@camstack/server 1.2.127 → 1.2.129

package/dist/agent/agent-update-service.js

@@ -63,12 +63,13 @@ exports.agentRuntimeManifestEntry = agentRuntimeManifestEntry;
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-const index_js_1 = require("../server-root/index.js");
-const system_exec_npm_js_1 = require("../core/server-update/system-exec-npm.js");
-const system_ensure_prebuilds_js_1 = require("../core/server-update/system-ensure-prebuilds.js");
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
+const system_ensure_prebuilds_js_1 = require("../core/server-update/system-ensure-prebuilds.js");
+const system_exec_npm_js_1 = require("../core/server-update/system-exec-npm.js");
 const update_availability_emitter_js_1 = require("../core/update-availability-emitter.js");
+const update_availability_store_js_1 = require("../core/update-availability-store.js");
+const index_js_1 = require("../server-root/index.js");
 /**
  * The synthetic addonId the agent's OWN runtime registers infra providers
  * under (no addon owns them — the bootstrap does). Appears in the agent's
@@ -151,6 +152,8 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
     eventBus;
     nodeId;
     agentDataDir;
+    /** The base class keeps `logger` private; hold our own for the store. */
+    agentLogger;
     constructor(options) {
         const restartAgent = options.restartAgent ??
             ((requestedBy) => scheduleAgentRestart(options.logger, requestedBy, options.dataDir));
@@ -189,22 +192,22 @@ class AgentUpdateService extends index_js_1.RootUpdateService {
         });
         this.nodeId = options.nodeId ?? process.env['CAMSTACK_NODE_ID'] ?? 'agent';
         this.agentDataDir = options.dataDir;
+        this.agentLogger = options.logger;
         this.eventBus = options.eventBus ?? null;
         this.updateAvailability =
             options.eventBus !== undefined
-                ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, {
-                    type: 'core',
-                    id: 'agent-update-service',
-                })
+                ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, { type: 'core', id: 'agent-update-service' }, options.updateAvailabilityStore)
                 : null;
     }
+    /**
+     * Bind the agent's real event bus once the mesh is up. The dedup state is
+     * persisted under the agent's data dir from here on — an agent restarts on
+     * every root update, which is exactly when its availability list is longest.
+     */
     bindAvailability(eventBus, nodeId) {
         this.eventBus = eventBus;
         this.nodeId = nodeId;
-        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBus, {
-            type: 'core',
-            id: 'agent-update-service',
-        });
+        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBus, { type: 'core', id: 'agent-update-service' }, new update_availability_store_js_1.FileUpdateAvailabilityStore(this.agentDataDir, 'agent-update', this.agentLogger));
     }
     async checkServerUpdate() {
         const result = await super.checkServerUpdate();

package/dist/api/core/cap-providers.js

@@ -76,6 +76,7 @@ const server_1 = require("@trpc/server");
 const integration_id_backfill_1 = require("../../boot/integration-id-backfill");
 const addon_package_service_js_1 = require("../../core/addon/addon-package.service.js");
 const lifecycle_runner_singleton_js_1 = require("../../core/lifecycle/lifecycle-runner.singleton.js");
+const agent_installed_packages_js_1 = require("../../core/updates/agent-installed-packages.js");
 const collection_preference_js_1 = require("./collection-preference.js");
 const site_location_js_1 = require("./site-location.js");
 // ── system ──────────────────────────────────────────────────────────
@@ -1220,18 +1221,6 @@ function isHubNode(nodeId) {
  * filter it out to make the list look clean — the number reaching zero is the
  * point of the number.
  */
-async function fetchAgentInstalledPackages(broker, nodeId) {
-    const status = await broker.call('$agent.status', {}, { nodeID: nodeId, timeout: 5_000 });
-    const out = [];
-    for (const a of status.addons ?? []) {
-        if (typeof a.packageName !== 'string' || typeof a.version !== 'string')
-            continue;
-        if ((0, addon_package_service_js_1.isFrameworkPackage)(a.packageName))
-            continue;
-        out.push({ name: a.packageName, version: a.version });
-    }
-    return out;
-}
 function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
     const broker = moleculer.broker;
     const frameworkAllowSet = new Set([addon_package_service_js_1.SYSTEM_PACKAGE]);
@@ -1277,7 +1266,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             const nodeId = input.nodeId;
             const updates = nodeId === undefined || isHubNode(nodeId)
                 ? await ps.checkUpdates()
-                : await ps.checkUpdatesForInstalled(await fetchAgentInstalledPackages(broker, nodeId), nodeId);
+                : await ps.checkUpdatesForInstalled(await (0, agent_installed_packages_js_1.fetchAgentInstalledPackages)(broker, nodeId), nodeId);
             return updates.map((u) => ({ ...u, isSystem: frameworkAllowSet.has(u.name) }));
         },
         updatePackage: async (input) => {
@@ -1331,7 +1320,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             if (nodeId === undefined || isHubNode(nodeId))
                 return ps.checkUpdates(true);
             // Agent rosters carry no hub-side cache — the diff is always live.
-            const installed = await fetchAgentInstalledPackages(broker, nodeId);
+            const installed = await (0, agent_installed_packages_js_1.fetchAgentInstalledPackages)(broker, nodeId);
             return ps.checkUpdatesForInstalled(installed, nodeId);
         },
         restartServer: async () => ps.restartServer(ctx.user?.username ?? ctx.user?.id),
@@ -1399,7 +1388,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             return { success: true };
         },
         getAutoUpdateSettings: async () => ps.getAutoUpdateSettings(),
-        setAutoUpdateSettings: async (input) => ps.setAutoUpdateSettings(input.channel, input.intervalSeconds),
+        setAutoUpdateSettings: async (input) => ps.setAutoUpdateSettings(input.channel, input.intervalSeconds, input.updateCheckIntervalSeconds),
         getAddonAutoUpdate: async (input) => ps.getAddonAutoUpdate(input.addonId),
         setAddonAutoUpdate: async (input) => ps.setAddonAutoUpdate(input.addonId, input.channel),
         applyAutoUpdateToAll: async (input) => {

package/dist/core/addon/addon-package.service.js

@@ -45,8 +45,9 @@ const path = __importStar(require("node:path"));
 const node_util_1 = require("node:util");
 const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
-const package_dir_utils_js_1 = require("./package-dir-utils.js");
 const update_availability_emitter_js_1 = require("../update-availability-emitter.js");
+const update_check_scheduler_js_1 = require("../updates/update-check-scheduler.js");
+const package_dir_utils_js_1 = require("./package-dir-utils.js");
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 /**
  * The primary host-provided framework package (kernel + core). Kept as a named
@@ -193,10 +194,20 @@ class AddonPackageService {
     updateAvailability;
     // -- Auto-update state ----------------------------------------------------
     autoUpdateConfig = {
-        global: { channel: 'off', intervalSeconds: 21600 },
+        global: {
+            channel: 'off',
+            intervalSeconds: 21600,
+            updateCheckIntervalSeconds: update_check_scheduler_js_1.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS,
+        },
         overrides: {},
     };
     autoUpdateTimer = null;
+    /**
+     * Re-arm hook for the availability poller, wired at boot (manual-boot). Kept
+     * as a callback rather than a service reference so this module never imports
+     * the scheduler's dependencies back.
+     */
+    updateCheckRescheduler = null;
     // -- Timing constants -----------------------------------------------------
     // Short TTL — operators expect to see freshly-published versions
     // within minutes of `npm publish`, not hours. The Addons page kicks
@@ -207,7 +218,12 @@ class AddonPackageService {
     static VERSION_CACHE_TTL_MS = 10 * 60 * 1000; // 10 minutes
     static NPM_REGISTRY = 'https://registry.npmjs.org';
     static REGISTRY_TIMEOUT_MS = 10_000;
-    constructor(loggingService, eventBusService, configService, addonRegistry, notificationService, toastService) {
+    constructor(loggingService, eventBusService, configService, addonRegistry, notificationService, toastService, 
+    /**
+     * Durable dedup state for `update.available`. Injected by boot wiring
+     * (manual-boot) — unit tests leave it out and get the RAM-only emitter.
+     */
+    updateAvailabilityStore) {
         this.loggingService = loggingService;
         this.eventBusService = eventBusService;
         this.configService = configService;
@@ -215,10 +231,7 @@ class AddonPackageService {
         this.notificationService = notificationService;
         this.toastService = toastService;
         this.logger = this.loggingService.createLogger('AddonPackageService');
-        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(this.eventBusService, {
-            type: 'core',
-            id: 'addon-package-service',
-        });
+        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(this.eventBusService, { type: 'core', id: 'addon-package-service' }, updateAvailabilityStore);
         // Initialize installer eagerly (no async needed).
         // Ensures install/uninstall works before full module init completes.
         try {
@@ -613,8 +626,8 @@ class AddonPackageService {
         this.logger.info('Checking for package updates...');
         const updates = [];
         // Check installed addon packages in addons dir
-        const addonUpdates = await this.checkAddonPackageUpdates();
-        updates.push(...addonUpdates);
+        const sweep = await this.checkAddonPackageUpdates();
+        updates.push(...sweep.updates);
         this.logger.info('Found package updates', {
             meta: {
                 count: updates.length,
@@ -629,12 +642,7 @@ class AddonPackageService {
             updates,
             expiresAt: now + AddonPackageService.UPDATE_CACHE_TTL_MS,
         };
-        this.updateAvailability.publishSnapshot('addon', updates.map((update) => ({
-            target: 'addon',
-            packageName: update.name,
-            currentVersion: update.currentVersion,
-            latestVersion: update.latestVersion,
-        })));
+        this.publishAddonAvailability(updates, sweep.failures);
         return updates;
     }
     /** Clear the cached update check results */
@@ -659,6 +667,7 @@ class AddonPackageService {
                 seen.set(pkg.name, pkg.version);
         }
         const updates = [];
+        let failures = 0;
         await Promise.all([...seen].map(async ([name, version]) => {
             if (!this.isAllowedPackage(name))
                 return;
@@ -667,7 +676,16 @@ class AddonPackageService {
             // keeps the UI honest (no dead "Update" button for @camstack/server).
             if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name))
                 return;
-            const latestVersion = await this.fetchLatestVersion(name);
+            const lookup = await this.lookupLatestVersion(name);
+            if (!lookup.ok) {
+                failures += 1;
+                this.logger.warn('Registry lookup failed for installed package', {
+                    tags: { nodeId: nodeId ?? 'hub' },
+                    meta: { name, error: lookup.error },
+                });
+                return;
+            }
+            const latestVersion = lookup.latestVersion;
             if (latestVersion === null || !isVersionNewer(latestVersion, version))
                 return;
             const category = this.categorize(name);
@@ -679,13 +697,7 @@ class AddonPackageService {
                 requiresRestart: category === 'core',
             });
         }));
-        this.updateAvailability.publishSnapshot('addon', updates.map((update) => ({
-            target: 'addon',
-            packageName: update.name,
-            currentVersion: update.currentVersion,
-            latestVersion: update.latestVersion,
-            ...(nodeId !== undefined ? { nodeId } : {}),
-        })), nodeId);
+        this.publishAddonAvailability(updates, failures, nodeId);
         return updates;
     }
     /**
@@ -1165,6 +1177,7 @@ class AddonPackageService {
             const hubPkgDir = (0, package_dir_utils_js_1.resolveHubClosurePackageDir)(packageName);
             const buildId = hubPkgDir !== null ? (0, package_dir_utils_js_1.computeDistBuildId)(path.join(hubPkgDir, 'dist')) : null;
             let latestVersion = null;
+            let lookupFailed = false;
             try {
                 const args = [
                     'view',
@@ -1177,21 +1190,73 @@ class AddonPackageService {
                 latestVersion = trimmed.length > 0 ? trimmed : null;
             }
             catch (err) {
+                lookupFailed = true;
                 this.logger.debug('listFrameworkPackages: npm view failed', {
                     meta: { packageName, error: (0, types_1.errMsg)(err) },
                 });
             }
-            const hasUpdate = latestVersion !== null && currentVersion !== 'unknown' && latestVersion !== currentVersion;
+            // STRICTLY newer, never merely different. The hub runs
+            // `1.2.x-dev.<timestamp>` builds that are AHEAD of the npm tag, and
+            // `latest !== current` lit an "update available" badge whose only
+            // possible outcome was a downgrade. `publishFrameworkAvailability`
+            // already gated on this; the row the UI reads did not, so the same
+            // page disagreed with itself.
+            const hasUpdate = latestVersion !== null &&
+                currentVersion !== 'unknown' &&
+                isVersionNewer(latestVersion, currentVersion);
             return {
                 packageName,
                 currentVersion,
                 latestVersion,
                 hasUpdate,
                 buildId,
+                lookupFailed,
                 ...(description !== undefined ? { description } : {}),
             };
         }));
-        return rows;
+        this.publishFrameworkAvailability(rows);
+        return rows.map(({ lookupFailed: _lookupFailed, ...row }) => row);
+    }
+    /**
+     * Announce framework updates. This surface SHOWED `@camstack/system` had an
+     * update and emitted nothing, so the operator was never told — it was the
+     * only discovery path with no publish at all.
+     *
+     * Two rules it must not break:
+     *  - **Strictly newer only.** `hasUpdate` is `latest !== current`, which is
+     *    true for a hub running a `-dev.<timestamp>` build AHEAD of the npm tag.
+     *    Announcing that would be telling the operator to downgrade.
+     *  - **A failed lookup publishes nothing.** Not even an empty snapshot: an
+     *    empty snapshot means "up to date" and would clear the dedup state, so
+     *    the next successful poll would re-announce everything.
+     */
+    publishFrameworkAvailability(rows) {
+        const failed = rows.filter((row) => row.lookupFailed);
+        if (failed.length > 0) {
+            this.logger.warn('Framework update check incomplete — availability not published', {
+                meta: { packages: failed.map((row) => row.packageName) },
+            });
+            return;
+        }
+        const candidates = [];
+        for (const row of rows) {
+            if (row.latestVersion === null || row.currentVersion === 'unknown')
+                continue;
+            if (!isVersionNewer(row.latestVersion, row.currentVersion))
+                continue;
+            candidates.push({
+                target: 'server',
+                packageName: row.packageName,
+                currentVersion: row.currentVersion,
+                latestVersion: row.latestVersion,
+                nodeId: this.resolveNodeId(),
+            });
+        }
+        this.updateAvailability.publishSnapshot('server', candidates, this.resolveNodeId());
+    }
+    /** Node id stamped on availability events emitted by THIS process. */
+    resolveNodeId() {
+        return process.env['CAMSTACK_NODE_ID'] ?? 'hub';
     }
     // =========================================================================
     // Reload
@@ -1224,21 +1289,39 @@ class AddonPackageService {
     // =========================================================================
     // Auto-update settings
     // =========================================================================
+    /**
+     * Register the availability poller's re-arm hook. Called once at boot so a
+     * `setAutoUpdateSettings` write takes effect without a restart.
+     */
+    setUpdateCheckRescheduler(reschedule) {
+        this.updateCheckRescheduler = reschedule;
+    }
     /** Get global auto-update settings */
     getAutoUpdateSettings() {
         return { ...this.autoUpdateConfig.global };
     }
     /** Set global auto-update settings and restart the timer */
-    async setAutoUpdateSettings(channel, intervalSeconds) {
+    async setAutoUpdateSettings(channel, intervalSeconds, updateCheckIntervalSeconds) {
+        const previousCheckInterval = this.autoUpdateConfig.global.updateCheckIntervalSeconds;
+        const nextCheckInterval = updateCheckIntervalSeconds === undefined
+            ? previousCheckInterval
+            : (0, update_check_scheduler_js_1.clampUpdateCheckInterval)(updateCheckIntervalSeconds);
         this.autoUpdateConfig = {
             ...this.autoUpdateConfig,
             global: {
                 channel,
                 intervalSeconds: intervalSeconds ?? this.autoUpdateConfig.global.intervalSeconds,
+                updateCheckIntervalSeconds: nextCheckInterval,
             },
         };
         this.saveAutoUpdateConfig();
         this.scheduleAutoUpdate();
+        if (updateCheckIntervalSeconds === undefined)
+            return;
+        this.logger.info('Update-check interval changed', {
+            meta: { from: previousCheckInterval, to: nextCheckInterval },
+        });
+        this.updateCheckRescheduler?.();
     }
     /** Get per-addon auto-update override */
     getAddonAutoUpdate(addonId) {
@@ -1395,10 +1478,14 @@ class AddonPackageService {
                     const global = asRecord(raw['global']);
                     const channel = asString(global['channel']);
                     const validChannel = channel === 'latest' || channel === 'beta' ? channel : 'off';
+                    const rawCheckInterval = global['updateCheckIntervalSeconds'];
                     return {
                         global: {
                             channel: validChannel,
                             intervalSeconds: typeof global['intervalSeconds'] === 'number' ? global['intervalSeconds'] : 3600,
+                            updateCheckIntervalSeconds: typeof rawCheckInterval === 'number'
+                                ? (0, update_check_scheduler_js_1.clampUpdateCheckInterval)(rawCheckInterval)
+                                : update_check_scheduler_js_1.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS,
                         },
                         overrides: Object.fromEntries(Object.entries(asRecord(raw['overrides'])).map(([k, v]) => {
                             const s = asString(v);
@@ -1414,7 +1501,14 @@ class AddonPackageService {
                 meta: { error: (0, types_1.errMsg)(err) },
             });
         }
-        return { global: { channel: 'off', intervalSeconds: 21600 }, overrides: {} };
+        return {
+            global: {
+                channel: 'off',
+                intervalSeconds: 21600,
+                updateCheckIntervalSeconds: update_check_scheduler_js_1.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS,
+            },
+            overrides: {},
+        };
     }
     /** Save auto-update config to disk */
     saveAutoUpdateConfig() {
@@ -1440,12 +1534,17 @@ class AddonPackageService {
     /**
      * Check addon packages for updates by reading installed versions from
      * data/addons/{name}/package.json and comparing against npm registry.
+     *
+     * Reports `failures` alongside the diff: a registry lookup that could not be
+     * MADE is not evidence that a package is up to date, and the availability
+     * publish branches on it.
      */
     async checkAddonPackageUpdates() {
         const addonsDir = this.resolveAddonsDir();
         const updates = [];
+        let failures = 0;
         if (!fs.existsSync(addonsDir))
-            return updates;
+            return { updates, failures };
         // Collect all package.json paths -- handles both flat and scoped layouts
         const pkgJsonPaths = [];
         const topDirs = fs
@@ -1491,7 +1590,16 @@ class AddonPackageService {
                     if (source === 'workspace')
                         continue;
                 }
-                const latestVersion = await this.fetchLatestVersion(name);
+                const lookup = await this.lookupLatestVersion(name);
+                if (!lookup.ok) {
+                    failures += 1;
+                    this.logger.warn('Registry lookup failed for installed addon package', {
+                        tags: { nodeId: this.resolveNodeId() },
+                        meta: { name, error: lookup.error },
+                    });
+                    continue;
+                }
+                const latestVersion = lookup.latestVersion;
                 if (!latestVersion)
                     continue;
                 if (isVersionNewer(latestVersion, version)) {
@@ -1505,13 +1613,16 @@ class AddonPackageService {
                 }
             }
             catch (error) {
+                // The package could not be evaluated at all (unreadable manifest, …).
+                // Counted as a failure for the same reason a registry miss is.
+                failures += 1;
                 const msg = (0, types_1.errMsg)(error);
-                this.logger.debug('Failed to check updates for addon', {
+                this.logger.warn('Failed to check updates for addon', {
                     meta: { pkgJsonPath, error: msg },
                 });
             }
         }
-        return updates;
+        return { updates, failures };
     }
     // =========================================================================
     // Private: npm registry helpers
@@ -1522,7 +1633,7 @@ class AddonPackageService {
      * Honours `CAMSTACK_NPM_REGISTRY` so update checks resolve against
      * the same registry the installer/pack paths use. Without this, a
      * per-node `listUpdates` (which diffs an agent's roster via
-     * `checkUpdatesForInstalled` → `fetchLatestVersion`) would bypass a
+     * `checkUpdatesForInstalled` → `lookupLatestVersion`) would bypass a
      * private registry — including the e2e harness's verdaccio — and
      * silently report "no update" for packages that only exist there.
      * Trailing slashes are stripped so the `${base}/${name}` join is clean.
@@ -1532,29 +1643,61 @@ class AddonPackageService {
         const base = override && override.length > 0 ? override : AddonPackageService.NPM_REGISTRY;
         return base.replace(/\/+$/, '');
     }
-    /** Fetch the latest published version of a package from the npm registry */
-    async fetchLatestVersion(packageName) {
+    /**
+     * Ask the registry for a package's latest version, distinguishing "there is
+     * no such package" (a definitive answer) from "I could not ask" (a failure).
+     * The difference decides whether an availability SNAPSHOT may be published —
+     * see {@link RegistryLookup}.
+     */
+    async lookupLatestVersion(packageName) {
         try {
             const encodedName = packageName.replace('/', '%2F');
             const url = `${this.resolveRegistryBase()}/${encodedName}/latest`;
             const response = await fetch(url, {
                 signal: AbortSignal.timeout(AddonPackageService.REGISTRY_TIMEOUT_MS),
             });
+            if (response.status === 404)
+                return { ok: true, latestVersion: null };
             if (!response.ok) {
                 this.logger.debug('Registry returned non-ok status', {
                     meta: { packageName, status: response.status },
                 });
-                return null;
+                return { ok: false, error: `registry status ${response.status}` };
             }
             const data = await fetchJsonObject(response);
             const version = asString(data['version']);
-            return version || null;
+            return { ok: true, latestVersion: version || null };
         }
         catch (error) {
-            const msg = (0, types_1.errMsg)(error);
-            this.logger.debug('Failed to fetch latest version', { meta: { packageName, error: msg } });
-            return null;
+            return { ok: false, error: (0, types_1.errMsg)(error) };
+        }
+    }
+    /**
+     * Announce the addon-update set for one scope (hub or a node).
+     *
+     * `failures > 0` means at least one registry lookup could not be made, so
+     * the set is INCOMPLETE — publish it as candidates (additive) rather than a
+     * snapshot (authoritative). A snapshot built from a partial sweep silently
+     * marks the unreachable packages "up to date", clears their dedup state and
+     * re-announces them on the next good poll.
+     */
+    publishAddonAvailability(updates, failures, nodeId) {
+        const candidates = updates.map((update) => ({
+            target: 'addon',
+            packageName: update.name,
+            currentVersion: update.currentVersion,
+            latestVersion: update.latestVersion,
+            ...(nodeId !== undefined ? { nodeId } : {}),
+        }));
+        if (failures > 0) {
+            this.logger.warn('Addon update check incomplete — availability published as partial', {
+                tags: { nodeId: nodeId ?? 'hub' },
+                meta: { failures, published: candidates.length },
+            });
+            this.updateAvailability.publishCandidates(candidates);
+            return;
         }
+        this.updateAvailability.publishSnapshot('addon', candidates, nodeId);
     }
     /** Fetch npm search results for camstack addon packages (cached 5 min) */
     async fetchSearchFromNpm() {

package/dist/core/logging/logging.service.js

@@ -28,11 +28,14 @@ class LoggingService extends system_1.LogManager {
         // keep their sparse history. `eventBus.ringBufferSize` still sizes the
         // separate system-event ring; logs get their own per-addon cap.
         const perAddonCapacity = configService.get('eventBus.perAddonLogBufferSize') ?? 5000;
-        // Soft total ceiling across all buckets, null (unbounded) by default so this
-        // changes nothing until an operator opts in. `?? null` rather than a numeric
-        // default on purpose: the per-addon rings are already a hard bound, and picking
-        // a total for someone would silently start discarding their debug history.
-        const maxTotalEntries = configService.get('eventBus.maxTotalLogBufferSize') ?? null;
+        // Total ceiling across all buckets. Left UNSET here on purpose so the buffer
+        // applies its own default (`DEFAULT_MAX_TOTAL_LOG_ENTRIES`): the per-addon
+        // rings are a hard bound only per bucket, and their product grows with the
+        // roster — hub-main ingests from every local runner AND every agent, so
+        // "unbounded by default" meant ~300k retained entries (~92MB) on the one
+        // process that must fit inside the cgroup. An operator who genuinely wants
+        // no aggregate bound writes an explicit `null`, which is preserved.
+        const maxTotalEntries = configService.get('eventBus.maxTotalLogBufferSize');
         // Only entries at or below this level are ever discarded to meet the total.
         const pruneLevel = configService.get('eventBus.logBufferPruneLevel') ?? 'debug';
         super(perAddonCapacity, { maxTotalEntries, pruneLevel });

package/dist/core/server-update/server-update.service.js

@@ -53,9 +53,9 @@ exports.ServerUpdateService = void 0;
  */
 const path = __importStar(require("node:path"));
 const index_js_1 = require("../../server-root/index.js");
-const system_exec_npm_js_1 = require("./system-exec-npm.js");
-const system_ensure_prebuilds_js_1 = require("./system-ensure-prebuilds.js");
 const update_availability_emitter_js_1 = require("../update-availability-emitter.js");
+const system_ensure_prebuilds_js_1 = require("./system-ensure-prebuilds.js");
+const system_exec_npm_js_1 = require("./system-exec-npm.js");
 class ServerUpdateService extends index_js_1.RootUpdateService {
     updateAvailability;
     nodeId;
@@ -95,10 +95,7 @@ class ServerUpdateService extends index_js_1.RootUpdateService {
         });
         this.updateAvailability =
             options.eventBus !== undefined
-                ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, {
-                    type: 'core',
-                    id: 'server-update-service',
-                })
+                ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, { type: 'core', id: 'server-update-service' }, options.updateAvailabilityStore)
                 : null;
         this.nodeId = options.nodeId ?? 'hub';
     }

package/dist/core/streaming/stream-probe.service.js

@@ -3,17 +3,38 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.StreamProbeService = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
+const ttl_cache_1 = require("./ttl-cache");
 const types_1 = require("@camstack/types");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const CACHE_TTL_MS = 3_600_000; // 1 hour
 const PROBE_TIMEOUT_MS = 5_000;
+/**
+ * Ceiling on cached probes.
+ *
+ * The cache is keyed by stream URL, and a URL is not a bounded quantity: every
+ * credential rotation, every edited field, every per-camera probe of a value
+ * that was later changed mints a new key. 512 is far above any real camera
+ * roster (the live cluster runs 27), so a working deployment never evicts;
+ * the ceiling exists so the key space cannot be walked into the OOM.
+ */
+const CACHE_MAX_ENTRIES = 512;
 /** Codec aliases normalised to canonical names. */
 const CODEC_ALIASES = {
     hevc: 'h265',
 };
 class StreamProbeService {
     logger;
-    cache = new Map();
+    /**
+     * Probe results, bounded by BOTH a swept TTL and an entry ceiling.
+     *
+     * It used to be a plain `Map` whose age was consulted only when the same URL
+     * was probed again — so an entry nobody asked about a second time was never
+     * found expired and never removed. See {@link TtlCache}.
+     */
+    cache = new ttl_cache_1.TtlCache({
+        ttlMs: CACHE_TTL_MS,
+        maxEntries: CACHE_MAX_ENTRIES,
+    });
     constructor(loggingService) {
         this.logger = loggingService.createLogger('StreamProbeService');
     }
@@ -25,12 +46,11 @@ class StreamProbeService {
         const force = options?.force ?? false;
         if (!force) {
             const cached = this.cache.get(url);
-            if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
-                return cached.metadata;
-            }
+            if (cached)
+                return cached;
         }
         const metadata = await this.runProbe(url);
-        this.cache.set(url, { metadata, timestamp: Date.now() });
+        this.cache.set(url, metadata);
         return metadata;
     }
     /**

package/dist/core/streaming/ttl-cache.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TtlCache = void 0;
+class TtlCache {
+    entries = new Map();
+    ttlMs;
+    maxEntries;
+    now;
+    constructor(options) {
+        this.ttlMs = options.ttlMs;
+        this.maxEntries = options.maxEntries;
+        this.now = options.now ?? (() => Date.now());
+    }
+    /** The live value, or undefined when absent or expired. An expired entry is
+     *  DELETED here, not merely reported missing. */
+    get(key) {
+        const slot = this.entries.get(key);
+        if (slot === undefined)
+            return undefined;
+        const at = this.now();
+        if (at - slot.storedAt >= this.ttlMs) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        slot.lastAccessAt = at;
+        return slot.value;
+    }
+    /**
+     * Store a value, then bring the map back inside both bounds.
+     *
+     * The sweep runs on WRITE and not on a timer on purpose: a timer would have
+     * to be owned, unref'd and stopped by every holder of a cache, and a cache
+     * that is never written to is a cache that is not growing.
+     */
+    set(key, value) {
+        const at = this.now();
+        this.entries.set(key, { value, storedAt: at, lastAccessAt: at });
+        this.sweepExpired(at);
+        this.enforceMaxEntries(key);
+    }
+    delete(key) {
+        this.entries.delete(key);
+    }
+    clear() {
+        this.entries.clear();
+    }
+    /** Entries currently retained. The number that used to only go up. */
+    size() {
+        return this.entries.size;
+    }
+    sweepExpired(at) {
+        for (const [key, slot] of this.entries) {
+            if (at - slot.storedAt >= this.ttlMs)
+                this.entries.delete(key);
+        }
+    }
+    /** Evict least-recently-USED first. `protectedKey` is the entry just written —
+     *  evicting it would make `set` a no-op. */
+    enforceMaxEntries(protectedKey) {
+        if (this.entries.size <= this.maxEntries)
+            return;
+        const coldestFirst = [...this.entries.entries()]
+            .filter(([key]) => key !== protectedKey)
+            .toSorted((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+        for (const [key] of coldestFirst) {
+            if (this.entries.size <= this.maxEntries)
+                return;
+            this.entries.delete(key);
+        }
+    }
+}
+exports.TtlCache = TtlCache;

package/dist/core/update-availability-emitter.js

@@ -14,15 +14,33 @@ const types_1 = require("@camstack/types");
  *
  * A successful empty snapshot clears prior state for that scope; failed checks
  * should not call this method.
+ *
+ * When a {@link IUpdateAvailabilityStore} is injected the dedup state is
+ * DURABLE: a restart does not re-announce what the operator already saw, and a
+ * genuinely newer version still announces. Without one the emitter stays
+ * RAM-only (the shape every unit test uses).
  */
 class UpdateAvailabilityEmitter {
     eventBus;
     source;
+    store;
     latestByKey = new Map();
     held = new Map();
-    constructor(eventBus, source) {
+    /** Set when in-memory state diverged from what the store last saw. */
+    dirty = false;
+    constructor(eventBus, source, store) {
         this.eventBus = eventBus;
         this.source = source;
+        this.store = store;
+        const persisted = store?.load() ?? null;
+        if (persisted === null)
+            return;
+        for (const [key, version] of Object.entries(persisted.latestByKey)) {
+            this.latestByKey.set(key, version);
+        }
+        for (const [key, candidate] of Object.entries(persisted.held)) {
+            this.held.set(key, candidate);
+        }
     }
     publishSnapshot(target, candidates, nodeId) {
         const scope = nodeId ?? 'hub';
@@ -44,7 +62,9 @@ class UpdateAvailabilityEmitter {
                 continue;
             this.held.delete(key);
             this.latestByKey.delete(key);
+            this.dirty = true;
         }
+        this.persistIfDirty();
         if (!latestChanged)
             return;
         this.emitList(target);
@@ -58,6 +78,7 @@ class UpdateAvailabilityEmitter {
             if (this.note(candidate))
                 latestChanged = true;
         }
+        this.persistIfDirty();
         if (!latestChanged)
             return;
         for (const target of targets)
@@ -66,10 +87,30 @@ class UpdateAvailabilityEmitter {
     note(candidate) {
         const key = this.key(candidate);
         const previous = this.latestByKey.get(key);
+        const previousHeld = this.held.get(key);
+        if (previousHeld === undefined ||
+            previousHeld.currentVersion !== candidate.currentVersion ||
+            previousHeld.latestVersion !== candidate.latestVersion ||
+            previousHeld.nodeId !== candidate.nodeId) {
+            this.dirty = true;
+        }
         this.held.set(key, candidate);
         this.latestByKey.set(key, candidate.latestVersion);
         return previous !== candidate.latestVersion;
     }
+    /**
+     * Flush to the durable store. Called BEFORE the emit so a crash between the
+     * two costs a duplicate announcement, never a silent one.
+     */
+    persistIfDirty() {
+        if (!this.dirty)
+            return;
+        this.dirty = false;
+        this.store?.save({
+            latestByKey: Object.fromEntries(this.latestByKey),
+            held: Object.fromEntries(this.held),
+        });
+    }
     emitList(target) {
         const list = [...this.held.values()].filter((candidate) => candidate.target === target);
         if (list.length === 0)

package/dist/core/update-availability-store.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileUpdateAvailabilityStore = exports.UPDATE_AVAILABILITY_DIR = void 0;
+/**
+ * Durable backing for {@link UpdateAvailabilityEmitter}'s dedup state.
+ *
+ * The emitter's whole job is "announce a (package, version) ONCE". Keeping
+ * that in RAM meant every hub restart re-announced everything the operator had
+ * already seen — and hubs restart on every framework update, which is exactly
+ * the moment the list is longest.
+ *
+ * The mechanism is deliberately the one the neighbouring update code already
+ * uses: a small JSON file under the node's data dir, next to
+ * `auto-update.json`, `runtime-state.json` and `.restart-pending`. No new
+ * database, no settings-store dependency (the emitter runs on the AGENT too,
+ * where the hub's SQLite settings store does not exist).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const types_1 = require("@camstack/types");
+/** Directory under the data dir that holds one file per emitter scope. */
+exports.UPDATE_AVAILABILITY_DIR = 'update-availability';
+/**
+ * One file per emitter scope (`addon-packages`, `server-update`,
+ * `agent-update`) so two emitters in the same process never overwrite each
+ * other's dedup state.
+ */
+class FileUpdateAvailabilityStore {
+    scopeId;
+    logger;
+    filePath;
+    constructor(dataDir, scopeId, logger) {
+        this.scopeId = scopeId;
+        this.logger = logger;
+        this.filePath = path.join(dataDir, exports.UPDATE_AVAILABILITY_DIR, `${scopeId}.json`);
+    }
+    load() {
+        try {
+            if (!fs.existsSync(this.filePath))
+                return null;
+            const parsed = JSON.parse(fs.readFileSync(this.filePath, 'utf-8'));
+            return parseState(parsed);
+        }
+        catch (error) {
+            // A corrupt file must not look like "nothing was ever announced" AND
+            // must not crash boot. It re-announces once, then heals on the next save.
+            this.logger.warn('Update-availability state unreadable; starting from empty', {
+                meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) },
+            });
+            return null;
+        }
+    }
+    save(state) {
+        try {
+            fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+            const tmp = `${this.filePath}.tmp`;
+            fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+            fs.renameSync(tmp, this.filePath);
+        }
+        catch (error) {
+            // Losing a write degrades to the old RAM-only behaviour (a re-announce
+            // after restart) — never a failed update check.
+            this.logger.warn('Failed to persist update-availability state', {
+                meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) },
+            });
+        }
+    }
+}
+exports.FileUpdateAvailabilityStore = FileUpdateAvailabilityStore;
+function parseState(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const latestRaw = Reflect.get(raw, 'latestByKey');
+    const heldRaw = Reflect.get(raw, 'held');
+    if (latestRaw === null || typeof latestRaw !== 'object')
+        return null;
+    if (heldRaw === null || typeof heldRaw !== 'object')
+        return null;
+    const latestByKey = {};
+    for (const [key, value] of Object.entries(latestRaw)) {
+        if (typeof value === 'string')
+            latestByKey[key] = value;
+    }
+    const held = {};
+    for (const [key, value] of Object.entries(heldRaw)) {
+        const candidate = parseCandidate(value);
+        if (candidate !== null)
+            held[key] = candidate;
+    }
+    return { latestByKey, held };
+}
+function parseCandidate(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const target = Reflect.get(raw, 'target');
+    const packageName = Reflect.get(raw, 'packageName');
+    const currentVersion = Reflect.get(raw, 'currentVersion');
+    const latestVersion = Reflect.get(raw, 'latestVersion');
+    const nodeId = Reflect.get(raw, 'nodeId');
+    if (target !== 'addon' && target !== 'server')
+        return null;
+    if (typeof packageName !== 'string')
+        return null;
+    if (typeof currentVersion !== 'string')
+        return null;
+    if (typeof latestVersion !== 'string')
+        return null;
+    return {
+        target,
+        packageName,
+        currentVersion,
+        latestVersion,
+        ...(typeof nodeId === 'string' ? { nodeId } : {}),
+    };
+}

package/dist/core/updates/agent-installed-packages.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_STATUS_TIMEOUT_MS = void 0;
+exports.fetchAgentInstalledPackages = fetchAgentInstalledPackages;
+/**
+ * The agent addon roster, as the hub sees it.
+ *
+ * An agent has no npm runtime: it reports what it has installed via
+ * `$agent.status` and the hub does the registry diff
+ * (`AddonPackageService.checkUpdatesForInstalled`). Extracted from
+ * `cap-providers.ts` so the availability poller and the `addons.listUpdates`
+ * cap route read the roster through ONE function — a second copy would drift
+ * the framework filter and make the two surfaces disagree about what is
+ * installed on a node.
+ */
+const addon_package_service_js_1 = require("../addon/addon-package.service.js");
+/** Timeout for `$agent.status`; a node that cannot answer this fast is unwell. */
+exports.AGENT_STATUS_TIMEOUT_MS = 5_000;
+async function fetchAgentInstalledPackages(broker, nodeId) {
+    const status = await broker.call('$agent.status', {}, { nodeID: nodeId, timeout: exports.AGENT_STATUS_TIMEOUT_MS });
+    const out = [];
+    for (const addon of status.addons ?? []) {
+        if (typeof addon.packageName !== 'string' || typeof addon.version !== 'string')
+            continue;
+        if ((0, addon_package_service_js_1.isFrameworkPackage)(addon.packageName))
+            continue;
+        out.push({ name: addon.packageName, version: addon.version });
+    }
+    return out;
+}

package/dist/core/updates/update-check-scheduler.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateCheckScheduler = exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS = exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS = exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS = void 0;
+exports.clampUpdateCheckInterval = clampUpdateCheckInterval;
+const types_1 = require("@camstack/types");
+/**
+ * Default poll cadence: 6 hours. Registry lookups are cheap but not free, and
+ * an operator who is told about a publish within a quarter-day is told in time.
+ */
+exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS = 6 * 60 * 60;
+/**
+ * Floor: 15 minutes. Below this the sweep starts overlapping its own npm
+ * lookups on a cluster of any size, and the notification stops being a
+ * notification. `setAutoUpdateSettings` clamps to this rather than refusing,
+ * so a bad value degrades to "poll briskly" instead of "poll never".
+ */
+exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS = 15 * 60;
+/** Ceiling: 7 days. Anything longer is indistinguishable from disabled. */
+exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS = 7 * 24 * 60 * 60;
+/** Grace after boot before the first sweep, so registry I/O never races boot. */
+const DEFAULT_INITIAL_DELAY_MS = 90_000;
+/** Clamp an operator-supplied interval into the supported window. */
+function clampUpdateCheckInterval(seconds) {
+    if (!Number.isFinite(seconds))
+        return exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS;
+    const whole = Math.floor(seconds);
+    if (whole < exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS)
+        return exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS;
+    if (whole > exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS)
+        return exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS;
+    return whole;
+}
+class UpdateCheckScheduler {
+    logger;
+    targets;
+    getIntervalSeconds;
+    initialDelayMs;
+    timer = null;
+    bootTimer = null;
+    intervalSeconds = exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS;
+    sweeping = false;
+    constructor(options) {
+        this.logger = options.logger;
+        this.targets = options.targets;
+        this.getIntervalSeconds = options.getIntervalSeconds;
+        this.initialDelayMs = options.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;
+    }
+    /** Interval currently armed, after clamping. Exposed for assertions + logs. */
+    currentIntervalSeconds() {
+        return this.intervalSeconds;
+    }
+    /** Arm the poller. Safe to call twice — the previous timers are replaced. */
+    start() {
+        this.arm();
+        if (this.bootTimer !== null)
+            clearTimeout(this.bootTimer);
+        this.bootTimer = setTimeout(() => {
+            this.bootTimer = null;
+            void this.runSweep();
+        }, this.initialDelayMs);
+        this.bootTimer.unref?.();
+    }
+    /** Re-read the interval from settings and re-arm if it moved. */
+    reschedule() {
+        const next = clampUpdateCheckInterval(this.getIntervalSeconds());
+        if (this.timer !== null && next === this.intervalSeconds)
+            return;
+        this.arm();
+    }
+    stop() {
+        if (this.timer !== null)
+            clearInterval(this.timer);
+        if (this.bootTimer !== null)
+            clearTimeout(this.bootTimer);
+        this.timer = null;
+        this.bootTimer = null;
+    }
+    /**
+     * One full sweep. Never throws and never runs concurrently with itself — an
+     * overlapping tick (slow registry, long agent fan-out) is dropped WITH a log
+     * rather than doubling the npm traffic.
+     */
+    async runSweep() {
+        if (this.sweeping) {
+            this.logger.warn('Update check skipped — previous sweep still running');
+            return;
+        }
+        this.sweeping = true;
+        try {
+            const nodes = this.targets.listNodes();
+            await this.attempt('hub addon packages', 'hub', () => this.targets.checkHubAddons());
+            await this.attempt('framework packages', 'hub', () => this.targets.checkFrameworkPackages());
+            for (const node of nodes) {
+                if (!node.isOnline) {
+                    // D58: never dispatch at a node the registry already called offline —
+                    // and a dropped branch is never silent.
+                    this.logger.warn('Update check skipped — node offline', { tags: { nodeId: node.id } });
+                    continue;
+                }
+                await this.attempt('node server package', node.id, () => this.targets.checkNodeServerUpdate(node.id, node.isHub));
+                if (node.isHub)
+                    continue;
+                await this.attempt('agent addon packages', node.id, () => this.targets.checkAgentAddons(node.id));
+            }
+        }
+        finally {
+            this.sweeping = false;
+        }
+    }
+    arm() {
+        if (this.timer !== null)
+            clearInterval(this.timer);
+        this.intervalSeconds = clampUpdateCheckInterval(this.getIntervalSeconds());
+        this.logger.info('Update check scheduled', {
+            meta: { intervalSeconds: this.intervalSeconds },
+        });
+        this.timer = setInterval(() => {
+            void this.runSweep();
+        }, this.intervalSeconds * 1_000);
+        this.timer.unref?.();
+    }
+    async attempt(what, nodeId, run) {
+        try {
+            await run();
+        }
+        catch (error) {
+            // Logged, not published: an empty snapshot would read as "up to date"
+            // and destroy the dedup state the operator's notifications rely on.
+            this.logger.warn(`Update check failed — ${what}`, {
+                tags: { nodeId },
+                meta: { error: (0, types_1.errMsg)(error) },
+            });
+        }
+    }
+}
+exports.UpdateCheckScheduler = UpdateCheckScheduler;

package/dist/manual-boot.js

@@ -77,6 +77,9 @@ const server_update_service_1 = require("./core/server-update/server-update.serv
 const storage_service_1 = require("./core/storage/storage.service");
 const stream_probe_service_1 = require("./core/streaming/stream-probe.service");
 const topology_emitter_service_1 = require("./core/topology/topology-emitter.service");
+const update_availability_store_js_1 = require("./core/update-availability-store.js");
+const agent_installed_packages_js_1 = require("./core/updates/agent-installed-packages.js");
+const update_check_scheduler_js_1 = require("./core/updates/update-check-scheduler.js");
 // ---------------------------------------------------------------------------
 // Service container — narrowing via `instanceof`, no casts.
 // ---------------------------------------------------------------------------
@@ -157,7 +160,10 @@ async function bootManual(opts) {
     // AddonWidgetsService — needs AddonRegistryService for the bundled-addon
     // dist sub-folder lookup (see service docstring).
     const addonWidgetsService = new addon_widgets_service_1.AddonWidgetsService(loggingService, capabilityService, addonRegistryService);
-    const addonPackageService = new addon_package_service_1.AddonPackageService(loggingService, eventBusService, configService, addonRegistryService, notificationWrapper, toastWrapper);
+    // Durable `update.available` dedup lives next to `auto-update.json`, so a
+    // hub restart never re-announces what the operator already saw.
+    const availabilityDataDir = path.resolve(process.env['CAMSTACK_DATA'] ?? 'camstack-data');
+    const addonPackageService = new addon_package_service_1.AddonPackageService(loggingService, eventBusService, configService, addonRegistryService, notificationWrapper, toastWrapper, new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, 'addon-packages', loggingService.createLogger('UpdateAvailability')));
     // Addon back-fill delivery seam. Wired here (not in the AgentRegistryService
     // constructor) because it needs AddonPackageService, which is a later layer.
     // Bytes come from THE HUB'S OWN INSTALLED COPY whenever it has one, and only
@@ -234,9 +240,45 @@ async function bootManual(opts) {
         logger: loggingService.createLogger('ServerUpdate'),
         restartServer: (requestedBy) => addonPackageService.restartServer(requestedBy),
         eventBus: eventBusService,
+        updateAvailabilityStore: new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, 'server-update', loggingService.createLogger('UpdateAvailability')),
     });
     const topologyEmitterService = new topology_emitter_service_1.TopologyEmitterService(eventBusService, agentRegistryService, addonRegistryService, (0, cap_providers_1.createNodeRootPackageLookup)(moleculerService, serverUpdateService));
     const postBootService = new post_boot_service_1.PostBootService(addonRegistryService, eventBusService, loggingService);
+    // ---- Update availability poller ---------------------------------------
+    // "Tell me, don't install." Deliberately NOT gated on the auto-update
+    // channel — that gate is why the only periodic publisher was dead on every
+    // live hub (`{"channel":"off"}`). See UpdateCheckScheduler.
+    const updateCheckLogger = loggingService.createLogger('UpdateCheck');
+    const updateCheckScheduler = new update_check_scheduler_js_1.UpdateCheckScheduler({
+        logger: updateCheckLogger,
+        getIntervalSeconds: () => addonPackageService.getAutoUpdateSettings().updateCheckIntervalSeconds,
+        targets: {
+            listNodes: () => agentRegistryService.listNodeLiveness(),
+            checkHubAddons: () => addonPackageService.checkUpdates(true),
+            checkFrameworkPackages: () => addonPackageService.listFrameworkPackages(),
+            checkAgentAddons: async (nodeId) => {
+                const broker = moleculerService.broker;
+                const installed = await (0, agent_installed_packages_js_1.fetchAgentInstalledPackages)(broker, nodeId);
+                return addonPackageService.checkUpdatesForInstalled(installed, nodeId);
+            },
+            checkNodeServerUpdate: async (nodeId, isHub) => {
+                if (isHub)
+                    return serverUpdateService.checkServerUpdate();
+                const proxy = moleculerService.createCapabilityProxy('server-management', nodeId);
+                if (proxy === null) {
+                    // A node with no reachable `server-management` cannot be checked —
+                    // say so rather than counting it as up to date.
+                    updateCheckLogger.warn('Update check skipped — server-management unreachable', {
+                        tags: { nodeId },
+                    });
+                    return undefined;
+                }
+                return proxy['checkServerUpdate']?.({});
+            },
+        },
+    });
+    addonPackageService.setUpdateCheckRescheduler(() => updateCheckScheduler.reschedule());
+    updateCheckScheduler.start();
     // ---- Container ---------------------------------------------------------
     const container = new ServiceContainer();
     container.register(config_service_1.ConfigService, configService);
@@ -262,6 +304,7 @@ async function bootManual(opts) {
     container.register(server_update_service_1.ServerUpdateService, serverUpdateService);
     container.register(topology_emitter_service_1.TopologyEmitterService, topologyEmitterService);
     container.register(post_boot_service_1.PostBootService, postBootService);
+    container.register(update_check_scheduler_js_1.UpdateCheckScheduler, updateCheckScheduler);
     // ---- Fastify instance --------------------------------------------------
     const fastify = (0, fastify_1.default)(fastifyOpts);
     // /health and /health/* — registered in `main.ts` via
@@ -278,6 +321,12 @@ async function bootManual(opts) {
         const logErr = (label, err) => {
             console.error(`[manual-boot] ${label} destroy failed:`, err);
         };
+        try {
+            updateCheckScheduler.stop();
+        }
+        catch (err) {
+            logErr('UpdateCheckScheduler', err);
+        }
         try {
             topologyEmitterService.onModuleDestroy();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.127",
+  "version": "1.2.129",
   "private": false,
   "files": [
     "dist",
@@ -33,18 +33,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.76",
+    "@camstack/addon-admin-ui": "1.2.77",
     "@camstack/addon-agent-ui": "1.2.20",
     "@camstack/addon-auth": "1.2.22",
     "@camstack/addon-decoder-nodeav": "1.2.19",
     "@camstack/addon-notifiers": "1.2.24",
-    "@camstack/addon-pipeline": "1.2.93",
-    "@camstack/addon-pipeline-orchestrator": "1.2.75",
-    "@camstack/addon-post-analysis": "1.2.90",
+    "@camstack/addon-pipeline": "1.2.94",
+    "@camstack/addon-pipeline-orchestrator": "1.2.77",
+    "@camstack/addon-post-analysis": "1.2.92",
     "@camstack/sdk": "1.2.22",
     "@camstack/shm-ring": "1.1.19",
-    "@camstack/system": "1.2.102",
-    "@camstack/types": "1.2.84",
+    "@camstack/system": "1.2.103",
+    "@camstack/types": "1.2.86",
     "@camstack/ui-library": "1.2.58",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",