@camstack/system 1.1.19 → 1.1.21

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-Dt5XNSyd.js");
+const require_manifest_python_deps = require("./manifest-python-deps-Di_9ayDE.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { $ as getWorkerNativeCapProvider, N as createUdsLoggerWithControl, P as LocalChildClient, _t as resolveAddonClass, et as getWorkerNativeCapSnapshot, gt as installManifestNativeDeps, i as createUdsAddonContext, it as validateProviderRegistrations, nt as setWorkerNativeCapsChangeListener, t as installManifestPythonDeps } from "./manifest-python-deps-C1Dd9MSr.mjs";
+import { I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as resolveAddonClass, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, yt as installManifestNativeDeps } from "./manifest-python-deps-Bp7nvTNF.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";

package/dist/index.js

@@ -20,7 +20,7 @@ const require_builtins_local_auth_local_auth_addon = require("./builtins/local-a
 require("./builtins/local-auth/index.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
-const require_manifest_python_deps = require("./manifest-python-deps-Dt5XNSyd.js");
+const require_manifest_python_deps = require("./manifest-python-deps-Di_9ayDE.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
@@ -92358,6 +92358,16 @@ function readAddonHeapProfile(spec) {
 	heapProfileCache.set(cacheKey, profile);
 	return profile;
 }
+/**
+* Drop the cached heap profile for each addon so the NEXT `readAddonHeapProfile`
+* re-reads the manifest from disk. Called on operator-driven spawns / restarts
+* (a deploy may have changed the addon's `execution.heapProfile`); the
+* crash-respawn fast path deliberately does NOT invalidate — a crashing runner
+* has the same on-disk manifest, so re-reading it is pure overhead.
+*/
+function invalidateHeapProfiles(addons) {
+	for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
+}
 function manifestHasAddon(parsed, addonId) {
 	return readManifestAddons(parsed).some((a) => a.id === addonId);
 }
@@ -92478,12 +92488,13 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_RUNNER_ADDONS: JSON.stringify(addons),
 			CAMSTACK_PARENT_NODE_ID: parentNodeId,
 			CAMSTACK_DATA_DIR: dataDir,
-			CAMSTACK_LOG_LEVEL: "debug",
+			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${isHeavyRunner(addons) ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [
@@ -92558,6 +92569,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				const { runnerId, addons, env } = ctx.params;
 				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				if (!Array.isArray(addons) || addons.length === 0) throw new Error(`spawnRunner requires non-empty addons array`);
+				invalidateHeapProfiles(addons);
 				const entry = spawnRunner(runnerId, addons, env);
 				return {
 					pid: entry.pid,
@@ -92632,6 +92644,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
+					invalidateHeapProfiles(runnerAddons);
 					const restarted = spawnRunner(name, runnerAddons);
 					restarted.restartCount = prevRestartCount + 1;
 					return {
@@ -92689,6 +92702,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						}
 						processes.delete(name);
 						crashSupervisor.reset(name);
+						invalidateHeapProfiles(runnerAddons);
 						const respawned = spawnRunner(name, runnerAddons);
 						respawned.restartCount = prevRestartCount + 1;
 					});
@@ -93473,6 +93487,7 @@ Object.defineProperty(exports, "getFfmpegDownloadUrl", {
 	}
 });
 exports.getModelFilePath = require_model_download_service.getModelFilePath;
+exports.getMoleculerEventStats = require_manifest_python_deps.getMoleculerEventStats;
 exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;
 exports.getOrInitReadinessRegistryForClient = require_manifest_python_deps.getOrInitReadinessRegistryForClient;
 exports.getPidStats = require_resource_monitor.getPidStats;
@@ -93542,8 +93557,10 @@ Object.defineProperty(exports, "scopeKey", {
 exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
 exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
 exports.setHubConnected = require_manifest_python_deps.setHubConnected;
+exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
 exports.stageFrameworkLockstep = stageFrameworkLockstep;
 exports.stripCamstackDeps = stripCamstackDeps;
+exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
 exports.writePendingRestart = writePendingRestart;

package/dist/index.mjs

@@ -18,7 +18,7 @@ import { LocalAuthAddon, a as require_ms, c as __esmMin, d as __toCommonJS, f as
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
-import { A as createUdsEventBus, B as CapRouteError, C as ipcParentLink, D as createHubCapForwardService, E as HUB_CAP_FWD_SERVICE, F as LocalChildRegistry, G as UdsLocalTransportServer, H as callWithServiceDiscovery, I as UDS_NO_ROUTE_PREFIX, J as FrameDecoder, K as SocketChannel, L as AGENT_CAP_FWD_ACTION, M as createUdsLogger, N as createUdsLoggerWithControl, O as createParentUnownedCallHandler, P as LocalChildClient, Q as createBrokerDeviceManagerApi, R as AGENT_CAP_FWD_SERVICE, S as ipcChildLink, T as HUB_CAP_FWD_ACTION, U as createLocalTransport, V as classifyCapRoute, W as UdsLocalTransportClient, X as buildNativeCapProxy, Y as encodeFrame, Z as buildUdsNativeCapProxy, _ as __resetCapUsageRegistryForTests, _t as resolveAddonClass, a as getWorkerDeviceRegistry, at as NATIVE_PROVIDER_SERVICE_INFIX, b as brokerTransportLink, c as setHubConnected, ct as capBareAction, d as registerEventBusService, dt as deserializeTypedArrays, f as AddonDepsManager, ft as serializeTypedArrays, g as CapUsageRegistry, gt as installManifestNativeDeps, h as createHwAccelService, ht as CapabilityUnavailableError, i as createUdsAddonContext, it as validateProviderRegistrations, j as udsChildLogToWorkerEntry, k as createUdsEventBridge, l as EVENT_TOPIC_PREFIX, lt as capServiceName, m as resolveHwAccel, mt as CapabilityHandle, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as capActionName, p as createKernelHwAccel, pt as DeviceRegistry, q as localEndpointPath, r as createAddonContext, rt as createAddonService, s as getOrInitReadinessRegistryForClient, st as capActionSuffix, t as installManifestPythonDeps, tt as mountNativeCapService, u as getBrokerEventBus, ut as parseCapAction, v as getCapUsageRegistry, w as localProviderLink, x as buildLinkChain, y as brokerCallForCap, z as CapRouteResolver } from "./manifest-python-deps-C1Dd9MSr.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as resolveHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as resolveAddonClass, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getMoleculerEventStats, dt as capBareAction, et as buildUdsNativeCapProxy, f as registerEventBusService, ft as capServiceName, g as createKernelHwAccel, gt as DeviceRegistry, h as AddonDepsManager, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as subscribePassthrough, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as setNodeEventInterest, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as getBrokerEventBus, ut as capActionSuffix, v as createHwAccelService, vt as CapabilityUnavailableError, w as buildLinkChain, x as getCapUsageRegistry, y as CapUsageRegistry, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Bp7nvTNF.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { request } from "node:http";
@@ -92350,6 +92350,16 @@ function readAddonHeapProfile(spec) {
 	heapProfileCache.set(cacheKey, profile);
 	return profile;
 }
+/**
+* Drop the cached heap profile for each addon so the NEXT `readAddonHeapProfile`
+* re-reads the manifest from disk. Called on operator-driven spawns / restarts
+* (a deploy may have changed the addon's `execution.heapProfile`); the
+* crash-respawn fast path deliberately does NOT invalidate — a crashing runner
+* has the same on-disk manifest, so re-reading it is pure overhead.
+*/
+function invalidateHeapProfiles(addons) {
+	for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
+}
 function manifestHasAddon(parsed, addonId) {
 	return readManifestAddons(parsed).some((a) => a.id === addonId);
 }
@@ -92470,12 +92480,13 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 			CAMSTACK_RUNNER_ADDONS: JSON.stringify(addons),
 			CAMSTACK_PARENT_NODE_ID: parentNodeId,
 			CAMSTACK_DATA_DIR: dataDir,
-			CAMSTACK_LOG_LEVEL: "debug",
+			CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
 			...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
 			...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
 			...env
 		};
 		const heapFlags = runnerHeapFlags(addons);
+		capturedBroker?.logger.info(`[${runnerId}] heap profile: ${isHeavyRunner(addons) ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
 		const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
 			env: childEnv,
 			stdio: [
@@ -92550,6 +92561,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 				const { runnerId, addons, env } = ctx.params;
 				if (processes.has(runnerId)) throw new Error(`Runner "${runnerId}" already running`);
 				if (!Array.isArray(addons) || addons.length === 0) throw new Error(`spawnRunner requires non-empty addons array`);
+				invalidateHeapProfiles(addons);
 				const entry = spawnRunner(runnerId, addons, env);
 				return {
 					pid: entry.pid,
@@ -92624,6 +92636,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 					processes.delete(name);
 					crashSupervisor.reset(name);
 					forceMoleculerDisconnect(ctx.broker, deadNodeId);
+					invalidateHeapProfiles(runnerAddons);
 					const restarted = spawnRunner(name, runnerAddons);
 					restarted.restartCount = prevRestartCount + 1;
 					return {
@@ -92681,6 +92694,7 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 						}
 						processes.delete(name);
 						crashSupervisor.reset(name);
+						invalidateHeapProfiles(runnerAddons);
 						const respawned = spawnRunner(name, runnerAddons);
 						respawned.restartCount = prevRestartCount + 1;
 					});
@@ -93238,4 +93252,4 @@ async function stageFrameworkLockstep(input) {
 	return results;
 }
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FRAMEWORK_LOCKSTEP, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyCapRoute, clearPendingRestart, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createHwAccelService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensurePython, ensureTlsCert, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isClusterSecretMismatchError, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, serializeTypedArrays, setHubConnected, stageFrameworkLockstep, stripCamstackDeps, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FRAMEWORK_LOCKSTEP, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyCapRoute, clearPendingRestart, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createHwAccelService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensurePython, ensureTlsCert, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isClusterSecretMismatchError, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, serializeTypedArrays, setHubConnected, setNodeEventInterest, stageFrameworkLockstep, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };

package/dist/kernel/index.d.ts

@@ -33,7 +33,8 @@ export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-d
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';
 export type { CoreCapAction, CoreCapServiceOptions } from './moleculer/core-cap-service.js';
-export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, getBrokerEventBus, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
+export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, getBrokerEventBus, EVENT_TOPIC_PREFIX, } from './moleculer/addon-context-factory.js';
+export type { MoleculerEventStats } from './moleculer/addon-context-factory.js';
 export { HubLogForwarder } from './moleculer/hub-log-forwarder.js';
 export type { AddonContextOptions } from './moleculer/addon-context-factory.js';
 export { createHubService } from './moleculer/hub-service.js';

package/dist/kernel/moleculer/addon-context-factory.d.ts

@@ -5,7 +5,7 @@ import { CapabilityRegistry } from '../capability-registry.js';
 import { CapCallInput } from '../transport/index.js';
 import { LocalChildClient } from '../transport/local-child-client.js';
 import { DataPlaneSink } from './addon-data-plane-facility.js';
-import { getBrokerEventBus, registerEventBusService, clusterEventTopic, EVENT_TOPIC_PREFIX } from './event-bus.js';
+import { getBrokerEventBus, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, clusterEventTopic, EVENT_TOPIC_PREFIX, MoleculerEventStats } from './event-bus.js';
 import { createRunnerLogger, setHubConnected, ___resetHubConnectedForTests, ___createRemoteLoggerForTests } from './remote-logger.js';
 import { withAddonScope, setPreferredProvider, ___resetBindingSubscriptionForTests } from './provider-registry.js';
 /**
@@ -99,5 +99,5 @@ declare function createUdsAddonContext(client: LocalChildClient, nodeId: string,
  * next addon instance loads.
  */
 declare function drainWorkerDisposerChain(nodeId: string, addonId: string): Promise<void>;
-export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, drainWorkerDisposerChain, registerEventBusService, clusterEventTopic, EVENT_TOPIC_PREFIX, getBrokerEventBus, withAddonScope, setPreferredProvider, createRunnerLogger, __resetHubConnectedForTests, __resetBindingSubscriptionForTests, __createRemoteLoggerForTests, };
-export type { AddonContextOptions };
+export { createAddonContext, createUdsAddonContext, setHubConnected, adaptBrokerToCluster, drainWorkerDisposerChain, registerEventBusService, setNodeEventInterest, getMoleculerEventStats, subscribePassthrough, clusterEventTopic, EVENT_TOPIC_PREFIX, getBrokerEventBus, withAddonScope, setPreferredProvider, createRunnerLogger, __resetHubConnectedForTests, __resetBindingSubscriptionForTests, __createRemoteLoggerForTests, };
+export type { AddonContextOptions, MoleculerEventStats };

package/dist/kernel/moleculer/event-bus-core.d.ts

@@ -1,4 +1,4 @@
-import { SystemEvent, EventFilter } from '@camstack/types';
+import { EventFilter, SystemEvent } from '@camstack/types';
 export interface SubscriberEntry {
     /** Original filter — kept whole so non-category dimensions are honoured per-event. */
     readonly filter: EventFilter | string | undefined;
@@ -18,11 +18,34 @@ export interface SharedBusState {
      * high-frequency categories so the buffer only accumulates audit-grade
      * lifecycle events.
      *
+     * ONLY populated when `retainRecent` is true (the hub main process). On every
+     * other bus this array stays empty for the process's whole lifetime.
+     *
      * Cleared on server restart (intentional — events are volatile by design).
      */
     readonly recent: SystemEvent[];
+    /**
+     * Whether this bus retains events in `recent[]` to back the
+     * `getRecent`/audit capability.
+     *
+     * Events are one-shot (fire-and-forget): ONLY the hub main process — the
+     * single process that serves `getRecent` — needs the registry, so ONLY its
+     * broker bus sets this true. Child addon runners and remote agents leave it
+     * false: they fan every event out to their local subscribers but retain
+     * nothing, so their heap can never accumulate an unbounded recent[] backlog.
+     *
+     * Mutable so the authoritative opt-in (the hub-main `getBrokerEventBus`
+     * caller) can upgrade a bus that a non-retaining caller happened to create
+     * first — see `getSharedBusState`. Never downgraded from true → false.
+     */
+    retainRecent: boolean;
 }
-export declare function createSharedBusState(): SharedBusState;
+/**
+ * @param retainRecent - `true` ONLY for the hub main broker bus (it serves
+ *   `getRecent`). Defaults to `false` — the safe one-shot default for child
+ *   runners + agents, which retain nothing.
+ */
+export declare function createSharedBusState(retainRecent?: boolean): SharedBusState;
 export declare function matchesPattern(pattern: string, category: string): boolean;
 export declare function extractCategoryPattern(filter: EventFilter | string): string;
 /**
@@ -45,9 +68,77 @@ export declare function matchesEventFilter(event: SystemEvent, filter: EventFilt
  * being displaced by per-frame noise.
  */
 export declare const RING_BUFFER_DENY_PATTERNS: readonly string[];
+/**
+ * Hard cap on the `recent[]` buffer size. Even audit-grade categories that
+ * are NOT on the deny-list (e.g. `device.state-changed`) must not accumulate
+ * without bound — this is the last-N window, not a durable log. Without this
+ * cap the buffer grew forever (~26 MB/h/process across every broker, agent,
+ * and UDS-child bus), filling the hub to 16 GB.
+ */
+export declare const MAX_RECENT_EVENTS = 1000;
 export declare function isHighFrequencyCategory(category: string): boolean;
 /**
- * Deliver `event` to all matching local subscribers and — unless it is
- * high-frequency — append it to the `recent[]` ring.
+ * Fan-out mode for cross-node (Moleculer) event delivery, read from the
+ * `CAMSTACK_MOLECULER_EVENT_FANOUT` env. The inter-node analogue of the
+ * intra-host `CAMSTACK_UDS_EVENT_FANOUT` gate (`local-child-registry.ts`):
+ *   - `filter`    (default) — drop an inbound cross-node event whose category
+ *     no local subscriber on THIS node wants (the union of its children's
+ *     declared patterns).
+ *   - `shadow`    — compute the drop decision + count would-suppresses, but
+ *     STILL deliver every event (burn-in: prove zero would-be-starved deliveries
+ *     before flipping to `filter`).
+ *   - `broadcast` — ignore the gate entirely (pre-D2 behaviour).
+ *
+ * ROLLBACK CONTRACT (operators, read this): this env governs ONLY the inter-node
+ * (Moleculer) gate. The intra-host UDS fan-out has a SEPARATE, independent
+ * kill-switch, `CAMSTACK_UDS_EVENT_FANOUT` (see `local-child-registry.ts`). A
+ * FULL rollback to pre-D2 / pre-#44 delivery therefore requires BOTH env vars
+ * set to `broadcast` AND a process restart on EVERY node (hub + all agents) —
+ * each is read ONCE at registration/construction, so a running process will not
+ * pick up a change. Flipping only one leg leaves the other filtering and yields
+ * inconsistent behaviour. Recommended first fleet-wide enable: `shadow` on both,
+ * watch the suppressed counters (`getMoleculerEventStats` /
+ * `getChildEventStats`), then flip to `filter` once burn-in shows zero
+ * would-be-starved deliveries.
+ */
+export type MoleculerEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
+export declare function readMoleculerFanoutMode(): MoleculerEventFanoutMode;
+/**
+ * A node's inbound-interest snapshot used by {@link crossNodeAcceptsCategory}.
+ *  - `retainRecent` — the receiving bus retains events for `getRecent`/audit
+ *    (the hub main process). Such a bus genuinely wants EVERY category (its
+ *    interest set is the admin-ui live stream + recent[] ring), so it always
+ *    fails OPEN — it never filters inbound cross-node events.
+ *  - `interest` — the union of this node's local subscribers' declared category
+ *    patterns (aggregated from its UDS children). `null` = undeclared / unknown
+ *    (a legacy child, or no oracle installed) → fail OPEN (accept everything).
+ *    An EMPTY array is a *declared* "wants nothing" and drops every category.
+ */
+export interface CrossNodeInterestSnapshot {
+    readonly retainRecent: boolean;
+    readonly interest: readonly string[] | null;
+}
+/**
+ * Does this node want to accept an inbound cross-node event in `category`?
+ * The receiving-side mirror of `LocalChildRegistry.childWantsEvent`:
+ *   - `broadcast` mode → always (gate disabled).
+ *   - a retaining bus (hub main) → always (it serves `getRecent` + admin-ui;
+ *     its interest is genuinely everything).
+ *   - undeclared interest (`null`) → always (fail-open).
+ *   - else the declared union must match via `matchesPattern` — the SAME
+ *     function the local subscriber map-key gate uses, giving delivery parity.
+ * `shadow` is handled by the caller (it counts the would-suppress but still
+ * delivers), exactly like the UDS fan-out.
+ */
+export declare function crossNodeAcceptsCategory(mode: MoleculerEventFanoutMode, snapshot: CrossNodeInterestSnapshot, category: string): boolean;
+/**
+ * Deliver `event` to all matching local subscribers and — ONLY on a bus that
+ * opted into retention (`state.retainRecent`, i.e. the hub main process) and
+ * unless the event is high-frequency — append it to the bounded `recent[]`
+ * ring.
+ *
+ * On a non-retaining bus (child runners, agents) the retention block is skipped
+ * entirely: events are one-shot / fire-and-forget, still fanned out to local
+ * subscribers but never accumulated. `getRecent` on such a bus returns `[]`.
  */
 export declare function deliverShared(state: SharedBusState, event: SystemEvent): void;

package/dist/kernel/moleculer/event-bus.d.ts

@@ -1,5 +1,5 @@
+import { IEventBus, SystemEvent } from '@camstack/types';
 import { ServiceBroker } from 'moleculer';
-import { IEventBus } from '@camstack/types';
 /**
  * Narrow interface for the Moleculer ServiceBroker surface used in this file.
  * moleculer's index.d.ts chains through eventemitter2 whose package.json has
@@ -28,6 +28,39 @@ export interface BrokerLike {
 export declare const EVENT_TOPIC_PREFIX = "camstack.evt.";
 /** Build the Moleculer broadcast topic for an event category. */
 export declare function clusterEventTopic(category: string): string;
+/**
+ * Subscribe a PASS-THROUGH relay handler to the broker's shared bus WITHOUT
+ * registering it in the local-interest surface. Used exclusively by the UDS
+ * event bridge for its cluster/parent-local → children fan-out subscription:
+ * the bridge must receive every event the gate lets through so it can relay to
+ * forked children, but it is not itself a terminal consumer, so it must not
+ * count toward this node's interest (a counted `*` would defeat the filter).
+ * Returns an unsubscribe function.
+ */
+export declare function subscribePassthrough(broker: ServiceBroker, handler: (event: SystemEvent) => void): () => void;
+/** Cross-node inbound fan-out counters for a broker, `{ delivered, suppressed }`. */
+export interface MoleculerEventStats {
+    readonly delivered: number;
+    readonly suppressed: number;
+}
+/**
+ * Install (or clear, with `null`) the per-node interest oracle consulted by the
+ * `$event-bus` inbound handler to decide whether an inbound cross-node event is
+ * wanted by any local subscriber on this node. The oracle is read PER-EVENT so a
+ * child (un)subscribing takes effect immediately with no re-registration.
+ *
+ * Only non-retaining nodes (agents) meaningfully filter — a retaining bus (hub
+ * main) always accepts every category (it serves `getRecent` + the admin-ui live
+ * stream). Installing the oracle on the hub too is therefore harmless and keeps
+ * the wiring uniform.
+ */
+export declare function setNodeEventInterest(broker: ServiceBroker, oracle: (() => readonly string[] | null) | null): void;
+/**
+ * Cross-node inbound counters for `broker`, or `null` if no cross-node event has
+ * been processed yet. Exposed for the D2 shadow burn-in + operator debug —
+ * mirror of `LocalChildRegistry.getChildEventStats`.
+ */
+export declare function getMoleculerEventStats(broker: ServiceBroker): MoleculerEventStats | null;
 /**
  * Register the `$event-bus` service on a broker. MUST be called BEFORE
  * `broker.start()` — Moleculer announces a service's event
@@ -49,5 +82,14 @@ export declare function clusterEventTopic(category: string): string;
  *  - forkable process / group runner, before `broker.start()`
  */
 export declare function registerEventBusService(broker: ServiceBroker): void;
-export declare function getBrokerEventBus(broker: ServiceBroker): IEventBus;
+/**
+ * @param options.retainRecent - Pass `true` ONLY from the hub main process
+ *   (`EventBusService.attachBroker`), the single process that serves the
+ *   `getRecent`/audit capability. Every other caller (agents, child runners,
+ *   the per-addon wrapper, the `$event-bus` handler) omits it → the bus retains
+ *   nothing and `getRecent` returns `[]`. Events are one-shot everywhere else.
+ */
+export declare function getBrokerEventBus(broker: ServiceBroker, options?: {
+    retainRecent?: boolean;
+}): IEventBus;
 export declare function createBrokerEventBus(broker: ServiceBroker, addonId: string): IEventBus;

package/dist/kernel/moleculer/process-service.d.ts

@@ -68,5 +68,5 @@ interface ProcessServiceDeps {
     readonly spawnFn?: SpawnFn;
 }
 declare function createProcessService(parentNodeId: string, dataDir: string, deps?: ProcessServiceDeps, parentTcpPort?: number, parentUdsPath?: string): ServiceSchema;
-export { createProcessService };
 export type { ProcessInfo, SpawnedProcess };
+export { createProcessService };

package/dist/kernel/transport/child-cap-protocol.d.ts

@@ -1,4 +1,4 @@
-import { SystemEvent, IReadinessRegistryRecord, LogLevel, LogTags } from '@camstack/types';
+import { IReadinessRegistryRecord, LogLevel, LogTags, SystemEvent } from '@camstack/types';
 /**
  * Routing descriptor a child sends so the parent can route cap calls to it.
  * The provider implementation never crosses the wire — only these keys do.
@@ -15,6 +15,27 @@ export interface RegisterMessage {
     readonly kind: 'register';
     readonly childId: string;
     readonly caps: readonly ChildCapDescriptor[];
+    /**
+     * Snapshot of the child's live category-pattern subscriptions (the keys of
+     * its local `SharedBusState.handlers` map). Carried IN the register frame so
+     * the parent learns the child's subscriptions race-free at boot — no separate
+     * post-connect sync can be missed. OPTIONAL: a legacy child bundling an older
+     * `@camstack/system` omits it; the parent treats an absent field as
+     * "undeclared" and fails OPEN (broadcast every event to that child). See
+     * `EventSubUpdateMessage` for post-boot updates.
+     */
+    readonly eventPatterns?: readonly string[];
+}
+/**
+ * Child → parent, fire-and-forget: the child's category-pattern subscription
+ * set changed after registration. FULL-SET REPLACE semantics — `patterns` is
+ * the complete current set, not a delta. Idempotent and order-safe on the
+ * in-order UDS socket (last write wins is correct). Sent via `channel.emit`
+ * like {@link ChildEventMessage}; carries no response.
+ */
+export interface EventSubUpdateMessage {
+    readonly kind: 'event-sub';
+    readonly patterns: readonly string[];
 }
 /** Child → parent outbound cap invocation — the child asks the parent to route a cap call it does not own. */
 export interface CapCallOutMessage {
@@ -56,10 +77,10 @@ export interface ReadinessSnapshotRequest {
  * Child → parent message bodies.
  * `RegisterMessage`, `CapCallOutMessage`, and `ReadinessSnapshotRequest` travel
  * as correlated request frames (`channel.request`) and carry a response.
- * `ChildEventMessage` and `ChildLogMessage` are sent fire-and-forget via
- * `channel.emit()` and do NOT carry a response.
+ * `ChildEventMessage`, `ChildLogMessage`, and `EventSubUpdateMessage` are sent
+ * fire-and-forget via `channel.emit()` and do NOT carry a response.
  */
-export type ChildToParentRequest = RegisterMessage | CapCallOutMessage | ChildEventMessage | ChildLogMessage | ReadinessSnapshotRequest;
+export type ChildToParentRequest = RegisterMessage | CapCallOutMessage | ChildEventMessage | ChildLogMessage | EventSubUpdateMessage | ReadinessSnapshotRequest;
 /** Parent → child cap invocation. */
 export interface CapCallMessage {
     readonly kind: 'cap-call';

package/dist/kernel/transport/local-child-client.d.ts

@@ -1,5 +1,5 @@
-import { ChildCapDescriptor, CapCallInput, ChildLogMessage, AddonCallInput } from './child-cap-protocol.js';
-import { SystemEvent, IReadinessRegistryRecord } from '@camstack/types';
+import { IReadinessRegistryRecord, SystemEvent } from '@camstack/types';
+import { AddonCallInput, CapCallInput, ChildCapDescriptor, ChildLogMessage } from './child-cap-protocol.js';
 export interface LocalChildClientOptions {
     /** Parent node id — selects the UDS endpoint this child connects to. */
     readonly nodeId: string;
@@ -38,6 +38,24 @@ export declare class LocalChildClient {
      * the latest set) instead of being lost or throwing.
      */
     private latestCaps;
+    /**
+     * Per-owner (addonId) category-pattern subscription sets, and their union.
+     * The union is declared to the parent (in `RegisterMessage.eventPatterns`
+     * pre/at-connect, or via an `event-sub` emit post-connect) so the parent can
+     * subscription-filter its event fan-out. Per-owner keying keeps the union
+     * correct if multiple event buses ever share one client (group-runner case).
+     */
+    private readonly patternsByOwner;
+    private latestEventPatterns;
+    /**
+     * Whether `updateEventPatterns` has ever been called. A client that never
+     * declared a subscription set (no event bus wired — e.g. a pure cap-call
+     * runner) omits `eventPatterns` from its register frame entirely, so the
+     * parent treats it as UNDECLARED and fails OPEN (broadcast-all). Once any
+     * owner declares (in production every addon context's framework
+     * subscriptions do), the register carries the real union — even if empty.
+     */
+    private hasDeclaredEventPatterns;
     /** Events and logs queued while the channel is not yet open. */
     private readonly pendingEmits;
     /** Handler for parent→child events. Registered via `onEvent`. */
@@ -60,6 +78,20 @@ export declare class LocalChildClient {
     /** Callbacks registered via `onConnected`. Fired on every (re)connect. */
     private readonly connectedHandlers;
     constructor(options: LocalChildClientOptions);
+    /**
+     * Declare an owner's live category-pattern subscription set. Stores it
+     * per-owner (keyed by `ownerId` = addonId), recomputes the union, and — only
+     * if the union changed — declares it to the parent:
+     *   - pre-connect: buffered only; `start()`'s register frame carries the set.
+     *   - post-connect: emitted as a fire-and-forget `event-sub` (full-set
+     *     replace).
+     * Idempotent on an unchanged union (no redundant `event-sub` frames).
+     */
+    updateEventPatterns(ownerId: string, patterns: readonly string[]): void;
+    /** Sorted, de-duplicated union across all owners' pattern sets. */
+    private computePatternUnion;
+    /** Order-insensitive equality — both inputs are already sorted unions here. */
+    private patternsEqual;
     /**
      * Register a callback that fires each time the client successfully connects
      * (or reconnects) to its parent. Multiple handlers may be registered; all

package/dist/kernel/transport/local-child-registry.d.ts

@@ -1,6 +1,22 @@
+import { IReadinessRegistryRecord, SystemEvent } from '@camstack/types';
+import { AddonCallInput, CapCallInput, ChildLogMessage, RegisteredChild } from './child-cap-protocol.js';
 import { LocalTransportServer } from './local-transport.js';
-import { ChildLogMessage, CapCallInput, AddonCallInput, RegisteredChild } from './child-cap-protocol.js';
-import { SystemEvent, IReadinessRegistryRecord } from '@camstack/types';
+/**
+ * Fan-out mode for parent→child event delivery, from the
+ * `CAMSTACK_UDS_EVENT_FANOUT` env (read once at registry construction):
+ *   - `filter`    (default) — apply the subscription gate; a child receives a
+ *     category only if one of its declared patterns matches.
+ *   - `shadow`    — compute the gate decision + count would-suppresses, but
+ *     STILL send every event (burn-in: prove zero would-be-starved deliveries).
+ *   - `broadcast` — ignore the gate entirely (today's behaviour); the operator's
+ *     one-env rollback without redeploying runners.
+ */
+export type UdsEventFanoutMode = 'filter' | 'shadow' | 'broadcast';
+/** Per-child event fan-out counters (sent = delivered, suppressed = gated/would-gate). */
+export interface ChildEventStats {
+    sent: number;
+    suppressed: number;
+}
 /**
  * Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
  * local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
@@ -69,6 +85,12 @@ export declare class LocalChildRegistry {
     private readonly resolveChildIdForAddon?;
     /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
     private readonly egressRoutedCaps;
+    /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
+    private readonly fanoutMode;
+    /** Per-child event fan-out counters (sent / suppressed). */
+    private readonly childEventStats;
+    /** Last pattern-set string logged per child, to dedup the INFO line. */
+    private readonly loggedPatternSet;
     /**
      * Accepts either a plain positional `server` argument (backward-compatible)
      * or a full `LocalChildRegistryOptions` object.
@@ -82,6 +104,51 @@ export declare class LocalChildRegistry {
      */
     constructor(serverOrOptions: LocalTransportServer | LocalChildRegistryOptions, onUnownedCallArg?: (input: CapCallInput) => Promise<unknown>);
     start(): Promise<void>;
+    /**
+     * Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
+     * child has no recorded events yet. Exposed for the starvation-verification
+     * surface (shadow burn-in + operator debug).
+     */
+    getChildEventStats(childId: string): ChildEventStats | null;
+    /**
+     * Does `entry` want to receive an event in `category`? Honours the fan-out
+     * mode: `broadcast` → always; undeclared patterns (`null`) → always
+     * (fail-open); else the child's declared set must match via `matchesPattern`
+     * — the SAME function the child's own `deliverShared` map-key gate uses,
+     * giving provable delivery parity. `shadow` is handled by the caller (it
+     * counts the would-suppress but still sends).
+     *
+     * NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
+     * `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
+     * that explicitly subscribes to a ring-denied category must still RECEIVE it.
+     */
+    private childWantsEvent;
+    /**
+     * D2: this node's aggregate cross-node event interest — the UNION of every
+     * connected child's declared category patterns. Consumed by the parent's
+     * `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
+     * accepts cross-node (Moleculer) categories at least one local child wants.
+     *
+     * Returns `null` (fail-open — accept everything) when:
+     *   - NO child is currently connected (boot window before the first forked
+     *     child completes its UDS handshake, or every child has disconnected): a
+     *     node MUST NOT drop 100% of inbound cross-node events during that window,
+     *     and a child may connect imminently. This is distinct from the
+     *     declared-empty case below.
+     *   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
+     *     runner): a node cannot safely narrow its inbound set while a child's
+     *     real interest is unknown. Mirrors the per-child fail-open in
+     *     {@link childWantsEvent}, aggregated conservatively.
+     *
+     * Returns an EMPTY array only when ≥1 child is connected and EVERY connected
+     * child declared an explicit empty set — a genuine "wants nothing". Reads the
+     * live `children` map, so a child registering / disconnecting / sending
+     * `event-sub` is reflected on the next call with no extra bookkeeping.
+     */
+    aggregateEventInterest(): readonly string[] | null;
+    private statsFor;
+    /** Deduped INFO line whenever a child's declared pattern set changes. */
+    private logPatternSet;
     /**
      * Child id that can service a call to `capName` (optionally addressing
      * `deviceId`), or null.