@camstack/system 1.2.132 → 1.2.134

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
+const require_manifest_python_deps = require("./manifest-python-deps-C9x9vrqt.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-Dmcnb287.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, Pt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-08rqn6xN.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/analyze-stats.d.ts

@@ -0,0 +1,41 @@
+import { Database } from 'better-sqlite3';
+/**
+ * Delay before the one-shot `ANALYZE`, in ms.
+ *
+ * Boot is itself the busiest window this runner has (`ensureTable` ×9, the
+ * retired-key purge, the vector registry), and adding a 14 s statement to it
+ * would turn a slow boot into one an operator reads as a hang. Long enough that
+ * the cluster is serving before the engine goes quiet.
+ */
+export declare const ANALYZE_DELAY_MS = 120000;
+/** Env var that disables the one-shot analysis. `off` is the only value read. */
+export declare const ANALYZE_ENV_VAR = "CAMSTACK_SQLITE_ANALYZE";
+/** What {@link runAnalyzeIfMissing} did, for the caller to log. */
+export type AnalyzeOutcome = {
+    readonly kind: 'already-present';
+} | {
+    readonly kind: 'analyzed';
+    readonly tookMs: number;
+    readonly indexesAnalyzed: number;
+} | {
+    readonly kind: 'failed';
+    readonly tookMs: number;
+    readonly error: string;
+};
+/**
+ * True when the database has no `sqlite_stat1` at all.
+ *
+ * Deliberately "none", not "old": a stale row still tells the planner the
+ * relative selectivity of two indexes, which is the entire question being
+ * asked. Re-analysis on a staleness heuristic would put a 14 s statement on a
+ * timer, and this runner cannot afford one.
+ */
+export declare function hasIndexStatistics(db: Database): boolean;
+/**
+ * `ANALYZE` the database, but only if it has never been analysed.
+ *
+ * Synchronous and long — see the module doc. Never throws: a database that
+ * refuses to be analysed is a missing optimisation, not a reason to take the
+ * settings engine down, and the outcome says so rather than going quiet.
+ */
+export declare function runAnalyzeIfMissing(db: Database, now?: () => number): AnalyzeOutcome;

package/dist/builtins/sqlite-storage/query-profiler.d.ts

@@ -35,6 +35,23 @@ import { IScopedLogger } from '@camstack/types';
  * statement that really does take seconds. Both are needed; neither is
  * sufficient.
  *
+ * ## Why the SQL shape, and why the plan
+ *
+ * `(op, collection)` names a TABLE, not a call site. On 2026-08-25 the busiest
+ * line of a 90 s operator stall was `query pipeline-analytics:tracks — 1005
+ * calls, max 1615 ms` and eleven different reads in one addon are spelled
+ * exactly that way; the aggregate accused all of them and cleared none. So the
+ * shape of the prepared statement (`statement-shape.ts`) is part of the
+ * aggregate KEY, and the report prints it.
+ *
+ * A shape says WHICH query. It does not say why it is slow — "1.6 s for 501
+ * rows" is a full scan and "1.6 s for 501 rows" is also a cold disk, and those
+ * are the same line. `EXPLAIN QUERY PLAN` is the only thing that separates
+ * them, and it is attached to the slow-call WARN because that is where the
+ * question is asked. It is asked ONCE PER SHAPE PER WINDOW: a scan that fires
+ * the WARN fires it repeatedly, and a plan re-printed forty times is how the
+ * one line that mattered stops being read.
+ *
  * ## Cost
  *
  * Two `Date.now()` calls and one `Map` lookup per statement. At the measured
@@ -64,17 +81,37 @@ export interface SqliteOpSample {
     readonly deviceId?: number;
     /** See {@link SqliteOpLabel.owner}. */
     readonly owner?: string;
+    /** See {@link SqliteOpLabel.sql}. */
+    readonly sql?: string;
+    /** See {@link SqliteOpLabel.params}. */
+    readonly params?: readonly unknown[];
 }
-/** One `(op, collection, owner)` triple's totals over a report window. */
+/** One `(op, collection, owner, shape)` tuple's totals over a report window. */
 export interface SqliteOpStat {
     readonly op: string;
     readonly collection: string;
     readonly owner?: string;
+    /** `statement-shape.ts` fingerprint; absent for a fixed-shape statement the
+     *  engine did not hand to the profiler. */
+    readonly shape?: string;
     readonly calls: number;
     readonly totalMs: number;
     readonly maxMs: number;
     readonly rows: number;
 }
+/**
+ * Runs `EXPLAIN QUERY PLAN` for a statement on the connection that executed it.
+ *
+ * Injected rather than reached for: the profiler must not own a database
+ * handle, and the plan is only trustworthy from the SAME connection — a second
+ * handle can differ in `sqlite_stat1` visibility and in temp-schema state, and
+ * a plan taken from a connection that is not the one that stalled describes a
+ * query nobody ran.
+ *
+ * Returns one string per plan row (SQLite's `detail` column). Must not throw —
+ * an unexplainable statement yields `[]`.
+ */
+export type SqlExplainer = (sql: string, params: readonly unknown[]) => readonly string[];
 /**
  * Duration at which one statement is worth a WARN on its own, in ms.
  *
@@ -104,6 +141,8 @@ export interface SqliteOpProfilerOptions {
     readonly reportIntervalMs?: number;
     readonly reportFloorMs?: number;
     readonly topN?: number;
+    /** Absent ⇒ slow-call WARNs carry no plan. See {@link SqlExplainer}. */
+    readonly explain?: SqlExplainer;
 }
 /** Identity of a measured call, without the numbers `measure` supplies itself. */
 export interface SqliteOpLabel {
@@ -117,6 +156,27 @@ export interface SqliteOpLabel {
      * exactly where the 67 660-call storm of 2026-08-25 stopped.
      */
     readonly owner?: string;
+    /**
+     * The statement the engine prepared, verbatim.
+     *
+     * Supplied only by the ops that BUILD their SQL from a filter — those are the
+     * ones whose cost varies by call site. A fixed-shape statement (`get`, `set`)
+     * is already fully described by `(op, collection)`.
+     *
+     * Used for two things and nothing else: the shape that becomes part of the
+     * aggregate key, and the `EXPLAIN QUERY PLAN` on a slow call. Never logged
+     * raw — see `statement-shape.ts` for what is dropped.
+     */
+    readonly sql?: string;
+    /**
+     * The values bound to {@link sql}.
+     *
+     * Needed because `EXPLAIN QUERY PLAN` on a statement with unbound parameters
+     * is not the plan that ran: SQLite's planner reads bound values for `LIKE`
+     * prefixes and for index-selection on `IN`. Never logged, in whole or in
+     * part — they carry device ids, keys and user data.
+     */
+    readonly params?: readonly unknown[];
 }
 export declare class SqliteOpProfiler {
     private readonly logger;
@@ -125,7 +185,11 @@ export declare class SqliteOpProfiler {
     private readonly reportIntervalMs;
     private readonly reportFloorMs;
     private readonly topN;
+    private readonly explain;
     private readonly stats;
+    /** Shapes already explained in this window — see the class doc on why the
+     *  plan is printed once and not on every WARN. Cleared by `drain`. */
+    private readonly explainedShapes;
     private windowStartedAt;
     private timer;
     constructor(options: SqliteOpProfilerOptions);
@@ -139,6 +203,15 @@ export declare class SqliteOpProfiler {
      */
     measure<T>(label: SqliteOpLabel, run: () => T): T;
     record(sample: SqliteOpSample): void;
+    /**
+     * `EXPLAIN QUERY PLAN` for a statement that just held the loop, or nothing.
+     *
+     * Nothing when: no explainer was injected, the op carries no SQL, or this
+     * shape has already been explained in this window. The explainer is
+     * contracted not to throw and is guarded anyway — a profiler that can turn a
+     * slow query into a crash is worse than one that cannot explain it.
+     */
+    private planFor;
     /** Totals for the window, busiest first, and reset. */
     drain(): readonly SqliteOpStat[];
     /** Emit one aggregate line for the window, unless the engine was idle. */

package/dist/builtins/sqlite-storage/sqlite-pragmas.d.ts

@@ -142,3 +142,27 @@ export interface SqliteOccupancy {
  * three header reads on a connection that is already open.
  */
 export declare function sqliteOccupancy(counters: SqlitePageCounters): SqliteOccupancy;
+/**
+ * How often the connection re-checks whether the file has outgrown its map.
+ *
+ * The database grows by roughly 40 MB a day on this cluster, so five minutes is
+ * far finer than it needs to be — but the check is three arithmetic operations
+ * on a `stat`, and the failure it prevents is a node silently returning to
+ * 418 synchronous page-ins per second. Cheap insurance against a slow leak.
+ */
+export declare const MAP_GROWTH_CHECK_INTERVAL_MS: number;
+/**
+ * The new `mmap_size` when the file has outgrown the current one, or `null`.
+ *
+ * `sqliteMmapSizeFor` already autoscales to any user's database — but it is
+ * applied when the connection OPENS and never again, which is the same bug one
+ * level up: a file that grows during uptime keeps the map it had at boot. This
+ * node escaped it only because 130 MB → 858 MB spanned seventeen days of
+ * restarts; a node up for two months walks straight back into 70% of the file
+ * outside the map.
+ *
+ * GROWTH only. Shrinking after a delete buys nothing and costs a remap, and the
+ * file does not shrink without a `VACUUM` regardless — measured 2026-08-25,
+ * `freePct=1` on an 858 MB file that had been deleting rows for days.
+ */
+export declare function resolveMapGrowth(currentMmapBytes: number, fileSizeBytes: number): number | null;

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -221,6 +221,24 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * Returns null if the backend has not been initialized yet.
      */
     getDatabase(): Database.Database | null;
+    /**
+     * `EXPLAIN QUERY PLAN` for a statement, as one string per plan row.
+     *
+     * Answers the question the timing alone cannot: "1.6 s for 501 rows" is a
+     * full scan and is also a cold disk, and only the plan tells them apart. It
+     * runs on the SAME connection as the statement, because that is the only
+     * connection whose `sqlite_stat1` visibility and temp schema match.
+     *
+     * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
+     * so it costs no page reads of its own. It is still called only from the
+     * slow-call path, once per shape per window.
+     *
+     * Never throws. A plan that cannot be taken (a statement the engine will no
+     * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
+     * failure worth turning a slow query into a crash — the profiler falls back
+     * to the line it would have printed anyway.
+     */
+    private explainQueryPlan;
     /**
      * Run one synchronous statement under the profiler.
      *
@@ -251,6 +269,30 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * enumerated. `unref` so it can never hold the process open, and
      * `CAMSTACK_SQLITE_STORAGE_REPORT=off` turns it off without a rebuild.
      */
+    /**
+     * Follow the file as it grows.
+     *
+     * The map is derived from the file at OPEN and never again, which is the same
+     * expiry one level up: a database that grows during uptime keeps the map it
+     * had at boot, and once the file passes it every read outside the window
+     * costs a synchronous page-in — 418 per second, measured 2026-08-25. This
+     * node escaped it only because 130 MB → 858 MB spanned seventeen days of
+     * restarts.
+     *
+     * `unref` so it never holds the process open, and the same kill switch as the
+     * storage report turns it off without a rebuild.
+     */
+    private scheduleMapGrowthCheck;
+    /**
+     * One-shot `ANALYZE`, long after boot, only if the database has none.
+     *
+     * `analyze-stats.ts` has the measurement that justifies it: without
+     * `sqlite_stat1` the planner walked 150 133 media rows to return six, and one
+     * `ANALYZE` took that same query from 727 ms to 3.2 ms. It is scheduled
+     * rather than run inline because it is a 14 s synchronous statement on the
+     * one thread the cluster reads configuration through.
+     */
+    private scheduleIndexAnalysis;
     private scheduleStorageReport;
     private logStorageReport;
     private readPragmaNumber;

package/dist/builtins/sqlite-storage/statement-shape.d.ts

@@ -0,0 +1,64 @@
+/**
+ * A stable, low-cardinality name for the SHAPE of a SQL statement.
+ *
+ * ## Why the profiler needs this
+ *
+ * `SqliteOpProfiler` aggregated on `(op, collection)`, and that pair is not an
+ * identity — it is a table. On 2026-08-25 the busiest line of a 90 s operator
+ * stall read `query pipeline-analytics:tracks — 1005 calls, 2694 ms,
+ * max 1615 ms, 17981 rows`, and there was no way to tell from it WHICH of the
+ * eleven distinct reads that addon issues against that one table had spent the
+ * second and a half. Every one of them was equally accused; the aggregate could
+ * not clear a single one.
+ *
+ * The shape is the missing half. It is derived from the statement the engine
+ * actually prepared, so it cannot drift from the code the way a hand-passed
+ * label would, and it collapses to exactly one string per call site — which is
+ * what makes it safe as part of an aggregate key.
+ *
+ * ## What is thrown away, and why
+ *
+ * - **The projection.** `queryDeclared` always selects every column, so the
+ *   `SELECT` list is the table's schema restated — pure noise, and the single
+ *   longest part of the statement.
+ * - **The table name.** It is already the `collection` field of the report.
+ * - **The width of an `IN` list.** `IN (?, ?, … ×500)` and `IN (?)` are the
+ *   same call site; keeping the literal placeholders would make every page of
+ *   a chunked read its own aggregate row. The COUNT is kept (`IN (?×500)`)
+ *   because it is the difference between "reads one row" and "reads five
+ *   hundred", which is the whole question being asked.
+ *
+ * Bound values are never included. They are not needed to name a call site, and
+ * a statement's parameters routinely carry device ids, keys and user data — a
+ * profiler line is not a place to put them.
+ */
+/**
+ * Longest fingerprint kept, in characters.
+ *
+ * A shape is a log field printed five to a line; past this it stops being
+ * readable and starts pushing the numbers off the end. Every real statement in
+ * this engine fits well inside it — the cap exists for the pathological
+ * `whereIn` with forty distinct fields, not for the normal case.
+ */
+export declare const SQL_SHAPE_MAX_LENGTH = 220;
+/** Appended when a shape is cut at {@link SQL_SHAPE_MAX_LENGTH}. */
+export declare const SQL_SHAPE_ELLIPSIS = "\u2026";
+/**
+ * How many distinct raw statements the memo holds before it is dropped.
+ *
+ * The engine prepares its SQL fresh on every call, so without a memo this runs
+ * a handful of regexes per statement at a few hundred statements a second.
+ * With one, it runs them once per call site. The bound exists because the raw
+ * key is unbounded in principle (an `IN` list of a new width mints a new
+ * entry): at the cap the memo is cleared rather than grown, which costs one
+ * re-derivation per shape and cannot leak.
+ */
+export declare const SQL_SHAPE_MEMO_MAX_ENTRIES = 512;
+/**
+ * Name the shape of `sql`, whose table is `collection`.
+ *
+ * Memoised on the raw statement — see {@link SQL_SHAPE_MEMO_MAX_ENTRIES}.
+ */
+export declare function sqlShape(sql: string, collection: string): string;
+/** Test seam: forget every memoised shape. */
+export declare function resetSqlShapeMemo(): void;

package/dist/index.js

@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BTkFwAk_.js");
+const require_manifest_python_deps = require("./manifest-python-deps-C9x9vrqt.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -94022,6 +94022,34 @@ function positiveInt(raw, fallback) {
 	const n = Number.parseInt(raw, 10);
 	return Number.isFinite(n) && n > 0 ? n : fallback;
 }
+/**
+* The child's environment, with the allocator pair applied or REMOVED.
+*
+* `runnerNativeAllocatorEnv` returns what to add. That was sufficient while the
+* parent had nothing to inherit: omitting a key meant the child never saw it.
+* Once the image entrypoint welds the pair into the container environment — the
+* change that lets an operator drop them from the Unraid template — the child
+* INHERITS them, and a kill switch that only omits is a kill switch that does
+* nothing.
+*
+* So `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` DELETES. And only that: the
+* non-linux path returns nothing to add for its own reasons (the pin is a pure
+* throughput cut there — measured `sharp.concurrency()` 6 on the darwin agent
+* against 1 on the linux hub) and must not be read as "remove what the operator
+* chose". Deletion is the switch's job, not absence's.
+*/
+function applyRunnerNativeAllocator(parentEnv, platform = process.platform) {
+	const next = { ...parentEnv };
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") {
+		delete next["MALLOC_ARENA_MAX"];
+		delete next["VIPS_CONCURRENCY"];
+		return next;
+	}
+	return {
+		...next,
+		...runnerNativeAllocatorEnv(parentEnv, platform)
+	};
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94319,7 +94347,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
-			...runnerNativeAllocatorEnv(process.env),
+			...applyRunnerNativeAllocator(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);

package/dist/index.mjs

@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Dmcnb287.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-08rqn6xN.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -94015,6 +94015,34 @@ function positiveInt(raw, fallback) {
 	const n = Number.parseInt(raw, 10);
 	return Number.isFinite(n) && n > 0 ? n : fallback;
 }
+/**
+* The child's environment, with the allocator pair applied or REMOVED.
+*
+* `runnerNativeAllocatorEnv` returns what to add. That was sufficient while the
+* parent had nothing to inherit: omitting a key meant the child never saw it.
+* Once the image entrypoint welds the pair into the container environment — the
+* change that lets an operator drop them from the Unraid template — the child
+* INHERITS them, and a kill switch that only omits is a kill switch that does
+* nothing.
+*
+* So `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` DELETES. And only that: the
+* non-linux path returns nothing to add for its own reasons (the pin is a pure
+* throughput cut there — measured `sharp.concurrency()` 6 on the darwin agent
+* against 1 on the linux hub) and must not be read as "remove what the operator
+* chose". Deletion is the switch's job, not absence's.
+*/
+function applyRunnerNativeAllocator(parentEnv, platform = process.platform) {
+	const next = { ...parentEnv };
+	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") {
+		delete next["MALLOC_ARENA_MAX"];
+		delete next["VIPS_CONCURRENCY"];
+		return next;
+	}
+	return {
+		...next,
+		...runnerNativeAllocatorEnv(parentEnv, platform)
+	};
+}
 //#endregion
 //#region src/kernel/moleculer/process-service.ts
 /**
@@ -94312,7 +94340,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
-			...runnerNativeAllocatorEnv(process.env),
+			...applyRunnerNativeAllocator(process.env),
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);

package/dist/kernel/moleculer/runner-native-allocator.d.ts

@@ -93,3 +93,20 @@ export interface RunnerNativeAllocatorEnv {
  * exists to leave.
  */
 export declare function runnerNativeAllocatorEnv(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): RunnerNativeAllocatorEnv;
+/**
+ * The child's environment, with the allocator pair applied or REMOVED.
+ *
+ * `runnerNativeAllocatorEnv` returns what to add. That was sufficient while the
+ * parent had nothing to inherit: omitting a key meant the child never saw it.
+ * Once the image entrypoint welds the pair into the container environment — the
+ * change that lets an operator drop them from the Unraid template — the child
+ * INHERITS them, and a kill switch that only omits is a kill switch that does
+ * nothing.
+ *
+ * So `CAMSTACK_RUNNER_NATIVE_ALLOCATOR=off` DELETES. And only that: the
+ * non-linux path returns nothing to add for its own reasons (the pin is a pure
+ * throughput cut there — measured `sharp.concurrency()` 6 on the darwin agent
+ * against 1 on the linux hub) and must not be read as "remove what the operator
+ * chose". Deletion is the switch's job, not absence's.
+ */
+export declare function applyRunnerNativeAllocator(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;

package/dist/kernel/moleculer/trpc-links.d.ts

@@ -1,7 +1,7 @@
-import { ServiceBroker } from 'moleculer';
 import { TRPCLink } from '@trpc/client';
 import { AnyRouter } from '@trpc/server';
-import { LocalChildRegistry, CapCallInput } from '../transport/index.js';
+import { ServiceBroker } from 'moleculer';
+import { CapCallInput, LocalChildRegistry } from '../transport/index.js';
 /**
  * Resolver for in-process capability providers.
  *
@@ -51,11 +51,39 @@ export type CapUsageObserver = (obs: CapUsageObservation) => void;
 export interface CapUsageObserverOptions {
     /** The addon whose `ctx.api` produced this link chain. */
     readonly callerAddonId: string;
-    /** Resolve which addon hosts the provider for `capName`. Return `null` to skip recording. */
+    /**
+     * Resolve which addon hosts the provider for `capName`. `null` means "not in
+     * the LOCAL registry" — which is every cross-process provider, and no longer
+     * means "do not record": see {@link UNRESOLVED_PROVIDER_ADDON_ID}.
+     */
     readonly providerAddonIdForCap: (capName: string) => string | null;
     /** Sink for observations. MUST NOT throw — wrapper catches anyway. */
     readonly observer: CapUsageObserver;
 }
+/**
+ * Stands in for a provider the LOCAL registry cannot name.
+ *
+ * `providerAddonIdForCap` only searches the local registry, so it returns
+ * `null` for every cross-process provider — which is every forked runner,
+ * `sqlite-settings` included. That `null` used to drop the whole observation,
+ * caller and all. The result: `nodes.getCapUsageGraph`, an admin API whose
+ * entire job is to show caller → provider → cap traffic, returned an EMPTY
+ * ARRAY on the live hub while the engine logged 39 717 calls a minute to a
+ * single collection. An empty graph reads as "nothing is calling anything".
+ *
+ * The caller is always known — it is whoever made the call — and "who is
+ * hammering this cap" is the question the graph exists to answer. So the
+ * observation is recorded and the unknown half stays VISIBLY unknown, which is
+ * a fact an operator can act on, rather than absent, which is a fact nobody can
+ * see. Naming the provider properly needs the cluster-wide cap list; until then
+ * this placeholder is the honest value.
+ */
+export declare const UNRESOLVED_PROVIDER_ADDON_ID = "(unresolved: cross-process)";
+/**
+ * Record one cap call, if an observer is configured. Extracted so the rule —
+ * an unresolved provider never erases the caller — has ONE place and a test.
+ */
+export declare function recordCapUsage(observerOpts: CapUsageObserverOptions, capName: string, methodName: string): void;
 /**
  * Non-terminating tRPC link that intercepts calls when the target
  * capability has a provider registered in the local process.

package/dist/{manifest-python-deps-Dmcnb287.mjs → manifest-python-deps-08rqn6xN.mjs}

@@ -6089,8 +6089,21 @@ function createHubCapForwardService(onUnownedCall) {
 		} } }
 	};
 }
-//#endregion
-//#region src/kernel/moleculer/trpc-links.ts
+/**
+* Record one cap call, if an observer is configured. Extracted so the rule —
+* an unresolved provider never erases the caller — has ONE place and a test.
+*/
+function recordCapUsage(observerOpts, capName, methodName) {
+	try {
+		observerOpts.observer({
+			callerAddonId: observerOpts.callerAddonId,
+			providerAddonId: observerOpts.providerAddonIdForCap(capName) ?? "(unresolved: cross-process)",
+			capName,
+			methodName,
+			atMs: Date.now()
+		});
+	} catch {}
+}
 /** Convert camelCase → kebab-case. */
 function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
@@ -6140,16 +6153,7 @@ function localProviderLink(resolver, observerOpts) {
 			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
 			if (typeof fn !== "function") return next(opWithDefaults);
-			if (observerOpts) try {
-				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
-				if (providerAddonId) observerOpts.observer({
-					callerAddonId: observerOpts.callerAddonId,
-					providerAddonId,
-					capName: parsed.capName,
-					methodName: parsed.method,
-					atMs: Date.now()
-				});
-			} catch {}
+			if (observerOpts) recordCapUsage(observerOpts, parsed.capName, parsed.method);
 			return observable((observer) => {
 				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
@@ -6410,9 +6414,9 @@ function brokerTransportLink(broker, serviceMap, observerOpts, linkOptions) {
 					}
 					if (observerOpts) try {
 						const providerAddonId = serviceName !== parsed.capName ? serviceName : observerOpts.providerAddonIdForCap(parsed.capName);
-						if (providerAddonId) observerOpts.observer({
+						observerOpts.observer({
 							callerAddonId: observerOpts.callerAddonId,
-							providerAddonId,
+							providerAddonId: providerAddonId ?? "(unresolved: cross-process)",
 							capName: parsed.capName,
 							methodName: parsed.method,
 							atMs: Date.now()

package/dist/{manifest-python-deps-BTkFwAk_.js → manifest-python-deps-C9x9vrqt.js}

@@ -6093,8 +6093,21 @@ function createHubCapForwardService(onUnownedCall) {
 		} } }
 	};
 }
-//#endregion
-//#region src/kernel/moleculer/trpc-links.ts
+/**
+* Record one cap call, if an observer is configured. Extracted so the rule —
+* an unresolved provider never erases the caller — has ONE place and a test.
+*/
+function recordCapUsage(observerOpts, capName, methodName) {
+	try {
+		observerOpts.observer({
+			callerAddonId: observerOpts.callerAddonId,
+			providerAddonId: observerOpts.providerAddonIdForCap(capName) ?? "(unresolved: cross-process)",
+			capName,
+			methodName,
+			atMs: Date.now()
+		});
+	} catch {}
+}
 /** Convert camelCase → kebab-case. */
 function toKebab(name) {
 	return name.replace(/[A-Z]/g, (m, i) => (i > 0 ? "-" : "") + m.toLowerCase());
@@ -6144,16 +6157,7 @@ function localProviderLink(resolver, observerOpts) {
 			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
 			if (typeof fn !== "function") return next(opWithDefaults);
-			if (observerOpts) try {
-				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
-				if (providerAddonId) observerOpts.observer({
-					callerAddonId: observerOpts.callerAddonId,
-					providerAddonId,
-					capName: parsed.capName,
-					methodName: parsed.method,
-					atMs: Date.now()
-				});
-			} catch {}
+			if (observerOpts) recordCapUsage(observerOpts, parsed.capName, parsed.method);
 			return observable((observer) => {
 				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
@@ -6414,9 +6418,9 @@ function brokerTransportLink(broker, serviceMap, observerOpts, linkOptions) {
 					}
 					if (observerOpts) try {
 						const providerAddonId = serviceName !== parsed.capName ? serviceName : observerOpts.providerAddonIdForCap(parsed.capName);
-						if (providerAddonId) observerOpts.observer({
+						observerOpts.observer({
 							callerAddonId: observerOpts.callerAddonId,
-							providerAddonId,
+							providerAddonId: providerAddonId ?? "(unresolved: cross-process)",
 							capName: parsed.capName,
 							methodName: parsed.method,
 							atMs: Date.now()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.132",
+  "version": "1.2.134",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",