@camstack/system 1.2.124 → 1.2.126

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DB_4H3tR.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -10,229 +10,6 @@ let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);
 let _camstack_types_addon = require("@camstack/types/addon");
 let node_url = require("node:url");
-//#region src/kernel/moleculer/worker-device-restore.ts
-/**
-* Worker-side device restore helper.
-*
-* Shared by `process-runner` (single-addon subprocess) and
-* `group-runner` (group subprocess). Calls the worker addon's
-* `restoreDevices(SavedDevice[])` with devices read from the hub's
-* `device-manager` capability. Blocks on the `system.ready-state`
-* readiness of the hub's `device-manager` via
-* `ReadinessRegistry.awaitReady`, then issues the calls ONCE.
-*
-* Lives in its own module so it can be imported without triggering
-* the runner entry-point side effects (each runner is also an
-* executable that calls `main()` at import time).
-*/
-async function runWorkerDeviceRestoreWithRetry(addon, context, addonId, sourceNodeId) {
-	const log = context.logger;
-	log?.debug?.(`[worker-restore] entry: addon="${addonId}" sourceNodeId="${sourceNodeId}"`);
-	const restoreFn = addon.restoreDevices;
-	if (typeof restoreFn !== "function") {
-		log?.warn?.(`[worker-restore] "${addonId}": no restoreDevices function — skipping`);
-		return;
-	}
-	const api = context.api;
-	if (!api) {
-		log?.warn?.(`[worker-restore] "${addonId}": context.api missing — skipping`);
-		return;
-	}
-	const bus = context.eventBus;
-	if (!bus) {
-		log?.warn?.(`[worker-restore] "${addonId}": context.eventBus missing — skipping`);
-		return;
-	}
-	const shared = context.kernel?.readinessRegistry ?? null;
-	const registry = shared ?? new _camstack_types_addon.ReadinessRegistry({
-		eventBus: bus,
-		sourceNodeId,
-		logger: context.logger
-	});
-	log?.debug?.(`[worker-restore] "${addonId}": awaiting device-manager readiness on hub...`);
-	try {
-		await registry.awaitReady("device-manager", {
-			type: "node",
-			nodeId: "hub"
-		}, { timeoutMs: 6e4 });
-		log?.debug?.(`[worker-restore] "${addonId}": device-manager READY`);
-	} catch (err) {
-		if (err instanceof _camstack_types_addon.ReadinessTimeoutError) {
-			context.logger?.warn?.(`[worker-restore] device-manager not ready within ${err.waitedMs}ms — skipping for "${addonId}"`);
-			return;
-		}
-		throw err;
-	} finally {
-		if (!shared && registry instanceof _camstack_types_addon.ReadinessRegistry) registry.close();
-	}
-	try {
-		const deviceManager = Reflect.get(api, "deviceManager");
-		log?.debug?.(`[worker-restore] "${addonId}": calling listPersistedByAddon...`);
-		const rowsResult = await deviceManager.listPersistedByAddon.query({ addonId });
-		log?.debug?.(`[worker-restore] "${addonId}": got ${Array.isArray(rowsResult) ? rowsResult.length : 0} row(s)`);
-		const rows = Array.isArray(rowsResult) ? rowsResult : [];
-		if (rows.length === 0) {
-			context.logger?.info?.(`[worker-restore] no persisted devices to restore for addon "${addonId}"`);
-			return;
-		}
-		const savedDevices = await Promise.all(rows.map(async (row) => {
-			const config = await deviceManager.loadConfig.query({ deviceId: row.id });
-			return {
-				id: row.id,
-				stableId: row.stableId,
-				type: row.type,
-				name: row.name,
-				parentDeviceId: row.parentDeviceId,
-				config: config ?? {}
-			};
-		}));
-		await restoreFn.call(addon, savedDevices);
-		log?.info?.(`[worker-restore] "${addonId}": restored ${savedDevices.length} device(s)`);
-	} catch (err) {
-		log?.warn?.(`[worker-restore] "${addonId}": restoreDevices threw: ${(0, _camstack_types_addon.errMsg)(err)}`);
-	}
-}
-//#endregion
-//#region src/kernel/moleculer/register-framework-resolver.ts
-/**
-* Register the ESM resolver hook so this runner's addon imports of the
-* host-provided packages (@camstack/system, @camstack/shm-ring, …) resolve from
-* `frameworkDir/node_modules` instead of failing to walk up from the addon's
-* isolated `/data/addons/<addon>` folder. No-op in dev (frameworkDir unset),
-* where workspace symlinks already resolve the framework.
-*/
-function registerFrameworkResolver(frameworkDir) {
-	if (!frameworkDir) return;
-	(0, node_module.register)((0, node_url.pathToFileURL)(node_path.join(__dirname, "framework-resolver-hook.mjs")), {
-		parentURL: (0, node_url.pathToFileURL)(`${__dirname}/`).href,
-		data: { frameworkDir }
-	});
-}
-/**
-* Start warning if `initialize()` has not returned within `firstMs`.
-*
-* The caller MUST `clear()` in a `finally`, so a throwing initialize (which the
-* runner turns into `process.exit(1)`) does not keep the timer alive.
-*/
-function startInitWatchdog(options) {
-	const now = options.now ?? Date.now;
-	const firstMs = options.firstMs ?? 6e4;
-	const repeatMs = options.repeatMs ?? 3e5;
-	const startedAt = now();
-	let timer;
-	let cleared = false;
-	const schedule = (ms) => {
-		timer = setTimeout(fire, ms);
-		timer.unref?.();
-	};
-	function fire() {
-		if (cleared) return;
-		const elapsedMs = now() - startedAt;
-		options.warn(`addon "${options.addonId}" initialize() has not returned after ${Math.round(elapsedMs / 1e3)}s — its capability manifest is NOT published, so every caller of ${options.declaredCapabilities.length > 0 ? options.declaredCapabilities.join(", ") : "(none declared)"} sees "no provider registered"`, {
-			addonId: options.addonId,
-			elapsedMs,
-			unpublishedCapabilities: [...options.declaredCapabilities]
-		});
-		schedule(repeatMs);
-	}
-	schedule(firstMs);
-	return { clear() {
-		cleared = true;
-		if (timer !== void 0) {
-			clearTimeout(timer);
-			timer = void 0;
-		}
-	} };
-}
-//#endregion
-//#region src/kernel/moleculer/child-cap-dispatch.ts
-/** Type guard narrowing a dynamically-read provider member to a callable method. */
-function isCapMethod(value) {
-	return typeof value === "function";
-}
-/**
-* Extract a string `addonId` out of arbitrary method args — the fallback
-* provider-selection hint for calls that arrive WITHOUT the out-of-band
-* `CapCallMessage.addonId` (e.g. a sibling child's unowned collection call
-* forwarded by the parent, where the raw input still carries `addonId`).
-*/
-function extractArgsAddonId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "addonId");
-	return typeof raw === "string" ? raw : void 0;
-}
-/**
-* Creates a unified dispatcher that routes a {@link CapCallInput} to either a
-* device-scoped or singleton provider, then invokes the requested method.
-*
-* Pure module — no Moleculer, no broker, no addon-runner dependency.
-*/
-function createChildCapDispatch(deps) {
-	return async (call) => {
-		const { capName, method, args, deviceId } = call;
-		const addonId = call.addonId ?? extractArgsAddonId(args);
-		let provider;
-		if (deviceId !== void 0) {
-			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName, addonId);
-			if (provider == null) throw new Error(`child-cap-dispatch: no provider for '${capName}' (device '${String(deviceId)}' or singleton)`);
-		} else {
-			provider = deps.getSingletonProvider(capName, addonId);
-			if (provider == null) throw new Error(`child-cap-dispatch: no singleton provider for '${capName}'`);
-		}
-		const fn = Reflect.get(provider, method);
-		if (!isCapMethod(fn)) {
-			if (deps.isCollectionListMethod(capName, method)) return [];
-			throw new Error(`child-cap-dispatch: method '${method}' not found on provider '${capName}'`);
-		}
-		return await fn.call(provider, args);
-	};
-}
-//#endregion
-//#region src/kernel/moleculer/child-cap-descriptors.ts
-/**
-* Builds the {@link ChildCapDescriptor} array that the UDS child transport
-* sends to the parent on registration.
-*
-* - Singleton caps come from the runner UNION manifest (all caps registered by
-*   every addon in this runner). One descriptor per unique (addonId, capName)
-*   pair, mode `'singleton'` and no `deviceId`. The `addonId` stamp lets the
-*   parent's manifest builder register each hosted addon's caps under the
-*   REAL addon id — a GROUPED runner (`execution.group`) hosts several addons,
-*   and deduplicating by capName alone would collapse two co-located providers
-*   of the same collection cap (e.g. `network-access` from cloudflare-tunnel
-*   AND tailscale-ingress) into one descriptor registered under a synthetic
-*   `addonId = childId` (the group name) — the "@camstack/addon-net-access"
-*   admin-UI bug.
-* - Device-scoped caps come from the native-cap snapshot — one descriptor per
-*   (capName, deviceId) pair, mode `'collection'`, stamped with the owning
-*   addon's id.
-*
-* Pure module — extracted from `addon-runner.ts` (whose `main()` runs at
-* import time) so it is unit-testable.
-*/
-function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
-	const descriptors = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of manifest) for (const capName of entry.capabilities) {
-		const key = `${entry.addonId}::${capName}`;
-		if (!seen.has(key)) {
-			seen.add(key);
-			descriptors.push({
-				capName,
-				mode: "singleton",
-				addonId: entry.addonId
-			});
-		}
-	}
-	for (const { capName, addonId, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
-		capName,
-		mode: "collection",
-		deviceId,
-		addonId
-	});
-	return descriptors;
-}
-//#endregion
 //#region src/kernel/moleculer/child-addon-call-dispatch.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -324,6 +101,229 @@ function createChildAddonCallDispatch(deps) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/child-cap-descriptors.ts
+/**
+* Builds the {@link ChildCapDescriptor} array that the UDS child transport
+* sends to the parent on registration.
+*
+* - Singleton caps come from the runner UNION manifest (all caps registered by
+*   every addon in this runner). One descriptor per unique (addonId, capName)
+*   pair, mode `'singleton'` and no `deviceId`. The `addonId` stamp lets the
+*   parent's manifest builder register each hosted addon's caps under the
+*   REAL addon id — a GROUPED runner (`execution.group`) hosts several addons,
+*   and deduplicating by capName alone would collapse two co-located providers
+*   of the same collection cap (e.g. `network-access` from cloudflare-tunnel
+*   AND tailscale-ingress) into one descriptor registered under a synthetic
+*   `addonId = childId` (the group name) — the "@camstack/addon-net-access"
+*   admin-UI bug.
+* - Device-scoped caps come from the native-cap snapshot — one descriptor per
+*   (capName, deviceId) pair, mode `'collection'`, stamped with the owning
+*   addon's id.
+*
+* Pure module — extracted from `addon-runner.ts` (whose `main()` runs at
+* import time) so it is unit-testable.
+*/
+function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
+	const descriptors = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of manifest) for (const capName of entry.capabilities) {
+		const key = `${entry.addonId}::${capName}`;
+		if (!seen.has(key)) {
+			seen.add(key);
+			descriptors.push({
+				capName,
+				mode: "singleton",
+				addonId: entry.addonId
+			});
+		}
+	}
+	for (const { capName, addonId, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
+		capName,
+		mode: "collection",
+		deviceId,
+		addonId
+	});
+	return descriptors;
+}
+//#endregion
+//#region src/kernel/moleculer/child-cap-dispatch.ts
+/** Type guard narrowing a dynamically-read provider member to a callable method. */
+function isCapMethod(value) {
+	return typeof value === "function";
+}
+/**
+* Extract a string `addonId` out of arbitrary method args — the fallback
+* provider-selection hint for calls that arrive WITHOUT the out-of-band
+* `CapCallMessage.addonId` (e.g. a sibling child's unowned collection call
+* forwarded by the parent, where the raw input still carries `addonId`).
+*/
+function extractArgsAddonId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "addonId");
+	return typeof raw === "string" ? raw : void 0;
+}
+/**
+* Creates a unified dispatcher that routes a {@link CapCallInput} to either a
+* device-scoped or singleton provider, then invokes the requested method.
+*
+* Pure module — no Moleculer, no broker, no addon-runner dependency.
+*/
+function createChildCapDispatch(deps) {
+	return async (call) => {
+		const { capName, method, args, deviceId } = call;
+		const addonId = call.addonId ?? extractArgsAddonId(args);
+		let provider;
+		if (deviceId !== void 0) {
+			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName, addonId);
+			if (provider == null) throw new Error(`child-cap-dispatch: no provider for '${capName}' (device '${String(deviceId)}' or singleton)`);
+		} else {
+			provider = deps.getSingletonProvider(capName, addonId);
+			if (provider == null) throw new Error(`child-cap-dispatch: no singleton provider for '${capName}'`);
+		}
+		const fn = Reflect.get(provider, method);
+		if (!isCapMethod(fn)) {
+			if (deps.isCollectionListMethod(capName, method)) return [];
+			throw new Error(`child-cap-dispatch: method '${method}' not found on provider '${capName}'`);
+		}
+		return await fn.call(provider, args);
+	};
+}
+/**
+* Start warning if `initialize()` has not returned within `firstMs`.
+*
+* The caller MUST `clear()` in a `finally`, so a throwing initialize (which the
+* runner turns into `process.exit(1)`) does not keep the timer alive.
+*/
+function startInitWatchdog(options) {
+	const now = options.now ?? Date.now;
+	const firstMs = options.firstMs ?? 6e4;
+	const repeatMs = options.repeatMs ?? 3e5;
+	const startedAt = now();
+	let timer;
+	let cleared = false;
+	const schedule = (ms) => {
+		timer = setTimeout(fire, ms);
+		timer.unref?.();
+	};
+	function fire() {
+		if (cleared) return;
+		const elapsedMs = now() - startedAt;
+		options.warn(`addon "${options.addonId}" initialize() has not returned after ${Math.round(elapsedMs / 1e3)}s — its capability manifest is NOT published, so every caller of ${options.declaredCapabilities.length > 0 ? options.declaredCapabilities.join(", ") : "(none declared)"} sees "no provider registered"`, {
+			addonId: options.addonId,
+			elapsedMs,
+			unpublishedCapabilities: [...options.declaredCapabilities]
+		});
+		schedule(repeatMs);
+	}
+	schedule(firstMs);
+	return { clear() {
+		cleared = true;
+		if (timer !== void 0) {
+			clearTimeout(timer);
+			timer = void 0;
+		}
+	} };
+}
+//#endregion
+//#region src/kernel/moleculer/register-framework-resolver.ts
+/**
+* Register the ESM resolver hook so this runner's addon imports of the
+* host-provided packages (@camstack/system, @camstack/shm-ring, …) resolve from
+* `frameworkDir/node_modules` instead of failing to walk up from the addon's
+* isolated `/data/addons/<addon>` folder. No-op in dev (frameworkDir unset),
+* where workspace symlinks already resolve the framework.
+*/
+function registerFrameworkResolver(frameworkDir) {
+	if (!frameworkDir) return;
+	(0, node_module.register)((0, node_url.pathToFileURL)(node_path.join(__dirname, "framework-resolver-hook.mjs")), {
+		parentURL: (0, node_url.pathToFileURL)(`${__dirname}/`).href,
+		data: { frameworkDir }
+	});
+}
+//#endregion
+//#region src/kernel/moleculer/worker-device-restore.ts
+/**
+* Worker-side device restore helper.
+*
+* Shared by `process-runner` (single-addon subprocess) and
+* `group-runner` (group subprocess). Calls the worker addon's
+* `restoreDevices(SavedDevice[])` with devices read from the hub's
+* `device-manager` capability. Blocks on the `system.ready-state`
+* readiness of the hub's `device-manager` via
+* `ReadinessRegistry.awaitReady`, then issues the calls ONCE.
+*
+* Lives in its own module so it can be imported without triggering
+* the runner entry-point side effects (each runner is also an
+* executable that calls `main()` at import time).
+*/
+async function runWorkerDeviceRestoreWithRetry(addon, context, addonId, sourceNodeId) {
+	const log = context.logger;
+	log?.debug?.(`[worker-restore] entry: addon="${addonId}" sourceNodeId="${sourceNodeId}"`);
+	const restoreFn = addon.restoreDevices;
+	if (typeof restoreFn !== "function") {
+		log?.warn?.(`[worker-restore] "${addonId}": no restoreDevices function — skipping`);
+		return;
+	}
+	const api = context.api;
+	if (!api) {
+		log?.warn?.(`[worker-restore] "${addonId}": context.api missing — skipping`);
+		return;
+	}
+	const bus = context.eventBus;
+	if (!bus) {
+		log?.warn?.(`[worker-restore] "${addonId}": context.eventBus missing — skipping`);
+		return;
+	}
+	const shared = context.kernel?.readinessRegistry ?? null;
+	const registry = shared ?? new _camstack_types_addon.ReadinessRegistry({
+		eventBus: bus,
+		sourceNodeId,
+		logger: context.logger
+	});
+	log?.debug?.(`[worker-restore] "${addonId}": awaiting device-manager readiness on hub...`);
+	try {
+		await registry.awaitReady("device-manager", {
+			type: "node",
+			nodeId: "hub"
+		}, { timeoutMs: 6e4 });
+		log?.debug?.(`[worker-restore] "${addonId}": device-manager READY`);
+	} catch (err) {
+		if (err instanceof _camstack_types_addon.ReadinessTimeoutError) {
+			context.logger?.warn?.(`[worker-restore] device-manager not ready within ${err.waitedMs}ms — skipping for "${addonId}"`);
+			return;
+		}
+		throw err;
+	} finally {
+		if (!shared && registry instanceof _camstack_types_addon.ReadinessRegistry) registry.close();
+	}
+	try {
+		const deviceManager = Reflect.get(api, "deviceManager");
+		log?.debug?.(`[worker-restore] "${addonId}": calling listPersistedByAddon...`);
+		const rowsResult = await deviceManager.listPersistedByAddon.query({ addonId });
+		log?.debug?.(`[worker-restore] "${addonId}": got ${Array.isArray(rowsResult) ? rowsResult.length : 0} row(s)`);
+		const rows = Array.isArray(rowsResult) ? rowsResult : [];
+		if (rows.length === 0) {
+			context.logger?.info?.(`[worker-restore] no persisted devices to restore for addon "${addonId}"`);
+			return;
+		}
+		const savedDevices = await Promise.all(rows.map(async (row) => {
+			const config = await deviceManager.loadConfig.query({ deviceId: row.id });
+			return {
+				id: row.id,
+				stableId: row.stableId,
+				type: row.type,
+				name: row.name,
+				parentDeviceId: row.parentDeviceId,
+				config: config ?? {}
+			};
+		}));
+		await restoreFn.call(addon, savedDevices);
+		log?.info?.(`[worker-restore] "${addonId}": restored ${savedDevices.length} device(s)`);
+	} catch (err) {
+		log?.warn?.(`[worker-restore] "${addonId}": restoreDevices threw: ${(0, _camstack_types_addon.errMsg)(err)}`);
+	}
+}
+//#endregion
 //#region src/kernel/moleculer/addon-runner.ts
 /**
 * Addon Runner — THE unified entry point for spawned subprocesses.

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-D1Ydw7J0.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-Dmcnb287.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";
@@ -6,229 +6,6 @@ import * as fs from "node:fs";
 import * as v8 from "node:v8";
 import { ReadinessRegistry, ReadinessTimeoutError, errMsg, isCollectionArrayMethodName, normalizeAddonInitResult } from "@camstack/types/addon";
 import { pathToFileURL } from "node:url";
-//#region src/kernel/moleculer/worker-device-restore.ts
-/**
-* Worker-side device restore helper.
-*
-* Shared by `process-runner` (single-addon subprocess) and
-* `group-runner` (group subprocess). Calls the worker addon's
-* `restoreDevices(SavedDevice[])` with devices read from the hub's
-* `device-manager` capability. Blocks on the `system.ready-state`
-* readiness of the hub's `device-manager` via
-* `ReadinessRegistry.awaitReady`, then issues the calls ONCE.
-*
-* Lives in its own module so it can be imported without triggering
-* the runner entry-point side effects (each runner is also an
-* executable that calls `main()` at import time).
-*/
-async function runWorkerDeviceRestoreWithRetry(addon, context, addonId, sourceNodeId) {
-	const log = context.logger;
-	log?.debug?.(`[worker-restore] entry: addon="${addonId}" sourceNodeId="${sourceNodeId}"`);
-	const restoreFn = addon.restoreDevices;
-	if (typeof restoreFn !== "function") {
-		log?.warn?.(`[worker-restore] "${addonId}": no restoreDevices function — skipping`);
-		return;
-	}
-	const api = context.api;
-	if (!api) {
-		log?.warn?.(`[worker-restore] "${addonId}": context.api missing — skipping`);
-		return;
-	}
-	const bus = context.eventBus;
-	if (!bus) {
-		log?.warn?.(`[worker-restore] "${addonId}": context.eventBus missing — skipping`);
-		return;
-	}
-	const shared = context.kernel?.readinessRegistry ?? null;
-	const registry = shared ?? new ReadinessRegistry({
-		eventBus: bus,
-		sourceNodeId,
-		logger: context.logger
-	});
-	log?.debug?.(`[worker-restore] "${addonId}": awaiting device-manager readiness on hub...`);
-	try {
-		await registry.awaitReady("device-manager", {
-			type: "node",
-			nodeId: "hub"
-		}, { timeoutMs: 6e4 });
-		log?.debug?.(`[worker-restore] "${addonId}": device-manager READY`);
-	} catch (err) {
-		if (err instanceof ReadinessTimeoutError) {
-			context.logger?.warn?.(`[worker-restore] device-manager not ready within ${err.waitedMs}ms — skipping for "${addonId}"`);
-			return;
-		}
-		throw err;
-	} finally {
-		if (!shared && registry instanceof ReadinessRegistry) registry.close();
-	}
-	try {
-		const deviceManager = Reflect.get(api, "deviceManager");
-		log?.debug?.(`[worker-restore] "${addonId}": calling listPersistedByAddon...`);
-		const rowsResult = await deviceManager.listPersistedByAddon.query({ addonId });
-		log?.debug?.(`[worker-restore] "${addonId}": got ${Array.isArray(rowsResult) ? rowsResult.length : 0} row(s)`);
-		const rows = Array.isArray(rowsResult) ? rowsResult : [];
-		if (rows.length === 0) {
-			context.logger?.info?.(`[worker-restore] no persisted devices to restore for addon "${addonId}"`);
-			return;
-		}
-		const savedDevices = await Promise.all(rows.map(async (row) => {
-			const config = await deviceManager.loadConfig.query({ deviceId: row.id });
-			return {
-				id: row.id,
-				stableId: row.stableId,
-				type: row.type,
-				name: row.name,
-				parentDeviceId: row.parentDeviceId,
-				config: config ?? {}
-			};
-		}));
-		await restoreFn.call(addon, savedDevices);
-		log?.info?.(`[worker-restore] "${addonId}": restored ${savedDevices.length} device(s)`);
-	} catch (err) {
-		log?.warn?.(`[worker-restore] "${addonId}": restoreDevices threw: ${errMsg(err)}`);
-	}
-}
-//#endregion
-//#region src/kernel/moleculer/register-framework-resolver.ts
-/**
-* Register the ESM resolver hook so this runner's addon imports of the
-* host-provided packages (@camstack/system, @camstack/shm-ring, …) resolve from
-* `frameworkDir/node_modules` instead of failing to walk up from the addon's
-* isolated `/data/addons/<addon>` folder. No-op in dev (frameworkDir unset),
-* where workspace symlinks already resolve the framework.
-*/
-function registerFrameworkResolver(frameworkDir) {
-	if (!frameworkDir) return;
-	register(pathToFileURL(path$1.join(__dirname, "framework-resolver-hook.mjs")), {
-		parentURL: pathToFileURL(`${__dirname}/`).href,
-		data: { frameworkDir }
-	});
-}
-/**
-* Start warning if `initialize()` has not returned within `firstMs`.
-*
-* The caller MUST `clear()` in a `finally`, so a throwing initialize (which the
-* runner turns into `process.exit(1)`) does not keep the timer alive.
-*/
-function startInitWatchdog(options) {
-	const now = options.now ?? Date.now;
-	const firstMs = options.firstMs ?? 6e4;
-	const repeatMs = options.repeatMs ?? 3e5;
-	const startedAt = now();
-	let timer;
-	let cleared = false;
-	const schedule = (ms) => {
-		timer = setTimeout(fire, ms);
-		timer.unref?.();
-	};
-	function fire() {
-		if (cleared) return;
-		const elapsedMs = now() - startedAt;
-		options.warn(`addon "${options.addonId}" initialize() has not returned after ${Math.round(elapsedMs / 1e3)}s — its capability manifest is NOT published, so every caller of ${options.declaredCapabilities.length > 0 ? options.declaredCapabilities.join(", ") : "(none declared)"} sees "no provider registered"`, {
-			addonId: options.addonId,
-			elapsedMs,
-			unpublishedCapabilities: [...options.declaredCapabilities]
-		});
-		schedule(repeatMs);
-	}
-	schedule(firstMs);
-	return { clear() {
-		cleared = true;
-		if (timer !== void 0) {
-			clearTimeout(timer);
-			timer = void 0;
-		}
-	} };
-}
-//#endregion
-//#region src/kernel/moleculer/child-cap-dispatch.ts
-/** Type guard narrowing a dynamically-read provider member to a callable method. */
-function isCapMethod(value) {
-	return typeof value === "function";
-}
-/**
-* Extract a string `addonId` out of arbitrary method args — the fallback
-* provider-selection hint for calls that arrive WITHOUT the out-of-band
-* `CapCallMessage.addonId` (e.g. a sibling child's unowned collection call
-* forwarded by the parent, where the raw input still carries `addonId`).
-*/
-function extractArgsAddonId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "addonId");
-	return typeof raw === "string" ? raw : void 0;
-}
-/**
-* Creates a unified dispatcher that routes a {@link CapCallInput} to either a
-* device-scoped or singleton provider, then invokes the requested method.
-*
-* Pure module — no Moleculer, no broker, no addon-runner dependency.
-*/
-function createChildCapDispatch(deps) {
-	return async (call) => {
-		const { capName, method, args, deviceId } = call;
-		const addonId = call.addonId ?? extractArgsAddonId(args);
-		let provider;
-		if (deviceId !== void 0) {
-			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName, addonId);
-			if (provider == null) throw new Error(`child-cap-dispatch: no provider for '${capName}' (device '${String(deviceId)}' or singleton)`);
-		} else {
-			provider = deps.getSingletonProvider(capName, addonId);
-			if (provider == null) throw new Error(`child-cap-dispatch: no singleton provider for '${capName}'`);
-		}
-		const fn = Reflect.get(provider, method);
-		if (!isCapMethod(fn)) {
-			if (deps.isCollectionListMethod(capName, method)) return [];
-			throw new Error(`child-cap-dispatch: method '${method}' not found on provider '${capName}'`);
-		}
-		return await fn.call(provider, args);
-	};
-}
-//#endregion
-//#region src/kernel/moleculer/child-cap-descriptors.ts
-/**
-* Builds the {@link ChildCapDescriptor} array that the UDS child transport
-* sends to the parent on registration.
-*
-* - Singleton caps come from the runner UNION manifest (all caps registered by
-*   every addon in this runner). One descriptor per unique (addonId, capName)
-*   pair, mode `'singleton'` and no `deviceId`. The `addonId` stamp lets the
-*   parent's manifest builder register each hosted addon's caps under the
-*   REAL addon id — a GROUPED runner (`execution.group`) hosts several addons,
-*   and deduplicating by capName alone would collapse two co-located providers
-*   of the same collection cap (e.g. `network-access` from cloudflare-tunnel
-*   AND tailscale-ingress) into one descriptor registered under a synthetic
-*   `addonId = childId` (the group name) — the "@camstack/addon-net-access"
-*   admin-UI bug.
-* - Device-scoped caps come from the native-cap snapshot — one descriptor per
-*   (capName, deviceId) pair, mode `'collection'`, stamped with the owning
-*   addon's id.
-*
-* Pure module — extracted from `addon-runner.ts` (whose `main()` runs at
-* import time) so it is unit-testable.
-*/
-function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
-	const descriptors = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of manifest) for (const capName of entry.capabilities) {
-		const key = `${entry.addonId}::${capName}`;
-		if (!seen.has(key)) {
-			seen.add(key);
-			descriptors.push({
-				capName,
-				mode: "singleton",
-				addonId: entry.addonId
-			});
-		}
-	}
-	for (const { capName, addonId, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
-		capName,
-		mode: "collection",
-		deviceId,
-		addonId
-	});
-	return descriptors;
-}
-//#endregion
 //#region src/kernel/moleculer/child-addon-call-dispatch.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -320,6 +97,229 @@ function createChildAddonCallDispatch(deps) {
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/child-cap-descriptors.ts
+/**
+* Builds the {@link ChildCapDescriptor} array that the UDS child transport
+* sends to the parent on registration.
+*
+* - Singleton caps come from the runner UNION manifest (all caps registered by
+*   every addon in this runner). One descriptor per unique (addonId, capName)
+*   pair, mode `'singleton'` and no `deviceId`. The `addonId` stamp lets the
+*   parent's manifest builder register each hosted addon's caps under the
+*   REAL addon id — a GROUPED runner (`execution.group`) hosts several addons,
+*   and deduplicating by capName alone would collapse two co-located providers
+*   of the same collection cap (e.g. `network-access` from cloudflare-tunnel
+*   AND tailscale-ingress) into one descriptor registered under a synthetic
+*   `addonId = childId` (the group name) — the "@camstack/addon-net-access"
+*   admin-UI bug.
+* - Device-scoped caps come from the native-cap snapshot — one descriptor per
+*   (capName, deviceId) pair, mode `'collection'`, stamped with the owning
+*   addon's id.
+*
+* Pure module — extracted from `addon-runner.ts` (whose `main()` runs at
+* import time) so it is unit-testable.
+*/
+function buildChildCapDescriptors(manifest, nativeCapSnapshot) {
+	const descriptors = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of manifest) for (const capName of entry.capabilities) {
+		const key = `${entry.addonId}::${capName}`;
+		if (!seen.has(key)) {
+			seen.add(key);
+			descriptors.push({
+				capName,
+				mode: "singleton",
+				addonId: entry.addonId
+			});
+		}
+	}
+	for (const { capName, addonId, deviceIds } of nativeCapSnapshot) for (const deviceId of deviceIds) descriptors.push({
+		capName,
+		mode: "collection",
+		deviceId,
+		addonId
+	});
+	return descriptors;
+}
+//#endregion
+//#region src/kernel/moleculer/child-cap-dispatch.ts
+/** Type guard narrowing a dynamically-read provider member to a callable method. */
+function isCapMethod(value) {
+	return typeof value === "function";
+}
+/**
+* Extract a string `addonId` out of arbitrary method args — the fallback
+* provider-selection hint for calls that arrive WITHOUT the out-of-band
+* `CapCallMessage.addonId` (e.g. a sibling child's unowned collection call
+* forwarded by the parent, where the raw input still carries `addonId`).
+*/
+function extractArgsAddonId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "addonId");
+	return typeof raw === "string" ? raw : void 0;
+}
+/**
+* Creates a unified dispatcher that routes a {@link CapCallInput} to either a
+* device-scoped or singleton provider, then invokes the requested method.
+*
+* Pure module — no Moleculer, no broker, no addon-runner dependency.
+*/
+function createChildCapDispatch(deps) {
+	return async (call) => {
+		const { capName, method, args, deviceId } = call;
+		const addonId = call.addonId ?? extractArgsAddonId(args);
+		let provider;
+		if (deviceId !== void 0) {
+			provider = deps.getDeviceProvider(capName, deviceId) ?? deps.getSingletonProvider(capName, addonId);
+			if (provider == null) throw new Error(`child-cap-dispatch: no provider for '${capName}' (device '${String(deviceId)}' or singleton)`);
+		} else {
+			provider = deps.getSingletonProvider(capName, addonId);
+			if (provider == null) throw new Error(`child-cap-dispatch: no singleton provider for '${capName}'`);
+		}
+		const fn = Reflect.get(provider, method);
+		if (!isCapMethod(fn)) {
+			if (deps.isCollectionListMethod(capName, method)) return [];
+			throw new Error(`child-cap-dispatch: method '${method}' not found on provider '${capName}'`);
+		}
+		return await fn.call(provider, args);
+	};
+}
+/**
+* Start warning if `initialize()` has not returned within `firstMs`.
+*
+* The caller MUST `clear()` in a `finally`, so a throwing initialize (which the
+* runner turns into `process.exit(1)`) does not keep the timer alive.
+*/
+function startInitWatchdog(options) {
+	const now = options.now ?? Date.now;
+	const firstMs = options.firstMs ?? 6e4;
+	const repeatMs = options.repeatMs ?? 3e5;
+	const startedAt = now();
+	let timer;
+	let cleared = false;
+	const schedule = (ms) => {
+		timer = setTimeout(fire, ms);
+		timer.unref?.();
+	};
+	function fire() {
+		if (cleared) return;
+		const elapsedMs = now() - startedAt;
+		options.warn(`addon "${options.addonId}" initialize() has not returned after ${Math.round(elapsedMs / 1e3)}s — its capability manifest is NOT published, so every caller of ${options.declaredCapabilities.length > 0 ? options.declaredCapabilities.join(", ") : "(none declared)"} sees "no provider registered"`, {
+			addonId: options.addonId,
+			elapsedMs,
+			unpublishedCapabilities: [...options.declaredCapabilities]
+		});
+		schedule(repeatMs);
+	}
+	schedule(firstMs);
+	return { clear() {
+		cleared = true;
+		if (timer !== void 0) {
+			clearTimeout(timer);
+			timer = void 0;
+		}
+	} };
+}
+//#endregion
+//#region src/kernel/moleculer/register-framework-resolver.ts
+/**
+* Register the ESM resolver hook so this runner's addon imports of the
+* host-provided packages (@camstack/system, @camstack/shm-ring, …) resolve from
+* `frameworkDir/node_modules` instead of failing to walk up from the addon's
+* isolated `/data/addons/<addon>` folder. No-op in dev (frameworkDir unset),
+* where workspace symlinks already resolve the framework.
+*/
+function registerFrameworkResolver(frameworkDir) {
+	if (!frameworkDir) return;
+	register(pathToFileURL(path$1.join(__dirname, "framework-resolver-hook.mjs")), {
+		parentURL: pathToFileURL(`${__dirname}/`).href,
+		data: { frameworkDir }
+	});
+}
+//#endregion
+//#region src/kernel/moleculer/worker-device-restore.ts
+/**
+* Worker-side device restore helper.
+*
+* Shared by `process-runner` (single-addon subprocess) and
+* `group-runner` (group subprocess). Calls the worker addon's
+* `restoreDevices(SavedDevice[])` with devices read from the hub's
+* `device-manager` capability. Blocks on the `system.ready-state`
+* readiness of the hub's `device-manager` via
+* `ReadinessRegistry.awaitReady`, then issues the calls ONCE.
+*
+* Lives in its own module so it can be imported without triggering
+* the runner entry-point side effects (each runner is also an
+* executable that calls `main()` at import time).
+*/
+async function runWorkerDeviceRestoreWithRetry(addon, context, addonId, sourceNodeId) {
+	const log = context.logger;
+	log?.debug?.(`[worker-restore] entry: addon="${addonId}" sourceNodeId="${sourceNodeId}"`);
+	const restoreFn = addon.restoreDevices;
+	if (typeof restoreFn !== "function") {
+		log?.warn?.(`[worker-restore] "${addonId}": no restoreDevices function — skipping`);
+		return;
+	}
+	const api = context.api;
+	if (!api) {
+		log?.warn?.(`[worker-restore] "${addonId}": context.api missing — skipping`);
+		return;
+	}
+	const bus = context.eventBus;
+	if (!bus) {
+		log?.warn?.(`[worker-restore] "${addonId}": context.eventBus missing — skipping`);
+		return;
+	}
+	const shared = context.kernel?.readinessRegistry ?? null;
+	const registry = shared ?? new ReadinessRegistry({
+		eventBus: bus,
+		sourceNodeId,
+		logger: context.logger
+	});
+	log?.debug?.(`[worker-restore] "${addonId}": awaiting device-manager readiness on hub...`);
+	try {
+		await registry.awaitReady("device-manager", {
+			type: "node",
+			nodeId: "hub"
+		}, { timeoutMs: 6e4 });
+		log?.debug?.(`[worker-restore] "${addonId}": device-manager READY`);
+	} catch (err) {
+		if (err instanceof ReadinessTimeoutError) {
+			context.logger?.warn?.(`[worker-restore] device-manager not ready within ${err.waitedMs}ms — skipping for "${addonId}"`);
+			return;
+		}
+		throw err;
+	} finally {
+		if (!shared && registry instanceof ReadinessRegistry) registry.close();
+	}
+	try {
+		const deviceManager = Reflect.get(api, "deviceManager");
+		log?.debug?.(`[worker-restore] "${addonId}": calling listPersistedByAddon...`);
+		const rowsResult = await deviceManager.listPersistedByAddon.query({ addonId });
+		log?.debug?.(`[worker-restore] "${addonId}": got ${Array.isArray(rowsResult) ? rowsResult.length : 0} row(s)`);
+		const rows = Array.isArray(rowsResult) ? rowsResult : [];
+		if (rows.length === 0) {
+			context.logger?.info?.(`[worker-restore] no persisted devices to restore for addon "${addonId}"`);
+			return;
+		}
+		const savedDevices = await Promise.all(rows.map(async (row) => {
+			const config = await deviceManager.loadConfig.query({ deviceId: row.id });
+			return {
+				id: row.id,
+				stableId: row.stableId,
+				type: row.type,
+				name: row.name,
+				parentDeviceId: row.parentDeviceId,
+				config: config ?? {}
+			};
+		}));
+		await restoreFn.call(addon, savedDevices);
+		log?.info?.(`[worker-restore] "${addonId}": restored ${savedDevices.length} device(s)`);
+	} catch (err) {
+		log?.warn?.(`[worker-restore] "${addonId}": restoreDevices threw: ${errMsg(err)}`);
+	}
+}
+//#endregion
 //#region src/kernel/moleculer/addon-runner.ts
 /**
 * Addon Runner — THE unified entry point for spawned subprocesses.

package/dist/index.js

@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DB_4H3tR.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_lan_http_bind = require("./lan-http-bind-DmgpFP6_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
@@ -93976,6 +93976,34 @@ var CrashSupervisor = class {
 		this.crashes.delete(runnerId);
 	}
 };
+/**
+* Resolve the native-allocator env for a child runner from the parent's env.
+*
+* Precedence, highest first:
+*   1. `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` — kill switch, returns nothing and
+*      restores the glibc/sharp defaults. Recoverable without a rebuild.
+*   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
+*      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
+*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
+*   4. The defaults above.
+*
+* A nonsense override falls back to the default rather than being passed through:
+* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
+* exists to leave.
+*/
+function runnerNativeAllocatorEnv(parentEnv, platform = process.platform) {
+	if (platform !== "linux") return {};
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
+	return {
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
+	};
+}
+function positiveInt(raw, fallback) {
+	if (raw === void 0) return fallback;
+	const n = Number.parseInt(raw, 10);
+	return Number.isFinite(n) && n > 0 ? n : fallback;
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94136,7 +94164,18 @@ function isHeavyRunner(addons) {
 *
 * A runner whose working set genuinely does not fit declares its own number in its manifest
 * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `stream-broker` (1323 MB measured, frame buffers) is the one shipped addon that does.
+* `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
+* shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+* from RSS.
+*
+* ## What this flag CANNOT do
+*
+* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 /**
@@ -94262,10 +94301,11 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
+			...runnerNativeAllocatorEnv(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
-		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [

package/dist/index.mjs

@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-D1Ydw7J0.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Dmcnb287.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { C as evaluateExistingCert, S as SERVER_AUTH_OID, _ as CA_COMMON_NAME, a as closeLanHttp, b as LEAF_RENEWAL_WINDOW_DAYS, c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, h as loadTlsCert, i as bindPendingLanHttp, l as readTlsAccessStatus, m as ensureTlsCert, n as allFamiliesListenHost, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, s as registerLanHttpHandler, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode, v as collectCertIdentity, x as MAX_LEAF_VALIDITY_DAYS, y as CA_VALIDITY_DAYS } from "./lan-http-bind-jKrj6OjQ.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
@@ -93969,6 +93969,34 @@ var CrashSupervisor = class {
 		this.crashes.delete(runnerId);
 	}
 };
+/**
+* Resolve the native-allocator env for a child runner from the parent's env.
+*
+* Precedence, highest first:
+*   1. `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` — kill switch, returns nothing and
+*      restores the glibc/sharp defaults. Recoverable without a rebuild.
+*   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
+*      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
+*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
+*   4. The defaults above.
+*
+* A nonsense override falls back to the default rather than being passed through:
+* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
+* exists to leave.
+*/
+function runnerNativeAllocatorEnv(parentEnv, platform = process.platform) {
+	if (platform !== "linux") return {};
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
+	return {
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
+	};
+}
+function positiveInt(raw, fallback) {
+	if (raw === void 0) return fallback;
+	const n = Number.parseInt(raw, 10);
+	return Number.isFinite(n) && n > 0 ? n : fallback;
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94129,7 +94157,18 @@ function isHeavyRunner(addons) {
 *
 * A runner whose working set genuinely does not fit declares its own number in its manifest
 * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `stream-broker` (1323 MB measured, frame buffers) is the one shipped addon that does.
+* `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
+* shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+* from RSS.
+*
+* ## What this flag CANNOT do
+*
+* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 /**
@@ -94255,10 +94294,11 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
+			...runnerNativeAllocatorEnv(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
-		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [

package/dist/kernel/heap-watch.d.ts

@@ -291,14 +291,17 @@ export interface RunnerHeapWatchOptions {
  *
  * ## Why heavy runners get hub-main's mechanism
  *
- * The media-path runners deliberately run with NO old-space ceiling
- * (`maxOldSpaceMb: 0` — a flat cap turned a disk-stall backlog into
- * `Ineffective mark-compacts near heap limit` and killed recording, twice on
- * 2026-08-17). Uncapped, V8 feels no pressure, so a one-off burst becomes the
- * runner's permanent RSS: the recorder measured 2122MB holding a ~50MB index.
- * hub-main had exactly this shape and its reclaimer is proven live — 11 passes
- * in 4h, 375–1652MB returned per pass at 550–680ms each. Same mechanism, same
- * `shouldReclaim` stranded-over-trigger gate; never a second implementation.
+ * Because a heap ceiling cannot reach what actually strands in them. Every
+ * media-path runner now carries an old-space ceiling sized from its own
+ * measured peak (`addon-pipeline` manifest + its `manifest-heap-ceilings` spec),
+ * and that changes nothing here: what a heavy runner strands is NATIVE —
+ * `external`, `arrayBuffers`, glibc arena free lists — none of which
+ * `--max-old-space-size` bounds. Measured 2026-08-25, `hub/pipeline-analytics`
+ * reported `stranded=2552MB` while holding an 81MB V8 heap under a 1024MB
+ * ceiling that was in force the whole time. hub-main had exactly this shape and
+ * its reclaimer is proven live — 11 passes in 4h, 375–1652MB returned per pass
+ * at 550–680ms each. Same mechanism, same `shouldReclaim` stranded-over-trigger
+ * gate; never a second implementation.
  *
  * ## The stall, priced for the runners that get it
  *

package/dist/kernel/moleculer/process-service.d.ts

@@ -36,7 +36,18 @@ interface RunnerAddonSpec {
  *
  * A runner whose working set genuinely does not fit declares its own number in its manifest
  * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
- * `stream-broker` (1323 MB measured, frame buffers) is the one shipped addon that does.
+ * `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
+ * shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+ * `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+ * space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+ * from RSS.
+ *
+ * ## What this flag CANNOT do
+ *
+ * It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+ * addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+ * whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+ * Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
  */
 export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 interface SpawnedProcess {

package/dist/kernel/moleculer/runner-native-allocator.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Native-allocator environment for a forked addon runner.
+ *
+ * ## The half of a runner's memory that no V8 flag reaches
+ *
+ * `--max-old-space-size` bounds V8's old space and nothing else. It does not
+ * bound `external`, it does not bound `arrayBuffers`, and it does not bound what
+ * a native addon (`sharp`/`libvips`, decoders, codecs) allocates through `malloc`.
+ *
+ * Measured on the live hub, 2026-08-25, over a ~6h window of `[mem]` heartbeats:
+ *
+ *   hub/pipeline-analytics  rss 309-7334MB   heapTotal max 343MB   external max 5479MB
+ *
+ * It already carried `--max-old-space-size=1024`, so the flag was in force the
+ * whole time and the process still reached 7.3GB — because 96% of it was never
+ * V8's to bound. Its reclaim line names the shape exactly:
+ *
+ *   reclaim hub/pipeline-analytics stranded=2552MB rss=2765MB→2647MB
+ *           freed=118MB arrayBuffers=81MB→29MB took=58ms
+ *
+ * The `arrayBuffers` FLOOR returns to ~1MB every cycle, so this is not a leak.
+ * It is glibc holding freed pages: with `MALLOC_ARENA_MAX` unset, glibc opens up
+ * to `8 × ncpu` arenas — 160 on this 20-core host — and each keeps its own free
+ * list, which is returned to the OS only when the top of that arena is free.
+ *
+ * ## Why this matters more than the cgroup number suggests
+ *
+ * The container is capped at 24GiB and `memory.current` rides at 21-24GB. Near
+ * the limit the kernel performs direct reclaim IN THE CONTEXT OF THE TASK THAT
+ * ALLOCATES, so every process in the container stalls together — measured as
+ * four idle, mutually unrelated runners sharing one ~39s stall in the same
+ * sample. Returning stranded pages is therefore not a tidiness win; it is what
+ * keeps unrelated runners off the direct-reclaim path.
+ *
+ * ## Why `VIPS_CONCURRENCY` is welded to it
+ *
+ * `sharp` reads `MALLOC_ARENA_MAX` in its NATIVE binding (not in JS — grepping
+ * the bundle finds nothing). Unset on glibc, sharp pins libvips concurrency to 1
+ * as its own fragmentation defence; the moment the variable appears it restores
+ * concurrency to `availableParallelism()`. Verified in the live container:
+ *
+ *   MALLOC_ARENA_MAX unset                  → sharp.concurrency() === 1
+ *   MALLOC_ARENA_MAX=2                      → sharp.concurrency() === 20
+ *   MALLOC_ARENA_MAX=2 VIPS_CONCURRENCY=1   → sharp.concurrency() === 1
+ *
+ * Shipping the arena bound alone would therefore have quietly shipped a 1→20
+ * libvips threading change to the busiest addon on a host already at ~75% CPU,
+ * under the banner of a memory fix. This module ships the allocator change and
+ * ONLY the allocator change; raising libvips concurrency is a separate decision.
+ *
+ * ## What it costs, measured
+ *
+ * Same container, same 12-image corpus, same pipeline as analytics (decode →
+ * extract → resize → encode → raw), 3 interleaved pairs so host load cancels,
+ * concurrency pinned to 1 on both arms:
+ *
+ *   arenas default : mean 51.9ms  p50 60.0ms  p90 67.3ms  p99 70.7ms  rss 505MB
+ *   arenas=2       : mean 51.5ms  p50 57.6ms  p90 67.2ms  p99 72.9ms  rss 354MB
+ *
+ * Latency is unchanged inside noise (-0.8% mean, +3.1% p99); the same work is
+ * done in 30% less RSS.
+ */
+/** Bounded glibc arenas per forked runner. */
+export declare const RUNNER_MALLOC_ARENA_MAX_DEFAULT = 2;
+/**
+ * libvips worker threads per forked runner. `1` is not a tuning choice — it is
+ * sharp's OWN default on glibc, pinned here so that bounding the arenas does not
+ * change it as a side effect. See the module header.
+ */
+export declare const RUNNER_VIPS_CONCURRENCY_DEFAULT = 1;
+/**
+ * The native-allocator variables to add to a runner's environment. Both keys are
+ * present or both are absent — see the `VIPS_CONCURRENCY` note in the module
+ * header for why one without the other is the dangerous configuration.
+ */
+export interface RunnerNativeAllocatorEnv {
+    readonly MALLOC_ARENA_MAX?: string;
+    readonly VIPS_CONCURRENCY?: string;
+}
+/**
+ * Resolve the native-allocator env for a child runner from the parent's env.
+ *
+ * Precedence, highest first:
+ *   1. `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` — kill switch, returns nothing and
+ *      restores the glibc/sharp defaults. Recoverable without a rebuild.
+ *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
+ *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
+ *   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
+ *   4. The defaults above.
+ *
+ * A nonsense override falls back to the default rather than being passed through:
+ * glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
+ * exists to leave.
+ */
+export declare function runnerNativeAllocatorEnv(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): RunnerNativeAllocatorEnv;

package/dist/{manifest-python-deps-DB_4H3tR.js → manifest-python-deps-BTkFwAk_.js}

@@ -422,14 +422,17 @@ var RUNNER_HEAP_WATCH_INTERVAL_MS = 3e5;
 *
 * ## Why heavy runners get hub-main's mechanism
 *
-* The media-path runners deliberately run with NO old-space ceiling
-* (`maxOldSpaceMb: 0` — a flat cap turned a disk-stall backlog into
-* `Ineffective mark-compacts near heap limit` and killed recording, twice on
-* 2026-08-17). Uncapped, V8 feels no pressure, so a one-off burst becomes the
-* runner's permanent RSS: the recorder measured 2122MB holding a ~50MB index.
-* hub-main had exactly this shape and its reclaimer is proven live — 11 passes
-* in 4h, 375–1652MB returned per pass at 550–680ms each. Same mechanism, same
-* `shouldReclaim` stranded-over-trigger gate; never a second implementation.
+* Because a heap ceiling cannot reach what actually strands in them. Every
+* media-path runner now carries an old-space ceiling sized from its own
+* measured peak (`addon-pipeline` manifest + its `manifest-heap-ceilings` spec),
+* and that changes nothing here: what a heavy runner strands is NATIVE —
+* `external`, `arrayBuffers`, glibc arena free lists — none of which
+* `--max-old-space-size` bounds. Measured 2026-08-25, `hub/pipeline-analytics`
+* reported `stranded=2552MB` while holding an 81MB V8 heap under a 1024MB
+* ceiling that was in force the whole time. hub-main had exactly this shape and
+* its reclaimer is proven live — 11 passes in 4h, 375–1652MB returned per pass
+* at 550–680ms each. Same mechanism, same `shouldReclaim` stranded-over-trigger
+* gate; never a second implementation.
 *
 * ## The stall, priced for the runners that get it
 *
@@ -453,7 +456,7 @@ function startRunnerHeapWatch(options) {
 		const reclaimer = createV8Reclaimer();
 		reclaimOptions = reclaimer === void 0 ? void 0 : { reclaim: reclaimer };
 	}
-	return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, false);
+	return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, true);
 }
 //#endregion
 //#region src/kernel/moleculer/addon-data-plane-facility.ts

package/dist/{manifest-python-deps-D1Ydw7J0.mjs → manifest-python-deps-Dmcnb287.mjs}

@@ -418,14 +418,17 @@ var RUNNER_HEAP_WATCH_INTERVAL_MS = 3e5;
 *
 * ## Why heavy runners get hub-main's mechanism
 *
-* The media-path runners deliberately run with NO old-space ceiling
-* (`maxOldSpaceMb: 0` — a flat cap turned a disk-stall backlog into
-* `Ineffective mark-compacts near heap limit` and killed recording, twice on
-* 2026-08-17). Uncapped, V8 feels no pressure, so a one-off burst becomes the
-* runner's permanent RSS: the recorder measured 2122MB holding a ~50MB index.
-* hub-main had exactly this shape and its reclaimer is proven live — 11 passes
-* in 4h, 375–1652MB returned per pass at 550–680ms each. Same mechanism, same
-* `shouldReclaim` stranded-over-trigger gate; never a second implementation.
+* Because a heap ceiling cannot reach what actually strands in them. Every
+* media-path runner now carries an old-space ceiling sized from its own
+* measured peak (`addon-pipeline` manifest + its `manifest-heap-ceilings` spec),
+* and that changes nothing here: what a heavy runner strands is NATIVE —
+* `external`, `arrayBuffers`, glibc arena free lists — none of which
+* `--max-old-space-size` bounds. Measured 2026-08-25, `hub/pipeline-analytics`
+* reported `stranded=2552MB` while holding an 81MB V8 heap under a 1024MB
+* ceiling that was in force the whole time. hub-main had exactly this shape and
+* its reclaimer is proven live — 11 passes in 4h, 375–1652MB returned per pass
+* at 550–680ms each. Same mechanism, same `shouldReclaim` stranded-over-trigger
+* gate; never a second implementation.
 *
 * ## The stall, priced for the runners that get it
 *
@@ -449,7 +452,7 @@ function startRunnerHeapWatch(options) {
 		const reclaimer = createV8Reclaimer();
 		reclaimOptions = reclaimer === void 0 ? void 0 : { reclaim: reclaimer };
 	}
-	return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, false);
+	return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, true);
 }
 //#endregion
 //#region src/kernel/moleculer/addon-data-plane-facility.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.124",
+  "version": "1.2.126",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",