@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/shared/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/shared/tokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AA0BxD,MAAM,CAAC,MAAM,kBAAkB,GAA+B,WAAW,CAAsB,cAAc,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,iBAAiB,GAAsB,WAAW,CAAa,YAAY,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAsB,WAAW,CAAa,YAAY,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,sBAAsB,GAA4B,WAAW,CAAmB,iBAAiB,CAAC,CAAC;AAEhH,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAoC,WAAW,CAA2B,YAAY,CAAC,CAAC;AACtH,oCAAoC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAuB,WAAW,CAAc,aAAa,CAAC,CAAC;AAC9F,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAA+B,WAAW,CAAsB,cAAc,CAAC,CAAC;AAEhH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAwB,WAAW,CAAe,cAAc,CAAC,CAAC;AAClG,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAwB,WAAW,CAAe,sBAAsB,CAAC,CAAC;AAC1G,6CAA6C;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAyB,WAAW,CAAgB,eAAe,CAAC,CAAC;AACtG,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAA8B,WAAW,CAAqB,oBAAoB,CAAC,CAAC;AAC3H,oCAAoC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAA4B,WAAW,CAAmB,kBAAkB,CAAC,CAAC;AAClH,oCAAoC;AACpC,MAAM,CAAC,MAAM,wBAAwB,GAA6B,WAAW,CAAoB,mBAAmB,CAAC,CAAC;AACtH,+BAA+B;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAA2B,WAAW,CAAkB,iBAAiB,CAAC,CAAC;AAC9G,kCAAkC;AAClC,MAAM,CAAC,MAAM,qBAAqB,GAAiC,WAAW,CAAwB,uBAAuB,CAAC,CAAC;AAC/H,yCAAyC;AACzC,MAAM,CAAC,MAAM,oBAAoB,GAAyB,WAAW,CAAgB,eAAe,CAAC,CAAC;AACtG,gCAAgC;AAChC,MAAM,CAAC,MAAM,qBAAqB,GAA0B,WAAW,CAAiB,gBAAgB,CAAC,CAAC;AAC1G,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAiC,WAAW,CAAwB,uBAAuB,CAAC,CAAC;AAE/H,oCAAoC;AACpC,MAAM,CAAC,MAAM,yBAAyB,GAA8B,WAAW,CAAqB,oBAAoB,CAAC,CAAC;AAC1H,yDAAyD;AACzD,MAAM,CAAC,MAAM,4BAA4B,GAAiC,WAAW,CAAwB,uBAAuB,CAAC,CAAC;AAEtI,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAA0B,WAAW,CAAiB,gBAAgB,CAAC,CAAC;AAE1G,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAA+B,WAAW,CAAsB,cAAc,CAAC,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/shared/tokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AA2BxD,MAAM,CAAC,MAAM,kBAAkB,GAA+B,WAAW,CAAsB,cAAc,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,iBAAiB,GAAsB,WAAW,CAAa,YAAY,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAsB,WAAW,CAAa,YAAY,CAAC,CAAC;AAC1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B,WAAW,CAAmB,kBAAkB,CAAC,CAAC;AACnH,MAAM,CAAC,MAAM,sBAAsB,GAA4B,WAAW,CAAmB,iBAAiB,CAAC,CAAC;AAEhH,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAoC,WAAW,CAA2B,YAAY,CAAC,CAAC;AACtH,oCAAoC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAuB,WAAW,CAAc,aAAa,CAAC,CAAC;AAC9F,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAA+B,WAAW,CAAsB,cAAc,CAAC,CAAC;AAEhH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAwB,WAAW,CAAe,cAAc,CAAC,CAAC;AAClG,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAwB,WAAW,CAAe,sBAAsB,CAAC,CAAC;AAC1G,6CAA6C;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAyB,WAAW,CAAgB,eAAe,CAAC,CAAC;AACtG,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAA8B,WAAW,CAAqB,oBAAoB,CAAC,CAAC;AAC3H,oCAAoC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAA4B,WAAW,CAAmB,kBAAkB,CAAC,CAAC;AAClH,oCAAoC;AACpC,MAAM,CAAC,MAAM,wBAAwB,GAA6B,WAAW,CAAoB,mBAAmB,CAAC,CAAC;AACtH,+BAA+B;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAA2B,WAAW,CAAkB,iBAAiB,CAAC,CAAC;AAC9G,kCAAkC;AAClC,MAAM,CAAC,MAAM,qBAAqB,GAAiC,WAAW,CAAwB,uBAAuB,CAAC,CAAC;AAC/H,yCAAyC;AACzC,MAAM,CAAC,MAAM,oBAAoB,GAAyB,WAAW,CAAgB,eAAe,CAAC,CAAC;AACtG,gCAAgC;AAChC,MAAM,CAAC,MAAM,qBAAqB,GAA0B,WAAW,CAAiB,gBAAgB,CAAC,CAAC;AAE1G;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,WAAW,CAAsD,cAAc,CAAC,CAAC;AACnF,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAiC,WAAW,CAAwB,uBAAuB,CAAC,CAAC;AAE/H,oCAAoC;AACpC,MAAM,CAAC,MAAM,yBAAyB,GAA8B,WAAW,CAAqB,oBAAoB,CAAC,CAAC;AAC1H,yDAAyD;AACzD,MAAM,CAAC,MAAM,4BAA4B,GAAiC,WAAW,CAAwB,uBAAuB,CAAC,CAAC;AAEtI,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAA0B,WAAW,CAAiB,gBAAgB,CAAC,CAAC;AAE1G,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAChF,EAAE;AACF,+DAA+D;AAC/D,mEAAmE;AACnE,oEAAoE;AACpE,gEAAgE;AAChE,8DAA8D;AAC9D,0CAA0C;AAE1C,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAkB,WAAW,CAAS,WAAW,CAAC,CAAC;AAChF,iEAAiE;AACjE,MAAM,CAAC,MAAM,wBAAwB,GACnC,WAAW,CAAqB,iBAAiB,CAAC,CAAC;AACrD,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAkB,WAAW,CAAS,mBAAmB,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,yBAAyB,GACpC,WAAW,CAAqB,mBAAmB,CAAC,CAAC;AAEvD,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAA+B,WAAW,CAAsB,cAAc,CAAC,CAAC"}

package/dist/webapp/webapp.service.d.ts

@@ -10,16 +10,47 @@
  * Architecture:
  *   Browser → :9800 (nginx) → static files (webapp dist/)
  *                             → /api/* → :9801 (daemon Netron HTTP)
- *                             → /ws → :9801 (WebSocket upgrade)
+ *                             → /ws → :9802 (daemon Netron WebSocket transport)
  */
 import type { ILogger } from '@omnitron-dev/titan/module/logger';
+export declare function generateNginxConfig(apiHost: string, apiPort: number, wsPort: number): string;
 export declare class WebappService {
     private readonly logger;
     private readonly apiPort;
     private readonly publicPort;
+    /**
+     * Interface the console's port is published on. Loopback by default.
+     *
+     * The daemon binds its own HTTP transport to 127.0.0.1, but the console's
+     * nginx container published `-p 9800:80` — every interface — and proxies
+     * `/netron/` straight to that daemon port. So the whole RPC surface was
+     * reachable from the network, and the methods that carry
+     * `allowAnonymous` were reachable without credentials: app metrics could
+     * be read, and `OmnitronTelemetry.pushBatch` accepted arbitrary rows into
+     * the daemon's `logs` table. Verified by writing one and deleting it.
+     *
+     * Set `daemon.consoleBindHost` to '0.0.0.0' to publish it, deliberately,
+     * to a network where something else is doing the authenticating.
+     */
+    private readonly bindHost;
     private readonly webappDir;
     private readonly configDir;
-    constructor(logger: ILogger, _projectRoot?: string, apiPort?: number, publicPort?: number);
+    constructor(logger: ILogger, _projectRoot?: string, apiPort?: number, publicPort?: number, 
+    /**
+     * Interface the console's port is published on. Loopback by default.
+     *
+     * The daemon binds its own HTTP transport to 127.0.0.1, but the console's
+     * nginx container published `-p 9800:80` — every interface — and proxies
+     * `/netron/` straight to that daemon port. So the whole RPC surface was
+     * reachable from the network, and the methods that carry
+     * `allowAnonymous` were reachable without credentials: app metrics could
+     * be read, and `OmnitronTelemetry.pushBatch` accepted arbitrary rows into
+     * the daemon's `logs` table. Verified by writing one and deleting it.
+     *
+     * Set `daemon.consoleBindHost` to '0.0.0.0' to publish it, deliberately,
+     * to a network where something else is doing the authenticating.
+     */
+    bindHost?: string);
     /**
      * Build the webapp using vite.
      */

package/dist/webapp/webapp.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webapp.service.d.ts","sourceRoot":"","sources":["../../src/webapp/webapp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAmGjE,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAP7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,MAAM,EAAE,OAAO,EAChC,YAAY,CAAC,EAAE,MAAM,EACJ,OAAO,GAAE,MAAa,EACtB,UAAU,GAAE,MAAa;IAW5C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB9D;;;;OAIG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DzD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAS7E;;OAEG;IACH,OAAO,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"webapp.service.d.ts","sourceRoot":"","sources":["../../src/webapp/webapp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AA0CjE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAoH5F;AAMD,qBAAa,aAAa;IAKtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAtB3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YACmB,MAAM,EAAE,OAAO,EAChC,YAAY,CAAC,EAAE,MAAM,EACJ,OAAO,GAAE,MAAa,EACtB,UAAU,GAAE,MAAa;IAC1C;;;;;;;;;;;;;OAaG;IACc,QAAQ,GAAE,MAAoB,EAShD;IAED;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAsB7D;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2FxD;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ1B;IAED;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAO5E;IAED;;OAEG;IACH,OAAO,IAAI,OAAO,CAEjB;CACF"}

package/dist/webapp/webapp.service.js

@@ -10,19 +10,41 @@
  * Architecture:
  *   Browser → :9800 (nginx) → static files (webapp dist/)
  *                             → /api/* → :9801 (daemon Netron HTTP)
- *                             → /ws → :9801 (WebSocket upgrade)
+ *                             → /ws → :9802 (daemon Netron WebSocket transport)
  */
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { createContainer, removeContainer, getContainerState, stopContainer, waitForHealthy, ensureImage, } from '../infrastructure/container-runtime.js';
+import { createContainer, removeContainer, getContainerState, stopContainer, waitForHealthy, ensureImage, containerSpecHash, } from '../infrastructure/container-runtime.js';
 import { resolveOmnitronNginx } from '../infrastructure/service-resolver.js';
 const exec = promisify(execFile);
 // =============================================================================
 // Nginx Config Template
 // =============================================================================
-function generateNginxConfig(apiHost, apiPort) {
+/**
+ * The console's security headers.
+ *
+ * Repeated verbatim in every location block that sets any header of its own:
+ * nginx's `add_header` does not merge with an outer scope — declaring one
+ * header inside a location DROPS every header inherited from `server`. That
+ * rule silently stripped Referrer-Policy and Permissions-Policy from
+ * index.html the first time this config was deployed.
+ */
+const SECURITY_HEADERS = [
+    'add_header X-Content-Type-Options "nosniff" always;',
+    'add_header Referrer-Policy "no-referrer" always;',
+    'add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;',
+    // style-src allows 'unsafe-inline' because Emotion (MUI's engine) injects
+    // component styles as inline <style> at runtime; script-src does not, which
+    // is the half that matters for injection.
+    `add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'" always;`,
+];
+/** Render the header set at a given indentation. */
+function securityHeaders(indent) {
+    return SECURITY_HEADERS.map((h) => `${indent}${h}`).join('\n');
+}
+export function generateNginxConfig(apiHost, apiPort, wsPort) {
     return `
 worker_processes auto;
 
@@ -46,6 +68,9 @@ http {
     gzip_min_length 1024;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;
 
+    # Don't advertise the nginx version on every response / error page.
+    server_tokens off;
+
     server {
         listen 80;
         server_name _;
@@ -54,6 +79,16 @@ http {
         root /usr/share/nginx/html;
         index index.html;
 
+        # --- Security headers -------------------------------------------------
+        # The console is an infrastructure control plane: it can start and stop
+        # processes, read logs and hold an operator session. It had no security
+        # headers at all, so a single injected script or a framing page was
+        # enough to drive it.
+        #
+        # The 'always' flag is required — without it nginx omits the header on
+        # error responses, which is exactly where an injection would surface.
+${securityHeaders('        ')}
+
         # API Gateway — proxy to daemon Netron HTTP
         location /netron/ {
             proxy_pass http://${apiHost}:${apiPort}/netron/;
@@ -75,26 +110,53 @@ http {
             proxy_pass http://${apiHost}:${apiPort}/metrics;
         }
 
-        # WebSocket support
+        # WebSocket support — the daemon's Netron WS transport listens on a
+        # separate port (httpPort + 2 = 9802) and serves at the root path, so
+        # the trailing slash rewrites "/ws" → "/" on the upstream.
         location /ws {
-            proxy_pass http://${apiHost}:${apiPort}/ws;
+            proxy_pass http://${apiHost}:${wsPort}/;
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
-            proxy_set_header Host $host;
+            # Forward the FULL Host incl. port ($http_host, not $host which
+            # strips it). The daemon's WS same-host origin guard compares the
+            # Origin header's host ("localhost:9800") against request Host; with
+            # the port stripped it sees "localhost" and rejects every upgrade,
+            # leaving the console stuck on HTTP polling.
+            proxy_set_header Host $http_host;
+            proxy_set_header Origin $http_origin;
             proxy_read_timeout 3600s;
         }
 
+        # Vite emits content-hashed asset filenames — "alerts-CEojylud.js":
+        # a DASH, then a base64url hash. (An earlier pattern here expected a
+        # dot and lowercase hex, matched nothing, and quietly demoted every
+        # asset to the 1-hour bucket below.) A changed file gets a new name,
+        # so these are immutable. Must precede the SPA fallback location.
+        location ~* "-[A-Za-z0-9_-]{8,}\\.(js|css|woff2?|ttf|otf|png|jpe?g|gif|svg|webp|avif|ico|map)$" {
+            add_header Cache-Control "public, max-age=31536000, immutable" always;
+${securityHeaders('            ')}
+            try_files $uri =404;
+        }
+
+        # Unhashed assets still get a short cache with revalidation.
+        location ~* "\\.(js|css|woff2?|ttf|otf|png|jpe?g|gif|svg|webp|avif|ico)$" {
+            add_header Cache-Control "public, max-age=3600, must-revalidate" always;
+${securityHeaders('            ')}
+            try_files $uri =404;
+        }
+
+        # index.html must never be cached: it carries the hashed asset names,
+        # so a stale copy pins the whole app to a previous deploy.
+        location = /index.html {
+            add_header Cache-Control "no-cache, must-revalidate" always;
+${securityHeaders('            ')}
+        }
+
         # SPA fallback — all non-file routes serve index.html
         location / {
             try_files $uri $uri/ /index.html;
         }
-
-        # Cache static assets aggressively
-        location ~* \\.(js|css|woff2|ttf|png|jpg|svg|ico)$ {
-            expires 7d;
-            add_header Cache-Control "public";
-        }
     }
 }
 `.trim();
@@ -106,12 +168,29 @@ export class WebappService {
     logger;
     apiPort;
     publicPort;
+    bindHost;
     webappDir;
     configDir;
-    constructor(logger, _projectRoot, apiPort = 9801, publicPort = 9800) {
+    constructor(logger, _projectRoot, apiPort = 9801, publicPort = 9800, 
+    /**
+     * Interface the console's port is published on. Loopback by default.
+     *
+     * The daemon binds its own HTTP transport to 127.0.0.1, but the console's
+     * nginx container published `-p 9800:80` — every interface — and proxies
+     * `/netron/` straight to that daemon port. So the whole RPC surface was
+     * reachable from the network, and the methods that carry
+     * `allowAnonymous` were reachable without credentials: app metrics could
+     * be read, and `OmnitronTelemetry.pushBatch` accepted arbitrary rows into
+     * the daemon's `logs` table. Verified by writing one and deleting it.
+     *
+     * Set `daemon.consoleBindHost` to '0.0.0.0' to publish it, deliberately,
+     * to a network where something else is doing the authenticating.
+     */
+    bindHost = '127.0.0.1') {
         this.logger = logger;
         this.apiPort = apiPort;
         this.publicPort = publicPort;
+        this.bindHost = bindHost;
         // Resolve webapp dir — find it relative to this module's location (not CWD)
         const thisDir = path.dirname(new URL(import.meta.url).pathname);
         // thisDir = .../apps/omnitron/src/webapp/ or .../apps/omnitron/dist/webapp/
@@ -151,11 +230,53 @@ export class WebappService {
      */
     async start(options) {
         const force = options?.force ?? false;
-        // 1. Check if container is already running
-        if (!force) {
+        // 1. Render the config we WANT before deciding whether to keep the running
+        //    container.
+        //
+        //    This ordering matters. `start()` used to return as soon as it saw a
+        //    healthy container, without ever comparing configuration — so an
+        //    edit to the nginx template took effect only if someone happened to
+        //    remove the container by hand. The security headers added in this
+        //    same change went live only after a manual recreate, which is exactly
+        //    the drift the infrastructure reconciler already guards against for
+        //    every other managed container.
+        //
+        //    WS transport lives on httpPort + 2; daemon HTTP (apiPort) is
+        //    httpPort + 1.
+        const nginxConfig = generateNginxConfig('host.docker.internal', this.apiPort, this.apiPort + 1);
+        const configPath = path.join(this.configDir, 'nginx.conf');
+        const appliedConfig = fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf-8') : null;
+        const configChanged = appliedConfig !== nginxConfig;
+        // The container spec we want, needed here rather than at creation time
+        // because step 2 compares it against what is actually running.
+        const distPathForSpec = path.join(this.webappDir, 'dist');
+        const desiredSpec = resolveOmnitronNginx({
+            port: this.publicPort,
+            internalApiPort: this.apiPort,
+            webappDistPath: distPathForSpec,
+            bindHost: this.bindHost,
+        });
+        desiredSpec.volumes.push({ source: configPath, target: '/etc/nginx/nginx.conf', readonly: true });
+        const desiredHash = containerSpecHash(desiredSpec);
+        // 2. Keep a healthy container only when it is running the current config
+        //    AND the current spec.
+        //
+        //    The config comparison alone was not enough: changing the published
+        //    port, its bind address, the image or a volume leaves nginx.conf
+        //    identical, so a healthy container kept running with the old spec and
+        //    the change took effect only if someone removed it by hand. Found by
+        //    binding the port to loopback and watching `docker ps` still report
+        //    0.0.0.0 after a full daemon restart.
+        //
+        //    Every other managed container is reconciled on this hash already;
+        //    the console was the one that reconciled on a file instead.
+        if (!force && !configChanged) {
             const state = await getContainerState('omnitron-nginx');
             if (state?.status === 'running') {
-                if (state.health === 'healthy') {
+                if (state.specHash && state.specHash !== desiredHash) {
+                    this.logger.info({ current: state.specHash, desired: desiredHash }, 'Console container spec changed — recreating');
+                }
+                else if (state.health === 'healthy') {
                     this.logger.info({ port: this.publicPort }, 'Omnitron Console is already running');
                     return;
                 }
@@ -163,31 +284,22 @@ export class WebappService {
                 this.logger.warn('Nginx container running but not healthy — recreating...');
             }
         }
-        // 2. Check webapp is built
+        else if (configChanged && appliedConfig !== null) {
+            this.logger.info('Nginx config changed — recreating the console container');
+        }
+        // 3. Check webapp is built
         const distPath = path.join(this.webappDir, 'dist');
         if (!fs.existsSync(path.join(distPath, 'index.html'))) {
             this.logger.info('Webapp not built — building now...');
             await this.build();
         }
-        // 3. Generate nginx config
-        const nginxConfig = generateNginxConfig('host.docker.internal', this.apiPort);
-        const configPath = path.join(this.configDir, 'nginx.conf');
         fs.writeFileSync(configPath, nginxConfig, 'utf-8');
         this.logger.info({ configPath }, 'Generated nginx config');
         // 4. Remove existing container if any
         await removeContainer('omnitron-nginx');
         // 5. Create container
-        const containerSpec = resolveOmnitronNginx({
-            port: this.publicPort,
-            internalApiPort: this.apiPort,
-            webappDistPath: distPath,
-        });
-        // Add nginx config mount
-        containerSpec.volumes.push({
-            source: configPath,
-            target: '/etc/nginx/nginx.conf',
-            readonly: true,
-        });
+        // Same spec the comparison above used, so what runs is what was compared.
+        const containerSpec = desiredSpec;
         await ensureImage(containerSpec.image);
         await createContainer(containerSpec);
         // 6. Wait for healthy

package/dist/webapp/webapp.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"webapp.service.js","sourceRoot":"","sources":["../../src/webapp/webapp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,WAAW,GACZ,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,OAAe,EAAE,OAAe;IAC3D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAiCuB,OAAO,IAAI,OAAO;;;;;;;;;;;gCAWlB,OAAO,IAAI,OAAO;;;;;gCAKlB,OAAO,IAAI,OAAO;;;;;gCAKlB,OAAO,IAAI,OAAO;;;;;;;;;;;;;;;;;;;;CAoBjD,CAAC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,aAAa;IAKL;IAEA;IACA;IAPF,SAAS,CAAS;IAClB,SAAS,CAAS;IAEnC,YACmB,MAAe,EAChC,YAAqB,EACJ,UAAkB,IAAI,EACtB,aAAqB,IAAI;QAHzB,WAAM,GAAN,MAAM,CAAS;QAEf,YAAO,GAAP,OAAO,CAAe;QACtB,eAAU,GAAV,UAAU,CAAe;QAE1C,4EAA4E;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAC5E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,2FAA2F;YAC3F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;gBACnC,GAAG,EAAE,IAAI,CAAC,SAAS;gBACnB,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;QAEtC,2CAA2C;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,qCAAqC,CAAC,CAAC;oBACnF,OAAO;gBACT,CAAC;gBACD,8CAA8C;gBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,2BAA2B;QAC3B,MAAM,WAAW,GAAG,mBAAmB,CAAC,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAE3D,sCAAsC;QACtC,MAAM,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAExC,sBAAsB;QACtB,MAAM,aAAa,GAAG,oBAAoB,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAC;QAEH,yBAAyB;QACzB,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QAErC,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,MAAM,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS;YACpC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;CACF"}
+{"version":3,"file":"webapp.service.js","sourceRoot":"","sources":["../../src/webapp/webapp.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,WAAW,EACX,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG;IACvB,qDAAqD;IACrD,kDAAkD;IAClD,sGAAsG;IACtG,0EAA0E;IAC1E,4EAA4E;IAC5E,0CAA0C;IAC1C,sSAAsS;CACvS,CAAC;AAEF,oDAAoD;AACpD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,OAAe,EAAE,MAAc;IAClF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CP,eAAe,CAAC,UAAU,CAAC;;;;gCAIG,OAAO,IAAI,OAAO;;;;;;;;;;;gCAWlB,OAAO,IAAI,OAAO;;;;;gCAKlB,OAAO,IAAI,OAAO;;;;;;;gCAOlB,OAAO,IAAI,MAAM;;;;;;;;;;;;;;;;;;;;;EAqB/C,eAAe,CAAC,cAAc,CAAC;;;;;;;EAO/B,eAAe,CAAC,cAAc,CAAC;;;;;;;;EAQ/B,eAAe,CAAC,cAAc,CAAC;;;;;;;;;CAShC,CAAC,IAAI,EAAE,CAAC;AACT,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,aAAa;IAKL,MAAM;IAEN,OAAO;IACP,UAAU;IAeV,QAAQ;IAtBV,SAAS,CAAS;IAClB,SAAS,CAAS;IAEnC,YACmB,MAAe,EAChC,YAAqB,EACJ,OAAO,GAAW,IAAI,EACtB,UAAU,GAAW,IAAI;IAC1C;;;;;;;;;;;;;OAaG;IACc,QAAQ,GAAW,WAAW;sBAlB9B,MAAM;uBAEN,OAAO;0BACP,UAAU;wBAeV,QAAQ;QAEzB,4EAA4E;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAC5E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAExD,IAAI,CAAC;YACH,2FAA2F;YAC3F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;gBACnC,GAAG,EAAE,IAAI,CAAC,SAAS;gBACnB,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;QAEtC,2EAA2E;QAC3E,gBAAgB;QAChB,EAAE;QACF,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,oCAAoC;QACpC,EAAE;QACF,kEAAkE;QAClE,mBAAmB;QACnB,MAAM,WAAW,GAAG,mBAAmB,CAAC,sBAAsB,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAChG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,MAAM,aAAa,GAAG,aAAa,KAAK,WAAW,CAAC;QAEpD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,oBAAoB,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,cAAc,EAAE,eAAe;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEnD,yEAAyE;QACzE,2BAA2B;QAC3B,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,0CAA0C;QAC1C,EAAE;QACF,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EACjD,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,qCAAqC,CAAC,CAAC;oBACnF,OAAO;gBACT,CAAC;gBACD,8CAA8C;gBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAC9E,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAE3D,sCAAsC;QACtC,MAAM,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAExC,sBAAsB;QACtB,0EAA0E;QAC1E,MAAM,aAAa,GAAG,WAAW,CAAC;QAElC,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QAErC,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,MAAM,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS;YACpC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/workers/health-monitor-process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-monitor-process.d.ts","sourceRoot":"","sources":["../../src/workers/health-monitor-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA6CzE,cACM,oBAAoB;IACxB,OAAO,CAAC,GAAG,CAA4B;IACvC,OAAO,CAAC,OAAO,CAAqC;IAEpD;;;OAGG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAe1E,6DAA6D;IAC7D,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIpC,uDAAuD;IACjD,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAIlE,6CAA6C;IAC7C,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,gCAAgC;IAC1B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAIpF,+BAA+B;IAC/B,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKhC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAShC;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"health-monitor-process.d.ts","sourceRoot":"","sources":["../../src/workers/health-monitor-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAuDzE,cACM,oBAAoB;IACxB,OAAO,CAAC,GAAG,CAA4B;IACvC,OAAO,CAAC,OAAO,CAAqC;IAEpD;;;OAGG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAazE;IAED,6DAA6D;IAC7D,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEnC;IAED,uDAAuD;IACjD,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAEjE;IAED,6CAA6C;IAC7C,kBAAkB,IAAI,kBAAkB,EAAE,CAEzC;IAED,gCAAgC;IAC1B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAEnF;IAED,+BAA+B;IAC/B,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAErC;IAGK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ9B;CACF;eAEc,oBAAoB"}

package/dist/workers/health-monitor-process.js

@@ -29,6 +29,16 @@ import { HealthMonitorService } from './health-monitor.service.js';
 // Inline PM decorators (avoid dual-package hazard with Symbol.for)
 // =============================================================================
 const PROCESS_METADATA_KEY = Symbol.for('process:metadata');
+// These decorators are declared locally rather than imported from
+// `@omnitron-dev/titan-pm` on purpose: this file is a worker ENTRY POINT, and
+// pulling the package in would load it into every child process. They
+// interoperate through `Symbol.for`, which is realm-wide, so the metadata they
+// write is the same metadata `titan-pm`'s `worker-runtime` scans for.
+//
+// That agreement is the whole contract, and it is not enforced by the type
+// system — `a-local-decorator-still-agrees-with-the-runtime.test.ts` pins it.
+// Note the direction of the last divergence: titan-pm's exported `@OnShutdown`
+// wrote a prototype key nothing reads, and THESE copies were the correct ones.
 const PROCESS_METHOD_METADATA_KEY = Symbol.for('process:method:metadata');
 function Process(options = {}) {
     return (target) => {

package/dist/workers/health-monitor-process.js.map

@@ -1 +1 @@
-{"version":3,"file":"health-monitor-process.js","sourceRoot":"","sources":["../../src/workers/health-monitor-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAEhF,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5D,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAE1E,SAAS,OAAO,CAAC,UAAyD,EAAE;IAC1E,OAAO,CAAC,MAAW,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7E,OAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,IAAI,IAAI,KAAK,aAAa;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU;gBAAE,SAAS;YACxD,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,2BAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,cAAc,CAAC,2BAA2B,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,EAAE,CAAC;gBACN,IAAI,OAAO,CAAC,gBAAgB;oBAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,WAA+B,EAAE,EAAE;QACpF,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,2BAA2B,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;QACtF,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;QAChB,OAAO,CAAC,cAAc,CAAC,2BAA2B,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAGhF,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChB,GAAG,GAAuB,IAAI,CAAC;IAC/B,OAAO,GAAgC,IAAI,CAAC;IAEpD;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,IAA+C;QACxD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QACvC,wDAAwD;QACxD,IAAI,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACvD,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAEvB,0DAA0D;QAC1D,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,CAAyB,CAAC;QAEnG,yCAAyC;QACzC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,OAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,YAAY,CAAC,MAAe;QAChC,OAAO,IAAI,CAAC,OAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,6CAA6C;IAC7C,kBAAkB;QAChB,OAAO,IAAI,CAAC,OAAQ,CAAC,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAc;QAClD,OAAO,IAAI,CAAC,OAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,+BAA+B;IAC/B,YAAY,CAAC,UAAkB;QAC7B,IAAI,CAAC,OAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;CACF,CAAA;AATO;IADL,UAAU,EAAE;;;;oDASZ;AAzDG,oBAAoB;IADzB,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;GACrD,oBAAoB,CA0DzB;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"health-monitor-process.js","sourceRoot":"","sources":["../../src/workers/health-monitor-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAEhF,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5D,kEAAkE;AAClE,8EAA8E;AAC9E,sEAAsE;AACtE,+EAA+E;AAC/E,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAE1E,SAAS,OAAO,CAAC,OAAO,GAAkD,EAAE;IAC1E,OAAO,CAAC,MAAW,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7E,OAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,IAAI,IAAI,KAAK,aAAa;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU;gBAAE,SAAS;YACxD,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,2BAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,cAAc,CAAC,2BAA2B,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,EAAE,CAAC;gBACN,IAAI,OAAO,CAAC,gBAAgB;oBAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,WAA+B,EAAE,EAAE;QACpF,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,2BAA2B,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;QACtF,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;QAChB,OAAO,CAAC,cAAc,CAAC,2BAA2B,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAGhF,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChB,GAAG,GAAuB,IAAI,CAAC;IAC/B,OAAO,GAAgC,IAAI,CAAC;IAEpD;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,IAA+C;QACxD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QACvC,wDAAwD;QACxD,IAAI,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACvD,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAEvB,0DAA0D;QAC1D,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,CAAyB,CAAC;QAEnG,yCAAyC;QACzC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,OAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,YAAY,CAAC,MAAe;QAChC,OAAO,IAAI,CAAC,OAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,6CAA6C;IAC7C,kBAAkB;QAChB,OAAO,IAAI,CAAC,OAAQ,CAAC,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAc;QAClD,OAAO,IAAI,CAAC,OAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,+BAA+B;IAC/B,YAAY,CAAC,UAAkB;QAC7B,IAAI,CAAC,OAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;CACF,CAAA;AATO;IADL,UAAU,EAAE;;;;oDASZ;AAzDG,oBAAoB;IADzB,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;GACrD,oBAAoB,CA0DzB;AAED,eAAe,oBAAoB,CAAC"}

package/dist/workers/health-monitor.service.d.ts

@@ -19,6 +19,8 @@ export declare class HealthMonitorService {
     private remoteOps;
     private checkTimer;
     private isRunning;
+    /** When the in-flight check round began; 0 when idle. */
+    private roundStartedAt;
     private lastCleanup;
     private readonly logger;
     constructor(loggerModule: ILoggerModule);
@@ -26,7 +28,17 @@ export declare class HealthMonitorService {
      * Initialize the worker. Called by master process via RPC with config/nodes.
      */
     init(configJson: string, nodesJson: string): Promise<void>;
-    /** Master calls this when nodes are added/updated/removed */
+    /**
+     * Master calls this when nodes are added/updated/removed.
+     *
+     * The status cache follows the list. It used to keep every node it had
+     * ever checked: measured 2026-09-23, a node removed at 07:28:00Z was still
+     * served by `getStatusSummaries` and re-broadcast every round as `online,
+     * checkedAt 07:27:49.607Z` — 82 minutes later — and `omnitron node check`
+     * printed `SSH ● Omnitron ●` for a machine that was no longer registered.
+     * A removed node is not checked again, so its last reading only ages; it
+     * never becomes a current one.
+     */
     updateNodes(nodesJson: string): void;
     /** On-demand check for a specific node or all nodes */
     triggerCheck(nodeId?: string): Promise<INodeHealthSummary[]>;
@@ -34,12 +46,31 @@ export declare class HealthMonitorService {
     getStatusSummaries(): INodeHealthSummary[];
     /** Get check history from PG */
     getCheckHistory(nodeId: string, limit?: number): Promise<IHealthCheckResult[]>;
-    /** Update config at runtime */
+    /**
+     * Update config at runtime.
+     *
+     * Merged onto the running config rather than replacing it: the console
+     * sends only the knobs an operator changed (ping on/off, the three
+     * timeouts), and a wholesale replacement dropped `dbUrl` and
+     * `retentionDays` — leaving the worker writing to nothing and pruning
+     * against `undefined` days.
+     */
     updateConfig(configJson: string): void;
-    /** Health check for PM */
+    /**
+     * Health check for PM.
+     *
+     * `isRunning` is "a check round is in progress" — the worker doing exactly
+     * what it exists to do. Reporting that as `degraded` and an idle worker as
+     * `healthy` inverted the answer: under a supervisor that acts on health,
+     * the busiest worker is the one that looks sick.
+     *
+     * What actually makes this worker unhealthy is a check loop that has
+     * stopped, or a round that started and never finished.
+     */
     checkHealth(): Promise<{
         status: string;
         timestamp: number;
+        reason?: string;
     }>;
     shutdown(): Promise<void>;
     private startCheckLoop;
@@ -48,6 +79,17 @@ export declare class HealthMonitorService {
     private checkNode;
     private deriveSummary;
     private persistResults;
+    /**
+     * Delete check rows past the retention horizon.
+     *
+     * Batched, and repeated until a batch comes back short. One capped DELETE
+     * per hour is a sweep that can fall permanently behind its own inflow: a
+     * fleet checked every 30 seconds writes 120 rows an hour per node, and a
+     * backlog — a retention window shortened, a table that ran unbounded for a
+     * while — is never caught up by a limit that only ever removes 10 000 in
+     * the same hour. The per-batch cap stays: it is what keeps the delete off
+     * the lock for minutes at a time.
+     */
     private cleanupOldRows;
     private sendIpc;
     private broadcastSummaries;

package/dist/workers/health-monitor.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-monitor.service.d.ts","sourceRoot":"","sources":["../../src/workers/health-monitor.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAwB,KAAK,aAAa,EAAgB,MAAM,mCAAmC,CAAC;AAM3G,OAAO,KAAK,EACV,kBAAkB,EAGlB,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAGpB,qBAEa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,EAAE,CAA4B;IACtC,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;gBAGD,YAAY,EAAE,aAAa;IAK3D;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiChE,6DAA6D;IAC7D,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IASpC,uDAAuD;IACjD,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAelE,6CAA6C;IAC7C,kBAAkB,IAAI,kBAAkB,EAAE;IAI1C,gCAAgC;IAC1B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAYhF,+BAA+B;IAC/B,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAOtC,0BAA0B;IACpB,WAAW,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO7D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAc/B,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,aAAa;YAOP,YAAY;YAuDZ,SAAS;IAuFvB,OAAO,CAAC,aAAa;YAuCP,cAAc;YA6Bd,cAAc;IAuB5B,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,kBAAkB;CAM3B"}
+{"version":3,"file":"health-monitor.service.d.ts","sourceRoot":"","sources":["../../src/workers/health-monitor.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAwB,KAAK,aAAa,EAAgB,MAAM,mCAAmC,CAAC;AAM3G,OAAO,KAAK,EACV,kBAAkB,EAGlB,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAGpB,qBAEa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,WAAW,CAA8C;IACjE,OAAO,CAAC,EAAE,CAA4B;IACtC,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,SAAS,CAAS;IAC1B,yDAAyD;IACzD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IAEjC,YACgC,YAAY,EAAE,aAAa,EAG1D;IAED;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/D;IAED;;;;;;;;;;OAUG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAYnC;IAED,uDAAuD;IACjD,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAajE;IAED,6CAA6C;IAC7C,kBAAkB,IAAI,kBAAkB,EAAE,CAEzC;IAED,gCAAgC;IAC1B,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAU/E;IAED;;;;;;;;OAQG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAYrC;IAED;;;;;;;;;;OAUG;IACG,WAAW,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAUnF;IAEK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ9B;IAMD,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,aAAa;YAOP,YAAY;YAyDZ,SAAS;IA6FvB,OAAO,CAAC,aAAa;YAuCP,cAAc;IA6D5B;;;;;;;;;;OAUG;YACW,cAAc;IAqC5B,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,kBAAkB;CAM3B"}