@camstack/system 1.2.311 → 1.2.313

package/dist/{child-cap-dispatch-Be8e2cBP.js → child-cap-dispatch-Dyn_7ezH.js}

@@ -1,4 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
+const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-DmHNjbB0.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -3210,7 +3211,7 @@ function createAddonPeerBytesFacility(args) {
 * Failures THROW with an actionable message — a caller must never proceed as
 * if dependencies were installed when they were not.
 */
-var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 /** Where the bootstrap lands inside `cacheDir` (npm tgz carries a `package/` prefix). */
 function bootstrappedCliPath(cacheDir) {
@@ -3218,7 +3219,7 @@ function bootstrappedCliPath(cacheDir) {
 }
 async function defaultProbeSystemNpm() {
 	try {
-		await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
+		await execFileAsync$3("npm", ["--version"], { timeout: 15e3 });
 		return true;
 	} catch {
 		return false;
@@ -3236,7 +3237,7 @@ async function defaultDownloadTarball(url, destTgz) {
 	await node_fs.promises.writeFile(destTgz, bytes);
 }
 async function defaultExtractTarball(tgzPath, destDir) {
-	await execFileAsync$2("tar", [
+	await execFileAsync$3("tar", [
 		"-xzf",
 		tgzPath,
 		"-C",
@@ -3307,7 +3308,7 @@ async function runNpm(args, options) {
 		registry: options.registry,
 		logger: options.logger
 	});
-	return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
+	return execFileAsync$3(invocation.command, [...invocation.argsPrefix, ...args], {
 		...options.cwd !== void 0 ? { cwd: options.cwd } : {},
 		timeout: options.timeout ?? 3e5,
 		env: buildNpmChildEnv(options.env ?? process.env, process.execPath)
@@ -3388,7 +3389,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/deps/manifest-native-deps.ts
-var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Fallback bootstrap-cache location when the caller doesn't thread one
 * through (the forked addon-runner's spawn-time install). tmpdir survives the
@@ -3697,7 +3698,7 @@ async function rebuildNativeDeps(addonDir, packageNames, logger, npmCacheDir, re
 				return;
 			}
 			logger.warn("@electron/rebuild not available — falling back to npx", { meta: { addonDir } });
-			await execFileAsync$1("npx", [
+			await execFileAsync$2("npx", [
 				"--yes",
 				"electron-rebuild",
 				"-m",
@@ -12119,7 +12120,7 @@ function requestPrivilegedInstall(req, socketPath = pkgdSocketPath(), timeoutMs
 * the failure it precedes ("smbclient: ENOENT") arrives minutes later in a
 * different addon's logs.
 */
-var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /** How long a single package-manager invocation may take. */
 var INSTALL_TIMEOUT_MS = 300 * 1e3;
 /** How long the `command -v <binary>` presence probe may take. */
@@ -12281,7 +12282,7 @@ function planFor(manager, packageName) {
 }
 async function defaultHasBinary(binary) {
 	try {
-		await execFileAsync("command", ["-v", binary], {
+		await execFileAsync$1("command", ["-v", binary], {
 			timeout: PROBE_TIMEOUT_MS,
 			shell: process.platform === "win32" ? false : "/bin/sh"
 		});
@@ -12301,7 +12302,290 @@ async function defaultDetectManager() {
 	return null;
 }
 async function defaultRun(command, args) {
-	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+	await execFileAsync$1(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+}
+//#endregion
+//#region src/kernel/moleculer/runner-process-group.ts
+/**
+* A runner OWNS a process group, and the kernel reaps it on every runner exit (D668).
+*
+* ## Why
+*
+* An addon-runner spawns long-lived children: recorder ffmpeg writers, stream-broker
+* ffmpeg, llama-server, tailscaled, cloudflared, HAP ffmpeg. Their only kill was the
+* addon's own graceful `stop()`, which a runner that dies of SIGABRT (V8 OOM), SIGKILL
+* or a native crash never runs. ffmpeg ignores SIGPIPE and does not quit on stdin EOF,
+* so a dead reader does not stop it either. On 2026-09-28 at 10:21 CEST the hub's
+* recorder runner aborted; 28 ffmpeg writers survived as orphans and kept writing into
+* the SAME staging directories the respawned runner's 28 new writers used — 13 minutes
+* of dual writers on every camera, until they were killed by hand.
+*
+* Runners were spawned `detached: false`, i.e. inside hub-main's own group, so there
+* was no handle meaning "this runner and everything under it". Now every runner is
+* spawned `detached: true` on POSIX, which makes it a SESSION and group leader
+* (`setsid`): pgid === runner pid, and every descendant that does not itself call
+* `setsid`/`setpgid` inherits that group. A process group outlives its leader, so
+* `kill(-pgid)` still reaches the orphans after the runner is gone — which is exactly
+* the moment it matters.
+*
+* ## What `detached` does NOT change
+*
+* - The child stays REF'd: nothing calls `unref()`, so the parent still waits on it,
+*   still gets its `exit`, still reads its stdout/stderr pipes.
+* - `process.ppid` is unchanged, so the runner can detect a lost parent before or
+*   after READY and hard-stop its own group.
+* - UDS/stdio wiring is fd-based and independent of the session.
+*
+* What it DOES change: the runner is no longer in hub-main's group, so a signal sent to
+* hub-main's group (`kill -- -<pid>` in `server/backend/src/main.ts`, a terminal Ctrl+C)
+* no longer reaches runners by itself. `signalAllRunnerGroups` is the replacement, and
+* the process `exit` backstop below hard-stops any groups a hub/agent still owns.
+*
+* ## Out of scope, deliberately
+*
+* - Windows has no process groups in this sense; nothing here runs on `win32` and the
+*   runner is spawned exactly as before.
+* - A descendant that calls `setsid`/`setpgid` itself (or is spawned `detached: true`
+*   by an addon) leaves the group and is NOT reaped. No shipped addon does; one that
+*   needs to must own its child's lifetime some other way.
+* - The kernel knows the runner id, not which device a child served. Per-device
+*   attribution is the addon's (the recorder's own foreign-writer reap, D667).
+*/
+var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+/** SIGTERM → SIGKILL grace for a runner's group, in ms. ffmpeg finalises a segment well inside it. */
+var RUNNER_GROUP_REAP_GRACE_MS = 2e3;
+/** How often the group is probed for emptiness during the grace. */
+var GROUP_PROBE_INTERVAL_MS = 100;
+/** Whether a runner is spawned as a process-group leader on this platform. */
+function runnerOwnsProcessGroup(platform = process.platform) {
+	return platform !== "win32";
+}
+function errnoOf(err) {
+	if (typeof err !== "object" || err === null) return void 0;
+	const code = Reflect.get(err, "code");
+	return typeof code === "string" ? code : void 0;
+}
+function signalGroup(ops, pgid, signal) {
+	try {
+		ops.kill(-pgid, signal);
+		return "delivered";
+	} catch (err) {
+		if (errnoOf(err) === "ESRCH") return "empty";
+		return { error: `${errnoOf(err) ?? "unknown"}: ${err instanceof Error ? err.message : String(err)}` };
+	}
+}
+function signalPid(ops, pid) {
+	try {
+		ops.kill(pid, 0);
+		return "delivered";
+	} catch (err) {
+		return errnoOf(err) === "ESRCH" ? "empty" : { error: errnoOf(err) ?? "unknown" };
+	}
+}
+/**
+* A pgid this module may address. `kill(-1)` signals every process the caller may
+* signal and `kill(-0)` is the caller's OWN group — both are catastrophes, not reaps.
+*/
+function isAddressableGroup(pgid) {
+	return Number.isInteger(pgid) && pgid > 1 && pgid !== process.pid;
+}
+/**
+* SIGTERM the whole group, wait up to `graceMs` for it to empty, SIGKILL what is left.
+*
+* pid reuse: POSIX never hands out a pid while a process group with that id exists, so
+* the SIGTERM always lands on our group. The SIGKILL is sent only when the group is
+* still populated at the end of the grace, which is the same group; the residual window
+* (group empties, the pid wraps around AND is reused as a new group leader, all inside
+* the grace) is not reachable in practice.
+*/
+async function reapProcessGroup(pgid, ops) {
+	if (!isAddressableGroup(pgid)) return {
+		pgid,
+		membersAtExit: null,
+		killed: null,
+		alreadyEmpty: true,
+		error: `refused pgid ${pgid}`
+	};
+	const membersAtExit = await ops.listMembers(pgid);
+	const term = signalGroup(ops, pgid, "SIGTERM");
+	if (term === "empty") return {
+		pgid,
+		membersAtExit,
+		killed: [],
+		alreadyEmpty: true,
+		error: null
+	};
+	if (typeof term === "object") return {
+		pgid,
+		membersAtExit,
+		killed: null,
+		alreadyEmpty: false,
+		error: term.error
+	};
+	for (let waited = 0; waited < ops.graceMs; waited += GROUP_PROBE_INTERVAL_MS) {
+		await ops.sleep(Math.min(GROUP_PROBE_INTERVAL_MS, ops.graceMs - waited));
+		if (signalGroup(ops, pgid, 0) === "empty") return {
+			pgid,
+			membersAtExit,
+			killed: [],
+			alreadyEmpty: false,
+			error: null
+		};
+	}
+	const survivors = membersAtExit === null ? null : membersAtExit.filter((m) => signalPid(ops, m.pid) === "delivered");
+	const kill = signalGroup(ops, pgid, "SIGKILL");
+	return {
+		pgid,
+		membersAtExit,
+		killed: kill === "empty" ? [] : survivors,
+		alreadyEmpty: false,
+		error: typeof kill === "object" ? kill.error : null
+	};
+}
+/** `ffmpeg×28 llama-server×1` — what a reap line says it removed. */
+function summarizeMembers(members) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const m of members) counts.set(m.command, (counts.get(m.command) ?? 0) + 1);
+	return [...counts.entries()].map(([command, n]) => `${command}×${n}`).join(" ");
+}
+async function listMembersFromProc(pgid, reader) {
+	const pids = await reader.listPids();
+	return (await Promise.all(pids.map(async (pid) => {
+		try {
+			return require_proc_stat.parseProcStat(await reader.readStat(pid));
+		} catch {
+			return null;
+		}
+	}))).flatMap((row) => row !== null && row.pgid === pgid && row.state !== "Z" ? [{
+		pid: row.pid,
+		command: row.comm
+	}] : []);
+}
+var PS_GROUP_ROW_RE = /^(\d+)\s+(\d+)\s+(\S+)\s+(.+)$/;
+/** Parse `ps -A -o pid=,pgid=,stat=,comm=` for one group, zombies excluded. */
+function parsePsGroupMembers(stdout, pgid) {
+	const members = [];
+	for (const line of stdout.split("\n")) {
+		const match = line.trim().match(PS_GROUP_ROW_RE);
+		if (!match) continue;
+		const [, pidS, pgidS, stat = "", comm = ""] = match;
+		if (Number(pgidS) !== pgid || stat.startsWith("Z")) continue;
+		const command = comm.trim();
+		members.push({
+			pid: Number(pidS),
+			command: command.slice(command.lastIndexOf("/") + 1)
+		});
+	}
+	return members;
+}
+async function listMembersFromPs(pgid) {
+	const { stdout } = await execFileAsync("ps", [
+		"-A",
+		"-o",
+		"pid=,pgid=,stat=,comm="
+	], {
+		timeout: 3e3,
+		maxBuffer: 8 * 1024 * 1024
+	});
+	return parsePsGroupMembers(stdout, pgid);
+}
+/** Live members of `pgid`: `/proc` on Linux, `ps` elsewhere; `null` when neither answers. */
+async function listProcessGroupMembers(pgid, platform = process.platform) {
+	try {
+		return platform === "linux" ? await listMembersFromProc(pgid, require_proc_stat.nodeProcReader) : await listMembersFromPs(pgid);
+	} catch {
+		return null;
+	}
+}
+var defaultProcessGroupOps = {
+	kill: (pid, signal) => {
+		process.kill(pid, signal);
+	},
+	listMembers: (pgid) => listProcessGroupMembers(pgid),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	graceMs: RUNNER_GROUP_REAP_GRACE_MS
+};
+/**
+* Every runner group this process leads and has not finished reaping. Process-wide on
+* purpose: `process.on('exit')` and hub-main's signal handler must reach the groups of
+* every `$process` service in the process, and neither holds a service reference.
+*/
+var ownedGroups = /* @__PURE__ */ new Map();
+var exitBackstopInstalled = false;
+function installExitBackstop() {
+	if (exitBackstopInstalled) return;
+	exitBackstopInstalled = true;
+	process.on("exit", () => {
+		for (const [pgid, group] of ownedGroups) try {
+			group.kill(-pgid, "SIGKILL");
+		} catch {}
+	});
+}
+function registerRunnerGroup(pgid, group) {
+	if (!isAddressableGroup(pgid)) return;
+	ownedGroups.set(pgid, group);
+	installExitBackstop();
+}
+function releaseRunnerGroup(pgid) {
+	ownedGroups.delete(pgid);
+}
+/**
+* Signal every runner group this process owns, synchronously. Hub-main's SIGTERM/SIGINT
+* handler calls it: before D668 the runners were in hub-main's own group and its
+* `kill -- -<pid>` reached them and their children; now each is its own group.
+* Returns how many groups were signalled.
+*/
+function signalAllRunnerGroups(signal) {
+	let signalled = 0;
+	for (const [pgid, group] of ownedGroups) try {
+		group.kill(-pgid, signal);
+		signalled += 1;
+	} catch {}
+	return signalled;
+}
+/**
+* Arm the runner's parent-death watchdog before addon code starts loading.
+*
+* A parent can die while an addon module or `initialize()` is still pending, so
+* installing this only after READY leaves exactly the boot window where a detached
+* runner can become an orphan. Any PPID change means the direct parent died and the
+* kernel reparented us; checking for a change also covers a non-PID-1 subreaper.
+*/
+function startRunnerParentDeathWatchdog(onParentDeath, options = {}) {
+	const initialPpid = options.initialPpid ?? process.ppid;
+	if (!Number.isInteger(initialPpid) || initialPpid <= 1) return null;
+	const readPpid = options.readPpid ?? (() => process.ppid);
+	const intervalMs = options.intervalMs ?? 5e3;
+	let fired = false;
+	const timer = setInterval(() => {
+		if (fired || readPpid() === initialPpid) return;
+		fired = true;
+		clearInterval(timer);
+		onParentDeath();
+	}, intervalMs);
+	return timer;
+}
+/**
+* Last resort for a detached runner whose direct parent disappeared without an
+* `exit` hook (SIGKILL, native crash). The runner's own pid is also its pgid, so
+* one SIGKILL removes the runner and every descendant in that group atomically.
+*
+* Calling `kill(-process.pid, ...)` from an ordinary, non-group-leading process
+* returns ESRCH: while this pid exists, no unrelated process group can have the
+* same id. That makes the failed call a safe compatibility fallback for an older
+* parent that did not spawn the runner detached.
+*/
+function killOwnRunnerGroupAfterParentLoss(platform = process.platform, kill = (target, signal) => {
+	process.kill(target, signal);
+}) {
+	const pid = process.pid;
+	if (!runnerOwnsProcessGroup(platform) || !Number.isInteger(pid) || pid <= 1) return false;
+	try {
+		kill(-pid, "SIGKILL");
+		return true;
+	} catch {
+		return false;
+	}
 }
 //#endregion
 //#region src/kernel/moleculer/child-cap-dispatch.ts
@@ -12942,6 +13226,12 @@ Object.defineProperty(exports, "createV8Reclaimer", {
 		return createV8Reclaimer;
 	}
 });
+Object.defineProperty(exports, "defaultProcessGroupOps", {
+	enumerable: true,
+	get: function() {
+		return defaultProcessGroupOps;
+	}
+});
 Object.defineProperty(exports, "describeRss", {
 	enumerable: true,
 	get: function() {
@@ -13122,6 +13412,12 @@ Object.defineProperty(exports, "isArrayBufferCensusReport", {
 		return isArrayBufferCensusReport;
 	}
 });
+Object.defineProperty(exports, "killOwnRunnerGroupAfterParentLoss", {
+	enumerable: true,
+	get: function() {
+		return killOwnRunnerGroupAfterParentLoss;
+	}
+});
 Object.defineProperty(exports, "localEndpointPath", {
 	enumerable: true,
 	get: function() {
@@ -13176,6 +13472,12 @@ Object.defineProperty(exports, "readSocketQueues", {
 		return readSocketQueues;
 	}
 });
+Object.defineProperty(exports, "reapProcessGroup", {
+	enumerable: true,
+	get: function() {
+		return reapProcessGroup;
+	}
+});
 Object.defineProperty(exports, "reclaimIntervalMs", {
 	enumerable: true,
 	get: function() {
@@ -13194,6 +13496,18 @@ Object.defineProperty(exports, "registerEventBusService", {
 		return registerEventBusService;
 	}
 });
+Object.defineProperty(exports, "registerRunnerGroup", {
+	enumerable: true,
+	get: function() {
+		return registerRunnerGroup;
+	}
+});
+Object.defineProperty(exports, "releaseRunnerGroup", {
+	enumerable: true,
+	get: function() {
+		return releaseRunnerGroup;
+	}
+});
 Object.defineProperty(exports, "resolveAddonClass", {
 	enumerable: true,
 	get: function() {
@@ -13218,6 +13532,12 @@ Object.defineProperty(exports, "runNpm", {
 		return runNpm;
 	}
 });
+Object.defineProperty(exports, "runnerOwnsProcessGroup", {
+	enumerable: true,
+	get: function() {
+		return runnerOwnsProcessGroup;
+	}
+});
 Object.defineProperty(exports, "sampleSocketDirection", {
 	enumerable: true,
 	get: function() {
@@ -13260,6 +13580,12 @@ Object.defineProperty(exports, "shouldReclaim", {
 		return shouldReclaim;
 	}
 });
+Object.defineProperty(exports, "signalAllRunnerGroups", {
+	enumerable: true,
+	get: function() {
+		return signalAllRunnerGroups;
+	}
+});
 Object.defineProperty(exports, "socketDirectionBytes", {
 	enumerable: true,
 	get: function() {
@@ -13284,6 +13610,12 @@ Object.defineProperty(exports, "startRunnerHeapWatch", {
 		return startRunnerHeapWatch;
 	}
 });
+Object.defineProperty(exports, "startRunnerParentDeathWatchdog", {
+	enumerable: true,
+	get: function() {
+		return startRunnerParentDeathWatchdog;
+	}
+});
 Object.defineProperty(exports, "strandedMb", {
 	enumerable: true,
 	get: function() {
@@ -13296,6 +13628,12 @@ Object.defineProperty(exports, "subscribePassthrough", {
 		return subscribePassthrough;
 	}
 });
+Object.defineProperty(exports, "summarizeMembers", {
+	enumerable: true,
+	get: function() {
+		return summarizeMembers;
+	}
+});
 Object.defineProperty(exports, "udsChildLogToWorkerEntry", {
 	enumerable: true,
 	get: function() {

package/dist/index.js

@@ -29,8 +29,8 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-D_wUeOTD.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-Be8e2cBP.js");
-const require_resource_monitor = require("./resource-monitor-LVE1BoLs.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-Dyn_7ezH.js");
+const require_resource_monitor = require("./resource-monitor-DzNn_IZK.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -95015,7 +95015,10 @@ var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
 function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parentUdsPath) {
 	const spawnFn = deps?.spawnFn ?? node_child_process.spawn;
+	const groupOps = deps?.processGroups ?? require_child_cap_dispatch.defaultProcessGroupOps;
+	const runnersOwnGroups = require_child_cap_dispatch.runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
 		const result = (runnerLocks.get(runnerId) ?? Promise.resolve()).then(fn, fn);
@@ -95055,6 +95058,49 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* One line per reap that found something, or that failed. An empty group is the
+	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
+	* which device a child served — the runner id is the finest attribution it has.
+	*/
+	function logGroupReap(runnerId, result) {
+		const found = result.membersAtExit;
+		const killed = result.killed ?? [];
+		const line = `[${runnerId}] runner group reaped {pgid=${result.pgid}, members=${found === null ? "unreadable" : found.length}${found !== null && found.length > 0 ? ` (${require_child_cap_dispatch.summarizeMembers(found)})` : ""}, sigkilled=${killed.length}${killed.length > 0 ? ` (${require_child_cap_dispatch.summarizeMembers(killed)})` : ""}${result.error !== null ? `, error=${result.error}` : ""}}`;
+		const logger = capturedBroker?.logger;
+		if (result.error !== null || killed.length > 0) if (logger) logger.warn(line);
+		else console.error(line);
+		else if ((found?.length ?? 0) > 0 || found === null) logger?.info(line);
+		else logger?.debug(line);
+	}
+	/**
+	* Reap a runner's process group (D668): SIGTERM, a bounded grace, SIGKILL for what
+	* remains. Memoized on the entry so the `exit` handler and a stop/restart that timed
+	* out waiting for that exit share one reap, and registered in `pendingGroupReaps` so
+	* the next spawn under the same id waits for it. Never rejects.
+	*/
+	function reapRunnerGroup(entry) {
+		if (entry.groupReap !== null) return entry.groupReap;
+		if (!entry.ownsGroup) {
+			entry.groupReap = Promise.resolve();
+			return entry.groupReap;
+		}
+		const reap = require_child_cap_dispatch.reapProcessGroup(entry.pid, groupOps).then((result) => logGroupReap(entry.name, result)).catch((err) => {
+			capturedBroker?.logger.error(`[${entry.name}] runner group reap threw: ${err instanceof Error ? err.message : String(err)}`);
+		}).finally(() => {
+			require_child_cap_dispatch.releaseRunnerGroup(entry.pid);
+			if (pendingGroupReaps.get(entry.name) === tracked) pendingGroupReaps.delete(entry.name);
+		});
+		const previous = pendingGroupReaps.get(entry.name);
+		const tracked = previous ? Promise.all([previous, reap]).then(() => void 0) : reap;
+		pendingGroupReaps.set(entry.name, tracked);
+		entry.groupReap = reap;
+		return reap;
+	}
+	/** Resolves once every reap started for `runnerId` has finished. */
+	async function awaitPredecessorReap(runnerId) {
+		await pendingGroupReaps.get(runnerId);
+	}
+	/**
 	* Spawn ONE runner subprocess (`addon-runner.js`) that hosts the
 	* `addons` set sharing a single Moleculer broker. The normal case is
 	* a size-1 `addons` array — one addon, one process; the media group
@@ -95103,8 +95149,9 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				"pipe",
 				"pipe"
 			],
-			detached: false
+			detached: runnersOwnGroups
 		});
+		const ownsGroup = runnersOwnGroups && typeof child.pid === "number" && child.pid > 1;
 		const entry = {
 			pid: child.pid,
 			nodeId,
@@ -95115,16 +95162,23 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
-			child
+			child,
+			ownsGroup,
+			groupReap: null
 		};
+		if (ownsGroup) require_child_cap_dispatch.registerRunnerGroup(entry.pid, {
+			runnerId,
+			kill: groupOps.kill
+		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`)) entry.state = "running";
+			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
 		});
 		child.on("exit", (code, signal) => {
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
+			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
 			entry.state = "crashed";
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
@@ -95163,6 +95217,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
+					await groupReap;
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -95175,10 +95230,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	return {
 		name: "$process",
 		actions: {
-			spawnRunner: { handler(ctx) {
+			spawnRunner: { async handler(ctx) {
 				const { runnerId, addons, env } = ctx.params;
 				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				if (!Array.isArray(addons) || addons.length === 0) throw new Error(`spawnRunner requires non-empty addons array`);
+				await awaitPredecessorReap(runnerId);
+				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				invalidateHeapProfiles(addons);
 				const entry = spawnRunner(runnerId, addons, env);
 				return {
@@ -95215,6 +95272,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95251,6 +95309,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 							});
 						});
 					}
+					await reapRunnerGroup(target);
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
@@ -95310,6 +95369,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 								});
 							});
 						}
+						await reapRunnerGroup(entry);
 						processes.delete(name);
 						crashSupervisor.reset(name);
 						invalidateHeapProfiles(runnerAddons);
@@ -95360,19 +95420,28 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		started() {
 			capturedBroker = this.broker;
 		},
-		stopped() {
-			const survivors = [];
-			for (const entry of processes.values()) {
+		async stopped() {
+			const entries = [...processes.values()];
+			await Promise.all(entries.map(async (entry) => {
 				entry.state = "stopped";
-				entry.child.kill("SIGTERM");
-				survivors.push(entry);
-			}
-			setTimeout(() => {
-				for (const entry of survivors) if (entry.child.exitCode === null && entry.child.signalCode === null) {
-					capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
-					entry.child.kill("SIGKILL");
+				if (!(entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+					entry.child.kill("SIGTERM");
+					await new Promise((resolve) => {
+						const timer = setTimeout(() => {
+							if (entry.child.exitCode === null && entry.child.signalCode === null) {
+								capturedBroker?.logger.warn(`[${entry.name}] Did not exit on SIGTERM — sending SIGKILL`);
+								entry.child.kill("SIGKILL");
+							}
+							resolve();
+						}, 3e3);
+						entry.child.once("exit", () => {
+							clearTimeout(timer);
+							resolve();
+						});
+					});
 				}
-			}, 3e3).unref();
+				await reapRunnerGroup(entry);
+			}));
 			processes.clear();
 			capturedBroker = null;
 		}
@@ -96259,6 +96328,7 @@ exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
+exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
 exports.socketDirectionBytes = require_child_cap_dispatch.socketDirectionBytes;
 exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMessages;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;