fix(jsc): preserve generational worker heap collection on main

[steipete]

Worker heap limits currently force automatic collections to be full and collapse the whole-heap target to the nursery allowance. Vitest workers consequently retrace large surviving code graphs instead of using young-generation collection. Native diagnostics reduce providers full/Eden counts from 698/154 to 112/1020 and messaging from 348/37 to 61/452, with unchanged complete test outcomes. These are diagnostic collection counts, not physical scan-byte measurements or a demonstrated compile-cache leak.

Separate nursery pacing from full-heap growth, and cap a budgeted worker's post-full target at twice its current heap ledger while retaining the collector minimum and smaller pressure-driven targets. Conservative checked accounting requests full verification when the managed-memory budget may be exhausted. Only the strict post-full survivor check reports OOM; the full-collection buffer snapshot preserves ArrayBuffer exclusion through Eden collections. Mandatory verification drives the existing collection ticket while idle through the matching Bun timer adapter. Cached-data, debugger, source/referrer identity and public accounting contracts are preserved.

This main-branch companion retains #19's post-GC termination delivery and the allocator-exit correction. Relative to the measured cadence source, the collector adds only the inherited termination hook; the growth policy and cadence regression remain unchanged. The release-line companion is #14. Bun timer companion openclaw/bun#129 remains separately coordinated and must accompany a consuming rebuild. The policy applies generically to budgeted Worker VMs.

A quiet Linux host completed 100 ordinary observations, four per arm in five cells, with pairwise ABBAABBA order against Node 24.21.0, the public Bun pin, a matched untreated fork, and the candidate with default or CPU/worker-ratio marker counts. All full outcome inventories, isolation/resource checks, zero-steal gates and final source/binary checks passed; no observation was retried or excluded.

Workload / shape	Wall versus matched control	CPU	Process peak RSS	Wall versus Node
Providers, 8 CPUs / 4 workers	-7.57%	-20.14%	+18.17%	+12.87%
Messaging, 8 / 4	+1.06%	-11.63%	+14.15%	+6.85%
Providers, 2 / 2, 7.5 GiB	-14.57%	-15.67%	+1.05%	+37.70%
Messaging, 2 / 2, 7.5 GiB	-13.86%	-15.83%	+13.64%	+12.80%
77-file CI providers envelope, 2 / 2, 7.5 GiB	-10.00%	-11.53%	+12.20%	+6.84%

Eight-CPU messaging's wall ratio interval is [0.9947, 1.0135]: no demonstrated wall win or equivalence. Bun remains slower than Node throughout. Constrained full providers reaches the memory cap in three of four candidate runs, with reclaim pressure but zero OOMs; capped RSS is not an unconstrained memory estimate. The marker ratio is rejected because it regresses two-CPU messaging by 1.49% (ratio interval [1.0074, 1.0230]); no marker override is added.

The measured candidate passed native Worker/VM/V8, ArrayBuffer accounting in five modes, resource-limit, N-API, serializer, inspector, stack/cache, and engine stress/module gates. The strict source-blind held-after-Eden observation remains blocked; the native idle-boundary regression passes. Original failures and superseded cohorts are retained separately. Earlier fixture/transport repairs landed in openclaw/openclaw#165661 and #165769.

The refreshed main head passed independent P2 review, pipeline integrity tests, and fresh exact-head engine and ARM64 qualification. The ARM64 lane passed all 1,779 stress and 1,639 module variants plus accounting and sampling in five modes. Native Linux baseline and candidate finished with identical passing 46-file inventories; the candidate also passed 17 Worker resource-limit cases. Both grouped arms first encountered the same inherited epoll registration error and recovered the same 26 unfinished files through the existing runner; no failed-file retry or GitHub rerun was used. The macOS cross-compilation lane also passed. Artifact publication is outside this PR.

The maintained Gateway check completed 64 scored observations plus two cache primes with four processes per arm/condition, fixed physical CPU placement, fresh Gateway state, separately controlled empty/retained transpiler caches, zero-steal checks and clean process settlement. Against the matched control, cold/warm startup readiness changed +0.64%/-0.14%, empty-cache restart -4.93%, retained-cache startup +0.97%, and retained-cache restart +4.21%. Peak Gateway-inclusive RSS medians decreased in all five conditions; every RSS upper bound stayed below 1.05. Only retained-cache restart latency did not meet the declared bound. No observations were discarded or added to obtain a pass.

Candidate cold root HWM was 732.4 MiB versus 736.8 MiB matched control, 744.4 MiB published667c and 805.5 MiB Node26 on the same host. Root RSS includes worker threads; sampled descendant-process memory is also reported separately. Observed worker starts remained comparable, and all observed descendants settled without forced cleanup. Retained caches were startup-primed; the first retained restart added 18 files per arm, so this is not a separately restart-primed experiment.

A new, separately predeclared restart-specific experiment now passes the product gate. Two restart primes per arm produced identical retained-cache inventories; twelve scored processes per arm then ran in six interleaved control/growth/growth/control blocks. All 24 scored processes and four primes passed readiness, clean exit, identity, affinity, all-CPU zero-steal and cleanup checks. No observations or caches were reused from the earlier cohort. A separate AWS attempt stopped during unscored priming for a steal tick and contributed no scored data.

• Restart readiness: control 3.800847 s, growth 3.559897 s; point change −6.339% (−240.95 ms). The two-sided 95% interval is [−10.075%, +1.070%], meeting the predeclared upper bound of +5%. The interval includes no change, so this is a bounded non-regression result rather than an established latency win.
• Gateway-inclusive peak RSS: 1282.889 → 1242.859 MiB (−3.120%); one-sided 95% upper bound +0.731%, below +5%. Root kernel HWM is 957.852 → 947.672 MiB. Worker threads share root RSS; the broader peak includes sampled child processes and transient controller-side helpers, excluding the controller itself.
• Observed Worker-thread starts: control 40–41, growth 39–41, with no increase. All 3,920 failure counters were zero and no cleanup signal was needed. Both caches stayed at 2,856 files / 73,911,125 bytes and their final contents were hash-identical.

The maintained harness and product commit, Node 26 controller, exact previously measured control/growth binaries, fresh Gateway state, four distinct physical Gateway cores and disjoint controller cores were held fixed within the new comparison. Its observer gained child-subreaper ownership before any run to preserve cleanup across the harness's detached processes. Three cycles were first summarized within each process; 20,000 independent process-median bootstrap draws used seed 174187. This cohort is independent of the earlier four-process comparison and does not establish that cache priming caused the earlier uncertainty. No marker policy or worker-type exception was added.

The whole-suite Node attempts exposed missing Git metadata and an unbounded SQLite fixture WAL; their failures remain preserved and no whole-suite equality pass is claimed. The independent test-only pacing repair openclaw/openclaw#165940 is merged and #165938 is closed, with dual-runtime proof, P2, exact-head CI and ClawSweeper qualification. The follow-up whole-suite attempts also retained a proof-wrapper orphan-reaping defect and missing host executables. Those invalid attempts are archived. The wrapper was corrected and independently checked; required zip/Ruby tools are installed before a fresh full Node/Bun pair on identical host inputs. No whole-suite equality pass is claimed yet. The fixture finding is separate from the cadence decision. Diagnostic restart profiling was prepared but not run because the follow-up gate passed. No artifact publication is requested.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.