@camstack/system 1.2.218 → 1.2.219

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,10 +1,11 @@
-import { Jt as errMsg, Ot as reducePoints, Yt as BaseAddon, cn as createEvent, kt as resolveBucketMs, rt as foldSnapshotByFunction, xn as EventCategory, xt as metricsProviderCapability } from "../../dist-DigmGsQS.mjs";
-import { readFile, readdir } from "node:fs/promises";
-import { execFile, execFileSync } from "node:child_process";
-import { promisify } from "node:util";
+import { Jt as errMsg, Ot as reducePoints, Yt as BaseAddon, cn as createEvent, kt as resolveBucketMs, rt as foldSnapshotByFunction, xn as EventCategory, xt as metricsProviderCapability } from "../../dist-Cyz5_i7z.mjs";
+import { access, readFile, readdir } from "node:fs/promises";
 import * as fs from "node:fs";
-import { readFileSync } from "node:fs";
+import { constants, readFileSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
 import * as os from "node:os";
+import { platform } from "node:os";
+import { promisify } from "node:util";
 //#region src/builtins/native-metrics/cgroup-memory.ts
 /** `readFileSync`, with every failure flattened to `null`. */
 var nodeCgroupFileReader = { read(path) {
@@ -1086,1118 +1087,1376 @@ var ContainerMemoryStore = class {
 	}
 };
 //#endregion
-//#region src/builtins/native-metrics/native-metrics-provider.ts
-var IS_DARWIN = os.platform() === "darwin";
-var IS_LINUX = os.platform() === "linux";
-var NativeMetricsProvider = class {
-	id = "native";
-	cachedSnapshot = null;
-	samplingTimer = null;
-	macMemTimer = null;
-	prevCpu;
-	diagnostics = null;
-	consecutiveSampleErrors = 0;
-	constructor() {
-		this.prevCpu = aggregateCpuTimes();
+//#region src/builtins/native-metrics/load-series-store.ts
+/**
+* @durable class=audit owner=metrics-native
+*   write="one row per process per sample, appended in ONE transaction per
+*     sample (`settingsStore.insertMany`) by the HUB's `native-metrics`, off its
+*     subscription to `metrics.node-processes-snapshot`. Emission is
+*     fixed-cadence, so the write rate is deterministic: nodes x processes /
+*     cadence, 7.6 rows/s on the live fleet at the 10 s default. Only a sample
+*     the in-memory ring ACCEPTED is written, which is what makes the append
+*     idempotent without a unique key."
+*   retention="TWO bounds, swept together at most once a minute. By AGE, the
+*     operator's `loadSeriesRetentionHours` (default 6, the intention); by ROWS,
+*     DEFAULT_MAX_ROWS (the guarantee, which bites regardless of the age knob).
+*     Both prune oldest-first through a bounded page — never a full scan — and
+*     the row cap logs when it bites. Losing the table loses the cold window
+*     only: the ring keeps serving the last hour and the charts keep drawing."
+*/
+var LOAD_SERIES_COLLECTION = "metrics:node-load-samples";
+/**
+* Hard ceiling on the table, in ROWS.
+*
+* The guarantee behind the retention knob. Sized against the shipped default
+* and against the worst configuration the knob can express:
+*
+* | cadence | retention | rows (3 nodes, 76 processes) |
+* | --- | --- | --- |
+* | 10 s | 6 h (default) | 164 160 |
+* | 5 s | 6 h | 328 320 |
+* | 5 s | 72 h | 3 939 840 — capped here |
+*
+* 500 000 rows x the measured 87 B = **41.5 MiB**, roughly 3x what the shipped
+* default needs and far below the 2 M rows a three-day retention would reach.
+* It is deliberately NOT a knob: the point of a guarantee is that it is not
+* subject to the same hand that raised the intention. This is the discipline
+* the in-memory ring already adopted (`DEFAULT_MAX_TOTAL_PROCESS_ROWS`) and
+* the one the RTP pre-roll rings still lack — a maximum per instance and no
+* budget at all for the whole, which reached 898 MB across 47 rings
+* (`docs/architecture/load-ledger.md` #5).
+*/
+var DEFAULT_MAX_ROWS = 5e5;
+var LOAD_SERIES_COLUMNS = [
+	(
+	/** `INTEGER PRIMARY KEY` = SQLite rowid alias: the key IS the row's address,
+	*  so it costs no separate index and no stored string. */
+	{
+		name: "id",
+		type: "INTEGER",
+		primaryKey: true,
+		notNull: true
+	}),
+	{
+		name: "nodeId",
+		type: "TEXT",
+		notNull: true
+	},
+	(
+	/** The EMITTING node's timestamp for the sample this row belongs to. Every
+	*  row of one sample shares it — that is what makes a sample reassemblable. */
+	{
+		name: "atMs",
+		type: "INTEGER",
+		notNull: true
+	}),
+	{
+		name: "pid",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** `NULL` for a process no addon owns — `root` and `system` both. */
+	{
+		name: "addonId",
+		type: "TEXT"
+	}),
+	{
+		name: "classification",
+		type: "TEXT",
+		notNull: true
+	},
+	(
+	/** `ps pcpu` x 10. A LIFETIME average, not a rate — see `NodeProcess`. */
+	{
+		name: "cpuDeci",
+		type: "INTEGER",
+		notNull: true
+	}),
+	{
+		name: "rssMib",
+		type: "INTEGER",
+		notNull: true
+	},
+	(
+	/** Instantaneous main-thread CPU% x 10. `NULL` = UNKNOWN, never zero. */
+	{
+		name: "cpuMainDeci",
+		type: "INTEGER"
+	}),
+	(
+	/** Instantaneous V8-helper-pool CPU% x 10. `NULL` = UNKNOWN, never zero. */
+	{
+		name: "cpuGcDeci",
+		type: "INTEGER"
+	})
+];
+var LOAD_SERIES_INDEXES = [(
+/**
+* The ONE index, and it serves both jobs.
+*
+* Reads are always "this node, newer than T" — `nodeId` leads so the
+* equality is a range scan and `atMs` supplies the order without a sort.
+* Prunes are always "this node, oldest first" — the same index, walked from
+* the other end. A second index on `atMs` alone was measured and rejected:
+* it cost 23 B/row (196.0 → 172.8 with the two column drops) to serve a
+* cross-node prune that a per-node loop over three nodes already serves.
+*/
+{
+	name: "idx_load_samples_node_at",
+	columns: ["nodeId", "atMs"]
+})];
+var BYTES_PER_MIB = 1048576;
+/** Tenths → percent. `null` stays `null`: unknown is not zero. */
+function fromDeci(value) {
+	return value === null ? null : Math.round(value) / 10;
+}
+/** Percent → tenths, lossless because both producers already round to tenths. */
+function toDeci(value) {
+	return value === null ? null : Math.round(value * 10);
+}
+/** Storage row → the shape a reader gets. The ONE decode. */
+function rowToProcess(row) {
+	return {
+		pid: row.pid,
+		addonId: row.addonId,
+		classification: row.classification,
+		cpuPercent: fromDeci(row.cpuDeci) ?? 0,
+		memoryRssBytes: row.rssMib * BYTES_PER_MIB,
+		cpuMainPercent: fromDeci(row.cpuMainDeci),
+		cpuGcPercent: fromDeci(row.cpuGcDeci)
+	};
+}
+/** The shape a reader gets → the storage row. The ONE encode. */
+function processToRow(nodeId, atMs, process) {
+	return {
+		nodeId,
+		atMs,
+		pid: process.pid,
+		addonId: process.addonId,
+		classification: process.classification,
+		cpuDeci: toDeci(process.cpuPercent) ?? 0,
+		rssMib: Math.round(process.memoryRssBytes / BYTES_PER_MIB),
+		cpuMainDeci: toDeci(process.cpuMainPercent),
+		cpuGcDeci: toDeci(process.cpuGcPercent)
+	};
+}
+/** Group flat rows into samples, oldest-first. A sample is one `atMs`. */
+function rowsToSamples(rows) {
+	const byAt = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const held = byAt.get(row.atMs);
+		if (held === void 0) byAt.set(row.atMs, [rowToProcess(row)]);
+		else held.push(rowToProcess(row));
 	}
-	/**
-	* Optional diagnostics sink for sampling errors. The first failure and
-	* every Nth failure thereafter are reported so a permanently-broken
-	* collector doesn't spam logs but is still observable.
-	*/
-	setDiagnostics(diag) {
-		this.diagnostics = diag;
+	return [...byAt.entries()].toSorted((a, b) => a[0] - b[0]).map(([atMs, processes]) => ({
+		atMs,
+		processes
+	}));
+}
+/**
+* The cold tier. Append-only, bounded, and never the authority on anything the
+* hot ring can answer.
+*
+* Every method is best-effort and says so in the log rather than throwing at
+* the emitter: a storage hiccup must cost a gap in a chart, never a dropped
+* snapshot on the bus.
+*/
+var LoadSeriesStore = class {
+	declared = false;
+	lastPruneAtMs = 0;
+	store;
+	logger;
+	nowFn;
+	prunePageRows;
+	pruneIntervalMs;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.nowFn = deps.now ?? (() => Date.now());
+		this.prunePageRows = deps.prunePageRows ?? 2e4;
+		this.pruneIntervalMs = deps.pruneIntervalMs ?? 6e4;
 	}
-	startSampling(intervalMs) {
-		if (IS_DARWIN) {
-			sampleMacMemory(this);
-			this.macMemTimer = setInterval(() => sampleMacMemory(this), 5e3);
-			if (this.macMemTimer.unref) this.macMemTimer.unref();
+	/** Idempotently declare the collection. `false` when the store refused. */
+	async declare() {
+		if (this.declared) return true;
+		try {
+			await this.store.declareCollection.mutate({
+				collection: LOAD_SERIES_COLLECTION,
+				columns: [...LOAD_SERIES_COLUMNS],
+				indexes: LOAD_SERIES_INDEXES.map((i) => ({
+					name: i.name,
+					columns: [...i.columns]
+				}))
+			});
+			this.declared = true;
+			return true;
+		} catch (err) {
+			this.logger.warn("load series declareCollection failed — nothing will be retained on disk", { meta: {
+				collection: LOAD_SERIES_COLLECTION,
+				error: errMsg(err)
+			} });
+			return false;
 		}
-		this.collectSnapshot().then((s) => {
-			this.cachedSnapshot = s;
-			this.consecutiveSampleErrors = 0;
-		}).catch((err) => this.reportSampleError(err));
-		this.samplingTimer = setInterval(() => {
-			this.collectSnapshot().then((s) => {
-				this.cachedSnapshot = s;
-				this.consecutiveSampleErrors = 0;
-			}).catch((err) => this.reportSampleError(err));
-		}, intervalMs);
-		if (this.samplingTimer.unref) this.samplingTimer.unref();
 	}
-	reportSampleError(err) {
-		this.consecutiveSampleErrors++;
-		if (!this.diagnostics) return;
-		if (!(this.consecutiveSampleErrors === 1 || this.consecutiveSampleErrors % 60 === 0)) return;
-		this.diagnostics.warn("metrics-provider sample failed", {
-			consecutiveErrors: this.consecutiveSampleErrors,
-			error: err instanceof Error ? err.message : String(err)
-		});
-	}
-	stopSampling() {
-		if (this.samplingTimer) {
-			clearInterval(this.samplingTimer);
-			this.samplingTimer = null;
-		}
-		if (this.macMemTimer) {
-			clearInterval(this.macMemTimer);
-			this.macMemTimer = null;
+	/**
+	* Append ONE sample — every process row of it — in ONE transaction.
+	*
+	* Never a write per row. `insertMany` exists for exactly this: at the 10 s
+	* default the fleet produces 7.6 rows/s, and 7.6 separate commits per second
+	* on the connection that also serves every cluster-wide configuration read
+	* is a constant load nobody asked for.
+	*/
+	async append(nodeId, atMs, processes) {
+		if (processes.length === 0) return 0;
+		if (!await this.declare()) return 0;
+		const records = processes.map((p) => ({ data: { ...processToRow(nodeId, atMs, p) } }));
+		try {
+			const { inserted } = await this.store.insertMany.mutate({
+				collection: LOAD_SERIES_COLLECTION,
+				records
+			});
+			return inserted;
+		} catch (err) {
+			this.logger.warn("load series sample not retained — this interval will be missing", { meta: {
+				nodeId,
+				atMs,
+				rows: processes.length,
+				error: errMsg(err)
+			} });
+			return 0;
 		}
 	}
-	async collectSnapshot() {
-		const cpu = this.sampleCpu();
-		const memory = this.getMemoryInfo();
-		const processInfo = getProcessResources();
-		const [gpu, network, disk, cpuTemp] = await Promise.all([
-			getGpuInfoInternal().catch(() => null),
-			takeNetworkIoSnapshot(),
-			takeDiskIoSnapshot(),
-			getCpuTemperatureInternal().catch(() => null)
-		]);
-		const snapshot = {
-			cpu,
-			memory,
-			gpu,
-			network,
-			disk,
-			pressure: {
-				cpu: getPressure("cpu"),
-				memory: getPressure("memory"),
-				io: getPressure("io")
-			},
-			process: processInfo,
-			cpuTemperature: cpuTemp,
-			timestampMs: Date.now()
-		};
-		this.cachedSnapshot = snapshot;
-		return snapshot;
-	}
-	async getCached() {
-		return this.cachedSnapshot;
+	/**
+	* Read one node's cold samples, oldest-first.
+	*
+	* `sinceMs` is EXCLUSIVE, matching the ring, so a caller passing the newest
+	* timestamp it holds gets only what it is missing. `limitRows` bounds the
+	* read in ROWS (not samples) because rows are what the query costs.
+	*/
+	async read(nodeId, sinceMs, limitRows) {
+		if (!await this.declare()) return [];
+		try {
+			const records = await this.store.query.query({
+				collection: LOAD_SERIES_COLLECTION,
+				filter: {
+					where: { nodeId },
+					whereBetween: { atMs: [sinceMs + 1, Number.MAX_SAFE_INTEGER] },
+					orderBy: {
+						field: "atMs",
+						direction: "asc"
+					},
+					limit: limitRows
+				}
+			});
+			const rows = [];
+			for (const record of records) {
+				const row = recordToRow(record.data);
+				if (row !== null) rows.push(row);
+			}
+			return rowsToSamples(rows);
+		} catch (err) {
+			this.logger.warn("load series cold read failed — answering from the hot window only", { meta: {
+				nodeId,
+				sinceMs,
+				error: errMsg(err)
+			} });
+			return [];
+		}
 	}
-	async getCurrent() {
-		const s = this.cachedSnapshot ?? await this.collectSnapshot();
-		const mb = (bytes) => Math.round(bytes / 1024 / 1024);
+	/**
+	* Enforce BOTH bounds, oldest-first, through a bounded page each.
+	*
+	* Rate-limited to {@link pruneIntervalMs}: a bound is not a deadline, and the
+	* append path must not pay a sweep on every sample.
+	*/
+	async prune(nodeIds, retention, force = false) {
+		const now = this.nowFn();
+		if (!force && now - this.lastPruneAtMs < this.pruneIntervalMs) return null;
+		this.lastPruneAtMs = now;
+		if (!await this.declare()) return null;
+		let deletedByAge = 0;
+		let deletedByCap = 0;
+		let rowsExamined = 0;
+		const ageCutoff = now - retention.retentionHours * 36e5;
+		for (const nodeId of nodeIds) {
+			const outcome = await this.pruneNodeToCutoff(nodeId, ageCutoff);
+			deletedByAge += outcome.deleted;
+			rowsExamined += outcome.examined;
+		}
+		const total = await this.count();
+		const excess = total === null ? 0 : total - retention.maxRows;
+		if (excess > 0) {
+			const outcome = await this.pruneOldestRows(nodeIds, excess);
+			deletedByCap = outcome.deleted;
+			rowsExamined += outcome.examined;
+			this.logger.warn("load series ROW CAP bit — evicting the oldest samples", { meta: {
+				collection: LOAD_SERIES_COLLECTION,
+				rows: total,
+				cap: retention.maxRows,
+				over: excess,
+				deleted: outcome.deleted,
+				retentionHours: retention.retentionHours,
+				hint: "lower the retention or the sampling cadence — the cap is the guarantee, not the intention"
+			} });
+		}
 		return {
-			cpuPercent: s.cpu.total,
-			memoryPercent: s.memory.percent,
-			memoryUsedMB: mb(s.memory.usedBytes),
-			memoryTotalMB: mb(s.memory.totalBytes),
-			temperature: s.cpuTemperature ?? void 0,
-			gpuPercent: s.gpu?.utilization,
-			gpuMemoryPercent: s.gpu && s.gpu.memoryTotalBytes > 0 ? Math.round(s.gpu.memoryUsedBytes / s.gpu.memoryTotalBytes * 1e3) / 10 : void 0
+			deletedByAge,
+			deletedByCap,
+			rowsExamined,
+			capBit: excess > 0
 		};
 	}
-	async getDiskSpace(input) {
-		return getDiskSpaceInternal(input.dirPath);
-	}
-	async getGpuInfo() {
-		return getGpuInfoInternal();
-	}
-	async getCpuTemperature() {
-		return getCpuTemperatureInternal();
-	}
-	async getProcessStats(input) {
-		const { getPidStats } = await import("../../resource-monitor-BWmQ5i-o.mjs").then((n) => n.r);
-		const raw = await getPidStats(input.pids);
-		const result = [];
-		for (const [pid, s] of raw) result.push({
-			pid,
-			cpu: s.cpu,
-			memory: s.memory,
-			privateBytes: s.privateBytes,
-			sharedBytes: s.sharedBytes
-		});
-		return result;
+	/** Total rows, or `null` when the store could not answer. */
+	async count() {
+		if (!await this.declare()) return null;
+		try {
+			return await this.store.count.query({ collection: LOAD_SERIES_COLLECTION });
+		} catch (err) {
+			this.logger.warn("load series count failed — the row cap is not enforced this pass", { meta: { error: errMsg(err) } });
+			return null;
+		}
 	}
-	sampleCpu() {
-		const curr = aggregateCpuTimes();
-		const prev = this.prevCpu;
-		this.prevCpu = curr;
-		const dUser = curr.user - prev.user;
-		const dNice = curr.nice - prev.nice;
-		const dSys = curr.sys - prev.sys;
-		const dIrq = curr.irq - prev.irq;
-		const dIdle = curr.idle - prev.idle;
-		const dTotal = dUser + dNice + dSys + dIrq + dIdle;
-		const pct = (v) => dTotal === 0 ? 0 : Math.round(v / dTotal * 1e3) / 10;
-		return {
-			total: pct(dUser + dNice + dSys + dIrq),
-			user: pct(dUser),
-			system: pct(dSys),
-			irq: pct(dIrq),
-			nice: pct(dNice),
-			loadAvg: os.loadavg(),
-			cores: os.cpus().length
-		};
+	/**
+	* Delete this node's rows older than `cutoff`, at most one page's worth.
+	*
+	* The page is the whole point. `deleteWhere({ atMs: [0, cutoff] })` on its
+	* own is one statement but an UNBOUNDED one — a first pass after a retention
+	* change would delete millions of rows inside a single stalling transaction.
+	* So the page is read first (keys only, ordered by the index), its last
+	* `atMs` becomes the EFFECTIVE cutoff, and the delete is bounded by it.
+	*/
+	async pruneNodeToCutoff(nodeId, cutoff) {
+		try {
+			const page = await this.store.query.query({
+				collection: LOAD_SERIES_COLLECTION,
+				filter: {
+					where: { nodeId },
+					whereBetween: { atMs: [0, cutoff] },
+					orderBy: {
+						field: "atMs",
+						direction: "asc"
+					},
+					limit: this.prunePageRows
+				},
+				columns: ["atMs"]
+			});
+			if (page.length === 0) return {
+				deleted: 0,
+				examined: 0
+			};
+			const effectiveCutoff = Number(page.at(-1)?.data["atMs"]);
+			if (!Number.isFinite(effectiveCutoff)) return {
+				deleted: 0,
+				examined: page.length
+			};
+			const { deleted } = await this.store.deleteWhere.mutate({
+				collection: LOAD_SERIES_COLLECTION,
+				filter: {
+					where: { nodeId },
+					whereBetween: { atMs: [0, effectiveCutoff] }
+				}
+			});
+			return {
+				deleted,
+				examined: page.length
+			};
+		} catch (err) {
+			this.logger.warn("load series age prune failed — the table keeps growing this pass", { meta: {
+				nodeId,
+				cutoff,
+				error: errMsg(err)
+			} });
+			return {
+				deleted: 0,
+				examined: 0
+			};
+		}
 	}
-	/** Cached macOS memory (set by sampleMacMemory timer). */
-	_cachedMacMem = null;
-	getMemoryInfo() {
-		const total = os.totalmem();
-		if (total === 0) return {
-			percent: 0,
-			totalBytes: 0,
-			usedBytes: 0,
-			availableBytes: 0,
-			swapUsedBytes: 0,
-			swapTotalBytes: 0
-		};
-		if (IS_DARWIN && this._cachedMacMem !== null) return this._cachedMacMem;
-		const free = os.freemem();
-		const used = total - free;
-		let swapUsedBytes = 0;
-		let swapTotalBytes = 0;
-		if (IS_LINUX) try {
-			const meminfo = fs.readFileSync("/proc/meminfo", "utf-8");
-			const swapTotal = parseInt(meminfo.match(/SwapTotal:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
-			const swapFree = parseInt(meminfo.match(/SwapFree:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
-			swapTotalBytes = swapTotal;
-			swapUsedBytes = swapTotal - swapFree;
-		} catch {}
+	/**
+	* Drop the oldest rows across the known nodes until `excess` is covered.
+	*
+	* Same bounded-page technique, walked per node so the one index serves it.
+	* The node holding the oldest rows pays first, which is also the node
+	* producing the pressure when a runaway process count is the cause.
+	*/
+	async pruneOldestRows(nodeIds, excess) {
+		let remaining = Math.min(excess, this.prunePageRows);
+		let deleted = 0;
+		let examined = 0;
+		for (const nodeId of nodeIds) {
+			if (remaining <= 0) break;
+			try {
+				const page = await this.store.query.query({
+					collection: LOAD_SERIES_COLLECTION,
+					filter: {
+						where: { nodeId },
+						orderBy: {
+							field: "atMs",
+							direction: "asc"
+						},
+						limit: remaining
+					},
+					columns: ["atMs"]
+				});
+				examined += page.length;
+				if (page.length === 0) continue;
+				const cutoff = Number(page.at(-1)?.data["atMs"]);
+				if (!Number.isFinite(cutoff)) continue;
+				const result = await this.store.deleteWhere.mutate({
+					collection: LOAD_SERIES_COLLECTION,
+					filter: {
+						where: { nodeId },
+						whereBetween: { atMs: [0, cutoff] }
+					}
+				});
+				deleted += result.deleted;
+				remaining -= result.deleted;
+			} catch (err) {
+				this.logger.warn("load series cap prune failed — the cap is not enforced this pass", { meta: {
+					nodeId,
+					error: errMsg(err)
+				} });
+			}
+		}
 		return {
-			percent: Math.round((total - free) / total * 1e3) / 10,
-			totalBytes: total,
-			usedBytes: used,
-			availableBytes: free,
-			swapUsedBytes,
-			swapTotalBytes
+			deleted,
+			examined
 		};
 	}
 };
-function aggregateCpuTimes() {
-	const cpus = os.cpus();
-	let user = 0, nice = 0, sys = 0, irq = 0, idle = 0;
-	for (const cpu of cpus) {
-		user += cpu.times.user;
-		nice += cpu.times.nice;
-		sys += cpu.times.sys;
-		irq += cpu.times.irq;
-		idle += cpu.times.idle;
-	}
-	return {
-		user,
-		nice,
-		sys,
-		irq,
-		idle
-	};
-}
-function sampleMacMemory(provider) {
-	try {
-		const output = execFileSync("vm_stat", {
-			timeout: 2e3,
-			encoding: "utf-8"
-		});
-		const pageSize = 16384;
-		const parse = (label) => {
-			const match = output.match(new RegExp(`${label}:\\s+(\\d+)`));
-			return match ? parseInt(match[1], 10) * pageSize : 0;
-		};
-		const free = parse("Pages free");
-		const inactive = parse("Pages inactive");
-		const purgeable = parse("Pages purgeable");
-		const speculative = parse("Pages speculative");
-		const available = free + inactive + purgeable + speculative;
-		const total = os.totalmem();
-		const used = total - available;
-		let swapUsedBytes = 0;
-		let swapTotalBytes = 0;
-		try {
-			const swapOut = execFileSync("sysctl", ["-n", "vm.swapusage"], {
-				timeout: 2e3,
-				encoding: "utf-8"
-			});
-			const totalMatch = swapOut.match(/total\s*=\s*([\d.]+)M/);
-			const usedMatch = swapOut.match(/used\s*=\s*([\d.]+)M/);
-			if (totalMatch) swapTotalBytes = parseFloat(totalMatch[1]) * 1024 * 1024;
-			if (usedMatch) swapUsedBytes = parseFloat(usedMatch[1]) * 1024 * 1024;
-		} catch {}
-		provider._cachedMacMem = {
-			percent: Math.round(used / total * 1e3) / 10,
-			totalBytes: total,
-			usedBytes: used,
-			availableBytes: available,
-			swapUsedBytes,
-			swapTotalBytes
-		};
-	} catch {
-		provider._cachedMacMem = null;
-	}
-}
-function getDiskSpaceInternal(dirPath) {
-	return new Promise((resolve, reject) => {
-		fs.statfs(dirPath, (err, stats) => {
-			if (err) return reject(err);
-			const totalBytes = stats.blocks * stats.bsize;
-			const availableBytes = stats.bavail * stats.bsize;
-			const usedBytes = totalBytes - stats.bfree * stats.bsize;
-			resolve({
-				path: dirPath,
-				totalBytes,
-				usedBytes,
-				availableBytes,
-				percent: totalBytes > 0 ? Math.round(usedBytes / totalBytes * 1e3) / 10 : 0
-			});
-		});
-	});
-}
-async function takeDiskIoSnapshot() {
-	const now = Date.now();
-	if (IS_LINUX) try {
-		const data = fs.readFileSync("/proc/diskstats", "utf-8");
-		let readOps = 0, readBytes = 0, writeOps = 0, writeBytes = 0;
-		for (const line of data.split("\n")) {
-			const parts = line.trim().split(/\s+/);
-			if (parts.length < 14) continue;
-			const devName = parts[2];
-			if (/\d+$/.test(devName) && !/^nvme\d+n\d+$/.test(devName)) continue;
-			readOps += parseInt(parts[3], 10) || 0;
-			readBytes += (parseInt(parts[5], 10) || 0) * 512;
-			writeOps += parseInt(parts[7], 10) || 0;
-			writeBytes += (parseInt(parts[9], 10) || 0) * 512;
-		}
-		return {
-			readBytes,
-			writeBytes,
-			readOps,
-			writeOps,
-			timestampMs: now
-		};
-	} catch {}
-	return {
-		readBytes: 0,
-		writeBytes: 0,
-		readOps: 0,
-		writeOps: 0,
-		timestampMs: now
+/** Structural validation on read. A malformed row is skipped, never charted. */
+function recordToRow(data) {
+	const nodeId = data["nodeId"];
+	const classification = data["classification"];
+	if (typeof nodeId !== "string" || typeof classification !== "string") return null;
+	const atMs = Number(data["atMs"]);
+	const pid = Number(data["pid"]);
+	const cpuDeci = Number(data["cpuDeci"]);
+	const rssMib = Number(data["rssMib"]);
+	if (![
+		atMs,
+		pid,
+		cpuDeci,
+		rssMib
+	].every((n) => Number.isFinite(n))) return null;
+	const rawAddon = data["addonId"];
+	const optional = (raw) => {
+		if (raw === null || raw === void 0) return null;
+		const n = Number(raw);
+		return Number.isFinite(n) ? n : null;
 	};
-}
-async function takeNetworkIoSnapshot() {
-	const now = Date.now();
-	if (IS_LINUX) try {
-		const data = fs.readFileSync("/proc/net/dev", "utf-8");
-		let rxBytes = 0, txBytes = 0, rxPackets = 0, txPackets = 0, rxErrors = 0, txErrors = 0;
-		for (const line of data.split("\n")) {
-			const match = line.match(/^\s*(\w+):\s+(.+)$/);
-			if (!match) continue;
-			if (match[1] === "lo") continue;
-			const cols = match[2].trim().split(/\s+/);
-			rxBytes += parseInt(cols[0], 10) || 0;
-			rxPackets += parseInt(cols[1], 10) || 0;
-			rxErrors += parseInt(cols[2], 10) || 0;
-			txBytes += parseInt(cols[8], 10) || 0;
-			txPackets += parseInt(cols[9], 10) || 0;
-			txErrors += parseInt(cols[10], 10) || 0;
-		}
-		return {
-			rxBytes,
-			txBytes,
-			rxPackets,
-			txPackets,
-			rxErrors,
-			txErrors,
-			timestampMs: now
-		};
-	} catch {}
-	if (IS_DARWIN) try {
-		const stdout = await execAsync("netstat", ["-ib"]);
-		let rxBytes = 0, txBytes = 0, rxPackets = 0, txPackets = 0, rxErrors = 0, txErrors = 0;
-		for (const line of stdout.split("\n")) {
-			const parts = line.trim().split(/\s+/);
-			if (parts.length < 11) continue;
-			if (parts[0] === "lo0" || parts[0] === "Name") continue;
-			if (!parts[2]?.startsWith("Link#")) continue;
-			rxPackets += parseInt(parts[4], 10) || 0;
-			rxErrors += parseInt(parts[5], 10) || 0;
-			rxBytes += parseInt(parts[6], 10) || 0;
-			txPackets += parseInt(parts[7], 10) || 0;
-			txErrors += parseInt(parts[8], 10) || 0;
-			txBytes += parseInt(parts[9], 10) || 0;
-		}
-		return {
-			rxBytes,
-			txBytes,
-			rxPackets,
-			txPackets,
-			rxErrors,
-			txErrors,
-			timestampMs: now
-		};
-	} catch {}
 	return {
-		rxBytes: 0,
-		txBytes: 0,
-		rxPackets: 0,
-		txPackets: 0,
-		rxErrors: 0,
-		txErrors: 0,
-		timestampMs: now
+		nodeId,
+		atMs,
+		pid,
+		addonId: typeof rawAddon === "string" ? rawAddon : null,
+		classification,
+		cpuDeci,
+		rssMib,
+		cpuMainDeci: optional(data["cpuMainDeci"]),
+		cpuGcDeci: optional(data["cpuGcDeci"])
 	};
 }
-async function getCpuTemperatureInternal() {
-	if (IS_LINUX) for (const p of ["/sys/class/thermal/thermal_zone0/temp", "/sys/class/hwmon/hwmon0/temp1_input"]) try {
-		const raw = fs.readFileSync(p, "utf-8").trim();
-		const millideg = parseInt(raw, 10);
-		if (!isNaN(millideg)) return Math.round(millideg / 100) / 10;
-	} catch {
-		continue;
-	}
-	if (IS_DARWIN) try {
-		const match = (await execAsync("sudo", [
-			"-n",
-			"powermetrics",
-			"--samplers",
-			"smc",
-			"-i",
-			"1",
-			"-n",
-			"1"
-		], 3e3)).match(/CPU die temperature:\s+([\d.]+)\s*C/);
-		if (match) return Math.round(parseFloat(match[1]) * 10) / 10;
-	} catch {}
-	return null;
-}
-async function getGpuInfoInternal() {
-	if (IS_DARWIN) try {
-		const utilMatch = (await execAsync("ioreg", [
-			"-r",
-			"-d",
-			"1",
-			"-c",
-			"IOAccelerator"
-		])).match(/"GPU Core Utilization"\s*=\s*(\d+)/);
-		const util = utilMatch ? parseInt(utilMatch[1], 10) : 0;
-		const utilPct = util > 1e3 ? Math.round(util / 1e7) : util;
-		return {
-			utilization: Math.min(100, utilPct),
-			model: "Apple Silicon GPU",
-			memoryUsedBytes: 0,
-			memoryTotalBytes: 0,
-			temperature: null
-		};
-	} catch {}
-	if (IS_LINUX) try {
-		const parts = (await execAsync("nvidia-smi", ["--query-gpu=utilization.gpu,name,memory.used,memory.total,temperature.gpu", "--format=csv,noheader,nounits"])).trim().split(",").map((s) => s.trim());
-		if (parts.length >= 5) return {
-			utilization: parseInt(parts[0], 10) || 0,
-			model: parts[1] ?? "Unknown GPU",
-			memoryUsedBytes: (parseInt(parts[2], 10) || 0) * 1024 * 1024,
-			memoryTotalBytes: (parseInt(parts[3], 10) || 0) * 1024 * 1024,
-			temperature: parseInt(parts[4], 10) || null
-		};
-	} catch {}
-	return null;
-}
-function getProcessResources() {
-	let openFds = 0;
-	let threadCount = 0;
-	if (IS_LINUX) {
-		try {
-			openFds = fs.readdirSync(`/proc/${process.pid}/fd`).length;
-		} catch {}
-		try {
-			const match = fs.readFileSync(`/proc/${process.pid}/status`, "utf-8").match(/Threads:\s+(\d+)/);
-			if (match) threadCount = parseInt(match[1], 10);
-		} catch {}
+//#endregion
+//#region src/builtins/native-metrics/load-series-config.ts
+/**
+* The two knobs of the durable load series, and the arithmetic that makes them
+* honest.
+*
+* ## Where they live, and why there
+*
+* In `native-metrics`'s OWN global settings document — the one that already
+* exists and already carries `samplingIntervalMs`. Fields on a document, never
+* a method per knob: `system.getLoggingSettings` / `setLoggingSettings` set
+* that precedent and it holds here.
+*
+* They are NOT in the logging document, and that is a decision rather than an
+* omission. That document is about levels and diagnostic windows; a metrics
+* cadence and a table's retention are neither. Two documents that both claim a
+* knob is how this repo has already shipped a switch nobody read.
+*
+* They are cluster-wide, not per-node. Every node emits on the same cadence or
+* the fleet's series cannot be laid over each other, and the table is single
+* and hub-resident, so a per-node retention would be a promise nothing could
+* keep.
+*
+* ## Refused, not clamped
+*
+* A cadence outside 5-60 s is REFUSED. Clamping would silently store 10 when
+* the operator typed 2 and then report 10 back as though it had been accepted
+* — the failure mode where a knob and its readback agree on a value nobody
+* chose. The schema advertises the bounds; this refuses anything else.
+*/
+/** Why a value was refused — the message an operator is shown verbatim. */
+var LoadSeriesConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "LoadSeriesConfigError";
+	}
+};
+function requireInteger(value, field) {
+	const n = typeof value === "number" ? value : Number(value);
+	if (!Number.isFinite(n)) throw new LoadSeriesConfigError(`${field} must be a number, received ${String(value)}`);
+	return Math.round(n);
+}
+/**
+* Resolve the configuration, REFUSING anything out of range.
+*
+* An ABSENT field takes its default — that is not a refusal, it is a document
+* that has never been written. A PRESENT field outside its bounds throws.
+*/
+function resolveLoadSeriesConfig(raw) {
+	let cadenceSec = 10;
+	if (raw.loadSeriesCadenceSec !== void 0 && raw.loadSeriesCadenceSec !== null) {
+		cadenceSec = requireInteger(raw.loadSeriesCadenceSec, "loadSeriesCadenceSec");
+		if (cadenceSec < 5 || cadenceSec > 60) throw new LoadSeriesConfigError(`load series cadence must be between 5 and 60 seconds — refused ${cadenceSec}`);
+	}
+	let retentionHours = 6;
+	if (raw.loadSeriesRetentionHours !== void 0 && raw.loadSeriesRetentionHours !== null) {
+		retentionHours = requireInteger(raw.loadSeriesRetentionHours, "loadSeriesRetentionHours");
+		if (retentionHours < 1 || retentionHours > 72) throw new LoadSeriesConfigError(`load series retention must be between 1 and 72 hours — refused ${retentionHours}`);
 	}
-	const nodeProcess = process;
 	return {
-		openFds,
-		threadCount,
-		activeHandles: (nodeProcess._getActiveHandles?.() ?? []).length,
-		activeRequests: (nodeProcess._getActiveRequests?.() ?? []).length
+		cadenceSec,
+		retentionHours,
+		maxRows: DEFAULT_MAX_ROWS
 	};
 }
-function getPressure(resource) {
-	if (!IS_LINUX) return null;
-	try {
-		const data = fs.readFileSync(`/proc/pressure/${resource}`, "utf-8");
-		const parseLine = (prefix) => {
-			const match = data.match(new RegExp(`${prefix} avg10=(\\d+\\.\\d+) avg60=(\\d+\\.\\d+) avg300=(\\d+\\.\\d+)`));
-			if (!match) return null;
-			return {
-				avg10: parseFloat(match[1]),
-				avg60: parseFloat(match[2]),
-				avg300: parseFloat(match[3])
-			};
-		};
-		const some = parseLine("some");
-		if (!some) return null;
-		return {
-			some,
-			full: parseLine("full")
-		};
-	} catch {
-		return null;
-	}
+/**
+* Project the cost of a configuration from the numbers the cluster is actually
+* reporting — nodes and processes OBSERVED, never a constant.
+*
+* This is what makes the knob honest: an operator raising retention to three
+* days sees the row count and the megabytes BEFORE applying it, rather than
+* discovering them afterwards. `MEASURED_BYTES_PER_ROW` is measured, not
+* guessed — see `load-series-store.ts`.
+*/
+function projectLoadSeriesCost(input) {
+	const samplesPerNodeWindow = input.config.retentionHours * 3600 / input.config.cadenceSec;
+	const intendedRows = Math.round(samplesPerNodeWindow * Math.max(input.observedProcessRows, 0));
+	const boundedRows = Math.min(intendedRows, input.config.maxRows);
+	return {
+		intendedRows,
+		boundedRows,
+		estimatedBytes: boundedRows * 87,
+		capBites: intendedRows > input.config.maxRows
+	};
 }
-function execAsync(cmd, args, timeoutMs = 5e3) {
-	return new Promise((resolve, reject) => {
-		execFile(cmd, args, { timeout: timeoutMs }, (err, stdout) => {
-			if (err) return reject(err);
-			resolve(stdout);
-		});
-	});
+/** Human-readable one-liner for the settings form. */
+function describeLoadSeriesCost(projection) {
+	const mib = (projection.estimatedBytes / 1048576).toFixed(1);
+	const rows = projection.intendedRows.toLocaleString("en-US");
+	const capped = projection.boundedRows.toLocaleString("en-US");
+	if (!projection.capBites) return `This configuration retains ~${rows} rows ≈ ${mib} MiB on the hub database (NVMe cache), measured at 87 bytes per row.`;
+	return `This configuration WANTS ~${rows} rows, above the ${projection.boundedRows.toLocaleString("en-US")}-row hard cap. The table will hold ~${capped} rows ≈ ${mib} MiB and the OLDEST samples will be evicted, so the effective window is shorter than the retention you asked for.`;
 }
 //#endregion
-//#region src/builtins/native-metrics/load-series-store.ts
-/**
-* @durable class=audit owner=metrics-native
-*   write="one row per process per sample, appended in ONE transaction per
-*     sample (`settingsStore.insertMany`) by the HUB's `native-metrics`, off its
-*     subscription to `metrics.node-processes-snapshot`. Emission is
-*     fixed-cadence, so the write rate is deterministic: nodes x processes /
-*     cadence, 7.6 rows/s on the live fleet at the 10 s default. Only a sample
-*     the in-memory ring ACCEPTED is written, which is what makes the append
-*     idempotent without a unique key."
-*   retention="TWO bounds, swept together at most once a minute. By AGE, the
-*     operator's `loadSeriesRetentionHours` (default 6, the intention); by ROWS,
-*     DEFAULT_MAX_ROWS (the guarantee, which bites regardless of the age knob).
-*     Both prune oldest-first through a bounded page — never a full scan — and
-*     the row cap logs when it bites. Losing the table loses the cold window
-*     only: the ring keeps serving the last hour and the charts keep drawing."
-*/
-var LOAD_SERIES_COLLECTION = "metrics:node-load-samples";
+//#region src/builtins/native-metrics/load-series-reader.ts
 /**
-* Hard ceiling on the table, in ROWS.
+* The ONE reader over both retention tiers.
 *
-* The guarantee behind the retention knob. Sized against the shipped default
-* and against the worst configuration the knob can express:
+* The hot window is the in-memory ring; the cold one is
+* `metrics:node-load-samples`. A caller never learns which tier a point came
+* from, and that is a hard requirement rather than a nicety: a second reader
+* is how two charts start disagreeing about the same node, and it is how "the
+* ring says X, the table says Y" becomes a question nobody can answer.
 *
-* | cadence | retention | rows (3 nodes, 76 processes) |
-* | --- | --- | --- |
-* | 10 s | 6 h (default) | 164 160 |
-* | 5 s | 6 h | 328 320 |
-* | 5 s | 72 h | 3 939 840 — capped here |
+* Three things happen here, in this order, and each one is load-bearing:
 *
-* 500 000 rows x the measured 87 B = **41.5 MiB**, roughly 3x what the shipped
-* default needs and far below the 2 M rows a three-day retention would reach.
-* It is deliberately NOT a knob: the point of a guarantee is that it is not
-* subject to the same hand that raised the intention. This is the discipline
-* the in-memory ring already adopted (`DEFAULT_MAX_TOTAL_PROCESS_ROWS`) and
-* the one the RTP pre-roll rings still lack — a maximum per instance and no
-* budget at all for the whole, which reached 898 MB across 47 rings
-* (`docs/architecture/load-ledger.md` #5).
+* 1. **Merge and dedupe on `atMs`.** The two tiers OVERLAP by construction —
+*    the ring holds the last 180 snapshots and the table holds every snapshot
+*    the ring accepted, including those same 180. A snapshot present in both
+*    must contribute exactly once. Identity is `atMs`, because one node emits
+*    one snapshot per tick and a timestamp already held IS that snapshot. The
+*    HOT copy wins on a tie: it is the payload as it arrived, while the cold
+*    one has been through the storage encode.
+* 2. **Fold per function.** The chart draws one series per addon, so the fold
+*    happens here rather than in the browser.
+* 3. **Reduce, preserving the extremes.** See `load-series-fold.ts` for why
+*    the representative of a bucket is its MAX and never its mean.
+*
+* A GAP stays a gap through all three. Emission is fixed-cadence, so a missing
+* interval means one thing — nobody reported — and nothing here fills it in.
 */
-var DEFAULT_MAX_ROWS = 5e5;
-var LOAD_SERIES_COLUMNS = [
-	(
-	/** `INTEGER PRIMARY KEY` = SQLite rowid alias: the key IS the row's address,
-	*  so it costs no separate index and no stored string. */
-	{
-		name: "id",
-		type: "INTEGER",
-		primaryKey: true,
-		notNull: true
-	}),
-	{
-		name: "nodeId",
-		type: "TEXT",
-		notNull: true
-	},
-	(
-	/** The EMITTING node's timestamp for the sample this row belongs to. Every
-	*  row of one sample shares it — that is what makes a sample reassemblable. */
-	{
-		name: "atMs",
-		type: "INTEGER",
-		notNull: true
-	}),
-	{
-		name: "pid",
-		type: "INTEGER",
-		notNull: true
-	},
-	(
-	/** `NULL` for a process no addon owns — `root` and `system` both. */
-	{
-		name: "addonId",
-		type: "TEXT"
-	}),
-	{
-		name: "classification",
-		type: "TEXT",
-		notNull: true
-	},
-	(
-	/** `ps pcpu` x 10. A LIFETIME average, not a rate — see `NodeProcess`. */
-	{
-		name: "cpuDeci",
-		type: "INTEGER",
-		notNull: true
-	}),
-	{
-		name: "rssMib",
-		type: "INTEGER",
-		notNull: true
-	},
-	(
-	/** Instantaneous main-thread CPU% x 10. `NULL` = UNKNOWN, never zero. */
-	{
-		name: "cpuMainDeci",
-		type: "INTEGER"
-	}),
-	(
-	/** Instantaneous V8-helper-pool CPU% x 10. `NULL` = UNKNOWN, never zero. */
-	{
-		name: "cpuGcDeci",
-		type: "INTEGER"
-	})
-];
-var LOAD_SERIES_INDEXES = [(
 /**
-* The ONE index, and it serves both jobs.
+* Merge the two tiers into one deduped, oldest-first list of samples.
 *
-* Reads are always "this node, newer than T" — `nodeId` leads so the
-* equality is a range scan and `atMs` supplies the order without a sort.
-* Prunes are always "this node, oldest first" — the same index, walked from
-* the other end. A second index on `atMs` alone was measured and rejected:
-* it cost 23 B/row (196.0 → 172.8 with the two column drops) to serve a
-* cross-node prune that a per-node loop over three nodes already serves.
+* Exported because the dedup is the property worth testing on its own: a
+* doubled point is invisible in a total and obvious only as a chart that reads
+* twice as loud as the machine.
 */
-{
-	name: "idx_load_samples_node_at",
-	columns: ["nodeId", "atMs"]
-})];
-var BYTES_PER_MIB = 1048576;
-/** Tenths → percent. `null` stays `null`: unknown is not zero. */
-function fromDeci(value) {
-	return value === null ? null : Math.round(value) / 10;
+function mergeSamples(cold, hot) {
+	const byAt = /* @__PURE__ */ new Map();
+	for (const sample of cold) byAt.set(sample.atMs, sample);
+	for (const sample of hot) byAt.set(sample.atMs, sample);
+	return [...byAt.values()].toSorted((a, b) => a.atMs - b.atMs);
 }
-/** Percent → tenths, lossless because both producers already round to tenths. */
-function toDeci(value) {
-	return value === null ? null : Math.round(value * 10);
+/** `RetainedProcess` is already the fold's row shape — named, not re-derived. */
+function toFoldRows(processes) {
+	return processes;
 }
-/** Storage row → the shape a reader gets. The ONE decode. */
-function rowToProcess(row) {
-	return {
-		pid: row.pid,
-		addonId: row.addonId,
-		classification: row.classification,
-		cpuPercent: fromDeci(row.cpuDeci) ?? 0,
-		memoryRssBytes: row.rssMib * BYTES_PER_MIB,
-		cpuMainPercent: fromDeci(row.cpuMainDeci),
-		cpuGcPercent: fromDeci(row.cpuGcDeci)
+/**
+* Merge, fold and reduce. The whole read path in one pure function, so every
+* property that matters — dedup, peak survival, an empty bucket staying empty
+* — is testable without a database or a ring.
+*/
+function mergeLoadSeries(input) {
+	const samples = mergeSamples(input.cold, input.hot);
+	if (samples.length === 0) return {
+		series: [],
+		bucketMs: input.cadenceMs,
+		retainedSamples: 0,
+		oldestAtMs: null
+	};
+	const byKey = /* @__PURE__ */ new Map();
+	for (const sample of samples) for (const bucket of foldSnapshotByFunction(toFoldRows(sample.processes), sample.atMs)) {
+		const held = byKey.get(bucket.key);
+		if (held === void 0) byKey.set(bucket.key, {
+			kind: bucket.kind,
+			points: [bucket.point]
+		});
+		else held.points.push(bucket.point);
+	}
+	const oldestAtMs = samples[0]?.atMs ?? null;
+	const newestAtMs = samples.at(-1)?.atMs ?? oldestAtMs;
+	const spanMs = oldestAtMs === null || newestAtMs === null ? 0 : newestAtMs - oldestAtMs + input.cadenceMs;
+	const bucketMs = input.maxPoints === void 0 ? input.cadenceMs : resolveBucketMs(spanMs, input.cadenceMs, input.maxPoints);
+	const origin = oldestAtMs ?? 0;
+	const series = [...byKey.entries()].map(([key, held]) => ({
+		key,
+		kind: held.kind,
+		points: bucketMs > input.cadenceMs ? reducePoints(held.points, bucketMs, origin) : held.points
+	}));
+	const weight = (s) => {
+		const last = s.points.at(-1);
+		if (last === void 0) return -1;
+		if (last.cpuMainPercent !== null && last.cpuGcPercent !== null) return last.cpuMainPercent + last.cpuGcPercent;
+		return last.cpuLifetimePercent;
 	};
-}
-/** The shape a reader gets → the storage row. The ONE encode. */
-function processToRow(nodeId, atMs, process) {
 	return {
-		nodeId,
-		atMs,
-		pid: process.pid,
-		addonId: process.addonId,
-		classification: process.classification,
-		cpuDeci: toDeci(process.cpuPercent) ?? 0,
-		rssMib: Math.round(process.memoryRssBytes / BYTES_PER_MIB),
-		cpuMainDeci: toDeci(process.cpuMainPercent),
-		cpuGcDeci: toDeci(process.cpuGcPercent)
+		series: series.toSorted((a, b) => {
+			const d = weight(b) - weight(a);
+			return d !== 0 ? d : a.key.localeCompare(b.key);
+		}),
+		bucketMs,
+		retainedSamples: samples.length,
+		oldestAtMs
 	};
 }
-/** Group flat rows into samples, oldest-first. A sample is one `atMs`. */
-function rowsToSamples(rows) {
-	const byAt = /* @__PURE__ */ new Map();
-	for (const row of rows) {
-		const held = byAt.get(row.atMs);
-		if (held === void 0) byAt.set(row.atMs, [rowToProcess(row)]);
-		else held.push(rowToProcess(row));
+//#endregion
+//#region src/builtins/native-metrics/gpu-probe.ts
+/**
+* The Linux GPU probe, forking only when there is something to fork.
+*
+* `nvidia-smi` was spawned on every sample — twelve times a minute from
+* hub-main — on a host with an Intel i915 and no NVIDIA driver. Each spawn
+* was a synchronous `fork()` of the largest process on the host (D441: p50
+* 91 ms at 5.8 GB RSS), and each one failed at `exec` and yielded `null`.
+* Twelve forks a minute bought nothing (D452).
+*
+* Whether the binary exists is a question `access(2)` answers on the libuv
+* pool without a fork. It is asked on EVERY call rather than latched: a handful
+* of `stat`s every five seconds costs nothing, and a latch is a second fact
+* about the host that can go stale — the same shape as the caches D224
+* forbids.
+*/
+var nodeAccessCheck = (path) => access(path, constants.X_OK);
+/**
+* The first `PATH` entry under which `binary` is executable, or `null`.
+* An empty or missing `PATH` asks nothing.
+*/
+async function findOnPath(binary, pathEnv, check = nodeAccessCheck) {
+	const dirs = (pathEnv ?? "").split(":").filter((dir) => dir.length > 0);
+	for (const dir of dirs) {
+		const candidate = `${dir}/${binary}`;
+		try {
+			await check(candidate);
+			return candidate;
+		} catch {}
 	}
-	return [...byAt.entries()].toSorted((a, b) => a[0] - b[0]).map(([atMs, processes]) => ({
-		atMs,
-		processes
-	}));
+	return null;
 }
+var NVIDIA_SMI_ARGS = ["--query-gpu=utilization.gpu,name,memory.used,memory.total,temperature.gpu", "--format=csv,noheader,nounits"];
 /**
-* The cold tier. Append-only, bounded, and never the authority on anything the
-* hot ring can answer.
-*
-* Every method is best-effort and says so in the log rather than throwing at
-* the emitter: a storage hiccup must cost a gap in a chart, never a dropped
-* snapshot on the bus.
+* `nvidia-smi`'s one-line CSV as a `MetricsGpuInfo`, or `null` when the
+* binary is absent, fails, or prints something else. Never throws.
 */
-var LoadSeriesStore = class {
-	declared = false;
-	lastPruneAtMs = 0;
-	store;
-	logger;
-	nowFn;
-	prunePageRows;
-	pruneIntervalMs;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-		this.nowFn = deps.now ?? (() => Date.now());
-		this.prunePageRows = deps.prunePageRows ?? 2e4;
-		this.pruneIntervalMs = deps.pruneIntervalMs ?? 6e4;
+async function readNvidiaGpu(deps) {
+	const binary = await deps.findOnPath("nvidia-smi");
+	if (binary === null) return null;
+	let stdout;
+	try {
+		stdout = await deps.exec(binary, NVIDIA_SMI_ARGS);
+	} catch {
+		return null;
+	}
+	const parts = stdout.trim().split(",").map((s) => s.trim());
+	if (parts.length < 5) return null;
+	return {
+		utilization: parseInt(parts[0], 10) || 0,
+		model: parts[1] ?? "Unknown GPU",
+		memoryUsedBytes: (parseInt(parts[2], 10) || 0) * 1024 * 1024,
+		memoryTotalBytes: (parseInt(parts[3], 10) || 0) * 1024 * 1024,
+		temperature: parseInt(parts[4], 10) || null
+	};
+}
+//#endregion
+//#region src/builtins/native-metrics/native-metrics-provider.ts
+var IS_DARWIN = os.platform() === "darwin";
+var IS_LINUX = os.platform() === "linux";
+var NativeMetricsProvider = class {
+	id = "native";
+	cachedSnapshot = null;
+	samplingTimer = null;
+	macMemTimer = null;
+	prevCpu;
+	diagnostics = null;
+	consecutiveSampleErrors = 0;
+	constructor() {
+		this.prevCpu = aggregateCpuTimes();
+	}
+	/**
+	* Optional diagnostics sink for sampling errors. The first failure and
+	* every Nth failure thereafter are reported so a permanently-broken
+	* collector doesn't spam logs but is still observable.
+	*/
+	setDiagnostics(diag) {
+		this.diagnostics = diag;
+	}
+	startSampling(intervalMs) {
+		if (IS_DARWIN) {
+			sampleMacMemory(this);
+			this.macMemTimer = setInterval(() => sampleMacMemory(this), 5e3);
+			if (this.macMemTimer.unref) this.macMemTimer.unref();
+		}
+		this.collectSnapshot().then((s) => {
+			this.cachedSnapshot = s;
+			this.consecutiveSampleErrors = 0;
+		}).catch((err) => this.reportSampleError(err));
+		this.samplingTimer = setInterval(() => {
+			this.collectSnapshot().then((s) => {
+				this.cachedSnapshot = s;
+				this.consecutiveSampleErrors = 0;
+			}).catch((err) => this.reportSampleError(err));
+		}, intervalMs);
+		if (this.samplingTimer.unref) this.samplingTimer.unref();
+	}
+	reportSampleError(err) {
+		this.consecutiveSampleErrors++;
+		if (!this.diagnostics) return;
+		if (!(this.consecutiveSampleErrors === 1 || this.consecutiveSampleErrors % 60 === 0)) return;
+		this.diagnostics.warn("metrics-provider sample failed", {
+			consecutiveErrors: this.consecutiveSampleErrors,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+	stopSampling() {
+		if (this.samplingTimer) {
+			clearInterval(this.samplingTimer);
+			this.samplingTimer = null;
+		}
+		if (this.macMemTimer) {
+			clearInterval(this.macMemTimer);
+			this.macMemTimer = null;
+		}
+	}
+	async collectSnapshot() {
+		const cpu = this.sampleCpu();
+		const memory = this.getMemoryInfo();
+		const processInfo = getProcessResources();
+		const [gpu, network, disk, cpuTemp] = await Promise.all([
+			getGpuInfoInternal().catch(() => null),
+			takeNetworkIoSnapshot(),
+			takeDiskIoSnapshot(),
+			getCpuTemperatureInternal().catch(() => null)
+		]);
+		const snapshot = {
+			cpu,
+			memory,
+			gpu,
+			network,
+			disk,
+			pressure: {
+				cpu: getPressure("cpu"),
+				memory: getPressure("memory"),
+				io: getPressure("io")
+			},
+			process: processInfo,
+			cpuTemperature: cpuTemp,
+			timestampMs: Date.now()
+		};
+		this.cachedSnapshot = snapshot;
+		return snapshot;
+	}
+	async getCached() {
+		return this.cachedSnapshot;
+	}
+	async getCurrent() {
+		const s = this.cachedSnapshot ?? await this.collectSnapshot();
+		const mb = (bytes) => Math.round(bytes / 1024 / 1024);
+		return {
+			cpuPercent: s.cpu.total,
+			memoryPercent: s.memory.percent,
+			memoryUsedMB: mb(s.memory.usedBytes),
+			memoryTotalMB: mb(s.memory.totalBytes),
+			temperature: s.cpuTemperature ?? void 0,
+			gpuPercent: s.gpu?.utilization,
+			gpuMemoryPercent: s.gpu && s.gpu.memoryTotalBytes > 0 ? Math.round(s.gpu.memoryUsedBytes / s.gpu.memoryTotalBytes * 1e3) / 10 : void 0
+		};
+	}
+	async getDiskSpace(input) {
+		return getDiskSpaceInternal(input.dirPath);
+	}
+	async getGpuInfo() {
+		return getGpuInfoInternal();
+	}
+	async getCpuTemperature() {
+		return getCpuTemperatureInternal();
+	}
+	async getProcessStats(input) {
+		const { getPidStats } = await import("../../resource-monitor-Vp0bPV3U.mjs").then((n) => n.r);
+		const raw = await getPidStats(input.pids);
+		const result = [];
+		for (const [pid, s] of raw) result.push({
+			pid,
+			cpu: s.cpu,
+			memory: s.memory,
+			privateBytes: s.privateBytes,
+			sharedBytes: s.sharedBytes
+		});
+		return result;
+	}
+	sampleCpu() {
+		const curr = aggregateCpuTimes();
+		const prev = this.prevCpu;
+		this.prevCpu = curr;
+		const dUser = curr.user - prev.user;
+		const dNice = curr.nice - prev.nice;
+		const dSys = curr.sys - prev.sys;
+		const dIrq = curr.irq - prev.irq;
+		const dIdle = curr.idle - prev.idle;
+		const dTotal = dUser + dNice + dSys + dIrq + dIdle;
+		const pct = (v) => dTotal === 0 ? 0 : Math.round(v / dTotal * 1e3) / 10;
+		return {
+			total: pct(dUser + dNice + dSys + dIrq),
+			user: pct(dUser),
+			system: pct(dSys),
+			irq: pct(dIrq),
+			nice: pct(dNice),
+			loadAvg: os.loadavg(),
+			cores: os.cpus().length
+		};
+	}
+	/** Cached macOS memory (set by sampleMacMemory timer). */
+	_cachedMacMem = null;
+	getMemoryInfo() {
+		const total = os.totalmem();
+		if (total === 0) return {
+			percent: 0,
+			totalBytes: 0,
+			usedBytes: 0,
+			availableBytes: 0,
+			swapUsedBytes: 0,
+			swapTotalBytes: 0
+		};
+		if (IS_DARWIN && this._cachedMacMem !== null) return this._cachedMacMem;
+		const free = os.freemem();
+		const used = total - free;
+		let swapUsedBytes = 0;
+		let swapTotalBytes = 0;
+		if (IS_LINUX) try {
+			const meminfo = fs.readFileSync("/proc/meminfo", "utf-8");
+			const swapTotal = parseInt(meminfo.match(/SwapTotal:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
+			const swapFree = parseInt(meminfo.match(/SwapFree:\s+(\d+)/)?.[1] ?? "0", 10) * 1024;
+			swapTotalBytes = swapTotal;
+			swapUsedBytes = swapTotal - swapFree;
+		} catch {}
+		return {
+			percent: Math.round((total - free) / total * 1e3) / 10,
+			totalBytes: total,
+			usedBytes: used,
+			availableBytes: free,
+			swapUsedBytes,
+			swapTotalBytes
+		};
 	}
-	/** Idempotently declare the collection. `false` when the store refused. */
-	async declare() {
-		if (this.declared) return true;
-		try {
-			await this.store.declareCollection.mutate({
-				collection: LOAD_SERIES_COLLECTION,
-				columns: [...LOAD_SERIES_COLUMNS],
-				indexes: LOAD_SERIES_INDEXES.map((i) => ({
-					name: i.name,
-					columns: [...i.columns]
-				}))
-			});
-			this.declared = true;
-			return true;
-		} catch (err) {
-			this.logger.warn("load series declareCollection failed — nothing will be retained on disk", { meta: {
-				collection: LOAD_SERIES_COLLECTION,
-				error: errMsg(err)
-			} });
-			return false;
-		}
+};
+function aggregateCpuTimes() {
+	const cpus = os.cpus();
+	let user = 0, nice = 0, sys = 0, irq = 0, idle = 0;
+	for (const cpu of cpus) {
+		user += cpu.times.user;
+		nice += cpu.times.nice;
+		sys += cpu.times.sys;
+		irq += cpu.times.irq;
+		idle += cpu.times.idle;
 	}
-	/**
-	* Append ONE sample — every process row of it — in ONE transaction.
-	*
-	* Never a write per row. `insertMany` exists for exactly this: at the 10 s
-	* default the fleet produces 7.6 rows/s, and 7.6 separate commits per second
-	* on the connection that also serves every cluster-wide configuration read
-	* is a constant load nobody asked for.
-	*/
-	async append(nodeId, atMs, processes) {
-		if (processes.length === 0) return 0;
-		if (!await this.declare()) return 0;
-		const records = processes.map((p) => ({ data: { ...processToRow(nodeId, atMs, p) } }));
+	return {
+		user,
+		nice,
+		sys,
+		irq,
+		idle
+	};
+}
+function sampleMacMemory(provider) {
+	try {
+		const output = execFileSync("vm_stat", {
+			timeout: 2e3,
+			encoding: "utf-8"
+		});
+		const pageSize = 16384;
+		const parse = (label) => {
+			const match = output.match(new RegExp(`${label}:\\s+(\\d+)`));
+			return match ? parseInt(match[1], 10) * pageSize : 0;
+		};
+		const free = parse("Pages free");
+		const inactive = parse("Pages inactive");
+		const purgeable = parse("Pages purgeable");
+		const speculative = parse("Pages speculative");
+		const available = free + inactive + purgeable + speculative;
+		const total = os.totalmem();
+		const used = total - available;
+		let swapUsedBytes = 0;
+		let swapTotalBytes = 0;
 		try {
-			const { inserted } = await this.store.insertMany.mutate({
-				collection: LOAD_SERIES_COLLECTION,
-				records
+			const swapOut = execFileSync("sysctl", ["-n", "vm.swapusage"], {
+				timeout: 2e3,
+				encoding: "utf-8"
 			});
-			return inserted;
-		} catch (err) {
-			this.logger.warn("load series sample not retained — this interval will be missing", { meta: {
-				nodeId,
-				atMs,
-				rows: processes.length,
-				error: errMsg(err)
-			} });
-			return 0;
-		}
+			const totalMatch = swapOut.match(/total\s*=\s*([\d.]+)M/);
+			const usedMatch = swapOut.match(/used\s*=\s*([\d.]+)M/);
+			if (totalMatch) swapTotalBytes = parseFloat(totalMatch[1]) * 1024 * 1024;
+			if (usedMatch) swapUsedBytes = parseFloat(usedMatch[1]) * 1024 * 1024;
+		} catch {}
+		provider._cachedMacMem = {
+			percent: Math.round(used / total * 1e3) / 10,
+			totalBytes: total,
+			usedBytes: used,
+			availableBytes: available,
+			swapUsedBytes,
+			swapTotalBytes
+		};
+	} catch {
+		provider._cachedMacMem = null;
 	}
-	/**
-	* Read one node's cold samples, oldest-first.
-	*
-	* `sinceMs` is EXCLUSIVE, matching the ring, so a caller passing the newest
-	* timestamp it holds gets only what it is missing. `limitRows` bounds the
-	* read in ROWS (not samples) because rows are what the query costs.
-	*/
-	async read(nodeId, sinceMs, limitRows) {
-		if (!await this.declare()) return [];
-		try {
-			const records = await this.store.query.query({
-				collection: LOAD_SERIES_COLLECTION,
-				filter: {
-					where: { nodeId },
-					whereBetween: { atMs: [sinceMs + 1, Number.MAX_SAFE_INTEGER] },
-					orderBy: {
-						field: "atMs",
-						direction: "asc"
-					},
-					limit: limitRows
-				}
+}
+function getDiskSpaceInternal(dirPath) {
+	return new Promise((resolve, reject) => {
+		fs.statfs(dirPath, (err, stats) => {
+			if (err) return reject(err);
+			const totalBytes = stats.blocks * stats.bsize;
+			const availableBytes = stats.bavail * stats.bsize;
+			const usedBytes = totalBytes - stats.bfree * stats.bsize;
+			resolve({
+				path: dirPath,
+				totalBytes,
+				usedBytes,
+				availableBytes,
+				percent: totalBytes > 0 ? Math.round(usedBytes / totalBytes * 1e3) / 10 : 0
 			});
-			const rows = [];
-			for (const record of records) {
-				const row = recordToRow(record.data);
-				if (row !== null) rows.push(row);
-			}
-			return rowsToSamples(rows);
-		} catch (err) {
-			this.logger.warn("load series cold read failed — answering from the hot window only", { meta: {
-				nodeId,
-				sinceMs,
-				error: errMsg(err)
-			} });
-			return [];
+		});
+	});
+}
+async function takeDiskIoSnapshot() {
+	const now = Date.now();
+	if (IS_LINUX) try {
+		const data = fs.readFileSync("/proc/diskstats", "utf-8");
+		let readOps = 0, readBytes = 0, writeOps = 0, writeBytes = 0;
+		for (const line of data.split("\n")) {
+			const parts = line.trim().split(/\s+/);
+			if (parts.length < 14) continue;
+			const devName = parts[2];
+			if (/\d+$/.test(devName) && !/^nvme\d+n\d+$/.test(devName)) continue;
+			readOps += parseInt(parts[3], 10) || 0;
+			readBytes += (parseInt(parts[5], 10) || 0) * 512;
+			writeOps += parseInt(parts[7], 10) || 0;
+			writeBytes += (parseInt(parts[9], 10) || 0) * 512;
 		}
-	}
-	/**
-	* Enforce BOTH bounds, oldest-first, through a bounded page each.
-	*
-	* Rate-limited to {@link pruneIntervalMs}: a bound is not a deadline, and the
-	* append path must not pay a sweep on every sample.
-	*/
-	async prune(nodeIds, retention, force = false) {
-		const now = this.nowFn();
-		if (!force && now - this.lastPruneAtMs < this.pruneIntervalMs) return null;
-		this.lastPruneAtMs = now;
-		if (!await this.declare()) return null;
-		let deletedByAge = 0;
-		let deletedByCap = 0;
-		let rowsExamined = 0;
-		const ageCutoff = now - retention.retentionHours * 36e5;
-		for (const nodeId of nodeIds) {
-			const outcome = await this.pruneNodeToCutoff(nodeId, ageCutoff);
-			deletedByAge += outcome.deleted;
-			rowsExamined += outcome.examined;
+		return {
+			readBytes,
+			writeBytes,
+			readOps,
+			writeOps,
+			timestampMs: now
+		};
+	} catch {}
+	return {
+		readBytes: 0,
+		writeBytes: 0,
+		readOps: 0,
+		writeOps: 0,
+		timestampMs: now
+	};
+}
+async function takeNetworkIoSnapshot() {
+	const now = Date.now();
+	if (IS_LINUX) try {
+		const data = fs.readFileSync("/proc/net/dev", "utf-8");
+		let rxBytes = 0, txBytes = 0, rxPackets = 0, txPackets = 0, rxErrors = 0, txErrors = 0;
+		for (const line of data.split("\n")) {
+			const match = line.match(/^\s*(\w+):\s+(.+)$/);
+			if (!match) continue;
+			if (match[1] === "lo") continue;
+			const cols = match[2].trim().split(/\s+/);
+			rxBytes += parseInt(cols[0], 10) || 0;
+			rxPackets += parseInt(cols[1], 10) || 0;
+			rxErrors += parseInt(cols[2], 10) || 0;
+			txBytes += parseInt(cols[8], 10) || 0;
+			txPackets += parseInt(cols[9], 10) || 0;
+			txErrors += parseInt(cols[10], 10) || 0;
 		}
-		const total = await this.count();
-		const excess = total === null ? 0 : total - retention.maxRows;
-		if (excess > 0) {
-			const outcome = await this.pruneOldestRows(nodeIds, excess);
-			deletedByCap = outcome.deleted;
-			rowsExamined += outcome.examined;
-			this.logger.warn("load series ROW CAP bit — evicting the oldest samples", { meta: {
-				collection: LOAD_SERIES_COLLECTION,
-				rows: total,
-				cap: retention.maxRows,
-				over: excess,
-				deleted: outcome.deleted,
-				retentionHours: retention.retentionHours,
-				hint: "lower the retention or the sampling cadence — the cap is the guarantee, not the intention"
-			} });
+		return {
+			rxBytes,
+			txBytes,
+			rxPackets,
+			txPackets,
+			rxErrors,
+			txErrors,
+			timestampMs: now
+		};
+	} catch {}
+	if (IS_DARWIN) try {
+		const stdout = await execAsync("netstat", ["-ib"]);
+		let rxBytes = 0, txBytes = 0, rxPackets = 0, txPackets = 0, rxErrors = 0, txErrors = 0;
+		for (const line of stdout.split("\n")) {
+			const parts = line.trim().split(/\s+/);
+			if (parts.length < 11) continue;
+			if (parts[0] === "lo0" || parts[0] === "Name") continue;
+			if (!parts[2]?.startsWith("Link#")) continue;
+			rxPackets += parseInt(parts[4], 10) || 0;
+			rxErrors += parseInt(parts[5], 10) || 0;
+			rxBytes += parseInt(parts[6], 10) || 0;
+			txPackets += parseInt(parts[7], 10) || 0;
+			txErrors += parseInt(parts[8], 10) || 0;
+			txBytes += parseInt(parts[9], 10) || 0;
 		}
 		return {
-			deletedByAge,
-			deletedByCap,
-			rowsExamined,
-			capBit: excess > 0
+			rxBytes,
+			txBytes,
+			rxPackets,
+			txPackets,
+			rxErrors,
+			txErrors,
+			timestampMs: now
 		};
+	} catch {}
+	return {
+		rxBytes: 0,
+		txBytes: 0,
+		rxPackets: 0,
+		txPackets: 0,
+		rxErrors: 0,
+		txErrors: 0,
+		timestampMs: now
+	};
+}
+async function getCpuTemperatureInternal() {
+	if (IS_LINUX) for (const p of ["/sys/class/thermal/thermal_zone0/temp", "/sys/class/hwmon/hwmon0/temp1_input"]) try {
+		const raw = fs.readFileSync(p, "utf-8").trim();
+		const millideg = parseInt(raw, 10);
+		if (!isNaN(millideg)) return Math.round(millideg / 100) / 10;
+	} catch {
+		continue;
 	}
-	/** Total rows, or `null` when the store could not answer. */
-	async count() {
-		if (!await this.declare()) return null;
+	if (IS_DARWIN) try {
+		const match = (await execAsync("sudo", [
+			"-n",
+			"powermetrics",
+			"--samplers",
+			"smc",
+			"-i",
+			"1",
+			"-n",
+			"1"
+		], 3e3)).match(/CPU die temperature:\s+([\d.]+)\s*C/);
+		if (match) return Math.round(parseFloat(match[1]) * 10) / 10;
+	} catch {}
+	return null;
+}
+async function getGpuInfoInternal() {
+	if (IS_DARWIN) try {
+		const utilMatch = (await execAsync("ioreg", [
+			"-r",
+			"-d",
+			"1",
+			"-c",
+			"IOAccelerator"
+		])).match(/"GPU Core Utilization"\s*=\s*(\d+)/);
+		const util = utilMatch ? parseInt(utilMatch[1], 10) : 0;
+		const utilPct = util > 1e3 ? Math.round(util / 1e7) : util;
+		return {
+			utilization: Math.min(100, utilPct),
+			model: "Apple Silicon GPU",
+			memoryUsedBytes: 0,
+			memoryTotalBytes: 0,
+			temperature: null
+		};
+	} catch {}
+	if (IS_LINUX) return readNvidiaGpu({
+		findOnPath: (binary) => findOnPath(binary, process.env["PATH"]),
+		exec: (command, args) => execAsync(command, [...args])
+	});
+	return null;
+}
+function getProcessResources() {
+	let openFds = 0;
+	let threadCount = 0;
+	if (IS_LINUX) {
 		try {
-			return await this.store.count.query({ collection: LOAD_SERIES_COLLECTION });
-		} catch (err) {
-			this.logger.warn("load series count failed — the row cap is not enforced this pass", { meta: { error: errMsg(err) } });
-			return null;
-		}
-	}
-	/**
-	* Delete this node's rows older than `cutoff`, at most one page's worth.
-	*
-	* The page is the whole point. `deleteWhere({ atMs: [0, cutoff] })` on its
-	* own is one statement but an UNBOUNDED one — a first pass after a retention
-	* change would delete millions of rows inside a single stalling transaction.
-	* So the page is read first (keys only, ordered by the index), its last
-	* `atMs` becomes the EFFECTIVE cutoff, and the delete is bounded by it.
-	*/
-	async pruneNodeToCutoff(nodeId, cutoff) {
+			openFds = fs.readdirSync(`/proc/${process.pid}/fd`).length;
+		} catch {}
 		try {
-			const page = await this.store.query.query({
-				collection: LOAD_SERIES_COLLECTION,
-				filter: {
-					where: { nodeId },
-					whereBetween: { atMs: [0, cutoff] },
-					orderBy: {
-						field: "atMs",
-						direction: "asc"
-					},
-					limit: this.prunePageRows
-				},
-				columns: ["atMs"]
-			});
-			if (page.length === 0) return {
-				deleted: 0,
-				examined: 0
-			};
-			const effectiveCutoff = Number(page.at(-1)?.data["atMs"]);
-			if (!Number.isFinite(effectiveCutoff)) return {
-				deleted: 0,
-				examined: page.length
-			};
-			const { deleted } = await this.store.deleteWhere.mutate({
-				collection: LOAD_SERIES_COLLECTION,
-				filter: {
-					where: { nodeId },
-					whereBetween: { atMs: [0, effectiveCutoff] }
-				}
-			});
-			return {
-				deleted,
-				examined: page.length
-			};
-		} catch (err) {
-			this.logger.warn("load series age prune failed — the table keeps growing this pass", { meta: {
-				nodeId,
-				cutoff,
-				error: errMsg(err)
-			} });
+			const match = fs.readFileSync(`/proc/${process.pid}/status`, "utf-8").match(/Threads:\s+(\d+)/);
+			if (match) threadCount = parseInt(match[1], 10);
+		} catch {}
+	}
+	const nodeProcess = process;
+	return {
+		openFds,
+		threadCount,
+		activeHandles: (nodeProcess._getActiveHandles?.() ?? []).length,
+		activeRequests: (nodeProcess._getActiveRequests?.() ?? []).length
+	};
+}
+function getPressure(resource) {
+	if (!IS_LINUX) return null;
+	try {
+		const data = fs.readFileSync(`/proc/pressure/${resource}`, "utf-8");
+		const parseLine = (prefix) => {
+			const match = data.match(new RegExp(`${prefix} avg10=(\\d+\\.\\d+) avg60=(\\d+\\.\\d+) avg300=(\\d+\\.\\d+)`));
+			if (!match) return null;
 			return {
-				deleted: 0,
-				examined: 0
+				avg10: parseFloat(match[1]),
+				avg60: parseFloat(match[2]),
+				avg300: parseFloat(match[3])
 			};
-		}
-	}
-	/**
-	* Drop the oldest rows across the known nodes until `excess` is covered.
-	*
-	* Same bounded-page technique, walked per node so the one index serves it.
-	* The node holding the oldest rows pays first, which is also the node
-	* producing the pressure when a runaway process count is the cause.
-	*/
-	async pruneOldestRows(nodeIds, excess) {
-		let remaining = Math.min(excess, this.prunePageRows);
-		let deleted = 0;
-		let examined = 0;
-		for (const nodeId of nodeIds) {
-			if (remaining <= 0) break;
-			try {
-				const page = await this.store.query.query({
-					collection: LOAD_SERIES_COLLECTION,
-					filter: {
-						where: { nodeId },
-						orderBy: {
-							field: "atMs",
-							direction: "asc"
-						},
-						limit: remaining
-					},
-					columns: ["atMs"]
-				});
-				examined += page.length;
-				if (page.length === 0) continue;
-				const cutoff = Number(page.at(-1)?.data["atMs"]);
-				if (!Number.isFinite(cutoff)) continue;
-				const result = await this.store.deleteWhere.mutate({
-					collection: LOAD_SERIES_COLLECTION,
-					filter: {
-						where: { nodeId },
-						whereBetween: { atMs: [0, cutoff] }
-					}
-				});
-				deleted += result.deleted;
-				remaining -= result.deleted;
-			} catch (err) {
-				this.logger.warn("load series cap prune failed — the cap is not enforced this pass", { meta: {
-					nodeId,
-					error: errMsg(err)
-				} });
-			}
-		}
+		};
+		const some = parseLine("some");
+		if (!some) return null;
 		return {
-			deleted,
-			examined
+			some,
+			full: parseLine("full")
 		};
+	} catch {
+		return null;
 	}
-};
-/** Structural validation on read. A malformed row is skipped, never charted. */
-function recordToRow(data) {
-	const nodeId = data["nodeId"];
-	const classification = data["classification"];
-	if (typeof nodeId !== "string" || typeof classification !== "string") return null;
-	const atMs = Number(data["atMs"]);
-	const pid = Number(data["pid"]);
-	const cpuDeci = Number(data["cpuDeci"]);
-	const rssMib = Number(data["rssMib"]);
+}
+function execAsync(cmd, args, timeoutMs = 5e3) {
+	return new Promise((resolve, reject) => {
+		execFile(cmd, args, { timeout: timeoutMs }, (err, stdout) => {
+			if (err) return reject(err);
+			resolve(stdout);
+		});
+	});
+}
+/**
+* Parse one `/proc/<pid>/stat` line. `null` for a line that does not parse —
+* a process that exited between the readdir and the read leaves a truncated
+* or empty file, and that is normal, not an error.
+*/
+function parseProcStat(line) {
+	const close = line.lastIndexOf(")");
+	const open = line.indexOf("(");
+	if (close < 0 || open < 0 || close < open) return null;
+	const pid = Number(line.slice(0, open).trim());
+	const comm = line.slice(open + 1, close);
+	const rest = line.slice(close + 1).trim().split(/\s+/);
+	const state = rest[0];
+	const ppid = Number(rest[1]);
+	const pgid = Number(rest[2]);
+	const utime = Number(rest[11]);
+	const stime = Number(rest[12]);
+	const startTicks = Number(rest[19]);
+	const rssPages = Number(rest[21]);
+	if (state === void 0 || state === "") return null;
 	if (![
-		atMs,
 		pid,
-		cpuDeci,
-		rssMib
-	].every((n) => Number.isFinite(n))) return null;
-	const rawAddon = data["addonId"];
-	const optional = (raw) => {
-		if (raw === null || raw === void 0) return null;
-		const n = Number(raw);
-		return Number.isFinite(n) ? n : null;
-	};
+		ppid,
+		pgid,
+		utime,
+		stime,
+		startTicks,
+		rssPages
+	].every(Number.isFinite)) return null;
 	return {
-		nodeId,
-		atMs,
 		pid,
-		addonId: typeof rawAddon === "string" ? rawAddon : null,
-		classification,
-		cpuDeci,
-		rssMib,
-		cpuMainDeci: optional(data["cpuMainDeci"]),
-		cpuGcDeci: optional(data["cpuGcDeci"])
+		comm,
+		state,
+		ppid,
+		pgid,
+		ticks: utime + stime,
+		startTicks,
+		rssPages
 	};
 }
-//#endregion
-//#region src/builtins/native-metrics/load-series-config.ts
+function statusKb(status, key) {
+	const match = status.match(new RegExp(`^${key}:\\s+(\\d+)`, "m"));
+	return match ? parseInt(match[1], 10) * 1024 : void 0;
+}
+/** Read `VmRSS` / `RssAnon` / `RssFile` (kB in the file) out of `/proc/<pid>/status`. */
+function parseProcStatusRss(status) {
+	return {
+		rssBytes: statusKb(status, "VmRSS"),
+		privateBytes: statusKb(status, "RssAnon"),
+		sharedBytes: statusKb(status, "RssFile")
+	};
+}
+/** Seconds the process has been alive — `ps etime`, whole seconds. */
+function elapsedSecSince(input) {
+	return Math.max(0, Math.floor(input.uptimeSec - input.startTicks / 100));
+}
 /**
-* The two knobs of the durable load series, and the arithmetic that makes them
-* honest.
+* `ps pcpu`: CPU time over elapsed time, as a percentage with one decimal.
 *
-* ## Where they live, and why there
-*
-* In `native-metrics`'s OWN global settings document — the one that already
-* exists and already carries `samplingIntervalMs`. Fields on a document, never
-* a method per knob: `system.getLoggingSettings` / `setLoggingSettings` set
-* that precedent and it holds here.
-*
-* They are NOT in the logging document, and that is a decision rather than an
-* omission. That document is about levels and diagnostic windows; a metrics
-* cadence and a table's retention are neither. Two documents that both claim a
-* knob is how this repo has already shipped a switch nobody read.
-*
-* They are cluster-wide, not per-node. Every node emits on the same cadence or
-* the fleet's series cannot be laid over each other, and the table is single
-* and hub-resident, so a per-node retention would be a promise nothing could
-* keep.
-*
-* ## Refused, not clamped
-*
-* A cadence outside 5-60 s is REFUSED. Clamping would silently store 10 when
-* the operator typed 2 and then report 10 back as though it had been accepted
-* — the failure mode where a knob and its readback agree on a value nobody
-* chose. The schema advertises the bounds; this refuses anything else.
+* This is deliberately the LIFETIME average `ps` prints, not an instantaneous
+* rate: the columns fed from it have always shown that quantity, and the
+* instantaneous split is a different number with a different owner
+* (`cpuMainPercent` / `cpuGcPercent` from `thread-cpu-sampler.ts`). A process
+* with no elapsed window yet reports 0, never a division by zero.
 */
-/** Why a value was refused — the message an operator is shown verbatim. */
-var LoadSeriesConfigError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "LoadSeriesConfigError";
+function lifetimeCpuPercent(input) {
+	const elapsedSec = input.uptimeSec - input.startTicks / 100;
+	if (!(elapsedSec > 0)) return 0;
+	const cpuSec = input.ticks / 100;
+	return Math.round(cpuSec / elapsedSec * 1e3) / 10;
+}
+var PID_RE = /^\d+$/;
+var nodeProcReader = {
+	listPids: async () => (await readdir("/proc")).filter((entry) => PID_RE.test(entry)).map((entry) => Number(entry)),
+	readStat: (pid) => readFile(`/proc/${pid}/stat`, "latin1"),
+	readStatus: (pid) => readFile(`/proc/${pid}/status`, "latin1"),
+	readCmdline: (pid) => readFile(`/proc/${pid}/cmdline`, "latin1"),
+	readUptimeSec: async () => {
+		const [first] = (await readFile("/proc/uptime", "latin1")).trim().split(/\s+/);
+		const seconds = Number(first);
+		if (!Number.isFinite(seconds)) throw new Error(`/proc/uptime unreadable: ${String(first)}`);
+		return seconds;
 	}
 };
-function requireInteger(value, field) {
-	const n = typeof value === "number" ? value : Number(value);
-	if (!Number.isFinite(n)) throw new LoadSeriesConfigError(`${field} must be a number, received ${String(value)}`);
-	return Math.round(n);
+/** `ps command=`: argv joined by spaces, or `[comm]` when there is no argv. */
+function commandFromCmdline(cmdline, comm) {
+	const joined = cmdline.split("\0").filter((part) => part.length > 0).join(" ");
+	return joined.length > 0 ? joined : `[${comm}]`;
 }
+//#endregion
+//#region src/builtins/native-metrics/proc-process-table.ts
 /**
-* Resolve the configuration, REFUSING anything out of range.
-*
-* An ABSENT field takes its default — that is not a refusal, it is a document
-* that has never been written. A PRESENT field outside its bounds throws.
+* The node's process table — every row `ps -eo pid,ppid,pgid,pcpu,rss,etime,
+* command` printed — read from `/proc` on Linux, with no fork.
+*
+* Why the fork mattered, and the numbers, are in `process/proc-stat.ts`. What
+* this file adds is the WHOLE-TABLE read: one `readdir` of `/proc`, then per
+* pid `stat`, `status` and `cmdline`, all through `fs/promises` so the reads
+* land on the libuv pool and the main thread pays only the parse. Measured in
+* the hub container (70 processes, D452): 2–4 ms wall for the walk, against
+* 3–4 ms for `ps` itself — the fork that USED to precede it was the cost.
+*
+* A pid that vanishes between the listing and its reads is omitted whole.
+* Never a partial row: a row with a command and no memory would render as a
+* process using nothing, which is a different claim from "gone".
 */
-function resolveLoadSeriesConfig(raw) {
-	let cadenceSec = 10;
-	if (raw.loadSeriesCadenceSec !== void 0 && raw.loadSeriesCadenceSec !== null) {
-		cadenceSec = requireInteger(raw.loadSeriesCadenceSec, "loadSeriesCadenceSec");
-		if (cadenceSec < 5 || cadenceSec > 60) throw new LoadSeriesConfigError(`load series cadence must be between 5 and 60 seconds — refused ${cadenceSec}`);
-	}
-	let retentionHours = 6;
-	if (raw.loadSeriesRetentionHours !== void 0 && raw.loadSeriesRetentionHours !== null) {
-		retentionHours = requireInteger(raw.loadSeriesRetentionHours, "loadSeriesRetentionHours");
-		if (retentionHours < 1 || retentionHours > 72) throw new LoadSeriesConfigError(`load series retention must be between 1 and 72 hours — refused ${retentionHours}`);
+var execFileAsync = promisify(execFile);
+async function readProcRow(pid, uptimeSec, reader) {
+	let stat;
+	let cmdline;
+	let status;
+	try {
+		[stat, cmdline, status] = await Promise.all([
+			reader.readStat(pid),
+			reader.readCmdline(pid),
+			reader.readStatus(pid)
+		]);
+	} catch {
+		return null;
 	}
+	const parsed = parseProcStat(stat);
+	if (parsed === null) return null;
+	const rss = parseProcStatusRss(status);
 	return {
-		cadenceSec,
-		retentionHours,
-		maxRows: DEFAULT_MAX_ROWS
-	};
-}
-/**
-* Project the cost of a configuration from the numbers the cluster is actually
-* reporting — nodes and processes OBSERVED, never a constant.
-*
-* This is what makes the knob honest: an operator raising retention to three
-* days sees the row count and the megabytes BEFORE applying it, rather than
-* discovering them afterwards. `MEASURED_BYTES_PER_ROW` is measured, not
-* guessed — see `load-series-store.ts`.
-*/
-function projectLoadSeriesCost(input) {
-	const samplesPerNodeWindow = input.config.retentionHours * 3600 / input.config.cadenceSec;
-	const intendedRows = Math.round(samplesPerNodeWindow * Math.max(input.observedProcessRows, 0));
-	const boundedRows = Math.min(intendedRows, input.config.maxRows);
-	return {
-		intendedRows,
-		boundedRows,
-		estimatedBytes: boundedRows * 87,
-		capBites: intendedRows > input.config.maxRows
+		pid: parsed.pid,
+		ppid: parsed.ppid,
+		pgid: parsed.pgid,
+		cpuPercent: lifetimeCpuPercent({
+			ticks: parsed.ticks,
+			startTicks: parsed.startTicks,
+			uptimeSec
+		}),
+		memoryRssBytes: rss.rssBytes ?? 0,
+		uptimeSec: elapsedSecSince({
+			startTicks: parsed.startTicks,
+			uptimeSec
+		}),
+		command: commandFromCmdline(cmdline, parsed.comm)
 	};
 }
-/** Human-readable one-liner for the settings form. */
-function describeLoadSeriesCost(projection) {
-	const mib = (projection.estimatedBytes / 1048576).toFixed(1);
-	const rows = projection.intendedRows.toLocaleString("en-US");
-	const capped = projection.boundedRows.toLocaleString("en-US");
-	if (!projection.capBites) return `This configuration retains ~${rows} rows ≈ ${mib} MiB on the hub database (NVMe cache), measured at 87 bytes per row.`;
-	return `This configuration WANTS ~${rows} rows, above the ${projection.boundedRows.toLocaleString("en-US")}-row hard cap. The table will hold ~${capped} rows ≈ ${mib} MiB and the OLDEST samples will be evicted, so the effective window is shorter than the retention you asked for.`;
+/** Every process in `/proc`, as the rows `ps -eo …` would have printed. */
+async function readProcProcessTable(reader = nodeProcReader) {
+	const [pids, uptimeSec] = await Promise.all([reader.listPids(), reader.readUptimeSec()]);
+	return (await Promise.all(pids.map((pid) => readProcRow(pid, uptimeSec, reader)))).filter((row) => row !== null);
 }
-//#endregion
-//#region src/builtins/native-metrics/load-series-reader.ts
-/**
-* The ONE reader over both retention tiers.
-*
-* The hot window is the in-memory ring; the cold one is
-* `metrics:node-load-samples`. A caller never learns which tier a point came
-* from, and that is a hard requirement rather than a nicety: a second reader
-* is how two charts start disagreeing about the same node, and it is how "the
-* ring says X, the table says Y" becomes a question nobody can answer.
-*
-* Three things happen here, in this order, and each one is load-bearing:
-*
-* 1. **Merge and dedupe on `atMs`.** The two tiers OVERLAP by construction —
-*    the ring holds the last 180 snapshots and the table holds every snapshot
-*    the ring accepted, including those same 180. A snapshot present in both
-*    must contribute exactly once. Identity is `atMs`, because one node emits
-*    one snapshot per tick and a timestamp already held IS that snapshot. The
-*    HOT copy wins on a tie: it is the payload as it arrived, while the cold
-*    one has been through the storage encode.
-* 2. **Fold per function.** The chart draws one series per addon, so the fold
-*    happens here rather than in the browser.
-* 3. **Reduce, preserving the extremes.** See `load-series-fold.ts` for why
-*    the representative of a bucket is its MAX and never its mean.
-*
-* A GAP stays a gap through all three. Emission is fixed-cadence, so a missing
-* interval means one thing — nobody reported — and nothing here fills it in.
-*/
 /**
-* Merge the two tiers into one deduped, oldest-first list of samples.
-*
-* Exported because the dedup is the property worth testing on its own: a
-* doubled point is invisible in a total and obvious only as a chart that reads
-* twice as loud as the machine.
+* Parse `ps etime` → seconds. `MM:SS`, `HH:MM:SS`, `DD-HH:MM:SS`.
+* Only the `ps` path needs this; `/proc` gives the number directly.
 */
-function mergeSamples(cold, hot) {
-	const byAt = /* @__PURE__ */ new Map();
-	for (const sample of cold) byAt.set(sample.atMs, sample);
-	for (const sample of hot) byAt.set(sample.atMs, sample);
-	return [...byAt.values()].toSorted((a, b) => a.atMs - b.atMs);
+function parseEtime(etime) {
+	const dashParts = etime.split("-");
+	let days = 0;
+	let hms = etime;
+	if (dashParts.length === 2) {
+		days = parseInt(dashParts[0], 10) || 0;
+		hms = dashParts[1];
+	}
+	const parts = hms.split(":").map((p) => parseInt(p, 10) || 0);
+	let hours = 0;
+	let minutes = 0;
+	let seconds = 0;
+	if (parts.length === 3) [hours, minutes, seconds] = parts;
+	else if (parts.length === 2) [minutes, seconds] = parts;
+	else if (parts.length === 1) [seconds] = parts;
+	return days * 86400 + hours * 3600 + minutes * 60 + seconds;
 }
-/** `RetainedProcess` is already the fold's row shape — named, not re-derived. */
-function toFoldRows(processes) {
-	return processes;
+var PS_ROW_RE = /^(\d+)\s+(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)\s+(.+)$/;
+/** Parse the output of `ps -eo pid=,ppid=,pgid=,pcpu=,rss=,etime=,command=`. */
+function parsePsTable(stdout) {
+	const rows = [];
+	for (const line of stdout.split("\n")) {
+		const match = line.trim().match(PS_ROW_RE);
+		if (!match) continue;
+		const [, pidS, ppidS, pgidS, cpuS, rssS, etimeS, command] = match;
+		rows.push({
+			pid: parseInt(pidS, 10),
+			ppid: parseInt(ppidS, 10),
+			pgid: parseInt(pgidS, 10),
+			cpuPercent: Math.round(parseFloat(cpuS) * 10) / 10,
+			memoryRssBytes: parseInt(rssS, 10) * 1024,
+			uptimeSec: parseEtime(etimeS),
+			command
+		});
+	}
+	return rows;
+}
+/** The fork. Only reached on a platform without `/proc`. */
+async function spawnPsTable() {
+	const { stdout } = await execFileAsync("ps", ["-eo", "pid=,ppid=,pgid=,pcpu=,rss=,etime=,command="], {
+		timeout: 5e3,
+		maxBuffer: 8 * 1024 * 1024
+	});
+	return parsePsTable(stdout);
 }
+var defaultDeps = {
+	platform: platform(),
+	reader: nodeProcReader,
+	spawnPs: spawnPsTable
+};
 /**
-* Merge, fold and reduce. The whole read path in one pure function, so every
-* property that matters — dedup, peak survival, an empty bucket staying empty
-* — is testable without a database or a ring.
+* The process table, from `/proc` where it exists and from `ps` elsewhere.
+* Throws only when the chosen source cannot answer at all; the caller logs it
+* as a skipped interval.
 */
-function mergeLoadSeries(input) {
-	const samples = mergeSamples(input.cold, input.hot);
-	if (samples.length === 0) return {
-		series: [],
-		bucketMs: input.cadenceMs,
-		retainedSamples: 0,
-		oldestAtMs: null
-	};
-	const byKey = /* @__PURE__ */ new Map();
-	for (const sample of samples) for (const bucket of foldSnapshotByFunction(toFoldRows(sample.processes), sample.atMs)) {
-		const held = byKey.get(bucket.key);
-		if (held === void 0) byKey.set(bucket.key, {
-			kind: bucket.kind,
-			points: [bucket.point]
-		});
-		else held.points.push(bucket.point);
-	}
-	const oldestAtMs = samples[0]?.atMs ?? null;
-	const newestAtMs = samples.at(-1)?.atMs ?? oldestAtMs;
-	const spanMs = oldestAtMs === null || newestAtMs === null ? 0 : newestAtMs - oldestAtMs + input.cadenceMs;
-	const bucketMs = input.maxPoints === void 0 ? input.cadenceMs : resolveBucketMs(spanMs, input.cadenceMs, input.maxPoints);
-	const origin = oldestAtMs ?? 0;
-	const series = [...byKey.entries()].map(([key, held]) => ({
-		key,
-		kind: held.kind,
-		points: bucketMs > input.cadenceMs ? reducePoints(held.points, bucketMs, origin) : held.points
-	}));
-	const weight = (s) => {
-		const last = s.points.at(-1);
-		if (last === void 0) return -1;
-		if (last.cpuMainPercent !== null && last.cpuGcPercent !== null) return last.cpuMainPercent + last.cpuGcPercent;
-		return last.cpuLifetimePercent;
-	};
-	return {
-		series: series.toSorted((a, b) => {
-			const d = weight(b) - weight(a);
-			return d !== 0 ? d : a.key.localeCompare(b.key);
-		}),
-		bucketMs,
-		retainedSamples: samples.length,
-		oldestAtMs
-	};
+function readProcessTable(deps = defaultDeps) {
+	return deps.platform === "linux" ? readProcProcessTable(deps.reader) : deps.spawnPs();
 }
 //#endregion
 //#region src/builtins/native-metrics/process-classification.ts
@@ -2448,7 +2707,6 @@ var ThreadCpuTracker = class {
 };
 //#endregion
 //#region src/builtins/native-metrics/native-metrics.addon.ts
-var execFileAsync = promisify(execFile);
 /**
 * Cadence for the per-node metric snapshot bus events. ~5 s matches
 * the existing UI polling cadence (ProcessesTab, ProcessResources)
@@ -2457,25 +2715,13 @@ var execFileAsync = promisify(execFile);
 */
 var METRICS_SNAPSHOT_INTERVAL_MS = 5e3;
 /**
-* The process-tree snapshot is FIXED-CADENCE, and its cadence is the
-* operator's `loadSeriesCadenceSec` (5-60 s, 10 by default).
-*
-* It used to emit only ON A CHANGE, with a 60 s fallback heartbeat, and the
-* dedup is gone rather than tuned. A conditional emit makes a hole in the
-* series mean two different things — "nothing changed" and "nobody reported"
-* — and telling those apart is the entire reason an operator opens this chart
-* after a spike. Now a gap means exactly one thing.
-*
-* It is not free: the emit rate is deterministic, so the durable table's row
-* count is too (nodes x processes / cadence, no discount for a quiet fleet).
-* The measured cost of that is in `docs/architecture/load-ledger.md`, and it
-* is why the retention default is six hours rather than three days.
-*/
-/**
-* Force a metrics-snapshot emit at least every 60s even when the
+* Force a RESOURCES-snapshot emit at least every 60s even when the
 * coarsened payload looks unchanged. Without this an idle node
 * (steady CPU within ±5%, no process churn) goes silent on the
 * bus and the UI's "node alive" chip can stale out.
+*
+* The PROCESS-tree snapshot has no such heartbeat and no dedup: it is
+* fixed-cadence — see `startProcessSnapshotTimer`.
 */
 var METRICS_SNAPSHOT_HEARTBEAT_MS = 6e4;
 /**
@@ -2790,7 +3036,23 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 			} });
 		}
 	}
-	/** (Re)arm the fixed-cadence process-tree timer at the configured interval. */
+	/**
+	* (Re)arm the process-tree timer at the configured interval.
+	*
+	* The process-tree snapshot is FIXED-CADENCE, and its cadence is the
+	* operator's `loadSeriesCadenceSec` (5-60 s, 10 by default).
+	*
+	* It used to emit only ON A CHANGE, with a 60 s fallback heartbeat, and the
+	* dedup is gone rather than tuned. A conditional emit makes a hole in the
+	* series mean two different things — "nothing changed" and "nobody reported"
+	* — and telling those apart is the entire reason an operator opens this chart
+	* after a spike. Now a gap means exactly one thing.
+	*
+	* It is not free: the emit rate is deterministic, so the durable table's row
+	* count is too (nodes x processes / cadence, no discount for a quiet fleet).
+	* The measured cost of that is in `docs/architecture/load-ledger.md`, and it
+	* is why the retention default is six hours rather than three days.
+	*/
 	startProcessSnapshotTimer() {
 		if (this.processSnapshotTimer) clearInterval(this.processSnapshotTimer);
 		this.processSnapshotTimer = setInterval(() => this.emitProcessesSnapshot(), this.loadConfig.cadenceSec * 1e3);
@@ -2852,7 +3114,8 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 	/**
 	* Emit one `metrics.node-processes-snapshot` for this node.
 	*
-	* Heavy — a full OS `ps -eo` scan plus a `$process.list` broker call — and
+	* Heavy — a full process-table read (`/proc` on Linux, `ps -eo` elsewhere;
+	* `proc-process-table.ts`) plus a `$process.list` broker call — and
 	* UNCONDITIONAL. The change-detection that used to guard it is gone: with a
 	* fixed cadence a missing interval means exactly one thing, and that is the
 	* property an operator investigating a spike is actually looking for.
@@ -2956,34 +3219,18 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 			cpuSplits
 		});
 	}
-	/** Raw `ps` scan returning every pid + command + resource stats. */
+	/**
+	* Every pid + command + resource stats on this node.
+	*
+	* From `/proc` on Linux — no fork. This used to be a `ps -eo` child on every
+	* tick, i.e. a synchronous `fork()` of hub-main at p50 91 ms (D441, D452).
+	* `ps` remains the source only on a platform without `/proc`.
+	*/
 	async runPs() {
 		try {
-			const { stdout } = await execFileAsync("ps", ["-eo", "pid=,ppid=,pgid=,pcpu=,rss=,etime=,command="], {
-				timeout: 5e3,
-				maxBuffer: 8 * 1024 * 1024
-			});
-			const lines = stdout.split("\n");
-			const rows = [];
-			for (const line of lines) {
-				const trimmed = line.trim();
-				if (!trimmed) continue;
-				const match = trimmed.match(/^(\d+)\s+(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(\S+)\s+(.+)$/);
-				if (!match) continue;
-				const [, pidS, ppidS, pgidS, cpuS, rssS, etimeS, command] = match;
-				rows.push({
-					pid: parseInt(pidS, 10),
-					ppid: parseInt(ppidS, 10),
-					pgid: parseInt(pgidS, 10),
-					cpuPercent: Math.round(parseFloat(cpuS) * 10) / 10,
-					memoryRssBytes: parseInt(rssS, 10) * 1024,
-					uptimeSec: parseEtime(etimeS),
-					command
-				});
-			}
-			return rows;
+			return await readProcessTable();
 		} catch (err) {
-			this.ctx.logger.warn("ps scan failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			this.ctx.logger.warn("process table read failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			return [];
 		}
 	}
@@ -3068,28 +3315,5 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 		}] });
 	}
 };
-/**
-* Parse `ps etime` format → seconds.
-*
-* Formats we handle:
-*  `MM:SS`           (< 1h)
-*  `HH:MM:SS`        (< 1d)
-*  `DD-HH:MM:SS`     (>= 1d)
-*/
-function parseEtime(etime) {
-	const dashParts = etime.split("-");
-	let days = 0;
-	let hms = etime;
-	if (dashParts.length === 2) {
-		days = parseInt(dashParts[0], 10) || 0;
-		hms = dashParts[1];
-	}
-	const parts = hms.split(":").map((p) => parseInt(p, 10) || 0);
-	let hours = 0, minutes = 0, seconds = 0;
-	if (parts.length === 3) [hours, minutes, seconds] = parts;
-	else if (parts.length === 2) [minutes, seconds] = parts;
-	else if (parts.length === 1) [seconds] = parts;
-	return days * 86400 + hours * 3600 + minutes * 60 + seconds;
-}
 //#endregion
-export { NativeMetricsAddon as default, NativeMetricsProvider as t };
+export { NativeMetricsProvider as a, NativeMetricsAddon as default, parseProcStatusRss as i, nodeProcReader as n, parseProcStat as r, lifetimeCpuPercent as t };