@camstack/system 1.2.310 → 1.2.312

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Cy6DFFjs.js");
+const require_dist = require("./dist-CkRwnhbo.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_composer_composer_addon = require("./builtins/composer/composer.addon.js");
@@ -29,8 +29,8 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-D_wUeOTD.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-Be8e2cBP.js");
-const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-Dyn_7ezH.js");
+const require_resource_monitor = require("./resource-monitor-DzNn_IZK.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -95015,7 +95015,10 @@ var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
 function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parentUdsPath) {
 	const spawnFn = deps?.spawnFn ?? node_child_process.spawn;
+	const groupOps = deps?.processGroups ?? require_child_cap_dispatch.defaultProcessGroupOps;
+	const runnersOwnGroups = require_child_cap_dispatch.runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
 		const result = (runnerLocks.get(runnerId) ?? Promise.resolve()).then(fn, fn);
@@ -95055,6 +95058,49 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* One line per reap that found something, or that failed. An empty group is the
+	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
+	* which device a child served — the runner id is the finest attribution it has.
+	*/
+	function logGroupReap(runnerId, result) {
+		const found = result.membersAtExit;
+		const killed = result.killed ?? [];
+		const line = `[${runnerId}] runner group reaped {pgid=${result.pgid}, members=${found === null ? "unreadable" : found.length}${found !== null && found.length > 0 ? ` (${require_child_cap_dispatch.summarizeMembers(found)})` : ""}, sigkilled=${killed.length}${killed.length > 0 ? ` (${require_child_cap_dispatch.summarizeMembers(killed)})` : ""}${result.error !== null ? `, error=${result.error}` : ""}}`;
+		const logger = capturedBroker?.logger;
+		if (result.error !== null || killed.length > 0) if (logger) logger.warn(line);
+		else console.error(line);
+		else if ((found?.length ?? 0) > 0 || found === null) logger?.info(line);
+		else logger?.debug(line);
+	}
+	/**
+	* Reap a runner's process group (D668): SIGTERM, a bounded grace, SIGKILL for what
+	* remains. Memoized on the entry so the `exit` handler and a stop/restart that timed
+	* out waiting for that exit share one reap, and registered in `pendingGroupReaps` so
+	* the next spawn under the same id waits for it. Never rejects.
+	*/
+	function reapRunnerGroup(entry) {
+		if (entry.groupReap !== null) return entry.groupReap;
+		if (!entry.ownsGroup) {
+			entry.groupReap = Promise.resolve();
+			return entry.groupReap;
+		}
+		const reap = require_child_cap_dispatch.reapProcessGroup(entry.pid, groupOps).then((result) => logGroupReap(entry.name, result)).catch((err) => {
+			capturedBroker?.logger.error(`[${entry.name}] runner group reap threw: ${err instanceof Error ? err.message : String(err)}`);
+		}).finally(() => {
+			require_child_cap_dispatch.releaseRunnerGroup(entry.pid);
+			if (pendingGroupReaps.get(entry.name) === tracked) pendingGroupReaps.delete(entry.name);
+		});
+		const previous = pendingGroupReaps.get(entry.name);
+		const tracked = previous ? Promise.all([previous, reap]).then(() => void 0) : reap;
+		pendingGroupReaps.set(entry.name, tracked);
+		entry.groupReap = reap;
+		return reap;
+	}
+	/** Resolves once every reap started for `runnerId` has finished. */
+	async function awaitPredecessorReap(runnerId) {
+		await pendingGroupReaps.get(runnerId);
+	}
+	/**
 	* Spawn ONE runner subprocess (`addon-runner.js`) that hosts the
 	* `addons` set sharing a single Moleculer broker. The normal case is
 	* a size-1 `addons` array — one addon, one process; the media group
@@ -95103,8 +95149,9 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				"pipe",
 				"pipe"
 			],
-			detached: false
+			detached: runnersOwnGroups
 		});
+		const ownsGroup = runnersOwnGroups && typeof child.pid === "number" && child.pid > 1;
 		const entry = {
 			pid: child.pid,
 			nodeId,
@@ -95115,16 +95162,23 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
-			child
+			child,
+			ownsGroup,
+			groupReap: null
 		};
+		if (ownsGroup) require_child_cap_dispatch.registerRunnerGroup(entry.pid, {
+			runnerId,
+			kill: groupOps.kill
+		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`)) entry.state = "running";
+			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
 		});
 		child.on("exit", (code, signal) => {
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
+			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
 			entry.state = "crashed";
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
@@ -95163,6 +95217,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
+					await groupReap;
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -95175,10 +95230,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	return {
 		name: "$process",
 		actions: {
-			spawnRunner: { handler(ctx) {
+			spawnRunner: { async handler(ctx) {
 				const { runnerId, addons, env } = ctx.params;
 				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				if (!Array.isArray(addons) || addons.length === 0) throw new Error(`spawnRunner requires non-empty addons array`);
+				await awaitPredecessorReap(runnerId);
+				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				invalidateHeapProfiles(addons);
 				const entry = spawnRunner(runnerId, addons, env);
 				return {
@@ -95215,6 +95272,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95251,6 +95309,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95310,6 +95369,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 								});
 							});
 						}
+						await reapRunnerGroup(entry);
 						processes.delete(name);
 						crashSupervisor.reset(name);
 						invalidateHeapProfiles(runnerAddons);
@@ -95360,19 +95420,28 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		started() {
 			capturedBroker = this.broker;
 		},
-		stopped() {
-			const survivors = [];
-			for (const entry of processes.values()) {
+		async stopped() {
+			const entries = [...processes.values()];
+			await Promise.all(entries.map(async (entry) => {
 				entry.state = "stopped";
-				entry.child.kill("SIGTERM");
-				survivors.push(entry);
-			}
-			setTimeout(() => {
-				for (const entry of survivors) if (entry.child.exitCode === null && entry.child.signalCode === null) {
-					capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
-					entry.child.kill("SIGKILL");
+				if (!(entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+					entry.child.kill("SIGTERM");
+					await new Promise((resolve) => {
+						const timer = setTimeout(() => {
+							if (entry.child.exitCode === null && entry.child.signalCode === null) {
+								capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
+								entry.child.kill("SIGKILL");
+							}
+							resolve();
+						}, 3e3);
+						entry.child.once("exit", () => {
+							clearTimeout(timer);
+							resolve();
+						});
+					});
 				}
-			}, 3e3).unref();
+				await reapRunnerGroup(entry);
+			}));
 			processes.clear();
 			capturedBroker = null;
 		}
@@ -96259,6 +96328,7 @@ exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
+exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
 exports.socketDirectionBytes = require_child_cap_dispatch.socketDirectionBytes;
 exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMessages;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as parseJsonUnknown, $t as objectInputDeclaresRequiredDeviceId, At as isArrayOutputSchema, Bt as lifecycleJobSchema, D as RUNTIME_DEFAULTS, Gn as emitDownForOwnedCaps, Gt as looseSchema, Hn as asNumber, It as isVoidInput, Lt as kebabToCamel, Mn as DATAPLANE_SECRET_HEADER$1, Nn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Nt as isObjectInput, Pn as DEVICE_STATUS_METHOD, Qn as parseJsonObject, Qt as objectInputDeclaresAddonId, Rn as ReadinessRegistry, S as METHOD_ACCESS_MAP, Tt as extractNestedAddonId, Un as asString$1, Vn as asJsonObject$1, Wn as createEvent, Wt as logLevelAtMost, cn as resolveMethodAuth, dn as scopesAllowDeviceCap, er as readinessKey, ir as EventCategory$1, jt as isCollectionArrayMethod, kn as errMsg$1, nr as scopeKey, qn as expandCapMethods, rn as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, tr as resolveCapMount, un as scopesAllowAddon, y as LOG_LEVEL_RANK, z as addonSettingsCapability, zn as ReadinessTimeoutError } from "./dist-B78pkrps.mjs";
+import { $n as parseJsonUnknown, $t as objectInputDeclaresRequiredDeviceId, At as isArrayOutputSchema, Bt as lifecycleJobSchema, D as RUNTIME_DEFAULTS, Gn as emitDownForOwnedCaps, Gt as looseSchema, Hn as asNumber, It as isVoidInput, Lt as kebabToCamel, Mn as DATAPLANE_SECRET_HEADER$1, Nn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Nt as isObjectInput, Pn as DEVICE_STATUS_METHOD, Qn as parseJsonObject, Qt as objectInputDeclaresAddonId, Rn as ReadinessRegistry, S as METHOD_ACCESS_MAP, Tt as extractNestedAddonId, Un as asString$1, Vn as asJsonObject$1, Wn as createEvent, Wt as logLevelAtMost, cn as resolveMethodAuth, dn as scopesAllowDeviceCap, er as readinessKey, ir as EventCategory$1, jt as isCollectionArrayMethod, kn as errMsg$1, nr as scopeKey, qn as expandCapMethods, rn as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, tr as resolveCapMount, un as scopesAllowAddon, y as LOG_LEVEL_RANK, z as addonSettingsCapability, zn as ReadinessTimeoutError } from "./dist-Cj7pJmXq.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { ComposerAddon } from "./builtins/composer/composer.addon.mjs";
@@ -16,7 +16,7 @@ import "./builtins/liveness-monitor/index.mjs";
 import { LocalAuthAddon, a as require_safe_buffer, i as require_ms, n as ScopedTokenManager, o as ApiKeyManager, r as AuthManager, t as UserManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
-import NativeMetricsAddon, { a as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
+import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
@@ -28,8 +28,8 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-IM-v7JV4.mjs";
-import { $ as localEndpointPath, $t as shouldReclaim, A as createUdsEventBus, An as createSocketPlaneReader, At as createAddonDataPlaneFacility, B as LocalChildClient, Bn as CAP_ACTION_OVERFLOW_LABEL, Bt as RSS_BUDGET_RELEASE_RATIO, C as brokerTransportLink, Cn as MESH_QUEUE_TOP_N, Ct as installManifestNativeDeps, D as localProviderLink, Dn as SOCKET_PLANE_TOP_N, Dt as runNpm, E as ipcParentLink, En as EMPTY_SOCKET_PLANE_BASELINE, Et as resolveNpmInvocation, F as AGENT_CAP_FWD_SERVICE, Fn as createSocketDirectionCounters, Ft as HEAP_WATCH_WARN_RATIO, G as PARENT_ROUTED_PROVIDER_ADDON_ID, Gn as createCapActionCensus, Gt as createDeferredHeapWatchSink, H as UDS_NO_ROUTE_PREFIX, Hn as EMPTY_CAP_ACTION_READING, Ht as RUNNER_RSS_BUDGET_ENV, I as CapRouteResolver, In as recordSocketFrame, It as HUB_MAIN_HEAP_WATCH_LABEL, J as createLocalTransport, Jn as createEventPlaneMeter, Jt as describeRss, K as __resetCapUsageRegistryForTests, Kn as diffCapActionCensus, Kt as createLoopDelayMeter, L as callWithServiceDiscovery, Ln as sampleSocketDirection, Lt as HUB_MAIN_RSS_BUDGET_MB, M as createUdsLogger, Mn as formatSocketPlane, Mt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, N as createUdsLoggerWithControl, Nn as readSocketQueues, Nt as HEAP_RECLAIM_TRIGGER_MB, O as createParentUnownedCallHandler, On as SOCKET_QUEUE_TOP_N, Ot as createAddonPeerBytesFacility, P as AGENT_CAP_FWD_ACTION, Pn as EMPTY_SOCKET_DIRECTION, Pt as HEAP_WATCH_INTERVAL_MS, Q as PeerAnsweredError, Qt as reclaimIntervalMs, R as CapRouteError, Rn as socketDirectionBytes, Rt as HUB_RSS_BUDGET_ENV, S as brokerCallForCap, Sn as formatOutboundQueueVerdict, St as copyBundledNativeModules, T as deviceCapResolverLink, Tn as formatMeshQueue, Tt as buildNpmChildEnv, U as readMoleculerFanoutMode, Un as MAX_CAP_ACTIONS_PER_PEER, Ut as ZERO_LOOP_DELAY, V as LocalChildRegistry, Vn as CAP_ACTION_UNLABELLED, Vt as RUNNER_HEAP_WATCH_INTERVAL_MS, W as CapUsageRegistry, Wn as capActionLabel, Wt as buildHeapSample, X as UdsLocalTransportServer, Xn as diffEventPlane, Xt as nextRssBudgetState, Y as UdsLocalTransportClient, Yn as createEventPlaneReader, Yt as hubMainRssBudget, Z as SocketChannel, Zn as formatEventPlane, Zt as parseRssBudgetMb, _ as setNodeEventInterest, _n as selectReportedSpaces, _t as deserializeTypedArrays, a as adaptBrokerToCluster, an as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, b as createKernelHwAccel, bn as OUTBOUND_QUEUE_THRESHOLD_BYTES, bt as CapabilityHandle, c as getWorkerDeviceRegistry, cn as createInspectorArrayBufferCensus, d as setHubConnected, dn as DECISIVE_HEAP_SPACES, dt as NATIVE_PROVIDER_SERVICE_INFIX, en as startHeapWatch, et as FrameDecoder, f as EVENT_TOPIC_PREFIX, fn as HEAP_SPACE_REPORT_MIN_MB, ft as capActionName, g as registerEventBusService, gn as readHeapSpaces, gt as parseCapAction, h as getMoleculerEventStats, hn as heapSpaceField, ht as capServiceName, i as installManifestPythonDeps, in as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, it as createBrokerDeviceManagerApi, j as udsChildLogToWorkerEntry, jn as diffSocketPlane, jt as HEAP_RECLAIM_MIN_INTERVAL_MS, k as createUdsEventBridge, kn as createSocketPlaneMeter, kt as hostNodeIdOf, l as getOrInitReadinessRegistry, ln as formatArrayBufferCensus, lt as createAddonService, m as getBrokerEventBus, mn as formatHeapSpaces, mt as capBareAction, nn as strandedMb, nt as buildNativeCapProxy, o as createAddonContext, on as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, p as clusterEventTopic, pn as emitHeapDiagnosticReport, pt as capActionSuffix, q as getCapUsageRegistry, qn as EVENT_PLANE_TOP_N, qt as createV8Reclaimer, r as installManifestSystemDeps, rn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, rt as buildUdsNativeCapProxy, s as createUdsAddonContext, sn as createArrayBufferCensusGate, st as mountNativeCapService, t as CAP_METHOD_NOT_IMPLEMENTED, tn as startRunnerHeapWatch, tt as encodeFrame, u as getOrInitReadinessRegistryForClient, un as isArrayBufferCensusReport, ut as validateProviderRegistrations, v as subscribePassthrough, vn as OUTBOUND_QUEUE_COOLDOWN_MS, vt as serializeTypedArrays, w as buildLinkChain, wn as createMeshQueueReader, wt as resolveAddonClass, x as resolveHwAccel, xn as createOutboundQueueGate, xt as CapabilityUnavailableError, y as AddonDepsManager, yn as OUTBOUND_QUEUE_SUSTAIN_MS, yt as DeviceRegistry, z as classifyCapRoute, zn as socketDirectionMessages, zt as RSS_BUDGET_REANNOUNCE_MIN_MS } from "./child-cap-dispatch-BCJjUtXV.mjs";
-import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
+import { $ as CapUsageRegistry, $n as capActionLabel, $t as buildHeapSample, A as resolveHwAccel, An as createOutboundQueueGate, At as CapabilityUnavailableError, B as udsChildLogToWorkerEntry, Bn as diffSocketPlane, Bt as HEAP_RECLAIM_MIN_INTERVAL_MS, C as getBrokerEventBus, Cn as formatHeapSpaces, Ct as capBareAction, D as subscribePassthrough, Dn as OUTBOUND_QUEUE_COOLDOWN_MS, Dt as serializeTypedArrays, E as setNodeEventInterest, En as selectReportedSpaces, Et as deserializeTypedArrays, F as ipcParentLink, Fn as EMPTY_SOCKET_PLANE_BASELINE, Ft as resolveNpmInvocation, G as CapRouteResolver, Gn as recordSocketFrame, Gt as HUB_MAIN_HEAP_WATCH_LABEL, H as createUdsLoggerWithControl, Hn as readSocketQueues, Ht as HEAP_RECLAIM_TRIGGER_MB, I as localProviderLink, In as SOCKET_PLANE_TOP_N, It as runNpm, J as classifyCapRoute, Jn as socketDirectionMessages, Jt as RSS_BUDGET_REANNOUNCE_MIN_MS, K as callWithServiceDiscovery, Kn as sampleSocketDirection, Kt as HUB_MAIN_RSS_BUDGET_MB, L as createParentUnownedCallHandler, Ln as SOCKET_QUEUE_TOP_N, Lt as createAddonPeerBytesFacility, M as brokerTransportLink, Mn as MESH_QUEUE_TOP_N, Mt as installManifestNativeDeps, N as buildLinkChain, Nn as createMeshQueueReader, Nt as resolveAddonClass, O as AddonDepsManager, On as OUTBOUND_QUEUE_SUSTAIN_MS, Ot as DeviceRegistry, P as deviceCapResolverLink, Pn as formatMeshQueue, Pt as buildNpmChildEnv, Q as readMoleculerFanoutMode, Qn as MAX_CAP_ACTIONS_PER_PEER, Qt as ZERO_LOOP_DELAY, R as createUdsEventBridge, Rn as createSocketPlaneMeter, Rt as hostNodeIdOf, S as clusterEventTopic, Sn as emitHeapDiagnosticReport, St as capActionSuffix, T as registerEventBusService, Tn as readHeapSpaces, Tt as parseCapAction, U as AGENT_CAP_FWD_ACTION, Un as EMPTY_SOCKET_DIRECTION, Ut as HEAP_WATCH_INTERVAL_MS, V as createUdsLogger, Vn as formatSocketPlane, Vt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, W as AGENT_CAP_FWD_SERVICE, Wn as createSocketDirectionCounters, Wt as HEAP_WATCH_WARN_RATIO, X as LocalChildRegistry, Xn as CAP_ACTION_UNLABELLED, Xt as RUNNER_HEAP_WATCH_INTERVAL_MS, Y as LocalChildClient, Yn as CAP_ACTION_OVERFLOW_LABEL, Yt as RSS_BUDGET_RELEASE_RATIO, Z as UDS_NO_ROUTE_PREFIX, Zn as EMPTY_CAP_ACTION_READING, Zt as RUNNER_RSS_BUDGET_ENV, _ as getWorkerDeviceRegistry, _n as createInspectorArrayBufferCensus, a as reapProcessGroup, an as nextRssBudgetState, ar as diffEventPlane, at as UdsLocalTransportServer, b as setHubConnected, bn as DECISIVE_HEAP_SPACES, bt as NATIVE_PROVIDER_SERVICE_INFIX, c as runnerOwnsProcessGroup, cn as shouldReclaim, ct as localEndpointPath, d as summarizeMembers, dn as strandedMb, dt as buildNativeCapProxy, en as createDeferredHeapWatchSink, er as createCapActionCensus, et as PARENT_ROUTED_PROVIDER_ADDON_ID, f as installManifestSystemDeps, fn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ft as buildUdsNativeCapProxy, g as createUdsAddonContext, gn as createArrayBufferCensusGate, gt as mountNativeCapService, h as createAddonContext, hn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, in as hubMainRssBudget, ir as createEventPlaneReader, it as UdsLocalTransportClient, j as brokerCallForCap, jn as formatOutboundQueueVerdict, jt as copyBundledNativeModules, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_THRESHOLD_BYTES, kt as CapabilityHandle, l as signalAllRunnerGroups, ln as startHeapWatch, lt as FrameDecoder, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, nn as createV8Reclaimer, nr as EVENT_PLANE_TOP_N, nt as getCapUsageRegistry, o as registerRunnerGroup, on as parseRssBudgetMb, or as formatEventPlane, ot as SocketChannel, p as installManifestPythonDeps, pn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, pt as createBrokerDeviceManagerApi, q as CapRouteError, qn as socketDirectionBytes, qt as HUB_RSS_BUDGET_ENV, r as defaultProcessGroupOps, rn as describeRss, rr as createEventPlaneMeter, rt as createLocalTransport, s as releaseRunnerGroup, sn as reclaimIntervalMs, st as PeerAnsweredError, t as CAP_METHOD_NOT_IMPLEMENTED, tn as createLoopDelayMeter, tr as diffCapActionCensus, tt as __resetCapUsageRegistryForTests, un as startRunnerHeapWatch, ut as encodeFrame, v as getOrInitReadinessRegistry, vn as formatArrayBufferCensus, vt as createAddonService, w as getMoleculerEventStats, wn as heapSpaceField, wt as capServiceName, x as EVENT_TOPIC_PREFIX, xn as HEAP_SPACE_REPORT_MIN_MB, xt as capActionName, y as getOrInitReadinessRegistryForClient, yn as isArrayBufferCensusReport, yt as validateProviderRegistrations, z as createUdsEventBus, zn as createSocketPlaneReader, zt as createAddonDataPlaneFacility } from "./child-cap-dispatch-CHTiHbsv.mjs";
+import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B1v6E07R.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -95008,7 +95008,10 @@ var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
 function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parentUdsPath) {
 	const spawnFn = deps?.spawnFn ?? spawn;
+	const groupOps = deps?.processGroups ?? defaultProcessGroupOps;
+	const runnersOwnGroups = runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
 		const result = (runnerLocks.get(runnerId) ?? Promise.resolve()).then(fn, fn);
@@ -95048,6 +95051,49 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* One line per reap that found something, or that failed. An empty group is the
+	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
+	* which device a child served — the runner id is the finest attribution it has.
+	*/
+	function logGroupReap(runnerId, result) {
+		const found = result.membersAtExit;
+		const killed = result.killed ?? [];
+		const line = `[${runnerId}] runner group reaped {pgid=${result.pgid}, members=${found === null ? "unreadable" : found.length}${found !== null && found.length > 0 ? ` (${summarizeMembers(found)})` : ""}, sigkilled=${killed.length}${killed.length > 0 ? ` (${summarizeMembers(killed)})` : ""}${result.error !== null ? `, error=${result.error}` : ""}}`;
+		const logger = capturedBroker?.logger;
+		if (result.error !== null || killed.length > 0) if (logger) logger.warn(line);
+		else console.error(line);
+		else if ((found?.length ?? 0) > 0 || found === null) logger?.info(line);
+		else logger?.debug(line);
+	}
+	/**
+	* Reap a runner's process group (D668): SIGTERM, a bounded grace, SIGKILL for what
+	* remains. Memoized on the entry so the `exit` handler and a stop/restart that timed
+	* out waiting for that exit share one reap, and registered in `pendingGroupReaps` so
+	* the next spawn under the same id waits for it. Never rejects.
+	*/
+	function reapRunnerGroup(entry) {
+		if (entry.groupReap !== null) return entry.groupReap;
+		if (!entry.ownsGroup) {
+			entry.groupReap = Promise.resolve();
+			return entry.groupReap;
+		}
+		const reap = reapProcessGroup(entry.pid, groupOps).then((result) => logGroupReap(entry.name, result)).catch((err) => {
+			capturedBroker?.logger.error(`[${entry.name}] runner group reap threw: ${err instanceof Error ? err.message : String(err)}`);
+		}).finally(() => {
+			releaseRunnerGroup(entry.pid);
+			if (pendingGroupReaps.get(entry.name) === tracked) pendingGroupReaps.delete(entry.name);
+		});
+		const previous = pendingGroupReaps.get(entry.name);
+		const tracked = previous ? Promise.all([previous, reap]).then(() => void 0) : reap;
+		pendingGroupReaps.set(entry.name, tracked);
+		entry.groupReap = reap;
+		return reap;
+	}
+	/** Resolves once every reap started for `runnerId` has finished. */
+	async function awaitPredecessorReap(runnerId) {
+		await pendingGroupReaps.get(runnerId);
+	}
+	/**
 	* Spawn ONE runner subprocess (`addon-runner.js`) that hosts the
 	* `addons` set sharing a single Moleculer broker. The normal case is
 	* a size-1 `addons` array — one addon, one process; the media group
@@ -95096,8 +95142,9 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				"pipe",
 				"pipe"
 			],
-			detached: false
+			detached: runnersOwnGroups
 		});
+		const ownsGroup = runnersOwnGroups && typeof child.pid === "number" && child.pid > 1;
 		const entry = {
 			pid: child.pid,
 			nodeId,
@@ -95108,16 +95155,23 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
-			child
+			child,
+			ownsGroup,
+			groupReap: null
 		};
+		if (ownsGroup) registerRunnerGroup(entry.pid, {
+			runnerId,
+			kill: groupOps.kill
+		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`)) entry.state = "running";
+			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
 		});
 		child.on("exit", (code, signal) => {
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
+			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
 			entry.state = "crashed";
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
@@ -95156,6 +95210,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
+					await groupReap;
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -95168,10 +95223,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	return {
 		name: "$process",
 		actions: {
-			spawnRunner: { handler(ctx) {
+			spawnRunner: { async handler(ctx) {
 				const { runnerId, addons, env } = ctx.params;
 				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				if (!Array.isArray(addons) || addons.length === 0) throw new Error(`spawnRunner requires non-empty addons array`);
+				await awaitPredecessorReap(runnerId);
+				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				invalidateHeapProfiles(addons);
 				const entry = spawnRunner(runnerId, addons, env);
 				return {
@@ -95208,6 +95265,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95244,6 +95302,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95303,6 +95362,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 								});
 							});
 						}
+						await reapRunnerGroup(entry);
 						processes.delete(name);
 						crashSupervisor.reset(name);
 						invalidateHeapProfiles(runnerAddons);
@@ -95353,19 +95413,28 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		started() {
 			capturedBroker = this.broker;
 		},
-		stopped() {
-			const survivors = [];
-			for (const entry of processes.values()) {
+		async stopped() {
+			const entries = [...processes.values()];
+			await Promise.all(entries.map(async (entry) => {
 				entry.state = "stopped";
-				entry.child.kill("SIGTERM");
-				survivors.push(entry);
-			}
-			setTimeout(() => {
-				for (const entry of survivors) if (entry.child.exitCode === null && entry.child.signalCode === null) {
-					capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
-					entry.child.kill("SIGKILL");
+				if (!(entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+					entry.child.kill("SIGTERM");
+					await new Promise((resolve) => {
+						const timer = setTimeout(() => {
+							if (entry.child.exitCode === null && entry.child.signalCode === null) {
+								capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
+								entry.child.kill("SIGKILL");
+							}
+							resolve();
+						}, 3e3);
+						entry.child.once("exit", () => {
+							clearTimeout(timer);
+							resolve();
+						});
+					});
 				}
-			}, 3e3).unref();
+				await reapRunnerGroup(entry);
+			}));
 			processes.clear();
 			capturedBroker = null;
 		}
@@ -95849,4 +95918,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -73,6 +73,7 @@ export { localProviderLink, brokerTransportLink, deviceCapResolverLink, ipcParen
 export type { LocalProviderResolver, BrokerCapCallOpts } from './moleculer/trpc-links.js';
 export { createProcessService } from './moleculer/process-service.js';
 export type { ProcessInfo } from './moleculer/process-service.js';
+export { signalAllRunnerGroups } from './moleculer/runner-process-group.js';
 export { CapUsageRegistry, getCapUsageRegistry, PARENT_ROUTED_PROVIDER_ADDON_ID, __resetCapUsageRegistryForTests, } from './moleculer/cap-usage-registry.js';
 export type { CapUsageCallRecord, CapUsageEdge, CapUsageRegistryOptions, CapUsageStats, } from './moleculer/cap-usage-registry.js';
 export { createScopedProcessManager } from './moleculer/process-context.js';

package/dist/kernel/moleculer/process-service.d.ts

@@ -1,5 +1,6 @@
 import { ChildProcess, SpawnOptions } from 'node:child_process';
 import { ServiceSchema } from 'moleculer';
+import { ProcessGroupOps } from './runner-process-group.js';
 /** One addon hosted inside a runner subprocess. */
 interface RunnerAddonSpec {
     readonly addonId: string;
@@ -137,6 +138,10 @@ interface SpawnedProcess {
      */
     state: 'starting' | 'running' | 'stopping' | 'stopped' | 'crashed' | 'failed';
     child: ChildProcess;
+    /** The runner leads its own process group (POSIX, D668); its pgid is its `pid`. */
+    readonly ownsGroup: boolean;
+    /** The reap of this runner's group, once started. Memoized: every exit path shares it. */
+    groupReap: Promise<void> | null;
 }
 interface ProcessInfo {
     readonly pid: number;
@@ -174,6 +179,10 @@ interface ProcessInfo {
 type SpawnFn = (command: string, args: readonly string[], opts: SpawnOptions) => ChildProcess;
 interface ProcessServiceDeps {
     readonly spawnFn?: SpawnFn;
+    /** Group signalling + member listing. Tests inject a fake: a fake pid must never be signalled. */
+    readonly processGroups?: ProcessGroupOps;
+    /** Platform deciding whether a runner leads a process group. Defaults to `process.platform`. */
+    readonly platform?: NodeJS.Platform;
 }
 declare function createProcessService(parentNodeId: string, dataDir: string, deps?: ProcessServiceDeps, parentTcpPort?: number, parentUdsPath?: string): ServiceSchema;
 export type { ProcessInfo, SpawnedProcess };

package/dist/kernel/moleculer/runner-process-group.d.ts

@@ -0,0 +1,92 @@
+/** SIGTERM → SIGKILL grace for a runner's group, in ms. ffmpeg finalises a segment well inside it. */
+export declare const RUNNER_GROUP_REAP_GRACE_MS = 2000;
+/** Whether a runner is spawned as a process-group leader on this platform. */
+export declare function runnerOwnsProcessGroup(platform?: NodeJS.Platform): boolean;
+/** One live (non-zombie) member of a process group. */
+export interface GroupMember {
+    readonly pid: number;
+    /** Executable name (`ffmpeg`, `llama-server`, …). */
+    readonly command: string;
+}
+/**
+ * The OS surface a group reap needs. Injectable so a unit test never signals a real pid:
+ * the fake-spawn suites hand out pids like 70001, and a `kill(-70001)` on a developer's
+ * machine is not a test.
+ */
+export interface ProcessGroupOps {
+    /** `process.kill`. A negative pid addresses a group; signal 0 probes. Throws ESRCH when empty. */
+    readonly kill: (pid: number, signal: NodeJS.Signals | 0) => void;
+    /** Live members of `pgid`, or `null` when the table could not be read. */
+    readonly listMembers: (pgid: number) => Promise<readonly GroupMember[] | null>;
+    readonly sleep: (ms: number) => Promise<void>;
+    readonly graceMs: number;
+}
+/** What one reap did. `membersAtExit === null` means the table was unreadable, not empty. */
+export interface GroupReapResult {
+    readonly pgid: number;
+    readonly membersAtExit: readonly GroupMember[] | null;
+    /** Members still present after the grace, which were sent SIGKILL. */
+    readonly killed: readonly GroupMember[] | null;
+    /** The group was already empty when the reap began — the normal case after a clean stop. */
+    readonly alreadyEmpty: boolean;
+    /** A signal the OS refused for a reason other than ESRCH (EPERM). */
+    readonly error: string | null;
+}
+/**
+ * SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
+ *
+ * pid reuse: POSIX never hands out a pid while a process group with that id exists, so
+ * the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
+ * still populated at the end of the grace, which is the same group; the residual window
+ * (group empties, the pid wraps around AND is reused as a new group leader, all inside
+ * the grace) is not reachable in practice.
+ */
+export declare function reapProcessGroup(pgid: number, ops: ProcessGroupOps): Promise<GroupReapResult>;
+/** `ffmpeg×28 llama-server×1` — what a reap line says it removed. */
+export declare function summarizeMembers(members: readonly GroupMember[]): string;
+/** Parse `ps -A -o pid=,pgid=,stat=,comm=` for one group, zombies excluded. */
+export declare function parsePsGroupMembers(stdout: string, pgid: number): readonly GroupMember[];
+/** Live members of `pgid`: `/proc` on Linux, `ps` elsewhere; `null` when neither answers. */
+export declare function listProcessGroupMembers(pgid: number, platform?: NodeJS.Platform): Promise<readonly GroupMember[] | null>;
+export declare const defaultProcessGroupOps: ProcessGroupOps;
+interface OwnedGroup {
+    readonly runnerId: string;
+    readonly kill: ProcessGroupOps['kill'];
+}
+export declare function registerRunnerGroup(pgid: number, group: OwnedGroup): void;
+export declare function releaseRunnerGroup(pgid: number): void;
+/**
+ * Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
+ * handler calls it: before D668 the runners were in hub-main's own group and its
+ * `kill -- -<pid>` reached them and their children; now each is its own group.
+ * Returns how many groups were signalled.
+ */
+export declare function signalAllRunnerGroups(signal: NodeJS.Signals): number;
+/** Test seam: the groups currently owned, by pgid. */
+export declare function ownedRunnerGroupIds(): readonly number[];
+export interface RunnerParentDeathWatchdogOptions {
+    readonly initialPpid?: number;
+    readonly readPpid?: () => number;
+    readonly intervalMs?: number;
+}
+/**
+ * Arm the runner's parent-death watchdog before addon code starts loading.
+ *
+ * A parent can die while an addon module or `initialize()` is still pending, so
+ * installing this only after READY leaves exactly the boot window where a detached
+ * runner can become an orphan. Any PPID change means the direct parent died and the
+ * kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
+ */
+export declare function startRunnerParentDeathWatchdog(onParentDeath: () => void, options?: RunnerParentDeathWatchdogOptions): NodeJS.Timeout | null;
+/**
+ * Last resort for a detached runner whose direct parent disappeared without an
+ * `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
+ * one SIGKILL removes the runner and every descendant in that group atomically.
+ *
+ * Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
+ * returns ESRCH: while this pid exists, no unrelated process group can have the
+ * same id. That makes the failed call a safe compatibility fallback for an older
+ * parent that did not spawn the runner detached.
+ */
+export declare function killOwnRunnerGroupAfterParentLoss(platform?: NodeJS.Platform, kill?: ProcessGroupOps['kill']): boolean;
+export {};