@camstack/system 1.2.354 → 1.2.355

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DePB7uwU.js");
+const require_dist = require("./dist-BWicEEVA.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -31,7 +31,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-CRqYKHAb.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CqV-7-QZ.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -3237,8 +3237,7 @@ async function copyDirRecursive(src, dest) {
 * `addons/` stays node_modules-free, which is what lets the backup tar the whole
 * folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
 * un-bundleable runtime dep declares it explicitly in
-* `camstack.runtimeDependencies`; the debug escape hatch
-* `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+* `camstack.runtimeDependencies`.
 *
 * (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
 * per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
@@ -3269,13 +3268,9 @@ function readRuntimeDependencies(pkg) {
 * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
 * patched `werift`).
 *
-* Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
-* (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
-*
 * Returns a new object (immutable).
 */
 function stripBundledDeps(pkg) {
-	if (process.env.CAMSTACK_INSTALL_FULL_DEPS === "1") return stripCamstackDeps(pkg);
 	const camstack = pkg.camstack;
 	if (camstack !== null && typeof camstack === "object" && !Array.isArray(camstack) && camstack.system === true) return stripCamstackDeps(pkg);
 	const keep = new Set([...RUNTIME_NATIVE_KEEP, ...readRuntimeDependencies(pkg)]);
@@ -94409,9 +94404,8 @@ function resolveUseHostname() {
 function createBroker(config) {
 	const { nodeID, mode, hubAddress, logLevel = "warn", secret, tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
 	const useHostname = resolveUseHostname();
-	const moleculerDebug = process.env["CAMSTACK_MOLECULER_DEBUG"] === "1" || process.env["CAMSTACK_MOLECULER_DEBUG"] === "true";
-	const infraLevel = moleculerDebug ? "debug" : "error";
-	const wildcardLevel = moleculerDebug ? "debug" : logLevel;
+	const infraLevel = "error";
+	const wildcardLevel = logLevel;
 	if (mode === "test") return new ServiceBroker({
 		nodeID,
 		transporter: "Fake",
@@ -94441,7 +94435,7 @@ function createBroker(config) {
 				udpDiscovery: true,
 				udpPort,
 				udpPeriod: 5,
-				debug: moleculerDebug
+				debug: false
 			}
 		},
 		logger: {
@@ -94461,7 +94455,7 @@ function createBroker(config) {
 		maxPacketSize: 10 * 1024 * 1024,
 		port: config.agentListenPort ?? deriveAgentListenPort(nodeID),
 		useHostname,
-		debug: moleculerDebug
+		debug: false
 	};
 	if (hubAddress) {
 		tcpOptions.urls = normalizeHubUrl(hubAddress, tcpPort);
@@ -95269,26 +95263,16 @@ var CrashSupervisor = class {
 *      restores the glibc/sharp defaults. Recoverable without a rebuild.
 *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
 *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
-*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
-*   4. The defaults above.
-*
-* A nonsense override falls back to the default rather than being passed through:
-* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
-* exists to leave.
+*   3. The defaults above.
 */
 function runnerNativeAllocatorEnv(parentEnv, platform = process.platform) {
 	if (platform !== "linux") return {};
 	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
 	return {
-		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(2),
 		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
 	};
 }
-function positiveInt(raw, fallback) {
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : fallback;
-}
 /**
 * The child's environment, with the allocator pair applied or REMOVED.
 *
@@ -95497,6 +95481,8 @@ function isHeavyRunner(addons) {
 * Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+/** Light runners' young-generation semi-space, in MB. */
+var LIGHT_SEMI_SPACE_MB = 2;
 /**
 * The runner's old-space ceiling in MB, or 0 for "uncapped".
 *
@@ -95506,7 +95492,7 @@ var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 * the cap for the whole runner, which is the intended escape hatch.
 */
 function runnerMaxOldSpaceMb(addons, heavy) {
-	const envDefault = heavy ? positiveIntEnv("CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB", HEAVY_MAX_OLD_MB_DEFAULT) : positiveIntEnv("CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB", 0);
+	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
 	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
 	if (declared.length === 0) return envDefault;
 	if (declared.includes(0)) return 0;
@@ -95533,38 +95519,25 @@ function runnerRssBudgetMb(addons) {
 * (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
 * V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
 * ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
-* hit) and keep an opt-in old-space cap (`CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`, unset = uncapped). HEAVY
+* hit) and carry no old-space cap unless a manifest declares one. HEAVY
 * runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
 * {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
 *
-* Kill-switch: `CAMSTACK_RUNNER_HEAP_TUNING=off` disables all flags (recover without a rebuild).
-* Overrides: `CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB` (default 2),
-* `CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE` (default {@link LIGHT_V8_POOL_SIZE_DEFAULT}; below 1 omits
-* the flag — `0` means "size from the CPU count" to V8, not "off"),
-* `CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`
-* (default unset = no old-space cap), `CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB`
-* (default {@link HEAVY_MAX_OLD_MB_DEFAULT}; `0` restores the old uncapped behaviour).
+* The per-addon override is the manifest's declared `maxOldSpaceMb` (`0` = uncapped); the
+* environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill switch were removed on
+* 2026-10-06 — nothing had set them since the rollout.
 */
 function runnerHeapFlags(addons) {
-	if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
 	const heavy = isHeavyRunner(addons);
 	const flags = [];
 	if (!heavy) {
-		const semiMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB", 2);
-		if (semiMb > 0) flags.push(`--max-semi-space-size=${semiMb}`);
-		const v8Pool = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE", 2);
-		if (v8Pool > 0) flags.push(`--v8-pool-size=${v8Pool}`);
+		flags.push(`--max-semi-space-size=${LIGHT_SEMI_SPACE_MB}`);
+		flags.push(`--v8-pool-size=2`);
 	}
 	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
 	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
 	return flags;
 }
-function positiveIntEnv(name, fallback) {
-	const raw = process.env[name];
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n >= 0 ? n : fallback;
-}
 var MAX_BACKOFF_MS = 3e4;
 var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
@@ -96864,7 +96837,6 @@ exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
 exports.readHeapSpaces = require_child_cap_dispatch.readHeapSpaces;
 exports.readLanHttpState = require_tls$1.readLanHttpState;
-exports.readMoleculerFanoutMode = require_child_cap_dispatch.readMoleculerFanoutMode;
 exports.readPendingRestart = readPendingRestart;
 exports.readSocketQueues = require_child_cap_dispatch.readSocketQueues;
 exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Gt as logLevelAtMost, It as isObjectInput, Kt as looseSchema, Lt as isVoidInput, N as RUNTIME_DEFAULTS, Nt as isArrayOutputSchema, O as METHOD_ACCESS_MAP, Ot as extractNestedAddonId, Pt as isCollectionArrayMethod, Qn as DATAPLANE_SECRET_HEADER$1, Rt as kebabToCamel, Sr as EventCategory$1, T as LOG_LEVEL_RANK, Vt as lifecycleJobSchema, W as addonSettingsCapability, Xn as errMsg$1, _n as scopesAllowAddon, _r as readinessKey, ar as asNumber, cr as emitDownForOwnedCaps, er as DEVICE_STATUS_METHOD, gr as parseJsonUnknown, hn as resolveMethodAuth, hr as parseJsonObject, ir as asJsonObject$1, nn as objectInputDeclaresRequiredDeviceId, nr as ReadinessTimeoutError, or as asString$1, sn as procedureAuthKey, sr as createEvent, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresAddonId, tr as ReadinessRegistry, ur as expandCapMethods, vn as scopesAllowDeviceCap, vr as resolveCapMount, yr as scopeKey } from "./dist-DVyXxn41.mjs";
+import { $n as DATAPLANE_SECRET_HEADER$1, Cr as EventCategory$1, Ft as isCollectionArrayMethod, Ht as lifecycleJobSchema, Kt as logLevelAtMost, Lt as isObjectInput, N as RUNTIME_DEFAULTS, O as METHOD_ACCESS_MAP, Pt as isArrayOutputSchema, Rt as isVoidInput, T as LOG_LEVEL_RANK, W as addonSettingsCapability, Zn as errMsg$1, _r as parseJsonUnknown, ar as asJsonObject$1, br as scopeKey, cn as procedureAuthKey, cr as createEvent, dr as expandCapMethods, er as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as resolveMethodAuth, gr as parseJsonObject, kt as extractNestedAddonId, lr as emitDownForOwnedCaps, nn as objectInputDeclaresAddonId, nr as ReadinessRegistry, or as asNumber, qt as looseSchema, rn as objectInputDeclaresRequiredDeviceId, rr as ReadinessTimeoutError, sr as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tr as DEVICE_STATUS_METHOD, vn as scopesAllowAddon, vr as readinessKey, yn as scopesAllowDeviceCap, yr as resolveCapMount, zt as kebabToCamel } from "./dist-OCi0K-iM.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -30,7 +30,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
-import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-C1x1kNJK.mjs";
+import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-DMx2axev.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -3230,8 +3230,7 @@ async function copyDirRecursive(src, dest) {
 * `addons/` stays node_modules-free, which is what lets the backup tar the whole
 * folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
 * un-bundleable runtime dep declares it explicitly in
-* `camstack.runtimeDependencies`; the debug escape hatch
-* `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+* `camstack.runtimeDependencies`.
 *
 * (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
 * per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
@@ -3262,13 +3261,9 @@ function readRuntimeDependencies(pkg) {
 * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
 * patched `werift`).
 *
-* Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
-* (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
-*
 * Returns a new object (immutable).
 */
 function stripBundledDeps(pkg) {
-	if (process.env.CAMSTACK_INSTALL_FULL_DEPS === "1") return stripCamstackDeps(pkg);
 	const camstack = pkg.camstack;
 	if (camstack !== null && typeof camstack === "object" && !Array.isArray(camstack) && camstack.system === true) return stripCamstackDeps(pkg);
 	const keep = new Set([...RUNTIME_NATIVE_KEEP, ...readRuntimeDependencies(pkg)]);
@@ -94402,9 +94397,8 @@ function resolveUseHostname() {
 function createBroker(config) {
 	const { nodeID, mode, hubAddress, logLevel = "warn", secret, tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
 	const useHostname = resolveUseHostname();
-	const moleculerDebug = process.env["CAMSTACK_MOLECULER_DEBUG"] === "1" || process.env["CAMSTACK_MOLECULER_DEBUG"] === "true";
-	const infraLevel = moleculerDebug ? "debug" : "error";
-	const wildcardLevel = moleculerDebug ? "debug" : logLevel;
+	const infraLevel = "error";
+	const wildcardLevel = logLevel;
 	if (mode === "test") return new ServiceBroker({
 		nodeID,
 		transporter: "Fake",
@@ -94434,7 +94428,7 @@ function createBroker(config) {
 				udpDiscovery: true,
 				udpPort,
 				udpPeriod: 5,
-				debug: moleculerDebug
+				debug: false
 			}
 		},
 		logger: {
@@ -94454,7 +94448,7 @@ function createBroker(config) {
 		maxPacketSize: 10 * 1024 * 1024,
 		port: config.agentListenPort ?? deriveAgentListenPort(nodeID),
 		useHostname,
-		debug: moleculerDebug
+		debug: false
 	};
 	if (hubAddress) {
 		tcpOptions.urls = normalizeHubUrl(hubAddress, tcpPort);
@@ -95262,26 +95256,16 @@ var CrashSupervisor = class {
 *      restores the glibc/sharp defaults. Recoverable without a rebuild.
 *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
 *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
-*   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
-*   4. The defaults above.
-*
-* A nonsense override falls back to the default rather than being passed through:
-* glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
-* exists to leave.
+*   3. The defaults above.
 */
 function runnerNativeAllocatorEnv(parentEnv, platform = process.platform) {
 	if (platform !== "linux") return {};
 	if (parentEnv["CAMSTACK_RUNNER_NATIVE_ALLOCATOR"] === "off") return {};
 	return {
-		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(positiveInt(parentEnv["CAMSTACK_RUNNER_MALLOC_ARENA_MAX"], 2)),
+		MALLOC_ARENA_MAX: parentEnv["MALLOC_ARENA_MAX"] ?? String(2),
 		VIPS_CONCURRENCY: parentEnv["VIPS_CONCURRENCY"] ?? String(1)
 	};
 }
-function positiveInt(raw, fallback) {
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n > 0 ? n : fallback;
-}
 /**
 * The child's environment, with the allocator pair applied or REMOVED.
 *
@@ -95490,6 +95474,8 @@ function isHeavyRunner(addons) {
 * Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
 */
 var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+/** Light runners' young-generation semi-space, in MB. */
+var LIGHT_SEMI_SPACE_MB = 2;
 /**
 * The runner's old-space ceiling in MB, or 0 for "uncapped".
 *
@@ -95499,7 +95485,7 @@ var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
 * the cap for the whole runner, which is the intended escape hatch.
 */
 function runnerMaxOldSpaceMb(addons, heavy) {
-	const envDefault = heavy ? positiveIntEnv("CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB", HEAVY_MAX_OLD_MB_DEFAULT) : positiveIntEnv("CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB", 0);
+	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
 	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
 	if (declared.length === 0) return envDefault;
 	if (declared.includes(0)) return 0;
@@ -95526,38 +95512,25 @@ function runnerRssBudgetMb(addons) {
 * (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
 * V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
 * ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
-* hit) and keep an opt-in old-space cap (`CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`, unset = uncapped). HEAVY
+* hit) and carry no old-space cap unless a manifest declares one. HEAVY
 * runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
 * {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
 *
-* Kill-switch: `CAMSTACK_RUNNER_HEAP_TUNING=off` disables all flags (recover without a rebuild).
-* Overrides: `CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB` (default 2),
-* `CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE` (default {@link LIGHT_V8_POOL_SIZE_DEFAULT}; below 1 omits
-* the flag — `0` means "size from the CPU count" to V8, not "off"),
-* `CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB`
-* (default unset = no old-space cap), `CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB`
-* (default {@link HEAVY_MAX_OLD_MB_DEFAULT}; `0` restores the old uncapped behaviour).
+* The per-addon override is the manifest's declared `maxOldSpaceMb` (`0` = uncapped); the
+* environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill switch were removed on
+* 2026-10-06 — nothing had set them since the rollout.
 */
 function runnerHeapFlags(addons) {
-	if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
 	const heavy = isHeavyRunner(addons);
 	const flags = [];
 	if (!heavy) {
-		const semiMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB", 2);
-		if (semiMb > 0) flags.push(`--max-semi-space-size=${semiMb}`);
-		const v8Pool = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE", 2);
-		if (v8Pool > 0) flags.push(`--v8-pool-size=${v8Pool}`);
+		flags.push(`--max-semi-space-size=${LIGHT_SEMI_SPACE_MB}`);
+		flags.push(`--v8-pool-size=2`);
 	}
 	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
 	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
 	return flags;
 }
-function positiveIntEnv(name, fallback) {
-	const raw = process.env[name];
-	if (raw === void 0) return fallback;
-	const n = Number.parseInt(raw, 10);
-	return Number.isFinite(n) && n >= 0 ? n : fallback;
-}
 var MAX_BACKOFF_MS = 3e4;
 var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;
@@ -96473,4 +96446,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/event-plane-report.d.ts

@@ -22,27 +22,13 @@
  * on that runner also counts page-cache reads and it owns a vector store, so the
  * correlation is not an attribution. `fanoutTop` turns it into one.
  *
- * ## And the burn-in that has been running forever
- *
- * `event-bus-core.ts:310` states the procedure in its own words: *"Recommended
- * first fleet-wide enable: `shadow` on both, watch the suppressed counters
- * (`getMoleculerEventStats` / `getChildEventStats`), then flip to `filter` once
- * burn-in shows zero would-be-starved deliveries."*
- *
- * The hub runs with `CAMSTACK_MOLECULER_EVENT_FANOUT=shadow` — which computes
- * the drop decision, counts the would-suppresses and **still delivers every
- * event** — and **neither counter has ever had a production caller**: both
- * functions are reachable only from barrel re-exports and unit tests. So the
- * burn-in has no end condition, and the promotion to `filter` never happened
- * because the evidence that would authorise it was never surfaced. This module
- * surfaces it. It changes no default and flips no env: the promotion stays a
- * one-env decision for the operator, and it now has a number behind it.
- *
- * Read the modes with the counts, always. A suppressed count of 0 means
- * "nothing would have been dropped" under `shadow` and "nothing WAS dropped"
- * under `filter`, and those are different claims. A count printed without its
- * regime is unreadable, and the regime is read ONCE at construction — invisible
- * at runtime until now.
+ * ## Both planes always filter
+ *
+ * The cross-node plane ran a `shadow` burn-in (`CAMSTACK_MOLECULER_EVENT_FANOUT`)
+ * with no end condition, and the UDS plane carried the same three-mode switch
+ * (`CAMSTACK_UDS_EVENT_FANOUT`). Both switches were removed on 2026-10-06: a
+ * suppressed count now always means "this many WERE dropped", and the line no
+ * longer prints a regime because there is only one.
  *
  * ## The fail-open nobody can see
  *
@@ -81,16 +67,7 @@
  * `fanoutOrphans` counts what was serialised and walked across every child with
  * zero subscribers. A suppressed pair was measured at **255 ns** — 1.84 ms/s of
  * event loop at this rate — so the filter is not the cost; the emit is.
- *
- * ## What this is NOT evidence of
- *
- * `shadow` is the CROSS-NODE plane. The local UDS plane defaults to `filter` and
- * its env is unset, so it is filtering. hub-main's ~44 000 socket syscalls/s are
- * mostly to LOCAL runners, so the shadow mode is a real defect and is **not**
- * established as the source of that load. Do not read these two facts as one.
  */
-/** Fan-out regime for one plane. Same three values on both. */
-export type EventFanoutMode = 'filter' | 'shadow' | 'broadcast';
 /** One child's fan-out counters, as the registry keeps them (cumulative). */
 export interface ChildFanoutSample {
     readonly childId: string;
@@ -127,7 +104,6 @@ export interface ChildFanoutRegistry {
     readonly listChildren: () => readonly ChildFanoutRegistryChild[];
     readonly getChildEventStats: (childId: string) => ChildFanoutRegistryStats | null;
     readonly undeclaredChildCount: () => number;
-    readonly eventFanoutMode: EventFanoutMode;
     readonly categoryFanout: () => readonly CategoryFanoutSample[];
     readonly categoryCensusOverflow: () => number;
 }
@@ -138,8 +114,6 @@ export interface CrossNodeEventStats {
 }
 /** One cumulative reading of both planes. */
 export interface EventPlaneCounters {
-    readonly udsMode: EventFanoutMode;
-    readonly crossNodeMode: EventFanoutMode;
     readonly children: readonly ChildFanoutSample[];
     readonly childrenConnected: number;
     readonly childrenUndeclared: number;
@@ -156,7 +130,6 @@ export type EventPlaneReader = () => EventPlaneCounters | undefined;
 export interface EventPlaneSources {
     readonly registry: () => ChildFanoutRegistry | null;
     readonly crossNodeStats: () => CrossNodeEventStats | null;
-    readonly crossNodeMode: () => EventFanoutMode;
 }
 /**
  * Build a reader over the two registries.
@@ -183,8 +156,6 @@ export declare function createEventPlaneReader(sources: EventPlaneSources): Even
 export declare const EVENT_PLANE_TOP_N = 5;
 /** Both planes over one heartbeat window. */
 export interface EventPlaneWindow {
-    readonly udsMode: EventFanoutMode;
-    readonly crossNodeMode: EventFanoutMode;
     readonly childrenConnected: number;
     readonly childrenUndeclared: number;
     readonly fanoutSent: number;

package/dist/kernel/fs-utils.d.ts

@@ -26,8 +26,7 @@ export declare function copyDirRecursive(src: string, dest: string): Promise<voi
  * `addons/` stays node_modules-free, which is what lets the backup tar the whole
  * folder with no exclusion list (see ADR-0027). An addon that genuinely needs an
  * un-bundleable runtime dep declares it explicitly in
- * `camstack.runtimeDependencies`; the debug escape hatch
- * `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy install-everything path.
+ * `camstack.runtimeDependencies`.
  *
  * (Historically this mirrored the build preset's COMMON_NATIVE_DEPS and
  * per-addon-installed node-av/sharp/onnxruntime-node/ssh2/werift/systeminformation
@@ -49,9 +48,6 @@ export declare const RUNTIME_NATIVE_KEEP: readonly string[];
  * `dependencies` so `--omit=peer` installs can't drop them (pipeline's
  * patched `werift`).
  *
- * Escape hatch: `CAMSTACK_INSTALL_FULL_DEPS=1` restores the legacy behaviour
- * (strip only @camstack/*) for debugging a suspected undeclared runtime dep.
- *
  * Returns a new object (immutable).
  */
 export declare function stripBundledDeps(pkg: Record<string, unknown>): Record<string, unknown>;

package/dist/kernel/heap-spaces.d.ts

@@ -88,22 +88,6 @@ export declare function selectReportedSpaces(spaces: readonly HeapSpaceUsage[],
  * a query someone already wrote.
  */
 export declare function formatHeapSpaces(spaces: readonly HeapSpaceUsage[], minMb?: number): string;
-/**
- * Env var that authorises a heap snapshot on SIGUSR2.
- *
- * A snapshot is an admin mutation on a production hub: `writeHeapSnapshot`
- * streams a file the size of the heap to `/tmp` and stops the world while it
- * walks it — on the recorder that is a multi-GB file and a stall measured in
- * seconds. The per-space breakdown is ~1.2 µs and changes nothing. Welding them
- * to one signal priced the free answer at the cost of the expensive one.
- */
-/**
- * Whether the operator has authorised the snapshot half of SIGUSR2.
- *
- * Explicit `'on'` only. Anything else — unset, empty, `'true'`, `'1'` — is NOT
- * authorisation: a multi-GB stop-the-world write must never be reachable by a
- * value someone set for a different purpose.
- */
 /** What a diagnostic report is ABOUT. */
 export interface HeapDiagnosticRequest {
     /** The runner's nodeId, so the line groups with its `[mem]` heartbeat. */
@@ -115,19 +99,14 @@ export interface HeapDiagnosticRequest {
 export interface HeapDiagnosticDeps {
     readonly readMemory: () => NodeJS.MemoryUsage;
     readonly readSpaces: HeapSpaceReader;
-    readonly env: NodeJS.ProcessEnv;
 }
 /**
- * The SIGUSR2 report — memory + the FULL per-space breakdown, always; the
- * snapshot NEVER — see the note in the body.
+ * The SIGUSR2 report — memory + the FULL per-space breakdown; never a heap
+ * snapshot (D718) — see the note in the body.
  *
  * The breakdown here keeps every non-empty space at 0.1 MB, unlike the
  * heartbeat's filtered whole-MB pair: this is a hand-fired diagnostic read once
  * by a human who asked for it, so completeness costs nothing. The heartbeat runs
  * unattended on every runner forever, so it pays for every field it prints.
- *
- * A refused snapshot SAYS SO. A branch that drops work silently reads as "it was
- * never requested", and this one is fired by an operator who is standing there
- * waiting for a file.
  */
 export declare function emitHeapDiagnosticReport(request: HeapDiagnosticRequest, deps?: HeapDiagnosticDeps): void;

package/dist/kernel/index.d.ts

@@ -45,8 +45,6 @@ export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-ca
 export type { CoreCapAction, CoreCapCallOrigin, CoreCapServiceOptions, } from './moleculer/core-cap-service.js';
 export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, clusterEventTopic, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
 export type { MoleculerEventStats } from './moleculer/addon-context-factory.js';
-export type { MoleculerEventFanoutMode } from './moleculer/event-bus-core.js';
-export { readMoleculerFanoutMode } from './moleculer/event-bus-core.js';
 export { HubLogForwarder } from './moleculer/hub-log-forwarder.js';
 export type { AddonContextOptions } from './moleculer/addon-context-factory.js';
 export { createHubService } from './moleculer/hub-service.js';

package/dist/kernel/moleculer/event-bus-core.d.ts

@@ -142,31 +142,12 @@ export declare const RING_BUFFER_DENY_PATTERNS: readonly string[];
 export declare const MAX_RECENT_EVENTS = 1000;
 export declare function isHighFrequencyCategory(category: string): boolean;
 /**
- * Fan-out mode for cross-node (Moleculer) event delivery, read from the
- * `CAMSTACK_MOLECULER_EVENT_FANOUT` env. The inter-node analogue of the
- * intra-host `CAMSTACK_UDS_EVENT_FANOUT` gate (`local-child-registry.ts`):
- *   - `filter`    (default) — drop an inbound cross-node event whose category
- *     no local subscriber on THIS node wants (the union of its children's
- *     declared patterns).
- *   - `shadow`    — compute the drop decision + count would-suppresses, but
- *     STILL deliver every event (burn-in: prove zero would-be-starved deliveries
- *     before flipping to `filter`).
- *   - `broadcast` — ignore the gate entirely (pre-D2 behaviour).
- *
- * ROLLBACK CONTRACT (operators, read this): this env governs ONLY the inter-node
- * (Moleculer) gate. The intra-host UDS fan-out has a SEPARATE, independent
- * kill-switch, `CAMSTACK_UDS_EVENT_FANOUT` (see `local-child-registry.ts`). A
- * FULL rollback to pre-D2 / pre-#44 delivery therefore requires BOTH env vars
- * set to `broadcast` AND a process restart on EVERY node (hub + all agents) —
- * each is read ONCE at registration/construction, so a running process will not
- * pick up a change. Flipping only one leg leaves the other filtering and yields
- * inconsistent behaviour. Recommended first fleet-wide enable: `shadow` on both,
- * watch the suppressed counters (`getMoleculerEventStats` /
- * `getChildEventStats`), then flip to `filter` once burn-in shows zero
- * would-be-starved deliveries.
+ * Cross-node (Moleculer) inbound gate: an inbound cross-node event whose
+ * category no local subscriber on THIS node wants (the union of its children's
+ * declared patterns) is dropped and counted (`suppressed`). It always filters —
+ * the `CAMSTACK_MOLECULER_EVENT_FANOUT` shadow/broadcast modes were removed on
+ * 2026-10-06; the intra-host analogue is `LocalChildRegistry.childWantsEvent`.
  */
-export type MoleculerEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
-export declare function readMoleculerFanoutMode(): MoleculerEventFanoutMode;
 /**
  * A node's inbound-interest snapshot used by {@link crossNodeAcceptsCategory}.
  *  - `retainRecent` — the receiving bus retains events for `getRecent`/audit
@@ -185,16 +166,13 @@ export interface CrossNodeInterestSnapshot {
 /**
  * Does this node want to accept an inbound cross-node event in `category`?
  * The receiving-side mirror of `LocalChildRegistry.childWantsEvent`:
- *   - `broadcast` mode → always (gate disabled).
  *   - a retaining bus (hub main) → always (it serves `getRecent` + admin-ui;
  *     its interest is genuinely everything).
  *   - undeclared interest (`null`) → always (fail-open).
  *   - else the declared union must match via `matchesPattern` — the SAME
  *     function the local subscriber map-key gate uses, giving delivery parity.
- * `shadow` is handled by the caller (it counts the would-suppress but still
- * delivers), exactly like the UDS fan-out.
  */
-export declare function crossNodeAcceptsCategory(mode: MoleculerEventFanoutMode, snapshot: CrossNodeInterestSnapshot, category: string): boolean;
+export declare function crossNodeAcceptsCategory(snapshot: CrossNodeInterestSnapshot, category: string): boolean;
 /**
  * Deliver `event` to all matching local subscribers and — ONLY on a bus that
  * opted into retention (`state.retainRecent`, i.e. the hub main process) and