@camstack/system 1.2.143 → 1.2.145

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CQs1b7uh.js");
+const require_dist = require("./dist-BVU5JADq.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-B_mCU6gz.js");
+const require_manifest_python_deps = require("./manifest-python-deps-GjlyPjm0.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -93435,13 +93435,23 @@ function createCoreCapService(options) {
 	const actions = {};
 	for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
 		const raw = require_manifest_python_deps.deserializeTypedArrays(ctx.params);
-		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw);
+		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
 	} };
 	return {
 		name: options.serviceName ?? "$core-caps",
 		actions
 	};
 }
+/** Structural read of the calling node/action. Anything unrecognised is `null`. */
+function readOrigin(ctx) {
+	return {
+		nodeId: asName(ctx.nodeID),
+		caller: asName(ctx.caller)
+	};
+}
+function asName(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
 //#endregion
 //#region src/kernel/moleculer/hub-log-forwarder.ts
 /**
@@ -94339,10 +94349,20 @@ function isHeavyRunner(addons) {
 * one-off burst becomes the runner's permanent RSS.
 *
 * Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
-* there after the deferred archive walk (99,809 segments in 84s), while the `RecordingIndex` it
-* actually retains is arithmetically ~21 MB (a `SegmentRow` is 5 numbers + 3 strings ≈ 207 B). The
-* same addon on two agent nodes carrying the same code and a smaller archive sits at **58 MB**.
-* The ~2 GB is walk garbage held as high-water in a heap that had no reason to collect it.
+* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
+* **58 MB**.
+*
+* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
+* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
+* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
+* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
+* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
+* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
+* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
+* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
+*
+* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
+* no reason to collect" is the explanation to reach for last, not first.
 *
 * ## Why 1024
 *
@@ -94359,8 +94379,7 @@ function isHeavyRunner(addons) {
 *
 * A runner whose working set genuinely does not fit declares its own number in its manifest
 * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
-* shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
 * `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
 * space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
 * from RSS.

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as kebabToCamel, Bt as emitDownForOwnedCaps, C as addonSettingsCapability, Dt as DATAPLANE_SECRET_HEADER$1, G as extractNestedAddonId, Ht as expandCapMethods, It as asJsonObject$1, J as isCollectionArrayMethod, Jt as readinessKey, Kt as parseJsonObject, Lt as asNumber, Nt as ReadinessRegistry, Ot as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Pt as ReadinessTimeoutError, Q as isVoidInput, Qt as EventCategory$1, Rt as asString$1, Tt as errMsg$1, Xt as scopeKey, Y as isObjectInput, Yt as resolveCapMount, dt as resolveMethodAuth, et as lifecycleJobSchema, f as LOG_LEVEL_RANK, it as looseSchema, kt as DEVICE_STATUS_METHOD, m as RUNTIME_DEFAULTS, mt as scopesAllowDeviceCap, p as METHOD_ACCESS_MAP, pt as scopesAllowAddon, q as isArrayOutputSchema, qt as parseJsonUnknown$1, rt as logLevelAtMost, st as objectInputDeclaresAddonId, t as ALL_CAPABILITY_DEFINITIONS, ut as procedureAuthKey, zt as createEvent } from "./dist-CVuVKA-O.mjs";
+import { $ as kebabToCamel, Bt as emitDownForOwnedCaps, C as addonSettingsCapability, Dt as DATAPLANE_SECRET_HEADER$1, G as extractNestedAddonId, Ht as expandCapMethods, It as asJsonObject$1, J as isCollectionArrayMethod, Jt as readinessKey, Kt as parseJsonObject, Lt as asNumber, Nt as ReadinessRegistry, Ot as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Pt as ReadinessTimeoutError, Q as isVoidInput, Qt as EventCategory$1, Rt as asString$1, Tt as errMsg$1, Xt as scopeKey, Y as isObjectInput, Yt as resolveCapMount, dt as resolveMethodAuth, et as lifecycleJobSchema, f as LOG_LEVEL_RANK, it as looseSchema, kt as DEVICE_STATUS_METHOD, m as RUNTIME_DEFAULTS, mt as scopesAllowDeviceCap, p as METHOD_ACCESS_MAP, pt as scopesAllowAddon, q as isArrayOutputSchema, qt as parseJsonUnknown$1, rt as logLevelAtMost, st as objectInputDeclaresAddonId, t as ALL_CAPABILITY_DEFINITIONS, ut as procedureAuthKey, zt as createEvent } from "./dist-CG7kwIZp.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-CQhPGSJm.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as createV8Reclaimer, B as AGENT_CAP_FWD_SERVICE, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, Mt as startHeapWatch, N as udsChildLogToWorkerEntry, Nt as startRunnerHeapWatch, O as HUB_CAP_FWD_SERVICE, Ot as RUNNER_HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as strandedMb, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as shouldReclaim, k as createHubCapForwardService, kt as buildHeapSample, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-BuhBXCg0.mjs";
+import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, At as createV8Reclaimer, B as AGENT_CAP_FWD_SERVICE, C as brokerTransportLink, Ct as createAddonDataPlaneFacility, D as HUB_CAP_FWD_ACTION, Dt as HEAP_WATCH_WARN_RATIO, E as localProviderLink, Et as HEAP_WATCH_INTERVAL_MS, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, Mt as startHeapWatch, N as udsChildLogToWorkerEntry, Nt as startRunnerHeapWatch, O as HUB_CAP_FWD_SERVICE, Ot as RUNNER_HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as strandedMb, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerCallForCap, St as runNpm, T as ipcParentLink, Tt as HEAP_RECLAIM_TRIGGER_MB, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as createKernelHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as capActionName, d as getBrokerEventBus, dt as capServiceName, et as createBrokerDeviceManagerApi, f as getMoleculerEventStats, ft as parseCapAction, g as AddonDepsManager, gt as CapabilityHandle, h as subscribePassthrough, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, jt as shouldReclaim, k as createHubCapForwardService, kt as buildHeapSample, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as setNodeEventInterest, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as registerEventBusService, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as clusterEventTopic, ut as capBareAction, v as resolveHwAccel, vt as copyBundledNativeModules, w as buildLinkChain, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as installManifestNativeDeps, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-BRyNCnnG.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -93428,13 +93428,23 @@ function createCoreCapService(options) {
 	const actions = {};
 	for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
 		const raw = deserializeTypedArrays(ctx.params);
-		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw);
+		return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
 	} };
 	return {
 		name: options.serviceName ?? "$core-caps",
 		actions
 	};
 }
+/** Structural read of the calling node/action. Anything unrecognised is `null`. */
+function readOrigin(ctx) {
+	return {
+		nodeId: asName(ctx.nodeID),
+		caller: asName(ctx.caller)
+	};
+}
+function asName(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
 //#endregion
 //#region src/kernel/moleculer/hub-log-forwarder.ts
 /**
@@ -94332,10 +94342,20 @@ function isHeavyRunner(addons) {
 * one-off burst becomes the runner's permanent RSS.
 *
 * Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
-* there after the deferred archive walk (99,809 segments in 84s), while the `RecordingIndex` it
-* actually retains is arithmetically ~21 MB (a `SegmentRow` is 5 numbers + 3 strings ≈ 207 B). The
-* same addon on two agent nodes carrying the same code and a smaller archive sits at **58 MB**.
-* The ~2 GB is walk garbage held as high-water in a heap that had no reason to collect it.
+* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
+* **58 MB**.
+*
+* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
+* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
+* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
+* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
+* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
+* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
+* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
+* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
+*
+* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
+* no reason to collect" is the explanation to reach for last, not first.
 *
 * ## Why 1024
 *
@@ -94352,8 +94372,7 @@ function isHeavyRunner(addons) {
 *
 * A runner whose working set genuinely does not fit declares its own number in its manifest
 * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
-* shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
 * `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
 * space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
 * from RSS.

package/dist/kernel/index.d.ts

@@ -37,7 +37,7 @@ export type { BrokerConfig } from './moleculer/broker-factory.js';
 export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-deploy-source.js';
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';
-export type { CoreCapAction, CoreCapServiceOptions } from './moleculer/core-cap-service.js';
+export type { CoreCapAction, CoreCapCallOrigin, CoreCapServiceOptions, } from './moleculer/core-cap-service.js';
 export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, clusterEventTopic, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
 export type { MoleculerEventStats } from './moleculer/addon-context-factory.js';
 export { HubLogForwarder } from './moleculer/hub-log-forwarder.js';

package/dist/kernel/moleculer/children-batch-loader.d.ts

@@ -0,0 +1,46 @@
+import { IScopedLogger } from '@camstack/types';
+/**
+ * The child fields the accessory reconcile reads. Deliberately narrower than
+ * `DeviceInfo`: the loader is a transport, and a transport that pins the whole
+ * projection would have to change every time an unrelated field does.
+ */
+export interface ReconcileChildRow {
+    readonly id: number;
+    readonly stableId: string;
+    readonly name: string;
+    readonly linkDeviceId?: number | null;
+}
+/**
+ * Narrow an untyped cap answer to the fields the reconcile reads.
+ *
+ * `callDeviceManager` is an untyped boundary, and the answer may come from a
+ * hub of a different vintage. A row that does not carry an id, a stableId and
+ * a name is not a child this code can prune ON, so it is dropped rather than
+ * cast into shape — the prune step DELETES, and a half-parsed row is the input
+ * that would make it delete the wrong thing.
+ */
+export declare function parseChildRows(value: unknown): readonly ReconcileChildRow[] | null;
+/**
+ * Narrow a `getChildrenBatch` answer: a record keyed by parent id as a string.
+ *
+ * An EMPTY record is a valid answer — "none of these parents has children" —
+ * and so is what a hub that answers the call but knows none of the parents
+ * would send. Both mean "nothing to prune", which is the safe direction. Only
+ * a shape that is not a record at all is `null`, and the loader treats that as
+ * a failed batch and re-asks per parent.
+ */
+export declare function parseChildrenByParent(value: unknown): ReadonlyMap<number, readonly ReconcileChildRow[]> | null;
+export interface ChildrenBatchLoaderOptions {
+    /** One `device-manager.getChildrenBatch` call. Rejects like any RPC. */
+    readonly fetchBatch: (parentDeviceIds: readonly number[]) => Promise<ReadonlyMap<number, readonly ReconcileChildRow[]>>;
+    /** One `device-manager.getChildren` call — the fallback, and the old path. */
+    readonly fetchOne: (parentDeviceId: number) => Promise<readonly ReconcileChildRow[]>;
+    readonly logger: IScopedLogger;
+    /** Test seam. Production takes {@link DEVICE_CHILDREN_BATCH_MAX}. */
+    readonly maxBatch?: number;
+}
+export interface ChildrenBatchLoader {
+    /** The direct children of one parent, coalesced with every other in-flight ask. */
+    load(parentDeviceId: number): Promise<readonly ReconcileChildRow[]>;
+}
+export declare function createChildrenBatchLoader(opts: ChildrenBatchLoaderOptions): ChildrenBatchLoader;

package/dist/kernel/moleculer/core-cap-service.d.ts

@@ -1,4 +1,13 @@
 import { ServiceSchema } from 'moleculer';
+/**
+ * Who issued a `$core-caps` action. Both fields are `null` when Moleculer did
+ * not carry the information — never blank, so an absent origin reads as absent
+ * rather than as a formatting defect.
+ */
+export interface CoreCapCallOrigin {
+    readonly nodeId: string | null;
+    readonly caller: string | null;
+}
 /**
  * Default Moleculer service name for the hub core-capability bridge.
  *
@@ -22,8 +31,14 @@ export declare const CORE_CAP_SERVICE_NAME = "$core-caps";
 export interface CoreCapAction {
     /** Kebab-cased `<capName>.<method>` — e.g. `system.info`, `addon-settings-raw.getGlobal`. */
     readonly actionName: string;
-    /** Invoke the underlying tRPC procedure with a trusted mesh context. */
-    readonly invoke: (input: unknown) => Promise<unknown> | unknown;
+    /**
+     * Invoke the underlying tRPC procedure with a trusted mesh context.
+     *
+     * `origin` is diagnostics only — the transport census uses it to name the
+     * caller of an in-process call, which has no request and therefore no other
+     * identity. No implementation may gate on it.
+     */
+    readonly invoke: (input: unknown, origin: CoreCapCallOrigin) => Promise<unknown> | unknown;
 }
 export interface CoreCapServiceOptions {
     /** Moleculer service name. Defaults to {@link CORE_CAP_SERVICE_NAME}. */

package/dist/kernel/moleculer/process-service.d.ts

@@ -16,10 +16,20 @@ interface RunnerAddonSpec {
  * one-off burst becomes the runner's permanent RSS.
  *
  * Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
- * there after the deferred archive walk (99,809 segments in 84s), while the `RecordingIndex` it
- * actually retains is arithmetically ~21 MB (a `SegmentRow` is 5 numbers + 3 strings ≈ 207 B). The
- * same addon on two agent nodes carrying the same code and a smaller archive sits at **58 MB**.
- * The ~2 GB is walk garbage held as high-water in a heap that had no reason to collect it.
+ * there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
+ * **58 MB**.
+ *
+ * ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
+ * and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
+ * 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
+ * index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
+ * `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
+ * 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
+ * ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
+ * segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
+ *
+ * The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
+ * no reason to collect" is the explanation to reach for last, not first.
  *
  * ## Why 1024
  *
@@ -36,8 +46,7 @@ interface RunnerAddonSpec {
  *
  * A runner whose working set genuinely does not fit declares its own number in its manifest
  * (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
- * `recorder` (3072 MB; peak 2341 MB heapTotal during the deferred archive walk) is the one
- * shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+ * `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
  * `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
  * space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
  * from RSS.

package/dist/{manifest-python-deps-BuhBXCg0.mjs → manifest-python-deps-BRyNCnnG.mjs}

@@ -1,3 +1,4 @@
+import "./dist-CG7kwIZp.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -1649,6 +1650,182 @@ async function readModifyWrite(input) {
 	return true;
 }
 //#endregion
+//#region src/kernel/moleculer/children-batch-loader.ts
+/**
+* "Who are my children?" asked by a thousand devices, answered in a handful of
+* calls.
+*
+* ## The number
+*
+* Every `BaseDevice` inherits a `getAccessoryChildren()` that returns `[]`, so
+* the accessory reconcile in `device-cap-proxy.ts` runs its orphan-prune step
+* for EVERY registered device — including the leaf accessories that can never
+* own one. Each pass asked `device-manager.getChildren` for its own id.
+* Measured on the live hub 2026-08-27, 120-second boot window, 1 017 devices:
+* **1 024 calls returning 919 rows in total**. A thousand round-trips, and a
+* thousand indexed scans behind them, to move less than one row each.
+*
+* ## Why a loader and not a caller that loops
+*
+* There is no loop to unroll. Reconcile is per-device by construction: it runs
+* inside `register()`, and again whenever a late feature-probe writes the
+* slice. The repetition is a THOUSAND INDEPENDENT CALLERS, not one caller
+* asking a thousand times — so the collapse has to happen between them.
+*
+* ## Why the batch is self-clocking, with no window to tune
+*
+* At most ONE batch call is in flight. Anything that arrives while it is in
+* flight lands in the next batch, dispatched the moment the current one
+* settles. That makes the batch size adapt to the arrival rate on its own:
+*
+*  - Idle: the first caller flushes on the next macrotask. No added wait, and
+*    no timer to pick a value for and be wrong about.
+*  - Boot: `BaseDeviceProvider.onRestoreDevices` issues every top-level
+*    `create()` at once and `runBounded(specs, 12)` spawns accessory children
+*    twelve wide, so reconciles arrive in bursts — measured as 2 372 device
+*    log lines in one 5-second bucket at boot+16s, against 62 at boot+142s.
+*    Every arrival inside one round-trip collapses into the next call.
+*  - Worst case: arrivals slower than a round-trip give batches of one, which
+*    is exactly today's cost. The loader can never be worse than what it
+*    replaces.
+*
+* A fixed debounce window would have to be guessed against that distribution,
+* and would tax the idle case to pay for the busy one.
+*
+* ## Degrading, rather than breaking, against an older hub
+*
+* `getChildrenBatch` is a NEW method: a hub that predates it rejects the call
+* (it does not silently strip the input and answer a different question, which
+* is what adding a `parentDeviceIds` FIELD to `getChildren` would have done).
+* Every waiter in a failed batch is then answered by the per-parent
+* `getChildren` it would have used anyway, so the reconcile is never denied
+* its answer. A rejection that names the method as unknown latches the
+* fallback permanently — re-probing a method the hub will never have, once per
+* batch for a whole boot, is the storm this exists to remove.
+*/
+/**
+* Narrow an untyped cap answer to the fields the reconcile reads.
+*
+* `callDeviceManager` is an untyped boundary, and the answer may come from a
+* hub of a different vintage. A row that does not carry an id, a stableId and
+* a name is not a child this code can prune ON, so it is dropped rather than
+* cast into shape — the prune step DELETES, and a half-parsed row is the input
+* that would make it delete the wrong thing.
+*/
+function parseChildRows(value) {
+	if (!Array.isArray(value)) return null;
+	const rows = [];
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null) return null;
+		const id = Reflect.get(entry, "id");
+		const stableId = Reflect.get(entry, "stableId");
+		const name = Reflect.get(entry, "name");
+		const linkDeviceId = Reflect.get(entry, "linkDeviceId");
+		if (typeof id !== "number" || typeof stableId !== "string" || typeof name !== "string") return null;
+		rows.push({
+			id,
+			stableId,
+			name,
+			...typeof linkDeviceId === "number" || linkDeviceId === null ? { linkDeviceId } : {}
+		});
+	}
+	return rows;
+}
+/**
+* Narrow a `getChildrenBatch` answer: a record keyed by parent id as a string.
+*
+* An EMPTY record is a valid answer — "none of these parents has children" —
+* and so is what a hub that answers the call but knows none of the parents
+* would send. Both mean "nothing to prune", which is the safe direction. Only
+* a shape that is not a record at all is `null`, and the loader treats that as
+* a failed batch and re-asks per parent.
+*/
+function parseChildrenByParent(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, entry] of Object.entries(value)) {
+		const parentDeviceId = Number(key);
+		if (!Number.isInteger(parentDeviceId)) return null;
+		const rows = parseChildRows(entry);
+		if (rows === null) return null;
+		out.set(parentDeviceId, rows);
+	}
+	return out;
+}
+/**
+* True when an error says the hub has no such procedure — the version-skew
+* case, and the only one worth latching on. Anything else (a timeout, a busy
+* broker) is transient and must not disable batching for the process lifetime.
+*/
+function looksLikeUnknownMethod(err) {
+	const lowered = (err instanceof Error ? err.message : String(err)).toLowerCase();
+	return lowered.includes("not_found") || lowered.includes("no procedure") || lowered.includes("unknown method") || lowered.includes("no such method") || lowered.includes("not available");
+}
+function createChildrenBatchLoader(opts) {
+	const maxBatch = Math.max(1, opts.maxBatch ?? 256);
+	let pending = [];
+	let flushScheduled = false;
+	let flushing = false;
+	let batchUnsupported = false;
+	const answerOneByOne = async (waiters) => {
+		await Promise.all(waiters.map(async (waiter) => {
+			try {
+				waiter.resolve(await opts.fetchOne(waiter.parentDeviceId));
+			} catch (err) {
+				waiter.reject(err);
+			}
+		}));
+	};
+	const runBatch = async (waiters) => {
+		const parentDeviceIds = [...new Set(waiters.map((w) => w.parentDeviceId))];
+		try {
+			const byParent = await opts.fetchBatch(parentDeviceIds);
+			for (const waiter of waiters) waiter.resolve(byParent.get(waiter.parentDeviceId) ?? []);
+		} catch (err) {
+			const unknown = looksLikeUnknownMethod(err);
+			if (unknown) batchUnsupported = true;
+			opts.logger.warn(unknown ? "device-manager.getChildrenBatch is not available on this hub — falling back to per-parent getChildren for the process lifetime" : "device-manager.getChildrenBatch failed — answering this batch per parent", { meta: {
+				parents: parentDeviceIds.length,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			await answerOneByOne(waiters);
+		}
+	};
+	const flush = async () => {
+		flushing = true;
+		try {
+			while (pending.length > 0) {
+				const batch = pending.slice(0, maxBatch);
+				pending = pending.slice(maxBatch);
+				if (batchUnsupported) await answerOneByOne(batch);
+				else await runBatch(batch);
+			}
+		} finally {
+			flushing = false;
+		}
+	};
+	const scheduleFlush = () => {
+		if (flushScheduled || flushing) return;
+		flushScheduled = true;
+		setTimeout(() => {
+			flushScheduled = false;
+			flush().catch((err) => {
+				opts.logger.warn("children batch flush threw", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, 0);
+	};
+	return { load(parentDeviceId) {
+		return new Promise((resolve, reject) => {
+			pending.push({
+				parentDeviceId,
+				resolve,
+				reject
+			});
+			scheduleFlush();
+		});
+	} };
+}
+//#endregion
 //#region src/kernel/moleculer/device-cap-proxy.ts
 /**
 * Max number of accessory children spawned concurrently during a single
@@ -1939,6 +2116,19 @@ function createBrokerDeviceManagerApi(opts) {
 		api
 	});
 	let selfApi;
+	const childrenLoader = createChildrenBatchLoader({
+		logger: opts.logger,
+		fetchBatch: async (parentDeviceIds) => {
+			const parsed = parseChildrenByParent(await callDeviceManager(api, "getChildrenBatch", { parentDeviceIds }));
+			if (parsed === null) throw new Error("getChildrenBatch returned a shape this kernel cannot read");
+			return parsed;
+		},
+		fetchOne: async (parentDeviceId) => {
+			const parsed = parseChildRows(await callDeviceManager(api, "getChildren", { parentDeviceId }));
+			if (parsed === null) throw new Error("getChildren returned a shape this kernel cannot read");
+			return parsed;
+		}
+	});
 	const deviceRebuildFactories = /* @__PURE__ */ new Map();
 	const buildContext = (stableId, id, parentDeviceId = null, initialRuntimeState = {}, persistedConfig = {}, deviceMeta = null) => {
 		let runtimeStateRef = null;
@@ -2356,7 +2546,7 @@ function createBrokerDeviceManagerApi(opts) {
 					return;
 				}
 				try {
-					const currentChildren = await callDeviceManager(api, "getChildren", { parentDeviceId: device.id });
+					const currentChildren = await childrenLoader.load(device.id);
 					for (const child of currentChildren) {
 						if (child.linkDeviceId !== device.id) continue;
 						if (expected.has(child.stableId)) continue;