@camstack/system 1.2.132 → 1.2.133

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
+const require_manifest_python_deps = require("./manifest-python-deps-C9x9vrqt.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-Dmcnb287.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-08rqn6xN.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-pragmas.d.ts

@@ -142,3 +142,27 @@ export interface SqliteOccupancy {
  * three header reads on a connection that is already open.
  */
 export declare function sqliteOccupancy(counters: SqlitePageCounters): SqliteOccupancy;
+/**
+ * How often the connection re-checks whether the file has outgrown its map.
+ *
+ * The database grows by roughly 40 MB a day on this cluster, so five minutes is
+ * far finer than it needs to be — but the check is three arithmetic operations
+ * on a `stat`, and the failure it prevents is a node silently returning to
+ * 418 synchronous page-ins per second. Cheap insurance against a slow leak.
+ */
+export declare const MAP_GROWTH_CHECK_INTERVAL_MS: number;
+/**
+ * The new `mmap_size` when the file has outgrown the current one, or `null`.
+ *
+ * `sqliteMmapSizeFor` already autoscales to any user's database — but it is
+ * applied when the connection OPENS and never again, which is the same bug one
+ * level up: a file that grows during uptime keeps the map it had at boot. This
+ * node escaped it only because 130 MB → 858 MB spanned seventeen days of
+ * restarts; a node up for two months walks straight back into 70% of the file
+ * outside the map.
+ *
+ * GROWTH only. Shrinking after a delete buys nothing and costs a remap, and the
+ * file does not shrink without a `VACUUM` regardless — measured 2026-08-25,
+ * `freePct=1` on an 858 MB file that had been deleting rows for days.
+ */
+export declare function resolveMapGrowth(currentMmapBytes: number, fileSizeBytes: number): number | null;

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -251,6 +251,20 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * enumerated. `unref` so it can never hold the process open, and
      * `CAMSTACK_SQLITE_STORAGE_REPORT=off` turns it off without a rebuild.
      */
+    /**
+     * Follow the file as it grows.
+     *
+     * The map is derived from the file at OPEN and never again, which is the same
+     * expiry one level up: a database that grows during uptime keeps the map it
+     * had at boot, and once the file passes it every read outside the window
+     * costs a synchronous page-in — 418 per second, measured 2026-08-25. This
+     * node escaped it only because 130 MB → 858 MB spanned seventeen days of
+     * restarts.
+     *
+     * `unref` so it never holds the process open, and the same kill switch as the
+     * storage report turns it off without a rebuild.
+     */
+    private scheduleMapGrowthCheck;
     private scheduleStorageReport;
     private logStorageReport;
     private readPragmaNumber;

package/dist/index.js

@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
+const require_manifest_python_deps = require("./manifest-python-deps-C9x9vrqt.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -94022,6 +94022,34 @@ function positiveInt(raw, fallback) {
 	const n = Number.parseInt(raw, 10);
 	return Number.isFinite(n) && n > 0 ? n : fallback;
 }
+/**
+* The child's environment, with the allocator pair applied or REMOVED.
+*
+* `runnerNativeAllocatorEnv` returns what to add. That was sufficient while the
+* parent had nothing to inherit: omitting a key meant the child never saw it.
+* Once the image entrypoint welds the pair into the container environment — the
+* change that lets an operator drop them from the Unraid template — the child
+* INHERITS them, and a kill switch that only omits is a kill switch that does
+* nothing.
+*
+* So `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` DELETES. And only that: the
+* non-linux path returns nothing to add for its own reasons (the pin is a pure
+* throughput cut there — measured `sharp.concurrency()` 6 on the darwin agent
+* against 1 on the linux hub) and must not be read as "remove what the operator
+* chose". Deletion is the switch's job, not absence's.
+*/
+function applyRunnerNativeAllocator(parentEnv, platform = process.platform) {
+	const next = { ...parentEnv };
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") {
+		delete next["MALLOC_ARENA_MAX"];
+		delete next["VIPS_CONCURRENCY"];
+		return next;
+	}
+	return {
+		...next,
+		...runnerNativeAllocatorEnv(parentEnv, platform)
+	};
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94319,7 +94347,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
-			...runnerNativeAllocatorEnv(process.env),
+			...applyRunnerNativeAllocator(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);

package/dist/index.mjs

@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Dmcnb287.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-08rqn6xN.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -94015,6 +94015,34 @@ function positiveInt(raw, fallback) {
 	const n = Number.parseInt(raw, 10);
 	return Number.isFinite(n) && n > 0 ? n : fallback;
 }
+/**
+* The child's environment, with the allocator pair applied or REMOVED.
+*
+* `runnerNativeAllocatorEnv` returns what to add. That was sufficient while the
+* parent had nothing to inherit: omitting a key meant the child never saw it.
+* Once the image entrypoint welds the pair into the container environment — the
+* change that lets an operator drop them from the Unraid template — the child
+* INHERITS them, and a kill switch that only omits is a kill switch that does
+* nothing.
+*
+* So `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` DELETES. And only that: the
+* non-linux path returns nothing to add for its own reasons (the pin is a pure
+* throughput cut there — measured `sharp.concurrency()` 6 on the darwin agent
+* against 1 on the linux hub) and must not be read as "remove what the operator
+* chose". Deletion is the switch's job, not absence's.
+*/
+function applyRunnerNativeAllocator(parentEnv, platform = process.platform) {
+	const next = { ...parentEnv };
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") {
+		delete next["MALLOC_ARENA_MAX"];
+		delete next["VIPS_CONCURRENCY"];
+		return next;
+	}
+	return {
+		...next,
+		...runnerNativeAllocatorEnv(parentEnv, platform)
+	};
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94312,7 +94340,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
-			...runnerNativeAllocatorEnv(process.env),
+			...applyRunnerNativeAllocator(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);

package/dist/kernel/moleculer/runner-native-allocator.d.ts

@@ -93,3 +93,20 @@ export interface RunnerNativeAllocatorEnv {
  * exists to leave.
  */
 export declare function runnerNativeAllocatorEnv(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): RunnerNativeAllocatorEnv;
+/**
+ * The child's environment, with the allocator pair applied or REMOVED.
+ *
+ * `runnerNativeAllocatorEnv` returns what to add. That was sufficient while the
+ * parent had nothing to inherit: omitting a key meant the child never saw it.
+ * Once the image entrypoint welds the pair into the container environment — the
+ * change that lets an operator drop them from the Unraid template — the child
+ * INHERITS them, and a kill switch that only omits is a kill switch that does
+ * nothing.
+ *
+ * So `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` DELETES. And only that: the
+ * non-linux path returns nothing to add for its own reasons (the pin is a pure
+ * throughput cut there — measured `sharp.concurrency()` 6 on the darwin agent
+ * against 1 on the linux hub) and must not be read as "remove what the operator
+ * chose". Deletion is the switch's job, not absence's.
+ */
+export declare function applyRunnerNativeAllocator(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;

package/dist/kernel/moleculer/trpc-links.d.ts

@@ -1,7 +1,7 @@
-import { ServiceBroker } from 'moleculer';
 import { TRPCLink } from '@trpc/client';
 import { AnyRouter } from '@trpc/server';
-import { LocalChildRegistry, CapCallInput } from '../transport/index.js';
+import { ServiceBroker } from 'moleculer';
+import { CapCallInput, LocalChildRegistry } from '../transport/index.js';
 /**
  * Resolver for in-process capability providers.
  *
@@ -51,11 +51,39 @@ export type CapUsageObserver = (obs: CapUsageObservation) => void;
 export interface CapUsageObserverOptions {
     /** The addon whose `ctx.api` produced this link chain. */
     readonly callerAddonId: string;
-    /** Resolve which addon hosts the provider for `capName`. Return `null` to skip recording. */
+    /**
+     * Resolve which addon hosts the provider for `capName`. `null` means "not in
+     * the LOCAL registry" — which is every cross-process provider, and no longer
+     * means "do not record": see {@link UNRESOLVED_PROVIDER_ADDON_ID}.
+     */
     readonly providerAddonIdForCap: (capName: string) => string | null;
     /** Sink for observations. MUST NOT throw — wrapper catches anyway. */
     readonly observer: CapUsageObserver;
 }
+/**
+ * Stands in for a provider the LOCAL registry cannot name.
+ *
+ * `providerAddonIdForCap` only searches the local registry, so it returns
+ * `null` for every cross-process provider — which is every forked runner,
+ * `sqlite-settings` included. That `null` used to drop the whole observation,
+ * caller and all. The result: `nodes.getCapUsageGraph`, an admin API whose
+ * entire job is to show caller → provider → cap traffic, returned an EMPTY
+ * ARRAY on the live hub while the engine logged 39 717 calls a minute to a
+ * single collection. An empty graph reads as "nothing is calling anything".
+ *
+ * The caller is always known — it is whoever made the call — and "who is
+ * hammering this cap" is the question the graph exists to answer. So the
+ * observation is recorded and the unknown half stays VISIBLY unknown, which is
+ * a fact an operator can act on, rather than absent, which is a fact nobody can
+ * see. Naming the provider properly needs the cluster-wide cap list; until then
+ * this placeholder is the honest value.
+ */
+export declare const UNRESOLVED_PROVIDER_ADDON_ID = "(unresolved: cross-process)";
+/**
+ * Record one cap call, if an observer is configured. Extracted so the rule —
+ * an unresolved provider never erases the caller — has ONE place and a test.
+ */
+export declare function recordCapUsage(observerOpts: CapUsageObserverOptions, capName: string, methodName: string): void;
 /**
  * Non-terminating tRPC link that intercepts calls when the target
  * capability has a provider registered in the local process.

package/dist/{manifest-python-deps-Dmcnb287.mjs → manifest-python-deps-08rqn6xN.mjs}

@@ -6089,8 +6089,21 @@ function createHubCapForwardService(onUnownedCall) {
 		} } }
 	};
 }
-//#endregion
-//#region src/kernel/moleculer/trpc-links.ts
+/**
+* Record one cap call, if an observer is configured. Extracted so the rule —
+* an unresolved provider never erases the caller — has ONE place and a test.
+*/
+function recordCapUsage(observerOpts, capName, methodName) {
+	try {
+		observerOpts.observer({
+			callerAddonId: observerOpts.callerAddonId,
+			providerAddonId: observerOpts.providerAddonIdForCap(capName) ?? "(unresolved: cross-process)",
+			capName,
+			methodName,
+			atMs: Date.now()
+		});
+	} catch {}
+}
 /** Convert camelCase → kebab-case. */
 function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
@@ -6140,16 +6153,7 @@ function localProviderLink(resolver, observerOpts) {
 			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
 			if (typeof fn !== "function") return next(opWithDefaults);
-			if (observerOpts) try {
-				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
-				if (providerAddonId) observerOpts.observer({
-					callerAddonId: observerOpts.callerAddonId,
-					providerAddonId,
-					capName: parsed.capName,
-					methodName: parsed.method,
-					atMs: Date.now()
-				});
-			} catch {}
+			if (observerOpts) recordCapUsage(observerOpts, parsed.capName, parsed.method);
 			return observable((observer) => {
 				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
@@ -6410,9 +6414,9 @@ function brokerTransportLink(broker, serviceMap, observerOpts, linkOptions) {
 					}
 					if (observerOpts) try {
 						const providerAddonId = serviceName !== parsed.capName ? serviceName : observerOpts.providerAddonIdForCap(parsed.capName);
-						if (providerAddonId) observerOpts.observer({
+						observerOpts.observer({
 							callerAddonId: observerOpts.callerAddonId,
-							providerAddonId,
+							providerAddonId: providerAddonId ?? "(unresolved: cross-process)",
 							capName: parsed.capName,
 							methodName: parsed.method,
 							atMs: Date.now()

package/dist/{manifest-python-deps-BTkFwAk_.js → manifest-python-deps-C9x9vrqt.js}

@@ -6093,8 +6093,21 @@ function createHubCapForwardService(onUnownedCall) {
 		} } }
 	};
 }
-//#endregion
-//#region src/kernel/moleculer/trpc-links.ts
+/**
+* Record one cap call, if an observer is configured. Extracted so the rule —
+* an unresolved provider never erases the caller — has ONE place and a test.
+*/
+function recordCapUsage(observerOpts, capName, methodName) {
+	try {
+		observerOpts.observer({
+			callerAddonId: observerOpts.callerAddonId,
+			providerAddonId: observerOpts.providerAddonIdForCap(capName) ?? "(unresolved: cross-process)",
+			capName,
+			methodName,
+			atMs: Date.now()
+		});
+	} catch {}
+}
 /** Convert camelCase → kebab-case. */
 function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
@@ -6144,16 +6157,7 @@ function localProviderLink(resolver, observerOpts) {
 			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
 			if (typeof fn !== "function") return next(opWithDefaults);
-			if (observerOpts) try {
-				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
-				if (providerAddonId) observerOpts.observer({
-					callerAddonId: observerOpts.callerAddonId,
-					providerAddonId,
-					capName: parsed.capName,
-					methodName: parsed.method,
-					atMs: Date.now()
-				});
-			} catch {}
+			if (observerOpts) recordCapUsage(observerOpts, parsed.capName, parsed.method);
 			return observable((observer) => {
 				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
@@ -6414,9 +6418,9 @@ function brokerTransportLink(broker, serviceMap, observerOpts, linkOptions) {
 					}
 					if (observerOpts) try {
 						const providerAddonId = serviceName !== parsed.capName ? serviceName : observerOpts.providerAddonIdForCap(parsed.capName);
-						if (providerAddonId) observerOpts.observer({
+						observerOpts.observer({
 							callerAddonId: observerOpts.callerAddonId,
-							providerAddonId,
+							providerAddonId: providerAddonId ?? "(unresolved: cross-process)",
 							capName: parsed.capName,
 							methodName: parsed.method,
 							atMs: Date.now()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.132",
+  "version": "1.2.133",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",