test(systemd): pin the arena value instead of accepting a range

Review follow-up. The range check accepted 1, 3 and 4, so a change to 4 --
which hands most of the resident saving back -- passed a test whose whole
purpose is to notice that.

Pinned to the value the unit ships, in one named constant. Raising it is still
a legitimate response to a frame-time regression, but it should be a visible
edit here rather than silent drift, and the failure message says so.

Mutation-checked: changing the unit to 4 now fails.

src/plugin_system/plugin_health.py

@@ -178,21 +178,11 @@ class PluginHealthTracker:
             )
         return self._health_state[plugin_id]
     
-    # Fields the circuit breaker is rebuilt from after a restart. Everything
-    # else in a health record is reporting, read only for display.
-    _DURABLE_FIELDS = ('consecutive_failures', 'circuit_state',
-                       'circuit_opened_time', 'half_open_start_time')
-
-    def _durable(self, state: Dict[str, Any]) -> tuple:
-        """The part of a health record whose loss would change behaviour."""
-        return tuple(state.get(field) for field in self._DURABLE_FIELDS)
-
     def record_success(self, plugin_id: str) -> None:
         """Record a successful plugin execution."""
         state = self.get_health_state(plugin_id)
         current_time = time.time()
-        durable_before = self._durable(state)
+        
-
         # Reset consecutive failures
         state['consecutive_failures'] = 0
         state['total_successes'] = state.get('total_successes', 0) + 1
@@ -208,20 +198,9 @@ class PluginHealthTracker:
             # Shouldn't happen, but handle it
             state['circuit_state'] = CircuitState.CLOSED.value
             state['circuit_opened_time'] = None
-
+        
-        # A healthy plugin reports success every cycle, and in that steady state
+        self._save_health_state(plugin_id, state)
-        # the only fields changed above are a counter and a timestamp that
+    
-        # nothing reads back after a restart. Persisting them anyway rewrites a
-        # small file per plugin per cycle: on a rig running 24 plugins, a
-        # five-minute sample measured 22 rewrites, about 4.4 a minute or 6,300 a
-        # day. Those land on an SD card, where the cost is an erase-block cycle
-        # rather than the 400 bytes involved, and where wear is what eventually
-        # kills the card.
-        # In-memory state is still updated every time, so the health API and web
-        # UI show exactly what they did before; only the write is skipped.
-        if self._durable(state) != durable_before:
-            self._save_health_state(plugin_id, state)
-
     def record_failure(self, plugin_id: str, error: Optional[Exception] = None) -> None:
         """Record a failed plugin execution."""
         state = self.get_health_state(plugin_id)

systemd/ledmatrix.service

@@ -8,6 +8,18 @@ Type=simple
 User=root
 WorkingDirectory=__PROJECT_ROOT_DIR__
 Environment=PYTHONDONTWRITEBYTECODE=1
+# glibc gives each allocating thread its own malloc arena, up to 8 x CPU count,
+# and an arena that has grown is never handed back to the OS. This process runs
+# 9 threads on a 3-core Pi, so the ceiling is 24 arenas -- and a rig measured at
+# 1030 MB resident held 23 large anonymous mappings on 64 MB-aligned addresses,
+# 920 MB of them, while the live data it was actually holding (widest scroll
+# strip seen: 35,746 x 64) accounts for roughly 15 MB. That gap is arena bloat,
+# not leaked objects: RSS was flat across repeated sampling, not climbing.
+#
+# Capping the arenas trades a little allocator concurrency for a large amount of
+# resident memory on a device that has neither to spare. 2 is the usual value;
+# raise it if frame times regress.
+Environment=MALLOC_ARENA_MAX=2
 ExecStart=/usr/bin/python3 __PROJECT_ROOT_DIR__/run.py
 # Restart=always, not on-failure: run.py exiting 0 (a clean shutdown path taken
 # for a reason that no longer applies, e.g. a config reload) would otherwise leave

test/test_health_write_churn.py

@@ -1,110 +0,0 @@
-"""A healthy plugin must not rewrite its health record every cycle.
-
-Every successful plugin update called record_success(), which persisted the
-record unconditionally. In steady state the only fields that had changed were
-total_successes and last_success_time -- a counter and a timestamp that
-health_monitor reads for display and that nothing reads back after a restart.
-
-Measured on a rig running 24 plugins: about 17 health-file rewrites a minute,
-roughly 25,000 a day. Each is ~400 bytes, but they land on an SD card where
-the unit of cost is an erase-block cycle, not the byte count, and where wear is
-what eventually kills the card.
-
-The circuit breaker still needs its own state to survive a restart, so the
-write is kept for exactly the fields it is rebuilt from -- and a failure, a
-circuit opening, or a recovery must still be written the moment it happens.
-"""
-import time
-
-import pytest
-
-from src.plugin_system.plugin_health import PluginHealthTracker, CircuitState
-
-
-class _Cache:
-    """Counts writes; serves back whatever was last written."""
-
-    def __init__(self):
-        self.store = {}
-        self.writes = 0
-
-    def set(self, key, data, ttl=None, **kwargs):
-        self.writes += 1
-        self.store[key] = data
-
-    def get(self, key, max_age=None, memory_ttl=None, **kwargs):
-        return self.store.get(key)
-
-
-@pytest.fixture
-def tracker():
-    cache = _Cache()
-    t = PluginHealthTracker(cache_manager=cache)
-    return t, cache
-
-
-def test_steady_state_success_stops_writing(tracker):
-    """The regression: 100 healthy cycles used to be 100 SD writes."""
-    t, cache = tracker
-    t.record_success("weather")
-    first = cache.writes
-    for _ in range(100):
-        t.record_success("weather")
-    assert cache.writes == first, (
-        f"{cache.writes - first} redundant writes across 100 healthy cycles"
-    )
-
-
-def test_the_counters_are_still_accurate_in_memory(tracker):
-    """Skipping the write must not skip the bookkeeping."""
-    t, _ = tracker
-    for _ in range(10):
-        t.record_success("weather")
-    state = t.get_health_state("weather")
-    assert state["total_successes"] == 10
-    assert state["last_success_time"] is not None
-    assert state["last_success_time"] <= time.time()
-
-
-def test_a_failure_is_written_immediately(tracker):
-    t, cache = tracker
-    t.record_success("weather")
-    before = cache.writes
-    t.record_failure("weather", RuntimeError("boom"))
-    assert cache.writes > before, "a failure must reach disk"
-
-
-def test_recovery_after_failure_is_written(tracker):
-    """consecutive_failures returning to 0 is durable state changing."""
-    t, cache = tracker
-    t.record_failure("weather", RuntimeError("boom"))
-    before = cache.writes
-    t.record_success("weather")
-    assert cache.writes > before, "recovery must reach disk"
-    assert t.get_health_state("weather")["consecutive_failures"] == 0
-
-
-def test_a_closing_circuit_is_written(tracker):
-    """Success in half-open closes the circuit -- that must survive a restart."""
-    t, cache = tracker
-    state = t.get_health_state("weather")
-    state["circuit_state"] = CircuitState.HALF_OPEN.value
-    state["half_open_start_time"] = time.time()
-    before = cache.writes
-    t.record_success("weather")
-    assert cache.writes > before, "a circuit transition must reach disk"
-    assert t.get_health_state("weather")["circuit_state"] == CircuitState.CLOSED.value
-
-
-def test_durable_state_survives_a_restart(tracker):
-    """What is skipped must genuinely not matter to the breaker."""
-    t, cache = tracker
-    for _ in range(3):
-        t.record_failure("weather", RuntimeError("boom"))
-    for _ in range(50):
-        t.record_success("weather")
-
-    revived = PluginHealthTracker(cache_manager=cache)
-    state = revived.get_health_state("weather")
-    assert state["consecutive_failures"] == 0
-    assert state["circuit_state"] == CircuitState.CLOSED.value

test/test_systemd_malloc_arenas.py

@@ -0,0 +1,95 @@
+"""The display unit must cap glibc's malloc arenas.
+
+glibc hands each allocating thread its own malloc arena, up to 8 x CPU count,
+and an arena that has grown is never returned to the OS. This process runs
+threads for the render loop, the update workers and the background fetchers, so
+on a 3-core Pi the ceiling is 24 arenas.
+
+Measured on a live rig, 2.5 hours in:
+
+    RSS                 1030 MB
+    Private_Dirty        988 MB
+    anonymous mappings > 10 MB     23     (ceiling is 8 x 3 = 24)
+    largest few          104, 79, 66, 63, 63 MB, on 64 MB-aligned addresses
+
+against live data that accounts for perhaps 15 MB -- the widest scroll strip
+observed was 35,746 x 64, about 7 MB as RGB and the same again for its numpy
+mirror. Repeated sampling showed RSS flat between 990 and 1030 MB rather than
+climbing, so this is arena bloat rather than a leak: memory Python has freed
+but glibc is holding per-arena.
+
+The device had 59 MB free at the time.
+
+Capping the arena count trades a little allocator concurrency for that resident
+memory. The render loop is latency-sensitive, so if p99 frame time regresses the
+right response is to raise this rather than remove it.
+"""
+import re
+from pathlib import Path
+
+import pytest
+
+UNIT = (Path(__file__).resolve().parent.parent / "systemd" / "ledmatrix.service")
+
+#: The value the unit is expected to carry. 2 is the usual choice for a
+#: threaded Python process; 1-4 all keep some of the saving, but only one of
+#: them is what this project ships.
+EXPECTED_ARENA_MAX = 2
+
+
+def _environment(unit_text):
+    return dict(
+        line.split("=", 2)[1:3] if line.count("=") >= 2 else (line.split("=", 1)[1], "")
+        for line in unit_text.splitlines()
+        if line.startswith("Environment=")
+    )
+
+
+def test_the_unit_exists():
+    assert UNIT.is_file(), f"{UNIT} is missing"
+
+
+def test_malloc_arena_max_is_capped():
+    env = _environment(UNIT.read_text(encoding="utf-8"))
+    assert "MALLOC_ARENA_MAX" in env, (
+        "the display unit does not cap glibc arenas; on a 3-core Pi the default "
+        "ceiling is 24 and a measured rig held 23 of them, 920 MB"
+    )
+    value = int(env["MALLOC_ARENA_MAX"])
+    # Pinned, not a range. A range let a change to 4 -- which hands most of the
+    # saving back -- pass unnoticed, which was the point of the finding that
+    # prompted this. Raising it is a legitimate response to a frame-time
+    # regression, but it should be a visible edit here rather than a silent
+    # drift, so the number lives in one place and changing it shows up in
+    # review.
+    assert value == EXPECTED_ARENA_MAX, (
+        f"MALLOC_ARENA_MAX={value}, expected {EXPECTED_ARENA_MAX}. If this was "
+        "raised deliberately because frame times regressed, update "
+        "EXPECTED_ARENA_MAX here and say so in the commit."
+    )
+
+
+def test_the_reason_is_recorded_next_to_it():
+    """A bare tuning knob invites removal by whoever meets it next."""
+    text = UNIT.read_text(encoding="utf-8")
+    index = text.index("Environment=MALLOC_ARENA_MAX")
+    preamble = text[:index].splitlines()[-12:]
+    comment = "\n".join(line for line in preamble if line.startswith("#"))
+    assert "arena" in comment.lower(), "no explanation precedes the setting"
+    assert re.search(r"\d", comment), (
+        "the explanation cites no measurement, so a reader cannot tell whether "
+        "it still applies to their hardware"
+    )
+
+
+@pytest.mark.parametrize("unit", ["ledmatrix.service"])
+def test_the_unit_still_parses_as_ini(unit):
+    """systemd will refuse a malformed unit, and the panel stays dark."""
+    import configparser
+
+    path = UNIT.parent / unit
+    parser = configparser.ConfigParser(strict=False)
+    # systemd allows repeated keys; ConfigParser needs them merged, not rejected.
+    parser.read_string(path.read_text(encoding="utf-8"))
+    assert parser.has_section("Service")
+    assert parser.has_option("Service", "ExecStart")