@camstack/system 1.2.218 → 1.2.219

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-DigmGsQS.mjs";
+import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-Cyz5_i7z.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -14,7 +14,7 @@ import "./builtins/liveness-monitor/index.mjs";
 import { LocalAuthAddon, a as require_safe_buffer, i as require_ms, n as ScopedTokenManager, o as ApiKeyManager, r as AuthManager, t as UserManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
-import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
+import NativeMetricsAddon, { a as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
@@ -24,23 +24,23 @@ import "./builtins/storage-orchestrator/index.mjs";
 import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-B3CFd9tM.mjs";
-import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
-import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, A as createUdsLoggerWithControl, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bt as createV8Reclaimer, C as ipcParentLink, Cn as EVENT_PLANE_TOP_N, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dn as formatEventPlane, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, En as diffEventPlane, Et as HEAP_RECLAIM_TRIGGER_MB, F as AGENT_CAP_FWD_SERVICE, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Ht as hubMainRssBudget, I as CapRouteResolver, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as CapRouteError, Lt as buildHeapSample, M as LocalChildRegistry, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as UDS_NO_ROUTE_PREFIX, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, Ot as HEAP_WATCH_WARN_RATIO, P as AGENT_CAP_FWD_ACTION, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, R as classifyCapRoute, Rt as createDeferredHeapWatchSink, S as buildLinkChain, Sn as socketDirectionMessages, St as runNpm, T as createParentUnownedCallHandler, Tn as createEventPlaneReader, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Ut as nextRssBudgetState, V as CapUsageRegistry, Vt as describeRss, W as getCapUsageRegistry, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, _ as AddonDepsManager, _n as EMPTY_SOCKET_DIRECTION, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as HEAP_SPACE_REPORT_MIN_MB, at as createAddonService, b as brokerCallForCap, bn as sampleSocketDirection, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as heapSpaceField, ct as capActionName, d as clusterEventTopic, dn as EMPTY_SOCKET_PLANE_BASELINE, dt as capServiceName, en as createArrayBufferCensusGate, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as SOCKET_PLANE_TOP_N, ft as parseCapAction, g as subscribePassthrough, gn as formatSocketPlane, gt as CapabilityHandle, h as setNodeEventInterest, hn as diffSocketPlane, ht as DeviceRegistry, i as createAddonContext, in as DECISIVE_HEAP_SPACES, j as LocalChildClient, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as readHeapSpaces, lt as capActionSuffix, m as registerEventBusService, mn as createSocketPlaneReader, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as formatArrayBufferCensus, o as getWorkerDeviceRegistry, on as emitHeapDiagnosticReport, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as createSocketPlaneMeter, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as isArrayBufferCensusReport, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as formatHeapSpaces, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createInspectorArrayBufferCensus, u as EVENT_TOPIC_PREFIX, un as selectReportedSpaces, ut as capBareAction, v as createKernelHwAccel, vn as createSocketDirectionCounters, vt as copyBundledNativeModules, w as localProviderLink, wn as createEventPlaneMeter, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xn as socketDirectionBytes, xt as resolveNpmInvocation, y as resolveHwAccel, yn as recordSocketFrame, yt as installManifestNativeDeps, z as callWithServiceDiscovery, zt as createLoopDelayMeter } from "./manifest-system-deps-D--wyMD9.mjs";
-import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
-import { t as CustomActionRegistry } from "./custom-action-registry-CsONUlhC.mjs";
+import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-GPrVvx14.mjs";
+import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
+import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, A as createUdsLoggerWithControl, An as sampleSocketDirection, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bt as createV8Reclaimer, C as ipcParentLink, Cn as createSocketPlaneReader, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dn as EMPTY_SOCKET_DIRECTION, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, En as readSocketQueues, Et as HEAP_RECLAIM_TRIGGER_MB, F as CapRouteError, Fn as createEventPlaneReader, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Ht as hubMainRssBudget, I as classifyCapRoute, In as diffEventPlane, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as LocalChildClient, Ln as formatEventPlane, Lt as buildHeapSample, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionMessages, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as CapRouteResolver, Nn as EVENT_PLANE_TOP_N, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, On as createSocketDirectionCounters, Ot as HEAP_WATCH_WARN_RATIO, P as callWithServiceDiscovery, Pn as createEventPlaneMeter, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, R as LocalChildRegistry, Rt as createDeferredHeapWatchSink, S as buildLinkChain, Sn as createSocketPlaneMeter, St as runNpm, T as createParentUnownedCallHandler, Tn as formatSocketPlane, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Ut as nextRssBudgetState, V as CapUsageRegistry, Vt as describeRss, W as getCapUsageRegistry, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, _ as AddonDepsManager, _n as createMeshQueueReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as HEAP_SPACE_REPORT_MIN_MB, at as createAddonService, b as brokerCallForCap, bn as SOCKET_PLANE_TOP_N, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as heapSpaceField, ct as capActionName, d as clusterEventTopic, dn as OUTBOUND_QUEUE_COOLDOWN_MS, dt as capServiceName, en as createArrayBufferCensusGate, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_SUSTAIN_MS, ft as parseCapAction, g as subscribePassthrough, gn as MESH_QUEUE_TOP_N, gt as CapabilityHandle, h as setNodeEventInterest, hn as formatOutboundQueueVerdict, ht as DeviceRegistry, i as createAddonContext, in as DECISIVE_HEAP_SPACES, j as AGENT_CAP_FWD_ACTION, jn as socketDirectionBytes, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kn as recordSocketFrame, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as readHeapSpaces, lt as capActionSuffix, m as registerEventBusService, mn as createOutboundQueueGate, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as formatArrayBufferCensus, o as getWorkerDeviceRegistry, on as emitHeapDiagnosticReport, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_THRESHOLD_BYTES, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as isArrayBufferCensusReport, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as formatHeapSpaces, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createInspectorArrayBufferCensus, u as EVENT_TOPIC_PREFIX, un as selectReportedSpaces, ut as capBareAction, v as createKernelHwAccel, vn as formatMeshQueue, vt as copyBundledNativeModules, w as localProviderLink, wn as diffSocketPlane, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xn as SOCKET_QUEUE_TOP_N, xt as resolveNpmInvocation, y as resolveHwAccel, yn as EMPTY_SOCKET_PLANE_BASELINE, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zt as createLoopDelayMeter } from "./manifest-system-deps-C7dihwWT.mjs";
+import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
+import { t as CustomActionRegistry } from "./custom-action-registry-B6gOtUWA.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { lstat, readdir, readlink, realpath } from "node:fs/promises";
 import * as path$39 from "node:path";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { execFile, spawn } from "node:child_process";
-import * as util$10 from "node:util";
-import { promisify } from "node:util";
 import * as fs$17 from "node:fs";
 import { accessSync, constants, existsSync } from "node:fs";
+import { execFile, spawn } from "node:child_process";
 import * as os$18 from "node:os";
+import * as util$10 from "node:util";
+import { promisify } from "node:util";
 import { request } from "node:http";
 import * as vm from "node:vm";
 import { asJsonObject, errMsg } from "@camstack/types/addon";
@@ -94693,35 +94693,20 @@ function forceMoleculerDisconnect(broker, nodeId) {
 		nodes.delete(nodeId);
 	} catch {}
 }
-/** Read CPU% and RSS for a set of PIDs via `ps`. */
+/**
+* CPU% and RSS for a set of PIDs — `/proc` on Linux, `ps -p` elsewhere.
+* One reader for the whole kernel (`process/resource-monitor.ts`): this used
+* to be a second `ps` fork of its own, from hub-main, on every
+* `$process.list` (D452).
+*/
 async function getPidStats$1(pids) {
-	if (pids.length === 0) return /* @__PURE__ */ new Map();
-	return new Promise((resolve) => {
-		execFile("ps", [
-			"-o",
-			"pid=,pcpu=,rss=",
-			"-p",
-			pids.join(",")
-		], { timeout: 5e3 }, (err, stdout) => {
-			const result = /* @__PURE__ */ new Map();
-			if (err || !stdout) {
-				resolve(result);
-				return;
-			}
-			for (const line of stdout.trim().split("\n")) {
-				const parts = line.trim().split(/\s+/);
-				if (parts.length < 3) continue;
-				const pid = parseInt(parts[0], 10);
-				const cpu = parseFloat(parts[1]);
-				const rssKb = parseInt(parts[2], 10);
-				if (!isNaN(pid) && !isNaN(cpu) && !isNaN(rssKb)) result.set(pid, {
-					cpu: Math.round(cpu * 10) / 10,
-					memoryRss: rssKb * 1024
-				});
-			}
-			resolve(result);
-		});
+	const stats = await getPidStats(pids);
+	const result = /* @__PURE__ */ new Map();
+	for (const [pid, s] of stats) result.set(pid, {
+		cpu: s.cpu,
+		memoryRss: s.memory
 	});
+	return result;
 }
 var EMPTY_HEAP_DECLARATION = {
 	profile: void 0,
@@ -95766,4 +95751,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/heap-watch.d.ts

@@ -1,5 +1,7 @@
 import { EventPlaneReader } from './event-plane-report.js';
-import { SocketPlaneReader } from './socket-plane-report.js';
+import { SocketPlaneCounters, SocketPlaneReader } from './socket-plane-report.js';
+import { MeshPeerQueue, MeshQueueReader } from './moleculer/mesh-queue-report.js';
+import { OutboundQueueGateOptions, OutboundQueueReading } from './outbound-queue-watch.js';
 import { HeapSpaceReader } from './heap-spaces.js';
 import { ArrayBufferCensus, ArrayBufferCensusGateOptions } from './array-buffer-census.js';
 /**
@@ -607,6 +609,20 @@ export interface HeapWatchProbes {
      * from the parent's side. Only hub-main and an agent's main pass one.
      */
     readonly socketPlane?: SocketPlaneReader;
+    /**
+     * The write queue of every Moleculer TCP socket to a peer node. No default:
+     * only a process with a broker on a real transporter has one. Those sockets
+     * are UNREF'D by Moleculer, so a sum over `_getActiveHandles()` never listed
+     * them — the hole in the 2026-09-10 exclusion of "every socket queue"
+     * (D446). Read on every probe, judged with the UDS queues below.
+     */
+    readonly meshQueue?: MeshQueueReader;
+    /**
+     * Thresholds for the outbound-queue gate. The gate itself is created
+     * whenever {@link socketPlane} or {@link meshQueue} is given; this only
+     * tunes it (tests, or a process with a different notion of "held").
+     */
+    readonly outboundQueue?: OutboundQueueGateOptions;
     /**
      * The ArrayBuffer census that ARMS ITSELF. No default: it costs a forced
      * full GC when it fires, and only hub-main has an episode on record (two
@@ -622,6 +638,13 @@ export interface HeapWatchProbes {
 export interface ArrayBufferCensusProbe extends ArrayBufferCensusGateOptions {
     readonly census: ArrayBufferCensus;
 }
+/**
+ * Every outbound queue the heartbeat can reach, as the gate wants them: the
+ * UDS children (only those whose channel keeps a reading — an unmeasured
+ * peer is not a zero) and the mesh writer sockets, each prefixed with its
+ * plane.
+ */
+export declare function outboundQueueReadings(uds: SocketPlaneCounters | undefined, mesh: readonly MeshPeerQueue[] | undefined): readonly OutboundQueueReading[];
 /**
  * Start the heartbeat. Returns a stop function.
  *

package/dist/kernel/moleculer/mesh-queue-report.d.ts

@@ -0,0 +1,51 @@
+/**
+ * mesh-queue-report — the write queue of every Moleculer TCP socket this
+ * process holds to a peer node, on the `[mem]` line (D446).
+ *
+ * ## Why a separate reader
+ *
+ * The UDS plane is measured on the channel (`SocketChannel.queuedBytes`). The
+ * mesh plane is Moleculer's: `TcpTransporter.writer` is a `TcpWriter` whose
+ * `sockets` map holds one `net.Socket` per peer node, opened lazily on the
+ * first send and — this is the point — `unref()`'d at connect
+ * (`transporters/tcp/tcp-writer.js`). An unref'd handle is not in
+ * `process._getActiveHandles()`, so the 2026-09-10 census that summed
+ * `writableLength` over that list and excluded "every socket queue" could not
+ * have seen a backlog to an agent, however large.
+ *
+ * ## What is read, and how carefully
+ *
+ * `broker.transit.tx.writer.sockets` — an internal path, walked with type
+ * guards and never a cast. Every step that is not the expected shape yields
+ * `undefined` for the WHOLE reading: a test broker (`Fake` transporter), a
+ * broker that does not exist yet, a Moleculer whose internals moved. `undefined`
+ * is "this process has no mesh writer to report", never "the mesh is quiet".
+ * A socket entry without numeric `writableLength`/`bytesWritten` is skipped
+ * on its own.
+ */
+/** One peer node's outbound socket, as the writer holds it. */
+export interface MeshPeerQueue {
+    readonly nodeId: string;
+    /** Bytes handed to the socket that the kernel has not taken yet. */
+    readonly queuedBytes: number;
+    /** Lifetime bytes written on this socket — so a stalled queue can be read
+     *  against the peer's normal rate. */
+    readonly bytesWritten: number;
+}
+/** `undefined` = no mesh writer to report (no broker, `Fake` transporter). */
+export type MeshQueueReader = () => readonly MeshPeerQueue[] | undefined;
+/**
+ * Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
+ * may throw, and a diagnostic that can crash the process it watches is worse
+ * than none.
+ */
+export declare function createMeshQueueReader(getBroker: () => unknown): MeshQueueReader;
+/** At most this many nodes named. A cluster has a handful. */
+export declare const MESH_QUEUE_TOP_N = 3;
+/**
+ * The suffix appended to a `[mem]` line — leading space included, empty when
+ * this process has no mesh writer. `meshQueued` is printed always, at zero
+ * included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
+ * a queue, largest first — a ranked list of zeros is noise.
+ */
+export declare function formatMeshQueue(peers: readonly MeshPeerQueue[] | undefined): string;

package/dist/kernel/outbound-queue-watch.d.ts

@@ -0,0 +1,94 @@
+/**
+ * outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
+ * release is timestamped (D446).
+ *
+ * ## The blind spot this closes
+ *
+ * On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
+ * (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
+ * forced compaction, with ~4 % of JS heap alongside, and each time released in
+ * one instant with no line from any owner. The investigation excluded "every
+ * socket write queue" by summing `writableLength` over
+ * `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
+ *
+ * `_getActiveHandles()` lists only handles that keep the loop alive. An
+ * UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
+ * unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
+ * `socket.unref()`). So the one outbound plane that writes to another MACHINE
+ * — where a reader that stops draining is the ordinary failure — was never in
+ * the sum. The UDS children were in it, but only as a total, at one instant,
+ * by hand.
+ *
+ * ## What this is
+ *
+ * A pure gate over per-peer queue depths the heartbeat reads on every probe:
+ * the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
+ * the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
+ * nothing else:
+ *
+ *  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
+ *    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
+ *    depth and how long it has held — at most once per
+ *    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
+ *  - a named peer whose queue then falls under half the threshold, or that
+ *    vanishes from the readings (its socket died — which is how a queue is
+ *    dropped in one instant), is reported as RELEASED with its peak and the
+ *    hold, so the release the episodes never logged has a line and a peer;
+ *  - a burst that drains inside the sustain window says nothing. Backpressure
+ *    measures LIVENESS, not identity (D444): a peer momentarily behind is
+ *    coming back.
+ *
+ * ## What it is NOT
+ *
+ * Not a bound. It terminates nothing: a UDS child whose channel is destroyed
+ * loses every in-flight call, and a mesh socket Moleculer reconnects on its
+ * own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
+ * whose client is expendable. Here the line is the deliverable; what to do
+ * about a peer that holds is decided with the peer named, not before.
+ */
+/** 64 MiB. Below this a queue is a burst on a busy peer (the orchestrator's
+ *  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
+ *  retention with a name. */
+export declare const OUTBOUND_QUEUE_THRESHOLD_BYTES: number;
+/** Matches the ArrayBuffer census sustain: a minute above the bound. */
+export declare const OUTBOUND_QUEUE_SUSTAIN_MS = 60000;
+/** A held queue is re-named every ten minutes, not every probe. */
+export declare const OUTBOUND_QUEUE_COOLDOWN_MS: number;
+/** One outbound channel's queue depth at one probe. `peerId` carries its
+ *  plane as a prefix (`uds:<childId>`, `mesh:<nodeId>`). */
+export interface OutboundQueueReading {
+    readonly peerId: string;
+    readonly bytes: number;
+}
+export type OutboundQueueVerdict = {
+    readonly kind: 'sustained';
+    readonly peerId: string;
+    readonly bytes: number;
+    readonly peakBytes: number;
+    readonly heldForMs: number;
+} | {
+    readonly kind: 'released';
+    readonly peerId: string;
+    readonly peakBytes: number;
+    readonly toBytes: number;
+    readonly heldForMs: number;
+    /** The peer left the readings altogether — its socket is gone. */
+    readonly gone: boolean;
+};
+export interface OutboundQueueGateOptions {
+    readonly thresholdBytes?: number;
+    readonly sustainMs?: number;
+    readonly cooldownMs?: number;
+}
+export interface OutboundQueueGate {
+    /** Judge one probe's readings. Every peer is judged on its own. */
+    readonly observe: (readings: readonly OutboundQueueReading[], at: number) => readonly OutboundQueueVerdict[];
+}
+/**
+ * The pure decision — threshold, sustain, cooldown, release, gone — testable
+ * without a socket.
+ */
+export declare function createOutboundQueueGate(options?: OutboundQueueGateOptions): OutboundQueueGate;
+/** The line for one verdict. Both carry the peer, the bytes and the hold;
+ *  the sustained one also says why the older census could not see it. */
+export declare function formatOutboundQueueVerdict(label: string, verdict: OutboundQueueVerdict): string;

package/dist/kernel/socket-plane-report.d.ts

@@ -1,24 +1,52 @@
 import { SocketDirectionSample, SocketTrafficSample } from './transport/socket-traffic.js';
-/** One peer's cumulative traffic, as the channel keeps it. */
+/** One peer's cumulative traffic, as the channel keeps it, plus its outbound
+ *  queue depth at the instant of the read. */
 export interface SocketPeerSample {
     readonly peerId: string;
     readonly tx: SocketDirectionSample;
     readonly rx: SocketDirectionSample;
+    /**
+     * Bytes written to this peer that it has not yet taken — `writableLength`
+     * on the channel, read live (D446). `null` when the channel keeps no such
+     * reading: a measurement that failed is null, never 0 (D393), and the
+     * window counts it as unmeasured rather than as empty.
+     */
+    readonly queuedBytes: number | null;
 }
 /** What `LocalChildRegistry` exposes, structurally — the kernel's heartbeat
  *  must not depend on the transport layer's class. */
 export interface SocketPlaneRegistryChild {
     readonly childId: string;
 }
+/**
+ * How many child→sibling cap calls the parent forwarded without reading
+ * their args (`raw`) against how many it decoded — see
+ * `transport/local-child-registry.ts` `ForwardCensus`. Cumulative on the
+ * registry; a delta on the window.
+ */
+export interface SocketForwardCensus {
+    readonly raw: number;
+    readonly decoded: number;
+}
 export interface SocketPlaneRegistry {
     readonly listChildren: () => readonly SocketPlaneRegistryChild[];
     readonly getChildSocketTraffic: (childId: string) => SocketTrafficSample | null;
+    /** Live outbound queue depth to one child, or `null` when unmeasured. */
+    readonly getChildQueuedBytes: (childId: string) => number | null;
+    /**
+     * The raw-forward census, when the registry keeps one. OPTIONAL: a registry
+     * that predates raw-forward has no such number, and the line must then omit
+     * the field rather than print a zero that reads as "nothing was forwarded".
+     */
+    readonly readForwardCensus?: () => SocketForwardCensus;
 }
 /** One cumulative reading of every measured peer. */
 export interface SocketPlaneCounters {
     readonly peers: readonly SocketPeerSample[];
     /** Connected children, INCLUDING any whose channel keeps no counters. */
     readonly peersConnected: number;
+    /** Cumulative forward census, absent when the registry keeps none. */
+    readonly forward?: SocketForwardCensus;
 }
 /** `undefined` = this process has no local socket plane to report (every forked
  *  runner, and hub-main before the registry exists). */
@@ -57,6 +85,23 @@ export interface SocketPeerDelta {
     readonly tx: SocketDirectionSample;
     readonly rx: SocketDirectionSample;
 }
+/** One peer holding an outbound queue at the instant of the read. */
+export interface SocketPeerQueue {
+    readonly peerId: string;
+    readonly bytes: number;
+}
+/**
+ * The outbound queues at the instant of the read — NOT a delta: a queue is a
+ * level, and the level is the reading (D446).
+ */
+export interface SocketQueueReading {
+    /** Summed over every peer with a reading. */
+    readonly totalBytes: number;
+    /** Peers whose channel keeps no queue reading. Never folded into the total. */
+    readonly unmeasured: number;
+    /** Peers holding a queue, largest first, at most {@link SOCKET_QUEUE_TOP_N}. */
+    readonly top: readonly SocketPeerQueue[];
+}
 /** The whole plane over one heartbeat window. */
 export interface SocketPlaneWindow {
     readonly peersConnected: number;
@@ -67,10 +112,31 @@ export interface SocketPlaneWindow {
     readonly rx: SocketDirectionSample;
     /** Busiest first (tx+rx messages), at most {@link SOCKET_PLANE_TOP_N}. */
     readonly top: readonly SocketPeerDelta[];
+    /**
+     * Heaviest first (tx+rx BYTES), at most {@link SOCKET_PLANE_TOP_N}.
+     *
+     * A separate ranking rather than a replacement, because the two questions
+     * have different answers and both are live: `top` names the peer paying for
+     * round trips (`audio-codec` at 8 379 calls/min of small frames), `topBytes`
+     * names the peer paying for copies and GC. A peer that moves FEW, HUGE
+     * frames is absent from `top` by construction — measured 2026-09-11, the
+     * five peers named by messages left 116 MB/min of hub-main's outbound bytes
+     * with no name on them (D454).
+     */
+    readonly topBytes: readonly SocketPeerDelta[];
+    readonly queued: SocketQueueReading;
+    /** Forwards in this window, absent when the registry keeps no census. */
+    readonly forward?: SocketForwardCensus;
 }
+/** How many queue-holding peers get named. Three: a queue is an exception,
+ *  and the line already carries five names for traffic. */
+export declare const SOCKET_QUEUE_TOP_N = 3;
+/** The queue reading over the current counters — a level, so no baseline. */
+export declare function readSocketQueues(current: SocketPlaneCounters): SocketQueueReading;
 /** Previous cumulative reading, kept between lines. */
 export interface SocketPlaneBaseline {
     readonly peers: ReadonlyMap<string, SocketPeerSample>;
+    readonly forward?: SocketForwardCensus;
 }
 /** A process that has never read the plane. */
 export declare const EMPTY_SOCKET_PLANE_BASELINE: SocketPlaneBaseline;
@@ -92,8 +158,13 @@ export declare function createSocketPlaneMeter(reader: SocketPlaneReader, topN?:
  * is the only way to see an unmeasured channel, and the per-kind splits because
  * "the plane went quiet for a minute" is a reading.
  *
- * `socketTop` is the one conditional field — a ranked list of nothing is noise —
- * and it is a single comma-separated value so the field COUNT does not change
- * from line to line.
+ * `socketTop` is a conditional field — a ranked list of nothing is noise — and
+ * it is a single comma-separated value so the field COUNT does not change from
+ * line to line.
+ *
+ * `socketTopBytes` is the other one, and its PRESENCE is the reading: it is
+ * printed only when ranking by bytes names a peer that ranking by messages
+ * does not. A line without it says the two rankings agree; a line with it says
+ * a peer is moving few, heavy frames and names it (D454).
  */
 export declare function formatSocketPlane(window: SocketPlaneWindow | undefined): string;

package/dist/kernel/transport/cap-routing-hints.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The routing facts a parent reads OUT OF a cap call's args.
+ *
+ * `LocalChildRegistry` routes a child's `cap-call-out` on two things it used
+ * to read straight out of `args`: an inline `nodeId` (the historical per-call
+ * node pin — `extractNodeId`) and an `addonId` selector on a collection cap
+ * (`addonPinOf`). Under raw-forward the parent never decodes `args`, so the
+ * SENDER lifts those two fields into the envelope, and the parent routes on
+ * the lifted copy in both modes — one code path, whichever way the args
+ * travelled.
+ *
+ * Only top-level string fields are lifted, which is exactly what the two
+ * readers ever looked at. Nothing else about the args is visible to the
+ * parent under raw-forward, and that is the point.
+ */
+export interface CapRoutingHints {
+    readonly nodeId?: string;
+    readonly addonId?: string;
+}
+/** Lift {@link CapRoutingHints} from a call's args. Never throws. */
+export declare function liftRoutingHints(args: unknown): CapRoutingHints;

package/dist/kernel/transport/child-cap-protocol.d.ts

@@ -1,4 +1,5 @@
 import { ChildCustomActionCatalogs, CustomActionCaller, IReadinessRegistryRecord, LogLevel, LogTags, SystemEvent } from '@camstack/types';
+import { CapRoutingHints } from './cap-routing-hints.js';
 /**
  * Routing descriptor a child sends so the parent can route cap calls to it.
  * The provider implementation never crosses the wire — only these keys do.
@@ -47,6 +48,22 @@ export interface RegisterMessage {
      * and from a legacy child; absent means "not described yet", never "none".
      */
     readonly customActions?: ChildCustomActionCatalogs;
+    /**
+     * The child can RECEIVE a `cap-call` whose args ride as an opaque payload
+     * beside the envelope (raw-forward), and answer with one. Declared, never
+     * assumed: a parent forwards a payload only to a child that said so, and
+     * decodes it for one that did not. Absent = legacy child = inline args.
+     */
+    readonly rawForward?: true;
+}
+/**
+ * Parent → child answer to `register`. `rawForward` says the parent accepts
+ * a `cap-call-out` whose args ride as a payload — a child packs its args
+ * only after seeing it. Absent = legacy parent = inline args.
+ */
+export interface RegisterAck {
+    readonly ok: true;
+    readonly rawForward?: true;
 }
 /**
  * Child → parent, fire-and-forget: the child's category-pattern subscription
@@ -59,12 +76,21 @@ export interface EventSubUpdateMessage {
     readonly kind: 'event-sub';
     readonly patterns: readonly string[];
 }
-/** Child → parent outbound cap invocation — the child asks the parent to route a cap call it does not own. */
+/**
+ * Child → parent outbound cap invocation — the child asks the parent to route
+ * a cap call it does not own.
+ *
+ * Under raw-forward `args` is ABSENT from the envelope: the packed args ride
+ * as the frame's opaque payload and `hints` carries the two fields the parent
+ * routes on. A legacy child sends `args` inline and no `hints`; the parent
+ * lifts the hints itself. See `cap-routing-hints.ts`.
+ */
 export interface CapCallOutMessage {
     readonly kind: 'cap-call-out';
     readonly capName: string;
     readonly method: string;
-    readonly args: unknown;
+    readonly args?: unknown;
+    readonly hints?: CapRoutingHints;
     readonly deviceId?: number;
     /**
      * Optional per-call node pin (out-of-band; NOT part of the validated method

package/dist/kernel/transport/frame-codec.d.ts

@@ -1,5 +1,54 @@
 /** Encode a value as a length-prefixed (4-byte big-endian) MsgPack frame. */
 export declare function encodeFrame(value: unknown): Buffer;
+/**
+ * The key under which an opaque payload rides on a frame — see
+ * {@link encodeFrameHead}. Short on purpose: it is written once per frame by
+ * hand, and it is the one msgpack key on this plane a decoder must never
+ * interpret.
+ */
+export declare const PAYLOAD_KEY = "pl";
+/**
+ * Encode the HEAD of a frame that carries an opaque payload: the length
+ * prefix, the msgpack envelope with one extra key ({@link PAYLOAD_KEY}), and
+ * the `bin 32` header for the payload — everything but the payload bytes
+ * themselves, which the caller writes straight after it.
+ *
+ * ## Why the payload is the frame's TAIL and not a field
+ *
+ * hub-main routes every sibling↔sibling call. Until this existed it decoded
+ * the whole request (args included), built a new message, and re-encoded it
+ * — walking a 13.5 KB PCM chunk or a 2 000-row settings answer twice on the
+ * one thread that serves every tRPC request, and allocating an `Encoder`
+ * buffer that doubles from 2 KiB up to the body's size on every write
+ * (D441: ~27 % of hub-main's busy time in msgpack decode, ~6 % in encode,
+ * and the churn that fed a 29.5 % GC share).
+ *
+ * With the payload appended as the LAST key of the map, the receiver's
+ * ordinary msgpack decode yields it as a zero-copy VIEW of the frame
+ * (`@msgpack/msgpack` decodes `bin` as `subarray`), the router reads only the
+ * envelope, and forwarding is: encode a ~60-byte head, write it, write the
+ * view. The wire stays plain msgpack — a peer that never heard of payloads
+ * decodes `{ …frame, pl: <bytes> }` and can be told, at register, not to be
+ * sent one.
+ *
+ * ## The one hand-written msgpack in this repository
+ *
+ * `@msgpack/msgpack` has no "encode a map, then append a key" API, so the
+ * envelope is encoded normally and its `fixmap` count byte is bumped by one
+ * before the key and the `bin 32` header are appended. That patch is only
+ * valid for a `fixmap` (≤ 15 keys); a `Frame` has at most four, and anything
+ * else is refused rather than silently corrupted.
+ */
+export declare function encodeFrameHead(frame: Record<string, unknown>, payload: Uint8Array): Buffer;
+/**
+ * Serialise a value into the bytes a payload carries. The SAME options as the
+ * envelope codec, so `undefined` properties are omitted rather than turned
+ * into `null` — a `z.void()` cap output must read back as `undefined` on the
+ * far side exactly as it did when it travelled inline.
+ */
+export declare function packPayload(value: unknown): Uint8Array;
+/** Inverse of {@link packPayload}. A `bin` inside decodes as a view of `bytes`. */
+export declare function unpackPayload(bytes: Uint8Array): unknown;
 /**
  * Reassembles length-prefixed MsgPack frames from a byte stream.
  *

package/dist/kernel/transport/local-child-client.d.ts

@@ -67,6 +67,13 @@ export declare class LocalChildClient {
     private latestCustomActions;
     /** Events and logs queued while the channel is not yet open. */
     private readonly pendingEmits;
+    /**
+     * Whether the parent acknowledged raw-forward at `register`. Until it has,
+     * `callOut` sends args inline exactly as every child always did — a legacy
+     * parent would decode a payload-borne call to `args: undefined` and run the
+     * provider on nothing, silently. Re-read on every re-register.
+     */
+    private parentRawForward;
     /** Handler for parent→child events. Registered via `onEvent`. */
     private eventHandler;
     /**