@camstack/system 1.2.122 → 1.2.123

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-76dZLxD0.js");
+const require_manifest_python_deps = require("./manifest-python-deps-B3_4YiDK.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-DZSNlHjU.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-DIIXlR1x.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/index.js

@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
-const require_manifest_python_deps = require("./manifest-python-deps-76dZLxD0.js");
+const require_manifest_python_deps = require("./manifest-python-deps-B3_4YiDK.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_lan_http_bind = require("./lan-http-bind-DmgpFP6_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");

package/dist/index.mjs

@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-DZSNlHjU.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-DIIXlR1x.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { C as evaluateExistingCert, S as SERVER_AUTH_OID, _ as CA_COMMON_NAME, a as closeLanHttp, b as LEAF_RENEWAL_WINDOW_DAYS, c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, h as loadTlsCert, i as bindPendingLanHttp, l as readTlsAccessStatus, m as ensureTlsCert, n as allFamiliesListenHost, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, s as registerLanHttpHandler, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode, v as collectCertIdentity, x as MAX_LEAF_VALIDITY_DAYS, y as CA_VALIDITY_DAYS } from "./lan-http-bind-jKrj6OjQ.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";

package/dist/kernel/heap-watch.d.ts

@@ -99,6 +99,85 @@ export declare const HEAP_RECLAIM_TRIGGER_MB = 1024;
  * router's time, against a ~1.5GiB peak it removes each pass.
  */
 export declare const HEAP_RECLAIM_MIN_INTERVAL_MS = 120000;
+/**
+ * Consecutive floor-to-floor passes after which the reclaim is announced as
+ * STEADY STATE rather than a rescue.
+ *
+ * The floor above is documented as a bound on a BURST, on the measured premise
+ * that re-stranding the trigger takes ~20 minutes. Measured on the live hub
+ * 2026-08-25 it takes under two: 13 passes in 30 minutes, every one of them
+ * firing the instant {@link HEAP_RECLAIM_MIN_INTERVAL_MS} elapsed, `took=`
+ * 556-695ms each. Nothing in the record said so, because a pass that fires
+ * every floor period and a pass that fires once an hour print the same line.
+ *
+ * Six is 12 minutes of back-to-back passes: long enough that a genuine burst
+ * (which subsides) never reaches it, short enough that a process which has
+ * quietly made the stop-the-world part of its steady state is named within the
+ * quarter-hour. The warn changes no behaviour — the pass is load-bearing and
+ * keeps running. It exists so the OPERATOR is told that the safety net has
+ * become the mechanism, which is the moment to go after the allocation source
+ * instead of the symptom.
+ */
+export declare const RECLAIM_STEADY_STATE_PASSES = 6;
+/**
+ * Event-loop delay over the window since the previous read, in milliseconds.
+ *
+ * Why the heartbeat carries this at all: hub-main's event loop is the cluster's
+ * only queue (D181 — every settings read from every runner and every agent,
+ * every UDS handshake and every cross-runner cap call is served on it, and a
+ * live CPU profile of a boot put `(idle)` at 0.1%). The reclaim pass is a
+ * stop-the-world ON that loop, and `took=` prices the PASS without ever pricing
+ * what it delays. 590ms against a p99 of 4ms is a visible stall; the same 590ms
+ * against a p99 of 900ms is noise inside a queue that was already saturated.
+ * Those are opposite conclusions, and until now the log could not tell them
+ * apart.
+ */
+export interface LoopDelaySample {
+    readonly p50Ms: number;
+    readonly p99Ms: number;
+    readonly maxMs: number;
+}
+/** What a loop with nothing recorded yet reports. */
+export declare const ZERO_LOOP_DELAY: LoopDelaySample;
+export interface LoopDelayMeter {
+    /** Percentiles over the window since the previous read. Reading RESETS it. */
+    readonly read: () => LoopDelaySample;
+    readonly stop: () => void;
+}
+/**
+ * A `perf_hooks` interval histogram, read once per LOGGED line.
+ *
+ * The histogram samples in libuv at `resolutionMs` and costs nothing to keep
+ * enabled; the expensive part would be reading it on every 2s probe, which
+ * would also destroy the window the line claims to describe (probe and log
+ * cadences are deliberately different — see {@link startHeapWatch}).
+ *
+ * An EMPTY histogram is the trap: Node answers `min = 9223372036854776000` and
+ * `percentile()` throws on some versions, so a first heartbeat that read it
+ * naively would print `loopMax=9223372036854ms` and be read as a catastrophe on
+ * every boot. `count === 0` short-circuits to {@link ZERO_LOOP_DELAY}.
+ *
+ * Returns undefined if the platform declines, so the caller keeps a heartbeat
+ * either way.
+ */
+export declare function createLoopDelayMeter(resolutionMs?: number): LoopDelayMeter | undefined;
+/** Whether anyone CHOSE this process's old-space ceiling, or V8 derived one. */
+export type HeapCeilingOrigin = 'explicit' | 'v8-default';
+/**
+ * Read the origin of the old-space ceiling off node's own options.
+ *
+ * hub-main is the only process in the cluster whose ceiling nobody chose. Every
+ * forked runner is given V8 heap flags by `process-service.ts`; hub-main gets
+ * `--max-old-space-size` from `docker-entrypoint.sh` ONLY when the operator sets
+ * `CAMSTACK_HUB_HEAP_MB`, and on the live container it is unset — verified
+ * 2026-08-25 by reading pid 7's argv, a bare `node .../starter.js`. So the
+ * ceiling in force is whatever V8 derives from the host (4288MB there), and the
+ * only record of that was a comment inside an image nobody rebuilds to read.
+ *
+ * A fact about the running process belongs in the running process's log, and
+ * `execArgv` answers it for free at boot.
+ */
+export declare function heapCeilingOrigin(execArgv?: readonly string[]): HeapCeilingOrigin;
 export interface HeapSample {
     readonly rssMb: number;
     readonly heapUsedMb: number;
@@ -167,7 +246,7 @@ export interface HeapReclaimOptions {
  * `unref`ed so it can never hold the process open, and every read is wrapped:
  * a diagnostic that can crash the process it watches is worse than none.
  */
-export declare function startHeapWatch(label?: string, sink?: HeapWatchSink, intervalMs?: number, reclaimOptions?: HeapReclaimOptions): () => void;
+export declare function startHeapWatch(label?: string, sink?: HeapWatchSink, intervalMs?: number, reclaimOptions?: HeapReclaimOptions, loopDelay?: LoopDelayMeter | undefined, execArgv?: readonly string[]): () => void;
 /**
  * Steady heartbeat period for a HEAVY addon runner.
  *

package/dist/{manifest-python-deps-76dZLxD0.js → manifest-python-deps-B3_4YiDK.js}

@@ -12,6 +12,7 @@ node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_http = require("node:http");
+let node_perf_hooks = require("node:perf_hooks");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);
 let node_vm = require("node:vm");
@@ -170,6 +171,72 @@ var HEAP_RECLAIM_TRIGGER_MB = 1024;
 * router's time, against a ~1.5GiB peak it removes each pass.
 */
 var HEAP_RECLAIM_MIN_INTERVAL_MS = 12e4;
+/** What a loop with nothing recorded yet reports. */
+var ZERO_LOOP_DELAY = {
+	p50Ms: 0,
+	p99Ms: 0,
+	maxMs: 0
+};
+/**
+* A `perf_hooks` interval histogram, read once per LOGGED line.
+*
+* The histogram samples in libuv at `resolutionMs` and costs nothing to keep
+* enabled; the expensive part would be reading it on every 2s probe, which
+* would also destroy the window the line claims to describe (probe and log
+* cadences are deliberately different — see {@link startHeapWatch}).
+*
+* An EMPTY histogram is the trap: Node answers `min = 9223372036854776000` and
+* `percentile()` throws on some versions, so a first heartbeat that read it
+* naively would print `loopMax=9223372036854ms` and be read as a catastrophe on
+* every boot. `count === 0` short-circuits to {@link ZERO_LOOP_DELAY}.
+*
+* Returns undefined if the platform declines, so the caller keeps a heartbeat
+* either way.
+*/
+function createLoopDelayMeter(resolutionMs = 20) {
+	try {
+		const histogram = (0, node_perf_hooks.monitorEventLoopDelay)({ resolution: resolutionMs });
+		histogram.enable();
+		return {
+			read: () => {
+				try {
+					if (histogram.count === 0) return ZERO_LOOP_DELAY;
+					const sample = {
+						p50Ms: Math.round(histogram.percentile(50) / 1e6),
+						p99Ms: Math.round(histogram.percentile(99) / 1e6),
+						maxMs: Math.round(histogram.max / 1e6)
+					};
+					histogram.reset();
+					return sample;
+				} catch {
+					return ZERO_LOOP_DELAY;
+				}
+			},
+			stop: () => {
+				histogram.disable();
+			}
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Read the origin of the old-space ceiling off node's own options.
+*
+* hub-main is the only process in the cluster whose ceiling nobody chose. Every
+* forked runner is given V8 heap flags by `process-service.ts`; hub-main gets
+* `--max-old-space-size` from `docker-entrypoint.sh` ONLY when the operator sets
+* `CAMSTACK_HUB_HEAP_MB`, and on the live container it is unset — verified
+* 2026-08-25 by reading pid 7's argv, a bare `node .../starter.js`. So the
+* ceiling in force is whatever V8 derives from the host (4288MB there), and the
+* only record of that was a comment inside an image nobody rebuilds to read.
+*
+* A fact about the running process belongs in the running process's log, and
+* `execArgv` answers it for free at boot.
+*/
+function heapCeilingOrigin(execArgv = process.execArgv) {
+	return execArgv.some((arg) => /^--max[-_]old[-_]space[-_]size(=|$)/.test(arg)) ? "explicit" : "v8-default";
+}
 var MB = (bytes) => Math.round(bytes / 1048576);
 /**
 * Build a sample from raw readings. Pure so the thresholds are testable without
@@ -233,8 +300,10 @@ function createV8Reclaimer() {
 		return;
 	}
 }
-function format(label, s) {
-	return `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+function format(label, s, loop) {
+	const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+	if (loop === void 0) return line;
+	return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms`;
 }
 /**
 * Start the heartbeat. Returns a stop function.
@@ -242,7 +311,7 @@ function format(label, s) {
 * `unref`ed so it can never hold the process open, and every read is wrapped:
 * a diagnostic that can crash the process it watches is worse than none.
 */
-function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions) {
+function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv) {
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
 	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -251,14 +320,24 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 	const escalateRatio = reclaimOptions?.escalateRatio ?? .7;
 	const deescalateRatio = reclaimOptions?.deescalateRatio ?? .6;
 	let lastReclaimAt = Number.NEGATIVE_INFINITY;
+	/** Consecutive passes that fired the instant the floor elapsed. See
+	*  {@link RECLAIM_STEADY_STATE_PASSES}. */
+	let passesAtFloor = 0;
+	let steadyStateAnnounced = false;
 	const read = () => {
 		const limit = reclaimOptions?.heapLimitBytes ?? node_v8.getHeapStatistics().heap_size_limit;
 		return buildHeapSample(readMemory(), limit);
 	};
 	const maybeReclaim = (sample) => {
 		if (reclaimOptions === void 0) return;
-		if (!shouldReclaim(sample, triggerMb)) return;
-		if (now() - lastReclaimAt < minIntervalMs) return;
+		if (!shouldReclaim(sample, triggerMb)) {
+			passesAtFloor = 0;
+			steadyStateAnnounced = false;
+			return;
+		}
+		const sinceLast = now() - lastReclaimAt;
+		if (sinceLast < minIntervalMs) return;
+		passesAtFloor = sinceLast <= minIntervalMs * 2 ? passesAtFloor + 1 : 1;
 		lastReclaimAt = now();
 		const startedAt = now();
 		try {
@@ -269,6 +348,10 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 		}
 		const after = read();
 		sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB→${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB→${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
+		if (passesAtFloor >= 6 && !steadyStateAnnounced) {
+			steadyStateAnnounced = true;
+			sink.warn(`[mem] reclaim ${label} has run at the floor for ${passesAtFloor} consecutive passes (every ${minIntervalMs}ms) — the stop-the-world is now STEADY STATE, not a rescue. The allocation source is what needs the fix; this pass only bounds its peak.`);
+		}
 	};
 	let mode = "steady";
 	let lastLoggedAt = Number.NEGATIVE_INFINITY;
@@ -297,7 +380,7 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample);
+				const line = format(label, sample, loopDelay?.read());
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -309,11 +392,13 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 	const timer = setInterval(tick, probeIntervalMs);
 	timer.unref?.();
 	tick();
+	if (heapCeilingOrigin(execArgv) === "v8-default") sink.info(`[mem] ${label} heap ceiling is V8's DEFAULT (${read().heapLimitMb}MB) — no --max-old-space-size on argv. Nothing here CHOSE that number; it is derived from host RAM and moves with it.`);
 	let stopped = false;
 	return () => {
 		if (stopped) return;
 		stopped = true;
 		clearInterval(timer);
+		loopDelay?.stop();
 	};
 }
 /**

package/dist/{manifest-python-deps-DZSNlHjU.mjs → manifest-python-deps-DIIXlR1x.mjs}

@@ -10,6 +10,7 @@ import * as os from "node:os";
 import { tmpdir } from "node:os";
 import * as fs from "node:fs";
 import { createServer } from "node:http";
+import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as v8 from "node:v8";
 import * as vm from "node:vm";
 import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, createEventBusSliceSource, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
@@ -166,6 +167,72 @@ var HEAP_RECLAIM_TRIGGER_MB = 1024;
 * router's time, against a ~1.5GiB peak it removes each pass.
 */
 var HEAP_RECLAIM_MIN_INTERVAL_MS = 12e4;
+/** What a loop with nothing recorded yet reports. */
+var ZERO_LOOP_DELAY = {
+	p50Ms: 0,
+	p99Ms: 0,
+	maxMs: 0
+};
+/**
+* A `perf_hooks` interval histogram, read once per LOGGED line.
+*
+* The histogram samples in libuv at `resolutionMs` and costs nothing to keep
+* enabled; the expensive part would be reading it on every 2s probe, which
+* would also destroy the window the line claims to describe (probe and log
+* cadences are deliberately different — see {@link startHeapWatch}).
+*
+* An EMPTY histogram is the trap: Node answers `min = 9223372036854776000` and
+* `percentile()` throws on some versions, so a first heartbeat that read it
+* naively would print `loopMax=9223372036854ms` and be read as a catastrophe on
+* every boot. `count === 0` short-circuits to {@link ZERO_LOOP_DELAY}.
+*
+* Returns undefined if the platform declines, so the caller keeps a heartbeat
+* either way.
+*/
+function createLoopDelayMeter(resolutionMs = 20) {
+	try {
+		const histogram = monitorEventLoopDelay({ resolution: resolutionMs });
+		histogram.enable();
+		return {
+			read: () => {
+				try {
+					if (histogram.count === 0) return ZERO_LOOP_DELAY;
+					const sample = {
+						p50Ms: Math.round(histogram.percentile(50) / 1e6),
+						p99Ms: Math.round(histogram.percentile(99) / 1e6),
+						maxMs: Math.round(histogram.max / 1e6)
+					};
+					histogram.reset();
+					return sample;
+				} catch {
+					return ZERO_LOOP_DELAY;
+				}
+			},
+			stop: () => {
+				histogram.disable();
+			}
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Read the origin of the old-space ceiling off node's own options.
+*
+* hub-main is the only process in the cluster whose ceiling nobody chose. Every
+* forked runner is given V8 heap flags by `process-service.ts`; hub-main gets
+* `--max-old-space-size` from `docker-entrypoint.sh` ONLY when the operator sets
+* `CAMSTACK_HUB_HEAP_MB`, and on the live container it is unset — verified
+* 2026-08-25 by reading pid 7's argv, a bare `node .../starter.js`. So the
+* ceiling in force is whatever V8 derives from the host (4288MB there), and the
+* only record of that was a comment inside an image nobody rebuilds to read.
+*
+* A fact about the running process belongs in the running process's log, and
+* `execArgv` answers it for free at boot.
+*/
+function heapCeilingOrigin(execArgv = process.execArgv) {
+	return execArgv.some((arg) => /^--max[-_]old[-_]space[-_]size(=|$)/.test(arg)) ? "explicit" : "v8-default";
+}
 var MB = (bytes) => Math.round(bytes / 1048576);
 /**
 * Build a sample from raw readings. Pure so the thresholds are testable without
@@ -229,8 +296,10 @@ function createV8Reclaimer() {
 		return;
 	}
 }
-function format(label, s) {
-	return `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+function format(label, s, loop) {
+	const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+	if (loop === void 0) return line;
+	return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms`;
 }
 /**
 * Start the heartbeat. Returns a stop function.
@@ -238,7 +307,7 @@ function format(label, s) {
 * `unref`ed so it can never hold the process open, and every read is wrapped:
 * a diagnostic that can crash the process it watches is worse than none.
 */
-function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions) {
+function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv) {
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
 	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -247,14 +316,24 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 	const escalateRatio = reclaimOptions?.escalateRatio ?? .7;
 	const deescalateRatio = reclaimOptions?.deescalateRatio ?? .6;
 	let lastReclaimAt = Number.NEGATIVE_INFINITY;
+	/** Consecutive passes that fired the instant the floor elapsed. See
+	*  {@link RECLAIM_STEADY_STATE_PASSES}. */
+	let passesAtFloor = 0;
+	let steadyStateAnnounced = false;
 	const read = () => {
 		const limit = reclaimOptions?.heapLimitBytes ?? v8.getHeapStatistics().heap_size_limit;
 		return buildHeapSample(readMemory(), limit);
 	};
 	const maybeReclaim = (sample) => {
 		if (reclaimOptions === void 0) return;
-		if (!shouldReclaim(sample, triggerMb)) return;
-		if (now() - lastReclaimAt < minIntervalMs) return;
+		if (!shouldReclaim(sample, triggerMb)) {
+			passesAtFloor = 0;
+			steadyStateAnnounced = false;
+			return;
+		}
+		const sinceLast = now() - lastReclaimAt;
+		if (sinceLast < minIntervalMs) return;
+		passesAtFloor = sinceLast <= minIntervalMs * 2 ? passesAtFloor + 1 : 1;
 		lastReclaimAt = now();
 		const startedAt = now();
 		try {
@@ -265,6 +344,10 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 		}
 		const after = read();
 		sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB→${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB→${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
+		if (passesAtFloor >= 6 && !steadyStateAnnounced) {
+			steadyStateAnnounced = true;
+			sink.warn(`[mem] reclaim ${label} has run at the floor for ${passesAtFloor} consecutive passes (every ${minIntervalMs}ms) — the stop-the-world is now STEADY STATE, not a rescue. The allocation source is what needs the fix; this pass only bounds its peak.`);
+		}
 	};
 	let mode = "steady";
 	let lastLoggedAt = Number.NEGATIVE_INFINITY;
@@ -293,7 +376,7 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample);
+				const line = format(label, sample, loopDelay?.read());
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -305,11 +388,13 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 	const timer = setInterval(tick, probeIntervalMs);
 	timer.unref?.();
 	tick();
+	if (heapCeilingOrigin(execArgv) === "v8-default") sink.info(`[mem] ${label} heap ceiling is V8's DEFAULT (${read().heapLimitMb}MB) — no --max-old-space-size on argv. Nothing here CHOSE that number; it is derived from host RAM and moves with it.`);
 	let stopped = false;
 	return () => {
 		if (stopped) return;
 		stopped = true;
 		clearInterval(timer);
+		loopDelay?.stop();
 	};
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.122",
+  "version": "1.2.123",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",