Incident: Node memory climbing to OOM

Each customer who drops off a film gets a line in the counter book and an envelope on the back racks. Every order also adds a line to the shared "text me when the machine runs" list on the wall, naming that customer's envelope.

At the photo lab	In the incident
a line in the counter book	the socket's small objects in the V8 heap
the envelope of prints on the back racks	the inbox Buffer's bytes, in external (step 4)
the wall list's line naming the envelope	the listener on the shared emitter, holding the socket (step 7)
customers collect and leave; nobody strikes their line	sockets close; the listener stays (step 8)
the owner checks the counter book's thickness, and it barely grows	watching heapUsed alone (step 5)
the fire officer counts all stock against the lease's limit and shuts the shop	the container limit: OOMKilled, every socket dropped (steps 1–2)
a thicker counter book	--max-old-space-size (step 10)
a bigger shop	a higher memory limit: the closing day moves (step 9)
striking the line when the customer leaves	off on close (step 11)

Breaks down when: an owner would see the racks fill; Node shows the climb only to someone who charts external beside heapUsed.

Contrasting case: the same forgotten listener keeping each socket's last message as a string or a plain array. Now heapUsed climbs, and a --max-old-space-size below the container limit makes V8 abort first, with "JavaScript heap out of memory" and no OOMKilled.

In real terms: read the kill reason, chart the three lines, and look for the long-lived holder before you touch a limit or a flag.

4.1 ExamHall EXH-2970: the gateway on a laptop

Release 2026.10.02-1's handler on a real ws server: 600 sockets stay open while 2,000 connect, send one message and close. Then two heap snapshots 1,000 closes apart, and the hook's restart arithmetic:

4.1 the §2 handler, ws 8.22.0 · 600 sockets open, 200 warm-up and 2000 more connected, sent one message and closed
4.1 alerts.listenerCount('alert'): 2800 · wss.clients.size: 600 · MaxListenersExceededWarning printed: yes
4.1 per closed socket, after forced collections: heapUsed under +8 KiB · external about +16 KiB · arrayBuffers about +16 KiB
4.1 heap snapshot 2 minus snapshot 1, 1000 sockets closed in between: Buffer +2000 · Socket +1000 · WebSocket +1000 (each at least one per closed socket)
4.1 path | Buffer            ← inbox in system / Context | new since snapshot 1
4.1 path | system / Context  ← context in (closure) | new since snapshot 1
4.1 path | (closure)         ← [n] in Array | new since snapshot 1
4.1 path | Array             ← alert in Object | at snapshot 1
4.1 path | Object            ← _events in EventEmitter | at snapshot 1
4.1 path | EventEmitter      ← alerts in system / Context | at snapshot 1
4.1 first object going up that existed at snapshot 1: Array, the alert listener array of alerts
4.1 the hook's restart: (1024 MiB - 230 MiB after start) / ((16 + 2) KiB kept per close x 900 closes a minute) = 50.2 minutes

The listener count follows every socket ever opened, not the 600 open ones (step 8). The 16 KiB inboxes show in external while heapUsed hardly moves (steps 3–5). The snapshot path goes up from a closed socket's inbox to the alert array, the first object that existed before those sockets (step 7), and the arithmetic gives the hook's 50 minutes (step 9).

4.2 Payments ledger MR !3270: the listener removed on close

A wallet's balance feed shipped the same handler. MR !3270 names the listener and removes it when the socket closes:

wss.on('connection', (ws) => {
  const inbox = Buffer.alloc(16 * 1024);
  ws.on('message', (data) => data.copy(inbox));
  const onBalance = (balance) => ws.send(balance);
  balances.on('balance', onBalance);
  ws.on('close', () => balances.off('balance', onBalance));
});

4.2 MR !3270's handler, ws 8.22.0 · 600 sockets open, 200 warm-up and 2000 more connected, sent one message and closed
4.2 balances.listenerCount('balance'): 600 · wss.clients.size: 600 · MaxListenersExceededWarning printed: yes
4.2 per closed socket, after forced collections: heapUsed under +1 KiB · external under +1 KiB

Listeners now equal open sockets, and both lines return to their floor after each close (step 11). Node still warns about more than 10 listeners, because 600 open sockets are 600 listeners: the warning cannot tell a fan-out from a leak, and the count against open sockets can (step 12).