@camstack/system 1.2.153 → 1.2.155

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C7uZ_fOb.js");
+const require_dist = require("./dist-BPlfW-CG.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-BxQlomxd.js");
-const require_manifest_python_deps = require("./manifest-python-deps-CRTx_j4k.js");
+const require_manifest_python_deps = require("./manifest-python-deps-w48vOhGR.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -95332,6 +95332,8 @@ exports.DataPlaneRegistry = DataPlaneRegistry;
 exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
 exports.DeviceRegistry = require_manifest_python_deps.DeviceRegistry;
 exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
+exports.EMPTY_SOCKET_DIRECTION = require_manifest_python_deps.EMPTY_SOCKET_DIRECTION;
+exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_python_deps.EMPTY_SOCKET_PLANE_BASELINE;
 exports.EVENT_PLANE_TOP_N = require_manifest_python_deps.EVENT_PLANE_TOP_N;
 exports.EVENT_TOPIC_PREFIX = require_manifest_python_deps.EVENT_TOPIC_PREFIX;
 exports.EngineManagerResolver = EngineManagerResolver;
@@ -95405,6 +95407,7 @@ exports.ReadinessTimeoutError = require_dist.ReadinessTimeoutError;
 exports.ReplEngine = ReplEngine;
 exports.RingBuffer = RingBuffer;
 exports.SERVER_AUTH_OID = require_tls$1.SERVER_AUTH_OID;
+exports.SOCKET_PLANE_TOP_N = require_manifest_python_deps.SOCKET_PLANE_TOP_N;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -95490,6 +95493,9 @@ exports.createProcessService = createProcessService;
 exports.createReadinessService = createReadinessService;
 exports.createReadinessServiceForRegistry = createReadinessServiceForRegistry;
 exports.createScopedProcessManager = createScopedProcessManager;
+exports.createSocketDirectionCounters = require_manifest_python_deps.createSocketDirectionCounters;
+exports.createSocketPlaneMeter = require_manifest_python_deps.createSocketPlaneMeter;
+exports.createSocketPlaneReader = require_manifest_python_deps.createSocketPlaneReader;
 exports.createStreamProbeBrokerService = createStreamProbeBrokerService;
 exports.createUdsAddonContext = require_manifest_python_deps.createUdsAddonContext;
 exports.createUdsEventBridge = require_manifest_python_deps.createUdsEventBridge;
@@ -95503,6 +95509,7 @@ exports.describeProviderKindDrift = describeProviderKindDrift;
 exports.describeRss = require_manifest_python_deps.describeRss;
 exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
 exports.diffEventPlane = require_manifest_python_deps.diffEventPlane;
+exports.diffSocketPlane = require_manifest_python_deps.diffSocketPlane;
 Object.defineProperty(exports, "downloadBinary", {
 	enumerable: true,
 	get: function() {
@@ -95550,6 +95557,7 @@ Object.defineProperty(exports, "findInPath", {
 exports.formatEventPlane = require_manifest_python_deps.formatEventPlane;
 exports.formatHeapSpaces = require_manifest_python_deps.formatHeapSpaces;
 exports.formatLogLine = require_formatter.formatLogLine;
+exports.formatSocketPlane = require_manifest_python_deps.formatSocketPlane;
 exports.getBrokerEventBus = require_manifest_python_deps.getBrokerEventBus;
 exports.getCapUsageRegistry = require_manifest_python_deps.getCapUsageRegistry;
 Object.defineProperty(exports, "getFfmpegDownloadUrl", {
@@ -95629,6 +95637,7 @@ exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;
 exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.reclaimIntervalMs = require_manifest_python_deps.reclaimIntervalMs;
+exports.recordSocketFrame = require_manifest_python_deps.recordSocketFrame;
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
 exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
@@ -95637,6 +95646,7 @@ exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
 exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
 exports.runHubAddonBoot = runHubAddonBoot;
 exports.runNpm = require_manifest_python_deps.runNpm;
+exports.sampleSocketDirection = require_manifest_python_deps.sampleSocketDirection;
 exports.scheduleSelfRestart = scheduleSelfRestart;
 exports.scopeKey = require_dist.scopeKey;
 exports.scopesAllowAddon = require_dist.scopesAllowAddon;
@@ -95647,6 +95657,8 @@ exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays
 exports.setHubConnected = require_manifest_python_deps.setHubConnected;
 exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
 exports.shouldReclaim = require_manifest_python_deps.shouldReclaim;
+exports.socketDirectionBytes = require_manifest_python_deps.socketDirectionBytes;
+exports.socketDirectionMessages = require_manifest_python_deps.socketDirectionMessages;
 exports.startHeapWatch = require_manifest_python_deps.startHeapWatch;
 exports.startRunnerHeapWatch = require_manifest_python_deps.startRunnerHeapWatch;
 exports.strandedMb = require_manifest_python_deps.strandedMb;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-BLhrrxIs.mjs";
+import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-D_NyUV6Y.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
-import { $ as buildNativeCapProxy, $t as RUNNER_HEAP_SNAPSHOT_ENV, A as createParentUnownedCallHandler, At as HUB_MAIN_HEAP_WATCH_LABEL, B as AGENT_CAP_FWD_SERVICE, Bt as createLoopDelayMeter, C as brokerTransportLink, Ct as runNpm, D as HUB_CAP_FWD_ACTION, Dt as HEAP_RECLAIM_TRIGGER_MB, E as localProviderLink, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as readMoleculerFanoutMode, Gt as parseRssBudgetMb, H as CapRouteError, Ht as describeRss, I as LocalChildClient, It as RUNNER_RSS_BUDGET_ENV, J as UdsLocalTransportServer, Jt as startHeapWatch, K as createLocalTransport, Kt as reclaimIntervalMs, L as LocalChildRegistry, Lt as ZERO_LOOP_DELAY, M as createUdsEventBus, Mt as HUB_RSS_BUDGET_ENV, N as udsChildLogToWorkerEntry, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as HUB_CAP_FWD_SERVICE, Ot as HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as RSS_BUDGET_RELEASE_RATIO, Q as encodeFrame, Qt as HEAP_SPACE_REPORT_MIN_MB, R as UDS_NO_ROUTE_PREFIX, Rt as buildHeapSample, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcParentLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as classifyCapRoute, Ut as hubMainRssBudget, V as CapRouteResolver, Vt as createV8Reclaimer, W as callWithServiceDiscovery, Wt as nextRssBudgetState, X as localEndpointPath, Xt as strandedMb, Y as SocketChannel, Yt as startRunnerHeapWatch, Z as FrameDecoder, Zt as DECISIVE_HEAP_SPACES, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, an as selectReportedSpaces, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, cn as createEventPlaneReader, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, en as emitHeapDiagnosticReport, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, in as readHeapSpaces, it as mountNativeCapService, j as createUdsEventBridge, jt as HUB_MAIN_RSS_BUDGET_MB, k as createHubCapForwardService, kt as HEAP_WATCH_WARN_RATIO, l as EVENT_TOPIC_PREFIX, ln as diffEventPlane, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, nn as heapSnapshotAuthorised, o as getOrInitReadinessRegistry, on as EVENT_PLANE_TOP_N, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, qt as shouldReclaim, r as createAddonContext, rn as heapSpaceField, s as getOrInitReadinessRegistryForClient, sn as createEventPlaneMeter, st as validateProviderRegistrations, t as installManifestPythonDeps, tn as formatHeapSpaces, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, un as formatEventPlane, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as AGENT_CAP_FWD_ACTION, zt as createDeferredHeapWatchSink } from "./manifest-python-deps-QompQxhG.mjs";
+import { $ as buildNativeCapProxy, $t as RUNNER_HEAP_SNAPSHOT_ENV, A as createParentUnownedCallHandler, At as HUB_MAIN_HEAP_WATCH_LABEL, B as AGENT_CAP_FWD_SERVICE, Bt as createLoopDelayMeter, C as brokerTransportLink, Ct as runNpm, D as HUB_CAP_FWD_ACTION, Dt as HEAP_RECLAIM_TRIGGER_MB, E as localProviderLink, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as readMoleculerFanoutMode, Gt as parseRssBudgetMb, H as CapRouteError, Ht as describeRss, I as LocalChildClient, It as RUNNER_RSS_BUDGET_ENV, J as UdsLocalTransportServer, Jt as startHeapWatch, K as createLocalTransport, Kt as reclaimIntervalMs, L as LocalChildRegistry, Lt as ZERO_LOOP_DELAY, M as createUdsEventBus, Mt as HUB_RSS_BUDGET_ENV, N as udsChildLogToWorkerEntry, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as HUB_CAP_FWD_SERVICE, Ot as HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as RSS_BUDGET_RELEASE_RATIO, Q as encodeFrame, Qt as HEAP_SPACE_REPORT_MIN_MB, R as UDS_NO_ROUTE_PREFIX, Rt as buildHeapSample, S as brokerCallForCap, Sn as formatEventPlane, St as resolveNpmInvocation, T as ipcParentLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as classifyCapRoute, Ut as hubMainRssBudget, V as CapRouteResolver, Vt as createV8Reclaimer, W as callWithServiceDiscovery, Wt as nextRssBudgetState, X as localEndpointPath, Xt as strandedMb, Y as SocketChannel, Yt as startRunnerHeapWatch, Z as FrameDecoder, Zt as DECISIVE_HEAP_SPACES, _ as createKernelHwAccel, _n as socketDirectionMessages, _t as CapabilityHandle, a as getWorkerDeviceRegistry, an as selectReportedSpaces, b as __resetCapUsageRegistryForTests, bn as createEventPlaneReader, bt as installManifestNativeDeps, c as setHubConnected, cn as createSocketPlaneMeter, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dn as formatSocketPlane, dt as capBareAction, en as emitHeapDiagnosticReport, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, fn as EMPTY_SOCKET_DIRECTION, ft as capServiceName, g as AddonDepsManager, gn as socketDirectionBytes, gt as DeviceRegistry, h as subscribePassthrough, hn as sampleSocketDirection, ht as serializeTypedArrays, i as createUdsAddonContext, in as readHeapSpaces, it as mountNativeCapService, j as createUdsEventBridge, jt as HUB_MAIN_RSS_BUDGET_MB, k as createHubCapForwardService, kt as HEAP_WATCH_WARN_RATIO, l as EVENT_TOPIC_PREFIX, ln as createSocketPlaneReader, lt as capActionName, m as setNodeEventInterest, mn as recordSocketFrame, mt as deserializeTypedArrays, n as adaptBrokerToCluster, nn as heapSnapshotAuthorised, o as getOrInitReadinessRegistry, on as EMPTY_SOCKET_PLANE_BASELINE, ot as createAddonService, p as registerEventBusService, pn as createSocketDirectionCounters, pt as parseCapAction, q as UdsLocalTransportClient, qt as shouldReclaim, r as createAddonContext, rn as heapSpaceField, s as getOrInitReadinessRegistryForClient, sn as SOCKET_PLANE_TOP_N, st as validateProviderRegistrations, t as installManifestPythonDeps, tn as formatHeapSpaces, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, un as diffSocketPlane, ut as capActionSuffix, v as resolveHwAccel, vn as EVENT_PLANE_TOP_N, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xn as diffEventPlane, xt as resolveAddonClass, y as CapUsageRegistry, yn as createEventPlaneMeter, yt as copyBundledNativeModules, z as AGENT_CAP_FWD_ACTION, zt as createDeferredHeapWatchSink } from "./manifest-python-deps-BiWtkFGY.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -95283,4 +95283,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_SNAPSHOT_ENV, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffEventPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatEventPlane, formatHeapSpaces, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSnapshotAuthorised, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_SNAPSHOT_ENV, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatEventPlane, formatHeapSpaces, formatLogLine, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSnapshotAuthorised, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/heap-watch.d.ts

@@ -1,4 +1,5 @@
 import { EventPlaneReader } from './event-plane-report.js';
+import { SocketPlaneReader } from './socket-plane-report.js';
 import { HeapSpaceReader } from './heap-spaces.js';
 /**
  * What hub-main calls itself in a `[mem]` line.
@@ -598,6 +599,13 @@ export interface HeapWatchProbes {
      * printing nothing. Only hub-main and an agent's main pass one.
      */
     readonly eventPlane?: EventPlaneReader;
+    /**
+     * Per-peer UDS socket traffic, split by frame kind. No default, for the same
+     * reason as {@link eventPlane}: a forked runner has no child registry, and the
+     * plane it does have (its single channel to its parent) is already reported
+     * from the parent's side. Only hub-main and an agent's main pass one.
+     */
+    readonly socketPlane?: SocketPlaneReader;
 }
 /**
  * Start the heartbeat. Returns a stop function.

package/dist/kernel/socket-plane-report.d.ts

@@ -0,0 +1,99 @@
+import { SocketDirectionSample, SocketTrafficSample } from './transport/socket-traffic.js';
+/** One peer's cumulative traffic, as the channel keeps it. */
+export interface SocketPeerSample {
+    readonly peerId: string;
+    readonly tx: SocketDirectionSample;
+    readonly rx: SocketDirectionSample;
+}
+/** What `LocalChildRegistry` exposes, structurally — the kernel's heartbeat
+ *  must not depend on the transport layer's class. */
+export interface SocketPlaneRegistryChild {
+    readonly childId: string;
+}
+export interface SocketPlaneRegistry {
+    readonly listChildren: () => readonly SocketPlaneRegistryChild[];
+    readonly getChildSocketTraffic: (childId: string) => SocketTrafficSample | null;
+}
+/** One cumulative reading of every measured peer. */
+export interface SocketPlaneCounters {
+    readonly peers: readonly SocketPeerSample[];
+    /** Connected children, INCLUDING any whose channel keeps no counters. */
+    readonly peersConnected: number;
+}
+/** `undefined` = this process has no local socket plane to report (every forked
+ *  runner, and hub-main before the registry exists). */
+export type SocketPlaneReader = () => SocketPlaneCounters | undefined;
+/** Where a reader gets its registry. Late-bound, because the heartbeat starts
+ *  before the registry exists. */
+export interface SocketPlaneSources {
+    readonly registry: () => SocketPlaneRegistry | null;
+}
+/**
+ * Build a reader over the child registry.
+ *
+ * Returns `undefined` until the registry exists — the heartbeat starts as the
+ * FIRST statement of `bootstrap()` and `LocalChildRegistry` is built hundreds
+ * of lines later. Printing zeros in that window would report a silent plane
+ * where there is no plane at all.
+ *
+ * Wrapped: a registry mid-teardown may throw, and a diagnostic that can crash
+ * the process it watches is worse than none.
+ */
+export declare function createSocketPlaneReader(sources: SocketPlaneSources): SocketPlaneReader;
+/**
+ * How many peers get named on the line.
+ *
+ * Five, matching `EVENT_PLANE_TOP_N` for the same reason: the measured
+ * distribution is not flat — one peer accounted for 78–82 % of outbound bytes
+ * and the runner-up for ~6 % — so five names the dominant peer, its challenger
+ * and enough of the tail to see the shape change. Naming all ~38 would put a
+ * kilobyte-long line in the hub's shared log every minute, which is how a log
+ * stops being read.
+ */
+export declare const SOCKET_PLANE_TOP_N = 5;
+/** One peer's traffic over the window since the previous read. */
+export interface SocketPeerDelta {
+    readonly peerId: string;
+    readonly tx: SocketDirectionSample;
+    readonly rx: SocketDirectionSample;
+}
+/** The whole plane over one heartbeat window. */
+export interface SocketPlaneWindow {
+    readonly peersConnected: number;
+    /** Peers that reported counters. Below `peersConnected` ⇒ unmeasured channels. */
+    readonly peersMeasured: number;
+    /** Summed over every measured peer. */
+    readonly tx: SocketDirectionSample;
+    readonly rx: SocketDirectionSample;
+    /** Busiest first (tx+rx messages), at most {@link SOCKET_PLANE_TOP_N}. */
+    readonly top: readonly SocketPeerDelta[];
+}
+/** Previous cumulative reading, kept between lines. */
+export interface SocketPlaneBaseline {
+    readonly peers: ReadonlyMap<string, SocketPeerSample>;
+}
+/** A process that has never read the plane. */
+export declare const EMPTY_SOCKET_PLANE_BASELINE: SocketPlaneBaseline;
+/** Subtract the previous cumulative reading from the current one. */
+export declare function diffSocketPlane(baseline: SocketPlaneBaseline, current: SocketPlaneCounters, topN?: number): SocketPlaneWindow;
+/** Reads the delta since the PREVIOUS read. Same contract as the loop meter. */
+export interface SocketPlaneMeter {
+    readonly read: () => SocketPlaneWindow | undefined;
+}
+export declare function createSocketPlaneMeter(reader: SocketPlaneReader, topN?: number): SocketPlaneMeter;
+/**
+ * The suffix appended to a `[mem]` line — leading space included, empty when
+ * this process has no local socket plane.
+ *
+ * Only the processes that OWN a child registry have one (hub-main, and an
+ * agent's main), so these fields never appear on the ~38 runner lines that
+ * share the same log stream. On the ones that do, every field is printed on
+ * every line including at zero — `socketPeers` because measured-below-connected
+ * is the only way to see an unmeasured channel, and the per-kind splits because
+ * "the plane went quiet for a minute" is a reading.
+ *
+ * `socketTop` is the one conditional field — a ranked list of nothing is noise —
+ * and it is a single comma-separated value so the field COUNT does not change
+ * from line to line.
+ */
+export declare function formatSocketPlane(window: SocketPlaneWindow | undefined): string;

package/dist/kernel/transport/frame-codec.d.ts

@@ -29,6 +29,31 @@ export declare class FrameDecoder {
     private chunks;
     /** Sum of `chunks[i].byteLength` — tracked so length checks cost nothing. */
     private buffered;
+    /** Backing store for {@link lastFrameBytes}; see that getter. */
+    private readonly sizes;
+    /**
+     * On-the-wire byte length (4-byte prefix included) of each frame returned by
+     * the most recent {@link push}, index-aligned with the returned array.
+     *
+     * It exists because the frames come back DECODED, and a decoded value has no
+     * memory of how many bytes it cost — so a caller counting received bytes per
+     * message kind (`SocketChannel`, feeding the `[mem]` line's per-peer socket
+     * attribution) could otherwise only charge a whole `data` chunk, which may
+     * hold several frames of different kinds, or half of one.
+     *
+     * **Only the first `frames.length` entries are meaningful**, and the array is
+     * never truncated. That is deliberate and it was measured on Node 24.17:
+     * `sizes.length = 0` + `push` costs **35.1–35.9 ns** per call — V8 shrinks the
+     * backing store and the next call re-grows it — which is 3 % of
+     * `FrameDecoder.push` itself and 15× the counter it feeds. Writing in place
+     * costs **0.06–0.13 ns**. On a path that runs ~22 000 times a second, an
+     * instrument may not be the most expensive thing on the line it measures.
+     *
+     * Read it immediately after the `push` that produced it — it is a window onto
+     * the decoder, not a value. Safe because `push` is only ever driven by a
+     * socket `data` event, which Node never delivers re-entrantly.
+     */
+    get lastFrameBytes(): readonly number[];
     push(chunk: Buffer): unknown[];
     /**
      * Read the frame length without consuming it. The prefix itself can land

package/dist/kernel/transport/index.d.ts

@@ -1,5 +1,7 @@
 export type { Frame, RequestHandler, EventHandler, LocalChannel, LocalTransportServer, LocalTransportClient, LocalTransportFactory, } from './local-transport.js';
 export { encodeFrame, FrameDecoder } from './frame-codec.js';
+export type { SocketDirectionCounters, SocketDirectionSample, SocketMessageKind, SocketTrafficSample, } from './socket-traffic.js';
+export { createSocketDirectionCounters, EMPTY_SOCKET_DIRECTION, recordSocketFrame, sampleSocketDirection, socketDirectionBytes, socketDirectionMessages, } from './socket-traffic.js';
 export { localEndpointPath } from './local-endpoint-path.js';
 export { SocketChannel } from './socket-channel.js';
 export { UdsLocalTransportServer, UdsLocalTransportClient } from './uds-local-transport.js';

package/dist/kernel/transport/local-child-registry.d.ts

@@ -1,6 +1,7 @@
 import { IReadinessRegistryRecord, SystemEvent } from '@camstack/types';
 import { AddonCallInput, CapCallInput, ChildLogMessage, RegisteredChild } from './child-cap-protocol.js';
 import { LocalTransportServer } from './local-transport.js';
+import { SocketTrafficSample } from './socket-traffic.js';
 /**
  * Fan-out mode for parent→child event delivery, from the
  * `CAMSTACK_UDS_EVENT_FANOUT` env (read once at registry construction):
@@ -183,6 +184,18 @@ export declare class LocalChildRegistry {
      * surface (shadow burn-in + operator debug).
      */
     getChildEventStats(childId: string): ChildEventStats | null;
+    /**
+     * This child's socket traffic — bytes and messages, both directions, split by
+     * frame kind — or `null` when the child is gone or its channel keeps no
+     * counters (an in-process or test transport).
+     *
+     * The event counters above cover ONE kind of frame and, once surfaced on
+     * 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
+     * is the same question asked of every frame the channel moves, and it is the
+     * only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
+     * pair for the whole process and has no per-socket breakdown.
+     */
+    getChildSocketTraffic(childId: string): SocketTrafficSample | null;
     /**
      * The regime the counters above were produced under, read once from
      * `CAMSTACK_UDS_EVENT_FANOUT` at construction.

package/dist/kernel/transport/local-transport.d.ts

@@ -1,3 +1,4 @@
+import { SocketTrafficSample } from './socket-traffic.js';
 /** Wire frame exchanged over a local channel. */
 export type Frame = {
     readonly k: 'req';
@@ -37,6 +38,16 @@ export interface LocalChannel {
     onEvent(handler: EventHandler): void;
     onClose(handler: () => void): void;
     close(): void;
+    /**
+     * Cumulative byte and message counters for this channel, split by frame
+     * kind, or absent when the implementation keeps none.
+     *
+     * OPTIONAL because the counters are a property of a real socket, not of the
+     * channel contract: the in-process and test transports move no bytes, and a
+     * required member would make every double invent numbers. A reader that
+     * finds it absent reports the peer as unmeasured rather than as silent.
+     */
+    readTraffic?(): SocketTrafficSample;
 }
 /** Parent side: listens and hands a channel per accepted child connection. */
 export interface LocalTransportServer {

package/dist/kernel/transport/socket-channel.d.ts

@@ -1,5 +1,6 @@
 import { Socket } from 'node:net';
 import { LocalChannel, RequestHandler, EventHandler } from './local-transport.js';
+import { SocketTrafficSample } from './socket-traffic.js';
 /**
  * Default bound on one UDS request, when the caller names none.
  *
@@ -26,6 +27,11 @@ export declare class SocketChannel implements LocalChannel {
     private closeHandler;
     private closed;
     private closeFired;
+    /** Frames written to the peer, cumulative, split by kind. See
+     *  {@link readTraffic} and `transport/socket-traffic.ts`. */
+    private readonly txCounters;
+    /** Frames read from the peer, cumulative, split by kind. */
+    private readonly rxCounters;
     constructor(socket: Socket);
     /**
      * Send a request and wait for the peer's response.
@@ -47,8 +53,25 @@ export declare class SocketChannel implements LocalChannel {
     /** Replace the close handler. Only one handler is active at a time. */
     onClose(handler: () => void): void;
     close(): void;
+    /**
+     * This channel's cumulative traffic, both directions, split by frame kind.
+     *
+     * Cumulative for the life of the channel: the reporting layer subtracts the
+     * previous reading, because the question is a RATE ("which peer receives the
+     * 22 500 writes/s") and not a total since boot.
+     */
+    readTraffic(): SocketTrafficSample;
     private send;
     private onData;
+    /**
+     * `wireBytes` is the frame's on-the-wire length, counted HERE rather than in
+     * `onData` on purpose: a peer that sends a frame this decoder can parse but
+     * whose shape is not a `Frame` throws on `frame.k`, and inside this async
+     * method that stays the rejected promise it has always been. Reading `.k`
+     * one frame earlier, synchronously in the socket's `data` handler, would
+     * turn the same malformed frame into an uncaught exception on the transport
+     * — a diagnostic that can crash the process it watches.
+     */
     private handleFrame;
     private handleClose;
 }

package/dist/kernel/transport/socket-traffic.d.ts

@@ -0,0 +1,118 @@
+/**
+ * socket-traffic — per-channel byte and message counters, split by frame kind.
+ *
+ * ## The question this exists to answer
+ *
+ * hub-main runs ~22 000 socket reads/s and ~22 500 writes/s at a **0.33 KB
+ * mean** (measured 2026-08-29 from `/proc/<pid>/io` with every regular-file
+ * descriptor's offset subtracted, so the bytes are socket bytes and not file
+ * bytes). That is ~44 000 syscalls/s on the process that mediates every
+ * cross-runner call, and **nothing could attribute a single one of them**. The
+ * event fan-out plane WAS measurable — `LocalChildRegistry` has counted
+ * `sent`/`suppressed` per child since the gate was built — and once surfaced it
+ * accounted for **4 %**. The other 96 % had no instrument at all.
+ *
+ * `/proc` cannot close this: it reports one `rchar`/`wchar` pair for the whole
+ * process, and per-socket counters do not exist there. The correlation that was
+ * available — 78–82 % of hub-main's outbound bytes moving with
+ * `hub/pipeline-analytics` — is derived from that runner's own `rchar`, which
+ * also counts page-cache file reads on a runner that owns a vector store. It is
+ * a correlation and it has never been an attribution.
+ *
+ * So the counters have to sit where the frames are: in the channel, on both
+ * sides, split by kind.
+ *
+ * ## Why split by KIND, and why these three
+ *
+ * A total answers nothing that was not already known. The three wire kinds are
+ * three different mechanisms with three different fixes:
+ *
+ *  - `req` — a cap call this process is making or serving. Scales with work.
+ *  - `res` — its answer. Where a payload can be large (a msgpack `Uint8Array`
+ *    of GOP bytes is a `res`), so this is the field the "message-RATE, not
+ *    media" conclusion is falsified against: if `res` bytes dominate at a large
+ *    mean, the traffic is media and D9/D18 must be re-opened.
+ *  - `evt` — one-way fan-out. Scales with the number of runners rather than
+ *    with anything an operator asked for; an IDLE addon still reads 82
+ *    messages/s of it.
+ *
+ * Bytes AND messages, per kind, because the mean is the whole argument: 0.33 KB
+ * across 22 000 reads/s is a rate problem, and the same bytes in 300 messages
+ * would be a media problem.
+ *
+ * ## Why these objects are MUTATED
+ *
+ * A deliberate, measured exception to the immutability default. The write
+ * happens on a path that runs ~44 000 times a second; allocating a replacement
+ * object per frame would make the instrument the largest allocator it is trying
+ * to measure. The counters are therefore plain mutable numbers, written only by
+ * {@link recordSocketFrame} and read only through {@link sampleSocketDirection},
+ * which copies. Same discipline `LocalChildRegistry` already applies to
+ * `childEventStats`.
+ *
+ * Cumulative for the life of the channel. A cumulative number on a heartbeat
+ * answers "how much since boot", which nobody asked; the reporting layer
+ * (`kernel/socket-plane-report.ts`) subtracts the previous reading and reports
+ * the window, exactly as the fan-out counters and the loop-delay histogram do.
+ */
+/** The three wire kinds of {@link import('./local-transport.js').Frame}. */
+export type SocketMessageKind = 'req' | 'res' | 'evt';
+/**
+ * One direction of one channel, cumulative. Mutable by design — see the module
+ * docblock; nothing outside {@link recordSocketFrame} may write these.
+ *
+ * `bytes` is the ON-THE-WIRE size: the 4-byte length prefix plus the MsgPack
+ * body, i.e. exactly what `socket.write` was handed and exactly what the peer's
+ * `rchar` will have counted. Anything else would not reconcile against `/proc`,
+ * and reconciling against `/proc` is the only reason to trust either number.
+ */
+export interface SocketDirectionCounters {
+    reqMessages: number;
+    reqBytes: number;
+    resMessages: number;
+    resBytes: number;
+    evtMessages: number;
+    evtBytes: number;
+}
+/** An immutable reading of {@link SocketDirectionCounters}. */
+export interface SocketDirectionSample {
+    readonly reqMessages: number;
+    readonly reqBytes: number;
+    readonly resMessages: number;
+    readonly resBytes: number;
+    readonly evtMessages: number;
+    readonly evtBytes: number;
+}
+/** Both directions of one channel. */
+export interface SocketTrafficSample {
+    /** Frames this process WROTE to the peer. */
+    readonly tx: SocketDirectionSample;
+    /** Frames this process READ from the peer. */
+    readonly rx: SocketDirectionSample;
+}
+export declare function createSocketDirectionCounters(): SocketDirectionCounters;
+/**
+ * The hot-path write. Two additions and at most two string comparisons against
+ * interned literals — no allocation, no branch on anything the caller has to
+ * compute, and nothing that can throw.
+ *
+ * Measured on Node 24.17, 20 M iterations, three runs: **2.37–2.41 ns/call**
+ * against an empty loop. Its neighbours on the same path, measured in the same
+ * run: `encodeFrame` on a 0.33 KB body 1948–1975 ns, `FrameDecoder.push`
+ * 1156–1166 ns, `process.memoryUsage()` 920–945 ns. The counter is **0.12 % of
+ * `encodeFrame`** — and `encodeFrame` is followed by a syscall.
+ *
+ * Together with the decoder's per-frame size write (0.06–0.13 ns, see
+ * `frame-codec.ts`) the whole instrument adds **~2.5 ns per frame**: at 44 000
+ * frames/s that is 107–111 µs/s, i.e. **0.011 % of one core**. An instrument
+ * that changes what it measures is not an instrument, and this one cannot.
+ */
+export declare function recordSocketFrame(counters: SocketDirectionCounters, kind: SocketMessageKind, bytes: number): void;
+/** Copy out. Called once per heartbeat line, never on the frame path. */
+export declare function sampleSocketDirection(counters: SocketDirectionCounters): SocketDirectionSample;
+/** A direction that has seen nothing. */
+export declare const EMPTY_SOCKET_DIRECTION: SocketDirectionSample;
+/** Total messages across the three kinds. */
+export declare function socketDirectionMessages(sample: SocketDirectionSample): number;
+/** Total on-the-wire bytes across the three kinds. */
+export declare function socketDirectionBytes(sample: SocketDirectionSample): number;