@camstack/system 1.2.218 → 1.2.220

package/dist/{manifest-system-deps-Bo92lg5u.js → manifest-system-deps-DfpwaXkh.js}

@@ -6,12 +6,12 @@ let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
-let node_child_process = require("node:child_process");
-let node_util = require("node:util");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
+let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_util = require("node:util");
 let node_http = require("node:http");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);
@@ -155,6 +155,166 @@ function formatEventPlane(window) {
 	return ` fanoutMode=uds:${window.udsMode}/cross-node:${window.crossNodeMode} children=${window.childrenConnected} childrenUndeclared=${window.childrenUndeclared} fanoutSent=${window.fanoutSent} fanoutSuppressed=${window.fanoutSuppressed} crossNodeDelivered=${window.crossNodeDelivered} crossNodeSuppressed=${window.crossNodeSuppressed}` + (top.length === 0 ? "" : ` fanoutTop=${top}`);
 }
 //#endregion
+//#region src/kernel/transport/cap-action-census.ts
+/** A process that has never read the census. */
+var EMPTY_CAP_ACTION_READING = /* @__PURE__ */ new Map();
+/**
+* Bytes that crossed on a frame carrying no cap envelope.
+*
+* Named rather than omitted so the census's coverage is readable off its own
+* output: `register`, `addon-call`, log frames and the event fan-out all land
+* here. A census that reported only what it could name would look like a
+* complete attribution of whatever share it happened to cover.
+*/
+var CAP_ACTION_UNLABELLED = "(unlabelled)";
+/** Bytes of actions past {@link MAX_CAP_ACTIONS_PER_PEER} on one peer. */
+var CAP_ACTION_OVERFLOW_LABEL = "(overflow)";
+/**
+* Distinct named actions kept per peer before the overflow bucket takes over.
+*
+* Sixty-four against a measured worst case of 14 (`pipeline-analytics`, the
+* heaviest peer on this hub, 2026-09-11) — four times the observed shape, so a
+* peer has to change character before it overflows, and a bound that is never
+* reached in practice still forbids the unbounded growth a wire-supplied key
+* makes possible in principle.
+*/
+var MAX_CAP_ACTIONS_PER_PEER = 64;
+/**
+* `<cap>.<method>` for a cap envelope, `null` for anything else.
+*
+* Both directions are labelled by the same function: a child's `cap-call-out`
+* and the parent's `cap-call` carry `capName` + `method` in the same two keys,
+* so one predicate covers the whole plane. Anything else — a `register`, an
+* `addon-call`, a log or an event — is deliberately unlabelled; see
+* {@link CAP_ACTION_UNLABELLED} for where its bytes go.
+*
+* Cost: two property reads, two `typeof`s and one concatenation of two short
+* strings, called once per `req` frame (not per frame). Against the
+* `encodeFrame` it sits beside — 1 948–1 975 ns on a 0.33 kB body — it is
+* noise, and unlike `recordSocketFrame` it is not on the `evt` path at all.
+*/
+function capActionLabel(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const env = body;
+	if (env.kind !== "cap-call" && env.kind !== "cap-call-out") return null;
+	if (typeof env.capName !== "string" || typeof env.method !== "string") return null;
+	return `${env.capName}.${env.method}`;
+}
+function emptyCounters() {
+	return {
+		calls: 0,
+		reqBytes: 0,
+		resBytes: 0,
+		raw: 0,
+		decoded: 0
+	};
+}
+function createCapActionCensus() {
+	const peers = /* @__PURE__ */ new Map();
+	/**
+	* The per-peer slot for `action`, creating it under the bound.
+	*
+	* Past {@link MAX_CAP_ACTIONS_PER_PEER} a NEW label is folded into the
+	* overflow bucket; labels already present keep their own slot, so a peer
+	* that overflows does not lose the attribution it had built.
+	*/
+	const slot = (peerId, action) => {
+		let byAction = peers.get(peerId);
+		if (byAction === void 0) {
+			byAction = /* @__PURE__ */ new Map();
+			peers.set(peerId, byAction);
+		}
+		const existing = byAction.get(action);
+		if (existing !== void 0) return existing;
+		if (byAction.size >= 64) {
+			let overflow = byAction.get(CAP_ACTION_OVERFLOW_LABEL);
+			if (overflow === void 0) {
+				overflow = emptyCounters();
+				byAction.set(CAP_ACTION_OVERFLOW_LABEL, overflow);
+			}
+			return overflow;
+		}
+		const fresh = emptyCounters();
+		byAction.set(action, fresh);
+		return fresh;
+	};
+	return {
+		record(peerId, action, reqBytes, resBytes) {
+			const c = slot(peerId, action);
+			c.calls += 1;
+			c.reqBytes += reqBytes;
+			c.resBytes += resBytes;
+		},
+		recordForward(peerId, action, kind) {
+			const c = slot(peerId, action);
+			if (kind === "raw") c.raw += 1;
+			else c.decoded += 1;
+		},
+		recordUnlabelled(peerId, bytes) {
+			const c = slot(peerId, CAP_ACTION_UNLABELLED);
+			c.resBytes += bytes;
+		},
+		forget(peerId) {
+			peers.delete(peerId);
+		},
+		read() {
+			const out = /* @__PURE__ */ new Map();
+			for (const [peerId, byAction] of peers) {
+				const copy = /* @__PURE__ */ new Map();
+				for (const [action, c] of byAction) copy.set(action, {
+					calls: c.calls,
+					reqBytes: c.reqBytes,
+					resBytes: c.resBytes,
+					raw: c.raw,
+					decoded: c.decoded
+				});
+				out.set(peerId, copy);
+			}
+			return out;
+		}
+	};
+}
+function sampleOf(reading, peerId, action) {
+	return reading.get(peerId)?.get(action);
+}
+/**
+* Subtract the previous reading from the current one.
+*
+* A peer whose runner RESPAWNED reconnects under the same id with counters
+* that went backwards. Clamped at 0, exactly as `diffSocketPlane` clamps for
+* the same reason: its traffic in that window is genuinely unknown, and a
+* negative number on a rate reads as a broken meter.
+*/
+function diffCapActionCensus(before, current, topN) {
+	const deltas = [];
+	let labelledBytes = 0;
+	let totalBytes = 0;
+	for (const [peerId, byAction] of current) for (const [action, now] of byAction) {
+		const then = sampleOf(before, peerId, action);
+		const reqBytes = Math.max(0, now.reqBytes - (then?.reqBytes ?? 0));
+		const resBytes = Math.max(0, now.resBytes - (then?.resBytes ?? 0));
+		const bytes = reqBytes + resBytes;
+		totalBytes += bytes;
+		if (action === "(unlabelled)" || action === "(overflow)") continue;
+		labelledBytes += bytes;
+		if (bytes === 0) continue;
+		deltas.push({
+			peerId,
+			action,
+			calls: Math.max(0, now.calls - (then?.calls ?? 0)),
+			reqBytes,
+			resBytes,
+			raw: Math.max(0, now.raw - (then?.raw ?? 0)),
+			decoded: Math.max(0, now.decoded - (then?.decoded ?? 0))
+		});
+	}
+	return {
+		top: deltas.toSorted((a, b) => b.reqBytes + b.resBytes - (a.reqBytes + a.resBytes) || a.peerId.localeCompare(b.peerId) || a.action.localeCompare(b.action)).slice(0, topN),
+		labelledBytes,
+		totalBytes
+	};
+}
+//#endregion
 //#region src/kernel/transport/socket-traffic.ts
 function createSocketDirectionCounters() {
 	return {
@@ -311,12 +471,17 @@ function createSocketPlaneReader(sources) {
 				peers.push({
 					peerId: child.childId,
 					tx: traffic.tx,
-					rx: traffic.rx
+					rx: traffic.rx,
+					queuedBytes: registry.getChildQueuedBytes(child.childId)
 				});
 			}
+			const forward = registry.readForwardCensus?.();
+			const actions = registry.readActionCensus?.();
 			return {
 				peers,
-				peersConnected: listed.length
+				peersConnected: listed.length,
+				...forward === void 0 ? {} : { forward },
+				...actions === void 0 ? {} : { actions }
 			};
 		} catch {
 			return;
@@ -334,8 +499,41 @@ function createSocketPlaneReader(sources) {
 * stops being read.
 */
 var SOCKET_PLANE_TOP_N = 5;
+/** How many queue-holding peers get named. Three: a queue is an exception,
+*  and the line already carries five names for traffic. */
+var SOCKET_QUEUE_TOP_N = 3;
+/** The queue reading over the current counters — a level, so no baseline. */
+function readSocketQueues(current) {
+	let totalBytes = 0;
+	let unmeasured = 0;
+	const holding = [];
+	for (const peer of current.peers) {
+		if (peer.queuedBytes === null) {
+			unmeasured += 1;
+			continue;
+		}
+		totalBytes += peer.queuedBytes;
+		if (peer.queuedBytes > 0) holding.push({
+			peerId: peer.peerId,
+			bytes: peer.queuedBytes
+		});
+	}
+	return {
+		totalBytes,
+		unmeasured,
+		top: holding.toSorted((a, b) => b.bytes - a.bytes || a.peerId.localeCompare(b.peerId)).slice(0, 3)
+	};
+}
 /** A process that has never read the plane. */
 var EMPTY_SOCKET_PLANE_BASELINE = { peers: /* @__PURE__ */ new Map() };
+/** The census over the window; a counter that went backwards reads as quiet. */
+function diffForward(current, before) {
+	if (current === void 0) return void 0;
+	return {
+		raw: Math.max(0, current.raw - (before?.raw ?? 0)),
+		decoded: Math.max(0, current.decoded - (before?.decoded ?? 0))
+	};
+}
 function diffDirection(current, before) {
 	const previous = before ?? EMPTY_SOCKET_DIRECTION;
 	return {
@@ -361,6 +559,14 @@ function addDirection(into, add) {
 function peerMessages(delta) {
 	return socketDirectionMessages(delta.tx) + socketDirectionMessages(delta.rx);
 }
+/**
+* Total bytes a peer moved in the window, both directions — the OTHER
+* ranking, and the one that names a peer the message ranking structurally
+* cannot see (D454).
+*/
+function peerBytes(delta) {
+	return socketDirectionBytes(delta.tx) + socketDirectionBytes(delta.rx);
+}
 /** Subtract the previous cumulative reading from the current one. */
 function diffSocketPlane(baseline, current, topN = 5) {
 	const deltas = [];
@@ -377,12 +583,18 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		rx = addDirection(rx, delta.rx);
 		if (peerMessages(delta) > 0) deltas.push(delta);
 	}
+	const forward = diffForward(current.forward, baseline.forward);
+	const actions = current.actions === void 0 ? void 0 : diffCapActionCensus(baseline.actions ?? EMPTY_CAP_ACTION_READING, current.actions, 5);
 	return {
 		peersConnected: current.peersConnected,
 		peersMeasured: current.peers.length,
 		tx,
 		rx,
-		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN)
+		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		topBytes: deltas.toSorted((a, b) => peerBytes(b) - peerBytes(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		queued: readSocketQueues(current),
+		...forward === void 0 ? {} : { forward },
+		...actions === void 0 ? {} : { actions }
 	};
 }
 function createSocketPlaneMeter(reader, topN = 5) {
@@ -391,24 +603,62 @@ function createSocketPlaneMeter(reader, topN = 5) {
 		const current = reader();
 		if (current === void 0) return void 0;
 		const window = diffSocketPlane(baseline, current, topN);
-		baseline = { peers: new Map(current.peers.map((p) => [p.peerId, p])) };
+		baseline = {
+			peers: new Map(current.peers.map((p) => [p.peerId, p])),
+			...current.forward === void 0 ? {} : { forward: current.forward },
+			...current.actions === void 0 ? {} : { actions: current.actions }
+		};
 		return window;
 	} };
 }
 /** Bytes → whole kB. The plane moves 180–330 MB/min; raw bytes would put
 *  nine-digit numbers on a line that has to stay readable. */
-function kb(bytes) {
+function kb$1(bytes) {
 	return Math.round(bytes / 1024);
 }
 /** `req:<msgs>/<kB>,res:<msgs>/<kB>,evt:<msgs>/<kB>` — every kind, always,
 *  including at zero: a kind that went quiet is a reading, not a blank. */
 function formatDirection(sample) {
-	return `req:${sample.reqMessages}/${kb(sample.reqBytes)}kB,res:${sample.resMessages}/${kb(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb(sample.evtBytes)}kB`;
+	return `req:${sample.reqMessages}/${kb$1(sample.reqBytes)}kB,res:${sample.resMessages}/${kb$1(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb$1(sample.evtBytes)}kB`;
+}
+/** `<req>/<res>/<evt>` in kB — the byte triple, in the same order as the
+*  message triple next to it, so the two read as one table. */
+function formatPeerBytes(sample) {
+	return `${kb$1(sample.reqBytes)}/${kb$1(sample.resBytes)}/${kb$1(sample.evtBytes)}`;
 }
-/** `<peer>:tx=<req>/<res>/<evt>:rx=<req>/<res>/<evt>:kB=<tx>/<rx>` — the whole
-*  peer×kind cross for one peer, which is the question in one token. */
+/**
+* `<peer>:tx=<req>/<res>/<evt>:rx=…:txkB=<req>/<res>/<evt>:rxkB=…` — the whole
+* peer×kind cross for one peer, messages and bytes, which is the question in
+* one token.
+*
+* The bytes were a per-direction TOTAL until D454, and the total could not
+* answer the question `socket-traffic.ts` says this instrument exists to
+* settle: whether a peer's bytes are RESPONSES (media, and D9/D18 re-opens) or
+* fan-out (`evt`, which scales with runner count and nothing an operator
+* asked for). On 2026-09-11 hub-main wrote 118 MB in one minute to
+* `hub/pipeline-analytics` and the line could only say "118 MB" — separating
+* `res` from `evt` took an hour of arithmetic against the plane-wide totals.
+*/
 function formatPeer(delta) {
-	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:kB=${kb(socketDirectionBytes(delta.tx))}/${kb(socketDirectionBytes(delta.rx))}`;
+	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:txkB=${formatPeerBytes(delta.tx)}:rxkB=${formatPeerBytes(delta.rx)}`;
+}
+/**
+* One named action: `<peer>!<cap>.<method>:<kB>kB/<calls>:r<raw>/d<decoded>`.
+*
+* `!` separates the peer from the action because `.` already separates cap
+* from method and a single delimiter for both would make the token ambiguous
+* to split.
+*
+* The raw/decoded pair is the half that did not exist anywhere before D456.
+* `socketFwd=` answers it for the whole plane — 30 349/5 051 on this hub — and
+* a plane-wide ratio cannot tell a method that is entirely forwarded from one
+* that is entirely decoded, which is the difference between bytes hub-main
+* copies and bytes hub-main reads. The census pays for the two counters it
+* takes; the conclusion they buy is which of the line's megabytes are actually
+* expensive.
+*/
+function formatAction(entry) {
+	return `${entry.peerId}!${entry.action}:${kb$1(entry.reqBytes + entry.resBytes)}kB/${entry.calls}:r${entry.raw}/d${entry.decoded}`;
 }
 /**
 * The suffix appended to a `[mem]` line — leading space included, empty when
@@ -421,14 +671,234 @@ function formatPeer(delta) {
 * is the only way to see an unmeasured channel, and the per-kind splits because
 * "the plane went quiet for a minute" is a reading.
 *
-* `socketTop` is the one conditional field — a ranked list of nothing is noise —
-* and it is a single comma-separated value so the field COUNT does not change
-* from line to line.
+* `socketTop` is a conditional field — a ranked list of nothing is noise — and
+* it is a single comma-separated value so the field COUNT does not change from
+* line to line.
+*
+* `socketTopBytes` is the other one, and its PRESENCE is the reading: it is
+* printed only when ranking by bytes names a peer that ranking by messages
+* does not. A line without it says the two rankings agree; a line with it says
+* a peer is moving few, heavy frames and names it (D454).
 */
 function formatSocketPlane(window) {
 	if (window === void 0) return "";
 	const top = window.top.map(formatPeer).join(",");
-	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`);
+	const named = new Set(window.top.map((p) => p.peerId));
+	const topBytes = window.topBytes.filter((p) => !named.has(p.peerId)).map(formatPeer).join(",");
+	const queuedTop = window.queued.top.map((p) => `${p.peerId}:${kb$1(p.bytes)}`).join(",");
+	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`) + (window.actions === void 0 ? "" : ` socketActions=${kb$1(window.actions.labelledBytes)}/${kb$1(window.actions.totalBytes)}kB` + (window.actions.top.length === 0 ? "" : ` socketTopActions=${window.actions.top.map(formatAction).join(",")}`));
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-queue-report.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+/** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
+function writerSocketsOf(broker) {
+	if (!isRecord$1(broker)) return void 0;
+	const transit = broker["transit"];
+	if (!isRecord$1(transit)) return void 0;
+	const transporter = transit["tx"];
+	if (!isRecord$1(transporter)) return void 0;
+	const writer = transporter["writer"];
+	if (!isRecord$1(writer)) return void 0;
+	const sockets = writer["sockets"];
+	return sockets instanceof Map ? sockets : void 0;
+}
+function readSocket(nodeId, socket) {
+	if (typeof nodeId !== "string" || !isRecord$1(socket)) return void 0;
+	const queuedBytes = socket["writableLength"];
+	const bytesWritten = socket["bytesWritten"];
+	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
+	return {
+		nodeId,
+		queuedBytes,
+		bytesWritten
+	};
+}
+/**
+* Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
+* may throw, and a diagnostic that can crash the process it watches is worse
+* than none.
+*/
+function createMeshQueueReader(getBroker) {
+	return () => {
+		try {
+			const sockets = writerSocketsOf(getBroker());
+			if (sockets === void 0) return void 0;
+			const peers = [];
+			for (const [nodeId, socket] of sockets) {
+				const peer = readSocket(nodeId, socket);
+				if (peer !== void 0) peers.push(peer);
+			}
+			return peers;
+		} catch {
+			return;
+		}
+	};
+}
+/** At most this many nodes named. A cluster has a handful. */
+var MESH_QUEUE_TOP_N = 3;
+function kb(bytes) {
+	return Math.round(bytes / 1024);
+}
+/**
+* The suffix appended to a `[mem]` line — leading space included, empty when
+* this process has no mesh writer. `meshQueued` is printed always, at zero
+* included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
+* a queue, largest first — a ranked list of zeros is noise.
+*/
+function formatMeshQueue(peers) {
+	if (peers === void 0) return "";
+	const total = peers.reduce((sum, p) => sum + p.queuedBytes, 0);
+	const top = peers.filter((p) => p.queuedBytes > 0).toSorted((a, b) => b.queuedBytes - a.queuedBytes || a.nodeId.localeCompare(b.nodeId)).slice(0, 3).map((p) => `${p.nodeId}:${kb(p.queuedBytes)}`).join(",");
+	return ` meshQueued=${kb(total)}kB` + (top.length === 0 ? "" : ` meshQueuedTop=${top}`);
+}
+//#endregion
+//#region src/kernel/outbound-queue-watch.ts
+/**
+* outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
+* release is timestamped (D446).
+*
+* ## The blind spot this closes
+*
+* On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
+* (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
+* forced compaction, with ~4 % of JS heap alongside, and each time released in
+* one instant with no line from any owner. The investigation excluded "every
+* socket write queue" by summing `writableLength` over
+* `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
+*
+* `_getActiveHandles()` lists only handles that keep the loop alive. An
+* UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
+* unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
+* `socket.unref()`). So the one outbound plane that writes to another MACHINE
+* — where a reader that stops draining is the ordinary failure — was never in
+* the sum. The UDS children were in it, but only as a total, at one instant,
+* by hand.
+*
+* ## What this is
+*
+* A pure gate over per-peer queue depths the heartbeat reads on every probe:
+* the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
+* the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
+* nothing else:
+*
+*  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
+*    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
+*    depth and how long it has held — at most once per
+*    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
+*  - a named peer whose queue then falls under half the threshold, or that
+*    vanishes from the readings (its socket died — which is how a queue is
+*    dropped in one instant), is reported as RELEASED with its peak and the
+*    hold, so the release the episodes never logged has a line and a peer;
+*  - a burst that drains inside the sustain window says nothing. Backpressure
+*    measures LIVENESS, not identity (D444): a peer momentarily behind is
+*    coming back.
+*
+* ## What it is NOT
+*
+* Not a bound. It terminates nothing: a UDS child whose channel is destroyed
+* loses every in-flight call, and a mesh socket Moleculer reconnects on its
+* own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
+* whose client is expendable. Here the line is the deliverable; what to do
+* about a peer that holds is decided with the peer named, not before.
+*/
+/** 64 MiB. Below this a queue is a burst on a busy peer (the orchestrator's
+*  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
+*  retention with a name. */
+var OUTBOUND_QUEUE_THRESHOLD_BYTES = 64 * 1024 * 1024;
+/** Matches the ArrayBuffer census sustain: a minute above the bound. */
+var OUTBOUND_QUEUE_SUSTAIN_MS = 6e4;
+/** A held queue is re-named every ten minutes, not every probe. */
+var OUTBOUND_QUEUE_COOLDOWN_MS = 10 * 6e4;
+/** A release is a fall under this fraction of the threshold. */
+var RELEASE_RATIO = .5;
+/**
+* The pure decision — threshold, sustain, cooldown, release, gone — testable
+* without a socket.
+*/
+function createOutboundQueueGate(options = {}) {
+	const thresholdBytes = options.thresholdBytes ?? 67108864;
+	const sustainMs = options.sustainMs ?? 6e4;
+	const cooldownMs = options.cooldownMs ?? 6e5;
+	const tracked = /* @__PURE__ */ new Map();
+	const judgeOne = (peerId, bytes, at) => {
+		const state = tracked.get(peerId);
+		if (bytes >= thresholdBytes) {
+			const next = state === void 0 ? {
+				aboveSince: at,
+				peakBytes: bytes,
+				lastNamedAt: null
+			} : {
+				...state,
+				peakBytes: Math.max(state.peakBytes, bytes)
+			};
+			const heldForMs = at - next.aboveSince;
+			const due = heldForMs >= sustainMs && (next.lastNamedAt === null || at - next.lastNamedAt >= cooldownMs);
+			tracked.set(peerId, due ? {
+				...next,
+				lastNamedAt: at
+			} : next);
+			return due ? {
+				kind: "sustained",
+				peerId,
+				bytes,
+				peakBytes: next.peakBytes,
+				heldForMs
+			} : void 0;
+		}
+		if (state === void 0) return void 0;
+		if (bytes >= thresholdBytes * RELEASE_RATIO) return void 0;
+		tracked.delete(peerId);
+		if (state.lastNamedAt === null) return void 0;
+		return {
+			kind: "released",
+			peerId,
+			peakBytes: state.peakBytes,
+			toBytes: bytes,
+			heldForMs: at - state.aboveSince,
+			gone: false
+		};
+	};
+	return { observe(readings, at) {
+		const verdicts = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const reading of readings) {
+			seen.add(reading.peerId);
+			const verdict = judgeOne(reading.peerId, reading.bytes, at);
+			if (verdict !== void 0) verdicts.push(verdict);
+		}
+		for (const [peerId, state] of tracked) {
+			if (seen.has(peerId)) continue;
+			tracked.delete(peerId);
+			if (state.lastNamedAt === null) continue;
+			verdicts.push({
+				kind: "released",
+				peerId,
+				peakBytes: state.peakBytes,
+				toBytes: 0,
+				heldForMs: at - state.aboveSince,
+				gone: true
+			});
+		}
+		return verdicts;
+	} };
+}
+var BYTES_PER_MB$1 = 1048576;
+function mb$2(bytes) {
+	return Math.round(bytes / BYTES_PER_MB$1);
+}
+/** `60s` under two minutes, `77m` from there — the hold is read at a glance. */
+function duration(ms) {
+	const seconds = Math.round(ms / 1e3);
+	return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)}m`;
+}
+/** The line for one verdict. Both carry the peer, the bytes and the hold;
+*  the sustained one also says why the older census could not see it. */
+function formatOutboundQueueVerdict(label, verdict) {
+	if (verdict.kind === "sustained") return `[mem] ${label} outbound queue to ${verdict.peerId} has held ${mb$2(verdict.bytes)}MB (peak ${mb$2(verdict.peakBytes)}MB) for ${duration(verdict.heldForMs)} — the peer is not draining what this process writes to it. This is socket.writableLength on the channel itself; a sum over _getActiveHandles() does not list an unref'd socket and would miss it.`;
+	return `[mem] ${label} outbound queue to ${verdict.peerId} RELEASED — ${mb$2(verdict.peakBytes)}MB at peak, ${mb$2(verdict.toBytes)}MB now, held ${duration(verdict.heldForMs)}` + (verdict.gone ? " (peer gone: the socket closed and dropped its queue)" : " (drained)");
 }
 //#endregion
 //#region src/kernel/heap-spaces.ts
@@ -852,6 +1322,125 @@ function formatArrayBufferCensus(label, report, context) {
 	return `[mem] ${label} arrayBuffer census: live=${live}MB in ${report.count} ArrayBuffers (raw arrayBuffers=${context.rawMb}MB at the trigger → ${verdict}) top sizes: ${report.topSizes.map(formatExact).join(", ") || "(none)"}; buckets: ${report.buckets.map(formatBucket).join(", ") || "(none)"}; detached=${report.detached} took=${context.tookMs}ms — cost: ONE forced full GC (the same pause as a reclaim pass), walked in memory, nothing serialised, nothing written; trigger: ${context.reason}`;
 }
 //#endregion
+//#region src/kernel/gc-census.ts
+function countsOf(entries, kinds) {
+	let majors = 0;
+	let minors = 0;
+	let incrementals = 0;
+	let pauseMs = 0;
+	for (const e of entries) {
+		if (e.kind === kinds.major) majors++;
+		else if (e.kind === kinds.minor) minors++;
+		else if (e.kind === kinds.incremental) incrementals++;
+		pauseMs += e.durationMs;
+	}
+	return {
+		majors,
+		minors,
+		incrementals,
+		pauseMs,
+		windowMs: 0
+	};
+}
+/**
+* Build a census over an injected observer.
+*
+* Returns `undefined` when the observer cannot be installed — the caller then
+* prints nothing, which is the honest reading. It must never degrade into a
+* census that reports zero collections: a process whose GC is not being
+* observed and a process that is not collecting look identical on the line, and
+* they are the two answers furthest apart.
+*/
+function createGcCensus(install, kinds, startedAt) {
+	let pending = [];
+	const stopObserving = install((entry) => {
+		pending.push(entry);
+	});
+	if (stopObserving === void 0) return void 0;
+	let windowStart = startedAt;
+	return {
+		read: (at) => {
+			const windowMs = at - windowStart;
+			if (windowMs < 1e3) return null;
+			const taken = pending;
+			pending = [];
+			windowStart = at;
+			return {
+				...countsOf(taken, kinds),
+				windowMs
+			};
+		},
+		stop: () => {
+			stopObserving();
+			pending = [];
+		}
+	};
+}
+/**
+* The observer this process actually gets.
+*
+* Everything that can fail is inside the try: a runtime without
+* `perf_hooks`, without the `gc` entry type, or without the kind constants
+* yields `undefined` from `install`, and {@link createGcCensus} then declines
+* to exist rather than reporting zeros.
+*/
+function nodeGcObserver() {
+	return {
+		kinds: readKinds({
+			major: 4,
+			minor: 1,
+			incremental: 8
+		}),
+		install: (observe) => {
+			try {
+				const observer = new (process.getBuiltinModule("node:perf_hooks")).PerformanceObserver((list) => {
+					for (const entry of list.getEntries()) {
+						const detail = "detail" in entry ? entry.detail : void 0;
+						observe({
+							kind: typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1,
+							durationMs: entry.duration
+						});
+					}
+				});
+				observer.observe({ entryTypes: ["gc"] });
+				return () => {
+					observer.disconnect();
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+function readKinds(fallback) {
+	try {
+		const c = process.getBuiltinModule("node:perf_hooks").constants;
+		return {
+			major: c.NODE_PERFORMANCE_GC_MAJOR,
+			minor: c.NODE_PERFORMANCE_GC_MINOR,
+			incremental: c.NODE_PERFORMANCE_GC_INCREMENTAL
+		};
+	} catch {
+		return fallback;
+	}
+}
+/**
+* The two fields, APPENDED LAST on the `[mem]` line.
+*
+* D446's rule: no existing field moves, so every Loki prefix written since
+* 2026-08-29 still matches. `gc=` prints even when nothing was collected — a
+* window with no collections is a reading, and it is the reading that says a
+* process is idle rather than unobserved. `gcPauseMs=` is the MAIN-THREAD
+* pause only; the concurrent marking that cost hub-main 70 % of its CPU is on
+* the platform workers and no in-process counter sees it, which is why the
+* field is named for the thread it describes (D456, part 4).
+*/
+function formatGcCensus(window) {
+	if (window === null || window === void 0) return "";
+	const perMin = (n) => window.windowMs <= 0 ? "?" : (n / (window.windowMs / 6e4)).toFixed(1);
+	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}`;
+}
+//#endregion
 //#region src/kernel/heap-watch.ts
 /**
 * heap-watch — hub-main's own memory, on the record, and returned to the OS.
@@ -1416,6 +2005,27 @@ function format(label, s, loop, budgetMb, suffix) {
 	return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms${suffix}`;
 }
 /**
+* Every outbound queue the heartbeat can reach, as the gate wants them: the
+* UDS children (only those whose channel keeps a reading — an unmeasured
+* peer is not a zero) and the mesh writer sockets, each prefixed with its
+* plane.
+*/
+function outboundQueueReadings(uds, mesh) {
+	const readings = [];
+	for (const peer of uds?.peers ?? []) {
+		if (peer.queuedBytes === null) continue;
+		readings.push({
+			peerId: `uds:${peer.peerId}`,
+			bytes: peer.queuedBytes
+		});
+	}
+	for (const node of mesh ?? []) readings.push({
+		peerId: `mesh:${node.nodeId}`,
+		bytes: node.queuedBytes
+	});
+	return readings;
+}
+/**
 * Start the heartbeat. Returns a stop function.
 *
 * `unref`ed so it can never hold the process open, and every read is wrapped:
@@ -1427,6 +2037,8 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	const socketPlane = probes?.socketPlane === void 0 ? void 0 : createSocketPlaneMeter(probes.socketPlane);
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
+	const gcObserver = probes?.gcObserver ?? nodeGcObserver();
+	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now());
 	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
 	const minIntervalMs = reclaimOptions?.minIntervalMs ?? 12e4;
 	const steadyStateIntervalMs = reclaimOptions?.steadyStateIntervalMs ?? 6e5;
@@ -1529,7 +2141,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()));
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -1538,8 +2150,17 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			checkRssBudget(sample, at);
 			maybeReclaim(sample);
 			judgeArrayBuffers(sample, at);
+			judgeOutboundQueues(at);
 		} catch {}
 	};
+	const meshQueue = probes?.meshQueue;
+	const queueReader = probes?.socketPlane;
+	const queueGate = queueReader === void 0 && meshQueue === void 0 ? void 0 : createOutboundQueueGate(probes?.outboundQueue);
+	const judgeOutboundQueues = (at) => {
+		if (queueGate === void 0) return;
+		const readings = outboundQueueReadings(queueReader?.(), meshQueue?.());
+		for (const verdict of queueGate.observe(readings, at)) sink.warn(formatOutboundQueueVerdict(label, verdict));
+	};
 	const censusProbe = probes?.arrayBufferCensus;
 	const censusGate = censusProbe === void 0 ? void 0 : createArrayBufferCensusGate(censusProbe);
 	let censusInFlight = false;
@@ -1577,6 +2198,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 		stopped = true;
 		clearInterval(timer);
 		loopDelay?.stop();
+		gcCensus?.stop();
 	};
 }
 /**
@@ -5336,6 +5958,74 @@ function encodeFrame(value) {
 	Buffer.from(body.buffer, body.byteOffset, body.byteLength).copy(out, 4);
 	return out;
 }
+/** msgpack `fixstr` of {@link PAYLOAD_KEY}: `0xa0 | length`, then the bytes. */
+var PAYLOAD_KEY_BYTES = Buffer.from([162, ...Buffer.from("pl")]);
+/** msgpack `bin 32` marker: one byte, then a 4-byte big-endian length. */
+var BIN32_MARKER = 198;
+/** msgpack `fixmap` range: `0x80 | count`, count in `0..15`. */
+var FIXMAP_BASE = 128;
+var FIXMAP_MAX_COUNT = 15;
+/**
+* Encode the HEAD of a frame that carries an opaque payload: the length
+* prefix, the msgpack envelope with one extra key ({@link PAYLOAD_KEY}), and
+* the `bin 32` header for the payload — everything but the payload bytes
+* themselves, which the caller writes straight after it.
+*
+* ## Why the payload is the frame's TAIL and not a field
+*
+* hub-main routes every sibling↔sibling call. Until this existed it decoded
+* the whole request (args included), built a new message, and re-encoded it
+* — walking a 13.5 KB PCM chunk or a 2 000-row settings answer twice on the
+* one thread that serves every tRPC request, and allocating an `Encoder`
+* buffer that doubles from 2 KiB up to the body's size on every write
+* (D441: ~27 % of hub-main's busy time in msgpack decode, ~6 % in encode,
+* and the churn that fed a 29.5 % GC share).
+*
+* With the payload appended as the LAST key of the map, the receiver's
+* ordinary msgpack decode yields it as a zero-copy VIEW of the frame
+* (`@msgpack/msgpack` decodes `bin` as `subarray`), the router reads only the
+* envelope, and forwarding is: encode a ~60-byte head, write it, write the
+* view. The wire stays plain msgpack — a peer that never heard of payloads
+* decodes `{ …frame, pl: <bytes> }` and can be told, at register, not to be
+* sent one.
+*
+* ## The one hand-written msgpack in this repository
+*
+* `@msgpack/msgpack` has no "encode a map, then append a key" API, so the
+* envelope is encoded normally and its `fixmap` count byte is bumped by one
+* before the key and the `bin 32` header are appended. That patch is only
+* valid for a `fixmap` (≤ 15 keys); a `Frame` has at most four, and anything
+* else is refused rather than silently corrupted.
+*/
+function encodeFrameHead(frame, payload) {
+	const envelope = encode(frame, ENCODE_OPTIONS);
+	const first = envelope[0];
+	if (envelope.byteLength === 0 || first === void 0 || first < FIXMAP_BASE || first > 142) throw new Error(`encodeFrameHead: envelope must be a msgpack fixmap with at most ${FIXMAP_MAX_COUNT - 1} keys (got leading byte 0x${(first ?? 0).toString(16)})`);
+	const bodyLength = envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5 + payload.byteLength;
+	const head = Buffer.allocUnsafe(HEADER_BYTES + envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5);
+	head.writeUInt32BE(bodyLength, 0);
+	Buffer.from(envelope.buffer, envelope.byteOffset, envelope.byteLength).copy(head, HEADER_BYTES);
+	head[HEADER_BYTES] = first + 1;
+	let at = HEADER_BYTES + envelope.byteLength;
+	PAYLOAD_KEY_BYTES.copy(head, at);
+	at += PAYLOAD_KEY_BYTES.byteLength;
+	head[at] = BIN32_MARKER;
+	head.writeUInt32BE(payload.byteLength, at + 1);
+	return head;
+}
+/**
+* Serialise a value into the bytes a payload carries. The SAME options as the
+* envelope codec, so `undefined` properties are omitted rather than turned
+* into `null` — a `z.void()` cap output must read back as `undefined` on the
+* far side exactly as it did when it travelled inline.
+*/
+function packPayload(value) {
+	return encode(value, ENCODE_OPTIONS);
+}
+/** Inverse of {@link packPayload}. A `bin` inside decodes as a view of `bytes`. */
+function unpackPayload(bytes) {
+	return decode(bytes);
+}
 /** Bytes in the big-endian length prefix that opens every frame. */
 var HEADER_BYTES = 4;
 /**
@@ -5494,6 +6184,25 @@ function localEndpointPath(nodeId) {
 	if (process.platform === "win32") return `\\\\.\\pipe\\camstack-${safe}`;
 	return (0, node_path.join)((0, node_os.tmpdir)(), `camstack-${safe}.sock`);
 }
+//#endregion
+//#region src/kernel/transport/local-transport.ts
+/**
+* An answer that carries an opaque payload beside its body.
+*
+* A CLASS rather than a shape so the channel can tell it from a provider's
+* ordinary `{ body, payload }` return value by identity, never by duck-typing:
+* a cap method is free to return an object with those two keys and it must
+* travel inline like any other. `request()` resolves with one of these only
+* when the peer's `res` frame carried a payload.
+*/
+var PayloadReply = class {
+	body;
+	payload;
+	constructor(body, payload) {
+		this.body = body;
+		this.payload = payload;
+	}
+};
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -5511,6 +6220,8 @@ var SocketChannel = class {
 	txCounters = createSocketDirectionCounters();
 	/** Frames read from the peer, cumulative, split by kind. */
 	rxCounters = createSocketDirectionCounters();
+	/** See {@link CapActionChannelObserver}. Absent = no per-action census. */
+	actionObserver = null;
 	constructor(socket) {
 		this.socket = socket;
 		socket.on("data", (chunk) => this.onData(chunk));
@@ -5541,15 +6252,25 @@ var SocketChannel = class {
 				}, timeoutMs);
 				timer.unref?.();
 			}
+			const label = this.labelSafely(body);
 			this.pending.set(id, {
 				resolve,
 				reject,
-				timer
+				timer,
+				action: null
 			});
-			this.send({
+			const reqBytes = this.send({
 				k: "req",
 				id,
 				body
+			}, opts?.payload);
+			const entry = this.pending.get(id);
+			if (entry !== void 0 && label !== void 0) this.pending.set(id, {
+				...entry,
+				action: {
+					label,
+					reqBytes
+				}
 			});
 		});
 	}
@@ -5560,6 +6281,36 @@ var SocketChannel = class {
 			body
 		});
 	}
+	/**
+	* Wire the per-action census. Only one observer is active at a time; an
+	* unwired channel records nothing at all (never zeros).
+	*/
+	observeActions(observer) {
+		this.actionObserver = observer;
+	}
+	/**
+	* The label for one envelope, or `undefined` when there is nothing to
+	* record. Wrapped: a broken labeller must never fail the call it watches —
+	* the same discipline `LocalChildRegistry.recordCapUsage` applies, and for
+	* the same reason.
+	*/
+	labelSafely(body) {
+		const obs = this.actionObserver;
+		if (obs === null) return void 0;
+		try {
+			return obs.label(body);
+		} catch {
+			return null;
+		}
+	}
+	/** Settle one request/response pair on the census. Never throws. */
+	recordAction(label, reqBytes, resBytes) {
+		const obs = this.actionObserver;
+		if (obs === null) return;
+		try {
+			obs.record(label, reqBytes, resBytes);
+		} catch {}
+	}
 	/** Replace the request handler. Only one handler is active at a time. */
 	onRequest(handler) {
 		this.requestHandler = handler;
@@ -5590,11 +6341,44 @@ var SocketChannel = class {
 			rx: sampleSocketDirection(this.rxCounters)
 		};
 	}
-	send(frame) {
-		if (this.closed) return;
-		const encoded = encodeFrame(frame);
-		recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
-		this.socket.write(encoded);
+	/**
+	* Bytes handed to the socket that the kernel has not taken yet — the
+	* `Writable` buffer plus the write in flight. Read LIVE, never cached: this
+	* is the number that says whether the peer is draining what we write, and
+	* it is read on every heartbeat probe (D446). An unref'd socket keeps it
+	* exactly like a ref'd one, which is why it is read here and not summed
+	* over `_getActiveHandles()`.
+	*/
+	queuedBytes() {
+		return this.socket.writableLength;
+	}
+	/**
+	* Write one frame. With a payload the head and the tail are two `write`
+	* calls under `cork()` — the kernel sees one `writev`, and the payload bytes
+	* are never copied into the head. A forwarded payload is a view into the
+	* frame it arrived on, and that frame's buffer is never mutated, so handing
+	* the view to the socket is safe.
+	*
+	* Returns the on-the-wire bytes it charged — the same number the per-kind
+	* counter got, so the per-action census can never disagree with the per-peer
+	* one. `0` when the channel is closed and nothing was written.
+	*/
+	send(frame, payload) {
+		if (this.closed) return 0;
+		if (payload === void 0) {
+			const encoded = encodeFrame(frame);
+			recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
+			this.socket.write(encoded);
+			return encoded.byteLength;
+		}
+		const head = encodeFrameHead(frame, payload);
+		const bytes = head.byteLength + payload.byteLength;
+		recordSocketFrame(this.txCounters, frame.k, bytes);
+		this.socket.cork();
+		this.socket.write(head);
+		this.socket.write(payload);
+		this.socket.uncork();
+		return bytes;
 	}
 	onData(chunk) {
 		const frames = this.decoder.push(chunk);
@@ -5613,22 +6397,31 @@ var SocketChannel = class {
 	async handleFrame(frame, wireBytes) {
 		recordSocketFrame(this.rxCounters, frame.k, wireBytes);
 		if (frame.k === "req") {
+			const label = this.labelSafely(frame.body);
+			let resBytes = 0;
 			try {
-				const result = await this.requestHandler(frame.body);
-				this.send({
+				const result = await this.requestHandler(frame.body, frame.pl);
+				if (result instanceof PayloadReply) resBytes = this.send({
+					k: "res",
+					id: frame.id,
+					ok: true,
+					body: result.body
+				}, result.payload);
+				else resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
 					body: result
 				});
 			} catch (err) {
-				this.send({
+				resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: false,
 					err: err instanceof Error ? err.message : String(err)
 				});
 			}
+			if (label !== void 0) this.recordAction(label, wireBytes, resBytes);
 			return;
 		}
 		if (frame.k === "res") {
@@ -5636,8 +6429,10 @@ var SocketChannel = class {
 			if (!p) return;
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
-			if (frame.ok) p.resolve(frame.body);
-			else p.reject(new Error(frame.err));
+			if (p.action !== null) this.recordAction(p.action.label, p.action.reqBytes, wireBytes);
+			if (!frame.ok) p.reject(new Error(frame.err));
+			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
+			else p.resolve(frame.body);
 			return;
 		}
 		this.eventHandler(frame.body);
@@ -6188,454 +6983,79 @@ function deliverShared(state, event) {
 	}
 }
 //#endregion
-//#region src/kernel/moleculer/resilient-cap-call.ts
-/** Moleculer error `type` values meaning "the service is not (yet) routable". */
-var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-/** Default ceiling for the discovery wait — fail-fast past this. */
-var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
-function isDiscoveryError(err) {
-	if (typeof err !== "object" || err === null) return false;
-	const type = err.type;
-	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
-}
+//#region src/kernel/transport/cap-child-index.ts
+/** Separator that cannot occur in a kebab cap name, so the key is unambiguous. */
+var DEVICE_KEY_SEPARATOR = "\0";
+var NO_CANDIDATES = Object.freeze([]);
+var MapCapChildIndex = class {
+	deviceOwners;
+	singletons;
+	constructor(deviceOwners, singletons) {
+		this.deviceOwners = deviceOwners;
+		this.singletons = singletons;
+	}
+	deviceOwner(capName, deviceId) {
+		return this.deviceOwners.get(`${capName}${DEVICE_KEY_SEPARATOR}${deviceId}`) ?? null;
+	}
+	singletonCandidates(capName) {
+		return this.singletons.get(capName) ?? NO_CANDIDATES;
+	}
+};
 /**
-* Call a Moleculer action; on a service-discovery error, wait for the
-* named service to be discovered and retry the call exactly once.
-*/
-async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
-	try {
-		return await broker.call(action, params, opts);
-	} catch (err) {
-		if (!isDiscoveryError(err)) throw err;
-		await broker.waitForServices([serviceName], discoveryTimeoutMs);
-		return await broker.call(action, params, opts);
+* Build the `(cap, device?) → child` index from the connected children.
+*
+* A PURE function of what it is handed — it captures nothing, subscribes to
+* nothing and cannot be updated in place. That is the whole safety argument
+* (D3, D457): the only way to change what it says is to build a new one from
+* the `children` map, so an index can never name a child that map has already
+* dropped. An incremental index — add on register, remove on close — would be
+* a second registry that can disagree with the first, and a stale one routes
+* to a dead runner, which is strictly worse than a slow scan.
+*
+* Cost: O(children × descriptors), paid once per mutation of the children map
+* (a register, a re-register, a disconnect) rather than once per cap call.
+*
+* The two tiers stay separate, exactly as the scan had them: a device lookup
+* is never answered from a deviceId-less descriptor. `resolveChildId` owns
+* the fallback from tier 1 to tier 2, and folding it in here would make it
+* unreachable.
+*/
+function buildCapChildIndex(entries) {
+	const deviceOwners = /* @__PURE__ */ new Map();
+	const singletons = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const namedForThisChild = /* @__PURE__ */ new Set();
+		for (const cap of entry.caps) {
+			if (cap.deviceId === void 0) {
+				if (namedForThisChild.has(cap.capName)) continue;
+				namedForThisChild.add(cap.capName);
+				const candidates = singletons.get(cap.capName);
+				if (candidates === void 0) singletons.set(cap.capName, [entry.childId]);
+				else candidates.push(entry.childId);
+				continue;
+			}
+			const key = `${cap.capName}${DEVICE_KEY_SEPARATOR}${cap.deviceId}`;
+			if (!deviceOwners.has(key)) deviceOwners.set(key, entry.childId);
+		}
 	}
+	return new MapCapChildIndex(deviceOwners, singletons);
 }
 //#endregion
-//#region src/kernel/transport/cap-route.ts
-function buildMessage(capName, method, detail) {
-	const call = method !== void 0 ? `${capName}.${method}` : capName;
-	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
-	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
-	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
-	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
-}
-var CapRouteError = class extends Error {
-	reason;
-	nodeId;
-	rejected;
-	/**
-	* @param cause  Optional original error that triggered this routing failure.
-	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
-	*               Dispatchers wrapping transport errors MUST pass the original.
-	*/
-	constructor(capName, method, detail, cause) {
-		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
-		this.name = "CapRouteError";
-		this.reason = detail.reason;
-		this.nodeId = detail.nodeId;
-		this.rejected = detail.rejected;
-	}
-};
-/**
-* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
-*
-* Precedence (explicit nodeId path):
-*   1. hub-in-process — hub node + hubInProcessProvides
-*   2. hub-local-uds  — hub node + hubLocalChildProvides
-*   3. node-offline   → CapRouteError{reason:'node-offline'}
-*   4. agent-child-forward — node is an agent AND nodeKnowsCap
-*   5. remote-moleculer — any other online non-agent node
-*
-* Singleton path (no nodeId):
-*   1. hub-in-process (hub provides in-process)
-*   2. hub-local-uds  (a hub-local UDS child provides it)
-*   3. remote-moleculer (any online, non-hub node that knows it)
-*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
-*
-* PURE: no side effects, no async, no broker/registry imports.
-*/
-function classifyCapRoute(capName, opts, snapshot) {
-	const rejected = [];
-	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
-	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
-}
-function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
-	if (nodeId === snap.hubNodeId) {
-		const residentProvides = snap.hubResidentProvides;
-		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
-		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
-		if (providesOnHub(capName)) {
-			const ref = getRef?.(capName) ?? null;
-			if (ref !== null) return {
-				kind: "hub-in-process",
-				capName,
-				ref
-			};
-			rejected.push({
-				kind: "hub-in-process",
-				why: "provider ref not available in snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		if (snap.hubLocalChildProvides(capName, deviceId)) {
-			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-			if (childId !== null) return {
-				kind: "hub-local-uds",
-				capName,
-				childId
-			};
-			rejected.push({
-				kind: "hub-local-uds",
-				why: "child id not resolvable from snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		rejected.push({
-			kind: "hub-in-process",
-			why: "hub does not provide this cap in-process"
-		});
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "no hub-local child provides this cap"
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
-	}
-	if (!snap.nodeOnline(nodeId)) {
-		rejected.push({
-			kind: "remote-moleculer",
-			why: `node ${nodeId} is offline`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "node-offline",
-			nodeId,
-			rejected
-		});
-	}
-	if (snap.nodeIsAgent(nodeId)) {
-		if (snap.nodeKnowsCap(nodeId, capName)) return {
-			kind: "agent-child-forward",
-			capName,
-			agentNodeId: nodeId,
-			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
-		};
-		rejected.push({
-			kind: "agent-child-forward",
-			why: `agent ${nodeId} does not know cap ${capName}`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
-	}
-	return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-}
-function classifySingleton(capName, deviceId, snap, rejected) {
-	if (snap.hubInProcessProvides(capName)) {
-		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-		if (ref !== null) return {
-			kind: "hub-in-process",
-			capName,
-			ref
-		};
-		rejected.push({
-			kind: "hub-in-process",
-			why: "provider ref not available in snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-in-process",
-		why: "hub does not provide this cap in-process"
-	});
-	if (snap.hubLocalChildProvides(capName, deviceId)) {
-		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId !== null) return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "child id not resolvable from snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-local-uds",
-		why: "no hub-local child provides this cap"
-	});
-	const knownNodes = snap.listKnownNodeIds?.() ?? [];
-	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-	rejected.push({
-		kind: "remote-moleculer",
-		why: "no online remote node knows this cap"
-	});
-	throw new CapRouteError(capName, void 0, {
-		reason: "no-provider",
-		rejected
-	});
-}
-//#endregion
-//#region src/kernel/transport/cap-route-resolver.ts
-/** The Moleculer service name that Task 6's agent registers. */
-var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
-/** The Moleculer action (service.action) for agent cap forwarding. */
-var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
-/** Default timeout for remote Moleculer cap calls (ms). */
-var REMOTE_CALL_TIMEOUT_MS = 6e4;
-function extractDeviceId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "deviceId");
-	return typeof raw === "number" ? raw : void 0;
-}
-/**
-* Extract an inline `nodeId` string from a cap call's args — the per-call node
-* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
-* device-scoped caps carry `deviceId`, and the way the generated cap-router on
-* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
-*
-* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
-* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
-* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
-* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
-* methods that don't declare `nodeId` simply ignore the extra field (they
-* destructure the fields they need); methods that DO declare it (e.g.
-* `getEngineProvisioning({nodeId})`) still receive it unchanged.
-*/
-function extractNodeId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "nodeId");
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
-/**
-* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
-* destructures what it needs and ignores the rest" convention
-* {@link extractNodeId} already relies on for the inline `nodeId` pin.
-* `undefined` (the overwhelmingly common case: no caller hint, or the census
-* consuming it is disarmed) returns `args` unchanged — no allocation. A
-* non-object `args` (or `null`/array) is returned unchanged too: there is
-* nowhere to attach an extra key without changing the payload's shape, and a
-* provider taking a bare value never reads `callerAddonId` off it anyway.
-*/
-function withCallerAddonId(args, callerAddonId) {
-	if (callerAddonId === void 0) return args;
-	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
-	return {
-		...args,
-		callerAddonId
-	};
-}
-var CapRouteResolver = class {
-	hubNodeId;
-	broker;
-	hubLocalRegistry;
-	nodeAuthority;
-	inProcessProviders;
-	hubResidentProviders;
-	capTimeoutMs;
-	snapshot;
-	constructor(deps) {
-		this.hubNodeId = deps.hubNodeId;
-		this.broker = deps.broker;
-		this.hubLocalRegistry = deps.hubLocalRegistry;
-		this.nodeAuthority = deps.nodeAuthority;
-		this.inProcessProviders = deps.inProcessProviders;
-		this.hubResidentProviders = deps.hubResidentProviders;
-		this.capTimeoutMs = deps.capTimeoutMs;
-		this.snapshot = this.buildSnapshot();
-	}
-	/** Per-call RPC timeout: the cap method's declared override, else the default. */
-	callTimeout(capName, method) {
-		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
-	}
-	resolveCapRoute(capName, opts) {
-		return classifyCapRoute(capName, opts, this.snapshot);
-	}
-	/**
-	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
-	* child, IGNORING any in-hub provider registered for the same cap name.
-	*
-	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
-	* provider (e.g. a wrapper) is registered for the cap, the route always
-	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
-	* reached. That is correct for the generic dispatch path (the wrapper is the
-	* active provider), but WRONG for the native-cap fallback
-	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
-	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
-	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
-	* itself, the native is never invoked, and the wrapper silently falls
-	* through to its secondary strategy.
-	*
-	* This method consults ONLY the hub-local-child authority
-	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
-	* it returns the native child route regardless of any in-process shadow.
-	* Returns null when no hub-local child owns `(capName, deviceId)` — the
-	* caller then falls through to its remote-resolution branch.
-	*/
-	resolveHubLocalUdsRoute(capName, deviceId) {
-		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
-		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId === null) return null;
-		return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
-	}
-	/**
-	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
-	*   the addonId of the provider the CALLER already resolved (e.g.
-	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
-	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
-	*   route already encodes the provider in its action name
-	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
-	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
-	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
-	*   `dispatch`.
-	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
-	*   addon that ORIGINATED the call, distinct from `addonId` above (which
-	*   names the resolved PROVIDER, not the caller). Set by
-	*   `onUnownedCall` from `CapCallInput.callerAddonId`
-	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
-	*   the `hub-in-process` branch consumes it — merged into `args` so a
-	*   diagnostic tool deep in that provider (e.g. device-manager's
-	*   fleet-read census) can read it without every provider method changing
-	*   signature, the same "extra field the provider destructures or
-	*   ignores" convention `nodeId` already uses on this path.
-	*/
-	async dispatch(route, method, args, addonId, callerAddonId) {
-		try {
-			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
-		} catch (err) {
-			if (err instanceof CapRouteError) throw err;
-			const nodeId = this.routeNodeId(route);
-			const cause = err instanceof Error ? err : new Error(String(err));
-			throw new CapRouteError(route.capName, method, {
-				reason: "transport-failed",
-				nodeId,
-				rejected: [{
-					kind: route.kind,
-					why: cause.message
-				}]
-			}, cause);
-		}
-	}
-	/**
-	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
-	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
-	*/
-	async dispatchInner(route, method, args, addonId, callerAddonId) {
-		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
-			case "hub-local-uds": {
-				const registry = this.hubLocalRegistry;
-				if (registry === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					rejected: [{
-						kind: "hub-local-uds",
-						why: "UDS registry not available"
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const input = {
-					capName: route.capName,
-					method,
-					args,
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return registry.callCapOnChild(route.childId, input);
-			}
-			case "remote-moleculer": {
-				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
-				if (addonId === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					nodeId: route.nodeId,
-					rejected: [{
-						kind: "remote-moleculer",
-						why: `no addonId known for ${route.nodeId}/${route.capName}`
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
-				const action = capActionName(addonId, route.capName, method, isNative);
-				return callWithServiceDiscovery(this.broker, addonId, action, args, {
-					nodeID: route.nodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
-			case "agent-child-forward": {
-				const deviceId = extractDeviceId(args);
-				const params = {
-					capName: route.capName,
-					method,
-					args,
-					...route.childId !== void 0 ? { childId: route.childId } : {},
-					...deviceId !== void 0 ? { deviceId } : {},
-					...addonId !== void 0 ? { addonId } : {}
-				};
-				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
-					nodeID: route.agentNodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
-		}
-	}
-	buildSnapshot() {
-		const hubLocalRegistry = this.hubLocalRegistry;
-		const nodeAuthority = this.nodeAuthority;
-		const inProcessProviders = this.inProcessProviders;
-		const hubResidentProviders = this.hubResidentProviders;
-		return {
-			hubNodeId: this.hubNodeId,
-			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
-			...hubResidentProviders !== void 0 ? {
-				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
-				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
-			} : {},
-			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
-			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
-			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
-			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
-			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
-			getInProcessProviderRef: (cap) => inProcessProviders(cap),
-			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
-			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
-		};
-	}
-	/** Extract a nodeId string from a route for error reporting, or undefined. */
-	routeNodeId(route) {
-		switch (route.kind) {
-			case "hub-in-process": return this.hubNodeId;
-			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
-			case "remote-moleculer": return route.nodeId;
-			case "agent-child-forward": return route.agentNodeId;
-		}
-	}
-};
-//#endregion
-//#region src/kernel/transport/local-child-registry.ts
-function readFanoutMode() {
-	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
-	if (raw === "shadow" || raw === "broadcast") return raw;
-	return "filter";
+//#region src/kernel/transport/cap-routing-hints.ts
+/** Lift {@link CapRoutingHints} from a call's args. Never throws. */
+function liftRoutingHints(args) {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return {};
+	const nodeId = Reflect.get(args, "nodeId");
+	const addonId = Reflect.get(args, "addonId");
+	return {
+		...typeof nodeId === "string" && nodeId.length > 0 ? { nodeId } : {},
+		...typeof addonId === "string" && addonId.length > 0 ? { addonId } : {}
+	};
+}
+function readFanoutMode() {
+	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
+	if (raw === "shadow" || raw === "broadcast") return raw;
+	return "filter";
 }
 /**
 * Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
@@ -6669,6 +7089,17 @@ var LocalChildRegistry = class {
 	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
 	isAggregatedCollectionMethod;
 	isAddonPinnedCall;
+	/** See {@link ForwardCensus}. Mutable counters on the hot path, by design. */
+	forwardedRaw = 0;
+	forwardedDecoded = 0;
+	/**
+	* The per-ACTION byte census (D456). `ForwardCensus` above is the same
+	* question asked of the whole plane; this one asks it per `<cap>.<method>`,
+	* beside the bytes that method actually moved. Both are kept: `socketFwd=`
+	* says whether the negotiation is working at all, and a `raw=0` on ONE
+	* method with `raw>0` on its neighbours is a different fault.
+	*/
+	actionCensus = createCapActionCensus();
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
 	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
@@ -6682,6 +7113,12 @@ var LocalChildRegistry = class {
 	/** Last pattern-set string logged per child, to dedup the INFO line. */
 	loggedPatternSet = /* @__PURE__ */ new Map();
 	/**
+	* Derived `(cap, device?) → child` index over {@link children}, or `null`
+	* when it must be rebuilt. See {@link capIndex} for why it is a cache and
+	* never a registry (D3, D457).
+	*/
+	capChildIndex = null;
+	/**
 	* Accepts either a plain positional `server` argument (backward-compatible)
 	* or a full `LocalChildRegistryOptions` object.
 	*
@@ -6738,10 +7175,43 @@ var LocalChildRegistry = class {
 	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
 	* pair for the whole process and has no per-socket breakdown.
 	*/
-	getChildSocketTraffic(childId) {
+	getChildSocketTraffic(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.readTraffic?.() ?? null;
+	}
+	/**
+	* Bytes this process has written to a child that the child has not yet
+	* taken, live, or `null` when the channel keeps no such reading. Read on
+	* every heartbeat probe (D446) — a child that stops draining is the shape
+	* of an outbound-queue episode, and the number lives on the channel.
+	*/
+	getChildQueuedBytes(childId) {
 		const entry = this.children.get(childId);
 		if (entry === void 0) return null;
-		return entry.channel.readTraffic?.() ?? null;
+		return entry.channel.queuedBytes?.() ?? null;
+	}
+	/** Cumulative {@link ForwardCensus} of this parent's `cap-call-out` routing. */
+	readForwardCensus() {
+		return {
+			raw: this.forwardedRaw,
+			decoded: this.forwardedDecoded
+		};
+	}
+	/**
+	* Cumulative per-action byte census: peer → `<cap>.<method>` → bytes, calls
+	* and the raw/decoded split. A COPY (`cap-action-census.ts` explains why it
+	* must be one); the heartbeat subtracts the previous reading.
+	*
+	* This is the instrument D454 closed by asking for. `socketTopBytes=` names
+	* the peer that moves the bytes and `txkB=` says they are responses; neither
+	* can say WHICH method originates them, and after raw-forward the bytes that
+	* cross are no longer the proxy for what hub-main pays — 85.7 % of sibling
+	* calls cross unread. What costs is what hub-main LOOKS at, and that is the
+	* `decoded` half of an entry, next to the bytes it carried.
+	*/
+	readActionCensus() {
+		return this.actionCensus.read();
 	}
 	/**
 	* The regime the counters above were produced under, read once from
@@ -6857,11 +7327,12 @@ var LocalChildRegistry = class {
 	* compete for the same capName.
 	*/
 	resolveChildId(capName, deviceId) {
+		const index = this.capIndex();
 		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
+			const deviceOwner = index.deviceOwner(capName, deviceId);
 			if (deviceOwner !== null) return deviceOwner;
 		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
+		const candidates = index.singletonCandidates(capName);
 		if (candidates.length === 0) return null;
 		if (candidates.length === 1) return candidates[0];
 		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
@@ -6894,16 +7365,37 @@ var LocalChildRegistry = class {
 			});
 		} catch {}
 	}
-	/** First child whose cap manifest contains a descriptor matching `predicate`. */
-	findChildId(predicate) {
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
-		return null;
+	/**
+	* The cap index over the CURRENT children, rebuilt on first use after any
+	* mutation of {@link children}.
+	*
+	* This replaced a linear walk of every child's cap manifest per
+	* `cap-call-out`, measured at **7.1 % of hub-main's busy main thread**
+	* across 39 children (D456). Why it did not exist before is the whole
+	* design: what it indexes moves — a runner is replaced on every update, a
+	* crash respawns one, a child re-registers with a replacement manifest after
+	* init — and an index that names a dead child routes work into a socket
+	* nobody is reading, which is strictly worse than a slow scan.
+	*
+	* So it is not maintained; it is DISCARDED. `buildCapChildIndex` is a pure
+	* function of `children.values()`, the only two writers of that map
+	* ({@link invalidateCapIndex}'s call sites) drop the index in the same
+	* statement, and nothing else can construct one. There is no add-on-register
+	* / remove-on-close path that could disagree with the map — i.e. no shadow
+	* registry (D3): the map remains the single authority and this holds no fact
+	* it does not.
+	*
+	* The operator's active-singleton preference is deliberately NOT indexed —
+	* it changes without any child connecting or leaving, so `resolveChildId`
+	* reads it live and the index only supplies the candidate list.
+	*/
+	capIndex() {
+		if (this.capChildIndex === null) this.capChildIndex = buildCapChildIndex(this.children.values());
+		return this.capChildIndex;
 	}
-	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
-	findAllChildIds(predicate) {
-		const out = [];
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
-		return out;
+	/** Drop the derived index. MUST follow every write to {@link children}. */
+	invalidateCapIndex() {
+		this.capChildIndex = null;
 	}
 	/**
 	* Does the named child currently provide `(capName, deviceId?)`?
@@ -7099,6 +7591,14 @@ var LocalChildRegistry = class {
 	onConnection(channel) {
 		let childId = null;
 		const incarnation = this.nextIncarnation++;
+		channel.observeActions?.({
+			label: capActionLabel,
+			record: (label, reqBytes, resBytes) => {
+				const peerId = childId ?? "(pre-register)";
+				if (label === null) this.actionCensus.recordUnlabelled(peerId, reqBytes + resBytes);
+				else this.actionCensus.record(peerId, label, reqBytes, resBytes);
+			}
+		});
 		channel.onEvent((body) => {
 			const msg = body;
 			if (msg.kind === "event") {
@@ -7121,7 +7621,7 @@ var LocalChildRegistry = class {
 				return;
 			}
 		});
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
 			if (msg.kind === "register") {
 				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
@@ -7138,8 +7638,10 @@ var LocalChildRegistry = class {
 					channel,
 					caps: msg.caps,
 					eventPatterns,
-					incarnation
+					incarnation,
+					rawForward: msg.rawForward === true
 				});
+				this.invalidateCapIndex();
 				this.logPatternSet(msg.childId, eventPatterns);
 				this.registeredHandler({
 					childId: msg.childId,
@@ -7147,33 +7649,62 @@ var LocalChildRegistry = class {
 					incarnation,
 					...msg.customActions !== void 0 ? { customActions: msg.customActions } : {}
 				});
-				return { ok: true };
+				return {
+					ok: true,
+					rawForward: true
+				};
 			}
 			if (msg.kind === "cap-call-out") {
 				const out = msg;
-				const input = {
+				const hints = out.hints ?? liftRoutingHints(out.args);
+				const materialise = () => payload !== void 0 ? unpackPayload(payload) : out.args;
+				const buildInput = () => ({
 					capName: out.capName,
 					method: out.method,
-					args: out.args,
+					args: materialise(),
 					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
 					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {},
 					...out.native === true ? { native: true } : {},
 					...childId !== null ? { callerAddonId: childId } : {}
-				};
-				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
+				});
+				const pinnedNodeId = out.nodeId ?? hints.nodeId;
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
 				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
-				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
+				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, hints) === true;
 				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
 				this.recordCapUsage(childId, target, out.capName, out.method);
+				const actionPeer = childId ?? "(pre-register)";
+				const actionLabel = `${out.capName}.${out.method}`;
 				if (target !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
 					}
-					return this.callCap(input);
+					const entry = this.children.get(target);
+					if (payload !== void 0 && entry !== void 0 && entry.rawForward) {
+						this.forwardedRaw += 1;
+						this.actionCensus.recordForward(actionPeer, actionLabel, "raw");
+						const forward = {
+							kind: "cap-call",
+							capName: out.capName,
+							method: out.method,
+							args: void 0,
+							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {}
+						};
+						const declared = this.capTimeoutMs?.(out.capName, out.method);
+						return entry.channel.request(forward, {
+							...typeof declared === "number" ? { timeoutMs: declared } : {},
+							payload
+						});
+					}
+					this.forwardedDecoded += 1;
+					this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
+					const input = buildInput();
+					return entry !== void 0 ? this.callCapOnChild(target, input) : this.callCap(input);
 				}
-				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
+				this.forwardedDecoded += 1;
+				this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
+				if (this.onUnownedCall !== void 0) return this.onUnownedCall(buildInput());
 				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
 			}
 			if (msg.kind === "readiness-request") return {
@@ -7195,7 +7726,9 @@ var LocalChildRegistry = class {
 				return;
 			}
 			this.children.delete(childId);
+			this.invalidateCapIndex();
 			this.childEventStats.delete(childId);
+			this.actionCensus.forget(childId);
 			this.loggedPatternSet.delete(childId);
 			this.goneHandler(childId, incarnation);
 		});
@@ -7203,6 +7736,11 @@ var LocalChildRegistry = class {
 };
 //#endregion
 //#region src/kernel/transport/local-child-client.ts
+/** Did the parent's `register` answer say it accepts payload-borne args? */
+function ackAcceptsRawForward(ack) {
+	if (ack === null || typeof ack !== "object") return false;
+	return ack.rawForward === true;
+}
 /**
 * Child side of the local UDS transport. Connects to its parent (hub or
 * agent), registers its cap manifest, and serves parent→child cap calls by
@@ -7258,6 +7796,13 @@ var LocalChildClient = class {
 	latestCustomActions = null;
 	/** Events and logs queued while the channel is not yet open. */
 	pendingEmits = [];
+	/**
+	* Whether the parent acknowledged raw-forward at `register`. Until it has,
+	* `callOut` sends args inline exactly as every child always did — a legacy
+	* parent would decode a payload-borne call to `args: undefined` and run the
+	* provider on nothing, silently. Re-read on every re-register.
+	*/
+	parentRawForward = false;
 	/** Handler for parent→child events. Registered via `onEvent`. */
 	eventHandler = null;
 	/**
@@ -7365,147 +7910,611 @@ var LocalChildClient = class {
 		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
 		const client = createLocalTransport().createClient(this.options.nodeId);
 		const channel = await client.connect();
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
-			if (msg.kind === "cap-call") return this.options.dispatch({
-				capName: msg.capName,
-				method: msg.method,
-				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
-				...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+			if (msg.kind === "cap-call") {
+				const args = payload !== void 0 ? unpackPayload(payload) : msg.args;
+				const result = await this.options.dispatch({
+					capName: msg.capName,
+					method: msg.method,
+					args,
+					...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
+					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+				});
+				if (payload !== void 0 && result !== void 0) return new PayloadReply(void 0, packPayload(result));
+				return result;
+			}
+			if (msg.kind === "addon-call") {
+				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
+				return this.addonCallHandler({
+					addonId: msg.addonId,
+					target: msg.target,
+					...msg.action !== void 0 ? { action: msg.action } : {},
+					...msg.method !== void 0 ? { method: msg.method } : {},
+					...msg.args !== void 0 ? { args: msg.args } : {},
+					...msg.caller !== void 0 ? { caller: msg.caller } : {}
+				});
+			}
+			throw new Error(`unknown parent request kind: ${msg.kind}`);
+		});
+		channel.onEvent((body) => {
+			const msg = body;
+			if (msg.kind === "event") {
+				this.eventHandler?.(msg.event);
+				return;
+			}
+			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
+		});
+		const register = this.registerFrame(this.latestCaps);
+		try {
+			this.parentRawForward = ackAcceptsRawForward(await channel.request(register));
+		} catch (err) {
+			await client.close();
+			throw err;
+		}
+		this.client = client;
+		this.channel = channel;
+		this.flushPending(channel);
+		for (const cb of this.connectedHandlers) cb();
+	}
+	/** Flush buffered pre-start emits over the now-open channel. */
+	flushPending(channel) {
+		for (const item of this.pendingEmits) channel.emit(item.msg);
+		this.pendingEmits.length = 0;
+	}
+	/**
+	* Re-send the cap manifest to the parent, atomically replacing the child's
+	* registered descriptor set. Call this after device-restore so newly
+	* registered native (device-scoped) caps become routable over UDS.
+	*
+	* Safe to call before `start()`: the new set is buffered and `start()` sends
+	* it (device-restore can race ahead of the UDS connect). After `start()`,
+	* the set is sent immediately.
+	*/
+	async updateCaps(caps, customActions) {
+		this.latestCaps = caps;
+		if (customActions !== void 0) this.latestCustomActions = customActions;
+		if (this.channel === null) return;
+		this.parentRawForward = ackAcceptsRawForward(await this.channel.request(this.registerFrame(caps)));
+	}
+	/**
+	* The register frame: caps, plus everything a re-register must atomically
+	* re-carry so no separate re-sync can be missed — the subscription union
+	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
+	* custom-action catalogs (omitted until the init loop produced them).
+	*/
+	registerFrame(caps) {
+		return {
+			kind: "register",
+			childId: this.options.childId,
+			caps,
+			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
+			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {},
+			rawForward: true
+		};
+	}
+	/**
+	* Fire-and-forget: send a system event to the parent for forwarding to the
+	* hub event bus. Safe to call before `start()` — events are buffered and
+	* flushed on connect.
+	*/
+	emitEvent(event) {
+		const msg = {
+			kind: "event",
+			event
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "event",
+			msg
+		});
+	}
+	/**
+	* Fire-and-forget: send a structured log entry to the parent. Safe to call
+	* before `start()` — log entries are buffered and flushed on connect.
+	*/
+	sendLog(entry) {
+		const msg = {
+			kind: "log",
+			...entry
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "log",
+			msg
+		});
+	}
+	/**
+	* Request the current readiness snapshot from the parent. Returns the
+	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
+	* Requires `start()` to have been called; throws with a clear message if not.
+	*/
+	async requestReadinessSnapshot() {
+		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
+		return (await this.channel.request({ kind: "readiness-request" })).records;
+	}
+	/**
+	* Ask the parent to execute a cap call this child does NOT own. The parent
+	* routes to the owning local sibling over UDS, or — if no sibling owns it —
+	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
+	* production). Throws if called before `start()`.
+	*/
+	async callOut(input) {
+		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+		const routing = {
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
+			...input.native === true ? { native: true } : {}
+		};
+		if (this.parentRawForward && input.args !== void 0) {
+			const hints = liftRoutingHints(input.args);
+			const msg = {
+				kind: "cap-call-out",
+				capName: input.capName,
+				method: input.method,
+				...Object.keys(hints).length > 0 ? { hints } : {},
+				...routing
+			};
+			const reply = await this.channel.request(msg, { payload: packPayload(input.args) });
+			return reply instanceof PayloadReply ? unpackPayload(reply.payload) : reply;
+		}
+		const msg = {
+			kind: "cap-call-out",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...routing
+		};
+		return this.channel.request(msg);
+	}
+	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
+	async close() {
+		await this.client?.close();
+		this.client = null;
+		this.channel = null;
+	}
+};
+//#endregion
+//#region src/kernel/transport/cap-route.ts
+function buildMessage(capName, method, detail) {
+	const call = method !== void 0 ? `${capName}.${method}` : capName;
+	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
+	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
+	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
+	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+}
+var CapRouteError = class extends Error {
+	reason;
+	nodeId;
+	rejected;
+	/**
+	* @param cause  Optional original error that triggered this routing failure.
+	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
+	*               Dispatchers wrapping transport errors MUST pass the original.
+	*/
+	constructor(capName, method, detail, cause) {
+		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
+		this.name = "CapRouteError";
+		this.reason = detail.reason;
+		this.nodeId = detail.nodeId;
+		this.rejected = detail.rejected;
+	}
+};
+/**
+* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
+*
+* Precedence (explicit nodeId path):
+*   1. hub-in-process — hub node + hubInProcessProvides
+*   2. hub-local-uds  — hub node + hubLocalChildProvides
+*   3. node-offline   → CapRouteError{reason:'node-offline'}
+*   4. agent-child-forward — node is an agent AND nodeKnowsCap
+*   5. remote-moleculer — any other online non-agent node
+*
+* Singleton path (no nodeId):
+*   1. hub-in-process (hub provides in-process)
+*   2. hub-local-uds  (a hub-local UDS child provides it)
+*   3. remote-moleculer (any online, non-hub node that knows it)
+*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
+*
+* PURE: no side effects, no async, no broker/registry imports.
+*/
+function classifyCapRoute(capName, opts, snapshot) {
+	const rejected = [];
+	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
+	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
+}
+function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
+	if (nodeId === snap.hubNodeId) {
+		const residentProvides = snap.hubResidentProvides;
+		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
+		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
+		if (providesOnHub(capName)) {
+			const ref = getRef?.(capName) ?? null;
+			if (ref !== null) return {
+				kind: "hub-in-process",
+				capName,
+				ref
+			};
+			rejected.push({
+				kind: "hub-in-process",
+				why: "provider ref not available in snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		if (snap.hubLocalChildProvides(capName, deviceId)) {
+			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+			if (childId !== null) return {
+				kind: "hub-local-uds",
+				capName,
+				childId
+			};
+			rejected.push({
+				kind: "hub-local-uds",
+				why: "child id not resolvable from snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
 			});
-			if (msg.kind === "addon-call") {
-				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
-				return this.addonCallHandler({
-					addonId: msg.addonId,
-					target: msg.target,
-					...msg.action !== void 0 ? { action: msg.action } : {},
-					...msg.method !== void 0 ? { method: msg.method } : {},
-					...msg.args !== void 0 ? { args: msg.args } : {},
-					...msg.caller !== void 0 ? { caller: msg.caller } : {}
-				});
-			}
-			throw new Error(`unknown parent request kind: ${msg.kind}`);
+		}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "hub does not provide this cap in-process"
 		});
-		channel.onEvent((body) => {
-			const msg = body;
-			if (msg.kind === "event") {
-				this.eventHandler?.(msg.event);
-				return;
-			}
-			if (msg.kind === "set-log-level") this.setLogLevelHandler?.(msg.level);
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "no hub-local child provides this cap"
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
 		});
-		const register = this.registerFrame(this.latestCaps);
-		try {
-			await channel.request(register);
-		} catch (err) {
-			await client.close();
-			throw err;
-		}
-		this.client = client;
-		this.channel = channel;
-		this.flushPending(channel);
-		for (const cb of this.connectedHandlers) cb();
-	}
-	/** Flush buffered pre-start emits over the now-open channel. */
-	flushPending(channel) {
-		for (const item of this.pendingEmits) channel.emit(item.msg);
-		this.pendingEmits.length = 0;
 	}
-	/**
-	* Re-send the cap manifest to the parent, atomically replacing the child's
-	* registered descriptor set. Call this after device-restore so newly
-	* registered native (device-scoped) caps become routable over UDS.
-	*
-	* Safe to call before `start()`: the new set is buffered and `start()` sends
-	* it (device-restore can race ahead of the UDS connect). After `start()`,
-	* the set is sent immediately.
-	*/
-	async updateCaps(caps, customActions) {
-		this.latestCaps = caps;
-		if (customActions !== void 0) this.latestCustomActions = customActions;
-		if (this.channel === null) return;
-		await this.channel.request(this.registerFrame(caps));
+	if (!snap.nodeOnline(nodeId)) {
+		rejected.push({
+			kind: "remote-moleculer",
+			why: `node ${nodeId} is offline`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "node-offline",
+			nodeId,
+			rejected
+		});
 	}
-	/**
-	* The register frame: caps, plus everything a re-register must atomically
-	* re-carry so no separate re-sync can be missed — the subscription union
-	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
-	* custom-action catalogs (omitted until the init loop produced them).
-	*/
-	registerFrame(caps) {
-		return {
-			kind: "register",
-			childId: this.options.childId,
-			caps,
-			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
-			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {}
+	if (snap.nodeIsAgent(nodeId)) {
+		if (snap.nodeKnowsCap(nodeId, capName)) return {
+			kind: "agent-child-forward",
+			capName,
+			agentNodeId: nodeId,
+			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
 		};
+		rejected.push({
+			kind: "agent-child-forward",
+			why: `agent ${nodeId} does not know cap ${capName}`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
 	}
-	/**
-	* Fire-and-forget: send a system event to the parent for forwarding to the
-	* hub event bus. Safe to call before `start()` — events are buffered and
-	* flushed on connect.
-	*/
-	emitEvent(event) {
-		const msg = {
-			kind: "event",
-			event
+	return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+}
+function classifySingleton(capName, deviceId, snap, rejected) {
+	if (snap.hubInProcessProvides(capName)) {
+		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		if (ref !== null) return {
+			kind: "hub-in-process",
+			capName,
+			ref
 		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "event",
-			msg
+		rejected.push({
+			kind: "hub-in-process",
+			why: "provider ref not available in snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-in-process",
+		why: "hub does not provide this cap in-process"
+	});
+	if (snap.hubLocalChildProvides(capName, deviceId)) {
+		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId !== null) return {
+			kind: "hub-local-uds",
+			capName,
+			childId
+		};
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "child id not resolvable from snapshot"
 		});
+	} else rejected.push({
+		kind: "hub-local-uds",
+		why: "no hub-local child provides this cap"
+	});
+	const knownNodes = snap.listKnownNodeIds?.() ?? [];
+	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+	rejected.push({
+		kind: "remote-moleculer",
+		why: "no online remote node knows this cap"
+	});
+	throw new CapRouteError(capName, void 0, {
+		reason: "no-provider",
+		rejected
+	});
+}
+//#endregion
+//#region src/kernel/moleculer/resilient-cap-call.ts
+/** Moleculer error `type` values meaning "the service is not (yet) routable". */
+var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
+/** Default ceiling for the discovery wait — fail-fast past this. */
+var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
+function isDiscoveryError(err) {
+	if (typeof err !== "object" || err === null) return false;
+	const type = err.type;
+	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+}
+/**
+* Call a Moleculer action; on a service-discovery error, wait for the
+* named service to be discovered and retry the call exactly once.
+*/
+async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
+	try {
+		return await broker.call(action, params, opts);
+	} catch (err) {
+		if (!isDiscoveryError(err)) throw err;
+		await broker.waitForServices([serviceName], discoveryTimeoutMs);
+		return await broker.call(action, params, opts);
+	}
+}
+//#endregion
+//#region src/kernel/transport/cap-route-resolver.ts
+/** The Moleculer service name that Task 6's agent registers. */
+var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
+/** The Moleculer action (service.action) for agent cap forwarding. */
+var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
+/** Default timeout for remote Moleculer cap calls (ms). */
+var REMOTE_CALL_TIMEOUT_MS = 6e4;
+function extractDeviceId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "deviceId");
+	return typeof raw === "number" ? raw : void 0;
+}
+/**
+* Extract an inline `nodeId` string from a cap call's args — the per-call node
+* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
+* device-scoped caps carry `deviceId`, and the way the generated cap-router on
+* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
+*
+* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
+* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
+* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
+* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
+* methods that don't declare `nodeId` simply ignore the extra field (they
+* destructure the fields they need); methods that DO declare it (e.g.
+* `getEngineProvisioning({nodeId})`) still receive it unchanged.
+*/
+function extractNodeId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "nodeId");
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+/**
+* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
+* destructures what it needs and ignores the rest" convention
+* {@link extractNodeId} already relies on for the inline `nodeId` pin.
+* `undefined` (the overwhelmingly common case: no caller hint, or the census
+* consuming it is disarmed) returns `args` unchanged — no allocation. A
+* non-object `args` (or `null`/array) is returned unchanged too: there is
+* nowhere to attach an extra key without changing the payload's shape, and a
+* provider taking a bare value never reads `callerAddonId` off it anyway.
+*/
+function withCallerAddonId(args, callerAddonId) {
+	if (callerAddonId === void 0) return args;
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	return {
+		...args,
+		callerAddonId
+	};
+}
+var CapRouteResolver = class {
+	hubNodeId;
+	broker;
+	hubLocalRegistry;
+	nodeAuthority;
+	inProcessProviders;
+	hubResidentProviders;
+	capTimeoutMs;
+	snapshot;
+	constructor(deps) {
+		this.hubNodeId = deps.hubNodeId;
+		this.broker = deps.broker;
+		this.hubLocalRegistry = deps.hubLocalRegistry;
+		this.nodeAuthority = deps.nodeAuthority;
+		this.inProcessProviders = deps.inProcessProviders;
+		this.hubResidentProviders = deps.hubResidentProviders;
+		this.capTimeoutMs = deps.capTimeoutMs;
+		this.snapshot = this.buildSnapshot();
+	}
+	/** Per-call RPC timeout: the cap method's declared override, else the default. */
+	callTimeout(capName, method) {
+		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
+	}
+	resolveCapRoute(capName, opts) {
+		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* Fire-and-forget: send a structured log entry to the parent. Safe to call
-	* before `start()` — log entries are buffered and flushed on connect.
+	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
+	* child, IGNORING any in-hub provider registered for the same cap name.
+	*
+	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
+	* provider (e.g. a wrapper) is registered for the cap, the route always
+	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
+	* reached. That is correct for the generic dispatch path (the wrapper is the
+	* active provider), but WRONG for the native-cap fallback
+	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
+	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
+	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
+	* itself, the native is never invoked, and the wrapper silently falls
+	* through to its secondary strategy.
+	*
+	* This method consults ONLY the hub-local-child authority
+	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
+	* it returns the native child route regardless of any in-process shadow.
+	* Returns null when no hub-local child owns `(capName, deviceId)` — the
+	* caller then falls through to its remote-resolution branch.
 	*/
-	sendLog(entry) {
-		const msg = {
-			kind: "log",
-			...entry
+	resolveHubLocalUdsRoute(capName, deviceId) {
+		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
+		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId === null) return null;
+		return {
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "log",
-			msg
-		});
 	}
 	/**
-	* Request the current readiness snapshot from the parent. Returns the
-	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
-	* Requires `start()` to have been called; throws with a clear message if not.
+	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
+	*   the addonId of the provider the CALLER already resolved (e.g.
+	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
+	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
+	*   route already encodes the provider in its action name
+	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
+	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
+	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
+	*   `dispatch`.
+	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
+	*   addon that ORIGINATED the call, distinct from `addonId` above (which
+	*   names the resolved PROVIDER, not the caller). Set by
+	*   `onUnownedCall` from `CapCallInput.callerAddonId`
+	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
+	*   the `hub-in-process` branch consumes it — merged into `args` so a
+	*   diagnostic tool deep in that provider (e.g. device-manager's
+	*   fleet-read census) can read it without every provider method changing
+	*   signature, the same "extra field the provider destructures or
+	*   ignores" convention `nodeId` already uses on this path.
 	*/
-	async requestReadinessSnapshot() {
-		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
-		return (await this.channel.request({ kind: "readiness-request" })).records;
+	async dispatch(route, method, args, addonId, callerAddonId) {
+		try {
+			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
+		} catch (err) {
+			if (err instanceof CapRouteError) throw err;
+			const nodeId = this.routeNodeId(route);
+			const cause = err instanceof Error ? err : new Error(String(err));
+			throw new CapRouteError(route.capName, method, {
+				reason: "transport-failed",
+				nodeId,
+				rejected: [{
+					kind: route.kind,
+					why: cause.message
+				}]
+			}, cause);
+		}
 	}
 	/**
-	* Ask the parent to execute a cap call this child does NOT own. The parent
-	* routes to the owning local sibling over UDS, or — if no sibling owns it —
-	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
-	* production). Throws if called before `start()`.
+	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
+	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
 	*/
-	async callOut(input) {
-		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
-		const msg = {
-			kind: "cap-call-out",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
-			...input.native === true ? { native: true } : {}
+	async dispatchInner(route, method, args, addonId, callerAddonId) {
+		switch (route.kind) {
+			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
+			case "hub-local-uds": {
+				const registry = this.hubLocalRegistry;
+				if (registry === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					rejected: [{
+						kind: "hub-local-uds",
+						why: "UDS registry not available"
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const input = {
+					capName: route.capName,
+					method,
+					args,
+					...deviceId !== void 0 ? { deviceId } : {}
+				};
+				return registry.callCapOnChild(route.childId, input);
+			}
+			case "remote-moleculer": {
+				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
+				if (addonId === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					nodeId: route.nodeId,
+					rejected: [{
+						kind: "remote-moleculer",
+						why: `no addonId known for ${route.nodeId}/${route.capName}`
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
+				const action = capActionName(addonId, route.capName, method, isNative);
+				return callWithServiceDiscovery(this.broker, addonId, action, args, {
+					nodeID: route.nodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+			case "agent-child-forward": {
+				const deviceId = extractDeviceId(args);
+				const params = {
+					capName: route.capName,
+					method,
+					args,
+					...route.childId !== void 0 ? { childId: route.childId } : {},
+					...deviceId !== void 0 ? { deviceId } : {},
+					...addonId !== void 0 ? { addonId } : {}
+				};
+				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
+					nodeID: route.agentNodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+		}
+	}
+	buildSnapshot() {
+		const hubLocalRegistry = this.hubLocalRegistry;
+		const nodeAuthority = this.nodeAuthority;
+		const inProcessProviders = this.inProcessProviders;
+		const hubResidentProviders = this.hubResidentProviders;
+		return {
+			hubNodeId: this.hubNodeId,
+			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			...hubResidentProviders !== void 0 ? {
+				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
+				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
+			} : {},
+			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
+			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
+			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
+			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
+			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
+			getInProcessProviderRef: (cap) => inProcessProviders(cap),
+			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
+			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
 		};
-		return this.channel.request(msg);
 	}
-	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
-	async close() {
-		await this.client?.close();
-		this.client = null;
-		this.channel = null;
+	/** Extract a nodeId string from a route for error reporting, or undefined. */
+	routeNodeId(route) {
+		switch (route.kind) {
+			case "hub-in-process": return this.hubNodeId;
+			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
+			case "remote-moleculer": return route.nodeId;
+			case "agent-child-forward": return route.agentNodeId;
+		}
 	}
 };
 //#endregion
@@ -10219,6 +11228,18 @@ Object.defineProperty(exports, "AddonDepsManager", {
 		return AddonDepsManager;
 	}
 });
+Object.defineProperty(exports, "CAP_ACTION_OVERFLOW_LABEL", {
+	enumerable: true,
+	get: function() {
+		return CAP_ACTION_OVERFLOW_LABEL;
+	}
+});
+Object.defineProperty(exports, "CAP_ACTION_UNLABELLED", {
+	enumerable: true,
+	get: function() {
+		return CAP_ACTION_UNLABELLED;
+	}
+});
 Object.defineProperty(exports, "CapRouteError", {
 	enumerable: true,
 	get: function() {
@@ -10261,6 +11282,12 @@ Object.defineProperty(exports, "DeviceRegistry", {
 		return DeviceRegistry;
 	}
 });
+Object.defineProperty(exports, "EMPTY_CAP_ACTION_READING", {
+	enumerable: true,
+	get: function() {
+		return EMPTY_CAP_ACTION_READING;
+	}
+});
 Object.defineProperty(exports, "EMPTY_SOCKET_DIRECTION", {
 	enumerable: true,
 	get: function() {
@@ -10357,12 +11384,42 @@ Object.defineProperty(exports, "LocalChildRegistry", {
 		return LocalChildRegistry;
 	}
 });
+Object.defineProperty(exports, "MAX_CAP_ACTIONS_PER_PEER", {
+	enumerable: true,
+	get: function() {
+		return MAX_CAP_ACTIONS_PER_PEER;
+	}
+});
+Object.defineProperty(exports, "MESH_QUEUE_TOP_N", {
+	enumerable: true,
+	get: function() {
+		return MESH_QUEUE_TOP_N;
+	}
+});
 Object.defineProperty(exports, "NATIVE_PROVIDER_SERVICE_INFIX", {
 	enumerable: true,
 	get: function() {
 		return NATIVE_PROVIDER_SERVICE_INFIX;
 	}
 });
+Object.defineProperty(exports, "OUTBOUND_QUEUE_COOLDOWN_MS", {
+	enumerable: true,
+	get: function() {
+		return OUTBOUND_QUEUE_COOLDOWN_MS;
+	}
+});
+Object.defineProperty(exports, "OUTBOUND_QUEUE_SUSTAIN_MS", {
+	enumerable: true,
+	get: function() {
+		return OUTBOUND_QUEUE_SUSTAIN_MS;
+	}
+});
+Object.defineProperty(exports, "OUTBOUND_QUEUE_THRESHOLD_BYTES", {
+	enumerable: true,
+	get: function() {
+		return OUTBOUND_QUEUE_THRESHOLD_BYTES;
+	}
+});
 Object.defineProperty(exports, "PARENT_ROUTED_PROVIDER_ADDON_ID", {
 	enumerable: true,
 	get: function() {
@@ -10399,6 +11456,12 @@ Object.defineProperty(exports, "SOCKET_PLANE_TOP_N", {
 		return SOCKET_PLANE_TOP_N;
 	}
 });
+Object.defineProperty(exports, "SOCKET_QUEUE_TOP_N", {
+	enumerable: true,
+	get: function() {
+		return SOCKET_QUEUE_TOP_N;
+	}
+});
 Object.defineProperty(exports, "SocketChannel", {
 	enumerable: true,
 	get: function() {
@@ -10483,6 +11546,12 @@ Object.defineProperty(exports, "callWithServiceDiscovery", {
 		return callWithServiceDiscovery;
 	}
 });
+Object.defineProperty(exports, "capActionLabel", {
+	enumerable: true,
+	get: function() {
+		return capActionLabel;
+	}
+});
 Object.defineProperty(exports, "capActionName", {
 	enumerable: true,
 	get: function() {
@@ -10555,6 +11624,12 @@ Object.defineProperty(exports, "createBrokerDeviceManagerApi", {
 		return createBrokerDeviceManagerApi;
 	}
 });
+Object.defineProperty(exports, "createCapActionCensus", {
+	enumerable: true,
+	get: function() {
+		return createCapActionCensus;
+	}
+});
 Object.defineProperty(exports, "createDeferredHeapWatchSink", {
 	enumerable: true,
 	get: function() {
@@ -10597,6 +11672,18 @@ Object.defineProperty(exports, "createLoopDelayMeter", {
 		return createLoopDelayMeter;
 	}
 });
+Object.defineProperty(exports, "createMeshQueueReader", {
+	enumerable: true,
+	get: function() {
+		return createMeshQueueReader;
+	}
+});
+Object.defineProperty(exports, "createOutboundQueueGate", {
+	enumerable: true,
+	get: function() {
+		return createOutboundQueueGate;
+	}
+});
 Object.defineProperty(exports, "createParentUnownedCallHandler", {
 	enumerable: true,
 	get: function() {
@@ -10669,6 +11756,12 @@ Object.defineProperty(exports, "deserializeTypedArrays", {
 		return deserializeTypedArrays;
 	}
 });
+Object.defineProperty(exports, "diffCapActionCensus", {
+	enumerable: true,
+	get: function() {
+		return diffCapActionCensus;
+	}
+});
 Object.defineProperty(exports, "diffEventPlane", {
 	enumerable: true,
 	get: function() {
@@ -10711,6 +11804,18 @@ Object.defineProperty(exports, "formatHeapSpaces", {
 		return formatHeapSpaces;
 	}
 });
+Object.defineProperty(exports, "formatMeshQueue", {
+	enumerable: true,
+	get: function() {
+		return formatMeshQueue;
+	}
+});
+Object.defineProperty(exports, "formatOutboundQueueVerdict", {
+	enumerable: true,
+	get: function() {
+		return formatOutboundQueueVerdict;
+	}
+});
 Object.defineProperty(exports, "formatSocketPlane", {
 	enumerable: true,
 	get: function() {
@@ -10855,6 +11960,12 @@ Object.defineProperty(exports, "readMoleculerFanoutMode", {
 		return readMoleculerFanoutMode;
 	}
 });
+Object.defineProperty(exports, "readSocketQueues", {
+	enumerable: true,
+	get: function() {
+		return readSocketQueues;
+	}
+});
 Object.defineProperty(exports, "reclaimIntervalMs", {
 	enumerable: true,
 	get: function() {