@camstack/system 1.2.218 → 1.2.220

package/dist/{manifest-system-deps-D--wyMD9.mjs → manifest-system-deps-iadzxSBr.mjs}

@@ -5,12 +5,12 @@ import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, instal
 import { unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { isAbsolute, join } from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import * as fs from "node:fs";
 import { existsSync } from "node:fs";
+import { execFile } from "node:child_process";
 import * as os from "node:os";
 import { tmpdir } from "node:os";
+import { promisify } from "node:util";
 import { createServer } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
@@ -152,6 +152,166 @@ function formatEventPlane(window) {
 	return ` fanoutMode=uds:${window.udsMode}/cross-node:${window.crossNodeMode} children=${window.childrenConnected} childrenUndeclared=${window.childrenUndeclared} fanoutSent=${window.fanoutSent} fanoutSuppressed=${window.fanoutSuppressed} crossNodeDelivered=${window.crossNodeDelivered} crossNodeSuppressed=${window.crossNodeSuppressed}` + (top.length === 0 ? "" : ` fanoutTop=${top}`);
 }
 //#endregion
+//#region src/kernel/transport/cap-action-census.ts
+/** A process that has never read the census. */
+var EMPTY_CAP_ACTION_READING = /* @__PURE__ */ new Map();
+/**
+* Bytes that crossed on a frame carrying no cap envelope.
+*
+* Named rather than omitted so the census's coverage is readable off its own
+* output: `register`, `addon-call`, log frames and the event fan-out all land
+* here. A census that reported only what it could name would look like a
+* complete attribution of whatever share it happened to cover.
+*/
+var CAP_ACTION_UNLABELLED = "(unlabelled)";
+/** Bytes of actions past {@link MAX_CAP_ACTIONS_PER_PEER} on one peer. */
+var CAP_ACTION_OVERFLOW_LABEL = "(overflow)";
+/**
+* Distinct named actions kept per peer before the overflow bucket takes over.
+*
+* Sixty-four against a measured worst case of 14 (`pipeline-analytics`, the
+* heaviest peer on this hub, 2026-09-11) — four times the observed shape, so a
+* peer has to change character before it overflows, and a bound that is never
+* reached in practice still forbids the unbounded growth a wire-supplied key
+* makes possible in principle.
+*/
+var MAX_CAP_ACTIONS_PER_PEER = 64;
+/**
+* `<cap>.<method>` for a cap envelope, `null` for anything else.
+*
+* Both directions are labelled by the same function: a child's `cap-call-out`
+* and the parent's `cap-call` carry `capName` + `method` in the same two keys,
+* so one predicate covers the whole plane. Anything else — a `register`, an
+* `addon-call`, a log or an event — is deliberately unlabelled; see
+* {@link CAP_ACTION_UNLABELLED} for where its bytes go.
+*
+* Cost: two property reads, two `typeof`s and one concatenation of two short
+* strings, called once per `req` frame (not per frame). Against the
+* `encodeFrame` it sits beside — 1 948–1 975 ns on a 0.33 kB body — it is
+* noise, and unlike `recordSocketFrame` it is not on the `evt` path at all.
+*/
+function capActionLabel(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const env = body;
+	if (env.kind !== "cap-call" && env.kind !== "cap-call-out") return null;
+	if (typeof env.capName !== "string" || typeof env.method !== "string") return null;
+	return `${env.capName}.${env.method}`;
+}
+function emptyCounters() {
+	return {
+		calls: 0,
+		reqBytes: 0,
+		resBytes: 0,
+		raw: 0,
+		decoded: 0
+	};
+}
+function createCapActionCensus() {
+	const peers = /* @__PURE__ */ new Map();
+	/**
+	* The per-peer slot for `action`, creating it under the bound.
+	*
+	* Past {@link MAX_CAP_ACTIONS_PER_PEER} a NEW label is folded into the
+	* overflow bucket; labels already present keep their own slot, so a peer
+	* that overflows does not lose the attribution it had built.
+	*/
+	const slot = (peerId, action) => {
+		let byAction = peers.get(peerId);
+		if (byAction === void 0) {
+			byAction = /* @__PURE__ */ new Map();
+			peers.set(peerId, byAction);
+		}
+		const existing = byAction.get(action);
+		if (existing !== void 0) return existing;
+		if (byAction.size >= 64) {
+			let overflow = byAction.get(CAP_ACTION_OVERFLOW_LABEL);
+			if (overflow === void 0) {
+				overflow = emptyCounters();
+				byAction.set(CAP_ACTION_OVERFLOW_LABEL, overflow);
+			}
+			return overflow;
+		}
+		const fresh = emptyCounters();
+		byAction.set(action, fresh);
+		return fresh;
+	};
+	return {
+		record(peerId, action, reqBytes, resBytes) {
+			const c = slot(peerId, action);
+			c.calls += 1;
+			c.reqBytes += reqBytes;
+			c.resBytes += resBytes;
+		},
+		recordForward(peerId, action, kind) {
+			const c = slot(peerId, action);
+			if (kind === "raw") c.raw += 1;
+			else c.decoded += 1;
+		},
+		recordUnlabelled(peerId, bytes) {
+			const c = slot(peerId, CAP_ACTION_UNLABELLED);
+			c.resBytes += bytes;
+		},
+		forget(peerId) {
+			peers.delete(peerId);
+		},
+		read() {
+			const out = /* @__PURE__ */ new Map();
+			for (const [peerId, byAction] of peers) {
+				const copy = /* @__PURE__ */ new Map();
+				for (const [action, c] of byAction) copy.set(action, {
+					calls: c.calls,
+					reqBytes: c.reqBytes,
+					resBytes: c.resBytes,
+					raw: c.raw,
+					decoded: c.decoded
+				});
+				out.set(peerId, copy);
+			}
+			return out;
+		}
+	};
+}
+function sampleOf(reading, peerId, action) {
+	return reading.get(peerId)?.get(action);
+}
+/**
+* Subtract the previous reading from the current one.
+*
+* A peer whose runner RESPAWNED reconnects under the same id with counters
+* that went backwards. Clamped at 0, exactly as `diffSocketPlane` clamps for
+* the same reason: its traffic in that window is genuinely unknown, and a
+* negative number on a rate reads as a broken meter.
+*/
+function diffCapActionCensus(before, current, topN) {
+	const deltas = [];
+	let labelledBytes = 0;
+	let totalBytes = 0;
+	for (const [peerId, byAction] of current) for (const [action, now] of byAction) {
+		const then = sampleOf(before, peerId, action);
+		const reqBytes = Math.max(0, now.reqBytes - (then?.reqBytes ?? 0));
+		const resBytes = Math.max(0, now.resBytes - (then?.resBytes ?? 0));
+		const bytes = reqBytes + resBytes;
+		totalBytes += bytes;
+		if (action === "(unlabelled)" || action === "(overflow)") continue;
+		labelledBytes += bytes;
+		if (bytes === 0) continue;
+		deltas.push({
+			peerId,
+			action,
+			calls: Math.max(0, now.calls - (then?.calls ?? 0)),
+			reqBytes,
+			resBytes,
+			raw: Math.max(0, now.raw - (then?.raw ?? 0)),
+			decoded: Math.max(0, now.decoded - (then?.decoded ?? 0))
+		});
+	}
+	return {
+		top: deltas.toSorted((a, b) => b.reqBytes + b.resBytes - (a.reqBytes + a.resBytes) || a.peerId.localeCompare(b.peerId) || a.action.localeCompare(b.action)).slice(0, topN),
+		labelledBytes,
+		totalBytes
+	};
+}
+//#endregion
 //#region src/kernel/transport/socket-traffic.ts
 function createSocketDirectionCounters() {
 	return {
@@ -308,12 +468,17 @@ function createSocketPlaneReader(sources) {
 				peers.push({
 					peerId: child.childId,
 					tx: traffic.tx,
-					rx: traffic.rx
+					rx: traffic.rx,
+					queuedBytes: registry.getChildQueuedBytes(child.childId)
 				});
 			}
+			const forward = registry.readForwardCensus?.();
+			const actions = registry.readActionCensus?.();
 			return {
 				peers,
-				peersConnected: listed.length
+				peersConnected: listed.length,
+				...forward === void 0 ? {} : { forward },
+				...actions === void 0 ? {} : { actions }
 			};
 		} catch {
 			return;
@@ -331,8 +496,41 @@ function createSocketPlaneReader(sources) {
 * stops being read.
 */
 var SOCKET_PLANE_TOP_N = 5;
+/** How many queue-holding peers get named. Three: a queue is an exception,
+*  and the line already carries five names for traffic. */
+var SOCKET_QUEUE_TOP_N = 3;
+/** The queue reading over the current counters — a level, so no baseline. */
+function readSocketQueues(current) {
+	let totalBytes = 0;
+	let unmeasured = 0;
+	const holding = [];
+	for (const peer of current.peers) {
+		if (peer.queuedBytes === null) {
+			unmeasured += 1;
+			continue;
+		}
+		totalBytes += peer.queuedBytes;
+		if (peer.queuedBytes > 0) holding.push({
+			peerId: peer.peerId,
+			bytes: peer.queuedBytes
+		});
+	}
+	return {
+		totalBytes,
+		unmeasured,
+		top: holding.toSorted((a, b) => b.bytes - a.bytes || a.peerId.localeCompare(b.peerId)).slice(0, 3)
+	};
+}
 /** A process that has never read the plane. */
 var EMPTY_SOCKET_PLANE_BASELINE = { peers: /* @__PURE__ */ new Map() };
+/** The census over the window; a counter that went backwards reads as quiet. */
+function diffForward(current, before) {
+	if (current === void 0) return void 0;
+	return {
+		raw: Math.max(0, current.raw - (before?.raw ?? 0)),
+		decoded: Math.max(0, current.decoded - (before?.decoded ?? 0))
+	};
+}
 function diffDirection(current, before) {
 	const previous = before ?? EMPTY_SOCKET_DIRECTION;
 	return {
@@ -358,6 +556,14 @@ function addDirection(into, add) {
 function peerMessages(delta) {
 	return socketDirectionMessages(delta.tx) + socketDirectionMessages(delta.rx);
 }
+/**
+* Total bytes a peer moved in the window, both directions — the OTHER
+* ranking, and the one that names a peer the message ranking structurally
+* cannot see (D454).
+*/
+function peerBytes(delta) {
+	return socketDirectionBytes(delta.tx) + socketDirectionBytes(delta.rx);
+}
 /** Subtract the previous cumulative reading from the current one. */
 function diffSocketPlane(baseline, current, topN = 5) {
 	const deltas = [];
@@ -374,12 +580,18 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		rx = addDirection(rx, delta.rx);
 		if (peerMessages(delta) > 0) deltas.push(delta);
 	}
+	const forward = diffForward(current.forward, baseline.forward);
+	const actions = current.actions === void 0 ? void 0 : diffCapActionCensus(baseline.actions ?? EMPTY_CAP_ACTION_READING, current.actions, 5);
 	return {
 		peersConnected: current.peersConnected,
 		peersMeasured: current.peers.length,
 		tx,
 		rx,
-		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN)
+		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		topBytes: deltas.toSorted((a, b) => peerBytes(b) - peerBytes(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
+		queued: readSocketQueues(current),
+		...forward === void 0 ? {} : { forward },
+		...actions === void 0 ? {} : { actions }
 	};
 }
 function createSocketPlaneMeter(reader, topN = 5) {
@@ -388,24 +600,62 @@ function createSocketPlaneMeter(reader, topN = 5) {
 		const current = reader();
 		if (current === void 0) return void 0;
 		const window = diffSocketPlane(baseline, current, topN);
-		baseline = { peers: new Map(current.peers.map((p) => [p.peerId, p])) };
+		baseline = {
+			peers: new Map(current.peers.map((p) => [p.peerId, p])),
+			...current.forward === void 0 ? {} : { forward: current.forward },
+			...current.actions === void 0 ? {} : { actions: current.actions }
+		};
 		return window;
 	} };
 }
 /** Bytes → whole kB. The plane moves 180–330 MB/min; raw bytes would put
 *  nine-digit numbers on a line that has to stay readable. */
-function kb(bytes) {
+function kb$1(bytes) {
 	return Math.round(bytes / 1024);
 }
 /** `req:<msgs>/<kB>,res:<msgs>/<kB>,evt:<msgs>/<kB>` — every kind, always,
 *  including at zero: a kind that went quiet is a reading, not a blank. */
 function formatDirection(sample) {
-	return `req:${sample.reqMessages}/${kb(sample.reqBytes)}kB,res:${sample.resMessages}/${kb(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb(sample.evtBytes)}kB`;
+	return `req:${sample.reqMessages}/${kb$1(sample.reqBytes)}kB,res:${sample.resMessages}/${kb$1(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb$1(sample.evtBytes)}kB`;
+}
+/** `<req>/<res>/<evt>` in kB — the byte triple, in the same order as the
+*  message triple next to it, so the two read as one table. */
+function formatPeerBytes(sample) {
+	return `${kb$1(sample.reqBytes)}/${kb$1(sample.resBytes)}/${kb$1(sample.evtBytes)}`;
 }
-/** `<peer>:tx=<req>/<res>/<evt>:rx=<req>/<res>/<evt>:kB=<tx>/<rx>` — the whole
-*  peer×kind cross for one peer, which is the question in one token. */
+/**
+* `<peer>:tx=<req>/<res>/<evt>:rx=…:txkB=<req>/<res>/<evt>:rxkB=…` — the whole
+* peer×kind cross for one peer, messages and bytes, which is the question in
+* one token.
+*
+* The bytes were a per-direction TOTAL until D454, and the total could not
+* answer the question `socket-traffic.ts` says this instrument exists to
+* settle: whether a peer's bytes are RESPONSES (media, and D9/D18 re-opens) or
+* fan-out (`evt`, which scales with runner count and nothing an operator
+* asked for). On 2026-09-11 hub-main wrote 118 MB in one minute to
+* `hub/pipeline-analytics` and the line could only say "118 MB" — separating
+* `res` from `evt` took an hour of arithmetic against the plane-wide totals.
+*/
 function formatPeer(delta) {
-	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:kB=${kb(socketDirectionBytes(delta.tx))}/${kb(socketDirectionBytes(delta.rx))}`;
+	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:txkB=${formatPeerBytes(delta.tx)}:rxkB=${formatPeerBytes(delta.rx)}`;
+}
+/**
+* One named action: `<peer>!<cap>.<method>:<kB>kB/<calls>:r<raw>/d<decoded>`.
+*
+* `!` separates the peer from the action because `.` already separates cap
+* from method and a single delimiter for both would make the token ambiguous
+* to split.
+*
+* The raw/decoded pair is the half that did not exist anywhere before D456.
+* `socketFwd=` answers it for the whole plane — 30 349/5 051 on this hub — and
+* a plane-wide ratio cannot tell a method that is entirely forwarded from one
+* that is entirely decoded, which is the difference between bytes hub-main
+* copies and bytes hub-main reads. The census pays for the two counters it
+* takes; the conclusion they buy is which of the line's megabytes are actually
+* expensive.
+*/
+function formatAction(entry) {
+	return `${entry.peerId}!${entry.action}:${kb$1(entry.reqBytes + entry.resBytes)}kB/${entry.calls}:r${entry.raw}/d${entry.decoded}`;
 }
 /**
 * The suffix appended to a `[mem]` line — leading space included, empty when
@@ -418,14 +668,234 @@ function formatPeer(delta) {
 * is the only way to see an unmeasured channel, and the per-kind splits because
 * "the plane went quiet for a minute" is a reading.
 *
-* `socketTop` is the one conditional field — a ranked list of nothing is noise —
-* and it is a single comma-separated value so the field COUNT does not change
-* from line to line.
+* `socketTop` is a conditional field — a ranked list of nothing is noise — and
+* it is a single comma-separated value so the field COUNT does not change from
+* line to line.
+*
+* `socketTopBytes` is the other one, and its PRESENCE is the reading: it is
+* printed only when ranking by bytes names a peer that ranking by messages
+* does not. A line without it says the two rankings agree; a line with it says
+* a peer is moving few, heavy frames and names it (D454).
 */
 function formatSocketPlane(window) {
 	if (window === void 0) return "";
 	const top = window.top.map(formatPeer).join(",");
-	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`);
+	const named = new Set(window.top.map((p) => p.peerId));
+	const topBytes = window.topBytes.filter((p) => !named.has(p.peerId)).map(formatPeer).join(",");
+	const queuedTop = window.queued.top.map((p) => `${p.peerId}:${kb$1(p.bytes)}`).join(",");
+	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`) + (window.actions === void 0 ? "" : ` socketActions=${kb$1(window.actions.labelledBytes)}/${kb$1(window.actions.totalBytes)}kB` + (window.actions.top.length === 0 ? "" : ` socketTopActions=${window.actions.top.map(formatAction).join(",")}`));
+}
+//#endregion
+//#region src/kernel/moleculer/mesh-queue-report.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+/** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
+function writerSocketsOf(broker) {
+	if (!isRecord$1(broker)) return void 0;
+	const transit = broker["transit"];
+	if (!isRecord$1(transit)) return void 0;
+	const transporter = transit["tx"];
+	if (!isRecord$1(transporter)) return void 0;
+	const writer = transporter["writer"];
+	if (!isRecord$1(writer)) return void 0;
+	const sockets = writer["sockets"];
+	return sockets instanceof Map ? sockets : void 0;
+}
+function readSocket(nodeId, socket) {
+	if (typeof nodeId !== "string" || !isRecord$1(socket)) return void 0;
+	const queuedBytes = socket["writableLength"];
+	const bytesWritten = socket["bytesWritten"];
+	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
+	return {
+		nodeId,
+		queuedBytes,
+		bytesWritten
+	};
+}
+/**
+* Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
+* may throw, and a diagnostic that can crash the process it watches is worse
+* than none.
+*/
+function createMeshQueueReader(getBroker) {
+	return () => {
+		try {
+			const sockets = writerSocketsOf(getBroker());
+			if (sockets === void 0) return void 0;
+			const peers = [];
+			for (const [nodeId, socket] of sockets) {
+				const peer = readSocket(nodeId, socket);
+				if (peer !== void 0) peers.push(peer);
+			}
+			return peers;
+		} catch {
+			return;
+		}
+	};
+}
+/** At most this many nodes named. A cluster has a handful. */
+var MESH_QUEUE_TOP_N = 3;
+function kb(bytes) {
+	return Math.round(bytes / 1024);
+}
+/**
+* The suffix appended to a `[mem]` line — leading space included, empty when
+* this process has no mesh writer. `meshQueued` is printed always, at zero
+* included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
+* a queue, largest first — a ranked list of zeros is noise.
+*/
+function formatMeshQueue(peers) {
+	if (peers === void 0) return "";
+	const total = peers.reduce((sum, p) => sum + p.queuedBytes, 0);
+	const top = peers.filter((p) => p.queuedBytes > 0).toSorted((a, b) => b.queuedBytes - a.queuedBytes || a.nodeId.localeCompare(b.nodeId)).slice(0, 3).map((p) => `${p.nodeId}:${kb(p.queuedBytes)}`).join(",");
+	return ` meshQueued=${kb(total)}kB` + (top.length === 0 ? "" : ` meshQueuedTop=${top}`);
+}
+//#endregion
+//#region src/kernel/outbound-queue-watch.ts
+/**
+* outbound-queue-watch — an outbound socket queue that HOLDS is named, and its
+* release is timestamped (D446).
+*
+* ## The blind spot this closes
+*
+* On 2026-09-10 hub-main's `arrayBuffers` climbed twice at a constant rate
+* (20 MB/min to 1 264 MB; 63 MB/min for 77 min to 4 968 MB), LIVE across a
+* forced compaction, with ~4 % of JS heap alongside, and each time released in
+* one instant with no line from any owner. The investigation excluded "every
+* socket write queue" by summing `writableLength` over
+* `process._getActiveHandles()` — 84 MB, all of it the phone's WebSocket.
+*
+* `_getActiveHandles()` lists only handles that keep the loop alive. An
+* UNREF'D socket is not one of them, and Moleculer's `TcpWriter.connect`
+* unrefs every socket it opens to a peer node (`transporters/tcp/tcp-writer.js`,
+* `socket.unref()`). So the one outbound plane that writes to another MACHINE
+* — where a reader that stops draining is the ordinary failure — was never in
+* the sum. The UDS children were in it, but only as a total, at one instant,
+* by hand.
+*
+* ## What this is
+*
+* A pure gate over per-peer queue depths the heartbeat reads on every probe:
+* the UDS children's `socket.writableLength` (`SocketChannel.queuedBytes`) and
+* the mesh writer sockets' (`mesh-queue-report.ts`). It says three things and
+* nothing else:
+*
+*  - a peer whose queue has been at or above {@link OUTBOUND_QUEUE_THRESHOLD_BYTES}
+*    for {@link OUTBOUND_QUEUE_SUSTAIN_MS} is NAMED, with its current and peak
+*    depth and how long it has held — at most once per
+*    {@link OUTBOUND_QUEUE_COOLDOWN_MS};
+*  - a named peer whose queue then falls under half the threshold, or that
+*    vanishes from the readings (its socket died — which is how a queue is
+*    dropped in one instant), is reported as RELEASED with its peak and the
+*    hold, so the release the episodes never logged has a line and a peer;
+*  - a burst that drains inside the sustain window says nothing. Backpressure
+*    measures LIVENESS, not identity (D444): a peer momentarily behind is
+*    coming back.
+*
+* ## What it is NOT
+*
+* Not a bound. It terminates nothing: a UDS child whose channel is destroyed
+* loses every in-flight call, and a mesh socket Moleculer reconnects on its
+* own terms. The WS guard (`ws-slow-consumer-guard.ts`) bounds the one plane
+* whose client is expendable. Here the line is the deliverable; what to do
+* about a peer that holds is decided with the peer named, not before.
+*/
+/** 64 MiB. Below this a queue is a burst on a busy peer (the orchestrator's
+*  channel moves ~1.5 MB/s of audio responses); above it, and held, it is
+*  retention with a name. */
+var OUTBOUND_QUEUE_THRESHOLD_BYTES = 64 * 1024 * 1024;
+/** Matches the ArrayBuffer census sustain: a minute above the bound. */
+var OUTBOUND_QUEUE_SUSTAIN_MS = 6e4;
+/** A held queue is re-named every ten minutes, not every probe. */
+var OUTBOUND_QUEUE_COOLDOWN_MS = 10 * 6e4;
+/** A release is a fall under this fraction of the threshold. */
+var RELEASE_RATIO = .5;
+/**
+* The pure decision — threshold, sustain, cooldown, release, gone — testable
+* without a socket.
+*/
+function createOutboundQueueGate(options = {}) {
+	const thresholdBytes = options.thresholdBytes ?? 67108864;
+	const sustainMs = options.sustainMs ?? 6e4;
+	const cooldownMs = options.cooldownMs ?? 6e5;
+	const tracked = /* @__PURE__ */ new Map();
+	const judgeOne = (peerId, bytes, at) => {
+		const state = tracked.get(peerId);
+		if (bytes >= thresholdBytes) {
+			const next = state === void 0 ? {
+				aboveSince: at,
+				peakBytes: bytes,
+				lastNamedAt: null
+			} : {
+				...state,
+				peakBytes: Math.max(state.peakBytes, bytes)
+			};
+			const heldForMs = at - next.aboveSince;
+			const due = heldForMs >= sustainMs && (next.lastNamedAt === null || at - next.lastNamedAt >= cooldownMs);
+			tracked.set(peerId, due ? {
+				...next,
+				lastNamedAt: at
+			} : next);
+			return due ? {
+				kind: "sustained",
+				peerId,
+				bytes,
+				peakBytes: next.peakBytes,
+				heldForMs
+			} : void 0;
+		}
+		if (state === void 0) return void 0;
+		if (bytes >= thresholdBytes * RELEASE_RATIO) return void 0;
+		tracked.delete(peerId);
+		if (state.lastNamedAt === null) return void 0;
+		return {
+			kind: "released",
+			peerId,
+			peakBytes: state.peakBytes,
+			toBytes: bytes,
+			heldForMs: at - state.aboveSince,
+			gone: false
+		};
+	};
+	return { observe(readings, at) {
+		const verdicts = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const reading of readings) {
+			seen.add(reading.peerId);
+			const verdict = judgeOne(reading.peerId, reading.bytes, at);
+			if (verdict !== void 0) verdicts.push(verdict);
+		}
+		for (const [peerId, state] of tracked) {
+			if (seen.has(peerId)) continue;
+			tracked.delete(peerId);
+			if (state.lastNamedAt === null) continue;
+			verdicts.push({
+				kind: "released",
+				peerId,
+				peakBytes: state.peakBytes,
+				toBytes: 0,
+				heldForMs: at - state.aboveSince,
+				gone: true
+			});
+		}
+		return verdicts;
+	} };
+}
+var BYTES_PER_MB$1 = 1048576;
+function mb$2(bytes) {
+	return Math.round(bytes / BYTES_PER_MB$1);
+}
+/** `60s` under two minutes, `77m` from there — the hold is read at a glance. */
+function duration(ms) {
+	const seconds = Math.round(ms / 1e3);
+	return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)}m`;
+}
+/** The line for one verdict. Both carry the peer, the bytes and the hold;
+*  the sustained one also says why the older census could not see it. */
+function formatOutboundQueueVerdict(label, verdict) {
+	if (verdict.kind === "sustained") return `[mem] ${label} outbound queue to ${verdict.peerId} has held ${mb$2(verdict.bytes)}MB (peak ${mb$2(verdict.peakBytes)}MB) for ${duration(verdict.heldForMs)} — the peer is not draining what this process writes to it. This is socket.writableLength on the channel itself; a sum over _getActiveHandles() does not list an unref'd socket and would miss it.`;
+	return `[mem] ${label} outbound queue to ${verdict.peerId} RELEASED — ${mb$2(verdict.peakBytes)}MB at peak, ${mb$2(verdict.toBytes)}MB now, held ${duration(verdict.heldForMs)}` + (verdict.gone ? " (peer gone: the socket closed and dropped its queue)" : " (drained)");
 }
 //#endregion
 //#region src/kernel/heap-spaces.ts
@@ -849,6 +1319,125 @@ function formatArrayBufferCensus(label, report, context) {
 	return `[mem] ${label} arrayBuffer census: live=${live}MB in ${report.count} ArrayBuffers (raw arrayBuffers=${context.rawMb}MB at the trigger → ${verdict}) top sizes: ${report.topSizes.map(formatExact).join(", ") || "(none)"}; buckets: ${report.buckets.map(formatBucket).join(", ") || "(none)"}; detached=${report.detached} took=${context.tookMs}ms — cost: ONE forced full GC (the same pause as a reclaim pass), walked in memory, nothing serialised, nothing written; trigger: ${context.reason}`;
 }
 //#endregion
+//#region src/kernel/gc-census.ts
+function countsOf(entries, kinds) {
+	let majors = 0;
+	let minors = 0;
+	let incrementals = 0;
+	let pauseMs = 0;
+	for (const e of entries) {
+		if (e.kind === kinds.major) majors++;
+		else if (e.kind === kinds.minor) minors++;
+		else if (e.kind === kinds.incremental) incrementals++;
+		pauseMs += e.durationMs;
+	}
+	return {
+		majors,
+		minors,
+		incrementals,
+		pauseMs,
+		windowMs: 0
+	};
+}
+/**
+* Build a census over an injected observer.
+*
+* Returns `undefined` when the observer cannot be installed — the caller then
+* prints nothing, which is the honest reading. It must never degrade into a
+* census that reports zero collections: a process whose GC is not being
+* observed and a process that is not collecting look identical on the line, and
+* they are the two answers furthest apart.
+*/
+function createGcCensus(install, kinds, startedAt) {
+	let pending = [];
+	const stopObserving = install((entry) => {
+		pending.push(entry);
+	});
+	if (stopObserving === void 0) return void 0;
+	let windowStart = startedAt;
+	return {
+		read: (at) => {
+			const windowMs = at - windowStart;
+			if (windowMs < 1e3) return null;
+			const taken = pending;
+			pending = [];
+			windowStart = at;
+			return {
+				...countsOf(taken, kinds),
+				windowMs
+			};
+		},
+		stop: () => {
+			stopObserving();
+			pending = [];
+		}
+	};
+}
+/**
+* The observer this process actually gets.
+*
+* Everything that can fail is inside the try: a runtime without
+* `perf_hooks`, without the `gc` entry type, or without the kind constants
+* yields `undefined` from `install`, and {@link createGcCensus} then declines
+* to exist rather than reporting zeros.
+*/
+function nodeGcObserver() {
+	return {
+		kinds: readKinds({
+			major: 4,
+			minor: 1,
+			incremental: 8
+		}),
+		install: (observe) => {
+			try {
+				const observer = new (process.getBuiltinModule("node:perf_hooks")).PerformanceObserver((list) => {
+					for (const entry of list.getEntries()) {
+						const detail = "detail" in entry ? entry.detail : void 0;
+						observe({
+							kind: typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1,
+							durationMs: entry.duration
+						});
+					}
+				});
+				observer.observe({ entryTypes: ["gc"] });
+				return () => {
+					observer.disconnect();
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+function readKinds(fallback) {
+	try {
+		const c = process.getBuiltinModule("node:perf_hooks").constants;
+		return {
+			major: c.NODE_PERFORMANCE_GC_MAJOR,
+			minor: c.NODE_PERFORMANCE_GC_MINOR,
+			incremental: c.NODE_PERFORMANCE_GC_INCREMENTAL
+		};
+	} catch {
+		return fallback;
+	}
+}
+/**
+* The two fields, APPENDED LAST on the `[mem]` line.
+*
+* D446's rule: no existing field moves, so every Loki prefix written since
+* 2026-08-29 still matches. `gc=` prints even when nothing was collected — a
+* window with no collections is a reading, and it is the reading that says a
+* process is idle rather than unobserved. `gcPauseMs=` is the MAIN-THREAD
+* pause only; the concurrent marking that cost hub-main 70 % of its CPU is on
+* the platform workers and no in-process counter sees it, which is why the
+* field is named for the thread it describes (D456, part 4).
+*/
+function formatGcCensus(window) {
+	if (window === null || window === void 0) return "";
+	const perMin = (n) => window.windowMs <= 0 ? "?" : (n / (window.windowMs / 6e4)).toFixed(1);
+	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}`;
+}
+//#endregion
 //#region src/kernel/heap-watch.ts
 /**
 * heap-watch — hub-main's own memory, on the record, and returned to the OS.
@@ -1413,6 +2002,27 @@ function format(label, s, loop, budgetMb, suffix) {
 	return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms${suffix}`;
 }
 /**
+* Every outbound queue the heartbeat can reach, as the gate wants them: the
+* UDS children (only those whose channel keeps a reading — an unmeasured
+* peer is not a zero) and the mesh writer sockets, each prefixed with its
+* plane.
+*/
+function outboundQueueReadings(uds, mesh) {
+	const readings = [];
+	for (const peer of uds?.peers ?? []) {
+		if (peer.queuedBytes === null) continue;
+		readings.push({
+			peerId: `uds:${peer.peerId}`,
+			bytes: peer.queuedBytes
+		});
+	}
+	for (const node of mesh ?? []) readings.push({
+		peerId: `mesh:${node.nodeId}`,
+		bytes: node.queuedBytes
+	});
+	return readings;
+}
+/**
 * Start the heartbeat. Returns a stop function.
 *
 * `unref`ed so it can never hold the process open, and every read is wrapped:
@@ -1424,6 +2034,8 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	const socketPlane = probes?.socketPlane === void 0 ? void 0 : createSocketPlaneMeter(probes.socketPlane);
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
+	const gcObserver = probes?.gcObserver ?? nodeGcObserver();
+	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now());
 	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
 	const minIntervalMs = reclaimOptions?.minIntervalMs ?? 12e4;
 	const steadyStateIntervalMs = reclaimOptions?.steadyStateIntervalMs ?? 6e5;
@@ -1526,7 +2138,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()));
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -1535,8 +2147,17 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			checkRssBudget(sample, at);
 			maybeReclaim(sample);
 			judgeArrayBuffers(sample, at);
+			judgeOutboundQueues(at);
 		} catch {}
 	};
+	const meshQueue = probes?.meshQueue;
+	const queueReader = probes?.socketPlane;
+	const queueGate = queueReader === void 0 && meshQueue === void 0 ? void 0 : createOutboundQueueGate(probes?.outboundQueue);
+	const judgeOutboundQueues = (at) => {
+		if (queueGate === void 0) return;
+		const readings = outboundQueueReadings(queueReader?.(), meshQueue?.());
+		for (const verdict of queueGate.observe(readings, at)) sink.warn(formatOutboundQueueVerdict(label, verdict));
+	};
 	const censusProbe = probes?.arrayBufferCensus;
 	const censusGate = censusProbe === void 0 ? void 0 : createArrayBufferCensusGate(censusProbe);
 	let censusInFlight = false;
@@ -1574,6 +2195,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 		stopped = true;
 		clearInterval(timer);
 		loopDelay?.stop();
+		gcCensus?.stop();
 	};
 }
 /**
@@ -5333,6 +5955,74 @@ function encodeFrame(value) {
 	Buffer.from(body.buffer, body.byteOffset, body.byteLength).copy(out, 4);
 	return out;
 }
+/** msgpack `fixstr` of {@link PAYLOAD_KEY}: `0xa0 | length`, then the bytes. */
+var PAYLOAD_KEY_BYTES = Buffer.from([162, ...Buffer.from("pl")]);
+/** msgpack `bin 32` marker: one byte, then a 4-byte big-endian length. */
+var BIN32_MARKER = 198;
+/** msgpack `fixmap` range: `0x80 | count`, count in `0..15`. */
+var FIXMAP_BASE = 128;
+var FIXMAP_MAX_COUNT = 15;
+/**
+* Encode the HEAD of a frame that carries an opaque payload: the length
+* prefix, the msgpack envelope with one extra key ({@link PAYLOAD_KEY}), and
+* the `bin 32` header for the payload — everything but the payload bytes
+* themselves, which the caller writes straight after it.
+*
+* ## Why the payload is the frame's TAIL and not a field
+*
+* hub-main routes every sibling↔sibling call. Until this existed it decoded
+* the whole request (args included), built a new message, and re-encoded it
+* — walking a 13.5 KB PCM chunk or a 2 000-row settings answer twice on the
+* one thread that serves every tRPC request, and allocating an `Encoder`
+* buffer that doubles from 2 KiB up to the body's size on every write
+* (D441: ~27 % of hub-main's busy time in msgpack decode, ~6 % in encode,
+* and the churn that fed a 29.5 % GC share).
+*
+* With the payload appended as the LAST key of the map, the receiver's
+* ordinary msgpack decode yields it as a zero-copy VIEW of the frame
+* (`@msgpack/msgpack` decodes `bin` as `subarray`), the router reads only the
+* envelope, and forwarding is: encode a ~60-byte head, write it, write the
+* view. The wire stays plain msgpack — a peer that never heard of payloads
+* decodes `{ …frame, pl: <bytes> }` and can be told, at register, not to be
+* sent one.
+*
+* ## The one hand-written msgpack in this repository
+*
+* `@msgpack/msgpack` has no "encode a map, then append a key" API, so the
+* envelope is encoded normally and its `fixmap` count byte is bumped by one
+* before the key and the `bin 32` header are appended. That patch is only
+* valid for a `fixmap` (≤ 15 keys); a `Frame` has at most four, and anything
+* else is refused rather than silently corrupted.
+*/
+function encodeFrameHead(frame, payload) {
+	const envelope = encode(frame, ENCODE_OPTIONS);
+	const first = envelope[0];
+	if (envelope.byteLength === 0 || first === void 0 || first < FIXMAP_BASE || first > 142) throw new Error(`encodeFrameHead: envelope must be a msgpack fixmap with at most ${FIXMAP_MAX_COUNT - 1} keys (got leading byte 0x${(first ?? 0).toString(16)})`);
+	const bodyLength = envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5 + payload.byteLength;
+	const head = Buffer.allocUnsafe(HEADER_BYTES + envelope.byteLength + PAYLOAD_KEY_BYTES.byteLength + 5);
+	head.writeUInt32BE(bodyLength, 0);
+	Buffer.from(envelope.buffer, envelope.byteOffset, envelope.byteLength).copy(head, HEADER_BYTES);
+	head[HEADER_BYTES] = first + 1;
+	let at = HEADER_BYTES + envelope.byteLength;
+	PAYLOAD_KEY_BYTES.copy(head, at);
+	at += PAYLOAD_KEY_BYTES.byteLength;
+	head[at] = BIN32_MARKER;
+	head.writeUInt32BE(payload.byteLength, at + 1);
+	return head;
+}
+/**
+* Serialise a value into the bytes a payload carries. The SAME options as the
+* envelope codec, so `undefined` properties are omitted rather than turned
+* into `null` — a `z.void()` cap output must read back as `undefined` on the
+* far side exactly as it did when it travelled inline.
+*/
+function packPayload(value) {
+	return encode(value, ENCODE_OPTIONS);
+}
+/** Inverse of {@link packPayload}. A `bin` inside decodes as a view of `bytes`. */
+function unpackPayload(bytes) {
+	return decode(bytes);
+}
 /** Bytes in the big-endian length prefix that opens every frame. */
 var HEADER_BYTES = 4;
 /**
@@ -5491,6 +6181,25 @@ function localEndpointPath(nodeId) {
 	if (process.platform === "win32") return `\\\\.\\pipe\\camstack-${safe}`;
 	return join(tmpdir(), `camstack-${safe}.sock`);
 }
+//#endregion
+//#region src/kernel/transport/local-transport.ts
+/**
+* An answer that carries an opaque payload beside its body.
+*
+* A CLASS rather than a shape so the channel can tell it from a provider's
+* ordinary `{ body, payload }` return value by identity, never by duck-typing:
+* a cap method is free to return an object with those two keys and it must
+* travel inline like any other. `request()` resolves with one of these only
+* when the peer's `res` frame carried a payload.
+*/
+var PayloadReply = class {
+	body;
+	payload;
+	constructor(body, payload) {
+		this.body = body;
+		this.payload = payload;
+	}
+};
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -5508,6 +6217,8 @@ var SocketChannel = class {
 	txCounters = createSocketDirectionCounters();
 	/** Frames read from the peer, cumulative, split by kind. */
 	rxCounters = createSocketDirectionCounters();
+	/** See {@link CapActionChannelObserver}. Absent = no per-action census. */
+	actionObserver = null;
 	constructor(socket) {
 		this.socket = socket;
 		socket.on("data", (chunk) => this.onData(chunk));
@@ -5538,15 +6249,25 @@ var SocketChannel = class {
 				}, timeoutMs);
 				timer.unref?.();
 			}
+			const label = this.labelSafely(body);
 			this.pending.set(id, {
 				resolve,
 				reject,
-				timer
+				timer,
+				action: null
 			});
-			this.send({
+			const reqBytes = this.send({
 				k: "req",
 				id,
 				body
+			}, opts?.payload);
+			const entry = this.pending.get(id);
+			if (entry !== void 0 && label !== void 0) this.pending.set(id, {
+				...entry,
+				action: {
+					label,
+					reqBytes
+				}
 			});
 		});
 	}
@@ -5557,6 +6278,36 @@ var SocketChannel = class {
 			body
 		});
 	}
+	/**
+	* Wire the per-action census. Only one observer is active at a time; an
+	* unwired channel records nothing at all (never zeros).
+	*/
+	observeActions(observer) {
+		this.actionObserver = observer;
+	}
+	/**
+	* The label for one envelope, or `undefined` when there is nothing to
+	* record. Wrapped: a broken labeller must never fail the call it watches —
+	* the same discipline `LocalChildRegistry.recordCapUsage` applies, and for
+	* the same reason.
+	*/
+	labelSafely(body) {
+		const obs = this.actionObserver;
+		if (obs === null) return void 0;
+		try {
+			return obs.label(body);
+		} catch {
+			return null;
+		}
+	}
+	/** Settle one request/response pair on the census. Never throws. */
+	recordAction(label, reqBytes, resBytes) {
+		const obs = this.actionObserver;
+		if (obs === null) return;
+		try {
+			obs.record(label, reqBytes, resBytes);
+		} catch {}
+	}
 	/** Replace the request handler. Only one handler is active at a time. */
 	onRequest(handler) {
 		this.requestHandler = handler;
@@ -5587,11 +6338,44 @@ var SocketChannel = class {
 			rx: sampleSocketDirection(this.rxCounters)
 		};
 	}
-	send(frame) {
-		if (this.closed) return;
-		const encoded = encodeFrame(frame);
-		recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
-		this.socket.write(encoded);
+	/**
+	* Bytes handed to the socket that the kernel has not taken yet — the
+	* `Writable` buffer plus the write in flight. Read LIVE, never cached: this
+	* is the number that says whether the peer is draining what we write, and
+	* it is read on every heartbeat probe (D446). An unref'd socket keeps it
+	* exactly like a ref'd one, which is why it is read here and not summed
+	* over `_getActiveHandles()`.
+	*/
+	queuedBytes() {
+		return this.socket.writableLength;
+	}
+	/**
+	* Write one frame. With a payload the head and the tail are two `write`
+	* calls under `cork()` — the kernel sees one `writev`, and the payload bytes
+	* are never copied into the head. A forwarded payload is a view into the
+	* frame it arrived on, and that frame's buffer is never mutated, so handing
+	* the view to the socket is safe.
+	*
+	* Returns the on-the-wire bytes it charged — the same number the per-kind
+	* counter got, so the per-action census can never disagree with the per-peer
+	* one. `0` when the channel is closed and nothing was written.
+	*/
+	send(frame, payload) {
+		if (this.closed) return 0;
+		if (payload === void 0) {
+			const encoded = encodeFrame(frame);
+			recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
+			this.socket.write(encoded);
+			return encoded.byteLength;
+		}
+		const head = encodeFrameHead(frame, payload);
+		const bytes = head.byteLength + payload.byteLength;
+		recordSocketFrame(this.txCounters, frame.k, bytes);
+		this.socket.cork();
+		this.socket.write(head);
+		this.socket.write(payload);
+		this.socket.uncork();
+		return bytes;
 	}
 	onData(chunk) {
 		const frames = this.decoder.push(chunk);
@@ -5610,22 +6394,31 @@ var SocketChannel = class {
 	async handleFrame(frame, wireBytes) {
 		recordSocketFrame(this.rxCounters, frame.k, wireBytes);
 		if (frame.k === "req") {
+			const label = this.labelSafely(frame.body);
+			let resBytes = 0;
 			try {
-				const result = await this.requestHandler(frame.body);
-				this.send({
+				const result = await this.requestHandler(frame.body, frame.pl);
+				if (result instanceof PayloadReply) resBytes = this.send({
+					k: "res",
+					id: frame.id,
+					ok: true,
+					body: result.body
+				}, result.payload);
+				else resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
 					body: result
 				});
 			} catch (err) {
-				this.send({
+				resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: false,
 					err: err instanceof Error ? err.message : String(err)
 				});
 			}
+			if (label !== void 0) this.recordAction(label, wireBytes, resBytes);
 			return;
 		}
 		if (frame.k === "res") {
@@ -5633,8 +6426,10 @@ var SocketChannel = class {
 			if (!p) return;
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
-			if (frame.ok) p.resolve(frame.body);
-			else p.reject(new Error(frame.err));
+			if (p.action !== null) this.recordAction(p.action.label, p.action.reqBytes, wireBytes);
+			if (!frame.ok) p.reject(new Error(frame.err));
+			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
+			else p.resolve(frame.body);
 			return;
 		}
 		this.eventHandler(frame.body);
@@ -6185,760 +6980,457 @@ function deliverShared(state, event) {
 	}
 }
 //#endregion
-//#region src/kernel/moleculer/resilient-cap-call.ts
-/** Moleculer error `type` values meaning "the service is not (yet) routable". */
-var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-/** Default ceiling for the discovery wait — fail-fast past this. */
-var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
-function isDiscoveryError(err) {
-	if (typeof err !== "object" || err === null) return false;
-	const type = err.type;
-	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
-}
+//#region src/kernel/transport/cap-child-index.ts
+/** Separator that cannot occur in a kebab cap name, so the key is unambiguous. */
+var DEVICE_KEY_SEPARATOR = "\0";
+var NO_CANDIDATES = Object.freeze([]);
+var MapCapChildIndex = class {
+	deviceOwners;
+	singletons;
+	constructor(deviceOwners, singletons) {
+		this.deviceOwners = deviceOwners;
+		this.singletons = singletons;
+	}
+	deviceOwner(capName, deviceId) {
+		return this.deviceOwners.get(`${capName}${DEVICE_KEY_SEPARATOR}${deviceId}`) ?? null;
+	}
+	singletonCandidates(capName) {
+		return this.singletons.get(capName) ?? NO_CANDIDATES;
+	}
+};
 /**
-* Call a Moleculer action; on a service-discovery error, wait for the
-* named service to be discovered and retry the call exactly once.
-*/
-async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
-	try {
-		return await broker.call(action, params, opts);
-	} catch (err) {
-		if (!isDiscoveryError(err)) throw err;
-		await broker.waitForServices([serviceName], discoveryTimeoutMs);
-		return await broker.call(action, params, opts);
+* Build the `(cap, device?) → child` index from the connected children.
+*
+* A PURE function of what it is handed — it captures nothing, subscribes to
+* nothing and cannot be updated in place. That is the whole safety argument
+* (D3, D457): the only way to change what it says is to build a new one from
+* the `children` map, so an index can never name a child that map has already
+* dropped. An incremental index — add on register, remove on close — would be
+* a second registry that can disagree with the first, and a stale one routes
+* to a dead runner, which is strictly worse than a slow scan.
+*
+* Cost: O(children × descriptors), paid once per mutation of the children map
+* (a register, a re-register, a disconnect) rather than once per cap call.
+*
+* The two tiers stay separate, exactly as the scan had them: a device lookup
+* is never answered from a deviceId-less descriptor. `resolveChildId` owns
+* the fallback from tier 1 to tier 2, and folding it in here would make it
+* unreachable.
+*/
+function buildCapChildIndex(entries) {
+	const deviceOwners = /* @__PURE__ */ new Map();
+	const singletons = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const namedForThisChild = /* @__PURE__ */ new Set();
+		for (const cap of entry.caps) {
+			if (cap.deviceId === void 0) {
+				if (namedForThisChild.has(cap.capName)) continue;
+				namedForThisChild.add(cap.capName);
+				const candidates = singletons.get(cap.capName);
+				if (candidates === void 0) singletons.set(cap.capName, [entry.childId]);
+				else candidates.push(entry.childId);
+				continue;
+			}
+			const key = `${cap.capName}${DEVICE_KEY_SEPARATOR}${cap.deviceId}`;
+			if (!deviceOwners.has(key)) deviceOwners.set(key, entry.childId);
+		}
 	}
+	return new MapCapChildIndex(deviceOwners, singletons);
 }
 //#endregion
-//#region src/kernel/transport/cap-route.ts
-function buildMessage(capName, method, detail) {
-	const call = method !== void 0 ? `${capName}.${method}` : capName;
-	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
-	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
-	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
-	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+//#region src/kernel/transport/cap-routing-hints.ts
+/** Lift {@link CapRoutingHints} from a call's args. Never throws. */
+function liftRoutingHints(args) {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return {};
+	const nodeId = Reflect.get(args, "nodeId");
+	const addonId = Reflect.get(args, "addonId");
+	return {
+		...typeof nodeId === "string" && nodeId.length > 0 ? { nodeId } : {},
+		...typeof addonId === "string" && addonId.length > 0 ? { addonId } : {}
+	};
+}
+function readFanoutMode() {
+	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
+	if (raw === "shadow" || raw === "broadcast") return raw;
+	return "filter";
 }
-var CapRouteError = class extends Error {
-	reason;
-	nodeId;
-	rejected;
-	/**
-	* @param cause  Optional original error that triggered this routing failure.
-	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
-	*               Dispatchers wrapping transport errors MUST pass the original.
-	*/
-	constructor(capName, method, detail, cause) {
-		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
-		this.name = "CapRouteError";
-		this.reason = detail.reason;
-		this.nodeId = detail.nodeId;
-		this.rejected = detail.rejected;
-	}
-};
 /**
-* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
-*
-* Precedence (explicit nodeId path):
-*   1. hub-in-process — hub node + hubInProcessProvides
-*   2. hub-local-uds  — hub node + hubLocalChildProvides
-*   3. node-offline   → CapRouteError{reason:'node-offline'}
-*   4. agent-child-forward — node is an agent AND nodeKnowsCap
-*   5. remote-moleculer — any other online non-agent node
-*
-* Singleton path (no nodeId):
-*   1. hub-in-process (hub provides in-process)
-*   2. hub-local-uds  (a hub-local UDS child provides it)
-*   3. remote-moleculer (any online, non-hub node that knows it)
-*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
-*
-* PURE: no side effects, no async, no broker/registry imports.
+* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
+* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
+* prefix to distinguish routing failures (safe to retry via broker) from real
+* provider errors (must NOT retry to avoid double-executing side effects).
 */
-function classifyCapRoute(capName, opts, snapshot) {
-	const rejected = [];
-	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
-	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
-}
-function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
-	if (nodeId === snap.hubNodeId) {
-		const residentProvides = snap.hubResidentProvides;
-		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
-		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
-		if (providesOnHub(capName)) {
-			const ref = getRef?.(capName) ?? null;
-			if (ref !== null) return {
-				kind: "hub-in-process",
-				capName,
-				ref
-			};
-			rejected.push({
-				kind: "hub-in-process",
-				why: "provider ref not available in snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
-		}
-		if (snap.hubLocalChildProvides(capName, deviceId)) {
-			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-			if (childId !== null) return {
-				kind: "hub-local-uds",
-				capName,
-				childId
-			};
-			rejected.push({
-				kind: "hub-local-uds",
-				why: "child id not resolvable from snapshot"
-			});
-			throw new CapRouteError(capName, void 0, {
-				reason: "no-provider",
-				nodeId,
-				rejected
-			});
+var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
+/**
+* Parent-side authority for local addon-runners reachable over a
+* `LocalTransportServer` (UDS). Children register their cap manifest on
+* connect; the registry routes `(capName, deviceId?)` cap calls to the
+* owning child over the channel and drops a child's caps on disconnect.
+*/
+var LocalChildRegistry = class {
+	children = /* @__PURE__ */ new Map();
+	registeredHandler = () => {};
+	goneHandler = () => {};
+	/** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
+	nextIncarnation = 1;
+	eventHandler = null;
+	logHandler = null;
+	readinessHandler = null;
+	server;
+	onUnownedCall;
+	logger;
+	getActiveSingletonAddonId;
+	resolveChildIdForAddon;
+	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
+	ownNodeId;
+	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
+	isAggregatedCollectionMethod;
+	isAddonPinnedCall;
+	/** See {@link ForwardCensus}. Mutable counters on the hot path, by design. */
+	forwardedRaw = 0;
+	forwardedDecoded = 0;
+	/**
+	* The per-ACTION byte census (D456). `ForwardCensus` above is the same
+	* question asked of the whole plane; this one asks it per `<cap>.<method>`,
+	* beside the bytes that method actually moved. Both are kept: `socketFwd=`
+	* says whether the negotiation is working at all, and a `raw=0` on ONE
+	* method with `raw>0` on its neighbours is a different fault.
+	*/
+	actionCensus = createCapActionCensus();
+	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
+	capTimeoutMs;
+	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+	capUsageObserver;
+	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
+	egressRoutedCaps = /* @__PURE__ */ new Set();
+	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
+	fanoutMode = readFanoutMode();
+	/** Per-child event fan-out counters (sent / suppressed). */
+	childEventStats = /* @__PURE__ */ new Map();
+	/** Last pattern-set string logged per child, to dedup the INFO line. */
+	loggedPatternSet = /* @__PURE__ */ new Map();
+	/**
+	* Derived `(cap, device?) → child` index over {@link children}, or `null`
+	* when it must be rebuilt. See {@link capIndex} for why it is a cache and
+	* never a registry (D3, D457).
+	*/
+	capChildIndex = null;
+	/**
+	* Accepts either a plain positional `server` argument (backward-compatible)
+	* or a full `LocalChildRegistryOptions` object.
+	*
+	* Positional overloads (existing call sites are unchanged):
+	*   new LocalChildRegistry(server)
+	*   new LocalChildRegistry(server, onUnownedCall)
+	*
+	* Options object (new call sites that pass a logger):
+	*   new LocalChildRegistry({ server, onUnownedCall, logger })
+	*/
+	constructor(serverOrOptions, onUnownedCallArg) {
+		if (serverOrOptions && !("listen" in serverOrOptions)) {
+			const opts = serverOrOptions;
+			this.server = opts.server;
+			this.onUnownedCall = opts.onUnownedCall;
+			this.logger = opts.logger;
+			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
+			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
+			this.ownNodeId = opts.ownNodeId;
+			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.isAddonPinnedCall = opts.isAddonPinnedCall;
+			this.capTimeoutMs = opts.capTimeoutMs;
+			this.capUsageObserver = opts.capUsageObserver;
+		} else {
+			this.server = serverOrOptions;
+			this.onUnownedCall = onUnownedCallArg;
 		}
-		rejected.push({
-			kind: "hub-in-process",
-			why: "hub does not provide this cap in-process"
-		});
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "no hub-local child provides this cap"
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
 	}
-	if (!snap.nodeOnline(nodeId)) {
-		rejected.push({
-			kind: "remote-moleculer",
-			why: `node ${nodeId} is offline`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "node-offline",
-			nodeId,
-			rejected
-		});
+	async start() {
+		this.logger?.info("UDS event fan-out mode", { mode: this.fanoutMode });
+		this.server.onConnection((channel) => this.onConnection(channel));
+		await this.server.listen();
 	}
-	if (snap.nodeIsAgent(nodeId)) {
-		if (snap.nodeKnowsCap(nodeId, capName)) return {
-			kind: "agent-child-forward",
-			capName,
-			agentNodeId: nodeId,
-			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+	/**
+	* Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
+	* child has no recorded events yet. Exposed for the starvation-verification
+	* surface (shadow burn-in + operator debug).
+	*/
+	getChildEventStats(childId) {
+		const s = this.childEventStats.get(childId);
+		return s === void 0 ? null : {
+			sent: s.sent,
+			suppressed: s.suppressed
 		};
-		rejected.push({
-			kind: "agent-child-forward",
-			why: `agent ${nodeId} does not know cap ${capName}`
-		});
-		throw new CapRouteError(capName, void 0, {
-			reason: "no-provider",
-			nodeId,
-			rejected
-		});
 	}
-	return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-}
-function classifySingleton(capName, deviceId, snap, rejected) {
-	if (snap.hubInProcessProvides(capName)) {
-		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
-		if (ref !== null) return {
-			kind: "hub-in-process",
-			capName,
-			ref
-		};
-		rejected.push({
-			kind: "hub-in-process",
-			why: "provider ref not available in snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-in-process",
-		why: "hub does not provide this cap in-process"
-	});
-	if (snap.hubLocalChildProvides(capName, deviceId)) {
-		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId !== null) return {
-			kind: "hub-local-uds",
-			capName,
-			childId
+	/**
+	* This child's socket traffic — bytes and messages, both directions, split by
+	* frame kind — or `null` when the child is gone or its channel keeps no
+	* counters (an in-process or test transport).
+	*
+	* The event counters above cover ONE kind of frame and, once surfaced on
+	* 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
+	* is the same question asked of every frame the channel moves, and it is the
+	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
+	* pair for the whole process and has no per-socket breakdown.
+	*/
+	getChildSocketTraffic(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.readTraffic?.() ?? null;
+	}
+	/**
+	* Bytes this process has written to a child that the child has not yet
+	* taken, live, or `null` when the channel keeps no such reading. Read on
+	* every heartbeat probe (D446) — a child that stops draining is the shape
+	* of an outbound-queue episode, and the number lives on the channel.
+	*/
+	getChildQueuedBytes(childId) {
+		const entry = this.children.get(childId);
+		if (entry === void 0) return null;
+		return entry.channel.queuedBytes?.() ?? null;
+	}
+	/** Cumulative {@link ForwardCensus} of this parent's `cap-call-out` routing. */
+	readForwardCensus() {
+		return {
+			raw: this.forwardedRaw,
+			decoded: this.forwardedDecoded
 		};
-		rejected.push({
-			kind: "hub-local-uds",
-			why: "child id not resolvable from snapshot"
-		});
-	} else rejected.push({
-		kind: "hub-local-uds",
-		why: "no hub-local child provides this cap"
-	});
-	const knownNodes = snap.listKnownNodeIds?.() ?? [];
-	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
-		kind: "remote-moleculer",
-		capName,
-		nodeId
-	};
-	rejected.push({
-		kind: "remote-moleculer",
-		why: "no online remote node knows this cap"
-	});
-	throw new CapRouteError(capName, void 0, {
-		reason: "no-provider",
-		rejected
-	});
-}
-//#endregion
-//#region src/kernel/transport/cap-route-resolver.ts
-/** The Moleculer service name that Task 6's agent registers. */
-var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
-/** The Moleculer action (service.action) for agent cap forwarding. */
-var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
-/** Default timeout for remote Moleculer cap calls (ms). */
-var REMOTE_CALL_TIMEOUT_MS = 6e4;
-function extractDeviceId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "deviceId");
-	return typeof raw === "number" ? raw : void 0;
-}
-/**
-* Extract an inline `nodeId` string from a cap call's args — the per-call node
-* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
-* device-scoped caps carry `deviceId`, and the way the generated cap-router on
-* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
-*
-* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
-* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
-* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
-* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
-* methods that don't declare `nodeId` simply ignore the extra field (they
-* destructure the fields they need); methods that DO declare it (e.g.
-* `getEngineProvisioning({nodeId})`) still receive it unchanged.
-*/
-function extractNodeId(args) {
-	if (args === null || typeof args !== "object") return void 0;
-	const raw = Reflect.get(args, "nodeId");
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
-/**
-* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
-* destructures what it needs and ignores the rest" convention
-* {@link extractNodeId} already relies on for the inline `nodeId` pin.
-* `undefined` (the overwhelmingly common case: no caller hint, or the census
-* consuming it is disarmed) returns `args` unchanged — no allocation. A
-* non-object `args` (or `null`/array) is returned unchanged too: there is
-* nowhere to attach an extra key without changing the payload's shape, and a
-* provider taking a bare value never reads `callerAddonId` off it anyway.
-*/
-function withCallerAddonId(args, callerAddonId) {
-	if (callerAddonId === void 0) return args;
-	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
-	return {
-		...args,
-		callerAddonId
-	};
-}
-var CapRouteResolver = class {
-	hubNodeId;
-	broker;
-	hubLocalRegistry;
-	nodeAuthority;
-	inProcessProviders;
-	hubResidentProviders;
-	capTimeoutMs;
-	snapshot;
-	constructor(deps) {
-		this.hubNodeId = deps.hubNodeId;
-		this.broker = deps.broker;
-		this.hubLocalRegistry = deps.hubLocalRegistry;
-		this.nodeAuthority = deps.nodeAuthority;
-		this.inProcessProviders = deps.inProcessProviders;
-		this.hubResidentProviders = deps.hubResidentProviders;
-		this.capTimeoutMs = deps.capTimeoutMs;
-		this.snapshot = this.buildSnapshot();
 	}
-	/** Per-call RPC timeout: the cap method's declared override, else the default. */
-	callTimeout(capName, method) {
-		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
+	/**
+	* Cumulative per-action byte census: peer → `<cap>.<method>` → bytes, calls
+	* and the raw/decoded split. A COPY (`cap-action-census.ts` explains why it
+	* must be one); the heartbeat subtracts the previous reading.
+	*
+	* This is the instrument D454 closed by asking for. `socketTopBytes=` names
+	* the peer that moves the bytes and `txkB=` says they are responses; neither
+	* can say WHICH method originates them, and after raw-forward the bytes that
+	* cross are no longer the proxy for what hub-main pays — 85.7 % of sibling
+	* calls cross unread. What costs is what hub-main LOOKS at, and that is the
+	* `decoded` half of an entry, next to the bytes it carried.
+	*/
+	readActionCensus() {
+		return this.actionCensus.read();
 	}
-	resolveCapRoute(capName, opts) {
-		return classifyCapRoute(capName, opts, this.snapshot);
+	/**
+	* The regime the counters above were produced under, read once from
+	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
+	*
+	* A suppressed count means "nothing WAS dropped" under `filter` and "nothing
+	* WOULD have been dropped" under `shadow`. Those are different claims, and
+	* until this getter existed the mode was invisible at runtime — the counters
+	* were readable and the regime that produced them was not.
+	*/
+	get eventFanoutMode() {
+		return this.fanoutMode;
 	}
 	/**
-	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
-	* child, IGNORING any in-hub provider registered for the same cap name.
+	* Connected children that never declared a subscription pattern set.
 	*
-	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
-	* provider (e.g. a wrapper) is registered for the cap, the route always
-	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
-	* reached. That is correct for the generic dispatch path (the wrapper is the
-	* active provider), but WRONG for the native-cap fallback
-	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
-	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
-	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
-	* itself, the native is never invoked, and the wrapper silently falls
-	* through to its secondary strategy.
+	* Each one is a fail-open on BOTH planes: `childWantsEvent` returns true for
+	* an undeclared child ({@link ChildEntry.eventPatterns} `=== null`), and
+	* `aggregateEventInterest` returns `null` — accept everything — if ANY
+	* connected child is undeclared, which disables the node's inbound cross-node
+	* gate as well. **One legacy runner silently turns off the filtering for the
+	* whole node**, and nothing reported it, so a zero here is as load-bearing as
+	* a non-zero one.
+	*/
+	undeclaredChildCount() {
+		let count = 0;
+		for (const entry of this.children.values()) if (entry.eventPatterns === null) count += 1;
+		return count;
+	}
+	/**
+	* Does `entry` want to receive an event in `category`? Honours the fan-out
+	* mode: `broadcast` → always; undeclared patterns (`null`) → always
+	* (fail-open); else the child's declared set must match via `matchesPattern`
+	* — the SAME function the child's own `deliverShared` map-key gate uses,
+	* giving provable delivery parity. `shadow` is handled by the caller (it
+	* counts the would-suppress but still sends).
 	*
-	* This method consults ONLY the hub-local-child authority
-	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
-	* it returns the native child route regardless of any in-process shadow.
-	* Returns null when no hub-local child owns `(capName, deviceId)` — the
-	* caller then falls through to its remote-resolution branch.
+	* NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
+	* `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
+	* that explicitly subscribes to a ring-denied category must still RECEIVE it.
 	*/
-	resolveHubLocalUdsRoute(capName, deviceId) {
-		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
-		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
-		if (childId === null) return null;
-		return {
-			kind: "hub-local-uds",
-			capName,
-			childId
-		};
+	childWantsEvent(entry, category) {
+		if (this.fanoutMode === "broadcast") return true;
+		if (entry.eventPatterns === null) return true;
+		return entry.eventPatterns.some((p) => matchesPattern(p, category));
 	}
 	/**
-	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
-	*   the addonId of the provider the CALLER already resolved (e.g.
-	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
-	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
-	*   route already encodes the provider in its action name
-	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
-	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
-	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
-	*   `dispatch`.
-	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
-	*   addon that ORIGINATED the call, distinct from `addonId` above (which
-	*   names the resolved PROVIDER, not the caller). Set by
-	*   `onUnownedCall` from `CapCallInput.callerAddonId`
-	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
-	*   the `hub-in-process` branch consumes it — merged into `args` so a
-	*   diagnostic tool deep in that provider (e.g. device-manager's
-	*   fleet-read census) can read it without every provider method changing
-	*   signature, the same "extra field the provider destructures or
-	*   ignores" convention `nodeId` already uses on this path.
+	* D2: this node's aggregate cross-node event interest — the UNION of every
+	* connected child's declared category patterns. Consumed by the parent's
+	* `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
+	* accepts cross-node (Moleculer) categories at least one local child wants.
+	*
+	* Returns `null` (fail-open — accept everything) when:
+	*   - NO child is currently connected (boot window before the first forked
+	*     child completes its UDS handshake, or every child has disconnected): a
+	*     node MUST NOT drop 100% of inbound cross-node events during that window,
+	*     and a child may connect imminently. This is distinct from the
+	*     declared-empty case below.
+	*   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
+	*     runner): a node cannot safely narrow its inbound set while a child's
+	*     real interest is unknown. Mirrors the per-child fail-open in
+	*     {@link childWantsEvent}, aggregated conservatively.
+	*
+	* Returns an EMPTY array only when ≥1 child is connected and EVERY connected
+	* child declared an explicit empty set — a genuine "wants nothing". Reads the
+	* live `children` map, so a child registering / disconnecting / sending
+	* `event-sub` is reflected on the next call with no extra bookkeeping.
 	*/
-	async dispatch(route, method, args, addonId, callerAddonId) {
-		try {
-			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
-		} catch (err) {
-			if (err instanceof CapRouteError) throw err;
-			const nodeId = this.routeNodeId(route);
-			const cause = err instanceof Error ? err : new Error(String(err));
-			throw new CapRouteError(route.capName, method, {
-				reason: "transport-failed",
-				nodeId,
-				rejected: [{
-					kind: route.kind,
-					why: cause.message
-				}]
-			}, cause);
+	aggregateEventInterest() {
+		if (this.children.size === 0) return null;
+		const union = /* @__PURE__ */ new Set();
+		for (const entry of this.children.values()) {
+			if (entry.eventPatterns === null) return null;
+			for (const p of entry.eventPatterns) union.add(p);
+		}
+		return [...union];
+	}
+	statsFor(childId) {
+		let s = this.childEventStats.get(childId);
+		if (s === void 0) {
+			s = {
+				sent: 0,
+				suppressed: 0
+			};
+			this.childEventStats.set(childId, s);
 		}
+		return s;
+	}
+	/** Deduped INFO line whenever a child's declared pattern set changes. */
+	logPatternSet(childId, patterns) {
+		const key = patterns === null ? "<undeclared>" : JSON.stringify([...patterns].toSorted());
+		if (this.loggedPatternSet.get(childId) === key) return;
+		this.loggedPatternSet.set(childId, key);
+		this.logger?.info("child event patterns", {
+			childId,
+			patterns: patterns ?? null
+		});
 	}
 	/**
-	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
-	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
+	* Child id that can service a call to `capName` (optionally addressing
+	* `deviceId`), or null.
+	*
+	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
+	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
+	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
+	* many cameras — so its descriptor carries no `deviceId`. Resolving on
+	* `deviceId` alone would never match it and would force the call onto the
+	* broker fallback (which then hangs in service discovery). Hence:
+	*   1. exact device-scoped owner (native per-device caps where each child
+	*      owns a disjoint device subset) is preferred, then
+	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
+	* A cap is globally singleton XOR device-scoped, so the two tiers never
+	* compete for the same capName.
 	*/
-	async dispatchInner(route, method, args, addonId, callerAddonId) {
-		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
-			case "hub-local-uds": {
-				const registry = this.hubLocalRegistry;
-				if (registry === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					rejected: [{
-						kind: "hub-local-uds",
-						why: "UDS registry not available"
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const input = {
-					capName: route.capName,
-					method,
-					args,
-					...deviceId !== void 0 ? { deviceId } : {}
-				};
-				return registry.callCapOnChild(route.childId, input);
-			}
-			case "remote-moleculer": {
-				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
-				if (addonId === null) throw new CapRouteError(route.capName, method, {
-					reason: "no-provider",
-					nodeId: route.nodeId,
-					rejected: [{
-						kind: "remote-moleculer",
-						why: `no addonId known for ${route.nodeId}/${route.capName}`
-					}]
-				});
-				const deviceId = extractDeviceId(args);
-				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
-				const action = capActionName(addonId, route.capName, method, isNative);
-				return callWithServiceDiscovery(this.broker, addonId, action, args, {
-					nodeID: route.nodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
-			case "agent-child-forward": {
-				const deviceId = extractDeviceId(args);
-				const params = {
-					capName: route.capName,
-					method,
-					args,
-					...route.childId !== void 0 ? { childId: route.childId } : {},
-					...deviceId !== void 0 ? { deviceId } : {},
-					...addonId !== void 0 ? { addonId } : {}
-				};
-				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
-					nodeID: route.agentNodeId,
-					timeout: this.callTimeout(route.capName, method)
-				});
-			}
+	resolveChildId(capName, deviceId) {
+		const index = this.capIndex();
+		if (deviceId !== void 0) {
+			const deviceOwner = index.deviceOwner(capName, deviceId);
+			if (deviceOwner !== null) return deviceOwner;
 		}
-	}
-	buildSnapshot() {
-		const hubLocalRegistry = this.hubLocalRegistry;
-		const nodeAuthority = this.nodeAuthority;
-		const inProcessProviders = this.inProcessProviders;
-		const hubResidentProviders = this.hubResidentProviders;
-		return {
-			hubNodeId: this.hubNodeId,
-			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
-			...hubResidentProviders !== void 0 ? {
-				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
-				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
-			} : {},
-			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
-			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
-			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
-			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
-			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
-			getInProcessProviderRef: (cap) => inProcessProviders(cap),
-			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
-			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
-		};
-	}
-	/** Extract a nodeId string from a route for error reporting, or undefined. */
-	routeNodeId(route) {
-		switch (route.kind) {
-			case "hub-in-process": return this.hubNodeId;
-			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
-			case "remote-moleculer": return route.nodeId;
-			case "agent-child-forward": return route.agentNodeId;
+		const candidates = index.singletonCandidates(capName);
+		if (candidates.length === 0) return null;
+		if (candidates.length === 1) return candidates[0];
+		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
+		if (preferredAddonId !== null) {
+			const preferredChildId = this.resolveChildIdForAddon?.(preferredAddonId) ?? preferredAddonId;
+			if (candidates.includes(preferredChildId)) return preferredChildId;
 		}
+		return candidates[0];
 	}
-};
-//#endregion
-//#region src/kernel/transport/local-child-registry.ts
-function readFanoutMode() {
-	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
-	if (raw === "shadow" || raw === "broadcast") return raw;
-	return "filter";
-}
-/**
-* Sentinel prefix used in the no-route error thrown when `cap-call-out` has no
-* local sibling and no `onUnownedCall` fallback. `ipcParentLink` detects this
-* prefix to distinguish routing failures (safe to retry via broker) from real
-* provider errors (must NOT retry to avoid double-executing side effects).
-*/
-var UDS_NO_ROUTE_PREFIX = "UDS_NO_ROUTE";
-/**
-* Parent-side authority for local addon-runners reachable over a
-* `LocalTransportServer` (UDS). Children register their cap manifest on
-* connect; the registry routes `(capName, deviceId?)` cap calls to the
-* owning child over the channel and drops a child's caps on disconnect.
-*/
-var LocalChildRegistry = class {
-	children = /* @__PURE__ */ new Map();
-	registeredHandler = () => {};
-	goneHandler = () => {};
-	/** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
-	nextIncarnation = 1;
-	eventHandler = null;
-	logHandler = null;
-	readinessHandler = null;
-	server;
-	onUnownedCall;
-	logger;
-	getActiveSingletonAddonId;
-	resolveChildIdForAddon;
-	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
-	ownNodeId;
-	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
-	isAggregatedCollectionMethod;
-	isAddonPinnedCall;
-	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
-	capTimeoutMs;
-	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
-	capUsageObserver;
-	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
-	egressRoutedCaps = /* @__PURE__ */ new Set();
-	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
-	fanoutMode = readFanoutMode();
-	/** Per-child event fan-out counters (sent / suppressed). */
-	childEventStats = /* @__PURE__ */ new Map();
-	/** Last pattern-set string logged per child, to dedup the INFO line. */
-	loggedPatternSet = /* @__PURE__ */ new Map();
 	/**
-	* Accepts either a plain positional `server` argument (backward-compatible)
-	* or a full `LocalChildRegistryOptions` object.
-	*
-	* Positional overloads (existing call sites are unchanged):
-	*   new LocalChildRegistry(server)
-	*   new LocalChildRegistry(server, onUnownedCall)
+	* Publish one cap-usage observation, if a sink is wired.
 	*
-	* Options object (new call sites that pass a logger):
-	*   new LocalChildRegistry({ server, onUnownedCall, logger })
+	* Cost discipline — this is on the hot path (D181: hub-main's event loop is
+	* the cluster's only queue): no sink means one undefined check; with a sink
+	* it is one object literal and one `Date.now()`, and the sink itself is O(1).
+	* Wrapped so a broken observer can never fail the call it observes — the
+	* registry swallows too, and BOTH matter: this catch also covers a sink that
+	* is not the registry.
 	*/
-	constructor(serverOrOptions, onUnownedCallArg) {
-		if (serverOrOptions && !("listen" in serverOrOptions)) {
-			const opts = serverOrOptions;
-			this.server = opts.server;
-			this.onUnownedCall = opts.onUnownedCall;
-			this.logger = opts.logger;
-			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
-			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
-			this.ownNodeId = opts.ownNodeId;
-			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
-			this.isAddonPinnedCall = opts.isAddonPinnedCall;
-			this.capTimeoutMs = opts.capTimeoutMs;
-			this.capUsageObserver = opts.capUsageObserver;
-		} else {
-			this.server = serverOrOptions;
-			this.onUnownedCall = onUnownedCallArg;
-		}
-	}
-	async start() {
-		this.logger?.info("UDS event fan-out mode", { mode: this.fanoutMode });
-		this.server.onConnection((channel) => this.onConnection(channel));
-		await this.server.listen();
+	recordCapUsage(callerChildId, providerChildId, capName, methodName) {
+		const sink = this.capUsageObserver;
+		if (sink === void 0 || callerChildId === null) return;
+		try {
+			sink({
+				callerAddonId: callerChildId,
+				providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
+				capName,
+				methodName,
+				atMs: Date.now()
+			});
+		} catch {}
 	}
 	/**
-	* Per-child event fan-out counters (`{ sent, suppressed }`) or `null` if the
-	* child has no recorded events yet. Exposed for the starvation-verification
-	* surface (shadow burn-in + operator debug).
+	* The cap index over the CURRENT children, rebuilt on first use after any
+	* mutation of {@link children}.
+	*
+	* This replaced a linear walk of every child's cap manifest per
+	* `cap-call-out`, measured at **7.1 % of hub-main's busy main thread**
+	* across 39 children (D456). Why it did not exist before is the whole
+	* design: what it indexes moves — a runner is replaced on every update, a
+	* crash respawns one, a child re-registers with a replacement manifest after
+	* init — and an index that names a dead child routes work into a socket
+	* nobody is reading, which is strictly worse than a slow scan.
+	*
+	* So it is not maintained; it is DISCARDED. `buildCapChildIndex` is a pure
+	* function of `children.values()`, the only two writers of that map
+	* ({@link invalidateCapIndex}'s call sites) drop the index in the same
+	* statement, and nothing else can construct one. There is no add-on-register
+	* / remove-on-close path that could disagree with the map — i.e. no shadow
+	* registry (D3): the map remains the single authority and this holds no fact
+	* it does not.
+	*
+	* The operator's active-singleton preference is deliberately NOT indexed —
+	* it changes without any child connecting or leaving, so `resolveChildId`
+	* reads it live and the index only supplies the candidate list.
 	*/
-	getChildEventStats(childId) {
-		const s = this.childEventStats.get(childId);
-		return s === void 0 ? null : {
-			sent: s.sent,
-			suppressed: s.suppressed
-		};
+	capIndex() {
+		if (this.capChildIndex === null) this.capChildIndex = buildCapChildIndex(this.children.values());
+		return this.capChildIndex;
+	}
+	/** Drop the derived index. MUST follow every write to {@link children}. */
+	invalidateCapIndex() {
+		this.capChildIndex = null;
 	}
 	/**
-	* This child's socket traffic — bytes and messages, both directions, split by
-	* frame kind — or `null` when the child is gone or its channel keeps no
-	* counters (an in-process or test transport).
+	* Does the named child currently provide `(capName, deviceId?)`?
 	*
-	* The event counters above cover ONE kind of frame and, once surfaced on
-	* 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
-	* is the same question asked of every frame the channel moves, and it is the
-	* only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
-	* pair for the whole process and has no per-socket breakdown.
+	* Used by the hub proxy seam, which knows the EXACT addon (→ runner →
+	* childId) a provider belongs to. Unlike `resolveChildId` (which picks the
+	* first child owning `capName`), this targets one child — required for
+	* COLLECTION caps (`addon-widgets-source`, …) where many children register
+	* the same capName: routing by capName alone collapses every provider to
+	* the first child. Same deviceId-as-hint semantics as `resolveChildId`:
+	* a device-scoped descriptor matching `deviceId` OR a deviceId-less
+	* (singleton/collection) descriptor counts.
 	*/
-	getChildSocketTraffic(childId) {
-		const entry = this.children.get(childId);
-		if (entry === void 0) return null;
-		return entry.channel.readTraffic?.() ?? null;
-	}
 	/**
-	* The regime the counters above were produced under, read once from
-	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
-	*
-	* A suppressed count means "nothing WAS dropped" under `filter` and "nothing
-	* WOULD have been dropped" under `shadow`. Those are different claims, and
-	* until this getter existed the mode was invisible at runtime — the counters
-	* were readable and the regime that produced them was not.
+	* Is `childId` currently connected (has it completed its UDS handshake)?
+	* Coarser than {@link childProvides}: it answers "is the child reachable
+	* over UDS at all", regardless of which caps it has announced yet. Used by
+	* the route-mount fallback to decide between the handler-stripped
+	* `callAddonOnChild(target:'routes')` path (child reachable) and awaiting a
+	* cap proxy's `getRoutes()` (child not yet UDS-registered).
 	*/
-	get eventFanoutMode() {
-		return this.fanoutMode;
+	isChildKnown(childId) {
+		return this.children.has(childId);
+	}
+	childProvides(childId, capName, deviceId) {
+		const entry = this.children.get(childId);
+		if (!entry) return false;
+		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
+		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
 	}
 	/**
-	* Connected children that never declared a subscription pattern set.
-	*
-	* Each one is a fail-open on BOTH planes: `childWantsEvent` returns true for
-	* an undeclared child ({@link ChildEntry.eventPatterns} `=== null`), and
-	* `aggregateEventInterest` returns `null` — accept everything — if ANY
-	* connected child is undeclared, which disables the node's inbound cross-node
-	* gate as well. **One legacy runner silently turns off the filtering for the
-	* whole node**, and nothing reported it, so a zero here is as load-bearing as
-	* a non-zero one.
+	* Per-request options for a cap call: the cap method's declared `timeoutMs`
+	* when one exists, else `undefined` so the channel applies its default.
+	* Mirrors `CapRouteResolver.callTimeout` for the remote plane.
 	*/
-	undeclaredChildCount() {
-		let count = 0;
-		for (const entry of this.children.values()) if (entry.eventPatterns === null) count += 1;
-		return count;
-	}
-	/**
-	* Does `entry` want to receive an event in `category`? Honours the fan-out
-	* mode: `broadcast` → always; undeclared patterns (`null`) → always
-	* (fail-open); else the child's declared set must match via `matchesPattern`
-	* — the SAME function the child's own `deliverShared` map-key gate uses,
-	* giving provable delivery parity. `shadow` is handled by the caller (it
-	* counts the would-suppress but still sends).
-	*
-	* NOTE: this gate must NOT consult `RING_BUFFER_DENY_PATTERNS` /
-	* `isHighFrequencyCategory` — those are ring-buffer STORAGE policy; a child
-	* that explicitly subscribes to a ring-denied category must still RECEIVE it.
-	*/
-	childWantsEvent(entry, category) {
-		if (this.fanoutMode === "broadcast") return true;
-		if (entry.eventPatterns === null) return true;
-		return entry.eventPatterns.some((p) => matchesPattern(p, category));
-	}
-	/**
-	* D2: this node's aggregate cross-node event interest — the UNION of every
-	* connected child's declared category patterns. Consumed by the parent's
-	* `$event-bus` inbound gate (via `setNodeEventInterest`) so the node only
-	* accepts cross-node (Moleculer) categories at least one local child wants.
-	*
-	* Returns `null` (fail-open — accept everything) when:
-	*   - NO child is currently connected (boot window before the first forked
-	*     child completes its UDS handshake, or every child has disconnected): a
-	*     node MUST NOT drop 100% of inbound cross-node events during that window,
-	*     and a child may connect imminently. This is distinct from the
-	*     declared-empty case below.
-	*   - ANY connected child is UNDECLARED (`eventPatterns === null`, a legacy
-	*     runner): a node cannot safely narrow its inbound set while a child's
-	*     real interest is unknown. Mirrors the per-child fail-open in
-	*     {@link childWantsEvent}, aggregated conservatively.
-	*
-	* Returns an EMPTY array only when ≥1 child is connected and EVERY connected
-	* child declared an explicit empty set — a genuine "wants nothing". Reads the
-	* live `children` map, so a child registering / disconnecting / sending
-	* `event-sub` is reflected on the next call with no extra bookkeeping.
-	*/
-	aggregateEventInterest() {
-		if (this.children.size === 0) return null;
-		const union = /* @__PURE__ */ new Set();
-		for (const entry of this.children.values()) {
-			if (entry.eventPatterns === null) return null;
-			for (const p of entry.eventPatterns) union.add(p);
-		}
-		return [...union];
-	}
-	statsFor(childId) {
-		let s = this.childEventStats.get(childId);
-		if (s === void 0) {
-			s = {
-				sent: 0,
-				suppressed: 0
-			};
-			this.childEventStats.set(childId, s);
-		}
-		return s;
-	}
-	/** Deduped INFO line whenever a child's declared pattern set changes. */
-	logPatternSet(childId, patterns) {
-		const key = patterns === null ? "<undeclared>" : JSON.stringify([...patterns].toSorted());
-		if (this.loggedPatternSet.get(childId) === key) return;
-		this.loggedPatternSet.set(childId, key);
-		this.logger?.info("child event patterns", {
-			childId,
-			patterns: patterns ?? null
-		});
-	}
-	/**
-	* Child id that can service a call to `capName` (optionally addressing
-	* `deviceId`), or null.
-	*
-	* `deviceId` is a routing HINT, not a hard filter. A singleton cap
-	* (`pipeline-runner`, `stream-broker`, …) addresses devices through its
-	* METHOD ARGUMENTS — `attachCamera({ deviceId })` is one provider serving
-	* many cameras — so its descriptor carries no `deviceId`. Resolving on
-	* `deviceId` alone would never match it and would force the call onto the
-	* broker fallback (which then hangs in service discovery). Hence:
-	*   1. exact device-scoped owner (native per-device caps where each child
-	*      owns a disjoint device subset) is preferred, then
-	*   2. a singleton owner (deviceId-less descriptor) is the fallback.
-	* A cap is globally singleton XOR device-scoped, so the two tiers never
-	* compete for the same capName.
-	*/
-	resolveChildId(capName, deviceId) {
-		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
-			if (deviceOwner !== null) return deviceOwner;
-		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
-		if (candidates.length === 0) return null;
-		if (candidates.length === 1) return candidates[0];
-		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
-		if (preferredAddonId !== null) {
-			const preferredChildId = this.resolveChildIdForAddon?.(preferredAddonId) ?? preferredAddonId;
-			if (candidates.includes(preferredChildId)) return preferredChildId;
-		}
-		return candidates[0];
-	}
-	/**
-	* Publish one cap-usage observation, if a sink is wired.
-	*
-	* Cost discipline — this is on the hot path (D181: hub-main's event loop is
-	* the cluster's only queue): no sink means one undefined check; with a sink
-	* it is one object literal and one `Date.now()`, and the sink itself is O(1).
-	* Wrapped so a broken observer can never fail the call it observes — the
-	* registry swallows too, and BOTH matter: this catch also covers a sink that
-	* is not the registry.
-	*/
-	recordCapUsage(callerChildId, providerChildId, capName, methodName) {
-		const sink = this.capUsageObserver;
-		if (sink === void 0 || callerChildId === null) return;
-		try {
-			sink({
-				callerAddonId: callerChildId,
-				providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
-				capName,
-				methodName,
-				atMs: Date.now()
-			});
-		} catch {}
-	}
-	/** First child whose cap manifest contains a descriptor matching `predicate`. */
-	findChildId(predicate) {
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
-		return null;
-	}
-	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
-	findAllChildIds(predicate) {
-		const out = [];
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
-		return out;
-	}
-	/**
-	* Does the named child currently provide `(capName, deviceId?)`?
-	*
-	* Used by the hub proxy seam, which knows the EXACT addon (→ runner →
-	* childId) a provider belongs to. Unlike `resolveChildId` (which picks the
-	* first child owning `capName`), this targets one child — required for
-	* COLLECTION caps (`addon-widgets-source`, …) where many children register
-	* the same capName: routing by capName alone collapses every provider to
-	* the first child. Same deviceId-as-hint semantics as `resolveChildId`:
-	* a device-scoped descriptor matching `deviceId` OR a deviceId-less
-	* (singleton/collection) descriptor counts.
-	*/
-	/**
-	* Is `childId` currently connected (has it completed its UDS handshake)?
-	* Coarser than {@link childProvides}: it answers "is the child reachable
-	* over UDS at all", regardless of which caps it has announced yet. Used by
-	* the route-mount fallback to decide between the handler-stripped
-	* `callAddonOnChild(target:'routes')` path (child reachable) and awaiting a
-	* cap proxy's `getRoutes()` (child not yet UDS-registered).
-	*/
-	isChildKnown(childId) {
-		return this.children.has(childId);
-	}
-	childProvides(childId, capName, deviceId) {
-		const entry = this.children.get(childId);
-		if (!entry) return false;
-		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
-		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
-	}
-	/**
-	* Per-request options for a cap call: the cap method's declared `timeoutMs`
-	* when one exists, else `undefined` so the channel applies its default.
-	* Mirrors `CapRouteResolver.callTimeout` for the remote plane.
-	*/
-	capRequestOpts(input) {
-		const declared = this.capTimeoutMs?.(input.capName, input.method);
-		return typeof declared === "number" ? { timeoutMs: declared } : void 0;
+	capRequestOpts(input) {
+		const declared = this.capTimeoutMs?.(input.capName, input.method);
+		return typeof declared === "number" ? { timeoutMs: declared } : void 0;
 	}
 	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
 	async callCapOnChild(childId, input) {
@@ -7096,6 +7588,14 @@ var LocalChildRegistry = class {
 	onConnection(channel) {
 		let childId = null;
 		const incarnation = this.nextIncarnation++;
+		channel.observeActions?.({
+			label: capActionLabel,
+			record: (label, reqBytes, resBytes) => {
+				const peerId = childId ?? "(pre-register)";
+				if (label === null) this.actionCensus.recordUnlabelled(peerId, reqBytes + resBytes);
+				else this.actionCensus.record(peerId, label, reqBytes, resBytes);
+			}
+		});
 		channel.onEvent((body) => {
 			const msg = body;
 			if (msg.kind === "event") {
@@ -7118,7 +7618,7 @@ var LocalChildRegistry = class {
 				return;
 			}
 		});
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
 			if (msg.kind === "register") {
 				if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
@@ -7135,8 +7635,10 @@ var LocalChildRegistry = class {
 					channel,
 					caps: msg.caps,
 					eventPatterns,
-					incarnation
+					incarnation,
+					rawForward: msg.rawForward === true
 				});
+				this.invalidateCapIndex();
 				this.logPatternSet(msg.childId, eventPatterns);
 				this.registeredHandler({
 					childId: msg.childId,
@@ -7144,33 +7646,62 @@ var LocalChildRegistry = class {
 					incarnation,
 					...msg.customActions !== void 0 ? { customActions: msg.customActions } : {}
 				});
-				return { ok: true };
+				return {
+					ok: true,
+					rawForward: true
+				};
 			}
 			if (msg.kind === "cap-call-out") {
 				const out = msg;
-				const input = {
+				const hints = out.hints ?? liftRoutingHints(out.args);
+				const materialise = () => payload !== void 0 ? unpackPayload(payload) : out.args;
+				const buildInput = () => ({
 					capName: out.capName,
 					method: out.method,
-					args: out.args,
+					args: materialise(),
 					...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
 					...out.nodeId !== void 0 ? { nodeId: out.nodeId } : {},
 					...out.native === true ? { native: true } : {},
 					...childId !== null ? { callerAddonId: childId } : {}
-				};
-				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
+				});
+				const pinnedNodeId = out.nodeId ?? hints.nodeId;
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
 				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
-				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
+				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, hints) === true;
 				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
 				this.recordCapUsage(childId, target, out.capName, out.method);
+				const actionPeer = childId ?? "(pre-register)";
+				const actionLabel = `${out.capName}.${out.method}`;
 				if (target !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
 					}
-					return this.callCap(input);
+					const entry = this.children.get(target);
+					if (payload !== void 0 && entry !== void 0 && entry.rawForward) {
+						this.forwardedRaw += 1;
+						this.actionCensus.recordForward(actionPeer, actionLabel, "raw");
+						const forward = {
+							kind: "cap-call",
+							capName: out.capName,
+							method: out.method,
+							args: void 0,
+							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {}
+						};
+						const declared = this.capTimeoutMs?.(out.capName, out.method);
+						return entry.channel.request(forward, {
+							...typeof declared === "number" ? { timeoutMs: declared } : {},
+							payload
+						});
+					}
+					this.forwardedDecoded += 1;
+					this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
+					const input = buildInput();
+					return entry !== void 0 ? this.callCapOnChild(target, input) : this.callCap(input);
 				}
-				if (this.onUnownedCall !== void 0) return this.onUnownedCall(input);
+				this.forwardedDecoded += 1;
+				this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
+				if (this.onUnownedCall !== void 0) return this.onUnownedCall(buildInput());
 				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
 			}
 			if (msg.kind === "readiness-request") return {
@@ -7192,7 +7723,9 @@ var LocalChildRegistry = class {
 				return;
 			}
 			this.children.delete(childId);
+			this.invalidateCapIndex();
 			this.childEventStats.delete(childId);
+			this.actionCensus.forget(childId);
 			this.loggedPatternSet.delete(childId);
 			this.goneHandler(childId, incarnation);
 		});
@@ -7200,6 +7733,11 @@ var LocalChildRegistry = class {
 };
 //#endregion
 //#region src/kernel/transport/local-child-client.ts
+/** Did the parent's `register` answer say it accepts payload-borne args? */
+function ackAcceptsRawForward(ack) {
+	if (ack === null || typeof ack !== "object") return false;
+	return ack.rawForward === true;
+}
 /**
 * Child side of the local UDS transport. Connects to its parent (hub or
 * agent), registers its cap manifest, and serves parent→child cap calls by
@@ -7255,6 +7793,13 @@ var LocalChildClient = class {
 	latestCustomActions = null;
 	/** Events and logs queued while the channel is not yet open. */
 	pendingEmits = [];
+	/**
+	* Whether the parent acknowledged raw-forward at `register`. Until it has,
+	* `callOut` sends args inline exactly as every child always did — a legacy
+	* parent would decode a payload-borne call to `args: undefined` and run the
+	* provider on nothing, silently. Re-read on every re-register.
+	*/
+	parentRawForward = false;
 	/** Handler for parent→child events. Registered via `onEvent`. */
 	eventHandler = null;
 	/**
@@ -7362,15 +7907,20 @@ var LocalChildClient = class {
 		if (this.client !== null) throw new Error("LocalChildClient: already started — call close() first");
 		const client = createLocalTransport().createClient(this.options.nodeId);
 		const channel = await client.connect();
-		channel.onRequest(async (body) => {
+		channel.onRequest(async (body, payload) => {
 			const msg = body;
-			if (msg.kind === "cap-call") return this.options.dispatch({
-				capName: msg.capName,
-				method: msg.method,
-				args: msg.args,
-				...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
-				...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
-			});
+			if (msg.kind === "cap-call") {
+				const args = payload !== void 0 ? unpackPayload(payload) : msg.args;
+				const result = await this.options.dispatch({
+					capName: msg.capName,
+					method: msg.method,
+					args,
+					...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
+					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+				});
+				if (payload !== void 0 && result !== void 0) return new PayloadReply(void 0, packPayload(result));
+				return result;
+			}
 			if (msg.kind === "addon-call") {
 				if (this.addonCallHandler === null) throw new Error(`LocalChildClient: addon-call for "${msg.addonId}" arrived but no onAddonCall handler is registered`);
 				return this.addonCallHandler({
@@ -7394,7 +7944,7 @@ var LocalChildClient = class {
 		});
 		const register = this.registerFrame(this.latestCaps);
 		try {
-			await channel.request(register);
+			this.parentRawForward = ackAcceptsRawForward(await channel.request(register));
 		} catch (err) {
 			await client.close();
 			throw err;
@@ -7404,105 +7954,564 @@ var LocalChildClient = class {
 		this.flushPending(channel);
 		for (const cb of this.connectedHandlers) cb();
 	}
-	/** Flush buffered pre-start emits over the now-open channel. */
-	flushPending(channel) {
-		for (const item of this.pendingEmits) channel.emit(item.msg);
-		this.pendingEmits.length = 0;
+	/** Flush buffered pre-start emits over the now-open channel. */
+	flushPending(channel) {
+		for (const item of this.pendingEmits) channel.emit(item.msg);
+		this.pendingEmits.length = 0;
+	}
+	/**
+	* Re-send the cap manifest to the parent, atomically replacing the child's
+	* registered descriptor set. Call this after device-restore so newly
+	* registered native (device-scoped) caps become routable over UDS.
+	*
+	* Safe to call before `start()`: the new set is buffered and `start()` sends
+	* it (device-restore can race ahead of the UDS connect). After `start()`,
+	* the set is sent immediately.
+	*/
+	async updateCaps(caps, customActions) {
+		this.latestCaps = caps;
+		if (customActions !== void 0) this.latestCustomActions = customActions;
+		if (this.channel === null) return;
+		this.parentRawForward = ackAcceptsRawForward(await this.channel.request(this.registerFrame(caps)));
+	}
+	/**
+	* The register frame: caps, plus everything a re-register must atomically
+	* re-carry so no separate re-sync can be missed — the subscription union
+	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
+	* custom-action catalogs (omitted until the init loop produced them).
+	*/
+	registerFrame(caps) {
+		return {
+			kind: "register",
+			childId: this.options.childId,
+			caps,
+			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
+			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {},
+			rawForward: true
+		};
+	}
+	/**
+	* Fire-and-forget: send a system event to the parent for forwarding to the
+	* hub event bus. Safe to call before `start()` — events are buffered and
+	* flushed on connect.
+	*/
+	emitEvent(event) {
+		const msg = {
+			kind: "event",
+			event
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "event",
+			msg
+		});
+	}
+	/**
+	* Fire-and-forget: send a structured log entry to the parent. Safe to call
+	* before `start()` — log entries are buffered and flushed on connect.
+	*/
+	sendLog(entry) {
+		const msg = {
+			kind: "log",
+			...entry
+		};
+		if (this.channel !== null) this.channel.emit(msg);
+		else this.pendingEmits.push({
+			kind: "log",
+			msg
+		});
+	}
+	/**
+	* Request the current readiness snapshot from the parent. Returns the
+	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
+	* Requires `start()` to have been called; throws with a clear message if not.
+	*/
+	async requestReadinessSnapshot() {
+		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
+		return (await this.channel.request({ kind: "readiness-request" })).records;
+	}
+	/**
+	* Ask the parent to execute a cap call this child does NOT own. The parent
+	* routes to the owning local sibling over UDS, or — if no sibling owns it —
+	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
+	* production). Throws if called before `start()`.
+	*/
+	async callOut(input) {
+		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
+		const routing = {
+			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
+			...input.native === true ? { native: true } : {}
+		};
+		if (this.parentRawForward && input.args !== void 0) {
+			const hints = liftRoutingHints(input.args);
+			const msg = {
+				kind: "cap-call-out",
+				capName: input.capName,
+				method: input.method,
+				...Object.keys(hints).length > 0 ? { hints } : {},
+				...routing
+			};
+			const reply = await this.channel.request(msg, { payload: packPayload(input.args) });
+			return reply instanceof PayloadReply ? unpackPayload(reply.payload) : reply;
+		}
+		const msg = {
+			kind: "cap-call-out",
+			capName: input.capName,
+			method: input.method,
+			args: input.args,
+			...routing
+		};
+		return this.channel.request(msg);
+	}
+	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
+	async close() {
+		await this.client?.close();
+		this.client = null;
+		this.channel = null;
+	}
+};
+//#endregion
+//#region src/kernel/transport/cap-route.ts
+function buildMessage(capName, method, detail) {
+	const call = method !== void 0 ? `${capName}.${method}` : capName;
+	const target = detail.nodeId !== void 0 ? ` to node ${detail.nodeId}` : "";
+	const rejectedStr = detail.rejected.map((r) => `${r.kind}=${r.why}`).join("; ");
+	const rejectedClause = rejectedStr.length > 0 ? ` (rejected: ${rejectedStr})` : "";
+	return `${call} not routable${target}: ${detail.reason}${rejectedClause}`;
+}
+var CapRouteError = class extends Error {
+	reason;
+	nodeId;
+	rejected;
+	/**
+	* @param cause  Optional original error that triggered this routing failure.
+	*               Stored as `Error.cause` (TC39 standard option, Node 16.9+).
+	*               Dispatchers wrapping transport errors MUST pass the original.
+	*/
+	constructor(capName, method, detail, cause) {
+		super(buildMessage(capName, method, detail), cause !== void 0 ? { cause } : void 0);
+		this.name = "CapRouteError";
+		this.reason = detail.reason;
+		this.nodeId = detail.nodeId;
+		this.rejected = detail.rejected;
+	}
+};
+/**
+* Classifies a (capName, opts) pair into a typed CapRoute dispatch descriptor.
+*
+* Precedence (explicit nodeId path):
+*   1. hub-in-process — hub node + hubInProcessProvides
+*   2. hub-local-uds  — hub node + hubLocalChildProvides
+*   3. node-offline   → CapRouteError{reason:'node-offline'}
+*   4. agent-child-forward — node is an agent AND nodeKnowsCap
+*   5. remote-moleculer — any other online non-agent node
+*
+* Singleton path (no nodeId):
+*   1. hub-in-process (hub provides in-process)
+*   2. hub-local-uds  (a hub-local UDS child provides it)
+*   3. remote-moleculer (any online, non-hub node that knows it)
+*   4. → CapRouteError{reason:'no-provider', rejected: all considered routes}
+*
+* PURE: no side effects, no async, no broker/registry imports.
+*/
+function classifyCapRoute(capName, opts, snapshot) {
+	const rejected = [];
+	if (opts.nodeId !== void 0) return classifyExplicitNode(capName, opts.nodeId, opts.deviceId, snapshot, rejected);
+	return classifySingleton(capName, opts.deviceId, snapshot, rejected);
+}
+function classifyExplicitNode(capName, nodeId, deviceId, snap, rejected) {
+	if (nodeId === snap.hubNodeId) {
+		const residentProvides = snap.hubResidentProvides;
+		const providesOnHub = residentProvides ?? snap.hubInProcessProvides;
+		const getRef = residentProvides !== void 0 ? snap.getHubResidentProviderRef : snap.getInProcessProviderRef;
+		if (providesOnHub(capName)) {
+			const ref = getRef?.(capName) ?? null;
+			if (ref !== null) return {
+				kind: "hub-in-process",
+				capName,
+				ref
+			};
+			rejected.push({
+				kind: "hub-in-process",
+				why: "provider ref not available in snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		if (snap.hubLocalChildProvides(capName, deviceId)) {
+			const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+			if (childId !== null) return {
+				kind: "hub-local-uds",
+				capName,
+				childId
+			};
+			rejected.push({
+				kind: "hub-local-uds",
+				why: "child id not resolvable from snapshot"
+			});
+			throw new CapRouteError(capName, void 0, {
+				reason: "no-provider",
+				nodeId,
+				rejected
+			});
+		}
+		rejected.push({
+			kind: "hub-in-process",
+			why: "hub does not provide this cap in-process"
+		});
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "no hub-local child provides this cap"
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
+	}
+	if (!snap.nodeOnline(nodeId)) {
+		rejected.push({
+			kind: "remote-moleculer",
+			why: `node ${nodeId} is offline`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "node-offline",
+			nodeId,
+			rejected
+		});
+	}
+	if (snap.nodeIsAgent(nodeId)) {
+		if (snap.nodeKnowsCap(nodeId, capName)) return {
+			kind: "agent-child-forward",
+			capName,
+			agentNodeId: nodeId,
+			childId: snap.getAgentChildId?.(nodeId, capName) ?? void 0
+		};
+		rejected.push({
+			kind: "agent-child-forward",
+			why: `agent ${nodeId} does not know cap ${capName}`
+		});
+		throw new CapRouteError(capName, void 0, {
+			reason: "no-provider",
+			nodeId,
+			rejected
+		});
+	}
+	return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+}
+function classifySingleton(capName, deviceId, snap, rejected) {
+	if (snap.hubInProcessProvides(capName)) {
+		const ref = snap.getInProcessProviderRef?.(capName) ?? null;
+		if (ref !== null) return {
+			kind: "hub-in-process",
+			capName,
+			ref
+		};
+		rejected.push({
+			kind: "hub-in-process",
+			why: "provider ref not available in snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-in-process",
+		why: "hub does not provide this cap in-process"
+	});
+	if (snap.hubLocalChildProvides(capName, deviceId)) {
+		const childId = snap.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId !== null) return {
+			kind: "hub-local-uds",
+			capName,
+			childId
+		};
+		rejected.push({
+			kind: "hub-local-uds",
+			why: "child id not resolvable from snapshot"
+		});
+	} else rejected.push({
+		kind: "hub-local-uds",
+		why: "no hub-local child provides this cap"
+	});
+	const knownNodes = snap.listKnownNodeIds?.() ?? [];
+	for (const nodeId of knownNodes) if (nodeId !== snap.hubNodeId && snap.nodeOnline(nodeId) && snap.nodeKnowsCap(nodeId, capName)) return {
+		kind: "remote-moleculer",
+		capName,
+		nodeId
+	};
+	rejected.push({
+		kind: "remote-moleculer",
+		why: "no online remote node knows this cap"
+	});
+	throw new CapRouteError(capName, void 0, {
+		reason: "no-provider",
+		rejected
+	});
+}
+//#endregion
+//#region src/kernel/moleculer/resilient-cap-call.ts
+/** Moleculer error `type` values meaning "the service is not (yet) routable". */
+var DISCOVERY_ERROR_TYPES = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
+/** Default ceiling for the discovery wait — fail-fast past this. */
+var DEFAULT_DISCOVERY_TIMEOUT_MS$1 = 3e4;
+function isDiscoveryError(err) {
+	if (typeof err !== "object" || err === null) return false;
+	const type = err.type;
+	return typeof type === "string" && DISCOVERY_ERROR_TYPES.has(type);
+}
+/**
+* Call a Moleculer action; on a service-discovery error, wait for the
+* named service to be discovered and retry the call exactly once.
+*/
+async function callWithServiceDiscovery(broker, serviceName, action, params, opts, discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS$1) {
+	try {
+		return await broker.call(action, params, opts);
+	} catch (err) {
+		if (!isDiscoveryError(err)) throw err;
+		await broker.waitForServices([serviceName], discoveryTimeoutMs);
+		return await broker.call(action, params, opts);
+	}
+}
+//#endregion
+//#region src/kernel/transport/cap-route-resolver.ts
+/** The Moleculer service name that Task 6's agent registers. */
+var AGENT_CAP_FWD_SERVICE = "$agent-cap-fwd";
+/** The Moleculer action (service.action) for agent cap forwarding. */
+var AGENT_CAP_FWD_ACTION = `${AGENT_CAP_FWD_SERVICE}.forward`;
+/** Default timeout for remote Moleculer cap calls (ms). */
+var REMOTE_CALL_TIMEOUT_MS = 6e4;
+function extractDeviceId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "deviceId");
+	return typeof raw === "number" ? raw : void 0;
+}
+/**
+* Extract an inline `nodeId` string from a cap call's args — the per-call node
+* pin a forked addon expresses by carrying `nodeId` in the input (the SAME way
+* device-scoped caps carry `deviceId`, and the way the generated cap-router on
+* the hub already honours an inline pin). Mirrors {@link extractDeviceId}.
+*
+* This is the routing source for hub→remote-node EXECUTION pinning (e.g. the
+* benchmark addon running a synthetic/decoder workload ON a chosen agent). The
+* out-of-band `nodePin(op.context)` path does NOT survive the forked addon →
+* hub UDS link chain, so `onUnownedCall` reads the inline pin instead. Provider
+* methods that don't declare `nodeId` simply ignore the extra field (they
+* destructure the fields they need); methods that DO declare it (e.g.
+* `getEngineProvisioning({nodeId})`) still receive it unchanged.
+*/
+function extractNodeId(args) {
+	if (args === null || typeof args !== "object") return void 0;
+	const raw = Reflect.get(args, "nodeId");
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+/**
+* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
+* destructures what it needs and ignores the rest" convention
+* {@link extractNodeId} already relies on for the inline `nodeId` pin.
+* `undefined` (the overwhelmingly common case: no caller hint, or the census
+* consuming it is disarmed) returns `args` unchanged — no allocation. A
+* non-object `args` (or `null`/array) is returned unchanged too: there is
+* nowhere to attach an extra key without changing the payload's shape, and a
+* provider taking a bare value never reads `callerAddonId` off it anyway.
+*/
+function withCallerAddonId(args, callerAddonId) {
+	if (callerAddonId === void 0) return args;
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	return {
+		...args,
+		callerAddonId
+	};
+}
+var CapRouteResolver = class {
+	hubNodeId;
+	broker;
+	hubLocalRegistry;
+	nodeAuthority;
+	inProcessProviders;
+	hubResidentProviders;
+	capTimeoutMs;
+	snapshot;
+	constructor(deps) {
+		this.hubNodeId = deps.hubNodeId;
+		this.broker = deps.broker;
+		this.hubLocalRegistry = deps.hubLocalRegistry;
+		this.nodeAuthority = deps.nodeAuthority;
+		this.inProcessProviders = deps.inProcessProviders;
+		this.hubResidentProviders = deps.hubResidentProviders;
+		this.capTimeoutMs = deps.capTimeoutMs;
+		this.snapshot = this.buildSnapshot();
+	}
+	/** Per-call RPC timeout: the cap method's declared override, else the default. */
+	callTimeout(capName, method) {
+		return this.capTimeoutMs?.(capName, method) ?? REMOTE_CALL_TIMEOUT_MS;
 	}
-	/**
-	* Re-send the cap manifest to the parent, atomically replacing the child's
-	* registered descriptor set. Call this after device-restore so newly
-	* registered native (device-scoped) caps become routable over UDS.
-	*
-	* Safe to call before `start()`: the new set is buffered and `start()` sends
-	* it (device-restore can race ahead of the UDS connect). After `start()`,
-	* the set is sent immediately.
-	*/
-	async updateCaps(caps, customActions) {
-		this.latestCaps = caps;
-		if (customActions !== void 0) this.latestCustomActions = customActions;
-		if (this.channel === null) return;
-		await this.channel.request(this.registerFrame(caps));
+	resolveCapRoute(capName, opts) {
+		return classifyCapRoute(capName, opts, this.snapshot);
 	}
 	/**
-	* The register frame: caps, plus everything a re-register must atomically
-	* re-carry so no separate re-sync can be missed — the subscription union
-	* (omitted if nothing ever declared, which keeps the fail-open shape) and the
-	* custom-action catalogs (omitted until the init loop produced them).
+	* Resolve the hub-local-uds route for a cap owned by a forked hub-local
+	* child, IGNORING any in-hub provider registered for the same cap name.
+	*
+	* `resolveCapRoute` gives Priority 1 to `hub-in-process`: when an in-hub
+	* provider (e.g. a wrapper) is registered for the cap, the route always
+	* classifies as `hub-in-process` and the hub-local-uds NATIVE child is never
+	* reached. That is correct for the generic dispatch path (the wrapper is the
+	* active provider), but WRONG for the native-cap fallback
+	* (`setNativeFallback`), whose contract is to reach the NATIVE provider in
+	* the forked vendor child so a wrapper can delegate to it. A wrapper cap
+	* with a forked native (today: `snapshot`) otherwise resolves to the wrapper
+	* itself, the native is never invoked, and the wrapper silently falls
+	* through to its secondary strategy.
+	*
+	* This method consults ONLY the hub-local-child authority
+	* (`hubLocalChildProvides` + `getHubLocalChildId`, both deviceId-aware), so
+	* it returns the native child route regardless of any in-process shadow.
+	* Returns null when no hub-local child owns `(capName, deviceId)` — the
+	* caller then falls through to its remote-resolution branch.
 	*/
-	registerFrame(caps) {
+	resolveHubLocalUdsRoute(capName, deviceId) {
+		if (!this.snapshot.hubLocalChildProvides(capName, deviceId)) return null;
+		const childId = this.snapshot.getHubLocalChildId?.(capName, deviceId) ?? null;
+		if (childId === null) return null;
 		return {
-			kind: "register",
-			childId: this.options.childId,
-			caps,
-			...this.hasDeclaredEventPatterns ? { eventPatterns: this.latestEventPatterns } : {},
-			...this.latestCustomActions !== null ? { customActions: this.latestCustomActions } : {}
-		};
-	}
-	/**
-	* Fire-and-forget: send a system event to the parent for forwarding to the
-	* hub event bus. Safe to call before `start()` — events are buffered and
-	* flushed on connect.
-	*/
-	emitEvent(event) {
-		const msg = {
-			kind: "event",
-			event
+			kind: "hub-local-uds",
+			capName,
+			childId
 		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "event",
-			msg
-		});
 	}
 	/**
-	* Fire-and-forget: send a structured log entry to the parent. Safe to call
-	* before `start()` — log entries are buffered and flushed on connect.
+	* @param addonId Optional out-of-band PROVIDER-selection hint (Task 7.5a):
+	*   the addonId of the provider the CALLER already resolved (e.g.
+	*   `buildCapCallFn`'s `deps.addonId` for a registered grouped-runner
+	*   provider). Only meaningful for `agent-child-forward` — a `remote-moleculer`
+	*   route already encodes the provider in its action name
+	*   (`${addonId}.${cap}.${method}`, via `NodeCapAuthority.getAddonId`), and a
+	*   `hub-local-uds` caller that already knows the addonId (`buildCapCallFn`)
+	*   talks to `LocalChildRegistry.callCapOnChild` directly rather than through
+	*   `dispatch`.
+	* @param callerAddonId Optional out-of-band CALLER-identity hint — the
+	*   addon that ORIGINATED the call, distinct from `addonId` above (which
+	*   names the resolved PROVIDER, not the caller). Set by
+	*   `onUnownedCall` from `CapCallInput.callerAddonId`
+	*   (`LocalChildRegistry` stamped it off the registered `childId`). Only
+	*   the `hub-in-process` branch consumes it — merged into `args` so a
+	*   diagnostic tool deep in that provider (e.g. device-manager's
+	*   fleet-read census) can read it without every provider method changing
+	*   signature, the same "extra field the provider destructures or
+	*   ignores" convention `nodeId` already uses on this path.
 	*/
-	sendLog(entry) {
-		const msg = {
-			kind: "log",
-			...entry
-		};
-		if (this.channel !== null) this.channel.emit(msg);
-		else this.pendingEmits.push({
-			kind: "log",
-			msg
-		});
+	async dispatch(route, method, args, addonId, callerAddonId) {
+		try {
+			return await this.dispatchInner(route, method, args, addonId, callerAddonId);
+		} catch (err) {
+			if (err instanceof CapRouteError) throw err;
+			const nodeId = this.routeNodeId(route);
+			const cause = err instanceof Error ? err : new Error(String(err));
+			throw new CapRouteError(route.capName, method, {
+				reason: "transport-failed",
+				nodeId,
+				rejected: [{
+					kind: route.kind,
+					why: cause.message
+				}]
+			}, cause);
+		}
 	}
 	/**
-	* Request the current readiness snapshot from the parent. Returns the
-	* authoritative set of `IReadinessRegistryRecord` entries the hub holds.
-	* Requires `start()` to have been called; throws with a clear message if not.
+	* Inner dispatch: may throw CapRouteError (validation failures) or arbitrary
+	* transport errors. The outer `dispatch` wraps non-CapRouteErrors.
 	*/
-	async requestReadinessSnapshot() {
-		if (this.channel === null) throw new Error("LocalChildClient: requestReadinessSnapshot called before start()");
-		return (await this.channel.request({ kind: "readiness-request" })).records;
+	async dispatchInner(route, method, args, addonId, callerAddonId) {
+		switch (route.kind) {
+			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
+			case "hub-local-uds": {
+				const registry = this.hubLocalRegistry;
+				if (registry === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					rejected: [{
+						kind: "hub-local-uds",
+						why: "UDS registry not available"
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const input = {
+					capName: route.capName,
+					method,
+					args,
+					...deviceId !== void 0 ? { deviceId } : {}
+				};
+				return registry.callCapOnChild(route.childId, input);
+			}
+			case "remote-moleculer": {
+				const addonId = this.nodeAuthority.getAddonId(route.nodeId, route.capName);
+				if (addonId === null) throw new CapRouteError(route.capName, method, {
+					reason: "no-provider",
+					nodeId: route.nodeId,
+					rejected: [{
+						kind: "remote-moleculer",
+						why: `no addonId known for ${route.nodeId}/${route.capName}`
+					}]
+				});
+				const deviceId = extractDeviceId(args);
+				const isNative = this.nodeAuthority.isNativeCap(route.nodeId, route.capName, deviceId);
+				const action = capActionName(addonId, route.capName, method, isNative);
+				return callWithServiceDiscovery(this.broker, addonId, action, args, {
+					nodeID: route.nodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+			case "agent-child-forward": {
+				const deviceId = extractDeviceId(args);
+				const params = {
+					capName: route.capName,
+					method,
+					args,
+					...route.childId !== void 0 ? { childId: route.childId } : {},
+					...deviceId !== void 0 ? { deviceId } : {},
+					...addonId !== void 0 ? { addonId } : {}
+				};
+				return callWithServiceDiscovery(this.broker, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, params, {
+					nodeID: route.agentNodeId,
+					timeout: this.callTimeout(route.capName, method)
+				});
+			}
+		}
 	}
-	/**
-	* Ask the parent to execute a cap call this child does NOT own. The parent
-	* routes to the owning local sibling over UDS, or — if no sibling owns it —
-	* to its `onUnownedCall` fallback (the cluster CapabilityRegistry in
-	* production). Throws if called before `start()`.
-	*/
-	async callOut(input) {
-		if (this.channel === null) throw new Error("LocalChildClient: callOut before start");
-		const msg = {
-			kind: "cap-call-out",
-			capName: input.capName,
-			method: input.method,
-			args: input.args,
-			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {},
-			...input.native === true ? { native: true } : {}
+	buildSnapshot() {
+		const hubLocalRegistry = this.hubLocalRegistry;
+		const nodeAuthority = this.nodeAuthority;
+		const inProcessProviders = this.inProcessProviders;
+		const hubResidentProviders = this.hubResidentProviders;
+		return {
+			hubNodeId: this.hubNodeId,
+			hubInProcessProvides: (cap) => inProcessProviders(cap) !== null,
+			...hubResidentProviders !== void 0 ? {
+				hubResidentProvides: (cap) => hubResidentProviders(cap) !== null,
+				getHubResidentProviderRef: (cap) => hubResidentProviders(cap)
+			} : {},
+			hubLocalChildProvides: (cap, deviceId) => hubLocalRegistry !== null && hubLocalRegistry.resolveChildId(cap, deviceId) !== null,
+			nodeKnowsCap: (nodeId, cap) => nodeAuthority.nodeKnowsCap(nodeId, cap),
+			nodeIsAgent: (nodeId) => nodeAuthority.nodeIsAgent(nodeId),
+			nodeOnline: (nodeId) => nodeAuthority.nodeOnline(nodeId),
+			listKnownNodeIds: () => nodeAuthority.listNodeIds(),
+			getInProcessProviderRef: (cap) => inProcessProviders(cap),
+			getHubLocalChildId: (cap, deviceId) => hubLocalRegistry !== null ? hubLocalRegistry.resolveChildId(cap, deviceId) : null,
+			getAgentChildId: (agentNodeId, cap) => nodeAuthority.getAgentChildId(agentNodeId, cap)
 		};
-		return this.channel.request(msg);
 	}
-	/** Disconnect from the parent. Safe to call before `start()` (no-op) and idempotent. */
-	async close() {
-		await this.client?.close();
-		this.client = null;
-		this.channel = null;
+	/** Extract a nodeId string from a route for error reporting, or undefined. */
+	routeNodeId(route) {
+		switch (route.kind) {
+			case "hub-in-process": return this.hubNodeId;
+			case "hub-local-uds": return `${this.hubNodeId}/${route.childId}`;
+			case "remote-moleculer": return route.nodeId;
+			case "agent-child-forward": return route.agentNodeId;
+		}
 	}
 };
 //#endregion
@@ -10174,4 +11183,4 @@ async function defaultRun(command, args) {
 	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
 }
 //#endregion
-export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, createV8Reclaimer as Bt, ipcParentLink as C, EVENT_PLANE_TOP_N as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, formatEventPlane as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, diffEventPlane as En, HEAP_RECLAIM_TRIGGER_MB as Et, AGENT_CAP_FWD_SERVICE as F, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, hubMainRssBudget as Ht, CapRouteResolver as I, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, CapRouteError as L, buildHeapSample as Lt, LocalChildRegistry as M, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, UDS_NO_ROUTE_PREFIX as N, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, HEAP_WATCH_WARN_RATIO as Ot, AGENT_CAP_FWD_ACTION as P, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, classifyCapRoute as R, createDeferredHeapWatchSink as Rt, buildLinkChain as S, socketDirectionMessages as Sn, runNpm as St, createParentUnownedCallHandler as T, createEventPlaneReader as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, nextRssBudgetState as Ut, CapUsageRegistry as V, describeRss as Vt, getCapUsageRegistry as W, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, EMPTY_SOCKET_DIRECTION as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, sampleSocketDirection as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, EMPTY_SOCKET_PLANE_BASELINE as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, SOCKET_PLANE_TOP_N as fn, parseCapAction as ft, subscribePassthrough as g, formatSocketPlane as gn, CapabilityHandle as gt, setNodeEventInterest as h, diffSocketPlane as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, LocalChildClient as j, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createSocketPlaneReader as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, createSocketPlaneMeter as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, createSocketDirectionCounters as vn, copyBundledNativeModules as vt, localProviderLink as w, createEventPlaneMeter as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, socketDirectionBytes as xn, resolveNpmInvocation as xt, resolveHwAccel as y, recordSocketFrame as yn, installManifestNativeDeps as yt, callWithServiceDiscovery as z, createLoopDelayMeter as zt };
+export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, sampleSocketDirection as An, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, EVENT_PLANE_TOP_N as Bn, createV8Reclaimer as Bt, ipcParentLink as C, createSocketPlaneReader as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, EMPTY_SOCKET_DIRECTION as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, readSocketQueues as En, HEAP_RECLAIM_TRIGGER_MB as Et, CapRouteError as F, EMPTY_CAP_ACTION_READING as Fn, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, createEventPlaneReader as Hn, hubMainRssBudget as Ht, classifyCapRoute as I, MAX_CAP_ACTIONS_PER_PEER as In, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, LocalChildClient as L, capActionLabel as Ln, buildHeapSample as Lt, AGENT_CAP_FWD_SERVICE as M, socketDirectionMessages as Mn, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, CapRouteResolver as N, CAP_ACTION_OVERFLOW_LABEL as Nn, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, createSocketDirectionCounters as On, HEAP_WATCH_WARN_RATIO as Ot, callWithServiceDiscovery as P, CAP_ACTION_UNLABELLED as Pn, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, LocalChildRegistry as R, createCapActionCensus as Rn, createDeferredHeapWatchSink as Rt, buildLinkChain as S, createSocketPlaneMeter as Sn, runNpm as St, createParentUnownedCallHandler as T, formatSocketPlane as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, diffEventPlane as Un, nextRssBudgetState as Ut, CapUsageRegistry as V, createEventPlaneMeter as Vn, describeRss as Vt, getCapUsageRegistry as W, formatEventPlane as Wn, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, createMeshQueueReader as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, SOCKET_PLANE_TOP_N as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, OUTBOUND_QUEUE_COOLDOWN_MS as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, OUTBOUND_QUEUE_SUSTAIN_MS as fn, parseCapAction as ft, subscribePassthrough as g, MESH_QUEUE_TOP_N as gn, CapabilityHandle as gt, setNodeEventInterest as h, formatOutboundQueueVerdict as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, AGENT_CAP_FWD_ACTION as j, socketDirectionBytes as jn, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, recordSocketFrame as kn, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createOutboundQueueGate as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, OUTBOUND_QUEUE_THRESHOLD_BYTES as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, formatMeshQueue as vn, copyBundledNativeModules as vt, localProviderLink as w, diffSocketPlane as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, SOCKET_QUEUE_TOP_N as xn, resolveNpmInvocation as xt, resolveHwAccel as y, EMPTY_SOCKET_PLANE_BASELINE as yn, installManifestNativeDeps as yt, UDS_NO_ROUTE_PREFIX as z, diffCapActionCensus as zn, createLoopDelayMeter as zt };