@camstack/system 1.2.440 → 1.2.442

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $n as splitTranslationRef, Ar as errMsg$1, B as METHOD_ACCESS_MAP, Dn as objectInputDeclaresAddonId, Hr as asNumber, Ir as RUNTIME_DEFAULTS, Jt as extractNestedAddonId, Kn as scopesAllowAddon, Lr as ReadinessRegistry, Mr as DATAPLANE_SECRET_HEADER$1, Nn as procedureAuthKey, Nr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, On as objectInputDeclaresRequiredDeviceId, Pr as DEVICE_STATUS_METHOD, Qr as expandCapMethods, R as LOG_LEVEL_RANK, Rr as ReadinessTimeoutError, Si as EventCategory$1, Un as resolveMethodAuth, Ur as asString$1, Vr as asJsonObject$1, Xr as emitDownForOwnedCaps, _ as CatalogFileSchema, _n as logLevelAtMost, at as addonSettingsCapability, cn as kebabToCamel$1, d as CATALOG_LANGS, en as interpolate, fi as readinessKey, hi as scopeKey, li as parseJsonObject, n as AGENT_MDNS_TXT_KEYS, nn as isArrayOutputSchema, on as isObjectInput, pi as resolveCapMount, pn as lifecycleJobSchema, qn as scopesAllowDeviceCap, qr as createEvent$1, r as ALL_CAPABILITY_DEFINITIONS, rn as isCollectionArrayMethod, sn as isVoidInput, sr as supportedRuntimes, t as AGENT_MDNS_SERVICE_TYPE, ui as parseJsonUnknown, vn as looseSchema, xi as userError } from "./dist-9fcsrFU3.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DLKXYseS.mjs";
+import { $n as splitTranslationRef, Ar as errMsg$1, B as METHOD_ACCESS_MAP, Ci as EventCategory$1, Dn as objectInputDeclaresAddonId, Hr as asNumber, Ir as RUNTIME_DEFAULTS, Jt as extractNestedAddonId, Kn as scopesAllowAddon, Lr as ReadinessRegistry, Mr as DATAPLANE_SECRET_HEADER$1, Nn as procedureAuthKey, Nr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, On as objectInputDeclaresRequiredDeviceId, Pr as DEVICE_STATUS_METHOD, Qr as expandCapMethods, R as LOG_LEVEL_RANK, Rr as ReadinessTimeoutError, Si as userError, Un as resolveMethodAuth, Ur as asString$1, Vr as asJsonObject$1, Xr as emitDownForOwnedCaps, _ as CatalogFileSchema, _n as logLevelAtMost, at as addonSettingsCapability, cn as kebabToCamel$1, d as CATALOG_LANGS, di as parseJsonUnknown, en as interpolate, gi as scopeKey, mi as resolveCapMount, n as AGENT_MDNS_TXT_KEYS, nn as isArrayOutputSchema, on as isObjectInput, pi as readinessKey, pn as lifecycleJobSchema, qn as scopesAllowDeviceCap, qr as createEvent$1, r as ALL_CAPABILITY_DEFINITIONS, rn as isCollectionArrayMethod, sn as isVoidInput, sr as supportedRuntimes, t as AGENT_MDNS_SERVICE_TYPE, ui as parseJsonObject, vn as looseSchema } from "./dist-DsrQYcLm.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-BJpYTAPg.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -24,21 +24,21 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend } from "./wal-maintenance-BZGmF-3U.mjs";
+import { c as SqliteSettingsBackend } from "./wal-maintenance-DE8QrreK.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-U0d4uvn2.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-CIzPjw7L.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-2iWQ-Nx-.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-CyUuhATc.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-Dy2YjRqC.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BS2akjWx.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DgvDecXM.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-RaA3uZ7H.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -23017,6 +23017,50 @@ function createRunnerAddonSettings(client, addonId, before = async () => {}) {
 	};
 }
 //#endregion
+//#region src/kernel/addon-refused-error.ts
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+var AddonRefusedError = class extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	code;
+	/** What the operator does about it. */
+	remedy;
+	constructor(code, message, remedy, options) {
+		super(message, options);
+		this.name = "AddonRefusedError";
+		this.code = code;
+		this.remedy = remedy;
+	}
+};
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+function findAddonRefusal(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== null && current !== void 0 && !seen.has(current)) {
+		if (current instanceof AddonRefusedError) return current;
+		seen.add(current);
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return null;
+}
+//#endregion
 //#region src/kernel/legacy-blob-guard.ts
 /** Root keys retired long before D870: they never count as "settings still to migrate". */
 var OWN_RETIRED_ROOT_KEYS = new Set([
@@ -23032,9 +23076,13 @@ function isRetiredRootKey(addonId, key) {
 	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
 	return RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
 }
-var UnmigratedSettingsError = class extends Error {
+/** Stable `code` of the D870 refusal. */
+var UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
+/** The remedy the refusal (and the update pre-flight) names. */
+var UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
+var UnmigratedSettingsError = class extends AddonRefusedError {
 	constructor(addonId, what) {
-		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		super(UNMIGRATED_SETTINGS_CODE, `addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`, UNMIGRATED_SETTINGS_REMEDY);
 		this.name = "UnmigratedSettingsError";
 	}
 };
@@ -25007,6 +25055,27 @@ var AddonHealthMonitor = class {
 	}
 };
 //#endregion
+//#region src/kernel/moleculer/runner-refusal.ts
+var REFUSED_PREFIX = "REFUSED:";
+function isReport(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rec = value;
+	return typeof rec["addonId"] === "string" && typeof rec["code"] === "string" && typeof rec["reason"] === "string" && typeof rec["remedy"] === "string";
+}
+/** The refusals announced in a chunk of runner stdout; lines that are not one are ignored. */
+function parseRunnerRefusals(nodeId, chunk) {
+	const prefix = `${REFUSED_PREFIX}${nodeId}:`;
+	const out = [];
+	for (const line of chunk.split("\n")) {
+		if (!line.startsWith(prefix)) continue;
+		try {
+			const parsed = JSON.parse(line.slice(prefix.length));
+			if (isReport(parsed)) out.push(parsed);
+		} catch {}
+	}
+	return out;
+}
+//#endregion
 //#region src/kernel/moleculer/crash-supervisor.ts
 /** Per-runner crash circuit-breaker. Replaces the old infinite-respawn loop. */
 var CrashSupervisor = class {
@@ -25645,6 +25714,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	const groupOps = deps?.processGroups ?? defaultProcessGroupOps;
 	const runnersOwnGroups = runnerOwnsProcessGroup(deps?.platform ?? process.platform);
 	const processes = /* @__PURE__ */ new Map();
+	const backingOff = /* @__PURE__ */ new Map();
 	const pendingGroupReaps = /* @__PURE__ */ new Map();
 	const runnerLocks = /* @__PURE__ */ new Map();
 	function withRunnerLock(runnerId, fn) {
@@ -25685,6 +25755,19 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 		}, data));
 	}
 	/**
+	* Every transition a supervisor or a boot check can settle on (D877):
+	* `running` (READY), `crashed`, `failed`, `refused`. In-process telemetry - the
+	* boot check re-evaluates on it and the alert centre closes a recovered runner.
+	*/
+	function emitStateChange(entry) {
+		emitRunnerEvent(EventCategory$1.ProcessStateChanged, entry.name, {
+			runnerId: entry.name,
+			nodeId: parentNodeId,
+			addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+			state: entry.state
+		});
+	}
+	/**
 	* One line per reap that found something, or that failed. An empty group is the
 	* normal case after a clean stop and stays quiet at debug. The kernel cannot say
 	* which device a child served — the runner id is the finest attribution it has.
@@ -25749,6 +25832,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	*/
 	function spawnRunner(runnerId, addons, env) {
 		const nodeId = buildNodeId(runnerId);
+		backingOff.delete(runnerId);
 		const runnerPath = path$1.resolve(__dirname, "addon-runner.js");
 		const heavy = isHeavyRunner(addons);
 		const rssBudgetMb = runnerRssBudgetMb(addons);
@@ -25789,6 +25873,8 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			startedAt: Date.now(),
 			restartCount: 0,
 			state: "starting",
+			refusal: null,
+			announcedRefusal: null,
 			child,
 			ownsGroup,
 			groupReap: null
@@ -25798,7 +25884,13 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			kill: groupOps.kill
 		});
 		child.stdout?.on("data", (data) => {
-			if (data.toString().includes(`READY:${nodeId}`) && entry.state === "starting") entry.state = "running";
+			const text = data.toString();
+			const refusals = parseRunnerRefusals(nodeId, text);
+			if (refusals[0] !== void 0) entry.announcedRefusal = refusals[0];
+			if (text.includes(`READY:${nodeId}`) && entry.state === "starting") {
+				entry.state = "running";
+				emitStateChange(entry);
+			}
 		});
 		child.stderr?.on("data", (data) => {
 			process.stderr.write(`[${runnerId}] ${data.toString()}`);
@@ -25807,7 +25899,33 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			console.error(`[process-service EXIT] runner=${runnerId} code=${String(code)} signal=${String(signal)} state=${entry.state}`);
 			const groupReap = reapRunnerGroup(entry);
 			if (entry.state === "stopped") return;
+			const announced = entry.announcedRefusal;
+			entry.announcedRefusal = null;
+			if (code === 78) {
+				const refusal = announced ?? {
+					addonId: entry.runnerAddons[0]?.addonId ?? runnerId,
+					code: "unknown",
+					reason: "the runner exited with the refusal code without saying why",
+					remedy: "Read the runner log, fix the cause, then restart the addon."
+				};
+				entry.refusal = refusal;
+				entry.state = "refused";
+				capturedBroker?.logger.error(`[${runnerId}] Addon refused to start (${refusal.code}): ${refusal.reason} Not respawning; ${refusal.remedy}`, { tags: { runnerId } });
+				processes.set(runnerId, entry);
+				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
+				emitRunnerEvent(EventCategory$1.AddonRunnerRefused, runnerId, {
+					runnerId,
+					nodeId: parentNodeId,
+					addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+					code: refusal.code,
+					reason: refusal.reason,
+					remedy: refusal.remedy
+				});
+				emitStateChange(entry);
+				return;
+			}
 			entry.state = "crashed";
+			emitStateChange(entry);
 			capturedBroker?.logger.error(`[${runnerId}] Process exited (code=${code}, signal=${signal})`);
 			const decision = crashSupervisor.recordCrash(runnerId);
 			emitRunnerEvent(EventCategory$1.ProcessCrashed, runnerId, {
@@ -25817,6 +25935,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			});
 			if (decision.action === "failed") {
 				entry.state = "failed";
+				emitStateChange(entry);
 				capturedBroker?.logger.error(`[${runnerId}] Crash circuit-breaker tripped — ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms. Not respawning.`);
 				processes.set(runnerId, entry);
 				if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
@@ -25841,10 +25960,12 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				delayMs: decision.backoffMs
 			});
 			processes.delete(runnerId);
+			backingOff.set(runnerId, entry);
 			if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
 			setTimeout(() => {
 				withRunnerLock(runnerId, async () => {
 					await groupReap;
+					backingOff.delete(runnerId);
 					if (processes.has(runnerId)) return;
 					const restarted = spawnRunner(runnerId, addons, env);
 					restarted.restartCount = entry.restartCount + 1;
@@ -25884,7 +26005,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						reason: "not found"
 					};
 					const deadNodeId = target.nodeId;
-					const alreadyDead = target.state === "failed" || target.child.exitCode !== null || target.child.signalCode !== null;
+					const alreadyDead = target.state === "failed" || target.state === "refused" || target.child.exitCode !== null || target.child.signalCode !== null;
 					target.state = "stopped";
 					if (!alreadyDead) {
 						target.child.kill("SIGTERM");
@@ -25921,7 +26042,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 					const { runnerAddons } = target;
 					const deadNodeId = target.nodeId;
 					const prevRestartCount = target.restartCount;
-					const alreadyDead = target.state === "failed" || target.child.exitCode !== null || target.child.signalCode !== null;
+					const alreadyDead = target.state === "failed" || target.state === "refused" || target.child.exitCode !== null || target.child.signalCode !== null;
 					target.state = "stopped";
 					if (!alreadyDead) {
 						target.child.kill("SIGTERM");
@@ -25950,7 +26071,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				});
 			} },
 			list: { async handler() {
-				const entries = [...processes.values()];
+				const entries = [...processes.values(), ...backingOff.values()];
 				const stats = await getPidStats$1(entries.filter((p) => p.pid > 0).map((p) => p.pid));
 				return entries.map((p) => {
 					const s = stats.get(p.pid);
@@ -25966,6 +26087,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						startedAt: p.startedAt,
 						restartCount: p.restartCount,
 						state: p.state,
+						...p.refusal !== null ? { refusal: p.refusal } : {},
 						cpuPercent: s?.cpu ?? 0,
 						memoryRss: s?.memoryRss ?? 0,
 						uptimeSeconds: Math.floor((Date.now() - p.startedAt) / 1e3)
@@ -25982,7 +26104,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						if (!entry) return;
 						const { runnerAddons } = entry;
 						const prevRestartCount = entry.restartCount;
-						if (!(entry.state === "failed" || entry.child.exitCode !== null || entry.child.signalCode !== null)) {
+						if (!(entry.state === "failed" || entry.state === "refused" || entry.child.exitCode !== null || entry.child.signalCode !== null)) {
 							entry.state = "stopped";
 							entry.child.kill("SIGTERM");
 							await new Promise((resolve) => {
@@ -26037,6 +26159,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						startedAt: p.startedAt,
 						restartCount: p.restartCount,
 						state: p.state,
+						...p.refusal !== null ? { refusal: p.refusal } : {},
 						cpuPercent: s?.cpu ?? 0,
 						memoryRss: s?.memoryRss ?? 0,
 						uptimeSeconds: Math.floor((Date.now() - p.startedAt) / 1e3)
@@ -27149,4 +27272,4 @@ function resetCatalogRegistryForTests() {
 	shared = null;
 }
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/addon-refused-error.d.ts

@@ -0,0 +1,30 @@
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+export declare class AddonRefusedError extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	readonly code: string;
+	/** What the operator does about it. */
+	readonly remedy: string;
+	constructor(code: string, message: string, remedy: string, options?: {
+		cause?: unknown;
+	});
+}
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+export declare function findAddonRefusal(err: unknown): AddonRefusedError | null;

package/dist/kernel/index.d.ts

@@ -91,6 +91,9 @@ export { localProviderLink, brokerTransportLink, deviceCapResolverLink, ipcParen
 export type { LocalProviderResolver, BrokerCapCallOpts } from "./moleculer/trpc-links.js";
 export { createProcessService } from "./moleculer/process-service.js";
 export type { ProcessInfo } from "./moleculer/process-service.js";
+export { AddonRefusedError, findAddonRefusal } from "./addon-refused-error.js";
+export { UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UnmigratedSettingsError, assertLegacyBlobsMigrated, type LegacyGuardClient } from "./legacy-blob-guard.js";
+export type { RunnerRefusalReport } from "./moleculer/runner-refusal.js";
 export { signalAllRunnerGroups } from "./moleculer/runner-process-group.js";
 export { CapUsageRegistry, getCapUsageRegistry, PARENT_ROUTED_PROVIDER_ADDON_ID, __resetCapUsageRegistryForTests } from "./moleculer/cap-usage-registry.js";
 export type { CapUsageCallRecord, CapUsageEdge, CapUsageRegistryOptions, CapUsageStats } from "./moleculer/cap-usage-registry.js";

package/dist/kernel/legacy-blob-guard.d.ts

@@ -13,6 +13,7 @@
 * quiet by itself once `--drop` removed the old tables.
 */
 import type { IScopedLogger } from "@camstack/types";
+import { AddonRefusedError } from "./addon-refused-error.js";
 /** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
 export declare function isRetiredRootKey(addonId: string, key: string): boolean;
 /** The client calls the guard uses. */
@@ -48,7 +49,11 @@ export interface LegacyGuardClient {
 		}): Promise<unknown>;
 	};
 }
-export declare class UnmigratedSettingsError extends Error {
+/** Stable `code` of the D870 refusal. */
+export declare const UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
+/** The remedy the refusal (and the update pre-flight) names. */
+export declare const UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
+export declare class UnmigratedSettingsError extends AddonRefusedError {
 	constructor(addonId: string, what: string);
 }
 /**

package/dist/kernel/moleculer/process-service.d.ts

@@ -1,3 +1,4 @@
+import { type RunnerRefusalReport } from "./runner-refusal.js";
 import { type ChildProcess, type SpawnOptions } from "node:child_process";
 import type { ServiceSchema } from "moleculer";
 import { type RunnerAddonSpec } from "./runner-heap-flags.js";
@@ -24,7 +25,19 @@ interface SpawnedProcess {
 	* and the runner will NOT be respawned. `crashed` is transient — the
 	* window between an exit and the next backoff respawn.
 	*/
-	state: "starting" | "running" | "stopping" | "stopped" | "crashed" | "failed";
+	state: "starting" | "running" | "stopping" | "stopped" | "crashed" | "failed" | "refused";
+	/**
+	* `refused` (D877): the hosted addon said, in a typed way, that it will not
+	* start. Terminal like `failed`, but NOT a crash - the D6 breaker never saw
+	* it - and an operator restart retries it. The reason is the addon's own.
+	*/
+	refusal: RunnerRefusalReport | null;
+	/**
+	* The `REFUSED:` line the runner wrote. It is honoured ONLY together with
+	* exit code 78 and is dropped on any other exit (a runner that announced a
+	* refusal and then died of something else did not refuse).
+	*/
+	announcedRefusal: RunnerRefusalReport | null;
 	child: ChildProcess;
 	/** The runner leads its own process group (POSIX, D668); its pgid is its `pid`. */
 	readonly ownsGroup: boolean;
@@ -50,6 +63,8 @@ interface ProcessInfo {
 	readonly startedAt: number;
 	readonly restartCount: number;
 	readonly state: string;
+	/** Why the runner is `refused` (D877); absent otherwise. */
+	readonly refusal?: RunnerRefusalReport;
 	readonly cpuPercent: number;
 	readonly memoryRss: number;
 	readonly uptimeSeconds: number;

package/dist/kernel/moleculer/runner-refusal.d.ts

@@ -0,0 +1,27 @@
+/**
+* The runner -> parent half of the Init-refusal protocol (D877).
+*
+* A runner whose addon refused to start writes ONE line to stdout and exits
+* with {@link RUNNER_REFUSED_EXIT_CODE}:
+*
+*   REFUSED:<nodeId>:<json {addonId, code, reason, remedy}>
+*
+* The parent reads the line to learn the reason; the exit code alone is enough
+* to know it was a refusal (so a line lost to a closed pipe still classifies
+* correctly, with an unknown reason). Neither is a crash: the process service
+* does not hand the exit to the D6 breaker.
+*/
+import { AddonRefusedError } from "../addon-refused-error.js";
+/** sysexits EX_CONFIG: "something was found in an unconfigured or misconfigured state". */
+export declare const RUNNER_REFUSED_EXIT_CODE = 78;
+export interface RunnerRefusalReport {
+	readonly addonId: string;
+	readonly code: string;
+	readonly reason: string;
+	readonly remedy: string;
+}
+/** The stdout line for a refusal. Always one line: JSON has no raw newline. */
+export declare function formatRunnerRefusalLine(nodeId: string, report: RunnerRefusalReport): string;
+export declare function refusalReportOf(addonId: string, err: AddonRefusedError): RunnerRefusalReport;
+/** The refusals announced in a chunk of runner stdout; lines that are not one are ignored. */
+export declare function parseRunnerRefusals(nodeId: string, chunk: string): readonly RunnerRefusalReport[];

package/dist/{restore-archive-49aZwkp8.js → restore-archive-Cdf09dHm.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BKhlcYz6.js");
+const require_dist = require("./dist-CyIHDLCg.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");