@camstack/addon-post-analysis 1.2.92 → 1.2.93

package/dist/{dist-BfrtqGyh.js → dist-DYoWeRRt.js}

@@ -29,7 +29,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-//#region ../types/dist/event-category-C0lyLd5U.mjs
+//#region ../types/dist/event-category-XfKNtfCc.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -68,6 +68,22 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AddonInstalled"] = "addon.installed";
 	EventCategory["AddonUninstalled"] = "addon.uninstalled";
 	EventCategory["AddonCrashed"] = "addon.crashed";
+	/**
+	* A RUNNER the D6 crash circuit-breaker gave up on — terminal.
+	*
+	* `AddonCrashed` is the routine, self-healing fact ("it crashed; it is being
+	* respawned"); this is the one that never resolves itself. Emitted exactly
+	* once per trip, by `process-service.ts`, carrying the node, the runner, the
+	* addons it hosted and the crash count that tripped the breaker.
+	*
+	* It exists because a runner marked terminally `failed` used to be SILENT:
+	* on 2026-08-18 the `recorder` runner died of three unhandled ffmpeg spawn
+	* errors, the breaker stopped respawning it (correctly), `/health` kept
+	* returning 200, and fleet-wide recording was gone for 3h15 before the
+	* operator's phone told him. The Notification Center's system-event intake
+	* consumes this category and maps it to the `addon-crash-loop` kind.
+	*/
+	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -14845,6 +14861,7 @@ var NcSystemEventKindSchema = _enum([
 	"node-offline",
 	"node-inference-unavailable",
 	"detection-blind",
+	"addon-crash-loop",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -15970,6 +15987,10 @@ var NC_CONDITION_CATALOG = [
 				value: "detection-blind",
 				label: "Camera detecting nothing"
 			},
+			{
+				value: "addon-crash-loop",
+				label: "Addon stopped after repeated crashes"
+			},
 			{
 				value: "addon-update-available",
 				label: "Addon update available"
@@ -38568,7 +38589,7 @@ function systemEventFilterApplies(kind, filter) {
 	switch (filter) {
 		case "deviceIds": return kind.startsWith("device-") || kind.startsWith("stream-") || kind === "detection-blind" || kind === "alarm-triggered" || kind === "export-completed";
 		case "deviceTypes": return kind.startsWith("device-") || kind === "detection-blind";
-		case "nodeIds": return kind.startsWith("node-") || kind === "addon-update-available" || kind === "addon-updated" || kind === "server-update-available" || kind === "server-updated";
+		case "nodeIds": return kind.startsWith("node-") || kind === "addon-crash-loop" || kind === "addon-update-available" || kind === "addon-updated" || kind === "server-update-available" || kind === "server-updated";
 		case "packageNames": return kind.endsWith("update-available") || kind === "addon-updated" || kind === "server-updated";
 	}
 }
@@ -39025,6 +39046,303 @@ function cosineSimilarity(a, b) {
 function hfModelUrl(repo, path) {
 	return `https://huggingface.co/${repo}/resolve/main/${path}`;
 }
+var MB = 1024 * 1024;
+var DEFAULT_POOL_MEMORY_POLICY = {
+	sampleIntervalMs: 6e4,
+	baselineSettleSamples: 5,
+	baselineSampleCount: 3,
+	restartMultiple: 4,
+	floorBytes: 1024 * MB,
+	ceilingBytes: 3072 * MB,
+	cooldownMs: 30 * 6e4,
+	maxRestartsPerWindow: 6,
+	restartWindowMs: 1440 * 6e4
+};
+/**
+* Resolve the policy from env overrides (`CAMSTACK_POOL_MEM_*`). Garbage or
+* absent values keep the default — an operator typo must never disable the
+* bound or set it to zero.
+*/
+function resolvePoolMemoryPolicy(env) {
+	const num = (key, fallback, min) => {
+		const raw = env[key];
+		if (raw === void 0) return fallback;
+		const parsed = Number(raw);
+		return Number.isFinite(parsed) && parsed >= min ? parsed : fallback;
+	};
+	const d = DEFAULT_POOL_MEMORY_POLICY;
+	return {
+		sampleIntervalMs: num("CAMSTACK_POOL_MEM_INTERVAL_MS", d.sampleIntervalMs, 5e3),
+		baselineSettleSamples: d.baselineSettleSamples,
+		baselineSampleCount: d.baselineSampleCount,
+		restartMultiple: num("CAMSTACK_POOL_MEM_MULTIPLE", d.restartMultiple, 1.5),
+		floorBytes: num("CAMSTACK_POOL_MEM_FLOOR_MB", d.floorBytes / MB, 128) * MB,
+		ceilingBytes: num("CAMSTACK_POOL_MEM_CEILING_MB", d.ceilingBytes / MB, 256) * MB,
+		cooldownMs: num("CAMSTACK_POOL_MEM_COOLDOWN_MS", d.cooldownMs, 6e4),
+		maxRestartsPerWindow: num("CAMSTACK_POOL_MEM_MAX_RESTARTS", d.maxRestartsPerWindow, 1),
+		restartWindowMs: num("CAMSTACK_POOL_MEM_RESTART_WINDOW_MS", d.restartWindowMs, 6e4)
+	};
+}
+/** Parse the fields this watchdog needs out of `/proc/<pid>/status` text.
+*  Returns null when VmRSS is missing (dead pid, kernel thread, bad read). */
+function parseProcStatus(text) {
+	const kb = (label) => {
+		const match = text.match(new RegExp(`^${label}:\\s+(\\d+)\\s*kB`, "m"));
+		return match ? Number(match[1]) * 1024 : null;
+	};
+	const rssBytes = kb("VmRSS");
+	if (rssBytes === null) return null;
+	const threadsMatch = text.match(/^Threads:\s+(\d+)/m);
+	return {
+		rssBytes,
+		vmBytes: kb("VmSize") ?? 0,
+		hwmBytes: kb("VmHWM") ?? 0,
+		swapBytes: kb("VmSwap") ?? 0,
+		threads: threadsMatch ? Number(threadsMatch[1]) : 0
+	};
+}
+function initialPoolMemoryState() {
+	return {
+		settleSeen: 0,
+		baselineWindow: [],
+		baselineBytes: null,
+		restartsAt: [],
+		lastRestartAt: null
+	};
+}
+function median(values) {
+	const sorted = [...values].sort((a, b) => a - b);
+	return sorted[Math.floor(sorted.length / 2)];
+}
+function advanceBaseline(state, rssBytes, policy) {
+	if (state.baselineBytes !== null) return state;
+	if (state.settleSeen < policy.baselineSettleSamples) return {
+		...state,
+		settleSeen: state.settleSeen + 1
+	};
+	const window = [...state.baselineWindow, rssBytes];
+	if (window.length < policy.baselineSampleCount) return {
+		...state,
+		baselineWindow: window
+	};
+	return {
+		...state,
+		baselineWindow: window,
+		baselineBytes: median(window)
+	};
+}
+/** The one place a pool's restart threshold is computed. */
+function poolMemoryThreshold(baselineBytes, policy) {
+	if (baselineBytes === null) return policy.ceilingBytes;
+	return Math.min(policy.ceilingBytes, Math.max(policy.floorBytes, policy.restartMultiple * baselineBytes));
+}
+function pruneRestarts(restartsAt, nowMs, policy) {
+	return restartsAt.filter((t) => nowMs - t < policy.restartWindowMs);
+}
+/**
+* Evaluate one RSS sample. Pure: returns the successor state plus the verdict.
+* The caller performs (and logs) the restart, then commits it via
+* {@link commitWatchdogRestart}.
+*/
+function evaluatePoolMemory(state, rssBytes, nowMs, policy) {
+	const next = advanceBaseline(state, rssBytes, policy);
+	const thresholdBytes = poolMemoryThreshold(next.baselineBytes, policy);
+	if (rssBytes <= thresholdBytes) return {
+		state: next,
+		action: next.baselineBytes === null ? "baseline-pending" : "ok",
+		baselineBytes: next.baselineBytes,
+		thresholdBytes
+	};
+	const inWindow = pruneRestarts(next.restartsAt, nowMs, policy);
+	const pruned = {
+		...next,
+		restartsAt: inWindow
+	};
+	if (inWindow.length >= policy.maxRestartsPerWindow) return {
+		state: pruned,
+		action: "exhausted",
+		baselineBytes: next.baselineBytes,
+		thresholdBytes
+	};
+	if (pruned.lastRestartAt !== null && nowMs - pruned.lastRestartAt < policy.cooldownMs) return {
+		state: pruned,
+		action: "cooldown",
+		baselineBytes: next.baselineBytes,
+		thresholdBytes
+	};
+	return {
+		state: pruned,
+		action: "restart",
+		baselineBytes: next.baselineBytes,
+		thresholdBytes
+	};
+}
+/** Record a performed watchdog restart: budget consumed, baseline reset —
+*  the recreated pool is a NEW process and gets a fresh settle window. */
+function commitWatchdogRestart(state, nowMs) {
+	return {
+		...initialPoolMemoryState(),
+		restartsAt: [...state.restartsAt, nowMs],
+		lastRestartAt: nowMs
+	};
+}
+/** Reset baseline tracking (pool process replaced OUTSIDE the watchdog —
+*  kernel OOM kill + respawn, idle-reaper eviction, tuning respawn). The
+*  restart budget is kept: it bounds the WATCHDOG, not the pool. */
+function resetPoolBaseline(state) {
+	return {
+		...initialPoolMemoryState(),
+		restartsAt: state.restartsAt,
+		lastRestartAt: state.lastRestartAt
+	};
+}
+/**
+* Pick ONE pool to restart this sweep — the worst overage ratio. Restarting
+* several pools at once (e.g. after a model rollout grew every baseline)
+* would take detection down on every camera simultaneously; one per sweep
+* means the survivors keep serving while the worst offender reloads, and the
+* next sweep (one interval later) takes the next one.
+*/
+function pickRestartCandidate(candidates) {
+	if (candidates.length === 0) return null;
+	let worst = candidates[0];
+	for (const c of candidates) if (c.rssBytes / c.thresholdBytes > worst.rssBytes / worst.thresholdBytes) worst = c;
+	return worst.key;
+}
+var PoolMemoryWatchdog = class {
+	pools = /* @__PURE__ */ new Map();
+	timer = null;
+	sweeping = false;
+	stopped = false;
+	opts;
+	now;
+	setTimer;
+	clearTimer;
+	constructor(opts) {
+		this.opts = opts;
+		this.now = opts.now ?? (() => Date.now());
+		this.setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+		this.clearTimer = opts.clearTimer ?? ((t) => clearTimeout(t));
+	}
+	start() {
+		if (this.timer || this.stopped) return;
+		this.arm();
+	}
+	stop() {
+		this.stopped = true;
+		if (this.timer) {
+			this.clearTimer(this.timer);
+			this.timer = null;
+		}
+	}
+	arm() {
+		const timer = this.setTimer(() => {
+			this.sweep().finally(() => {
+				if (!this.stopped) this.arm();
+			});
+		}, this.opts.policy.sampleIntervalMs);
+		if (typeof timer.unref === "function") timer.unref();
+		this.timer = timer;
+	}
+	/** One sweep: sample → log every pool → restart at most one. Public so the
+	*  loop is testable without fake global timers. */
+	async sweep() {
+		if (this.sweeping) return;
+		this.sweeping = true;
+		try {
+			await this.doSweep();
+		} catch (err) {
+			this.opts.log.warn("pool memory sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		} finally {
+			this.sweeping = false;
+		}
+	}
+	async doSweep() {
+		const nowMs = this.now();
+		const samples = await this.opts.sample();
+		const candidates = [];
+		const verdictByKey = /* @__PURE__ */ new Map();
+		for (const t of samples) {
+			const tracked = this.pools.get(t.key);
+			let state = tracked?.state ?? initialPoolMemoryState();
+			if (tracked && tracked.pids.length > 0 && !samePids(tracked.pids, t.pids)) {
+				this.opts.log.warn("pool process changed outside the watchdog — re-baselining", { meta: {
+					poolKey: t.key,
+					previousPids: tracked.pids,
+					pids: t.pids
+				} });
+				state = resetPoolBaseline(state);
+			}
+			const verdict = evaluatePoolMemory(state, t.rssBytes, nowMs, this.opts.policy);
+			this.pools.set(t.key, {
+				state: verdict.state,
+				pids: t.pids
+			});
+			verdictByKey.set(t.key, verdict);
+			this.opts.log.info("pool memory", { meta: {
+				poolKey: t.key,
+				pids: t.pids,
+				rssMb: Math.round(t.rssBytes / MB),
+				baselineMb: verdict.baselineBytes === null ? null : Math.round(verdict.baselineBytes / MB),
+				thresholdMb: Math.round(verdict.thresholdBytes / MB),
+				action: verdict.action,
+				...t.meta
+			} });
+			if (verdict.action === "restart") candidates.push({
+				key: t.key,
+				rssBytes: t.rssBytes,
+				thresholdBytes: verdict.thresholdBytes
+			});
+			else if (verdict.action === "cooldown") this.opts.log.warn("pool over memory threshold but inside restart cooldown", { meta: {
+				poolKey: t.key,
+				rssMb: Math.round(t.rssBytes / MB),
+				thresholdMb: Math.round(verdict.thresholdBytes / MB),
+				cooldownMs: this.opts.policy.cooldownMs
+			} });
+			else if (verdict.action === "exhausted") this.opts.log.error("pool memory watchdog gave up — restart budget exhausted, pool leaks faster than restarts can pay for; needs a heap profile (py-spy / tracemalloc)", { meta: {
+				poolKey: t.key,
+				rssMb: Math.round(t.rssBytes / MB),
+				thresholdMb: Math.round(verdict.thresholdBytes / MB),
+				maxRestartsPerWindow: this.opts.policy.maxRestartsPerWindow,
+				restartWindowMs: this.opts.policy.restartWindowMs
+			} });
+		}
+		for (const key of [...this.pools.keys()]) if (!samples.some((t) => t.key === key)) this.pools.delete(key);
+		const pickedKey = pickRestartCandidate(candidates);
+		if (pickedKey === null) return;
+		const picked = candidates.find((c) => c.key === pickedKey);
+		const verdict = verdictByKey.get(pickedKey);
+		const tracked = this.pools.get(pickedKey);
+		const restartsInWindow = tracked.state.restartsAt.length + 1;
+		this.opts.log.warn("pool memory watchdog restarting pool — RSS over threshold", { meta: {
+			poolKey: pickedKey,
+			pids: tracked.pids,
+			rssMb: Math.round(picked.rssBytes / MB),
+			thresholdMb: Math.round(picked.thresholdBytes / MB),
+			baselineMb: verdict.baselineBytes === null ? null : Math.round(verdict.baselineBytes / MB),
+			restartsInWindow,
+			deferredCandidates: candidates.filter((c) => c.key !== pickedKey).map((c) => c.key)
+		} });
+		try {
+			await this.opts.restart(pickedKey);
+			this.pools.set(pickedKey, {
+				state: commitWatchdogRestart(tracked.state, this.now()),
+				pids: []
+			});
+		} catch (err) {
+			this.opts.log.error("pool memory watchdog restart failed", { meta: {
+				poolKey: pickedKey,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+};
+function samePids(a, b) {
+	if (a.length !== b.length) return false;
+	const sortedA = [...a].sort((x, y) => x - y);
+	const sortedB = [...b].sort((x, y) => x - y);
+	return sortedA.every((v, i) => v === sortedB[i]);
+}
 /**
 * Vector wire codec — base64 of little-endian Float32.
 *
@@ -39234,6 +39552,12 @@ Object.defineProperty(exports, "OpsLogEntrySchema", {
 		return OpsLogEntrySchema;
 	}
 });
+Object.defineProperty(exports, "PoolMemoryWatchdog", {
+	enumerable: true,
+	get: function() {
+		return PoolMemoryWatchdog;
+	}
+});
 Object.defineProperty(exports, "RECORDING_EXPORT_MAX_READ_BYTES", {
 	enumerable: true,
 	get: function() {
@@ -39504,6 +39828,12 @@ Object.defineProperty(exports, "object", {
 		return object;
 	}
 });
+Object.defineProperty(exports, "parseProcStatus", {
+	enumerable: true,
+	get: function() {
+		return parseProcStatus;
+	}
+});
 Object.defineProperty(exports, "partialRecord", {
 	enumerable: true,
 	get: function() {
@@ -39540,6 +39870,12 @@ Object.defineProperty(exports, "record", {
 		return record;
 	}
 });
+Object.defineProperty(exports, "resolvePoolMemoryPolicy", {
+	enumerable: true,
+	get: function() {
+		return resolvePoolMemoryPolicy;
+	}
+});
 Object.defineProperty(exports, "sceneMonitorCapability", {
 	enumerable: true,
 	get: function() {

package/dist/embedding-encoder/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BfrtqGyh.js");
+const require_dist = require("../dist-DYoWeRRt.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_dist.__toESM(node_fs, 1);
 node_fs = require_dist.__toESM(node_fs);
@@ -10,9 +10,56 @@ let node_path = require("node:path");
 let node_path$1 = require_dist.__toESM(node_path, 1);
 node_path = require_dist.__toESM(node_path);
 require("node:crypto");
+let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_zlib = require("node:zlib");
-let node_child_process = require("node:child_process");
+//#region src/embedding-encoder/shared/process-memory.ts
+/**
+* Read a child process's memory footprint for the pool memory watchdog.
+*
+* Deliberate twin of `packages/addon-pipeline/src/shared/process-memory.ts`:
+* addons must not import each other, and `@camstack/system` stays EXTERNAL in
+* addon bundles (a symbol added there would be missing at runtime until the
+* next framework train). The pure parse (`parseProcStatus`) and the whole
+* watchdog policy live once in `@camstack/types` (inlined at build time);
+* only this thin `fs`/`ps` read is duplicated.
+*
+* Linux (the fleet): `/proc/<pid>/status` — RSS, VmSize, VmHWM (peak RSS ≈
+* getrusage maxrss), VmSwap, Threads in one read. macOS (dev): `ps -o rss=`
+* gives RSS alone. Returns null when the pid is gone — the CALLER logs the
+* dropped sample.
+*/
+var IS_LINUX = process.platform === "linux";
+async function readProcessMemory(pid) {
+	if (IS_LINUX) try {
+		return require_dist.parseProcStatus(await node_fs.promises.readFile(`/proc/${pid}/status`, "utf8"));
+	} catch {
+		return null;
+	}
+	return readViaPs(pid);
+}
+function readViaPs(pid) {
+	return new Promise((resolve) => {
+		(0, node_child_process.execFile)("ps", [
+			"-o",
+			"rss=",
+			"-p",
+			String(pid)
+		], { timeout: 2e3 }, (err, stdout) => {
+			if (err) return resolve(null);
+			const kb = Number(stdout.trim());
+			if (!Number.isFinite(kb) || kb <= 0) return resolve(null);
+			resolve({
+				rssBytes: kb * 1024,
+				vmBytes: 0,
+				hwmBytes: 0,
+				swapBytes: 0,
+				threads: 0
+			});
+		});
+	});
+}
+//#endregion
 //#region ../system/dist/file-data-plane-CuE_hBli.mjs
 function isNonEmptyFile(filePath) {
 	return node_fs$1.existsSync(filePath) && node_fs$1.statSync(filePath).size > 0;
@@ -499,8 +546,20 @@ var PythonRawTensorEngine = class {
 		if (ready.length !== 1 || ready[0] !== 1) throw new Error("PythonRawTensorEngine: unexpected ready frame");
 		this.log.info("ONNX raw-tensor engine ready (embedded Python)", { meta: { modelPath: this.modelPath } });
 	}
+	/** Native pid of the Python subprocess — sampled by the pool memory
+	*  watchdog (`/proc/<pid>/status`). */
+	getPid() {
+		return this.process?.pid ?? null;
+	}
+	/** Inference requests served since spawn — the denominator that separates
+	*  "RSS grew per unit of work" (leak) from "RSS grew because it worked". */
+	getRequestCount() {
+		return this.requestCount;
+	}
+	requestCount = 0;
 	async run(input, inputShape) {
 		if (!this.process?.stdin) throw new Error("PythonRawTensorEngine: not initialized — call initialize() first");
+		this.requestCount++;
 		const ndims = inputShape.length;
 		const meta = Buffer.allocUnsafe(1 + ndims * 4);
 		meta.writeUInt8(ndims, 0);
@@ -625,9 +684,21 @@ var PythonTextEncoderEngine = class {
 			tokenizerPath: this.tokenizerPath
 		} });
 	}
+	/** Native pid of the Python subprocess — sampled by the pool memory
+	*  watchdog (`/proc/<pid>/status`). */
+	getPid() {
+		return this.process?.pid ?? null;
+	}
+	/** Encode requests served since spawn — the denominator that separates
+	*  "RSS grew per unit of work" (leak) from "RSS grew because it worked". */
+	getRequestCount() {
+		return this.requestCount;
+	}
+	requestCount = 0;
 	/** Tokenize + encode `text` into the model embedding (float32). */
 	async encode(text) {
 		if (!this.process?.stdin) throw new Error("PythonTextEncoderEngine: not initialized — call initialize() first");
+		this.requestCount++;
 		const payload = Buffer.from(text, "utf-8");
 		const lenBuf = Buffer.allocUnsafe(4);
 		lenBuf.writeUInt32LE(payload.length, 0);
@@ -753,6 +824,22 @@ var EmbeddingEncoderAddon = class extends require_dist.BaseAddon {
 	imageRawEngine = null;
 	textEngine = null;
 	models = null;
+	/**
+	* RSS bound + periodic memory telemetry for the two Python engines
+	* (`raw_tensor_inference.py` — one of the four leaking pools in the
+	* 2026-08-18 OOM audit — and `text_encoder_inference.py`). Shared
+	* watchdog from `@camstack/types`; a restart here is dispose + null, and
+	* the next encode lazily re-resolves the engine (the exact recovery an
+	* operator model change already uses). Started in `onInitialize`,
+	* stopped in `onShutdown`.
+	*/
+	memoryGuard = null;
+	/** Single-flight guards for the lazy engine builds — a watchdog restart
+	*  followed by two concurrent encodes must not spawn the engine twice
+	*  (the same bug detection-pipeline fixed three times; see its
+	*  `engineFactoryInflight`). */
+	imageEngineInflight = null;
+	textEngineInflight = null;
 	constructor() {
 		super({
 			modelId: DEFAULT_CLIP_MODEL,
@@ -763,11 +850,75 @@ var EmbeddingEncoderAddon = class extends require_dist.BaseAddon {
 	async onInitialize() {
 		const modelsDir = await this.resolveModelsDir();
 		this.models = new ModelDownloadService(modelsDir, [...CLIP_IMAGE_MODELS, ...CLIP_TEXT_MODELS]);
+		this.memoryGuard = new require_dist.PoolMemoryWatchdog({
+			policy: require_dist.resolvePoolMemoryPolicy(process.env),
+			log: this.ctx.logger.child("pool-memory"),
+			sample: () => this.sampleEngineMemory(),
+			restart: (key) => this.restartEngineForMemory(key)
+		});
+		this.memoryGuard.start();
 		return [{
 			capability: require_dist.embeddingEncoderCapability,
 			provider: this
 		}];
 	}
+	/** Watchdog sample: one telemetry row per live Python engine. A pid the
+	*  read cannot see is logged, never silently skipped. */
+	async sampleEngineMemory() {
+		const engines = [{
+			key: "clip-image",
+			pid: this.imageRawEngine?.getPid() ?? null,
+			requests: this.imageRawEngine?.getRequestCount() ?? 0
+		}, {
+			key: "clip-text",
+			pid: this.textEngine?.getPid() ?? null,
+			requests: this.textEngine?.getRequestCount() ?? 0
+		}];
+		const out = [];
+		for (const engine of engines) {
+			if (engine.pid === null) continue;
+			const mem = await readProcessMemory(engine.pid);
+			if (!mem) {
+				this.ctx.logger.warn("embedding engine memory sample dropped", { meta: {
+					poolKey: engine.key,
+					pid: engine.pid
+				} });
+				continue;
+			}
+			const mb = (bytes) => Math.round(bytes / (1024 * 1024));
+			out.push({
+				key: engine.key,
+				pids: [engine.pid],
+				rssBytes: mem.rssBytes,
+				meta: {
+					modelId: this.config.modelId,
+					vmMb: mb(mem.vmBytes),
+					peakRssMb: mb(mem.hwmBytes),
+					swapMb: mb(mem.swapBytes),
+					threads: mem.threads,
+					requestsServed: engine.requests
+				}
+			});
+		}
+		return out;
+	}
+	/** Watchdog restart: dispose + null; the next encode re-resolves lazily
+	*  through the single-flight ensure. An in-flight encode fails once — its
+	*  callers are the retry-until-landed bulk passes (D58) and RPCs that
+	*  surface errors, never silent loss. */
+	async restartEngineForMemory(key) {
+		if (key === "clip-image") {
+			const engine = this.imageRawEngine;
+			if (!engine) return;
+			this.imageRawEngine = null;
+			await engine.dispose();
+			return;
+		}
+		const engine = this.textEngine;
+		if (!engine) return;
+		this.textEngine = null;
+		await engine.dispose();
+	}
 	async encode(input) {
 		const { crop, width, height } = input;
 		await this.ensureImageEngine();
@@ -811,17 +962,31 @@ var EmbeddingEncoderAddon = class extends require_dist.BaseAddon {
 	}
 	async ensureImageEngine() {
 		if (this.imageRawEngine) return;
+		if (this.imageEngineInflight) return this.imageEngineInflight;
 		const meta = getModelMeta(this.config.modelId);
 		const imageEntry = CLIP_IMAGE_MODELS.find((m) => m.id === meta.imageModelId);
 		if (!imageEntry) throw new Error(`EmbeddingEncoderAddon: unknown image model "${meta.imageModelId}"`);
-		await this.resolveForEntry(imageEntry, "image");
+		const inflight = this.resolveForEntry(imageEntry, "image");
+		this.imageEngineInflight = inflight;
+		try {
+			await inflight;
+		} finally {
+			this.imageEngineInflight = null;
+		}
 	}
 	async ensureTextEngine() {
 		if (this.textEngine) return;
+		if (this.textEngineInflight) return this.textEngineInflight;
 		const meta = getModelMeta(this.config.modelId);
 		const textEntry = CLIP_TEXT_MODELS.find((m) => m.id === meta.textModelId);
 		if (!textEntry) throw new Error(`EmbeddingEncoderAddon: unknown text model "${meta.textModelId}"`);
-		await this.resolveForEntry(textEntry, "text");
+		const inflight = this.resolveForEntry(textEntry, "text");
+		this.textEngineInflight = inflight;
+		try {
+			await inflight;
+		} finally {
+			this.textEngineInflight = null;
+		}
 	}
 	async resolveForEntry(entry, target) {
 		const engineLogger = this.ctx.logger.withTags({
@@ -847,6 +1012,8 @@ var EmbeddingEncoderAddon = class extends require_dist.BaseAddon {
 		this.textEngine = textEngine;
 	}
 	async onShutdown() {
+		this.memoryGuard?.stop();
+		this.memoryGuard = null;
 		await this.imageRawEngine?.dispose();
 		await this.textEngine?.dispose();
 	}