@camstack/system 1.1.0 → 1.1.2

package/dist/{manifest-python-deps-BcrTzHH_.mjs → manifest-python-deps-8Wvwz-d1.mjs}

@@ -3351,926 +3351,945 @@ function createLocalTransport() {
 	};
 }
 //#endregion
-//#region src/kernel/transport/local-child-registry.ts
-/**
-* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
-* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
-* prefix to distinguish routing failures (safe to retry via broker) from real
-* provider errors (must NOT retry to avoid double-executing side effects).
-*/
-var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+//#region src/kernel/moleculer/resilient-cap-call.ts
+/** Moleculer error `type` values meaning "the service is not (yet) routable". */
+var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
+/** Default ceiling for the discovery wait — fail-fast past this. */
+var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
+function isDiscoveryError(err) {
+	if (typeof err !== "object" || err === null) return false;
+	const type = err.type;
+	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+}
 /**
-* Parent-side authority for local addon-runners reachable over a
-* `LocalTransportServer` (UDS). Children register their cap manifest on
-* connect; the registry routes `(capName, deviceId?)` cap calls to the
-* owning child over the channel and drops a child's caps on disconnect.
+* Call a Moleculer action; on a service-discovery error, wait for the
+* named service to be discovered and retry the call exactly once.
 */
-var LocalChildRegistry = class {
-	children = /* @__PURE__ */ new Map();
-	registeredHandler = () => {};
-	goneHandler = () => {};
-	eventHandler = null;
-	logHandler = null;
-	readinessHandler = null;
-	server;
-	onUnownedCall;
-	logger;
-	getActiveSingletonAddonId;
-	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
-	egressRoutedCaps = /* @__PURE__ */ new Set();
-	/**
-	* Accepts either a plain positional `server` argument (backward-compatible)
-	* or a full `LocalChildRegistryOptions` object.
-	*
-	* Positional overloads (existing call sites are unchanged):
-	*   new LocalChildRegistry(server)
-	*   new LocalChildRegistry(server, onUnownedCall)
-	*
-	* Options object (new call sites that pass a logger):
-	*   new LocalChildRegistry({ server, onUnownedCall, logger })
-	*/
-	constructor(serverOrOptions, onUnownedCallArg) {
-		if (serverOrOptions && !("listen" in serverOrOptions)) {
-			const opts = serverOrOptions;
-			this.server = opts.server;
-			this.onUnownedCall = opts.onUnownedCall;
-			this.logger = opts.logger;
-			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
-		} else {
-			this.server = serverOrOptions;
-			this.onUnownedCall = onUnownedCallArg;
-		}
-	}
-	async start() {
-		this.server.onConnection((channel) => this.onConnection(channel));
-		await this.server.listen();
+async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
+	try {
+		return await broker.call(action, params, opts);
+	} catch (err) {
+		if (!isDiscoveryError(err)) throw err;
+		await broker.waitForServices([serviceName], discoveryTimeoutMs);
+		return await broker.call(action, params, opts);
 	}
+}
+//#endregion
+//#region src/kernel/transport/cap-route.ts
+function buildMessage(capName, method, detail) {
+	const call = method !== void 0 ? `${capName}.${method}` : capName;
+	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
+	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
+	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
+	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+}
+var CapRouteError = class extends Error {
+	reason;
+	nodeId;
+	rejected;
 	/**
-	* Child id that can service a call to `capName` (optionally addressing
-	* `deviceId`), or null.
-	*
-	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
-	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
-	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
-	* many cameras — so its descriptor carries no `deviceId`. Resolving on
-	* `deviceId` alone would never match it and would force the call onto the
-	* broker fallback (which then hangs in service discovery). Hence:
-	*   1. exact device-scoped owner (native per-device caps where each child
-	*      owns a disjoint device subset) is preferred, then
-	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
-	* A cap is globally singleton XOR device-scoped, so the two tiers never
-	* compete for the same capName.
+	* @param cause  Optional original error that triggered this routing failure.
+	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
+	*               Dispatchers wrapping transport errors MUST pass the original.
 	*/
-	resolveChildId(capName, deviceId) {
-		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
-			if (deviceOwner !== null) return deviceOwner;
-		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
-		if (candidates.length === 0) return null;
-		if (candidates.length === 1) return candidates[0];
-		const preferred = this.getActiveSingletonAddonId?.(capName) ?? null;
-		if (preferred !== null && candidates.includes(preferred)) return preferred;
-		return candidates[0];
-	}
-	/** First child whose cap manifest contains a descriptor matching `predicate`. */
-	findChildId(predicate) {
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
-		return null;
+	constructor(capName, method, detail, cause) {
+		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
+		this.name = "CapRouteError";
+		this.reason = detail.reason;
+		this.nodeId = detail.nodeId;
+		this.rejected = detail.rejected;
 	}
-	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
-	findAllChildIds(predicate) {
-		const out = [];
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
-		return out;
+};
+/**
+* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
+*
+* Precedence (explicit nodeId path):
+*   1. hub-in-process — hub node + hubInProcessProvides
+*   2. hub-local-uds  — hub node + hubLocalChildProvides
+*   3. node-offline   → CapRouteError{reason:'node-offline'}
+*   4. agent-child-forward — node is an agent AND nodeKnowsCap
+*   5. remote-moleculer — any other online non-agent node
+*
+* Singleton path (no nodeId):
+*   1. hub-in-process (hub provides in-process)
+*   2. hub-local-uds  (a hub-local UDS child provides it)
+*   3. remote-moleculer (any online, non-hub node that knows it)
+*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
+*
+* PURE: no side effects, no async, no broker/registry imports.
+*/
+function classifyCapRoute(capName, opts, snapshot) {
+	const rejected = [];
+	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
+	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
+}
+function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
+	if (nodeId === snap.hubNodeId) {
+		if (snap.hubInProcessProvides(capName)) {
+			const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+			if (ref !== null) return {
+				kind: "hub-in-process",
+				capName,
+				ref
+			};
+			rejected.push({
+				kind: "hub-in-process",
+				why: "provider ref not available in snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		if (snap.hubLocalChildProvides(capName, deviceId)) {
+			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+			if (childId !== null) return {
+				kind: "hub-local-uds",
+				capName,
+				childId
+			};
+			rejected.push({
+				kind: "hub-local-uds",
+				why: "child id not resolvable from snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "hub does not provide this cap in-process"
+		});
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "no hub-local child provides this cap"
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
 	}
-	/**
-	* Does the named child currently provide `(capName, deviceId?)`?
-	*
-	* Used by the hub proxy seam, which knows the EXACT addon (→ runner →
-	* childId) a provider belongs to. Unlike `resolveChildId` (which picks the
-	* first child owning `capName`), this targets one child — required for
-	* COLLECTION caps (`addon-widgets-source`, …) where many children register
-	* the same capName: routing by capName alone collapses every provider to
-	* the first child. Same deviceId-as-hint semantics as `resolveChildId`:
-	* a device-scoped descriptor matching `deviceId` OR a deviceId-less
-	* (singleton/collection) descriptor counts.
-	*/
-	/**
-	* Is `childId` currently connected (has it completed its UDS handshake)?
-	* Coarser than {@link childProvides}: it answers "is the child reachable
-	* over UDS at all", regardless of which caps it has announced yet. Used by
-	* the route-mount fallback to decide between the handler-stripped
-	* `callAddonOnChild(target:'routes')` path (child reachable) and awaiting a
-	* cap proxy's `getRoutes()` (child not yet UDS-registered).
-	*/
-	isChildKnown(childId) {
-		return this.children.has(childId);
+	if (!snap.nodeOnline(nodeId)) {
+		rejected.push({
+			kind: "remote-moleculer",
+			why: `node ${nodeId} is offline`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "node-offline",
+			nodeId,
+			rejected
+		});
 	}
-	childProvides(childId, capName, deviceId) {
-		const entry = this.children.get(childId);
-		if (!entry) return false;
-		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
-		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
+	if (snap.nodeIsAgent(nodeId)) {
+		if (snap.nodeKnowsCap(nodeId, capName)) return {
+			kind: "agent-child-forward",
+			capName,
+			agentNodeId: nodeId,
+			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+		};
+		rejected.push({
+			kind: "agent-child-forward",
+			why: `agent ${nodeId} does not know cap ${capName}`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
 	}
-	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
-	async callCapOnChild(childId, input) {
-		const entry = this.children.get(childId);
-		if (!entry) throw new Error(`no local child "${childId}" for cap "${input.capName}"`);
-		return entry.channel.request(this.toCapCall(input));
-	}
-	/** Forward a cap method call to the owning child over UDS; rejects if none. */
-	async callCap(input) {
-		const childId = this.resolveChildId(input.capName, input.deviceId);
-		const entry = childId === null ? void 0 : this.children.get(childId);
-		if (!entry) {
-			const where = input.deviceId === void 0 ? "" : ` for device ${input.deviceId}`;
-			throw new Error(`no local child provides cap "${input.capName}"${where}`);
-		}
-		return entry.channel.request(this.toCapCall(input));
-	}
-	/**
-	* Forward an ADDON-LEVEL call (routes / custom-action) to a SPECIFIC child
-	* by id over UDS; rejects if that child is absent.
-	*
-	* The childId for a hub-local single-addon runner equals the addonId
-	* (`resolveRunnerId` returns the addonId when no `execution.group` is
-	* declared — no shipped addon declares one). Mirrors `callCapOnChild` for
-	* the cap plane; carries the two surfaces the removed per-addon Moleculer
-	* broker used to serve (`getRoutes` + `custom.<action>`).
-	*/
-	async callAddonOnChild(childId, input) {
-		const entry = this.children.get(childId);
-		if (!entry) throw new Error(`no local child "${childId}" for addon-call (${input.target})`);
-		return entry.channel.request(this.toAddonCall(input));
-	}
-	/** Build the parent→child `addon-call` wire message from an addon-call input. */
-	toAddonCall(input) {
-		return {
-			kind: "addon-call",
-			addonId: input.addonId,
-			target: input.target,
-			...input.action !== void 0 ? { action: input.action } : {},
-			...input.method !== void 0 ? { method: input.method } : {},
-			...input.args !== void 0 ? { args: input.args } : {}
+	return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+}
+function classifySingleton(capName, deviceId, snap, rejected) {
+	if (snap.hubInProcessProvides(capName)) {
+		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		if (ref !== null) return {
+			kind: "hub-in-process",
+			capName,
+			ref
 		};
-	}
-	/** Build the parent→child `cap-call` wire message from a routing input. */
-	toCapCall(input) {
-		return {
-			kind: "cap-call",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "provider ref not available in snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-in-process",
+		why: "hub does not provide this cap in-process"
+	});
+	if (snap.hubLocalChildProvides(capName, deviceId)) {
+		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId !== null) return {
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "child id not resolvable from snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-local-uds",
+		why: "no hub-local child provides this cap"
+	});
+	const knownNodes = snap.listKnownNodeIds?.() ?? [];
+	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+	rejected.push({
+		kind: "remote-moleculer",
+		why: "no online remote node knows this cap"
+	});
+	throw new CapRouteError(capName, void 0, {
+		reason: "no-provider",
+		rejected
+	});
+}
+//#endregion
+//#region src/kernel/transport/cap-route-resolver.ts
+/** The Moleculer service name that Task 6's agent registers. */
+var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
+/** The Moleculer action (service.action) for agent cap forwarding. */
+var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
+/** Default timeout for remote Moleculer cap calls (ms). */
+var REMOTE_CALL_TIMEOUT_MS = 6e4;
+function extractDeviceId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "deviceId");
+	return typeof raw === "number" ? raw : void 0;
+}
+/**
+* Extract an inline `nodeId` string from a cap call's args — the per-call node
+* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
+* device-scoped caps carry `deviceId`, and the way the generated cap-router on
+* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
+*
+* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
+* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
+* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
+* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
+* methods that don't declare `nodeId` simply ignore the extra field (they
+* destructure the fields they need); methods that DO declare it (e.g.
+* `getEngineProvisioning({nodeId})`) still receive it unchanged.
+*/
+function extractNodeId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "nodeId");
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+var CapRouteResolver = class {
+	hubNodeId;
+	broker;
+	hubLocalRegistry;
+	nodeAuthority;
+	inProcessProviders;
+	snapshot;
+	constructor(deps) {
+		this.hubNodeId = deps.hubNodeId;
+		this.broker = deps.broker;
+		this.hubLocalRegistry = deps.hubLocalRegistry;
+		this.nodeAuthority = deps.nodeAuthority;
+		this.inProcessProviders = deps.inProcessProviders;
+		this.snapshot = this.buildSnapshot();
 	}
-	listChildren() {
-		return [...this.children.values()].map((e) => ({
-			childId: e.childId,
-			caps: e.caps
-		}));
-	}
-	/** Register the (single) child-registered handler. Only one handler is active at a time. */
-	onChildRegistered(handler) {
-		this.registeredHandler = handler;
-	}
-	/** Register the (single) child-gone handler. Only one handler is active at a time. */
-	onChildGone(handler) {
-		this.goneHandler = handler;
-	}
-	/**
-	* Register the (single) child-event handler. Invoked when a child sends an
-	* event via `LocalChildClient.emitEvent`. Only one handler is active at a
-	* time; a new handler replaces the prior one. Pass `null` to clear the
-	* handler entirely (used by the UDS event bridge disposer on shutdown).
-	*/
-	onChildEvent(handler) {
-		this.eventHandler = handler;
-	}
-	/**
-	* Register the (single) child-log handler. Invoked when a child sends a log
-	* entry via `LocalChildClient.sendLog`. Only one handler is active.
-	*/
-	onChildLog(handler) {
-		this.logHandler = handler;
-	}
-	/**
-	* Register the handler that supplies the authoritative readiness snapshot
-	* when a child sends a `readiness-request`. Only one handler is active.
-	*/
-	onReadinessSnapshotRequest(handler) {
-		this.readinessHandler = handler;
+	resolveCapRoute(capName, opts) {
+		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* Push a parent→child event to a specific child. Fire-and-forget (uses the
-	* one-way `emit` path on the channel). No-op if the child is not connected.
+	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
+	* child, IGNORING any in-hub provider registered for the same cap name.
+	*
+	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
+	* provider (e.g. a wrapper) is registered for the cap, the route always
+	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
+	* reached. That is correct for the generic dispatch path (the wrapper is the
+	* active provider), but WRONG for the native-cap fallback
+	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
+	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
+	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
+	* itself, the native is never invoked, and the wrapper silently falls
+	* through to its secondary strategy.
+	*
+	* This method consults ONLY the hub-local-child authority
+	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
+	* it returns the native child route regardless of any in-process shadow.
+	* Returns null when no hub-local child owns `(capName, deviceId)` — the
+	* caller then falls through to its remote-resolution branch.
 	*/
-	sendEventToChild(childId, event, sourceNodeId) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return;
-		const msg = {
-			kind: "event",
-			event,
-			sourceNodeId
+	resolveHubLocalUdsRoute(capName, deviceId) {
+		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
+		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId === null) return null;
+		return {
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
-		entry.channel.emit(msg);
 	}
-	/**
-	* Push a parent→child event to every registered child, optionally skipping
-	* one (the originating child, to avoid echo). Fire-and-forget.
-	*/
-	broadcastEventToChildren(event, sourceNodeId, exceptChildId) {
-		for (const entry of this.children.values()) {
-			if (entry.childId === exceptChildId) continue;
-			const msg = {
-				kind: "event",
-				event,
-				sourceNodeId
-			};
-			entry.channel.emit(msg);
+	async dispatch(route, method, args) {
+		try {
+			return await this.dispatchInner(route, method, args);
+		} catch (err) {
+			if (err instanceof CapRouteError) throw err;
+			const nodeId = this.routeNodeId(route);
+			const cause = err instanceof Error ? err : new Error(String(err));
+			throw new CapRouteError(route.capName, method, {
+				reason: "transport-failed",
+				nodeId,
+				rejected: [{
+					kind: route.kind,
+					why: cause.message
+				}]
+			}, cause);
 		}
 	}
 	/**
-	* E2: Send a `set-log-level` control message to a specific child.
-	* Returns `true` if the child is currently connected and the message was
-	* emitted; `false` if the child is not connected (no-op). The `false`
-	* return lets the caller (MoleculerService.setChildLogLevelByNodeId) fall
-	* back to the Moleculer `$node-mgmt.setLogLevel` action for the node.
-	* Mirrors the `$node-mgmt.setLogLevel` Moleculer action for UDS children.
+	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
+	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
 	*/
-	setChildLogLevel(childId, level) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return false;
-		const msg = {
-			kind: "set-log-level",
-			level
-		};
-		entry.channel.emit(msg);
-		return true;
-	}
-	async close() {
-		await this.server.close();
-	}
-	onConnection(channel) {
-		let childId = null;
-		channel.onEvent((body) => {
-			const msg = body;
-			if (msg.kind === "event") {
-				if (childId !== null) this.eventHandler?.(childId, msg.event);
-				return;
-			}
-			if (msg.kind === "log") {
-				if (childId !== null) this.logHandler?.(childId, msg);
-				return;
+	async dispatchInner(route, method, args) {
+		switch (route.kind) {
+			case "hub-in-process": return route.ref.invoke(method, args);
+			case "hub-local-uds": {
+				const registry = this.hubLocalRegistry;
+				if (registry === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					rejected: [{
+						kind: "hub-local-uds",
+						why: "UDS registry not available"
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const input = {
+					capName: route.capName,
+					method,
+					args,
+					...deviceId !== void 0 ? { deviceId } : {}
+				};
+				return registry.callCapOnChild(route.childId, input);
 			}
-		});
-		channel.onRequest(async (body) => {
-			const msg = body;
-			if (msg.kind === "register") {
-				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
-				childId = msg.childId;
-				this.children.set(msg.childId, {
-					childId: msg.childId,
-					channel,
-					caps: msg.caps
+			case "remote-moleculer": {
+				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
+				if (addonId === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					nodeId: route.nodeId,
+					rejected: [{
+						kind: "remote-moleculer",
+						why: `no addonId known for ${route.nodeId}/${route.capName}`
+					}]
 				});
-				this.registeredHandler({
-					childId: msg.childId,
-					caps: msg.caps
+				const deviceId = extractDeviceId(args);
+				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
+				const action = capActionName(addonId, route.capName, method, isNative);
+				return callWithServiceDiscovery(this.broker, addonId, action, args, {
+					nodeID: route.nodeId,
+					timeout: REMOTE_CALL_TIMEOUT_MS
 				});
-				return { ok: true };
 			}
-			if (msg.kind === "cap-call-out") {
-				const out = msg;
-				const input = {
-					capName: out.capName,
-					method: out.method,
-					args: out.args,
-					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
-					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {}
+			case "agent-child-forward": {
+				const deviceId = extractDeviceId(args);
+				const params = {
+					capName: route.capName,
+					method,
+					args,
+					...route.childId !== void 0 ? { childId: route.childId } : {},
+					...deviceId !== void 0 ? { deviceId } : {}
 				};
-				if (this.resolveChildId(out.capName, out.deviceId) !== null) {
-					if (!this.egressRoutedCaps.has(out.capName)) {
-						this.egressRoutedCaps.add(out.capName);
-						this.logger?.info("routed child egress over UDS", { capName: out.capName });
-					}
-					return this.callCap(input);
-				}
-				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
-				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
+				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
+					nodeID: route.agentNodeId,
+					timeout: REMOTE_CALL_TIMEOUT_MS
+				});
 			}
-			if (msg.kind === "readiness-request") return {
-				kind: "readiness-snapshot",
-				records: this.readinessHandler?.() ?? []
-			};
-			throw new Error(`unknown child request kind: ${msg.kind}`);
-		});
-		channel.onClose(() => {
-			if (childId !== null && this.children.delete(childId)) this.goneHandler(childId);
-		});
+		}
+	}
+	buildSnapshot() {
+		const hubLocalRegistry = this.hubLocalRegistry;
+		const nodeAuthority = this.nodeAuthority;
+		const inProcessProviders = this.inProcessProviders;
+		return {
+			hubNodeId: this.hubNodeId,
+			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
+			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
+			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
+			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
+			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
+			getInProcessProviderRef: (cap) => inProcessProviders(cap),
+			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
+			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
+		};
+	}
+	/** Extract a nodeId string from a route for error reporting, or undefined. */
+	routeNodeId(route) {
+		switch (route.kind) {
+			case "hub-in-process": return this.hubNodeId;
+			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
+			case "remote-moleculer": return route.nodeId;
+			case "agent-child-forward": return route.agentNodeId;
+		}
 	}
 };
 //#endregion
-//#region src/kernel/transport/local-child-client.ts
+//#region src/kernel/transport/local-child-registry.ts
 /**
-* Child side of the local UDS transport. Connects to its parent (hub or
-* agent), registers its cap manifest, and serves parent→child cap calls by
-* delegating to `dispatch`. The provider implementation lives in the child;
-* only routing keys + call arguments cross the wire.
-*
-* Additional channels beyond cap-call:
-*   - `emitEvent`              fire-and-forget event toward the parent
-*   - `sendLog`                fire-and-forget log entry toward the parent
-*   - `requestReadinessSnapshot` request/response snapshot of readiness records
-*   - `onEvent`                register a handler for parent→child events
-*
-* Events and logs emitted before `start()` resolves are buffered and flushed
-* on connect (mirrors the `updateCaps`/`latestCaps` pattern).
+* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
+* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
+* prefix to distinguish routing failures (safe to retry via broker) from real
+* provider errors (must NOT retry to avoid double-executing side effects).
 */
-var LocalChildClient = class {
-	options;
-	client = null;
-	channel = null;
-	/**
-	* The cap set `start()` will register, kept current by `updateCaps`. Native
-	* device caps register on device-restore, which can race AHEAD of the UDS
-	* connect — buffering here lets a pre-start `updateCaps` survive (start sends
-	* the latest set) instead of being lost or throwing.
-	*/
-	latestCaps;
-	/** Events and logs queued while the channel is not yet open. */
-	pendingEmits = [];
-	/** Handler for parent→child events. Registered via `onEvent`. */
+var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+/**
+* Parent-side authority for local addon-runners reachable over a
+* `LocalTransportServer` (UDS). Children register their cap manifest on
+* connect; the registry routes `(capName, deviceId?)` cap calls to the
+* owning child over the channel and drops a child's caps on disconnect.
+*/
+var LocalChildRegistry = class {
+	children = /* @__PURE__ */ new Map();
+	registeredHandler = () => {};
+	goneHandler = () => {};
 	eventHandler = null;
+	logHandler = null;
+	readinessHandler = null;
+	server;
+	onUnownedCall;
+	logger;
+	getActiveSingletonAddonId;
+	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
+	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/**
-	* Handler for parent→child addon-level calls (`routes` / `custom`).
-	* Registered via `onAddonCall`. Resolves the loaded addon instance and
-	* invokes its `addon-routes.getRoutes()` or its custom-action handler.
-	* Replaces the per-addon Moleculer `getRoutes` / `custom.<action>` actions
-	* removed in F1/F2. Only one handler is active at a time.
-	*/
-	addonCallHandler = null;
-	/**
-	* Handler for `set-log-level` messages pushed by the parent.
-	* Registered via `onSetLogLevel`. The handler applies the new level to the
-	* child's local Moleculer logger (mirrors `$node-mgmt.setLogLevel`).
-	* E2: wired in `addon-runner.ts` to forward to the broker logger.
+	* Accepts either a plain positional `server` argument (backward-compatible)
+	* or a full `LocalChildRegistryOptions` object.
+	*
+	* Positional overloads (existing call sites are unchanged):
+	*   new LocalChildRegistry(server)
+	*   new LocalChildRegistry(server, onUnownedCall)
+	*
+	* Options object (new call sites that pass a logger):
+	*   new LocalChildRegistry({ server, onUnownedCall, logger })
 	*/
-	setLogLevelHandler = null;
-	/** Callbacks registered via `onConnected`. Fired on every (re)connect. */
-	connectedHandlers = [];
-	constructor(options) {
-		this.options = options;
-		this.latestCaps = options.caps;
+	constructor(serverOrOptions, onUnownedCallArg) {
+		if (serverOrOptions && !("listen" in serverOrOptions)) {
+			const opts = serverOrOptions;
+			this.server = opts.server;
+			this.onUnownedCall = opts.onUnownedCall;
+			this.logger = opts.logger;
+			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
+		} else {
+			this.server = serverOrOptions;
+			this.onUnownedCall = onUnownedCallArg;
+		}
 	}
-	/**
-	* Register a callback that fires each time the client successfully connects
-	* (or reconnects) to its parent. Multiple handlers may be registered; all
-	* are called in registration order. Used by readiness-context in UDS mode
-	* to trigger a snapshot hydrate on connect/reconnect.
-	*/
-	onConnected(handler) {
-		this.connectedHandlers.push(handler);
+	async start() {
+		this.server.onConnection((channel) => this.onConnection(channel));
+		await this.server.listen();
 	}
 	/**
-	* Register a handler for events pushed from the parent to this child.
-	* Must be called before `start()` to avoid missing early events (though
-	* registration after start is also safe for events not yet delivered).
-	* Replaces any previously registered handler.
+	* Child id that can service a call to `capName` (optionally addressing
+	* `deviceId`), or null.
+	*
+	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
+	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
+	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
+	* many cameras — so its descriptor carries no `deviceId`. Resolving on
+	* `deviceId` alone would never match it and would force the call onto the
+	* broker fallback (which then hangs in service discovery). Hence:
+	*   1. exact device-scoped owner (native per-device caps where each child
+	*      owns a disjoint device subset) is preferred, then
+	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
+	* A cap is globally singleton XOR device-scoped, so the two tiers never
+	* compete for the same capName.
 	*/
-	onEvent(handler) {
-		this.eventHandler = handler;
+	resolveChildId(capName, deviceId) {
+		if (deviceId !== void 0) {
+			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
+			if (deviceOwner !== null) return deviceOwner;
+		}
+		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
+		if (candidates.length === 0) return null;
+		if (candidates.length === 1) return candidates[0];
+		const preferred = this.getActiveSingletonAddonId?.(capName) ?? null;
+		if (preferred !== null && candidates.includes(preferred)) return preferred;
+		return candidates[0];
 	}
-	/**
-	* Register the handler invoked when the parent sends an `addon-call` (the
-	* addon-level routes / custom-action plane). The addon-runner wires this to
-	* resolve the loaded addon by id and dispatch to its `getRoutes()` or its
-	* custom-action handler. Safe to register before or after `start()`;
-	* replaces any prior handler.
-	*/
-	onAddonCall(handler) {
-		this.addonCallHandler = handler;
+	/** First child whose cap manifest contains a descriptor matching `predicate`. */
+	findChildId(predicate) {
+		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
+		return null;
+	}
+	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
+	findAllChildIds(predicate) {
+		const out = [];
+		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
+		return out;
 	}
 	/**
-	* E2: Register a handler invoked when the parent sends a `set-log-level`
-	* message to this child. The handler should forward the new level to the
-	* child's local Moleculer broker logger (mirrors `$node-mgmt.setLogLevel`).
-	* Safe to register before or after `start()`. Replaces any prior handler.
+	* Does the named child currently provide `(capName, deviceId?)`?
+	*
+	* Used by the hub proxy seam, which knows the EXACT addon (→ runner →
+	* childId) a provider belongs to. Unlike `resolveChildId` (which picks the
+	* first child owning `capName`), this targets one child — required for
+	* COLLECTION caps (`addon-widgets-source`, …) where many children register
+	* the same capName: routing by capName alone collapses every provider to
+	* the first child. Same deviceId-as-hint semantics as `resolveChildId`:
+	* a device-scoped descriptor matching `deviceId` OR a deviceId-less
+	* (singleton/collection) descriptor counts.
 	*/
-	onSetLogLevel(handler) {
-		this.setLogLevelHandler = handler;
-	}
 	/**
-	* True once `start()` has successfully connected and registered. Used by
-	* callers (event-bus/logger bridges) to know the channel is live.
+	* Is `childId` currently connected (has it completed its UDS handshake)?
+	* Coarser than {@link childProvides}: it answers "is the child reachable
+	* over UDS at all", regardless of which caps it has announced yet. Used by
+	* the route-mount fallback to decide between the handler-stripped
+	* `callAddonOnChild(target:'routes')` path (child reachable) and awaiting a
+	* cap proxy's `getRoutes()` (child not yet UDS-registered).
 	*/
-	get isConnected() {
-		return this.channel !== null;
+	isChildKnown(childId) {
+		return this.children.has(childId);
 	}
-	async start() {
-		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
-		const client = createLocalTransport().createClient(this.options.nodeId);
-		const channel = await client.connect();
-		channel.onRequest(async (body) => {
-			const msg = body;
-			if (msg.kind === "cap-call") return this.options.dispatch({
-				capName: msg.capName,
-				method: msg.method,
-				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {}
-			});
-			if (msg.kind === "addon-call") {
-				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
-				return this.addonCallHandler({
-					addonId: msg.addonId,
-					target: msg.target,
-					...msg.action !== void 0 ? { action: msg.action } : {},
-					...msg.method !== void 0 ? { method: msg.method } : {},
-					...msg.args !== void 0 ? { args: msg.args } : {}
-				});
-			}
-			throw new Error(`unknown parent request kind: ${msg.kind}`);
-		});
-		channel.onEvent((body) => {
-			const msg = body;
-			if (msg.kind === "event") {
-				this.eventHandler?.(msg.event);
-				return;
-			}
-			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
-		});
-		const register = {
-			kind: "register",
-			childId: this.options.childId,
-			caps: this.latestCaps
-		};
-		try {
-			await channel.request(register);
-		} catch (err) {
-			await client.close();
-			throw err;
-		}
-		this.client = client;
-		this.channel = channel;
-		this.flushPending(channel);
-		for (const cb of this.connectedHandlers) cb();
+	childProvides(childId, capName, deviceId) {
+		const entry = this.children.get(childId);
+		if (!entry) return false;
+		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
+		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
 	}
-	/** Flush buffered pre-start emits over the now-open channel. */
-	flushPending(channel) {
-		for (const item of this.pendingEmits) channel.emit(item.msg);
-		this.pendingEmits.length = 0;
+	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
+	async callCapOnChild(childId, input) {
+		const entry = this.children.get(childId);
+		if (!entry) throw new Error(`no local child "${childId}" for cap "${input.capName}"`);
+		return entry.channel.request(this.toCapCall(input));
+	}
+	/** Forward a cap method call to the owning child over UDS; rejects if none. */
+	async callCap(input) {
+		const childId = this.resolveChildId(input.capName, input.deviceId);
+		const entry = childId === null ? void 0 : this.children.get(childId);
+		if (!entry) {
+			const where = input.deviceId === void 0 ? "" : ` for device ${input.deviceId}`;
+			throw new Error(`no local child provides cap "${input.capName}"${where}`);
+		}
+		return entry.channel.request(this.toCapCall(input));
 	}
 	/**
-	* Re-send the cap manifest to the parent, atomically replacing the child's
-	* registered descriptor set. Call this after device-restore so newly
-	* registered native (device-scoped) caps become routable over UDS.
+	* Forward an ADDON-LEVEL call (routes / custom-action) to a SPECIFIC child
+	* by id over UDS; rejects if that child is absent.
 	*
-	* Safe to call before `start()`: the new set is buffered and `start()` sends
-	* it (device-restore can race ahead of the UDS connect). After `start()`,
-	* the set is sent immediately.
+	* The childId for a hub-local single-addon runner equals the addonId
+	* (`resolveRunnerId` returns the addonId when no `execution.group` is
+	* declared — no shipped addon declares one). Mirrors `callCapOnChild` for
+	* the cap plane; carries the two surfaces the removed per-addon Moleculer
+	* broker used to serve (`getRoutes` + `custom.<action>`).
 	*/
-	async updateCaps(caps) {
-		this.latestCaps = caps;
-		if (this.channel === null) return;
-		const register = {
-			kind: "register",
-			childId: this.options.childId,
-			caps
+	async callAddonOnChild(childId, input) {
+		const entry = this.children.get(childId);
+		if (!entry) throw new Error(`no local child "${childId}" for addon-call (${input.target})`);
+		return entry.channel.request(this.toAddonCall(input));
+	}
+	/** Build the parent→child `addon-call` wire message from an addon-call input. */
+	toAddonCall(input) {
+		return {
+			kind: "addon-call",
+			addonId: input.addonId,
+			target: input.target,
+			...input.action !== void 0 ? { action: input.action } : {},
+			...input.method !== void 0 ? { method: input.method } : {},
+			...input.args !== void 0 ? { args: input.args } : {}
 		};
-		await this.channel.request(register);
+	}
+	/** Build the parent→child `cap-call` wire message from a routing input. */
+	toCapCall(input) {
+		return {
+			kind: "cap-call",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {}
+		};
+	}
+	listChildren() {
+		return [...this.children.values()].map((e) => ({
+			childId: e.childId,
+			caps: e.caps
+		}));
+	}
+	/** Register the (single) child-registered handler. Only one handler is active at a time. */
+	onChildRegistered(handler) {
+		this.registeredHandler = handler;
+	}
+	/** Register the (single) child-gone handler. Only one handler is active at a time. */
+	onChildGone(handler) {
+		this.goneHandler = handler;
 	}
 	/**
-	* Fire-and-forget: send a system event to the parent for forwarding to the
-	* hub event bus. Safe to call before `start()` — events are buffered and
-	* flushed on connect.
+	* Register the (single) child-event handler. Invoked when a child sends an
+	* event via `LocalChildClient.emitEvent`. Only one handler is active at a
+	* time; a new handler replaces the prior one. Pass `null` to clear the
+	* handler entirely (used by the UDS event bridge disposer on shutdown).
 	*/
-	emitEvent(event) {
-		const msg = {
-			kind: "event",
-			event
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "event",
-			msg
-		});
+	onChildEvent(handler) {
+		this.eventHandler = handler;
 	}
 	/**
-	* Fire-and-forget: send a structured log entry to the parent. Safe to call
-	* before `start()` — log entries are buffered and flushed on connect.
+	* Register the (single) child-log handler. Invoked when a child sends a log
+	* entry via `LocalChildClient.sendLog`. Only one handler is active.
 	*/
-	sendLog(entry) {
-		const msg = {
-			kind: "log",
-			...entry
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "log",
-			msg
-		});
+	onChildLog(handler) {
+		this.logHandler = handler;
 	}
 	/**
-	* Request the current readiness snapshot from the parent. Returns the
-	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
-	* Requires `start()` to have been called; throws with a clear message if not.
+	* Register the handler that supplies the authoritative readiness snapshot
+	* when a child sends a `readiness-request`. Only one handler is active.
 	*/
-	async requestReadinessSnapshot() {
-		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
-		return (await this.channel.request({ kind: "readiness-request" })).records;
+	onReadinessSnapshotRequest(handler) {
+		this.readinessHandler = handler;
 	}
 	/**
-	* Ask the parent to execute a cap call this child does NOT own. The parent
-	* routes to the owning local sibling over UDS, or — if no sibling owns it —
-	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
-	* production). Throws if called before `start()`.
+	* Push a parent→child event to a specific child. Fire-and-forget (uses the
+	* one-way `emit` path on the channel). No-op if the child is not connected.
 	*/
-	async callOut(input) {
-		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+	sendEventToChild(childId, event, sourceNodeId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return;
 		const msg = {
-			kind: "cap-call-out",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
+			kind: "event",
+			event,
+			sourceNodeId
 		};
-		return this.channel.request(msg);
-	}
-	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
-	async close() {
-		await this.client?.close();
-		this.client = null;
-		this.channel = null;
+		entry.channel.emit(msg);
 	}
-};
-//#endregion
-//#region src/kernel/transport/cap-route.ts
-function buildMessage(capName, method, detail) {
-	const call = method !== void 0 ? `${capName}.${method}` : capName;
-	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
-	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
-	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
-	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
-}
-var CapRouteError = class extends Error {
-	reason;
-	nodeId;
-	rejected;
 	/**
-	* @param cause  Optional original error that triggered this routing failure.
-	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
-	*               Dispatchers wrapping transport errors MUST pass the original.
+	* Push a parent→child event to every registered child, optionally skipping
+	* one (the originating child, to avoid echo). Fire-and-forget.
 	*/
-	constructor(capName, method, detail, cause) {
-		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
-		this.name = "CapRouteError";
-		this.reason = detail.reason;
-		this.nodeId = detail.nodeId;
-		this.rejected = detail.rejected;
-	}
-};
-/**
-* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
-*
-* Precedence (explicit nodeId path):
-*   1. hub-in-process — hub node + hubInProcessProvides
-*   2. hub-local-uds  — hub node + hubLocalChildProvides
-*   3. node-offline   → CapRouteError{reason:'node-offline'}
-*   4. agent-child-forward — node is an agent AND nodeKnowsCap
-*   5. remote-moleculer — any other online non-agent node
-*
-* Singleton path (no nodeId):
-*   1. hub-in-process (hub provides in-process)
-*   2. hub-local-uds  (a hub-local UDS child provides it)
-*   3. remote-moleculer (any online, non-hub node that knows it)
-*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
-*
-* PURE: no side effects, no async, no broker/registry imports.
-*/
-function classifyCapRoute(capName, opts, snapshot) {
-	const rejected = [];
-	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
-	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
-}
-function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
-	if (nodeId === snap.hubNodeId) {
-		if (snap.hubInProcessProvides(capName)) {
-			const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-			if (ref !== null) return {
-				kind: "hub-in-process",
-				capName,
-				ref
-			};
-			rejected.push({
-				kind: "hub-in-process",
-				why: "provider ref not available in snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		if (snap.hubLocalChildProvides(capName, deviceId)) {
-			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-			if (childId !== null) return {
-				kind: "hub-local-uds",
-				capName,
-				childId
+	broadcastEventToChildren(event, sourceNodeId, exceptChildId) {
+		for (const entry of this.children.values()) {
+			if (entry.childId === exceptChildId) continue;
+			const msg = {
+				kind: "event",
+				event,
+				sourceNodeId
 			};
-			rejected.push({
-				kind: "hub-local-uds",
-				why: "child id not resolvable from snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
+			entry.channel.emit(msg);
 		}
-		rejected.push({
-			kind: "hub-in-process",
-			why: "hub does not provide this cap in-process"
-		});
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "no hub-local child provides this cap"
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
 	}
-	if (!snap.nodeOnline(nodeId)) {
-		rejected.push({
-			kind: "remote-moleculer",
-			why: `node ${nodeId} is offline`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "node-offline",
-			nodeId,
-			rejected
-		});
-	}
-	if (snap.nodeIsAgent(nodeId)) {
-		if (snap.nodeKnowsCap(nodeId, capName)) return {
-			kind: "agent-child-forward",
-			capName,
-			agentNodeId: nodeId,
-			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+	/**
+	* E2: Send a `set-log-level` control message to a specific child.
+	* Returns `true` if the child is currently connected and the message was
+	* emitted; `false` if the child is not connected (no-op). The `false`
+	* return lets the caller (MoleculerService.setChildLogLevelByNodeId) fall
+	* back to the Moleculer `$node-mgmt.setLogLevel` action for the node.
+	* Mirrors the `$node-mgmt.setLogLevel` Moleculer action for UDS children.
+	*/
+	setChildLogLevel(childId, level) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return false;
+		const msg = {
+			kind: "set-log-level",
+			level
 		};
-		rejected.push({
-			kind: "agent-child-forward",
-			why: `agent ${nodeId} does not know cap ${capName}`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
+		entry.channel.emit(msg);
+		return true;
 	}
-	return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-}
-function classifySingleton(capName, deviceId, snap, rejected) {
-	if (snap.hubInProcessProvides(capName)) {
-		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-		if (ref !== null) return {
-			kind: "hub-in-process",
-			capName,
-			ref
-		};
-		rejected.push({
-			kind: "hub-in-process",
-			why: "provider ref not available in snapshot"
+	async close() {
+		await this.server.close();
+	}
+	onConnection(channel) {
+		let childId = null;
+		channel.onEvent((body) => {
+			const msg = body;
+			if (msg.kind === "event") {
+				if (childId !== null) this.eventHandler?.(childId, msg.event);
+				return;
+			}
+			if (msg.kind === "log") {
+				if (childId !== null) this.logHandler?.(childId, msg);
+				return;
+			}
 		});
-	} else rejected.push({
-		kind: "hub-in-process",
-		why: "hub does not provide this cap in-process"
-	});
-	if (snap.hubLocalChildProvides(capName, deviceId)) {
-		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId !== null) return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "child id not resolvable from snapshot"
+		channel.onRequest(async (body) => {
+			const msg = body;
+			if (msg.kind === "register") {
+				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
+				childId = msg.childId;
+				this.children.set(msg.childId, {
+					childId: msg.childId,
+					channel,
+					caps: msg.caps
+				});
+				this.registeredHandler({
+					childId: msg.childId,
+					caps: msg.caps
+				});
+				return { ok: true };
+			}
+			if (msg.kind === "cap-call-out") {
+				const out = msg;
+				const input = {
+					capName: out.capName,
+					method: out.method,
+					args: out.args,
+					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
+					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {}
+				};
+				if (((out.nodeId ?? extractNodeId(out.args)) === void 0 ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+					if (!this.egressRoutedCaps.has(out.capName)) {
+						this.egressRoutedCaps.add(out.capName);
+						this.logger?.info("routed child egress over UDS", { capName: out.capName });
+					}
+					return this.callCap(input);
+				}
+				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
+				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
+			}
+			if (msg.kind === "readiness-request") return {
+				kind: "readiness-snapshot",
+				records: this.readinessHandler?.() ?? []
+			};
+			throw new Error(`unknown child request kind: ${msg.kind}`);
 		});
-	} else rejected.push({
-		kind: "hub-local-uds",
-		why: "no hub-local child provides this cap"
-	});
-	const knownNodes = snap.listKnownNodeIds?.() ?? [];
-	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-	rejected.push({
-		kind: "remote-moleculer",
-		why: "no online remote node knows this cap"
-	});
-	throw new CapRouteError(capName, void 0, {
-		reason: "no-provider",
-		rejected
-	});
-}
+		channel.onClose(() => {
+			if (childId !== null && this.children.delete(childId)) this.goneHandler(childId);
+		});
+	}
+};
 //#endregion
-//#region src/kernel/moleculer/resilient-cap-call.ts
-/** Moleculer error `type` values meaning "the service is not (yet) routable". */
-var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-/** Default ceiling for the discovery wait — fail-fast past this. */
-var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
-function isDiscoveryError(err) {
-	if (typeof err !== "object" || err === null) return false;
-	const type = err.type;
-	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
-}
+//#region src/kernel/transport/local-child-client.ts
 /**
-* Call a Moleculer action; on a service-discovery error, wait for the
-* named service to be discovered and retry the call exactly once.
+* Child side of the local UDS transport. Connects to its parent (hub or
+* agent), registers its cap manifest, and serves parent→child cap calls by
+* delegating to `dispatch`. The provider implementation lives in the child;
+* only routing keys + call arguments cross the wire.
+*
+* Additional channels beyond cap-call:
+*   - `emitEvent`              fire-and-forget event toward the parent
+*   - `sendLog`                fire-and-forget log entry toward the parent
+*   - `requestReadinessSnapshot` request/response snapshot of readiness records
+*   - `onEvent`                register a handler for parent→child events
+*
+* Events and logs emitted before `start()` resolves are buffered and flushed
+* on connect (mirrors the `updateCaps`/`latestCaps` pattern).
 */
-async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
-	try {
-		return await broker.call(action, params, opts);
-	} catch (err) {
-		if (!isDiscoveryError(err)) throw err;
-		await broker.waitForServices([serviceName], discoveryTimeoutMs);
-		return await broker.call(action, params, opts);
+var LocalChildClient = class {
+	options;
+	client = null;
+	channel = null;
+	/**
+	* The cap set `start()` will register, kept current by `updateCaps`. Native
+	* device caps register on device-restore, which can race AHEAD of the UDS
+	* connect — buffering here lets a pre-start `updateCaps` survive (start sends
+	* the latest set) instead of being lost or throwing.
+	*/
+	latestCaps;
+	/** Events and logs queued while the channel is not yet open. */
+	pendingEmits = [];
+	/** Handler for parent→child events. Registered via `onEvent`. */
+	eventHandler = null;
+	/**
+	* Handler for parent→child addon-level calls (`routes` / `custom`).
+	* Registered via `onAddonCall`. Resolves the loaded addon instance and
+	* invokes its `addon-routes.getRoutes()` or its custom-action handler.
+	* Replaces the per-addon Moleculer `getRoutes` / `custom.<action>` actions
+	* removed in F1/F2. Only one handler is active at a time.
+	*/
+	addonCallHandler = null;
+	/**
+	* Handler for `set-log-level` messages pushed by the parent.
+	* Registered via `onSetLogLevel`. The handler applies the new level to the
+	* child's local Moleculer logger (mirrors `$node-mgmt.setLogLevel`).
+	* E2: wired in `addon-runner.ts` to forward to the broker logger.
+	*/
+	setLogLevelHandler = null;
+	/** Callbacks registered via `onConnected`. Fired on every (re)connect. */
+	connectedHandlers = [];
+	constructor(options) {
+		this.options = options;
+		this.latestCaps = options.caps;
 	}
-}
-//#endregion
-//#region src/kernel/transport/cap-route-resolver.ts
-/** The Moleculer service name that Task 6's agent registers. */
-var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
-/** The Moleculer action (service.action) for agent cap forwarding. */
-var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
-/** Default timeout for remote Moleculer cap calls (ms). */
-var REMOTE_CALL_TIMEOUT_MS = 6e4;
-function extractDeviceId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "deviceId");
-	return typeof raw === "number" ? raw : void 0;
-}
-var CapRouteResolver = class {
-	hubNodeId;
-	broker;
-	hubLocalRegistry;
-	nodeAuthority;
-	inProcessProviders;
-	snapshot;
-	constructor(deps) {
-		this.hubNodeId = deps.hubNodeId;
-		this.broker = deps.broker;
-		this.hubLocalRegistry = deps.hubLocalRegistry;
-		this.nodeAuthority = deps.nodeAuthority;
-		this.inProcessProviders = deps.inProcessProviders;
-		this.snapshot = this.buildSnapshot();
+	/**
+	* Register a callback that fires each time the client successfully connects
+	* (or reconnects) to its parent. Multiple handlers may be registered; all
+	* are called in registration order. Used by readiness-context in UDS mode
+	* to trigger a snapshot hydrate on connect/reconnect.
+	*/
+	onConnected(handler) {
+		this.connectedHandlers.push(handler);
+	}
+	/**
+	* Register a handler for events pushed from the parent to this child.
+	* Must be called before `start()` to avoid missing early events (though
+	* registration after start is also safe for events not yet delivered).
+	* Replaces any previously registered handler.
+	*/
+	onEvent(handler) {
+		this.eventHandler = handler;
+	}
+	/**
+	* Register the handler invoked when the parent sends an `addon-call` (the
+	* addon-level routes / custom-action plane). The addon-runner wires this to
+	* resolve the loaded addon by id and dispatch to its `getRoutes()` or its
+	* custom-action handler. Safe to register before or after `start()`;
+	* replaces any prior handler.
+	*/
+	onAddonCall(handler) {
+		this.addonCallHandler = handler;
+	}
+	/**
+	* E2: Register a handler invoked when the parent sends a `set-log-level`
+	* message to this child. The handler should forward the new level to the
+	* child's local Moleculer broker logger (mirrors `$node-mgmt.setLogLevel`).
+	* Safe to register before or after `start()`. Replaces any prior handler.
+	*/
+	onSetLogLevel(handler) {
+		this.setLogLevelHandler = handler;
+	}
+	/**
+	* True once `start()` has successfully connected and registered. Used by
+	* callers (event-bus/logger bridges) to know the channel is live.
+	*/
+	get isConnected() {
+		return this.channel !== null;
 	}
-	resolveCapRoute(capName, opts) {
-		return classifyCapRoute(capName, opts, this.snapshot);
+	async start() {
+		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
+		const client = createLocalTransport().createClient(this.options.nodeId);
+		const channel = await client.connect();
+		channel.onRequest(async (body) => {
+			const msg = body;
+			if (msg.kind === "cap-call") return this.options.dispatch({
+				capName: msg.capName,
+				method: msg.method,
+				args: msg.args,
+				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {}
+			});
+			if (msg.kind === "addon-call") {
+				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
+				return this.addonCallHandler({
+					addonId: msg.addonId,
+					target: msg.target,
+					...msg.action !== void 0 ? { action: msg.action } : {},
+					...msg.method !== void 0 ? { method: msg.method } : {},
+					...msg.args !== void 0 ? { args: msg.args } : {}
+				});
+			}
+			throw new Error(`unknown parent request kind: ${msg.kind}`);
+		});
+		channel.onEvent((body) => {
+			const msg = body;
+			if (msg.kind === "event") {
+				this.eventHandler?.(msg.event);
+				return;
+			}
+			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
+		});
+		const register = {
+			kind: "register",
+			childId: this.options.childId,
+			caps: this.latestCaps
+		};
+		try {
+			await channel.request(register);
+		} catch (err) {
+			await client.close();
+			throw err;
+		}
+		this.client = client;
+		this.channel = channel;
+		this.flushPending(channel);
+		for (const cb of this.connectedHandlers) cb();
+	}
+	/** Flush buffered pre-start emits over the now-open channel. */
+	flushPending(channel) {
+		for (const item of this.pendingEmits) channel.emit(item.msg);
+		this.pendingEmits.length = 0;
 	}
 	/**
-	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
-	* child, IGNORING any in-hub provider registered for the same cap name.
-	*
-	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
-	* provider (e.g. a wrapper) is registered for the cap, the route always
-	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
-	* reached. That is correct for the generic dispatch path (the wrapper is the
-	* active provider), but WRONG for the native-cap fallback
-	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
-	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
-	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
-	* itself, the native is never invoked, and the wrapper silently falls
-	* through to its secondary strategy.
+	* Re-send the cap manifest to the parent, atomically replacing the child's
+	* registered descriptor set. Call this after device-restore so newly
+	* registered native (device-scoped) caps become routable over UDS.
 	*
-	* This method consults ONLY the hub-local-child authority
-	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
-	* it returns the native child route regardless of any in-process shadow.
-	* Returns null when no hub-local child owns `(capName, deviceId)` — the
-	* caller then falls through to its remote-resolution branch.
+	* Safe to call before `start()`: the new set is buffered and `start()` sends
+	* it (device-restore can race ahead of the UDS connect). After `start()`,
+	* the set is sent immediately.
 	*/
-	resolveHubLocalUdsRoute(capName, deviceId) {
-		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
-		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId === null) return null;
-		return {
-			kind: "hub-local-uds",
-			capName,
-			childId
+	async updateCaps(caps) {
+		this.latestCaps = caps;
+		if (this.channel === null) return;
+		const register = {
+			kind: "register",
+			childId: this.options.childId,
+			caps
 		};
+		await this.channel.request(register);
 	}
-	async dispatch(route, method, args) {
-		try {
-			return await this.dispatchInner(route, method, args);
-		} catch (err) {
-			if (err instanceof CapRouteError) throw err;
-			const nodeId = this.routeNodeId(route);
-			const cause = err instanceof Error ? err : new Error(String(err));
-			throw new CapRouteError(route.capName, method, {
-				reason: "transport-failed",
-				nodeId,
-				rejected: [{
-					kind: route.kind,
-					why: cause.message
-				}]
-			}, cause);
-		}
+	/**
+	* Fire-and-forget: send a system event to the parent for forwarding to the
+	* hub event bus. Safe to call before `start()` — events are buffered and
+	* flushed on connect.
+	*/
+	emitEvent(event) {
+		const msg = {
+			kind: "event",
+			event
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "event",
+			msg
+		});
 	}
 	/**
-	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
-	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
+	* Fire-and-forget: send a structured log entry to the parent. Safe to call
+	* before `start()` — log entries are buffered and flushed on connect.
 	*/
-	async dispatchInner(route, method, args) {
-		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, args);
-			case "hub-local-uds": {
-				const registry = this.hubLocalRegistry;
-				if (registry === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					rejected: [{
-						kind: "hub-local-uds",
-						why: "UDS registry not available"
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const input = {
-					capName: route.capName,
-					method,
-					args,
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return registry.callCapOnChild(route.childId, input);
-			}
-			case "remote-moleculer": {
-				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
-				if (addonId === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					nodeId: route.nodeId,
-					rejected: [{
-						kind: "remote-moleculer",
-						why: `no addonId known for ${route.nodeId}/${route.capName}`
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
-				const action = capActionName(addonId, route.capName, method, isNative);
-				return callWithServiceDiscovery(this.broker, addonId, action, args, {
-					nodeID: route.nodeId,
-					timeout: REMOTE_CALL_TIMEOUT_MS
-				});
-			}
-			case "agent-child-forward": {
-				const deviceId = extractDeviceId(args);
-				const params = {
-					capName: route.capName,
-					method,
-					args,
-					...route.childId !== void 0 ? { childId: route.childId } : {},
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
-					nodeID: route.agentNodeId,
-					timeout: REMOTE_CALL_TIMEOUT_MS
-				});
-			}
-		}
+	sendLog(entry) {
+		const msg = {
+			kind: "log",
+			...entry
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "log",
+			msg
+		});
 	}
-	buildSnapshot() {
-		const hubLocalRegistry = this.hubLocalRegistry;
-		const nodeAuthority = this.nodeAuthority;
-		const inProcessProviders = this.inProcessProviders;
-		return {
-			hubNodeId: this.hubNodeId,
-			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
-			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
-			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
-			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
-			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
-			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
-			getInProcessProviderRef: (cap) => inProcessProviders(cap),
-			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
-			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
+	/**
+	* Request the current readiness snapshot from the parent. Returns the
+	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
+	* Requires `start()` to have been called; throws with a clear message if not.
+	*/
+	async requestReadinessSnapshot() {
+		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
+		return (await this.channel.request({ kind: "readiness-request" })).records;
+	}
+	/**
+	* Ask the parent to execute a cap call this child does NOT own. The parent
+	* routes to the owning local sibling over UDS, or — if no sibling owns it —
+	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
+	* production). Throws if called before `start()`.
+	*/
+	async callOut(input) {
+		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+		const msg = {
+			kind: "cap-call-out",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
 		};
+		return this.channel.request(msg);
 	}
-	/** Extract a nodeId string from a route for error reporting, or undefined. */
-	routeNodeId(route) {
-		switch (route.kind) {
-			case "hub-in-process": return this.hubNodeId;
-			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
-			case "remote-moleculer": return route.nodeId;
-			case "agent-child-forward": return route.agentNodeId;
-		}
+	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
+	async close() {
+		await this.client?.close();
+		this.client = null;
+		this.channel = null;
 	}
 };
 //#endregion
@@ -4586,10 +4605,11 @@ var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function createParentUnownedCallHandler(deps) {
 	return async (input) => {
 		const deviceId = input.deviceId ?? extractDeviceId(input.args);
+		const nodeId = input.nodeId ?? extractNodeId(input.args);
 		const resolver = deps.getResolver();
 		if (resolver !== null) try {
 			const route = resolver.resolveCapRoute(input.capName, {
-				...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
+				...nodeId !== void 0 ? { nodeId } : {},
 				...deviceId !== void 0 ? { deviceId } : {}
 			});
 			return await resolver.dispatch(route, input.method, input.args);
@@ -4666,10 +4686,15 @@ function parsePath(path) {
 * on a forked worker that has a co-located pipeline-executor.
 */
 function localProviderLink(resolver, observerOpts) {
+	const localBase = resolver.localNodeId !== void 0 ? resolver.localNodeId.split("/")[0] ?? resolver.localNodeId : void 0;
 	return () => {
 		return ({ op, next }) => {
 			const parsed = parsePath(op.path);
 			if (!parsed) return next(op);
+			if (localBase !== void 0) {
+				const pinnedNodeId = readNodePin(op.context);
+				if (pinnedNodeId !== void 0 && pinnedNodeId !== localBase) return next(op);
+			}
 			const provider = resolver.getByName(parsed.capName);
 			if (!provider || typeof provider !== "object") return next(op);
 			const fn = Reflect.get(provider, parsed.method);
@@ -6218,15 +6243,18 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 	fs.mkdirSync(addonDataDir, { recursive: true });
 	if (runtime.mode === "broker") ensureBindingSubscription(runtime.broker);
 	const regs = getRegistries(nodeId);
-	const workerResolver = { getByName(capabilityName) {
-		const preferred = regs.preferred.get(capabilityName);
-		if (preferred) {
-			const provider = regs.byAddonId.get(capabilityName)?.get(preferred);
-			if (provider) return provider;
+	const workerResolver = {
+		localNodeId: nodeId,
+		getByName(capabilityName) {
+			const preferred = regs.preferred.get(capabilityName);
+			if (preferred) {
+				const provider = regs.byAddonId.get(capabilityName)?.get(preferred);
+				if (provider) return provider;
+			}
+			const providers = regs.providers.get(capabilityName);
+			return (providers && providers.length > 0 ? providers[0] : void 0) ?? null;
 		}
-		const providers = regs.providers.get(capabilityName);
-		return (providers && providers.length > 0 ? providers[0] : void 0) ?? null;
-	} };
+	};
 	const usageRegistry = getCapUsageRegistry();
 	const observerOpts = {
 		callerAddonId: addonId,
@@ -6546,4 +6574,4 @@ async function installManifestPythonDeps(declaration, addonDir, deps, logger) {
 	await deps.installPythonRequirements(reqAbs);
 }
 //#endregion
-export { setWorkerNativeCapsChangeListener as $, createUdsLoggerWithControl as A, createLocalTransport as B, ipcParentLink as C, createUdsEventBus as D, createUdsEventBridge as E, CapRouteError as F, FrameDecoder as G, UdsLocalTransportServer as H, classifyCapRoute as I, buildUdsNativeCapProxy as J, encodeFrame as K, LocalChildClient as L, AGENT_CAP_FWD_SERVICE as M, CapRouteResolver as N, udsChildLogToWorkerEntry as O, callWithServiceDiscovery as P, mountNativeCapService as Q, LocalChildRegistry as R, ipcChildLink as S, createParentUnownedCallHandler as T, SocketChannel as U, UdsLocalTransportClient as V, localEndpointPath as W, getWorkerNativeCapProvider as X, createBrokerDeviceManagerApi as Y, getWorkerNativeCapSnapshot as Z, __resetCapUsageRegistryForTests as _, getWorkerDeviceRegistry as a, capBareAction as at, brokerTransportLink as b, setHubConnected as c, deserializeTypedArrays as ct, registerEventBusService as d, CapabilityHandle as dt, createAddonService as et, AddonDepsManager as f, CapabilityUnavailableError as ft, CapUsageRegistry as g, createHwAccelService as h, createUdsAddonContext as i, capActionSuffix as it, AGENT_CAP_FWD_ACTION as j, createUdsLogger as k, EVENT_TOPIC_PREFIX as l, serializeTypedArrays as lt, resolveHwAccel as m, resolveAddonClass as mt, adaptBrokerToCluster as n, NATIVE_PROVIDER_SERVICE_INFIX as nt, getOrInitReadinessRegistry as o, capServiceName as ot, createKernelHwAccel as p, installManifestNativeDeps as pt, buildNativeCapProxy as q, createAddonContext as r, capActionName as rt, getOrInitReadinessRegistryForClient as s, parseCapAction as st, installManifestPythonDeps as t, validateProviderRegistrations as tt, getBrokerEventBus as u, DeviceRegistry as ut, getCapUsageRegistry as v, localProviderLink as w, buildLinkChain as x, brokerCallForCap as y, UDS_NO_ROUTE_PREFIX as z };
+export { setWorkerNativeCapsChangeListener as $, createUdsLoggerWithControl as A, createLocalTransport as B, ipcParentLink as C, createUdsEventBus as D, createUdsEventBridge as E, AGENT_CAP_FWD_SERVICE as F, FrameDecoder as G, UdsLocalTransportServer as H, CapRouteResolver as I, buildUdsNativeCapProxy as J, encodeFrame as K, CapRouteError as L, LocalChildRegistry as M, UDS_NO_ROUTE_PREFIX as N, udsChildLogToWorkerEntry as O, AGENT_CAP_FWD_ACTION as P, mountNativeCapService as Q, classifyCapRoute as R, ipcChildLink as S, createParentUnownedCallHandler as T, SocketChannel as U, UdsLocalTransportClient as V, localEndpointPath as W, getWorkerNativeCapProvider as X, createBrokerDeviceManagerApi as Y, getWorkerNativeCapSnapshot as Z, __resetCapUsageRegistryForTests as _, getWorkerDeviceRegistry as a, capBareAction as at, brokerTransportLink as b, setHubConnected as c, deserializeTypedArrays as ct, registerEventBusService as d, CapabilityHandle as dt, createAddonService as et, AddonDepsManager as f, CapabilityUnavailableError as ft, CapUsageRegistry as g, createHwAccelService as h, createUdsAddonContext as i, capActionSuffix as it, LocalChildClient as j, createUdsLogger as k, EVENT_TOPIC_PREFIX as l, serializeTypedArrays as lt, resolveHwAccel as m, resolveAddonClass as mt, adaptBrokerToCluster as n, NATIVE_PROVIDER_SERVICE_INFIX as nt, getOrInitReadinessRegistry as o, capServiceName as ot, createKernelHwAccel as p, installManifestNativeDeps as pt, buildNativeCapProxy as q, createAddonContext as r, capActionName as rt, getOrInitReadinessRegistryForClient as s, parseCapAction as st, installManifestPythonDeps as t, validateProviderRegistrations as tt, getBrokerEventBus as u, DeviceRegistry as ut, getCapUsageRegistry as v, localProviderLink as w, buildLinkChain as x, brokerCallForCap as y, callWithServiceDiscovery as z };