@camstack/system 1.2.425 → 1.2.427

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-DJV1rde2.js");
+const require_wal_maintenance = require("./wal-maintenance-DItkuOvu.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BtfyfuT5.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Drqhcjit.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DnALrQF-.js");
-const require_jwt_signing_key = require("./jwt-signing-key-DeqG7LD9.js");
+const require_dist = require("./dist-BQG3QFg7.js");
+const require_jwt_signing_key = require("./jwt-signing-key-BZm055IP.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,12 +22,12 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-DJV1rde2.js");
+const require_wal_maintenance = require("./wal-maintenance-DItkuOvu.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-B5Jd8Zch.js");
+const require_constants = require("./constants-CCSJGnjs.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -35,7 +35,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_tls = require("./tls-BgImdxCO.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-C4UhQOsg.js");
+const require_restore_archive = require("./restore-archive-Dccm8lkA.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -25368,6 +25368,273 @@ var CrashSupervisor = class {
 		this.crashes.delete(runnerId);
 	}
 };
+//#endregion
+//#region src/kernel/moleculer/runner-heap-flags.ts
+var EMPTY_HEAP_DECLARATION = {
+	profile: void 0,
+	maxOldSpaceMb: void 0,
+	rssBudgetMb: void 0,
+	semiSpaceMb: void 0,
+	initialOldSpaceMb: void 0
+};
+/**
+* `execution.semiSpaceMb` is accepted in `[1, 256]` MB. V8 itself clamps the flag to its
+* own limits (the 64-bit default is 64 MB after Node 24's scavenger change, a 256 MB
+* semi-space is three times anything measured useful here); below 1 MB the flag is
+* meaningless. Outside the range the declaration is IGNORED (the runner keeps its class
+* default) rather than clamped: a clamped number silently becomes a different setting from
+* the one in the file, and the spawn log would then say something the manifest does not.
+*/
+var SEMI_SPACE_MB_RANGE = {
+	min: 1,
+	max: 256
+};
+/**
+* `execution.initialOldSpaceMb` is accepted in `[16, 65536]` MB. Below 16 MB V8's default
+* already starts larger; 64 GB clears any runner in this fleet. The accepted value is then
+* clamped at spawn to the runner's old-space CEILING (`runnerHeapFlags`) — V8 refuses an
+* initial size above `--max-old-space-size`, and the ceiling is the one number that belongs
+* to the runner as a whole.
+*/
+var INITIAL_OLD_SPACE_MB_RANGE = {
+	min: 16,
+	max: 65536
+};
+/** An integer MB inside `range`, else `undefined` — a non-integer is floored first. */
+function mbInRange(value, range) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return void 0;
+	const mb = Math.floor(value);
+	return mb >= range.min && mb <= range.max ? mb : void 0;
+}
+/**
+* Resolve the declared heap profile + old-space ceiling for one addon by reading its package.json
+* manifest (`camstack.addons[].execution.{heapProfile,maxOldSpaceMb}`). `addonDir` points at the
+* addon's built `dist`, so the manifest is one level up; we also try `addonDir` itself for layouts
+* where it IS the package root.
+* Result is cached per (dir,id) — spawns are infrequent but a runner may re-spawn on crash/restart.
+* Returns an empty declaration when the manifest is unreadable → treated as light, default ceiling.
+*/
+var heapProfileCache = /* @__PURE__ */ new Map();
+function readAddonHeapDeclaration(spec) {
+	const cacheKey = `${spec.addonDir}::${spec.addonId}`;
+	const cached = heapProfileCache.get(cacheKey);
+	if (cached !== void 0) return cached;
+	let declaration = EMPTY_HEAP_DECLARATION;
+	for (const manifestPath of [node_path.join(spec.addonDir, "package.json"), node_path.join(node_path.dirname(spec.addonDir), "package.json")]) try {
+		const raw = node_fs.readFileSync(manifestPath, "utf8");
+		const parsed = JSON.parse(raw);
+		const profile = extractHeapProfile(parsed, spec.addonId);
+		const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
+		const rssBudgetMb = extractRssBudgetMb(parsed, spec.addonId);
+		const semiSpaceMb = extractSemiSpaceMb(parsed, spec.addonId);
+		const initialOldSpaceMb = extractInitialOldSpaceMb(parsed, spec.addonId);
+		if (profile !== void 0 || maxOldSpaceMb !== void 0 || rssBudgetMb !== void 0 || semiSpaceMb !== void 0 || initialOldSpaceMb !== void 0) {
+			declaration = {
+				profile,
+				maxOldSpaceMb,
+				rssBudgetMb,
+				semiSpaceMb,
+				initialOldSpaceMb
+			};
+			break;
+		}
+		if (manifestHasAddon(parsed, spec.addonId)) break;
+	} catch {}
+	heapProfileCache.set(cacheKey, declaration);
+	return declaration;
+}
+/**
+* Drop the cached heap declaration for each addon so the NEXT `readAddonHeapDeclaration`
+* re-reads the manifest from disk. Called on operator-driven spawns / restarts
+* (a deploy may have changed `execution.heapProfile` / `execution.maxOldSpaceMb`); the
+* crash-respawn fast path deliberately does NOT invalidate — a crashing runner
+* has the same on-disk manifest, so re-reading it is pure overhead.
+*/
+function invalidateHeapProfiles(addons) {
+	for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
+}
+function manifestHasAddon(parsed, addonId) {
+	return readManifestAddons(parsed).some((a) => a.id === addonId);
+}
+function extractHeapProfile(parsed, addonId) {
+	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.heapProfile;
+	return value === "heavy" || value === "light" ? value : void 0;
+}
+function extractMaxOldSpaceMb(parsed, addonId) {
+	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
+}
+/**
+* `execution.rssBudgetMb` for one addon. Only a POSITIVE finite number is a budget: unlike
+* `maxOldSpaceMb`, `0` here is not an escape hatch that lifts a cap, it is an absent budget —
+* and an absent budget is reported as "unwatched", never rounded into a default.
+*/
+function extractRssBudgetMb(parsed, addonId) {
+	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.rssBudgetMb;
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+}
+/** `execution.semiSpaceMb` for one addon — only a value inside {@link SEMI_SPACE_MB_RANGE}. */
+function extractSemiSpaceMb(parsed, addonId) {
+	return mbInRange(readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.semiSpaceMb, SEMI_SPACE_MB_RANGE);
+}
+/** `execution.initialOldSpaceMb` for one addon — only a value inside {@link INITIAL_OLD_SPACE_MB_RANGE}. */
+function extractInitialOldSpaceMb(parsed, addonId) {
+	return mbInRange(readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.initialOldSpaceMb, INITIAL_OLD_SPACE_MB_RANGE);
+}
+function readManifestAddons(parsed) {
+	if (typeof parsed !== "object" || parsed === null) return [];
+	const camstack = parsed.camstack;
+	if (typeof camstack !== "object" || camstack === null) return [];
+	const addons = camstack.addons;
+	return Array.isArray(addons) ? addons : [];
+}
+/**
+* A runner is heavy if ANY co-located addon declares `heapProfile: 'heavy'` in its manifest.
+* Everything else (the un-annotated default) is a light control-plane runner. No hard-coded names.
+*/
+function isHeavyRunner(addons) {
+	return addons.some((a) => readAddonHeapDeclaration(a).profile === "heavy");
+}
+/**
+* Default old-space ceiling for a HEAVY runner, in MB.
+*
+* ## Why a heavy runner needs a ceiling at all
+*
+* `heapProfile: 'heavy'` used to mean "V8 defaults", i.e. no `--max-old-space-size` — which on this
+* host is V8's own memory-derived default (multiple GB). Nothing then bounds a burst, and V8 does
+* not hand committed pages back (the long argument for that is in `kernel/heap-watch.ts`), so a
+* one-off burst becomes the runner's permanent RSS.
+*
+* Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
+* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
+* **58 MB**.
+*
+* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
+* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
+* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
+* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
+* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
+* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
+* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
+* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
+*
+* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
+* no reason to collect" is the explanation to reach for last, not first.
+*
+* ## Why 1024
+*
+* From the same live topology snapshot, every heavy runner's FULL RSS — which is a strict
+* over-estimate of its old space, since it also contains native allocations, `external` and
+* `arrayBuffers`, none of which `--max-old-space-size` bounds:
+*
+*   detection 471 MB · provider-reolink 507 MB · pipeline-orchestrator 238 MB · ml 218 MB ·
+*   snapshot 185 MB · decoder-nodeav 174 MB · audio-analyzer 170 MB
+*
+* 1024 MB clears the largest of those by ~2x while cutting the recorder's observed ratchet by
+* more than half. It is a CEILING, not a target: a runner that fits today keeps behaving exactly
+* as it does now, because V8 only collects harder as it approaches the limit.
+*
+* A runner whose working set genuinely does not fit declares its own number in its manifest
+* (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
+* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
+* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
+* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
+* from RSS.
+*
+* ## What this flag CANNOT do
+*
+* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
+* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
+* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
+* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
+*/
+var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+/**
+* The runner's old-space ceiling in MB, or 0 for "uncapped".
+*
+* The runner takes the MAXIMUM ceiling any co-located addon declares — co-location must never
+* silence the hungriest member (D2/D29: a runner is respawned as a whole, so an OOM caused by
+* under-sizing one member kills every addon in the group). An addon declaring `0` therefore lifts
+* the cap for the whole runner, which is the intended escape hatch.
+*/
+function runnerMaxOldSpaceMb(addons, heavy) {
+	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
+	if (declared.length === 0) return envDefault;
+	if (declared.includes(0)) return 0;
+	return Math.max(...declared);
+}
+/**
+* The runner's declared RSS budget in MB, or `undefined` when NOBODY declared one.
+*
+* Same rule as the old-space ceiling, for the same reason (D2/D29): the runner takes the MAXIMUM
+* any co-located addon declares, because a runner is respawned as a whole and co-location must
+* never silence the hungriest member. It would be strictly worse here than for a heap ceiling —
+* an under-sized budget does not kill anything, it just cries wolf, and a watchdog that cries
+* wolf is a watchdog that gets muted.
+*
+* `undefined` propagates as an ABSENT env var, and the child then announces itself unwatched.
+* There is deliberately no class default: see `AddonExecution.rssBudgetMb`.
+*/
+function runnerRssBudgetMb(addons) {
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).rssBudgetMb).filter((mb) => mb !== void 0);
+	return declared.length === 0 ? void 0 : Math.max(...declared);
+}
+/**
+* Per-placement V8 flags (Block D). LIGHT runners cap their young generation
+* (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
+* V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
+* ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
+* hit) and carry no old-space cap unless a manifest declares one. HEAVY
+* runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
+* {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
+*
+* The per-addon overrides are the manifest's declared `maxOldSpaceMb` (`0` = uncapped),
+* `semiSpaceMb` (`--max-semi-space-size`, replacing the class default) and
+* `initialOldSpaceMb` (`--initial-old-space-size`, clamped to the ceiling) — each the MAXIMUM
+* across a runner's co-located addons. Shipped for `stream-broker` alone (8 / 512): with the
+* heavy class default the hub's broker ran ~166 major GCs a minute and not one scavenge, at
+* 45–60 % of a core. The environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill
+* switch were removed on 2026-10-06 — nothing had set them since the rollout. The flags must
+* be on the spawn command line: `v8.setFlagsFromString` at runtime changes neither space.
+*/
+function runnerHeapFlags(addons) {
+	const heavy = isHeavyRunner(addons);
+	const flags = [];
+	const semiMb = runnerSemiSpaceMb(addons) ?? (heavy ? void 0 : 2);
+	if (semiMb !== void 0) flags.push(`--max-semi-space-size=${semiMb}`);
+	if (!heavy) flags.push(`--v8-pool-size=2`);
+	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
+	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
+	const initialOldMb = runnerInitialOldSpaceMb(addons);
+	if (initialOldMb !== void 0) {
+		const bounded = oldMb > 0 ? Math.min(initialOldMb, oldMb) : initialOldMb;
+		flags.push(`--initial-old-space-size=${bounded}`);
+	}
+	return flags;
+}
+/**
+* The runner's declared young-generation semi-space in MB, or `undefined` when no
+* co-located addon declares one (→ the class default applies).
+*
+* The MAXIMUM across the group, like every other declaration here (D2/D29): the
+* member that measured its churn away must not be handed a smaller young
+* generation because a quieter co-tenant declared one.
+*/
+function runnerSemiSpaceMb(addons) {
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).semiSpaceMb).filter((mb) => mb !== void 0);
+	return declared.length === 0 ? void 0 : Math.max(...declared);
+}
+/**
+* The runner's declared initial old space in MB, or `undefined` when nobody declares
+* one (→ V8 grows it from the live set). MAXIMUM across the group, same rule and same
+* reason as {@link runnerSemiSpaceMb}; the clamp to the runner's ceiling happens in
+* {@link runnerHeapFlags}, where the ceiling is known.
+*/
+function runnerInitialOldSpaceMb(addons) {
+	const declared = addons.map((a) => readAddonHeapDeclaration(a).initialOldSpaceMb).filter((mb) => mb !== void 0);
+	return declared.length === 0 ? void 0 : Math.max(...declared);
+}
 /**
 * Resolve the native-allocator env for a child runner from the parent's env.
 *
@@ -25697,199 +25964,6 @@ async function getPidStats$1(pids) {
 	});
 	return result;
 }
-var EMPTY_HEAP_DECLARATION = {
-	profile: void 0,
-	maxOldSpaceMb: void 0,
-	rssBudgetMb: void 0
-};
-/**
-* Resolve the declared heap profile + old-space ceiling for one addon by reading its package.json
-* manifest (`camstack.addons[].execution.{heapProfile,maxOldSpaceMb}`). `addonDir` points at the
-* addon's built `dist`, so the manifest is one level up; we also try `addonDir` itself for layouts
-* where it IS the package root.
-* Result is cached per (dir,id) — spawns are infrequent but a runner may re-spawn on crash/restart.
-* Returns an empty declaration when the manifest is unreadable → treated as light, default ceiling.
-*/
-var heapProfileCache = /* @__PURE__ */ new Map();
-function readAddonHeapDeclaration(spec) {
-	const cacheKey = `${spec.addonDir}::${spec.addonId}`;
-	const cached = heapProfileCache.get(cacheKey);
-	if (cached !== void 0) return cached;
-	let declaration = EMPTY_HEAP_DECLARATION;
-	for (const manifestPath of [node_path.join(spec.addonDir, "package.json"), node_path.join(node_path.dirname(spec.addonDir), "package.json")]) try {
-		const raw = node_fs.readFileSync(manifestPath, "utf8");
-		const parsed = JSON.parse(raw);
-		const profile = extractHeapProfile(parsed, spec.addonId);
-		const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
-		const rssBudgetMb = extractRssBudgetMb(parsed, spec.addonId);
-		if (profile !== void 0 || maxOldSpaceMb !== void 0 || rssBudgetMb !== void 0) {
-			declaration = {
-				profile,
-				maxOldSpaceMb,
-				rssBudgetMb
-			};
-			break;
-		}
-		if (manifestHasAddon(parsed, spec.addonId)) break;
-	} catch {}
-	heapProfileCache.set(cacheKey, declaration);
-	return declaration;
-}
-/**
-* Drop the cached heap declaration for each addon so the NEXT `readAddonHeapDeclaration`
-* re-reads the manifest from disk. Called on operator-driven spawns / restarts
-* (a deploy may have changed `execution.heapProfile` / `execution.maxOldSpaceMb`); the
-* crash-respawn fast path deliberately does NOT invalidate — a crashing runner
-* has the same on-disk manifest, so re-reading it is pure overhead.
-*/
-function invalidateHeapProfiles(addons) {
-	for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
-}
-function manifestHasAddon(parsed, addonId) {
-	return readManifestAddons(parsed).some((a) => a.id === addonId);
-}
-function extractHeapProfile(parsed, addonId) {
-	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.heapProfile;
-	return value === "heavy" || value === "light" ? value : void 0;
-}
-function extractMaxOldSpaceMb(parsed, addonId) {
-	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
-}
-/**
-* `execution.rssBudgetMb` for one addon. Only a POSITIVE finite number is a budget: unlike
-* `maxOldSpaceMb`, `0` here is not an escape hatch that lifts a cap, it is an absent budget —
-* and an absent budget is reported as "unwatched", never rounded into a default.
-*/
-function extractRssBudgetMb(parsed, addonId) {
-	const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.rssBudgetMb;
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
-}
-function readManifestAddons(parsed) {
-	if (typeof parsed !== "object" || parsed === null) return [];
-	const camstack = parsed.camstack;
-	if (typeof camstack !== "object" || camstack === null) return [];
-	const addons = camstack.addons;
-	return Array.isArray(addons) ? addons : [];
-}
-/**
-* A runner is heavy if ANY co-located addon declares `heapProfile: 'heavy'` in its manifest.
-* Everything else (the un-annotated default) is a light control-plane runner. No hard-coded names.
-*/
-function isHeavyRunner(addons) {
-	return addons.some((a) => readAddonHeapDeclaration(a).profile === "heavy");
-}
-/**
-* Default old-space ceiling for a HEAVY runner, in MB.
-*
-* ## Why a heavy runner needs a ceiling at all
-*
-* `heapProfile: 'heavy'` used to mean "V8 defaults", i.e. no `--max-old-space-size` — which on this
-* host is V8's own memory-derived default (multiple GB). Nothing then bounds a burst, and V8 does
-* not hand committed pages back (the long argument for that is in `kernel/heap-watch.ts`), so a
-* one-off burst becomes the runner's permanent RSS.
-*
-* Measured on the live hub, 2026-08-17: the `recorder` runner reaches **2122 MB RSS** and stays
-* there. The same addon on two agent nodes carrying the same code and a smaller archive sits at
-* **58 MB**.
-*
-* ⚠ This paragraph used to attribute that ~2 GB to "walk garbage" from the deferred archive walk,
-* and to argue from a ~21 MB `RecordingIndex`. Both were wrong, and the error cost a session on
-* 2026-08-27. The deferred walk had NO CALLER and never ran (it has since been deleted). And the
-* index is not 21 MB: a 2026-08-27 profile of the live recorder read `heapUsed = 1606 MB` against
-* `external = 8 MB`, with an `smaps` census putting 1510 MB in V8's 256 KB page ranges against
-* 54 MB of native heap — LIVE JavaScript retainers, not high-water garbage. The retained set is
-* ~7.1 M `SegmentRow`s plus their path strings and Map entries (13 cameras x 2 profiles x 8 640
-* segments/day x ~30 days), reseeded at boot by `SegmentHourLedger.hydrateIndex`.
-*
-* The lesson for anyone sizing this flag: a heap number needs a RETAINER, and "garbage the GC has
-* no reason to collect" is the explanation to reach for last, not first.
-*
-* ## Why 1024
-*
-* From the same live topology snapshot, every heavy runner's FULL RSS — which is a strict
-* over-estimate of its old space, since it also contains native allocations, `external` and
-* `arrayBuffers`, none of which `--max-old-space-size` bounds:
-*
-*   detection 471 MB · provider-reolink 507 MB · pipeline-orchestrator 238 MB · ml 218 MB ·
-*   snapshot 185 MB · decoder-nodeav 174 MB · audio-analyzer 170 MB
-*
-* 1024 MB clears the largest of those by ~2x while cutting the recorder's observed ratchet by
-* more than half. It is a CEILING, not a target: a runner that fits today keeps behaving exactly
-* as it does now, because V8 only collects harder as it approaches the limit.
-*
-* A runner whose working set genuinely does not fit declares its own number in its manifest
-* (`execution.maxOldSpaceMb`) — the number belongs next to the addon that knows its working set.
-* `recorder` (3072 MB; peak 2341 MB heapTotal) is the one shipped addon that does. `stream-broker` does NOT, despite 1585 MB peak RSS: ~1 GB of that is
-* `arrayBuffers` (47 RTP rings), which this flag does not bound and never will — its actual old
-* space peaks at 224 MB. Size the declaration from `heapTotal` in the `[mem]` heartbeat, never
-* from RSS.
-*
-* ## What this flag CANNOT do
-*
-* It bounds old space and nothing else — not `external`, not `arrayBuffers`, not what a native
-* addon mallocs. `hub/pipeline-analytics` reached 7334 MB RSS with this flag set to 1024 the
-* whole time, because 96% of it was native. That half is bounded in `runner-native-allocator.ts`.
-* Reaching for a bigger number here when RSS is the complaint is the standard wrong move.
-*/
-var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
-/** Light runners' young-generation semi-space, in MB. */
-var LIGHT_SEMI_SPACE_MB = 2;
-/**
-* The runner's old-space ceiling in MB, or 0 for "uncapped".
-*
-* The runner takes the MAXIMUM ceiling any co-located addon declares — co-location must never
-* silence the hungriest member (D2/D29: a runner is respawned as a whole, so an OOM caused by
-* under-sizing one member kills every addon in the group). An addon declaring `0` therefore lifts
-* the cap for the whole runner, which is the intended escape hatch.
-*/
-function runnerMaxOldSpaceMb(addons, heavy) {
-	const envDefault = heavy ? HEAVY_MAX_OLD_MB_DEFAULT : 0;
-	const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
-	if (declared.length === 0) return envDefault;
-	if (declared.includes(0)) return 0;
-	return Math.max(...declared);
-}
-/**
-* The runner's declared RSS budget in MB, or `undefined` when NOBODY declared one.
-*
-* Same rule as the old-space ceiling, for the same reason (D2/D29): the runner takes the MAXIMUM
-* any co-located addon declares, because a runner is respawned as a whole and co-location must
-* never silence the hungriest member. It would be strictly worse here than for a heap ceiling —
-* an under-sized budget does not kill anything, it just cries wolf, and a watchdog that cries
-* wolf is a watchdog that gets muted.
-*
-* `undefined` propagates as an ABSENT env var, and the child then announces itself unwatched.
-* There is deliberately no class default: see `AddonExecution.rssBudgetMb`.
-*/
-function runnerRssBudgetMb(addons) {
-	const declared = addons.map((a) => readAddonHeapDeclaration(a).rssBudgetMb).filter((mb) => mb !== void 0);
-	return declared.length === 0 ? void 0 : Math.max(...declared);
-}
-/**
-* Per-placement V8 flags (Block D). LIGHT runners cap their young generation
-* (`--max-semi-space-size`) to reclaim V8's over-reservation — a measured ~15 MB/runner win — bound
-* V8's platform thread pool (`--v8-pool-size`, see {@link LIGHT_V8_POOL_SIZE_DEFAULT}: a measured
-* ~58 threads across the hub's 29 light runners, against a cgroup `pids.max` this host has already
-* hit) and carry no old-space cap unless a manifest declares one. HEAVY
-* runners keep V8's default young generation but ALWAYS carry an old-space ceiling; see
-* {@link HEAVY_MAX_OLD_MB_DEFAULT} for why, and how a runner declares its own.
-*
-* The per-addon override is the manifest's declared `maxOldSpaceMb` (`0` = uncapped); the
-* environment overrides and the `CAMSTACK_RUNNER_HEAP_TUNING=off` kill switch were removed on
-* 2026-10-06 — nothing had set them since the rollout.
-*/
-function runnerHeapFlags(addons) {
-	const heavy = isHeavyRunner(addons);
-	const flags = [];
-	if (!heavy) {
-		flags.push(`--max-semi-space-size=${LIGHT_SEMI_SPACE_MB}`);
-		flags.push(`--v8-pool-size=2`);
-	}
-	const oldMb = runnerMaxOldSpaceMb(addons, heavy);
-	if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
-	return flags;
-}
 var MAX_BACKOFF_MS = 3e4;
 var CRASH_WINDOW_MS = 6e4;
 var MAX_CRASHES_IN_WINDOW = 5;