@camstack/system 1.2.354 → 1.2.355

package/dist/kernel/moleculer/process-service.d.ts

@@ -95,9 +95,8 @@ export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
  *   --v8-pool-size=2    9 threads
  *   --v8-pool-size=0   18 threads
  *
- * So a value below 1 omits the flag entirely rather than being passed through —
- * the same trap as `MALLOC_ARENA_MAX=0` in `runner-native-allocator.ts`. To turn
- * the tuning off, use `CAMSTACK_RUNNER_HEAP_TUNING=off`.
+ * So the flag is only ever passed with a value of at least 1 — the same trap as
+ * `MALLOC_ARENA_MAX=0` in `runner-native-allocator.ts`.
  *
  * ## What is deliberately NOT bounded
  *
@@ -110,8 +109,6 @@ export declare const HEAVY_MAX_OLD_MB_DEFAULT = 1024;
  * ~58 more threads for serialized filesystem I/O in runners whose I/O profile
  * has not been measured, on a media system. A thread saving is not worth a
  * media gap.
- *
- * Override: `CAMSTACK_RUNNER_LIGHT_V8_POOL_SIZE`.
  */
 export declare const LIGHT_V8_POOL_SIZE_DEFAULT = 2;
 interface SpawnedProcess {

package/dist/kernel/moleculer/runner-native-allocator.d.ts

@@ -85,12 +85,7 @@ export interface RunnerNativeAllocatorEnv {
  *      restores the glibc/sharp defaults. Recoverable without a rebuild.
  *   2. A value the operator already put in the environment (`MALLOC_ARENA_MAX`,
  *      `VIPS_CONCURRENCY`) — inherited verbatim, never overwritten.
- *   3. `CAMSTACK_RUNNER_MALLOC_ARENA_MAX` — the CamStack override.
- *   4. The defaults above.
- *
- * A nonsense override falls back to the default rather than being passed through:
- * glibc reads `MALLOC_ARENA_MAX=0` as "unbounded", which is the very state this
- * exists to leave.
+ *   3. The defaults above.
  */
 export declare function runnerNativeAllocatorEnv(parentEnv: NodeJS.ProcessEnv, platform?: NodeJS.Platform): RunnerNativeAllocatorEnv;
 /**

package/dist/kernel/transport/index.d.ts

@@ -10,7 +10,7 @@ export { PeerAnsweredError } from './peer-answered-error.js';
 export { UdsLocalTransportServer, UdsLocalTransportClient } from './uds-local-transport.js';
 export { createLocalTransport } from './create-local-transport.js';
 export type { ChildCapDescriptor, RegisterMessage, ChildLogMessage, ChildEventMessage, ChildToParentRequest, CapCallMessage, CapCallInput, CapCallOutMessage, AddonCallMessage, AddonCallInput, AddonCallTarget, AddonSettingsMethod, ParentToChildRequest, RegisteredChild, SetLogLevelMessage, } from './child-cap-protocol.js';
-export { LocalChildRegistry, afterWorkerOnlineAnnounce, UDS_NO_ROUTE_PREFIX } from './local-child-registry.js';
+export { LocalChildRegistry, afterWorkerOnlineAnnounce, UDS_NO_ROUTE_PREFIX, } from './local-child-registry.js';
 export type { LocalChildRegistryOptions, LocalChildRegistryLogger, ChildLifecycleEvents, } from './local-child-registry.js';
 export type { LocalChildClientOptions, AddonCallHandler } from './local-child-client.js';
 export { LocalChildClient } from './local-child-client.js';

package/dist/kernel/transport/local-child-registry.d.ts

@@ -29,17 +29,6 @@ export interface ForwardCensus {
  * check.
  */
 export declare const PRE_REGISTER_PEER_ID = "(pre-register)";
-/**
- * Fan-out mode for parent→child event delivery, from the
- * `CAMSTACK_UDS_EVENT_FANOUT` env (read once at registry construction):
- *   - `filter`    (default) — apply the subscription gate; a child receives a
- *     category only if one of its declared patterns matches.
- *   - `shadow`    — compute the gate decision + count would-suppresses, but
- *     STILL send every event (burn-in: prove zero would-be-starved deliveries).
- *   - `broadcast` — ignore the gate entirely (today's behaviour); the operator's
- *     one-env rollback without redeploying runners.
- */
-export type UdsEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
 /** Per-child event fan-out counters (sent = delivered, suppressed = gated/would-gate). */
 export interface ChildEventStats {
     sent: number;
@@ -56,8 +45,7 @@ export interface ChildEventStats {
  * sums them concludes the cluster emits an order of magnitude more than it does.
  *
  * `wanted` is the number of (event × child) pairs whose SUBSCRIPTION matched —
- * the gate answer, not the delivery answer, so `broadcast`/`shadow` mode (which
- * deliver regardless) still report the truth. `wanted === 0` over a window means
+ * the gate answer, which is also the delivery answer. `wanted === 0` over a window means
  * the category was serialised and walked across every child and **nobody asked
  * for it**: pure waste, and the one finding worth acting on.
  */
@@ -340,8 +328,6 @@ export declare class LocalChildRegistry {
     private readonly capUsageObserver?;
     /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
     private readonly egressRoutedCaps;
-    /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
-    private readonly fanoutMode;
     /** Per-child event fan-out counters (sent / suppressed). */
     private readonly childEventStats;
     /** D467: per-category production census (cumulative). See {@link CategoryFanoutSample}. */
@@ -374,7 +360,7 @@ export declare class LocalChildRegistry {
     /**
      * Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
      * child has no recorded events yet. Exposed for the starvation-verification
-     * surface (shadow burn-in + operator debug).
+     * surface (operator debug).
      */
     getChildEventStats(childId: string): ChildEventStats | null;
     /**
@@ -420,16 +406,6 @@ export declare class LocalChildRegistry {
      * `decoded` half of an entry, next to the bytes it carried.
      */
     readActionCensus(): CapActionReading;
-    /**
-     * The regime the counters above were produced under, read once from
-     * `CAMSTACK_UDS_EVENT_FANOUT` at construction.
-     *
-     * A suppressed count means "nothing WAS dropped" under `filter` and "nothing
-     * WOULD have been dropped" under `shadow`. Those are different claims, and
-     * until this getter existed the mode was invisible at runtime — the counters
-     * were readable and the regime that produced them was not.
-     */
-    get eventFanoutMode(): UdsEventFanoutMode;
     /**
      * Connected children that never declared a subscription pattern set.
      *
@@ -443,27 +419,18 @@ export declare class LocalChildRegistry {
      */
     undeclaredChildCount(): number;
     /**
-     * Does `entry` want to receive an event in `category`? Honours the fan-out
-     * mode: `broadcast` → always; undeclared patterns (`null`) → always
-     * (fail-open); else the child's declared set must match via `matchesPattern`
-     * — the SAME function the child's own `deliverShared` map-key gate uses,
-     * giving provable delivery parity. `shadow` is handled by the caller (it
-     * counts the would-suppress but still sends).
+     * Does `entry` want to receive an event in `category`? Undeclared patterns
+     * (`null`) → always (fail-open, counted by {@link undeclaredChildCount});
+     * else the child's declared set must match via `matchesPattern` — the SAME
+     * function the child's own `deliverShared` map-key gate uses, giving provable
+     * delivery parity. The parent always filters: the `CAMSTACK_UDS_EVENT_FANOUT`
+     * shadow/broadcast modes were removed on 2026-10-06.
      *
      * NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
      * `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
      * that explicitly subscribes to a ring-denied category must still RECEIVE it.
      */
     private childWantsEvent;
-    /**
-     * The SUBSCRIPTION answer alone, with no fan-out-mode override.
-     *
-     * {@link childWantsEvent} answers "will this child be sent the event", which
-     * under `broadcast` is `true` for everything and therefore cannot say whether
-     * anyone actually asked. The D467 census needs the second question, so the
-     * two are separate functions and `broadcast` mode overrides only the first.
-     */
-    private childSubscribesTo;
     /**
      * D2: this node's aggregate cross-node event interest — the UNION of every
      * connected child's declared category patterns. Consumed by the parent's

package/dist/kernel/transport/uds-event-bridge.d.ts

@@ -7,8 +7,8 @@ import { IEventBus, SystemEvent } from '@camstack/types';
  * fans an event only to children whose declared category-pattern set matches
  * `event.category` (mirror of each child's local `SharedBusState.handlers`
  * keys). A child that never declared a set (legacy/undeclared) fails OPEN and
- * receives everything. The `CAMSTACK_UDS_EVENT_FANOUT` env (`filter` default /
- * `shadow` / `broadcast`) is the registry-side kill-switch. The bridge itself
+ * receives everything. There is no kill-switch any more (the
+ * `CAMSTACK_UDS_EVENT_FANOUT` modes were removed on 2026-10-06). The bridge itself
  * needs no per-event logic change — both fan-out call sites here go through the
  * filtered `broadcastEventToChildren`. `sendEventToChild` (targeted push) is
  * NOT filtered — an explicit single-child send expresses intent.

package/dist/{retired-settings-keys-BTKZdPn6.js → retired-settings-keys-DLJ7MvIB.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DePB7uwU.js");
+const require_dist = require("./dist-BWicEEVA.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-DFur4hJF.mjs → retired-settings-keys-TDzxE6GA.mjs}

@@ -1,4 +1,4 @@
-import { ir as asJsonObject } from "./dist-DVyXxn41.mjs";
+import { ar as asJsonObject } from "./dist-OCi0K-iM.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.354",
+  "version": "1.2.355",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/kernel/heap-allocation-sample.d.ts

@@ -1,107 +0,0 @@
-/**
- * WHERE the bytes come from, without stopping the process.
- *
- * A heap SNAPSHOT answers "what is retained" and costs a stop-the-world walk
- * plus a multi-gigabyte write. On this hub that took the machine down twice;
- * the second attempt did not even finish — it left a 0-byte file and an
- * unresponsive host that had to be rebooted. The remotely-triggerable command
- * is gone (`scripts/check-no-heap-dump-command.ts`).
- *
- * V8's SAMPLING heap profiler answers a cheaper, different question: which
- * allocation SITES the bytes came from, statistically, with no pause and
- * nothing written. Measured locally: 51 ms for a window that allocated 200 000
- * objects.
- *
- * ## What this is NOT
- *
- * It is not retention analysis. It says where bytes were BORN, not what is
- * holding them alive, and a leak is about the second. It is still the right
- * first instrument for the recorder's ~900 MB of large objects that "no
- * allocation site in its tree can produce" — because naming the sites is
- * exactly the claim under test, and if the sites turn out to be ordinary, the
- * retention question is the one that survives.
- *
- * This module is the PURE half: it folds the profile V8 hands back. The
- * sampling belongs to the caller, so the fold is testable without a profiler.
- */
-/** One frame as the inspector protocol reports it. */
-export interface AllocationCallFrame {
-    readonly functionName: string;
-    readonly url: string;
-    readonly lineNumber: number;
-}
-/** One node of `HeapProfiler.stopSampling`'s profile tree. */
-export interface AllocationProfileNode {
-    readonly selfSize: number;
-    readonly callFrame: AllocationCallFrame;
-    readonly children?: readonly AllocationProfileNode[];
-}
-export interface AllocationSite {
-    readonly functionName: string;
-    /** `file.js:line` — what a human reads in a log line. */
-    readonly site: string;
-    readonly bytes: number;
-}
-/**
- * Fold the tree into the biggest allocation sites.
- *
- * Sites are SUMMED across call paths: one site reached from two callers is one
- * site, and reporting it twice at half the size is how a dominant allocator
- * hides in a long tail. Identity is (function, url, line) — the same line of
- * two files is two sites.
- */
-export declare function summariseAllocationProfile(head: AllocationProfileNode, limit: number): readonly AllocationSite[];
-/**
- * The inspector session slice this needs. Injected so the sampler is testable
- * without an inspector, and so nothing here reaches for a global.
- */
-export interface HeapProfilerSession {
-    connect: () => void;
-    disconnect: () => void;
-    post: (method: string, paramsOrCb: unknown, maybeCb?: unknown) => void;
-}
-export interface SampleHeapAllocationsInput {
-    readonly session: HeapProfilerSession;
-    /** How long to sample. Bounded by the caller; this module never loops. */
-    readonly durationMs: number;
-    readonly limit: number;
-    readonly wait: (ms: number) => Promise<void>;
-    /** Bytes between samples. Larger = cheaper and coarser. */
-    readonly samplingInterval?: number;
-}
-/**
- * Sample allocations for a bounded window and answer with the top sites.
- *
- * Writes NOTHING and pauses nothing. The profiler is stopped and the session
- * disconnected in a `finally`, because a sampler left running is a tax on the
- * process that outlives whoever enabled it — and the failure that made this
- * module necessary was a diagnostic nobody could turn off from outside.
- */
-export declare function sampleHeapAllocations(input: SampleHeapAllocationsInput): Promise<readonly AllocationSite[]>;
-/**
- * Per-runner opt-in for allocation sampling.
- *
- * Explicit `'on'` only — the same discipline the snapshot flag had. The
- * DIFFERENCE is what it authorises: that flag allowed a stop-the-world walk and
- * a multi-gigabyte write, so leaving it on in production (which is exactly what
- * happened) was an outage waiting for a signal. This one allows ~50 ms of
- * statistical sampling and one log line, so a runner left with it on is simply
- * a runner that reports where its bytes come from.
- */
-export declare const RUNNER_ALLOC_SAMPLE_ENV = "CAMSTACK_RUNNER_ALLOC_SAMPLE";
-export declare function allocationSamplingEnabled(env?: NodeJS.ProcessEnv): boolean;
-/** Sample on every Nth heartbeat — one sample per ~10 minutes at a 60 s beat. */
-export declare const ALLOCATION_SAMPLE_EVERY_N_BEATS = 10;
-/** How long one sample runs. Short enough that two can never overlap. */
-export declare const ALLOCATION_SAMPLE_WINDOW_MS = 5000;
-/** How many sites one log line carries. */
-export declare const ALLOCATION_SAMPLE_TOP_N = 8;
-/**
- * Is this the beat that samples?
- *
- * Beat 0 never samples: a runner that has just booted has allocated nothing
- * worth ranking. A non-positive cadence samples NEVER rather than always — a
- * misconfigured `0` must not turn a diagnostic into a permanent load, which is
- * the failure mode this whole module exists because of.
- */
-export declare function shouldSampleAllocations(beat: number, everyN: number): boolean;