@camstack/system 1.2.218 → 1.2.219

package/dist/{manifest-system-deps-D--wyMD9.mjs → manifest-system-deps-C7dihwWT.mjs}

@@ -5,12 +5,12 @@ import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, instal
 import { unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { isAbsolute, join } from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import * as fs from "node:fs";
 import { existsSync } from "node:fs";
+import { execFile } from "node:child_process";
 import * as os from "node:os";
 import { tmpdir } from "node:os";
+import { promisify } from "node:util";
 import { createServer } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
@@ -308,12 +308,15 @@ function createSocketPlaneReader(sources) {
 				peers.push({
 					peerId: child.childId,
 					tx: traffic.tx,
-					rx: traffic.rx
+					rx: traffic.rx,
+					queuedBytes: registry.getChildQueuedBytes(child.childId)
 				});
 			}
+			const forward = registry.readForwardCensus?.();
 			return {
 				peers,
-				peersConnected: listed.length
+				peersConnected: listed.length,
+				...forward === void 0 ? {} : { forward }
 			};
 		} catch {
 			return;
@@ -331,8 +334,41 @@ function createSocketPlaneReader(sources) {
 * stops being read.
 */
 var SOCKET_PLANE_TOP_N = 5;
+/** How many queue-holding peers get named. Three: a queue is an exception,
+*  and the line already carries five names for traffic. */
+var SOCKET_QUEUE_TOP_N = 3;
+/** The queue reading over the current counters — a level, so no baseline. */
+function readSocketQueues(current) {
+	let totalBytes = 0;
+	let unmeasured = 0;
+	const holding = [];
+	for (const peer of current.peers) {
+		if (peer.queuedBytes === null) {
+			unmeasured += 1;
+			continue;
+		}
+		totalBytes += peer.queuedBytes;
+		if (peer.queuedBytes > 0) holding.push({
+			peerId: peer.peerId,
+			bytes: peer.queuedBytes
+		});
+	}
+	return {
+		totalBytes,
+		unmeasured,
+		top: holding.toSorted((a, b) => b.bytes - a.bytes || a.peerId.localeCompare(b.peerId)).slice(0, 3)
+	};
+}
 /** A process that has never read the plane. */
 var EMPTY_SOCKET_PLANE_BASELINE = { peers: /* @__PURE__ */ new Map() };
+/** The census over the window; a counter that went backwards reads as quiet. */
+function diffForward(current, before) {
+	if (current === void 0) return void 0;
+	return {
+		raw: Math.max(0, current.raw - (before?.raw ?? 0)),
+		decoded: Math.max(0, current.decoded - (before?.decoded ?? 0))
+	};
+}
 function diffDirection(current, before) {
 	const previous = before ?? EMPTY_SOCKET_DIRECTION;
 	return {
@@ -358,6 +394,14 @@ function addDirection(into, add) {
 function peerMessages(delta) {
 	return socketDirectionMessages(delta.tx) + socketDirectionMessages(delta.rx);
 }
+/**
+* Total bytes a peer moved in the window, both directions — the OTHER
+* ranking, and the one that names a peer the message ranking structurally
+* cannot see (D454).
+*/
+function peerBytes(delta) {
+	return socketDirectionBytes(delta.tx) + socketDirectionBytes(delta.rx);
+}
 /** Subtract the previous cumulative reading from the current one. */
 function diffSocketPlane(baseline, current, topN = 5) {
 	const deltas = [];
@@ -374,12 +418,16 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		rx = addDirection(rx, delta.rx);
 		if (peerMessages(delta) > 0) deltas.push(delta);
 	}
+	const forward = diffForward(current.forward, baseline.forward);
 	return {
 		peersConnected: current.peersConnected,
 		peersMeasured: current.peers.length,
 		tx,
 		rx,
-		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN)
+		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		topBytes: deltas.toSorted((a, b) => peerBytes(b) - peerBytes(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		queued: readSocketQueues(current),
+		...forward === void 0 ? {} : { forward }
 	};
 }
 function createSocketPlaneMeter(reader, topN = 5) {
@@ -388,24 +436,43 @@ function createSocketPlaneMeter(reader, topN = 5) {
 		const current = reader();
 		if (current === void 0) return void 0;
 		const window = diffSocketPlane(baseline, current, topN);
-		baseline = { peers: new Map(current.peers.map((p) => [p.peerId, p])) };
+		baseline = {
+			peers: new Map(current.peers.map((p) => [p.peerId, p])),
+			...current.forward === void 0 ? {} : { forward: current.forward }
+		};
 		return window;
 	} };
 }
 /** Bytes → whole kB. The plane moves 180–330 MB/min; raw bytes would put
 *  nine-digit numbers on a line that has to stay readable. */
-function kb(bytes) {
+function kb$1(bytes) {
 	return Math.round(bytes / 1024);
 }
 /** `req:<msgs>/<kB>,res:<msgs>/<kB>,evt:<msgs>/<kB>` — every kind, always,
 *  including at zero: a kind that went quiet is a reading, not a blank. */
 function formatDirection(sample) {
-	return `req:${sample.reqMessages}/${kb(sample.reqBytes)}kB,res:${sample.resMessages}/${kb(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb(sample.evtBytes)}kB`;
+	return `req:${sample.reqMessages}/${kb$1(sample.reqBytes)}kB,res:${sample.resMessages}/${kb$1(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb$1(sample.evtBytes)}kB`;
 }
-/** `<peer>:tx=<req>/<res>/<evt>:rx=<req>/<res>/<evt>:kB=<tx>/<rx>` — the whole
-*  peer×kind cross for one peer, which is the question in one token. */
+/** `<req>/<res>/<evt>` in kB — the byte triple, in the same order as the
+*  message triple next to it, so the two read as one table. */
+function formatPeerBytes(sample) {
+	return `${kb$1(sample.reqBytes)}/${kb$1(sample.resBytes)}/${kb$1(sample.evtBytes)}`;
+}
+/**
+* `<peer>:tx=<req>/<res>/<evt>:rx=…:txkB=<req>/<res>/<evt>:rxkB=…` — the whole
+* peer×kind cross for one peer, messages and bytes, which is the question in
+* one token.
+*
+* The bytes were a per-direction TOTAL until D454, and the total could not
+* answer the question `socket-traffic.ts` says this instrument exists to
+* settle: whether a peer's bytes are RESPONSES (media, and D9/D18 re-opens) or
+* fan-out (`evt`, which scales with runner count and nothing an operator
+* asked for). On 2026-09-11 hub-main wrote 118 MB in one minute to
+* `hub/pipeline-analytics` and the line could only say "118 MB" — separating
+* `res` from `evt` took an hour of arithmetic against the plane-wide totals.
+*/
 function formatPeer(delta) {
-	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:kB=${kb(socketDirectionBytes(delta.tx))}/${kb(socketDirectionBytes(delta.rx))}`;
+	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:txkB=${formatPeerBytes(delta.tx)}:rxkB=${formatPeerBytes(delta.rx)}`;
 }
 /**
 * The suffix appended to a `[mem]` line — leading space included, empty when
@@ -418,14 +485,234 @@ function formatPeer(delta) {
 * is the only way to see an unmeasured channel, and the per-kind splits because
 * "the plane went quiet for a minute" is a reading.
 *
-* `socketTop` is the one conditional field — a ranked list of nothing is noise —
-* and it is a single comma-separated value so the field COUNT does not change
-* from line to line.
+* `socketTop` is a conditional field — a ranked list of nothing is noise — and
+* it is a single comma-separated value so the field COUNT does not change from
+* line to line.
+*
+* `socketTopBytes` is the other one, and its PRESENCE is the reading: it is
+* printed only when ranking by bytes names a peer that ranking by messages
+* does not. A line without it says the two rankings agree; a line with it says
+* a peer is moving few, heavy frames and names it (D454).
 */
 function formatSocketPlane(window) {
 	if (window === void 0) return "";
 	const top = window.top.map(formatPeer).join(",");
-	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`);
+	const named = new Set(window.top.map((p) => p.peerId));
+	const topBytes = window.topBytes.filter((p) => !named.has(p.peerId)).map(formatPeer).join(",");
+	const queuedTop = window.queued.top.map((p) => `${p.peerId}:${kb$1(p.bytes)}`).join(",");
+	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`);
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-queue-report.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+/** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
+function writerSocketsOf(broker) {
+	if (!isRecord$1(broker)) return void 0;
+	const transit = broker["transit"];
+	if (!isRecord$1(transit)) return void 0;
+	const transporter = transit["tx"];
+	if (!isRecord$1(transporter)) return void 0;
+	const writer = transporter["writer"];
+	if (!isRecord$1(writer)) return void 0;
+	const sockets = writer["sockets"];
+	return sockets instanceof Map ? sockets : void 0;
+}
+function readSocket(nodeId, socket) {
+	if (typeof nodeId !== "string" || !isRecord$1(socket)) return void 0;
+	const queuedBytes = socket["writableLength"];
+	const bytesWritten = socket["bytesWritten"];
+	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
+	return {
+		nodeId,
+		queuedBytes,
+		bytesWritten
+	};
+}
+/**
+* Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
+* may throw, and a diagnostic that can crash the process it watches is worse
+* than none.
+*/
+function createMeshQueueReader(getBroker) {
+	return () => {
+		try {
+			const sockets = writerSocketsOf(getBroker());
+			if (sockets === void 0) return void 0;
+			const peers = [];
+			for (const [nodeId, socket] of sockets) {
+				const peer = readSocket(nodeId, socket);
+				if (peer !== void 0) peers.push(peer);
+			}
+			return peers;
+		} catch {
+			return;
+		}
+	};
+}
+/** At most this many nodes named. A cluster has a handful. */
+var MESH_QUEUE_TOP_N = 3;
+function kb(bytes) {
+	return Math.round(bytes / 1024);
+}
+/**
+* The suffix appended to a `[mem]` line — leading space included, empty when
+* this process has no mesh writer. `meshQueued` is printed always, at zero
+* included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
+* a queue, largest first — a ranked list of zeros is noise.
+*/
+function formatMeshQueue(peers) {
+	if (peers === void 0) return "";
+	const total = peers.reduce((sum, p) => sum + p.queuedBytes, 0);
+	const top = peers.filter((p) => p.queuedBytes > 0).toSorted((a, b) => b.queuedBytes - a.queuedBytes || a.nodeId.localeCompare(b.nodeId)).slice(0, 3).map((p) => `${p.nodeId}:${kb(p.queuedBytes)}`).join(",");
+	return ` meshQueued=${kb(total)}kB` + (top.length === 0 ? "" : ` meshQueuedTop=${top}`);
+}
+//#endregion
+//#region src/kernel/outbound-queue-watch.ts
+/**
+* outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
+* release is timestamped (D446).
+*
+* ## The blind spot this closes
+*
+* On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
+* (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
+* forced compaction, with ~4 % of JS heap alongside, and each time released in
+* one instant with no line from any owner. The investigation excluded "every
+* socket write queue" by summing `writableLength` over
+* `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
+*
+* `_getActiveHandles()` lists only handles that keep the loop alive. An
+* UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
+* unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
+* `socket.unref()`). So the one outbound plane that writes to another MACHINE
+* — where a reader that stops draining is the ordinary failure — was never in
+* the sum. The UDS children were in it, but only as a total, at one instant,
+* by hand.
+*
+* ## What this is
+*
+* A pure gate over per-peer queue depths the heartbeat reads on every probe:
+* the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
+* the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
+* nothing else:
+*
+*  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
+*    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
+*    depth and how long it has held — at most once per
+*    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
+*  - a named peer whose queue then falls under half the threshold, or that
+*    vanishes from the readings (its socket died — which is how a queue is
+*    dropped in one instant), is reported as RELEASED with its peak and the
+*    hold, so the release the episodes never logged has a line and a peer;
+*  - a burst that drains inside the sustain window says nothing. Backpressure
+*    measures LIVENESS, not identity (D444): a peer momentarily behind is
+*    coming back.
+*
+* ## What it is NOT
+*
+* Not a bound. It terminates nothing: a UDS child whose channel is destroyed
+* loses every in-flight call, and a mesh socket Moleculer reconnects on its
+* own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
+* whose client is expendable. Here the line is the deliverable; what to do
+* about a peer that holds is decided with the peer named, not before.
+*/
+/** 64 MiB. Below this a queue is a burst on a busy peer (the orchestrator's
+*  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
+*  retention with a name. */
+var OUTBOUND_QUEUE_THRESHOLD_BYTES = 64 * 1024 * 1024;
+/** Matches the ArrayBuffer census sustain: a minute above the bound. */
+var OUTBOUND_QUEUE_SUSTAIN_MS = 6e4;
+/** A held queue is re-named every ten minutes, not every probe. */
+var OUTBOUND_QUEUE_COOLDOWN_MS = 10 * 6e4;
+/** A release is a fall under this fraction of the threshold. */
+var RELEASE_RATIO = .5;
+/**
+* The pure decision — threshold, sustain, cooldown, release, gone — testable
+* without a socket.
+*/
+function createOutboundQueueGate(options = {}) {
+	const thresholdBytes = options.thresholdBytes ?? 67108864;
+	const sustainMs = options.sustainMs ?? 6e4;
+	const cooldownMs = options.cooldownMs ?? 6e5;
+	const tracked = /* @__PURE__ */ new Map();
+	const judgeOne = (peerId, bytes, at) => {
+		const state = tracked.get(peerId);
+		if (bytes >= thresholdBytes) {
+			const next = state === void 0 ? {
+				aboveSince: at,
+				peakBytes: bytes,
+				lastNamedAt: null
+			} : {
+				...state,
+				peakBytes: Math.max(state.peakBytes, bytes)
+			};
+			const heldForMs = at - next.aboveSince;
+			const due = heldForMs >= sustainMs && (next.lastNamedAt === null || at - next.lastNamedAt >= cooldownMs);
+			tracked.set(peerId, due ? {
+				...next,
+				lastNamedAt: at
+			} : next);
+			return due ? {
+				kind: "sustained",
+				peerId,
+				bytes,
+				peakBytes: next.peakBytes,
+				heldForMs
+			} : void 0;
+		}
+		if (state === void 0) return void 0;
+		if (bytes >= thresholdBytes * RELEASE_RATIO) return void 0;
+		tracked.delete(peerId);
+		if (state.lastNamedAt === null) return void 0;
+		return {
+			kind: "released",
+			peerId,
+			peakBytes: state.peakBytes,
+			toBytes: bytes,
+			heldForMs: at - state.aboveSince,
+			gone: false
+		};
+	};
+	return { observe(readings, at) {
+		const verdicts = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const reading of readings) {
+			seen.add(reading.peerId);
+			const verdict = judgeOne(reading.peerId, reading.bytes, at);
+			if (verdict !== void 0) verdicts.push(verdict);
+		}
+		for (const [peerId, state] of tracked) {
+			if (seen.has(peerId)) continue;
+			tracked.delete(peerId);
+			if (state.lastNamedAt === null) continue;
+			verdicts.push({
+				kind: "released",
+				peerId,
+				peakBytes: state.peakBytes,
+				toBytes: 0,
+				heldForMs: at - state.aboveSince,
+				gone: true
+			});
+		}
+		return verdicts;
+	} };
+}
+var BYTES_PER_MB$1 = 1048576;
+function mb$2(bytes) {
+	return Math.round(bytes / BYTES_PER_MB$1);
+}
+/** `60s` under two minutes, `77m` from there — the hold is read at a glance. */
+function duration(ms) {
+	const seconds = Math.round(ms / 1e3);
+	return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)}m`;
+}
+/** The line for one verdict. Both carry the peer, the bytes and the hold;
+*  the sustained one also says why the older census could not see it. */
+function formatOutboundQueueVerdict(label, verdict) {
+	if (verdict.kind === "sustained") return `[mem] ${label} outbound queue to ${verdict.peerId} has held ${mb$2(verdict.bytes)}MB (peak ${mb$2(verdict.peakBytes)}MB) for ${duration(verdict.heldForMs)} — the peer is not draining what this process writes to it. This is socket.writableLength on the channel itself; a sum over _getActiveHandles() does not list an unref'd socket and would miss it.`;
+	return `[mem] ${label} outbound queue to ${verdict.peerId} RELEASED — ${mb$2(verdict.peakBytes)}MB at peak, ${mb$2(verdict.toBytes)}MB now, held ${duration(verdict.heldForMs)}` + (verdict.gone ? " (peer gone: the socket closed and dropped its queue)" : " (drained)");
 }
 //#endregion
 //#region src/kernel/heap-spaces.ts
@@ -1413,6 +1700,27 @@ function format(label, s, loop, budgetMb, suffix) {
 	return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms${suffix}`;
 }
 /**
+* Every outbound queue the heartbeat can reach, as the gate wants them: the
+* UDS children (only those whose channel keeps a reading — an unmeasured
+* peer is not a zero) and the mesh writer sockets, each prefixed with its
+* plane.
+*/
+function outboundQueueReadings(uds, mesh) {
+	const readings = [];
+	for (const peer of uds?.peers ?? []) {
+		if (peer.queuedBytes === null) continue;
+		readings.push({
+			peerId: `uds:${peer.peerId}`,
+			bytes: peer.queuedBytes
+		});
+	}
+	for (const node of mesh ?? []) readings.push({
+		peerId: `mesh:${node.nodeId}`,
+		bytes: node.queuedBytes
+	});
+	return readings;
+}
+/**
 * Start the heartbeat. Returns a stop function.
 *
 * `unref`ed so it can never hold the process open, and every read is wrapped:
@@ -1526,7 +1834,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()));
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -1535,8 +1843,17 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			checkRssBudget(sample, at);
 			maybeReclaim(sample);
 			judgeArrayBuffers(sample, at);
+			judgeOutboundQueues(at);
 		} catch {}
 	};
+	const meshQueue = probes?.meshQueue;
+	const queueReader = probes?.socketPlane;
+	const queueGate = queueReader === void 0 && meshQueue === void 0 ? void 0 : createOutboundQueueGate(probes?.outboundQueue);
+	const judgeOutboundQueues = (at) => {
+		if (queueGate === void 0) return;
+		const readings = outboundQueueReadings(queueReader?.(), meshQueue?.());
+		for (const verdict of queueGate.observe(readings, at)) sink.warn(formatOutboundQueueVerdict(label, verdict));
+	};
 	const censusProbe = probes?.arrayBufferCensus;
 	const censusGate = censusProbe === void 0 ? void 0 : createArrayBufferCensusGate(censusProbe);
 	let censusInFlight = false;
@@ -5333,6 +5650,74 @@ function encodeFrame(value) {
 	Buffer.from(body.buffer, body.byteOffset, body.byteLength).copy(out, 4);
 	return out;
 }
+/** msgpack `fixstr` of {@link PAYLOAD_KEY}: `0xa0 | length`, then the bytes. */
+var PAYLOAD_KEY_BYTES = Buffer.from([162, ...Buffer.from("pl")]);
+/** msgpack `bin 32` marker: one byte, then a 4-byte big-endian length. */
+var BIN32_MARKER = 198;
+/** msgpack `fixmap` range: `0x80 | count`, count in `0..15`. */
+var FIXMAP_BASE = 128;
+var FIXMAP_MAX_COUNT = 15;
+/**
+* Encode the HEAD of a frame that carries an opaque payload: the length
+* prefix, the msgpack envelope with one extra key ({@link PAYLOAD_KEY}), and
+* the `bin 32` header for the payload — everything but the payload bytes
+* themselves, which the caller writes straight after it.
+*
+* ## Why the payload is the frame's TAIL and not a field
+*
+* hub-main routes every sibling↔sibling call. Until this existed it decoded
+* the whole request (args included), built a new message, and re-encoded it
+* — walking a 13.5 KB PCM chunk or a 2 000-row settings answer twice on the
+* one thread that serves every tRPC request, and allocating an `Encoder`
+* buffer that doubles from 2 KiB up to the body's size on every write
+* (D441: ~27 % of hub-main's busy time in msgpack decode, ~6 % in encode,
+* and the churn that fed a 29.5 % GC share).
+*
+* With the payload appended as the LAST key of the map, the receiver's
+* ordinary msgpack decode yields it as a zero-copy VIEW of the frame
+* (`@msgpack/msgpack` decodes `bin` as `subarray`), the router reads only the
+* envelope, and forwarding is: encode a ~60-byte head, write it, write the
+* view. The wire stays plain msgpack — a peer that never heard of payloads
+* decodes `{ …frame, pl: <bytes> }` and can be told, at register, not to be
+* sent one.
+*
+* ## The one hand-written msgpack in this repository
+*
+* `@msgpack/msgpack` has no "encode a map, then append a key" API, so the
+* envelope is encoded normally and its `fixmap` count byte is bumped by one
+* before the key and the `bin 32` header are appended. That patch is only
+* valid for a `fixmap` (≤ 15 keys); a `Frame` has at most four, and anything
+* else is refused rather than silently corrupted.
+*/
+function encodeFrameHead(frame, payload) {
+	const envelope = encode(frame, ENCODE_OPTIONS);
+	const first = envelope[0];
+	if (envelope.byteLength === 0 || first === void 0 || first < FIXMAP_BASE || first > 142) throw new Error(`encodeFrameHead: envelope must be a msgpack fixmap with at most ${FIXMAP_MAX_COUNT - 1} keys (got leading byte 0x${(first ?? 0).toString(16)})`);
+	const bodyLength = envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5 + payload.byteLength;
+	const head = Buffer.allocUnsafe(HEADER_BYTES + envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5);
+	head.writeUInt32BE(bodyLength, 0);
+	Buffer.from(envelope.buffer, envelope.byteOffset, envelope.byteLength).copy(head, HEADER_BYTES);
+	head[HEADER_BYTES] = first + 1;
+	let at = HEADER_BYTES + envelope.byteLength;
+	PAYLOAD_KEY_BYTES.copy(head, at);
+	at += PAYLOAD_KEY_BYTES.byteLength;
+	head[at] = BIN32_MARKER;
+	head.writeUInt32BE(payload.byteLength, at + 1);
+	return head;
+}
+/**
+* Serialise a value into the bytes a payload carries. The SAME options as the
+* envelope codec, so `undefined` properties are omitted rather than turned
+* into `null` — a `z.void()` cap output must read back as `undefined` on the
+* far side exactly as it did when it travelled inline.
+*/
+function packPayload(value) {
+	return encode(value, ENCODE_OPTIONS);
+}
+/** Inverse of {@link packPayload}. A `bin` inside decodes as a view of `bytes`. */
+function unpackPayload(bytes) {
+	return decode(bytes);
+}
 /** Bytes in the big-endian length prefix that opens every frame. */
 var HEADER_BYTES = 4;
 /**
@@ -5491,6 +5876,25 @@ function localEndpointPath(nodeId) {
 	if (process.platform === "win32") return `\\\\.\\pipe\\camstack-${safe}`;
 	return join(tmpdir(), `camstack-${safe}.sock`);
 }
+//#endregion
+//#region src/kernel/transport/local-transport.ts
+/**
+* An answer that carries an opaque payload beside its body.
+*
+* A CLASS rather than a shape so the channel can tell it from a provider's
+* ordinary `{ body, payload }` return value by identity, never by duck-typing:
+* a cap method is free to return an object with those two keys and it must
+* travel inline like any other. `request()` resolves with one of these only
+* when the peer's `res` frame carried a payload.
+*/
+var PayloadReply = class {
+	body;
+	payload;
+	constructor(body, payload) {
+		this.body = body;
+		this.payload = payload;
+	}
+};
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -5547,7 +5951,7 @@ var SocketChannel = class {
 				k: "req",
 				id,
 				body
-			});
+			}, opts?.payload);
 		});
 	}
 	emit(body) {
@@ -5587,11 +5991,38 @@ var SocketChannel = class {
 			rx: sampleSocketDirection(this.rxCounters)
 		};
 	}
-	send(frame) {
+	/**
+	* Bytes handed to the socket that the kernel has not taken yet — the
+	* `Writable` buffer plus the write in flight. Read LIVE, never cached: this
+	* is the number that says whether the peer is draining what we write, and
+	* it is read on every heartbeat probe (D446). An unref'd socket keeps it
+	* exactly like a ref'd one, which is why it is read here and not summed
+	* over `_getActiveHandles()`.
+	*/
+	queuedBytes() {
+		return this.socket.writableLength;
+	}
+	/**
+	* Write one frame. With a payload the head and the tail are two `write`
+	* calls under `cork()` — the kernel sees one `writev`, and the payload bytes
+	* are never copied into the head. A forwarded payload is a view into the
+	* frame it arrived on, and that frame's buffer is never mutated, so handing
+	* the view to the socket is safe.
+	*/
+	send(frame, payload) {
 		if (this.closed) return;
-		const encoded = encodeFrame(frame);
-		recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
-		this.socket.write(encoded);
+		if (payload === void 0) {
+			const encoded = encodeFrame(frame);
+			recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
+			this.socket.write(encoded);
+			return;
+		}
+		const head = encodeFrameHead(frame, payload);
+		recordSocketFrame(this.txCounters, frame.k, head.byteLength + payload.byteLength);
+		this.socket.cork();
+		this.socket.write(head);
+		this.socket.write(payload);
+		this.socket.uncork();
 	}
 	onData(chunk) {
 		const frames = this.decoder.push(chunk);
@@ -5611,8 +6042,14 @@ var SocketChannel = class {
 		recordSocketFrame(this.rxCounters, frame.k, wireBytes);
 		if (frame.k === "req") {
 			try {
-				const result = await this.requestHandler(frame.body);
-				this.send({
+				const result = await this.requestHandler(frame.body, frame.pl);
+				if (result instanceof PayloadReply) this.send({
+					k: "res",
+					id: frame.id,
+					ok: true,
+					body: result.body
+				}, result.payload);
+				else this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
@@ -5633,8 +6070,9 @@ var SocketChannel = class {
 			if (!p) return;
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
-			if (frame.ok) p.resolve(frame.body);
-			else p.reject(new Error(frame.err));
+			if (!frame.ok) p.reject(new Error(frame.err));
+			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
+			else p.resolve(frame.body);
 			return;
 		}
 		this.eventHandler(frame.body);
@@ -6185,572 +6623,162 @@ function deliverShared(state, event) {
 	}
 }
 //#endregion
-//#region src/kernel/moleculer/resilient-cap-call.ts
-/** Moleculer error `type` values meaning "the service is not (yet) routable". */
-var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-/** Default ceiling for the discovery wait — fail-fast past this. */
-var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
-function isDiscoveryError(err) {
-	if (typeof err !== "object" || err === null) return false;
-	const type = err.type;
-	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+//#region src/kernel/transport/cap-routing-hints.ts
+/** Lift {@link CapRoutingHints} from a call's args. Never throws. */
+function liftRoutingHints(args) {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return {};
+	const nodeId = Reflect.get(args, "nodeId");
+	const addonId = Reflect.get(args, "addonId");
+	return {
+		...typeof nodeId === "string" && nodeId.length > 0 ? { nodeId } : {},
+		...typeof addonId === "string" && addonId.length > 0 ? { addonId } : {}
+	};
+}
+//#endregion
+//#region src/kernel/transport/local-child-registry.ts
+function readFanoutMode() {
+	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
+	if (raw === "shadow" || raw === "broadcast") return raw;
+	return "filter";
 }
 /**
-* Call a Moleculer action; on a service-discovery error, wait for the
-* named service to be discovered and retry the call exactly once.
+* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
+* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
+* prefix to distinguish routing failures (safe to retry via broker) from real
+* provider errors (must NOT retry to avoid double-executing side effects).
 */
-async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
-	try {
-		return await broker.call(action, params, opts);
-	} catch (err) {
-		if (!isDiscoveryError(err)) throw err;
-		await broker.waitForServices([serviceName], discoveryTimeoutMs);
-		return await broker.call(action, params, opts);
+var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+/**
+* Parent-side authority for local addon-runners reachable over a
+* `LocalTransportServer` (UDS). Children register their cap manifest on
+* connect; the registry routes `(capName, deviceId?)` cap calls to the
+* owning child over the channel and drops a child's caps on disconnect.
+*/
+var LocalChildRegistry = class {
+	children = /* @__PURE__ */ new Map();
+	registeredHandler = () => {};
+	goneHandler = () => {};
+	/** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
+	nextIncarnation = 1;
+	eventHandler = null;
+	logHandler = null;
+	readinessHandler = null;
+	server;
+	onUnownedCall;
+	logger;
+	getActiveSingletonAddonId;
+	resolveChildIdForAddon;
+	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
+	ownNodeId;
+	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
+	isAggregatedCollectionMethod;
+	isAddonPinnedCall;
+	/** See {@link ForwardCensus}. Mutable counters on the hot path, by design. */
+	forwardedRaw = 0;
+	forwardedDecoded = 0;
+	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
+	capTimeoutMs;
+	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+	capUsageObserver;
+	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
+	egressRoutedCaps = /* @__PURE__ */ new Set();
+	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
+	fanoutMode = readFanoutMode();
+	/** Per-child event fan-out counters (sent / suppressed). */
+	childEventStats = /* @__PURE__ */ new Map();
+	/** Last pattern-set string logged per child, to dedup the INFO line. */
+	loggedPatternSet = /* @__PURE__ */ new Map();
+	/**
+	* Accepts either a plain positional `server` argument (backward-compatible)
+	* or a full `LocalChildRegistryOptions` object.
+	*
+	* Positional overloads (existing call sites are unchanged):
+	*   new LocalChildRegistry(server)
+	*   new LocalChildRegistry(server, onUnownedCall)
+	*
+	* Options object (new call sites that pass a logger):
+	*   new LocalChildRegistry({ server, onUnownedCall, logger })
+	*/
+	constructor(serverOrOptions, onUnownedCallArg) {
+		if (serverOrOptions && !("listen" in serverOrOptions)) {
+			const opts = serverOrOptions;
+			this.server = opts.server;
+			this.onUnownedCall = opts.onUnownedCall;
+			this.logger = opts.logger;
+			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
+			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
+			this.ownNodeId = opts.ownNodeId;
+			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.isAddonPinnedCall = opts.isAddonPinnedCall;
+			this.capTimeoutMs = opts.capTimeoutMs;
+			this.capUsageObserver = opts.capUsageObserver;
+		} else {
+			this.server = serverOrOptions;
+			this.onUnownedCall = onUnownedCallArg;
+		}
+	}
+	async start() {
+		this.logger?.info("UDS event fan-out mode", { mode: this.fanoutMode });
+		this.server.onConnection((channel) => this.onConnection(channel));
+		await this.server.listen();
 	}
-}
-//#endregion
-//#region src/kernel/transport/cap-route.ts
-function buildMessage(capName, method, detail) {
-	const call = method !== void 0 ? `${capName}.${method}` : capName;
-	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
-	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
-	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
-	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
-}
-var CapRouteError = class extends Error {
-	reason;
-	nodeId;
-	rejected;
 	/**
-	* @param cause  Optional original error that triggered this routing failure.
-	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
-	*               Dispatchers wrapping transport errors MUST pass the original.
+	* Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
+	* child has no recorded events yet. Exposed for the starvation-verification
+	* surface (shadow burn-in + operator debug).
 	*/
-	constructor(capName, method, detail, cause) {
-		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
-		this.name = "CapRouteError";
-		this.reason = detail.reason;
-		this.nodeId = detail.nodeId;
-		this.rejected = detail.rejected;
+	getChildEventStats(childId) {
+		const s = this.childEventStats.get(childId);
+		return s === void 0 ? null : {
+			sent: s.sent,
+			suppressed: s.suppressed
+		};
 	}
-};
-/**
-* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
-*
-* Precedence (explicit nodeId path):
-*   1. hub-in-process — hub node + hubInProcessProvides
-*   2. hub-local-uds  — hub node + hubLocalChildProvides
-*   3. node-offline   → CapRouteError{reason:'node-offline'}
-*   4. agent-child-forward — node is an agent AND nodeKnowsCap
-*   5. remote-moleculer — any other online non-agent node
-*
-* Singleton path (no nodeId):
-*   1. hub-in-process (hub provides in-process)
-*   2. hub-local-uds  (a hub-local UDS child provides it)
-*   3. remote-moleculer (any online, non-hub node that knows it)
-*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
-*
-* PURE: no side effects, no async, no broker/registry imports.
-*/
-function classifyCapRoute(capName, opts, snapshot) {
-	const rejected = [];
-	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
-	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
-}
-function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
-	if (nodeId === snap.hubNodeId) {
-		const residentProvides = snap.hubResidentProvides;
-		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
-		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
-		if (providesOnHub(capName)) {
-			const ref = getRef?.(capName) ?? null;
-			if (ref !== null) return {
-				kind: "hub-in-process",
-				capName,
-				ref
-			};
-			rejected.push({
-				kind: "hub-in-process",
-				why: "provider ref not available in snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		if (snap.hubLocalChildProvides(capName, deviceId)) {
-			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-			if (childId !== null) return {
-				kind: "hub-local-uds",
-				capName,
-				childId
-			};
-			rejected.push({
-				kind: "hub-local-uds",
-				why: "child id not resolvable from snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		rejected.push({
-			kind: "hub-in-process",
-			why: "hub does not provide this cap in-process"
-		});
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "no hub-local child provides this cap"
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
-	}
-	if (!snap.nodeOnline(nodeId)) {
-		rejected.push({
-			kind: "remote-moleculer",
-			why: `node ${nodeId} is offline`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "node-offline",
-			nodeId,
-			rejected
-		});
+	/**
+	* This child's socket traffic — bytes and messages, both directions, split by
+	* frame kind — or `null` when the child is gone or its channel keeps no
+	* counters (an in-process or test transport).
+	*
+	* The event counters above cover ONE kind of frame and, once surfaced on
+	* 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
+	* is the same question asked of every frame the channel moves, and it is the
+	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
+	* pair for the whole process and has no per-socket breakdown.
+	*/
+	getChildSocketTraffic(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.readTraffic?.() ?? null;
 	}
-	if (snap.nodeIsAgent(nodeId)) {
-		if (snap.nodeKnowsCap(nodeId, capName)) return {
-			kind: "agent-child-forward",
-			capName,
-			agentNodeId: nodeId,
-			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
-		};
-		rejected.push({
-			kind: "agent-child-forward",
-			why: `agent ${nodeId} does not know cap ${capName}`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
+	/**
+	* Bytes this process has written to a child that the child has not yet
+	* taken, live, or `null` when the channel keeps no such reading. Read on
+	* every heartbeat probe (D446) — a child that stops draining is the shape
+	* of an outbound-queue episode, and the number lives on the channel.
+	*/
+	getChildQueuedBytes(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.queuedBytes?.() ?? null;
 	}
-	return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-}
-function classifySingleton(capName, deviceId, snap, rejected) {
-	if (snap.hubInProcessProvides(capName)) {
-		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-		if (ref !== null) return {
-			kind: "hub-in-process",
-			capName,
-			ref
-		};
-		rejected.push({
-			kind: "hub-in-process",
-			why: "provider ref not available in snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-in-process",
-		why: "hub does not provide this cap in-process"
-	});
-	if (snap.hubLocalChildProvides(capName, deviceId)) {
-		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId !== null) return {
-			kind: "hub-local-uds",
-			capName,
-			childId
+	/** Cumulative {@link ForwardCensus} of this parent's `cap-call-out` routing. */
+	readForwardCensus() {
+		return {
+			raw: this.forwardedRaw,
+			decoded: this.forwardedDecoded
 		};
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "child id not resolvable from snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-local-uds",
-		why: "no hub-local child provides this cap"
-	});
-	const knownNodes = snap.listKnownNodeIds?.() ?? [];
-	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-	rejected.push({
-		kind: "remote-moleculer",
-		why: "no online remote node knows this cap"
-	});
-	throw new CapRouteError(capName, void 0, {
-		reason: "no-provider",
-		rejected
-	});
-}
-//#endregion
-//#region src/kernel/transport/cap-route-resolver.ts
-/** The Moleculer service name that Task 6's agent registers. */
-var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
-/** The Moleculer action (service.action) for agent cap forwarding. */
-var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
-/** Default timeout for remote Moleculer cap calls (ms). */
-var REMOTE_CALL_TIMEOUT_MS = 6e4;
-function extractDeviceId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "deviceId");
-	return typeof raw === "number" ? raw : void 0;
-}
-/**
-* Extract an inline `nodeId` string from a cap call's args — the per-call node
-* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
-* device-scoped caps carry `deviceId`, and the way the generated cap-router on
-* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
-*
-* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
-* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
-* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
-* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
-* methods that don't declare `nodeId` simply ignore the extra field (they
-* destructure the fields they need); methods that DO declare it (e.g.
-* `getEngineProvisioning({nodeId})`) still receive it unchanged.
-*/
-function extractNodeId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "nodeId");
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
-/**
-* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
-* destructures what it needs and ignores the rest" convention
-* {@link extractNodeId} already relies on for the inline `nodeId` pin.
-* `undefined` (the overwhelmingly common case: no caller hint, or the census
-* consuming it is disarmed) returns `args` unchanged — no allocation. A
-* non-object `args` (or `null`/array) is returned unchanged too: there is
-* nowhere to attach an extra key without changing the payload's shape, and a
-* provider taking a bare value never reads `callerAddonId` off it anyway.
-*/
-function withCallerAddonId(args, callerAddonId) {
-	if (callerAddonId === void 0) return args;
-	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
-	return {
-		...args,
-		callerAddonId
-	};
-}
-var CapRouteResolver = class {
-	hubNodeId;
-	broker;
-	hubLocalRegistry;
-	nodeAuthority;
-	inProcessProviders;
-	hubResidentProviders;
-	capTimeoutMs;
-	snapshot;
-	constructor(deps) {
-		this.hubNodeId = deps.hubNodeId;
-		this.broker = deps.broker;
-		this.hubLocalRegistry = deps.hubLocalRegistry;
-		this.nodeAuthority = deps.nodeAuthority;
-		this.inProcessProviders = deps.inProcessProviders;
-		this.hubResidentProviders = deps.hubResidentProviders;
-		this.capTimeoutMs = deps.capTimeoutMs;
-		this.snapshot = this.buildSnapshot();
-	}
-	/** Per-call RPC timeout: the cap method's declared override, else the default. */
-	callTimeout(capName, method) {
-		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
-	}
-	resolveCapRoute(capName, opts) {
-		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
-	* child, IGNORING any in-hub provider registered for the same cap name.
-	*
-	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
-	* provider (e.g. a wrapper) is registered for the cap, the route always
-	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
-	* reached. That is correct for the generic dispatch path (the wrapper is the
-	* active provider), but WRONG for the native-cap fallback
-	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
-	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
-	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
-	* itself, the native is never invoked, and the wrapper silently falls
-	* through to its secondary strategy.
+	* The regime the counters above were produced under, read once from
+	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
 	*
-	* This method consults ONLY the hub-local-child authority
-	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
-	* it returns the native child route regardless of any in-process shadow.
-	* Returns null when no hub-local child owns `(capName, deviceId)` — the
-	* caller then falls through to its remote-resolution branch.
+	* A suppressed count means "nothing WAS dropped" under `filter` and "nothing
+	* WOULD have been dropped" under `shadow`. Those are different claims, and
+	* until this getter existed the mode was invisible at runtime — the counters
+	* were readable and the regime that produced them was not.
 	*/
-	resolveHubLocalUdsRoute(capName, deviceId) {
-		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
-		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId === null) return null;
-		return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
-	}
-	/**
-	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
-	*   the addonId of the provider the CALLER already resolved (e.g.
-	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
-	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
-	*   route already encodes the provider in its action name
-	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
-	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
-	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
-	*   `dispatch`.
-	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
-	*   addon that ORIGINATED the call, distinct from `addonId` above (which
-	*   names the resolved PROVIDER, not the caller). Set by
-	*   `onUnownedCall` from `CapCallInput.callerAddonId`
-	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
-	*   the `hub-in-process` branch consumes it — merged into `args` so a
-	*   diagnostic tool deep in that provider (e.g. device-manager's
-	*   fleet-read census) can read it without every provider method changing
-	*   signature, the same "extra field the provider destructures or
-	*   ignores" convention `nodeId` already uses on this path.
-	*/
-	async dispatch(route, method, args, addonId, callerAddonId) {
-		try {
-			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
-		} catch (err) {
-			if (err instanceof CapRouteError) throw err;
-			const nodeId = this.routeNodeId(route);
-			const cause = err instanceof Error ? err : new Error(String(err));
-			throw new CapRouteError(route.capName, method, {
-				reason: "transport-failed",
-				nodeId,
-				rejected: [{
-					kind: route.kind,
-					why: cause.message
-				}]
-			}, cause);
-		}
-	}
-	/**
-	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
-	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
-	*/
-	async dispatchInner(route, method, args, addonId, callerAddonId) {
-		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
-			case "hub-local-uds": {
-				const registry = this.hubLocalRegistry;
-				if (registry === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					rejected: [{
-						kind: "hub-local-uds",
-						why: "UDS registry not available"
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const input = {
-					capName: route.capName,
-					method,
-					args,
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return registry.callCapOnChild(route.childId, input);
-			}
-			case "remote-moleculer": {
-				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
-				if (addonId === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					nodeId: route.nodeId,
-					rejected: [{
-						kind: "remote-moleculer",
-						why: `no addonId known for ${route.nodeId}/${route.capName}`
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
-				const action = capActionName(addonId, route.capName, method, isNative);
-				return callWithServiceDiscovery(this.broker, addonId, action, args, {
-					nodeID: route.nodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
-			case "agent-child-forward": {
-				const deviceId = extractDeviceId(args);
-				const params = {
-					capName: route.capName,
-					method,
-					args,
-					...route.childId !== void 0 ? { childId: route.childId } : {},
-					...deviceId !== void 0 ? { deviceId } : {},
-					...addonId !== void 0 ? { addonId } : {}
-				};
-				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
-					nodeID: route.agentNodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
-		}
-	}
-	buildSnapshot() {
-		const hubLocalRegistry = this.hubLocalRegistry;
-		const nodeAuthority = this.nodeAuthority;
-		const inProcessProviders = this.inProcessProviders;
-		const hubResidentProviders = this.hubResidentProviders;
-		return {
-			hubNodeId: this.hubNodeId,
-			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
-			...hubResidentProviders !== void 0 ? {
-				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
-				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
-			} : {},
-			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
-			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
-			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
-			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
-			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
-			getInProcessProviderRef: (cap) => inProcessProviders(cap),
-			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
-			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
-		};
-	}
-	/** Extract a nodeId string from a route for error reporting, or undefined. */
-	routeNodeId(route) {
-		switch (route.kind) {
-			case "hub-in-process": return this.hubNodeId;
-			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
-			case "remote-moleculer": return route.nodeId;
-			case "agent-child-forward": return route.agentNodeId;
-		}
-	}
-};
-//#endregion
-//#region src/kernel/transport/local-child-registry.ts
-function readFanoutMode() {
-	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
-	if (raw === "shadow" || raw === "broadcast") return raw;
-	return "filter";
-}
-/**
-* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
-* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
-* prefix to distinguish routing failures (safe to retry via broker) from real
-* provider errors (must NOT retry to avoid double-executing side effects).
-*/
-var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
-/**
-* Parent-side authority for local addon-runners reachable over a
-* `LocalTransportServer` (UDS). Children register their cap manifest on
-* connect; the registry routes `(capName, deviceId?)` cap calls to the
-* owning child over the channel and drops a child's caps on disconnect.
-*/
-var LocalChildRegistry = class {
-	children = /* @__PURE__ */ new Map();
-	registeredHandler = () => {};
-	goneHandler = () => {};
-	/** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
-	nextIncarnation = 1;
-	eventHandler = null;
-	logHandler = null;
-	readinessHandler = null;
-	server;
-	onUnownedCall;
-	logger;
-	getActiveSingletonAddonId;
-	resolveChildIdForAddon;
-	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
-	ownNodeId;
-	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
-	isAggregatedCollectionMethod;
-	isAddonPinnedCall;
-	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
-	capTimeoutMs;
-	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
-	capUsageObserver;
-	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
-	egressRoutedCaps = /* @__PURE__ */ new Set();
-	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
-	fanoutMode = readFanoutMode();
-	/** Per-child event fan-out counters (sent / suppressed). */
-	childEventStats = /* @__PURE__ */ new Map();
-	/** Last pattern-set string logged per child, to dedup the INFO line. */
-	loggedPatternSet = /* @__PURE__ */ new Map();
-	/**
-	* Accepts either a plain positional `server` argument (backward-compatible)
-	* or a full `LocalChildRegistryOptions` object.
-	*
-	* Positional overloads (existing call sites are unchanged):
-	*   new LocalChildRegistry(server)
-	*   new LocalChildRegistry(server, onUnownedCall)
-	*
-	* Options object (new call sites that pass a logger):
-	*   new LocalChildRegistry({ server, onUnownedCall, logger })
-	*/
-	constructor(serverOrOptions, onUnownedCallArg) {
-		if (serverOrOptions && !("listen" in serverOrOptions)) {
-			const opts = serverOrOptions;
-			this.server = opts.server;
-			this.onUnownedCall = opts.onUnownedCall;
-			this.logger = opts.logger;
-			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
-			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
-			this.ownNodeId = opts.ownNodeId;
-			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
-			this.isAddonPinnedCall = opts.isAddonPinnedCall;
-			this.capTimeoutMs = opts.capTimeoutMs;
-			this.capUsageObserver = opts.capUsageObserver;
-		} else {
-			this.server = serverOrOptions;
-			this.onUnownedCall = onUnownedCallArg;
-		}
-	}
-	async start() {
-		this.logger?.info("UDS event fan-out mode", { mode: this.fanoutMode });
-		this.server.onConnection((channel) => this.onConnection(channel));
-		await this.server.listen();
-	}
-	/**
-	* Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
-	* child has no recorded events yet. Exposed for the starvation-verification
-	* surface (shadow burn-in + operator debug).
-	*/
-	getChildEventStats(childId) {
-		const s = this.childEventStats.get(childId);
-		return s === void 0 ? null : {
-			sent: s.sent,
-			suppressed: s.suppressed
-		};
-	}
-	/**
-	* This child's socket traffic — bytes and messages, both directions, split by
-	* frame kind — or `null` when the child is gone or its channel keeps no
-	* counters (an in-process or test transport).
-	*
-	* The event counters above cover ONE kind of frame and, once surfaced on
-	* 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
-	* is the same question asked of every frame the channel moves, and it is the
-	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
-	* pair for the whole process and has no per-socket breakdown.
-	*/
-	getChildSocketTraffic(childId) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return null;
-		return entry.channel.readTraffic?.() ?? null;
-	}
-	/**
-	* The regime the counters above were produced under, read once from
-	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
-	*
-	* A suppressed count means "nothing WAS dropped" under `filter` and "nothing
-	* WOULD have been dropped" under `shadow`. Those are different claims, and
-	* until this getter existed the mode was invisible at runtime — the counters
-	* were readable and the regime that produced them was not.
-	*/
-	get eventFanoutMode() {
-		return this.fanoutMode;
+	get eventFanoutMode() {
+		return this.fanoutMode;
 	}
 	/**
 	* Connected children that never declared a subscription pattern set.
@@ -7118,7 +7146,7 @@ var LocalChildRegistry = class {
 				return;
 			}
 		});
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
 			if (msg.kind === "register") {
 				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
@@ -7135,7 +7163,8 @@ var LocalChildRegistry = class {
 					channel,
 					caps: msg.caps,
 					eventPatterns,
-					incarnation
+					incarnation,
+					rawForward: msg.rawForward === true
 				});
 				this.logPatternSet(msg.childId, eventPatterns);
 				this.registeredHandler({
@@ -7144,23 +7173,28 @@ var LocalChildRegistry = class {
 					incarnation,
 					...msg.customActions !== void 0 ? { customActions: msg.customActions } : {}
 				});
-				return { ok: true };
-			}
+				return {
+					ok: true,
+					rawForward: true
+				};
+			}
 			if (msg.kind === "cap-call-out") {
 				const out = msg;
-				const input = {
+				const hints = out.hints ?? liftRoutingHints(out.args);
+				const materialise = () => payload !== void 0 ? unpackPayload(payload) : out.args;
+				const buildInput = () => ({
 					capName: out.capName,
 					method: out.method,
-					args: out.args,
+					args: materialise(),
 					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
 					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {},
 					...out.native === true ? { native: true } : {},
 					...childId !== null ? { callerAddonId: childId } : {}
-				};
-				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
+				});
+				const pinnedNodeId = out.nodeId ?? hints.nodeId;
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
 				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
-				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
+				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, hints) === true;
 				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
 				this.recordCapUsage(childId, target, out.capName, out.method);
 				if (target !== null) {
@@ -7168,9 +7202,27 @@ var LocalChildRegistry = class {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
 					}
-					return this.callCap(input);
+					const entry = this.children.get(target);
+					if (payload !== void 0 && entry !== void 0 && entry.rawForward) {
+						this.forwardedRaw += 1;
+						const forward = {
+							kind: "cap-call",
+							capName: out.capName,
+							method: out.method,
+							args: void 0,
+							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {}
+						};
+						const declared = this.capTimeoutMs?.(out.capName, out.method);
+						return entry.channel.request(forward, {
+							...typeof declared === "number" ? { timeoutMs: declared } : {},
+							payload
+						});
+					}
+					this.forwardedDecoded += 1;
+					return this.callCap(buildInput());
 				}
-				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
+				this.forwardedDecoded += 1;
+				if (this.onUnownedCall !== void 0) return this.onUnownedCall(buildInput());
 				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
 			}
 			if (msg.kind === "readiness-request") return {
@@ -7200,6 +7252,11 @@ var LocalChildRegistry = class {
 };
 //#endregion
 //#region src/kernel/transport/local-child-client.ts
+/** Did the parent's `register` answer say it accepts payload-borne args? */
+function ackAcceptsRawForward(ack) {
+	if (ack === null || typeof ack !== "object") return false;
+	return ack.rawForward === true;
+}
 /**
 * Child side of the local UDS transport. Connects to its parent (hub or
 * agent), registers its cap manifest, and serves parent→child cap calls by
@@ -7255,6 +7312,13 @@ var LocalChildClient = class {
 	latestCustomActions = null;
 	/** Events and logs queued while the channel is not yet open. */
 	pendingEmits = [];
+	/**
+	* Whether the parent acknowledged raw-forward at `register`. Until it has,
+	* `callOut` sends args inline exactly as every child always did — a legacy
+	* parent would decode a payload-borne call to `args: undefined` and run the
+	* provider on nothing, silently. Re-read on every re-register.
+	*/
+	parentRawForward = false;
 	/** Handler for parent→child events. Registered via `onEvent`. */
 	eventHandler = null;
 	/**
@@ -7362,15 +7426,20 @@ var LocalChildClient = class {
 		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
 		const client = createLocalTransport().createClient(this.options.nodeId);
 		const channel = await client.connect();
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
-			if (msg.kind === "cap-call") return this.options.dispatch({
-				capName: msg.capName,
-				method: msg.method,
-				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
-				...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
-			});
+			if (msg.kind === "cap-call") {
+				const args = payload !== void 0 ? unpackPayload(payload) : msg.args;
+				const result = await this.options.dispatch({
+					capName: msg.capName,
+					method: msg.method,
+					args,
+					...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
+					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+				});
+				if (payload !== void 0 && result !== void 0) return new PayloadReply(void 0, packPayload(result));
+				return result;
+			}
 			if (msg.kind === "addon-call") {
 				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
 				return this.addonCallHandler({
@@ -7394,7 +7463,7 @@ var LocalChildClient = class {
 		});
 		const register = this.registerFrame(this.latestCaps);
 		try {
-			await channel.request(register);
+			this.parentRawForward = ackAcceptsRawForward(await channel.request(register));
 		} catch (err) {
 			await client.close();
 			throw err;
@@ -7404,105 +7473,564 @@ var LocalChildClient = class {
 		this.flushPending(channel);
 		for (const cb of this.connectedHandlers) cb();
 	}
-	/** Flush buffered pre-start emits over the now-open channel. */
-	flushPending(channel) {
-		for (const item of this.pendingEmits) channel.emit(item.msg);
-		this.pendingEmits.length = 0;
+	/** Flush buffered pre-start emits over the now-open channel. */
+	flushPending(channel) {
+		for (const item of this.pendingEmits) channel.emit(item.msg);
+		this.pendingEmits.length = 0;
+	}
+	/**
+	* Re-send the cap manifest to the parent, atomically replacing the child's
+	* registered descriptor set. Call this after device-restore so newly
+	* registered native (device-scoped) caps become routable over UDS.
+	*
+	* Safe to call before `start()`: the new set is buffered and `start()` sends
+	* it (device-restore can race ahead of the UDS connect). After `start()`,
+	* the set is sent immediately.
+	*/
+	async updateCaps(caps, customActions) {
+		this.latestCaps = caps;
+		if (customActions !== void 0) this.latestCustomActions = customActions;
+		if (this.channel === null) return;
+		this.parentRawForward = ackAcceptsRawForward(await this.channel.request(this.registerFrame(caps)));
+	}
+	/**
+	* The register frame: caps, plus everything a re-register must atomically
+	* re-carry so no separate re-sync can be missed — the subscription union
+	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
+	* custom-action catalogs (omitted until the init loop produced them).
+	*/
+	registerFrame(caps) {
+		return {
+			kind: "register",
+			childId: this.options.childId,
+			caps,
+			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
+			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {},
+			rawForward: true
+		};
+	}
+	/**
+	* Fire-and-forget: send a system event to the parent for forwarding to the
+	* hub event bus. Safe to call before `start()` — events are buffered and
+	* flushed on connect.
+	*/
+	emitEvent(event) {
+		const msg = {
+			kind: "event",
+			event
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "event",
+			msg
+		});
+	}
+	/**
+	* Fire-and-forget: send a structured log entry to the parent. Safe to call
+	* before `start()` — log entries are buffered and flushed on connect.
+	*/
+	sendLog(entry) {
+		const msg = {
+			kind: "log",
+			...entry
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "log",
+			msg
+		});
+	}
+	/**
+	* Request the current readiness snapshot from the parent. Returns the
+	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
+	* Requires `start()` to have been called; throws with a clear message if not.
+	*/
+	async requestReadinessSnapshot() {
+		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
+		return (await this.channel.request({ kind: "readiness-request" })).records;
+	}
+	/**
+	* Ask the parent to execute a cap call this child does NOT own. The parent
+	* routes to the owning local sibling over UDS, or — if no sibling owns it —
+	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
+	* production). Throws if called before `start()`.
+	*/
+	async callOut(input) {
+		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+		const routing = {
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
+			...input.native === true ? { native: true } : {}
+		};
+		if (this.parentRawForward && input.args !== void 0) {
+			const hints = liftRoutingHints(input.args);
+			const msg = {
+				kind: "cap-call-out",
+				capName: input.capName,
+				method: input.method,
+				...Object.keys(hints).length > 0 ? { hints } : {},
+				...routing
+			};
+			const reply = await this.channel.request(msg, { payload: packPayload(input.args) });
+			return reply instanceof PayloadReply ? unpackPayload(reply.payload) : reply;
+		}
+		const msg = {
+			kind: "cap-call-out",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...routing
+		};
+		return this.channel.request(msg);
+	}
+	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
+	async close() {
+		await this.client?.close();
+		this.client = null;
+		this.channel = null;
+	}
+};
+//#endregion
+//#region src/kernel/transport/cap-route.ts
+function buildMessage(capName, method, detail) {
+	const call = method !== void 0 ? `${capName}.${method}` : capName;
+	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
+	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
+	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
+	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+}
+var CapRouteError = class extends Error {
+	reason;
+	nodeId;
+	rejected;
+	/**
+	* @param cause  Optional original error that triggered this routing failure.
+	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
+	*               Dispatchers wrapping transport errors MUST pass the original.
+	*/
+	constructor(capName, method, detail, cause) {
+		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
+		this.name = "CapRouteError";
+		this.reason = detail.reason;
+		this.nodeId = detail.nodeId;
+		this.rejected = detail.rejected;
+	}
+};
+/**
+* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
+*
+* Precedence (explicit nodeId path):
+*   1. hub-in-process — hub node + hubInProcessProvides
+*   2. hub-local-uds  — hub node + hubLocalChildProvides
+*   3. node-offline   → CapRouteError{reason:'node-offline'}
+*   4. agent-child-forward — node is an agent AND nodeKnowsCap
+*   5. remote-moleculer — any other online non-agent node
+*
+* Singleton path (no nodeId):
+*   1. hub-in-process (hub provides in-process)
+*   2. hub-local-uds  (a hub-local UDS child provides it)
+*   3. remote-moleculer (any online, non-hub node that knows it)
+*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
+*
+* PURE: no side effects, no async, no broker/registry imports.
+*/
+function classifyCapRoute(capName, opts, snapshot) {
+	const rejected = [];
+	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
+	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
+}
+function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
+	if (nodeId === snap.hubNodeId) {
+		const residentProvides = snap.hubResidentProvides;
+		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
+		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
+		if (providesOnHub(capName)) {
+			const ref = getRef?.(capName) ?? null;
+			if (ref !== null) return {
+				kind: "hub-in-process",
+				capName,
+				ref
+			};
+			rejected.push({
+				kind: "hub-in-process",
+				why: "provider ref not available in snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		if (snap.hubLocalChildProvides(capName, deviceId)) {
+			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+			if (childId !== null) return {
+				kind: "hub-local-uds",
+				capName,
+				childId
+			};
+			rejected.push({
+				kind: "hub-local-uds",
+				why: "child id not resolvable from snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "hub does not provide this cap in-process"
+		});
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "no hub-local child provides this cap"
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
+	}
+	if (!snap.nodeOnline(nodeId)) {
+		rejected.push({
+			kind: "remote-moleculer",
+			why: `node ${nodeId} is offline`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "node-offline",
+			nodeId,
+			rejected
+		});
+	}
+	if (snap.nodeIsAgent(nodeId)) {
+		if (snap.nodeKnowsCap(nodeId, capName)) return {
+			kind: "agent-child-forward",
+			capName,
+			agentNodeId: nodeId,
+			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+		};
+		rejected.push({
+			kind: "agent-child-forward",
+			why: `agent ${nodeId} does not know cap ${capName}`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
+	}
+	return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+}
+function classifySingleton(capName, deviceId, snap, rejected) {
+	if (snap.hubInProcessProvides(capName)) {
+		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		if (ref !== null) return {
+			kind: "hub-in-process",
+			capName,
+			ref
+		};
+		rejected.push({
+			kind: "hub-in-process",
+			why: "provider ref not available in snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-in-process",
+		why: "hub does not provide this cap in-process"
+	});
+	if (snap.hubLocalChildProvides(capName, deviceId)) {
+		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId !== null) return {
+			kind: "hub-local-uds",
+			capName,
+			childId
+		};
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "child id not resolvable from snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-local-uds",
+		why: "no hub-local child provides this cap"
+	});
+	const knownNodes = snap.listKnownNodeIds?.() ?? [];
+	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+	rejected.push({
+		kind: "remote-moleculer",
+		why: "no online remote node knows this cap"
+	});
+	throw new CapRouteError(capName, void 0, {
+		reason: "no-provider",
+		rejected
+	});
+}
+//#endregion
+//#region src/kernel/moleculer/resilient-cap-call.ts
+/** Moleculer error `type` values meaning "the service is not (yet) routable". */
+var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
+/** Default ceiling for the discovery wait — fail-fast past this. */
+var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
+function isDiscoveryError(err) {
+	if (typeof err !== "object" || err === null) return false;
+	const type = err.type;
+	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+}
+/**
+* Call a Moleculer action; on a service-discovery error, wait for the
+* named service to be discovered and retry the call exactly once.
+*/
+async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
+	try {
+		return await broker.call(action, params, opts);
+	} catch (err) {
+		if (!isDiscoveryError(err)) throw err;
+		await broker.waitForServices([serviceName], discoveryTimeoutMs);
+		return await broker.call(action, params, opts);
+	}
+}
+//#endregion
+//#region src/kernel/transport/cap-route-resolver.ts
+/** The Moleculer service name that Task 6's agent registers. */
+var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
+/** The Moleculer action (service.action) for agent cap forwarding. */
+var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
+/** Default timeout for remote Moleculer cap calls (ms). */
+var REMOTE_CALL_TIMEOUT_MS = 6e4;
+function extractDeviceId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "deviceId");
+	return typeof raw === "number" ? raw : void 0;
+}
+/**
+* Extract an inline `nodeId` string from a cap call's args — the per-call node
+* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
+* device-scoped caps carry `deviceId`, and the way the generated cap-router on
+* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
+*
+* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
+* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
+* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
+* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
+* methods that don't declare `nodeId` simply ignore the extra field (they
+* destructure the fields they need); methods that DO declare it (e.g.
+* `getEngineProvisioning({nodeId})`) still receive it unchanged.
+*/
+function extractNodeId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "nodeId");
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+/**
+* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
+* destructures what it needs and ignores the rest" convention
+* {@link extractNodeId} already relies on for the inline `nodeId` pin.
+* `undefined` (the overwhelmingly common case: no caller hint, or the census
+* consuming it is disarmed) returns `args` unchanged — no allocation. A
+* non-object `args` (or `null`/array) is returned unchanged too: there is
+* nowhere to attach an extra key without changing the payload's shape, and a
+* provider taking a bare value never reads `callerAddonId` off it anyway.
+*/
+function withCallerAddonId(args, callerAddonId) {
+	if (callerAddonId === void 0) return args;
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	return {
+		...args,
+		callerAddonId
+	};
+}
+var CapRouteResolver = class {
+	hubNodeId;
+	broker;
+	hubLocalRegistry;
+	nodeAuthority;
+	inProcessProviders;
+	hubResidentProviders;
+	capTimeoutMs;
+	snapshot;
+	constructor(deps) {
+		this.hubNodeId = deps.hubNodeId;
+		this.broker = deps.broker;
+		this.hubLocalRegistry = deps.hubLocalRegistry;
+		this.nodeAuthority = deps.nodeAuthority;
+		this.inProcessProviders = deps.inProcessProviders;
+		this.hubResidentProviders = deps.hubResidentProviders;
+		this.capTimeoutMs = deps.capTimeoutMs;
+		this.snapshot = this.buildSnapshot();
+	}
+	/** Per-call RPC timeout: the cap method's declared override, else the default. */
+	callTimeout(capName, method) {
+		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
 	}
-	/**
-	* Re-send the cap manifest to the parent, atomically replacing the child's
-	* registered descriptor set. Call this after device-restore so newly
-	* registered native (device-scoped) caps become routable over UDS.
-	*
-	* Safe to call before `start()`: the new set is buffered and `start()` sends
-	* it (device-restore can race ahead of the UDS connect). After `start()`,
-	* the set is sent immediately.
-	*/
-	async updateCaps(caps, customActions) {
-		this.latestCaps = caps;
-		if (customActions !== void 0) this.latestCustomActions = customActions;
-		if (this.channel === null) return;
-		await this.channel.request(this.registerFrame(caps));
+	resolveCapRoute(capName, opts) {
+		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* The register frame: caps, plus everything a re-register must atomically
-	* re-carry so no separate re-sync can be missed — the subscription union
-	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
-	* custom-action catalogs (omitted until the init loop produced them).
+	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
+	* child, IGNORING any in-hub provider registered for the same cap name.
+	*
+	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
+	* provider (e.g. a wrapper) is registered for the cap, the route always
+	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
+	* reached. That is correct for the generic dispatch path (the wrapper is the
+	* active provider), but WRONG for the native-cap fallback
+	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
+	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
+	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
+	* itself, the native is never invoked, and the wrapper silently falls
+	* through to its secondary strategy.
+	*
+	* This method consults ONLY the hub-local-child authority
+	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
+	* it returns the native child route regardless of any in-process shadow.
+	* Returns null when no hub-local child owns `(capName, deviceId)` — the
+	* caller then falls through to its remote-resolution branch.
 	*/
-	registerFrame(caps) {
+	resolveHubLocalUdsRoute(capName, deviceId) {
+		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
+		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId === null) return null;
 		return {
-			kind: "register",
-			childId: this.options.childId,
-			caps,
-			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
-			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {}
-		};
-	}
-	/**
-	* Fire-and-forget: send a system event to the parent for forwarding to the
-	* hub event bus. Safe to call before `start()` — events are buffered and
-	* flushed on connect.
-	*/
-	emitEvent(event) {
-		const msg = {
-			kind: "event",
-			event
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "event",
-			msg
-		});
 	}
 	/**
-	* Fire-and-forget: send a structured log entry to the parent. Safe to call
-	* before `start()` — log entries are buffered and flushed on connect.
+	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
+	*   the addonId of the provider the CALLER already resolved (e.g.
+	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
+	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
+	*   route already encodes the provider in its action name
+	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
+	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
+	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
+	*   `dispatch`.
+	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
+	*   addon that ORIGINATED the call, distinct from `addonId` above (which
+	*   names the resolved PROVIDER, not the caller). Set by
+	*   `onUnownedCall` from `CapCallInput.callerAddonId`
+	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
+	*   the `hub-in-process` branch consumes it — merged into `args` so a
+	*   diagnostic tool deep in that provider (e.g. device-manager's
+	*   fleet-read census) can read it without every provider method changing
+	*   signature, the same "extra field the provider destructures or
+	*   ignores" convention `nodeId` already uses on this path.
 	*/
-	sendLog(entry) {
-		const msg = {
-			kind: "log",
-			...entry
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "log",
-			msg
-		});
+	async dispatch(route, method, args, addonId, callerAddonId) {
+		try {
+			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
+		} catch (err) {
+			if (err instanceof CapRouteError) throw err;
+			const nodeId = this.routeNodeId(route);
+			const cause = err instanceof Error ? err : new Error(String(err));
+			throw new CapRouteError(route.capName, method, {
+				reason: "transport-failed",
+				nodeId,
+				rejected: [{
+					kind: route.kind,
+					why: cause.message
+				}]
+			}, cause);
+		}
 	}
 	/**
-	* Request the current readiness snapshot from the parent. Returns the
-	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
-	* Requires `start()` to have been called; throws with a clear message if not.
+	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
+	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
 	*/
-	async requestReadinessSnapshot() {
-		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
-		return (await this.channel.request({ kind: "readiness-request" })).records;
+	async dispatchInner(route, method, args, addonId, callerAddonId) {
+		switch (route.kind) {
+			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
+			case "hub-local-uds": {
+				const registry = this.hubLocalRegistry;
+				if (registry === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					rejected: [{
+						kind: "hub-local-uds",
+						why: "UDS registry not available"
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const input = {
+					capName: route.capName,
+					method,
+					args,
+					...deviceId !== void 0 ? { deviceId } : {}
+				};
+				return registry.callCapOnChild(route.childId, input);
+			}
+			case "remote-moleculer": {
+				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
+				if (addonId === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					nodeId: route.nodeId,
+					rejected: [{
+						kind: "remote-moleculer",
+						why: `no addonId known for ${route.nodeId}/${route.capName}`
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
+				const action = capActionName(addonId, route.capName, method, isNative);
+				return callWithServiceDiscovery(this.broker, addonId, action, args, {
+					nodeID: route.nodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+			case "agent-child-forward": {
+				const deviceId = extractDeviceId(args);
+				const params = {
+					capName: route.capName,
+					method,
+					args,
+					...route.childId !== void 0 ? { childId: route.childId } : {},
+					...deviceId !== void 0 ? { deviceId } : {},
+					...addonId !== void 0 ? { addonId } : {}
+				};
+				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
+					nodeID: route.agentNodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+		}
 	}
-	/**
-	* Ask the parent to execute a cap call this child does NOT own. The parent
-	* routes to the owning local sibling over UDS, or — if no sibling owns it —
-	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
-	* production). Throws if called before `start()`.
-	*/
-	async callOut(input) {
-		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
-		const msg = {
-			kind: "cap-call-out",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
-			...input.native === true ? { native: true } : {}
+	buildSnapshot() {
+		const hubLocalRegistry = this.hubLocalRegistry;
+		const nodeAuthority = this.nodeAuthority;
+		const inProcessProviders = this.inProcessProviders;
+		const hubResidentProviders = this.hubResidentProviders;
+		return {
+			hubNodeId: this.hubNodeId,
+			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			...hubResidentProviders !== void 0 ? {
+				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
+				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
+			} : {},
+			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
+			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
+			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
+			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
+			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
+			getInProcessProviderRef: (cap) => inProcessProviders(cap),
+			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
+			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
 		};
-		return this.channel.request(msg);
 	}
-	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
-	async close() {
-		await this.client?.close();
-		this.client = null;
-		this.channel = null;
+	/** Extract a nodeId string from a route for error reporting, or undefined. */
+	routeNodeId(route) {
+		switch (route.kind) {
+			case "hub-in-process": return this.hubNodeId;
+			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
+			case "remote-moleculer": return route.nodeId;
+			case "agent-child-forward": return route.agentNodeId;
+		}
 	}
 };
 //#endregion
@@ -10174,4 +10702,4 @@ async function defaultRun(command, args) {
 	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
 }
 //#endregion
-export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, createV8Reclaimer as Bt, ipcParentLink as C, EVENT_PLANE_TOP_N as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, formatEventPlane as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, diffEventPlane as En, HEAP_RECLAIM_TRIGGER_MB as Et, AGENT_CAP_FWD_SERVICE as F, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, hubMainRssBudget as Ht, CapRouteResolver as I, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, CapRouteError as L, buildHeapSample as Lt, LocalChildRegistry as M, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, UDS_NO_ROUTE_PREFIX as N, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, HEAP_WATCH_WARN_RATIO as Ot, AGENT_CAP_FWD_ACTION as P, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, classifyCapRoute as R, createDeferredHeapWatchSink as Rt, buildLinkChain as S, socketDirectionMessages as Sn, runNpm as St, createParentUnownedCallHandler as T, createEventPlaneReader as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, nextRssBudgetState as Ut, CapUsageRegistry as V, describeRss as Vt, getCapUsageRegistry as W, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, EMPTY_SOCKET_DIRECTION as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, sampleSocketDirection as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, EMPTY_SOCKET_PLANE_BASELINE as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, SOCKET_PLANE_TOP_N as fn, parseCapAction as ft, subscribePassthrough as g, formatSocketPlane as gn, CapabilityHandle as gt, setNodeEventInterest as h, diffSocketPlane as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, LocalChildClient as j, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createSocketPlaneReader as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, createSocketPlaneMeter as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, createSocketDirectionCounters as vn, copyBundledNativeModules as vt, localProviderLink as w, createEventPlaneMeter as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, socketDirectionBytes as xn, resolveNpmInvocation as xt, resolveHwAccel as y, recordSocketFrame as yn, installManifestNativeDeps as yt, callWithServiceDiscovery as z, createLoopDelayMeter as zt };
+export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, sampleSocketDirection as An, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, createV8Reclaimer as Bt, ipcParentLink as C, createSocketPlaneReader as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, EMPTY_SOCKET_DIRECTION as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, readSocketQueues as En, HEAP_RECLAIM_TRIGGER_MB as Et, CapRouteError as F, createEventPlaneReader as Fn, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, hubMainRssBudget as Ht, classifyCapRoute as I, diffEventPlane as In, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, LocalChildClient as L, formatEventPlane as Ln, buildHeapSample as Lt, AGENT_CAP_FWD_SERVICE as M, socketDirectionMessages as Mn, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, CapRouteResolver as N, EVENT_PLANE_TOP_N as Nn, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, createSocketDirectionCounters as On, HEAP_WATCH_WARN_RATIO as Ot, callWithServiceDiscovery as P, createEventPlaneMeter as Pn, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, LocalChildRegistry as R, createDeferredHeapWatchSink as Rt, buildLinkChain as S, createSocketPlaneMeter as Sn, runNpm as St, createParentUnownedCallHandler as T, formatSocketPlane as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, nextRssBudgetState as Ut, CapUsageRegistry as V, describeRss as Vt, getCapUsageRegistry as W, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, createMeshQueueReader as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, SOCKET_PLANE_TOP_N as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, OUTBOUND_QUEUE_COOLDOWN_MS as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, OUTBOUND_QUEUE_SUSTAIN_MS as fn, parseCapAction as ft, subscribePassthrough as g, MESH_QUEUE_TOP_N as gn, CapabilityHandle as gt, setNodeEventInterest as h, formatOutboundQueueVerdict as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, AGENT_CAP_FWD_ACTION as j, socketDirectionBytes as jn, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, recordSocketFrame as kn, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createOutboundQueueGate as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, OUTBOUND_QUEUE_THRESHOLD_BYTES as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, formatMeshQueue as vn, copyBundledNativeModules as vt, localProviderLink as w, diffSocketPlane as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, SOCKET_QUEUE_TOP_N as xn, resolveNpmInvocation as xt, resolveHwAccel as y, EMPTY_SOCKET_PLANE_BASELINE as yn, installManifestNativeDeps as yt, UDS_NO_ROUTE_PREFIX as z, createLoopDelayMeter as zt };