@camstack/system 1.2.219 → 1.2.221

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-Cyz5_i7z.mjs";
+import { A as addonSettingsCapability, Dt as procedureAuthKey, Ft as scopesAllowDeviceCap, Jt as errMsg$1, Mt as resolveMethodAuth, Pt as scopesAllowAddon, Qt as DEVICE_STATUS_METHOD, Xt as DATAPLANE_SECRET_HEADER$1, Zt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as RUNTIME_DEFAULTS, _n as readinessKey, _t as logLevelAtMost, an as asJsonObject$1, at as isArrayOutputSchema, cn as createEvent, ct as isObjectInput, dn as expandCapMethods, dt as isVoidInput, ft as kebabToCamel, gn as parseJsonUnknown, h as METHOD_ACCESS_MAP, hn as parseJsonObject, ln as emitDownForOwnedCaps, mt as lifecycleJobSchema, nn as ReadinessRegistry, on as asNumber, ot as isCollectionArrayMethod, p as LOG_LEVEL_RANK, rn as ReadinessTimeoutError, sn as asString$1, t as ALL_CAPABILITY_DEFINITIONS, tt as extractNestedAddonId, vn as resolveCapMount, vt as looseSchema, wt as objectInputDeclaresAddonId, xn as EventCategory$1, yn as scopeKey } from "./dist-T9GvfhgV.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -26,9 +26,9 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as fetchJson, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, f as collectModelFiles, g as ensureModel, h as downloadModel, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as downloadFile, n as STALL_TICK_MS, o as contentTypeFor, p as deleteModelFromDisk, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as getModelFilePath, y as isModelDownloaded } from "./event-loop-stall-monitor-GPrVvx14.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-2xbgg78V.mjs";
-import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, A as createUdsLoggerWithControl, An as sampleSocketDirection, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bt as createV8Reclaimer, C as ipcParentLink, Cn as createSocketPlaneReader, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dn as EMPTY_SOCKET_DIRECTION, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, En as readSocketQueues, Et as HEAP_RECLAIM_TRIGGER_MB, F as CapRouteError, Fn as createEventPlaneReader, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Ht as hubMainRssBudget, I as classifyCapRoute, In as diffEventPlane, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as LocalChildClient, Ln as formatEventPlane, Lt as buildHeapSample, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionMessages, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as CapRouteResolver, Nn as EVENT_PLANE_TOP_N, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, On as createSocketDirectionCounters, Ot as HEAP_WATCH_WARN_RATIO, P as callWithServiceDiscovery, Pn as createEventPlaneMeter, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, R as LocalChildRegistry, Rt as createDeferredHeapWatchSink, S as buildLinkChain, Sn as createSocketPlaneMeter, St as runNpm, T as createParentUnownedCallHandler, Tn as formatSocketPlane, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Ut as nextRssBudgetState, V as CapUsageRegistry, Vt as describeRss, W as getCapUsageRegistry, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, _ as AddonDepsManager, _n as createMeshQueueReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as HEAP_SPACE_REPORT_MIN_MB, at as createAddonService, b as brokerCallForCap, bn as SOCKET_PLANE_TOP_N, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as heapSpaceField, ct as capActionName, d as clusterEventTopic, dn as OUTBOUND_QUEUE_COOLDOWN_MS, dt as capServiceName, en as createArrayBufferCensusGate, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_SUSTAIN_MS, ft as parseCapAction, g as subscribePassthrough, gn as MESH_QUEUE_TOP_N, gt as CapabilityHandle, h as setNodeEventInterest, hn as formatOutboundQueueVerdict, ht as DeviceRegistry, i as createAddonContext, in as DECISIVE_HEAP_SPACES, j as AGENT_CAP_FWD_ACTION, jn as socketDirectionBytes, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kn as recordSocketFrame, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as readHeapSpaces, lt as capActionSuffix, m as registerEventBusService, mn as createOutboundQueueGate, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as formatArrayBufferCensus, o as getWorkerDeviceRegistry, on as emitHeapDiagnosticReport, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_THRESHOLD_BYTES, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as isArrayBufferCensusReport, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as formatHeapSpaces, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createInspectorArrayBufferCensus, u as EVENT_TOPIC_PREFIX, un as selectReportedSpaces, ut as capBareAction, v as createKernelHwAccel, vn as formatMeshQueue, vt as copyBundledNativeModules, w as localProviderLink, wn as diffSocketPlane, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xn as SOCKET_QUEUE_TOP_N, xt as resolveNpmInvocation, y as resolveHwAccel, yn as EMPTY_SOCKET_PLANE_BASELINE, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zt as createLoopDelayMeter } from "./manifest-system-deps-C7dihwWT.mjs";
+import { $ as buildUdsNativeCapProxy, $t as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, A as createUdsLoggerWithControl, An as sampleSocketDirection, At as HUB_MAIN_RSS_BUDGET_MB, B as readMoleculerFanoutMode, Bn as EVENT_PLANE_TOP_N, Bt as createV8Reclaimer, C as ipcParentLink, Cn as createSocketPlaneReader, Ct as createAddonDataPlaneFacility, D as createUdsEventBus, Dn as EMPTY_SOCKET_DIRECTION, Dt as HEAP_WATCH_INTERVAL_MS, E as createUdsEventBridge, En as readSocketQueues, Et as HEAP_RECLAIM_TRIGGER_MB, F as CapRouteError, Fn as EMPTY_CAP_ACTION_READING, Ft as RUNNER_RSS_BUDGET_ENV, G as createLocalTransport, Gt as reclaimIntervalMs, H as PARENT_ROUTED_PROVIDER_ADDON_ID, Hn as createEventPlaneReader, Ht as hubMainRssBudget, I as classifyCapRoute, In as MAX_CAP_ACTIONS_PER_PEER, It as ZERO_LOOP_DELAY, J as SocketChannel, Jt as startRunnerHeapWatch, K as UdsLocalTransportClient, Kt as shouldReclaim, L as LocalChildClient, Ln as capActionLabel, Lt as buildHeapSample, M as AGENT_CAP_FWD_SERVICE, Mn as socketDirectionMessages, Mt as RSS_BUDGET_REANNOUNCE_MIN_MS, N as CapRouteResolver, Nn as CAP_ACTION_OVERFLOW_LABEL, Nt as RSS_BUDGET_RELEASE_RATIO, O as udsChildLogToWorkerEntry, On as createSocketDirectionCounters, Ot as HEAP_WATCH_WARN_RATIO, P as callWithServiceDiscovery, Pn as CAP_ACTION_UNLABELLED, Pt as RUNNER_HEAP_WATCH_INTERVAL_MS, Q as buildNativeCapProxy, Qt as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, R as LocalChildRegistry, Rn as createCapActionCensus, Rt as createDeferredHeapWatchSink, S as buildLinkChain, Sn as createSocketPlaneMeter, St as runNpm, T as createParentUnownedCallHandler, Tn as formatSocketPlane, Tt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, U as __resetCapUsageRegistryForTests, Un as diffEventPlane, Ut as nextRssBudgetState, V as CapUsageRegistry, Vn as createEventPlaneMeter, Vt as describeRss, W as getCapUsageRegistry, Wn as formatEventPlane, Wt as parseRssBudgetMb, X as FrameDecoder, Xt as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, Y as localEndpointPath, Yt as strandedMb, Z as encodeFrame, Zt as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, _ as AddonDepsManager, _n as createMeshQueueReader, _t as CapabilityUnavailableError, a as createUdsAddonContext, an as HEAP_SPACE_REPORT_MIN_MB, at as createAddonService, b as brokerCallForCap, bn as SOCKET_PLANE_TOP_N, bt as resolveAddonClass, c as getOrInitReadinessRegistryForClient, cn as heapSpaceField, ct as capActionName, d as clusterEventTopic, dn as OUTBOUND_QUEUE_COOLDOWN_MS, dt as capServiceName, en as createArrayBufferCensusGate, et as createBrokerDeviceManagerApi, f as getBrokerEventBus, fn as OUTBOUND_QUEUE_SUSTAIN_MS, ft as parseCapAction, g as subscribePassthrough, gn as MESH_QUEUE_TOP_N, gt as CapabilityHandle, h as setNodeEventInterest, hn as formatOutboundQueueVerdict, ht as DeviceRegistry, i as createAddonContext, in as DECISIVE_HEAP_SPACES, j as AGENT_CAP_FWD_ACTION, jn as socketDirectionBytes, jt as HUB_RSS_BUDGET_ENV, k as createUdsLogger, kn as recordSocketFrame, kt as HUB_MAIN_HEAP_WATCH_LABEL, l as setHubConnected, ln as readHeapSpaces, lt as capActionSuffix, m as registerEventBusService, mn as createOutboundQueueGate, mt as serializeTypedArrays, n as installManifestPythonDeps, nn as formatArrayBufferCensus, o as getWorkerDeviceRegistry, on as emitHeapDiagnosticReport, ot as validateProviderRegistrations, p as getMoleculerEventStats, pn as OUTBOUND_QUEUE_THRESHOLD_BYTES, pt as deserializeTypedArrays, q as UdsLocalTransportServer, qt as startHeapWatch, r as adaptBrokerToCluster, rn as isArrayBufferCensusReport, rt as mountNativeCapService, s as getOrInitReadinessRegistry, sn as formatHeapSpaces, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestSystemDeps, tn as createInspectorArrayBufferCensus, u as EVENT_TOPIC_PREFIX, un as selectReportedSpaces, ut as capBareAction, v as createKernelHwAccel, vn as formatMeshQueue, vt as copyBundledNativeModules, w as localProviderLink, wn as diffSocketPlane, wt as HEAP_RECLAIM_MIN_INTERVAL_MS, x as brokerTransportLink, xn as SOCKET_QUEUE_TOP_N, xt as resolveNpmInvocation, y as resolveHwAccel, yn as EMPTY_SOCKET_PLANE_BASELINE, yt as installManifestNativeDeps, z as UDS_NO_ROUTE_PREFIX, zn as diffCapActionCensus, zt as createLoopDelayMeter } from "./manifest-system-deps-iadzxSBr.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Vp0bPV3U.mjs";
-import { t as CustomActionRegistry } from "./custom-action-registry-B6gOtUWA.mjs";
+import { t as CustomActionRegistry } from "./custom-action-registry-DvtOs-tp.mjs";
 import { z } from "zod";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -78878,16 +78878,36 @@ var require_udp_broadcaster = /* @__PURE__ */ __commonJSMin$1(((exports, module)
 var require_parser = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 	var Writable = __require("stream").Writable;
 	var { resolvePacketType } = require_constants();
-	/**
-	* Import types
-	*
-	* @typedef {import("./parser")} ParserClass
-	*/
+	/** Moleculer TCP framing: CRC byte, 4-byte BE total length, type byte, payload. */
+	var HEADER_BYTES = 6;
 	/**
 	* TCP packet parser
 	* @class Parser
 	* @extends {Writable}
 	* @implements {ParserClass}
+	*
+	* ── CamStack patch (D457) — the accumulator is no longer quadratic ─────────
+	*
+	* The shipped `_write` did, ONCE PER SOCKET CHUNK that left a partial packet:
+	*
+	*     packet = Buffer.concat([this.buf, chunk]);   // copies the whole pending
+	*     this.buf = Buffer.from(packet);              // copies it AGAIN
+	*
+	* so a message of M bytes arriving in chunks of c copied ~2·M²/2c bytes on the
+	* receiving event loop — quadratic in the chunk COUNT. On CamStack's hub the
+	* mesh carries base64 JPEG cross-node (`pipelineRunner.getNativeCrop`
+	* with `encodeJpeg`, `pipelineRunner.runStatelessStep{frameJpeg}`) at
+	* `maxPacketSize: 10 MiB`, and a 50 s V8 profile of hub-main put **20.8 % of
+	* its busy main thread inside this one function**.
+	*
+	* The fix is the same one CamStack applied to its own UDS `FrameDecoder`:
+	* hold the pending chunks in a LIST, concatenate ONCE when a whole packet is
+	* available, and never at all while one is still incomplete. Everything else —
+	* the framing, the CRC check and its position, the `maxPacketSize` rule
+	* (accumulated bytes, not the declared length, exactly as before), the `data`
+	* event shape, the error text — is byte-for-byte the original behaviour, and
+	* `packages/system/src/kernel/__tests__/moleculer/mesh-tcp-parser.spec.ts`
+	* asserts each of those cases alongside the copy accounting.
 	*/
 	var Parser = class extends Writable {
 		/**
@@ -78898,32 +78918,44 @@ var require_parser = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
 		constructor(options, maxPacketSize) {
 			super(options);
 			this.maxPacketSize = maxPacketSize;
-			this.buf = null;
+			/** Pending chunks, newest last. Never concatenated until a packet completes. */
+			this.bufs = [];
+			/** Total bytes across `bufs` — the old `this.buf.length`. */
+			this.bufLen = 0;
+		}
+		/** The first `HEADER_BYTES` pending bytes, without flattening the rest. */
+		_header() {
+			const first = this.bufs[0];
+			if (first.length >= HEADER_BYTES) return first;
+			const head = Buffer.allocUnsafe(HEADER_BYTES);
+			let written = 0;
+			for (let i = 0; i < this.bufs.length && written < HEADER_BYTES; i++) {
+				const b = this.bufs[i];
+				const take = Math.min(HEADER_BYTES - written, b.length);
+				b.copy(head, written, 0, take);
+				written += take;
+			}
+			return head;
 		}
 		_write(chunk, encoding, cb) {
-			let packet = chunk;
-			if (this.buf && this.buf.length > 0) {
-				packet = Buffer.concat([this.buf, chunk]);
-				this.buf = null;
-			}
-			while (packet.length > 0) {
-				if (packet.length < 6) {
-					this.buf = Buffer.from(packet);
-					return cb();
-				}
-				if (this.maxPacketSize && packet.length > this.maxPacketSize) return cb(/* @__PURE__ */ new Error(`Incoming packet is larger than the 'maxPacketSize' limit (${packet.length} > ${this.maxPacketSize})!`));
-				const crc = packet[1] ^ packet[2] ^ packet[3] ^ packet[4] ^ packet[5];
-				if (crc !== packet[0]) return cb(/* @__PURE__ */ new Error("Invalid packet CRC! " + crc));
-				const length = packet.readInt32BE(1);
-				if (packet.length >= length) {
-					const msg = packet.slice(6, length);
-					const type = resolvePacketType(packet[5]);
-					this.emit("data", type, msg);
-					packet = packet.slice(length);
-				} else {
-					this.buf = Buffer.from(packet);
-					return cb();
-				}
+			if (this.bufLen > 0) this.bufs.push(chunk);
+			else this.bufs = [chunk];
+			this.bufLen += chunk.length;
+			while (this.bufLen > 0) {
+				if (this.bufLen < HEADER_BYTES) return cb();
+				if (this.maxPacketSize && this.bufLen > this.maxPacketSize) return cb(/* @__PURE__ */ new Error(`Incoming packet is larger than the 'maxPacketSize' limit (${this.bufLen} > ${this.maxPacketSize})!`));
+				const header = this._header();
+				const crc = header[1] ^ header[2] ^ header[3] ^ header[4] ^ header[5];
+				if (crc !== header[0]) return cb(/* @__PURE__ */ new Error("Invalid packet CRC! " + crc));
+				const length = header.readInt32BE(1);
+				if (this.bufLen < length) return cb();
+				const packet = this.bufs.length === 1 ? this.bufs[0] : Buffer.concat(this.bufs, this.bufLen);
+				const msg = packet.slice(HEADER_BYTES, length);
+				const type = resolvePacketType(packet[5]);
+				this.emit("data", type, msg);
+				const rest = packet.slice(length);
+				this.bufs = rest.length > 0 ? [rest] : [];
+				this.bufLen = rest.length;
 			}
 			cb();
 		}
@@ -95751,4 +95783,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/gc-census.d.ts

@@ -0,0 +1,144 @@
+/**
+ * gc-census — HOW OFTEN V8 collects, on the ordinary heartbeat.
+ *
+ * ## The question this exists to answer, and why four records could not
+ *
+ * A garbage collector's cost is a product of two independent things: the LIVE
+ * SET (how much there is to mark) and the RATE at which a cycle is triggered.
+ * The `[mem]` line has carried the live set since 2026-08-29 — `heapUsed`,
+ * `oldSpace`, `largeObjectSpace`, `external`, `arrayBuffers` — and has never
+ * carried the rate. So D443, D444, D446 and D456 each read a level, saw it flat
+ * or falling, and could not say whether the GC share they were looking at came
+ * from the size of the heap or from the frequency of the collection. D444 cut
+ * hub-main's live set from 2 491 MB to 714 MB — a factor of 3.5 — and the GC
+ * share did not move. That result was unreadable until the rate was measured.
+ *
+ * Measured on hub-main 2026-09-11 with the observer below, the answer was on
+ * sight: **1.39 major mark-compacts per second against a 602 MB live set whose
+ * old space grew 22 MB/s.** A major GC every 0.7 s cannot be explained by 22
+ * MB/s of heap growth under a 3 264 MB ceiling — V8 was being driven by
+ * EXTERNAL memory pressure (537 MB/s of ArrayBuffer allocation, D458), and each
+ * of those cycles then had to mark the 602 MB live set on four platform
+ * workers. That is 70 % of the process.
+ *
+ * ## Why counts and not a rate of bytes
+ *
+ * An allocation rate sampled from `process.memoryUsage()` on this heartbeat
+ * would be a lie with a number on it. The probe runs every 2 s; external memory
+ * on hub-main cycles many times inside 2 s, so a sum of positive deltas
+ * under-reports it by more than an order of magnitude (a 100 ms sampler already
+ * reported 234 MB/s where a 5 ms one would have said 537). The GC COUNT is
+ * exact at any cadence — V8 reports every cycle — and it is the half of the
+ * product the line was missing. Read against the `oldSpace=` field already on
+ * the line, the two together say which economy is paying:
+ *
+ *  - many majors, little old-space growth between them ⇒ EXTERNAL pressure.
+ *    The fix is an allocation site, and shrinking the live set buys nothing.
+ *  - majors that track old-space growth ⇒ the heap is genuinely filling.
+ *    The fix is retention.
+ *
+ * ## Cost
+ *
+ * One prologue/epilogue callback per GC, into a counter. On hub-main at its
+ * worst that is ~4 entries/s. The observer was run against the live hub three
+ * times for 90 s while this was written, with no measurable effect on the
+ * process; `Profiler.start`, by comparison, stalls it 867 ms (D456).
+ *
+ * Absence is never zero (D393): a runtime that will not give an observer
+ * reports NOTHING on the line, not a census of zero collections.
+ */
+/** One window of collections, as V8 counted them. */
+export interface GcCensusWindow {
+    /** Full mark-compacts. The expensive kind: every one marks the live set. */
+    readonly majors: number;
+    /** Scavenges of the young generation. */
+    readonly minors: number;
+    /** Incremental marking steps on the main thread. */
+    readonly incrementals: number;
+    /** Total MAIN-THREAD pause across the window. Never the concurrent work. */
+    readonly pauseMs: number;
+    /** How long the window was, so a rate can be computed from the line. */
+    readonly windowMs: number;
+}
+/**
+ * A census that accumulates until it is read, then starts a new window.
+ *
+ * Window semantics, not cumulative, for the reason D456 gives: a line printing
+ * a lifetime total says nothing about the minute it describes, and the reader
+ * has to diff two lines by hand to learn anything.
+ */
+export interface GcCensus {
+    /** The window since the previous read. `null` until the first full window. */
+    readonly read: (at: number) => GcCensusWindow | null;
+    readonly stop: () => void;
+}
+/** What the census counts. Node's `PerformanceEntry.detail.kind` values. */
+export interface GcObservation {
+    readonly kind: number;
+    readonly durationMs: number;
+}
+/**
+ * How the census is fed. Injectable so a spec can pose a sequence of
+ * collections without provoking real ones, which is not something a test can
+ * do deterministically.
+ */
+export type GcObserverInstall = (observe: (entry: GcObservation) => void) => (() => void) | undefined;
+/**
+ * V8's kinds, as Node reports them on `detail.kind`.
+ *
+ * Read from `perf_hooks.constants` rather than written as literals: the values
+ * are a Node ABI, and a literal `4` in this file would keep compiling and stop
+ * meaning "major" the release it changed.
+ */
+export interface GcKinds {
+    readonly major: number;
+    readonly minor: number;
+    readonly incremental: number;
+}
+/**
+ * The shortest window a rate may be quoted over.
+ *
+ * One second, and the number comes from the line this field lives on: the boot
+ * line is printed microseconds after the watch starts, and `maj0@0s` there
+ * would be a rate computed over no time at all — indistinguishable on sight
+ * from a process that is genuinely not collecting. Below the floor the census
+ * says NOTHING, which is the same discipline as an unobservable runtime
+ * (D393): a window too short to answer is not an answer of zero.
+ */
+export declare const GC_CENSUS_MIN_WINDOW_MS = 1000;
+/**
+ * Build a census over an injected observer.
+ *
+ * Returns `undefined` when the observer cannot be installed — the caller then
+ * prints nothing, which is the honest reading. It must never degrade into a
+ * census that reports zero collections: a process whose GC is not being
+ * observed and a process that is not collecting look identical on the line, and
+ * they are the two answers furthest apart.
+ */
+export declare function createGcCensus(install: GcObserverInstall, kinds: GcKinds, startedAt: number): GcCensus | undefined;
+/** The real Node observer and the real kind constants, wrapped so they can be replaced in a spec. */
+export interface NodeGcObserver {
+    readonly install: GcObserverInstall;
+    readonly kinds: GcKinds;
+}
+/**
+ * The observer this process actually gets.
+ *
+ * Everything that can fail is inside the try: a runtime without
+ * `perf_hooks`, without the `gc` entry type, or without the kind constants
+ * yields `undefined` from `install`, and {@link createGcCensus} then declines
+ * to exist rather than reporting zeros.
+ */
+export declare function nodeGcObserver(): NodeGcObserver;
+/**
+ * The two fields, APPENDED LAST on the `[mem]` line.
+ *
+ * D446's rule: no existing field moves, so every Loki prefix written since
+ * 2026-08-29 still matches. `gc=` prints even when nothing was collected — a
+ * window with no collections is a reading, and it is the reading that says a
+ * process is idle rather than unobserved. `gcPauseMs=` is the MAIN-THREAD
+ * pause only; the concurrent marking that cost hub-main 70 % of its CPU is on
+ * the platform workers and no in-process counter sees it, which is why the
+ * field is named for the thread it describes (D456, part 4).
+ */
+export declare function formatGcCensus(window: GcCensusWindow | null | undefined): string;

package/dist/kernel/heap-watch.d.ts

@@ -3,6 +3,7 @@ import { SocketPlaneCounters, SocketPlaneReader } from './socket-plane-report.js
 import { MeshPeerQueue, MeshQueueReader } from './moleculer/mesh-queue-report.js';
 import { OutboundQueueGateOptions, OutboundQueueReading } from './outbound-queue-watch.js';
 import { HeapSpaceReader } from './heap-spaces.js';
+import { NodeGcObserver } from './gc-census.js';
 import { ArrayBufferCensus, ArrayBufferCensusGateOptions } from './array-buffer-census.js';
 /**
  * What hub-main calls itself in a `[mem]` line.
@@ -633,6 +634,13 @@ export interface HeapWatchProbes {
      * `array-buffer-census.ts` for the gate, the cost and what it is NOT.
      */
     readonly arrayBufferCensus?: ArrayBufferCensusProbe;
+    /**
+     * How the GC census observes collections. Defaults to the real Node
+     * observer, for EVERY process — the rate is half of what a GC costs and the
+     * line has never carried it (see `gc-census.ts`). A spec passes its own so a
+     * sequence of collections can be posed; nothing in production passes one.
+     */
+    readonly gcObserver?: NodeGcObserver;
 }
 /** How the census is wired: the census itself plus the gate's thresholds. */
 export interface ArrayBufferCensusProbe extends ArrayBufferCensusGateOptions {

package/dist/kernel/socket-plane-report.d.ts

@@ -1,3 +1,4 @@
+import { CapActionReading, CapActionWindow } from './transport/cap-action-census.js';
 import { SocketDirectionSample, SocketTrafficSample } from './transport/socket-traffic.js';
 /** One peer's cumulative traffic, as the channel keeps it, plus its outbound
  *  queue depth at the instant of the read. */
@@ -39,6 +40,15 @@ export interface SocketPlaneRegistry {
      * the field rather than print a zero that reads as "nothing was forwarded".
      */
     readonly readForwardCensus?: () => SocketForwardCensus;
+    /**
+     * The per-ACTION byte census, when the registry keeps one (D456).
+     *
+     * OPTIONAL on the same terms as {@link readForwardCensus}: a registry whose
+     * channels carry no byte counters has nothing to attribute, and the line
+     * must omit the fields rather than print a `0/0` that reads as "the plane
+     * moved nothing" instead of "nobody measured".
+     */
+    readonly readActionCensus?: () => CapActionReading;
 }
 /** One cumulative reading of every measured peer. */
 export interface SocketPlaneCounters {
@@ -47,6 +57,8 @@ export interface SocketPlaneCounters {
     readonly peersConnected: number;
     /** Cumulative forward census, absent when the registry keeps none. */
     readonly forward?: SocketForwardCensus;
+    /** Cumulative per-action census, absent when the registry keeps none. */
+    readonly actions?: CapActionReading;
 }
 /** `undefined` = this process has no local socket plane to report (every forked
  *  runner, and hub-main before the registry exists). */
@@ -127,16 +139,41 @@ export interface SocketPlaneWindow {
     readonly queued: SocketQueueReading;
     /** Forwards in this window, absent when the registry keeps no census. */
     readonly forward?: SocketForwardCensus;
+    /**
+     * The per-action census over this window, absent when none is kept.
+     *
+     * This is the field that survives raw-forward. Once 85.7 % of sibling calls
+     * cross hub-main without being read (D448, measured on 1.2.270), the bytes
+     * a peer moves stop being the proxy for what hub-main PAYS — a forwarded
+     * body costs a memcpy, a decoded one costs msgpack plus the garbage. So the
+     * entry carries the raw/decoded split BESIDE the bytes, per method, and the
+     * two questions are read off one row.
+     */
+    readonly actions?: CapActionWindow;
 }
 /** How many queue-holding peers get named. Three: a queue is an exception,
  *  and the line already carries five names for traffic. */
 export declare const SOCKET_QUEUE_TOP_N = 3;
+/**
+ * How many (peer, action) pairs get named.
+ *
+ * Five, matching {@link SOCKET_PLANE_TOP_N}, and for the same measured reason:
+ * the distribution is not flat. Queried on this hub 2026-09-11, the heaviest
+ * peer's top THREE caps were 2 077 of its 2 141 calls/min — five names the
+ * dominant action, its challenger, and enough of the tail to see the shape
+ * change. The map behind it keeps every action (see `cap-action-census.ts` on
+ * why the bound that matters is the line's width, not the map's size); this
+ * constant governs only what is printed.
+ */
+export declare const SOCKET_ACTION_TOP_N = 5;
 /** The queue reading over the current counters — a level, so no baseline. */
 export declare function readSocketQueues(current: SocketPlaneCounters): SocketQueueReading;
 /** Previous cumulative reading, kept between lines. */
 export interface SocketPlaneBaseline {
     readonly peers: ReadonlyMap<string, SocketPeerSample>;
     readonly forward?: SocketForwardCensus;
+    /** Previous per-action reading; absent = nothing has been read yet. */
+    readonly actions?: CapActionReading;
 }
 /** A process that has never read the plane. */
 export declare const EMPTY_SOCKET_PLANE_BASELINE: SocketPlaneBaseline;

package/dist/kernel/transport/cap-action-census.d.ts

@@ -0,0 +1,218 @@
+/**
+ * cap-action-census — which cap METHOD moves the bytes, and how much of each
+ * one this parent forwarded without ever reading it.
+ *
+ * ## Why `socket-traffic.ts` keeps no method, and why this is a separate file
+ *
+ * Read `socket-traffic.ts` before changing anything here. It does not omit the
+ * method by oversight; three separate properties of that file forbid it, and
+ * this module exists because each can be answered somewhere else rather than
+ * relaxed:
+ *
+ * 1. **The channel does not know one.** `SocketChannel` sees a {@link
+ *    import('./local-transport.js').Frame} — `{ k, id, body }` — and `body` is
+ *    `unknown` by contract. The cap envelope lives one layer up, in
+ *    `child-cap-protocol.ts`. A counter inside the channel that reached into
+ *    `body.capName` would make the transport depend on the protocol it
+ *    carries. So the LABEL is supplied from above ({@link capActionLabel}) and
+ *    only the BYTES come from the wire.
+ *
+ * 2. **A `res` frame carries no method at all** — only its correlation `id`.
+ *    And the responses are the whole question: measured 2026-09-11, hub-main
+ *    wrote 144–262 MB/min to `hub/pipeline-analytics` on 1 966–2 411 responses
+ *    (a 73–108 kB mean) against 2 kB of requests. Charging those bytes to a
+ *    method is therefore not a counter at all, it is a CORRELATION: the label
+ *    is taken off the `req`, held against its id, and settled when the `res`
+ *    for that id is written. `socket-traffic.ts` is a two-addition hot path
+ *    with no state per message; this is state per in-flight request, and the
+ *    two do not belong in one file.
+ *
+ * 3. **Cardinality.** `recordSocketFrame` costs 2.37–2.41 ns and allocates
+ *    nothing, on a path that runs ~44 000 times a second. Its docblock's rule
+ *    — "an instrument that changes what it measures is not an instrument" — is
+ *    the binding constraint, and a naive per-method map breaks it twice: a Map
+ *    lookup and a counter object per method NAME, where the names arrive off
+ *    the wire and are therefore unbounded in principle.
+ *
+ * ## What was chosen for the cardinality, and why not a sample
+ *
+ * **Full per-method counters in memory, bounded per peer; top-N only at REPORT
+ * time.** The constraint that is real is the LINE's width (D446: Loki reads
+ * these prefixes), not the map's size — and those are different limits:
+ *
+ *  - *Measured shape.* The cap-usage graph already keeps `(caller, provider,
+ *    cap, method)` and, queried on this hub on 2026-09-11, holds **53 rows for
+ *    the whole cluster** — 14 of them for `pipeline-analytics`, whose top three
+ *    caps are 2 077 of its 2 141 calls/min. A peer uses a handful of methods,
+ *    not hundreds. ~39 peers × a few dozen labels is a few hundred counter
+ *    objects, each allocated ONCE and then only incremented. That is not an
+ *    explosion; it is smaller than the `childEventStats` map next to it.
+ *  - *The unbounded case is still refused*, because "measured today" is not a
+ *    guarantee: {@link MAX_CAP_ACTIONS_PER_PEER} caps the distinct labels per
+ *    peer and everything past it is charged to ONE
+ *    {@link CAP_ACTION_OVERFLOW_LABEL} bucket. The bytes are never dropped —
+ *    they stop being *named*, which is a different and visible failure.
+ *  - *A sampled window was rejected.* The flow this exists to name is few,
+ *    enormous responses: 1 966 responses carrying 144 MB. A 1-in-N sample of a
+ *    distribution whose top item fires ~30 times a minute answers "probably"
+ *    to a question that has an exact answer for the price of an integer add.
+ *    And a sample that misses a method would report it as zero bytes, which is
+ *    exactly the `null`-vs-`0` confusion D393 exists to forbid.
+ *  - *A byte THRESHOLD was rejected for the same reason in reverse*: a
+ *    threshold decides what to keep before it knows the window's shape, so the
+ *    method that only matters during an episode is the one it discards. Rank
+ *    at report time, when the totals are known.
+ *
+ * ## What a reader may conclude, and what it may not
+ *
+ * {@link CapActionWindow.labelledBytes} against `totalBytes` is the census's
+ * own coverage, and it is on the line. Bytes this parent moved that carry no
+ * cap envelope (`register`, `addon-call`, log and event frames) are charged to
+ * {@link CAP_ACTION_UNLABELLED} rather than omitted: an instrument that
+ * silently drops what it cannot classify reports a clean attribution of a
+ * fraction it never names. A window whose `labelledBytes` is a small part of
+ * `totalBytes` has NOT attributed the plane, and says so.
+ *
+ * ## Mutation, as in `socket-traffic.ts`
+ *
+ * Same deliberate exception, for the same measured reason: the counters are
+ * plain mutable numbers written only by {@link CapActionCensus.record} and
+ * friends, and read only through {@link CapActionCensus.read}, which COPIES.
+ * The copy is not a nicety — the reporting layer subtracts the previous
+ * reading, and a `read()` that handed back the live maps would advance the
+ * baseline together with the counters and report every window as empty.
+ */
+/**
+ * The channel's half of the census — see `socket-channel.ts` for the seam.
+ *
+ * The channel owns the BYTES and the request↔response correlation and NOTHING
+ * else: it sees `{ k, id, body }` with `body: unknown`, and a `res` frame
+ * carries no method at all. So the layer that understands the protocol supplies
+ * {@link CapActionChannelObserver.label}, and the channel calls it once per
+ * `req` frame, holds the answer against the frame's id, and settles it with
+ * {@link CapActionChannelObserver.record} when the matching `res` is written or
+ * read. A `null` label is still recorded — those bytes crossed, and a census
+ * that drops what it cannot name reports a clean attribution of a fraction it
+ * never mentions.
+ *
+ * Declared HERE rather than in the channel so `local-transport.ts` can name it
+ * on {@link import('./local-transport.js').LocalChannel} without importing the
+ * implementation that satisfies it.
+ */
+export interface CapActionChannelObserver {
+    /** `<cap>.<method>`, or `null` for a frame that carries no cap envelope. */
+    label(body: unknown): string | null;
+    /** One completed request/response pair, its on-the-wire bytes both ways. */
+    record(label: string | null, reqBytes: number, resBytes: number): void;
+}
+/** One action's cumulative cost on one peer's channel. Mutable by design. */
+export interface CapActionCounters {
+    /** Completed request/response pairs. */
+    calls: number;
+    /** On-the-wire bytes of the requests, prefix and payload included. */
+    reqBytes: number;
+    /** On-the-wire bytes of the answers. */
+    resBytes: number;
+    /** Of `calls`, how many this parent forwarded without reading (D448). */
+    raw: number;
+    /** Of `calls`, how many it materialised the args of. */
+    decoded: number;
+}
+/** An immutable reading of one action. */
+export interface CapActionSample {
+    readonly calls: number;
+    readonly reqBytes: number;
+    readonly resBytes: number;
+    readonly raw: number;
+    readonly decoded: number;
+}
+/** One complete reading: peer → action → counters. */
+export type CapActionReading = ReadonlyMap<string, ReadonlyMap<string, CapActionSample>>;
+/** A process that has never read the census. */
+export declare const EMPTY_CAP_ACTION_READING: CapActionReading;
+/**
+ * Bytes that crossed on a frame carrying no cap envelope.
+ *
+ * Named rather than omitted so the census's coverage is readable off its own
+ * output: `register`, `addon-call`, log frames and the event fan-out all land
+ * here. A census that reported only what it could name would look like a
+ * complete attribution of whatever share it happened to cover.
+ */
+export declare const CAP_ACTION_UNLABELLED = "(unlabelled)";
+/** Bytes of actions past {@link MAX_CAP_ACTIONS_PER_PEER} on one peer. */
+export declare const CAP_ACTION_OVERFLOW_LABEL = "(overflow)";
+/**
+ * Distinct named actions kept per peer before the overflow bucket takes over.
+ *
+ * Sixty-four against a measured worst case of 14 (`pipeline-analytics`, the
+ * heaviest peer on this hub, 2026-09-11) — four times the observed shape, so a
+ * peer has to change character before it overflows, and a bound that is never
+ * reached in practice still forbids the unbounded growth a wire-supplied key
+ * makes possible in principle.
+ */
+export declare const MAX_CAP_ACTIONS_PER_PEER = 64;
+/**
+ * `<cap>.<method>` for a cap envelope, `null` for anything else.
+ *
+ * Both directions are labelled by the same function: a child's `cap-call-out`
+ * and the parent's `cap-call` carry `capName` + `method` in the same two keys,
+ * so one predicate covers the whole plane. Anything else — a `register`, an
+ * `addon-call`, a log or an event — is deliberately unlabelled; see
+ * {@link CAP_ACTION_UNLABELLED} for where its bytes go.
+ *
+ * Cost: two property reads, two `typeof`s and one concatenation of two short
+ * strings, called once per `req` frame (not per frame). Against the
+ * `encodeFrame` it sits beside — 1 948–1 975 ns on a 0.33 kB body — it is
+ * noise, and unlike `recordSocketFrame` it is not on the `evt` path at all.
+ */
+export declare function capActionLabel(body: unknown): string | null;
+/** Which half of D448's census one call fell on. */
+export type CapActionForwardKind = 'raw' | 'decoded';
+/** The census as its writers see it. */
+export interface CapActionCensus {
+    /** One completed request/response pair on `peerId`, charged to `action`. */
+    record(peerId: string, action: string, reqBytes: number, resBytes: number): void;
+    /** How `action`'s most recent call was routed — see {@link CapActionForwardKind}. */
+    recordForward(peerId: string, action: string, kind: CapActionForwardKind): void;
+    /** Bytes on a frame that carried no cap envelope. */
+    recordUnlabelled(peerId: string, bytes: number): void;
+    /** Drop a peer's counters when its channel closes for good. */
+    forget(peerId: string): void;
+    /** A COPY of the counters — see the module docblock on why it must be one. */
+    read(): CapActionReading;
+}
+export declare function createCapActionCensus(): CapActionCensus;
+/** One (peer, action) pair over the window since the previous reading. */
+export interface CapActionDelta {
+    readonly peerId: string;
+    readonly action: string;
+    readonly calls: number;
+    readonly reqBytes: number;
+    readonly resBytes: number;
+    readonly raw: number;
+    readonly decoded: number;
+}
+/** The census over one heartbeat window. */
+export interface CapActionWindow {
+    /**
+     * Heaviest first by `reqBytes + resBytes`, at most the requested N.
+     *
+     * By BYTES and never by calls, for the reason D454 records: the flow this
+     * exists to name is few, enormous responses, and a ranking by count cannot
+     * see it by construction.
+     */
+    readonly top: readonly CapActionDelta[];
+    /** Bytes the census could put a cap method on, this window. */
+    readonly labelledBytes: number;
+    /** Every byte it saw, named or not. `labelled/total` is its own coverage. */
+    readonly totalBytes: number;
+}
+/**
+ * Subtract the previous reading from the current one.
+ *
+ * A peer whose runner RESPAWNED reconnects under the same id with counters
+ * that went backwards. Clamped at 0, exactly as `diffSocketPlane` clamps for
+ * the same reason: its traffic in that window is genuinely unknown, and a
+ * negative number on a rate reads as a broken meter.
+ */
+export declare function diffCapActionCensus(before: CapActionReading, current: CapActionReading, topN: number): CapActionWindow;