@camstack/system 1.2.103 → 1.2.104

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-DHKXob1m.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-CAzHQ03i.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Bt_J04b0.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-5ei2xVUh.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -40,7 +40,6 @@ import * as os$18 from "node:os";
 import * as fs$17 from "node:fs";
 import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { request } from "node:http";
-import * as v8 from "node:v8";
 import * as vm from "node:vm";
 import { asJsonObject, errMsg, parseJsonUnknown } from "@camstack/types/addon";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -423,304 +422,6 @@ function proxyToUpstream(opts) {
 	else clientReq.pipe(upstream);
 }
 //#endregion
-//#region src/kernel/heap-watch.ts
-/**
-* heap-watch — hub-main's own memory, on the record, and returned to the OS.
-*
-* ## Why this exists
-*
-* hub-main used to be launched with `--max-old-space-size=1536` (docker-entrypoint;
-* the cap was removed on 2026-08-02, so the live ceiling is now V8's own default —
-* 4288MB in this container — and this module reads it at runtime rather than
-* assuming a number). It logged NOTHING about its own heap. When it died on
-* 2026-08-01/02 the only trace was V8's own stderr line:
-*
-*     FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
-*
-* which carries no process name, no heap number and no history — the whole
-* server restarts and the evidence is gone. Four of those in ~15h, and the one
-* at 06:57:57 landed nine seconds after a viewer opened a WebRTC session, which
-* is why the app sat in a permanent "loading": the hub was dying as it
-* connected.
-*
-* `[mem]` reports already exist for forked addon runners (SIGUSR2 in
-* `addon-runner.ts`) — hub-main, the one process that actually OOMs, was the
-* one process with no telemetry at all.
-*
-* ## What it gives
-*
-* A heartbeat carrying the numbers that separate the two possible stories, and
-* a WARN as the heap approaches the ceiling — the line that will exist BEFORE
-* the next fatal instead of after it:
-*
-*  - `heapUsedMb` climbing steadily between restarts → a leak;
-*  - `heapUsedMb` flat with a sharp jump under load → a burst allocation, and
-*    the timestamp says what was being served.
-*
-* `external`/`arrayBuffers` ride along because they are NOT bounded by
-* `--max-old-space-size` and are most of the gap between a 1.5GB cap and the
-* ~2.05GB RSS observed live: a diagnosis that only looks at the JS heap
-* misreads that process by 500MB.
-*
-* ## And then the heartbeat explained the "off-heap leak", which was not one
-*
-* 2026-08-08, measured on the live hub over 1019 consecutive samples and seven
-* separate boots: **hub-main's RSS is a HIGH-WATER MARK, not a leak.** In every
-* one of those 1019 samples RSS was >= the running maximum of
-* `heapTotal + external`, never once below it, and
-* `RSS_peak - peak(heapTotal + external)` landed between 874MB and 1639MB on
-* every boot — a roughly constant native floor on top of a number that only
-* ever goes up. RSS tracked the highest point the process ever reached and
-* stayed there: 3.3GB -> 4.5GB -> 5.2GB, and 7.8GB on the worst boot.
-*
-* Two things push that peak, and neither is a retained object:
-*
-*  - the JS heap sawtooths to 2.0-2.8GB because the ceiling is 4288MB and
-*    nothing creates pressure before then;
-*  - `arrayBuffers` accumulates DEAD Buffers — up to 3.65GB — because V8 only
-*    sweeps them on a major GC. Eleven collapses were captured, and every
-*    single one coincides with `heapUsed` dropping to its ~650MB floor. No code
-*    released a reference at 13:23:03; a mark-compact ran.
-*
-* At the peak V8 has committed the pages, and **an ordinary major GC does not
-* give them back.** Proven on the production hub: `smaps` showed 10,819 mapped
-* 256KB pages (V8's `kRegularPageSize`) holding 2704MB while V8 itself reported
-* `total_physical_size` of only 846MB — ~7,800 pages committed, resident, and
-* outside V8's own accounting. One `gc({ flavor: 'last-resort' })` took 417ms
-* and returned RSS 3355MB -> 1237MB, pages 10,819 -> 2,963.
-*
-* So the fix for the "~3GB/2h off-heap growth" is not a retainer hunt. It is to
-* ask V8 for the pages back when the process is visibly holding more than it is
-* using — which is what `shouldReclaim` decides and what the heartbeat now does.
-*
-* The cost is a stop-the-world on the hub's router process — 250-450ms when
-* first measured, 654ms on the largest pass seen since — bounded to once per
-* `HEAP_RECLAIM_MIN_INTERVAL_MS`. The alternative, measured, is a ratchet to
-* 7.8GB and the OOM that ends it.
-*/
-/** Heartbeat period. Slow enough to be free, fast enough that the sample before
-*  a fatal is recent. */
-var HEAP_WATCH_INTERVAL_MS = 6e4;
-/** Warn above this share of the heap ceiling. Chosen so the warning precedes
-*  the fatal by more than one interval under realistic growth. */
-var HEAP_WATCH_WARN_RATIO = .8;
-/**
-* Escalate above this share of the ceiling.
-*
-* 0.70 is 3002MB: clear of the measured routine max (2847MB) so steady state
-* never escalates, and below {@link HEAP_WATCH_WARN_RATIO} so the fast cadence
-* is already running by the time the warn is reachable.
-*/
-var HEAP_WATCH_ESCALATE_RATIO = .7;
-/**
-* Release escalation below this share.
-*
-* Hysteresis, not a second threshold: hub-main's heap sawtooths continuously,
-* so a single ratio would flap the mode on every GC. 0.60 is 2573MB — a real
-* retreat rather than the trough of one collection.
-*/
-var HEAP_WATCH_DEESCALATE_RATIO = .6;
-/**
-* The cadence state machine, pure so the thresholds are testable without
-* allocating three gigabytes to reach them.
-*/
-function nextMode(current, usedRatio, escalateRatio = HEAP_WATCH_ESCALATE_RATIO, deescalateRatio = HEAP_WATCH_DEESCALATE_RATIO) {
-	if (current === "escalated") return usedRatio < deescalateRatio ? "steady" : "escalated";
-	return usedRatio >= escalateRatio ? "escalated" : "steady";
-}
-/**
-* Reclaim once the process holds this many MB beyond what it is USING.
-*
-* Live calibration, both readings from the same hub minutes apart: 2491MB
-* stranded before the reclaim, 438MB after. 438MB is this process's irreducible
-* native floor (sqlite pages, libvips, sharp, thread stacks, node's own text) —
-* collecting against it would buy nothing and cost a stall every minute.
-*
-* ## Why this came down from 1536 (2026-08-17)
-*
-* The trigger was originally set to fire only on an unmistakable strand. It
-* does, and the pass on the record works exactly as designed:
-*
-*     [mem] reclaim hub-main stranded=2365MB rss=4016MB→2368MB freed=1648MB took=654ms
-*
-* But the number it was protecting against changed. The host now runs with a
-* 24GiB cgroup ceiling and **no swap**, and is OOM-killing a neighbouring VM.
-* RSS this process is holding and not using is no longer merely untidy — it is
-* the headroom something else needed, and the OOM is triggered by the PEAK, not
-* by the average. A trigger of 1536 means the peak is allowed to stand 1.5GiB
-* above the floor before anything happens.
-*
-* 1024 is 2.3x the measured 438MB floor, so ordinary movement around the floor
-* can never trip it, and every pass that does fire still returns roughly
-* `1024 - 438` ≈ **580MB minimum** — a real return for a 250-650ms stall,
-* not a stall spent collecting noise.
-*/
-var HEAP_RECLAIM_TRIGGER_MB = 1024;
-/**
-* Floor on how often the stop-the-world may run.
-*
-* Ten minutes was chosen to keep the worst case under 0.1% of the router's
-* time. The worst case is not what governs the cost, though: the reclaim only
-* runs when {@link shouldReclaim} says the process is genuinely stranded, and
-* after a pass it is at the ~438MB floor. Live off-heap growth was measured at
-* roughly 3GB/2h ≈ 25MB/min, so re-stranding the ~580MB needed to qualify again
-* takes on the order of **20 minutes** — well outside any floor considered
-* here. In steady state this constant therefore costs nothing at all.
-*
-* What it does govern is a BURST, which is the only case that matters on a host
-* with no swap: the ten-minute floor let a peak that re-formed in seconds stand
-* for ten minutes. Two minutes bounds that, and even the pathological case of a
-* process that re-strands instantly costs 654ms per 120s — 0.55% of the
-* router's time, against a ~1.5GiB peak it removes each pass.
-*/
-var HEAP_RECLAIM_MIN_INTERVAL_MS = 12e4;
-var MB = (bytes) => Math.round(bytes / 1048576);
-/**
-* Build a sample from raw readings. Pure so the thresholds are testable without
-* allocating a gigabyte to reach them.
-*/
-function buildHeapSample(mem, heapLimitBytes, warnRatio = HEAP_WATCH_WARN_RATIO) {
-	const usedRatio = heapLimitBytes > 0 ? mem.heapUsed / heapLimitBytes : 0;
-	return {
-		rssMb: MB(mem.rss),
-		heapUsedMb: MB(mem.heapUsed),
-		heapTotalMb: MB(mem.heapTotal),
-		heapLimitMb: MB(heapLimitBytes),
-		externalMb: MB(mem.external),
-		arrayBuffersMb: MB(mem.arrayBuffers),
-		usedRatio: Math.round(usedRatio * 100) / 100,
-		nearLimit: usedRatio >= warnRatio
-	};
-}
-var consoleSink = {
-	info: (line) => console.log(line),
-	warn: (line) => console.warn(line)
-};
-/**
-* RSS the process is holding but not using.
-*
-* The subtrahend is heapUSED, not heapTotal, deliberately: the pages V8
-* committed at a sawtooth peak and no longer needs are counted inside heapTotal,
-* and they are precisely what this number exists to see.
-*/
-function strandedMb(s) {
-	return s.rssMb - s.heapUsedMb - s.externalMb;
-}
-/** Whether it is worth paying a stop-the-world to get those pages back. */
-function shouldReclaim(s, triggerMb = HEAP_RECLAIM_TRIGGER_MB) {
-	return strandedMb(s) > triggerMb;
-}
-function isGcFunction(value) {
-	return typeof value === "function";
-}
-/**
-* Build the reclaimer without requiring `--expose-gc` on argv.
-*
-* The flag is turned on, the function captured, and the flag turned straight
-* back off — a global `gc` left reachable by application code is a footgun, and
-* requiring an argv change would mean this cannot ship without a new image.
-* Verified against the live hub before being written: 266ms, RSS 1453 -> 1237.
-*
-* Returns undefined if V8 declines, so the caller keeps a heartbeat either way.
-*/
-function createV8Reclaimer() {
-	try {
-		v8.setFlagsFromString("--expose-gc");
-		const gc = vm.runInNewContext("gc");
-		v8.setFlagsFromString("--no-expose-gc");
-		if (!isGcFunction(gc)) return void 0;
-		return () => gc({
-			execution: "sync",
-			flavor: "last-resort"
-		});
-	} catch {
-		return;
-	}
-}
-function format$1(label, s) {
-	return `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
-}
-/**
-* Start the heartbeat. Returns a stop function.
-*
-* `unref`ed so it can never hold the process open, and every read is wrapped:
-* a diagnostic that can crash the process it watches is worse than none.
-*/
-function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions) {
-	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
-	const now = reclaimOptions?.now ?? (() => Date.now());
-	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
-	const minIntervalMs = reclaimOptions?.minIntervalMs ?? 12e4;
-	const fastIntervalMs = reclaimOptions?.fastIntervalMs ?? 2e3;
-	const escalateRatio = reclaimOptions?.escalateRatio ?? .7;
-	const deescalateRatio = reclaimOptions?.deescalateRatio ?? .6;
-	let lastReclaimAt = Number.NEGATIVE_INFINITY;
-	const read = () => {
-		const limit = reclaimOptions?.heapLimitBytes ?? v8.getHeapStatistics().heap_size_limit;
-		return buildHeapSample(readMemory(), limit);
-	};
-	const maybeReclaim = (sample) => {
-		if (reclaimOptions === void 0) return;
-		if (!shouldReclaim(sample, triggerMb)) return;
-		if (now() - lastReclaimAt < minIntervalMs) return;
-		lastReclaimAt = now();
-		const startedAt = now();
-		try {
-			reclaimOptions.reclaim();
-		} catch (error) {
-			sink.warn(`[mem] reclaim failed — ${error instanceof Error ? error.message : String(error)}`);
-			return;
-		}
-		const after = read();
-		sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB→${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB→${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
-	};
-	let mode = "steady";
-	let lastLoggedAt = Number.NEGATIVE_INFINITY;
-	/**
-	* PROBING and LOGGING are separate cadences, and that separation is the whole
-	* point.
-	*
-	* The 2026-08-08 fatal escaped a 60s heartbeat because the burst began and
-	* ended between two samples. Deciding "is the heap elevated?" only when a
-	* line is due would reproduce that exactly: the process would still be read
-	* once a minute, and a 62-second climb would still be invisible. So the timer
-	* runs at the FAST period always — `process.memoryUsage()` is tens of
-	* microseconds, i.e. free at this rate — and the slow period governs only how
-	* often a steady process is allowed to say so.
-	*
-	* Never probe slower than the log cadence, or a caller passing a short
-	* `intervalMs` would silently get the long one.
-	*/
-	const probeIntervalMs = Math.min(fastIntervalMs, intervalMs);
-	const tick = () => {
-		try {
-			const sample = read();
-			const previous = mode;
-			mode = nextMode(previous, sample.usedRatio, escalateRatio, deescalateRatio);
-			const at = now();
-			const due = at - lastLoggedAt >= intervalMs;
-			if (mode === "escalated" || due) {
-				lastLoggedAt = at;
-				const line = format$1(label, sample);
-				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
-				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
-				else sink.info(line);
-			}
-			if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine — logging every ${intervalMs}ms`);
-			maybeReclaim(sample);
-		} catch {}
-	};
-	const timer = setInterval(tick, probeIntervalMs);
-	timer.unref?.();
-	tick();
-	let stopped = false;
-	return () => {
-		if (stopped) return;
-		stopped = true;
-		clearInterval(timer);
-	};
-}
-//#endregion
 //#region src/lifecycle/lifecycle-state-machine.ts
 var VALID_TRANSITIONS = {
 	stopped: ["starting", "disabled"],
@@ -94645,19 +94346,21 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	function spawnRunner(runnerId, addons, env) {
 		const nodeId = buildNodeId(runnerId);
 		const runnerPath = path$39.resolve(__dirname, "addon-runner.js");
+		const heavy = isHeavyRunner(addons);
 		const childEnv = {
 			...process.env,
 			CAMSTACK_RUNNER_ID: runnerId,
 			CAMSTACK_RUNNER_ADDONS: JSON.stringify(addons),
 			CAMSTACK_PARENT_NODE_ID: parentNodeId,
 			CAMSTACK_DATA_DIR: dataDir,
+			CAMSTACK_RUNNER_HEAP_PROFILE: heavy ? "heavy" : "light",
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
-		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${isHeavyRunner(addons) ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [
@@ -94701,6 +94404,15 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				capturedBroker?.logger.error(`[${runnerId}] Crash circuit-breaker tripped — ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms. Not respawning.`);
 				processes.set(runnerId, entry);
 				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
+				emitRunnerEvent(EventCategory$1.AddonRunnerFailed, runnerId, {
+					runnerId,
+					nodeId: parentNodeId,
+					addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+					crashesInWindow: decision.crashesInWindow,
+					windowMs: CRASH_WINDOW_MS,
+					...code !== null ? { exitCode: code } : {},
+					...signal !== null ? { signal } : {}
+				});
 				for (const addon of entry.runnerAddons) emitRunnerEvent(EventCategory$1.AddonCrashed, addon.addonId, {
 					addonId: addon.addonId,
 					error: `Crash circuit-breaker tripped after ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms`
@@ -95379,4 +95091,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };

package/dist/kernel/heap-watch.d.ts

@@ -168,3 +168,70 @@ export interface HeapReclaimOptions {
  * a diagnostic that can crash the process it watches is worse than none.
  */
 export declare function startHeapWatch(label?: string, sink?: HeapWatchSink, intervalMs?: number, reclaimOptions?: HeapReclaimOptions): () => void;
+/**
+ * Steady heartbeat period for a HEAVY addon runner.
+ *
+ * hub-main logs once a minute because it is ONE process. The heavy runners are
+ * ~7 per node sharing the same hub log stream; at 60s each they would put 7
+ * routine lines a minute in it forever, which is how a log stops being read.
+ * Five minutes keeps the per-runner record (a leak is still a visible climb
+ * across samples) at ~1.4 lines/min across the class.
+ *
+ * This slows LOGGING only. The probe keeps running at
+ * {@link HEAP_WATCH_FAST_INTERVAL_MS} (probe and log cadences are separate —
+ * see the comment inside {@link startHeapWatch}), so the reclaim gate and the
+ * escalated burst-sampling react exactly as fast as hub-main's.
+ */
+export declare const RUNNER_HEAP_WATCH_INTERVAL_MS = 300000;
+/** Wiring for {@link startRunnerHeapWatch}. */
+export interface RunnerHeapWatchOptions {
+    /**
+     * `CAMSTACK_RUNNER_HEAP_PROFILE` as the parent passed it. Anything but
+     * `'heavy'` (including unset — the un-annotated default is light) starts
+     * nothing: light runners are small, already carry V8 heap flags, and a
+     * quiet runner must never pay a stop-the-world.
+     */
+    readonly heapProfile: string | undefined;
+    /** Log label — the runner's nodeId, so `[mem]` lines group per runner. */
+    readonly label: string;
+    readonly sink: HeapWatchSink;
+    /**
+     * `CAMSTACK_RUNNER_HEAP_RECLAIM` as the environment carries it. `'off'`
+     * keeps the heartbeat and disables only the reclaim pass — the operator
+     * kill-switch for the media path, usable without a rebuild.
+     */
+    readonly reclaimSwitch?: string;
+    /** Heartbeat period override. Defaults to {@link RUNNER_HEAP_WATCH_INTERVAL_MS}. */
+    readonly intervalMs?: number;
+    /** Test injection. Production omits it and gets {@link createV8Reclaimer}. */
+    readonly reclaimOptions?: HeapReclaimOptions;
+}
+/**
+ * Start the heap watch + stranded-page reclaimer for ONE addon runner, iff it
+ * is a heavy one. Returns the stop function, or undefined when nothing started.
+ *
+ * ## Why heavy runners get hub-main's mechanism
+ *
+ * The media-path runners deliberately run with NO old-space ceiling
+ * (`maxOldSpaceMb: 0` — a flat cap turned a disk-stall backlog into
+ * `Ineffective mark-compacts near heap limit` and killed recording, twice on
+ * 2026-08-17). Uncapped, V8 feels no pressure, so a one-off burst becomes the
+ * runner's permanent RSS: the recorder measured 2122MB holding a ~50MB index.
+ * hub-main had exactly this shape and its reclaimer is proven live — 11 passes
+ * in 4h, 375–1652MB returned per pass at 550–680ms each. Same mechanism, same
+ * `shouldReclaim` stranded-over-trigger gate; never a second implementation.
+ *
+ * ## The stall, priced for the runners that get it
+ *
+ * A pass is a sub-second stop-the-world at most once per
+ * {@link HEAP_RECLAIM_MIN_INTERVAL_MS}, and only while >1GiB is stranded. For
+ * the recorder — finalizing a segment every ~300ms across 34 profile-writers —
+ * the pause delays WATCHER work, not video: ffmpeg children keep writing to
+ * disk independently, the playlist tail is the durable queue, and the next
+ * tick drains what accrued. For stream-broker a pass can hitch live frames
+ * once per qualifying window; after a pass the runner sits at its floor and
+ * re-stranding the trigger takes tens of minutes, so in practice the class
+ * pays a few passes per hour against the multi-GiB peak that was OOM-killing
+ * a neighbouring VM on a host with no swap.
+ */
+export declare function startRunnerHeapWatch(options: RunnerHeapWatchOptions): (() => void) | undefined;