camstack 1.2.136 → 1.2.137

package/dist/{launcher-SY5BQXD2.js → launcher-U2UTNMNT.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-C85OOASj.js
-var require_dist_C85OOASj = __commonJS({
-  "../system/dist/dist-C85OOASj.js"(exports) {
+// ../system/dist/dist-BOlMCOeT.js
+var require_dist_BOlMCOeT = __commonJS({
+  "../system/dist/dist-BOlMCOeT.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -30499,6 +30499,16 @@ var require_dist_C85OOASj = __commonJS({
         })) }), { auth: "admin" })
       }
     };
+    function describeCustomActions(catalog) {
+      const out = {};
+      for (const [name, spec] of Object.entries(catalog)) out[name] = {
+        kind: spec.kind,
+        auth: spec.auth,
+        scope: spec.scope,
+        ...spec.caller === "required" ? { caller: "required" } : {}
+      };
+      return out;
+    }
     var CustomModelDescriptorSchema = zod.z.object({
       stepId: zod.z.string(),
       entry: ModelCatalogEntrySchema
@@ -35018,6 +35028,7 @@ var require_dist_C85OOASj = __commonJS({
       "addon-crash-loop",
       "addon-update-available",
       "server-update-available",
+      "wrapper-update-available",
       "alarm-triggered",
       "alarm-armed",
       "alarm-disarmed",
@@ -40692,6 +40703,45 @@ var require_dist_C85OOASj = __commonJS({
       /** One operator-grade sentence: this node runs image X; the contract says Y. */
       message: zod.z.string()
     });
+    var WrapperKindSchema = zod.z.enum([
+      "docker",
+      "electron",
+      "native",
+      "contradictory",
+      "unknown"
+    ]);
+    var WrapperEvidenceSchema = zod.z.object({
+      /** Which probe this row reports. */
+      fact: zod.z.enum([
+        "dockerenv-file",
+        "proc-1-cgroup",
+        "platform",
+        "electron-app-version-env"
+      ]),
+      /**
+      * `observed` — this process read it itself. `declared` — the shell told the
+      * process and nothing here can check it. Only the Electron app version is
+      * ever `declared`, and only because a child cannot see its parent.
+      */
+      mode: zod.z.enum(["observed", "declared"]),
+      /** Did the probe support the fact it names? A `false` row is still evidence. */
+      holds: zod.z.boolean(),
+      /** What was actually read, verbatim enough for an operator to argue with. */
+      detail: zod.z.string()
+    });
+    var WrapperIdentitySchema = zod.z.object({
+      kind: WrapperKindSchema,
+      /** Every probe that ran, in a stable order. Never empty. */
+      evidence: zod.z.array(WrapperEvidenceSchema),
+      /**
+      * The version of the SHELL, when the shell has one it can state: the
+      * Electron app version it declared, or the baked seed closure that
+      * fingerprints a container / app bundle. `null` for `contradictory` and
+      * `unknown` — which version belongs to the shell is precisely what is not
+      * known there.
+      */
+      currentVersion: zod.z.string().nullable()
+    });
     var ServerRollbackInfoSchema = zod.z.object({
       /** The version that failed (or was manually rolled back). */
       fromVersion: zod.z.string(),
@@ -40733,7 +40783,13 @@ var require_dist_C85OOASj = __commonJS({
       * Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
       * version skew: an older provider's payload simply omits it.
       */
-      imageContract: ImageContractSchema.optional()
+      imageContract: ImageContractSchema.optional(),
+      /**
+      * What this node runs INSIDE (see {@link WrapperIdentitySchema}). Optional
+      * for version skew: an older provider's payload simply omits it, and an
+      * absent wrapper is unknown — never `native`.
+      */
+      wrapper: WrapperIdentitySchema.optional()
     });
     var ServerUpdateCheckResultSchema = zod.z.object({
       packageName: zod.z.string(),
@@ -61098,6 +61154,12 @@ var require_dist_C85OOASj = __commonJS({
         return deriveBatteryPresence;
       }
     });
+    Object.defineProperty(exports, "describeCustomActions", {
+      enumerable: true,
+      get: function() {
+        return describeCustomActions;
+      }
+    });
     Object.defineProperty(exports, "deviceManagerCapability", {
       enumerable: true,
       get: function() {
@@ -61524,7 +61586,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -62343,7 +62405,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -62437,7 +62499,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -63334,11 +63396,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-Dfj9LA-i.js
-var require_retired_settings_keys_Dfj9LA_i = __commonJS({
-  "../system/dist/retired-settings-keys-Dfj9LA-i.js"(exports) {
+// ../system/dist/retired-settings-keys-xEAlYnv7.js
+var require_retired_settings_keys_xEAlYnv7 = __commonJS({
+  "../system/dist/retired-settings-keys-xEAlYnv7.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -65573,8 +65635,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
-    var require_retired_settings_keys = require_retired_settings_keys_Dfj9LA_i();
+    var require_dist10 = require_dist_BOlMCOeT();
+    var require_retired_settings_keys = require_retired_settings_keys_xEAlYnv7();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -71199,7 +71261,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -71336,7 +71398,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -71532,7 +71594,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -79345,7 +79407,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -79910,7 +79972,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -82346,13 +82408,6 @@ var require_native_metrics_addon = __commonJS({
           cpuSplits
         });
       }
-      /**
-      * Ask the addon's forked runner to write a V8 heap snapshot (SIGUSR2 → the
-      * runner's diagnostic handler in addon-runner.ts), for deep per-addon memory
-      * attribution. Resolves the addon's worker pid from the kernel `$process.list`
-      * and signals it; the runner writes `/tmp/heap-<sanitized nodeId>.heapsnapshot`
-      * and logs its memoryUsage + heap-space breakdown. '$hub' targets this process.
-      */
       /** Raw `ps` scan returning every pid + command + resource stats. */
       async runPs() {
         try {
@@ -82494,7 +82549,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -83610,8 +83665,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
-    var require_retired_settings_keys = require_retired_settings_keys_Dfj9LA_i();
+    var require_dist10 = require_dist_BOlMCOeT();
+    var require_retired_settings_keys = require_retired_settings_keys_xEAlYnv7();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -86115,7 +86170,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -89765,7 +89820,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -107826,7 +107881,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -120460,9 +120515,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-DvY1bY_n.js
-var require_manifest_system_deps_DvY1bY_n = __commonJS({
-  "../system/dist/manifest-system-deps-DvY1bY_n.js"(exports) {
+// ../system/dist/manifest-system-deps-Bo92lg5u.js
+var require_manifest_system_deps_Bo92lg5u = __commonJS({
+  "../system/dist/manifest-system-deps-Bo92lg5u.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     require_hub_cap_forward_DmHNjbB0();
@@ -120481,6 +120536,7 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
     var node_http = __require("http");
     var node_v8 = __require("v8");
     node_v8 = require_chunk.__toESM(node_v8);
+    var node_inspector_promises = __require("inspector/promises");
     var node_perf_hooks = __require("perf_hooks");
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
@@ -120720,7 +120776,7 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
     var DECISIVE_HEAP_SPACES = ["old_space", "large_object_space"];
     var HEAP_SPACE_REPORT_MIN_MB = 32;
     var BYTES_PER_MB = 1048576;
-    function mb(bytes) {
+    function mb$1(bytes) {
       return Math.round(bytes / BYTES_PER_MB);
     }
     function tenthsMb(bytes) {
@@ -120741,13 +120797,13 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
     }
     function selectReportedSpaces(spaces, minMb = 32) {
       const decisive = DECISIVE_HEAP_SPACES.map((name) => spaces.find((space) => space.name === name)).filter((space) => space !== void 0);
-      const rest = spaces.filter((space) => !DECISIVE_HEAP_SPACES.includes(space.name)).filter((space) => mb(space.usedBytes) >= minMb).toSorted((a, b) => b.usedBytes - a.usedBytes || a.name.localeCompare(b.name));
+      const rest = spaces.filter((space) => !DECISIVE_HEAP_SPACES.includes(space.name)).filter((space) => mb$1(space.usedBytes) >= minMb).toSorted((a, b) => b.usedBytes - a.usedBytes || a.name.localeCompare(b.name));
       return [...decisive, ...rest];
     }
     function formatHeapSpaces(spaces, minMb = 32) {
       const selected = selectReportedSpaces(spaces, minMb);
       if (selected.length === 0) return "";
-      return ` ${selected.map((s) => `${heapSpaceField(s.name)}=${mb(s.usedBytes)}MB`).join(" ")}`;
+      return ` ${selected.map((s) => `${heapSpaceField(s.name)}=${mb$1(s.usedBytes)}MB`).join(" ")}`;
     }
     var defaultDeps = {
       readMemory: () => process.memoryUsage(),
@@ -120763,6 +120819,137 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
         request.sink.warn(`[mem] node="${request.label}" space report failed: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
+    var ARRAY_BUFFER_CENSUS_THRESHOLD_MB = 512;
+    var ARRAY_BUFFER_CENSUS_SUSTAIN_MS = 6e4;
+    var ARRAY_BUFFER_CENSUS_COOLDOWN_MS = 30 * 6e4;
+    var ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO = 0.5;
+    function createArrayBufferCensusGate(options = {}) {
+      const thresholdMb = options.thresholdMb ?? 512;
+      const sustainMs = options.sustainMs ?? 6e4;
+      const cooldownMs = options.cooldownMs ?? 18e5;
+      let aboveSince = null;
+      let lastTakenAt = Number.NEGATIVE_INFINITY;
+      let previousMb = null;
+      let previousAt = null;
+      return { observe(arrayBuffersMb, at) {
+        const previous = previousMb;
+        const previousHeldForMs = previous !== null && previousAt !== null && aboveSince !== null ? previousAt - aboveSince : null;
+        previousMb = arrayBuffersMb;
+        previousAt = at;
+        if (previous !== null && previousHeldForMs !== null && previousHeldForMs >= sustainMs && previous - arrayBuffersMb >= thresholdMb * 0.5) {
+          aboveSince = null;
+          return {
+            kind: "released",
+            fromMb: previous,
+            toMb: arrayBuffersMb
+          };
+        }
+        if (arrayBuffersMb < thresholdMb) {
+          aboveSince = null;
+          return { kind: "hold" };
+        }
+        aboveSince ??= at;
+        const heldForMs = at - aboveSince;
+        if (heldForMs < sustainMs) return { kind: "hold" };
+        if (at - lastTakenAt < cooldownMs) return { kind: "hold" };
+        lastTakenAt = at;
+        return {
+          kind: "take",
+          reason: `arrayBuffers=${arrayBuffersMb}MB has been >=${thresholdMb}MB for ${heldForMs}ms`
+        };
+      } };
+    }
+    var HISTOGRAM_FN = `function () {
+  var byBucket = new Map(), bySize = new Map()
+  var count = 0, bytes = 0, detached = 0
+  for (var i = 0; i < this.length; i++) {
+    var b = this[i].byteLength
+    count++
+    bytes += b
+    if (b === 0) { detached++; continue }
+    var bucket = 1
+    while (bucket < b) bucket *= 2
+    var e = byBucket.get(bucket); if (!e) { e = [0, 0]; byBucket.set(bucket, e) }
+    e[0]++; e[1] += b
+    var s = bySize.get(b); if (!s) { s = [0, 0]; bySize.set(b, s) }
+    s[0]++; s[1] += b
+  }
+  var buckets = []
+  byBucket.forEach(function (v, k) { buckets.push({ upToBytes: k, count: v[0], bytes: v[1] }) })
+  buckets.sort(function (a, b) { return b.bytes - a.bytes })
+  var topSizes = []
+  bySize.forEach(function (v, k) { topSizes.push({ byteLength: k, count: v[0], bytes: v[1] }) })
+  topSizes.sort(function (a, b) { return b.bytes - a.bytes })
+  return { count: count, bytes: bytes, detached: detached,
+    buckets: buckets.slice(0, 6), topSizes: topSizes.slice(0, 5) }
+}`;
+    function isFiniteNumber(value) {
+      return typeof value === "number" && Number.isFinite(value);
+    }
+    function isBucket(value) {
+      return typeof value === "object" && value !== null && isFiniteNumber(Reflect.get(value, "upToBytes")) && isFiniteNumber(Reflect.get(value, "count")) && isFiniteNumber(Reflect.get(value, "bytes"));
+    }
+    function isExactSize(value) {
+      return typeof value === "object" && value !== null && isFiniteNumber(Reflect.get(value, "byteLength")) && isFiniteNumber(Reflect.get(value, "count")) && isFiniteNumber(Reflect.get(value, "bytes"));
+    }
+    function isArrayBufferCensusReport(value) {
+      if (typeof value !== "object" || value === null) return false;
+      const buckets = Reflect.get(value, "buckets");
+      const topSizes = Reflect.get(value, "topSizes");
+      return isFiniteNumber(Reflect.get(value, "count")) && isFiniteNumber(Reflect.get(value, "bytes")) && isFiniteNumber(Reflect.get(value, "detached")) && Array.isArray(buckets) && buckets.every(isBucket) && Array.isArray(topSizes) && topSizes.every(isExactSize);
+    }
+    function readObjectId(result, path) {
+      let cursor = result;
+      for (const key of path) {
+        if (typeof cursor !== "object" || cursor === null) throw new Error(`inspector reply has no ${path.join(".")}`);
+        cursor = Reflect.get(cursor, key);
+      }
+      if (typeof cursor !== "string") throw new Error(`inspector reply has no ${path.join(".")}`);
+      return cursor;
+    }
+    function createInspectorArrayBufferCensus() {
+      return async () => {
+        const session = new node_inspector_promises.Session();
+        session.connect();
+        try {
+          const prototypeObjectId = readObjectId(await session.post("Runtime.evaluate", { expression: "ArrayBuffer.prototype" }), ["result", "objectId"]);
+          try {
+            const objectId = readObjectId(await session.post("Runtime.queryObjects", { prototypeObjectId }), ["objects", "objectId"]);
+            try {
+              const evaluated = await session.post("Runtime.callFunctionOn", {
+                objectId,
+                functionDeclaration: HISTOGRAM_FN,
+                returnByValue: true
+              });
+              const value = typeof evaluated === "object" && evaluated !== null ? Reflect.get(Reflect.get(evaluated, "result") ?? {}, "value") : void 0;
+              if (!isArrayBufferCensusReport(value)) throw new Error("inspector returned a histogram of an unexpected shape");
+              return value;
+            } finally {
+              await session.post("Runtime.releaseObject", { objectId });
+            }
+          } finally {
+            await session.post("Runtime.releaseObject", { objectId: prototypeObjectId });
+          }
+        } finally {
+          session.disconnect();
+        }
+      };
+    }
+    var MB$1 = 1048576;
+    function mb(bytes) {
+      return Math.round(bytes / MB$1);
+    }
+    function formatBucket(bucket) {
+      return `<=${bucket.upToBytes >= MB$1 ? `${Math.round(bucket.upToBytes / MB$1)}MB` : bucket.upToBytes >= 1024 ? `${Math.round(bucket.upToBytes / 1024)}KB` : `${bucket.upToBytes}B`}:${bucket.count}x/${mb(bucket.bytes)}MB`;
+    }
+    function formatExact(size) {
+      return `${size.byteLength}Bx${size.count}=${mb(size.bytes)}MB`;
+    }
+    function formatArrayBufferCensus(label, report, context) {
+      const live = mb(report.bytes);
+      const verdict = live < context.rawMb * 0.5 ? "mostly DEAD buffers awaiting a sweep, not a retention" : "LIVE \u2014 something holds them";
+      return `[mem] ${label} arrayBuffer census: live=${live}MB in ${report.count} ArrayBuffers (raw arrayBuffers=${context.rawMb}MB at the trigger \u2192 ${verdict}) top sizes: ${report.topSizes.map(formatExact).join(", ") || "(none)"}; buckets: ${report.buckets.map(formatBucket).join(", ") || "(none)"}; detached=${report.detached} took=${context.tookMs}ms \u2014 cost: ONE forced full GC (the same pause as a reclaim pass), walked in memory, nothing serialised, nothing written; trigger: ${context.reason}`;
+    }
     var HUB_MAIN_HEAP_WATCH_LABEL = "hub-main";
     var HEAP_WATCH_INTERVAL_MS = 6e4;
     var HEAP_WATCH_WARN_RATIO = 0.8;
@@ -120999,9 +121186,36 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
           if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine \u2014 logging every ${intervalMs}ms`);
           checkRssBudget(sample, at);
           maybeReclaim(sample);
+          judgeArrayBuffers(sample, at);
         } catch {
         }
       };
+      const censusProbe = probes?.arrayBufferCensus;
+      const censusGate = censusProbe === void 0 ? void 0 : createArrayBufferCensusGate(censusProbe);
+      let censusInFlight = false;
+      const judgeArrayBuffers = (sample, at) => {
+        if (censusProbe === void 0 || censusGate === void 0) return;
+        const verdict = censusGate.observe(sample.arrayBuffersMb, at);
+        if (verdict.kind === "released") {
+          sink.warn(`[mem] ${label} arrayBuffers RELEASED ${verdict.fromMb}MB\u2192${verdict.toMb}MB between two probes ${probeIntervalMs}ms apart \u2014 no owner logged this release; whatever held them let go in one instant (a socket that died, a queue that drained, a map that was cleared). Correlate with every line of this process in that window.`);
+          return;
+        }
+        if (verdict.kind !== "take" || censusInFlight) return;
+        censusInFlight = true;
+        const startedAt = now();
+        const rawMb = sample.arrayBuffersMb;
+        censusProbe.census().then((report) => {
+          sink.warn(formatArrayBufferCensus(label, report, {
+            rawMb,
+            tookMs: now() - startedAt,
+            reason: verdict.reason
+          }));
+        }).catch((error) => {
+          sink.warn(`[mem] ${label} arrayBuffer census FAILED after ${now() - startedAt}ms (trigger: ${verdict.reason}) \u2014 ${error instanceof Error ? error.message : String(error)}`);
+        }).finally(() => {
+          censusInFlight = false;
+        });
+      };
       const timer = setInterval(tick, probeIntervalMs);
       timer.unref?.();
       tick();
@@ -125746,7 +125960,8 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
             this.registeredHandler({
               childId: msg.childId,
               caps: msg.caps,
-              incarnation
+              incarnation,
+              ...msg.customActions !== void 0 ? { customActions: msg.customActions } : {}
             });
             return { ok: true };
           }
@@ -125831,6 +126046,15 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
       * subscriptions do), the register carries the real union — even if empty.
       */
       hasDeclaredEventPatterns = false;
+      /**
+      * The custom-action catalogs of every hosted addon, once the runner's init
+      * loop has produced them (`updateCaps(caps, catalogs)` at post-init). `null`
+      * until then, and OMITTED from the register frame while null: the parent
+      * reads absence as "not described yet", and a pre-init register must never
+      * look like "this child declares no actions". Kept on the client so every
+      * later re-register (native-cap change, reconnect) re-carries it unchanged.
+      */
+      latestCustomActions = null;
       /** Events and logs queued while the channel is not yet open. */
       pendingEmits = [];
       /** Handler for parent→child events. Registered via `onEvent`. */
@@ -125970,12 +126194,7 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
           }
           if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
         });
-        const register = {
-          kind: "register",
-          childId: this.options.childId,
-          caps: this.latestCaps,
-          ...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {}
-        };
+        const register = this.registerFrame(this.latestCaps);
         try {
           await channel.request(register);
         } catch (err) {
@@ -126001,16 +126220,26 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
       * it (device-restore can race ahead of the UDS connect). After `start()`,
       * the set is sent immediately.
       */
-      async updateCaps(caps) {
+      async updateCaps(caps, customActions) {
         this.latestCaps = caps;
+        if (customActions !== void 0) this.latestCustomActions = customActions;
         if (this.channel === null) return;
-        const register = {
+        await this.channel.request(this.registerFrame(caps));
+      }
+      /**
+      * The register frame: caps, plus everything a re-register must atomically
+      * re-carry so no separate re-sync can be missed — the subscription union
+      * (omitted if nothing ever declared, which keeps the fail-open shape) and the
+      * custom-action catalogs (omitted until the init loop produced them).
+      */
+      registerFrame(caps) {
+        return {
           kind: "register",
           childId: this.options.childId,
           caps,
-          ...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {}
+          ...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
+          ...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {}
         };
-        await this.channel.request(register);
       }
       /**
       * Fire-and-forget: send a system event to the parent for forwarding to the
@@ -127983,6 +128212,30 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
         return AGENT_CAP_FWD_SERVICE;
       }
     });
+    Object.defineProperty(exports, "ARRAY_BUFFER_CENSUS_COOLDOWN_MS", {
+      enumerable: true,
+      get: function() {
+        return ARRAY_BUFFER_CENSUS_COOLDOWN_MS;
+      }
+    });
+    Object.defineProperty(exports, "ARRAY_BUFFER_CENSUS_SUSTAIN_MS", {
+      enumerable: true,
+      get: function() {
+        return ARRAY_BUFFER_CENSUS_SUSTAIN_MS;
+      }
+    });
+    Object.defineProperty(exports, "ARRAY_BUFFER_CENSUS_THRESHOLD_MB", {
+      enumerable: true,
+      get: function() {
+        return ARRAY_BUFFER_CENSUS_THRESHOLD_MB;
+      }
+    });
+    Object.defineProperty(exports, "ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO", {
+      enumerable: true,
+      get: function() {
+        return ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO;
+      }
+    });
     Object.defineProperty(exports, "AddonDepsManager", {
       enumerable: true,
       get: function() {
@@ -128313,6 +128566,12 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
         return createAddonService;
       }
     });
+    Object.defineProperty(exports, "createArrayBufferCensusGate", {
+      enumerable: true,
+      get: function() {
+        return createArrayBufferCensusGate;
+      }
+    });
     Object.defineProperty(exports, "createBrokerDeviceManagerApi", {
       enumerable: true,
       get: function() {
@@ -128337,6 +128596,12 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
         return createEventPlaneReader;
       }
     });
+    Object.defineProperty(exports, "createInspectorArrayBufferCensus", {
+      enumerable: true,
+      get: function() {
+        return createInspectorArrayBufferCensus;
+      }
+    });
     Object.defineProperty(exports, "createKernelHwAccel", {
       enumerable: true,
       get: function() {
@@ -128451,6 +128716,12 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
         return encodeFrame;
       }
     });
+    Object.defineProperty(exports, "formatArrayBufferCensus", {
+      enumerable: true,
+      get: function() {
+        return formatArrayBufferCensus;
+      }
+    });
     Object.defineProperty(exports, "formatEventPlane", {
       enumerable: true,
       get: function() {
@@ -128553,6 +128824,12 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
         return ipcParentLink;
       }
     });
+    Object.defineProperty(exports, "isArrayBufferCensusReport", {
+      enumerable: true,
+      get: function() {
+        return isArrayBufferCensusReport;
+      }
+    });
     Object.defineProperty(exports, "localEndpointPath", {
       enumerable: true,
       get: function() {
@@ -128736,10 +129013,11 @@ var require_manifest_system_deps_DvY1bY_n = __commonJS({
   }
 });
 
-// ../system/dist/custom-action-registry-jY0NOZK8.js
-var require_custom_action_registry_jY0NOZK8 = __commonJS({
-  "../system/dist/custom-action-registry-jY0NOZK8.js"(exports) {
+// ../system/dist/custom-action-registry-BDwM5qAK.js
+var require_custom_action_registry_BDwM5qAK = __commonJS({
+  "../system/dist/custom-action-registry-BDwM5qAK.js"(exports) {
     "use strict";
+    var require_dist10 = require_dist_BOlMCOeT();
     var CustomActionRegistry = class {
       byAddon = /* @__PURE__ */ new Map();
       registerAddon(addonId, catalog, handler) {
@@ -128766,6 +129044,24 @@ var require_custom_action_registry_jY0NOZK8 = __commonJS({
       listAddons() {
         return [...this.byAddon.keys()];
       }
+      /**
+      * Every registered catalog with its schemas stripped, keyed by addon id —
+      * what a runner puts in its register frame so the hub learns the catalogs
+      * from the process that owns them (D444). `hostedAddonIds` are the addons
+      * this runner hosts: each is present in the result, with an EMPTY catalog
+      * when it registered none, so the parent can say "declares no actions" per
+      * addon instead of guessing from an absent key.
+      */
+      describeAll(hostedAddonIds) {
+        const out = {};
+        for (const addonId of hostedAddonIds) out[addonId] = {};
+        for (const [addonId, actions] of this.byAddon) {
+          const catalog = {};
+          for (const [name, entry] of actions) catalog[name] = entry.spec;
+          out[addonId] = require_dist10.describeCustomActions(catalog);
+        }
+        return out;
+      }
     };
     Object.defineProperty(exports, "CustomActionRegistry", {
       enumerable: true,
@@ -132535,7 +132831,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C85OOASj();
+    var require_dist10 = require_dist_BOlMCOeT();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -132562,9 +132858,9 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_event_loop_stall_monitor = require_event_loop_stall_monitor_DM9OAzy8();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_DvY1bY_n();
+    var require_manifest_system_deps = require_manifest_system_deps_Bo92lg5u();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
-    var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
+    var require_custom_action_registry = require_custom_action_registry_BDwM5qAK();
     var zod = require_zod();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
@@ -213246,6 +213542,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.AGENT_CAP_FWD_SERVICE = require_manifest_system_deps.AGENT_CAP_FWD_SERVICE;
     exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
     exports.ALL_CAPABILITY_DEFINITIONS = require_dist10.ALL_CAPABILITY_DEFINITIONS;
+    exports.ARRAY_BUFFER_CENSUS_COOLDOWN_MS = require_manifest_system_deps.ARRAY_BUFFER_CENSUS_COOLDOWN_MS;
+    exports.ARRAY_BUFFER_CENSUS_SUSTAIN_MS = require_manifest_system_deps.ARRAY_BUFFER_CENSUS_SUSTAIN_MS;
+    exports.ARRAY_BUFFER_CENSUS_THRESHOLD_MB = require_manifest_system_deps.ARRAY_BUFFER_CENSUS_THRESHOLD_MB;
+    exports.ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO = require_manifest_system_deps.ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO;
     exports.AddonApiFactory = AddonApiFactory;
     exports.AddonDepsManager = require_manifest_system_deps.AddonDepsManager;
     exports.AddonEngineManager = AddonEngineManager;
@@ -213429,6 +213729,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.createAddonContext = require_manifest_system_deps.createAddonContext;
     exports.createAddonDataPlaneFacility = require_manifest_system_deps.createAddonDataPlaneFacility;
     exports.createAddonService = require_manifest_system_deps.createAddonService;
+    exports.createArrayBufferCensusGate = require_manifest_system_deps.createArrayBufferCensusGate;
     exports.createAuthenticatedFileServer = require_event_loop_stall_monitor.createAuthenticatedFileServer;
     exports.createBroker = createBroker2;
     exports.createBrokerDeviceManagerApi = require_manifest_system_deps.createBrokerDeviceManagerApi;
@@ -213440,6 +213741,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.createFileDataPlaneHandler = require_event_loop_stall_monitor.createFileDataPlaneHandler;
     exports.createHubCapForwardService = require_hub_cap_forward.createHubCapForwardService;
     exports.createHubService = createHubService;
+    exports.createInspectorArrayBufferCensus = require_manifest_system_deps.createInspectorArrayBufferCensus;
     exports.createKernelHwAccel = require_manifest_system_deps.createKernelHwAccel;
     exports.createLocalTransport = require_manifest_system_deps.createLocalTransport;
     exports.createLoopDelayMeter = require_manifest_system_deps.createLoopDelayMeter;
@@ -213509,6 +213811,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.findInPath;
       }
     });
+    exports.formatArrayBufferCensus = require_manifest_system_deps.formatArrayBufferCensus;
     exports.formatEventPlane = require_manifest_system_deps.formatEventPlane;
     exports.formatHeapSpaces = require_manifest_system_deps.formatHeapSpaces;
     exports.formatLogLine = require_formatter.formatLogLine;
@@ -213564,6 +213867,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     });
     exports.ipcParentLink = require_manifest_system_deps.ipcParentLink;
     exports.isAddonDeploySource = isAddonDeploySource;
+    exports.isArrayBufferCensusReport = require_manifest_system_deps.isArrayBufferCensusReport;
     exports.isArrayOutputSchema = require_dist10.isArrayOutputSchema;
     exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
     exports.isCollectionArrayMethod = require_dist10.isCollectionArrayMethod;
@@ -220368,6 +220672,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }
       };
     }
+    function describeCustomActions(catalog) {
+      const out = {};
+      for (const [name, spec] of Object.entries(catalog)) out[name] = {
+        kind: spec.kind,
+        auth: spec.auth,
+        scope: spec.scope,
+        ...spec.caller === "required" ? { caller: "required" } : {}
+      };
+      return out;
+    }
     var CustomModelDescriptorSchema = zod.z.object({
       stepId: zod.z.string(),
       entry: ModelCatalogEntrySchema
@@ -225327,6 +225641,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "addon-crash-loop",
       "addon-update-available",
       "server-update-available",
+      "wrapper-update-available",
       "alarm-triggered",
       "alarm-armed",
       "alarm-disarmed",
@@ -226184,6 +226499,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             value: "server-update-available",
             label: "Server update available"
           },
+          {
+            value: "wrapper-update-available",
+            label: "Container / app update available"
+          },
           {
             value: "addon-updated",
             label: "Addons updated"
@@ -231656,6 +231975,45 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** One operator-grade sentence: this node runs image X; the contract says Y. */
       message: zod.z.string()
     });
+    var WrapperKindSchema = zod.z.enum([
+      "docker",
+      "electron",
+      "native",
+      "contradictory",
+      "unknown"
+    ]);
+    var WrapperEvidenceSchema = zod.z.object({
+      /** Which probe this row reports. */
+      fact: zod.z.enum([
+        "dockerenv-file",
+        "proc-1-cgroup",
+        "platform",
+        "electron-app-version-env"
+      ]),
+      /**
+      * `observed` — this process read it itself. `declared` — the shell told the
+      * process and nothing here can check it. Only the Electron app version is
+      * ever `declared`, and only because a child cannot see its parent.
+      */
+      mode: zod.z.enum(["observed", "declared"]),
+      /** Did the probe support the fact it names? A `false` row is still evidence. */
+      holds: zod.z.boolean(),
+      /** What was actually read, verbatim enough for an operator to argue with. */
+      detail: zod.z.string()
+    });
+    var WrapperIdentitySchema = zod.z.object({
+      kind: WrapperKindSchema,
+      /** Every probe that ran, in a stable order. Never empty. */
+      evidence: zod.z.array(WrapperEvidenceSchema),
+      /**
+      * The version of the SHELL, when the shell has one it can state: the
+      * Electron app version it declared, or the baked seed closure that
+      * fingerprints a container / app bundle. `null` for `contradictory` and
+      * `unknown` — which version belongs to the shell is precisely what is not
+      * known there.
+      */
+      currentVersion: zod.z.string().nullable()
+    });
     var ServerRollbackInfoSchema = zod.z.object({
       /** The version that failed (or was manually rolled back). */
       fromVersion: zod.z.string(),
@@ -231697,7 +232055,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
       * version skew: an older provider's payload simply omits it.
       */
-      imageContract: ImageContractSchema.optional()
+      imageContract: ImageContractSchema.optional(),
+      /**
+      * What this node runs INSIDE (see {@link WrapperIdentitySchema}). Optional
+      * for version skew: an older provider's payload simply omits it, and an
+      * absent wrapper is unknown — never `native`.
+      */
+      wrapper: WrapperIdentitySchema.optional()
     });
     var ServerUpdateCheckResultSchema = zod.z.object({
       packageName: zod.z.string(),
@@ -256648,7 +257012,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         case "deviceTypes":
           return kind.startsWith("device-") || kind === "detection-blind";
         case "nodeIds":
-          return kind.startsWith("node-") || kind === "addon-crash-loop" || kind === "addon-update-available" || kind === "addon-updated" || kind === "server-update-available" || kind === "server-updated";
+          return kind.startsWith("node-") || kind === "addon-crash-loop" || kind === "addon-update-available" || kind === "addon-updated" || kind === "server-update-available" || kind === "wrapper-update-available" || kind === "server-updated";
         case "packageNames":
           return kind.endsWith("update-available") || kind === "addon-updated" || kind === "server-updated";
       }
@@ -259684,6 +260048,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.WidgetMetadataSchema = WidgetMetadataSchema;
     exports.WidgetRemoteSchema = WidgetRemoteSchema;
     exports.WidgetSizeEnum = WidgetSizeEnum;
+    exports.WrapperEvidenceSchema = WrapperEvidenceSchema;
+    exports.WrapperIdentitySchema = WrapperIdentitySchema;
+    exports.WrapperKindSchema = WrapperKindSchema;
     exports.YAMNET_TO_MACRO = YAMNET_TO_MACRO;
     exports.ZoneCrossingDirectionSchema = ZoneCrossingDirectionSchema;
     exports.ZoneCrossingSchema = ZoneCrossingSchema;
@@ -259812,6 +260179,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.deriveCameraSwitches = deriveCameraSwitches;
     exports.deriveDetailCropRect = deriveDetailCropRect;
     exports.deriveRecordingMode = deriveRecordingMode;
+    exports.describeCustomActions = describeCustomActions;
     exports.describeModelVariant = describeModelVariant;
     exports.detectAccessRole = detectAccessRole;
     exports.detectionPipelineCapability = detectionPipelineCapability;
@@ -260731,6 +261099,7 @@ var require_server_root = __commonJS({
           DEV_UPLOADS_DIRNAME: /* @__PURE__ */ __name(() => DEV_UPLOADS_DIRNAME, "DEV_UPLOADS_DIRNAME"),
           DEV_UPLOADS_KEEP_COUNT: /* @__PURE__ */ __name(() => DEV_UPLOADS_KEEP_COUNT, "DEV_UPLOADS_KEEP_COUNT"),
           DEV_UPLOAD_MANIFEST_FILE: /* @__PURE__ */ __name(() => DEV_UPLOAD_MANIFEST_FILE, "DEV_UPLOAD_MANIFEST_FILE"),
+          ELECTRON_APP_VERSION_ENV: /* @__PURE__ */ __name(() => ELECTRON_APP_VERSION_ENV, "ELECTRON_APP_VERSION_ENV"),
           HOST_EXTERNAL_SPECIFIERS: /* @__PURE__ */ __name(() => HOST_EXTERNAL_SPECIFIERS, "HOST_EXTERNAL_SPECIFIERS"),
           HUB_ROOT_SPEC: /* @__PURE__ */ __name(() => HUB_ROOT_SPEC2, "HUB_ROOT_SPEC"),
           PENDING_ROOT_SWAP_FILE: /* @__PURE__ */ __name(() => PENDING_ROOT_SWAP_FILE, "PENDING_ROOT_SWAP_FILE"),
@@ -260747,6 +261116,7 @@ var require_server_root = __commonJS({
           currentDir: /* @__PURE__ */ __name(() => currentDir, "currentDir"),
           currentEntryPath: /* @__PURE__ */ __name(() => currentEntryPath, "currentEntryPath"),
           detectWorkspaceRoot: /* @__PURE__ */ __name(() => detectWorkspaceRoot, "detectWorkspaceRoot"),
+          detectWrapperIdentity: /* @__PURE__ */ __name(() => detectWrapperIdentity, "detectWrapperIdentity"),
           devChannelEpoch: /* @__PURE__ */ __name(() => devChannelEpoch, "devChannelEpoch"),
           devUploadManifestPath: /* @__PURE__ */ __name(() => devUploadManifestPath, "devUploadManifestPath"),
           devUploadVersionDir: /* @__PURE__ */ __name(() => devUploadVersionDir, "devUploadVersionDir"),
@@ -260764,6 +261134,7 @@ var require_server_root = __commonJS({
           readPendingRootSwap: /* @__PURE__ */ __name(() => readPendingRootSwap, "readPendingRootSwap"),
           readRestartIntentMarker: /* @__PURE__ */ __name(() => readRestartIntentMarker, "readRestartIntentMarker"),
           readServerRootState: /* @__PURE__ */ __name(() => readServerRootState, "readServerRootState"),
+          readWrapperProbes: /* @__PURE__ */ __name(() => readWrapperProbes, "readWrapperProbes"),
           registerActiveRootResolver: /* @__PURE__ */ __name(() => registerActiveRootResolver, "registerActiveRootResolver"),
           restartIntentMarkerPath: /* @__PURE__ */ __name(() => restartIntentMarkerPath, "restartIntentMarkerPath"),
           rootEntryPath: /* @__PURE__ */ __name(() => rootEntryPath2, "rootEntryPath"),
@@ -261443,6 +261814,93 @@ var require_server_root = __commonJS({
           };
         }
         __name(assessImageContract, "assessImageContract");
+        var ELECTRON_APP_VERSION_ENV = "CAMSTACK_AGENT_APP_VERSION";
+        var CONTAINER_CGROUP_MARKERS = [
+          "docker",
+          "containerd",
+          "kubepods",
+          "podman"
+        ];
+        function cgroupNamesAContainer(contents) {
+          const lower = contents.toLowerCase();
+          return CONTAINER_CGROUP_MARKERS.some((marker) => lower.includes(marker));
+        }
+        __name(cgroupNamesAContainer, "cgroupNamesAContainer");
+        function cgroupDetail(contents) {
+          const lines = contents.split("\n").filter((line) => line.trim().length > 0);
+          const named = lines.find((line) => cgroupNamesAContainer(line));
+          return (named ?? lines[0] ?? "").trim().slice(0, 200);
+        }
+        __name(cgroupDetail, "cgroupDetail");
+        function detectWrapperIdentity(inputs) {
+          const { platform, dockerEnvFileExists, proc1Cgroup, electronAppVersion, seedVersion } = inputs;
+          const linux = platform === "linux";
+          const cgroupAnswered = proc1Cgroup !== null;
+          const cgroupSaysContainer = proc1Cgroup !== null && cgroupNamesAContainer(proc1Cgroup);
+          const containerObserved = dockerEnvFileExists || cgroupSaysContainer;
+          const electronDeclared = electronAppVersion !== void 0 && electronAppVersion.length > 0;
+          const containerRuledOut = !containerObserved && (cgroupAnswered || !linux);
+          const evidence = [
+            {
+              fact: "platform",
+              mode: "observed",
+              holds: linux,
+              detail: linux ? `process.platform=${platform} \u2014 a container is possible here` : `process.platform=${platform} \u2014 a linux container cannot run on this platform`
+            },
+            {
+              fact: "dockerenv-file",
+              mode: "observed",
+              holds: dockerEnvFileExists,
+              detail: dockerEnvFileExists ? "/.dockerenv exists" : "/.dockerenv not present"
+            },
+            {
+              fact: "proc-1-cgroup",
+              mode: "observed",
+              holds: cgroupSaysContainer,
+              detail: proc1Cgroup === null ? "/proc/1/cgroup unreadable \u2014 this probe did NOT answer" : cgroupDetail(proc1Cgroup)
+            },
+            {
+              fact: "electron-app-version-env",
+              mode: "declared",
+              holds: electronDeclared,
+              detail: electronDeclared ? `CAMSTACK_AGENT_APP_VERSION=${String(electronAppVersion)}` : "CAMSTACK_AGENT_APP_VERSION not set"
+            }
+          ];
+          if (containerObserved && electronDeclared) {
+            return {
+              kind: "contradictory",
+              evidence,
+              currentVersion: null
+            };
+          }
+          if (containerObserved) {
+            return {
+              kind: "docker",
+              evidence,
+              currentVersion: seedVersion
+            };
+          }
+          if (electronDeclared) {
+            return {
+              kind: "electron",
+              evidence,
+              currentVersion: electronAppVersion ?? null
+            };
+          }
+          if (containerRuledOut) {
+            return {
+              kind: "native",
+              evidence,
+              currentVersion: seedVersion
+            };
+          }
+          return {
+            kind: "unknown",
+            evidence,
+            currentVersion: null
+          };
+        }
+        __name(detectWrapperIdentity, "detectWrapperIdentity");
         var fs4 = __toESM2(__require("fs"));
         var path4 = __toESM2(__require("path"));
         function detectWorkspaceRoot(fromDir) {
@@ -261584,6 +262042,26 @@ var require_server_root = __commonJS({
         var NPM_INSTALL_TIMEOUT_MS = 15 * 6e4;
         var RESTART_REASON_PREFIX = "server-update";
         var STALE_TRANSIENT_MS = 24 * 60 * 60 * 1e3;
+        function readWrapperProbes() {
+          let proc1Cgroup = null;
+          try {
+            proc1Cgroup = fs6.readFileSync("/proc/1/cgroup", "utf-8");
+          } catch {
+            proc1Cgroup = null;
+          }
+          let dockerEnvFileExists = false;
+          try {
+            dockerEnvFileExists = fs6.existsSync("/.dockerenv");
+          } catch {
+            dockerEnvFileExists = false;
+          }
+          return {
+            platform: process.platform,
+            dockerEnvFileExists,
+            proc1Cgroup
+          };
+        }
+        __name(readWrapperProbes, "readWrapperProbes");
         function readPackageVersion(pkgJsonPath) {
           try {
             const raw = JSON.parse(fs6.readFileSync(pkgJsonPath, "utf-8"));
@@ -261610,6 +262088,7 @@ var require_server_root = __commonJS({
           execNpm;
           ensureNativePrebuildsFn;
           env;
+          readWrapperProbesFn;
           now;
           runningPackageJsonPath;
           workspaceProbeDir;
@@ -261637,6 +262116,7 @@ var require_server_root = __commonJS({
             });
             this.ensureNativePrebuildsFn = options.ensureNativePrebuilds ?? (async () => void 0);
             this.env = options.env ?? process.env;
+            this.readWrapperProbesFn = options.readWrapperProbes ?? readWrapperProbes;
             this.now = options.now ?? Date.now;
             this.runningPackageJsonPath = options.runningPackageJsonPath;
             this.workspaceProbeDir = options.workspaceProbeDir;
@@ -261662,6 +262142,20 @@ var require_server_root = __commonJS({
             if (seedDir === void 0 || seedDir.length === 0) return null;
             return readPackageVersion(path6.join(seedDir, "package.json"));
           }
+          /**
+          * What this node runs INSIDE. Observed where it can be (the container
+          * probes), declared only where it cannot (the Electron app version, which a
+          * child process has no other way to learn). A contradiction between the two
+          * is reported as `contradictory`, never resolved — see `wrapper-identity.ts`
+          * and D437.
+          */
+          wrapperIdentity() {
+            return detectWrapperIdentity({
+              ...this.readWrapperProbesFn(),
+              electronAppVersion: this.env[ELECTRON_APP_VERSION_ENV],
+              seedVersion: this.seedVersion()
+            });
+          }
           rootDir() {
             return serverRootDir(this.dataDir);
           }
@@ -261700,7 +262194,11 @@ var require_server_root = __commonJS({
                 seedVersion: this.seedVersion(),
                 latestVersion,
                 runningVersion
-              })
+              }),
+              // The other half of the same question. `imageContract` says the shell is
+              // BEHIND; this says WHAT the shell is, which is the only thing that can
+              // turn that verdict into an instruction the operator can act on.
+              wrapper: this.wrapperIdentity()
             };
           }
           // ── Check ─────────────────────────────────────────────────────────────
@@ -393072,6 +393570,7 @@ var require_update_availability_emitter = __commonJS({
           nodeId: scope
         }));
         const head = list[0];
+        const wrapperKind = head.wrapperKind;
         this.eventBus.emit({
           id: `update.available:${target}:${scope}:${packages.map((pkg) => `${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",")}`,
           timestamp: /* @__PURE__ */ new Date(),
@@ -393084,7 +393583,8 @@ var require_update_availability_emitter = __commonJS({
             latestVersion: head.latestVersion,
             packages,
             nodeId: scope,
-            nodeIds: [scope]
+            nodeIds: [scope],
+            ...wrapperKind !== void 0 ? { wrapperKind } : {}
           }
         });
       }
@@ -409851,6 +410351,7 @@ var require_update_check_scheduler = __commonJS({
               continue;
             }
             await this.attempt("node server package", node.id, () => this.targets.checkNodeServerUpdate(node.id, node.isHub));
+            await this.attempt("node wrapper", node.id, () => this.targets.checkWrapperUpdate(node.id, node.isHub));
             if (node.isHub)
               continue;
             await this.attempt("agent addon packages", node.id, () => this.targets.checkAgentAddons(node.id));
@@ -424401,6 +424902,161 @@ var require_ws_request_census = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/trpc/ws-slow-consumer-guard.js
+var require_ws_slow_consumer_guard = __commonJS({
+  "../../server/backend/dist/api/trpc/ws-slow-consumer-guard.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.WsSlowConsumerGuard = exports.WS_SLOW_CONSUMER_POLL_MS = exports.WS_SLOW_CONSUMER_GRACE_MS = exports.WS_SLOW_CONSUMER_MAX_BUFFERED_BYTES = void 0;
+    exports.wsConnectionFacts = wsConnectionFacts;
+    var client_ip_js_1 = require_client_ip();
+    exports.WS_SLOW_CONSUMER_MAX_BUFFERED_BYTES = 16 * 1024 * 1024;
+    exports.WS_SLOW_CONSUMER_GRACE_MS = 3e4;
+    exports.WS_SLOW_CONSUMER_POLL_MS = 5e3;
+    var ABNORMAL_CLOSURE = 1006;
+    var UNIDENTIFIED = "(unidentified)";
+    var WsSlowConsumerGuard = class {
+      connections = /* @__PURE__ */ new Set();
+      bySocket = /* @__PURE__ */ new WeakMap();
+      logger;
+      maxBufferedBytes;
+      graceMs;
+      pollMs;
+      now;
+      timer = null;
+      constructor(options) {
+        this.logger = options.logger;
+        this.maxBufferedBytes = options.maxBufferedBytes ?? exports.WS_SLOW_CONSUMER_MAX_BUFFERED_BYTES;
+        this.graceMs = options.graceMs ?? exports.WS_SLOW_CONSUMER_GRACE_MS;
+        this.pollMs = options.pollMs ?? exports.WS_SLOW_CONSUMER_POLL_MS;
+        this.now = options.now ?? (() => Date.now());
+      }
+      /** Watch one connection until it closes. */
+      attach(socket, facts) {
+        const connection = {
+          socket,
+          facts,
+          openedAt: this.now(),
+          principal: UNIDENTIFIED,
+          overSince: null,
+          peakBufferedBytes: 0,
+          terminated: false
+        };
+        this.connections.add(connection);
+        this.bySocket.set(socket, connection);
+        socket.once("close", (code, reason) => {
+          this.connections.delete(connection);
+          this.logger.info("tRPC WS connection closed", {
+            meta: {
+              ...this.describe(connection),
+              code,
+              reason: reason.length > 0 ? reason.toString("utf8") : "",
+              closedBy: connection.terminated ? "slow-consumer-guard" : code === ABNORMAL_CLOSURE ? "peer gone or keep-alive PING unanswered" : "peer"
+            }
+          });
+        });
+      }
+      /** Name the connection's principal once the WS context resolved it. */
+      identify(socket, principal) {
+        const connection = this.bySocket.get(socket);
+        if (connection !== void 0)
+          connection.principal = principal;
+      }
+      /** Read every queue once. Exposed for the spec; production runs it on {@link start}. */
+      poll() {
+        const at = this.now();
+        for (const connection of this.connections) {
+          try {
+            this.judge(connection, at);
+          } catch (err) {
+            this.logger.warn("tRPC WS slow-consumer guard could not read a socket", {
+              meta: { ...this.describe(connection), error: errorMessage(err) }
+            });
+          }
+        }
+      }
+      start() {
+        if (this.timer !== null)
+          return;
+        this.timer = setInterval(() => this.poll(), this.pollMs);
+        this.timer.unref?.();
+      }
+      stop() {
+        if (this.timer === null)
+          return;
+        clearInterval(this.timer);
+        this.timer = null;
+      }
+      judge(connection, at) {
+        if (connection.terminated)
+          return;
+        const buffered = connection.socket.bufferedAmount;
+        if (buffered > connection.peakBufferedBytes)
+          connection.peakBufferedBytes = buffered;
+        if (buffered <= this.maxBufferedBytes) {
+          if (connection.overSince !== null) {
+            this.logger.info("tRPC WS client drained a backlog that had crossed the bound", {
+              meta: {
+                ...this.describe(connection),
+                overForMs: at - connection.overSince,
+                bufferedBytes: buffered
+              }
+            });
+            connection.overSince = null;
+            connection.peakBufferedBytes = buffered;
+          }
+          return;
+        }
+        connection.overSince ??= at;
+        const overForMs = at - connection.overSince;
+        if (overForMs < this.graceMs)
+          return;
+        connection.terminated = true;
+        this.logger.warn("tRPC WS client disconnected \u2014 slow consumer: it stopped reading and its send queue stayed above the bound for the whole grace period (a backgrounded viewer keeps the socket open with its JS suspended; the queue lived in hub-main old_space)", {
+          meta: {
+            ...this.describe(connection),
+            bufferedBytes: buffered,
+            overForMs,
+            boundBytes: this.maxBufferedBytes,
+            graceMs: this.graceMs
+          }
+        });
+        connection.socket.terminate();
+      }
+      describe(connection) {
+        return {
+          ip: connection.facts.ip ?? UNIDENTIFIED,
+          userAgent: connection.facts.userAgent ?? UNIDENTIFIED,
+          principal: connection.principal,
+          bytesRead: safeCount(connection.facts.bytesRead),
+          bytesWritten: safeCount(connection.facts.bytesWritten),
+          peakBufferedBytes: connection.peakBufferedBytes,
+          connectionAgeMs: this.now() - connection.openedAt
+        };
+      }
+    };
+    exports.WsSlowConsumerGuard = WsSlowConsumerGuard;
+    function safeCount(read) {
+      try {
+        return read();
+      } catch {
+        return null;
+      }
+    }
+    function errorMessage(err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+    function wsConnectionFacts(req) {
+      return {
+        ip: (0, client_ip_js_1.extractClientIp)(req),
+        userAgent: (0, client_ip_js_1.extractUserAgent)(req),
+        bytesRead: () => req.socket.bytesRead,
+        bytesWritten: () => req.socket.bytesWritten
+      };
+    }
+  }
+});
+
 // ../../server/backend/dist/auth/addon-route-jwt-gate.js
 var require_addon_route_jwt_gate = __commonJS({
   "../../server/backend/dist/auth/addon-route-jwt-gate.js"(exports) {
@@ -425270,6 +425926,58 @@ var require_integration_visibility = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/addon/forked-custom-actions.js
+var require_forked_custom_actions = __commonJS({
+  "../../server/backend/dist/core/addon/forked-custom-actions.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.toForkedCustomActionsSpec = toForkedCustomActionsSpec;
+    exports.childCatalogsFingerprint = childCatalogsFingerprint;
+    exports.summarizeChildCatalogs = summarizeChildCatalogs;
+    var zod_1 = require_zod();
+    function toForkedCustomActionsSpec(descriptor) {
+      const spec = {};
+      for (const [name, action] of Object.entries(descriptor)) {
+        spec[name] = {
+          input: zod_1.z.unknown(),
+          output: zod_1.z.unknown(),
+          kind: action.kind,
+          auth: action.auth,
+          scope: action.scope,
+          ...action.caller === "required" ? { caller: "required" } : {}
+        };
+      }
+      return spec;
+    }
+    function childCatalogsFingerprint(catalogs) {
+      return JSON.stringify(sortKeysDeep(catalogs));
+    }
+    function sortKeysDeep(value) {
+      if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+      if (value === null || typeof value !== "object")
+        return value;
+      const out = {};
+      for (const key of Object.keys(value).sort()) {
+        out[key] = sortKeysDeep(Reflect.get(value, key));
+      }
+      return out;
+    }
+    function summarizeChildCatalogs(catalogs) {
+      const withActions = [];
+      const withoutActions = [];
+      for (const addonId of Object.keys(catalogs).sort()) {
+        const count = Object.keys(catalogs[addonId] ?? {}).length;
+        if (count > 0)
+          withActions.push(`${addonId}:${count}`);
+        else
+          withoutActions.push(addonId);
+      }
+      return { withActions, withoutActions };
+    }
+  }
+});
+
 // ../../server/backend/dist/core/addon/prune-misplaced-addons.js
 var require_prune_misplaced_addons = __commonJS({
   "../../server/backend/dist/core/addon/prune-misplaced-addons.js"(exports) {
@@ -425364,49 +426072,6 @@ var require_prune_misplaced_addons = __commonJS({
   }
 });
 
-// ../../server/backend/dist/core/addon/require-cache.js
-var require_require_cache = __commonJS({
-  "../../server/backend/dist/core/addon/require-cache.js"(exports) {
-    "use strict";
-    var __importDefault = exports && exports.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.purgeRequireCacheUnder = purgeRequireCacheUnder;
-    exports.bundleGraphRootFor = bundleGraphRootFor;
-    var node_fs_1 = __importDefault(__require("fs"));
-    var node_path_1 = __importDefault(__require("path"));
-    function purgeRequireCacheUnder(dir) {
-      try {
-        const cache2 = __require.cache;
-        if (cache2 === void 0)
-          return;
-        const prefixes = candidatePrefixes(dir);
-        for (const key of Object.keys(cache2)) {
-          if (prefixes.some((prefix) => key.startsWith(prefix)))
-            delete cache2[key];
-        }
-      } catch {
-      }
-    }
-    function bundleGraphRootFor(addonDir, entryPath) {
-      const distDir = node_path_1.default.resolve(addonDir, "dist");
-      const withSep = distDir.endsWith(node_path_1.default.sep) ? distDir : `${distDir}${node_path_1.default.sep}`;
-      return entryPath.startsWith(withSep) ? distDir : node_path_1.default.dirname(entryPath);
-    }
-    function candidatePrefixes(dir) {
-      const withSep = (d) => d.endsWith(node_path_1.default.sep) ? d : `${d}${node_path_1.default.sep}`;
-      const given = withSep(dir);
-      let real = given;
-      try {
-        real = withSep(node_fs_1.default.realpathSync(dir));
-      } catch {
-      }
-      return real === given ? [given] : [given, real];
-    }
-  }
-});
-
 // ../../server/backend/dist/core/addon/runner-convergence.js
 var require_runner_convergence = __commonJS({
   "../../server/backend/dist/core/addon/runner-convergence.js"(exports) {
@@ -425525,7 +426190,6 @@ var require_addon_registry_service = __commonJS({
     var fs = __importStar(__require("fs"));
     var os = __importStar(__require("os"));
     var path = __importStar(__require("path"));
-    var node_url_1 = __require("url");
     var system_1 = require_dist3();
     var types_1 = require_dist4();
     var client_1 = require_dist2();
@@ -425535,8 +426199,8 @@ var require_addon_registry_service = __commonJS({
     var device_meta_mirror_js_1 = require_device_meta_mirror();
     var integration_visibility_js_1 = require_integration_visibility();
     var package_dir_utils_1 = require_package_dir_utils();
+    var forked_custom_actions_js_1 = require_forked_custom_actions();
     var prune_misplaced_addons_js_1 = require_prune_misplaced_addons();
-    var require_cache_js_1 = require_require_cache();
     var runner_convergence_1 = require_runner_convergence();
     var runner_spawn_fanout_js_1 = require_runner_spawn_fanout();
     function shouldEvictMissingOnDisk(entry, id, onDiskIds) {
@@ -425682,10 +426346,14 @@ var require_addon_registry_service = __commonJS({
       // through this from the `api.addons.custom` tRPC procedure.
       customActionRegistry = new system_1.CustomActionRegistry();
       /**
-       * Keeps `purgeRequireCacheUnder` + `import()` atomic per addon directory now
-       * that the boot runner plan overlaps (D171). See `runner-spawn-fanout.ts`.
+       * Fingerprint of the custom-action catalogs each UDS child last DESCRIBED
+       * (keyed by child id), and the addon ids registered from that description.
+       * A re-register carrying the same catalogs is a no-op with no line; a child
+       * whose new description drops an addon has that addon's actions withdrawn.
+       * See {@link applyChildCustomActions}.
        */
-      moduleLoadSerializer = (0, runner_spawn_fanout_js_1.createKeyedSerializer)();
+      childCatalogFingerprints = /* @__PURE__ */ new Map();
+      childCatalogAddons = /* @__PURE__ */ new Map();
       /**
        * AddonIds whose group-runner disconnect is operator-initiated (update /
        * restart / uninstall). The Moleculer `$node.disconnected` handler skips
@@ -427289,6 +427957,7 @@ var require_addon_registry_service = __commonJS({
       wireCapabilityConsumers() {
         if (!this.capabilityRegistry)
           return;
+        this.moleculer.onChildCustomActions((child) => this.applyChildCustomActions(child));
         this.eventBusService.subscribe({ category: "capability:provider-registered" }, (event) => {
           const rawCapability = event.data["capability"];
           const rawAddonId = event.data["addonId"];
@@ -427852,7 +428521,6 @@ var require_addon_registry_service = __commonJS({
           throw new Error(`Failed to spawn runner "${runnerId}" (${addons.length} addons): ${(0, types_1.errMsg)(err)}`, { cause: err });
         }
         for (const { addonId } of addons) {
-          await this.registerForkedAddonCustomActions(addonId, runnerId);
           const entry = this.addonEntries.get(addonId);
           if (entry) {
             entry.initialized = true;
@@ -427933,86 +428601,72 @@ var require_addon_registry_service = __commonJS({
           this.recentGroupRespawns.set(runnerId, Date.now());
         }
         for (const { addonId: memberId } of roster) {
-          await this.registerForkedAddonCustomActions(memberId, runnerId);
           const memberEntry = this.addonEntries.get(memberId);
           if (memberEntry)
             memberEntry.initialized = true;
         }
       }
       /**
-       * (Re-)register the custom-action catalog for a forked / group-hosted
-       * addon against the shared `CustomActionRegistry`.
-       *
-       * The catalog (zod `input`/`output` specs) is read STATICALLY from the
-       * addon module's `customActions` named export — the handler dispatches
-       * over UDS via `LocalChildRegistry.callAddonOnChild(addonId,
-       * {target:'custom', action, args})` (F3 — replaces the removed per-addon
-       * Moleculer `custom.<action>` action), so the only divergence vs an
-       * in-process addon is the transport, exactly like cap methods. The hub's
-       * `CustomActionRegistry` validates input/output around this dispatch.
-       *
-       * Why a fresh import: `this.addonLoader`'s `module` namespace is
-       * captured once at boot. After a hot-update (`installFromTgz` →
-       * `restartAddon`) the on-disk bundle is newer than that cached module,
-       * so re-reading the boot-time `module` would register a STALE catalog
-       * (or none at all, if the addon was first installed after boot). We
-       * re-`import()` the entry with a cache-busting query so Node's ESM
-       * loader hands back the current bundle.
-       *
-       * Idempotent: drops any prior registration first. No-op (with a debug
-       * log) when the addon exports no `customActions` — most addons don't.
-       */
-      async registerForkedAddonCustomActions(addonId, runnerId) {
-        this.customActionRegistry.unregisterAddon(addonId);
-        const entry = this.addonEntries.get(addonId);
-        const addonDir = entry?.addonDir;
-        const declarationEntry = entry?.declaration?.entry;
-        if (!addonDir || !declarationEntry)
+       * Apply the custom-action catalogs a UDS child DESCRIBED in its register
+       * frame (`RegisteredChild.customActions`, schemas stripped) to the hub-wide
+       * `CustomActionRegistry`, dispatching each action back to that child over
+       * the addon-call plane.
+       *
+       * ## Why the child describes, and the hub never reads the bundle
+       *
+       * Until D444 this was `registerForkedAddonCustomActions`: purge the require
+       * cache, re-import the addon's entry INSIDE hub-main, read its
+       * `customActions` export. Measured 2026-09-10 on the live hub: 9.3 MB of
+       * `addon-pipeline-orchestrator/dist/index.js` evaluated in hub-main by a
+       * sampling heap profile, ten deploys in the process's 23 h life, NONE of
+       * which exported a catalog — and the only line saying so was at `debug`,
+       * which the hub does not write. Every evaluation pins whatever module-scope
+       * state the evicted graph left behind, and the bundle-reload guard existed
+       * only to keep that re-execution survivable (D284). The runner is the
+       * process that owns the addon; it describes its catalog once its init loop
+       * has produced it, in the post-init register frame, and validates the
+       * action's input and output itself (`child-addon-call-dispatch.ts`).
+       *
+       * ## What one description does
+       *
+       *  - identical to the child's last description → nothing, silently (a
+       *    native-cap change or reconnect re-sends the same frame);
+       *  - otherwise every addon in it is (re-)registered — an EMPTY catalog
+       *    withdraws that addon's actions — and an addon the previous description
+       *    named but this one does not is withdrawn too;
+       *  - and ONE `info` line per applied description names what it produced,
+       *    including "nothing": a load that produces nothing and says nothing is
+       *    the branch D391 forbids.
+       */
+      applyChildCustomActions(child) {
+        const catalogs = child.customActions;
+        if (catalogs === void 0)
           return;
-        const entryFile = declarationEntry.replace(/^\.\//, "").replace(/^src\//, "dist/").replace(/\.ts$/, ".js");
-        let entryPath = path.resolve(addonDir, entryFile);
-        if (!fs.existsSync(entryPath)) {
-          const base = entryPath.replace(/\.(js|cjs|mjs)$/, "");
-          const alternatives = [
-            `${base}.cjs`,
-            `${base}.mjs`,
-            path.resolve(addonDir, "dist", "index.js"),
-            path.resolve(addonDir, "dist", "index.cjs"),
-            path.resolve(addonDir, "dist", "index.mjs"),
-            path.resolve(addonDir, declarationEntry)
-          ];
-          entryPath = alternatives.find((p) => fs.existsSync(p)) ?? entryPath;
-        }
-        if (!fs.existsSync(entryPath))
-          return;
-        let catalog;
-        try {
-          const graphRoot = (0, require_cache_js_1.bundleGraphRootFor)(addonDir, entryPath);
-          const modUnknown = await this.moduleLoadSerializer.run(graphRoot, async () => {
-            (0, require_cache_js_1.purgeRequireCacheUnder)(graphRoot);
-            const cacheBustedUrl = `${(0, node_url_1.pathToFileURL)(entryPath).href}?t=${Date.now()}`;
-            const nativeImport = new Function("specifier", "return import(specifier)");
-            return nativeImport(cacheBustedUrl);
-          });
-          catalog = modUnknown && typeof modUnknown === "object" ? modUnknown["customActions"] : void 0;
-        } catch (err) {
-          this.logger.warn("Failed to load custom-action catalog for forked addon", {
-            tags: { addonId },
-            meta: { error: (0, types_1.errMsg)(err) }
-          });
-          return;
-        }
-        if (!catalog || typeof catalog !== "object") {
-          this.logger.debug("Forked addon exports no custom actions", {
-            tags: { addonId },
-            meta: { runnerId }
-          });
+        const fingerprint = (0, forked_custom_actions_js_1.childCatalogsFingerprint)(catalogs);
+        if (this.childCatalogFingerprints.get(child.childId) === fingerprint)
           return;
+        this.childCatalogFingerprints.set(child.childId, fingerprint);
+        const described = new Set(Object.keys(catalogs));
+        for (const previous of this.childCatalogAddons.get(child.childId) ?? []) {
+          if (!described.has(previous))
+            this.customActionRegistry.unregisterAddon(previous);
+        }
+        this.childCatalogAddons.set(child.childId, described);
+        for (const [addonId, descriptor] of Object.entries(catalogs)) {
+          if (Object.keys(descriptor).length === 0) {
+            this.customActionRegistry.unregisterAddon(addonId);
+            continue;
+          }
+          this.customActionRegistry.registerAddon(addonId, (0, forked_custom_actions_js_1.toForkedCustomActionsSpec)(descriptor), (action, input, caller) => this.dispatchForkedCustomAction(addonId, action, input, caller));
         }
-        this.customActionRegistry.registerAddon(addonId, catalog, (action, input, caller) => this.dispatchForkedCustomAction(addonId, action, input, caller));
-        this.logger.info("Runner addon custom actions registered", {
-          tags: { addonId },
-          meta: { runnerId }
+        const summary = (0, forked_custom_actions_js_1.summarizeChildCatalogs)(catalogs);
+        this.logger.info("UDS child custom-action catalogs applied", {
+          meta: {
+            childId: child.childId,
+            incarnation: child.incarnation,
+            registered: summary.withActions.length > 0 ? summary.withActions.join(",") : "(none)",
+            withoutActions: summary.withoutActions.length > 0 ? summary.withoutActions.join(",") : "(none)"
+          }
         });
       }
       /**
@@ -429982,6 +430636,15 @@ var require_moleculer_service = __commonJS({
        * See {@link ChildManifestGate}.
        */
       childManifestGate = new ChildManifestGate();
+      /**
+       * Receives every child register frame that DESCRIBES its custom-action
+       * catalogs (the post-init one and every re-register after it). Consulted
+       * BEFORE {@link ChildManifestGate}: the gate compares caps, and a post-init
+       * register of a non-device runner carries the same caps as its pre-init one
+       * — skipping it would lose the only frame that carries the catalogs (D444).
+       * The consumer (`AddonRegistryService`) dedupes by catalog fingerprint.
+       */
+      childCustomActionsHandler = null;
       /**
        * Fixed-period agent-readiness snapshot sweep (D8 reconcile) — repairs
        * agent-origin readiness deltas lost while the agent stayed connected.
@@ -430059,6 +430722,14 @@ var require_moleculer_service = __commonJS({
       get childRegistry() {
         return this.localChildRegistry;
       }
+      /**
+       * Register the (single) handler for a child's described custom-action
+       * catalogs. See {@link childCustomActionsHandler}. Called once by
+       * `AddonRegistryService` when it wires its consumers.
+       */
+      onChildCustomActions(handler) {
+        this.childCustomActionsHandler = handler;
+      }
       /** The CapRouteResolver once onModuleInit has completed; null before that. */
       get capRouteResolver() {
         return this.resolver;
@@ -430311,6 +430982,15 @@ var require_moleculer_service = __commonJS({
           registry.onChildRegistered((child) => {
             const hubNodeId = this.brokerSafe.nodeID;
             const childNodeId = `${hubNodeId}/${child.childId}`;
+            if (child.customActions !== void 0) {
+              try {
+                this.childCustomActionsHandler?.(child);
+              } catch (err) {
+                logger.warn("UDS child custom-action catalogs could not be applied", {
+                  meta: { nodeId: childNodeId, incarnation: child.incarnation, error: (0, types_1.errMsg)(err) }
+                });
+              }
+            }
             const params = buildChildUdsManifest(childNodeId, child.childId, child.caps);
             if (!this.childManifestGate.shouldApply(child.childId, child.incarnation, params)) {
               if (this.childManifestGate.sampleDue()) {
@@ -432104,6 +432784,62 @@ var require_topology_emitter_service = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/updates/wrapper-update-checker.js
+var require_wrapper_update_checker = __commonJS({
+  "../../server/backend/dist/core/updates/wrapper-update-checker.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.WrapperUpdateChecker = exports.WRAPPER_PACKAGE_NAME = void 0;
+    exports.WRAPPER_PACKAGE_NAME = "camstack-wrapper";
+    var WrapperUpdateChecker = class {
+      emitter;
+      logger;
+      readStatus;
+      constructor(options) {
+        this.emitter = options.emitter;
+        this.logger = options.logger;
+        this.readStatus = options.readStatus;
+      }
+      async check(nodeId, isHub) {
+        const status = await this.readStatus(nodeId, isHub);
+        const wrapper = status.wrapper;
+        const contract = status.imageContract;
+        if (wrapper === void 0 || contract === void 0) {
+          throw new Error(`node ${nodeId} reports no wrapper identity (server-management payload predates it)`);
+        }
+        if (contract.state === "in-sync") {
+          this.emitter.publishSnapshot("wrapper", [], nodeId);
+          return;
+        }
+        const seedVersion = contract.seedVersion;
+        const contractVersion = contract.contractVersion;
+        const behind = contract.state === "behind-patch" || contract.state === "behind-series";
+        if (!behind || seedVersion === null || contractVersion === null) {
+          this.logger.warn("Wrapper check inconclusive \u2014 nothing published", {
+            tags: { nodeId },
+            meta: { state: contract.state, wrapperKind: wrapper.kind, seedVersion, contractVersion }
+          });
+          return;
+        }
+        const candidate = {
+          target: "wrapper",
+          packageName: exports.WRAPPER_PACKAGE_NAME,
+          // The SHELL's versions, not the running code's. `wrapper.currentVersion`
+          // is what the shell says about ITSELF (an Electron app version), which
+          // is not on the same scale as a release; the seed is, and the seed is
+          // what `contractVersion` was compared against.
+          currentVersion: seedVersion,
+          latestVersion: contractVersion,
+          nodeId,
+          wrapperKind: wrapper.kind
+        };
+        this.emitter.publishSnapshot("wrapper", [candidate], nodeId);
+      }
+    };
+    exports.WrapperUpdateChecker = WrapperUpdateChecker;
+  }
+});
+
 // ../../server/backend/dist/manual-boot.js
 var require_manual_boot = __commonJS({
   "../../server/backend/dist/manual-boot.js"(exports) {
@@ -432183,9 +432919,11 @@ var require_manual_boot = __commonJS({
     var storage_service_1 = require_storage_service();
     var stream_probe_service_1 = require_stream_probe_service();
     var topology_emitter_service_1 = require_topology_emitter_service();
+    var update_availability_emitter_js_1 = require_update_availability_emitter();
     var update_availability_store_js_1 = require_update_availability_store();
     var agent_installed_packages_js_1 = require_agent_installed_packages();
     var update_check_scheduler_js_1 = require_update_check_scheduler();
+    var wrapper_update_checker_js_1 = require_wrapper_update_checker();
     var ServiceContainer = class {
       services = /* @__PURE__ */ new Map();
       register(ctor, instance) {
@@ -432292,6 +433030,20 @@ var require_manual_boot = __commonJS({
       const topologyEmitterService = new topology_emitter_service_1.TopologyEmitterService(eventBusService, agentRegistryService, addonRegistryService, (0, cap_providers_1.createNodeRootPackageLookup)(moleculerService, serverUpdateService));
       const postBootService = new post_boot_service_1.PostBootService(addonRegistryService, eventBusService, loggingService);
       const updateCheckLogger = loggingService.createLogger("UpdateCheck");
+      const wrapperUpdateChecker = new wrapper_update_checker_js_1.WrapperUpdateChecker({
+        logger: updateCheckLogger,
+        emitter: new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBusService, { type: "core", id: "wrapper-update-check" }, new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, "wrapper-update", loggingService.createLogger("UpdateAvailability"))),
+        readStatus: async (nodeId, isHub) => {
+          if (isHub)
+            return serverUpdateService.getServerPackageStatus();
+          const proxy = moleculerService.createCapabilityProxy("server-management", nodeId);
+          if (proxy === null) {
+            throw new Error(`server-management unreachable on ${nodeId}`);
+          }
+          const status = await proxy["getServerPackageStatus"]?.({});
+          return types_1.ServerPackageStatusSchema.parse(status);
+        }
+      });
       const updateCheckScheduler = new update_check_scheduler_js_1.UpdateCheckScheduler({
         logger: updateCheckLogger,
         getIntervalSeconds: () => addonPackageService.getAutoUpdateSettings().updateCheckIntervalSeconds,
@@ -432315,7 +433067,8 @@ var require_manual_boot = __commonJS({
               return void 0;
             }
             return proxy["checkServerUpdate"]?.({});
-          }
+          },
+          checkWrapperUpdate: (nodeId, isHub) => wrapperUpdateChecker.check(nodeId, isHub)
         }
       });
       addonPackageService.setUpdateCheckRescheduler(() => updateCheckScheduler.reschedule());
@@ -432522,6 +433275,7 @@ var require_main4 = __commonJS({
     var trpc_error_principal_1 = require_trpc_error_principal();
     var trpc_error_device_tags_1 = require_trpc_error_device_tags();
     var ws_request_census_1 = require_ws_request_census();
+    var ws_slow_consumer_guard_js_1 = require_ws_slow_consumer_guard();
     var addon_route_jwt_gate_js_1 = require_addon_route_jwt_gate();
     var addon_route_share_gate_js_1 = require_addon_route_share_gate();
     var session_cookie_js_1 = require_session_cookie();
@@ -432646,7 +433400,17 @@ var require_main4 = __commonJS({
         // per peer and per frame kind. Same lazy registry, same reason.
         socketPlane: (0, system_1.createSocketPlaneReader)({
           registry: () => moleculerForEventPlane?.childRegistry ?? null
-        })
+        }),
+        // The ArrayBuffer census, armed by the probe itself. Twice on 2026-09-10
+        // this process's `arrayBuffers` climbed linearly for an hour (to 1.3 GB
+        // and to 5 GB, both LIVE across a forced compaction) and released in one
+        // instant, with no line at either boundary; the measurement that names
+        // the shape existed and was never run because it needed a human awake
+        // during the episode. Now the heartbeat takes it: one forced full GC —
+        // the pause a reclaim pass already costs — walked in memory, nothing
+        // written, on a threshold held for a minute, at most twice an hour.
+        // It is NOT a heap snapshot; see `array-buffer-census.ts`.
+        arrayBufferCensus: { census: (0, system_1.createInspectorArrayBufferCensus)() }
       });
       cleanupOrphanProcesses();
       let spaIndexHtml = null;
@@ -433246,15 +434010,31 @@ var require_main4 = __commonJS({
             concurrencyLimit: 10
           }
         });
+        const wsSlowConsumerGuard = new ws_slow_consumer_guard_js_1.WsSlowConsumerGuard({
+          logger: app.get(logging_service_1.LoggingService).createLogger("tRPC:ws")
+        });
+        wsSlowConsumerGuard.start();
         wss.on("connection", (client, req) => {
           (0, ws_request_census_1.attachWsCensusSession)(httpRequestCensus, client, req, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws"));
+          wsSlowConsumerGuard.attach(client, (0, ws_slow_consumer_guard_js_1.wsConnectionFacts)(req));
         });
         (0, ws_1.applyWSSHandler)({
           wss,
           router: appRouter,
+          // The complement of the bound above, for the SUSPENDED client: a PING is
+          // a text frame the client's JS must answer, and a backgrounded app's JS
+          // does not run — so the socket is terminated ~40 s into the background
+          // instead of accumulating for the night, and the app reconnects on
+          // return (every WS client of this hub is `@trpc/client` >= 11, which
+          // answers PING with PONG; the viewer pins ^11.16). The bound stays: it
+          // covers a client whose JS runs but whose link cannot drain the events.
+          // A termination here closes with 1006; the guard's close line names it.
+          keepAlive: { enabled: true, pingMs: 3e4, pongWaitMs: 1e4 },
           createContext: async (opts) => {
             const wsCtx = await (0, trpc_context_1.createWsTrpcContext)(opts, authService, addonRegistry, shareTokenService, app.get(logging_service_1.LoggingService).createLogger("tRPC:ws"));
-            (0, ws_request_census_1.identifyWsCensusSession)(opts.res, (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user));
+            const principal = (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user);
+            (0, ws_request_census_1.identifyWsCensusSession)(opts.res, principal);
+            wsSlowConsumerGuard.identify(opts.res, principal);
             return wsCtx;
           },
           onError: ({ path: trpcPath, error, ctx, input }) => {