonly observe: (readings: readonly OutboundQueueReading[], at: number) => readonly OutboundQueueVerdict[];
 }
 /**
- * The pure decision — threshold, sustain, cooldown, release, gone — testable
- * without a socket.
- */
+* The pure decision — threshold, sustain, cooldown, release, gone — testable
+* without a socket.
+*/
 export declare function createOutboundQueueGate(options?: OutboundQueueGateOptions): OutboundQueueGate;
 /** The line for one verdict. Both carry the peer, the bytes and the hold;
- *  the sustained one also says why the older census could not see it. */
+*  the sustained one also says why the older census could not see it. */
 export declare function formatOutboundQueueVerdict(label: string, verdict: OutboundQueueVerdict): string;

package/dist/kernel/process-cpu-census.d.ts

@@ -1,74 +1,74 @@
 /**
- * A window shorter than this is not answered. Same rule and same reason as
- * `GC_CENSUS_MIN_WINDOW_MS`: the boot line spans milliseconds, and a percentage
- * computed over it is noise wearing a decimal point. The unread interval is
- * KEPT, so the next line describes it rather than losing it (D393 applied to a
- * rate, as D458 part 3 put it).
- */
-export declare const PROCESS_CPU_MIN_WINDOW_MS = 1000;
+* A window shorter than this is not answered. Same rule and same reason as
+* `GC_CENSUS_MIN_WINDOW_MS`: the boot line spans milliseconds, and a percentage
+* computed over it is noise wearing a decimal point. The unread interval is
+* KEPT, so the next line describes it rather than losing it (D393 applied to a
+* rate, as D458 part 3 put it).
+*/
+export declare const PROCESS_CPU_MIN_WINDOW_MS = 1e3;
 /** One thread's cumulative scheduled time, in whatever unit `/proc` counts. */
 export interface TaskTicks {
-    /** The thread name — `MainThread`, `V8Worker`, `libuv-worker`, … */
-    readonly comm: string;
-    /** Cumulative `utime + stime` for this thread. Units never leave this module. */
-    readonly ticks: number;
+	/** The thread name — `MainThread`, `V8Worker`, `libuv-worker`, … */
+	readonly comm: string;
+	/** Cumulative `utime + stime` for this thread. Units never leave this module. */
+	readonly ticks: number;
 }
 /** What V8's background threads cost, when the platform let us find out. */
 export interface V8WorkerCpu {
-    /** Percent of ONE core, over the same window as the process reading. */
-    readonly percentOfCore: number;
-    /** How many threads that is spread over — 4 is the usual platform pool. */
-    readonly threads: number;
+	/** Percent of ONE core, over the same window as the process reading. */
+	readonly percentOfCore: number;
+	/** How many threads that is spread over — 4 is the usual platform pool. */
+	readonly threads: number;
 }
 export interface ProcessCpuReading {
-    /** Percent of ONE core this process used across the window. */
-    readonly percentOfCore: number;
-    readonly windowMs: number;
-    /**
-     * `null` means UNKNOWN — not zero. Off Linux, or with `/proc` unreadable, or
-     * when the thread deltas cannot describe an interval, there is no reading,
-     * and the line says nothing rather than printing a zero somebody will quote.
-     */
-    readonly v8Workers: V8WorkerCpu | null;
+	/** Percent of ONE core this process used across the window. */
+	readonly percentOfCore: number;
+	readonly windowMs: number;
+	/**
+	* `null` means UNKNOWN — not zero. Off Linux, or with `/proc` unreadable, or
+	* when the thread deltas cannot describe an interval, there is no reading,
+	* and the line says nothing rather than printing a zero somebody will quote.
+	*/
+	readonly v8Workers: V8WorkerCpu | null;
 }
 export interface ProcessCpuCensus {
-    /** The window since the last read that ANSWERED. `null` when too short. */
-    read(at: number): ProcessCpuReading | null;
+	/** The window since the last read that ANSWERED. `null` when too short. */
+	read(at: number): ProcessCpuReading | null;
 }
 export interface ProcessCpuCensusOptions {
-    /** Cumulative user+system CPU for the whole process, in microseconds. */
-    readonly cpuUsageUs: () => number;
-    /** Per-thread cumulative ticks, or `null` when the platform cannot say. */
-    readonly readTasks: () => readonly TaskTicks[] | null;
-    readonly startedAt: number;
+	/** Cumulative user+system CPU for the whole process, in microseconds. */
+	readonly cpuUsageUs: () => number;
+	/** Per-thread cumulative ticks, or `null` when the platform cannot say. */
+	readonly readTasks: () => readonly TaskTicks[] | null;
+	readonly startedAt: number;
 }
 /**
- * The census. Always exists — `process.cpuUsage()` is available on every
- * platform Node runs on, so unlike the GC census there is no runtime in which
- * this has nothing to report.
- */
+* The census. Always exists — `process.cpuUsage()` is available on every
+* platform Node runs on, so unlike the GC census there is no runtime in which
+* this has nothing to report.
+*/
 export declare function createProcessCpuCensus(options: ProcessCpuCensusOptions): ProcessCpuCensus;
 /**
- * Per-thread ticks for THIS process, or `null` where that cannot be read.
- *
- * `/proc/self/task/<tid>/stat` is `pid (comm) state ppid …`, and `comm` may
- * itself contain spaces and parentheses — so the split is on the LAST `)`,
- * never on whitespace. `utime` and `stime` are the 12th and 13th fields after
- * it. Everything that can fail is inside the try: a non-Linux platform, a
- * container with `hidepid`, a thread that exits between the readdir and the
- * read. A thread that vanishes mid-scan is skipped rather than failing the
- * whole reading — it contributed to neither snapshot's total.
- */
+* Per-thread ticks for THIS process, or `null` where that cannot be read.
+*
+* `/proc/self/task/<tid>/stat` is `pid (comm) state ppid …`, and `comm` may
+* itself contain spaces and parentheses — so the split is on the LAST `)`,
+* never on whitespace. `utime` and `stime` are the 12th and 13th fields after
+* it. Everything that can fail is inside the try: a non-Linux platform, a
+* container with `hidepid`, a thread that exits between the readdir and the
+* read. A thread that vanishes mid-scan is skipped rather than failing the
+* whole reading — it contributed to neither snapshot's total.
+*/
 export declare function readSelfTaskTicks(): readonly TaskTicks[] | null;
 /**
- * The two fields, APPENDED LAST on the `[mem]` line — after everything D446,
- * D456 and D458 appended, so every Loki prefix written since 2026-08-29 still
- * matches (D446's rule).
- *
- * `procCpu` prints whenever there is a window, including at 0.0 %, because an
- * idle process is a reading and it is the one that says a runner is alive and
- * doing nothing. `v8WorkerCpu` is CONDITIONAL and its absence is the reading:
- * the platform could not be asked. It carries its thread count because "36.6 %
- * over four threads" and "36.6 % on one" are different faults.
- */
+* The two fields, APPENDED LAST on the `[mem]` line — after everything D446,
+* D456 and D458 appended, so every Loki prefix written since 2026-08-29 still
+* matches (D446's rule).
+*
+* `procCpu` prints whenever there is a window, including at 0.0 %, because an
+* idle process is a reading and it is the one that says a runner is alive and
+* doing nothing. `v8WorkerCpu` is CONDITIONAL and its absence is the reading:
+* the platform could not be asked. It carries its thread count because "36.6 %
+* over four threads" and "36.6 % on one" are different faults.
+*/
 export declare function formatProcessCpu(reading: ProcessCpuReading | null | undefined): string;

package/dist/kernel/provider-kind-drift.d.ts

@@ -1,12 +1,21 @@
-import { CapabilityDefinition } from '@camstack/types';
+/**
+* D4 — capability metadata cross-check.
+*
+* The `*.cap.ts` `CapabilityDefinition` is the single source of truth for
+* `kind` / `defaultActive`. The runtime `ProviderRegistration.kind` /
+* `defaultActive` survive only as deprecated optional hints. When an addon
+* still sets a hint and it disagrees with the cap definition, the kernel
+* logs this warning — the cap definition always wins.
+*/
+import type { CapabilityDefinition } from "@camstack/types";
 /** The deprecated runtime metadata hint carried on a `ProviderRegistration`. */
 export type ProviderKindHint = {
-    readonly kind?: 'native' | 'wrapper';
-    readonly defaultActive?: boolean;
+	readonly kind?: "native" | "wrapper";
+	readonly defaultActive?: boolean;
 };
 /**
- * Compare a runtime registration hint against the authoritative cap
- * definition. Returns a human-readable warning string when they disagree,
- * or `null` when the hint is absent or consistent.
- */
-export declare function describeProviderKindDrift(capName: string, capDef: Pick<CapabilityDefinition, 'kind' | 'defaultActive'>, hint: ProviderKindHint): string | null;
+* Compare a runtime registration hint against the authoritative cap
+* definition. Returns a human-readable warning string when they disagree,
+* or `null` when the hint is absent or consistent.
+*/
+export declare function describeProviderKindDrift(capName: string, capDef: Pick<CapabilityDefinition, "kind" | "defaultActive">, hint: ProviderKindHint): string | null;

package/dist/kernel/restart-coordinator.d.ts

@@ -1,90 +1,90 @@
 /**
- * RestartCoordinator — shared primitives for the framework live-update flow.
- *
- * Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md (P2)
- *
- * Three responsibilities:
- *   1) Marker schema + read/write/clear on `<dataDir>/.restart-pending`.
- *   2) Boot-side handoff: `readPendingRestart()` returns the payload exactly
- *      once and atomically clears the marker so a crashed second boot
- *      doesn't re-fire the completion event.
- *   3) Environment-agnostic `scheduleSelfRestart()` — Electron calls
- *      `app.relaunch()`+`app.exit(0)`, everything else `process.exit(0)`.
- *
- * The cap method that writes the marker lives in the addons cap (P3); this
- * module is the zero-dep primitive both the cap (writer) and PostBootService
- * (reader) call into.
- */
+* RestartCoordinator — shared primitives for the framework live-update flow.
+*
+* Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md (P2)
+*
+* Three responsibilities:
+*   1) Marker schema + read/write/clear on `<dataDir>/.restart-pending`.
+*   2) Boot-side handoff: `readPendingRestart()` returns the payload exactly
+*      once and atomically clears the marker so a crashed second boot
+*      doesn't re-fire the completion event.
+*   3) Environment-agnostic `scheduleSelfRestart()` — Electron calls
+*      `app.relaunch()`+`app.exit(0)`, everything else `process.exit(0)`.
+*
+* The cap method that writes the marker lives in the addons cap (P3); this
+* module is the zero-dep primitive both the cap (writer) and PostBootService
+* (reader) call into.
+*/
 /** Filename of the restart marker, written under `<dataDir>`. */
 export declare const RESTART_MARKER_FILE = ".restart-pending";
 /** Discriminated union of reasons the hub can be asked to restart. */
-export type RestartKind = 'framework-update' | 'framework-bulk-update' | 'manual' | 'system';
+export type RestartKind = "framework-update" | "framework-bulk-update" | "manual" | "system";
 /**
- * On-disk shape. All fields stable + load-bearing for the completion event.
- * Future kinds add new optional fields; existing readers ignore them.
- */
+* On-disk shape. All fields stable + load-bearing for the completion event.
+* Future kinds add new optional fields; existing readers ignore them.
+*/
 export interface PendingRestartMarker {
-    readonly kind: RestartKind;
-    readonly packageName?: string;
-    readonly fromVersion?: string;
-    readonly toVersion?: string;
-    readonly requestedBy?: string;
-    readonly requestedAt: number;
+	readonly kind: RestartKind;
+	readonly packageName?: string;
+	readonly fromVersion?: string;
+	readonly toVersion?: string;
+	readonly requestedBy?: string;
+	readonly requestedAt: number;
 }
 /** Resolve the marker path inside a data directory. */
 export declare function getRestartMarkerPath(dataDir: string): string;
 /**
- * Write the marker atomically. Existing marker is overwritten — the most
- * recent restart request wins.
- *
- * Uses write-then-rename so a crash mid-write leaves either the old marker
- * intact or no marker at all (never a half-written file).
- */
+* Write the marker atomically. Existing marker is overwritten — the most
+* recent restart request wins.
+*
+* Uses write-then-rename so a crash mid-write leaves either the old marker
+* intact or no marker at all (never a half-written file).
+*/
 export declare function writePendingRestart(dataDir: string, marker: PendingRestartMarker): void;
 /**
- * Read + consume the marker. Returns the parsed payload on success and
- * clears the file in the same tick (rename → unlink), so a crash between
- * read and emit won't replay the completion event on the next boot.
- *
- * Failure modes:
- *   - no marker present     → returns null
- *   - file unreadable / IO  → logs to console, returns null, leaves marker
- *   - JSON malformed        → logs, clears the marker, returns null
- *   - missing required `kind` / `requestedAt` → logs, clears, returns null
- *
- * "Clear on parse failure" is intentional: a stuck unparseable marker would
- * otherwise block every subsequent restart's completion event.
- *
- * NOTE: the `console.error` calls below are deliberate, documented
- * residuals. This is a stateless bootstrap utility invoked during hub
- * startup before `LogManager` / the Moleculer broker exist — there is no
- * `IScopedLogger` or `$hub.log` transport in scope. Threading a logger
- * parameter through every caller is out of scope for the D8 log-forwarding
- * work (which only touches `packages/kernel/src`).
- */
+* Read + consume the marker. Returns the parsed payload on success and
+* clears the file in the same tick (rename → unlink), so a crash between
+* read and emit won't replay the completion event on the next boot.
+*
+* Failure modes:
+*   - no marker present     → returns null
+*   - file unreadable / IO  → logs to console, returns null, leaves marker
+*   - JSON malformed        → logs, clears the marker, returns null
+*   - missing required `kind` / `requestedAt` → logs, clears, returns null
+*
+* "Clear on parse failure" is intentional: a stuck unparseable marker would
+* otherwise block every subsequent restart's completion event.
+*
+* NOTE: the `console.error` calls below are deliberate, documented
+* residuals. This is a stateless bootstrap utility invoked during hub
+* startup before `LogManager` / the Moleculer broker exist — there is no
+* `IScopedLogger` or `$hub.log` transport in scope. Threading a logger
+* parameter through every caller is out of scope for the D8 log-forwarding
+* work (which only touches `packages/kernel/src`).
+*/
 export declare function readPendingRestart(dataDir: string): PendingRestartMarker | null;
 /** Remove the marker if present. No-op if missing. */
 export declare function clearPendingRestart(dataDir: string): void;
 /**
- * Schedule a self-restart appropriate for the runtime:
- *   - Electron: `app.relaunch()` then `app.exit(0)` — the bundle handles the spawn.
- *   - Docker / standalone Node: `process.exit(0)` — the supervisor (compose
- *     `restart: unless-stopped`, systemd, pm2, …) brings the process back up.
- *
- * Caller is expected to have:
- *   1) Written the marker via `writePendingRestart`.
- *   2) Returned the cap-method response to the caller (so the WS doesn't
- *      drop mid-reply).
- *   3) Closed the Fastify instance gracefully (`await fastify.close()`).
- *
- * The 500ms delay is the same beat used by P3's cap method — kept here as a
- * default so non-cap callers (signal handlers, future flows) share the same
- * shutdown pacing.
- */
+* Schedule a self-restart appropriate for the runtime:
+*   - Electron: `app.relaunch()` then `app.exit(0)` — the bundle handles the spawn.
+*   - Docker / standalone Node: `process.exit(0)` — the supervisor (compose
+*     `restart: unless-stopped`, systemd, pm2, …) brings the process back up.
+*
+* Caller is expected to have:
+*   1) Written the marker via `writePendingRestart`.
+*   2) Returned the cap-method response to the caller (so the WS doesn't
+*      drop mid-reply).
+*   3) Closed the Fastify instance gracefully (`await fastify.close()`).
+*
+* The 500ms delay is the same beat used by P3's cap method — kept here as a
+* default so non-cap callers (signal handlers, future flows) share the same
+* shutdown pacing.
+*/
 export interface ScheduleSelfRestartOptions {
-    /** Delay before exit (ms). Default 500 — gives in-flight RPC time to drain. */
-    readonly delayMs?: number;
-    /** Override exit code. Default 0 (clean exit → supervisor restart). */
-    readonly exitCode?: number;
+	/** Delay before exit (ms). Default 500 — gives in-flight RPC time to drain. */
+	readonly delayMs?: number;
+	/** Override exit code. Default 0 (clean exit → supervisor restart). */
+	readonly exitCode?: number;
 }
 export declare function scheduleSelfRestart(options?: ScheduleSelfRestartOptions): void;

package/dist/kernel/settings-door-view.d.ts

@@ -1,30 +1,41 @@
-import { ISettingsStoreProvider } from '@camstack/types';
-import { SettingsViewBackend } from './config-manager.js';
 /**
- * Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
- *
- * `system-settings` stores the value ITSELF (`setSystem` / `door.set` write
- * `JSON.stringify(value)`), mostly scalars. The engine's `query` hands a KV row
- * back parsed only when its text is an object or an array; a scalar comes back
- * as `{ value: <its JSON text> }` — `"12h"` arrives as `{ value: '"12h"' }`.
- * That is not a value anyone stored, and guessing it back would misread a
- * stored object that happens to be `{ value: … }`. So the range read only
- * ENUMERATES the keys (same keyset walk and refusal as every prefix read
- * here), and each value is taken from `get`, which parses the row exactly
- * (D675). These reads are small and rare: a section's handful of keys when a
- * form opens, and the capability preferences once at boot.
- */
-export declare function loadSystemSettingsPrefix(door: ISettingsStoreProvider, prefix: string, 
-/** Suffixes the caller may read. A refused one is never FETCHED — the
- *  `auth` section's credential rows never enter this process (D675). */
-mayRead?: (suffix: string) => boolean): Promise<Record<string, unknown>>;
+* `AddonSettingsView` backed by the async `settings-store` door, not by a
+* synchronous `ISettingsStore` handle on the engine.
+*
+* Isolating sqlite-settings removes that handle from hub-main: the UDS proxy
+* for `data-store-provider` does not implement `getAllAddon` /
+* `setDeviceRuntimeState`. The door already does, as `get` / `set` / `query`,
+* and those calls `await` — so hub-main can yield while the engine's
+* `Statement.run` occupies the child.
+*
+* Storage layout is the in-process one (`addon-settings` keys
+* `"<addonId>.<key>"`, runtime state in `device-runtime-state`), not the
+* forked-runner namespaced tables. Device-manager still lives here.
+*/
+import type { ISettingsStoreProvider } from "@camstack/types";
+import type { SettingsViewBackend } from "./config-manager.js";
 /**
- * The `system-settings` section surface a door-backed view delegates to.
- * `getSection` is ASYNC: it reads the section through the door (D675) — a
- * synchronous reader has no store to ask when the engine is isolated.
- */
+* Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
+*
+* `system-settings` stores the value ITSELF (`setSystem` / `door.set` write
+* `JSON.stringify(value)`), mostly scalars. The engine's `query` hands a KV row
+* back parsed only when its text is an object or an array; a scalar comes back
+* as `{ value: <its JSON text> }` — `"12h"` arrives as `{ value: '"12h"' }`.
+* That is not a value anyone stored, and guessing it back would misread a
+* stored object that happens to be `{ value: … }`. So the range read only
+* ENUMERATES the keys (same keyset walk and refusal as every prefix read
+* here), and each value is taken from `get`, which parses the row exactly
+* (D675). These reads are small and rare: a section's handful of keys when a
+* form opens, and the capability preferences once at boot.
+*/
+export declare function loadSystemSettingsPrefix(door: ISettingsStoreProvider, prefix: string, mayRead?: (suffix: string) => boolean): Promise<Record<string, unknown>>;
+/**
+* The `system-settings` section surface a door-backed view delegates to.
+* `getSection` is ASYNC: it reads the section through the door (D675) — a
+* synchronous reader has no store to ask when the engine is isolated.
+*/
 export interface DoorSectionAccess {
-    getSection(section: string): Promise<Record<string, unknown>>;
-    setSection(section: string, patch: Record<string, unknown>): void | Promise<void>;
+	getSection(section: string): Promise<Record<string, unknown>>;
+	setSection(section: string, patch: Record<string, unknown>): void | Promise<void>;
 }
 export declare function createDoorSettingsView(addonId: string, door: ISettingsStoreProvider, sections: DoorSectionAccess): SettingsViewBackend;

package/dist/kernel/settings-read-error.d.ts

@@ -1,37 +1,35 @@
 /**
- * The refusal a SYNCHRONOUS settings reader raises when it cannot answer — D675.
- *
- * `ConfigManager`'s sync readers (`get`, `getSection`, `getAddonConfig`, …)
- * used to answer `{}` / a runtime default whenever no sync `ISettingsStore`
- * was wired. Since D231 isolated `sqlite-settings`, hub-main never gets one:
- * only the async door. So every such read answered "nothing stored" for the
- * life of the process, and "nothing stored" is exactly what a store holding
- * nothing looks like (D315, D393). The readers now refuse instead, and this
- * is what they throw, so a caller can tell "the store could not be asked"
- * from every other failure and from "never written".
- */
+* The refusal a SYNCHRONOUS settings reader raises when it cannot answer — D675.
+*
+* `ConfigManager`'s sync readers (`get`, `getSection`, `getAddonConfig`, …)
+* used to answer `{}` / a runtime default whenever no sync `ISettingsStore`
+* was wired. Since D231 isolated `sqlite-settings`, hub-main never gets one:
+* only the async door. So every such read answered "nothing stored" for the
+* life of the process, and "nothing stored" is exactly what a store holding
+* nothing looks like (D315, D393). The readers now refuse instead, and this
+* is what they throw, so a caller can tell "the store could not be asked"
+* from every other failure and from "never written".
+*/
 /**
- * Why the read was refused.
- *
- * - `door-only` — the engine is isolated: only the async door is wired, and a
- *   synchronous caller cannot await it. Use the settings view instead.
- * - `not-wired` — no backend at all yet (the D294 window, before
- *   `setSettingsStore` / `setSettingsDoor`).
- * - `preload-pending` — the key is one of the few the kernel loads from the
- *   door into memory at boot, and that one read has not settled yet.
- * - `preload-failed` — that boot read failed; the value is unknown until the
- *   next boot (one read, no polling — D3).
- * - `read-failed` — the async read itself threw.
- */
-export type SettingsReadRefusal = 'door-only' | 'not-wired' | 'preload-pending' | 'preload-failed' | 'read-failed';
+* Why the read was refused.
+*
+* - `door-only` — the engine is isolated: only the async door is wired, and a
+*   synchronous caller cannot await it. Use the settings view instead.
+* - `not-wired` — no backend at all yet (the D294 window, before
+*   `setSettingsStore` / `setSettingsDoor`).
+* - `preload-pending` — the key is one of the few the kernel loads from the
+*   door into memory at boot, and that one read has not settled yet.
+* - `preload-failed` — that boot read failed; the value is unknown until the
+*   next boot (one read, no polling — D3).
+* - `read-failed` — the async read itself threw.
+*/
+export type SettingsReadRefusal = "door-only" | "not-wired" | "preload-pending" | "preload-failed" | "read-failed";
 export declare class SettingsReadUnavailableError extends Error {
-    /** The reader that refused, e.g. `ConfigManager.getAddonConfig`. */
-    readonly reader: string;
-    readonly reason: SettingsReadRefusal;
-    readonly name = "SettingsReadUnavailableError";
-    constructor(
-    /** The reader that refused, e.g. `ConfigManager.getAddonConfig`. */
-    reader: string, reason: SettingsReadRefusal, detail: string);
+	/** The reader that refused, e.g. `ConfigManager.getAddonConfig`. */
+	readonly reader: string;
+	readonly reason: SettingsReadRefusal;
+	override readonly name = "SettingsReadUnavailableError";
+	constructor(reader: string, reason: SettingsReadRefusal, detail: string);
 }
 /** Narrow an unknown throw to {@link SettingsReadUnavailableError}. */
 export declare function isSettingsReadUnavailable(err: unknown): err is SettingsReadUnavailableError;