@camstack/system 1.2.219 → 1.2.221

package/dist/{manifest-system-deps-g_nK0xsF.js → manifest-system-deps-DfpwaXkh.js}

@@ -155,6 +155,166 @@ function formatEventPlane(window) {
 	return ` fanoutMode=uds:${window.udsMode}/cross-node:${window.crossNodeMode} children=${window.childrenConnected} childrenUndeclared=${window.childrenUndeclared} fanoutSent=${window.fanoutSent} fanoutSuppressed=${window.fanoutSuppressed} crossNodeDelivered=${window.crossNodeDelivered} crossNodeSuppressed=${window.crossNodeSuppressed}` + (top.length === 0 ? "" : ` fanoutTop=${top}`);
 }
 //#endregion
+//#region src/kernel/transport/cap-action-census.ts
+/** A process that has never read the census. */
+var EMPTY_CAP_ACTION_READING = /* @__PURE__ */ new Map();
+/**
+* Bytes that crossed on a frame carrying no cap envelope.
+*
+* Named rather than omitted so the census's coverage is readable off its own
+* output: `register`, `addon-call`, log frames and the event fan-out all land
+* here. A census that reported only what it could name would look like a
+* complete attribution of whatever share it happened to cover.
+*/
+var CAP_ACTION_UNLABELLED = "(unlabelled)";
+/** Bytes of actions past {@link MAX_CAP_ACTIONS_PER_PEER} on one peer. */
+var CAP_ACTION_OVERFLOW_LABEL = "(overflow)";
+/**
+* Distinct named actions kept per peer before the overflow bucket takes over.
+*
+* Sixty-four against a measured worst case of 14 (`pipeline-analytics`, the
+* heaviest peer on this hub, 2026-09-11) — four times the observed shape, so a
+* peer has to change character before it overflows, and a bound that is never
+* reached in practice still forbids the unbounded growth a wire-supplied key
+* makes possible in principle.
+*/
+var MAX_CAP_ACTIONS_PER_PEER = 64;
+/**
+* `<cap>.<method>` for a cap envelope, `null` for anything else.
+*
+* Both directions are labelled by the same function: a child's `cap-call-out`
+* and the parent's `cap-call` carry `capName` + `method` in the same two keys,
+* so one predicate covers the whole plane. Anything else — a `register`, an
+* `addon-call`, a log or an event — is deliberately unlabelled; see
+* {@link CAP_ACTION_UNLABELLED} for where its bytes go.
+*
+* Cost: two property reads, two `typeof`s and one concatenation of two short
+* strings, called once per `req` frame (not per frame). Against the
+* `encodeFrame` it sits beside — 1 948–1 975 ns on a 0.33 kB body — it is
+* noise, and unlike `recordSocketFrame` it is not on the `evt` path at all.
+*/
+function capActionLabel(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const env = body;
+	if (env.kind !== "cap-call" && env.kind !== "cap-call-out") return null;
+	if (typeof env.capName !== "string" || typeof env.method !== "string") return null;
+	return `${env.capName}.${env.method}`;
+}
+function emptyCounters() {
+	return {
+		calls: 0,
+		reqBytes: 0,
+		resBytes: 0,
+		raw: 0,
+		decoded: 0
+	};
+}
+function createCapActionCensus() {
+	const peers = /* @__PURE__ */ new Map();
+	/**
+	* The per-peer slot for `action`, creating it under the bound.
+	*
+	* Past {@link MAX_CAP_ACTIONS_PER_PEER} a NEW label is folded into the
+	* overflow bucket; labels already present keep their own slot, so a peer
+	* that overflows does not lose the attribution it had built.
+	*/
+	const slot = (peerId, action) => {
+		let byAction = peers.get(peerId);
+		if (byAction === void 0) {
+			byAction = /* @__PURE__ */ new Map();
+			peers.set(peerId, byAction);
+		}
+		const existing = byAction.get(action);
+		if (existing !== void 0) return existing;
+		if (byAction.size >= 64) {
+			let overflow = byAction.get(CAP_ACTION_OVERFLOW_LABEL);
+			if (overflow === void 0) {
+				overflow = emptyCounters();
+				byAction.set(CAP_ACTION_OVERFLOW_LABEL, overflow);
+			}
+			return overflow;
+		}
+		const fresh = emptyCounters();
+		byAction.set(action, fresh);
+		return fresh;
+	};
+	return {
+		record(peerId, action, reqBytes, resBytes) {
+			const c = slot(peerId, action);
+			c.calls += 1;
+			c.reqBytes += reqBytes;
+			c.resBytes += resBytes;
+		},
+		recordForward(peerId, action, kind) {
+			const c = slot(peerId, action);
+			if (kind === "raw") c.raw += 1;
+			else c.decoded += 1;
+		},
+		recordUnlabelled(peerId, bytes) {
+			const c = slot(peerId, CAP_ACTION_UNLABELLED);
+			c.resBytes += bytes;
+		},
+		forget(peerId) {
+			peers.delete(peerId);
+		},
+		read() {
+			const out = /* @__PURE__ */ new Map();
+			for (const [peerId, byAction] of peers) {
+				const copy = /* @__PURE__ */ new Map();
+				for (const [action, c] of byAction) copy.set(action, {
+					calls: c.calls,
+					reqBytes: c.reqBytes,
+					resBytes: c.resBytes,
+					raw: c.raw,
+					decoded: c.decoded
+				});
+				out.set(peerId, copy);
+			}
+			return out;
+		}
+	};
+}
+function sampleOf(reading, peerId, action) {
+	return reading.get(peerId)?.get(action);
+}
+/**
+* Subtract the previous reading from the current one.
+*
+* A peer whose runner RESPAWNED reconnects under the same id with counters
+* that went backwards. Clamped at 0, exactly as `diffSocketPlane` clamps for
+* the same reason: its traffic in that window is genuinely unknown, and a
+* negative number on a rate reads as a broken meter.
+*/
+function diffCapActionCensus(before, current, topN) {
+	const deltas = [];
+	let labelledBytes = 0;
+	let totalBytes = 0;
+	for (const [peerId, byAction] of current) for (const [action, now] of byAction) {
+		const then = sampleOf(before, peerId, action);
+		const reqBytes = Math.max(0, now.reqBytes - (then?.reqBytes ?? 0));
+		const resBytes = Math.max(0, now.resBytes - (then?.resBytes ?? 0));
+		const bytes = reqBytes + resBytes;
+		totalBytes += bytes;
+		if (action === "(unlabelled)" || action === "(overflow)") continue;
+		labelledBytes += bytes;
+		if (bytes === 0) continue;
+		deltas.push({
+			peerId,
+			action,
+			calls: Math.max(0, now.calls - (then?.calls ?? 0)),
+			reqBytes,
+			resBytes,
+			raw: Math.max(0, now.raw - (then?.raw ?? 0)),
+			decoded: Math.max(0, now.decoded - (then?.decoded ?? 0))
+		});
+	}
+	return {
+		top: deltas.toSorted((a, b) => b.reqBytes + b.resBytes - (a.reqBytes + a.resBytes) || a.peerId.localeCompare(b.peerId) || a.action.localeCompare(b.action)).slice(0, topN),
+		labelledBytes,
+		totalBytes
+	};
+}
+//#endregion
 //#region src/kernel/transport/socket-traffic.ts
 function createSocketDirectionCounters() {
 	return {
@@ -316,10 +476,12 @@ function createSocketPlaneReader(sources) {
 				});
 			}
 			const forward = registry.readForwardCensus?.();
+			const actions = registry.readActionCensus?.();
 			return {
 				peers,
 				peersConnected: listed.length,
-				...forward === void 0 ? {} : { forward }
+				...forward === void 0 ? {} : { forward },
+				...actions === void 0 ? {} : { actions }
 			};
 		} catch {
 			return;
@@ -422,6 +584,7 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		if (peerMessages(delta) > 0) deltas.push(delta);
 	}
 	const forward = diffForward(current.forward, baseline.forward);
+	const actions = current.actions === void 0 ? void 0 : diffCapActionCensus(baseline.actions ?? EMPTY_CAP_ACTION_READING, current.actions, 5);
 	return {
 		peersConnected: current.peersConnected,
 		peersMeasured: current.peers.length,
@@ -430,7 +593,8 @@ function diffSocketPlane(baseline, current, topN = 5) {
 		top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
 		topBytes: deltas.toSorted((a, b) => peerBytes(b) - peerBytes(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN),
 		queued: readSocketQueues(current),
-		...forward === void 0 ? {} : { forward }
+		...forward === void 0 ? {} : { forward },
+		...actions === void 0 ? {} : { actions }
 	};
 }
 function createSocketPlaneMeter(reader, topN = 5) {
@@ -441,7 +605,8 @@ function createSocketPlaneMeter(reader, topN = 5) {
 		const window = diffSocketPlane(baseline, current, topN);
 		baseline = {
 			peers: new Map(current.peers.map((p) => [p.peerId, p])),
-			...current.forward === void 0 ? {} : { forward: current.forward }
+			...current.forward === void 0 ? {} : { forward: current.forward },
+			...current.actions === void 0 ? {} : { actions: current.actions }
 		};
 		return window;
 	} };
@@ -478,6 +643,24 @@ function formatPeer(delta) {
 	return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:txkB=${formatPeerBytes(delta.tx)}:rxkB=${formatPeerBytes(delta.rx)}`;
 }
 /**
+* One named action: `<peer>!<cap>.<method>:<kB>kB/<calls>:r<raw>/d<decoded>`.
+*
+* `!` separates the peer from the action because `.` already separates cap
+* from method and a single delimiter for both would make the token ambiguous
+* to split.
+*
+* The raw/decoded pair is the half that did not exist anywhere before D456.
+* `socketFwd=` answers it for the whole plane — 30 349/5 051 on this hub — and
+* a plane-wide ratio cannot tell a method that is entirely forwarded from one
+* that is entirely decoded, which is the difference between bytes hub-main
+* copies and bytes hub-main reads. The census pays for the two counters it
+* takes; the conclusion they buy is which of the line's megabytes are actually
+* expensive.
+*/
+function formatAction(entry) {
+	return `${entry.peerId}!${entry.action}:${kb$1(entry.reqBytes + entry.resBytes)}kB/${entry.calls}:r${entry.raw}/d${entry.decoded}`;
+}
+/**
 * The suffix appended to a `[mem]` line — leading space included, empty when
 * this process has no local socket plane.
 *
@@ -503,7 +686,7 @@ function formatSocketPlane(window) {
 	const named = new Set(window.top.map((p) => p.peerId));
 	const topBytes = window.topBytes.filter((p) => !named.has(p.peerId)).map(formatPeer).join(",");
 	const queuedTop = window.queued.top.map((p) => `${p.peerId}:${kb$1(p.bytes)}`).join(",");
-	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`);
+	return ` socketPeers=${window.peersMeasured}/${window.peersConnected} socketTx=${formatDirection(window.tx)} socketRx=${formatDirection(window.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`) + (topBytes.length === 0 ? "" : ` socketTopBytes=${topBytes}`) + ` socketQueued=${kb$1(window.queued.totalBytes)}kB` + (window.queued.unmeasured === 0 ? "" : ` socketQueuedUnmeasured=${window.queued.unmeasured}`) + (queuedTop.length === 0 ? "" : ` socketQueuedTop=${queuedTop}`) + (window.forward === void 0 ? "" : ` socketFwd=${window.forward.raw}/${window.forward.decoded}`) + (window.actions === void 0 ? "" : ` socketActions=${kb$1(window.actions.labelledBytes)}/${kb$1(window.actions.totalBytes)}kB` + (window.actions.top.length === 0 ? "" : ` socketTopActions=${window.actions.top.map(formatAction).join(",")}`));
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-queue-report.ts
@@ -1139,6 +1322,125 @@ function formatArrayBufferCensus(label, report, context) {
 	return `[mem] ${label} arrayBuffer census: live=${live}MB in ${report.count} ArrayBuffers (raw arrayBuffers=${context.rawMb}MB at the trigger → ${verdict}) top sizes: ${report.topSizes.map(formatExact).join(", ") || "(none)"}; buckets: ${report.buckets.map(formatBucket).join(", ") || "(none)"}; detached=${report.detached} took=${context.tookMs}ms — cost: ONE forced full GC (the same pause as a reclaim pass), walked in memory, nothing serialised, nothing written; trigger: ${context.reason}`;
 }
 //#endregion
+//#region src/kernel/gc-census.ts
+function countsOf(entries, kinds) {
+	let majors = 0;
+	let minors = 0;
+	let incrementals = 0;
+	let pauseMs = 0;
+	for (const e of entries) {
+		if (e.kind === kinds.major) majors++;
+		else if (e.kind === kinds.minor) minors++;
+		else if (e.kind === kinds.incremental) incrementals++;
+		pauseMs += e.durationMs;
+	}
+	return {
+		majors,
+		minors,
+		incrementals,
+		pauseMs,
+		windowMs: 0
+	};
+}
+/**
+* Build a census over an injected observer.
+*
+* Returns `undefined` when the observer cannot be installed — the caller then
+* prints nothing, which is the honest reading. It must never degrade into a
+* census that reports zero collections: a process whose GC is not being
+* observed and a process that is not collecting look identical on the line, and
+* they are the two answers furthest apart.
+*/
+function createGcCensus(install, kinds, startedAt) {
+	let pending = [];
+	const stopObserving = install((entry) => {
+		pending.push(entry);
+	});
+	if (stopObserving === void 0) return void 0;
+	let windowStart = startedAt;
+	return {
+		read: (at) => {
+			const windowMs = at - windowStart;
+			if (windowMs < 1e3) return null;
+			const taken = pending;
+			pending = [];
+			windowStart = at;
+			return {
+				...countsOf(taken, kinds),
+				windowMs
+			};
+		},
+		stop: () => {
+			stopObserving();
+			pending = [];
+		}
+	};
+}
+/**
+* The observer this process actually gets.
+*
+* Everything that can fail is inside the try: a runtime without
+* `perf_hooks`, without the `gc` entry type, or without the kind constants
+* yields `undefined` from `install`, and {@link createGcCensus} then declines
+* to exist rather than reporting zeros.
+*/
+function nodeGcObserver() {
+	return {
+		kinds: readKinds({
+			major: 4,
+			minor: 1,
+			incremental: 8
+		}),
+		install: (observe) => {
+			try {
+				const observer = new (process.getBuiltinModule("node:perf_hooks")).PerformanceObserver((list) => {
+					for (const entry of list.getEntries()) {
+						const detail = "detail" in entry ? entry.detail : void 0;
+						observe({
+							kind: typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1,
+							durationMs: entry.duration
+						});
+					}
+				});
+				observer.observe({ entryTypes: ["gc"] });
+				return () => {
+					observer.disconnect();
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+function readKinds(fallback) {
+	try {
+		const c = process.getBuiltinModule("node:perf_hooks").constants;
+		return {
+			major: c.NODE_PERFORMANCE_GC_MAJOR,
+			minor: c.NODE_PERFORMANCE_GC_MINOR,
+			incremental: c.NODE_PERFORMANCE_GC_INCREMENTAL
+		};
+	} catch {
+		return fallback;
+	}
+}
+/**
+* The two fields, APPENDED LAST on the `[mem]` line.
+*
+* D446's rule: no existing field moves, so every Loki prefix written since
+* 2026-08-29 still matches. `gc=` prints even when nothing was collected — a
+* window with no collections is a reading, and it is the reading that says a
+* process is idle rather than unobserved. `gcPauseMs=` is the MAIN-THREAD
+* pause only; the concurrent marking that cost hub-main 70 % of its CPU is on
+* the platform workers and no in-process counter sees it, which is why the
+* field is named for the thread it describes (D456, part 4).
+*/
+function formatGcCensus(window) {
+	if (window === null || window === void 0) return "";
+	const perMin = (n) => window.windowMs <= 0 ? "?" : (n / (window.windowMs / 6e4)).toFixed(1);
+	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}`;
+}
+//#endregion
 //#region src/kernel/heap-watch.ts
 /**
 * heap-watch — hub-main's own memory, on the record, and returned to the OS.
@@ -1735,6 +2037,8 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	const socketPlane = probes?.socketPlane === void 0 ? void 0 : createSocketPlaneMeter(probes.socketPlane);
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
+	const gcObserver = probes?.gcObserver ?? nodeGcObserver();
+	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now());
 	const triggerMb = reclaimOptions?.triggerMb ?? 1024;
 	const minIntervalMs = reclaimOptions?.minIntervalMs ?? 12e4;
 	const steadyStateIntervalMs = reclaimOptions?.steadyStateIntervalMs ?? 6e5;
@@ -1837,7 +2141,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()));
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -1894,6 +2198,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 		stopped = true;
 		clearInterval(timer);
 		loopDelay?.stop();
+		gcCensus?.stop();
 	};
 }
 /**
@@ -5915,6 +6220,8 @@ var SocketChannel = class {
 	txCounters = createSocketDirectionCounters();
 	/** Frames read from the peer, cumulative, split by kind. */
 	rxCounters = createSocketDirectionCounters();
+	/** See {@link CapActionChannelObserver}. Absent = no per-action census. */
+	actionObserver = null;
 	constructor(socket) {
 		this.socket = socket;
 		socket.on("data", (chunk) => this.onData(chunk));
@@ -5945,16 +6252,26 @@ var SocketChannel = class {
 				}, timeoutMs);
 				timer.unref?.();
 			}
+			const label = this.labelSafely(body);
 			this.pending.set(id, {
 				resolve,
 				reject,
-				timer
+				timer,
+				action: null
 			});
-			this.send({
+			const reqBytes = this.send({
 				k: "req",
 				id,
 				body
 			}, opts?.payload);
+			const entry = this.pending.get(id);
+			if (entry !== void 0 && label !== void 0) this.pending.set(id, {
+				...entry,
+				action: {
+					label,
+					reqBytes
+				}
+			});
 		});
 	}
 	emit(body) {
@@ -5964,6 +6281,36 @@ var SocketChannel = class {
 			body
 		});
 	}
+	/**
+	* Wire the per-action census. Only one observer is active at a time; an
+	* unwired channel records nothing at all (never zeros).
+	*/
+	observeActions(observer) {
+		this.actionObserver = observer;
+	}
+	/**
+	* The label for one envelope, or `undefined` when there is nothing to
+	* record. Wrapped: a broken labeller must never fail the call it watches —
+	* the same discipline `LocalChildRegistry.recordCapUsage` applies, and for
+	* the same reason.
+	*/
+	labelSafely(body) {
+		const obs = this.actionObserver;
+		if (obs === null) return void 0;
+		try {
+			return obs.label(body);
+		} catch {
+			return null;
+		}
+	}
+	/** Settle one request/response pair on the census. Never throws. */
+	recordAction(label, reqBytes, resBytes) {
+		const obs = this.actionObserver;
+		if (obs === null) return;
+		try {
+			obs.record(label, reqBytes, resBytes);
+		} catch {}
+	}
 	/** Replace the request handler. Only one handler is active at a time. */
 	onRequest(handler) {
 		this.requestHandler = handler;
@@ -6011,21 +6358,27 @@ var SocketChannel = class {
 	* are never copied into the head. A forwarded payload is a view into the
 	* frame it arrived on, and that frame's buffer is never mutated, so handing
 	* the view to the socket is safe.
+	*
+	* Returns the on-the-wire bytes it charged — the same number the per-kind
+	* counter got, so the per-action census can never disagree with the per-peer
+	* one. `0` when the channel is closed and nothing was written.
 	*/
 	send(frame, payload) {
-		if (this.closed) return;
+		if (this.closed) return 0;
 		if (payload === void 0) {
 			const encoded = encodeFrame(frame);
 			recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
 			this.socket.write(encoded);
-			return;
+			return encoded.byteLength;
 		}
 		const head = encodeFrameHead(frame, payload);
-		recordSocketFrame(this.txCounters, frame.k, head.byteLength + payload.byteLength);
+		const bytes = head.byteLength + payload.byteLength;
+		recordSocketFrame(this.txCounters, frame.k, bytes);
 		this.socket.cork();
 		this.socket.write(head);
 		this.socket.write(payload);
 		this.socket.uncork();
+		return bytes;
 	}
 	onData(chunk) {
 		const frames = this.decoder.push(chunk);
@@ -6044,28 +6397,31 @@ var SocketChannel = class {
 	async handleFrame(frame, wireBytes) {
 		recordSocketFrame(this.rxCounters, frame.k, wireBytes);
 		if (frame.k === "req") {
+			const label = this.labelSafely(frame.body);
+			let resBytes = 0;
 			try {
 				const result = await this.requestHandler(frame.body, frame.pl);
-				if (result instanceof PayloadReply) this.send({
+				if (result instanceof PayloadReply) resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
 					body: result.body
 				}, result.payload);
-				else this.send({
+				else resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: true,
 					body: result
 				});
 			} catch (err) {
-				this.send({
+				resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: false,
 					err: err instanceof Error ? err.message : String(err)
 				});
 			}
+			if (label !== void 0) this.recordAction(label, wireBytes, resBytes);
 			return;
 		}
 		if (frame.k === "res") {
@@ -6073,6 +6429,7 @@ var SocketChannel = class {
 			if (!p) return;
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
+			if (p.action !== null) this.recordAction(p.action.label, p.action.reqBytes, wireBytes);
 			if (!frame.ok) p.reject(new Error(frame.err));
 			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
 			else p.resolve(frame.body);
@@ -6626,6 +6983,64 @@ function deliverShared(state, event) {
 	}
 }
 //#endregion
+//#region src/kernel/transport/cap-child-index.ts
+/** Separator that cannot occur in a kebab cap name, so the key is unambiguous. */
+var DEVICE_KEY_SEPARATOR = "\0";
+var NO_CANDIDATES = Object.freeze([]);
+var MapCapChildIndex = class {
+	deviceOwners;
+	singletons;
+	constructor(deviceOwners, singletons) {
+		this.deviceOwners = deviceOwners;
+		this.singletons = singletons;
+	}
+	deviceOwner(capName, deviceId) {
+		return this.deviceOwners.get(`${capName}${DEVICE_KEY_SEPARATOR}${deviceId}`) ?? null;
+	}
+	singletonCandidates(capName) {
+		return this.singletons.get(capName) ?? NO_CANDIDATES;
+	}
+};
+/**
+* Build the `(cap, device?) → child` index from the connected children.
+*
+* A PURE function of what it is handed — it captures nothing, subscribes to
+* nothing and cannot be updated in place. That is the whole safety argument
+* (D3, D457): the only way to change what it says is to build a new one from
+* the `children` map, so an index can never name a child that map has already
+* dropped. An incremental index — add on register, remove on close — would be
+* a second registry that can disagree with the first, and a stale one routes
+* to a dead runner, which is strictly worse than a slow scan.
+*
+* Cost: O(children × descriptors), paid once per mutation of the children map
+* (a register, a re-register, a disconnect) rather than once per cap call.
+*
+* The two tiers stay separate, exactly as the scan had them: a device lookup
+* is never answered from a deviceId-less descriptor. `resolveChildId` owns
+* the fallback from tier 1 to tier 2, and folding it in here would make it
+* unreachable.
+*/
+function buildCapChildIndex(entries) {
+	const deviceOwners = /* @__PURE__ */ new Map();
+	const singletons = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const namedForThisChild = /* @__PURE__ */ new Set();
+		for (const cap of entry.caps) {
+			if (cap.deviceId === void 0) {
+				if (namedForThisChild.has(cap.capName)) continue;
+				namedForThisChild.add(cap.capName);
+				const candidates = singletons.get(cap.capName);
+				if (candidates === void 0) singletons.set(cap.capName, [entry.childId]);
+				else candidates.push(entry.childId);
+				continue;
+			}
+			const key = `${cap.capName}${DEVICE_KEY_SEPARATOR}${cap.deviceId}`;
+			if (!deviceOwners.has(key)) deviceOwners.set(key, entry.childId);
+		}
+	}
+	return new MapCapChildIndex(deviceOwners, singletons);
+}
+//#endregion
 //#region src/kernel/transport/cap-routing-hints.ts
 /** Lift {@link CapRoutingHints} from a call's args. Never throws. */
 function liftRoutingHints(args) {
@@ -6637,8 +7052,6 @@ function liftRoutingHints(args) {
 		...typeof addonId === "string" && addonId.length > 0 ? { addonId } : {}
 	};
 }
-//#endregion
-//#region src/kernel/transport/local-child-registry.ts
 function readFanoutMode() {
 	const raw = process.env.CAMSTACK_UDS_EVENT_FANOUT;
 	if (raw === "shadow" || raw === "broadcast") return raw;
@@ -6679,6 +7092,14 @@ var LocalChildRegistry = class {
 	/** See {@link ForwardCensus}. Mutable counters on the hot path, by design. */
 	forwardedRaw = 0;
 	forwardedDecoded = 0;
+	/**
+	* The per-ACTION byte census (D456). `ForwardCensus` above is the same
+	* question asked of the whole plane; this one asks it per `<cap>.<method>`,
+	* beside the bytes that method actually moved. Both are kept: `socketFwd=`
+	* says whether the negotiation is working at all, and a `raw=0` on ONE
+	* method with `raw>0` on its neighbours is a different fault.
+	*/
+	actionCensus = createCapActionCensus();
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
 	/** See {@link LocalChildRegistryOptions.capUsageObserver}. */
@@ -6692,6 +7113,12 @@ var LocalChildRegistry = class {
 	/** Last pattern-set string logged per child, to dedup the INFO line. */
 	loggedPatternSet = /* @__PURE__ */ new Map();
 	/**
+	* Derived `(cap, device?) → child` index over {@link children}, or `null`
+	* when it must be rebuilt. See {@link capIndex} for why it is a cache and
+	* never a registry (D3, D457).
+	*/
+	capChildIndex = null;
+	/**
 	* Accepts either a plain positional `server` argument (backward-compatible)
 	* or a full `LocalChildRegistryOptions` object.
 	*
@@ -6772,6 +7199,21 @@ var LocalChildRegistry = class {
 		};
 	}
 	/**
+	* Cumulative per-action byte census: peer → `<cap>.<method>` → bytes, calls
+	* and the raw/decoded split. A COPY (`cap-action-census.ts` explains why it
+	* must be one); the heartbeat subtracts the previous reading.
+	*
+	* This is the instrument D454 closed by asking for. `socketTopBytes=` names
+	* the peer that moves the bytes and `txkB=` says they are responses; neither
+	* can say WHICH method originates them, and after raw-forward the bytes that
+	* cross are no longer the proxy for what hub-main pays — 85.7 % of sibling
+	* calls cross unread. What costs is what hub-main LOOKS at, and that is the
+	* `decoded` half of an entry, next to the bytes it carried.
+	*/
+	readActionCensus() {
+		return this.actionCensus.read();
+	}
+	/**
 	* The regime the counters above were produced under, read once from
 	* `CAMSTACK_UDS_EVENT_FANOUT` at construction.
 	*
@@ -6885,11 +7327,12 @@ var LocalChildRegistry = class {
 	* compete for the same capName.
 	*/
 	resolveChildId(capName, deviceId) {
+		const index = this.capIndex();
 		if (deviceId !== void 0) {
-			const deviceOwner = this.findChildId((cap) => cap.capName === capName && cap.deviceId === deviceId);
+			const deviceOwner = index.deviceOwner(capName, deviceId);
 			if (deviceOwner !== null) return deviceOwner;
 		}
-		const candidates = this.findAllChildIds((cap) => cap.capName === capName && cap.deviceId === void 0);
+		const candidates = index.singletonCandidates(capName);
 		if (candidates.length === 0) return null;
 		if (candidates.length === 1) return candidates[0];
 		const preferredAddonId = this.getActiveSingletonAddonId?.(capName) ?? null;
@@ -6922,16 +7365,37 @@ var LocalChildRegistry = class {
 			});
 		} catch {}
 	}
-	/** First child whose cap manifest contains a descriptor matching `predicate`. */
-	findChildId(predicate) {
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
-		return null;
+	/**
+	* The cap index over the CURRENT children, rebuilt on first use after any
+	* mutation of {@link children}.
+	*
+	* This replaced a linear walk of every child's cap manifest per
+	* `cap-call-out`, measured at **7.1 % of hub-main's busy main thread**
+	* across 39 children (D456). Why it did not exist before is the whole
+	* design: what it indexes moves — a runner is replaced on every update, a
+	* crash respawns one, a child re-registers with a replacement manifest after
+	* init — and an index that names a dead child routes work into a socket
+	* nobody is reading, which is strictly worse than a slow scan.
+	*
+	* So it is not maintained; it is DISCARDED. `buildCapChildIndex` is a pure
+	* function of `children.values()`, the only two writers of that map
+	* ({@link invalidateCapIndex}'s call sites) drop the index in the same
+	* statement, and nothing else can construct one. There is no add-on-register
+	* / remove-on-close path that could disagree with the map — i.e. no shadow
+	* registry (D3): the map remains the single authority and this holds no fact
+	* it does not.
+	*
+	* The operator's active-singleton preference is deliberately NOT indexed —
+	* it changes without any child connecting or leaving, so `resolveChildId`
+	* reads it live and the index only supplies the candidate list.
+	*/
+	capIndex() {
+		if (this.capChildIndex === null) this.capChildIndex = buildCapChildIndex(this.children.values());
+		return this.capChildIndex;
 	}
-	/** Every child whose cap manifest contains a descriptor matching `predicate`. */
-	findAllChildIds(predicate) {
-		const out = [];
-		for (const entry of this.children.values()) if (entry.caps.some(predicate)) out.push(entry.childId);
-		return out;
+	/** Drop the derived index. MUST follow every write to {@link children}. */
+	invalidateCapIndex() {
+		this.capChildIndex = null;
 	}
 	/**
 	* Does the named child currently provide `(capName, deviceId?)`?
@@ -7127,6 +7591,14 @@ var LocalChildRegistry = class {
 	onConnection(channel) {
 		let childId = null;
 		const incarnation = this.nextIncarnation++;
+		channel.observeActions?.({
+			label: capActionLabel,
+			record: (label, reqBytes, resBytes) => {
+				const peerId = childId ?? "(pre-register)";
+				if (label === null) this.actionCensus.recordUnlabelled(peerId, reqBytes + resBytes);
+				else this.actionCensus.record(peerId, label, reqBytes, resBytes);
+			}
+		});
 		channel.onEvent((body) => {
 			const msg = body;
 			if (msg.kind === "event") {
@@ -7169,6 +7641,7 @@ var LocalChildRegistry = class {
 					incarnation,
 					rawForward: msg.rawForward === true
 				});
+				this.invalidateCapIndex();
 				this.logPatternSet(msg.childId, eventPatterns);
 				this.registeredHandler({
 					childId: msg.childId,
@@ -7200,6 +7673,8 @@ var LocalChildRegistry = class {
 				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, hints) === true;
 				const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
 				this.recordCapUsage(childId, target, out.capName, out.method);
+				const actionPeer = childId ?? "(pre-register)";
+				const actionLabel = `${out.capName}.${out.method}`;
 				if (target !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
@@ -7208,6 +7683,7 @@ var LocalChildRegistry = class {
 					const entry = this.children.get(target);
 					if (payload !== void 0 && entry !== void 0 && entry.rawForward) {
 						this.forwardedRaw += 1;
+						this.actionCensus.recordForward(actionPeer, actionLabel, "raw");
 						const forward = {
 							kind: "cap-call",
 							capName: out.capName,
@@ -7222,9 +7698,12 @@ var LocalChildRegistry = class {
 						});
 					}
 					this.forwardedDecoded += 1;
-					return this.callCap(buildInput());
+					this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
+					const input = buildInput();
+					return entry !== void 0 ? this.callCapOnChild(target, input) : this.callCap(input);
 				}
 				this.forwardedDecoded += 1;
+				this.actionCensus.recordForward(actionPeer, actionLabel, "decoded");
 				if (this.onUnownedCall !== void 0) return this.onUnownedCall(buildInput());
 				throw new Error(`${UDS_NO_ROUTE_PREFIX}: cap-call-out has no local provider for "${out.capName}" and no fallback`);
 			}
@@ -7247,7 +7726,9 @@ var LocalChildRegistry = class {
 				return;
 			}
 			this.children.delete(childId);
+			this.invalidateCapIndex();
 			this.childEventStats.delete(childId);
+			this.actionCensus.forget(childId);
 			this.loggedPatternSet.delete(childId);
 			this.goneHandler(childId, incarnation);
 		});
@@ -10747,6 +11228,18 @@ Object.defineProperty(exports, "AddonDepsManager", {
 		return AddonDepsManager;
 	}
 });
+Object.defineProperty(exports, "CAP_ACTION_OVERFLOW_LABEL", {
+	enumerable: true,
+	get: function() {
+		return CAP_ACTION_OVERFLOW_LABEL;
+	}
+});
+Object.defineProperty(exports, "CAP_ACTION_UNLABELLED", {
+	enumerable: true,
+	get: function() {
+		return CAP_ACTION_UNLABELLED;
+	}
+});
 Object.defineProperty(exports, "CapRouteError", {
 	enumerable: true,
 	get: function() {
@@ -10789,6 +11282,12 @@ Object.defineProperty(exports, "DeviceRegistry", {
 		return DeviceRegistry;
 	}
 });
+Object.defineProperty(exports, "EMPTY_CAP_ACTION_READING", {
+	enumerable: true,
+	get: function() {
+		return EMPTY_CAP_ACTION_READING;
+	}
+});
 Object.defineProperty(exports, "EMPTY_SOCKET_DIRECTION", {
 	enumerable: true,
 	get: function() {
@@ -10885,6 +11384,12 @@ Object.defineProperty(exports, "LocalChildRegistry", {
 		return LocalChildRegistry;
 	}
 });
+Object.defineProperty(exports, "MAX_CAP_ACTIONS_PER_PEER", {
+	enumerable: true,
+	get: function() {
+		return MAX_CAP_ACTIONS_PER_PEER;
+	}
+});
 Object.defineProperty(exports, "MESH_QUEUE_TOP_N", {
 	enumerable: true,
 	get: function() {
@@ -11041,6 +11546,12 @@ Object.defineProperty(exports, "callWithServiceDiscovery", {
 		return callWithServiceDiscovery;
 	}
 });
+Object.defineProperty(exports, "capActionLabel", {
+	enumerable: true,
+	get: function() {
+		return capActionLabel;
+	}
+});
 Object.defineProperty(exports, "capActionName", {
 	enumerable: true,
 	get: function() {
@@ -11113,6 +11624,12 @@ Object.defineProperty(exports, "createBrokerDeviceManagerApi", {
 		return createBrokerDeviceManagerApi;
 	}
 });
+Object.defineProperty(exports, "createCapActionCensus", {
+	enumerable: true,
+	get: function() {
+		return createCapActionCensus;
+	}
+});
 Object.defineProperty(exports, "createDeferredHeapWatchSink", {
 	enumerable: true,
 	get: function() {
@@ -11239,6 +11756,12 @@ Object.defineProperty(exports, "deserializeTypedArrays", {
 		return deserializeTypedArrays;
 	}
 });
+Object.defineProperty(exports, "diffCapActionCensus", {
+	enumerable: true,
+	get: function() {
+		return diffCapActionCensus;
+	}
+});
 Object.defineProperty(exports, "diffEventPlane", {
 	enumerable: true,
 	get: function() {