@camstack/system 1.2.217 → 1.2.219

package/dist/{manifest-system-deps-726RBOX7.mjs → manifest-system-deps-C7dihwWT.mjs}

@@ -5,14 +5,15 @@ import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, instal
 import { unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { isAbsolute, join } from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import * as fs from "node:fs";
 import { existsSync } from "node:fs";
+import { execFile } from "node:child_process";
 import * as os from "node:os";
 import { tmpdir } from "node:os";
+import { promisify } from "node:util";
 import { createServer } from "node:http";
 import * as v8 from "node:v8";
+import { Session } from "node:inspector/promises";
 import { monitorEventLoopDelay } from "node:perf_hooks";
 import * as vm from "node:vm";
 import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, createEventBusSliceSource, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
@@ -307,12 +308,15 @@ function createSocketPlaneReader(sources) {
 				peers.push({
 					peerId: child.childId,
 					tx: traffic.tx,
-					rx: traffic.rx
+					rx: traffic.rx,
+					queuedBytes: registry.getChildQueuedBytes(child.childId)
 				});
 			}
+			const forward = registry.readForwardCensus?.();
 			return {
 				peers,
-				peersConnected: listed.length
+				peersConnected: listed.length,
+				...forward === void 0 ? {} : { forward }
 			};
 		} catch {
 			return;
@@ -330,8 +334,41 @@ function createSocketPlaneReader(sources) {
 * stops being read.
 */
 var SOCKET_PLANE_TOP_N = 5;
+/** How many queue-holding peers get named. Three: a queue is an exception,
+*  and the line already carries five names for traffic. */
+var SOCKET_QUEUE_TOP_N = 3;
+/** The queue reading over the current counters — a level, so no baseline. */
+function readSocketQueues(current) {
+	let totalBytes = 0;
+	let unmeasured = 0;
+	const holding = [];
+	for (const peer of current.peers) {
+		if (peer.queuedBytes === null) {
+			unmeasured += 1;
+			continue;
+		}
+		totalBytes += peer.queuedBytes;
+		if (peer.queuedBytes > 0) holding.push({
+			peerId: peer.peerId,
+			bytes: peer.queuedBytes
+		});
+	}
+	return {
+		totalBytes,
+		unmeasured,
+		top: holding.toSorted((a, b) => b.bytes - a.bytes || a.peerId.localeCompare(b.peerId)).slice(0, 3)
+	};
+}
 /** A process that has never read the plane. */
 var EMPTY_SOCKET_PLANE_BASELINE = { peers: /* @__PURE__ */ new Map() };
+/** The census over the window; a counter that went backwards reads as quiet. */
+function diffForward(current, before) {
+	if (current === void 0) return void 0;
+	return {
+		raw: Math.max(0, current.raw - (before?.raw ?? 0)),
+		decoded: Math.max(0, current.decoded - (before?.decoded ?? 0))
+	};
+}
 function diffDirection(current, before) {
 	const previous = before ?? EMPTY_SOCKET_DIRECTION;
 	return {
@@ -357,6 +394,14 @@ function addDirection(into, add) {
 function peerMessages(delta) {
 	return socketDirectionMessages(delta.tx) + socketDirectionMessages(delta.rx);
 }
+/**
+* Total bytes a peer moved in the window, both directions — the OTHER
+* ranking, and the one that names a peer the message ranking structurally
+* cannot see (D454).
+*/
+function peerBytes(delta) {
+	return socketDirectionBytes(delta.tx) + socketDirectionBytes(delta.rx);
+}
 /** Subtract the previous cumulative reading from the current one. */
 function diffSocketPlane(baseline, current, topN = 5) {
 	const deltas = [];
@@ -373,12 +418,16 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		rx = addDirection(rx, delta.rx);
 		if (peerMessages(delta) > 0) deltas.push(delta);
 	}
+	const forward = diffForward(current.forward, baseline.forward);
 	return {
 		peersConnected: current.peersConnected,
 		peersMeasured: current.peers.length,
 		tx,
 		rx,
-		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN)
+		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		topBytes: deltas.toSorted((a, b) => peerBytes(b) - peerBytes(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		queued: readSocketQueues(current),
+		...forward === void 0 ? {} : { forward }
 	};
 }
 function createSocketPlaneMeter(reader, topN = 5) {
@@ -387,24 +436,43 @@ function createSocketPlaneMeter(reader, topN = 5) {
 		const current = reader();
 		if (current === void 0) return void 0;
 		const window = diffSocketPlane(baseline, current, topN);
-		baseline = { peers: new Map(current.peers.map((p) => [p.peerId, p])) };
+		baseline = {
+			peers: new Map(current.peers.map((p) => [p.peerId, p])),
+			...current.forward === void 0 ? {} : { forward: current.forward }
+		};
 		return window;
 	} };
 }
 /** Bytes → whole kB. The plane moves 180–330 MB/min; raw bytes would put
 *  nine-digit numbers on a line that has to stay readable. */
-function kb(bytes) {
+function kb$1(bytes) {
 	return Math.round(bytes / 1024);
 }
 /** `req:<msgs>/<kB>,res:<msgs>/<kB>,evt:<msgs>/<kB>` — every kind, always,
 *  including at zero: a kind that went quiet is a reading, not a blank. */
 function formatDirection(sample) {
-	return `req:${sample.reqMessages}/${kb(sample.reqBytes)}kB,res:${sample.resMessages}/${kb(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb(sample.evtBytes)}kB`;
+	return `req:${sample.reqMessages}/${kb$1(sample.reqBytes)}kB,res:${sample.resMessages}/${kb$1(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb$1(sample.evtBytes)}kB`;
 }
-/** `<peer>:tx=<req>/<res>/<evt>:rx=<req>/<res>/<evt>:kB=<tx>/<rx>` — the whole
-*  peer×kind cross for one peer, which is the question in one token. */
+/** `<req>/<res>/<evt>` in kB — the byte triple, in the same order as the
+*  message triple next to it, so the two read as one table. */
+function formatPeerBytes(sample) {
+	return `${kb$1(sample.reqBytes)}/${kb$1(sample.resBytes)}/${kb$1(sample.evtBytes)}`;
+}
+/**
+* `<peer>:tx=<req>/<res>/<evt>:rx=…:txkB=<req>/<res>/<evt>:rxkB=…` — the whole
+* peer×kind cross for one peer, messages and bytes, which is the question in
+* one token.
+*
+* The bytes were a per-direction TOTAL until D454, and the total could not
+* answer the question `socket-traffic.ts` says this instrument exists to
+* settle: whether a peer's bytes are RESPONSES (media, and D9/D18 re-opens) or
+* fan-out (`evt`, which scales with runner count and nothing an operator
+* asked for). On 2026-09-11 hub-main wrote 118 MB in one minute to
+* `hub/pipeline-analytics` and the line could only say "118 MB" — separating
+* `res` from `evt` took an hour of arithmetic against the plane-wide totals.
+*/
 function formatPeer(delta) {
-	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:kB=${kb(socketDirectionBytes(delta.tx))}/${kb(socketDirectionBytes(delta.rx))}`;
+	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:txkB=${formatPeerBytes(delta.tx)}:rxkB=${formatPeerBytes(delta.rx)}`;
 }
 /**
 * The suffix appended to a `[mem]` line — leading space included, empty when
@@ -417,14 +485,234 @@ function formatPeer(delta) {
 * is the only way to see an unmeasured channel, and the per-kind splits because
 * "the plane went quiet for a minute" is a reading.
 *
-* `socketTop` is the one conditional field — a ranked list of nothing is noise —
-* and it is a single comma-separated value so the field COUNT does not change
-* from line to line.
+* `socketTop` is a conditional field — a ranked list of nothing is noise — and
+* it is a single comma-separated value so the field COUNT does not change from
+* line to line.
+*
+* `socketTopBytes` is the other one, and its PRESENCE is the reading: it is
+* printed only when ranking by bytes names a peer that ranking by messages
+* does not. A line without it says the two rankings agree; a line with it says
+* a peer is moving few, heavy frames and names it (D454).
 */
 function formatSocketPlane(window) {
 	if (window === void 0) return "";
 	const top = window.top.map(formatPeer).join(",");
-	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`);
+	const named = new Set(window.top.map((p) => p.peerId));
+	const topBytes = window.topBytes.filter((p) => !named.has(p.peerId)).map(formatPeer).join(",");
+	const queuedTop = window.queued.top.map((p) => `${p.peerId}:${kb$1(p.bytes)}`).join(",");
+	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`);
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-queue-report.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+/** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
+function writerSocketsOf(broker) {
+	if (!isRecord$1(broker)) return void 0;
+	const transit = broker["transit"];
+	if (!isRecord$1(transit)) return void 0;
+	const transporter = transit["tx"];
+	if (!isRecord$1(transporter)) return void 0;
+	const writer = transporter["writer"];
+	if (!isRecord$1(writer)) return void 0;
+	const sockets = writer["sockets"];
+	return sockets instanceof Map ? sockets : void 0;
+}
+function readSocket(nodeId, socket) {
+	if (typeof nodeId !== "string" || !isRecord$1(socket)) return void 0;
+	const queuedBytes = socket["writableLength"];
+	const bytesWritten = socket["bytesWritten"];
+	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
+	return {
+		nodeId,
+		queuedBytes,
+		bytesWritten
+	};
+}
+/**
+* Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
+* may throw, and a diagnostic that can crash the process it watches is worse
+* than none.
+*/
+function createMeshQueueReader(getBroker) {
+	return () => {
+		try {
+			const sockets = writerSocketsOf(getBroker());
+			if (sockets === void 0) return void 0;
+			const peers = [];
+			for (const [nodeId, socket] of sockets) {
+				const peer = readSocket(nodeId, socket);
+				if (peer !== void 0) peers.push(peer);
+			}
+			return peers;
+		} catch {
+			return;
+		}
+	};
+}
+/** At most this many nodes named. A cluster has a handful. */
+var MESH_QUEUE_TOP_N = 3;
+function kb(bytes) {
+	return Math.round(bytes / 1024);
+}
+/**
+* The suffix appended to a `[mem]` line — leading space included, empty when
+* this process has no mesh writer. `meshQueued` is printed always, at zero
+* included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
+* a queue, largest first — a ranked list of zeros is noise.
+*/
+function formatMeshQueue(peers) {
+	if (peers === void 0) return "";
+	const total = peers.reduce((sum, p) => sum + p.queuedBytes, 0);
+	const top = peers.filter((p) => p.queuedBytes > 0).toSorted((a, b) => b.queuedBytes - a.queuedBytes || a.nodeId.localeCompare(b.nodeId)).slice(0, 3).map((p) => `${p.nodeId}:${kb(p.queuedBytes)}`).join(",");
+	return ` meshQueued=${kb(total)}kB` + (top.length === 0 ? "" : ` meshQueuedTop=${top}`);
+}
+//#endregion
+//#region src/kernel/outbound-queue-watch.ts
+/**
+* outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
+* release is timestamped (D446).
+*
+* ## The blind spot this closes
+*
+* On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
+* (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
+* forced compaction, with ~4 % of JS heap alongside, and each time released in
+* one instant with no line from any owner. The investigation excluded "every
+* socket write queue" by summing `writableLength` over
+* `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
+*
+* `_getActiveHandles()` lists only handles that keep the loop alive. An
+* UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
+* unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
+* `socket.unref()`). So the one outbound plane that writes to another MACHINE
+* — where a reader that stops draining is the ordinary failure — was never in
+* the sum. The UDS children were in it, but only as a total, at one instant,
+* by hand.
+*
+* ## What this is
+*
+* A pure gate over per-peer queue depths the heartbeat reads on every probe:
+* the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
+* the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
+* nothing else:
+*
+*  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
+*    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
+*    depth and how long it has held — at most once per
+*    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
+*  - a named peer whose queue then falls under half the threshold, or that
+*    vanishes from the readings (its socket died — which is how a queue is
+*    dropped in one instant), is reported as RELEASED with its peak and the
+*    hold, so the release the episodes never logged has a line and a peer;
+*  - a burst that drains inside the sustain window says nothing. Backpressure
+*    measures LIVENESS, not identity (D444): a peer momentarily behind is
+*    coming back.
+*
+* ## What it is NOT
+*
+* Not a bound. It terminates nothing: a UDS child whose channel is destroyed
+* loses every in-flight call, and a mesh socket Moleculer reconnects on its
+* own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
+* whose client is expendable. Here the line is the deliverable; what to do
+* about a peer that holds is decided with the peer named, not before.
+*/
+/** 64 MiB. Below this a queue is a burst on a busy peer (the orchestrator's
+*  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
+*  retention with a name. */
+var OUTBOUND_QUEUE_THRESHOLD_BYTES = 64 * 1024 * 1024;
+/** Matches the ArrayBuffer census sustain: a minute above the bound. */
+var OUTBOUND_QUEUE_SUSTAIN_MS = 6e4;
+/** A held queue is re-named every ten minutes, not every probe. */
+var OUTBOUND_QUEUE_COOLDOWN_MS = 10 * 6e4;
+/** A release is a fall under this fraction of the threshold. */
+var RELEASE_RATIO = .5;
+/**
+* The pure decision — threshold, sustain, cooldown, release, gone — testable
+* without a socket.
+*/
+function createOutboundQueueGate(options = {}) {
+	const thresholdBytes = options.thresholdBytes ?? 67108864;
+	const sustainMs = options.sustainMs ?? 6e4;
+	const cooldownMs = options.cooldownMs ?? 6e5;
+	const tracked = /* @__PURE__ */ new Map();
+	const judgeOne = (peerId, bytes, at) => {
+		const state = tracked.get(peerId);
+		if (bytes >= thresholdBytes) {
+			const next = state === void 0 ? {
+				aboveSince: at,
+				peakBytes: bytes,
+				lastNamedAt: null
+			} : {
+				...state,
+				peakBytes: Math.max(state.peakBytes, bytes)
+			};
+			const heldForMs = at - next.aboveSince;
+			const due = heldForMs >= sustainMs && (next.lastNamedAt === null || at - next.lastNamedAt >= cooldownMs);
+			tracked.set(peerId, due ? {
+				...next,
+				lastNamedAt: at
+			} : next);
+			return due ? {
+				kind: "sustained",
+				peerId,
+				bytes,
+				peakBytes: next.peakBytes,
+				heldForMs
+			} : void 0;
+		}
+		if (state === void 0) return void 0;
+		if (bytes >= thresholdBytes * RELEASE_RATIO) return void 0;
+		tracked.delete(peerId);
+		if (state.lastNamedAt === null) return void 0;
+		return {
+			kind: "released",
+			peerId,
+			peakBytes: state.peakBytes,
+			toBytes: bytes,
+			heldForMs: at - state.aboveSince,
+			gone: false
+		};
+	};
+	return { observe(readings, at) {
+		const verdicts = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const reading of readings) {
+			seen.add(reading.peerId);
+			const verdict = judgeOne(reading.peerId, reading.bytes, at);
+			if (verdict !== void 0) verdicts.push(verdict);
+		}
+		for (const [peerId, state] of tracked) {
+			if (seen.has(peerId)) continue;
+			tracked.delete(peerId);
+			if (state.lastNamedAt === null) continue;
+			verdicts.push({
+				kind: "released",
+				peerId,
+				peakBytes: state.peakBytes,
+				toBytes: 0,
+				heldForMs: at - state.aboveSince,
+				gone: true
+			});
+		}
+		return verdicts;
+	} };
+}
+var BYTES_PER_MB$1 = 1048576;
+function mb$2(bytes) {
+	return Math.round(bytes / BYTES_PER_MB$1);
+}
+/** `60s` under two minutes, `77m` from there — the hold is read at a glance. */
+function duration(ms) {
+	const seconds = Math.round(ms / 1e3);
+	return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)}m`;
+}
+/** The line for one verdict. Both carry the peer, the bytes and the hold;
+*  the sustained one also says why the older census could not see it. */
+function formatOutboundQueueVerdict(label, verdict) {
+	if (verdict.kind === "sustained") return `[mem] ${label} outbound queue to ${verdict.peerId} has held ${mb$2(verdict.bytes)}MB (peak ${mb$2(verdict.peakBytes)}MB) for ${duration(verdict.heldForMs)} — the peer is not draining what this process writes to it. This is socket.writableLength on the channel itself; a sum over _getActiveHandles() does not list an unref'd socket and would miss it.`;
+	return `[mem] ${label} outbound queue to ${verdict.peerId} RELEASED — ${mb$2(verdict.peakBytes)}MB at peak, ${mb$2(verdict.toBytes)}MB now, held ${duration(verdict.heldForMs)}` + (verdict.gone ? " (peer gone: the socket closed and dropped its queue)" : " (drained)");
 }
 //#endregion
 //#region src/kernel/heap-spaces.ts
@@ -511,7 +799,7 @@ var DECISIVE_HEAP_SPACES = ["old_space", "large_object_space"];
 var HEAP_SPACE_REPORT_MIN_MB = 32;
 var BYTES_PER_MB = 1048576;
 /** Whole MB, matching the rest of the `[mem]` line. */
-function mb(bytes) {
+function mb$1(bytes) {
 	return Math.round(bytes / BYTES_PER_MB);
 }
 /** Tenths of an MB — the resolution the SIGUSR2 report has always printed. */
@@ -558,7 +846,7 @@ function heapSpaceField(v8Name) {
 */
 function selectReportedSpaces(spaces, minMb = 32) {
 	const decisive = DECISIVE_HEAP_SPACES.map((name) => spaces.find((space) => space.name === name)).filter((space) => space !== void 0);
-	const rest = spaces.filter((space) => !DECISIVE_HEAP_SPACES.includes(space.name)).filter((space) => mb(space.usedBytes) >= minMb).toSorted((a, b) => b.usedBytes - a.usedBytes || a.name.localeCompare(b.name));
+	const rest = spaces.filter((space) => !DECISIVE_HEAP_SPACES.includes(space.name)).filter((space) => mb$1(space.usedBytes) >= minMb).toSorted((a, b) => b.usedBytes - a.usedBytes || a.name.localeCompare(b.name));
 	return [...decisive, ...rest];
 }
 /**
@@ -573,7 +861,7 @@ function selectReportedSpaces(spaces, minMb = 32) {
 function formatHeapSpaces(spaces, minMb = 32) {
 	const selected = selectReportedSpaces(spaces, minMb);
 	if (selected.length === 0) return "";
-	return ` ${selected.map((s) => `${heapSpaceField(s.name)}=${mb(s.usedBytes)}MB`).join(" ")}`;
+	return ` ${selected.map((s) => `${heapSpaceField(s.name)}=${mb$1(s.usedBytes)}MB`).join(" ")}`;
 }
 var defaultDeps = {
 	readMemory: () => process.memoryUsage(),
@@ -603,6 +891,251 @@ function emitHeapDiagnosticReport(request, deps = defaultDeps) {
 	}
 }
 //#endregion
+//#region src/kernel/array-buffer-census.ts
+/**
+* array-buffer-census — WHAT SHAPE the live ArrayBuffers have, taken by the
+* heartbeat itself when they grow, because nobody can be awake for it.
+*
+* ## The episodes this exists for
+*
+* hub-main, 2026-09-10 (CEST): `arrayBuffers` climbed linearly and released in
+* one instant, twice, with not one line from the process at either boundary —
+* 17:26→18:31 at ~20 MB/min to 1 264 MB, released in one heartbeat; 22:20→23:36
+* at 60–85 MB/min to **4 968 MB**, released between two probes at 23:38. Both
+* were LIVE: a forced compacting GC at 23:36:40 returned 4 968→4 954 MB. The
+* measurement that names their shape had been prepared (D443) and was never
+* run, because it needed a human to run it during the episode, and the
+* episode does not wait. Two hours after the second release the process died
+* on `Ineffective mark-compacts near heap limit`.
+*
+* ## What this is, and what it is NOT
+*
+* `Runtime.queryObjects(ArrayBuffer.prototype)` over an IN-PROCESS inspector
+* session, followed by `Runtime.callFunctionOn` computing a byteLength
+* histogram over the result array, returned BY VALUE. It walks the heap in
+* memory and returns a few hundred bytes of JSON. Nothing is serialised,
+* nothing is written, no file exists afterwards.
+*
+* It is NOT a heap snapshot. `scripts/check-no-heap-dump-command.ts` forbids
+* `writeHeapSnapshot` because a multi-GB serialisation of the heap took the
+* whole host down twice; this module contains no such call and must never
+* grow one. The two look alike only in that both need a GC first.
+*
+* ## What it costs, and why the line says so
+*
+* `queryObjects` forces ONE full garbage collection before it walks — the same
+* stop-the-world the reclaim pass already pays every 10 minutes on this
+* process (~1 s at a 2.5 GB heap). The cost is printed on the line it
+* produces, because a pause with no owner in the log is exactly the kind of
+* stall D181 warns about on the process that mediates every cross-runner call.
+* The gate ({@link createArrayBufferCensusGate}) bounds it: a threshold, held
+* for a sustain window so a burst that dies in the next scavenge never pays,
+* and a generous cooldown so an hour-long episode buys a handful of readings,
+* not one per probe.
+*
+* ## Why the byteLength histogram, and not "who holds them"
+*
+* `queryObjects` returns the objects, not their retainers; a retainer walk is
+* a heap snapshot by another name. But the SIZE distribution already
+* discriminates the candidates that were argued about for a night: 65 536-byte
+* buffers are socket chunks, 8 192-byte ones are Buffer-pool slabs, a few
+* hundred equal multi-megabyte ones are frames or JPEGs, and the count says
+* whether it is thousands of small or dozens of huge. The exact top sizes are
+* printed as well as power-of-two buckets, because "1 462 272 B × 880" names
+* a producer where "≤2 MB: 1.2 GB" does not.
+*/
+/**
+* Take the census once `arrayBuffers` has been at or above this for
+* {@link ARRAY_BUFFER_CENSUS_SUSTAIN_MS}.
+*
+* 512 MB. The two 2026-09-10 episodes crossed it 25 and 8 minutes in; the
+* routine reading in six hours of 2-second samples around them was 18–100 MB
+* with single-sample spikes to 479 MB, and the process's floor after every
+* compaction is 12–18 MB. A dead-buffer sawtooth between major GCs (measured
+* up to 3.65 GB on 2026-08-08 when the heap had 4 GB of headroom) cannot reach
+* it while GC runs every few seconds — and if one did, the census would SAY
+* so: it reports the live total after its own GC next to the raw reading.
+*/
+var ARRAY_BUFFER_CENSUS_THRESHOLD_MB = 512;
+/**
+* How long the reading must stay above the threshold before a census is taken.
+*
+* 60 s = 30 probes at the 2 s cadence. A burst that a scavenge or the next
+* major GC returns never pays a forced GC; an episode climbing at the slowest
+* rate measured (20 MB/min) is still 20 MB higher by the time it is measured,
+* which is nothing against the threshold.
+*/
+var ARRAY_BUFFER_CENSUS_SUSTAIN_MS = 6e4;
+/**
+* Minimum spacing between two censuses.
+*
+* 30 minutes: the second episode ran 76 minutes, so it would have produced
+* three readings — enough to see the shape change (or not) as it grew — at a
+* cost the router already pays six times an hour for the reclaim pass.
+*/
+var ARRAY_BUFFER_CENSUS_COOLDOWN_MS = 30 * 6e4;
+/**
+* A drop of at least this share of the threshold between two consecutive
+* probes, from a reading that had been SUSTAINED above the threshold, is a
+* RELEASE — the boundary both episodes crossed with no line, and the one line
+* that lets the release be correlated with whatever else the process logged
+* that second. Sustained, not merely above: a one-probe spike that the next
+* scavenge sweeps (a 1.3 GB burst in 11 s was measured on 2026-08-29) is not
+* an episode ending, and a WARN for every one of those would bury the line
+* this exists to produce.
+*/
+var ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO = .5;
+/**
+* The pure decision: threshold, sustain, cooldown, release — testable without
+* allocating a gigabyte or forcing a GC.
+*/
+function createArrayBufferCensusGate(options = {}) {
+	const thresholdMb = options.thresholdMb ?? 512;
+	const sustainMs = options.sustainMs ?? 6e4;
+	const cooldownMs = options.cooldownMs ?? 18e5;
+	let aboveSince = null;
+	let lastTakenAt = Number.NEGATIVE_INFINITY;
+	let previousMb = null;
+	let previousAt = null;
+	return { observe(arrayBuffersMb, at) {
+		const previous = previousMb;
+		const previousHeldForMs = previous !== null && previousAt !== null && aboveSince !== null ? previousAt - aboveSince : null;
+		previousMb = arrayBuffersMb;
+		previousAt = at;
+		if (previous !== null && previousHeldForMs !== null && previousHeldForMs >= sustainMs && previous - arrayBuffersMb >= thresholdMb * .5) {
+			aboveSince = null;
+			return {
+				kind: "released",
+				fromMb: previous,
+				toMb: arrayBuffersMb
+			};
+		}
+		if (arrayBuffersMb < thresholdMb) {
+			aboveSince = null;
+			return { kind: "hold" };
+		}
+		aboveSince ??= at;
+		const heldForMs = at - aboveSince;
+		if (heldForMs < sustainMs) return { kind: "hold" };
+		if (at - lastTakenAt < cooldownMs) return { kind: "hold" };
+		lastTakenAt = at;
+		return {
+			kind: "take",
+			reason: `arrayBuffers=${arrayBuffersMb}MB has been >=${thresholdMb}MB for ${heldForMs}ms`
+		};
+	} };
+}
+/**
+* The function evaluated INSIDE the inspector against the `queryObjects`
+* result array (`this`). Kept as source text because that is what the
+* protocol takes; kept small because it runs with the world stopped.
+*/
+var HISTOGRAM_FN = `function () {
+  var byBucket = new Map(), bySize = new Map()
+  var count = 0, bytes = 0, detached = 0
+  for (var i = 0; i < this.length; i++) {
+    var b = this[i].byteLength
+    count++
+    bytes += b
+    if (b === 0) { detached++; continue }
+    var bucket = 1
+    while (bucket < b) bucket *= 2
+    var e = byBucket.get(bucket); if (!e) { e = [0, 0]; byBucket.set(bucket, e) }
+    e[0]++; e[1] += b
+    var s = bySize.get(b); if (!s) { s = [0, 0]; bySize.set(b, s) }
+    s[0]++; s[1] += b
+  }
+  var buckets = []
+  byBucket.forEach(function (v, k) { buckets.push({ upToBytes: k, count: v[0], bytes: v[1] }) })
+  buckets.sort(function (a, b) { return b.bytes - a.bytes })
+  var topSizes = []
+  bySize.forEach(function (v, k) { topSizes.push({ byteLength: k, count: v[0], bytes: v[1] }) })
+  topSizes.sort(function (a, b) { return b.bytes - a.bytes })
+  return { count: count, bytes: bytes, detached: detached,
+    buckets: buckets.slice(0, 6), topSizes: topSizes.slice(0, 5) }
+}`;
+function isFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value);
+}
+function isBucket(value) {
+	return typeof value === "object" && value !== null && isFiniteNumber(Reflect.get(value, "upToBytes")) && isFiniteNumber(Reflect.get(value, "count")) && isFiniteNumber(Reflect.get(value, "bytes"));
+}
+function isExactSize(value) {
+	return typeof value === "object" && value !== null && isFiniteNumber(Reflect.get(value, "byteLength")) && isFiniteNumber(Reflect.get(value, "count")) && isFiniteNumber(Reflect.get(value, "bytes"));
+}
+/** The inspector answers `unknown`; the report is trusted only once it has this shape. */
+function isArrayBufferCensusReport(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const buckets = Reflect.get(value, "buckets");
+	const topSizes = Reflect.get(value, "topSizes");
+	return isFiniteNumber(Reflect.get(value, "count")) && isFiniteNumber(Reflect.get(value, "bytes")) && isFiniteNumber(Reflect.get(value, "detached")) && Array.isArray(buckets) && buckets.every(isBucket) && Array.isArray(topSizes) && topSizes.every(isExactSize);
+}
+function readObjectId(result, path) {
+	let cursor = result;
+	for (const key of path) {
+		if (typeof cursor !== "object" || cursor === null) throw new Error(`inspector reply has no ${path.join(".")}`);
+		cursor = Reflect.get(cursor, key);
+	}
+	if (typeof cursor !== "string") throw new Error(`inspector reply has no ${path.join(".")}`);
+	return cursor;
+}
+/**
+* The real census: an in-process inspector session, opened for the call and
+* closed after it, so no session is left listening between censuses.
+*
+* Every remote object it creates is released before the session closes; a
+* failure anywhere still disconnects. The session is in-process — nothing
+* listens on a port, nothing outside this process can reach it.
+*/
+function createInspectorArrayBufferCensus() {
+	return async () => {
+		const session = new Session();
+		session.connect();
+		try {
+			const prototypeObjectId = readObjectId(await session.post("Runtime.evaluate", { expression: "ArrayBuffer.prototype" }), ["result", "objectId"]);
+			try {
+				const objectId = readObjectId(await session.post("Runtime.queryObjects", { prototypeObjectId }), ["objects", "objectId"]);
+				try {
+					const evaluated = await session.post("Runtime.callFunctionOn", {
+						objectId,
+						functionDeclaration: HISTOGRAM_FN,
+						returnByValue: true
+					});
+					const value = typeof evaluated === "object" && evaluated !== null ? Reflect.get(Reflect.get(evaluated, "result") ?? {}, "value") : void 0;
+					if (!isArrayBufferCensusReport(value)) throw new Error("inspector returned a histogram of an unexpected shape");
+					return value;
+				} finally {
+					await session.post("Runtime.releaseObject", { objectId });
+				}
+			} finally {
+				await session.post("Runtime.releaseObject", { objectId: prototypeObjectId });
+			}
+		} finally {
+			session.disconnect();
+		}
+	};
+}
+var MB$1 = 1048576;
+function mb(bytes) {
+	return Math.round(bytes / MB$1);
+}
+function formatBucket(bucket) {
+	return `<=${bucket.upToBytes >= MB$1 ? `${Math.round(bucket.upToBytes / MB$1)}MB` : bucket.upToBytes >= 1024 ? `${Math.round(bucket.upToBytes / 1024)}KB` : `${bucket.upToBytes}B`}:${bucket.count}x/${mb(bucket.bytes)}MB`;
+}
+function formatExact(size) {
+	return `${size.byteLength}Bx${size.count}=${mb(size.bytes)}MB`;
+}
+/**
+* The census line. `live` is what survived the census's own GC; `raw` is the
+* reading that triggered it — when they disagree by a lot, the growth was dead
+* buffers awaiting a sweep, not a retention, and the line says which.
+*/
+function formatArrayBufferCensus(label, report, context) {
+	const live = mb(report.bytes);
+	const verdict = live < context.rawMb * .5 ? "mostly DEAD buffers awaiting a sweep, not a retention" : "LIVE — something holds them";
+	return `[mem] ${label} arrayBuffer census: live=${live}MB in ${report.count} ArrayBuffers (raw arrayBuffers=${context.rawMb}MB at the trigger → ${verdict}) top sizes: ${report.topSizes.map(formatExact).join(", ") || "(none)"}; buckets: ${report.buckets.map(formatBucket).join(", ") || "(none)"}; detached=${report.detached} took=${context.tookMs}ms — cost: ONE forced full GC (the same pause as a reclaim pass), walked in memory, nothing serialised, nothing written; trigger: ${context.reason}`;
+}
+//#endregion
 //#region src/kernel/heap-watch.ts
 /**
 * heap-watch — hub-main's own memory, on the record, and returned to the OS.
@@ -1167,6 +1700,27 @@ function format(label, s, loop, budgetMb, suffix) {
 	return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms${suffix}`;
 }
 /**
+* Every outbound queue the heartbeat can reach, as the gate wants them: the
+* UDS children (only those whose channel keeps a reading — an unmeasured
+* peer is not a zero) and the mesh writer sockets, each prefixed with its
+* plane.
+*/
+function outboundQueueReadings(uds, mesh) {
+	const readings = [];
+	for (const peer of uds?.peers ?? []) {
+		if (peer.queuedBytes === null) continue;
+		readings.push({
+			peerId: `uds:${peer.peerId}`,
+			bytes: peer.queuedBytes
+		});
+	}
+	for (const node of mesh ?? []) readings.push({
+		peerId: `mesh:${node.nodeId}`,
+		bytes: node.queuedBytes
+	});
+	return readings;
+}
+/**
 * Start the heartbeat. Returns a stop function.
 *
 * `unref`ed so it can never hold the process open, and every read is wrapped:
@@ -1280,7 +1834,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()));
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -1288,8 +1842,44 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine — logging every ${intervalMs}ms`);
 			checkRssBudget(sample, at);
 			maybeReclaim(sample);
+			judgeArrayBuffers(sample, at);
+			judgeOutboundQueues(at);
 		} catch {}
 	};
+	const meshQueue = probes?.meshQueue;
+	const queueReader = probes?.socketPlane;
+	const queueGate = queueReader === void 0 && meshQueue === void 0 ? void 0 : createOutboundQueueGate(probes?.outboundQueue);
+	const judgeOutboundQueues = (at) => {
+		if (queueGate === void 0) return;
+		const readings = outboundQueueReadings(queueReader?.(), meshQueue?.());
+		for (const verdict of queueGate.observe(readings, at)) sink.warn(formatOutboundQueueVerdict(label, verdict));
+	};
+	const censusProbe = probes?.arrayBufferCensus;
+	const censusGate = censusProbe === void 0 ? void 0 : createArrayBufferCensusGate(censusProbe);
+	let censusInFlight = false;
+	const judgeArrayBuffers = (sample, at) => {
+		if (censusProbe === void 0 || censusGate === void 0) return;
+		const verdict = censusGate.observe(sample.arrayBuffersMb, at);
+		if (verdict.kind === "released") {
+			sink.warn(`[mem] ${label} arrayBuffers RELEASED ${verdict.fromMb}MB→${verdict.toMb}MB between two probes ${probeIntervalMs}ms apart — no owner logged this release; whatever held them let go in one instant (a socket that died, a queue that drained, a map that was cleared). Correlate with every line of this process in that window.`);
+			return;
+		}
+		if (verdict.kind !== "take" || censusInFlight) return;
+		censusInFlight = true;
+		const startedAt = now();
+		const rawMb = sample.arrayBuffersMb;
+		censusProbe.census().then((report) => {
+			sink.warn(formatArrayBufferCensus(label, report, {
+				rawMb,
+				tookMs: now() - startedAt,
+				reason: verdict.reason
+			}));
+		}).catch((error) => {
+			sink.warn(`[mem] ${label} arrayBuffer census FAILED after ${now() - startedAt}ms (trigger: ${verdict.reason}) — ${error instanceof Error ? error.message : String(error)}`);
+		}).finally(() => {
+			censusInFlight = false;
+		});
+	};
 	const timer = setInterval(tick, probeIntervalMs);
 	timer.unref?.();
 	tick();
@@ -5060,6 +5650,74 @@ function encodeFrame(value) {
 	Buffer.from(body.buffer, body.byteOffset, body.byteLength).copy(out, 4);
 	return out;
 }
+/** msgpack `fixstr` of {@link PAYLOAD_KEY}: `0xa0 | length`, then the bytes. */
+var PAYLOAD_KEY_BYTES = Buffer.from([162, ...Buffer.from("pl")]);
+/** msgpack `bin 32` marker: one byte, then a 4-byte big-endian length. */
+var BIN32_MARKER = 198;
+/** msgpack `fixmap` range: `0x80 | count`, count in `0..15`. */
+var FIXMAP_BASE = 128;
+var FIXMAP_MAX_COUNT = 15;
+/**
+* Encode the HEAD of a frame that carries an opaque payload: the length
+* prefix, the msgpack envelope with one extra key ({@link PAYLOAD_KEY}), and
+* the `bin 32` header for the payload — everything but the payload bytes
+* themselves, which the caller writes straight after it.
+*
+* ## Why the payload is the frame's TAIL and not a field
+*
+* hub-main routes every sibling↔sibling call. Until this existed it decoded
+* the whole request (args included), built a new message, and re-encoded it
+* — walking a 13.5 KB PCM chunk or a 2 000-row settings answer twice on the
+* one thread that serves every tRPC request, and allocating an `Encoder`
+* buffer that doubles from 2 KiB up to the body's size on every write
+* (D441: ~27 % of hub-main's busy time in msgpack decode, ~6 % in encode,
+* and the churn that fed a 29.5 % GC share).
+*
+* With the payload appended as the LAST key of the map, the receiver's
+* ordinary msgpack decode yields it as a zero-copy VIEW of the frame
+* (`@msgpack/msgpack` decodes `bin` as `subarray`), the router reads only the
+* envelope, and forwarding is: encode a ~60-byte head, write it, write the
+* view. The wire stays plain msgpack — a peer that never heard of payloads
+* decodes `{ …frame, pl: <bytes> }` and can be told, at register, not to be
+* sent one.
+*
+* ## The one hand-written msgpack in this repository
+*
+* `@msgpack/msgpack` has no "encode a map, then append a key" API, so the
+* envelope is encoded normally and its `fixmap` count byte is bumped by one
+* before the key and the `bin 32` header are appended. That patch is only
+* valid for a `fixmap` (≤ 15 keys); a `Frame` has at most four, and anything
+* else is refused rather than silently corrupted.
+*/
+function encodeFrameHead(frame, payload) {
+	const envelope = encode(frame, ENCODE_OPTIONS);
+	const first = envelope[0];
+	if (envelope.byteLength === 0 || first === void 0 || first < FIXMAP_BASE || first > 142) throw new Error(`encodeFrameHead: envelope must be a msgpack fixmap with at most ${FIXMAP_MAX_COUNT - 1} keys (got leading byte 0x${(first ?? 0).toString(16)})`);
+	const bodyLength = envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5 + payload.byteLength;
+	const head = Buffer.allocUnsafe(HEADER_BYTES + envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5);
+	head.writeUInt32BE(bodyLength, 0);
+	Buffer.from(envelope.buffer, envelope.byteOffset, envelope.byteLength).copy(head, HEADER_BYTES);
+	head[HEADER_BYTES] = first + 1;
+	let at = HEADER_BYTES + envelope.byteLength;
+	PAYLOAD_KEY_BYTES.copy(head, at);
+	at += PAYLOAD_KEY_BYTES.byteLength;
+	head[at] = BIN32_MARKER;
+	head.writeUInt32BE(payload.byteLength, at + 1);
+	return head;
+}
+/**
+* Serialise a value into the bytes a payload carries. The SAME options as the
+* envelope codec, so `undefined` properties are omitted rather than turned
+* into `null` — a `z.void()` cap output must read back as `undefined` on the
+* far side exactly as it did when it travelled inline.
+*/
+function packPayload(value) {
+	return encode(value, ENCODE_OPTIONS);
+}
+/** Inverse of {@link packPayload}. A `bin` inside decodes as a view of `bytes`. */
+function unpackPayload(bytes) {
+	return decode(bytes);
+}
 /** Bytes in the big-endian length prefix that opens every frame. */
 var HEADER_BYTES = 4;
 /**
@@ -5218,6 +5876,25 @@ function localEndpointPath(nodeId) {
 	if (process.platform === "win32") return `\\\\.\\pipe\\camstack-${safe}`;
 	return join(tmpdir(), `camstack-${safe}.sock`);
 }
+//#endregion
+//#region src/kernel/transport/local-transport.ts
+/**
+* An answer that carries an opaque payload beside its body.
+*
+* A CLASS rather than a shape so the channel can tell it from a provider's
+* ordinary `{ body, payload }` return value by identity, never by duck-typing:
+* a cap method is free to return an object with those two keys and it must
+* travel inline like any other. `request()` resolves with one of these only
+* when the peer's `res` frame carried a payload.
+*/
+var PayloadReply = class {
+	body;
+	payload;
+	constructor(body, payload) {
+		this.body = body;
+		this.payload = payload;
+	}
+};
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -5274,7 +5951,7 @@ var SocketChannel = class {
 				k: "req",
 				id,
 				body
-			});
+			}, opts?.payload);
 		});
 	}
 	emit(body) {
@@ -5314,11 +5991,38 @@ var SocketChannel = class {
 			rx: sampleSocketDirection(this.rxCounters)
 		};
 	}
-	send(frame) {
+	/**
+	* Bytes handed to the socket that the kernel has not taken yet — the
+	* `Writable` buffer plus the write in flight. Read LIVE, never cached: this
+	* is the number that says whether the peer is draining what we write, and
+	* it is read on every heartbeat probe (D446). An unref'd socket keeps it
+	* exactly like a ref'd one, which is why it is read here and not summed
+	* over `_getActiveHandles()`.
+	*/
+	queuedBytes() {
+		return this.socket.writableLength;
+	}
+	/**
+	* Write one frame. With a payload the head and the tail are two `write`
+	* calls under `cork()` — the kernel sees one `writev`, and the payload bytes
+	* are never copied into the head. A forwarded payload is a view into the
+	* frame it arrived on, and that frame's buffer is never mutated, so handing
+	* the view to the socket is safe.
+	*/
+	send(frame, payload) {
 		if (this.closed) return;
-		const encoded = encodeFrame(frame);
-		recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
-		this.socket.write(encoded);
+		if (payload === void 0) {
+			const encoded = encodeFrame(frame);
+			recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
+			this.socket.write(encoded);
+			return;
+		}
+		const head = encodeFrameHead(frame, payload);
+		recordSocketFrame(this.txCounters, frame.k, head.byteLength + payload.byteLength);
+		this.socket.cork();
+		this.socket.write(head);
+		this.socket.write(payload);
+		this.socket.uncork();
 	}
 	onData(chunk) {
 		const frames = this.decoder.push(chunk);
@@ -5338,8 +6042,14 @@ var SocketChannel = class {
 		recordSocketFrame(this.rxCounters, frame.k, wireBytes);
 		if (frame.k === "req") {
 			try {
-				const result = await this.requestHandler(frame.body);
-				this.send({
+				const result = await this.requestHandler(frame.body, frame.pl);
+				if (result instanceof PayloadReply) this.send({
+					k: "res",
+					id: frame.id,
+					ok: true,
+					body: result.body
+				}, result.payload);
+				else this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
@@ -5360,8 +6070,9 @@ var SocketChannel = class {
 			if (!p) return;
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
-			if (frame.ok) p.resolve(frame.body);
-			else p.reject(new Error(frame.err));
+			if (!frame.ok) p.reject(new Error(frame.err));
+			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
+			else p.resolve(frame.body);
 			return;
 		}
 		this.eventHandler(frame.body);
@@ -5912,688 +6623,278 @@ function deliverShared(state, event) {
 	}
 }
 //#endregion
-//#region src/kernel/moleculer/resilient-cap-call.ts
-/** Moleculer error `type` values meaning "the service is not (yet) routable". */
-var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-/** Default ceiling for the discovery wait — fail-fast past this. */
-var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
-function isDiscoveryError(err) {
-	if (typeof err !== "object" || err === null) return false;
-	const type = err.type;
-	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
-}
-/**
-* Call a Moleculer action; on a service-discovery error, wait for the
-* named service to be discovered and retry the call exactly once.
-*/
-async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
-	try {
-		return await broker.call(action, params, opts);
-	} catch (err) {
-		if (!isDiscoveryError(err)) throw err;
-		await broker.waitForServices([serviceName], discoveryTimeoutMs);
-		return await broker.call(action, params, opts);
-	}
+//#region src/kernel/transport/cap-routing-hints.ts
+/** Lift {@link CapRoutingHints} from a call's args. Never throws. */
+function liftRoutingHints(args) {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return {};
+	const nodeId = Reflect.get(args, "nodeId");
+	const addonId = Reflect.get(args, "addonId");
+	return {
+		...typeof nodeId === "string" && nodeId.length > 0 ? { nodeId } : {},
+		...typeof addonId === "string" && addonId.length > 0 ? { addonId } : {}
+	};
 }
 //#endregion
-//#region src/kernel/transport/cap-route.ts
-function buildMessage(capName, method, detail) {
-	const call = method !== void 0 ? `${capName}.${method}` : capName;
-	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
-	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
-	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
-	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+//#region src/kernel/transport/local-child-registry.ts
+function readFanoutMode() {
+	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
+	if (raw === "shadow" || raw === "broadcast") return raw;
+	return "filter";
 }
-var CapRouteError = class extends Error {
-	reason;
-	nodeId;
-	rejected;
+/**
+* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
+* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
+* prefix to distinguish routing failures (safe to retry via broker) from real
+* provider errors (must NOT retry to avoid double-executing side effects).
+*/
+var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+/**
+* Parent-side authority for local addon-runners reachable over a
+* `LocalTransportServer` (UDS). Children register their cap manifest on
+* connect; the registry routes `(capName, deviceId?)` cap calls to the
+* owning child over the channel and drops a child's caps on disconnect.
+*/
+var LocalChildRegistry = class {
+	children = /* @__PURE__ */ new Map();
+	registeredHandler = () => {};
+	goneHandler = () => {};
+	/** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
+	nextIncarnation = 1;
+	eventHandler = null;
+	logHandler = null;
+	readinessHandler = null;
+	server;
+	onUnownedCall;
+	logger;
+	getActiveSingletonAddonId;
+	resolveChildIdForAddon;
+	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
+	ownNodeId;
+	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
+	isAggregatedCollectionMethod;
+	isAddonPinnedCall;
+	/** See {@link ForwardCensus}. Mutable counters on the hot path, by design. */
+	forwardedRaw = 0;
+	forwardedDecoded = 0;
+	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
+	capTimeoutMs;
+	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+	capUsageObserver;
+	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
+	egressRoutedCaps = /* @__PURE__ */ new Set();
+	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
+	fanoutMode = readFanoutMode();
+	/** Per-child event fan-out counters (sent / suppressed). */
+	childEventStats = /* @__PURE__ */ new Map();
+	/** Last pattern-set string logged per child, to dedup the INFO line. */
+	loggedPatternSet = /* @__PURE__ */ new Map();
 	/**
-	* @param cause  Optional original error that triggered this routing failure.
-	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
-	*               Dispatchers wrapping transport errors MUST pass the original.
+	* Accepts either a plain positional `server` argument (backward-compatible)
+	* or a full `LocalChildRegistryOptions` object.
+	*
+	* Positional overloads (existing call sites are unchanged):
+	*   new LocalChildRegistry(server)
+	*   new LocalChildRegistry(server, onUnownedCall)
+	*
+	* Options object (new call sites that pass a logger):
+	*   new LocalChildRegistry({ server, onUnownedCall, logger })
 	*/
-	constructor(capName, method, detail, cause) {
-		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
-		this.name = "CapRouteError";
-		this.reason = detail.reason;
-		this.nodeId = detail.nodeId;
-		this.rejected = detail.rejected;
+	constructor(serverOrOptions, onUnownedCallArg) {
+		if (serverOrOptions && !("listen" in serverOrOptions)) {
+			const opts = serverOrOptions;
+			this.server = opts.server;
+			this.onUnownedCall = opts.onUnownedCall;
+			this.logger = opts.logger;
+			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
+			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
+			this.ownNodeId = opts.ownNodeId;
+			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.isAddonPinnedCall = opts.isAddonPinnedCall;
+			this.capTimeoutMs = opts.capTimeoutMs;
+			this.capUsageObserver = opts.capUsageObserver;
+		} else {
+			this.server = serverOrOptions;
+			this.onUnownedCall = onUnownedCallArg;
+		}
 	}
-};
-/**
-* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
-*
-* Precedence (explicit nodeId path):
-*   1. hub-in-process — hub node + hubInProcessProvides
-*   2. hub-local-uds  — hub node + hubLocalChildProvides
-*   3. node-offline   → CapRouteError{reason:'node-offline'}
-*   4. agent-child-forward — node is an agent AND nodeKnowsCap
-*   5. remote-moleculer — any other online non-agent node
-*
-* Singleton path (no nodeId):
-*   1. hub-in-process (hub provides in-process)
-*   2. hub-local-uds  (a hub-local UDS child provides it)
-*   3. remote-moleculer (any online, non-hub node that knows it)
-*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
-*
-* PURE: no side effects, no async, no broker/registry imports.
-*/
-function classifyCapRoute(capName, opts, snapshot) {
-	const rejected = [];
-	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
-	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
-}
-function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
-	if (nodeId === snap.hubNodeId) {
-		const residentProvides = snap.hubResidentProvides;
-		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
-		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
-		if (providesOnHub(capName)) {
-			const ref = getRef?.(capName) ?? null;
-			if (ref !== null) return {
-				kind: "hub-in-process",
-				capName,
-				ref
-			};
-			rejected.push({
-				kind: "hub-in-process",
-				why: "provider ref not available in snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		if (snap.hubLocalChildProvides(capName, deviceId)) {
-			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-			if (childId !== null) return {
-				kind: "hub-local-uds",
-				capName,
-				childId
-			};
-			rejected.push({
-				kind: "hub-local-uds",
-				why: "child id not resolvable from snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		rejected.push({
-			kind: "hub-in-process",
-			why: "hub does not provide this cap in-process"
-		});
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "no hub-local child provides this cap"
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
-	}
-	if (!snap.nodeOnline(nodeId)) {
-		rejected.push({
-			kind: "remote-moleculer",
-			why: `node ${nodeId} is offline`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "node-offline",
-			nodeId,
-			rejected
-		});
+	async start() {
+		this.logger?.info("UDS event fan-out mode", { mode: this.fanoutMode });
+		this.server.onConnection((channel) => this.onConnection(channel));
+		await this.server.listen();
 	}
-	if (snap.nodeIsAgent(nodeId)) {
-		if (snap.nodeKnowsCap(nodeId, capName)) return {
-			kind: "agent-child-forward",
-			capName,
-			agentNodeId: nodeId,
-			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+	/**
+	* Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
+	* child has no recorded events yet. Exposed for the starvation-verification
+	* surface (shadow burn-in + operator debug).
+	*/
+	getChildEventStats(childId) {
+		const s = this.childEventStats.get(childId);
+		return s === void 0 ? null : {
+			sent: s.sent,
+			suppressed: s.suppressed
 		};
-		rejected.push({
-			kind: "agent-child-forward",
-			why: `agent ${nodeId} does not know cap ${capName}`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
 	}
-	return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-}
-function classifySingleton(capName, deviceId, snap, rejected) {
-	if (snap.hubInProcessProvides(capName)) {
-		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-		if (ref !== null) return {
-			kind: "hub-in-process",
-			capName,
-			ref
-		};
-		rejected.push({
-			kind: "hub-in-process",
-			why: "provider ref not available in snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-in-process",
-		why: "hub does not provide this cap in-process"
-	});
-	if (snap.hubLocalChildProvides(capName, deviceId)) {
-		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId !== null) return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "child id not resolvable from snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-local-uds",
-		why: "no hub-local child provides this cap"
-	});
-	const knownNodes = snap.listKnownNodeIds?.() ?? [];
-	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-	rejected.push({
-		kind: "remote-moleculer",
-		why: "no online remote node knows this cap"
-	});
-	throw new CapRouteError(capName, void 0, {
-		reason: "no-provider",
-		rejected
-	});
-}
-//#endregion
-//#region src/kernel/transport/cap-route-resolver.ts
-/** The Moleculer service name that Task 6's agent registers. */
-var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
-/** The Moleculer action (service.action) for agent cap forwarding. */
-var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
-/** Default timeout for remote Moleculer cap calls (ms). */
-var REMOTE_CALL_TIMEOUT_MS = 6e4;
-function extractDeviceId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "deviceId");
-	return typeof raw === "number" ? raw : void 0;
-}
-/**
-* Extract an inline `nodeId` string from a cap call's args — the per-call node
-* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
-* device-scoped caps carry `deviceId`, and the way the generated cap-router on
-* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
-*
-* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
-* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
-* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
-* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
-* methods that don't declare `nodeId` simply ignore the extra field (they
-* destructure the fields they need); methods that DO declare it (e.g.
-* `getEngineProvisioning({nodeId})`) still receive it unchanged.
-*/
-function extractNodeId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "nodeId");
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
-/**
-* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
-* destructures what it needs and ignores the rest" convention
-* {@link extractNodeId} already relies on for the inline `nodeId` pin.
-* `undefined` (the overwhelmingly common case: no caller hint, or the census
-* consuming it is disarmed) returns `args` unchanged — no allocation. A
-* non-object `args` (or `null`/array) is returned unchanged too: there is
-* nowhere to attach an extra key without changing the payload's shape, and a
-* provider taking a bare value never reads `callerAddonId` off it anyway.
-*/
-function withCallerAddonId(args, callerAddonId) {
-	if (callerAddonId === void 0) return args;
-	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
-	return {
-		...args,
-		callerAddonId
-	};
-}
-var CapRouteResolver = class {
-	hubNodeId;
-	broker;
-	hubLocalRegistry;
-	nodeAuthority;
-	inProcessProviders;
-	hubResidentProviders;
-	capTimeoutMs;
-	snapshot;
-	constructor(deps) {
-		this.hubNodeId = deps.hubNodeId;
-		this.broker = deps.broker;
-		this.hubLocalRegistry = deps.hubLocalRegistry;
-		this.nodeAuthority = deps.nodeAuthority;
-		this.inProcessProviders = deps.inProcessProviders;
-		this.hubResidentProviders = deps.hubResidentProviders;
-		this.capTimeoutMs = deps.capTimeoutMs;
-		this.snapshot = this.buildSnapshot();
+	/**
+	* This child's socket traffic — bytes and messages, both directions, split by
+	* frame kind — or `null` when the child is gone or its channel keeps no
+	* counters (an in-process or test transport).
+	*
+	* The event counters above cover ONE kind of frame and, once surfaced on
+	* 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
+	* is the same question asked of every frame the channel moves, and it is the
+	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
+	* pair for the whole process and has no per-socket breakdown.
+	*/
+	getChildSocketTraffic(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.readTraffic?.() ?? null;
 	}
-	/** Per-call RPC timeout: the cap method's declared override, else the default. */
-	callTimeout(capName, method) {
-		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
+	/**
+	* Bytes this process has written to a child that the child has not yet
+	* taken, live, or `null` when the channel keeps no such reading. Read on
+	* every heartbeat probe (D446) — a child that stops draining is the shape
+	* of an outbound-queue episode, and the number lives on the channel.
+	*/
+	getChildQueuedBytes(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.queuedBytes?.() ?? null;
 	}
-	resolveCapRoute(capName, opts) {
-		return classifyCapRoute(capName, opts, this.snapshot);
+	/** Cumulative {@link ForwardCensus} of this parent's `cap-call-out` routing. */
+	readForwardCensus() {
+		return {
+			raw: this.forwardedRaw,
+			decoded: this.forwardedDecoded
+		};
 	}
 	/**
-	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
-	* child, IGNORING any in-hub provider registered for the same cap name.
+	* The regime the counters above were produced under, read once from
+	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
 	*
-	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
-	* provider (e.g. a wrapper) is registered for the cap, the route always
-	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
-	* reached. That is correct for the generic dispatch path (the wrapper is the
-	* active provider), but WRONG for the native-cap fallback
-	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
-	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
-	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
-	* itself, the native is never invoked, and the wrapper silently falls
-	* through to its secondary strategy.
+	* A suppressed count means "nothing WAS dropped" under `filter` and "nothing
+	* WOULD have been dropped" under `shadow`. Those are different claims, and
+	* until this getter existed the mode was invisible at runtime — the counters
+	* were readable and the regime that produced them was not.
+	*/
+	get eventFanoutMode() {
+		return this.fanoutMode;
+	}
+	/**
+	* Connected children that never declared a subscription pattern set.
 	*
-	* This method consults ONLY the hub-local-child authority
-	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
-	* it returns the native child route regardless of any in-process shadow.
-	* Returns null when no hub-local child owns `(capName, deviceId)` — the
-	* caller then falls through to its remote-resolution branch.
+	* Each one is a fail-open on BOTH planes: `childWantsEvent` returns true for
+	* an undeclared child ({@link ChildEntry.eventPatterns} `=== null`), and
+	* `aggregateEventInterest` returns `null` — accept everything — if ANY
+	* connected child is undeclared, which disables the node's inbound cross-node
+	* gate as well. **One legacy runner silently turns off the filtering for the
+	* whole node**, and nothing reported it, so a zero here is as load-bearing as
+	* a non-zero one.
 	*/
-	resolveHubLocalUdsRoute(capName, deviceId) {
-		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
-		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId === null) return null;
-		return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
+	undeclaredChildCount() {
+		let count = 0;
+		for (const entry of this.children.values()) if (entry.eventPatterns === null) count += 1;
+		return count;
 	}
 	/**
-	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
-	*   the addonId of the provider the CALLER already resolved (e.g.
-	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
-	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
-	*   route already encodes the provider in its action name
-	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
-	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
-	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
-	*   `dispatch`.
-	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
-	*   addon that ORIGINATED the call, distinct from `addonId` above (which
-	*   names the resolved PROVIDER, not the caller). Set by
-	*   `onUnownedCall` from `CapCallInput.callerAddonId`
-	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
-	*   the `hub-in-process` branch consumes it — merged into `args` so a
-	*   diagnostic tool deep in that provider (e.g. device-manager's
-	*   fleet-read census) can read it without every provider method changing
-	*   signature, the same "extra field the provider destructures or
-	*   ignores" convention `nodeId` already uses on this path.
+	* Does `entry` want to receive an event in `category`? Honours the fan-out
+	* mode: `broadcast` → always; undeclared patterns (`null`) → always
+	* (fail-open); else the child's declared set must match via `matchesPattern`
+	* — the SAME function the child's own `deliverShared` map-key gate uses,
+	* giving provable delivery parity. `shadow` is handled by the caller (it
+	* counts the would-suppress but still sends).
+	*
+	* NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
+	* `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
+	* that explicitly subscribes to a ring-denied category must still RECEIVE it.
 	*/
-	async dispatch(route, method, args, addonId, callerAddonId) {
-		try {
-			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
-		} catch (err) {
-			if (err instanceof CapRouteError) throw err;
-			const nodeId = this.routeNodeId(route);
-			const cause = err instanceof Error ? err : new Error(String(err));
-			throw new CapRouteError(route.capName, method, {
-				reason: "transport-failed",
-				nodeId,
-				rejected: [{
-					kind: route.kind,
-					why: cause.message
-				}]
-			}, cause);
-		}
+	childWantsEvent(entry, category) {
+		if (this.fanoutMode === "broadcast") return true;
+		if (entry.eventPatterns === null) return true;
+		return entry.eventPatterns.some((p) => matchesPattern(p, category));
 	}
 	/**
-	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
-	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
+	* D2: this node's aggregate cross-node event interest — the UNION of every
+	* connected child's declared category patterns. Consumed by the parent's
+	* `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
+	* accepts cross-node (Moleculer) categories at least one local child wants.
+	*
+	* Returns `null` (fail-open — accept everything) when:
+	*   - NO child is currently connected (boot window before the first forked
+	*     child completes its UDS handshake, or every child has disconnected): a
+	*     node MUST NOT drop 100% of inbound cross-node events during that window,
+	*     and a child may connect imminently. This is distinct from the
+	*     declared-empty case below.
+	*   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
+	*     runner): a node cannot safely narrow its inbound set while a child's
+	*     real interest is unknown. Mirrors the per-child fail-open in
+	*     {@link childWantsEvent}, aggregated conservatively.
+	*
+	* Returns an EMPTY array only when ≥1 child is connected and EVERY connected
+	* child declared an explicit empty set — a genuine "wants nothing". Reads the
+	* live `children` map, so a child registering / disconnecting / sending
+	* `event-sub` is reflected on the next call with no extra bookkeeping.
 	*/
-	async dispatchInner(route, method, args, addonId, callerAddonId) {
-		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
-			case "hub-local-uds": {
-				const registry = this.hubLocalRegistry;
-				if (registry === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					rejected: [{
-						kind: "hub-local-uds",
-						why: "UDS registry not available"
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const input = {
-					capName: route.capName,
-					method,
-					args,
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return registry.callCapOnChild(route.childId, input);
-			}
-			case "remote-moleculer": {
-				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
-				if (addonId === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					nodeId: route.nodeId,
-					rejected: [{
-						kind: "remote-moleculer",
-						why: `no addonId known for ${route.nodeId}/${route.capName}`
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
-				const action = capActionName(addonId, route.capName, method, isNative);
-				return callWithServiceDiscovery(this.broker, addonId, action, args, {
-					nodeID: route.nodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
-			case "agent-child-forward": {
-				const deviceId = extractDeviceId(args);
-				const params = {
-					capName: route.capName,
-					method,
-					args,
-					...route.childId !== void 0 ? { childId: route.childId } : {},
-					...deviceId !== void 0 ? { deviceId } : {},
-					...addonId !== void 0 ? { addonId } : {}
-				};
-				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
-					nodeID: route.agentNodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
+	aggregateEventInterest() {
+		if (this.children.size === 0) return null;
+		const union = /* @__PURE__ */ new Set();
+		for (const entry of this.children.values()) {
+			if (entry.eventPatterns === null) return null;
+			for (const p of entry.eventPatterns) union.add(p);
 		}
+		return [...union];
 	}
-	buildSnapshot() {
-		const hubLocalRegistry = this.hubLocalRegistry;
-		const nodeAuthority = this.nodeAuthority;
-		const inProcessProviders = this.inProcessProviders;
-		const hubResidentProviders = this.hubResidentProviders;
-		return {
-			hubNodeId: this.hubNodeId,
-			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
-			...hubResidentProviders !== void 0 ? {
-				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
-				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
-			} : {},
-			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
-			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
-			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
-			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
-			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
-			getInProcessProviderRef: (cap) => inProcessProviders(cap),
-			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
-			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
-		};
+	statsFor(childId) {
+		let s = this.childEventStats.get(childId);
+		if (s === void 0) {
+			s = {
+				sent: 0,
+				suppressed: 0
+			};
+			this.childEventStats.set(childId, s);
+		}
+		return s;
 	}
-	/** Extract a nodeId string from a route for error reporting, or undefined. */
-	routeNodeId(route) {
-		switch (route.kind) {
-			case "hub-in-process": return this.hubNodeId;
-			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
-			case "remote-moleculer": return route.nodeId;
-			case "agent-child-forward": return route.agentNodeId;
+	/** Deduped INFO line whenever a child's declared pattern set changes. */
+	logPatternSet(childId, patterns) {
+		const key = patterns === null ? "<undeclared>" : JSON.stringify([...patterns].toSorted());
+		if (this.loggedPatternSet.get(childId) === key) return;
+		this.loggedPatternSet.set(childId, key);
+		this.logger?.info("child event patterns", {
+			childId,
+			patterns: patterns ?? null
+		});
+	}
+	/**
+	* Child id that can service a call to `capName` (optionally addressing
+	* `deviceId`), or null.
+	*
+	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
+	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
+	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
+	* many cameras — so its descriptor carries no `deviceId`. Resolving on
+	* `deviceId` alone would never match it and would force the call onto the
+	* broker fallback (which then hangs in service discovery). Hence:
+	*   1. exact device-scoped owner (native per-device caps where each child
+	*      owns a disjoint device subset) is preferred, then
+	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
+	* A cap is globally singleton XOR device-scoped, so the two tiers never
+	* compete for the same capName.
+	*/
+	resolveChildId(capName, deviceId) {
+		if (deviceId !== void 0) {
+			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
+			if (deviceOwner !== null) return deviceOwner;
+		}
+		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
+		if (candidates.length === 0) return null;
+		if (candidates.length === 1) return candidates[0];
+		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
+		if (preferredAddonId !== null) {
+			const preferredChildId = this.resolveChildIdForAddon?.(preferredAddonId) ?? preferredAddonId;
+			if (candidates.includes(preferredChildId)) return preferredChildId;
 		}
-	}
-};
-//#endregion
-//#region src/kernel/transport/local-child-registry.ts
-function readFanoutMode() {
-	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
-	if (raw === "shadow" || raw === "broadcast") return raw;
-	return "filter";
-}
-/**
-* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
-* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
-* prefix to distinguish routing failures (safe to retry via broker) from real
-* provider errors (must NOT retry to avoid double-executing side effects).
-*/
-var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
-/**
-* Parent-side authority for local addon-runners reachable over a
-* `LocalTransportServer` (UDS). Children register their cap manifest on
-* connect; the registry routes `(capName, deviceId?)` cap calls to the
-* owning child over the channel and drops a child's caps on disconnect.
-*/
-var LocalChildRegistry = class {
-	children = /* @__PURE__ */ new Map();
-	registeredHandler = () => {};
-	goneHandler = () => {};
-	/** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
-	nextIncarnation = 1;
-	eventHandler = null;
-	logHandler = null;
-	readinessHandler = null;
-	server;
-	onUnownedCall;
-	logger;
-	getActiveSingletonAddonId;
-	resolveChildIdForAddon;
-	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
-	ownNodeId;
-	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
-	isAggregatedCollectionMethod;
-	isAddonPinnedCall;
-	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
-	capTimeoutMs;
-	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
-	capUsageObserver;
-	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
-	egressRoutedCaps = /* @__PURE__ */ new Set();
-	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
-	fanoutMode = readFanoutMode();
-	/** Per-child event fan-out counters (sent / suppressed). */
-	childEventStats = /* @__PURE__ */ new Map();
-	/** Last pattern-set string logged per child, to dedup the INFO line. */
-	loggedPatternSet = /* @__PURE__ */ new Map();
-	/**
-	* Accepts either a plain positional `server` argument (backward-compatible)
-	* or a full `LocalChildRegistryOptions` object.
-	*
-	* Positional overloads (existing call sites are unchanged):
-	*   new LocalChildRegistry(server)
-	*   new LocalChildRegistry(server, onUnownedCall)
-	*
-	* Options object (new call sites that pass a logger):
-	*   new LocalChildRegistry({ server, onUnownedCall, logger })
-	*/
-	constructor(serverOrOptions, onUnownedCallArg) {
-		if (serverOrOptions && !("listen" in serverOrOptions)) {
-			const opts = serverOrOptions;
-			this.server = opts.server;
-			this.onUnownedCall = opts.onUnownedCall;
-			this.logger = opts.logger;
-			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
-			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
-			this.ownNodeId = opts.ownNodeId;
-			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
-			this.isAddonPinnedCall = opts.isAddonPinnedCall;
-			this.capTimeoutMs = opts.capTimeoutMs;
-			this.capUsageObserver = opts.capUsageObserver;
-		} else {
-			this.server = serverOrOptions;
-			this.onUnownedCall = onUnownedCallArg;
-		}
-	}
-	async start() {
-		this.logger?.info("UDS event fan-out mode", { mode: this.fanoutMode });
-		this.server.onConnection((channel) => this.onConnection(channel));
-		await this.server.listen();
-	}
-	/**
-	* Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
-	* child has no recorded events yet. Exposed for the starvation-verification
-	* surface (shadow burn-in + operator debug).
-	*/
-	getChildEventStats(childId) {
-		const s = this.childEventStats.get(childId);
-		return s === void 0 ? null : {
-			sent: s.sent,
-			suppressed: s.suppressed
-		};
-	}
-	/**
-	* This child's socket traffic — bytes and messages, both directions, split by
-	* frame kind — or `null` when the child is gone or its channel keeps no
-	* counters (an in-process or test transport).
-	*
-	* The event counters above cover ONE kind of frame and, once surfaced on
-	* 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
-	* is the same question asked of every frame the channel moves, and it is the
-	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
-	* pair for the whole process and has no per-socket breakdown.
-	*/
-	getChildSocketTraffic(childId) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return null;
-		return entry.channel.readTraffic?.() ?? null;
-	}
-	/**
-	* The regime the counters above were produced under, read once from
-	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
-	*
-	* A suppressed count means "nothing WAS dropped" under `filter` and "nothing
-	* WOULD have been dropped" under `shadow`. Those are different claims, and
-	* until this getter existed the mode was invisible at runtime — the counters
-	* were readable and the regime that produced them was not.
-	*/
-	get eventFanoutMode() {
-		return this.fanoutMode;
-	}
-	/**
-	* Connected children that never declared a subscription pattern set.
-	*
-	* Each one is a fail-open on BOTH planes: `childWantsEvent` returns true for
-	* an undeclared child ({@link ChildEntry.eventPatterns} `=== null`), and
-	* `aggregateEventInterest` returns `null` — accept everything — if ANY
-	* connected child is undeclared, which disables the node's inbound cross-node
-	* gate as well. **One legacy runner silently turns off the filtering for the
-	* whole node**, and nothing reported it, so a zero here is as load-bearing as
-	* a non-zero one.
-	*/
-	undeclaredChildCount() {
-		let count = 0;
-		for (const entry of this.children.values()) if (entry.eventPatterns === null) count += 1;
-		return count;
-	}
-	/**
-	* Does `entry` want to receive an event in `category`? Honours the fan-out
-	* mode: `broadcast` → always; undeclared patterns (`null`) → always
-	* (fail-open); else the child's declared set must match via `matchesPattern`
-	* — the SAME function the child's own `deliverShared` map-key gate uses,
-	* giving provable delivery parity. `shadow` is handled by the caller (it
-	* counts the would-suppress but still sends).
-	*
-	* NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
-	* `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
-	* that explicitly subscribes to a ring-denied category must still RECEIVE it.
-	*/
-	childWantsEvent(entry, category) {
-		if (this.fanoutMode === "broadcast") return true;
-		if (entry.eventPatterns === null) return true;
-		return entry.eventPatterns.some((p) => matchesPattern(p, category));
-	}
-	/**
-	* D2: this node's aggregate cross-node event interest — the UNION of every
-	* connected child's declared category patterns. Consumed by the parent's
-	* `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
-	* accepts cross-node (Moleculer) categories at least one local child wants.
-	*
-	* Returns `null` (fail-open — accept everything) when:
-	*   - NO child is currently connected (boot window before the first forked
-	*     child completes its UDS handshake, or every child has disconnected): a
-	*     node MUST NOT drop 100% of inbound cross-node events during that window,
-	*     and a child may connect imminently. This is distinct from the
-	*     declared-empty case below.
-	*   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
-	*     runner): a node cannot safely narrow its inbound set while a child's
-	*     real interest is unknown. Mirrors the per-child fail-open in
-	*     {@link childWantsEvent}, aggregated conservatively.
-	*
-	* Returns an EMPTY array only when ≥1 child is connected and EVERY connected
-	* child declared an explicit empty set — a genuine "wants nothing". Reads the
-	* live `children` map, so a child registering / disconnecting / sending
-	* `event-sub` is reflected on the next call with no extra bookkeeping.
-	*/
-	aggregateEventInterest() {
-		if (this.children.size === 0) return null;
-		const union = /* @__PURE__ */ new Set();
-		for (const entry of this.children.values()) {
-			if (entry.eventPatterns === null) return null;
-			for (const p of entry.eventPatterns) union.add(p);
-		}
-		return [...union];
-	}
-	statsFor(childId) {
-		let s = this.childEventStats.get(childId);
-		if (s === void 0) {
-			s = {
-				sent: 0,
-				suppressed: 0
-			};
-			this.childEventStats.set(childId, s);
-		}
-		return s;
-	}
-	/** Deduped INFO line whenever a child's declared pattern set changes. */
-	logPatternSet(childId, patterns) {
-		const key = patterns === null ? "<undeclared>" : JSON.stringify([...patterns].toSorted());
-		if (this.loggedPatternSet.get(childId) === key) return;
-		this.loggedPatternSet.set(childId, key);
-		this.logger?.info("child event patterns", {
-			childId,
-			patterns: patterns ?? null
-		});
-	}
-	/**
-	* Child id that can service a call to `capName` (optionally addressing
-	* `deviceId`), or null.
-	*
-	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
-	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
-	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
-	* many cameras — so its descriptor carries no `deviceId`. Resolving on
-	* `deviceId` alone would never match it and would force the call onto the
-	* broker fallback (which then hangs in service discovery). Hence:
-	*   1. exact device-scoped owner (native per-device caps where each child
-	*      owns a disjoint device subset) is preferred, then
-	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
-	* A cap is globally singleton XOR device-scoped, so the two tiers never
-	* compete for the same capName.
-	*/
-	resolveChildId(capName, deviceId) {
-		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
-			if (deviceOwner !== null) return deviceOwner;
-		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
-		if (candidates.length === 0) return null;
-		if (candidates.length === 1) return candidates[0];
-		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
-		if (preferredAddonId !== null) {
-			const preferredChildId = this.resolveChildIdForAddon?.(preferredAddonId) ?? preferredAddonId;
-			if (candidates.includes(preferredChildId)) return preferredChildId;
-		}
-		return candidates[0];
+		return candidates[0];
 	}
 	/**
 	* Publish one cap-usage observation, if a sink is wired.
@@ -6845,7 +7146,7 @@ var LocalChildRegistry = class {
 				return;
 			}
 		});
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
 			if (msg.kind === "register") {
 				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
@@ -6862,31 +7163,38 @@ var LocalChildRegistry = class {
 					channel,
 					caps: msg.caps,
 					eventPatterns,
-					incarnation
+					incarnation,
+					rawForward: msg.rawForward === true
 				});
 				this.logPatternSet(msg.childId, eventPatterns);
 				this.registeredHandler({
 					childId: msg.childId,
 					caps: msg.caps,
-					incarnation
+					incarnation,
+					...msg.customActions !== void 0 ? { customActions: msg.customActions } : {}
 				});
-				return { ok: true };
+				return {
+					ok: true,
+					rawForward: true
+				};
 			}
 			if (msg.kind === "cap-call-out") {
 				const out = msg;
-				const input = {
+				const hints = out.hints ?? liftRoutingHints(out.args);
+				const materialise = () => payload !== void 0 ? unpackPayload(payload) : out.args;
+				const buildInput = () => ({
 					capName: out.capName,
 					method: out.method,
-					args: out.args,
+					args: materialise(),
 					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
 					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {},
 					...out.native === true ? { native: true } : {},
 					...childId !== null ? { callerAddonId: childId } : {}
-				};
-				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
+				});
+				const pinnedNodeId = out.nodeId ?? hints.nodeId;
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
 				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
-				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
+				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, hints) === true;
 				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
 				this.recordCapUsage(childId, target, out.capName, out.method);
 				if (target !== null) {
@@ -6894,9 +7202,27 @@ var LocalChildRegistry = class {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
 					}
-					return this.callCap(input);
+					const entry = this.children.get(target);
+					if (payload !== void 0 && entry !== void 0 && entry.rawForward) {
+						this.forwardedRaw += 1;
+						const forward = {
+							kind: "cap-call",
+							capName: out.capName,
+							method: out.method,
+							args: void 0,
+							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {}
+						};
+						const declared = this.capTimeoutMs?.(out.capName, out.method);
+						return entry.channel.request(forward, {
+							...typeof declared === "number" ? { timeoutMs: declared } : {},
+							payload
+						});
+					}
+					this.forwardedDecoded += 1;
+					return this.callCap(buildInput());
 				}
-				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
+				this.forwardedDecoded += 1;
+				if (this.onUnownedCall !== void 0) return this.onUnownedCall(buildInput());
 				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
 			}
 			if (msg.kind === "readiness-request") return {
@@ -6926,6 +7252,11 @@ var LocalChildRegistry = class {
 };
 //#endregion
 //#region src/kernel/transport/local-child-client.ts
+/** Did the parent's `register` answer say it accepts payload-borne args? */
+function ackAcceptsRawForward(ack) {
+	if (ack === null || typeof ack !== "object") return false;
+	return ack.rawForward === true;
+}
 /**
 * Child side of the local UDS transport. Connects to its parent (hub or
 * agent), registers its cap manifest, and serves parent→child cap calls by
@@ -6970,8 +7301,24 @@ var LocalChildClient = class {
 	* subscriptions do), the register carries the real union — even if empty.
 	*/
 	hasDeclaredEventPatterns = false;
+	/**
+	* The custom-action catalogs of every hosted addon, once the runner's init
+	* loop has produced them (`updateCaps(caps, catalogs)` at post-init). `null`
+	* until then, and OMITTED from the register frame while null: the parent
+	* reads absence as "not described yet", and a pre-init register must never
+	* look like "this child declares no actions". Kept on the client so every
+	* later re-register (native-cap change, reconnect) re-carries it unchanged.
+	*/
+	latestCustomActions = null;
 	/** Events and logs queued while the channel is not yet open. */
 	pendingEmits = [];
+	/**
+	* Whether the parent acknowledged raw-forward at `register`. Until it has,
+	* `callOut` sends args inline exactly as every child always did — a legacy
+	* parent would decode a payload-borne call to `args: undefined` and run the
+	* provider on nothing, silently. Re-read on every re-register.
+	*/
+	parentRawForward = false;
 	/** Handler for parent→child events. Registered via `onEvent`. */
 	eventHandler = null;
 	/**
@@ -7079,17 +7426,22 @@ var LocalChildClient = class {
 		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
 		const client = createLocalTransport().createClient(this.options.nodeId);
 		const channel = await client.connect();
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
-			if (msg.kind === "cap-call") return this.options.dispatch({
-				capName: msg.capName,
-				method: msg.method,
-				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
-				...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
-			});
-			if (msg.kind === "addon-call") {
-				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
+			if (msg.kind === "cap-call") {
+				const args = payload !== void 0 ? unpackPayload(payload) : msg.args;
+				const result = await this.options.dispatch({
+					capName: msg.capName,
+					method: msg.method,
+					args,
+					...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
+					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+				});
+				if (payload !== void 0 && result !== void 0) return new PayloadReply(void 0, packPayload(result));
+				return result;
+			}
+			if (msg.kind === "addon-call") {
+				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
 				return this.addonCallHandler({
 					addonId: msg.addonId,
 					target: msg.target,
@@ -7109,14 +7461,9 @@ var LocalChildClient = class {
 			}
 			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
 		});
-		const register = {
-			kind: "register",
-			childId: this.options.childId,
-			caps: this.latestCaps,
-			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {}
-		};
+		const register = this.registerFrame(this.latestCaps);
 		try {
-			await channel.request(register);
+			this.parentRawForward = ackAcceptsRawForward(await channel.request(register));
 		} catch (err) {
 			await client.close();
 			throw err;
@@ -7126,95 +7473,564 @@ var LocalChildClient = class {
 		this.flushPending(channel);
 		for (const cb of this.connectedHandlers) cb();
 	}
-	/** Flush buffered pre-start emits over the now-open channel. */
-	flushPending(channel) {
-		for (const item of this.pendingEmits) channel.emit(item.msg);
-		this.pendingEmits.length = 0;
+	/** Flush buffered pre-start emits over the now-open channel. */
+	flushPending(channel) {
+		for (const item of this.pendingEmits) channel.emit(item.msg);
+		this.pendingEmits.length = 0;
+	}
+	/**
+	* Re-send the cap manifest to the parent, atomically replacing the child's
+	* registered descriptor set. Call this after device-restore so newly
+	* registered native (device-scoped) caps become routable over UDS.
+	*
+	* Safe to call before `start()`: the new set is buffered and `start()` sends
+	* it (device-restore can race ahead of the UDS connect). After `start()`,
+	* the set is sent immediately.
+	*/
+	async updateCaps(caps, customActions) {
+		this.latestCaps = caps;
+		if (customActions !== void 0) this.latestCustomActions = customActions;
+		if (this.channel === null) return;
+		this.parentRawForward = ackAcceptsRawForward(await this.channel.request(this.registerFrame(caps)));
+	}
+	/**
+	* The register frame: caps, plus everything a re-register must atomically
+	* re-carry so no separate re-sync can be missed — the subscription union
+	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
+	* custom-action catalogs (omitted until the init loop produced them).
+	*/
+	registerFrame(caps) {
+		return {
+			kind: "register",
+			childId: this.options.childId,
+			caps,
+			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
+			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {},
+			rawForward: true
+		};
+	}
+	/**
+	* Fire-and-forget: send a system event to the parent for forwarding to the
+	* hub event bus. Safe to call before `start()` — events are buffered and
+	* flushed on connect.
+	*/
+	emitEvent(event) {
+		const msg = {
+			kind: "event",
+			event
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "event",
+			msg
+		});
+	}
+	/**
+	* Fire-and-forget: send a structured log entry to the parent. Safe to call
+	* before `start()` — log entries are buffered and flushed on connect.
+	*/
+	sendLog(entry) {
+		const msg = {
+			kind: "log",
+			...entry
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "log",
+			msg
+		});
+	}
+	/**
+	* Request the current readiness snapshot from the parent. Returns the
+	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
+	* Requires `start()` to have been called; throws with a clear message if not.
+	*/
+	async requestReadinessSnapshot() {
+		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
+		return (await this.channel.request({ kind: "readiness-request" })).records;
+	}
+	/**
+	* Ask the parent to execute a cap call this child does NOT own. The parent
+	* routes to the owning local sibling over UDS, or — if no sibling owns it —
+	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
+	* production). Throws if called before `start()`.
+	*/
+	async callOut(input) {
+		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+		const routing = {
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
+			...input.native === true ? { native: true } : {}
+		};
+		if (this.parentRawForward && input.args !== void 0) {
+			const hints = liftRoutingHints(input.args);
+			const msg = {
+				kind: "cap-call-out",
+				capName: input.capName,
+				method: input.method,
+				...Object.keys(hints).length > 0 ? { hints } : {},
+				...routing
+			};
+			const reply = await this.channel.request(msg, { payload: packPayload(input.args) });
+			return reply instanceof PayloadReply ? unpackPayload(reply.payload) : reply;
+		}
+		const msg = {
+			kind: "cap-call-out",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...routing
+		};
+		return this.channel.request(msg);
+	}
+	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
+	async close() {
+		await this.client?.close();
+		this.client = null;
+		this.channel = null;
+	}
+};
+//#endregion
+//#region src/kernel/transport/cap-route.ts
+function buildMessage(capName, method, detail) {
+	const call = method !== void 0 ? `${capName}.${method}` : capName;
+	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
+	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
+	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
+	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+}
+var CapRouteError = class extends Error {
+	reason;
+	nodeId;
+	rejected;
+	/**
+	* @param cause  Optional original error that triggered this routing failure.
+	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
+	*               Dispatchers wrapping transport errors MUST pass the original.
+	*/
+	constructor(capName, method, detail, cause) {
+		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
+		this.name = "CapRouteError";
+		this.reason = detail.reason;
+		this.nodeId = detail.nodeId;
+		this.rejected = detail.rejected;
+	}
+};
+/**
+* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
+*
+* Precedence (explicit nodeId path):
+*   1. hub-in-process — hub node + hubInProcessProvides
+*   2. hub-local-uds  — hub node + hubLocalChildProvides
+*   3. node-offline   → CapRouteError{reason:'node-offline'}
+*   4. agent-child-forward — node is an agent AND nodeKnowsCap
+*   5. remote-moleculer — any other online non-agent node
+*
+* Singleton path (no nodeId):
+*   1. hub-in-process (hub provides in-process)
+*   2. hub-local-uds  (a hub-local UDS child provides it)
+*   3. remote-moleculer (any online, non-hub node that knows it)
+*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
+*
+* PURE: no side effects, no async, no broker/registry imports.
+*/
+function classifyCapRoute(capName, opts, snapshot) {
+	const rejected = [];
+	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
+	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
+}
+function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
+	if (nodeId === snap.hubNodeId) {
+		const residentProvides = snap.hubResidentProvides;
+		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
+		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
+		if (providesOnHub(capName)) {
+			const ref = getRef?.(capName) ?? null;
+			if (ref !== null) return {
+				kind: "hub-in-process",
+				capName,
+				ref
+			};
+			rejected.push({
+				kind: "hub-in-process",
+				why: "provider ref not available in snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		if (snap.hubLocalChildProvides(capName, deviceId)) {
+			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+			if (childId !== null) return {
+				kind: "hub-local-uds",
+				capName,
+				childId
+			};
+			rejected.push({
+				kind: "hub-local-uds",
+				why: "child id not resolvable from snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "hub does not provide this cap in-process"
+		});
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "no hub-local child provides this cap"
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
+	}
+	if (!snap.nodeOnline(nodeId)) {
+		rejected.push({
+			kind: "remote-moleculer",
+			why: `node ${nodeId} is offline`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "node-offline",
+			nodeId,
+			rejected
+		});
+	}
+	if (snap.nodeIsAgent(nodeId)) {
+		if (snap.nodeKnowsCap(nodeId, capName)) return {
+			kind: "agent-child-forward",
+			capName,
+			agentNodeId: nodeId,
+			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+		};
+		rejected.push({
+			kind: "agent-child-forward",
+			why: `agent ${nodeId} does not know cap ${capName}`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
+	}
+	return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+}
+function classifySingleton(capName, deviceId, snap, rejected) {
+	if (snap.hubInProcessProvides(capName)) {
+		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		if (ref !== null) return {
+			kind: "hub-in-process",
+			capName,
+			ref
+		};
+		rejected.push({
+			kind: "hub-in-process",
+			why: "provider ref not available in snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-in-process",
+		why: "hub does not provide this cap in-process"
+	});
+	if (snap.hubLocalChildProvides(capName, deviceId)) {
+		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId !== null) return {
+			kind: "hub-local-uds",
+			capName,
+			childId
+		};
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "child id not resolvable from snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-local-uds",
+		why: "no hub-local child provides this cap"
+	});
+	const knownNodes = snap.listKnownNodeIds?.() ?? [];
+	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+	rejected.push({
+		kind: "remote-moleculer",
+		why: "no online remote node knows this cap"
+	});
+	throw new CapRouteError(capName, void 0, {
+		reason: "no-provider",
+		rejected
+	});
+}
+//#endregion
+//#region src/kernel/moleculer/resilient-cap-call.ts
+/** Moleculer error `type` values meaning "the service is not (yet) routable". */
+var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
+/** Default ceiling for the discovery wait — fail-fast past this. */
+var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
+function isDiscoveryError(err) {
+	if (typeof err !== "object" || err === null) return false;
+	const type = err.type;
+	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+}
+/**
+* Call a Moleculer action; on a service-discovery error, wait for the
+* named service to be discovered and retry the call exactly once.
+*/
+async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
+	try {
+		return await broker.call(action, params, opts);
+	} catch (err) {
+		if (!isDiscoveryError(err)) throw err;
+		await broker.waitForServices([serviceName], discoveryTimeoutMs);
+		return await broker.call(action, params, opts);
+	}
+}
+//#endregion
+//#region src/kernel/transport/cap-route-resolver.ts
+/** The Moleculer service name that Task 6's agent registers. */
+var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
+/** The Moleculer action (service.action) for agent cap forwarding. */
+var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
+/** Default timeout for remote Moleculer cap calls (ms). */
+var REMOTE_CALL_TIMEOUT_MS = 6e4;
+function extractDeviceId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "deviceId");
+	return typeof raw === "number" ? raw : void 0;
+}
+/**
+* Extract an inline `nodeId` string from a cap call's args — the per-call node
+* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
+* device-scoped caps carry `deviceId`, and the way the generated cap-router on
+* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
+*
+* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
+* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
+* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
+* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
+* methods that don't declare `nodeId` simply ignore the extra field (they
+* destructure the fields they need); methods that DO declare it (e.g.
+* `getEngineProvisioning({nodeId})`) still receive it unchanged.
+*/
+function extractNodeId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "nodeId");
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+/**
+* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
+* destructures what it needs and ignores the rest" convention
+* {@link extractNodeId} already relies on for the inline `nodeId` pin.
+* `undefined` (the overwhelmingly common case: no caller hint, or the census
+* consuming it is disarmed) returns `args` unchanged — no allocation. A
+* non-object `args` (or `null`/array) is returned unchanged too: there is
+* nowhere to attach an extra key without changing the payload's shape, and a
+* provider taking a bare value never reads `callerAddonId` off it anyway.
+*/
+function withCallerAddonId(args, callerAddonId) {
+	if (callerAddonId === void 0) return args;
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	return {
+		...args,
+		callerAddonId
+	};
+}
+var CapRouteResolver = class {
+	hubNodeId;
+	broker;
+	hubLocalRegistry;
+	nodeAuthority;
+	inProcessProviders;
+	hubResidentProviders;
+	capTimeoutMs;
+	snapshot;
+	constructor(deps) {
+		this.hubNodeId = deps.hubNodeId;
+		this.broker = deps.broker;
+		this.hubLocalRegistry = deps.hubLocalRegistry;
+		this.nodeAuthority = deps.nodeAuthority;
+		this.inProcessProviders = deps.inProcessProviders;
+		this.hubResidentProviders = deps.hubResidentProviders;
+		this.capTimeoutMs = deps.capTimeoutMs;
+		this.snapshot = this.buildSnapshot();
+	}
+	/** Per-call RPC timeout: the cap method's declared override, else the default. */
+	callTimeout(capName, method) {
+		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
 	}
-	/**
-	* Re-send the cap manifest to the parent, atomically replacing the child's
-	* registered descriptor set. Call this after device-restore so newly
-	* registered native (device-scoped) caps become routable over UDS.
-	*
-	* Safe to call before `start()`: the new set is buffered and `start()` sends
-	* it (device-restore can race ahead of the UDS connect). After `start()`,
-	* the set is sent immediately.
-	*/
-	async updateCaps(caps) {
-		this.latestCaps = caps;
-		if (this.channel === null) return;
-		const register = {
-			kind: "register",
-			childId: this.options.childId,
-			caps,
-			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {}
-		};
-		await this.channel.request(register);
+	resolveCapRoute(capName, opts) {
+		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* Fire-and-forget: send a system event to the parent for forwarding to the
-	* hub event bus. Safe to call before `start()` — events are buffered and
-	* flushed on connect.
+	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
+	* child, IGNORING any in-hub provider registered for the same cap name.
+	*
+	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
+	* provider (e.g. a wrapper) is registered for the cap, the route always
+	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
+	* reached. That is correct for the generic dispatch path (the wrapper is the
+	* active provider), but WRONG for the native-cap fallback
+	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
+	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
+	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
+	* itself, the native is never invoked, and the wrapper silently falls
+	* through to its secondary strategy.
+	*
+	* This method consults ONLY the hub-local-child authority
+	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
+	* it returns the native child route regardless of any in-process shadow.
+	* Returns null when no hub-local child owns `(capName, deviceId)` — the
+	* caller then falls through to its remote-resolution branch.
 	*/
-	emitEvent(event) {
-		const msg = {
-			kind: "event",
-			event
+	resolveHubLocalUdsRoute(capName, deviceId) {
+		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
+		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId === null) return null;
+		return {
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "event",
-			msg
-		});
 	}
 	/**
-	* Fire-and-forget: send a structured log entry to the parent. Safe to call
-	* before `start()` — log entries are buffered and flushed on connect.
+	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
+	*   the addonId of the provider the CALLER already resolved (e.g.
+	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
+	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
+	*   route already encodes the provider in its action name
+	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
+	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
+	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
+	*   `dispatch`.
+	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
+	*   addon that ORIGINATED the call, distinct from `addonId` above (which
+	*   names the resolved PROVIDER, not the caller). Set by
+	*   `onUnownedCall` from `CapCallInput.callerAddonId`
+	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
+	*   the `hub-in-process` branch consumes it — merged into `args` so a
+	*   diagnostic tool deep in that provider (e.g. device-manager's
+	*   fleet-read census) can read it without every provider method changing
+	*   signature, the same "extra field the provider destructures or
+	*   ignores" convention `nodeId` already uses on this path.
 	*/
-	sendLog(entry) {
-		const msg = {
-			kind: "log",
-			...entry
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "log",
-			msg
-		});
+	async dispatch(route, method, args, addonId, callerAddonId) {
+		try {
+			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
+		} catch (err) {
+			if (err instanceof CapRouteError) throw err;
+			const nodeId = this.routeNodeId(route);
+			const cause = err instanceof Error ? err : new Error(String(err));
+			throw new CapRouteError(route.capName, method, {
+				reason: "transport-failed",
+				nodeId,
+				rejected: [{
+					kind: route.kind,
+					why: cause.message
+				}]
+			}, cause);
+		}
 	}
 	/**
-	* Request the current readiness snapshot from the parent. Returns the
-	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
-	* Requires `start()` to have been called; throws with a clear message if not.
+	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
+	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
 	*/
-	async requestReadinessSnapshot() {
-		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
-		return (await this.channel.request({ kind: "readiness-request" })).records;
+	async dispatchInner(route, method, args, addonId, callerAddonId) {
+		switch (route.kind) {
+			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
+			case "hub-local-uds": {
+				const registry = this.hubLocalRegistry;
+				if (registry === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					rejected: [{
+						kind: "hub-local-uds",
+						why: "UDS registry not available"
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const input = {
+					capName: route.capName,
+					method,
+					args,
+					...deviceId !== void 0 ? { deviceId } : {}
+				};
+				return registry.callCapOnChild(route.childId, input);
+			}
+			case "remote-moleculer": {
+				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
+				if (addonId === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					nodeId: route.nodeId,
+					rejected: [{
+						kind: "remote-moleculer",
+						why: `no addonId known for ${route.nodeId}/${route.capName}`
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
+				const action = capActionName(addonId, route.capName, method, isNative);
+				return callWithServiceDiscovery(this.broker, addonId, action, args, {
+					nodeID: route.nodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+			case "agent-child-forward": {
+				const deviceId = extractDeviceId(args);
+				const params = {
+					capName: route.capName,
+					method,
+					args,
+					...route.childId !== void 0 ? { childId: route.childId } : {},
+					...deviceId !== void 0 ? { deviceId } : {},
+					...addonId !== void 0 ? { addonId } : {}
+				};
+				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
+					nodeID: route.agentNodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+		}
 	}
-	/**
-	* Ask the parent to execute a cap call this child does NOT own. The parent
-	* routes to the owning local sibling over UDS, or — if no sibling owns it —
-	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
-	* production). Throws if called before `start()`.
-	*/
-	async callOut(input) {
-		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
-		const msg = {
-			kind: "cap-call-out",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
-			...input.native === true ? { native: true } : {}
+	buildSnapshot() {
+		const hubLocalRegistry = this.hubLocalRegistry;
+		const nodeAuthority = this.nodeAuthority;
+		const inProcessProviders = this.inProcessProviders;
+		const hubResidentProviders = this.hubResidentProviders;
+		return {
+			hubNodeId: this.hubNodeId,
+			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			...hubResidentProviders !== void 0 ? {
+				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
+				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
+			} : {},
+			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
+			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
+			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
+			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
+			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
+			getInProcessProviderRef: (cap) => inProcessProviders(cap),
+			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
+			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
 		};
-		return this.channel.request(msg);
 	}
-	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
-	async close() {
-		await this.client?.close();
-		this.client = null;
-		this.channel = null;
+	/** Extract a nodeId string from a route for error reporting, or undefined. */
+	routeNodeId(route) {
+		switch (route.kind) {
+			case "hub-in-process": return this.hubNodeId;
+			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
+			case "remote-moleculer": return route.nodeId;
+			case "agent-child-forward": return route.agentNodeId;
+		}
 	}
 };
 //#endregion
@@ -9886,4 +10702,4 @@ async function defaultRun(command, args) {
 	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
 }
 //#endregion
-export { buildUdsNativeCapProxy as $, formatHeapSpaces as $t, createUdsLoggerWithControl as A, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, createV8Reclaimer as Bt, ipcParentLink as C, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, HEAP_RECLAIM_TRIGGER_MB as Et, AGENT_CAP_FWD_SERVICE as F, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, hubMainRssBudget as Ht, CapRouteResolver as I, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, CapRouteError as L, buildHeapSample as Lt, LocalChildRegistry as M, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, UDS_NO_ROUTE_PREFIX as N, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, HEAP_WATCH_WARN_RATIO as Ot, AGENT_CAP_FWD_ACTION as P, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, emitHeapDiagnosticReport as Qt, classifyCapRoute as R, createDeferredHeapWatchSink as Rt, buildLinkChain as S, runNpm as St, createParentUnownedCallHandler as T, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, nextRssBudgetState as Ut, CapUsageRegistry as V, describeRss as Vt, getCapUsageRegistry as W, parseRssBudgetMb as Wt, FrameDecoder as X, DECISIVE_HEAP_SPACES as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, HEAP_SPACE_REPORT_MIN_MB as Zt, AddonDepsManager as _, createEventPlaneReader as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, createSocketPlaneMeter as an, createAddonService as at, brokerCallForCap as b, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, formatSocketPlane as cn, capActionName as ct, clusterEventTopic as d, recordSocketFrame as dn, capServiceName as dt, heapSpaceField as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, sampleSocketDirection as fn, parseCapAction as ft, subscribePassthrough as g, createEventPlaneMeter as gn, CapabilityHandle as gt, setNodeEventInterest as h, EVENT_PLANE_TOP_N as hn, DeviceRegistry as ht, createAddonContext as i, SOCKET_PLANE_TOP_N as in, setWorkerNativeCapsChangeListener as it, LocalChildClient as j, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, EMPTY_SOCKET_DIRECTION as ln, capActionSuffix as lt, registerEventBusService as m, socketDirectionMessages as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, selectReportedSpaces as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, createSocketPlaneReader as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, socketDirectionBytes as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, EMPTY_SOCKET_PLANE_BASELINE as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, diffSocketPlane as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, readHeapSpaces as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, createSocketDirectionCounters as un, capBareAction as ut, createKernelHwAccel as v, diffEventPlane as vn, copyBundledNativeModules as vt, localProviderLink as w, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, resolveNpmInvocation as xt, resolveHwAccel as y, formatEventPlane as yn, installManifestNativeDeps as yt, callWithServiceDiscovery as z, createLoopDelayMeter as zt };
+export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, sampleSocketDirection as An, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, createV8Reclaimer as Bt, ipcParentLink as C, createSocketPlaneReader as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, EMPTY_SOCKET_DIRECTION as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, readSocketQueues as En, HEAP_RECLAIM_TRIGGER_MB as Et, CapRouteError as F, createEventPlaneReader as Fn, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, hubMainRssBudget as Ht, classifyCapRoute as I, diffEventPlane as In, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, LocalChildClient as L, formatEventPlane as Ln, buildHeapSample as Lt, AGENT_CAP_FWD_SERVICE as M, socketDirectionMessages as Mn, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, CapRouteResolver as N, EVENT_PLANE_TOP_N as Nn, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, createSocketDirectionCounters as On, HEAP_WATCH_WARN_RATIO as Ot, callWithServiceDiscovery as P, createEventPlaneMeter as Pn, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, LocalChildRegistry as R, createDeferredHeapWatchSink as Rt, buildLinkChain as S, createSocketPlaneMeter as Sn, runNpm as St, createParentUnownedCallHandler as T, formatSocketPlane as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, nextRssBudgetState as Ut, CapUsageRegistry as V, describeRss as Vt, getCapUsageRegistry as W, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, createMeshQueueReader as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, SOCKET_PLANE_TOP_N as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, OUTBOUND_QUEUE_COOLDOWN_MS as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, OUTBOUND_QUEUE_SUSTAIN_MS as fn, parseCapAction as ft, subscribePassthrough as g, MESH_QUEUE_TOP_N as gn, CapabilityHandle as gt, setNodeEventInterest as h, formatOutboundQueueVerdict as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, AGENT_CAP_FWD_ACTION as j, socketDirectionBytes as jn, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, recordSocketFrame as kn, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createOutboundQueueGate as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, OUTBOUND_QUEUE_THRESHOLD_BYTES as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, formatMeshQueue as vn, copyBundledNativeModules as vt, localProviderLink as w, diffSocketPlane as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, SOCKET_QUEUE_TOP_N as xn, resolveNpmInvocation as xt, resolveHwAccel as y, EMPTY_SOCKET_PLANE_BASELINE as yn, installManifestNativeDeps as yt, UDS_NO_ROUTE_PREFIX as z, createLoopDelayMeter as zt };