deepline 0.3.128 → 0.3.129

package/dist/bundling-sources/shared_libs/play-runtime/map-memory-limits.ts

@@ -1,13 +1,32 @@
+import { readFileSync } from 'node:fs';
+import { availableParallelism } from 'node:os';
+import {
+  PerformanceObserver,
+  constants as perfConstants,
+} from 'node:perf_hooks';
+import { getHeapStatistics } from 'node:v8';
+
+import type {
+  RuntimeMemoryLedger,
+  RuntimeMemoryLedgerCategory,
+  RuntimeMemoryLedgerSnapshot,
+} from './memory-ledger';
+import {
+  RUNTIME_MEMORY_LEDGER_CATEGORIES,
+  RUNTIME_MEMORY_LEDGER_INITIAL_FACTOR,
+  runtimeJsonByteLength,
+} from './memory-ledger';
+import {
+  onMemoryPressure as subscribeRuntimeMemoryPressure,
+  reportMemoryLedger as publishRuntimeMemoryLedger,
+} from './memory-pressure-signal';
+
 export const NODE_RUNTIME_MAP_MEMORY_BUDGET_BYTES = 512 * 1024 * 1024;
-export const NODE_RUNTIME_MAP_ACTIVE_ROWS_MEMORY_BUDGET_BYTES =
-  384 * 1024 * 1024;
 export const NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER = 4;
-export const NODE_RUNTIME_MAP_ACTIVE_ROW_MEMORY_MULTIPLIER = 3;
 export const NODE_RUNTIME_MAP_ROW_OVERHEAD_BYTES = 512;
 
 export type RuntimeMapMemoryLimits = {
   materializedBudgetBytes: number;
-  activeRowsBudgetBytes: number;
 };
 
 export type RuntimeMapMemoryEstimate = {
@@ -17,12 +36,1633 @@ export type RuntimeMapMemoryEstimate = {
   largestRowBytes: number;
 };
 
-export type RuntimeMapRowAdmission = {
+export const RUNTIME_GC_KINDS = [
+  'minor',
+  'major',
+  'incremental',
+  'weakcb',
+  'other',
+] as const;
+export type RuntimeGcKind = (typeof RUNTIME_GC_KINDS)[number];
+
+export type RuntimeGcKindStats = {
+  count: number;
+  totalMs: number;
+  maxMs: number;
+  /** Epoch ms at which the last collection of this kind finished. */
+  lastCompletedAtMs: number | null;
+};
+
+/**
+ * What the collector actually cost, from V8 rather than from a guess.
+ *
+ * A 1-CPU sandbox holding a ~500 MB heap of megabyte response bodies pays for
+ * every major collection in event-loop lag: the jai runner showed p90 0.6 s /
+ * p99 0.8 s while a light map showed none. Without this the lag is visible but
+ * unattributable, and admission cannot tell a slow provider from a stalled
+ * process.
+ */
+export type RuntimeGcObservation = {
+  /** False when this runtime delivers no `gc` performance entries. */
+  observing: boolean;
+  count: number;
+  totalMs: number;
+  maxMs: number;
+  byKind: Record<RuntimeGcKind, RuntimeGcKindStats>;
+};
+
+export type RuntimeGcObserver = {
+  snapshot(): RuntimeGcObservation;
+  close(): void;
+};
+
+function emptyGcKindStats(): RuntimeGcKindStats {
+  return { count: 0, totalMs: 0, maxMs: 0, lastCompletedAtMs: null };
+}
+
+function gcKindFromEntry(entry: {
+  kind?: number;
+  detail?: { kind?: number } | null;
+}): RuntimeGcKind {
+  const kind = entry.detail?.kind ?? entry.kind;
+  switch (kind) {
+    case perfConstants.NODE_PERFORMANCE_GC_MINOR:
+      return 'minor';
+    case perfConstants.NODE_PERFORMANCE_GC_MAJOR:
+      return 'major';
+    case perfConstants.NODE_PERFORMANCE_GC_INCREMENTAL:
+      return 'incremental';
+    case perfConstants.NODE_PERFORMANCE_GC_WEAKCB:
+      return 'weakcb';
+    default:
+      return 'other';
+  }
+}
+
+/**
+ * Tally every collection V8 reports. Installed once per process: the entries
+ * are process-wide, so a per-map observer would only multiply the callbacks
+ * without changing the numbers. Unref'd, so it never holds the runner open.
+ */
+export function createRuntimeGcObserver(): RuntimeGcObserver {
+  const byKind = Object.fromEntries(
+    RUNTIME_GC_KINDS.map((kind) => [kind, emptyGcKindStats()]),
+  ) as Record<RuntimeGcKind, RuntimeGcKindStats>;
+  let count = 0;
+  let totalMs = 0;
+  let maxMs = 0;
+  let observing = false;
+  let observer: PerformanceObserver | null = null;
+  try {
+    observer = new PerformanceObserver((list) => {
+      for (const entry of list.getEntries()) {
+        const durationMs = Number.isFinite(entry.duration) ? entry.duration : 0;
+        const stats =
+          byKind[
+            gcKindFromEntry(
+              entry as unknown as {
+                kind?: number;
+                detail?: { kind?: number } | null;
+              },
+            )
+          ];
+        stats.count += 1;
+        stats.totalMs += durationMs;
+        stats.maxMs = Math.max(stats.maxMs, durationMs);
+        // `startTime` is milliseconds since `timeOrigin`, so this is the same
+        // clock the admission cooldown compares against.
+        stats.lastCompletedAtMs =
+          performance.timeOrigin + entry.startTime + durationMs;
+        count += 1;
+        totalMs += durationMs;
+        maxMs = Math.max(maxMs, durationMs);
+      }
+    });
+    observer.observe({ entryTypes: ['gc'] });
+    (observer as { unref?: () => void }).unref?.();
+    observing = true;
+  } catch {
+    // A runtime without `gc` performance entries is not a failure: admission
+    // reports that it is not observing rather than inventing zeroes that look
+    // like a collector that never ran.
+    observer = null;
+    observing = false;
+  }
+  return {
+    snapshot: () => ({
+      observing,
+      count,
+      totalMs,
+      maxMs,
+      byKind: Object.fromEntries(
+        RUNTIME_GC_KINDS.map((kind) => [kind, { ...byKind[kind] }]),
+      ) as Record<RuntimeGcKind, RuntimeGcKindStats>,
+    }),
+    close: () => {
+      observer?.disconnect();
+      observer = null;
+      observing = false;
+    },
+  };
+}
+
+let sharedGcObserver: RuntimeGcObserver | null = null;
+
+/** The process-wide collector tally, installed on first use. */
+export function runtimeGcObserver(): RuntimeGcObserver {
+  sharedGcObserver ??= createRuntimeGcObserver();
+  return sharedGcObserver;
+}
+
+/** A sampled V8 heap view; no customer data is retained in this diagnostic. */
+export type RuntimeMapHeapSnapshot = {
+  usedHeapBytes: number;
+  heapLimitBytes: number;
+  /**
+   * Native memory owned by JS objects (decoded response Buffers, ArrayBuffers).
+   * V8's heapUsed excludes it, yet it is freed with its owners, so it is part
+   * of the live footprint the map can actually shrink.
+   */
+  externalBytes?: number;
+  /**
+   * The process working set. It is what the sandbox cgroup kills on, but Node
+   * rarely returns freed pages to the OS, so RSS only proves proximity to the
+   * cliff; it never proves that memory is still in use.
+   */
+  residentBytes?: number;
+};
+
+export type RuntimeMapHeapAdmissionSnapshot = {
+  activeRows: number;
+  activeRowPeak: number;
+  admittedRows: number;
+  /** Rows that have released their lease. */
+  settledRows: number;
+  /** Rows queued for admission right now: the latch this window can hold. */
+  waitingRows: number;
   concurrency: number;
-  estimatedBytesPerActiveRow: number;
-  estimatedResidentBytes: number;
+  maxConcurrency: number;
+  heapLimitBytes: number | null;
+  heapTargetBytes: number | null;
+  heapUsedBytes: number | null;
+  heapUsedPeakBytes: number | null;
+  /** heapUsed + external: the footprint that shrinks when rows settle. */
+  liveBytes: number | null;
+  liveBaselineBytes: number | null;
+  livePeakBytes: number | null;
+  /**
+   * Bytes reserved per admitted row while it has not started materializing a
+   * provider response. In deferred-body mode this is the learned row promise,
+   * capped at the unknown full-row prior; decoded responses are separately
+   * admitted at materialization.
+   */
+  rowReserveBytes: number | null;
+  /** Whether decoded provider bodies are reserved at materialization. */
+  providerBodyReservationDeferred: boolean;
+  /** Compact per-row reserve used while body reservation is deferred. */
+  waitingRowReserveBytes: number | null;
+  /**
+   * The ledger's settled p90 per-row peak scaled by the calibration factor:
+   * the live bytes one more row is expected to cost. Null until enough rows
+   * have settled, where the unmeasured prior stands instead.
+   */
+  measuredRowBytes: number | null;
+  /**
+   * Settled per-row peaks behind `measuredRowBytes`. A reserve with none
+   * behind it is still the unmeasured prior, which is why the readout carries
+   * the count.
+   */
+  footprintSamples: number;
+  /**
+   * Retained for readout compatibility. Under byte admission the per-row cost
+   * comes from the ledger's settled owners, never from a probe quotient, so no
+   * minimum in-flight width gates it; this echoes the configured input.
+   */
+  footprintSampleMinActiveRows: number;
+  /** Ledger bytes x calibration factor: the live footprint the ledger predicts. */
+  predictedLiveBytes: number | null;
+  /**
+   * `liveBaselineBytes + predictedLiveBytes`: what admission divides headroom
+   * against. The ledger, not the probe, is the estimator — with a large old
+   * space V8 lets garbage pile toward the limit before a major GC, so
+   * `heapUsed + external` is mostly garbage between collections and pacing on
+   * it collapses the window to one row (jai run 34074320144: 139/1000 rows in
+   * 25 minutes with the calibration factor pinned at its clamp).
+   */
+  occupiedBytes: number | null;
+  /**
+   * The byte ledger at the last probe, with what the collector cost alongside
+   * it; null when no ledger is attached.
+   */
+  memory: RuntimeMapMemorySnapshot | null;
+  /** Watchdog pressure signals delivered from outside this process. */
+  externalPressureSignals: number;
+  /** Probes that paused new row admission while pressure was active. */
+  admissionHolds: number;
+  /**
+   * Whether memory pressure is currently pausing new row admission. The
+   * computed concurrency remains the next safe width so a short pressure
+   * episode cannot turn the rest of a map into a serial tail.
+   */
+  admissionPaused: boolean;
+  /**
+   * What the collector cost this process. Also carried inside `memory`, and
+   * repeated here because the terminal runtime-resources summary keeps the
+   * per-map admission snapshot but drops its copy of the process-wide ledger.
+   */
+  gc: RuntimeGcObservation | null;
+  /** Whether this runner can collect on demand (`node --expose-gc`). */
+  gcAvailable: boolean;
+  /** Collections this admission asked for itself. */
+  gcExplicitCount: number;
+  /** Wall time spent inside those explicit collections. */
+  gcExplicitTotalMs: number;
+  /**
+   * Age of the last collection admission counted on — its own, or a major one
+   * V8 ran on its own account. Null before the first.
+   */
+  lastGcAgeMs: number | null;
+  limitedByHeap: boolean;
+  /** The sandbox memory limit the RSS guard is derived from, when readable. */
+  cgroupLimitBytes: number | null;
+  /**
+   * CPU cores the sandbox may actually use (cgroup quota / period), so a
+   * readout labels a 2 vCPU session as one instead of asserting it in prose.
+   * Null only when neither cgroup interface nor the host count is readable.
+   */
+  cpuCount: number | null;
+  residentGuardBytes: number | null;
+  residentBytes: number | null;
+  residentPeakBytes: number | null;
+  limitedByResidentMemory: boolean;
+  /** Distinguishes V8 graph pressure from Buffer/native response pressure. */
+  heapPressureEvents: number;
+  residentPressureEvents: number;
+  /** Admission was held because the event loop could not keep up. */
+  limitedByEventLoop: boolean;
+  eventLoopPressureEvents: number;
+  /** Row ceiling set by event-loop lag; maxConcurrency when it never lagged. */
+  eventLoopCeiling: number;
+  /** The last event-loop lag reading admission acted on, if it had one. */
+  eventLoopLagMs: number | null;
+  memoryPressureEvents: number;
+};
+
+/**
+ * The subset of a heap probe the admission decision needs as non-null numbers.
+ * Returned rather than read back off the mutable snapshot fields so a
+ * post-collection re-probe replaces the reading it supersedes.
+ */
+type HeapReading = {
+  heapLimitBytes: number;
+  heapTargetBytes: number;
+  liveBytes: number;
+  liveBaselineBytes: number;
+  residentBytes: number | null;
+  residentGuardBytes: number;
+};
+
+/** The byte ledger plus the collector cost measured over the same process. */
+export type RuntimeMapMemorySnapshot = RuntimeMemoryLedgerSnapshot & {
+  /** Process-wide collector tally, or null when nothing is observing. */
+  gc: RuntimeGcObservation | null;
 };
 
+export type RuntimeMapHeapAdmissionLease = {
+  release(): void;
+};
+
+export type RuntimeMapHeapAdmission = {
+  acquire(): Promise<RuntimeMapHeapAdmissionLease>;
+  /** Sample V8 and admit any newly safe waiting rows. Useful for deterministic tests. */
+  reconcile(): void;
+  /** Reject waiters after a row failure, or release the timer after normal completion. */
+  close(error?: unknown): RuntimeMapHeapAdmissionSnapshot;
+  snapshot(): RuntimeMapHeapAdmissionSnapshot;
+};
+
+// Upper bound of the opening wave, before any probe has run. It is not a row
+// limit in its own right: the construction-time clamp below divides probed
+// headroom by the unmeasured per-row reserve and almost always lands far under
+// it (146 rows on a 1 GiB sandbox), and every later width comes from bytes.
+// It exists because acquire() is called by every row worker before the first
+// probe, so the wave has to be bounded by *something* in the same tick.
+const RUNTIME_MAP_HEAP_INITIAL_CONCURRENCY = 256;
+const RUNTIME_MAP_HEAP_PROBE_INTERVAL_MS = 25;
+// Live memory (heapUsed + external) may fill this share of the heap limit.
+// Live is not what the cgroup kills on: RSS runs about 1.3-1.5x live plus the
+// runtime's own baseline, so a 65% live target on the 960 MiB heap limit of a
+// 1 GiB sandbox authorizes 624 MiB of live bytes and lands RSS on the cliff.
+// The measured jai shape (~2.5-4 MB live per row) proves both sides of it: one
+// run survived at 364 rows in flight only by peaking at 964 MB RSS inside a
+// 1 GiB cgroup, and the next died of RUNTIME_SANDBOX_OOM at 205 settled rows
+// with 256 in flight. Half the heap limit keeps the RSS that follows from a
+// full window inside the sandbox instead of one settling wave away from it.
+const RUNTIME_MAP_HEAP_TARGET_UTILIZATION = 0.5;
+/**
+ * Event-loop lag (EWMA of timer delay) above which admission holds. Memory
+ * headroom alone let a one-vCPU sandbox keep 1,000 rows active pinned to the
+ * heap target, where V8 collected continuously and the runner's own
+ * heartbeats and result writes could no longer get scheduled.
+ */
+export const RUNTIME_MAP_EVENT_LOOP_LAG_HOLD_MS = 250;
+/**
+ * While the loop lags, the row ceiling is cut to this fraction of the active
+ * set once per adjust interval; once it keeps up, the ceiling grows back by
+ * a tenth per interval. Holding alone could only stop new rows: the window
+ * had already ramped to its cap before the lag sampler could register it.
+ */
+const RUNTIME_MAP_EVENT_LOOP_SHRINK_FACTOR = 0.75;
+const RUNTIME_MAP_EVENT_LOOP_GROW_FRACTION = 0.1;
+export const RUNTIME_MAP_EVENT_LOOP_ADJUST_INTERVAL_MS = 2_000;
+// RSS is the number the sandbox actually kills on, so the guard belongs on the
+// cgroup limit, not on the heap limit. The runner now sets its old space to
+// roughly half the cgroup, so a guard expressed as a share of heap_size_limit
+// would sit at ~364 MB of a 1 GiB sandbox — below the RSS a healthy map holds
+// once Node stops returning freed pages, which would latch the window shut.
+// The watchdog signals pressure at 0.8 of the cgroup and aborts at 0.92, so a
+// guard above 0.8 could never fire before the watchdog had already spoken.
+const RUNTIME_MAP_RESIDENT_GUARD_CGROUP_FRACTION = 0.8;
+// Fallback when the cgroup limit is unreadable (a local run, a host without
+// cgroups). Derivation: old space is set to ~50% of the cgroup, so the cgroup
+// is ~2x heap_size_limit; a full old space plus the young generation
+// (~16 MiB semi-space, three of them live during a scavenge) plus the runner's
+// own native baseline lands RSS near 1.45x heap_size_limit before the cgroup
+// is in danger. Measured 1k runs agree: a kareem map peaked at 379 MB RSS on
+// a 256 MB heap limit.
+const RUNTIME_MAP_RESIDENT_GUARD_HEAP_MULTIPLE = 1.45;
+const CGROUP_V2_MEMORY_MAX_PATH = '/sys/fs/cgroup/memory.max';
+const CGROUP_V1_MEMORY_LIMIT_PATH =
+  '/sys/fs/cgroup/memory/memory.limit_in_bytes';
+// Minimum wall time between admission-requested collections. A full collection
+// of a ~500 MB heap of megabyte response bodies on a 1-CPU sandbox costs
+// 0.3-1 s of event-loop lag — the jai runner measured p90 0.6 s / p99 0.8 s —
+// so an explicit collection is a real cost, not a free measurement. Five
+// seconds keeps it under a few percent of wall while still answering the
+// garbage question faster than a map can fill the sandbox. The observer below
+// makes most of these unnecessary anyway: if V8 already ran a major collection
+// inside the interval, admission re-probes instead of paying for its own.
+const RUNTIME_MAP_GC_MIN_INTERVAL_MS = 5_000;
+// RSS near the cliff only means danger while live memory is itself
+// substantial. Node keeps freed pages, so a high RSS over a small live
+// footprint is a stale plateau: new rows reuse those pages and RSS does not
+// grow. Below this share of the live target the guard is ignored.
+const RUNTIME_MAP_RESIDENT_GUARD_LIVE_FRACTION = 0.5;
+// New rows admitted per probe: a 1,000-row window ramps in ~0.4 s while every
+// step is checked against live memory, instead of one blind launch wave.
+const RUNTIME_MAP_HEAP_GROWTH_STEP_MAX = 64;
+// Reserve per row before the ledger has settled enough rows to state one. It
+// must cover a large provider response outright: a thousand optimistic guesses
+// arriving as one wave of decoded bodies is exactly how a 1 GiB sandbox dies
+// before the ledger can say anything. 3 MiB opens ~150 rows of an unknown
+// shape on the 960 MiB heap limit of a 1 GiB sandbox, where 2 MiB opened
+// ~300 and a heavy shape reached the cliff before a single row had settled.
+// The cost is paid only until 16 rows settle: a light shape's measured
+// footprint replaces this prior within the first probes and the window
+// widens, while a heavy shape never gets to the cliff to begin with.
+export const RUNTIME_MAP_ROW_RESERVE_DEFAULT_BYTES = 3 * 1024 * 1024;
+// Publish cadence for the byte ledger the watchdog attaches to a memory abort.
+const RUNTIME_MAP_LEDGER_PUBLISH_INTERVAL_MS = 1_000;
+const RUNTIME_MAP_ROW_RESERVE_MIN_BYTES = 64 * 1024;
+// Settled rows the ledger needs before its p90 per-row peak replaces the
+// prior. Sixteen settled peaks make a p90 mean something without making the
+// map wait for a tenth of itself to finish.
+const RUNTIME_MAP_FOOTPRINT_SAMPLE_ROWS = 16;
+// Retained input default for the snapshot field of the same name. Byte
+// admission derives the per-row cost from the ledger's settled owners, so no
+// in-flight width gates a measurement any more; see the snapshot type.
+const RUNTIME_MAP_ROW_FOOTPRINT_SAMPLE_MIN_ACTIVE_ROWS = 16;
+const RUNTIME_MAP_ROW_FOOTPRINT_SAMPLE_MIN_ACTIVE_ROWS_DIVISOR = 4;
+// Rows the window may exceed the opening width by, per row that has fully
+// settled. This paces growth; it does not cap the map. Admission cannot be
+// undone: a row admitted while a downstream lane is slow holds every body it
+// has already fetched until that lane drains, so a window that grows faster
+// than rows finish fills the sandbox with bodies the ledger has not yet had a
+// settled row to price (jai: 1,000 rows each holding an enformion result while
+// ~490 agent calls queued on a 30-permit lane). Rows keep arriving for as long
+// as rows keep finishing, so a map of any size still runs to completion.
+const RUNTIME_MAP_ROWS_PER_SETTLED_ROW = 4;
+
+/**
+ * The runner's real heap, rather than input JSON size, is the authority for
+ * how many live resolver graphs it may hold. A failed probe deliberately
+ * disables this adaptive layer; the existing structural input limits remain.
+ */
+/**
+ * The sandbox memory limit as the kernel states it, read once at construction.
+ *
+ * V8's `heap_size_limit` is a JS-heap ceiling the runner chooses; the cgroup
+ * limit is what the sandbox is actually killed on and what the watchdog
+ * measures against. An unreadable or absent limit is not a failure — a local
+ * run has no cgroup — so the caller falls back to a documented multiple of the
+ * heap limit rather than guessing a sandbox size.
+ */
+export function readCgroupMemoryLimitBytes(options?: {
+  /** Seam for tests; production reads the two cgroup interface files. */
+  readFile?: (path: string) => string;
+}): number | null {
+  const readFile =
+    options?.readFile ?? ((path: string) => readFileSync(path, 'utf8'));
+  for (const path of [CGROUP_V2_MEMORY_MAX_PATH, CGROUP_V1_MEMORY_LIMIT_PATH]) {
+    let raw: string;
+    try {
+      raw = readFile(path).trim();
+    } catch {
+      continue;
+    }
+    // cgroup v2 writes the literal "max" for no limit; v1 writes a sentinel
+    // near 2^63. Neither is a memory limit.
+    if (!raw || raw === 'max') continue;
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value <= 0) continue;
+    if (value >= Number.MAX_SAFE_INTEGER) continue;
+    return value;
+  }
+  return null;
+}
+
+const CGROUP_V2_CPU_MAX_PATH = '/sys/fs/cgroup/cpu.max';
+const CGROUP_V1_CPU_QUOTA_PATH = '/sys/fs/cgroup/cpu/cpu.cfs_quota_us';
+const CGROUP_V1_CPU_PERIOD_PATH = '/sys/fs/cgroup/cpu/cpu.cfs_period_us';
+
+/**
+ * The CPU the sandbox may actually use: cgroup v2 `cpu.max` ("quota period"
+ * or "max period"), else cgroup v1 quota/period, else the host's parallelism.
+ * The host count is the wrong answer inside a sandbox (Daytona reports the
+ * host's 48-64 cores against a quota of one), so it is only the fallback for
+ * an unlimited or unreadable cgroup.
+ */
+export function readCgroupCpuLimitCores(options?: {
+  readFile?: (path: string) => string;
+  hostCpuCount?: () => number;
+}): number | null {
+  const readFile =
+    options?.readFile ?? ((path: string) => readFileSync(path, 'utf8'));
+  const hostCpuCount = options?.hostCpuCount ?? availableParallelism;
+  const quotaCores = (quotaRaw: string, periodRaw: string): number | null => {
+    const quota = Number(quotaRaw);
+    const period = Number(periodRaw);
+    if (!Number.isFinite(quota) || !Number.isFinite(period)) return null;
+    if (quota <= 0 || period <= 0) return null;
+    return Math.max(quota / period, 0.01);
+  };
+  try {
+    const [quota, period] = readFile(CGROUP_V2_CPU_MAX_PATH)
+      .trim()
+      .split(/\s+/, 2);
+    if (quota && quota !== 'max' && period) {
+      const cores = quotaCores(quota, period);
+      if (cores !== null) return cores;
+    }
+  } catch {
+    try {
+      const cores = quotaCores(
+        readFile(CGROUP_V1_CPU_QUOTA_PATH).trim(),
+        readFile(CGROUP_V1_CPU_PERIOD_PATH).trim(),
+      );
+      if (cores !== null) return cores;
+    } catch {
+      // No cgroup CPU interface: fall through to the host count.
+    }
+  }
+  const host = hostCpuCount();
+  return Number.isFinite(host) && host > 0 ? host : null;
+}
+
+export function readRuntimeMapHeapSnapshot(): RuntimeMapHeapSnapshot | null {
+  try {
+    const memoryUsage = process.memoryUsage();
+    const usedHeapBytes = memoryUsage.heapUsed;
+    const heapLimitBytes = getHeapStatistics().heap_size_limit;
+    if (
+      !Number.isFinite(usedHeapBytes) ||
+      !Number.isFinite(heapLimitBytes) ||
+      usedHeapBytes < 0 ||
+      heapLimitBytes <= 0
+    ) {
+      return null;
+    }
+    return {
+      usedHeapBytes,
+      heapLimitBytes,
+      externalBytes:
+        Number.isFinite(memoryUsage.external) && memoryUsage.external >= 0
+          ? memoryUsage.external
+          : undefined,
+      residentBytes: Number.isFinite(memoryUsage.rss)
+        ? memoryUsage.rss
+        : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What the runtime is occupying, and what one more unit of work may cost.
+ *
+ * This is the single statement of the memory invariant's arithmetic. Map row
+ * admission and completed-receipt hydration both admit against it, so neither
+ * can drift into a private notion of "full" — and neither states a limit as a
+ * count of anything.
+ */
+export type RuntimeMemoryOccupancy = {
+  /** Live bytes the process may hold: a share of the V8 heap limit. */
+  heapTargetBytes: number;
+  /** `heapUsed + external` at the probe this was computed from. */
+  liveBytes: number;
+  liveBaselineBytes: number;
+  /**
+   * Sum over ledger categories of bytes x that category's fitted factor, or
+   * null with no ledger attached.
+   */
+  predictedLiveBytes: number | null;
+  /** `baseline + predictedLive`: what headroom is measured against. */
+  occupiedBytes: number;
+  /** Live bytes still available under the target. Never negative. */
+  headroomBytes: number;
+  /** The ledger's settled p90 per-owner peak in live bytes; null if unmeasured. */
+  measuredOwnerBytes: number | null;
+  /** Live bytes one more owner may cost: the measurement, or the prior. */
+  ownerReserveBytes: number;
+  /**
+   * The same reserve expressed in ledger bytes, which is the unit a
+   * reservation is registered in. Registering live bytes would double-count
+   * the calibration factor the moment the ledger scaled them again.
+   */
+  ownerReserveLedgerBytes: number;
+  /**
+   * The mix-weighted factor the ledger currently implies. Kept for readouts
+   * and for the no-ledger fallback; a lane converting its own reservation to
+   * live bytes must use `categoryFactors` for the category it registers on,
+   * because the mix at the moment it asks is not its own mix.
+   */
+  calibrationFactor: number;
+  /** Live bytes per ledger byte, per category: the conversion each lane owns. */
+  categoryFactors: Record<RuntimeMemoryLedgerCategory, number>;
+  /** Settled owner peaks behind `measuredOwnerBytes`. */
+  footprintSamples: number;
+};
+
+/**
+ * The occupancy arithmetic, with no probing and no state. Both admission
+ * paths call this so the invariant is stated once.
+ */
+export function runtimeMemoryOccupancy(input: {
+  heapLimitBytes: number;
+  liveBytes: number;
+  liveBaselineBytes: number;
+  ledger: RuntimeMemoryLedgerSnapshot | null;
+  footprintSampleRows?: number;
+  ownerReserveDefaultBytes?: number;
+  ownerReserveMinBytes?: number;
+}): RuntimeMemoryOccupancy {
+  const footprintSampleRows = positiveBudget(
+    input.footprintSampleRows,
+    RUNTIME_MAP_FOOTPRINT_SAMPLE_ROWS,
+  );
+  const ownerReserveDefaultBytes = positiveBudget(
+    input.ownerReserveDefaultBytes,
+    RUNTIME_MAP_ROW_RESERVE_DEFAULT_BYTES,
+  );
+  const ownerReserveMinBytes = positiveBudget(
+    input.ownerReserveMinBytes,
+    RUNTIME_MAP_ROW_RESERVE_MIN_BYTES,
+  );
+  const heapTargetBytes = Math.floor(
+    input.heapLimitBytes * RUNTIME_MAP_HEAP_TARGET_UTILIZATION,
+  );
+  const ledger = input.ledger;
+  const predictedLiveBytes = ledger?.predictedLiveBytes ?? null;
+  // The ledger is the estimator and the probe is only the guard; without a
+  // ledger the probe is all there is.
+  const occupiedBytes =
+    predictedLiveBytes === null
+      ? input.liveBytes
+      : input.liveBaselineBytes + predictedLiveBytes;
+  const categoryFactors = runtimeMemoryCategoryFactors(ledger);
+  // A settled owner peak is provider-body bytes: the reserve is what one more
+  // row's decoded body costs. Scaling it by the mix-weighted factor priced a
+  // row from whatever else the process happened to be holding at the probe.
+  const rowFactor = categoryFactors.providerBody;
+  const measuredOwnerBytes =
+    ledger &&
+    ledger.ownerPeakSamples >= footprintSampleRows &&
+    ledger.ownerPeakBytesP90 !== null
+      ? ledger.ownerPeakBytesP90 * rowFactor
+      : null;
+  const ownerReserveBytes =
+    measuredOwnerBytes === null
+      ? ownerReserveDefaultBytes
+      : Math.max(ownerReserveMinBytes, measuredOwnerBytes);
+  const calibrationFactor =
+    ledger && ledger.calibrationFactor > 0
+      ? ledger.calibrationFactor
+      : RUNTIME_MEMORY_LEDGER_INITIAL_FACTOR;
+  return {
+    heapTargetBytes,
+    liveBytes: input.liveBytes,
+    liveBaselineBytes: input.liveBaselineBytes,
+    predictedLiveBytes,
+    occupiedBytes,
+    headroomBytes: Math.max(0, heapTargetBytes - occupiedBytes),
+    measuredOwnerBytes,
+    ownerReserveBytes,
+    ownerReserveLedgerBytes: Math.max(
+      1,
+      Math.ceil(ownerReserveBytes / rowFactor),
+    ),
+    calibrationFactor,
+    categoryFactors,
+    footprintSamples: ledger?.ownerPeakSamples ?? 0,
+  };
+}
+
+/**
+ * The per-category live-bytes-per-ledger-byte conversion a lane should use.
+ *
+ * With a ledger attached these are its fitted factors. Without one — a runtime
+ * whose heap cannot be read, or a snapshot published before per-category
+ * calibration existed — every category falls back to whatever single factor
+ * that snapshot carries, so an old readout still converts the way it used to
+ * rather than silently switching to a prior it never measured.
+ */
+export function runtimeMemoryCategoryFactors(
+  ledger: RuntimeMemoryLedgerSnapshot | null,
+): Record<RuntimeMemoryLedgerCategory, number> {
+  const factors = {} as Record<RuntimeMemoryLedgerCategory, number>;
+  const legacyFactor =
+    ledger && ledger.calibrationFactor > 0
+      ? ledger.calibrationFactor
+      : RUNTIME_MEMORY_LEDGER_INITIAL_FACTOR;
+  for (const category of RUNTIME_MEMORY_LEDGER_CATEGORIES) {
+    const fitted = ledger?.categoryFactors?.[category];
+    factors[category] =
+      typeof fitted === 'number' && Number.isFinite(fitted) && fitted > 0
+        ? fitted
+        : legacyFactor;
+  }
+  return factors;
+}
+
+export type RuntimeMemoryOccupancyReader = {
+  /**
+   * Current occupancy, or null when this runtime has no readable heap. A null
+   * reading disables byte admission for its caller rather than inventing a
+   * limit out of a probe that did not answer.
+   */
+  read(): RuntimeMemoryOccupancy | null;
+  /**
+   * Answer the garbage question the same way map admission does: let V8's own
+   * recent major collection stand, otherwise collect (rate limited), then
+   * re-probe. Returns the post-collection reading, or null when no collection
+   * happened and the caller's reading still stands.
+   */
+  collectAndRead(): RuntimeMemoryOccupancy | null;
+  snapshot(): {
+    /** Heap probes taken, and probes served from the interval cache. */
+    probes: number;
+    cachedProbes: number;
+    /** Collections this reader asked for, and what they cost. */
+    gcCount: number;
+    gcTotalMs: number;
+    gcAvailable: boolean;
+  };
+};
+
+/**
+ * A process-wide occupancy reader.
+ *
+ * Map row admission owns its own probe loop because it also carries the RSS
+ * guard, the watchdog hold, and calibration. A lane that only needs to ask
+ * "do these bytes fit" gets this instead: the same arithmetic, the same
+ * collect-before-you-conclude rule, and a probe cached for the same interval
+ * so asking the question often costs no more than asking it once.
+ */
+export function createRuntimeMemoryOccupancyReader(input: {
+  memoryLedger: RuntimeMemoryLedger;
+  heapProbe?: () => RuntimeMapHeapSnapshot | null;
+  /** Omit for the runner's `--expose-gc` hook; null states it cannot collect. */
+  collectGarbage?: (() => void) | null;
+  observeGc?: (() => RuntimeGcObservation) | null;
+  probeIntervalMs?: number;
+  gcMinIntervalMs?: number;
+  footprintSampleRows?: number;
+  ownerReserveDefaultBytes?: number;
+  ownerReserveMinBytes?: number;
+  now?: () => number;
+}): RuntimeMemoryOccupancyReader {
+  const heapProbe = input.heapProbe ?? readRuntimeMapHeapSnapshot;
+  const probeIntervalMs = positiveBudget(
+    input.probeIntervalMs,
+    RUNTIME_MAP_HEAP_PROBE_INTERVAL_MS,
+  );
+  const gcMinIntervalMs = positiveBudget(
+    input.gcMinIntervalMs,
+    RUNTIME_MAP_GC_MIN_INTERVAL_MS,
+  );
+  const runtimeGc =
+    input.collectGarbage === undefined
+      ? ((globalThis as { gc?: () => void }).gc?.bind(globalThis) ?? null)
+      : input.collectGarbage;
+  const gcObserver =
+    input.observeGc === undefined
+      ? () => runtimeGcObserver().snapshot()
+      : input.observeGc;
+  const now = input.now ?? Date.now;
+  let heapLimitBytes: number | null = null;
+  let liveBytes: number | null = null;
+  let liveBaselineBytes: number | null = null;
+  let lastProbeAtMs: number | null = null;
+  let lastGcAtMs: number | null = null;
+  let probes = 0;
+  let cachedProbes = 0;
+  let gcCount = 0;
+  let gcTotalMs = 0;
+
+  const sampleHeap = (): boolean => {
+    const heap = heapProbe();
+    if (!heap) return false;
+    probes += 1;
+    heapLimitBytes = heap.heapLimitBytes;
+    liveBytes = heap.usedHeapBytes + Math.max(0, heap.externalBytes ?? 0);
+    // The baseline is the first reading this reader ever took, which for a run
+    // is taken before any row work: the same "before the work" meaning map
+    // admission gives it.
+    liveBaselineBytes ??= liveBytes;
+    lastProbeAtMs = now();
+    return true;
+  };
+
+  const occupancy = (): RuntimeMemoryOccupancy | null => {
+    if (heapLimitBytes === null || liveBytes === null) return null;
+    return runtimeMemoryOccupancy({
+      heapLimitBytes,
+      liveBytes,
+      liveBaselineBytes: liveBaselineBytes ?? liveBytes,
+      // Read every time, never cached: a reservation registered a microsecond
+      // ago must be visible to the next admission decision, or the lane admits
+      // twice against the same headroom.
+      ledger: input.memoryLedger.snapshot(),
+      ...(input.footprintSampleRows === undefined
+        ? {}
+        : { footprintSampleRows: input.footprintSampleRows }),
+      ...(input.ownerReserveDefaultBytes === undefined
+        ? {}
+        : { ownerReserveDefaultBytes: input.ownerReserveDefaultBytes }),
+      ...(input.ownerReserveMinBytes === undefined
+        ? {}
+        : { ownerReserveMinBytes: input.ownerReserveMinBytes }),
+    });
+  };
+
+  return {
+    read() {
+      const staleAtMs = lastProbeAtMs;
+      if (staleAtMs === null || now() - staleAtMs >= probeIntervalMs) {
+        if (!sampleHeap() && heapLimitBytes === null) return null;
+      } else {
+        cachedProbes += 1;
+      }
+      return occupancy();
+    },
+    collectAndRead() {
+      const startedAt = now();
+      const lastMajorAtMs =
+        gcObserver?.().byKind.major.lastCompletedAtMs ?? null;
+      if (
+        lastMajorAtMs !== null &&
+        startedAt - lastMajorAtMs < gcMinIntervalMs &&
+        lastMajorAtMs > (lastGcAtMs ?? Number.NEGATIVE_INFINITY)
+      ) {
+        // V8 already swept inside the interval; re-probing reads live objects
+        // without paying for a second sweep of them.
+        lastGcAtMs = lastMajorAtMs;
+        return sampleHeap() ? occupancy() : null;
+      }
+      if (runtimeGc === null) return null;
+      if (lastGcAtMs !== null && startedAt - lastGcAtMs < gcMinIntervalMs) {
+        return null;
+      }
+      runtimeGc();
+      const finishedAt = now();
+      gcCount += 1;
+      gcTotalMs += Math.max(0, finishedAt - startedAt);
+      lastGcAtMs = finishedAt;
+      return sampleHeap() ? occupancy() : null;
+    },
+    snapshot: () => ({
+      probes,
+      cachedProbes,
+      gcCount,
+      gcTotalMs,
+      gcAvailable: runtimeGc !== null,
+    }),
+  };
+}
+
+/**
+ * Admit row resolver bodies against the bytes the runtime says it is holding.
+ * This is intentionally separate from provider admission: it owns only
+ * resident JS graphs, while AIMD continues to decide provider dispatch.
+ * Pending rows are waiters, not created resolver bodies, so a wide requested
+ * concurrency cannot create a one-shot heap spike before the first provider
+ * response arrives.
+ *
+ * Nothing here caps the map by a row count. The opening wave is bounded by
+ * bytes at construction, every later width is bytes divided by a per-row
+ * reserve, and settlement only paces how fast that width may be reached. A
+ * map of any size runs to completion; it just never holds more bytes than the
+ * sandbox has.
+ *
+ * Policy, in order:
+ *   1. Occupancy is `baseline + ledger.liveBytes x factor`. The ledger is the
+ *      estimator and the heap probe is only a guard. `heapUsed + external` is
+ *      not a live measurement: with a 512 MiB old space V8 lets garbage pile
+ *      toward the limit before it runs a major GC, so between collections the
+ *      probe reads mostly garbage. Pacing on it collapsed a 1,000-row map to
+ *      one row at a time for 25 minutes with the calibration factor pinned at
+ *      its clamp (jai, run 34074320144), because every reading said the
+ *      sandbox was full of rows it had already finished.
+ *   2. Headroom above occupancy is divided by a per-row reserve. The reserve
+ *      is the unmeasured prior until the ledger has settled enough rows to
+ *      state a p90 per-row peak, then that peak scaled by the ledger's
+ *      calibration factor. It is never a probe quotient: dividing heap growth
+ *      by rows in flight read 0.9 MB/row with bodies on the wire and 48 MB/row
+ *      over a draining tail, and admission acted on both.
+ *   3. Observed live crossing the target is a question, not a verdict. The
+ *      answer is a collection: admission collects (at most once every
+ *      `RUNTIME_MAP_GC_MIN_INTERVAL_MS`), re-probes, and holds only if the
+ *      post-collection reading is still over. The same post-collection probes
+ *      are the only ones the ledger calibrates from, so the factor describes
+ *      live objects instead of uncollected garbage.
+ *   4. RSS near the cgroup limit is a hard guard, and a watchdog pressure
+ *      signal from outside the process is another. Both pause new admission,
+ *      release the map's durable results, collect, and reprobe; both release
+ *      only once live memory has visibly dropped. The last safe width is
+ *      retained while paused, so an episode cannot turn the tail serial.
+ */
+export function createRuntimeMapHeapAdmission(input: {
+  maxConcurrency: number;
+  heapProbe?: () => RuntimeMapHeapSnapshot | null;
+  initialConcurrency?: number;
+  probeIntervalMs?: number;
+  /** Settled rows the ledger needs before its p90 per-row peak is trusted. */
+  footprintSampleRows?: number;
+  /** Retained for the snapshot field of the same name; see its documentation. */
+  footprintSampleMinActiveRows?: number;
+  /** Per-row reserve used until the ledger has priced a row. */
+  rowReserveBytes?: number;
+  /** Floor under the ledger reserve so one light row cannot launch a wave. */
+  rowReserveMinBytes?: number;
+  /**
+   * Keep a decoded provider body out of row admission until the response is
+   * about to be read. A shared payload gate then reserves it by bytes, so rows
+   * waiting on provider residence retain only compact local state here.
+   */
+  deferProviderBodyReservationToMaterialization?: boolean;
+  /** Compact waiting-row floor retained in deferred-body diagnostics. */
+  waitingRowReserveBytes?: number;
+  /** Rows admitted per probe while growing toward the safe width. */
+  growthStepRows?: number;
+  /** Rows the window may grow past the opening width per settled row. */
+  rowsPerSettledRow?: number;
+  /**
+   * The runtime's byte ledger. Admission calibrates it on every probe and
+   * prices a row from its settled owners. Without one the unmeasured prior
+   * stands for the whole map, which is honest: nothing measured a row.
+   */
+  memoryLedger?: RuntimeMemoryLedger | null;
+  /**
+   * Gives the map a chance to discard results which have already crossed its
+   * durable egress boundary before memory constrains more row work.
+   */
+  onMemoryPressure?: () => void;
+  /** Watchdog pressure subscription. Overridable for deterministic tests. */
+  subscribeMemoryPressure?: (listener: () => void) => () => void;
+  /**
+   * Recent event-loop lag in milliseconds. While it is at or above
+   * `eventLoopLagHoldMs` admission holds exactly as it does for memory
+   * pressure: active rows drain as they settle and nothing new starts.
+   */
+  getEventLoopLagMs?: () => number | null;
+  eventLoopLagHoldMs?: number;
+  eventLoopAdjustIntervalMs?: number;
+  /** Publishes the snapshot the watchdog attaches to a memory abort. */
+  reportLedger?: (snapshot: RuntimeMapHeapAdmissionSnapshot) => void;
+  /**
+   * Explicit collection. Omit to use the runner's own `--expose-gc` hook; pass
+   * null to state that this runner cannot collect, which changes what
+   * admission is allowed to conclude from a probe.
+   */
+  collectGarbage?: (() => void) | null;
+  /** Minimum wall time between admission-requested collections. */
+  gcMinIntervalMs?: number;
+  /**
+   * Reads the collector tally. Omit to use the process-wide observer; pass
+   * null to run without one (its cost then reads as unobserved, not as zero).
+   * `lastCompletedAtMs` is on the same clock as `now`, so a test that injects
+   * `now` must inject this too rather than let the two disagree.
+   */
+  observeGc?: (() => RuntimeGcObservation) | null;
+  /**
+   * The sandbox memory limit the RSS guard is derived from. Omit to read the
+   * cgroup; pass null to state explicitly that no limit is known.
+   */
+  cgroupLimitBytes?: number | null;
+  /** CPU cores available to the runner. Omit to read the cgroup quota. */
+  cpuCount?: number | null;
+  /** Clock for the collection cooldown. Injectable for deterministic tests. */
+  now?: () => number;
+}): RuntimeMapHeapAdmission {
+  const maxConcurrency = positiveBudget(input.maxConcurrency, 1);
+  const initialConcurrency = Math.min(
+    maxConcurrency,
+    positiveBudget(
+      input.initialConcurrency,
+      RUNTIME_MAP_HEAP_INITIAL_CONCURRENCY,
+    ),
+  );
+  const probeIntervalMs = positiveBudget(
+    input.probeIntervalMs,
+    RUNTIME_MAP_HEAP_PROBE_INTERVAL_MS,
+  );
+  const footprintSampleRows = positiveBudget(
+    input.footprintSampleRows,
+    RUNTIME_MAP_FOOTPRINT_SAMPLE_ROWS,
+  );
+  const footprintSampleMinActiveRows = positiveBudget(
+    input.footprintSampleMinActiveRows,
+    Math.max(
+      RUNTIME_MAP_ROW_FOOTPRINT_SAMPLE_MIN_ACTIVE_ROWS,
+      Math.floor(
+        initialConcurrency /
+          RUNTIME_MAP_ROW_FOOTPRINT_SAMPLE_MIN_ACTIVE_ROWS_DIVISOR,
+      ),
+    ),
+  );
+  const defaultRowReserveBytes = positiveBudget(
+    input.rowReserveBytes,
+    RUNTIME_MAP_ROW_RESERVE_DEFAULT_BYTES,
+  );
+  const growthStepRows = positiveBudget(
+    input.growthStepRows,
+    RUNTIME_MAP_HEAP_GROWTH_STEP_MAX,
+  );
+  const rowReserveMinBytes = positiveBudget(
+    input.rowReserveMinBytes,
+    RUNTIME_MAP_ROW_RESERVE_MIN_BYTES,
+  );
+  const providerBodyReservationDeferred =
+    input.deferProviderBodyReservationToMaterialization === true;
+  const waitingRowReserveBytes = providerBodyReservationDeferred
+    ? positiveBudget(
+        input.waitingRowReserveBytes,
+        RUNTIME_MAP_ROW_RESERVE_MIN_BYTES,
+      )
+    : null;
+  const rowsPerSettledRow = positiveBudget(
+    input.rowsPerSettledRow,
+    RUNTIME_MAP_ROWS_PER_SETTLED_ROW,
+  );
+  const heapProbe = input.heapProbe ?? readRuntimeMapHeapSnapshot;
+  const memoryLedger = input.memoryLedger ?? null;
+  const subscribeMemoryPressure =
+    input.subscribeMemoryPressure ??
+    ((listener: () => void) =>
+      subscribeRuntimeMemoryPressure(() => listener()));
+  const reportLedger = input.reportLedger ?? publishRuntimeMemoryLedger;
+  let lastLedgerPublishMs = 0;
+  // A runner without `--expose-gc` cannot separate live bytes from garbage.
+  // That is not a failure mode to paper over: it changes what a probe proves,
+  // so admission records it and calibrates differently rather than pretending
+  // it collected.
+  const runtimeGc =
+    input.collectGarbage === undefined
+      ? ((globalThis as { gc?: () => void }).gc?.bind(globalThis) ?? null)
+      : input.collectGarbage;
+  const gcAvailable = runtimeGc !== null;
+  const gcMinIntervalMs = positiveBudget(
+    input.gcMinIntervalMs,
+    RUNTIME_MAP_GC_MIN_INTERVAL_MS,
+  );
+  const now = input.now ?? Date.now;
+  const cgroupLimitBytes =
+    input.cgroupLimitBytes === undefined
+      ? readCgroupMemoryLimitBytes()
+      : input.cgroupLimitBytes;
+  const cpuCount =
+    input.cpuCount === undefined ? readCgroupCpuLimitCores() : input.cpuCount;
+  const gcObserver =
+    input.observeGc === undefined
+      ? () => runtimeGcObserver().snapshot()
+      : input.observeGc;
+  let gcExplicitCount = 0;
+  let lastNaturalMajorCalibratedAtMs: number | null = null;
+  let gcExplicitTotalMs = 0;
+  let lastGcAtMs: number | null = null;
+  /**
+   * The last collected verdict on observed live memory. Sticky between
+   * collections: inside the cooldown a probe carries no new evidence, so it
+   * may neither arm the hold on fresh garbage nor release one that a
+   * collection confirmed.
+   */
+  let observedOverTargetConfirmed = false;
+  /** Set by the watchdog handler so the next probe counts as collected. */
+  let nextProbeIsPostCollection = false;
+  let concurrency = initialConcurrency;
+  let activeRows = 0;
+  let activeRowPeak = 0;
+  let admittedRows = 0;
+  let settledRows = 0;
+  let heapLimitBytes: number | null = null;
+  let heapTargetBytes: number | null = null;
+  let heapUsedBytes: number | null = null;
+  let heapUsedPeakBytes: number | null = null;
+  let liveBytes: number | null = null;
+  let liveBaselineBytes: number | null = null;
+  let livePeakBytes: number | null = null;
+  let rowReserveBytes: number | null = null;
+  let measuredRowBytes: number | null = null;
+  let footprintSamples = 0;
+  let predictedLiveBytes: number | null = null;
+  let occupiedBytes: number | null = null;
+  let memorySnapshot: RuntimeMemoryLedgerSnapshot | null = null;
+  let externalPressureSignals = 0;
+  let admissionHolds = 0;
+  let admissionPaused = false;
+  // Live memory observed when the watchdog last signalled. The hold releases
+  // only once live memory has fallen below it, so a signal cannot be answered
+  // by a probe taken before the collection it asked for had any effect.
+  let externalHoldLiveBytes: number | null = null;
+  let limitedByHeap = false;
+  let residentGuardBytes: number | null = null;
+  let residentBytes: number | null = null;
+  let residentPeakBytes: number | null = null;
+  let limitedByResidentMemory = false;
+  let memoryPressureActive = false;
+  let heapPressureEvents = 0;
+  let residentPressureEvents = 0;
+  let limitedByEventLoop = false;
+  let eventLoopPressureEvents = 0;
+  let eventLoopPressureActive = false;
+  let eventLoopLagMs: number | null = null;
+  const eventLoopLagHoldMs = positiveBudget(
+    input.eventLoopLagHoldMs,
+    RUNTIME_MAP_EVENT_LOOP_LAG_HOLD_MS,
+  );
+  const eventLoopAdjustIntervalMs =
+    input.eventLoopAdjustIntervalMs !== undefined &&
+    Number.isFinite(input.eventLoopAdjustIntervalMs) &&
+    input.eventLoopAdjustIntervalMs >= 0
+      ? input.eventLoopAdjustIntervalMs
+      : RUNTIME_MAP_EVENT_LOOP_ADJUST_INTERVAL_MS;
+  let eventLoopCeiling = maxConcurrency;
+  let lastEventLoopAdjustAtMs: number | null = null;
+  let memoryPressureEvents = 0;
+  let closed = false;
+  let closeError: unknown = null;
+  const waiters: Array<{
+    resolve: (lease: RuntimeMapHeapAdmissionLease) => void;
+    reject: (error: unknown) => void;
+  }> = [];
+  {
+    // The baseline must predate the first admitted row, or the ledger's
+    // calibration would credit early bodies to the map's own overhead. It must
+    // also be a collected reading: every calibration sample below is taken
+    // after a collection, and subtracting an uncollected baseline from one
+    // would charge the map's own garbage against it and read the factor low —
+    // the direction that over-admits. One collection per map buys a baseline
+    // the samples are actually comparable to.
+    if (runtimeGc !== null) {
+      const startedAt = now();
+      runtimeGc();
+      const finishedAt = now();
+      gcExplicitCount += 1;
+      gcExplicitTotalMs += Math.max(0, finishedAt - startedAt);
+      lastGcAtMs = finishedAt;
+    }
+    const initial = heapProbe();
+    if (initial) {
+      liveBaselineBytes =
+        initial.usedHeapBytes + Math.max(0, initial.externalBytes ?? 0);
+      // The opening width is spent before any probe: every row worker calls
+      // acquire() at once, and a granted lease cannot be taken back. So the
+      // unmeasured reserve has to bound the first wave too, not just the
+      // width the first probe computes — otherwise a heavy shape puts the
+      // full opening width of bodies in flight on a sandbox with room for
+      // half of them (jai: OOM at 205 settled rows, 256 in flight from the
+      // first probe on).
+      const openingHeadroomBytes =
+        Math.floor(
+          initial.heapLimitBytes * RUNTIME_MAP_HEAP_TARGET_UTILIZATION,
+        ) - liveBaselineBytes;
+      // A body is deferred only after a response has reached its byte gate;
+      // before the first representative row settles, this map has not yet
+      // measured what that gate will admit or how much surrounding resolver
+      // state that body retains. The compact waiting-row allowance describes
+      // one row already known to be waiting on I/O, not an unknown first wave.
+      // Starting the latter on 64 KiB turns a 1 GiB sandbox into its arbitrary
+      // 256-row cap before a single body can price the shape (JAI did exactly
+      // that). The unknown full-row prior bounds that one irreversible wave.
+      const openingRowReserveBytes = defaultRowReserveBytes;
+      concurrency = Math.max(
+        1,
+        Math.min(
+          concurrency,
+          Math.floor(openingHeadroomBytes / openingRowReserveBytes),
+        ),
+      );
+    }
+  }
+
+  const snapshot = (): RuntimeMapHeapAdmissionSnapshot => {
+    const gcObservation = gcObserver?.() ?? null;
+    return {
+      activeRows,
+      activeRowPeak,
+      admittedRows,
+      settledRows,
+      waitingRows: waiters.length,
+      concurrency,
+      maxConcurrency,
+      heapLimitBytes,
+      heapTargetBytes,
+      heapUsedBytes,
+      heapUsedPeakBytes,
+      liveBytes,
+      liveBaselineBytes,
+      livePeakBytes,
+      rowReserveBytes,
+      providerBodyReservationDeferred,
+      waitingRowReserveBytes,
+      measuredRowBytes,
+      footprintSamples,
+      footprintSampleMinActiveRows,
+      predictedLiveBytes,
+      occupiedBytes,
+      memory:
+        memorySnapshot === null
+          ? null
+          : { ...memorySnapshot, gc: gcObservation },
+      externalPressureSignals,
+      admissionHolds,
+      admissionPaused,
+      gc: gcObservation,
+      gcAvailable,
+      gcExplicitCount,
+      gcExplicitTotalMs,
+      lastGcAgeMs: lastGcAtMs === null ? null : Math.max(0, now() - lastGcAtMs),
+      limitedByHeap,
+      cgroupLimitBytes,
+      cpuCount,
+      residentGuardBytes,
+      residentBytes,
+      residentPeakBytes,
+      limitedByResidentMemory,
+      heapPressureEvents,
+      residentPressureEvents,
+      memoryPressureEvents,
+      limitedByEventLoop,
+      eventLoopPressureEvents,
+      eventLoopCeiling,
+      eventLoopLagMs,
+    };
+  };
+
+  const drain = (
+    maximumAdmissions = Number.POSITIVE_INFINITY,
+    allowWhilePaused = false,
+  ) => {
+    let admissions = 0;
+    while (
+      !closed &&
+      // A pressure pause retains exactly one progress row after the active
+      // set drains. The waiter may arrive after the reconciliation that
+      // noticed the zero width, so make the allowance in drain rather than
+      // relying on a waiter already existing at that instant.
+      (allowWhilePaused || !admissionPaused || activeRows === 0) &&
+      admissions < maximumAdmissions &&
+      activeRows < concurrency &&
+      waiters.length > 0
+    ) {
+      const waiter = waiters.shift();
+      if (!waiter) return;
+      activeRows += 1;
+      activeRowPeak = Math.max(activeRowPeak, activeRows);
+      admittedRows += 1;
+      admissions += 1;
+      let released = false;
+      waiter.resolve({
+        release() {
+          if (released) return;
+          released = true;
+          activeRows = Math.max(0, activeRows - 1);
+          settledRows += 1;
+          // Re-pricing here is deliberate and load-bearing: a settling row is
+          // the only evidence the ledger gets about what a row of this shape
+          // actually cost, and `probeIntervalMs` may be far longer than a row
+          // (the admission tests set it to 60s precisely to prove settlement
+          // drives pricing, not the timer). The per-row cost is kept sane by
+          // memoizing the ledger's percentiles rather than by skipping this.
+          reconcile();
+        },
+      });
+    }
+  };
+
+  const pauseAdmission = () => {
+    admissionHolds += 1;
+    admissionPaused = true;
+  };
+
+  const applyHeapSample = (heap: RuntimeMapHeapSnapshot): HeapReading => {
+    heapLimitBytes = heap.heapLimitBytes;
+    heapUsedBytes = heap.usedHeapBytes;
+    heapUsedPeakBytes = Math.max(heapUsedPeakBytes ?? 0, heap.usedHeapBytes);
+    heapTargetBytes = Math.floor(
+      heap.heapLimitBytes * RUNTIME_MAP_HEAP_TARGET_UTILIZATION,
+    );
+    liveBytes = heap.usedHeapBytes + Math.max(0, heap.externalBytes ?? 0);
+    liveBaselineBytes ??= liveBytes;
+    livePeakBytes = Math.max(livePeakBytes ?? 0, liveBytes);
+    residentBytes = heap.residentBytes ?? null;
+    residentPeakBytes =
+      residentBytes == null
+        ? residentPeakBytes
+        : Math.max(residentPeakBytes ?? 0, residentBytes);
+    // The sandbox kills on RSS against the cgroup, so the guard is a share of
+    // the cgroup limit whenever the kernel will state one. heap_size_limit is
+    // only the fallback, and then at a multiple rather than a fraction: the
+    // runner's old space is about half the cgroup, so RSS legitimately runs
+    // well above the heap limit.
+    residentGuardBytes =
+      cgroupLimitBytes === null
+        ? Math.floor(
+            heap.heapLimitBytes * RUNTIME_MAP_RESIDENT_GUARD_HEAP_MULTIPLE,
+          )
+        : Math.floor(
+            cgroupLimitBytes * RUNTIME_MAP_RESIDENT_GUARD_CGROUP_FRACTION,
+          );
+    return {
+      heapLimitBytes: heap.heapLimitBytes,
+      heapTargetBytes,
+      liveBytes,
+      liveBaselineBytes: liveBaselineBytes ?? liveBytes,
+      residentBytes,
+      residentGuardBytes,
+    };
+  };
+
+  /**
+   * Answer the garbage question with a collected reading.
+   *
+   * V8's own major collections count: if one finished inside the interval the
+   * heap has already been swept, so admission re-probes instead of paying
+   * 0.3-1 s of event-loop lag for a second sweep of the same objects. An
+   * explicit collection is the fallback, and it is rate limited because on a
+   * 1-CPU sandbox it is one of the most expensive things this process can do.
+   *
+   * Returns the post-collection reading, or null when no collection happened
+   * and the caller's reading still stands.
+   */
+  const collectAndReprobe = (): HeapReading | null => {
+    const startedAt = now();
+    const lastMajorAtMs = gcObserver?.().byKind.major.lastCompletedAtMs ?? null;
+    if (
+      lastMajorAtMs !== null &&
+      startedAt - lastMajorAtMs < gcMinIntervalMs &&
+      lastMajorAtMs > (lastGcAtMs ?? Number.NEGATIVE_INFINITY)
+    ) {
+      lastGcAtMs = lastMajorAtMs;
+      const swept = heapProbe();
+      return swept ? applyHeapSample(swept) : null;
+    }
+    if (runtimeGc === null) return null;
+    if (lastGcAtMs !== null && startedAt - lastGcAtMs < gcMinIntervalMs) {
+      return null;
+    }
+    runtimeGc();
+    const finishedAt = now();
+    gcExplicitCount += 1;
+    gcExplicitTotalMs += Math.max(0, finishedAt - startedAt);
+    lastGcAtMs = finishedAt;
+    const collected = heapProbe();
+    return collected ? applyHeapSample(collected) : null;
+  };
+
+  /**
+   * Memory headroom bounds the width; settlement paces how fast it may be
+   * reached, because only a finished row proves the shape drains.
+   */
+  const applyWidth = (admissibleRows: number): void => {
+    const settledAllowance =
+      initialConcurrency + settledRows * rowsPerSettledRow;
+    const safeWidth = Math.max(
+      1,
+      Math.min(
+        maxConcurrency,
+        activeRows + admissibleRows,
+        settledAllowance,
+        eventLoopCeiling,
+      ),
+    );
+    concurrency =
+      safeWidth >= concurrency
+        ? Math.min(safeWidth, concurrency + growthStepRows)
+        : safeWidth;
+  };
+
+  const reconcile = () => {
+    if (closed) return;
+    const heap = heapProbe();
+    if (!heap) {
+      admissionPaused = false;
+      concurrency = maxConcurrency;
+      drain();
+      return;
+    }
+    let reading = applyHeapSample(heap);
+    // A collection the watchdog just asked for makes this probe a collected
+    // one, which is the only kind the ledger may calibrate from.
+    let postCollectionSample = nextProbeIsPostCollection;
+    nextProbeIsPostCollection = false;
+    // V8's own major collections count too: a probe taken right after one
+    // reads live objects, not garbage, so a light map that never crosses the
+    // target still calibrates instead of keeping the prior for its whole life.
+    const naturalMajorAtMs =
+      gcObserver?.().byKind.major.lastCompletedAtMs ?? null;
+    if (
+      naturalMajorAtMs !== null &&
+      naturalMajorAtMs >
+        (lastNaturalMajorCalibratedAtMs ?? Number.NEGATIVE_INFINITY)
+    ) {
+      lastNaturalMajorCalibratedAtMs = naturalMajorAtMs;
+      postCollectionSample = true;
+    }
+
+    // Observed live over the target is a question about garbage, not a verdict
+    // about rows. Collect, re-probe, and let the post-collection reading
+    // answer it. Without a collection the reading cannot be trusted either
+    // way, so a runner that cannot collect keeps the old, conservative rule:
+    // over target is over target.
+    if (reading.liveBytes < reading.heapTargetBytes) {
+      // Under target even counting garbage: there is nothing to confirm.
+      observedOverTargetConfirmed = false;
+    } else {
+      const collected = collectAndReprobe();
+      if (collected) {
+        reading = collected;
+        postCollectionSample = true;
+      }
+      if (postCollectionSample || !gcAvailable) {
+        observedOverTargetConfirmed =
+          reading.liveBytes >= reading.heapTargetBytes;
+      }
+      // Inside the collection cooldown there is no new evidence, so the last
+      // collected verdict stands. That is what keeps a confirmed hold held
+      // and keeps a disproved one from re-arming on fresh garbage.
+    }
+
+    // Calibrate only from collected memory. A pre-collection probe divides
+    // garbage by the ledger and reads the clamp — that is how a 1,000-row map
+    // ended up pricing every row at six times its real cost.
+    // The ledger only sees objects that have reached an owning lane. A
+    // deferred-body map still needs a bounded admission promise between a
+    // response arriving and the body gate taking it; otherwise a learned
+    // multi-megabyte row can be widened as if it cost the 64 KiB waiting
+    // prior, and no later pressure signal can retract that launch wave. The
+    // body gate remains the authority for responses larger than the unknown
+    // full-row prior, so a slow provider does not become a synthetic
+    // row-concurrency ceiling. The calculation below still subtracts
+    // registered growth to avoid charging observed bytes twice.
+    const preCalibrationSnapshot = memoryLedger?.snapshot() ?? null;
+    const preCalibrationOccupancy = runtimeMemoryOccupancy({
+      heapLimitBytes: reading.heapLimitBytes,
+      liveBytes: reading.liveBytes,
+      liveBaselineBytes: reading.liveBaselineBytes,
+      ledger: preCalibrationSnapshot,
+      footprintSampleRows,
+      ownerReserveDefaultBytes: defaultRowReserveBytes,
+      ownerReserveMinBytes: rowReserveMinBytes,
+    });
+    const reserveForAdmittedRow = (occupancy: RuntimeMemoryOccupancy) =>
+      providerBodyReservationDeferred
+        ? Math.max(
+            waitingRowReserveBytes ?? rowReserveMinBytes,
+            Math.min(defaultRowReserveBytes, occupancy.ownerReserveBytes),
+          )
+        : occupancy.ownerReserveBytes;
+    const admittedRowReserveBytes =
+      activeRows * reserveForAdmittedRow(preCalibrationOccupancy);
+    if (postCollectionSample || !gcAvailable) {
+      memoryLedger?.calibrate({
+        observedLiveBytes: reading.liveBytes,
+        baselineBytes: reading.liveBaselineBytes,
+        admittedRowReserveBytes,
+      });
+    }
+    memorySnapshot = memoryLedger?.snapshot() ?? null;
+    // The ledger is the occupancy estimator; the probe above is the guard.
+    // Stated once, in `runtimeMemoryOccupancy`, so the receipt hydration lane
+    // admits against the same arithmetic instead of a second opinion.
+    const occupancy = runtimeMemoryOccupancy({
+      heapLimitBytes: reading.heapLimitBytes,
+      liveBytes: reading.liveBytes,
+      liveBaselineBytes: reading.liveBaselineBytes,
+      ledger: memorySnapshot,
+      footprintSampleRows,
+      ownerReserveDefaultBytes: defaultRowReserveBytes,
+      ownerReserveMinBytes: rowReserveMinBytes,
+    });
+    predictedLiveBytes = occupancy.predictedLiveBytes;
+    occupiedBytes = occupancy.occupiedBytes;
+    footprintSamples = occupancy.footprintSamples;
+    const ledgerRowBytes = occupancy.measuredOwnerBytes;
+    measuredRowBytes = ledgerRowBytes;
+
+    const overHeapTarget =
+      occupiedBytes >= reading.heapTargetBytes || observedOverTargetConfirmed;
+    // RSS at the cliff is pressure only while live memory is substantial;
+    // a high RSS over a small live footprint is freed pages that new rows
+    // will reuse, and holding on it would latch the window as the old clamp
+    // did.
+    const overResidentGuard =
+      reading.residentBytes != null &&
+      reading.residentBytes >= reading.residentGuardBytes &&
+      reading.liveBytes >=
+        reading.heapTargetBytes * RUNTIME_MAP_RESIDENT_GUARD_LIVE_FRACTION;
+    // A watchdog signal holds until the collection it asked for has actually
+    // shown up as a fall in live memory.
+    const underExternalHold =
+      externalHoldLiveBytes !== null &&
+      reading.liveBytes >= externalHoldLiveBytes;
+    if (externalHoldLiveBytes !== null && !underExternalHold) {
+      externalHoldLiveBytes = null;
+    }
+
+    // The watchdog reads the published ledger only when it aborts, so the
+    // file need not track every 25 ms probe; publishing is synchronous I/O
+    // on the runner's event loop and one write per second is plenty.
+    const nowMs = Date.now();
+    if (nowMs - lastLedgerPublishMs >= RUNTIME_MAP_LEDGER_PUBLISH_INTERVAL_MS) {
+      lastLedgerPublishMs = nowMs;
+      reportLedger(snapshot());
+    }
+
+    if (overHeapTarget || overResidentGuard || underExternalHold) {
+      // Existing rows are never interrupted. Pause new admission until
+      // settled rows free enough live memory to grow again. Keep the computed
+      // width intact: replacing it with the momentary active count makes a
+      // transient pause compound into a serial tail as rows finish. Once the
+      // active count reaches zero, retain one progress row; otherwise a map
+      // whose baseline is already over target could strand every queued row.
+      limitedByHeap ||= overHeapTarget;
+      limitedByResidentMemory ||= overResidentGuard;
+      if (!memoryPressureActive) {
+        memoryPressureActive = true;
+        memoryPressureEvents += 1;
+        if (overHeapTarget) heapPressureEvents += 1;
+        if (overResidentGuard) residentPressureEvents += 1;
+        input.onMemoryPressure?.();
+      }
+      pauseAdmission();
+      if (activeRows === 0) drain(1, true);
+      return;
+    }
+    memoryPressureActive = false;
+    eventLoopLagMs = input.getEventLoopLagMs?.() ?? null;
+    const adjustDue =
+      lastEventLoopAdjustAtMs === null ||
+      now() - lastEventLoopAdjustAtMs >= eventLoopAdjustIntervalMs;
+    if (eventLoopLagMs !== null && eventLoopLagMs >= eventLoopLagHoldMs) {
+      limitedByEventLoop = true;
+      if (!eventLoopPressureActive) {
+        eventLoopPressureActive = true;
+        eventLoopPressureEvents += 1;
+        lastEventLoopAdjustAtMs = null;
+      }
+      if (
+        lastEventLoopAdjustAtMs === null ||
+        now() - lastEventLoopAdjustAtMs >= eventLoopAdjustIntervalMs
+      ) {
+        lastEventLoopAdjustAtMs = now();
+        // Never below the opening width: the hold above still keeps a
+        // saturated loop from admitting, and a ceiling of a handful of rows
+        // would take minutes of additive growth to recover from.
+        eventLoopCeiling = Math.max(
+          initialConcurrency,
+          Math.floor(
+            Math.min(eventLoopCeiling, Math.max(activeRows, 1)) *
+              RUNTIME_MAP_EVENT_LOOP_SHRINK_FACTOR,
+          ),
+        );
+        concurrency = Math.min(concurrency, eventLoopCeiling);
+      }
+      pauseAdmission();
+      if (activeRows === 0) drain(1, true);
+      return;
+    }
+    eventLoopPressureActive = false;
+    if (eventLoopLagMs !== null && eventLoopCeiling < maxConcurrency && adjustDue) {
+      lastEventLoopAdjustAtMs = now();
+      eventLoopCeiling = Math.min(
+        maxConcurrency,
+        eventLoopCeiling +
+          Math.max(
+            1,
+            Math.ceil(eventLoopCeiling * RUNTIME_MAP_EVENT_LOOP_GROW_FRACTION),
+          ),
+      );
+    }
+    admissionPaused = false;
+
+    // The reserve is what one more row may cost: the ledger's settled p90
+    // per-row peak scaled by its calibration factor, or the unmeasured prior
+    // until enough rows have settled to state one. It is floored so a run of
+    // light rows cannot authorize a launch wave for a heavy one.
+    rowReserveBytes = reserveForAdmittedRow(occupancy);
+    // Rows already admitted may not have shown their bodies yet. Charge them
+    // the reserve minus whatever growth occupancy already reflects, so a
+    // static reading between probes cannot be mistaken for free headroom.
+    const growthBytes = Math.max(0, occupiedBytes - reading.liveBaselineBytes);
+    const unmaterializedBytes = Math.max(
+      0,
+      activeRows * rowReserveBytes - growthBytes,
+    );
+    const admissibleRows = Math.floor(
+      Math.max(
+        0,
+        reading.heapTargetBytes - occupiedBytes - unmaterializedBytes,
+      ) / rowReserveBytes,
+    );
+    applyWidth(admissibleRows);
+    drain();
+  };
+
+  const unsubscribeMemoryPressure = subscribeMemoryPressure(() => {
+    if (closed) return;
+    externalPressureSignals += 1;
+    // Pause first, then release durable results and collect, then reprobe. The
+    // order matters: a signal that reprobed first would widen the window on
+    // the reading that provoked the signal.
+    pauseAdmission();
+    // Before the first interval probe the only live reading is the baseline
+    // taken at construction; a signal that early still holds against it.
+    externalHoldLiveBytes = liveBytes ?? liveBaselineBytes;
+    // One episode, one egress release: the reprobe below re-enters the hold
+    // branch, and it must not re-announce pressure the map is already under.
+    if (!memoryPressureActive) {
+      memoryPressureActive = true;
+      memoryPressureEvents += 1;
+      input.onMemoryPressure?.();
+    }
+    // The watchdog asked for memory back, so this collection is not on the
+    // probe cooldown: it is the point of the signal.
+    if (runtimeGc !== null) {
+      const startedAt = now();
+      runtimeGc();
+      const finishedAt = now();
+      gcExplicitCount += 1;
+      gcExplicitTotalMs += Math.max(0, finishedAt - startedAt);
+      lastGcAtMs = finishedAt;
+      nextProbeIsPostCollection = true;
+    }
+    reconcile();
+  });
+
+  const timer = setInterval(reconcile, probeIntervalMs);
+  if (typeof timer === 'object' && 'unref' in timer) timer.unref();
+
+  return {
+    async acquire() {
+      if (closed) {
+        throw closeError ?? new Error('Runtime map row admission is closed.');
+      }
+      return await new Promise<RuntimeMapHeapAdmissionLease>(
+        (resolve, reject) => {
+          waiters.push({ resolve, reject });
+          drain();
+        },
+      );
+    },
+    reconcile,
+    close(error) {
+      if (!closed) {
+        closed = true;
+        closeError = error ?? new Error('Runtime map row admission is closed.');
+        clearInterval(timer);
+        unsubscribeMemoryPressure();
+        while (waiters.length > 0) {
+          waiters.shift()?.reject(closeError);
+        }
+      }
+      return snapshot();
+    },
+    snapshot,
+  };
+}
+
 export class RuntimeMapMemoryLimitError extends Error {
   readonly code = 'RUNTIME_MAP_MEMORY_LIMIT_EXCEEDED';
   constructor(input: {
@@ -58,19 +1698,16 @@ export class RuntimeMapMemoryLimitError extends Error {
   }
 }
 
-const textEncoder =
-  typeof TextEncoder === 'undefined' ? null : new TextEncoder();
-
-export function runtimeMapJsonByteLength(value: unknown): number {
-  const serialized = JSON.stringify(value);
-  if (serialized === undefined) return 0;
-  return textEncoder?.encode(serialized).byteLength ?? serialized.length;
-}
+/**
+ * Serialized size in the ledger's unit. The implementation moved to
+ * `memory-ledger.ts` so callers that must not pull `node:v8` into their module
+ * graph can measure bytes too; this name stays for the map's own call sites.
+ */
+export const runtimeMapJsonByteLength = runtimeJsonByteLength;
 
 export function defaultRuntimeMapMemoryLimits(): RuntimeMapMemoryLimits {
   return {
     materializedBudgetBytes: NODE_RUNTIME_MAP_MEMORY_BUDGET_BYTES,
-    activeRowsBudgetBytes: NODE_RUNTIME_MAP_ACTIVE_ROWS_MEMORY_BUDGET_BYTES,
   };
 }
 
@@ -83,10 +1720,6 @@ export function resolveRuntimeMapMemoryLimits(
       override?.materializedBudgetBytes,
       defaults.materializedBudgetBytes,
     ),
-    activeRowsBudgetBytes: positiveBudget(
-      override?.activeRowsBudgetBytes,
-      defaults.activeRowsBudgetBytes,
-    ),
   };
 }
 
@@ -185,81 +1818,3 @@ export function createRuntimeMapRetainedRowsTracker(
 ): RuntimeMapRowsTracker {
   return createRuntimeMapRowsTracker(input, 'retained_rows');
 }
-
-export function assertRuntimeMapActiveRowsWithinMemoryLimit(input: {
-  mapName: string;
-  rowCount: number;
-  rowConcurrency: number;
-  largestRowBytes: number;
-  activeRowsBudgetBytes?: number;
-}): void {
-  const activeRows = Math.min(
-    Math.max(0, input.rowCount),
-    Math.max(1, Math.floor(input.rowConcurrency)),
-  );
-  const estimate: RuntimeMapMemoryEstimate = {
-    rowCount: input.rowCount,
-    serializedBytes: input.largestRowBytes * activeRows,
-    largestRowBytes: input.largestRowBytes,
-    estimatedResidentBytes:
-      input.largestRowBytes *
-        activeRows *
-        NODE_RUNTIME_MAP_ACTIVE_ROW_MEMORY_MULTIPLIER +
-      activeRows * NODE_RUNTIME_MAP_ROW_OVERHEAD_BYTES,
-  };
-  const budgetBytes = positiveBudget(
-    input.activeRowsBudgetBytes,
-    NODE_RUNTIME_MAP_ACTIVE_ROWS_MEMORY_BUDGET_BYTES,
-  );
-  if (estimate.estimatedResidentBytes > budgetBytes) {
-    throw new RuntimeMapMemoryLimitError({
-      mapName: input.mapName,
-      phase: 'active_rows',
-      estimate,
-      budgetBytes,
-      activeRows,
-      rowConcurrency: input.rowConcurrency,
-    });
-  }
-}
-
-/**
- * Resolve a row-worker window from the shared concurrency target and a concrete
- * resident-byte budget. Pending rows remain indexes, so only this admitted
- * window contributes active row copies/promises. If one row cannot fit, fail
- * before any resolver body starts; otherwise memory pressure is normal
- * backpressure and reduces the window explicitly.
- */
-export function resolveRuntimeMapRowAdmission(input: {
-  rowCount: number;
-  requestedConcurrency: number;
-  largestRowBytes: number;
-  activeRowsBudgetBytes?: number;
-}): RuntimeMapRowAdmission {
-  const rowCount = Math.max(0, Math.floor(input.rowCount));
-  const requestedConcurrency = Math.max(
-    1,
-    Math.floor(input.requestedConcurrency),
-  );
-  const largestRowBytes = Math.max(0, Math.floor(input.largestRowBytes));
-  const budgetBytes = positiveBudget(
-    input.activeRowsBudgetBytes,
-    NODE_RUNTIME_MAP_ACTIVE_ROWS_MEMORY_BUDGET_BYTES,
-  );
-  const estimatedBytesPerActiveRow =
-    largestRowBytes * NODE_RUNTIME_MAP_ACTIVE_ROW_MEMORY_MULTIPLIER +
-    NODE_RUNTIME_MAP_ROW_OVERHEAD_BYTES;
-
-  const maxConcurrencyByMemory = Math.floor(
-    budgetBytes / Math.max(1, estimatedBytesPerActiveRow),
-  );
-  const concurrency =
-    rowCount === 0
-      ? 0
-      : Math.min(rowCount, requestedConcurrency, maxConcurrencyByMemory);
-  return {
-    concurrency,
-    estimatedBytesPerActiveRow,
-    estimatedResidentBytes: estimatedBytesPerActiveRow * concurrency,
-  };
-}