Resolves #16819

A process running under NODE_OPTIONS='"--max-old-space-size=256"' is bounded at 256 MiB and reported {state: 'undeclared'} — affirmative evidence that nobody bounded it. And start() promised "returns, never throws" while its one production config read sat outside the try, on an MCP server's boot path.

Evidence: L2 (both fixes exercised by unit execution, every behavioural claim measured against real spawned node v25.9.0 children before it was written) → L2 required. Residual: the value rules are measured on one Node line; see Post-Merge Validation.

The measurement came first, and it corrected the ticket twice

Every row below is from spawning real children with an explicit env object — no shell, so no shell quoting could contaminate the input. Baseline heap_size_limit with no declaration: 4496293888 (4288 MiB).

Delta 1 — the ticket prescribed a shape list, and a shape list is still wrong. It asked to "recognize at minimum a double-quoted whole option and a double-quoted numeric value" — rows two and three. That leaves row five reporting undeclared for a live 256 MiB ceiling. Node's ParseNodeOptionsEnvVar does not recognise forms; it removes double quotes wherever they appear, escapes with backslash only inside a quoted run, and separates on the space character alone. tokenizeNodeOptions transcribes that algorithm, so the fix covers the shapes nobody enumerated. This is the ticket's own lesson — an instrument's vocabulary reported as the population — applied to the ticket's own prescription.

Delta 2 — the ticket did not mention the other channel, and the two are opposite. Quoting is NODE_OPTIONS syntax that Node consumes before V8 sees the flag. The same text on the command line reaches V8 intact and Node refuses to start:

node --max-old-space-size="256" -e 0
  → Error: Value for flag --max-old-space-size="256" of type size_t is out of bounds

So a live process can never carry a quoted execArgv entry, and applying the tokenizer to both channels would credit a ceiling to a process that could not have booted. execArgv keeps the strict parse. The asymmetry is pinned by its own test.

The same predicate was wrong in both directions on values

Not in the ticket; found by measuring the predicate rather than the reported symptom. All against the same 4288 MiB baseline:

=0 is the one worth naming: it binds nothing, and the old reader called it a ceiling of zero bytes. Every saturation ratio taken against zero is infinite, so an unbounded process read as catastrophically saturated. The last row is the /\s+/ split — only ' ' separates in NODE_OPTIONS, so that input aborts startup while the old reader reported a clean 256 MiB declaration.

The upper bound is Number.isSafeInteger on the byte product, not a transcribed V8 size_t constant: the rule is "never state a byte count this runtime cannot represent exactly", which is a property of the arithmetic here and needs nothing from a runtime we do not control.

ambiguous is widened, and consumers already handle it. It now means "a declaration is in play and no single ceiling can be read from it" — divergence between channels, or a declaration naming the flag without yielding a ceiling. Both leave bytes: null. ContainerHealthDiagnosisService.mjs:1975 gates on ceilingState !== 'declared', so the widening reaches the only consumer as the same refusal. What is emphatically not returned is undeclared, which is affirmative evidence that no declaration exists.

Deltas

Delta 3 — gap 2 is fixed with a reader thunk, not by moving the default into the body. The obvious repair is config ??= AiConfig.heapObservation inside the try. That does put the production read under the guard — and leaves the totality claim unfalsifiable by unit test, because proving it would require making AiConfig.heapObservation itself throw, i.e. mutating the shared singleton (ADR 0019 §4 B4, the mechanism behind the #12335 orphan incident). The seam is now readConfig = () => AiConfig.heapObservation: creating an arrow-function literal cannot throw, the read happens at readConfig() inside the guard, and production and every spec arm run the identical mechanism, differing only in which function is invoked. An injected throwing reader is therefore a true falsifier for the shipped path.

That distinction is the whole defect. The superseded spec injected {get enabled() { throw }} — a failure one property deeper, reachable from inside any guard — so it passed against a boundary production never crossed, which is exactly what the ticket caught. Both depths now have a test.

AiConfig reads stay at the use site, no alias (B2), no defensive ?. (B3), no threading (B5). observationPath's own default-parameter read is untouched and already guarded: it is evaluated when the method is called, which is inside writeOnce()'s try.

Test Evidence

npm run test-unit -- unit/ai/services/shared/processHeapObservation.spec.mjs \
                     unit/ai/mcp/server/shared/services/HeapObservationReporterService.spec.mjs
  55 passed

npm run test-unit -- unit/ai/deploy/DeclaredHeapCeilings.spec.mjs \
                     unit/ai/daemons/orchestrator/DeclaredHeapCeilingObservation.spec.mjs \
                     unit/ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.spec.mjs \
                     unit/ai/mcp/server/
  707 passed

Mutation-differential — both source files reverted to the merge base, specs kept:

All 14 are tests this PR adds or whose seam it renames; no untouched pre-existing test reddens, so no contracted behaviour changed. The two new parser tests that stay green on the merge base are deliberate controls — the unquoted baseline row, and the check that quote-stripping does not swallow the options around it.

What this does NOT establish

• One Node line. Every row was measured on node v25.9.0. The tokenizer transcribes an algorithm that has been stable in node_options.cc for years, but the value rules (=0 and overflow being silently ignored) are V8 behaviour I observed rather than a documented contract.
• It does not prove the ceiling is correct — only that a declaration present in either channel is never reported as absent, and that a number is never stated for a declaration that does not produce one.
• heapSizeLimitBytes remains the independent instrument. Nothing here derives a ceiling from it or vice versa.

Post-Merge Validation

• On the next deployment touching Node's major version, re-run the two measurement harnesses (attached to the ticket) and confirm the =0 / overflow rows still land in ambiguous. They encode V8 behaviour, not a documented contract, and a change there would move a row from ambiguous to declared — the safe direction, but worth seeing.

Commits

• 1c0bf86db9 — the tokenizer, the value rules, and the widened ambiguous
• 2cde0d7797 — the reporter's boot guard covers the config read it claims to

Authored by Ada (Claude Opus 5, Claude Code). Session 87f453f9-aa80-4487-9ed1-b5d91e052c43.