camstack 1.2.49 → 1.2.51

package/dist/{launcher-Y5UOZ2NP.js → launcher-EJ6BGNVY.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-BVU5JADq.js
-var require_dist_BVU5JADq = __commonJS({
-  "../system/dist/dist-BVU5JADq.js"(exports) {
+// ../system/dist/dist-Dl6MFXPr.js
+var require_dist_Dl6MFXPr = __commonJS({
+  "../system/dist/dist-Dl6MFXPr.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26367,6 +26367,116 @@ var require_dist_BVU5JADq = __commonJS({
       */
       debug: zod.z.boolean().optional()
     });
+    var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
+    var ROOT_BUCKET_KEY = "__root__";
+    function bucketFor(row) {
+      if (row.addonId !== null) return {
+        key: row.addonId,
+        kind: "addon"
+      };
+      if (row.classification === "root") return {
+        key: ROOT_BUCKET_KEY,
+        kind: "root"
+      };
+      return {
+        key: UNATTRIBUTED_BUCKET_KEY,
+        kind: "unattributed"
+      };
+    }
+    function deci(value) {
+      return Math.round(value * 10) / 10;
+    }
+    function foldSnapshotByFunction(rows, atMs) {
+      const acc = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        const { key, kind } = bucketFor(row);
+        const cur = acc.get(key) ?? {
+          kind,
+          main: 0,
+          gc: 0,
+          lifetime: 0,
+          memory: 0,
+          count: 0,
+          splitKnown: true
+        };
+        const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
+        acc.set(key, {
+          kind: cur.kind,
+          main: cur.main + (row.cpuMainPercent ?? 0),
+          gc: cur.gc + (row.cpuGcPercent ?? 0),
+          lifetime: cur.lifetime + row.cpuPercent,
+          memory: cur.memory + row.memoryRssBytes,
+          count: cur.count + 1,
+          splitKnown: cur.splitKnown && known
+        });
+      }
+      return [...acc.entries()].map(([key, a]) => {
+        const main = a.splitKnown ? deci(a.main) : null;
+        const gc = a.splitKnown ? deci(a.gc) : null;
+        const lifetime = deci(a.lifetime);
+        return {
+          key,
+          kind: a.kind,
+          point: {
+            atMs,
+            samples: 1,
+            cpuMainPercent: main,
+            cpuMainPercentMin: main,
+            cpuGcPercent: gc,
+            cpuGcPercentMin: gc,
+            cpuLifetimePercent: lifetime,
+            cpuLifetimePercentMin: lifetime,
+            memoryRssBytes: a.memory,
+            memoryRssBytesMin: a.memory,
+            processCount: a.count,
+            processCountMin: a.count
+          }
+        };
+      });
+    }
+    function minNullable(a, b) {
+      if (a === null || b === null) return null;
+      return a < b ? a : b;
+    }
+    function maxNullable(a, b) {
+      if (a === null || b === null) return null;
+      return a > b ? a : b;
+    }
+    function mergePoints(held, next, atMs) {
+      return {
+        atMs,
+        samples: held.samples + next.samples,
+        cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
+        cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
+        cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
+        cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
+        cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
+        cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
+        memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
+        memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
+        processCount: Math.max(held.processCount, next.processCount),
+        processCountMin: Math.min(held.processCountMin, next.processCountMin)
+      };
+    }
+    function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
+      if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
+      const wanted = spanMs / maxPoints;
+      if (wanted <= cadenceMs) return cadenceMs;
+      return Math.ceil(wanted / cadenceMs) * cadenceMs;
+    }
+    function reducePoints(points, bucketMs, origin) {
+      if (bucketMs <= 0 || points.length === 0) return points;
+      const buckets = /* @__PURE__ */ new Map();
+      for (const point of points) {
+        const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+        const held = buckets.get(start);
+        buckets.set(start, held === void 0 ? {
+          ...point,
+          atMs: start
+        } : mergePoints(held, point, start));
+      }
+      return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+    }
     var MODEL_FORMATS = [
       "onnx",
       "coreml",
@@ -29520,6 +29630,10 @@ var require_dist_BVU5JADq = __commonJS({
       id: zod.z.string(),
       data: zod.z.record(zod.z.string(), zod.z.unknown())
     });
+    var BulkRecordSchema = zod.z.object({
+      id: zod.z.string().optional(),
+      data: zod.z.record(zod.z.string(), zod.z.unknown())
+    });
     var CollectionColumnSchema = zod.z.object({
       name: zod.z.string(),
       type: zod.z.enum([
@@ -29594,6 +29708,34 @@ var require_dist_BVU5JADq = __commonJS({
           collection: zod.z.string(),
           record: SettingsRecordSchema
         }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Insert MANY records in ONE transaction, returning how many landed.
+        *
+        * The write-side twin of {@link deleteWhere}, and it exists for the same
+        * reason: without it, appending a batch is N round trips and N COMMITs on
+        * the single shared connection that also serves every cluster-wide
+        * configuration read. The durable load series writes one process row per
+        * process per sample — 76 rows every 10 s on the live fleet — and the
+        * operator's rule for it is *one transaction per sample, never one per
+        * row*. `insert` cannot express that; nothing else could.
+        *
+        * **All or nothing.** A batch that fails on its fifth row leaves none of
+        * the five behind. A half-written sample is worse than a missing one: the
+        * missing one reads as "nobody reported", which is true, while the half
+        * one reads as "these were the only processes running", which is not.
+        *
+        * `id` is OPTIONAL per record, and that is the difference from
+        * {@link insert}. A collection whose primary key is an `INTEGER` rowid
+        * alias has no id to supply — SQLite assigns it, for free, and inventing a
+        * `randomUUID()` for such a column would write a 36-character string into
+        * an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+        * `insert` does.
+        */
+        insertMany: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          records: zod.z.array(BulkRecordSchema).readonly()
+        }), zod.z.object({ inserted: zod.z.number().int() }), { kind: "mutation" }),
         /** Update an existing record by ID. */
         update: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -29783,6 +29925,15 @@ var require_dist_BVU5JADq = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /** Insert many records in ONE transaction. All or nothing. */
+        insertMany: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          records: zod.z.array(BulkRecordSchema).readonly()
+        }), zod.z.object({ inserted: zod.z.number().int() }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Update an existing record by ID. */
         update: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -32089,6 +32240,83 @@ var require_dist_BVU5JADq = __commonJS({
       /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
       mount: { kind: "skip" }
     };
+    var LoadContributionSchema = zod.z.object({
+      role: zod.z.enum([
+        "decode",
+        "transcode",
+        "recording",
+        "streaming",
+        "detection"
+      ]),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. `null` means this cost genuinely belongs to no single
+      * camera (a shared pool), NOT that the contributor forgot to look it up: a
+      * contributor that cannot name its camera must not emit the entry at all,
+      * because an unnamed per-camera entry is indistinguishable from a shared one
+      * and would quietly turn one camera's cost into everybody's.
+      */
+      deviceId: zod.z.number().int().positive().nullable(),
+      attribution: zod.z.enum([
+        "measured",
+        "accounted",
+        "unattributable"
+      ]),
+      /**
+      * What ONE entry is, in the contributor's own words — `615/high`,
+      * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+      * family and inventing a common one would lose the only information that
+      * makes two entries for the same camera distinguishable.
+      */
+      unit: zod.z.string(),
+      /**
+      * The OS process this cost lives in, when there is one. Present so a
+      * consumer can (a) tell two generations of the same unit apart across a
+      * restart, and (b) subtract claimed processes from the node's process
+      * snapshot to see what NOBODY claimed. Absent for an entry that owns no
+      * process of its own.
+      */
+      pid: zod.z.number().int().positive().optional(),
+      /**
+      * When this generation started. The pid's incarnation marker: a consumer
+      * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+      * window when this changes, because the counter restarted from zero in a new
+      * process.
+      */
+      startedAtMs: zod.z.number().optional(),
+      /**
+      * CUMULATIVE CPU seconds this unit has consumed since it started — user +
+      * system, read from the child's own `/proc/<pid>/stat` at the moment the
+      * contribution is asked for.
+      *
+      * Cumulative and not a rate on purpose: a rate needs a window, a window
+      * needs a sampler, and a new per-node sampler is the defect half of
+      * `docs/architecture/load-ledger.md` documents. A counter can be differenced
+      * by whoever already keeps a history; a rate cannot be un-averaged.
+      *
+      * Absent — never zero — on a node with no `/proc`, on a read failure, and on
+      * an entry with no process.
+      */
+      cpuSeconds: zod.z.number().optional(),
+      /** Resident bytes of this unit's process, same source and same rules. */
+      rssBytes: zod.z.number().optional()
+    });
+    var loadContributionCapability = {
+      name: "load-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's own cost entries, computed live from state it already
+        * holds. Inert: no persistence, no sampling, no timer. It is answered on
+        * whatever beat the caller already has.
+        */
+        list: method(zod.z.void(), zod.z.array(LoadContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -32260,8 +32488,7 @@ var require_dist_BVU5JADq = __commonJS({
       classification: zod.z.enum([
         "root",
         "managed",
-        "system",
-        "ghost"
+        "system"
       ]),
       /** `$process` addon binding when `managed`, else null. */
       addonId: zod.z.string().nullable(),
@@ -32269,22 +32496,39 @@ var require_dist_BVU5JADq = __commonJS({
       nodeId: zod.z.string().nullable(),
       /** Truncated command line. */
       command: zod.z.string(),
+      /**
+      * `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+      * On a runner up for days it barely moves. Fine as a column, useless as a
+      * series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+      */
       cpuPercent: zod.z.number(),
       memoryRssBytes: zod.z.number(),
+      /**
+      * Instantaneous CPU% of the process's own threads over the last
+      * process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+      *
+      * `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+      * boot), the pid was recycled, or this node is not Linux.
+      */
+      cpuMainPercent: zod.z.number().nullable(),
+      /**
+      * Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+      *
+      * This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+      * `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+      * does not separate it from `cpuMainPercent` shows "busy" where the truth is
+      * "allocating too much".
+      *
+      * Concurrent GC is the dominant tenant of that pool but not the only one
+      * (background compilation runs there too), so it is reported as
+      * "GC / V8 helpers" rather than as pure collection time. `null` has the same
+      * meaning as on `cpuMainPercent`.
+      */
+      cpuGcPercent: zod.z.number().nullable(),
+      /** Threads seen in the tick scan. `null` under the same conditions. */
+      threadCount: zod.z.number().nullable(),
       /** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-      uptimeSec: zod.z.number(),
-      /** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-      orphaned: zod.z.boolean()
-    });
-    var KillProcessInputSchema = zod.z.object({
-      pid: zod.z.number(),
-      /** Force = SIGKILL. Default is SIGTERM. */
-      force: zod.z.boolean().optional()
-    });
-    var KillProcessResultSchema = zod.z.object({
-      success: zod.z.boolean(),
-      reason: zod.z.string().optional(),
-      signal: zod.z.enum(["SIGTERM", "SIGKILL"]).optional()
+      uptimeSec: zod.z.number()
     });
     var DumpHeapSnapshotInputSchema = zod.z.object({
       /** The addon whose runner should dump a heap snapshot. */
@@ -32298,6 +32542,89 @@ var require_dist_BVU5JADq = __commonJS({
       pid: zod.z.number().optional(),
       reason: zod.z.string().optional()
     });
+    var LoadPointSchema = zod.z.object({
+      /** Bucket START, or the snapshot's own timestamp when unreduced. */
+      atMs: zod.z.number(),
+      /** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+      samples: zod.z.number().int(),
+      /**
+      * `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+      * of every snapshot in it reported a thread split. A partial sum is a
+      * smaller number that looks exactly as real as a complete one.
+      */
+      cpuMainPercent: zod.z.number().nullable(),
+      cpuMainPercentMin: zod.z.number().nullable(),
+      cpuGcPercent: zod.z.number().nullable(),
+      cpuGcPercentMin: zod.z.number().nullable(),
+      /** Lifetime-average CPU%, summed. Always known — and never a rate. */
+      cpuLifetimePercent: zod.z.number(),
+      cpuLifetimePercentMin: zod.z.number(),
+      memoryRssBytes: zod.z.number(),
+      memoryRssBytesMin: zod.z.number(),
+      processCount: zod.z.number().int(),
+      processCountMin: zod.z.number().int()
+    });
+    var LoadFunctionSeriesSchema = zod.z.object({
+      key: zod.z.string(),
+      kind: zod.z.enum([
+        "addon",
+        "root",
+        "unattributed"
+      ]),
+      /** Oldest-first. A missing interval is MISSING — never zero-filled. */
+      points: zod.z.array(LoadPointSchema).readonly()
+    });
+    var NodeLoadSeriesSchema = zod.z.object({
+      nodeId: zod.z.string(),
+      /** One entry per function seen in the window, heaviest-first. */
+      series: zod.z.array(LoadFunctionSeriesSchema).readonly(),
+      /**
+      * Width of one returned bucket, in ms. Equals the sampling cadence when no
+      * reduction was needed — so a caller can always say what one point covers
+      * without having to know whether it was reduced.
+      */
+      bucketMs: zod.z.number(),
+      /** Raw snapshots that went into this answer, across both tiers. */
+      retainedSamples: zod.z.number(),
+      /** Oldest snapshot represented, or `null` when nothing is retained. */
+      oldestAtMs: zod.z.number().nullable(),
+      /** The fixed sampling cadence in force on the cluster, in ms. */
+      cadenceMs: zod.z.number(),
+      /**
+      * Did the DURABLE tier contribute? `false` means the answer is the hot ring
+      * alone — an agent (which holds no table), or a store that refused.
+      * Reported because "the last hour" and "the last six hours" are different
+      * questions and an operator must not have to guess which was answered.
+      */
+      durable: zod.z.boolean()
+    });
+    var GetLoadSeriesInputSchema = zod.z.object({
+      /**
+      * The node whose series is wanted.
+      *
+      * NOT named `nodeId`: the generated cap router strips a top-level
+      * `nodeId` from every method input and uses it to ROUTE the call to
+      * that node's provider (`generated-cap-routers.ts`). A series target
+      * called `nodeId` would silently become a routing pin and never reach
+      * the provider. The hub holds every node it hears from, so the
+      * ordinary call is unpinned — answered by the hub, for any node.
+      */
+      forNodeId: zod.z.string(),
+      /**
+      * EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+      * holds and receives only what it is missing, so seeding a live chart
+      * from this method cannot double a point already drawn.
+      */
+      sinceMs: zod.z.number().optional(),
+      /**
+      * Most points the caller wants PER FUNCTION. The window is reduced to fit,
+      * preserving min and max per bucket.
+      *
+      * Absent means NO reduction — legitimate for a short window and a trap for a
+      * long one, which is why a chart passes its own pixel width.
+      */
+      maxPoints: zod.z.number().int().positive().optional()
+    });
     var SystemMetricsSchema = zod.z.object({
       cpuPercent: zod.z.number(),
       memoryPercent: zod.z.number(),
@@ -32343,28 +32670,44 @@ var require_dist_BVU5JADq = __commonJS({
         getAddonStats: method(zod.z.object({ addonId: zod.z.string() }), PidResourceStatsSchema.nullable()),
         /**
         * Snapshot of every camstack-related process on this node with a
-        * ghost/managed/root classification. Powers the Cluster → Agent →
-        * Processes tab: cross-references `$process.list` against a `ps` scan
-        * so orphaned trees (PPID=1) or unknown children show up as `ghost`
-        * and can be killed from the UI.
+        * root/managed/system classification. Powers the Cluster → Agent →
+        * Processes tab: cross-references `$process.list` against a `ps` scan so
+        * per-addon CPU and RSS can be attributed, and so a process the cluster
+        * does not manage is still visible.
+        *
+        * **Read-only, by design.** This cap once carried a `killProcess`
+        * mutation; it was deleted on 2026-08-27. A runner's lifecycle belongs to
+        * `CrashSupervisor` and is driven through `addons.restartAddon` /
+        * `$process.restart` — signalling a raw pid went around the supervisor
+        * (D6), and the one class it was willing to signal turned out to be the
+        * container's own init and the operator's desktop app.
         */
         listNodeProcesses: method(zod.z.void(), zod.z.array(NodeProcessSchema).readonly()),
         /**
-        * Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
-        * process tree. The provider refuses pids that aren't in the live
-        * `listNodeProcesses()` snapshot — callers can't use this endpoint
-        * to kill arbitrary system processes.
+        * The retained per-node load series — the ONE reader over BOTH tiers.
+        *
+        * The in-memory ring is the HOT window (the last 180 snapshots, held by
+        * every node's `native-metrics`); the hub's `metrics:node-load-samples`
+        * table is the COLD one (the operator's retention, six hours by default).
+        * This method merges them and DEDUPES on `atMs`, so a snapshot present in
+        * both contributes once and the caller never learns which tier a point
+        * came from. There is deliberately no second read surface: two readers is
+        * how two charts start disagreeing about the same node.
+        *
+        * Reads only; nothing is sampled to answer it. Normally called UNPINNED —
+        * the hub hears every node's snapshot and holds every node's rows — and
+        * answers for any `forNodeId`. Pinned to an agent it answers from that
+        * agent's ring alone (`durable: false`). Empty is a legitimate answer: a
+        * node nobody has heard from has no series, and saying so is the truth.
         */
-        killProcess: method(KillProcessInputSchema, KillProcessResultSchema, {
-          kind: "mutation",
-          auth: "admin"
-        }),
+        getLoadSeries: method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema),
         /**
         * Tell the addon's forked runner to write a V8 heap snapshot to disk (via
         * SIGUSR2 — the runner's diagnostic handler). Also logs its
-        * `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
-        * live `listNodeProcesses()` snapshot. Use for deep per-addon memory
-        * attribution; copy the returned path off the node to analyze.
+        * `process.memoryUsage()` + heap-space breakdown. Resolves the pid from
+        * `$process.list`, so it can only reach a runner this node spawned. Use
+        * for deep per-addon memory attribution; copy the returned path off the
+        * node to analyze.
         */
         dumpHeapSnapshot: method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
           kind: "mutation",
@@ -47465,6 +47808,7 @@ var require_dist_BVU5JADq = __commonJS({
       */
       channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
     });
+    var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: zod.z.string() });
     var GetLoggingSettingsInputSchema = zod.z.object({
       scopeNodeId: zod.z.string().optional(),
       /**
@@ -47558,6 +47902,22 @@ var require_dist_BVU5JADq = __commonJS({
         */
         getRequestCensus: method(zod.z.void(), RequestCensusStatusSchema, { auth: "admin" }),
         /**
+        * Every `load-contribution` an addon on this cluster reports — each
+        * addon's OWN cost, already attributed by the addon that owns it.
+        *
+        * There is no central list of what costs what: an addon that spawns a
+        * per-camera child declares it, and one that cannot attribute its cost
+        * (the shared inference pool) declares THAT. So a new cost family appears
+        * here the moment its addon is redeployed, with nobody editing anything.
+        *
+        * What this does NOT do is measure the node. `metrics.node-processes-
+        * snapshot` still does that, and the difference between the two is the
+        * finding: a process no contribution claims is either a leak or a family
+        * nobody has taught to report. Both belong in the unattributed bucket, and
+        * neither may be folded into a camera.
+        */
+        getLoadContributions: method(zod.z.void(), zod.z.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
+        /**
         * The logging settings document — levels and armed diagnostics — resolved
         * for `nodeId`, or for the cluster when `nodeId` is absent.
         *
@@ -48976,6 +49336,7 @@ var require_dist_BVU5JADq = __commonJS({
       lawnMowerControlCapability,
       llmCapability,
       llmRuntimeCapability,
+      loadContributionCapability,
       localNetworkCapability,
       lockControlCapability,
       logChannelsCapability,
@@ -49999,6 +50360,12 @@ var require_dist_BVU5JADq = __commonJS({
         addonId: null,
         access: "create"
       },
+      "dataStoreProvider.insertMany": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "dataStoreProvider.isEmpty": {
         capName: "data-store-provider",
         capScope: "system",
@@ -51313,6 +51680,12 @@ var require_dist_BVU5JADq = __commonJS({
         addonId: null,
         access: "create"
       },
+      "loadContribution.list": {
+        capName: "load-contribution",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.downloadCa": {
         capName: "local-network",
         capScope: "system",
@@ -51613,17 +51986,17 @@ var require_dist_BVU5JADq = __commonJS({
         addonId: null,
         access: "view"
       },
-      "metricsProvider.getProcessStats": {
+      "metricsProvider.getLoadSeries": {
         capName: "metrics-provider",
         capScope: "system",
         addonId: null,
         access: "view"
       },
-      "metricsProvider.killProcess": {
+      "metricsProvider.getProcessStats": {
         capName: "metrics-provider",
         capScope: "system",
         addonId: null,
-        access: "create"
+        access: "view"
       },
       "metricsProvider.listAddonInstances": {
         capName: "metrics-provider",
@@ -53635,6 +54008,12 @@ var require_dist_BVU5JADq = __commonJS({
         addonId: null,
         access: "create"
       },
+      "settingsStore.insertMany": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "settingsStore.isEmpty": {
         capName: "settings-store",
         capScope: "system",
@@ -54247,6 +54626,12 @@ var require_dist_BVU5JADq = __commonJS({
         addonId: null,
         access: "create"
       },
+      "system.getLoadContributions": {
+        capName: "system",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "system.getLoggingSettings": {
         capName: "system",
         capScope: "system",
@@ -57734,6 +58119,12 @@ var require_dist_BVU5JADq = __commonJS({
         return filesystemBrowseCapability;
       }
     });
+    Object.defineProperty(exports, "foldSnapshotByFunction", {
+      enumerable: true,
+      get: function() {
+        return foldSnapshotByFunction;
+      }
+    });
     Object.defineProperty(exports, "hydrateSchema", {
       enumerable: true,
       get: function() {
@@ -57878,6 +58269,18 @@ var require_dist_BVU5JADq = __commonJS({
         return readinessKey;
       }
     });
+    Object.defineProperty(exports, "reducePoints", {
+      enumerable: true,
+      get: function() {
+        return reducePoints;
+      }
+    });
+    Object.defineProperty(exports, "resolveBucketMs", {
+      enumerable: true,
+      get: function() {
+        return resolveBucketMs;
+      }
+    });
     Object.defineProperty(exports, "resolveCapMount", {
       enumerable: true,
       get: function() {
@@ -57992,7 +58395,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -58811,7 +59214,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -58905,7 +59308,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -59802,11 +60205,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-_PLI9w0k.js
-var require_retired_settings_keys_PLI9w0k = __commonJS({
-  "../system/dist/retired-settings-keys-_PLI9w0k.js"(exports) {
+// ../system/dist/retired-settings-keys-6w_JOqBg.js
+var require_retired_settings_keys_6w_JOqBg = __commonJS({
+  "../system/dist/retired-settings-keys-6w_JOqBg.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -60638,6 +61041,7 @@ var require_node = __commonJS({
     var node_stream_promises = __require("stream/promises");
     var node_stream = __require("stream");
     var node_child_process = __require("child_process");
+    var node_fs_promises = __require("fs/promises");
     function findFileByName(dir, name) {
       try {
         for (const entry of (0, node_fs.readdirSync)(dir, { withFileTypes: true })) {
@@ -60998,6 +61402,110 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
         hash
       } });
     }
+    var CLOCK_TICKS_PER_SEC = 100;
+    var PAGE_BYTES = 4096;
+    var NO_COST_CLAIM = { release: () => void 0 };
+    var nodeProcStatReader = {
+      readStat: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/stat`, "utf8"),
+      readStatm: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/statm`, "utf8")
+    };
+    function parseProcCpuSeconds(line) {
+      const close = line.lastIndexOf(")");
+      if (close < 0) return null;
+      const rest = line.slice(close + 1).trim().split(/\s+/);
+      const utime = Number(rest[11]);
+      const stime = Number(rest[12]);
+      if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+      return (utime + stime) / CLOCK_TICKS_PER_SEC;
+    }
+    function parseProcRssBytes(line) {
+      const fields = line.trim().split(/\s+/);
+      const residentPages = Number(fields[1]);
+      if (!Number.isFinite(residentPages)) return null;
+      return residentPages * PAGE_BYTES;
+    }
+    async function readProcessCost(pid, reader = nodeProcStatReader) {
+      let cpuSeconds = null;
+      let rssBytes = null;
+      try {
+        cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
+      } catch {
+        cpuSeconds = null;
+      }
+      try {
+        rssBytes = parseProcRssBytes(await reader.readStatm(pid));
+      } catch {
+        rssBytes = null;
+      }
+      return {
+        ...cpuSeconds === null ? {} : { cpuSeconds },
+        ...rssBytes === null ? {} : { rssBytes }
+      };
+    }
+    var ChildCostRegistry = class {
+      reader;
+      now;
+      claims = /* @__PURE__ */ new Map();
+      constructor(reader = nodeProcStatReader, now = Date.now) {
+        this.reader = reader;
+        this.now = now;
+      }
+      /**
+      * Record one child. The returned handle is the only way to remove it.
+      *
+      * A claim with no pid is dropped rather than stored: it could carry no
+      * measurement, and an entry with a camera and no numbers reads on a chart as
+      * a camera that cost nothing.
+      */
+      claim(input) {
+        const pid = input.pid;
+        if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
+        const key = /* @__PURE__ */ Symbol("child-cost-claim");
+        this.claims.set(key, {
+          role: input.role,
+          deviceId: input.deviceId,
+          unit: input.unit,
+          attribution: input.attribution ?? "measured",
+          pid,
+          startedAtMs: this.now()
+        });
+        return { release: () => {
+          this.claims.delete(key);
+        } };
+      }
+      /** Live claims, in claim order. Diagnostics and tests; not a contribution. */
+      list() {
+        return [...this.claims.values()].map((c) => ({
+          role: c.role,
+          deviceId: c.deviceId,
+          unit: c.unit,
+          attribution: c.attribution,
+          pid: c.pid
+        }));
+      }
+      /**
+      * This addon's contribution: one entry per live claim, with whatever the OS
+      * will tell us about that child right now.
+      *
+      * A child that has exited between the claim and this read contributes an
+      * entry with no numbers rather than no entry — the unit exists, the addon
+      * believes it is running, and hiding it would make a dying writer look like
+      * a writer that was never started.
+      */
+      async contributions() {
+        const out = [];
+        for (const claim of this.claims.values()) out.push({
+          role: claim.role,
+          deviceId: claim.deviceId,
+          attribution: claim.attribution,
+          unit: claim.unit,
+          pid: claim.pid,
+          startedAtMs: claim.startedAtMs,
+          ...await readProcessCost(claim.pid, this.reader)
+        });
+        return out;
+      }
+    };
     var STORAGE_LOCATION_TYPES = [
       "data",
       "media",
@@ -61815,10 +62323,12 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
         }
       }
     };
+    exports.ChildCostRegistry = ChildCostRegistry;
     exports.FfmpegProcess = FfmpegProcess;
     exports.FilesystemStorageProvider = FilesystemStorageProvider;
     exports.Fmp4FragmentChild = Fmp4FragmentChild;
     exports.Fmp4FragmentPlane = Fmp4FragmentPlane;
+    exports.NO_COST_CLAIM = NO_COST_CLAIM;
     exports.PYTHON_VERSION = PYTHON_VERSION;
     exports.buildBinaryPath = buildBinaryPath;
     exports.canonicalDeviceFingerprint = canonicalDeviceFingerprint;
@@ -61834,6 +62344,10 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
     exports.getPythonDownloadUrl = getPythonDownloadUrl;
     exports.installPythonPackages = installPythonPackages;
     exports.installPythonRequirements = installPythonRequirements;
+    exports.nodeProcStatReader = nodeProcStatReader;
+    exports.parseProcCpuSeconds = parseProcCpuSeconds;
+    exports.parseProcRssBytes = parseProcRssBytes;
+    exports.readProcessCost = readProcessCost;
     exports.resolveExportFingerprint = resolveExportFingerprint;
     exports.signExpiringUrl = signExpiringUrl;
     exports.verifyExpiringUrl = verifyExpiringUrl;
@@ -61849,8 +62363,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
-    var require_retired_settings_keys = require_retired_settings_keys_PLI9w0k();
+    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_retired_settings_keys = require_retired_settings_keys_6w_JOqBg();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -66599,7 +67113,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -66736,7 +67250,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -66926,7 +67440,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -74610,7 +75124,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -75175,7 +75689,8 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
+    var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -75646,11 +76161,893 @@ var require_native_metrics_addon = __commonJS({
         });
       });
     }
-    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var LoadPartition = class {
+      capacity;
+      slots;
+      head = 0;
+      count = 0;
+      rows = 0;
+      /** Newest retained sample's timestamp — the monotonic gate for `push`. */
+      newestAtMs = null;
+      constructor(capacity) {
+        this.capacity = capacity;
+        this.slots = Array.from({ length: capacity });
+      }
+      /**
+      * Accept a sample.
+      *
+      * A sample at or before the newest one already held is REFUSED. The bus drops
+      * a node's own broadcast echo, but a cross-node redelivery or a replayed
+      * subscription must not be able to double a point — and idempotence here is
+      * what lets every reader above treat the series as a set.
+      *
+      * `accepted` is reported separately from `rowDelta` on purpose: a full ring
+      * that evicts a sample of the same size has a delta of zero and is not a
+      * refusal, and conflating the two would silently stop advancing the write
+      * ordinal on a steady-state cluster.
+      */
+      push(sample) {
+        if (this.newestAtMs !== null && sample.atMs <= this.newestAtMs) return {
+          accepted: false,
+          rowDelta: 0
+        };
+        const evicted = this.count === this.capacity ? this.slots[this.head]?.processes.length ?? 0 : 0;
+        this.slots[this.head] = sample;
+        this.head = (this.head + 1) % this.capacity;
+        if (this.count < this.capacity) this.count++;
+        this.newestAtMs = sample.atMs;
+        const rowDelta = sample.processes.length - evicted;
+        this.rows += rowDelta;
+        return {
+          accepted: true,
+          rowDelta
+        };
+      }
+      /** Drop the oldest sample. Returns the rows reclaimed (0 when empty). */
+      dropOldest() {
+        if (this.count === 0) return 0;
+        const index = (this.head - this.count + this.capacity) % this.capacity;
+        const victim = this.slots[index];
+        this.slots[index] = void 0;
+        this.count--;
+        const reclaimed = victim?.processes.length ?? 0;
+        this.rows -= reclaimed;
+        if (this.count === 0) this.newestAtMs = null;
+        return reclaimed;
+      }
+      /** Oldest-first, optionally only what is strictly newer than `sinceMs`. */
+      list(sinceMs) {
+        const out = [];
+        for (let i = 0; i < this.count; i++) {
+          const index = (this.head - this.count + i + this.capacity) % this.capacity;
+          const sample = this.slots[index];
+          if (sample === void 0) continue;
+          if (sinceMs !== void 0 && sample.atMs <= sinceMs) continue;
+          out.push(sample);
+        }
+        return out;
+      }
+      size() {
+        return this.count;
+      }
+      rowCount() {
+        return this.rows;
+      }
+      oldestAtMs() {
+        if (this.count === 0) return null;
+        const index = (this.head - this.count + this.capacity) % this.capacity;
+        return this.slots[index]?.atMs ?? null;
+      }
+      lastWriteAtMs() {
+        return this.newestAtMs;
+      }
+    };
+    var NodeLoadRing = class {
+      partitions = /* @__PURE__ */ new Map();
+      /**
+      * Node id → write ordinal of its last accepted sample. A monotonic counter,
+      * not a clock: partition eviction must follow the order writes actually
+      * happened, and node clocks disagree.
+      */
+      lastWriteSeq = /* @__PURE__ */ new Map();
+      writeSeq = 0;
+      totalRows = 0;
+      samplesPerNode;
+      maxTotalProcessRows;
+      maxNodes;
+      idleEvictionMs;
+      now;
+      constructor(options = {}) {
+        this.samplesPerNode = options.samplesPerNode ?? 180;
+        this.maxTotalProcessRows = options.maxTotalProcessRows ?? 32e3;
+        this.maxNodes = options.maxNodes ?? 16;
+        this.idleEvictionMs = options.idleEvictionMs ?? 36e5;
+        this.now = options.now ?? Date.now;
+      }
+      /**
+      * Retain one snapshot. `processes` is stored by reference — the payload is
+      * already an immutable arrival off the bus, and copying it would double the
+      * measured cost for nothing.
+      *
+      * Returns whether the sample was ACCEPTED — that is, whether it was new
+      * rather than a replay of a timestamp this node has already delivered.
+      *
+      * The return value is not diagnostics. It is the idempotence gate the
+      * DURABLE tier rides on (`load-series-store.ts`): only an accepted sample is
+      * appended to the table, which is what lets that table carry an `INTEGER`
+      * rowid key instead of a composite unique index over two million rows. The
+      * gate is one monotonic comparison in memory; the index it replaces was
+      * measured at ~40 bytes per row.
+      */
+      record(nodeId, atMs, processes) {
+        if (nodeId.length === 0) return false;
+        this.sweepIdle();
+        let partition = this.partitions.get(nodeId);
+        if (partition === void 0) {
+          partition = new LoadPartition(this.samplesPerNode);
+          this.partitions.set(nodeId, partition);
+        }
+        const outcome = partition.push({
+          atMs,
+          processes
+        });
+        if (!outcome.accepted) {
+          if (partition.size() === 0) this.partitions.delete(nodeId);
+          return false;
+        }
+        this.totalRows += outcome.rowDelta;
+        this.lastWriteSeq.set(nodeId, ++this.writeSeq);
+        if (this.partitions.size > this.maxNodes) this.evictPartitions(this.partitions.size - this.maxNodes, nodeId);
+        this.enforceRowBudget();
+        return true;
+      }
+      /**
+      * Read one node's retained series, oldest-first.
+      *
+      * `sinceMs` is EXCLUSIVE: a caller passes the newest timestamp it already
+      * holds and gets back only what it is missing. That is the whole contract
+      * that lets the admin UI seed from here and then continue live without
+      * doubling a point it already drew.
+      *
+      * A node nobody has recorded answers with an empty series, not an error —
+      * unknown is the truth about a node that has not reported.
+      */
+      read(nodeId, sinceMs) {
+        this.sweepIdle();
+        const partition = this.partitions.get(nodeId);
+        if (partition === void 0) return {
+          nodeId,
+          samples: [],
+          retainedSamples: 0,
+          oldestAtMs: null,
+          capacity: this.samplesPerNode
+        };
+        return {
+          nodeId,
+          samples: partition.list(sinceMs),
+          retainedSamples: partition.size(),
+          oldestAtMs: partition.oldestAtMs(),
+          capacity: this.samplesPerNode
+        };
+      }
+      /** Node ids with a live partition. Observability for the fleet bound. */
+      nodeIds() {
+        return [...this.partitions.keys()];
+      }
+      /** Process rows retained across every partition — the number that IS memory. */
+      rowCount() {
+        return this.totalRows;
+      }
+      /** Samples retained across every partition. */
+      sampleCount() {
+        let total = 0;
+        for (const partition of this.partitions.values()) total += partition.size();
+        return total;
+      }
+      /**
+      * Drop partitions whose newest sample is older than the retention window.
+      *
+      * Lazy, on write and on read — never a timer. A timer would be a new
+      * periodic cost in a subsystem whose entire premise is that it adds none,
+      * and a ring that nobody writes to and nobody reads is not growing either.
+      */
+      sweepIdle() {
+        const cutoff = this.now() - this.idleEvictionMs;
+        for (const [nodeId, partition] of [...this.partitions.entries()]) {
+          const lastWrite = partition.lastWriteAtMs();
+          if (lastWrite !== null && lastWrite > cutoff) continue;
+          this.dropPartition(nodeId);
+        }
+      }
+      /**
+      * Bring the fleet back under the row budget by dropping the OLDEST sample of
+      * the HEAVIEST partition, repeatedly.
+      *
+      * Terminates: every iteration removes one sample from a non-empty partition,
+      * and the population of samples is finite and strictly decreasing.
+      */
+      enforceRowBudget() {
+        while (this.totalRows > this.maxTotalProcessRows) {
+          const victim = this.heaviestPartition();
+          if (victim === null) return;
+          const [nodeId, partition] = victim;
+          this.totalRows -= partition.dropOldest();
+          if (partition.size() === 0) this.dropPartition(nodeId);
+        }
+      }
+      heaviestPartition() {
+        let best = null;
+        for (const entry of this.partitions.entries()) {
+          if (entry[1].size() === 0) continue;
+          if (best === null || entry[1].rowCount() > best[1].rowCount()) best = entry;
+        }
+        return best;
+      }
+      /** Drop `count` whole partitions, least-recently-written first. */
+      evictPartitions(count, protectedNodeId) {
+        const order = [...this.partitions.keys()].filter((nodeId) => nodeId !== protectedNodeId).toSorted((a, b) => (this.lastWriteSeq.get(a) ?? 0) - (this.lastWriteSeq.get(b) ?? 0));
+        let remaining = count;
+        for (const nodeId of order) {
+          if (remaining <= 0) return;
+          this.dropPartition(nodeId);
+          remaining -= 1;
+        }
+      }
+      /** Remove a partition and everything that indexes it. */
+      dropPartition(nodeId) {
+        const partition = this.partitions.get(nodeId);
+        if (partition === void 0) return;
+        this.totalRows -= partition.rowCount();
+        this.partitions.delete(nodeId);
+        this.lastWriteSeq.delete(nodeId);
+      }
+    };
+    var LOAD_SERIES_COLLECTION = "metrics:node-load-samples";
+    var DEFAULT_MAX_ROWS = 5e5;
+    var LOAD_SERIES_COLUMNS = [
+      /** `INTEGER PRIMARY KEY` = SQLite rowid alias: the key IS the row's address,
+      *  so it costs no separate index and no stored string. */
+      {
+        name: "id",
+        type: "INTEGER",
+        primaryKey: true,
+        notNull: true
+      },
+      {
+        name: "nodeId",
+        type: "TEXT",
+        notNull: true
+      },
+      /** The EMITTING node's timestamp for the sample this row belongs to. Every
+      *  row of one sample shares it — that is what makes a sample reassemblable. */
+      {
+        name: "atMs",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "pid",
+        type: "INTEGER",
+        notNull: true
+      },
+      /** `NULL` for a process no addon owns — `root` and `system` both. */
+      {
+        name: "addonId",
+        type: "TEXT"
+      },
+      {
+        name: "classification",
+        type: "TEXT",
+        notNull: true
+      },
+      /** `ps pcpu` x 10. A LIFETIME average, not a rate — see `NodeProcess`. */
+      {
+        name: "cpuDeci",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "rssMib",
+        type: "INTEGER",
+        notNull: true
+      },
+      /** Instantaneous main-thread CPU% x 10. `NULL` = UNKNOWN, never zero. */
+      {
+        name: "cpuMainDeci",
+        type: "INTEGER"
+      },
+      /** Instantaneous V8-helper-pool CPU% x 10. `NULL` = UNKNOWN, never zero. */
+      {
+        name: "cpuGcDeci",
+        type: "INTEGER"
+      }
+    ];
+    var LOAD_SERIES_INDEXES = [
+      /**
+      * The ONE index, and it serves both jobs.
+      *
+      * Reads are always "this node, newer than T" — `nodeId` leads so the
+      * equality is a range scan and `atMs` supplies the order without a sort.
+      * Prunes are always "this node, oldest first" — the same index, walked from
+      * the other end. A second index on `atMs` alone was measured and rejected:
+      * it cost 23 B/row (196.0 → 172.8 with the two column drops) to serve a
+      * cross-node prune that a per-node loop over three nodes already serves.
+      */
+      {
+        name: "idx_load_samples_node_at",
+        columns: ["nodeId", "atMs"]
+      }
+    ];
+    var BYTES_PER_MIB = 1048576;
+    function fromDeci(value) {
+      return value === null ? null : Math.round(value) / 10;
+    }
+    function toDeci(value) {
+      return value === null ? null : Math.round(value * 10);
+    }
+    function rowToProcess(row) {
+      return {
+        pid: row.pid,
+        addonId: row.addonId,
+        classification: row.classification,
+        cpuPercent: fromDeci(row.cpuDeci) ?? 0,
+        memoryRssBytes: row.rssMib * BYTES_PER_MIB,
+        cpuMainPercent: fromDeci(row.cpuMainDeci),
+        cpuGcPercent: fromDeci(row.cpuGcDeci)
+      };
+    }
+    function processToRow(nodeId, atMs, process2) {
+      return {
+        nodeId,
+        atMs,
+        pid: process2.pid,
+        addonId: process2.addonId,
+        classification: process2.classification,
+        cpuDeci: toDeci(process2.cpuPercent) ?? 0,
+        rssMib: Math.round(process2.memoryRssBytes / BYTES_PER_MIB),
+        cpuMainDeci: toDeci(process2.cpuMainPercent),
+        cpuGcDeci: toDeci(process2.cpuGcPercent)
+      };
+    }
+    function rowsToSamples(rows) {
+      const byAt = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        const held = byAt.get(row.atMs);
+        if (held === void 0) byAt.set(row.atMs, [rowToProcess(row)]);
+        else held.push(rowToProcess(row));
+      }
+      return [...byAt.entries()].toSorted((a, b) => a[0] - b[0]).map(([atMs, processes]) => ({
+        atMs,
+        processes
+      }));
+    }
+    var LoadSeriesStore = class {
+      declared = false;
+      lastPruneAtMs = 0;
+      store;
+      logger;
+      nowFn;
+      prunePageRows;
+      pruneIntervalMs;
+      constructor(deps) {
+        this.store = deps.store;
+        this.logger = deps.logger;
+        this.nowFn = deps.now ?? (() => Date.now());
+        this.prunePageRows = deps.prunePageRows ?? 2e4;
+        this.pruneIntervalMs = deps.pruneIntervalMs ?? 6e4;
+      }
+      /** Idempotently declare the collection. `false` when the store refused. */
+      async declare() {
+        if (this.declared) return true;
+        try {
+          await this.store.declareCollection.mutate({
+            collection: LOAD_SERIES_COLLECTION,
+            columns: [...LOAD_SERIES_COLUMNS],
+            indexes: LOAD_SERIES_INDEXES.map((i) => ({
+              name: i.name,
+              columns: [...i.columns]
+            }))
+          });
+          this.declared = true;
+          return true;
+        } catch (err) {
+          this.logger.warn("load series declareCollection failed \u2014 nothing will be retained on disk", { meta: {
+            collection: LOAD_SERIES_COLLECTION,
+            error: require_dist10.errMsg(err)
+          } });
+          return false;
+        }
+      }
+      /**
+      * Append ONE sample — every process row of it — in ONE transaction.
+      *
+      * Never a write per row. `insertMany` exists for exactly this: at the 10 s
+      * default the fleet produces 7.6 rows/s, and 7.6 separate commits per second
+      * on the connection that also serves every cluster-wide configuration read
+      * is a constant load nobody asked for.
+      */
+      async append(nodeId, atMs, processes) {
+        if (processes.length === 0) return 0;
+        if (!await this.declare()) return 0;
+        const records = processes.map((p) => ({ data: { ...processToRow(nodeId, atMs, p) } }));
+        try {
+          const { inserted } = await this.store.insertMany.mutate({
+            collection: LOAD_SERIES_COLLECTION,
+            records
+          });
+          return inserted;
+        } catch (err) {
+          this.logger.warn("load series sample not retained \u2014 this interval will be missing", { meta: {
+            nodeId,
+            atMs,
+            rows: processes.length,
+            error: require_dist10.errMsg(err)
+          } });
+          return 0;
+        }
+      }
+      /**
+      * Read one node's cold samples, oldest-first.
+      *
+      * `sinceMs` is EXCLUSIVE, matching the ring, so a caller passing the newest
+      * timestamp it holds gets only what it is missing. `limitRows` bounds the
+      * read in ROWS (not samples) because rows are what the query costs.
+      */
+      async read(nodeId, sinceMs, limitRows) {
+        if (!await this.declare()) return [];
+        try {
+          const records = await this.store.query.query({
+            collection: LOAD_SERIES_COLLECTION,
+            filter: {
+              where: { nodeId },
+              whereBetween: { atMs: [sinceMs + 1, Number.MAX_SAFE_INTEGER] },
+              orderBy: {
+                field: "atMs",
+                direction: "asc"
+              },
+              limit: limitRows
+            }
+          });
+          const rows = [];
+          for (const record of records) {
+            const row = recordToRow(record.data);
+            if (row !== null) rows.push(row);
+          }
+          return rowsToSamples(rows);
+        } catch (err) {
+          this.logger.warn("load series cold read failed \u2014 answering from the hot window only", { meta: {
+            nodeId,
+            sinceMs,
+            error: require_dist10.errMsg(err)
+          } });
+          return [];
+        }
+      }
+      /**
+      * Enforce BOTH bounds, oldest-first, through a bounded page each.
+      *
+      * Rate-limited to {@link pruneIntervalMs}: a bound is not a deadline, and the
+      * append path must not pay a sweep on every sample.
+      */
+      async prune(nodeIds, retention, force = false) {
+        const now = this.nowFn();
+        if (!force && now - this.lastPruneAtMs < this.pruneIntervalMs) return null;
+        this.lastPruneAtMs = now;
+        if (!await this.declare()) return null;
+        let deletedByAge = 0;
+        let deletedByCap = 0;
+        let rowsExamined = 0;
+        const ageCutoff = now - retention.retentionHours * 36e5;
+        for (const nodeId of nodeIds) {
+          const outcome = await this.pruneNodeToCutoff(nodeId, ageCutoff);
+          deletedByAge += outcome.deleted;
+          rowsExamined += outcome.examined;
+        }
+        const total = await this.count();
+        const excess = total === null ? 0 : total - retention.maxRows;
+        if (excess > 0) {
+          const outcome = await this.pruneOldestRows(nodeIds, excess);
+          deletedByCap = outcome.deleted;
+          rowsExamined += outcome.examined;
+          this.logger.warn("load series ROW CAP bit \u2014 evicting the oldest samples", { meta: {
+            collection: LOAD_SERIES_COLLECTION,
+            rows: total,
+            cap: retention.maxRows,
+            over: excess,
+            deleted: outcome.deleted,
+            retentionHours: retention.retentionHours,
+            hint: "lower the retention or the sampling cadence \u2014 the cap is the guarantee, not the intention"
+          } });
+        }
+        return {
+          deletedByAge,
+          deletedByCap,
+          rowsExamined,
+          capBit: excess > 0
+        };
+      }
+      /** Total rows, or `null` when the store could not answer. */
+      async count() {
+        if (!await this.declare()) return null;
+        try {
+          return await this.store.count.query({ collection: LOAD_SERIES_COLLECTION });
+        } catch (err) {
+          this.logger.warn("load series count failed \u2014 the row cap is not enforced this pass", { meta: { error: require_dist10.errMsg(err) } });
+          return null;
+        }
+      }
+      /**
+      * Delete this node's rows older than `cutoff`, at most one page's worth.
+      *
+      * The page is the whole point. `deleteWhere({ atMs: [0, cutoff] })` on its
+      * own is one statement but an UNBOUNDED one — a first pass after a retention
+      * change would delete millions of rows inside a single stalling transaction.
+      * So the page is read first (keys only, ordered by the index), its last
+      * `atMs` becomes the EFFECTIVE cutoff, and the delete is bounded by it.
+      */
+      async pruneNodeToCutoff(nodeId, cutoff) {
+        try {
+          const page = await this.store.query.query({
+            collection: LOAD_SERIES_COLLECTION,
+            filter: {
+              where: { nodeId },
+              whereBetween: { atMs: [0, cutoff] },
+              orderBy: {
+                field: "atMs",
+                direction: "asc"
+              },
+              limit: this.prunePageRows
+            },
+            columns: ["atMs"]
+          });
+          if (page.length === 0) return {
+            deleted: 0,
+            examined: 0
+          };
+          const effectiveCutoff = Number(page.at(-1)?.data["atMs"]);
+          if (!Number.isFinite(effectiveCutoff)) return {
+            deleted: 0,
+            examined: page.length
+          };
+          const { deleted } = await this.store.deleteWhere.mutate({
+            collection: LOAD_SERIES_COLLECTION,
+            filter: {
+              where: { nodeId },
+              whereBetween: { atMs: [0, effectiveCutoff] }
+            }
+          });
+          return {
+            deleted,
+            examined: page.length
+          };
+        } catch (err) {
+          this.logger.warn("load series age prune failed \u2014 the table keeps growing this pass", { meta: {
+            nodeId,
+            cutoff,
+            error: require_dist10.errMsg(err)
+          } });
+          return {
+            deleted: 0,
+            examined: 0
+          };
+        }
+      }
+      /**
+      * Drop the oldest rows across the known nodes until `excess` is covered.
+      *
+      * Same bounded-page technique, walked per node so the one index serves it.
+      * The node holding the oldest rows pays first, which is also the node
+      * producing the pressure when a runaway process count is the cause.
+      */
+      async pruneOldestRows(nodeIds, excess) {
+        let remaining = Math.min(excess, this.prunePageRows);
+        let deleted = 0;
+        let examined = 0;
+        for (const nodeId of nodeIds) {
+          if (remaining <= 0) break;
+          try {
+            const page = await this.store.query.query({
+              collection: LOAD_SERIES_COLLECTION,
+              filter: {
+                where: { nodeId },
+                orderBy: {
+                  field: "atMs",
+                  direction: "asc"
+                },
+                limit: remaining
+              },
+              columns: ["atMs"]
+            });
+            examined += page.length;
+            if (page.length === 0) continue;
+            const cutoff = Number(page.at(-1)?.data["atMs"]);
+            if (!Number.isFinite(cutoff)) continue;
+            const result = await this.store.deleteWhere.mutate({
+              collection: LOAD_SERIES_COLLECTION,
+              filter: {
+                where: { nodeId },
+                whereBetween: { atMs: [0, cutoff] }
+              }
+            });
+            deleted += result.deleted;
+            remaining -= result.deleted;
+          } catch (err) {
+            this.logger.warn("load series cap prune failed \u2014 the cap is not enforced this pass", { meta: {
+              nodeId,
+              error: require_dist10.errMsg(err)
+            } });
+          }
+        }
+        return {
+          deleted,
+          examined
+        };
+      }
+    };
+    function recordToRow(data) {
+      const nodeId = data["nodeId"];
+      const classification = data["classification"];
+      if (typeof nodeId !== "string" || typeof classification !== "string") return null;
+      const atMs = Number(data["atMs"]);
+      const pid = Number(data["pid"]);
+      const cpuDeci = Number(data["cpuDeci"]);
+      const rssMib = Number(data["rssMib"]);
+      if (![
+        atMs,
+        pid,
+        cpuDeci,
+        rssMib
+      ].every((n) => Number.isFinite(n))) return null;
+      const rawAddon = data["addonId"];
+      const optional = (raw) => {
+        if (raw === null || raw === void 0) return null;
+        const n = Number(raw);
+        return Number.isFinite(n) ? n : null;
+      };
+      return {
+        nodeId,
+        atMs,
+        pid,
+        addonId: typeof rawAddon === "string" ? rawAddon : null,
+        classification,
+        cpuDeci,
+        rssMib,
+        cpuMainDeci: optional(data["cpuMainDeci"]),
+        cpuGcDeci: optional(data["cpuGcDeci"])
+      };
+    }
+    var LoadSeriesConfigError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "LoadSeriesConfigError";
+      }
+    };
+    function requireInteger(value, field) {
+      const n = typeof value === "number" ? value : Number(value);
+      if (!Number.isFinite(n)) throw new LoadSeriesConfigError(`${field} must be a number, received ${String(value)}`);
+      return Math.round(n);
+    }
+    function resolveLoadSeriesConfig(raw) {
+      let cadenceSec = 10;
+      if (raw.loadSeriesCadenceSec !== void 0 && raw.loadSeriesCadenceSec !== null) {
+        cadenceSec = requireInteger(raw.loadSeriesCadenceSec, "loadSeriesCadenceSec");
+        if (cadenceSec < 5 || cadenceSec > 60) throw new LoadSeriesConfigError(`load series cadence must be between 5 and 60 seconds \u2014 refused ${cadenceSec}`);
+      }
+      let retentionHours = 6;
+      if (raw.loadSeriesRetentionHours !== void 0 && raw.loadSeriesRetentionHours !== null) {
+        retentionHours = requireInteger(raw.loadSeriesRetentionHours, "loadSeriesRetentionHours");
+        if (retentionHours < 1 || retentionHours > 72) throw new LoadSeriesConfigError(`load series retention must be between 1 and 72 hours \u2014 refused ${retentionHours}`);
+      }
+      return {
+        cadenceSec,
+        retentionHours,
+        maxRows: DEFAULT_MAX_ROWS
+      };
+    }
+    function projectLoadSeriesCost(input) {
+      const samplesPerNodeWindow = input.config.retentionHours * 3600 / input.config.cadenceSec;
+      const intendedRows = Math.round(samplesPerNodeWindow * Math.max(input.observedProcessRows, 0));
+      const boundedRows = Math.min(intendedRows, input.config.maxRows);
+      return {
+        intendedRows,
+        boundedRows,
+        estimatedBytes: boundedRows * 87,
+        capBites: intendedRows > input.config.maxRows
+      };
+    }
+    function describeLoadSeriesCost(projection) {
+      const mib = (projection.estimatedBytes / 1048576).toFixed(1);
+      const rows = projection.intendedRows.toLocaleString("en-US");
+      const capped = projection.boundedRows.toLocaleString("en-US");
+      if (!projection.capBites) return `This configuration retains ~${rows} rows \u2248 ${mib} MiB on the hub database (NVMe cache), measured at 87 bytes per row.`;
+      return `This configuration WANTS ~${rows} rows, above the ${projection.boundedRows.toLocaleString("en-US")}-row hard cap. The table will hold ~${capped} rows \u2248 ${mib} MiB and the OLDEST samples will be evicted, so the effective window is shorter than the retention you asked for.`;
+    }
+    function mergeSamples(cold, hot) {
+      const byAt = /* @__PURE__ */ new Map();
+      for (const sample of cold) byAt.set(sample.atMs, sample);
+      for (const sample of hot) byAt.set(sample.atMs, sample);
+      return [...byAt.values()].toSorted((a, b) => a.atMs - b.atMs);
+    }
+    function toFoldRows(processes) {
+      return processes;
+    }
+    function mergeLoadSeries(input) {
+      const samples = mergeSamples(input.cold, input.hot);
+      if (samples.length === 0) return {
+        series: [],
+        bucketMs: input.cadenceMs,
+        retainedSamples: 0,
+        oldestAtMs: null
+      };
+      const byKey = /* @__PURE__ */ new Map();
+      for (const sample of samples) for (const bucket of require_dist10.foldSnapshotByFunction(toFoldRows(sample.processes), sample.atMs)) {
+        const held = byKey.get(bucket.key);
+        if (held === void 0) byKey.set(bucket.key, {
+          kind: bucket.kind,
+          points: [bucket.point]
+        });
+        else held.points.push(bucket.point);
+      }
+      const oldestAtMs = samples[0]?.atMs ?? null;
+      const newestAtMs = samples.at(-1)?.atMs ?? oldestAtMs;
+      const spanMs = oldestAtMs === null || newestAtMs === null ? 0 : newestAtMs - oldestAtMs + input.cadenceMs;
+      const bucketMs = input.maxPoints === void 0 ? input.cadenceMs : require_dist10.resolveBucketMs(spanMs, input.cadenceMs, input.maxPoints);
+      const origin = oldestAtMs ?? 0;
+      const series = [...byKey.entries()].map(([key, held]) => ({
+        key,
+        kind: held.kind,
+        points: bucketMs > input.cadenceMs ? require_dist10.reducePoints(held.points, bucketMs, origin) : held.points
+      }));
+      const weight = (s) => {
+        const last = s.points.at(-1);
+        if (last === void 0) return -1;
+        if (last.cpuMainPercent !== null && last.cpuGcPercent !== null) return last.cpuMainPercent + last.cpuGcPercent;
+        return last.cpuLifetimePercent;
+      };
+      return {
+        series: series.toSorted((a, b) => {
+          const d = weight(b) - weight(a);
+          return d !== 0 ? d : a.key.localeCompare(b.key);
+        }),
+        bucketMs,
+        retainedSamples: samples.length,
+        oldestAtMs
+      };
+    }
     var CAMSTACK_CMD_RE = /(camstack|tsx\s+watch\s.*launcher\.ts|packages\/agent\/dist\/cli\.js|inference_pool\.py|bench-(inference-pool|nodeav)|node .*\/packages\/)/;
-    var SUPERVISOR_BOUNDARY_RE = /(tsx\s+watch\s.*launcher\.ts|packages\/agent\/dist\/cli\.js|\.bin\/concurrently|\/concurrently\/dist|\bnpm-cli\.js\b|npm exec |\.bin\/vite|\/vite\/bin\/vite\.js|node_modules\/\.bin\/(vite|concurrently|tsup|rollup|esbuild|tsx)(\s|$))/;
+    function classifyProcess(pid, selfPid, managed) {
+      if (pid === selfPid) return "root";
+      if (managed.has(pid)) return "managed";
+      return "system";
+    }
+    function buildNodeProcesses(input) {
+      const out = [];
+      for (const p of input.psRows) {
+        if (!CAMSTACK_CMD_RE.test(p.command)) continue;
+        const managed = input.managed.get(p.pid);
+        const split = input.cpuSplits.get(p.pid);
+        const classification = classifyProcess(p.pid, input.selfPid, input.managed);
+        out.push({
+          pid: p.pid,
+          ppid: p.ppid,
+          pgid: p.pgid,
+          classification,
+          addonId: managed?.addonId ?? null,
+          nodeId: managed?.nodeId ?? (p.pid === input.selfPid ? input.selfNodeId : null),
+          command: p.command,
+          cpuPercent: p.cpuPercent,
+          memoryRssBytes: p.memoryRssBytes,
+          cpuMainPercent: split?.mainPercent ?? null,
+          cpuGcPercent: split?.gcPercent ?? null,
+          threadCount: split?.threadCount ?? null,
+          uptimeSec: p.uptimeSec
+        });
+      }
+      return out;
+    }
+    var CLOCK_TICKS_PER_SEC = 100;
+    var V8_HELPER_THREAD_RE = /^V8Worker/;
+    function parseThreadStat(line) {
+      const close = line.lastIndexOf(")");
+      const open = line.indexOf("(");
+      if (close < 0 || open < 0 || close < open) return null;
+      const comm = line.slice(open + 1, close);
+      const rest = line.slice(close + 1).trim().split(/\s+/);
+      const utime = Number(rest[11]);
+      const stime = Number(rest[12]);
+      const startTicks = Number(rest[19]);
+      if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+      if (!Number.isFinite(startTicks)) return null;
+      return {
+        comm,
+        ticks: utime + stime,
+        startTicks
+      };
+    }
+    var nodeProcFsReader = {
+      listTaskIds: (pid) => (0, node_fs_promises.readdir)(`/proc/${pid}/task`),
+      readTaskStat: (pid, tid) => (0, node_fs_promises.readFile)(`/proc/${pid}/task/${tid}/stat`, "utf8")
+    };
+    async function readThreadTicks(pid, reader = nodeProcFsReader) {
+      let tids;
+      try {
+        tids = await reader.listTaskIds(pid);
+      } catch {
+        return null;
+      }
+      let mainTicks = 0;
+      let gcTicks = 0;
+      let threadCount = 0;
+      let startTicks = null;
+      const mainThreadTid = String(pid);
+      for (const tid of tids) {
+        let line;
+        try {
+          line = await reader.readTaskStat(pid, tid);
+        } catch {
+          continue;
+        }
+        const parsed = parseThreadStat(line);
+        if (parsed === null) continue;
+        threadCount += 1;
+        if (tid === mainThreadTid) startTicks = parsed.startTicks;
+        if (V8_HELPER_THREAD_RE.test(parsed.comm)) gcTicks += parsed.ticks;
+        else mainTicks += parsed.ticks;
+      }
+      if (threadCount === 0) return null;
+      return {
+        mainTicks,
+        gcTicks,
+        threadCount,
+        atMs: Date.now(),
+        startTicks
+      };
+    }
+    function cpuSplitBetween(prev, next) {
+      const windowMs = next.atMs - prev.atMs;
+      if (windowMs <= 0) return null;
+      if (prev.startTicks === null || next.startTicks === null) return null;
+      if (prev.startTicks !== next.startTicks) return null;
+      const mainDelta = next.mainTicks - prev.mainTicks;
+      const gcDelta = next.gcTicks - prev.gcTicks;
+      if (mainDelta < 0 || gcDelta < 0) return null;
+      const windowTicks = windowMs / 1e3 * CLOCK_TICKS_PER_SEC;
+      const pct = (delta) => Math.round(delta / windowTicks * 1e3) / 10;
+      return {
+        mainPercent: pct(mainDelta),
+        gcPercent: pct(gcDelta),
+        threadCount: next.threadCount
+      };
+    }
+    var ThreadCpuTracker = class {
+      reader;
+      previous = /* @__PURE__ */ new Map();
+      constructor(reader = nodeProcFsReader) {
+        this.reader = reader;
+      }
+      /**
+      * Sample `pids` and return the split for each one that HAS a usable previous
+      * sample. A pid absent from the result has no answer yet — the caller must
+      * report `null`, not `0`.
+      */
+      async sample(pids) {
+        const out = /* @__PURE__ */ new Map();
+        const nextPrevious = /* @__PURE__ */ new Map();
+        for (const pid of pids) {
+          const next = await readThreadTicks(pid, this.reader);
+          if (next === null) continue;
+          nextPrevious.set(pid, next);
+          const prev = this.previous.get(pid);
+          if (prev === void 0) continue;
+          const split = cpuSplitBetween(prev, next);
+          if (split !== null) out.set(pid, split);
+        }
+        this.previous = nextPrevious;
+        return out;
+      }
+    };
+    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
     var METRICS_SNAPSHOT_INTERVAL_MS = 5e3;
-    var PROCESS_SNAPSHOT_INTERVAL_MS = 2e4;
     var METRICS_SNAPSHOT_HEARTBEAT_MS = 6e4;
     function coarsenResourcesSnapshot(snapshot) {
       if (!snapshot || typeof snapshot !== "object") return JSON.stringify(snapshot);
@@ -75669,18 +77066,6 @@ var require_native_metrics_addon = __commonJS({
       };
       return JSON.stringify(round(snapshot));
     }
-    function coarsenProcessList(processes) {
-      const summary = processes.filter((p) => !!p && typeof p === "object").map((p) => {
-        return [
-          p["pid"],
-          p["addonId"],
-          p["state"],
-          typeof p["cpuPercent"] === "number" ? Math.round(p["cpuPercent"] / 5) * 5 : null,
-          typeof p["memoryRss"] === "number" ? Math.round(p["memoryRss"] / (50 * 1024 * 1024)) : null
-        ];
-      });
-      return JSON.stringify(summary);
-    }
     function narrowWorkerState(state) {
       switch (state) {
         case "starting":
@@ -75693,7 +77078,7 @@ var require_native_metrics_addon = __commonJS({
           return "running";
       }
     }
-    var NativeMetricsAddon = class extends require_dist10.BaseAddon {
+    var NativeMetricsAddon = class NativeMetricsAddon2 extends require_dist10.BaseAddon {
       provider = null;
       startedAtMs = Date.now();
       snapshotTimer = null;
@@ -75705,9 +77090,77 @@ var require_native_metrics_addon = __commonJS({
       * elapsed) is skipped.
       */
       lastResourcesEmit = null;
-      lastProcessesEmit = null;
+      /**
+      * Holds the previous `/proc/<pid>/task/*` tick counts so each process scan
+      * can turn them into an instantaneous CPU rate split between the process's
+      * own threads and V8's helper pool. Self-bounding — see `ThreadCpuTracker`.
+      */
+      threadCpu = new ThreadCpuTracker();
+      /**
+      * Retention for the snapshots this addon emits. Fed by SUBSCRIBING to
+      * `metrics.node-processes-snapshot`, never by a second sampler — on the hub
+      * that bus carries every node, so the hub's ring is the cluster's. Bounds and
+      * measured cost live in `node-load-ring.ts`.
+      */
+      loadRing = new NodeLoadRing();
+      /**
+      * The COLD tier, and it exists only on the HUB.
+      *
+      * The table is hub-resident and the hub already hears every node's snapshot
+      * on its bus, so the hub's writer is the cluster's. An agent writing through
+      * the `settings-store` singleton would ship its rows over Moleculer, once
+      * per sample, to reach that very same table.
+      */
+      loadStore = null;
+      /** The resolved knobs. Re-resolved on every settings write. */
+      loadConfig = {
+        cadenceSec: 10,
+        retentionHours: 6,
+        maxRows: DEFAULT_MAX_ROWS
+      };
+      /**
+      * Process rows seen in each node's most recent snapshot — the OBSERVED
+      * numbers the settings form projects its cost from. A constant here would be
+      * a projection that stops being true the first time the fleet changes.
+      */
+      observedRowsByNode = /* @__PURE__ */ new Map();
       constructor() {
-        super({ samplingIntervalMs: 5e3 });
+        super({
+          samplingIntervalMs: 5e3,
+          loadSeriesCadenceSec: 10,
+          loadSeriesRetentionHours: 6
+        });
+      }
+      /** Is this the hub? The same test every other addon uses (`addon-ai`). */
+      get isHub() {
+        return (this.ctx.kernel.cluster?.broker?.nodeID ?? "hub") === "hub";
+      }
+      /** Process rows observed across the whole fleet, for the cost projection. */
+      observedFleetRows() {
+        let total = 0;
+        for (const rows of this.observedRowsByNode.values()) total += rows;
+        return total;
+      }
+      /**
+      * Project a `NodeProcess` onto the series' own row.
+      *
+      * `command`, `ppid`, `pgid`, `nodeId`, `threadCount` and `uptimeSec` are
+      * dropped here, at the single point both tiers pass through, so the hot ring
+      * and the cold table carry the SAME shape and the merged read cannot tell
+      * them apart. `command` in particular is the fattest field in a snapshot and
+      * the same identical string on every runner — the runner id travels in the
+      * environment, not in argv — and nothing that draws this series reads it.
+      */
+      static toRetained(process2) {
+        return {
+          pid: process2.pid,
+          addonId: process2.addonId,
+          classification: process2.classification,
+          cpuPercent: process2.cpuPercent,
+          memoryRssBytes: process2.memoryRssBytes,
+          cpuMainPercent: process2.cpuMainPercent,
+          cpuGcPercent: process2.cpuGcPercent
+        };
       }
       async onInitialize() {
         const provider = new NativeMetricsProvider();
@@ -75727,16 +77180,127 @@ var require_native_metrics_addon = __commonJS({
           listAddonInstances: () => this.listAddonInstances(),
           getAddonStats: (params) => this.getAddonStats(params.addonId),
           listNodeProcesses: () => this.listNodeProcesses(),
-          killProcess: (params) => this.killProcess(params),
+          getLoadSeries: (params) => this.readLoadSeries(params),
           dumpHeapSnapshot: (params) => this.dumpHeapSnapshot(params)
         };
+        this.applyLoadSeriesConfig();
+        if (this.isHub) this.loadStore = new LoadSeriesStore({
+          store: this.ctx.api.settingsStore,
+          logger: this.ctx.logger.child("LoadSeries")
+        });
         this.snapshotTimer = setInterval(() => this.emitResourcesSnapshot(), METRICS_SNAPSHOT_INTERVAL_MS);
-        this.processSnapshotTimer = setInterval(() => this.emitProcessesSnapshot(), PROCESS_SNAPSHOT_INTERVAL_MS);
+        this.startProcessSnapshotTimer();
+        this.ctx.addDisposer(this.ctx.eventBus.subscribe({ category: require_dist10.EventCategory.MetricsNodeProcessesSnapshot }, (event) => this.retainSnapshot(event.data.nodeId, event.data.timestamp, event.data.processes)));
         return [{
           capability: require_dist10.metricsProviderCapability,
           provider: composed
         }];
       }
+      /**
+      * Retain one arriving snapshot in BOTH tiers.
+      *
+      * The ring is written FIRST and it is the gate: `record` refuses a timestamp
+      * this node has already delivered, and only an accepted sample reaches the
+      * table. That is what makes the append idempotent without a unique index
+      * over two million rows — the composite key it replaces was measured at ~40
+      * bytes per row (`load-series-store.ts`).
+      *
+      * The durable append is fire-and-forget: a storage stall must cost a gap in
+      * the cold window, never a blocked event-bus handler. Every failure logs.
+      */
+      retainSnapshot(nodeId, atMs, processes) {
+        const retained = processes.map((p) => NativeMetricsAddon2.toRetained(p));
+        if (!this.loadRing.record(nodeId, atMs, retained)) return;
+        this.observedRowsByNode.set(nodeId, retained.length);
+        const store = this.loadStore;
+        if (store === null) return;
+        store.append(nodeId, atMs, retained).then(() => store.prune([...this.observedRowsByNode.keys()], this.loadConfig)).catch((err) => {
+          this.ctx.logger.warn("durable load series write failed", { meta: {
+            nodeId,
+            atMs,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+        });
+      }
+      /**
+      * The ONE reader, over both tiers.
+      *
+      * Cold first, hot second, merged and deduped on `atMs` — see
+      * `load-series-reader.ts`. The cold read is bounded in ROWS, because rows
+      * are what a query costs, and the fold + reduction happen HERE rather than
+      * in the browser: six hours at the 10 s cadence is 2 160 snapshots, and
+      * shipping them to a page that will discard most of them is precisely the
+      * cost this subsystem exists to avoid.
+      */
+      async readLoadSeries(params) {
+        const cadenceMs = this.loadConfig.cadenceSec * 1e3;
+        const sinceMs = params.sinceMs ?? 0;
+        const hotSamples = this.loadRing.read(params.forNodeId, params.sinceMs).samples.map((sample) => ({
+          atMs: sample.atMs,
+          processes: sample.processes
+        }));
+        const store = this.loadStore;
+        const merged = mergeLoadSeries({
+          cold: store === null ? [] : await store.read(params.forNodeId, sinceMs, this.loadConfig.maxRows),
+          hot: hotSamples,
+          cadenceMs,
+          ...params.maxPoints !== void 0 ? { maxPoints: params.maxPoints } : {}
+        });
+        return {
+          nodeId: params.forNodeId,
+          series: merged.series,
+          bucketMs: merged.bucketMs,
+          retainedSamples: merged.retainedSamples,
+          oldestAtMs: merged.oldestAtMs,
+          cadenceMs,
+          durable: store !== null
+        };
+      }
+      /**
+      * Re-resolve the knobs and restate the fixed cadence.
+      *
+      * A REFUSED value (out of 5-60 s, or out of 1-72 h) leaves the previous
+      * configuration in force and says so. Refused, never clamped: storing 10
+      * when the operator typed 2 and reading 10 back is a knob and a readback
+      * agreeing on a value nobody chose.
+      */
+      applyLoadSeriesConfig() {
+        try {
+          const next = resolveLoadSeriesConfig({
+            loadSeriesCadenceSec: this.config.loadSeriesCadenceSec,
+            loadSeriesRetentionHours: this.config.loadSeriesRetentionHours
+          });
+          const changed = next.cadenceSec !== this.loadConfig.cadenceSec || next.retentionHours !== this.loadConfig.retentionHours;
+          this.loadConfig = next;
+          if (changed) {
+            const projection = projectLoadSeriesCost({
+              config: next,
+              observedProcessRows: this.observedFleetRows()
+            });
+            this.ctx.logger.info("load series configuration applied", { meta: {
+              nodeId: this.ctx.kernel.localNodeId ?? this.ctx.id,
+              cadenceSec: next.cadenceSec,
+              retentionHours: next.retentionHours,
+              maxRows: next.maxRows,
+              projectedRows: projection.intendedRows,
+              projectedMib: Math.round(projection.estimatedBytes / 1048576 * 10) / 10,
+              capBites: projection.capBites
+            } });
+          }
+        } catch (err) {
+          this.ctx.logger.warn("load series configuration REFUSED \u2014 keeping the previous values", { meta: {
+            nodeId: this.ctx.kernel.localNodeId ?? this.ctx.id,
+            cadenceSec: this.loadConfig.cadenceSec,
+            retentionHours: this.loadConfig.retentionHours,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+        }
+      }
+      /** (Re)arm the fixed-cadence process-tree timer at the configured interval. */
+      startProcessSnapshotTimer() {
+        if (this.processSnapshotTimer) clearInterval(this.processSnapshotTimer);
+        this.processSnapshotTimer = setInterval(() => this.emitProcessesSnapshot(), this.loadConfig.cadenceSec * 1e3);
+      }
       async onShutdown() {
         if (this.snapshotTimer) {
           clearInterval(this.snapshotTimer);
@@ -75793,10 +77357,14 @@ var require_native_metrics_addon = __commonJS({
         }
       }
       /**
-      * Emit one `metrics.node-processes-snapshot` for this node. Heavy —
-      * runs a full OS `ps -eo` scan (`runPs`) plus a `$process.list` broker
-      * call. Fires on the coarser PROCESS_SNAPSHOT_INTERVAL_MS so an idle
-      * node isn't paying a process-table walk every 5s. Skip on failure.
+      * Emit one `metrics.node-processes-snapshot` for this node.
+      *
+      * Heavy — a full OS `ps -eo` scan plus a `$process.list` broker call — and
+      * UNCONDITIONAL. The change-detection that used to guard it is gone: with a
+      * fixed cadence a missing interval means exactly one thing, and that is the
+      * property an operator investigating a spike is actually looking for.
+      *
+      * A failed scan emits nothing, which is the same signal: nobody reported.
       */
       async emitProcessesSnapshot() {
         const eventBus = this.ctx.eventBus;
@@ -75805,30 +77373,27 @@ var require_native_metrics_addon = __commonJS({
         const timestamp = Date.now();
         try {
           const processes = await this.listNodeProcesses();
-          const coarse = coarsenProcessList(processes);
-          const prev = this.lastProcessesEmit;
-          const heartbeatDue = !prev || timestamp - prev.emittedAt >= METRICS_SNAPSHOT_HEARTBEAT_MS;
-          if (!prev || prev.coarse !== coarse || heartbeatDue) {
-            this.lastProcessesEmit = {
-              coarse,
-              emittedAt: timestamp
-            };
-            eventBus.emit(require_dist10.createEvent(require_dist10.EventCategory.MetricsNodeProcessesSnapshot, {
-              type: "node",
-              id: nodeId,
-              nodeId
-            }, {
-              nodeId,
-              processes,
-              timestamp
-            }));
-          }
-        } catch {
+          eventBus.emit(require_dist10.createEvent(require_dist10.EventCategory.MetricsNodeProcessesSnapshot, {
+            type: "node",
+            id: nodeId,
+            nodeId
+          }, {
+            nodeId,
+            processes,
+            timestamp
+          }));
+        } catch (err) {
+          this.ctx.logger.warn("process snapshot skipped \u2014 this interval will be missing", { meta: {
+            nodeId,
+            error: err instanceof Error ? err.message : String(err)
+          } });
         }
       }
       async onConfigChanged() {
         this.provider?.stopSampling();
         this.provider?.startSampling(this.config.samplingIntervalMs);
+        this.applyLoadSeriesConfig();
+        this.startProcessSnapshotTimer();
       }
       async listWorkerInstances() {
         const broker = this.ctx.kernel.cluster?.broker;
@@ -75872,128 +77437,29 @@ var require_native_metrics_addon = __commonJS({
       /**
       * Walk the OS process table and classify each camstack-shaped process.
       *
-      * Classification (ancestry-driven, NOT pattern-driven):
-      *  - root    — the current node's own pid (`process.pid`).
-      *  - managed — pid is registered in the kernel's `$process.list`
-      *              (forked addon worker spawned by this hub).
-      *  - system  — ancestry walk crosses a SUPERVISOR_BOUNDARY_RE match
-      *              (tsx-watch launcher, agent CLI, concurrently, vite,
-      *              npm exec wrapper). The process belongs to the dev
-      *              tree even if not in `$process.list`. NEVER killable.
-      *  - ghost   — ancestry walk reaches `ppid=1` without crossing any
-      *              supervisor boundary AND the parent isn't visible in
-      *              `ps`. A truly orphaned camstack-shaped process. The
-      *              ONLY classification that's eligible for kill.
-      *
-      * Old pattern-only ghost detection produced false positives: every
-      * monorepo-path process matched CAMSTACK_CMD_RE, ancestry walk
-      * stopping at ppid=hub returned false-positive ghosts whenever a
-      * concurrently sibling sat above hub. Ancestry-driven classification
-      * fixes that.
+      * Classification is IDENTITY-driven: `root` is this pid, `managed` is a pid
+      * the kernel's `$process.list` names, and every other camstack-shaped
+      * process is `system`. The rules — and why there is no longer an ancestry
+      * walk behind them — live in `process-classification.ts`.
       */
       async listNodeProcesses() {
         const ps = await this.runPs();
         if (ps.length === 0) return [];
-        const managedPids = /* @__PURE__ */ new Map();
+        const managed = /* @__PURE__ */ new Map();
         const workers = await this.listWorkerInstances();
-        for (const w of workers) managedPids.set(w.pid, {
+        for (const w of workers) managed.set(w.pid, {
           addonId: w.addonId,
           nodeId: w.nodeId
         });
-        const hubNodeId = this.ctx.kernel.cluster?.broker?.nodeID ?? "hub";
-        const selfPid = process.pid;
-        const psIndex = /* @__PURE__ */ new Map();
-        for (const p of ps) psIndex.set(p.pid, {
-          ppid: p.ppid,
-          command: p.command
+        const camstackPids = ps.filter((p) => CAMSTACK_CMD_RE.test(p.command)).map((p) => p.pid);
+        const cpuSplits = await this.threadCpu.sample(camstackPids);
+        return buildNodeProcesses({
+          psRows: ps,
+          selfPid: process.pid,
+          selfNodeId: this.ctx.kernel.cluster?.broker?.nodeID ?? "hub",
+          managed,
+          cpuSplits
         });
-        const classifyByAncestry = (startPid) => {
-          let cur = startPid;
-          for (let depth = 0; depth < 32; depth++) {
-            const node = psIndex.get(cur);
-            if (!node) return "ghost";
-            if (cur === selfPid) return "system";
-            if (SUPERVISOR_BOUNDARY_RE.test(node.command)) return "system";
-            if (node.ppid === 1) return "ghost";
-            if (node.ppid === selfPid) return "system";
-            cur = node.ppid;
-          }
-          return "system";
-        };
-        const out = [];
-        for (const p of ps) {
-          if (!CAMSTACK_CMD_RE.test(p.command)) continue;
-          const managed = managedPids.get(p.pid);
-          let classification;
-          if (p.pid === selfPid) classification = "root";
-          else if (managed) classification = "managed";
-          else classification = classifyByAncestry(p.pid);
-          const orphaned = classification === "ghost";
-          out.push({
-            pid: p.pid,
-            ppid: p.ppid,
-            pgid: p.pgid,
-            classification,
-            addonId: managed?.addonId ?? null,
-            nodeId: managed?.nodeId ?? (p.pid === selfPid ? hubNodeId : null),
-            command: p.command,
-            cpuPercent: p.cpuPercent,
-            memoryRssBytes: p.memoryRssBytes,
-            uptimeSec: p.uptimeSec,
-            orphaned
-          });
-        }
-        return out;
-      }
-      /**
-      * Send SIGTERM / SIGKILL to a pid. Refuses pids that don't appear in
-      * `listNodeProcesses()` to prevent arbitrary system kills — a dedicated
-      * admin-path for resurrected zombies, not a generic shell replacement.
-      *
-      * `root`-classified pids (the running launcher / agent CLI / hub itself)
-      * are also refused: killing them tears down the whole node and the
-      * operator's intent is almost always to nuke a leaked child, not the
-      * supervisor that keeps the rest alive. Process restart goes through
-      * the dedicated `$process.restart` action, not this kill API.
-      */
-      async killProcess(input) {
-        const match = (await this.listNodeProcesses()).find((p) => p.pid === input.pid);
-        if (!match) return {
-          success: false,
-          reason: "pid not in node process table"
-        };
-        if (match.classification === "root" || match.classification === "system") {
-          this.ctx.logger.warn("Refused to kill protected process", { meta: {
-            pid: input.pid,
-            classification: match.classification,
-            addonId: match.addonId,
-            command: match.command
-          } });
-          return {
-            success: false,
-            reason: match.classification === "root" ? "cannot kill root (current node supervisor)" : "cannot kill system (intentional dev-tree ancestor \u2014 vite, concurrently, npm, etc.)"
-          };
-        }
-        const signal = input.force ? "SIGKILL" : "SIGTERM";
-        try {
-          process.kill(input.pid, signal);
-          this.ctx.logger.info("Killed node process", { meta: {
-            pid: input.pid,
-            signal,
-            classification: match.classification,
-            addonId: match.addonId
-          } });
-          return {
-            success: true,
-            signal
-          };
-        } catch (err) {
-          return {
-            success: false,
-            reason: err instanceof Error ? err.message : String(err),
-            signal
-          };
-        }
       }
       /**
       * Ask the addon's forked runner to write a V8 heap snapshot (SIGUSR2 → the
@@ -76070,7 +77536,29 @@ var require_native_metrics_addon = __commonJS({
           return [];
         }
       }
+      /**
+      * The knobs live HERE, on the document this addon already owns.
+      *
+      * Fields on an existing document, never a method per knob —
+      * `system.getLoggingSettings` / `setLoggingSettings` set that precedent.
+      * They are deliberately NOT in the logging document: that one is about
+      * levels and diagnostic windows, and two documents both claiming a knob is
+      * how this repo has already shipped a switch nobody read.
+      *
+      * Cluster-wide, not per-node: every node must emit on the same cadence or
+      * the fleet's series cannot be laid over each other, and the table is single
+      * and hub-resident, so a per-node retention would be a promise nothing could
+      * keep.
+      *
+      * The cost line is computed from OBSERVED numbers — the nodes and process
+      * counts the cluster is actually reporting — so an operator raising the
+      * retention sees what it costs BEFORE applying it, not afterwards.
+      */
       globalSettingsSchema() {
+        const projection = projectLoadSeriesCost({
+          config: this.loadConfig,
+          observedProcessRows: this.observedFleetRows()
+        });
         return this.schema({ sections: [{
           id: "native-metrics-settings",
           title: "System Metrics",
@@ -76085,6 +77573,47 @@ var require_native_metrics_addon = __commonJS({
             default: 5e3,
             unit: "ms"
           })]
+        }, {
+          id: "native-metrics-load-series",
+          title: "Load history",
+          fields: [
+            this.field({
+              type: "number",
+              key: "loadSeriesCadenceSec",
+              label: "Sampling cadence",
+              description: "How often every node reports its process tree. FIXED \u2014 a sample is emitted on every interval whether or not anything changed, so a gap in the chart means one thing only: nobody reported. Outside 5-60 s the value is refused.",
+              min: 5,
+              max: 60,
+              step: 1,
+              default: 10,
+              unit: "s"
+            }),
+            this.field({
+              type: "number",
+              key: "loadSeriesRetentionHours",
+              label: "Retention",
+              description: "How long the load history is kept on disk (the hub database, on the NVMe cache \u2014 never the recordings disk). This is the INTENTION; the row cap below is the guarantee.",
+              min: 1,
+              max: 72,
+              step: 1,
+              default: 6,
+              unit: "h"
+            }),
+            {
+              type: "info",
+              key: "load-series-cost",
+              label: "What this configuration costs",
+              content: describeLoadSeriesCost(projection),
+              variant: projection.capBites ? "warning" : "info"
+            },
+            {
+              type: "info",
+              key: "load-series-cap",
+              label: "Hard row cap",
+              content: `The table never exceeds ${this.loadConfig.maxRows.toLocaleString("en-US")} rows. When it would, the OLDEST samples are evicted and a warning is logged \u2014 so raising the retention can never turn into an incident, only into a shorter effective window.`,
+              variant: "info"
+            }
+          ]
         }] });
       }
     };
@@ -76117,7 +77646,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -77233,8 +78762,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
-    var require_retired_settings_keys = require_retired_settings_keys_PLI9w0k();
+    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_retired_settings_keys = require_retired_settings_keys_6w_JOqBg();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -77861,7 +79390,8 @@ var require_sqlite_settings_addon = __commonJS({
           this.declaredCollections.set(collection, {
             primaryKey: "id",
             columns: /* @__PURE__ */ new Set(["data"]),
-            booleanColumns: /* @__PURE__ */ new Set()
+            booleanColumns: /* @__PURE__ */ new Set(),
+            autoPrimaryKey: false
           });
         }
         if (await this.isEmpty({ collection: "system-settings" })) await this.seedDefaults();
@@ -77877,7 +79407,8 @@ var require_sqlite_settings_addon = __commonJS({
             const decl = {
               primaryKey: "id",
               columns: /* @__PURE__ */ new Set(["data"]),
-              booleanColumns: /* @__PURE__ */ new Set()
+              booleanColumns: /* @__PURE__ */ new Set(),
+              autoPrimaryKey: false
             };
             this.declaredCollections.set(scoped, decl);
             return decl;
@@ -77981,6 +79512,48 @@ var require_sqlite_settings_addon = __commonJS({
         else for (const [k, v] of Object.entries(record.data)) if (decl.columns.has(k)) row[k] = this.serializeColumnValue(v);
         await this.tableInsert(scoped, row);
       }
+      /**
+      * Insert a batch in ONE transaction, on ONE prepared statement.
+      *
+      * The write-side twin of {@link deleteWhere}. Every row in the batch shares
+      * a single column list, which is what makes one `prepare` legal: rows are
+      * normalised to the collection's DECLARED column set, so a row that omits a
+      * column binds `null` for it rather than producing a second statement shape.
+      *
+      * All or nothing — `better-sqlite3`'s `transaction()` rolls the whole batch
+      * back on any throw. A caller writing one process sample gets one COMMIT,
+      * which is the entire point: 76 rows every 10 s is 7.6 rows/s, and 7.6
+      * separate commits per second on the connection that also serves every
+      * cluster-wide configuration read is a constant load nobody asked for.
+      */
+      async insertMany({ namespace, collection, records }) {
+        if (records.length === 0) return { inserted: 0 };
+        const scoped = this.scopedName(namespace, collection);
+        const decl = this.requireDeclared(scoped);
+        const isKvShape = decl.columns.size === 1 && decl.columns.has("data");
+        const dataColumns = [...decl.columns];
+        const keys = decl.autoPrimaryKey ? dataColumns : [decl.primaryKey, ...dataColumns];
+        const sql = `INSERT INTO "${scoped}" (${keys.map((k) => `"${k}"`).join(", ")}) VALUES (${keys.map(() => "?").join(", ")})`;
+        const batch = records.map((record) => {
+          const row = {};
+          if (isKvShape) row["data"] = JSON.stringify(record.data);
+          else for (const [k, v] of Object.entries(record.data)) if (decl.columns.has(k)) row[k] = this.serializeColumnValue(v);
+          if (!decl.autoPrimaryKey) row[decl.primaryKey] = record.id || (0, node_crypto.randomUUID)();
+          return keys.map((k) => row[k] ?? null);
+        });
+        const db = this.getDb();
+        const stmt = db.prepare(sql);
+        const run = db.transaction((rows) => {
+          for (const row of rows) stmt.run(...row);
+        });
+        this.measured({
+          op: "insertMany",
+          collection: scoped,
+          sql,
+          params: batch[0] ?? []
+        }, () => run(batch));
+        return { inserted: batch.length };
+      }
       async update({ namespace, collection, id, data }) {
         const scoped = this.scopedName(namespace, collection);
         const decl = this.requireDeclared(scoped);
@@ -78655,7 +80228,8 @@ var require_sqlite_settings_addon = __commonJS({
         this.declaredCollections.set(table, {
           primaryKey,
           columns: columnNames,
-          booleanColumns
+          booleanColumns,
+          autoPrimaryKey: pkCol?.type === "INTEGER"
         });
       }
       /** Serialise per-column values for SQL binding: objects → JSON, booleans → 0/1. */
@@ -79468,7 +81042,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -80032,6 +81606,7 @@ var require_storage_orchestrator_addon = __commonJS({
         set: async (input) => (await engine()).set(input),
         query: async (input) => (await engine()).query(input),
         insert: async (input) => (await engine()).insert(input),
+        insertMany: async (input) => (await engine()).insertMany(input),
         update: async (input) => (await engine()).update(input),
         delete: async (input) => (await engine()).delete(input),
         deleteWhere: async (input) => (await engine()).deleteWhere(input),
@@ -81348,7 +82923,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -99409,7 +100984,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -101185,9 +102760,9 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
   }
 });
 
-// ../types/dist/event-category-EY0GNjV9.js
-var require_event_category_EY0GNjV9 = __commonJS({
-  "../types/dist/event-category-EY0GNjV9.js"(exports) {
+// ../types/dist/event-category-BaEgqJNv.js
+var require_event_category_BaEgqJNv = __commonJS({
+  "../types/dist/event-category-BaEgqJNv.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
@@ -101352,11 +102927,11 @@ var require_event_category_EY0GNjV9 = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CSodb2vQ.js
-var require_sleep_CSodb2vQ = __commonJS({
-  "../types/dist/sleep-CSodb2vQ.js"(exports) {
+// ../types/dist/sleep-9d8tJRbO.js
+var require_sleep_9d8tJRbO = __commonJS({
+  "../types/dist/sleep-9d8tJRbO.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_EY0GNjV9();
+    var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
     var WELL_KNOWN_TABS = [
       {
@@ -104907,8 +106482,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_EY0GNjV9();
-    var require_sleep = require_sleep_CSodb2vQ();
+    var require_event_category = require_event_category_BaEgqJNv();
+    var require_sleep = require_sleep_9d8tJRbO();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -105197,6 +106772,7 @@ var require_addon = __commonJS({
         "listProfiles",
         "listRuntimeNodes"
       ],
+      "load-contribution": ["list"],
       "log-channels": ["list"],
       "log-destination": ["query"],
       "login-method": ["getLoginMethods"],
@@ -111785,12 +113361,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-GjlyPjm0.js
-var require_manifest_python_deps_GjlyPjm0 = __commonJS({
-  "../system/dist/manifest-python-deps-GjlyPjm0.js"(exports) {
+// ../system/dist/manifest-python-deps-FYZBHc3v.js
+var require_manifest_python_deps_FYZBHc3v = __commonJS({
+  "../system/dist/manifest-python-deps-FYZBHc3v.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_BVU5JADq();
+    require_dist_Dl6MFXPr();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -111881,6 +113457,34 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
     function shouldReclaim(s, triggerMb = HEAP_RECLAIM_TRIGGER_MB) {
       return strandedMb(s) > triggerMb;
     }
+    function share(partMb, rssMb) {
+      return rssMb > 0 ? Math.round(partMb / rssMb * 100) : 0;
+    }
+    function describeRss(s, budgetMb) {
+      const nativeResidueMb = Math.max(0, strandedMb(s));
+      const shape = s.heapUsedMb >= s.externalMb && s.heapUsedMb >= nativeResidueMb ? "v8-heap" : s.externalMb >= nativeResidueMb ? "external" : "native-residue";
+      return {
+        rssMb: s.rssMb,
+        budgetMb,
+        overMb: Math.max(0, s.rssMb - budgetMb),
+        heapUsedMb: s.heapUsedMb,
+        externalMb: s.externalMb,
+        nativeResidueMb,
+        arrayBuffersMb: s.arrayBuffersMb,
+        shape
+      };
+    }
+    var SHAPE_ADVICE = {
+      "v8-heap": "live JS retainers \u2014 bounded by --max-old-space-size; the fix is the retained set",
+      external: "Buffers / native external \u2014 NO V8 flag bounds this, and the old-space ceiling never will",
+      "native-residue": "freed native memory the allocator has not returned \u2014 MALLOC_ARENA_MAX/VIPS_CONCURRENCY are already applied, so this lever is spent"
+    };
+    var RSS_BUDGET_RELEASE_RATIO = 0.9;
+    var RSS_BUDGET_REANNOUNCE_MIN_MS = 9e5;
+    function nextRssBudgetState(current, rssMb, budgetMb, releaseRatio = RSS_BUDGET_RELEASE_RATIO) {
+      if (current === "over") return rssMb < budgetMb * releaseRatio ? "within" : "over";
+      return rssMb > budgetMb ? "over" : "within";
+    }
     function isGcFunction(value) {
       return typeof value === "function";
     }
@@ -111898,12 +113502,15 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
         return;
       }
     }
-    function format2(label, s, loop) {
-      const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+    function formatOverBudget(label, b, source) {
+      return `[mem] ${label} OVER RSS BUDGET rss=${b.rssMb}MB budget=${b.budgetMb}MB over=+${b.overMb}MB shape=${b.shape} heapUsed=${b.heapUsedMb}MB(${share(b.heapUsedMb, b.rssMb)}%) external=${b.externalMb}MB(${share(b.externalMb, b.rssMb)}%) nativeResidue=${b.nativeResidueMb}MB(${share(b.nativeResidueMb, b.rssMb)}%) arrayBuffers=${b.arrayBuffersMb}MB budgetFrom="${source}" \u2014 ${SHAPE_ADVICE[b.shape]}`;
+    }
+    function format2(label, s, loop, budgetMb) {
+      const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB` + (budgetMb === void 0 ? "" : ` rssBudget=${budgetMb}MB`);
       if (loop === void 0) return line;
       return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms`;
     }
-    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv, announceCeilingOrigin = true) {
+    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv, announceCeilingOrigin = true, rssBudget) {
       const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
       const now = reclaimOptions?.now ?? (() => Date.now());
       const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -111945,6 +113552,29 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
       };
       let mode = "steady";
       let lastLoggedAt = Number.NEGATIVE_INFINITY;
+      const budgetMb = rssBudget?.budgetMb !== void 0 && rssBudget.budgetMb > 0 ? rssBudget.budgetMb : void 0;
+      const budgetSource = rssBudget?.source ?? "unspecified";
+      const releaseRatio = rssBudget?.releaseRatio ?? 0.9;
+      const reannounceMinMs = rssBudget?.reannounceMinMs ?? 9e5;
+      let budgetState = "within";
+      let lastBudgetWarnAt = Number.NEGATIVE_INFINITY;
+      let overBudgetAnnounced = false;
+      const checkRssBudget = (sample, at) => {
+        if (budgetMb === void 0) return;
+        const previous = budgetState;
+        budgetState = nextRssBudgetState(previous, sample.rssMb, budgetMb, releaseRatio);
+        if (budgetState === previous) return;
+        if (budgetState === "over") {
+          if (at - lastBudgetWarnAt < reannounceMinMs) return;
+          lastBudgetWarnAt = at;
+          overBudgetAnnounced = true;
+          sink.warn(formatOverBudget(label, describeRss(sample, budgetMb), budgetSource));
+          return;
+        }
+        if (!overBudgetAnnounced) return;
+        overBudgetAnnounced = false;
+        sink.info(`[mem] ${label} back within its RSS budget \u2014 rss=${sample.rssMb}MB budget=${budgetMb}MB`);
+      };
       const probeIntervalMs = Math.min(fastIntervalMs, intervalMs);
       const tick = () => {
         try {
@@ -111955,12 +113585,13 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
           const due = at - lastLoggedAt >= intervalMs;
           if (mode === "escalated" || due) {
             lastLoggedAt = at;
-            const line = format2(label, sample, loopDelay?.read());
+            const line = format2(label, sample, loopDelay?.read(), budgetMb);
             if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
             else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
             else sink.info(line);
           }
           if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine \u2014 logging every ${intervalMs}ms`);
+          checkRssBudget(sample, at);
           maybeReclaim(sample);
         } catch {
         }
@@ -111968,6 +113599,7 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
       const timer = setInterval(tick, probeIntervalMs);
       timer.unref?.();
       tick();
+      if (rssBudget !== void 0 && budgetMb === void 0) sink.info(`[mem] ${label} is NOT WATCHED against an RSS budget \u2014 no budget declared (${budgetSource}). rss growth outside the V8 heap raises nothing here: --max-old-space-size bounds old space only, and stranded subtracts external by construction. Declare execution.rssBudgetMb once this process has a measured working set.`);
       if (announceCeilingOrigin && heapCeilingOrigin(execArgv) === "v8-default") sink.info(`[mem] ${label} heap ceiling is V8's DEFAULT (${read().heapLimitMb}MB) \u2014 no --max-old-space-size on argv. Nothing here CHOSE that number; it is derived from host RAM and moves with it.`);
       let stopped = false;
       return () => {
@@ -111978,16 +113610,40 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
       };
     }
     var RUNNER_HEAP_WATCH_INTERVAL_MS = 3e5;
+    function parseRssBudgetMb(raw) {
+      if (raw === void 0) return void 0;
+      const parsed = Number(raw);
+      if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
+      return Math.floor(parsed);
+    }
+    var RUNNER_RSS_BUDGET_ENV = "CAMSTACK_RUNNER_RSS_BUDGET_MB";
+    var HUB_RSS_BUDGET_ENV = "CAMSTACK_HUB_RSS_BUDGET_MB";
+    var HUB_MAIN_RSS_BUDGET_MB = 4096;
+    function hubMainRssBudget(env = process.env) {
+      const override = env[HUB_RSS_BUDGET_ENV];
+      if (override !== void 0) return {
+        budgetMb: parseRssBudgetMb(override),
+        source: HUB_RSS_BUDGET_ENV
+      };
+      return {
+        budgetMb: HUB_MAIN_RSS_BUDGET_MB,
+        source: "HUB_MAIN_RSS_BUDGET_MB (kernel/heap-watch)"
+      };
+    }
     function startRunnerHeapWatch(options) {
       if (options.heapProfile !== "heavy") return void 0;
       const intervalMs = options.intervalMs ?? 3e5;
-      if (options.reclaimSwitch === "off") return startHeapWatch(options.label, options.sink, intervalMs, void 0, void 0, void 0, false);
+      const rssBudget = {
+        budgetMb: parseRssBudgetMb(options.rssBudgetMb),
+        source: `manifest execution.rssBudgetMb (via ${RUNNER_RSS_BUDGET_ENV})`
+      };
+      if (options.reclaimSwitch === "off") return startHeapWatch(options.label, options.sink, intervalMs, void 0, void 0, void 0, false, rssBudget);
       let reclaimOptions = options.reclaimOptions;
       if (reclaimOptions === void 0) {
         const reclaimer = createV8Reclaimer();
         reclaimOptions = reclaimer === void 0 ? void 0 : { reclaim: reclaimer };
       }
-      return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, true);
+      return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, true, rssBudget);
     }
     function trimSlashes(s) {
       return s.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -118543,6 +120199,18 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
         return HUB_CAP_FWD_SERVICE;
       }
     });
+    Object.defineProperty(exports, "HUB_MAIN_RSS_BUDGET_MB", {
+      enumerable: true,
+      get: function() {
+        return HUB_MAIN_RSS_BUDGET_MB;
+      }
+    });
+    Object.defineProperty(exports, "HUB_RSS_BUDGET_ENV", {
+      enumerable: true,
+      get: function() {
+        return HUB_RSS_BUDGET_ENV;
+      }
+    });
     Object.defineProperty(exports, "LocalChildClient", {
       enumerable: true,
       get: function() {
@@ -118561,12 +120229,30 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
         return NATIVE_PROVIDER_SERVICE_INFIX;
       }
     });
+    Object.defineProperty(exports, "RSS_BUDGET_REANNOUNCE_MIN_MS", {
+      enumerable: true,
+      get: function() {
+        return RSS_BUDGET_REANNOUNCE_MIN_MS;
+      }
+    });
+    Object.defineProperty(exports, "RSS_BUDGET_RELEASE_RATIO", {
+      enumerable: true,
+      get: function() {
+        return RSS_BUDGET_RELEASE_RATIO;
+      }
+    });
     Object.defineProperty(exports, "RUNNER_HEAP_WATCH_INTERVAL_MS", {
       enumerable: true,
       get: function() {
         return RUNNER_HEAP_WATCH_INTERVAL_MS;
       }
     });
+    Object.defineProperty(exports, "RUNNER_RSS_BUDGET_ENV", {
+      enumerable: true,
+      get: function() {
+        return RUNNER_RSS_BUDGET_ENV;
+      }
+    });
     Object.defineProperty(exports, "SocketChannel", {
       enumerable: true,
       get: function() {
@@ -118771,6 +120457,12 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
         return createV8Reclaimer;
       }
     });
+    Object.defineProperty(exports, "describeRss", {
+      enumerable: true,
+      get: function() {
+        return describeRss;
+      }
+    });
     Object.defineProperty(exports, "deserializeTypedArrays", {
       enumerable: true,
       get: function() {
@@ -118831,6 +120523,12 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
         return getWorkerNativeCapSnapshot;
       }
     });
+    Object.defineProperty(exports, "hubMainRssBudget", {
+      enumerable: true,
+      get: function() {
+        return hubMainRssBudget;
+      }
+    });
     Object.defineProperty(exports, "installManifestNativeDeps", {
       enumerable: true,
       get: function() {
@@ -118867,12 +120565,24 @@ var require_manifest_python_deps_GjlyPjm0 = __commonJS({
         return mountNativeCapService;
       }
     });
+    Object.defineProperty(exports, "nextRssBudgetState", {
+      enumerable: true,
+      get: function() {
+        return nextRssBudgetState;
+      }
+    });
     Object.defineProperty(exports, "parseCapAction", {
       enumerable: true,
       get: function() {
         return parseCapAction;
       }
     });
+    Object.defineProperty(exports, "parseRssBudgetMb", {
+      enumerable: true,
+      get: function() {
+        return parseRssBudgetMb;
+      }
+    });
     Object.defineProperty(exports, "registerEventBusService", {
       enumerable: true,
       get: function() {
@@ -122771,7 +124481,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BVU5JADq();
+    var require_dist10 = require_dist_Dl6MFXPr();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -122797,7 +124507,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_u8QCJCFE();
-    var require_manifest_python_deps = require_manifest_python_deps_GjlyPjm0();
+    var require_manifest_python_deps = require_manifest_python_deps_FYZBHc3v();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -202263,7 +203973,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     }
     var EMPTY_HEAP_DECLARATION = {
       profile: void 0,
-      maxOldSpaceMb: void 0
+      maxOldSpaceMb: void 0,
+      rssBudgetMb: void 0
     };
     var heapProfileCache = /* @__PURE__ */ new Map();
     function readAddonHeapDeclaration(spec) {
@@ -202276,10 +203987,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         const parsed = JSON.parse(raw);
         const profile = extractHeapProfile(parsed, spec.addonId);
         const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
-        if (profile !== void 0 || maxOldSpaceMb !== void 0) {
+        const rssBudgetMb = extractRssBudgetMb(parsed, spec.addonId);
+        if (profile !== void 0 || maxOldSpaceMb !== void 0 || rssBudgetMb !== void 0) {
           declaration = {
             profile,
-            maxOldSpaceMb
+            maxOldSpaceMb,
+            rssBudgetMb
           };
           break;
         }
@@ -202303,6 +204016,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
       return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
     }
+    function extractRssBudgetMb(parsed, addonId) {
+      const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.rssBudgetMb;
+      return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+    }
     function readManifestAddons(parsed) {
       if (typeof parsed !== "object" || parsed === null) return [];
       const camstack = parsed.camstack;
@@ -202321,6 +204038,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       if (declared.includes(0)) return 0;
       return Math.max(...declared);
     }
+    function runnerRssBudgetMb(addons) {
+      const declared = addons.map((a) => readAddonHeapDeclaration(a).rssBudgetMb).filter((mb) => mb !== void 0);
+      return declared.length === 0 ? void 0 : Math.max(...declared);
+    }
     function runnerHeapFlags(addons) {
       if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
       const heavy = isHeavyRunner(addons);
@@ -202377,6 +204098,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         const nodeId = buildNodeId(runnerId);
         const runnerPath = node_path.resolve(__dirname, "addon-runner.js");
         const heavy = isHeavyRunner(addons);
+        const rssBudgetMb = runnerRssBudgetMb(addons);
         const childEnv = {
           ...process.env,
           CAMSTACK_RUNNER_ID: runnerId,
@@ -202390,6 +204112,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           ...applyRunnerNativeAllocator(process.env),
           ...env
         };
+        if (rssBudgetMb === void 0) delete childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV];
+        else childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV] = String(rssBudgetMb);
         const heapFlags = runnerHeapFlags(addons);
         capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
         const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
@@ -203180,6 +204904,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
     exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
     exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
+    exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_python_deps.HUB_MAIN_RSS_BUDGET_MB;
+    exports.HUB_RSS_BUDGET_ENV = require_manifest_python_deps.HUB_RSS_BUDGET_ENV;
     exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
     exports.HubForwarderDestination = require_builtins_hub_forwarder_index.HubForwarderDestination$1;
     exports.HubLogForwarder = HubLogForwarder;
@@ -203219,7 +204945,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.PythonEnvManager = PythonEnvManager;
     exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
     exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
+    exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_python_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
+    exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_python_deps.RSS_BUDGET_RELEASE_RATIO;
     exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
+    exports.RUNNER_RSS_BUDGET_ENV = require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV;
     exports.RUNTIME_DEFAULTS = require_dist10.RUNTIME_DEFAULTS;
     exports.ReadinessRegistry = require_dist10.ReadinessRegistry;
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
@@ -203316,6 +205045,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.deleteModelFromDisk = require_file_data_plane.deleteModelFromDisk;
     exports.deriveAgentListenPort = deriveAgentListenPort;
     exports.describeProviderKindDrift = describeProviderKindDrift;
+    exports.describeRss = require_manifest_python_deps.describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
     Object.defineProperty(exports, "downloadBinary", {
       enumerable: true,
@@ -203392,6 +205122,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.getWorkerDeviceRegistry = require_manifest_python_deps.getWorkerDeviceRegistry;
     exports.hasDotNode = hasDotNode;
     exports.hashClusterSecret = hashClusterSecret;
+    exports.hubMainRssBudget = require_manifest_python_deps.hubMainRssBudget;
     exports.installManifestNativeDeps = require_manifest_python_deps.installManifestNativeDeps;
     exports.installManifestPythonDeps = require_manifest_python_deps.installManifestPythonDeps;
     exports.installPackageFromNpm = installPackageFromNpm;
@@ -203420,8 +205151,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
     exports.localProviderLink = require_manifest_python_deps.localProviderLink;
     exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
+    exports.nextRssBudgetState = require_manifest_python_deps.nextRssBudgetState;
     exports.parseCapAction = require_manifest_python_deps.parseCapAction;
     exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
+    exports.parseRssBudgetMb = require_manifest_python_deps.parseRssBudgetMb;
     exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
     exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
     exports.proxyToUpstream = proxyToUpstream;
@@ -203469,7 +205202,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_EY0GNjV9();
+    var require_event_category = require_event_category_BaEgqJNv();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -203489,8 +205222,8 @@ var require_dist4 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_EY0GNjV9();
-    var require_sleep = require_sleep_CSodb2vQ();
+    var require_event_category = require_event_category_BaEgqJNv();
+    var require_sleep = require_sleep_9d8tJRbO();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -205256,6 +206989,116 @@ var require_dist4 = __commonJS({
       }
       return bestAbove?.entry ?? bestBelow?.entry;
     }
+    var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
+    var ROOT_BUCKET_KEY = "__root__";
+    function bucketFor(row) {
+      if (row.addonId !== null) return {
+        key: row.addonId,
+        kind: "addon"
+      };
+      if (row.classification === "root") return {
+        key: ROOT_BUCKET_KEY,
+        kind: "root"
+      };
+      return {
+        key: UNATTRIBUTED_BUCKET_KEY,
+        kind: "unattributed"
+      };
+    }
+    function deci(value) {
+      return Math.round(value * 10) / 10;
+    }
+    function foldSnapshotByFunction(rows, atMs) {
+      const acc = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        const { key, kind } = bucketFor(row);
+        const cur = acc.get(key) ?? {
+          kind,
+          main: 0,
+          gc: 0,
+          lifetime: 0,
+          memory: 0,
+          count: 0,
+          splitKnown: true
+        };
+        const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
+        acc.set(key, {
+          kind: cur.kind,
+          main: cur.main + (row.cpuMainPercent ?? 0),
+          gc: cur.gc + (row.cpuGcPercent ?? 0),
+          lifetime: cur.lifetime + row.cpuPercent,
+          memory: cur.memory + row.memoryRssBytes,
+          count: cur.count + 1,
+          splitKnown: cur.splitKnown && known
+        });
+      }
+      return [...acc.entries()].map(([key, a]) => {
+        const main = a.splitKnown ? deci(a.main) : null;
+        const gc = a.splitKnown ? deci(a.gc) : null;
+        const lifetime = deci(a.lifetime);
+        return {
+          key,
+          kind: a.kind,
+          point: {
+            atMs,
+            samples: 1,
+            cpuMainPercent: main,
+            cpuMainPercentMin: main,
+            cpuGcPercent: gc,
+            cpuGcPercentMin: gc,
+            cpuLifetimePercent: lifetime,
+            cpuLifetimePercentMin: lifetime,
+            memoryRssBytes: a.memory,
+            memoryRssBytesMin: a.memory,
+            processCount: a.count,
+            processCountMin: a.count
+          }
+        };
+      });
+    }
+    function minNullable(a, b) {
+      if (a === null || b === null) return null;
+      return a < b ? a : b;
+    }
+    function maxNullable(a, b) {
+      if (a === null || b === null) return null;
+      return a > b ? a : b;
+    }
+    function mergePoints(held, next, atMs) {
+      return {
+        atMs,
+        samples: held.samples + next.samples,
+        cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
+        cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
+        cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
+        cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
+        cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
+        cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
+        memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
+        memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
+        processCount: Math.max(held.processCount, next.processCount),
+        processCountMin: Math.min(held.processCountMin, next.processCountMin)
+      };
+    }
+    function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
+      if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
+      const wanted = spanMs / maxPoints;
+      if (wanted <= cadenceMs) return cadenceMs;
+      return Math.ceil(wanted / cadenceMs) * cadenceMs;
+    }
+    function reducePoints(points, bucketMs, origin) {
+      if (bucketMs <= 0 || points.length === 0) return points;
+      const buckets = /* @__PURE__ */ new Map();
+      for (const point of points) {
+        const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+        const held = buckets.get(start);
+        buckets.set(start, held === void 0 ? {
+          ...point,
+          atMs: start
+        } : mergePoints(held, point, start));
+      }
+      return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+    }
     var FORMAT_KEYS = [
       "onnx",
       "coreml",
@@ -209179,6 +211022,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       data: zod.z.record(zod.z.string(), zod.z.unknown())
     });
+    var BulkRecordSchema = zod.z.object({
+      id: zod.z.string().optional(),
+      data: zod.z.record(zod.z.string(), zod.z.unknown())
+    });
     var CollectionColumnSchema = zod.z.object({
       name: zod.z.string(),
       type: zod.z.enum([
@@ -209253,6 +211100,34 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           collection: zod.z.string(),
           record: SettingsRecordSchema
         }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Insert MANY records in ONE transaction, returning how many landed.
+        *
+        * The write-side twin of {@link deleteWhere}, and it exists for the same
+        * reason: without it, appending a batch is N round trips and N COMMITs on
+        * the single shared connection that also serves every cluster-wide
+        * configuration read. The durable load series writes one process row per
+        * process per sample — 76 rows every 10 s on the live fleet — and the
+        * operator's rule for it is *one transaction per sample, never one per
+        * row*. `insert` cannot express that; nothing else could.
+        *
+        * **All or nothing.** A batch that fails on its fifth row leaves none of
+        * the five behind. A half-written sample is worse than a missing one: the
+        * missing one reads as "nobody reported", which is true, while the half
+        * one reads as "these were the only processes running", which is not.
+        *
+        * `id` is OPTIONAL per record, and that is the difference from
+        * {@link insert}. A collection whose primary key is an `INTEGER` rowid
+        * alias has no id to supply — SQLite assigns it, for free, and inventing a
+        * `randomUUID()` for such a column would write a 36-character string into
+        * an integer key. Omitted on a TEXT key, a uuid is generated exactly as
+        * `insert` does.
+        */
+        insertMany: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          records: zod.z.array(BulkRecordSchema).readonly()
+        }), zod.z.object({ inserted: zod.z.number().int() }), { kind: "mutation" }),
         /** Update an existing record by ID. */
         update: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -209442,6 +211317,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /** Insert many records in ONE transaction. All or nothing. */
+        insertMany: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          records: zod.z.array(BulkRecordSchema).readonly()
+        }), zod.z.object({ inserted: zod.z.number().int() }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
         /** Update an existing record by ID. */
         update: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -211840,6 +213724,85 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
       mount: { kind: "skip" }
     };
+    var LOAD_CONTRIBUTION_ROLES = [
+      "decode",
+      "transcode",
+      "recording",
+      "streaming",
+      "detection"
+    ];
+    var LOAD_CONTRIBUTION_ATTRIBUTIONS = [
+      "measured",
+      "accounted",
+      "unattributable"
+    ];
+    var LoadContributionSchema = zod.z.object({
+      role: zod.z.enum(LOAD_CONTRIBUTION_ROLES),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. `null` means this cost genuinely belongs to no single
+      * camera (a shared pool), NOT that the contributor forgot to look it up: a
+      * contributor that cannot name its camera must not emit the entry at all,
+      * because an unnamed per-camera entry is indistinguishable from a shared one
+      * and would quietly turn one camera's cost into everybody's.
+      */
+      deviceId: zod.z.number().int().positive().nullable(),
+      attribution: zod.z.enum(LOAD_CONTRIBUTION_ATTRIBUTIONS),
+      /**
+      * What ONE entry is, in the contributor's own words — `615/high`,
+      * `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+      * family and inventing a common one would lose the only information that
+      * makes two entries for the same camera distinguishable.
+      */
+      unit: zod.z.string(),
+      /**
+      * The OS process this cost lives in, when there is one. Present so a
+      * consumer can (a) tell two generations of the same unit apart across a
+      * restart, and (b) subtract claimed processes from the node's process
+      * snapshot to see what NOBODY claimed. Absent for an entry that owns no
+      * process of its own.
+      */
+      pid: zod.z.number().int().positive().optional(),
+      /**
+      * When this generation started. The pid's incarnation marker: a consumer
+      * differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+      * window when this changes, because the counter restarted from zero in a new
+      * process.
+      */
+      startedAtMs: zod.z.number().optional(),
+      /**
+      * CUMULATIVE CPU seconds this unit has consumed since it started — user +
+      * system, read from the child's own `/proc/<pid>/stat` at the moment the
+      * contribution is asked for.
+      *
+      * Cumulative and not a rate on purpose: a rate needs a window, a window
+      * needs a sampler, and a new per-node sampler is the defect half of
+      * `docs/architecture/load-ledger.md` documents. A counter can be differenced
+      * by whoever already keeps a history; a rate cannot be un-averaged.
+      *
+      * Absent — never zero — on a node with no `/proc`, on a read failure, and on
+      * an entry with no process.
+      */
+      cpuSeconds: zod.z.number().optional(),
+      /** Resident bytes of this unit's process, same source and same rules. */
+      rssBytes: zod.z.number().optional()
+    });
+    var loadContributionCapability = {
+      name: "load-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's own cost entries, computed live from state it already
+        * holds. Inert: no persistence, no sampling, no timer. It is answered on
+        * whatever beat the caller already has.
+        */
+        list: require_sleep.method(zod.z.void(), zod.z.array(LoadContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -212011,8 +213974,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       classification: zod.z.enum([
         "root",
         "managed",
-        "system",
-        "ghost"
+        "system"
       ]),
       /** `$process` addon binding when `managed`, else null. */
       addonId: zod.z.string().nullable(),
@@ -212020,22 +213982,39 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       nodeId: zod.z.string().nullable(),
       /** Truncated command line. */
       command: zod.z.string(),
+      /**
+      * `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+      * On a runner up for days it barely moves. Fine as a column, useless as a
+      * series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+      */
       cpuPercent: zod.z.number(),
       memoryRssBytes: zod.z.number(),
+      /**
+      * Instantaneous CPU% of the process's own threads over the last
+      * process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+      *
+      * `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+      * boot), the pid was recycled, or this node is not Linux.
+      */
+      cpuMainPercent: zod.z.number().nullable(),
+      /**
+      * Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+      *
+      * This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+      * `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+      * does not separate it from `cpuMainPercent` shows "busy" where the truth is
+      * "allocating too much".
+      *
+      * Concurrent GC is the dominant tenant of that pool but not the only one
+      * (background compilation runs there too), so it is reported as
+      * "GC / V8 helpers" rather than as pure collection time. `null` has the same
+      * meaning as on `cpuMainPercent`.
+      */
+      cpuGcPercent: zod.z.number().nullable(),
+      /** Threads seen in the tick scan. `null` under the same conditions. */
+      threadCount: zod.z.number().nullable(),
       /** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-      uptimeSec: zod.z.number(),
-      /** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-      orphaned: zod.z.boolean()
-    });
-    var KillProcessInputSchema = zod.z.object({
-      pid: zod.z.number(),
-      /** Force = SIGKILL. Default is SIGTERM. */
-      force: zod.z.boolean().optional()
-    });
-    var KillProcessResultSchema = zod.z.object({
-      success: zod.z.boolean(),
-      reason: zod.z.string().optional(),
-      signal: zod.z.enum(["SIGTERM", "SIGKILL"]).optional()
+      uptimeSec: zod.z.number()
     });
     var DumpHeapSnapshotInputSchema = zod.z.object({
       /** The addon whose runner should dump a heap snapshot. */
@@ -212049,6 +214028,89 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       pid: zod.z.number().optional(),
       reason: zod.z.string().optional()
     });
+    var LoadPointSchema = zod.z.object({
+      /** Bucket START, or the snapshot's own timestamp when unreduced. */
+      atMs: zod.z.number(),
+      /** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+      samples: zod.z.number().int(),
+      /**
+      * `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+      * of every snapshot in it reported a thread split. A partial sum is a
+      * smaller number that looks exactly as real as a complete one.
+      */
+      cpuMainPercent: zod.z.number().nullable(),
+      cpuMainPercentMin: zod.z.number().nullable(),
+      cpuGcPercent: zod.z.number().nullable(),
+      cpuGcPercentMin: zod.z.number().nullable(),
+      /** Lifetime-average CPU%, summed. Always known — and never a rate. */
+      cpuLifetimePercent: zod.z.number(),
+      cpuLifetimePercentMin: zod.z.number(),
+      memoryRssBytes: zod.z.number(),
+      memoryRssBytesMin: zod.z.number(),
+      processCount: zod.z.number().int(),
+      processCountMin: zod.z.number().int()
+    });
+    var LoadFunctionSeriesSchema = zod.z.object({
+      key: zod.z.string(),
+      kind: zod.z.enum([
+        "addon",
+        "root",
+        "unattributed"
+      ]),
+      /** Oldest-first. A missing interval is MISSING — never zero-filled. */
+      points: zod.z.array(LoadPointSchema).readonly()
+    });
+    var NodeLoadSeriesSchema = zod.z.object({
+      nodeId: zod.z.string(),
+      /** One entry per function seen in the window, heaviest-first. */
+      series: zod.z.array(LoadFunctionSeriesSchema).readonly(),
+      /**
+      * Width of one returned bucket, in ms. Equals the sampling cadence when no
+      * reduction was needed — so a caller can always say what one point covers
+      * without having to know whether it was reduced.
+      */
+      bucketMs: zod.z.number(),
+      /** Raw snapshots that went into this answer, across both tiers. */
+      retainedSamples: zod.z.number(),
+      /** Oldest snapshot represented, or `null` when nothing is retained. */
+      oldestAtMs: zod.z.number().nullable(),
+      /** The fixed sampling cadence in force on the cluster, in ms. */
+      cadenceMs: zod.z.number(),
+      /**
+      * Did the DURABLE tier contribute? `false` means the answer is the hot ring
+      * alone — an agent (which holds no table), or a store that refused.
+      * Reported because "the last hour" and "the last six hours" are different
+      * questions and an operator must not have to guess which was answered.
+      */
+      durable: zod.z.boolean()
+    });
+    var GetLoadSeriesInputSchema = zod.z.object({
+      /**
+      * The node whose series is wanted.
+      *
+      * NOT named `nodeId`: the generated cap router strips a top-level
+      * `nodeId` from every method input and uses it to ROUTE the call to
+      * that node's provider (`generated-cap-routers.ts`). A series target
+      * called `nodeId` would silently become a routing pin and never reach
+      * the provider. The hub holds every node it hears from, so the
+      * ordinary call is unpinned — answered by the hub, for any node.
+      */
+      forNodeId: zod.z.string(),
+      /**
+      * EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+      * holds and receives only what it is missing, so seeding a live chart
+      * from this method cannot double a point already drawn.
+      */
+      sinceMs: zod.z.number().optional(),
+      /**
+      * Most points the caller wants PER FUNCTION. The window is reduced to fit,
+      * preserving min and max per bucket.
+      *
+      * Absent means NO reduction — legitimate for a short window and a trap for a
+      * long one, which is why a chart passes its own pixel width.
+      */
+      maxPoints: zod.z.number().int().positive().optional()
+    });
     var SystemMetricsSchema = zod.z.object({
       cpuPercent: zod.z.number(),
       memoryPercent: zod.z.number(),
@@ -212094,28 +214156,44 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         getAddonStats: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), PidResourceStatsSchema.nullable()),
         /**
         * Snapshot of every camstack-related process on this node with a
-        * ghost/managed/root classification. Powers the Cluster → Agent →
-        * Processes tab: cross-references `$process.list` against a `ps` scan
-        * so orphaned trees (PPID=1) or unknown children show up as `ghost`
-        * and can be killed from the UI.
+        * root/managed/system classification. Powers the Cluster → Agent →
+        * Processes tab: cross-references `$process.list` against a `ps` scan so
+        * per-addon CPU and RSS can be attributed, and so a process the cluster
+        * does not manage is still visible.
+        *
+        * **Read-only, by design.** This cap once carried a `killProcess`
+        * mutation; it was deleted on 2026-08-27. A runner's lifecycle belongs to
+        * `CrashSupervisor` and is driven through `addons.restartAddon` /
+        * `$process.restart` — signalling a raw pid went around the supervisor
+        * (D6), and the one class it was willing to signal turned out to be the
+        * container's own init and the operator's desktop app.
         */
         listNodeProcesses: require_sleep.method(zod.z.void(), zod.z.array(NodeProcessSchema).readonly()),
         /**
-        * Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
-        * process tree. The provider refuses pids that aren't in the live
-        * `listNodeProcesses()` snapshot — callers can't use this endpoint
-        * to kill arbitrary system processes.
+        * The retained per-node load series — the ONE reader over BOTH tiers.
+        *
+        * The in-memory ring is the HOT window (the last 180 snapshots, held by
+        * every node's `native-metrics`); the hub's `metrics:node-load-samples`
+        * table is the COLD one (the operator's retention, six hours by default).
+        * This method merges them and DEDUPES on `atMs`, so a snapshot present in
+        * both contributes once and the caller never learns which tier a point
+        * came from. There is deliberately no second read surface: two readers is
+        * how two charts start disagreeing about the same node.
+        *
+        * Reads only; nothing is sampled to answer it. Normally called UNPINNED —
+        * the hub hears every node's snapshot and holds every node's rows — and
+        * answers for any `forNodeId`. Pinned to an agent it answers from that
+        * agent's ring alone (`durable: false`). Empty is a legitimate answer: a
+        * node nobody has heard from has no series, and saying so is the truth.
         */
-        killProcess: require_sleep.method(KillProcessInputSchema, KillProcessResultSchema, {
-          kind: "mutation",
-          auth: "admin"
-        }),
+        getLoadSeries: require_sleep.method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema),
         /**
         * Tell the addon's forked runner to write a V8 heap snapshot to disk (via
         * SIGUSR2 — the runner's diagnostic handler). Also logs its
-        * `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
-        * live `listNodeProcesses()` snapshot. Use for deep per-addon memory
-        * attribution; copy the returned path off the node to analyze.
+        * `process.memoryUsage()` + heap-space breakdown. Resolves the pid from
+        * `$process.list`, so it can only reach a runner this node spawned. Use
+        * for deep per-addon memory attribution; copy the returned path off the
+        * node to analyze.
         */
         dumpHeapSnapshot: require_sleep.method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
           kind: "mutation",
@@ -228210,6 +230288,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
     });
+    var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: zod.z.string() });
     var GetLoggingSettingsInputSchema = zod.z.object({
       scopeNodeId: zod.z.string().optional(),
       /**
@@ -228303,6 +230382,22 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         getRequestCensus: require_sleep.method(zod.z.void(), RequestCensusStatusSchema, { auth: "admin" }),
         /**
+        * Every `load-contribution` an addon on this cluster reports — each
+        * addon's OWN cost, already attributed by the addon that owns it.
+        *
+        * There is no central list of what costs what: an addon that spawns a
+        * per-camera child declares it, and one that cannot attribute its cost
+        * (the shared inference pool) declares THAT. So a new cost family appears
+        * here the moment its addon is redeployed, with nobody editing anything.
+        *
+        * What this does NOT do is measure the node. `metrics.node-processes-
+        * snapshot` still does that, and the difference between the two is the
+        * finding: a process no contribution claims is either a leak or a family
+        * nobody has taught to report. Both belong in the unattributed bucket, and
+        * neither may be folded into a camera.
+        */
+        getLoadContributions: require_sleep.method(zod.z.void(), zod.z.array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }),
+        /**
         * The logging settings document — levels and armed diagnostics — resolved
         * for `nodeId`, or for the cluster when `nodeId` is absent.
         *
@@ -231874,6 +233969,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       lawnMowerControl: "lawn-mower-control",
       llm: "llm",
       llmRuntime: "llm-runtime",
+      loadContribution: "load-contribution",
       localNetwork: "local-network",
       lockControl: "lock-control",
       logChannels: "log-channels",
@@ -232239,6 +234335,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         key: "llmRuntime",
         name: "llm-runtime"
       },
+      {
+        key: "loadContribution",
+        name: "load-contribution"
+      },
       {
         key: "localNetwork",
         name: "local-network"
@@ -232628,6 +234728,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       lawnMowerControlCapability,
       llmCapability,
       llmRuntimeCapability,
+      loadContributionCapability,
       localNetworkCapability,
       lockControlCapability,
       logChannelsCapability,
@@ -233651,6 +235752,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "dataStoreProvider.insertMany": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "dataStoreProvider.isEmpty": {
         capName: "data-store-provider",
         capScope: "system",
@@ -234965,6 +237072,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "loadContribution.list": {
+        capName: "load-contribution",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "localNetwork.downloadCa": {
         capName: "local-network",
         capScope: "system",
@@ -235265,17 +237378,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
-      "metricsProvider.getProcessStats": {
+      "metricsProvider.getLoadSeries": {
         capName: "metrics-provider",
         capScope: "system",
         addonId: null,
         access: "view"
       },
-      "metricsProvider.killProcess": {
+      "metricsProvider.getProcessStats": {
         capName: "metrics-provider",
         capScope: "system",
         addonId: null,
-        access: "create"
+        access: "view"
       },
       "metricsProvider.listAddonInstances": {
         capName: "metrics-provider",
@@ -237287,6 +239400,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "settingsStore.insertMany": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "settingsStore.isEmpty": {
         capName: "settings-store",
         capScope: "system",
@@ -237899,6 +240018,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "system.getLoadContributions": {
+        capName: "system",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "system.getLoggingSettings": {
         capName: "system",
         capScope: "system",
@@ -238591,6 +240716,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "lawn-mower-control",
       "llm",
       "llm-runtime",
+      "load-contribution",
       "local-network",
       "lock-control",
       "log-channels",
@@ -238749,6 +240875,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "integrations",
       "llm",
       "llm-runtime",
+      "load-contribution",
       "local-network",
       "log-channels",
       "log-destination",
@@ -241381,7 +243508,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           listAddonInstances: (input) => dispatch("metricsProvider", "listAddonInstances", "query", input),
           getAddonStats: (input) => dispatch("metricsProvider", "getAddonStats", "query", input),
           listNodeProcesses: (input) => dispatch("metricsProvider", "listNodeProcesses", "query", input),
-          killProcess: (input) => dispatch("metricsProvider", "killProcess", "mutation", input),
+          getLoadSeries: (input) => dispatch("metricsProvider", "getLoadSeries", "query", input),
           dumpHeapSnapshot: (input) => dispatch("metricsProvider", "dumpHeapSnapshot", "mutation", input)
         },
         mqttBroker: {
@@ -241560,6 +243687,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           set: (input) => dispatch("settingsStore", "set", "mutation", input),
           query: (input) => dispatch("settingsStore", "query", "query", input),
           insert: (input) => dispatch("settingsStore", "insert", "mutation", input),
+          insertMany: (input) => dispatch("settingsStore", "insertMany", "mutation", input),
           update: (input) => dispatch("settingsStore", "update", "mutation", input),
           delete: (input) => dispatch("settingsStore", "delete", "mutation", input),
           deleteWhere: (input) => dispatch("settingsStore", "deleteWhere", "mutation", input),
@@ -241640,6 +243768,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           setSiteLocation: (input) => dispatch("system", "setSiteLocation", "mutation", input),
           detectSiteLocation: (input) => dispatch("system", "detectSiteLocation", "mutation", input),
           getRequestCensus: (input) => dispatch("system", "getRequestCensus", "query", input),
+          getLoadContributions: (input) => dispatch("system", "getLoadContributions", "query", input),
           getLoggingSettings: (input) => dispatch("system", "getLoggingSettings", "query", input),
           setLoggingSettings: (input) => dispatch("system", "setLoggingSettings", "mutation", input)
         },
@@ -244453,6 +246582,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.BrokerSubscribeResultSchema = SubscribeResultSchema;
     exports.BrokerTestConnectionResultSchema = TestConnectionResultSchema;
     exports.BrokerUnsubscribeInputSchema = UnsubscribeInputSchema;
+    exports.BulkRecordSchema = BulkRecordSchema;
     exports.CAMERA_SWITCH_CATALOG = CAMERA_SWITCH_CATALOG;
     exports.CAMERA_SWITCH_ORDER = CAMERA_SWITCH_ORDER;
     exports.CAM_PROFILE_ORDER = require_sleep.CAM_PROFILE_ORDER;
@@ -244726,6 +246856,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.IntercomStatusSchema = IntercomStatusSchema;
     exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
     exports.KeyEventSchema = KeyEventSchema;
+    exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
+    exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
     exports.LOG_CHANNEL_TICK_MS = LOG_CHANNEL_TICK_MS;
     exports.LOG_LEVEL_RANK = LOG_LEVEL_RANK;
     exports.LabelAttributionSchema = LabelAttributionSchema;
@@ -244758,6 +246890,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.LlmTimeoutDefaults = LlmTimeoutDefaults;
     exports.LlmUsageRollupSchema = LlmUsageRollupSchema;
     exports.LlmUsageSchema = LlmUsageSchema;
+    exports.LoadContributionSchema = LoadContributionSchema;
     exports.LocateSegmentResultSchema = LocateSegmentResultSchema;
     exports.LocationStatSchema = LocationStatSchema;
     exports.LockControlStatusSchema = LockControlStatusSchema;
@@ -245040,6 +247173,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
     exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
     exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
+    exports.ROOT_BUCKET_KEY = ROOT_BUCKET_KEY;
     exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
     exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
     exports.RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS;
@@ -245082,6 +247216,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
     exports.RenderedAsSchema = RenderedAsSchema;
     exports.ReportMotionInputSchema = ReportMotionInputSchema;
+    exports.ReportedLoadContributionSchema = ReportedLoadContributionSchema;
     exports.RequestCensusGroupSchema = RequestCensusGroupSchema;
     exports.RequestCensusProcedureSchema = RequestCensusProcedureSchema;
     exports.RequestCensusSnapshotSchema = RequestCensusSnapshotSchema;
@@ -245265,6 +247400,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.TransportPlaneCountsSchema = TransportPlaneCountsSchema;
     exports.TransportPlaneSchema = TransportPlaneSchema;
     exports.TurnServerSchema = TurnServerSchema;
+    exports.UNATTRIBUTED_BUCKET_KEY = UNATTRIBUTED_BUCKET_KEY;
     exports.UNIT_TABLE = UNIT_TABLE;
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
     exports.UnitConversionError = UnitConversionError;
@@ -245483,6 +247619,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.filesystemBrowseCapability = filesystemBrowseCapability;
     exports.findTimezone = findTimezone;
     exports.floodCapability = floodCapability;
+    exports.foldSnapshotByFunction = foldSnapshotByFunction;
     exports.formatForBackend = formatForBackend;
     exports.formatForRuntime = formatForRuntime;
     exports.gasCapability = gasCapability;
@@ -245540,6 +247677,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.lifecycleTaskSchema = lifecycleTaskSchema;
     exports.llmCapability = llmCapability;
     exports.llmRuntimeCapability = llmRuntimeCapability;
+    exports.loadContributionCapability = loadContributionCapability;
     exports.localNetworkCapability = localNetworkCapability;
     exports.locationSimilarity = locationSimilarity;
     exports.lockControlCapability = lockControlCapability;
@@ -245636,12 +247774,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.recordingCapability = recordingCapability;
     exports.recordingExportCapability = recordingExportCapability;
     exports.rectsToCells = rectsToCells;
+    exports.reducePoints = reducePoints;
     exports.requiresPython = requiresPython;
     exports.resetPoolBaseline = resetPoolBaseline;
     exports.resolveAddonExecution = resolveAddonExecution;
     exports.resolveAddonGroup = resolveAddonGroup;
     exports.resolveAddonPlacement = resolveAddonPlacement;
     exports.resolveAddonRuntime = resolveAddonRuntime;
+    exports.resolveBucketMs = resolveBucketMs;
     exports.resolveCapMount = require_sleep.resolveCapMount;
     exports.resolveClusterStepModelId = resolveClusterStepModelId;
     exports.resolveDetectionRuntime = resolveDetectionRuntime;
@@ -402831,6 +404971,37 @@ var require_collection_preference = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/core/load-contributions.js
+var require_load_contributions = __commonJS({
+  "../../server/backend/dist/api/core/load-contributions.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.EMPTY_LOAD_CONTRIBUTION_PLANE = void 0;
+    exports.buildLoadContributionPlane = buildLoadContributionPlane;
+    var types_1 = require_dist4();
+    exports.EMPTY_LOAD_CONTRIBUTION_PLANE = {
+      contributions: async () => []
+    };
+    function buildLoadContributionPlane(source, onProviderError) {
+      return {
+        contributions: async () => {
+          const out = [];
+          for (const [addonId, provider] of source.entries()) {
+            try {
+              for (const entry of await provider.list()) {
+                out.push({ ...entry, addonId });
+              }
+            } catch (err) {
+              onProviderError?.(addonId, (0, types_1.errMsg)(err));
+            }
+          }
+          return out;
+        }
+      };
+    }
+  }
+});
+
 // ../../server/backend/dist/api/core/logging-settings.js
 var require_logging_settings = __commonJS({
   "../../server/backend/dist/api/core/logging-settings.js"(exports) {
@@ -403872,6 +406043,7 @@ var require_cap_providers = __commonJS({
     var agent_installed_packages_js_1 = require_agent_installed_packages();
     var http_request_census_singleton_js_1 = require_http_request_census_singleton();
     var collection_preference_js_1 = require_collection_preference();
+    var load_contributions_js_1 = require_load_contributions();
     var logging_settings_js_1 = require_logging_settings();
     var request_census_settings_js_1 = require_request_census_settings();
     var site_location_js_1 = require_site_location();
@@ -403889,6 +406061,9 @@ var require_cap_providers = __commonJS({
       const channels = (0, logging_settings_js_1.buildLogChannelPlane)({ entries: () => registry?.getCollectionEntries("log-channels") ?? [] }, (addonId, phase, error) => {
         logger?.warn("log-channels provider unreachable", { meta: { addonId, phase, error } });
       });
+      const loadContributions = (0, load_contributions_js_1.buildLoadContributionPlane)({ entries: () => registry?.getCollectionEntries("load-contribution") ?? [] }, (addonId, error) => {
+        logger?.warn("load-contribution provider unreachable", { meta: { addonId, error } });
+      });
       const loggingSettings = new logging_settings_js_1.LoggingSettingsService({
         store,
         gate: (0, system_1.getLoggingGate)(),
@@ -403915,6 +406090,7 @@ var require_cap_providers = __commonJS({
           }
           return result;
         },
+        getLoadContributions: async () => loadContributions.contributions(),
         getRetentionConfig: async () => getRetention(registry)?.getConfig() ?? null,
         setRetentionConfig: async (input) => {
           getRetention(registry)?.setConfig(input);
@@ -417610,7 +419786,7 @@ var require_main4 = __commonJS({
     async function bootstrap() {
       const heapReclaimer = (0, system_1.createV8Reclaimer)();
       const heapReclaim = heapReclaimer === void 0 ? void 0 : { reclaim: heapReclaimer };
-      (0, system_1.startHeapWatch)("hub-main", void 0, void 0, heapReclaim);
+      (0, system_1.startHeapWatch)("hub-main", void 0, void 0, heapReclaim, void 0, void 0, true, (0, system_1.hubMainRssBudget)());
       cleanupOrphanProcesses();
       let spaIndexHtml = null;
       const configPath = process.env.CONFIG_PATH ?? path.join(process.env.CAMSTACK_DATA ?? path.join(process.cwd(), "camstack-data"), "config.yaml");