@camstack/system 1.2.110 → 1.2.112

package/dist/builtins/snapshot/snapshot.addon.d.ts

@@ -464,6 +464,22 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
     private courtesyFrame;
     /** A courtesy frame shaped as the cap's response, or null when unrenderable. */
     private courtesyImage;
+    /**
+     * The answer for a camera the hub cannot reach: its last good frame, with
+     * `Offline` painted over it, and `offline` stamped on the response identity.
+     *
+     * Called only AFTER the ladder has run (offline is not in
+     * {@link CAPTURE_BLOCKING_REASONS}), so this dresses a frame that could not be
+     * refreshed — never one that just landed.
+     *
+     * The `stateReason` is set FIRST and unconditionally, because it is what a
+     * surface labels the tile from and what puts `offline` in the ETag: a client
+     * holding the live frame has to see a new identity the moment the camera
+     * drops, or it paints the unlabelled photograph until the camera comes back.
+     * A failed render therefore degrades to the raw frame rather than to nothing —
+     * the metadata still says offline, so the tile is still honest.
+     */
+    private offlineImage;
     /**
      * Render a state-labelled answer. A cached real frame is the background, not
      * the answer by itself; if it cannot be decoded, fall back to the generated

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CQkr5Kw0.js");
+const require_dist = require("../../dist-IPLFQ_-A.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-CW4Cims4.mjs";
+import { V as filesystemBrowseCapability, pt as storageProviderCapability, yt as BaseAddon } from "../../dist-bkg2-2g3.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CQkr5Kw0.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DCESas5O.js");
+const require_dist = require("../../dist-IPLFQ_-A.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-B-I7w1Ta.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,5 +1,5 @@
-import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-CW4Cims4.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-DGgOxOir.mjs";
+import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-bkg2-2g3.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-C7rRSzbP.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CQkr5Kw0.js");
+const require_dist = require("../../dist-IPLFQ_-A.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-CW4Cims4.mjs";
+import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-bkg2-2g3.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CQkr5Kw0.js");
+const require_dist = require("../../dist-IPLFQ_-A.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-CW4Cims4.mjs";
+import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-bkg2-2g3.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CQkr5Kw0.js");
+const require_dist = require("../../dist-IPLFQ_-A.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-CW4Cims4.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-bkg2-2g3.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-CQkr5Kw0.js → dist-IPLFQ_-A.js}

@@ -18629,6 +18629,7 @@ var snapshotCapability = {
 				isBattery: zod.z.boolean(),
 				reason: zod.z.enum([
 					"disabled",
+					"offline",
 					"sleeping",
 					"unreachable",
 					"waking"
@@ -18718,9 +18719,17 @@ targets: zod.z.array(zod.z.object({
 			sleeping: zod.z.boolean(),
 			/** Current device state rendered over the cached frame. State images
 			*  remain authoritative even when their photographic background is
-			*  old; null means the link must carry a current camera frame. */
+			*  old; null means the link must carry a current camera frame.
+			*
+			*  **This is the ONLY source a surface may derive an inactive tile
+			*  from.** A client that reads a device's `online`/`disabled` flags and
+			*  draws its own verdict will disagree with the pixels it is painting
+			*  — the frame comes from here, and so must the sentence over it
+			*  (D190). Pair with `ageMs` for the age of the photograph behind the
+			*  state. */
 			stateReason: zod.z.enum([
 				"disabled",
+				"offline",
 				"sleeping",
 				"unreachable",
 				"waking"

package/dist/{dist-CW4Cims4.mjs → dist-bkg2-2g3.mjs}

@@ -18629,6 +18629,7 @@ var snapshotCapability = {
 				isBattery: z.boolean(),
 				reason: z.enum([
 					"disabled",
+					"offline",
 					"sleeping",
 					"unreachable",
 					"waking"
@@ -18718,9 +18719,17 @@ targets: z.array(z.object({
 			sleeping: z.boolean(),
 			/** Current device state rendered over the cached frame. State images
 			*  remain authoritative even when their photographic background is
-			*  old; null means the link must carry a current camera frame. */
+			*  old; null means the link must carry a current camera frame.
+			*
+			*  **This is the ONLY source a surface may derive an inactive tile
+			*  from.** A client that reads a device's `online`/`disabled` flags and
+			*  draws its own verdict will disagree with the pixels it is painting
+			*  — the frame comes from here, and so must the sentence over it
+			*  (D190). Pair with `ageMs` for the age of the photograph behind the
+			*  state. */
 			stateReason: z.enum([
 				"disabled",
+				"offline",
 				"sleeping",
 				"unreachable",
 				"waking"

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CQkr5Kw0.js");
+const require_dist = require("./dist-IPLFQ_-A.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
-const require_manifest_python_deps = require("./manifest-python-deps-GejnH--L.js");
+const require_manifest_python_deps = require("./manifest-python-deps-MA_BZGBz.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -5367,6 +5367,7 @@ var CapabilityRegistry = class CapabilityRegistry {
 		const state = {
 			definition,
 			providers: /* @__PURE__ */ new Map(),
+			providerOwners: /* @__PURE__ */ new Map(),
 			activeAddonId: null,
 			router: null,
 			disabledProviders: /* @__PURE__ */ new Set()
@@ -5424,8 +5425,15 @@ var CapabilityRegistry = class CapabilityRegistry {
 	* Double-register of the same pair is always a programmer error —
 	* two legitimately different addons implementing the same cap keep
 	* using different `addonId`s and the user picks one via `configReader`.
-	*/
-	registerProvider(capabilityName, addonId, provider) {
+	*
+	* `owner` (optional) stamps the registration with the incarnation that made
+	* it — see {@link ProviderOwnerToken}. Once stamped, only an unregister
+	* presenting the SAME token can delete it. Registration paths whose key is
+	* reused across process generations (the UDS child manifest, the D3
+	* `registerNode` handshake) MUST pass one; ownerless registrations keep the
+	* historical unconditional behaviour.
+	*/
+	registerProvider(capabilityName, addonId, provider, owner) {
 		let state = this.capabilities.get(capabilityName);
 		if (!state) {
 			const colonIdx = capabilityName.indexOf(":");
@@ -5457,6 +5465,7 @@ var CapabilityRegistry = class CapabilityRegistry {
 			if (missing.length > 0) throw new Error(`CapabilityRegistry: provider "${addonId}" for capability "${capabilityName}" declares exposesDeviceSettings: true but is missing DeviceSettingsContribution method(s): ${missing.join(", ")}. Implement them on the provider (or drop the flag from the cap def).`);
 		}
 		state.providers.set(addonId, provider);
+		if (owner !== void 0) state.providerOwners.set(addonId, owner);
 		if (state.definition.mode === "singleton") {
 			const userChoice = this.configReader?.(capabilityName);
 			const preferred = state.definition.preferredProvider;
@@ -5487,7 +5496,8 @@ var CapabilityRegistry = class CapabilityRegistry {
 			tags: { addonId },
 			meta: {
 				capability: capabilityName,
-				mode: state.definition.mode
+				mode: state.definition.mode,
+				...owner === void 0 ? {} : { owner }
 			}
 		});
 		this.emitEvent("capability:provider-registered", {
@@ -5534,11 +5544,70 @@ var CapabilityRegistry = class CapabilityRegistry {
 		const declarers = this.manifestDeclarers.get(capabilityName);
 		return declarers ? [...declarers] : [];
 	}
-	/** Unregister a provider. For singleton: clears active. For collection: removes from list. */
-	unregisterProvider(capabilityName, addonId) {
+	/**
+	* The owner token a registration declared, or `null` when the pair is not
+	* registered or was registered without one.
+	*/
+	getProviderOwner(capabilityName, addonId) {
+		return this.capabilities.get(capabilityName)?.providerOwners.get(addonId) ?? null;
+	}
+	/**
+	* Hand an EXISTING registration to a new owner, without touching the provider
+	* instance, the active-singleton selection or any event.
+	*
+	* The takeover case: a replacement runner handshakes with an UNCHANGED cap
+	* set, so the manifest diff correctly leaves the registration alone — but the
+	* registration is still stamped with the dead generation's token, and nothing
+	* the LIVE generation can present would ever match it. Re-stamping keeps the
+	* capability cleanable when the successor eventually dies.
+	*
+	* Returns `false` when the pair is not registered (nothing to hand over) —
+	* the caller decides whether that is a register-instead or a diagnosis.
+	*/
+	reassignProviderOwner(capabilityName, addonId, owner) {
+		const state = this.capabilities.get(capabilityName);
+		if (!state || !state.providers.has(addonId)) return false;
+		const previous = state.providerOwners.get(addonId);
+		if (previous === owner) return true;
+		state.providerOwners.set(addonId, owner);
+		this.logger.info("Capability registration ownership reassigned", {
+			tags: { addonId },
+			meta: {
+				capability: capabilityName,
+				owner,
+				previousOwner: previous ?? null
+			}
+		});
+		return true;
+	}
+	/**
+	* Unregister a provider. For singleton: clears active. For collection:
+	* removes from list.
+	*
+	* `owner` is the caller's PROOF that it owns the registration it is deleting.
+	* When the registration declared an owner (see {@link ProviderOwnerToken})
+	* and the caller presents a different one — or none at all — this is a
+	* logged no-op: the caller belongs to a generation that no longer holds the
+	* key. This is what stops a dead runner's teardown from erasing its
+	* successor's live registration ([D188](../../../../docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md)).
+	*/
+	unregisterProvider(capabilityName, addonId, owner) {
 		const state = this.capabilities.get(capabilityName);
 		if (!state) return;
+		const registeredOwner = state.providerOwners.get(addonId);
+		if (registeredOwner !== void 0 && registeredOwner !== owner) {
+			this.logger.info("Unregister ignored — registration is owned by another incarnation", {
+				tags: { addonId },
+				meta: {
+					capability: capabilityName,
+					registeredOwner,
+					presentedOwner: owner ?? null
+				}
+			});
+			return;
+		}
 		state.providers.delete(addonId);
+		state.providerOwners.delete(addonId);
 		if (state.definition.mode === "singleton" && state.activeAddonId === addonId) {
 			const userChoice = this.configReader?.(capabilityName);
 			const preferred = state.definition.preferredProvider;
@@ -94555,6 +94624,11 @@ var JobJournal = class {
 function safeSegment(name) {
 	return name.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
+/** An exact semver — the only shape the staged package.json can be compared
+*  against literally. Anything else ('latest', 'beta', a range) is a dist-tag
+*  the FETCHER resolves; comparing the resolved version to the literal tag
+*  failed every tag-based update (30/30 on 2026-08-20). */
+var EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var StagingArea = class {
 	stagingDir;
 	deps;
@@ -94572,8 +94646,12 @@ var StagingArea = class {
 		if (input.signal.aborted) throw new Error("staging aborted after fetch");
 		await this.deps.extract(tgz, destDir);
 		const raw = JSON.parse(node_fs.readFileSync(node_path.join(destDir, "package.json"), "utf-8"));
-		if (raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${String(raw.version)}`);
-		return { stagedPath: destDir };
+		if (typeof raw.version !== "string" || raw.version.length === 0) throw new Error(`staging validation failed: ${input.name} staged a package.json with no version`);
+		if (EXACT_SEMVER.test(input.version) && raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${raw.version}`);
+		return {
+			stagedPath: destDir,
+			resolvedVersion: raw.version
+		};
 	}
 	cleanup(jobId) {
 		node_fs.rmSync(node_path.join(this.stagingDir, jobId), {

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-CW4Cims4.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-bkg2-2g3.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-5ei2xVUh.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Cb1ANt3i.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -5360,6 +5360,7 @@ var CapabilityRegistry = class CapabilityRegistry {
 		const state = {
 			definition,
 			providers: /* @__PURE__ */ new Map(),
+			providerOwners: /* @__PURE__ */ new Map(),
 			activeAddonId: null,
 			router: null,
 			disabledProviders: /* @__PURE__ */ new Set()
@@ -5417,8 +5418,15 @@ var CapabilityRegistry = class CapabilityRegistry {
 	* Double-register of the same pair is always a programmer error —
 	* two legitimately different addons implementing the same cap keep
 	* using different `addonId`s and the user picks one via `configReader`.
-	*/
-	registerProvider(capabilityName, addonId, provider) {
+	*
+	* `owner` (optional) stamps the registration with the incarnation that made
+	* it — see {@link ProviderOwnerToken}. Once stamped, only an unregister
+	* presenting the SAME token can delete it. Registration paths whose key is
+	* reused across process generations (the UDS child manifest, the D3
+	* `registerNode` handshake) MUST pass one; ownerless registrations keep the
+	* historical unconditional behaviour.
+	*/
+	registerProvider(capabilityName, addonId, provider, owner) {
 		let state = this.capabilities.get(capabilityName);
 		if (!state) {
 			const colonIdx = capabilityName.indexOf(":");
@@ -5450,6 +5458,7 @@ var CapabilityRegistry = class CapabilityRegistry {
 			if (missing.length > 0) throw new Error(`CapabilityRegistry: provider "${addonId}" for capability "${capabilityName}" declares exposesDeviceSettings: true but is missing DeviceSettingsContribution method(s): ${missing.join(", ")}. Implement them on the provider (or drop the flag from the cap def).`);
 		}
 		state.providers.set(addonId, provider);
+		if (owner !== void 0) state.providerOwners.set(addonId, owner);
 		if (state.definition.mode === "singleton") {
 			const userChoice = this.configReader?.(capabilityName);
 			const preferred = state.definition.preferredProvider;
@@ -5480,7 +5489,8 @@ var CapabilityRegistry = class CapabilityRegistry {
 			tags: { addonId },
 			meta: {
 				capability: capabilityName,
-				mode: state.definition.mode
+				mode: state.definition.mode,
+				...owner === void 0 ? {} : { owner }
 			}
 		});
 		this.emitEvent("capability:provider-registered", {
@@ -5527,11 +5537,70 @@ var CapabilityRegistry = class CapabilityRegistry {
 		const declarers = this.manifestDeclarers.get(capabilityName);
 		return declarers ? [...declarers] : [];
 	}
-	/** Unregister a provider. For singleton: clears active. For collection: removes from list. */
-	unregisterProvider(capabilityName, addonId) {
+	/**
+	* The owner token a registration declared, or `null` when the pair is not
+	* registered or was registered without one.
+	*/
+	getProviderOwner(capabilityName, addonId) {
+		return this.capabilities.get(capabilityName)?.providerOwners.get(addonId) ?? null;
+	}
+	/**
+	* Hand an EXISTING registration to a new owner, without touching the provider
+	* instance, the active-singleton selection or any event.
+	*
+	* The takeover case: a replacement runner handshakes with an UNCHANGED cap
+	* set, so the manifest diff correctly leaves the registration alone — but the
+	* registration is still stamped with the dead generation's token, and nothing
+	* the LIVE generation can present would ever match it. Re-stamping keeps the
+	* capability cleanable when the successor eventually dies.
+	*
+	* Returns `false` when the pair is not registered (nothing to hand over) —
+	* the caller decides whether that is a register-instead or a diagnosis.
+	*/
+	reassignProviderOwner(capabilityName, addonId, owner) {
+		const state = this.capabilities.get(capabilityName);
+		if (!state || !state.providers.has(addonId)) return false;
+		const previous = state.providerOwners.get(addonId);
+		if (previous === owner) return true;
+		state.providerOwners.set(addonId, owner);
+		this.logger.info("Capability registration ownership reassigned", {
+			tags: { addonId },
+			meta: {
+				capability: capabilityName,
+				owner,
+				previousOwner: previous ?? null
+			}
+		});
+		return true;
+	}
+	/**
+	* Unregister a provider. For singleton: clears active. For collection:
+	* removes from list.
+	*
+	* `owner` is the caller's PROOF that it owns the registration it is deleting.
+	* When the registration declared an owner (see {@link ProviderOwnerToken})
+	* and the caller presents a different one — or none at all — this is a
+	* logged no-op: the caller belongs to a generation that no longer holds the
+	* key. This is what stops a dead runner's teardown from erasing its
+	* successor's live registration ([D188](../../../../docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md)).
+	*/
+	unregisterProvider(capabilityName, addonId, owner) {
 		const state = this.capabilities.get(capabilityName);
 		if (!state) return;
+		const registeredOwner = state.providerOwners.get(addonId);
+		if (registeredOwner !== void 0 && registeredOwner !== owner) {
+			this.logger.info("Unregister ignored — registration is owned by another incarnation", {
+				tags: { addonId },
+				meta: {
+					capability: capabilityName,
+					registeredOwner,
+					presentedOwner: owner ?? null
+				}
+			});
+			return;
+		}
 		state.providers.delete(addonId);
+		state.providerOwners.delete(addonId);
 		if (state.definition.mode === "singleton" && state.activeAddonId === addonId) {
 			const userChoice = this.configReader?.(capabilityName);
 			const preferred = state.definition.preferredProvider;
@@ -94548,6 +94617,11 @@ var JobJournal = class {
 function safeSegment(name) {
 	return name.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
+/** An exact semver — the only shape the staged package.json can be compared
+*  against literally. Anything else ('latest', 'beta', a range) is a dist-tag
+*  the FETCHER resolves; comparing the resolved version to the literal tag
+*  failed every tag-based update (30/30 on 2026-08-20). */
+var EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 var StagingArea = class {
 	stagingDir;
 	deps;
@@ -94565,8 +94639,12 @@ var StagingArea = class {
 		if (input.signal.aborted) throw new Error("staging aborted after fetch");
 		await this.deps.extract(tgz, destDir);
 		const raw = JSON.parse(fs$17.readFileSync(path$39.join(destDir, "package.json"), "utf-8"));
-		if (raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${String(raw.version)}`);
-		return { stagedPath: destDir };
+		if (typeof raw.version !== "string" || raw.version.length === 0) throw new Error(`staging validation failed: ${input.name} staged a package.json with no version`);
+		if (EXACT_SEMVER.test(input.version) && raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${raw.version}`);
+		return {
+			stagedPath: destDir,
+			resolvedVersion: raw.version
+		};
 	}
 	cleanup(jobId) {
 		fs$17.rmSync(path$39.join(this.stagingDir, jobId), {

package/dist/kernel/capability-registry.d.ts

@@ -19,6 +19,18 @@ export type ConfigReader = (capability: string) => string | undefined;
  * {@link ConfigReader} does for singletons.
  */
 export type CollectionConfigReader = (capability: string) => readonly string[] | undefined;
+/**
+ * Proof that an unregister owns the registration it is about to delete.
+ *
+ * A `(capability, addonId)` key is NOT unique over time: a runner replaced by
+ * an update re-registers under the exact same key (`resolveRunnerId` is
+ * deterministic), so the dead generation's teardown and the live generation's
+ * registration are indistinguishable by key alone. The owner token names the
+ * INCARNATION that made a registration — e.g. `hub/recorder#7` — and
+ * {@link CapabilityRegistry.unregisterProvider} refuses any unregister that
+ * cannot present it. See docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md.
+ */
+export type ProviderOwnerToken = string;
 export declare class CapabilityRegistry {
     private readonly capabilities;
     private readonly logger;
@@ -148,8 +160,15 @@ export declare class CapabilityRegistry {
      * Double-register of the same pair is always a programmer error —
      * two legitimately different addons implementing the same cap keep
      * using different `addonId`s and the user picks one via `configReader`.
+     *
+     * `owner` (optional) stamps the registration with the incarnation that made
+     * it — see {@link ProviderOwnerToken}. Once stamped, only an unregister
+     * presenting the SAME token can delete it. Registration paths whose key is
+     * reused across process generations (the UDS child manifest, the D3
+     * `registerNode` handshake) MUST pass one; ownerless registrations keep the
+     * historical unconditional behaviour.
      */
-    registerProvider(capabilityName: string, addonId: string, provider: unknown): void;
+    registerProvider(capabilityName: string, addonId: string, provider: unknown, owner?: ProviderOwnerToken): void;
     /**
      * Whether a provider for the exact `(capabilityName, addonId)` pair is
      * currently registered. Lets a re-registration path (e.g. the agent's
@@ -173,8 +192,37 @@ export declare class CapabilityRegistry {
      * it is the diagnosis).
      */
     getManifestDeclarers(capabilityName: string): readonly string[];
-    /** Unregister a provider. For singleton: clears active. For collection: removes from list. */
-    unregisterProvider(capabilityName: string, addonId: string): void;
+    /**
+     * The owner token a registration declared, or `null` when the pair is not
+     * registered or was registered without one.
+     */
+    getProviderOwner(capabilityName: string, addonId: string): ProviderOwnerToken | null;
+    /**
+     * Hand an EXISTING registration to a new owner, without touching the provider
+     * instance, the active-singleton selection or any event.
+     *
+     * The takeover case: a replacement runner handshakes with an UNCHANGED cap
+     * set, so the manifest diff correctly leaves the registration alone — but the
+     * registration is still stamped with the dead generation's token, and nothing
+     * the LIVE generation can present would ever match it. Re-stamping keeps the
+     * capability cleanable when the successor eventually dies.
+     *
+     * Returns `false` when the pair is not registered (nothing to hand over) —
+     * the caller decides whether that is a register-instead or a diagnosis.
+     */
+    reassignProviderOwner(capabilityName: string, addonId: string, owner: ProviderOwnerToken): boolean;
+    /**
+     * Unregister a provider. For singleton: clears active. For collection:
+     * removes from list.
+     *
+     * `owner` is the caller's PROOF that it owns the registration it is deleting.
+     * When the registration declared an owner (see {@link ProviderOwnerToken})
+     * and the caller presents a different one — or none at all — this is a
+     * logged no-op: the caller belongs to a generation that no longer holds the
+     * key. This is what stops a dead runner's teardown from erasing its
+     * successor's live registration ([D188](../../../../docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md)).
+     */
+    unregisterProvider(capabilityName: string, addonId: string, owner?: ProviderOwnerToken): void;
     /** Enable a previously disabled collection provider. */
     enableCollectionProvider(capability: string, addonId: string): void;
     /** Disable a collection provider (keeps it registered but excluded from active list). */

package/dist/kernel/index.d.ts

@@ -17,7 +17,7 @@ export { buildCapRouters, builderMountedCapNames } from './cap-router-builder.js
 export type { CapRouterPrimitives, CapRouterServices, CapProviderGetter, RemoteProxyFactory, ProcedureBuilder, ProcedureResolverArgs, } from './cap-router-builder.js';
 export { describeProviderKindDrift } from './provider-kind-drift.js';
 export type { ProviderKindHint } from './provider-kind-drift.js';
-export type { CapabilityRouter, CapabilityRouterFactory, ConfigReader, } from './capability-registry.js';
+export type { CapabilityRouter, CapabilityRouterFactory, ConfigReader, ProviderOwnerToken, } from './capability-registry.js';
 export { CustomActionRegistry, type CustomActionEntry } from './custom-action-registry.js';
 export { INFRA_CAPABILITIES, isInfraCapability } from './infra-capabilities.js';
 export type { InfraCapability } from './infra-capabilities.js';

package/dist/kernel/lifecycle/staging-area.d.ts

@@ -16,6 +16,7 @@ export declare class StagingArea {
     constructor(stagingDir: string, deps: StagingAreaDeps);
     fetchAndStage(input: FetchAndStageInput): Promise<{
         stagedPath: string;
+        resolvedVersion: string;
     }>;
     cleanup(jobId: string): void;
     /**

package/dist/kernel/transport/child-cap-protocol.d.ts

@@ -222,6 +222,18 @@ export type ParentToChildRequest = CapCallMessage | ParentEventMessage | Readine
 export interface RegisteredChild {
     readonly childId: string;
     readonly caps: readonly ChildCapDescriptor[];
+    /**
+     * Monotonic id of the CONNECTION this registration arrived on, unique within
+     * the parent process.
+     *
+     * `childId` is deterministic (`resolveRunnerId`), so a runner replaced by an
+     * update reconnects under the exact same id — the two generations are
+     * indistinguishable without this. Consumers stamp it onto whatever they
+     * derive from the child (capability registrations, subtree manifests) so a
+     * teardown arriving from the DEAD generation can be told apart from the live
+     * one. See docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md.
+     */
+    readonly incarnation: number;
 }
 /** Arguments to route a cap method call (the `cap-call` message minus its discriminant). */
 export type CapCallInput = Omit<CapCallMessage, 'kind'>;

package/dist/kernel/transport/local-child-registry.d.ts

@@ -139,6 +139,8 @@ export declare class LocalChildRegistry {
     private readonly children;
     private registeredHandler;
     private goneHandler;
+    /** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
+    private nextIncarnation;
     private eventHandler;
     private logHandler;
     private readinessHandler;
@@ -291,8 +293,13 @@ export declare class LocalChildRegistry {
     listChildren(): readonly RegisteredChild[];
     /** Register the (single) child-registered handler. Only one handler is active at a time. */
     onChildRegistered(handler: (child: RegisteredChild) => void): void;
-    /** Register the (single) child-gone handler. Only one handler is active at a time. */
-    onChildGone(handler: (childId: string) => void): void;
+    /**
+     * Register the (single) child-gone handler. Only one handler is active at a
+     * time. The handler receives the {@link RegisteredChild.incarnation} of the
+     * connection that closed — carry it into whatever teardown it triggers, so a
+     * dead generation cannot tear down its successor's work.
+     */
+    onChildGone(handler: (childId: string, incarnation: number) => void): void;
     /**
      * Register the (single) child-event handler. Invoked when a child sends an
      * event via `LocalChildClient.emitEvent`. Only one handler is active at a