@camstack/system 1.2.219 → 1.2.220

package/dist/{manifest-system-deps-C7dihwWT.mjs → manifest-system-deps-iadzxSBr.mjs}

@@ -152,6 +152,166 @@ function formatEventPlane(window) {
 	return ` fanoutMode=uds:${window.udsMode}/cross-node:${window.crossNodeMode} children=${window.childrenConnected} childrenUndeclared=${window.childrenUndeclared} fanoutSent=${window.fanoutSent} fanoutSuppressed=${window.fanoutSuppressed} crossNodeDelivered=${window.crossNodeDelivered} crossNodeSuppressed=${window.crossNodeSuppressed}` + (top.length === 0 ? "" : ` fanoutTop=${top}`);
 }
 //#endregion
+//#region src/kernel/transport/cap-action-census.ts
+/** A process that has never read the census. */
+var EMPTY_CAP_ACTION_READING = /* @__PURE__ */ new Map();
+/**
+* Bytes that crossed on a frame carrying no cap envelope.
+*
+* Named rather than omitted so the census's coverage is readable off its own
+* output: `register`, `addon-call`, log frames and the event fan-out all land
+* here. A census that reported only what it could name would look like a
+* complete attribution of whatever share it happened to cover.
+*/
+var CAP_ACTION_UNLABELLED = "(unlabelled)";
+/** Bytes of actions past {@link MAX_CAP_ACTIONS_PER_PEER} on one peer. */
+var CAP_ACTION_OVERFLOW_LABEL = "(overflow)";
+/**
+* Distinct named actions kept per peer before the overflow bucket takes over.
+*
+* Sixty-four against a measured worst case of 14 (`pipeline-analytics`, the
+* heaviest peer on this hub, 2026-09-11) — four times the observed shape, so a
+* peer has to change character before it overflows, and a bound that is never
+* reached in practice still forbids the unbounded growth a wire-supplied key
+* makes possible in principle.
+*/
+var MAX_CAP_ACTIONS_PER_PEER = 64;
+/**
+* `<cap>.<method>` for a cap envelope, `null` for anything else.
+*
+* Both directions are labelled by the same function: a child's `cap-call-out`
+* and the parent's `cap-call` carry `capName` + `method` in the same two keys,
+* so one predicate covers the whole plane. Anything else — a `register`, an
+* `addon-call`, a log or an event — is deliberately unlabelled; see
+* {@link CAP_ACTION_UNLABELLED} for where its bytes go.
+*
+* Cost: two property reads, two `typeof`s and one concatenation of two short
+* strings, called once per `req` frame (not per frame). Against the
+* `encodeFrame` it sits beside — 1 948–1 975 ns on a 0.33 kB body — it is
+* noise, and unlike `recordSocketFrame` it is not on the `evt` path at all.
+*/
+function capActionLabel(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const env = body;
+	if (env.kind !== "cap-call" && env.kind !== "cap-call-out") return null;
+	if (typeof env.capName !== "string" || typeof env.method !== "string") return null;
+	return `${env.capName}.${env.method}`;
+}
+function emptyCounters() {
+	return {
+		calls: 0,
+		reqBytes: 0,
+		resBytes: 0,
+		raw: 0,
+		decoded: 0
+	};
+}
+function createCapActionCensus() {
+	const peers = /* @__PURE__ */ new Map();
+	/**
+	* The per-peer slot for `action`, creating it under the bound.
+	*
+	* Past {@link MAX_CAP_ACTIONS_PER_PEER} a NEW label is folded into the
+	* overflow bucket; labels already present keep their own slot, so a peer
+	* that overflows does not lose the attribution it had built.
+	*/
+	const slot = (peerId, action) => {
+		let byAction = peers.get(peerId);
+		if (byAction === void 0) {
+			byAction = /* @__PURE__ */ new Map();
+			peers.set(peerId, byAction);
+		}
+		const existing = byAction.get(action);
+		if (existing !== void 0) return existing;
+		if (byAction.size >= 64) {
+			let overflow = byAction.get(CAP_ACTION_OVERFLOW_LABEL);
+			if (overflow === void 0) {
+				overflow = emptyCounters();
+				byAction.set(CAP_ACTION_OVERFLOW_LABEL, overflow);
+			}
+			return overflow;
+		}
+		const fresh = emptyCounters();
+		byAction.set(action, fresh);
+		return fresh;
+	};
+	return {
+		record(peerId, action, reqBytes, resBytes) {
+			const c = slot(peerId, action);
+			c.calls += 1;
+			c.reqBytes += reqBytes;
+			c.resBytes += resBytes;
+		},
+		recordForward(peerId, action, kind) {
+			const c = slot(peerId, action);
+			if (kind === "raw") c.raw += 1;
+			else c.decoded += 1;
+		},
+		recordUnlabelled(peerId, bytes) {
+			const c = slot(peerId, CAP_ACTION_UNLABELLED);
+			c.resBytes += bytes;
+		},
+		forget(peerId) {
+			peers.delete(peerId);
+		},
+		read() {
+			const out = /* @__PURE__ */ new Map();
+			for (const [peerId, byAction] of peers) {
+				const copy = /* @__PURE__ */ new Map();
+				for (const [action, c] of byAction) copy.set(action, {
+					calls: c.calls,
+					reqBytes: c.reqBytes,
+					resBytes: c.resBytes,
+					raw: c.raw,
+					decoded: c.decoded
+				});
+				out.set(peerId, copy);
+			}
+			return out;
+		}
+	};
+}
+function sampleOf(reading, peerId, action) {
+	return reading.get(peerId)?.get(action);
+}
+/**
+* Subtract the previous reading from the current one.
+*
+* A peer whose runner RESPAWNED reconnects under the same id with counters
+* that went backwards. Clamped at 0, exactly as `diffSocketPlane` clamps for
+* the same reason: its traffic in that window is genuinely unknown, and a
+* negative number on a rate reads as a broken meter.
+*/
+function diffCapActionCensus(before, current, topN) {
+	const deltas = [];
+	let labelledBytes = 0;
+	let totalBytes = 0;
+	for (const [peerId, byAction] of current) for (const [action, now] of byAction) {
+		const then = sampleOf(before, peerId, action);
+		const reqBytes = Math.max(0, now.reqBytes - (then?.reqBytes ?? 0));
+		const resBytes = Math.max(0, now.resBytes - (then?.resBytes ?? 0));
+		const bytes = reqBytes + resBytes;
+		totalBytes += bytes;
+		if (action === "(unlabelled)" || action === "(overflow)") continue;
+		labelledBytes += bytes;
+		if (bytes === 0) continue;
+		deltas.push({
+			peerId,
+			action,
+			calls: Math.max(0, now.calls - (then?.calls ?? 0)),
+			reqBytes,
+			resBytes,
+			raw: Math.max(0, now.raw - (then?.raw ?? 0)),
+			decoded: Math.max(0, now.decoded - (then?.decoded ?? 0))
+		});
+	}
+	return {
+		top: deltas.toSorted((a, b) => b.reqBytes + b.resBytes - (a.reqBytes + a.resBytes) || a.peerId.localeCompare(b.peerId) || a.action.localeCompare(b.action)).slice(0, topN),
+		labelledBytes,
+		totalBytes
+	};
+}
+//#endregion
 //#region src/kernel/transport/socket-traffic.ts
 function createSocketDirectionCounters() {
 	return {
@@ -313,10 +473,12 @@ function createSocketPlaneReader(sources) {
 				});
 			}
 			const forward = registry.readForwardCensus?.();
+			const actions = registry.readActionCensus?.();
 			return {
 				peers,
 				peersConnected: listed.length,
-				...forward === void 0 ? {} : { forward }
+				...forward === void 0 ? {} : { forward },
+				...actions === void 0 ? {} : { actions }
 			};
 		} catch {
 			return;
@@ -419,6 +581,7 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		if (peerMessages(delta) > 0) deltas.push(delta);
 	}
 	const forward = diffForward(current.forward, baseline.forward);
+	const actions = current.actions === void 0 ? void 0 : diffCapActionCensus(baseline.actions ?? EMPTY_CAP_ACTION_READING, current.actions, 5);
 	return {
 		peersConnected: current.peersConnected,
 		peersMeasured: current.peers.length,
@@ -427,7 +590,8 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
 		topBytes: deltas.toSorted((a, b) => peerBytes(b) - peerBytes(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
 		queued: readSocketQueues(current),
-		...forward === void 0 ? {} : { forward }
+		...forward === void 0 ? {} : { forward },
+		...actions === void 0 ? {} : { actions }
 	};
 }
 function createSocketPlaneMeter(reader, topN = 5) {
@@ -438,7 +602,8 @@ function createSocketPlaneMeter(reader, topN = 5) {
 		const window = diffSocketPlane(baseline, current, topN);
 		baseline = {
 			peers: new Map(current.peers.map((p) => [p.peerId, p])),
-			...current.forward === void 0 ? {} : { forward: current.forward }
+			...current.forward === void 0 ? {} : { forward: current.forward },
+			...current.actions === void 0 ? {} : { actions: current.actions }
 		};
 		return window;
 	} };
@@ -475,6 +640,24 @@ function formatPeer(delta) {
 	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:txkB=${formatPeerBytes(delta.tx)}:rxkB=${formatPeerBytes(delta.rx)}`;
 }
 /**
+* One named action: `<peer>!<cap>.<method>:<kB>kB/<calls>:r<raw>/d<decoded>`.
+*
+* `!` separates the peer from the action because `.` already separates cap
+* from method and a single delimiter for both would make the token ambiguous
+* to split.
+*
+* The raw/decoded pair is the half that did not exist anywhere before D456.
+* `socketFwd=` answers it for the whole plane — 30 349/5 051 on this hub — and
+* a plane-wide ratio cannot tell a method that is entirely forwarded from one
+* that is entirely decoded, which is the difference between bytes hub-main
+* copies and bytes hub-main reads. The census pays for the two counters it
+* takes; the conclusion they buy is which of the line's megabytes are actually
+* expensive.
+*/
+function formatAction(entry) {
+	return `${entry.peerId}!${entry.action}:${kb$1(entry.reqBytes + entry.resBytes)}kB/${entry.calls}:r${entry.raw}/d${entry.decoded}`;
+}
+/**
 * The suffix appended to a `[mem]` line — leading space included, empty when
 * this process has no local socket plane.
 *
@@ -500,7 +683,7 @@ function formatSocketPlane(window) {
 	const named = new Set(window.top.map((p) => p.peerId));
 	const topBytes = window.topBytes.filter((p) => !named.has(p.peerId)).map(formatPeer).join(",");
 	const queuedTop = window.queued.top.map((p) => `${p.peerId}:${kb$1(p.bytes)}`).join(",");
-	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`);
+	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`) + (window.actions === void 0 ? "" : ` socketActions=${kb$1(window.actions.labelledBytes)}/${kb$1(window.actions.totalBytes)}kB` + (window.actions.top.length === 0 ? "" : ` socketTopActions=${window.actions.top.map(formatAction).join(",")}`));
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-queue-report.ts
@@ -1136,6 +1319,125 @@ function formatArrayBufferCensus(label, report, context) {
 	return `[mem] ${label} arrayBuffer census: live=${live}MB in ${report.count} ArrayBuffers (raw arrayBuffers=${context.rawMb}MB at the trigger → ${verdict}) top sizes: ${report.topSizes.map(formatExact).join(", ") || "(none)"}; buckets: ${report.buckets.map(formatBucket).join(", ") || "(none)"}; detached=${report.detached} took=${context.tookMs}ms — cost: ONE forced full GC (the same pause as a reclaim pass), walked in memory, nothing serialised, nothing written; trigger: ${context.reason}`;
 }
 //#endregion
+//#region src/kernel/gc-census.ts
+function countsOf(entries, kinds) {
+	let majors = 0;
+	let minors = 0;
+	let incrementals = 0;
+	let pauseMs = 0;
+	for (const e of entries) {
+		if (e.kind === kinds.major) majors++;
+		else if (e.kind === kinds.minor) minors++;
+		else if (e.kind === kinds.incremental) incrementals++;
+		pauseMs += e.durationMs;
+	}
+	return {
+		majors,
+		minors,
+		incrementals,
+		pauseMs,
+		windowMs: 0
+	};
+}
+/**
+* Build a census over an injected observer.
+*
+* Returns `undefined` when the observer cannot be installed — the caller then
+* prints nothing, which is the honest reading. It must never degrade into a
+* census that reports zero collections: a process whose GC is not being
+* observed and a process that is not collecting look identical on the line, and
+* they are the two answers furthest apart.
+*/
+function createGcCensus(install, kinds, startedAt) {
+	let pending = [];
+	const stopObserving = install((entry) => {
+		pending.push(entry);
+	});
+	if (stopObserving === void 0) return void 0;
+	let windowStart = startedAt;
+	return {
+		read: (at) => {
+			const windowMs = at - windowStart;
+			if (windowMs < 1e3) return null;
+			const taken = pending;
+			pending = [];
+			windowStart = at;
+			return {
+				...countsOf(taken, kinds),
+				windowMs
+			};
+		},
+		stop: () => {
+			stopObserving();
+			pending = [];
+		}
+	};
+}
+/**
+* The observer this process actually gets.
+*
+* Everything that can fail is inside the try: a runtime without
+* `perf_hooks`, without the `gc` entry type, or without the kind constants
+* yields `undefined` from `install`, and {@link createGcCensus} then declines
+* to exist rather than reporting zeros.
+*/
+function nodeGcObserver() {
+	return {
+		kinds: readKinds({
+			major: 4,
+			minor: 1,
+			incremental: 8
+		}),
+		install: (observe) => {
+			try {
+				const observer = new (process.getBuiltinModule("node:perf_hooks")).PerformanceObserver((list) => {
+					for (const entry of list.getEntries()) {
+						const detail = "detail" in entry ? entry.detail : void 0;
+						observe({
+							kind: typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1,
+							durationMs: entry.duration
+						});
+					}
+				});
+				observer.observe({ entryTypes: ["gc"] });
+				return () => {
+					observer.disconnect();
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+function readKinds(fallback) {
+	try {
+		const c = process.getBuiltinModule("node:perf_hooks").constants;
+		return {
+			major: c.NODE_PERFORMANCE_GC_MAJOR,
+			minor: c.NODE_PERFORMANCE_GC_MINOR,
+			incremental: c.NODE_PERFORMANCE_GC_INCREMENTAL
+		};
+	} catch {
+		return fallback;
+	}
+}
+/**
+* The two fields, APPENDED LAST on the `[mem]` line.
+*
+* D446's rule: no existing field moves, so every Loki prefix written since
+* 2026-08-29 still matches. `gc=` prints even when nothing was collected — a
+* window with no collections is a reading, and it is the reading that says a
+* process is idle rather than unobserved. `gcPauseMs=` is the MAIN-THREAD
+* pause only; the concurrent marking that cost hub-main 70 % of its CPU is on
+* the platform workers and no in-process counter sees it, which is why the
+* field is named for the thread it describes (D456, part 4).
+*/
+function formatGcCensus(window) {
+	if (window === null || window === void 0) return "";
+	const perMin = (n) => window.windowMs <= 0 ? "?" : (n / (window.windowMs / 6e4)).toFixed(1);
+	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}`;
+}
+//#endregion
 //#region src/kernel/heap-watch.ts
 /**
 * heap-watch — hub-main's own memory, on the record, and returned to the OS.
@@ -1732,6 +2034,8 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	const socketPlane = probes?.socketPlane === void 0 ? void 0 : createSocketPlaneMeter(probes.socketPlane);
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
+	const gcObserver = probes?.gcObserver ?? nodeGcObserver();
+	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now());
 	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
 	const minIntervalMs = reclaimOptions?.minIntervalMs ?? 12e4;
 	const steadyStateIntervalMs = reclaimOptions?.steadyStateIntervalMs ?? 6e5;
@@ -1834,7 +2138,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()));
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -1891,6 +2195,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 		stopped = true;
 		clearInterval(timer);
 		loopDelay?.stop();
+		gcCensus?.stop();
 	};
 }
 /**
@@ -5912,6 +6217,8 @@ var SocketChannel = class {
 	txCounters = createSocketDirectionCounters();
 	/** Frames read from the peer, cumulative, split by kind. */
 	rxCounters = createSocketDirectionCounters();
+	/** See {@link CapActionChannelObserver}. Absent = no per-action census. */
+	actionObserver = null;
 	constructor(socket) {
 		this.socket = socket;
 		socket.on("data", (chunk) => this.onData(chunk));
@@ -5942,16 +6249,26 @@ var SocketChannel = class {
 				}, timeoutMs);
 				timer.unref?.();
 			}
+			const label = this.labelSafely(body);
 			this.pending.set(id, {
 				resolve,
 				reject,
-				timer
+				timer,
+				action: null
 			});
-			this.send({
+			const reqBytes = this.send({
 				k: "req",
 				id,
 				body
 			}, opts?.payload);
+			const entry = this.pending.get(id);
+			if (entry !== void 0 && label !== void 0) this.pending.set(id, {
+				...entry,
+				action: {
+					label,
+					reqBytes
+				}
+			});
 		});
 	}
 	emit(body) {
@@ -5961,6 +6278,36 @@ var SocketChannel = class {
 			body
 		});
 	}
+	/**
+	* Wire the per-action census. Only one observer is active at a time; an
+	* unwired channel records nothing at all (never zeros).
+	*/
+	observeActions(observer) {
+		this.actionObserver = observer;
+	}
+	/**
+	* The label for one envelope, or `undefined` when there is nothing to
+	* record. Wrapped: a broken labeller must never fail the call it watches —
+	* the same discipline `LocalChildRegistry.recordCapUsage` applies, and for
+	* the same reason.
+	*/
+	labelSafely(body) {
+		const obs = this.actionObserver;
+		if (obs === null) return void 0;
+		try {
+			return obs.label(body);
+		} catch {
+			return null;
+		}
+	}
+	/** Settle one request/response pair on the census. Never throws. */
+	recordAction(label, reqBytes, resBytes) {
+		const obs = this.actionObserver;
+		if (obs === null) return;
+		try {
+			obs.record(label, reqBytes, resBytes);
+		} catch {}
+	}
 	/** Replace the request handler. Only one handler is active at a time. */
 	onRequest(handler) {
 		this.requestHandler = handler;
@@ -6008,21 +6355,27 @@ var SocketChannel = class {
 	* are never copied into the head. A forwarded payload is a view into the
 	* frame it arrived on, and that frame's buffer is never mutated, so handing
 	* the view to the socket is safe.
+	*
+	* Returns the on-the-wire bytes it charged — the same number the per-kind
+	* counter got, so the per-action census can never disagree with the per-peer
+	* one. `0` when the channel is closed and nothing was written.
 	*/
 	send(frame, payload) {
-		if (this.closed) return;
+		if (this.closed) return 0;
 		if (payload === void 0) {
 			const encoded = encodeFrame(frame);
 			recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
 			this.socket.write(encoded);
-			return;
+			return encoded.byteLength;
 		}
 		const head = encodeFrameHead(frame, payload);
-		recordSocketFrame(this.txCounters, frame.k, head.byteLength + payload.byteLength);
+		const bytes = head.byteLength + payload.byteLength;
+		recordSocketFrame(this.txCounters, frame.k, bytes);
 		this.socket.cork();
 		this.socket.write(head);
 		this.socket.write(payload);
 		this.socket.uncork();
+		return bytes;
 	}
 	onData(chunk) {
 		const frames = this.decoder.push(chunk);
@@ -6041,28 +6394,31 @@ var SocketChannel = class {
 	async handleFrame(frame, wireBytes) {
 		recordSocketFrame(this.rxCounters, frame.k, wireBytes);
 		if (frame.k === "req") {
+			const label = this.labelSafely(frame.body);
+			let resBytes = 0;
 			try {
 				const result = await this.requestHandler(frame.body, frame.pl);
-				if (result instanceof PayloadReply) this.send({
+				if (result instanceof PayloadReply) resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
 					body: result.body
 				}, result.payload);
-				else this.send({
+				else resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
 					body: result
 				});
 			} catch (err) {
-				this.send({
+				resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: false,
 					err: err instanceof Error ? err.message : String(err)
 				});
 			}
+			if (label !== void 0) this.recordAction(label, wireBytes, resBytes);
 			return;
 		}
 		if (frame.k === "res") {
@@ -6070,6 +6426,7 @@ var SocketChannel = class {
 			if (!p) return;
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
+			if (p.action !== null) this.recordAction(p.action.label, p.action.reqBytes, wireBytes);
 			if (!frame.ok) p.reject(new Error(frame.err));
 			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
 			else p.resolve(frame.body);
@@ -6623,6 +6980,64 @@ function deliverShared(state, event) {
 	}
 }
 //#endregion
+//#region src/kernel/transport/cap-child-index.ts
+/** Separator that cannot occur in a kebab cap name, so the key is unambiguous. */
+var DEVICE_KEY_SEPARATOR = "\0";
+var NO_CANDIDATES = Object.freeze([]);
+var MapCapChildIndex = class {
+	deviceOwners;
+	singletons;
+	constructor(deviceOwners, singletons) {
+		this.deviceOwners = deviceOwners;
+		this.singletons = singletons;
+	}
+	deviceOwner(capName, deviceId) {
+		return this.deviceOwners.get(`${capName}${DEVICE_KEY_SEPARATOR}${deviceId}`) ?? null;
+	}
+	singletonCandidates(capName) {
+		return this.singletons.get(capName) ?? NO_CANDIDATES;
+	}
+};
+/**
+* Build the `(cap, device?) → child` index from the connected children.
+*
+* A PURE function of what it is handed — it captures nothing, subscribes to
+* nothing and cannot be updated in place. That is the whole safety argument
+* (D3, D457): the only way to change what it says is to build a new one from
+* the `children` map, so an index can never name a child that map has already
+* dropped. An incremental index — add on register, remove on close — would be
+* a second registry that can disagree with the first, and a stale one routes
+* to a dead runner, which is strictly worse than a slow scan.
+*
+* Cost: O(children × descriptors), paid once per mutation of the children map
+* (a register, a re-register, a disconnect) rather than once per cap call.
+*
+* The two tiers stay separate, exactly as the scan had them: a device lookup
+* is never answered from a deviceId-less descriptor. `resolveChildId` owns
+* the fallback from tier 1 to tier 2, and folding it in here would make it
+* unreachable.
+*/
+function buildCapChildIndex(entries) {
+	const deviceOwners = /* @__PURE__ */ new Map();
+	const singletons = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const namedForThisChild = /* @__PURE__ */ new Set();
+		for (const cap of entry.caps) {
+			if (cap.deviceId === void 0) {
+				if (namedForThisChild.has(cap.capName)) continue;
+				namedForThisChild.add(cap.capName);
+				const candidates = singletons.get(cap.capName);
+				if (candidates === void 0) singletons.set(cap.capName, [entry.childId]);
+				else candidates.push(entry.childId);
+				continue;
+			}
+			const key = `${cap.capName}${DEVICE_KEY_SEPARATOR}${cap.deviceId}`;
+			if (!deviceOwners.has(key)) deviceOwners.set(key, entry.childId);
+		}
+	}
+	return new MapCapChildIndex(deviceOwners, singletons);
+}
+//#endregion
 //#region src/kernel/transport/cap-routing-hints.ts
 /** Lift {@link CapRoutingHints} from a call's args. Never throws. */
 function liftRoutingHints(args) {
@@ -6634,8 +7049,6 @@ function liftRoutingHints(args) {
 		...typeof addonId === "string" && addonId.length > 0 ? { addonId } : {}
 	};
 }
-//#endregion
-//#region src/kernel/transport/local-child-registry.ts
 function readFanoutMode() {
 	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
 	if (raw === "shadow" || raw === "broadcast") return raw;
@@ -6676,6 +7089,14 @@ var LocalChildRegistry = class {
 	/** See {@link ForwardCensus}. Mutable counters on the hot path, by design. */
 	forwardedRaw = 0;
 	forwardedDecoded = 0;
+	/**
+	* The per-ACTION byte census (D456). `ForwardCensus` above is the same
+	* question asked of the whole plane; this one asks it per `<cap>.<method>`,
+	* beside the bytes that method actually moved. Both are kept: `socketFwd=`
+	* says whether the negotiation is working at all, and a `raw=0` on ONE
+	* method with `raw>0` on its neighbours is a different fault.
+	*/
+	actionCensus = createCapActionCensus();
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
 	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
@@ -6689,6 +7110,12 @@ var LocalChildRegistry = class {
 	/** Last pattern-set string logged per child, to dedup the INFO line. */
 	loggedPatternSet = /* @__PURE__ */ new Map();
 	/**
+	* Derived `(cap, device?) → child` index over {@link children}, or `null`
+	* when it must be rebuilt. See {@link capIndex} for why it is a cache and
+	* never a registry (D3, D457).
+	*/
+	capChildIndex = null;
+	/**
 	* Accepts either a plain positional `server` argument (backward-compatible)
 	* or a full `LocalChildRegistryOptions` object.
 	*
@@ -6769,6 +7196,21 @@ var LocalChildRegistry = class {
 		};
 	}
 	/**
+	* Cumulative per-action byte census: peer → `<cap>.<method>` → bytes, calls
+	* and the raw/decoded split. A COPY (`cap-action-census.ts` explains why it
+	* must be one); the heartbeat subtracts the previous reading.
+	*
+	* This is the instrument D454 closed by asking for. `socketTopBytes=` names
+	* the peer that moves the bytes and `txkB=` says they are responses; neither
+	* can say WHICH method originates them, and after raw-forward the bytes that
+	* cross are no longer the proxy for what hub-main pays — 85.7 % of sibling
+	* calls cross unread. What costs is what hub-main LOOKS at, and that is the
+	* `decoded` half of an entry, next to the bytes it carried.
+	*/
+	readActionCensus() {
+		return this.actionCensus.read();
+	}
+	/**
 	* The regime the counters above were produced under, read once from
 	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
 	*
@@ -6882,11 +7324,12 @@ var LocalChildRegistry = class {
 	* compete for the same capName.
 	*/
 	resolveChildId(capName, deviceId) {
+		const index = this.capIndex();
 		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
+			const deviceOwner = index.deviceOwner(capName, deviceId);
 			if (deviceOwner !== null) return deviceOwner;
 		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
+		const candidates = index.singletonCandidates(capName);
 		if (candidates.length === 0) return null;
 		if (candidates.length === 1) return candidates[0];
 		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
@@ -6919,16 +7362,37 @@ var LocalChildRegistry = class {
 			});
 		} catch {}
 	}
-	/** First child whose cap manifest contains a descriptor matching `predicate`. */
-	findChildId(predicate) {
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
-		return null;
+	/**
+	* The cap index over the CURRENT children, rebuilt on first use after any
+	* mutation of {@link children}.
+	*
+	* This replaced a linear walk of every child's cap manifest per
+	* `cap-call-out`, measured at **7.1 % of hub-main's busy main thread**
+	* across 39 children (D456). Why it did not exist before is the whole
+	* design: what it indexes moves — a runner is replaced on every update, a
+	* crash respawns one, a child re-registers with a replacement manifest after
+	* init — and an index that names a dead child routes work into a socket
+	* nobody is reading, which is strictly worse than a slow scan.
+	*
+	* So it is not maintained; it is DISCARDED. `buildCapChildIndex` is a pure
+	* function of `children.values()`, the only two writers of that map
+	* ({@link invalidateCapIndex}'s call sites) drop the index in the same
+	* statement, and nothing else can construct one. There is no add-on-register
+	* / remove-on-close path that could disagree with the map — i.e. no shadow
+	* registry (D3): the map remains the single authority and this holds no fact
+	* it does not.
+	*
+	* The operator's active-singleton preference is deliberately NOT indexed —
+	* it changes without any child connecting or leaving, so `resolveChildId`
+	* reads it live and the index only supplies the candidate list.
+	*/
+	capIndex() {
+		if (this.capChildIndex === null) this.capChildIndex = buildCapChildIndex(this.children.values());
+		return this.capChildIndex;
 	}
-	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
-	findAllChildIds(predicate) {
-		const out = [];
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
-		return out;
+	/** Drop the derived index. MUST follow every write to {@link children}. */
+	invalidateCapIndex() {
+		this.capChildIndex = null;
 	}
 	/**
 	* Does the named child currently provide `(capName, deviceId?)`?
@@ -7124,6 +7588,14 @@ var LocalChildRegistry = class {
 	onConnection(channel) {
 		let childId = null;
 		const incarnation = this.nextIncarnation++;
+		channel.observeActions?.({
+			label: capActionLabel,
+			record: (label, reqBytes, resBytes) => {
+				const peerId = childId ?? "(pre-register)";
+				if (label === null) this.actionCensus.recordUnlabelled(peerId, reqBytes + resBytes);
+				else this.actionCensus.record(peerId, label, reqBytes, resBytes);
+			}
+		});
 		channel.onEvent((body) => {
 			const msg = body;
 			if (msg.kind === "event") {
@@ -7166,6 +7638,7 @@ var LocalChildRegistry = class {
 					incarnation,
 					rawForward: msg.rawForward === true
 				});
+				this.invalidateCapIndex();
 				this.logPatternSet(msg.childId, eventPatterns);
 				this.registeredHandler({
 					childId: msg.childId,
@@ -7197,6 +7670,8 @@ var LocalChildRegistry = class {
 				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, hints) === true;
 				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
 				this.recordCapUsage(childId, target, out.capName, out.method);
+				const actionPeer = childId ?? "(pre-register)";
+				const actionLabel = `${out.capName}.${out.method}`;
 				if (target !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
@@ -7205,6 +7680,7 @@ var LocalChildRegistry = class {
 					const entry = this.children.get(target);
 					if (payload !== void 0 && entry !== void 0 && entry.rawForward) {
 						this.forwardedRaw += 1;
+						this.actionCensus.recordForward(actionPeer, actionLabel, "raw");
 						const forward = {
 							kind: "cap-call",
 							capName: out.capName,
@@ -7219,9 +7695,12 @@ var LocalChildRegistry = class {
 						});
 					}
 					this.forwardedDecoded += 1;
-					return this.callCap(buildInput());
+					this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
+					const input = buildInput();
+					return entry !== void 0 ? this.callCapOnChild(target, input) : this.callCap(input);
 				}
 				this.forwardedDecoded += 1;
+				this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
 				if (this.onUnownedCall !== void 0) return this.onUnownedCall(buildInput());
 				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
 			}
@@ -7244,7 +7723,9 @@ var LocalChildRegistry = class {
 				return;
 			}
 			this.children.delete(childId);
+			this.invalidateCapIndex();
 			this.childEventStats.delete(childId);
+			this.actionCensus.forget(childId);
 			this.loggedPatternSet.delete(childId);
 			this.goneHandler(childId, incarnation);
 		});
@@ -10702,4 +11183,4 @@ async function defaultRun(command, args) {
 	await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
 }
 //#endregion
-export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, sampleSocketDirection as An, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, createV8Reclaimer as Bt, ipcParentLink as C, createSocketPlaneReader as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, EMPTY_SOCKET_DIRECTION as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, readSocketQueues as En, HEAP_RECLAIM_TRIGGER_MB as Et, CapRouteError as F, createEventPlaneReader as Fn, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, hubMainRssBudget as Ht, classifyCapRoute as I, diffEventPlane as In, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, LocalChildClient as L, formatEventPlane as Ln, buildHeapSample as Lt, AGENT_CAP_FWD_SERVICE as M, socketDirectionMessages as Mn, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, CapRouteResolver as N, EVENT_PLANE_TOP_N as Nn, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, createSocketDirectionCounters as On, HEAP_WATCH_WARN_RATIO as Ot, callWithServiceDiscovery as P, createEventPlaneMeter as Pn, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, LocalChildRegistry as R, createDeferredHeapWatchSink as Rt, buildLinkChain as S, createSocketPlaneMeter as Sn, runNpm as St, createParentUnownedCallHandler as T, formatSocketPlane as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, nextRssBudgetState as Ut, CapUsageRegistry as V, describeRss as Vt, getCapUsageRegistry as W, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, createMeshQueueReader as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, SOCKET_PLANE_TOP_N as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, OUTBOUND_QUEUE_COOLDOWN_MS as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, OUTBOUND_QUEUE_SUSTAIN_MS as fn, parseCapAction as ft, subscribePassthrough as g, MESH_QUEUE_TOP_N as gn, CapabilityHandle as gt, setNodeEventInterest as h, formatOutboundQueueVerdict as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, AGENT_CAP_FWD_ACTION as j, socketDirectionBytes as jn, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, recordSocketFrame as kn, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createOutboundQueueGate as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, OUTBOUND_QUEUE_THRESHOLD_BYTES as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, formatMeshQueue as vn, copyBundledNativeModules as vt, localProviderLink as w, diffSocketPlane as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, SOCKET_QUEUE_TOP_N as xn, resolveNpmInvocation as xt, resolveHwAccel as y, EMPTY_SOCKET_PLANE_BASELINE as yn, installManifestNativeDeps as yt, UDS_NO_ROUTE_PREFIX as z, createLoopDelayMeter as zt };
+export { buildUdsNativeCapProxy as $, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO as $t, createUdsLoggerWithControl as A, sampleSocketDirection as An, HUB_MAIN_RSS_BUDGET_MB as At, readMoleculerFanoutMode as B, EVENT_PLANE_TOP_N as Bn, createV8Reclaimer as Bt, ipcParentLink as C, createSocketPlaneReader as Cn, createAddonDataPlaneFacility as Ct, createUdsEventBus as D, EMPTY_SOCKET_DIRECTION as Dn, HEAP_WATCH_INTERVAL_MS as Dt, createUdsEventBridge as E, readSocketQueues as En, HEAP_RECLAIM_TRIGGER_MB as Et, CapRouteError as F, EMPTY_CAP_ACTION_READING as Fn, RUNNER_RSS_BUDGET_ENV as Ft, createLocalTransport as G, reclaimIntervalMs as Gt, PARENT_ROUTED_PROVIDER_ADDON_ID as H, createEventPlaneReader as Hn, hubMainRssBudget as Ht, classifyCapRoute as I, MAX_CAP_ACTIONS_PER_PEER as In, ZERO_LOOP_DELAY as It, SocketChannel as J, startRunnerHeapWatch as Jt, UdsLocalTransportClient as K, shouldReclaim as Kt, LocalChildClient as L, capActionLabel as Ln, buildHeapSample as Lt, AGENT_CAP_FWD_SERVICE as M, socketDirectionMessages as Mn, RSS_BUDGET_REANNOUNCE_MIN_MS as Mt, CapRouteResolver as N, CAP_ACTION_OVERFLOW_LABEL as Nn, RSS_BUDGET_RELEASE_RATIO as Nt, udsChildLogToWorkerEntry as O, createSocketDirectionCounters as On, HEAP_WATCH_WARN_RATIO as Ot, callWithServiceDiscovery as P, CAP_ACTION_UNLABELLED as Pn, RUNNER_HEAP_WATCH_INTERVAL_MS as Pt, buildNativeCapProxy as Q, ARRAY_BUFFER_CENSUS_THRESHOLD_MB as Qt, LocalChildRegistry as R, createCapActionCensus as Rn, createDeferredHeapWatchSink as Rt, buildLinkChain as S, createSocketPlaneMeter as Sn, runNpm as St, createParentUnownedCallHandler as T, formatSocketPlane as Tn, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS as Tt, __resetCapUsageRegistryForTests as U, diffEventPlane as Un, nextRssBudgetState as Ut, CapUsageRegistry as V, createEventPlaneMeter as Vn, describeRss as Vt, getCapUsageRegistry as W, formatEventPlane as Wn, parseRssBudgetMb as Wt, FrameDecoder as X, ARRAY_BUFFER_CENSUS_COOLDOWN_MS as Xt, localEndpointPath as Y, strandedMb as Yt, encodeFrame as Z, ARRAY_BUFFER_CENSUS_SUSTAIN_MS as Zt, AddonDepsManager as _, createMeshQueueReader as _n, CapabilityUnavailableError as _t, createUdsAddonContext as a, HEAP_SPACE_REPORT_MIN_MB as an, createAddonService as at, brokerCallForCap as b, SOCKET_PLANE_TOP_N as bn, resolveAddonClass as bt, getOrInitReadinessRegistryForClient as c, heapSpaceField as cn, capActionName as ct, clusterEventTopic as d, OUTBOUND_QUEUE_COOLDOWN_MS as dn, capServiceName as dt, createArrayBufferCensusGate as en, createBrokerDeviceManagerApi as et, getBrokerEventBus as f, OUTBOUND_QUEUE_SUSTAIN_MS as fn, parseCapAction as ft, subscribePassthrough as g, MESH_QUEUE_TOP_N as gn, CapabilityHandle as gt, setNodeEventInterest as h, formatOutboundQueueVerdict as hn, DeviceRegistry as ht, createAddonContext as i, DECISIVE_HEAP_SPACES as in, setWorkerNativeCapsChangeListener as it, AGENT_CAP_FWD_ACTION as j, socketDirectionBytes as jn, HUB_RSS_BUDGET_ENV as jt, createUdsLogger as k, recordSocketFrame as kn, HUB_MAIN_HEAP_WATCH_LABEL as kt, setHubConnected as l, readHeapSpaces as ln, capActionSuffix as lt, registerEventBusService as m, createOutboundQueueGate as mn, serializeTypedArrays as mt, installManifestPythonDeps as n, formatArrayBufferCensus as nn, getWorkerNativeCapSnapshot as nt, getWorkerDeviceRegistry as o, emitHeapDiagnosticReport as on, validateProviderRegistrations as ot, getMoleculerEventStats as p, OUTBOUND_QUEUE_THRESHOLD_BYTES as pn, deserializeTypedArrays as pt, UdsLocalTransportServer as q, startHeapWatch as qt, adaptBrokerToCluster as r, isArrayBufferCensusReport as rn, mountNativeCapService as rt, getOrInitReadinessRegistry as s, formatHeapSpaces as sn, NATIVE_PROVIDER_SERVICE_INFIX as st, installManifestSystemDeps as t, createInspectorArrayBufferCensus as tn, getWorkerNativeCapProvider as tt, EVENT_TOPIC_PREFIX as u, selectReportedSpaces as un, capBareAction as ut, createKernelHwAccel as v, formatMeshQueue as vn, copyBundledNativeModules as vt, localProviderLink as w, diffSocketPlane as wn, HEAP_RECLAIM_MIN_INTERVAL_MS as wt, brokerTransportLink as x, SOCKET_QUEUE_TOP_N as xn, resolveNpmInvocation as xt, resolveHwAccel as y, EMPTY_SOCKET_PLANE_BASELINE as yn, installManifestNativeDeps as yt, UDS_NO_ROUTE_PREFIX as z, diffCapActionCensus as zn, createLoopDelayMeter as zt };