@camstack/system 1.2.310 → 1.2.312

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,5 @@
-import { Dt as foldSnapshotByFunction, Jt as metricsProviderCapability, Wn as createEvent, an as reducePoints, ir as EventCategory, jn as BaseAddon, kn as errMsg, on as resolveBucketMs } from "../../dist-B78pkrps.mjs";
+import { Dt as foldSnapshotByFunction, Jt as metricsProviderCapability, Wn as createEvent, an as reducePoints, ir as EventCategory, jn as BaseAddon, kn as errMsg, on as resolveBucketMs } from "../../dist-Cj7pJmXq.mjs";
+import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as fs from "node:fs";
 import { constants, readFileSync } from "node:fs";
@@ -2120,7 +2121,7 @@ var NativeMetricsProvider = class {
 		return getCpuTemperatureInternal();
 	}
 	async getProcessStats(input) {
-		const { getPidStats } = await import("../../resource-monitor-Vp0bPV3U.mjs").then((n) => n.r);
+		const { getPidStats } = await import("../../resource-monitor-B1v6E07R.mjs").then((n) => n.r);
 		const raw = await getPidStats(input.pids);
 		const result = [];
 		for (const [pid, s] of raw) result.push({
@@ -2456,95 +2457,6 @@ function execAsync(cmd, args, timeoutMs = 5e3) {
 		});
 	});
 }
-/**
-* Parse one `/proc/<pid>/stat` line. `null` for a line that does not parse —
-* a process that exited between the readdir and the read leaves a truncated
-* or empty file, and that is normal, not an error.
-*/
-function parseProcStat(line) {
-	const close = line.lastIndexOf(")");
-	const open = line.indexOf("(");
-	if (close < 0 || open < 0 || close < open) return null;
-	const pid = Number(line.slice(0, open).trim());
-	const comm = line.slice(open + 1, close);
-	const rest = line.slice(close + 1).trim().split(/\s+/);
-	const state = rest[0];
-	const ppid = Number(rest[1]);
-	const pgid = Number(rest[2]);
-	const utime = Number(rest[11]);
-	const stime = Number(rest[12]);
-	const startTicks = Number(rest[19]);
-	const rssPages = Number(rest[21]);
-	if (state === void 0 || state === "") return null;
-	if (![
-		pid,
-		ppid,
-		pgid,
-		utime,
-		stime,
-		startTicks,
-		rssPages
-	].every(Number.isFinite)) return null;
-	return {
-		pid,
-		comm,
-		state,
-		ppid,
-		pgid,
-		ticks: utime + stime,
-		startTicks,
-		rssPages
-	};
-}
-function statusKb(status, key) {
-	const match = status.match(new RegExp(`^${key}:\\s+(\\d+)`, "m"));
-	return match ? parseInt(match[1], 10) * 1024 : void 0;
-}
-/** Read `VmRSS` / `RssAnon` / `RssFile` (kB in the file) out of `/proc/<pid>/status`. */
-function parseProcStatusRss(status) {
-	return {
-		rssBytes: statusKb(status, "VmRSS"),
-		privateBytes: statusKb(status, "RssAnon"),
-		sharedBytes: statusKb(status, "RssFile")
-	};
-}
-/** Seconds the process has been alive — `ps etime`, whole seconds. */
-function elapsedSecSince(input) {
-	return Math.max(0, Math.floor(input.uptimeSec - input.startTicks / 100));
-}
-/**
-* `ps pcpu`: CPU time over elapsed time, as a percentage with one decimal.
-*
-* This is deliberately the LIFETIME average `ps` prints, not an instantaneous
-* rate: the columns fed from it have always shown that quantity, and the
-* instantaneous split is a different number with a different owner
-* (`cpuMainPercent` / `cpuGcPercent` from `thread-cpu-sampler.ts`). A process
-* with no elapsed window yet reports 0, never a division by zero.
-*/
-function lifetimeCpuPercent(input) {
-	const elapsedSec = input.uptimeSec - input.startTicks / 100;
-	if (!(elapsedSec > 0)) return 0;
-	const cpuSec = input.ticks / 100;
-	return Math.round(cpuSec / elapsedSec * 1e3) / 10;
-}
-var PID_RE = /^\d+$/;
-var nodeProcReader = {
-	listPids: async () => (await readdir("/proc")).filter((entry) => PID_RE.test(entry)).map((entry) => Number(entry)),
-	readStat: (pid) => readFile(`/proc/${pid}/stat`, "latin1"),
-	readStatus: (pid) => readFile(`/proc/${pid}/status`, "latin1"),
-	readCmdline: (pid) => readFile(`/proc/${pid}/cmdline`, "latin1"),
-	readUptimeSec: async () => {
-		const [first] = (await readFile("/proc/uptime", "latin1")).trim().split(/\s+/);
-		const seconds = Number(first);
-		if (!Number.isFinite(seconds)) throw new Error(`/proc/uptime unreadable: ${String(first)}`);
-		return seconds;
-	}
-};
-/** `ps command=`: argv joined by spaces, or `[comm]` when there is no argv. */
-function commandFromCmdline(cmdline, comm) {
-	const joined = cmdline.split("\0").filter((part) => part.length > 0).join(" ");
-	return joined.length > 0 ? joined : `[${comm}]`;
-}
 //#endregion
 //#region src/builtins/native-metrics/proc-process-table.ts
 /**
@@ -3524,4 +3436,4 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 	}
 };
 //#endregion
-export { NativeMetricsProvider as a, NativeMetricsAddon as default, parseProcStatusRss as i, nodeProcReader as n, parseProcStat as r, lifetimeCpuPercent as t };
+export { NativeMetricsAddon as default, NativeMetricsProvider as t };

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Kn as emitReadiness, fn as scoreRuntimes, ir as EventCategory, jn as BaseAddon, kn as errMsg, nn as platformProbeCapability, vt as enumerateInferenceDevices } from "../../dist-B78pkrps.mjs";
+import { Kn as emitReadiness, fn as scoreRuntimes, ir as EventCategory, jn as BaseAddon, kn as errMsg, nn as platformProbeCapability, vt as enumerateInferenceDevices } from "../../dist-Cj7pJmXq.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { ir as EventCategory, jn as BaseAddon } from "../../dist-B78pkrps.mjs";
+import { ir as EventCategory, jn as BaseAddon } from "../../dist-Cj7pJmXq.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-Cqs7GkOV.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Fn as DeviceFeature, G as batteryCapability, Ln as DeviceType, W as bareAddonId, Zn as nodePin, a as BatteryStatusSchema, ft as deriveBatteryPresence, hn as snapshotCapability, ir as EventCategory, jn as BaseAddon, kn as errMsg, xn as streamQualityLabel } from "../../dist-B78pkrps.mjs";
+import { Fn as DeviceFeature, G as batteryCapability, Ln as DeviceType, W as bareAddonId, Zn as nodePin, a as BatteryStatusSchema, ft as deriveBatteryPresence, hn as snapshotCapability, ir as EventCategory, jn as BaseAddon, kn as errMsg, xn as streamQualityLabel } from "../../dist-Cj7pJmXq.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CZPvteq2.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as filesystemBrowseCapability, jn as BaseAddon, yn as storageProviderCapability } from "../../dist-B78pkrps.mjs";
+import { Et as filesystemBrowseCapability, jn as BaseAddon, yn as storageProviderCapability } from "../../dist-Cj7pJmXq.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as evictionPolicyOfLocation, E as REDACTED_SECRET, F as StorageLocationTypeSchema, I as StorageMigrationJobSchema, Kt as mayReadLocation, Mt as isLocationEnabled, N as StorageCleanupJobSchema, On as withLocationMode, P as StorageLocationModeSchema, Qn as parseJsonObject, Y as collectSecretConfigKeys, Yt as modeMayWrite, _n as storageMigrationCapability, b as LegacyStorageLocationDefaultSchema, gn as storageCapability, ir as EventCategory, jn as BaseAddon, kt as gbToBytes, pn as settingsStoreCapability, qt as mayWriteToLocation, sn as resolveLocationMode, zt as legacyModeOf } from "../../dist-B78pkrps.mjs";
+import { Ct as evictionPolicyOfLocation, E as REDACTED_SECRET, F as StorageLocationTypeSchema, I as StorageMigrationJobSchema, Kt as mayReadLocation, Mt as isLocationEnabled, N as StorageCleanupJobSchema, On as withLocationMode, P as StorageLocationModeSchema, Qn as parseJsonObject, Y as collectSecretConfigKeys, Yt as modeMayWrite, _n as storageMigrationCapability, b as LegacyStorageLocationDefaultSchema, gn as storageCapability, ir as EventCategory, jn as BaseAddon, kt as gbToBytes, pn as settingsStoreCapability, qt as mayWriteToLocation, sn as resolveLocationMode, zt as legacyModeOf } from "../../dist-Cj7pJmXq.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Jn as hydrateSchema, jn as BaseAddon, kn as errMsg } from "../../dist-B78pkrps.mjs";
+import { Jn as hydrateSchema, jn as BaseAddon, kn as errMsg } from "../../dist-Cj7pJmXq.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cy6DFFjs.js");
+const require_dist = require("../../dist-CkRwnhbo.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ut as logDestinationCapability, jn as BaseAddon } from "../../dist-B78pkrps.mjs";
+import { Ut as logDestinationCapability, jn as BaseAddon } from "../../dist-Cj7pJmXq.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-BCJjUtXV.mjs → child-cap-dispatch-CHTiHbsv.mjs}

@@ -1,3 +1,4 @@
+import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-BdT320dq.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -3207,7 +3208,7 @@ function createAddonPeerBytesFacility(args) {
 * Failures THROW with an actionable message — a caller must never proceed as
 * if dependencies were installed when they were not.
 */
-var execFileAsync$2 = promisify(execFile);
+var execFileAsync$3 = promisify(execFile);
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 /** Where the bootstrap lands inside `cacheDir` (npm tgz carries a `package/` prefix). */
 function bootstrappedCliPath(cacheDir) {
@@ -3215,7 +3216,7 @@ function bootstrappedCliPath(cacheDir) {
 }
 async function defaultProbeSystemNpm() {
 	try {
-		await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
+		await execFileAsync$3("npm", ["--version"], { timeout: 15e3 });
 		return true;
 	} catch {
 		return false;
@@ -3233,7 +3234,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	await fs.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
-	await execFileAsync$2("tar", [
+	await execFileAsync$3("tar", [
 		"-xzf",
 		tgzPath,
 		"-C",
@@ -3304,7 +3305,7 @@ async function runNpm(args, options) {
 		registry: options.registry,
 		logger: options.logger
 	});
-	return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
+	return execFileAsync$3(invocation.command, [...invocation.argsPrefix, ...args], {
 		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
 		timeout: options.timeout ?? 3e5,
 		env: buildNpmChildEnv(options.env ?? process.env, process.execPath)
@@ -3385,7 +3386,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/deps/manifest-native-deps.ts
-var execFileAsync$1 = promisify(execFile);
+var execFileAsync$2 = promisify(execFile);
 /**
 * Fallback bootstrap-cache location when the caller doesn't thread one
 * through (the forked addon-runner's spawn-time install). tmpdir survives the
@@ -3694,7 +3695,7 @@ async function rebuildNativeDeps(addonDir, packageNames, logger, npmCacheDir, re
 				return;
 			}
 			logger.warn("@electron/rebuild not available — falling back to npx", { meta: { addonDir } });
-			await execFileAsync$1("npx", [
+			await execFileAsync$2("npx", [
 				"--yes",
 				"electron-rebuild",
 				"-m",
@@ -12116,7 +12117,7 @@ function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs
 * the failure it precedes ("smbclient: ENOENT") arrives minutes later in a
 * different addon's logs.
 */
-var execFileAsync = promisify(execFile);
+var execFileAsync$1 = promisify(execFile);
 /** How long a single package-manager invocation may take. */
 var INSTALL_TIMEOUT_MS = 300 * 1e3;
 /** How long the `command -v <binary>` presence probe may take. */
@@ -12278,7 +12279,7 @@ function planFor(manager, packageName) {
 }
 async function defaultHasBinary(binary) {
 	try {
-		await execFileAsync("command", ["-v", binary], {
+		await execFileAsync$1("command", ["-v", binary], {
 			timeout: PROBE_TIMEOUT_MS,
 			shell: process.platform === "win32" ? false : "/bin/sh"
 		});
@@ -12298,7 +12299,290 @@ async function defaultDetectManager() {
 	return null;
 }
 async function defaultRun(command, args) {
-	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+	await execFileAsync$1(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+}
+//#endregion
+//#region src/kernel/moleculer/runner-process-group.ts
+/**
+* A runner OWNS a process group, and the kernel reaps it on every runner exit (D668).
+*
+* ## Why
+*
+* An addon-runner spawns long-lived children: recorder ffmpeg writers, stream-broker
+* ffmpeg, llama-server, tailscaled, cloudflared, HAP ffmpeg. Their only kill was the
+* addon's own graceful `stop()`, which a runner that dies of SIGABRT (V8 OOM), SIGKILL
+* or a native crash never runs. ffmpeg ignores SIGPIPE and does not quit on stdin EOF,
+* so a dead reader does not stop it either. On 2026-09-28 at 10:21 CEST the hub's
+* recorder runner aborted; 28 ffmpeg writers survived as orphans and kept writing into
+* the SAME staging directories the respawned runner's 28 new writers used — 13 minutes
+* of dual writers on every camera, until they were killed by hand.
+*
+* Runners were spawned `detached: false`, i.e. inside hub-main's own group, so there
+* was no handle meaning "this runner and everything under it". Now every runner is
+* spawned `detached: true` on POSIX, which makes it a SESSION and group leader
+* (`setsid`): pgid === runner pid, and every descendant that does not itself call
+* `setsid`/`setpgid` inherits that group. A process group outlives its leader, so
+* `kill(-pgid)` still reaches the orphans after the runner is gone — which is exactly
+* the moment it matters.
+*
+* ## What `detached` does NOT change
+*
+* - The child stays REF'd: nothing calls `unref()`, so the parent still waits on it,
+*   still gets its `exit`, still reads its stdout/stderr pipes.
+* - `process.ppid` is unchanged, so the runner can detect a lost parent before or
+*   after READY and hard-stop its own group.
+* - UDS/stdio wiring is fd-based and independent of the session.
+*
+* What it DOES change: the runner is no longer in hub-main's group, so a signal sent to
+* hub-main's group (`kill -- -<pid>` in `server/backend/src/main.ts`, a terminal Ctrl+C)
+* no longer reaches runners by itself. `signalAllRunnerGroups` is the replacement, and
+* the process `exit` backstop below hard-stops any groups a hub/agent still owns.
+*
+* ## Out of scope, deliberately
+*
+* - Windows has no process groups in this sense; nothing here runs on `win32` and the
+*   runner is spawned exactly as before.
+* - A descendant that calls `setsid`/`setpgid` itself (or is spawned `detached: true`
+*   by an addon) leaves the group and is NOT reaped. No shipped addon does; one that
+*   needs to must own its child's lifetime some other way.
+* - The kernel knows the runner id, not which device a child served. Per-device
+*   attribution is the addon's (the recorder's own foreign-writer reap, D667).
+*/
+var execFileAsync = promisify(execFile);
+/** SIGTERM → SIGKILL grace for a runner's group, in ms. ffmpeg finalises a segment well inside it. */
+var RUNNER_GROUP_REAP_GRACE_MS = 2e3;
+/** How often the group is probed for emptiness during the grace. */
+var GROUP_PROBE_INTERVAL_MS = 100;
+/** Whether a runner is spawned as a process-group leader on this platform. */
+function runnerOwnsProcessGroup(platform = process.platform) {
+	return platform !== "win32";
+}
+function errnoOf(err) {
+	if (typeof err !== "object" || err === null) return void 0;
+	const code = Reflect.get(err, "code");
+	return typeof code === "string" ? code : void 0;
+}
+function signalGroup(ops, pgid, signal) {
+	try {
+		ops.kill(-pgid, signal);
+		return "delivered";
+	} catch (err) {
+		if (errnoOf(err) === "ESRCH") return "empty";
+		return { error: `${errnoOf(err) ?? "unknown"}: ${err instanceof Error ? err.message : String(err)}` };
+	}
+}
+function signalPid(ops, pid) {
+	try {
+		ops.kill(pid, 0);
+		return "delivered";
+	} catch (err) {
+		return errnoOf(err) === "ESRCH" ? "empty" : { error: errnoOf(err) ?? "unknown" };
+	}
+}
+/**
+* A pgid this module may address. `kill(-1)` signals every process the caller may
+* signal and `kill(-0)` is the caller's OWN group — both are catastrophes, not reaps.
+*/
+function isAddressableGroup(pgid) {
+	return Number.isInteger(pgid) && pgid > 1 && pgid !== process.pid;
+}
+/**
+* SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
+*
+* pid reuse: POSIX never hands out a pid while a process group with that id exists, so
+* the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
+* still populated at the end of the grace, which is the same group; the residual window
+* (group empties, the pid wraps around AND is reused as a new group leader, all inside
+* the grace) is not reachable in practice.
+*/
+async function reapProcessGroup(pgid, ops) {
+	if (!isAddressableGroup(pgid)) return {
+		pgid,
+		membersAtExit: null,
+		killed: null,
+		alreadyEmpty: true,
+		error: `refused pgid ${pgid}`
+	};
+	const membersAtExit = await ops.listMembers(pgid);
+	const term = signalGroup(ops, pgid, "SIGTERM");
+	if (term === "empty") return {
+		pgid,
+		membersAtExit,
+		killed: [],
+		alreadyEmpty: true,
+		error: null
+	};
+	if (typeof term === "object") return {
+		pgid,
+		membersAtExit,
+		killed: null,
+		alreadyEmpty: false,
+		error: term.error
+	};
+	for (let waited = 0; waited < ops.graceMs; waited += GROUP_PROBE_INTERVAL_MS) {
+		await ops.sleep(Math.min(GROUP_PROBE_INTERVAL_MS, ops.graceMs - waited));
+		if (signalGroup(ops, pgid, 0) === "empty") return {
+			pgid,
+			membersAtExit,
+			killed: [],
+			alreadyEmpty: false,
+			error: null
+		};
+	}
+	const survivors = membersAtExit === null ? null : membersAtExit.filter((m) => signalPid(ops, m.pid) === "delivered");
+	const kill = signalGroup(ops, pgid, "SIGKILL");
+	return {
+		pgid,
+		membersAtExit,
+		killed: kill === "empty" ? [] : survivors,
+		alreadyEmpty: false,
+		error: typeof kill === "object" ? kill.error : null
+	};
+}
+/** `ffmpeg×28 llama-server×1` — what a reap line says it removed. */
+function summarizeMembers(members) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const m of members) counts.set(m.command, (counts.get(m.command) ?? 0) + 1);
+	return [...counts.entries()].map(([command, n]) => `${command}×${n}`).join(" ");
+}
+async function listMembersFromProc(pgid, reader) {
+	const pids = await reader.listPids();
+	return (await Promise.all(pids.map(async (pid) => {
+		try {
+			return parseProcStat(await reader.readStat(pid));
+		} catch {
+			return null;
+		}
+	}))).flatMap((row) => row !== null && row.pgid === pgid && row.state !== "Z" ? [{
+		pid: row.pid,
+		command: row.comm
+	}] : []);
+}
+var PS_GROUP_ROW_RE = /^(\d+)\s+(\d+)\s+(\S+)\s+(.+)$/;
+/** Parse `ps -A -o pid=,pgid=,stat=,comm=` for one group, zombies excluded. */
+function parsePsGroupMembers(stdout, pgid) {
+	const members = [];
+	for (const line of stdout.split("\n")) {
+		const match = line.trim().match(PS_GROUP_ROW_RE);
+		if (!match) continue;
+		const [, pidS, pgidS, stat = "", comm = ""] = match;
+		if (Number(pgidS) !== pgid || stat.startsWith("Z")) continue;
+		const command = comm.trim();
+		members.push({
+			pid: Number(pidS),
+			command: command.slice(command.lastIndexOf("/") + 1)
+		});
+	}
+	return members;
+}
+async function listMembersFromPs(pgid) {
+	const { stdout } = await execFileAsync("ps", [
+		"-A",
+		"-o",
+		"pid=,pgid=,stat=,comm="
+	], {
+		timeout: 3e3,
+		maxBuffer: 8 * 1024 * 1024
+	});
+	return parsePsGroupMembers(stdout, pgid);
+}
+/** Live members of `pgid`: `/proc` on Linux, `ps` elsewhere; `null` when neither answers. */
+async function listProcessGroupMembers(pgid, platform = process.platform) {
+	try {
+		return platform === "linux" ? await listMembersFromProc(pgid, nodeProcReader) : await listMembersFromPs(pgid);
+	} catch {
+		return null;
+	}
+}
+var defaultProcessGroupOps = {
+	kill: (pid, signal) => {
+		process.kill(pid, signal);
+	},
+	listMembers: (pgid) => listProcessGroupMembers(pgid),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	graceMs: RUNNER_GROUP_REAP_GRACE_MS
+};
+/**
+* Every runner group this process leads and has not finished reaping. Process-wide on
+* purpose: `process.on('exit')` and hub-main's signal handler must reach the groups of
+* every `$process` service in the process, and neither holds a service reference.
+*/
+var ownedGroups = /* @__PURE__ */ new Map();
+var exitBackstopInstalled = false;
+function installExitBackstop() {
+	if (exitBackstopInstalled) return;
+	exitBackstopInstalled = true;
+	process.on("exit", () => {
+		for (const [pgid, group] of ownedGroups) try {
+			group.kill(-pgid, "SIGKILL");
+		} catch {}
+	});
+}
+function registerRunnerGroup(pgid, group) {
+	if (!isAddressableGroup(pgid)) return;
+	ownedGroups.set(pgid, group);
+	installExitBackstop();
+}
+function releaseRunnerGroup(pgid) {
+	ownedGroups.delete(pgid);
+}
+/**
+* Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
+* handler calls it: before D668 the runners were in hub-main's own group and its
+* `kill -- -<pid>` reached them and their children; now each is its own group.
+* Returns how many groups were signalled.
+*/
+function signalAllRunnerGroups(signal) {
+	let signalled = 0;
+	for (const [pgid, group] of ownedGroups) try {
+		group.kill(-pgid, signal);
+		signalled += 1;
+	} catch {}
+	return signalled;
+}
+/**
+* Arm the runner's parent-death watchdog before addon code starts loading.
+*
+* A parent can die while an addon module or `initialize()` is still pending, so
+* installing this only after READY leaves exactly the boot window where a detached
+* runner can become an orphan. Any PPID change means the direct parent died and the
+* kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
+*/
+function startRunnerParentDeathWatchdog(onParentDeath, options = {}) {
+	const initialPpid = options.initialPpid ?? process.ppid;
+	if (!Number.isInteger(initialPpid) || initialPpid <= 1) return null;
+	const readPpid = options.readPpid ?? (() => process.ppid);
+	const intervalMs = options.intervalMs ?? 5e3;
+	let fired = false;
+	const timer = setInterval(() => {
+		if (fired || readPpid() === initialPpid) return;
+		fired = true;
+		clearInterval(timer);
+		onParentDeath();
+	}, intervalMs);
+	return timer;
+}
+/**
+* Last resort for a detached runner whose direct parent disappeared without an
+* `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
+* one SIGKILL removes the runner and every descendant in that group atomically.
+*
+* Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
+* returns ESRCH: while this pid exists, no unrelated process group can have the
+* same id. That makes the failed call a safe compatibility fallback for an older
+* parent that did not spawn the runner detached.
+*/
+function killOwnRunnerGroupAfterParentLoss(platform = process.platform, kill = (target, signal) => {
+	process.kill(target, signal);
+}) {
+	const pid = process.pid;
+	if (!runnerOwnsProcessGroup(platform) || !Number.isInteger(pid) || pid <= 1) return false;
+	try {
+		kill(-pid, "SIGKILL");
+		return true;
+	} catch {
+		return false;
+	}
 }
 //#endregion
 //#region src/kernel/moleculer/child-cap-dispatch.ts
@@ -12351,4 +12635,4 @@ function createChildCapDispatch(deps) {
 	};
 }
 //#endregion
-export { localEndpointPath as $, shouldReclaim as $t, createUdsEventBus as A, createSocketPlaneReader as An, createAddonDataPlaneFacility as At, LocalChildClient as B, CAP_ACTION_OVERFLOW_LABEL as Bn, RSS_BUDGET_RELEASE_RATIO as Bt, brokerTransportLink as C, MESH_QUEUE_TOP_N as Cn, installManifestNativeDeps as Ct, localProviderLink as D, SOCKET_PLANE_TOP_N as Dn, runNpm as Dt, ipcParentLink as E, EMPTY_SOCKET_PLANE_BASELINE as En, resolveNpmInvocation as Et, AGENT_CAP_FWD_SERVICE as F, createSocketDirectionCounters as Fn, HEAP_WATCH_WARN_RATIO as Ft, PARENT_ROUTED_PROVIDER_ADDON_ID as G, createCapActionCensus as Gn, createDeferredHeapWatchSink as Gt, UDS_NO_ROUTE_PREFIX as H, EMPTY_CAP_ACTION_READING as Hn, RUNNER_RSS_BUDGET_ENV as Ht, CapRouteResolver as I, recordSocketFrame as In, HUB_MAIN_HEAP_WATCH_LABEL as It, createLocalTransport as J, createEventPlaneMeter as Jn, describeRss as Jt, __resetCapUsageRegistryForTests as K, diffCapActionCensus as Kn, createLoopDelayMeter as Kt, callWithServiceDiscovery as L, sampleSocketDirection as Ln, HUB_MAIN_RSS_BUDGET_MB as Lt, createUdsLogger as M, formatSocketPlane as Mn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Mt, createUdsLoggerWithControl as N, readSocketQueues as Nn, HEAP_RECLAIM_TRIGGER_MB as Nt, createParentUnownedCallHandler as O, SOCKET_QUEUE_TOP_N as On, createAddonPeerBytesFacility as Ot, AGENT_CAP_FWD_ACTION as P, EMPTY_SOCKET_DIRECTION as Pn, HEAP_WATCH_INTERVAL_MS as Pt, PeerAnsweredError as Q, reclaimIntervalMs as Qt, CapRouteError as R, socketDirectionBytes as Rn, HUB_RSS_BUDGET_ENV as Rt, brokerCallForCap as S, formatOutboundQueueVerdict as Sn, copyBundledNativeModules as St, deviceCapResolverLink as T, formatMeshQueue as Tn, buildNpmChildEnv as Tt, readMoleculerFanoutMode as U, MAX_CAP_ACTIONS_PER_PEER as Un, ZERO_LOOP_DELAY as Ut, LocalChildRegistry as V, CAP_ACTION_UNLABELLED as Vn, RUNNER_HEAP_WATCH_INTERVAL_MS as Vt, CapUsageRegistry as W, capActionLabel as Wn, buildHeapSample as Wt, UdsLocalTransportServer as X, diffEventPlane as Xn, nextRssBudgetState as Xt, UdsLocalTransportClient as Y, createEventPlaneReader as Yn, hubMainRssBudget as Yt, SocketChannel as Z, formatEventPlane as Zn, parseRssBudgetMb as Zt, setNodeEventInterest as _, selectReportedSpaces as _n, deserializeTypedArrays as _t, adaptBrokerToCluster as a, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as an, getWorkerNativeCapProvider as at, createKernelHwAccel as b, OUTBOUND_QUEUE_THRESHOLD_BYTES as bn, CapabilityHandle as bt, getWorkerDeviceRegistry as c, createInspectorArrayBufferCensus as cn, setWorkerNativeCapsChangeListener as ct, setHubConnected as d, DECISIVE_HEAP_SPACES as dn, NATIVE_PROVIDER_SERVICE_INFIX as dt, startHeapWatch as en, FrameDecoder as et, EVENT_TOPIC_PREFIX as f, HEAP_SPACE_REPORT_MIN_MB as fn, capActionName as ft, registerEventBusService as g, readHeapSpaces as gn, parseCapAction as gt, getMoleculerEventStats as h, heapSpaceField as hn, capServiceName as ht, installManifestPythonDeps as i, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as in, createBrokerDeviceManagerApi as it, udsChildLogToWorkerEntry as j, diffSocketPlane as jn, HEAP_RECLAIM_MIN_INTERVAL_MS as jt, createUdsEventBridge as k, createSocketPlaneMeter as kn, hostNodeIdOf as kt, getOrInitReadinessRegistry as l, formatArrayBufferCensus as ln, createAddonService as lt, getBrokerEventBus as m, formatHeapSpaces as mn, capBareAction as mt, createChildCapDispatch as n, strandedMb as nn, buildNativeCapProxy as nt, createAddonContext as o, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as on, getWorkerNativeCapSnapshot as ot, clusterEventTopic as p, emitHeapDiagnosticReport as pn, capActionSuffix as pt, getCapUsageRegistry as q, EVENT_PLANE_TOP_N as qn, createV8Reclaimer as qt, installManifestSystemDeps as r, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as rn, buildUdsNativeCapProxy as rt, createUdsAddonContext as s, createArrayBufferCensusGate as sn, mountNativeCapService as st, CAP_METHOD_NOT_IMPLEMENTED as t, startRunnerHeapWatch as tn, encodeFrame as tt, getOrInitReadinessRegistryForClient as u, isArrayBufferCensusReport as un, validateProviderRegistrations as ut, subscribePassthrough as v, OUTBOUND_QUEUE_COOLDOWN_MS as vn, serializeTypedArrays as vt, buildLinkChain as w, createMeshQueueReader as wn, resolveAddonClass as wt, resolveHwAccel as x, createOutboundQueueGate as xn, CapabilityUnavailableError as xt, AddonDepsManager as y, OUTBOUND_QUEUE_SUSTAIN_MS as yn, DeviceRegistry as yt, classifyCapRoute as z, socketDirectionMessages as zn, RSS_BUDGET_REANNOUNCE_MIN_MS as zt };
+export { CapUsageRegistry as $, capActionLabel as $n, buildHeapSample as $t, resolveHwAccel as A, createOutboundQueueGate as An, CapabilityUnavailableError as At, udsChildLogToWorkerEntry as B, diffSocketPlane as Bn, HEAP_RECLAIM_MIN_INTERVAL_MS as Bt, getBrokerEventBus as C, formatHeapSpaces as Cn, capBareAction as Ct, subscribePassthrough as D, OUTBOUND_QUEUE_COOLDOWN_MS as Dn, serializeTypedArrays as Dt, setNodeEventInterest as E, selectReportedSpaces as En, deserializeTypedArrays as Et, ipcParentLink as F, EMPTY_SOCKET_PLANE_BASELINE as Fn, resolveNpmInvocation as Ft, CapRouteResolver as G, recordSocketFrame as Gn, HUB_MAIN_HEAP_WATCH_LABEL as Gt, createUdsLoggerWithControl as H, readSocketQueues as Hn, HEAP_RECLAIM_TRIGGER_MB as Ht, localProviderLink as I, SOCKET_PLANE_TOP_N as In, runNpm as It, classifyCapRoute as J, socketDirectionMessages as Jn, RSS_BUDGET_REANNOUNCE_MIN_MS as Jt, callWithServiceDiscovery as K, sampleSocketDirection as Kn, HUB_MAIN_RSS_BUDGET_MB as Kt, createParentUnownedCallHandler as L, SOCKET_QUEUE_TOP_N as Ln, createAddonPeerBytesFacility as Lt, brokerTransportLink as M, MESH_QUEUE_TOP_N as Mn, installManifestNativeDeps as Mt, buildLinkChain as N, createMeshQueueReader as Nn, resolveAddonClass as Nt, AddonDepsManager as O, OUTBOUND_QUEUE_SUSTAIN_MS as On, DeviceRegistry as Ot, deviceCapResolverLink as P, formatMeshQueue as Pn, buildNpmChildEnv as Pt, readMoleculerFanoutMode as Q, MAX_CAP_ACTIONS_PER_PEER as Qn, ZERO_LOOP_DELAY as Qt, createUdsEventBridge as R, createSocketPlaneMeter as Rn, hostNodeIdOf as Rt, clusterEventTopic as S, emitHeapDiagnosticReport as Sn, capActionSuffix as St, registerEventBusService as T, readHeapSpaces as Tn, parseCapAction as Tt, AGENT_CAP_FWD_ACTION as U, EMPTY_SOCKET_DIRECTION as Un, HEAP_WATCH_INTERVAL_MS as Ut, createUdsLogger as V, formatSocketPlane as Vn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Vt, AGENT_CAP_FWD_SERVICE as W, createSocketDirectionCounters as Wn, HEAP_WATCH_WARN_RATIO as Wt, LocalChildRegistry as X, CAP_ACTION_UNLABELLED as Xn, RUNNER_HEAP_WATCH_INTERVAL_MS as Xt, LocalChildClient as Y, CAP_ACTION_OVERFLOW_LABEL as Yn, RSS_BUDGET_RELEASE_RATIO as Yt, UDS_NO_ROUTE_PREFIX as Z, EMPTY_CAP_ACTION_READING as Zn, RUNNER_RSS_BUDGET_ENV as Zt, getWorkerDeviceRegistry as _, createInspectorArrayBufferCensus as _n, setWorkerNativeCapsChangeListener as _t, reapProcessGroup as a, nextRssBudgetState as an, diffEventPlane as ar, UdsLocalTransportServer as at, setHubConnected as b, DECISIVE_HEAP_SPACES as bn, NATIVE_PROVIDER_SERVICE_INFIX as bt, runnerOwnsProcessGroup as c, shouldReclaim as cn, localEndpointPath as ct, summarizeMembers as d, strandedMb as dn, buildNativeCapProxy as dt, createDeferredHeapWatchSink as en, createCapActionCensus as er, PARENT_ROUTED_PROVIDER_ADDON_ID as et, installManifestSystemDeps as f, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as fn, buildUdsNativeCapProxy as ft, createUdsAddonContext as g, createArrayBufferCensusGate as gn, mountNativeCapService as gt, createAddonContext as h, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as hn, getWorkerNativeCapSnapshot as ht, killOwnRunnerGroupAfterParentLoss as i, hubMainRssBudget as in, createEventPlaneReader as ir, UdsLocalTransportClient as it, brokerCallForCap as j, formatOutboundQueueVerdict as jn, copyBundledNativeModules as jt, createKernelHwAccel as k, OUTBOUND_QUEUE_THRESHOLD_BYTES as kn, CapabilityHandle as kt, signalAllRunnerGroups as l, startHeapWatch as ln, FrameDecoder as lt, adaptBrokerToCluster as m, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as mn, getWorkerNativeCapProvider as mt, createChildCapDispatch as n, createV8Reclaimer as nn, EVENT_PLANE_TOP_N as nr, getCapUsageRegistry as nt, registerRunnerGroup as o, parseRssBudgetMb as on, formatEventPlane as or, SocketChannel as ot, installManifestPythonDeps as p, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as pn, createBrokerDeviceManagerApi as pt, CapRouteError as q, socketDirectionBytes as qn, HUB_RSS_BUDGET_ENV as qt, defaultProcessGroupOps as r, describeRss as rn, createEventPlaneMeter as rr, createLocalTransport as rt, releaseRunnerGroup as s, reclaimIntervalMs as sn, PeerAnsweredError as st, CAP_METHOD_NOT_IMPLEMENTED as t, createLoopDelayMeter as tn, diffCapActionCensus as tr, __resetCapUsageRegistryForTests as tt, startRunnerParentDeathWatchdog as u, startRunnerHeapWatch as un, encodeFrame as ut, getOrInitReadinessRegistry as v, formatArrayBufferCensus as vn, createAddonService as vt, getMoleculerEventStats as w, heapSpaceField as wn, capServiceName as wt, EVENT_TOPIC_PREFIX as x, HEAP_SPACE_REPORT_MIN_MB as xn, capActionName as xt, getOrInitReadinessRegistryForClient as y, isArrayBufferCensusReport as yn, validateProviderRegistrations as yt, createUdsEventBus as z, createSocketPlaneReader as zn, createAddonDataPlaneFacility as zt };