@camstack/system 1.1.0 → 1.1.1

package/dist/{manifest-python-deps-BWURo7dc.js → manifest-python-deps-RihGbmpb.js}

@@ -3352,926 +3352,945 @@ function createLocalTransport() {
 	};
 }
 //#endregion
-//#region src/kernel/transport/local-child-registry.ts
-/**
-* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
-* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
-* prefix to distinguish routing failures (safe to retry via broker) from real
-* provider errors (must NOT retry to avoid double-executing side effects).
-*/
-var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+//#region src/kernel/moleculer/resilient-cap-call.ts
+/** Moleculer error `type` values meaning "the service is not (yet) routable". */
+var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
+/** Default ceiling for the discovery wait — fail-fast past this. */
+var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
+function isDiscoveryError(err) {
+	if (typeof err !== "object" || err === null) return false;
+	const type = err.type;
+	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+}
 /**
-* Parent-side authority for local addon-runners reachable over a
-* `LocalTransportServer` (UDS). Children register their cap manifest on
-* connect; the registry routes `(capName, deviceId?)` cap calls to the
-* owning child over the channel and drops a child's caps on disconnect.
+* Call a Moleculer action; on a service-discovery error, wait for the
+* named service to be discovered and retry the call exactly once.
 */
-var LocalChildRegistry = class {
-	children = /* @__PURE__ */ new Map();
-	registeredHandler = () => {};
-	goneHandler = () => {};
-	eventHandler = null;
-	logHandler = null;
-	readinessHandler = null;
-	server;
-	onUnownedCall;
-	logger;
-	getActiveSingletonAddonId;
-	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
-	egressRoutedCaps = /* @__PURE__ */ new Set();
-	/**
-	* Accepts either a plain positional `server` argument (backward-compatible)
-	* or a full `LocalChildRegistryOptions` object.
-	*
-	* Positional overloads (existing call sites are unchanged):
-	*   new LocalChildRegistry(server)
-	*   new LocalChildRegistry(server, onUnownedCall)
-	*
-	* Options object (new call sites that pass a logger):
-	*   new LocalChildRegistry({ server, onUnownedCall, logger })
-	*/
-	constructor(serverOrOptions, onUnownedCallArg) {
-		if (serverOrOptions && !("listen" in serverOrOptions)) {
-			const opts = serverOrOptions;
-			this.server = opts.server;
-			this.onUnownedCall = opts.onUnownedCall;
-			this.logger = opts.logger;
-			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
-		} else {
-			this.server = serverOrOptions;
-			this.onUnownedCall = onUnownedCallArg;
-		}
-	}
-	async start() {
-		this.server.onConnection((channel) => this.onConnection(channel));
-		await this.server.listen();
+async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
+	try {
+		return await broker.call(action, params, opts);
+	} catch (err) {
+		if (!isDiscoveryError(err)) throw err;
+		await broker.waitForServices([serviceName], discoveryTimeoutMs);
+		return await broker.call(action, params, opts);
 	}
+}
+//#endregion
+//#region src/kernel/transport/cap-route.ts
+function buildMessage(capName, method, detail) {
+	const call = method !== void 0 ? `${capName}.${method}` : capName;
+	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
+	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
+	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
+	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+}
+var CapRouteError = class extends Error {
+	reason;
+	nodeId;
+	rejected;
 	/**
-	* Child id that can service a call to `capName` (optionally addressing
-	* `deviceId`), or null.
-	*
-	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
-	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
-	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
-	* many cameras — so its descriptor carries no `deviceId`. Resolving on
-	* `deviceId` alone would never match it and would force the call onto the
-	* broker fallback (which then hangs in service discovery). Hence:
-	*   1. exact device-scoped owner (native per-device caps where each child
-	*      owns a disjoint device subset) is preferred, then
-	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
-	* A cap is globally singleton XOR device-scoped, so the two tiers never
-	* compete for the same capName.
+	* @param cause  Optional original error that triggered this routing failure.
+	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
+	*               Dispatchers wrapping transport errors MUST pass the original.
 	*/
-	resolveChildId(capName, deviceId) {
-		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
-			if (deviceOwner !== null) return deviceOwner;
-		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
-		if (candidates.length === 0) return null;
-		if (candidates.length === 1) return candidates[0];
-		const preferred = this.getActiveSingletonAddonId?.(capName) ?? null;
-		if (preferred !== null && candidates.includes(preferred)) return preferred;
-		return candidates[0];
-	}
-	/** First child whose cap manifest contains a descriptor matching `predicate`. */
-	findChildId(predicate) {
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
-		return null;
+	constructor(capName, method, detail, cause) {
+		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
+		this.name = "CapRouteError";
+		this.reason = detail.reason;
+		this.nodeId = detail.nodeId;
+		this.rejected = detail.rejected;
 	}
-	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
-	findAllChildIds(predicate) {
-		const out = [];
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
-		return out;
+};
+/**
+* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
+*
+* Precedence (explicit nodeId path):
+*   1. hub-in-process — hub node + hubInProcessProvides
+*   2. hub-local-uds  — hub node + hubLocalChildProvides
+*   3. node-offline   → CapRouteError{reason:'node-offline'}
+*   4. agent-child-forward — node is an agent AND nodeKnowsCap
+*   5. remote-moleculer — any other online non-agent node
+*
+* Singleton path (no nodeId):
+*   1. hub-in-process (hub provides in-process)
+*   2. hub-local-uds  (a hub-local UDS child provides it)
+*   3. remote-moleculer (any online, non-hub node that knows it)
+*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
+*
+* PURE: no side effects, no async, no broker/registry imports.
+*/
+function classifyCapRoute(capName, opts, snapshot) {
+	const rejected = [];
+	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
+	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
+}
+function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
+	if (nodeId === snap.hubNodeId) {
+		if (snap.hubInProcessProvides(capName)) {
+			const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+			if (ref !== null) return {
+				kind: "hub-in-process",
+				capName,
+				ref
+			};
+			rejected.push({
+				kind: "hub-in-process",
+				why: "provider ref not available in snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		if (snap.hubLocalChildProvides(capName, deviceId)) {
+			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+			if (childId !== null) return {
+				kind: "hub-local-uds",
+				capName,
+				childId
+			};
+			rejected.push({
+				kind: "hub-local-uds",
+				why: "child id not resolvable from snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "hub does not provide this cap in-process"
+		});
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "no hub-local child provides this cap"
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
 	}
-	/**
-	* Does the named child currently provide `(capName, deviceId?)`?
-	*
-	* Used by the hub proxy seam, which knows the EXACT addon (→ runner →
-	* childId) a provider belongs to. Unlike `resolveChildId` (which picks the
-	* first child owning `capName`), this targets one child — required for
-	* COLLECTION caps (`addon-widgets-source`, …) where many children register
-	* the same capName: routing by capName alone collapses every provider to
-	* the first child. Same deviceId-as-hint semantics as `resolveChildId`:
-	* a device-scoped descriptor matching `deviceId` OR a deviceId-less
-	* (singleton/collection) descriptor counts.
-	*/
-	/**
-	* Is `childId` currently connected (has it completed its UDS handshake)?
-	* Coarser than {@link childProvides}: it answers "is the child reachable
-	* over UDS at all", regardless of which caps it has announced yet. Used by
-	* the route-mount fallback to decide between the handler-stripped
-	* `callAddonOnChild(target:'routes')` path (child reachable) and awaiting a
-	* cap proxy's `getRoutes()` (child not yet UDS-registered).
-	*/
-	isChildKnown(childId) {
-		return this.children.has(childId);
+	if (!snap.nodeOnline(nodeId)) {
+		rejected.push({
+			kind: "remote-moleculer",
+			why: `node ${nodeId} is offline`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "node-offline",
+			nodeId,
+			rejected
+		});
 	}
-	childProvides(childId, capName, deviceId) {
-		const entry = this.children.get(childId);
-		if (!entry) return false;
-		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
-		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
+	if (snap.nodeIsAgent(nodeId)) {
+		if (snap.nodeKnowsCap(nodeId, capName)) return {
+			kind: "agent-child-forward",
+			capName,
+			agentNodeId: nodeId,
+			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+		};
+		rejected.push({
+			kind: "agent-child-forward",
+			why: `agent ${nodeId} does not know cap ${capName}`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
 	}
-	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
-	async callCapOnChild(childId, input) {
-		const entry = this.children.get(childId);
-		if (!entry) throw new Error(`no local child "${childId}" for cap "${input.capName}"`);
-		return entry.channel.request(this.toCapCall(input));
-	}
-	/** Forward a cap method call to the owning child over UDS; rejects if none. */
-	async callCap(input) {
-		const childId = this.resolveChildId(input.capName, input.deviceId);
-		const entry = childId === null ? void 0 : this.children.get(childId);
-		if (!entry) {
-			const where = input.deviceId === void 0 ? "" : ` for device ${input.deviceId}`;
-			throw new Error(`no local child provides cap "${input.capName}"${where}`);
-		}
-		return entry.channel.request(this.toCapCall(input));
-	}
-	/**
-	* Forward an ADDON-LEVEL call (routes / custom-action) to a SPECIFIC child
-	* by id over UDS; rejects if that child is absent.
-	*
-	* The childId for a hub-local single-addon runner equals the addonId
-	* (`resolveRunnerId` returns the addonId when no `execution.group` is
-	* declared — no shipped addon declares one). Mirrors `callCapOnChild` for
-	* the cap plane; carries the two surfaces the removed per-addon Moleculer
-	* broker used to serve (`getRoutes` + `custom.<action>`).
-	*/
-	async callAddonOnChild(childId, input) {
-		const entry = this.children.get(childId);
-		if (!entry) throw new Error(`no local child "${childId}" for addon-call (${input.target})`);
-		return entry.channel.request(this.toAddonCall(input));
-	}
-	/** Build the parent→child `addon-call` wire message from an addon-call input. */
-	toAddonCall(input) {
-		return {
-			kind: "addon-call",
-			addonId: input.addonId,
-			target: input.target,
-			...input.action !== void 0 ? { action: input.action } : {},
-			...input.method !== void 0 ? { method: input.method } : {},
-			...input.args !== void 0 ? { args: input.args } : {}
+	return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+}
+function classifySingleton(capName, deviceId, snap, rejected) {
+	if (snap.hubInProcessProvides(capName)) {
+		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		if (ref !== null) return {
+			kind: "hub-in-process",
+			capName,
+			ref
 		};
-	}
-	/** Build the parent→child `cap-call` wire message from a routing input. */
-	toCapCall(input) {
-		return {
-			kind: "cap-call",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "provider ref not available in snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-in-process",
+		why: "hub does not provide this cap in-process"
+	});
+	if (snap.hubLocalChildProvides(capName, deviceId)) {
+		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId !== null) return {
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "child id not resolvable from snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-local-uds",
+		why: "no hub-local child provides this cap"
+	});
+	const knownNodes = snap.listKnownNodeIds?.() ?? [];
+	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+	rejected.push({
+		kind: "remote-moleculer",
+		why: "no online remote node knows this cap"
+	});
+	throw new CapRouteError(capName, void 0, {
+		reason: "no-provider",
+		rejected
+	});
+}
+//#endregion
+//#region src/kernel/transport/cap-route-resolver.ts
+/** The Moleculer service name that Task 6's agent registers. */
+var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
+/** The Moleculer action (service.action) for agent cap forwarding. */
+var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
+/** Default timeout for remote Moleculer cap calls (ms). */
+var REMOTE_CALL_TIMEOUT_MS = 6e4;
+function extractDeviceId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "deviceId");
+	return typeof raw === "number" ? raw : void 0;
+}
+/**
+* Extract an inline `nodeId` string from a cap call's args — the per-call node
+* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
+* device-scoped caps carry `deviceId`, and the way the generated cap-router on
+* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
+*
+* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
+* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
+* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
+* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
+* methods that don't declare `nodeId` simply ignore the extra field (they
+* destructure the fields they need); methods that DO declare it (e.g.
+* `getEngineProvisioning({nodeId})`) still receive it unchanged.
+*/
+function extractNodeId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "nodeId");
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+var CapRouteResolver = class {
+	hubNodeId;
+	broker;
+	hubLocalRegistry;
+	nodeAuthority;
+	inProcessProviders;
+	snapshot;
+	constructor(deps) {
+		this.hubNodeId = deps.hubNodeId;
+		this.broker = deps.broker;
+		this.hubLocalRegistry = deps.hubLocalRegistry;
+		this.nodeAuthority = deps.nodeAuthority;
+		this.inProcessProviders = deps.inProcessProviders;
+		this.snapshot = this.buildSnapshot();
 	}
-	listChildren() {
-		return [...this.children.values()].map((e) => ({
-			childId: e.childId,
-			caps: e.caps
-		}));
-	}
-	/** Register the (single) child-registered handler. Only one handler is active at a time. */
-	onChildRegistered(handler) {
-		this.registeredHandler = handler;
-	}
-	/** Register the (single) child-gone handler. Only one handler is active at a time. */
-	onChildGone(handler) {
-		this.goneHandler = handler;
-	}
-	/**
-	* Register the (single) child-event handler. Invoked when a child sends an
-	* event via `LocalChildClient.emitEvent`. Only one handler is active at a
-	* time; a new handler replaces the prior one. Pass `null` to clear the
-	* handler entirely (used by the UDS event bridge disposer on shutdown).
-	*/
-	onChildEvent(handler) {
-		this.eventHandler = handler;
-	}
-	/**
-	* Register the (single) child-log handler. Invoked when a child sends a log
-	* entry via `LocalChildClient.sendLog`. Only one handler is active.
-	*/
-	onChildLog(handler) {
-		this.logHandler = handler;
-	}
-	/**
-	* Register the handler that supplies the authoritative readiness snapshot
-	* when a child sends a `readiness-request`. Only one handler is active.
-	*/
-	onReadinessSnapshotRequest(handler) {
-		this.readinessHandler = handler;
+	resolveCapRoute(capName, opts) {
+		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* Push a parent→child event to a specific child. Fire-and-forget (uses the
-	* one-way `emit` path on the channel). No-op if the child is not connected.
+	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
+	* child, IGNORING any in-hub provider registered for the same cap name.
+	*
+	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
+	* provider (e.g. a wrapper) is registered for the cap, the route always
+	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
+	* reached. That is correct for the generic dispatch path (the wrapper is the
+	* active provider), but WRONG for the native-cap fallback
+	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
+	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
+	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
+	* itself, the native is never invoked, and the wrapper silently falls
+	* through to its secondary strategy.
+	*
+	* This method consults ONLY the hub-local-child authority
+	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
+	* it returns the native child route regardless of any in-process shadow.
+	* Returns null when no hub-local child owns `(capName, deviceId)` — the
+	* caller then falls through to its remote-resolution branch.
 	*/
-	sendEventToChild(childId, event, sourceNodeId) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return;
-		const msg = {
-			kind: "event",
-			event,
-			sourceNodeId
+	resolveHubLocalUdsRoute(capName, deviceId) {
+		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
+		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId === null) return null;
+		return {
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
-		entry.channel.emit(msg);
 	}
-	/**
-	* Push a parent→child event to every registered child, optionally skipping
-	* one (the originating child, to avoid echo). Fire-and-forget.
-	*/
-	broadcastEventToChildren(event, sourceNodeId, exceptChildId) {
-		for (const entry of this.children.values()) {
-			if (entry.childId === exceptChildId) continue;
-			const msg = {
-				kind: "event",
-				event,
-				sourceNodeId
-			};
-			entry.channel.emit(msg);
+	async dispatch(route, method, args) {
+		try {
+			return await this.dispatchInner(route, method, args);
+		} catch (err) {
+			if (err instanceof CapRouteError) throw err;
+			const nodeId = this.routeNodeId(route);
+			const cause = err instanceof Error ? err : new Error(String(err));
+			throw new CapRouteError(route.capName, method, {
+				reason: "transport-failed",
+				nodeId,
+				rejected: [{
+					kind: route.kind,
+					why: cause.message
+				}]
+			}, cause);
 		}
 	}
 	/**
-	* E2: Send a `set-log-level` control message to a specific child.
-	* Returns `true` if the child is currently connected and the message was
-	* emitted; `false` if the child is not connected (no-op). The `false`
-	* return lets the caller (MoleculerService.setChildLogLevelByNodeId) fall
-	* back to the Moleculer `$node-mgmt.setLogLevel` action for the node.
-	* Mirrors the `$node-mgmt.setLogLevel` Moleculer action for UDS children.
+	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
+	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
 	*/
-	setChildLogLevel(childId, level) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return false;
-		const msg = {
-			kind: "set-log-level",
-			level
-		};
-		entry.channel.emit(msg);
-		return true;
-	}
-	async close() {
-		await this.server.close();
-	}
-	onConnection(channel) {
-		let childId = null;
-		channel.onEvent((body) => {
-			const msg = body;
-			if (msg.kind === "event") {
-				if (childId !== null) this.eventHandler?.(childId, msg.event);
-				return;
-			}
-			if (msg.kind === "log") {
-				if (childId !== null) this.logHandler?.(childId, msg);
-				return;
+	async dispatchInner(route, method, args) {
+		switch (route.kind) {
+			case "hub-in-process": return route.ref.invoke(method, args);
+			case "hub-local-uds": {
+				const registry = this.hubLocalRegistry;
+				if (registry === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					rejected: [{
+						kind: "hub-local-uds",
+						why: "UDS registry not available"
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const input = {
+					capName: route.capName,
+					method,
+					args,
+					...deviceId !== void 0 ? { deviceId } : {}
+				};
+				return registry.callCapOnChild(route.childId, input);
 			}
-		});
-		channel.onRequest(async (body) => {
-			const msg = body;
-			if (msg.kind === "register") {
-				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
-				childId = msg.childId;
-				this.children.set(msg.childId, {
-					childId: msg.childId,
-					channel,
-					caps: msg.caps
+			case "remote-moleculer": {
+				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
+				if (addonId === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					nodeId: route.nodeId,
+					rejected: [{
+						kind: "remote-moleculer",
+						why: `no addonId known for ${route.nodeId}/${route.capName}`
+					}]
 				});
-				this.registeredHandler({
-					childId: msg.childId,
-					caps: msg.caps
+				const deviceId = extractDeviceId(args);
+				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
+				const action = capActionName(addonId, route.capName, method, isNative);
+				return callWithServiceDiscovery(this.broker, addonId, action, args, {
+					nodeID: route.nodeId,
+					timeout: REMOTE_CALL_TIMEOUT_MS
 				});
-				return { ok: true };
 			}
-			if (msg.kind === "cap-call-out") {
-				const out = msg;
-				const input = {
-					capName: out.capName,
-					method: out.method,
-					args: out.args,
-					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
-					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {}
+			case "agent-child-forward": {
+				const deviceId = extractDeviceId(args);
+				const params = {
+					capName: route.capName,
+					method,
+					args,
+					...route.childId !== void 0 ? { childId: route.childId } : {},
+					...deviceId !== void 0 ? { deviceId } : {}
 				};
-				if (this.resolveChildId(out.capName, out.deviceId) !== null) {
-					if (!this.egressRoutedCaps.has(out.capName)) {
-						this.egressRoutedCaps.add(out.capName);
-						this.logger?.info("routed child egress over UDS", { capName: out.capName });
-					}
-					return this.callCap(input);
-				}
-				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
-				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
+				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
+					nodeID: route.agentNodeId,
+					timeout: REMOTE_CALL_TIMEOUT_MS
+				});
 			}
-			if (msg.kind === "readiness-request") return {
-				kind: "readiness-snapshot",
-				records: this.readinessHandler?.() ?? []
-			};
-			throw new Error(`unknown child request kind: ${msg.kind}`);
-		});
-		channel.onClose(() => {
-			if (childId !== null && this.children.delete(childId)) this.goneHandler(childId);
-		});
+		}
+	}
+	buildSnapshot() {
+		const hubLocalRegistry = this.hubLocalRegistry;
+		const nodeAuthority = this.nodeAuthority;
+		const inProcessProviders = this.inProcessProviders;
+		return {
+			hubNodeId: this.hubNodeId,
+			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
+			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
+			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
+			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
+			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
+			getInProcessProviderRef: (cap) => inProcessProviders(cap),
+			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
+			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
+		};
+	}
+	/** Extract a nodeId string from a route for error reporting, or undefined. */
+	routeNodeId(route) {
+		switch (route.kind) {
+			case "hub-in-process": return this.hubNodeId;
+			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
+			case "remote-moleculer": return route.nodeId;
+			case "agent-child-forward": return route.agentNodeId;
+		}
 	}
 };
 //#endregion
-//#region src/kernel/transport/local-child-client.ts
+//#region src/kernel/transport/local-child-registry.ts
 /**
-* Child side of the local UDS transport. Connects to its parent (hub or
-* agent), registers its cap manifest, and serves parent→child cap calls by
-* delegating to `dispatch`. The provider implementation lives in the child;
-* only routing keys + call arguments cross the wire.
-*
-* Additional channels beyond cap-call:
-*   - `emitEvent`              fire-and-forget event toward the parent
-*   - `sendLog`                fire-and-forget log entry toward the parent
-*   - `requestReadinessSnapshot` request/response snapshot of readiness records
-*   - `onEvent`                register a handler for parent→child events
-*
-* Events and logs emitted before `start()` resolves are buffered and flushed
-* on connect (mirrors the `updateCaps`/`latestCaps` pattern).
+* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
+* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
+* prefix to distinguish routing failures (safe to retry via broker) from real
+* provider errors (must NOT retry to avoid double-executing side effects).
 */
-var LocalChildClient = class {
-	options;
-	client = null;
-	channel = null;
-	/**
-	* The cap set `start()` will register, kept current by `updateCaps`. Native
-	* device caps register on device-restore, which can race AHEAD of the UDS
-	* connect — buffering here lets a pre-start `updateCaps` survive (start sends
-	* the latest set) instead of being lost or throwing.
-	*/
-	latestCaps;
-	/** Events and logs queued while the channel is not yet open. */
-	pendingEmits = [];
-	/** Handler for parent→child events. Registered via `onEvent`. */
+var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+/**
+* Parent-side authority for local addon-runners reachable over a
+* `LocalTransportServer` (UDS). Children register their cap manifest on
+* connect; the registry routes `(capName, deviceId?)` cap calls to the
+* owning child over the channel and drops a child's caps on disconnect.
+*/
+var LocalChildRegistry = class {
+	children = /* @__PURE__ */ new Map();
+	registeredHandler = () => {};
+	goneHandler = () => {};
 	eventHandler = null;
+	logHandler = null;
+	readinessHandler = null;
+	server;
+	onUnownedCall;
+	logger;
+	getActiveSingletonAddonId;
+	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
+	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/**
-	* Handler for parent→child addon-level calls (`routes` / `custom`).
-	* Registered via `onAddonCall`. Resolves the loaded addon instance and
-	* invokes its `addon-routes.getRoutes()` or its custom-action handler.
-	* Replaces the per-addon Moleculer `getRoutes` / `custom.<action>` actions
-	* removed in F1/F2. Only one handler is active at a time.
-	*/
-	addonCallHandler = null;
-	/**
-	* Handler for `set-log-level` messages pushed by the parent.
-	* Registered via `onSetLogLevel`. The handler applies the new level to the
-	* child's local Moleculer logger (mirrors `$node-mgmt.setLogLevel`).
-	* E2: wired in `addon-runner.ts` to forward to the broker logger.
+	* Accepts either a plain positional `server` argument (backward-compatible)
+	* or a full `LocalChildRegistryOptions` object.
+	*
+	* Positional overloads (existing call sites are unchanged):
+	*   new LocalChildRegistry(server)
+	*   new LocalChildRegistry(server, onUnownedCall)
+	*
+	* Options object (new call sites that pass a logger):
+	*   new LocalChildRegistry({ server, onUnownedCall, logger })
 	*/
-	setLogLevelHandler = null;
-	/** Callbacks registered via `onConnected`. Fired on every (re)connect. */
-	connectedHandlers = [];
-	constructor(options) {
-		this.options = options;
-		this.latestCaps = options.caps;
+	constructor(serverOrOptions, onUnownedCallArg) {
+		if (serverOrOptions && !("listen" in serverOrOptions)) {
+			const opts = serverOrOptions;
+			this.server = opts.server;
+			this.onUnownedCall = opts.onUnownedCall;
+			this.logger = opts.logger;
+			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
+		} else {
+			this.server = serverOrOptions;
+			this.onUnownedCall = onUnownedCallArg;
+		}
 	}
-	/**
-	* Register a callback that fires each time the client successfully connects
-	* (or reconnects) to its parent. Multiple handlers may be registered; all
-	* are called in registration order. Used by readiness-context in UDS mode
-	* to trigger a snapshot hydrate on connect/reconnect.
-	*/
-	onConnected(handler) {
-		this.connectedHandlers.push(handler);
+	async start() {
+		this.server.onConnection((channel) => this.onConnection(channel));
+		await this.server.listen();
 	}
 	/**
-	* Register a handler for events pushed from the parent to this child.
-	* Must be called before `start()` to avoid missing early events (though
-	* registration after start is also safe for events not yet delivered).
-	* Replaces any previously registered handler.
+	* Child id that can service a call to `capName` (optionally addressing
+	* `deviceId`), or null.
+	*
+	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
+	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
+	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
+	* many cameras — so its descriptor carries no `deviceId`. Resolving on
+	* `deviceId` alone would never match it and would force the call onto the
+	* broker fallback (which then hangs in service discovery). Hence:
+	*   1. exact device-scoped owner (native per-device caps where each child
+	*      owns a disjoint device subset) is preferred, then
+	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
+	* A cap is globally singleton XOR device-scoped, so the two tiers never
+	* compete for the same capName.
 	*/
-	onEvent(handler) {
-		this.eventHandler = handler;
+	resolveChildId(capName, deviceId) {
+		if (deviceId !== void 0) {
+			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
+			if (deviceOwner !== null) return deviceOwner;
+		}
+		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
+		if (candidates.length === 0) return null;
+		if (candidates.length === 1) return candidates[0];
+		const preferred = this.getActiveSingletonAddonId?.(capName) ?? null;
+		if (preferred !== null && candidates.includes(preferred)) return preferred;
+		return candidates[0];
 	}
-	/**
-	* Register the handler invoked when the parent sends an `addon-call` (the
-	* addon-level routes / custom-action plane). The addon-runner wires this to
-	* resolve the loaded addon by id and dispatch to its `getRoutes()` or its
-	* custom-action handler. Safe to register before or after `start()`;
-	* replaces any prior handler.
-	*/
-	onAddonCall(handler) {
-		this.addonCallHandler = handler;
+	/** First child whose cap manifest contains a descriptor matching `predicate`. */
+	findChildId(predicate) {
+		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
+		return null;
+	}
+	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
+	findAllChildIds(predicate) {
+		const out = [];
+		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
+		return out;
 	}
 	/**
-	* E2: Register a handler invoked when the parent sends a `set-log-level`
-	* message to this child. The handler should forward the new level to the
-	* child's local Moleculer broker logger (mirrors `$node-mgmt.setLogLevel`).
-	* Safe to register before or after `start()`. Replaces any prior handler.
+	* Does the named child currently provide `(capName, deviceId?)`?
+	*
+	* Used by the hub proxy seam, which knows the EXACT addon (→ runner →
+	* childId) a provider belongs to. Unlike `resolveChildId` (which picks the
+	* first child owning `capName`), this targets one child — required for
+	* COLLECTION caps (`addon-widgets-source`, …) where many children register
+	* the same capName: routing by capName alone collapses every provider to
+	* the first child. Same deviceId-as-hint semantics as `resolveChildId`:
+	* a device-scoped descriptor matching `deviceId` OR a deviceId-less
+	* (singleton/collection) descriptor counts.
 	*/
-	onSetLogLevel(handler) {
-		this.setLogLevelHandler = handler;
-	}
 	/**
-	* True once `start()` has successfully connected and registered. Used by
-	* callers (event-bus/logger bridges) to know the channel is live.
+	* Is `childId` currently connected (has it completed its UDS handshake)?
+	* Coarser than {@link childProvides}: it answers "is the child reachable
+	* over UDS at all", regardless of which caps it has announced yet. Used by
+	* the route-mount fallback to decide between the handler-stripped
+	* `callAddonOnChild(target:'routes')` path (child reachable) and awaiting a
+	* cap proxy's `getRoutes()` (child not yet UDS-registered).
 	*/
-	get isConnected() {
-		return this.channel !== null;
+	isChildKnown(childId) {
+		return this.children.has(childId);
 	}
-	async start() {
-		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
-		const client = createLocalTransport().createClient(this.options.nodeId);
-		const channel = await client.connect();
-		channel.onRequest(async (body) => {
-			const msg = body;
-			if (msg.kind === "cap-call") return this.options.dispatch({
-				capName: msg.capName,
-				method: msg.method,
-				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {}
-			});
-			if (msg.kind === "addon-call") {
-				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
-				return this.addonCallHandler({
-					addonId: msg.addonId,
-					target: msg.target,
-					...msg.action !== void 0 ? { action: msg.action } : {},
-					...msg.method !== void 0 ? { method: msg.method } : {},
-					...msg.args !== void 0 ? { args: msg.args } : {}
-				});
-			}
-			throw new Error(`unknown parent request kind: ${msg.kind}`);
-		});
-		channel.onEvent((body) => {
-			const msg = body;
-			if (msg.kind === "event") {
-				this.eventHandler?.(msg.event);
-				return;
-			}
-			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
-		});
-		const register = {
-			kind: "register",
-			childId: this.options.childId,
-			caps: this.latestCaps
-		};
-		try {
-			await channel.request(register);
-		} catch (err) {
-			await client.close();
-			throw err;
-		}
-		this.client = client;
-		this.channel = channel;
-		this.flushPending(channel);
-		for (const cb of this.connectedHandlers) cb();
+	childProvides(childId, capName, deviceId) {
+		const entry = this.children.get(childId);
+		if (!entry) return false;
+		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
+		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
 	}
-	/** Flush buffered pre-start emits over the now-open channel. */
-	flushPending(channel) {
-		for (const item of this.pendingEmits) channel.emit(item.msg);
-		this.pendingEmits.length = 0;
+	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
+	async callCapOnChild(childId, input) {
+		const entry = this.children.get(childId);
+		if (!entry) throw new Error(`no local child "${childId}" for cap "${input.capName}"`);
+		return entry.channel.request(this.toCapCall(input));
+	}
+	/** Forward a cap method call to the owning child over UDS; rejects if none. */
+	async callCap(input) {
+		const childId = this.resolveChildId(input.capName, input.deviceId);
+		const entry = childId === null ? void 0 : this.children.get(childId);
+		if (!entry) {
+			const where = input.deviceId === void 0 ? "" : ` for device ${input.deviceId}`;
+			throw new Error(`no local child provides cap "${input.capName}"${where}`);
+		}
+		return entry.channel.request(this.toCapCall(input));
 	}
 	/**
-	* Re-send the cap manifest to the parent, atomically replacing the child's
-	* registered descriptor set. Call this after device-restore so newly
-	* registered native (device-scoped) caps become routable over UDS.
+	* Forward an ADDON-LEVEL call (routes / custom-action) to a SPECIFIC child
+	* by id over UDS; rejects if that child is absent.
 	*
-	* Safe to call before `start()`: the new set is buffered and `start()` sends
-	* it (device-restore can race ahead of the UDS connect). After `start()`,
-	* the set is sent immediately.
+	* The childId for a hub-local single-addon runner equals the addonId
+	* (`resolveRunnerId` returns the addonId when no `execution.group` is
+	* declared — no shipped addon declares one). Mirrors `callCapOnChild` for
+	* the cap plane; carries the two surfaces the removed per-addon Moleculer
+	* broker used to serve (`getRoutes` + `custom.<action>`).
 	*/
-	async updateCaps(caps) {
-		this.latestCaps = caps;
-		if (this.channel === null) return;
-		const register = {
-			kind: "register",
-			childId: this.options.childId,
-			caps
+	async callAddonOnChild(childId, input) {
+		const entry = this.children.get(childId);
+		if (!entry) throw new Error(`no local child "${childId}" for addon-call (${input.target})`);
+		return entry.channel.request(this.toAddonCall(input));
+	}
+	/** Build the parent→child `addon-call` wire message from an addon-call input. */
+	toAddonCall(input) {
+		return {
+			kind: "addon-call",
+			addonId: input.addonId,
+			target: input.target,
+			...input.action !== void 0 ? { action: input.action } : {},
+			...input.method !== void 0 ? { method: input.method } : {},
+			...input.args !== void 0 ? { args: input.args } : {}
 		};
-		await this.channel.request(register);
+	}
+	/** Build the parent→child `cap-call` wire message from a routing input. */
+	toCapCall(input) {
+		return {
+			kind: "cap-call",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {}
+		};
+	}
+	listChildren() {
+		return [...this.children.values()].map((e) => ({
+			childId: e.childId,
+			caps: e.caps
+		}));
+	}
+	/** Register the (single) child-registered handler. Only one handler is active at a time. */
+	onChildRegistered(handler) {
+		this.registeredHandler = handler;
+	}
+	/** Register the (single) child-gone handler. Only one handler is active at a time. */
+	onChildGone(handler) {
+		this.goneHandler = handler;
 	}
 	/**
-	* Fire-and-forget: send a system event to the parent for forwarding to the
-	* hub event bus. Safe to call before `start()` — events are buffered and
-	* flushed on connect.
+	* Register the (single) child-event handler. Invoked when a child sends an
+	* event via `LocalChildClient.emitEvent`. Only one handler is active at a
+	* time; a new handler replaces the prior one. Pass `null` to clear the
+	* handler entirely (used by the UDS event bridge disposer on shutdown).
 	*/
-	emitEvent(event) {
-		const msg = {
-			kind: "event",
-			event
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "event",
-			msg
-		});
+	onChildEvent(handler) {
+		this.eventHandler = handler;
 	}
 	/**
-	* Fire-and-forget: send a structured log entry to the parent. Safe to call
-	* before `start()` — log entries are buffered and flushed on connect.
+	* Register the (single) child-log handler. Invoked when a child sends a log
+	* entry via `LocalChildClient.sendLog`. Only one handler is active.
 	*/
-	sendLog(entry) {
-		const msg = {
-			kind: "log",
-			...entry
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "log",
-			msg
-		});
+	onChildLog(handler) {
+		this.logHandler = handler;
 	}
 	/**
-	* Request the current readiness snapshot from the parent. Returns the
-	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
-	* Requires `start()` to have been called; throws with a clear message if not.
+	* Register the handler that supplies the authoritative readiness snapshot
+	* when a child sends a `readiness-request`. Only one handler is active.
 	*/
-	async requestReadinessSnapshot() {
-		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
-		return (await this.channel.request({ kind: "readiness-request" })).records;
+	onReadinessSnapshotRequest(handler) {
+		this.readinessHandler = handler;
 	}
 	/**
-	* Ask the parent to execute a cap call this child does NOT own. The parent
-	* routes to the owning local sibling over UDS, or — if no sibling owns it —
-	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
-	* production). Throws if called before `start()`.
+	* Push a parent→child event to a specific child. Fire-and-forget (uses the
+	* one-way `emit` path on the channel). No-op if the child is not connected.
 	*/
-	async callOut(input) {
-		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+	sendEventToChild(childId, event, sourceNodeId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return;
 		const msg = {
-			kind: "cap-call-out",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
+			kind: "event",
+			event,
+			sourceNodeId
 		};
-		return this.channel.request(msg);
-	}
-	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
-	async close() {
-		await this.client?.close();
-		this.client = null;
-		this.channel = null;
+		entry.channel.emit(msg);
 	}
-};
-//#endregion
-//#region src/kernel/transport/cap-route.ts
-function buildMessage(capName, method, detail) {
-	const call = method !== void 0 ? `${capName}.${method}` : capName;
-	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
-	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
-	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
-	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
-}
-var CapRouteError = class extends Error {
-	reason;
-	nodeId;
-	rejected;
 	/**
-	* @param cause  Optional original error that triggered this routing failure.
-	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
-	*               Dispatchers wrapping transport errors MUST pass the original.
+	* Push a parent→child event to every registered child, optionally skipping
+	* one (the originating child, to avoid echo). Fire-and-forget.
 	*/
-	constructor(capName, method, detail, cause) {
-		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
-		this.name = "CapRouteError";
-		this.reason = detail.reason;
-		this.nodeId = detail.nodeId;
-		this.rejected = detail.rejected;
-	}
-};
-/**
-* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
-*
-* Precedence (explicit nodeId path):
-*   1. hub-in-process — hub node + hubInProcessProvides
-*   2. hub-local-uds  — hub node + hubLocalChildProvides
-*   3. node-offline   → CapRouteError{reason:'node-offline'}
-*   4. agent-child-forward — node is an agent AND nodeKnowsCap
-*   5. remote-moleculer — any other online non-agent node
-*
-* Singleton path (no nodeId):
-*   1. hub-in-process (hub provides in-process)
-*   2. hub-local-uds  (a hub-local UDS child provides it)
-*   3. remote-moleculer (any online, non-hub node that knows it)
-*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
-*
-* PURE: no side effects, no async, no broker/registry imports.
-*/
-function classifyCapRoute(capName, opts, snapshot) {
-	const rejected = [];
-	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
-	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
-}
-function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
-	if (nodeId === snap.hubNodeId) {
-		if (snap.hubInProcessProvides(capName)) {
-			const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-			if (ref !== null) return {
-				kind: "hub-in-process",
-				capName,
-				ref
-			};
-			rejected.push({
-				kind: "hub-in-process",
-				why: "provider ref not available in snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		if (snap.hubLocalChildProvides(capName, deviceId)) {
-			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-			if (childId !== null) return {
-				kind: "hub-local-uds",
-				capName,
-				childId
+	broadcastEventToChildren(event, sourceNodeId, exceptChildId) {
+		for (const entry of this.children.values()) {
+			if (entry.childId === exceptChildId) continue;
+			const msg = {
+				kind: "event",
+				event,
+				sourceNodeId
 			};
-			rejected.push({
-				kind: "hub-local-uds",
-				why: "child id not resolvable from snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
+			entry.channel.emit(msg);
 		}
-		rejected.push({
-			kind: "hub-in-process",
-			why: "hub does not provide this cap in-process"
-		});
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "no hub-local child provides this cap"
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
 	}
-	if (!snap.nodeOnline(nodeId)) {
-		rejected.push({
-			kind: "remote-moleculer",
-			why: `node ${nodeId} is offline`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "node-offline",
-			nodeId,
-			rejected
-		});
-	}
-	if (snap.nodeIsAgent(nodeId)) {
-		if (snap.nodeKnowsCap(nodeId, capName)) return {
-			kind: "agent-child-forward",
-			capName,
-			agentNodeId: nodeId,
-			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+	/**
+	* E2: Send a `set-log-level` control message to a specific child.
+	* Returns `true` if the child is currently connected and the message was
+	* emitted; `false` if the child is not connected (no-op). The `false`
+	* return lets the caller (MoleculerService.setChildLogLevelByNodeId) fall
+	* back to the Moleculer `$node-mgmt.setLogLevel` action for the node.
+	* Mirrors the `$node-mgmt.setLogLevel` Moleculer action for UDS children.
+	*/
+	setChildLogLevel(childId, level) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return false;
+		const msg = {
+			kind: "set-log-level",
+			level
 		};
-		rejected.push({
-			kind: "agent-child-forward",
-			why: `agent ${nodeId} does not know cap ${capName}`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
+		entry.channel.emit(msg);
+		return true;
 	}
-	return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-}
-function classifySingleton(capName, deviceId, snap, rejected) {
-	if (snap.hubInProcessProvides(capName)) {
-		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-		if (ref !== null) return {
-			kind: "hub-in-process",
-			capName,
-			ref
-		};
-		rejected.push({
-			kind: "hub-in-process",
-			why: "provider ref not available in snapshot"
+	async close() {
+		await this.server.close();
+	}
+	onConnection(channel) {
+		let childId = null;
+		channel.onEvent((body) => {
+			const msg = body;
+			if (msg.kind === "event") {
+				if (childId !== null) this.eventHandler?.(childId, msg.event);
+				return;
+			}
+			if (msg.kind === "log") {
+				if (childId !== null) this.logHandler?.(childId, msg);
+				return;
+			}
 		});
-	} else rejected.push({
-		kind: "hub-in-process",
-		why: "hub does not provide this cap in-process"
-	});
-	if (snap.hubLocalChildProvides(capName, deviceId)) {
-		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId !== null) return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "child id not resolvable from snapshot"
+		channel.onRequest(async (body) => {
+			const msg = body;
+			if (msg.kind === "register") {
+				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
+				childId = msg.childId;
+				this.children.set(msg.childId, {
+					childId: msg.childId,
+					channel,
+					caps: msg.caps
+				});
+				this.registeredHandler({
+					childId: msg.childId,
+					caps: msg.caps
+				});
+				return { ok: true };
+			}
+			if (msg.kind === "cap-call-out") {
+				const out = msg;
+				const input = {
+					capName: out.capName,
+					method: out.method,
+					args: out.args,
+					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
+					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {}
+				};
+				if (((out.nodeId ?? extractNodeId(out.args)) === void 0 ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+					if (!this.egressRoutedCaps.has(out.capName)) {
+						this.egressRoutedCaps.add(out.capName);
+						this.logger?.info("routed child egress over UDS", { capName: out.capName });
+					}
+					return this.callCap(input);
+				}
+				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
+				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
+			}
+			if (msg.kind === "readiness-request") return {
+				kind: "readiness-snapshot",
+				records: this.readinessHandler?.() ?? []
+			};
+			throw new Error(`unknown child request kind: ${msg.kind}`);
 		});
-	} else rejected.push({
-		kind: "hub-local-uds",
-		why: "no hub-local child provides this cap"
-	});
-	const knownNodes = snap.listKnownNodeIds?.() ?? [];
-	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-	rejected.push({
-		kind: "remote-moleculer",
-		why: "no online remote node knows this cap"
-	});
-	throw new CapRouteError(capName, void 0, {
-		reason: "no-provider",
-		rejected
-	});
-}
+		channel.onClose(() => {
+			if (childId !== null && this.children.delete(childId)) this.goneHandler(childId);
+		});
+	}
+};
 //#endregion
-//#region src/kernel/moleculer/resilient-cap-call.ts
-/** Moleculer error `type` values meaning "the service is not (yet) routable". */
-var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-/** Default ceiling for the discovery wait — fail-fast past this. */
-var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
-function isDiscoveryError(err) {
-	if (typeof err !== "object" || err === null) return false;
-	const type = err.type;
-	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
-}
+//#region src/kernel/transport/local-child-client.ts
 /**
-* Call a Moleculer action; on a service-discovery error, wait for the
-* named service to be discovered and retry the call exactly once.
+* Child side of the local UDS transport. Connects to its parent (hub or
+* agent), registers its cap manifest, and serves parent→child cap calls by
+* delegating to `dispatch`. The provider implementation lives in the child;
+* only routing keys + call arguments cross the wire.
+*
+* Additional channels beyond cap-call:
+*   - `emitEvent`              fire-and-forget event toward the parent
+*   - `sendLog`                fire-and-forget log entry toward the parent
+*   - `requestReadinessSnapshot` request/response snapshot of readiness records
+*   - `onEvent`                register a handler for parent→child events
+*
+* Events and logs emitted before `start()` resolves are buffered and flushed
+* on connect (mirrors the `updateCaps`/`latestCaps` pattern).
 */
-async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
-	try {
-		return await broker.call(action, params, opts);
-	} catch (err) {
-		if (!isDiscoveryError(err)) throw err;
-		await broker.waitForServices([serviceName], discoveryTimeoutMs);
-		return await broker.call(action, params, opts);
+var LocalChildClient = class {
+	options;
+	client = null;
+	channel = null;
+	/**
+	* The cap set `start()` will register, kept current by `updateCaps`. Native
+	* device caps register on device-restore, which can race AHEAD of the UDS
+	* connect — buffering here lets a pre-start `updateCaps` survive (start sends
+	* the latest set) instead of being lost or throwing.
+	*/
+	latestCaps;
+	/** Events and logs queued while the channel is not yet open. */
+	pendingEmits = [];
+	/** Handler for parent→child events. Registered via `onEvent`. */
+	eventHandler = null;
+	/**
+	* Handler for parent→child addon-level calls (`routes` / `custom`).
+	* Registered via `onAddonCall`. Resolves the loaded addon instance and
+	* invokes its `addon-routes.getRoutes()` or its custom-action handler.
+	* Replaces the per-addon Moleculer `getRoutes` / `custom.<action>` actions
+	* removed in F1/F2. Only one handler is active at a time.
+	*/
+	addonCallHandler = null;
+	/**
+	* Handler for `set-log-level` messages pushed by the parent.
+	* Registered via `onSetLogLevel`. The handler applies the new level to the
+	* child's local Moleculer logger (mirrors `$node-mgmt.setLogLevel`).
+	* E2: wired in `addon-runner.ts` to forward to the broker logger.
+	*/
+	setLogLevelHandler = null;
+	/** Callbacks registered via `onConnected`. Fired on every (re)connect. */
+	connectedHandlers = [];
+	constructor(options) {
+		this.options = options;
+		this.latestCaps = options.caps;
 	}
-}
-//#endregion
-//#region src/kernel/transport/cap-route-resolver.ts
-/** The Moleculer service name that Task 6's agent registers. */
-var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
-/** The Moleculer action (service.action) for agent cap forwarding. */
-var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
-/** Default timeout for remote Moleculer cap calls (ms). */
-var REMOTE_CALL_TIMEOUT_MS = 6e4;
-function extractDeviceId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "deviceId");
-	return typeof raw === "number" ? raw : void 0;
-}
-var CapRouteResolver = class {
-	hubNodeId;
-	broker;
-	hubLocalRegistry;
-	nodeAuthority;
-	inProcessProviders;
-	snapshot;
-	constructor(deps) {
-		this.hubNodeId = deps.hubNodeId;
-		this.broker = deps.broker;
-		this.hubLocalRegistry = deps.hubLocalRegistry;
-		this.nodeAuthority = deps.nodeAuthority;
-		this.inProcessProviders = deps.inProcessProviders;
-		this.snapshot = this.buildSnapshot();
+	/**
+	* Register a callback that fires each time the client successfully connects
+	* (or reconnects) to its parent. Multiple handlers may be registered; all
+	* are called in registration order. Used by readiness-context in UDS mode
+	* to trigger a snapshot hydrate on connect/reconnect.
+	*/
+	onConnected(handler) {
+		this.connectedHandlers.push(handler);
+	}
+	/**
+	* Register a handler for events pushed from the parent to this child.
+	* Must be called before `start()` to avoid missing early events (though
+	* registration after start is also safe for events not yet delivered).
+	* Replaces any previously registered handler.
+	*/
+	onEvent(handler) {
+		this.eventHandler = handler;
+	}
+	/**
+	* Register the handler invoked when the parent sends an `addon-call` (the
+	* addon-level routes / custom-action plane). The addon-runner wires this to
+	* resolve the loaded addon by id and dispatch to its `getRoutes()` or its
+	* custom-action handler. Safe to register before or after `start()`;
+	* replaces any prior handler.
+	*/
+	onAddonCall(handler) {
+		this.addonCallHandler = handler;
+	}
+	/**
+	* E2: Register a handler invoked when the parent sends a `set-log-level`
+	* message to this child. The handler should forward the new level to the
+	* child's local Moleculer broker logger (mirrors `$node-mgmt.setLogLevel`).
+	* Safe to register before or after `start()`. Replaces any prior handler.
+	*/
+	onSetLogLevel(handler) {
+		this.setLogLevelHandler = handler;
+	}
+	/**
+	* True once `start()` has successfully connected and registered. Used by
+	* callers (event-bus/logger bridges) to know the channel is live.
+	*/
+	get isConnected() {
+		return this.channel !== null;
 	}
-	resolveCapRoute(capName, opts) {
-		return classifyCapRoute(capName, opts, this.snapshot);
+	async start() {
+		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
+		const client = createLocalTransport().createClient(this.options.nodeId);
+		const channel = await client.connect();
+		channel.onRequest(async (body) => {
+			const msg = body;
+			if (msg.kind === "cap-call") return this.options.dispatch({
+				capName: msg.capName,
+				method: msg.method,
+				args: msg.args,
+				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {}
+			});
+			if (msg.kind === "addon-call") {
+				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
+				return this.addonCallHandler({
+					addonId: msg.addonId,
+					target: msg.target,
+					...msg.action !== void 0 ? { action: msg.action } : {},
+					...msg.method !== void 0 ? { method: msg.method } : {},
+					...msg.args !== void 0 ? { args: msg.args } : {}
+				});
+			}
+			throw new Error(`unknown parent request kind: ${msg.kind}`);
+		});
+		channel.onEvent((body) => {
+			const msg = body;
+			if (msg.kind === "event") {
+				this.eventHandler?.(msg.event);
+				return;
+			}
+			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
+		});
+		const register = {
+			kind: "register",
+			childId: this.options.childId,
+			caps: this.latestCaps
+		};
+		try {
+			await channel.request(register);
+		} catch (err) {
+			await client.close();
+			throw err;
+		}
+		this.client = client;
+		this.channel = channel;
+		this.flushPending(channel);
+		for (const cb of this.connectedHandlers) cb();
+	}
+	/** Flush buffered pre-start emits over the now-open channel. */
+	flushPending(channel) {
+		for (const item of this.pendingEmits) channel.emit(item.msg);
+		this.pendingEmits.length = 0;
 	}
 	/**
-	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
-	* child, IGNORING any in-hub provider registered for the same cap name.
-	*
-	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
-	* provider (e.g. a wrapper) is registered for the cap, the route always
-	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
-	* reached. That is correct for the generic dispatch path (the wrapper is the
-	* active provider), but WRONG for the native-cap fallback
-	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
-	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
-	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
-	* itself, the native is never invoked, and the wrapper silently falls
-	* through to its secondary strategy.
+	* Re-send the cap manifest to the parent, atomically replacing the child's
+	* registered descriptor set. Call this after device-restore so newly
+	* registered native (device-scoped) caps become routable over UDS.
 	*
-	* This method consults ONLY the hub-local-child authority
-	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
-	* it returns the native child route regardless of any in-process shadow.
-	* Returns null when no hub-local child owns `(capName, deviceId)` — the
-	* caller then falls through to its remote-resolution branch.
+	* Safe to call before `start()`: the new set is buffered and `start()` sends
+	* it (device-restore can race ahead of the UDS connect). After `start()`,
+	* the set is sent immediately.
 	*/
-	resolveHubLocalUdsRoute(capName, deviceId) {
-		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
-		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId === null) return null;
-		return {
-			kind: "hub-local-uds",
-			capName,
-			childId
+	async updateCaps(caps) {
+		this.latestCaps = caps;
+		if (this.channel === null) return;
+		const register = {
+			kind: "register",
+			childId: this.options.childId,
+			caps
 		};
+		await this.channel.request(register);
 	}
-	async dispatch(route, method, args) {
-		try {
-			return await this.dispatchInner(route, method, args);
-		} catch (err) {
-			if (err instanceof CapRouteError) throw err;
-			const nodeId = this.routeNodeId(route);
-			const cause = err instanceof Error ? err : new Error(String(err));
-			throw new CapRouteError(route.capName, method, {
-				reason: "transport-failed",
-				nodeId,
-				rejected: [{
-					kind: route.kind,
-					why: cause.message
-				}]
-			}, cause);
-		}
+	/**
+	* Fire-and-forget: send a system event to the parent for forwarding to the
+	* hub event bus. Safe to call before `start()` — events are buffered and
+	* flushed on connect.
+	*/
+	emitEvent(event) {
+		const msg = {
+			kind: "event",
+			event
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "event",
+			msg
+		});
 	}
 	/**
-	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
-	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
+	* Fire-and-forget: send a structured log entry to the parent. Safe to call
+	* before `start()` — log entries are buffered and flushed on connect.
 	*/
-	async dispatchInner(route, method, args) {
-		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, args);
-			case "hub-local-uds": {
-				const registry = this.hubLocalRegistry;
-				if (registry === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					rejected: [{
-						kind: "hub-local-uds",
-						why: "UDS registry not available"
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const input = {
-					capName: route.capName,
-					method,
-					args,
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return registry.callCapOnChild(route.childId, input);
-			}
-			case "remote-moleculer": {
-				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
-				if (addonId === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					nodeId: route.nodeId,
-					rejected: [{
-						kind: "remote-moleculer",
-						why: `no addonId known for ${route.nodeId}/${route.capName}`
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
-				const action = capActionName(addonId, route.capName, method, isNative);
-				return callWithServiceDiscovery(this.broker, addonId, action, args, {
-					nodeID: route.nodeId,
-					timeout: REMOTE_CALL_TIMEOUT_MS
-				});
-			}
-			case "agent-child-forward": {
-				const deviceId = extractDeviceId(args);
-				const params = {
-					capName: route.capName,
-					method,
-					args,
-					...route.childId !== void 0 ? { childId: route.childId } : {},
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
-					nodeID: route.agentNodeId,
-					timeout: REMOTE_CALL_TIMEOUT_MS
-				});
-			}
-		}
+	sendLog(entry) {
+		const msg = {
+			kind: "log",
+			...entry
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "log",
+			msg
+		});
 	}
-	buildSnapshot() {
-		const hubLocalRegistry = this.hubLocalRegistry;
-		const nodeAuthority = this.nodeAuthority;
-		const inProcessProviders = this.inProcessProviders;
-		return {
-			hubNodeId: this.hubNodeId,
-			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
-			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
-			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
-			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
-			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
-			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
-			getInProcessProviderRef: (cap) => inProcessProviders(cap),
-			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
-			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
+	/**
+	* Request the current readiness snapshot from the parent. Returns the
+	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
+	* Requires `start()` to have been called; throws with a clear message if not.
+	*/
+	async requestReadinessSnapshot() {
+		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
+		return (await this.channel.request({ kind: "readiness-request" })).records;
+	}
+	/**
+	* Ask the parent to execute a cap call this child does NOT own. The parent
+	* routes to the owning local sibling over UDS, or — if no sibling owns it —
+	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
+	* production). Throws if called before `start()`.
+	*/
+	async callOut(input) {
+		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+		const msg = {
+			kind: "cap-call-out",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
 		};
+		return this.channel.request(msg);
 	}
-	/** Extract a nodeId string from a route for error reporting, or undefined. */
-	routeNodeId(route) {
-		switch (route.kind) {
-			case "hub-in-process": return this.hubNodeId;
-			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
-			case "remote-moleculer": return route.nodeId;
-			case "agent-child-forward": return route.agentNodeId;
-		}
+	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
+	async close() {
+		await this.client?.close();
+		this.client = null;
+		this.channel = null;
 	}
 };
 //#endregion
@@ -4587,10 +4606,11 @@ var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function createParentUnownedCallHandler(deps) {
 	return async (input) => {
 		const deviceId = input.deviceId ?? extractDeviceId(input.args);
+		const nodeId = input.nodeId ?? extractNodeId(input.args);
 		const resolver = deps.getResolver();
 		if (resolver !== null) try {
 			const route = resolver.resolveCapRoute(input.capName, {
-				...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
+				...nodeId !== void 0 ? { nodeId } : {},
 				...deviceId !== void 0 ? { deviceId } : {}
 			});
 			return await resolver.dispatch(route, input.method, input.args);
@@ -4667,10 +4687,15 @@ function parsePath(path) {
 * on a forked worker that has a co-located pipeline-executor.
 */
 function localProviderLink(resolver, observerOpts) {
+	const localBase = resolver.localNodeId !== void 0 ? resolver.localNodeId.split("/")[0] ?? resolver.localNodeId : void 0;
 	return () => {
 		return ({ op, next }) => {
 			const parsed = parsePath(op.path);
 			if (!parsed) return next(op);
+			if (localBase !== void 0) {
+				const pinnedNodeId = (0, _camstack_types.readNodePin)(op.context);
+				if (pinnedNodeId !== void 0 && pinnedNodeId !== localBase) return next(op);
+			}
 			const provider = resolver.getByName(parsed.capName);
 			if (!provider || typeof provider !== "object") return next(op);
 			const fn = Reflect.get(provider, parsed.method);
@@ -6219,15 +6244,18 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 	node_fs.mkdirSync(addonDataDir, { recursive: true });
 	if (runtime.mode === "broker") ensureBindingSubscription(runtime.broker);
 	const regs = getRegistries(nodeId);
-	const workerResolver = { getByName(capabilityName) {
-		const preferred = regs.preferred.get(capabilityName);
-		if (preferred) {
-			const provider = regs.byAddonId.get(capabilityName)?.get(preferred);
-			if (provider) return provider;
+	const workerResolver = {
+		localNodeId: nodeId,
+		getByName(capabilityName) {
+			const preferred = regs.preferred.get(capabilityName);
+			if (preferred) {
+				const provider = regs.byAddonId.get(capabilityName)?.get(preferred);
+				if (provider) return provider;
+			}
+			const providers = regs.providers.get(capabilityName);
+			return (providers && providers.length > 0 ? providers[0] : void 0) ?? null;
 		}
-		const providers = regs.providers.get(capabilityName);
-		return (providers && providers.length > 0 ? providers[0] : void 0) ?? null;
-	} };
+	};
 	const usageRegistry = getCapUsageRegistry();
 	const observerOpts = {
 		callerAddonId: addonId,