@camstack/system 1.2.123 → 1.2.125

package/dist/{dist-DnhGRFEn.js → dist-CIDgcxPk.js}

@@ -9213,6 +9213,27 @@ var LinkedDeviceSchema = zod.z.object({
 	features: zod.z.array(zod.z.string()),
 	producesTrackedEvents: zod.z.boolean().optional()
 });
+/** One camera's resolved linked set, tagged with the camera it belongs to.
+*  The batch answer needs the tag; the single-device answer already has it
+*  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
+var LinkedDevicesForDeviceSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	mode: LinkedDevicesModeSchema,
+	devices: zod.z.array(LinkedDeviceSchema)
+});
+/** One device's binding map — the shape `getBindings`, `getBindingsBatch` and
+*  `getAllBindings` all answer in. Declared once: three copies of the same
+*  object literal is exactly how the three drift apart. */
+var DeviceBindingsForDeviceSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	entries: zod.z.array(zod.z.object({
+		capName: zod.z.string(),
+		kind: zod.z.enum(["native", "wrapped"]),
+		providerAddonId: zod.z.string(),
+		providerNodeId: zod.z.string(),
+		nativeAddonId: zod.z.string()
+	}))
+});
 var SavedDeviceRowSchema = zod.z.object({
 	/** Numeric id reserved at allocateDeviceId time. */
 	id: zod.z.number(),
@@ -9575,7 +9596,21 @@ var deviceManagerCapability = {
 			projection: zod.z.enum(["full", "slim"]).optional(),
 			/** Return only camera devices. Filtering server-side instead of
 			*  shipping 293 rows to find 12. */
-			isCamera: zod.z.boolean().optional()
+			isCamera: zod.z.boolean().optional(),
+			/**
+			* Return only these device ids. For the caller that already KNOWS the
+			* handful it wants and needs a field the id-bearing answer does not
+			* carry — the viewer's linked-devices panel joins `type` and `online`
+			* onto ~8 linked ids and, unfiltered, dragged the fleet across to do
+			* it: 433 KB slim / 958 KB full for 967 devices, on a query that
+			* refetches on the reconcile interval, on a phone.
+			*
+			* Safe to send at a hub that predates it: Zod STRIPS unknown input
+			* keys rather than rejecting them (verified against the live hub
+			* 2026-08-25 — 967 rows came back), so an old hub answers exactly what
+			* it answers today and the caller filters as it already does.
+			*/
+			deviceIds: zod.z.array(zod.z.number()).optional()
 		}), zod.z.array(DeviceInfoSchema)),
 		/** Get a single device by numeric deviceId. */
 		getDevice: method(zod.z.object({ deviceId: zod.z.number() }), DeviceInfoSchema.nullable()),
@@ -9594,6 +9629,23 @@ var deviceManagerCapability = {
 			mode: LinkedDevicesModeSchema,
 			devices: zod.z.array(LinkedDeviceSchema)
 		})),
+		/**
+		* `getLinkedDevices` for MANY cameras, in one call.
+		*
+		* Not a convenience wrapper — a cost fix. Resolving one camera's linked set
+		* needs the whole fleet as candidates (children ∪ same-location), so the
+		* single-device path runs a full `listAll` per call. Asked per camera that
+		* is N full-fleet sweeps of device-manager's event loop, and they do not
+		* overlap: measured on the live hub 2026-08-25, 30 concurrent
+		* `getLinkedDevices` took 4110 ms wall (median 4060 ms each) to return
+		* 7260 bytes in total. The batch takes ONE sweep and one settings read per
+		* camera.
+		*
+		* A device id that resolves to nothing still gets a row (`devices: []`) —
+		* a caller that asked for thirty and got twenty-eight cannot tell which two
+		* are missing, or that any are.
+		*/
+		getLinkedDevicesBatch: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()) }), zod.z.array(LinkedDevicesForDeviceSchema)),
 		/** Get stream sources for a camera device. */
 		getStreamSources: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(StreamSourceEntrySchema$1)),
 		/** Get config entries (key + value + description) for a device. */
@@ -9651,16 +9703,22 @@ var deviceManagerCapability = {
 		* currently-active provider (native or wrapper) + the underlying native
 		* addon id, so consumers can decide routing without re-running discovery.
 		*/
-		getBindings: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
-			deviceId: zod.z.number(),
-			entries: zod.z.array(zod.z.object({
-				capName: zod.z.string(),
-				kind: zod.z.enum(["native", "wrapped"]),
-				providerAddonId: zod.z.string(),
-				providerNodeId: zod.z.string(),
-				nativeAddonId: zod.z.string()
-			}))
-		})),
+		getBindings: method(zod.z.object({ deviceId: zod.z.number() }), DeviceBindingsForDeviceSchema),
+		/**
+		* `getBindings` for a NAMED set of devices, in one call.
+		*
+		* Between `getBindings` (one device) and `getAllBindings` (all 988) there
+		* was nothing, so a caller that needs seventy-five either pays
+		* seventy-five round-trips or drags the whole fleet across. Measured on
+		* the live hub 2026-08-25: 75 concurrent `getBindings` = 1211 ms / 118 KB,
+		* `getAllBindings({})` = 511 ms / 679 KB. Neither is the right answer to
+		* "these seventy-five".
+		*
+		* Same resolver, same routing rules, same per-device shape as
+		* `getBindings`; ids are deduped and a device with no bindings answers
+		* `entries: []` rather than dropping out.
+		*/
+		getBindingsBatch: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()) }), zod.z.array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Return the binding map for every device known to the hub. Used by
 		* `SystemManager` warm-boot: a single round-trip resolves the
@@ -9669,16 +9727,7 @@ var deviceManagerCapability = {
 		* device add/remove) — clients invalidate via the
 		* `capability.binding-changed` event.
 		*/
-		getAllBindings: method(zod.z.object({}), zod.z.array(zod.z.object({
-			deviceId: zod.z.number(),
-			entries: zod.z.array(zod.z.object({
-				capName: zod.z.string(),
-				kind: zod.z.enum(["native", "wrapped"]),
-				providerAddonId: zod.z.string(),
-				providerNodeId: zod.z.string(),
-				nativeAddonId: zod.z.string()
-			}))
-		}))),
+		getAllBindings: method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Activate (or deactivate) a wrapper addon for a (device, cap) pair.
 		* Persists the binding via ctx.settings. active=false clears the wrapper
@@ -31810,6 +31859,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getBindingsBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getChildren": {
 		capName: "device-manager",
 		capScope: "system",
@@ -31870,6 +31925,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getLinkedDevicesBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getRoleDisplayDefaults": {
 		capName: "device-manager",
 		capScope: "system",
@@ -36517,6 +36578,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getBindingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getChildren": [{
 		name: "parentDeviceId",
 		form: "single",
@@ -36562,6 +36628,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getLinkedDevicesBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getSettingsSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -36582,6 +36653,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.listAll": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"deviceManager.loadConfig": [{
 		name: "deviceId",
 		form: "single",

package/dist/{dist-CEhrHp3u.mjs → dist-CvJrtLkw.mjs}

@@ -9213,6 +9213,27 @@ var LinkedDeviceSchema = z.object({
 	features: z.array(z.string()),
 	producesTrackedEvents: z.boolean().optional()
 });
+/** One camera's resolved linked set, tagged with the camera it belongs to.
+*  The batch answer needs the tag; the single-device answer already has it
+*  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
+var LinkedDevicesForDeviceSchema = z.object({
+	deviceId: z.number(),
+	mode: LinkedDevicesModeSchema,
+	devices: z.array(LinkedDeviceSchema)
+});
+/** One device's binding map — the shape `getBindings`, `getBindingsBatch` and
+*  `getAllBindings` all answer in. Declared once: three copies of the same
+*  object literal is exactly how the three drift apart. */
+var DeviceBindingsForDeviceSchema = z.object({
+	deviceId: z.number(),
+	entries: z.array(z.object({
+		capName: z.string(),
+		kind: z.enum(["native", "wrapped"]),
+		providerAddonId: z.string(),
+		providerNodeId: z.string(),
+		nativeAddonId: z.string()
+	}))
+});
 var SavedDeviceRowSchema = z.object({
 	/** Numeric id reserved at allocateDeviceId time. */
 	id: z.number(),
@@ -9575,7 +9596,21 @@ var deviceManagerCapability = {
 			projection: z.enum(["full", "slim"]).optional(),
 			/** Return only camera devices. Filtering server-side instead of
 			*  shipping 293 rows to find 12. */
-			isCamera: z.boolean().optional()
+			isCamera: z.boolean().optional(),
+			/**
+			* Return only these device ids. For the caller that already KNOWS the
+			* handful it wants and needs a field the id-bearing answer does not
+			* carry — the viewer's linked-devices panel joins `type` and `online`
+			* onto ~8 linked ids and, unfiltered, dragged the fleet across to do
+			* it: 433 KB slim / 958 KB full for 967 devices, on a query that
+			* refetches on the reconcile interval, on a phone.
+			*
+			* Safe to send at a hub that predates it: Zod STRIPS unknown input
+			* keys rather than rejecting them (verified against the live hub
+			* 2026-08-25 — 967 rows came back), so an old hub answers exactly what
+			* it answers today and the caller filters as it already does.
+			*/
+			deviceIds: z.array(z.number()).optional()
 		}), z.array(DeviceInfoSchema)),
 		/** Get a single device by numeric deviceId. */
 		getDevice: method(z.object({ deviceId: z.number() }), DeviceInfoSchema.nullable()),
@@ -9594,6 +9629,23 @@ var deviceManagerCapability = {
 			mode: LinkedDevicesModeSchema,
 			devices: z.array(LinkedDeviceSchema)
 		})),
+		/**
+		* `getLinkedDevices` for MANY cameras, in one call.
+		*
+		* Not a convenience wrapper — a cost fix. Resolving one camera's linked set
+		* needs the whole fleet as candidates (children ∪ same-location), so the
+		* single-device path runs a full `listAll` per call. Asked per camera that
+		* is N full-fleet sweeps of device-manager's event loop, and they do not
+		* overlap: measured on the live hub 2026-08-25, 30 concurrent
+		* `getLinkedDevices` took 4110 ms wall (median 4060 ms each) to return
+		* 7260 bytes in total. The batch takes ONE sweep and one settings read per
+		* camera.
+		*
+		* A device id that resolves to nothing still gets a row (`devices: []`) —
+		* a caller that asked for thirty and got twenty-eight cannot tell which two
+		* are missing, or that any are.
+		*/
+		getLinkedDevicesBatch: method(z.object({ deviceIds: z.array(z.number()) }), z.array(LinkedDevicesForDeviceSchema)),
 		/** Get stream sources for a camera device. */
 		getStreamSources: method(z.object({ deviceId: z.number() }), z.array(StreamSourceEntrySchema$1)),
 		/** Get config entries (key + value + description) for a device. */
@@ -9651,16 +9703,22 @@ var deviceManagerCapability = {
 		* currently-active provider (native or wrapper) + the underlying native
 		* addon id, so consumers can decide routing without re-running discovery.
 		*/
-		getBindings: method(z.object({ deviceId: z.number() }), z.object({
-			deviceId: z.number(),
-			entries: z.array(z.object({
-				capName: z.string(),
-				kind: z.enum(["native", "wrapped"]),
-				providerAddonId: z.string(),
-				providerNodeId: z.string(),
-				nativeAddonId: z.string()
-			}))
-		})),
+		getBindings: method(z.object({ deviceId: z.number() }), DeviceBindingsForDeviceSchema),
+		/**
+		* `getBindings` for a NAMED set of devices, in one call.
+		*
+		* Between `getBindings` (one device) and `getAllBindings` (all 988) there
+		* was nothing, so a caller that needs seventy-five either pays
+		* seventy-five round-trips or drags the whole fleet across. Measured on
+		* the live hub 2026-08-25: 75 concurrent `getBindings` = 1211 ms / 118 KB,
+		* `getAllBindings({})` = 511 ms / 679 KB. Neither is the right answer to
+		* "these seventy-five".
+		*
+		* Same resolver, same routing rules, same per-device shape as
+		* `getBindings`; ids are deduped and a device with no bindings answers
+		* `entries: []` rather than dropping out.
+		*/
+		getBindingsBatch: method(z.object({ deviceIds: z.array(z.number()) }), z.array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Return the binding map for every device known to the hub. Used by
 		* `SystemManager` warm-boot: a single round-trip resolves the
@@ -9669,16 +9727,7 @@ var deviceManagerCapability = {
 		* device add/remove) — clients invalidate via the
 		* `capability.binding-changed` event.
 		*/
-		getAllBindings: method(z.object({}), z.array(z.object({
-			deviceId: z.number(),
-			entries: z.array(z.object({
-				capName: z.string(),
-				kind: z.enum(["native", "wrapped"]),
-				providerAddonId: z.string(),
-				providerNodeId: z.string(),
-				nativeAddonId: z.string()
-			}))
-		}))),
+		getAllBindings: method(z.object({}), z.array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Activate (or deactivate) a wrapper addon for a (device, cap) pair.
 		* Persists the binding via ctx.settings. active=false clears the wrapper
@@ -31810,6 +31859,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getBindingsBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getChildren": {
 		capName: "device-manager",
 		capScope: "system",
@@ -31870,6 +31925,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getLinkedDevicesBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getRoleDisplayDefaults": {
 		capName: "device-manager",
 		capScope: "system",
@@ -36517,6 +36578,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getBindingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getChildren": [{
 		name: "parentDeviceId",
 		form: "single",
@@ -36562,6 +36628,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getLinkedDevicesBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getSettingsSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -36582,6 +36653,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.listAll": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"deviceManager.loadConfig": [{
 		name: "deviceId",
 		form: "single",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DnhGRFEn.js");
+const require_dist = require("./dist-CIDgcxPk.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
-const require_manifest_python_deps = require("./manifest-python-deps-B3_4YiDK.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_lan_http_bind = require("./lan-http-bind-DmgpFP6_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
@@ -93976,6 +93976,33 @@ var CrashSupervisor = class {
 		this.crashes.delete(runnerId);
 	}
 };
+/**
+* Resolve the native-allocator env for a child runner from the parent's env.
+*
+* Precedence, highest first:
+*   1. `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` — kill switch, returns nothing and
+*      restores the glibc/sharp defaults. Recoverable without a rebuild.
+*   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
+*      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
+*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
+*   4. The defaults above.
+*
+* A nonsense override falls back to the default rather than being passed through:
+* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
+* exists to leave.
+*/
+function runnerNativeAllocatorEnv(parentEnv) {
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
+	return {
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
+	};
+}
+function positiveInt(raw, fallback) {
+	if (raw === void 0) return fallback;
+	const n = Number.parseInt(raw, 10);
+	return Number.isFinite(n) && n > 0 ? n : fallback;
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94136,7 +94163,18 @@ function isHeavyRunner(addons) {
 *
 * A runner whose working set genuinely does not fit declares its own number in its manifest
 * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `stream-broker` (1323 MB measured, frame buffers) is the one shipped addon that does.
+* `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
+* shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+* from RSS.
+*
+* ## What this flag CANNOT do
+*
+* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 /**
@@ -94262,10 +94300,11 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
+			...runnerNativeAllocatorEnv(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
-		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-CEhrHp3u.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-CvJrtLkw.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-DIIXlR1x.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Dmcnb287.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { C as evaluateExistingCert, S as SERVER_AUTH_OID, _ as CA_COMMON_NAME, a as closeLanHttp, b as LEAF_RENEWAL_WINDOW_DAYS, c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, h as loadTlsCert, i as bindPendingLanHttp, l as readTlsAccessStatus, m as ensureTlsCert, n as allFamiliesListenHost, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, s as registerLanHttpHandler, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode, v as collectCertIdentity, x as MAX_LEAF_VALIDITY_DAYS, y as CA_VALIDITY_DAYS } from "./lan-http-bind-jKrj6OjQ.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
@@ -93969,6 +93969,33 @@ var CrashSupervisor = class {
 		this.crashes.delete(runnerId);
 	}
 };
+/**
+* Resolve the native-allocator env for a child runner from the parent's env.
+*
+* Precedence, highest first:
+*   1. `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` — kill switch, returns nothing and
+*      restores the glibc/sharp defaults. Recoverable without a rebuild.
+*   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
+*      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
+*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
+*   4. The defaults above.
+*
+* A nonsense override falls back to the default rather than being passed through:
+* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
+* exists to leave.
+*/
+function runnerNativeAllocatorEnv(parentEnv) {
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
+	return {
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
+	};
+}
+function positiveInt(raw, fallback) {
+	if (raw === void 0) return fallback;
+	const n = Number.parseInt(raw, 10);
+	return Number.isFinite(n) && n > 0 ? n : fallback;
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94129,7 +94156,18 @@ function isHeavyRunner(addons) {
 *
 * A runner whose working set genuinely does not fit declares its own number in its manifest
 * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `stream-broker` (1323 MB measured, frame buffers) is the one shipped addon that does.
+* `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
+* shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+* from RSS.
+*
+* ## What this flag CANNOT do
+*
+* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 /**
@@ -94255,10 +94293,11 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
+			...runnerNativeAllocatorEnv(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
-		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [

package/dist/kernel/heap-watch.d.ts

@@ -246,7 +246,7 @@ export interface HeapReclaimOptions {
  * `unref`ed so it can never hold the process open, and every read is wrapped:
  * a diagnostic that can crash the process it watches is worse than none.
  */
-export declare function startHeapWatch(label?: string, sink?: HeapWatchSink, intervalMs?: number, reclaimOptions?: HeapReclaimOptions, loopDelay?: LoopDelayMeter | undefined, execArgv?: readonly string[]): () => void;
+export declare function startHeapWatch(label?: string, sink?: HeapWatchSink, intervalMs?: number, reclaimOptions?: HeapReclaimOptions, loopDelay?: LoopDelayMeter | undefined, execArgv?: readonly string[], announceCeilingOrigin?: boolean): () => void;
 /**
  * Steady heartbeat period for a HEAVY addon runner.
  *
@@ -291,14 +291,17 @@ export interface RunnerHeapWatchOptions {
  *
  * ## Why heavy runners get hub-main's mechanism
  *
- * The media-path runners deliberately run with NO old-space ceiling
- * (`maxOldSpaceMb: 0` — a flat cap turned a disk-stall backlog into
- * `Ineffective mark-compacts near heap limit` and killed recording, twice on
- * 2026-08-17). Uncapped, V8 feels no pressure, so a one-off burst becomes the
- * runner's permanent RSS: the recorder measured 2122MB holding a ~50MB index.
- * hub-main had exactly this shape and its reclaimer is proven live — 11 passes
- * in 4h, 375–1652MB returned per pass at 550–680ms each. Same mechanism, same
- * `shouldReclaim` stranded-over-trigger gate; never a second implementation.
+ * Because a heap ceiling cannot reach what actually strands in them. Every
+ * media-path runner now carries an old-space ceiling sized from its own
+ * measured peak (`addon-pipeline` manifest + its `manifest-heap-ceilings` spec),
+ * and that changes nothing here: what a heavy runner strands is NATIVE —
+ * `external`, `arrayBuffers`, glibc arena free lists — none of which
+ * `--max-old-space-size` bounds. Measured 2026-08-25, `hub/pipeline-analytics`
+ * reported `stranded=2552MB` while holding an 81MB V8 heap under a 1024MB
+ * ceiling that was in force the whole time. hub-main had exactly this shape and
+ * its reclaimer is proven live — 11 passes in 4h, 375–1652MB returned per pass
+ * at 550–680ms each. Same mechanism, same `shouldReclaim` stranded-over-trigger
+ * gate; never a second implementation.
  *
  * ## The stall, priced for the runners that get it
  *

package/dist/kernel/moleculer/process-service.d.ts

@@ -36,7 +36,18 @@ interface RunnerAddonSpec {
  *
  * A runner whose working set genuinely does not fit declares its own number in its manifest
  * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
- * `stream-broker` (1323 MB measured, frame buffers) is the one shipped addon that does.
+ * `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
+ * shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+ * `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+ * space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+ * from RSS.
+ *
+ * ## What this flag CANNOT do
+ *
+ * It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+ * addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+ * whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+ * Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
  */
 export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 interface SpawnedProcess {