@camstack/system 1.2.481 → 1.2.483

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Ci as ReadinessTimeoutError, Cn as isCollectionArrayMethod, Da as userError, Dn as isObjectInput, Fi as asJsonObject$1, Gi as createEvent$1, Ii as asNumber, J as METHOD_ACCESS_MAP, Ji as defineRecordKinds, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Li as asString$1, Mr as supportedRuntimes, Oa as withoutCallerStamp, On as isVoidInput, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessRegistry, Sn as isArrayOutputSchema, Yi as emitDownForOwnedCaps, Yn as objectInputDeclaresRequiredDeviceId, Zi as expandCapMethods, _ as CatalogFileSchema, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, ba as scopeKey, fn as extractNestedAddonId, ga as readinessKey, ii as CALLER_STAMPED_CAPABILITIES$1, ka as EventCategory$1, kn as kebabToCamel$1, ma as parseJsonUnknown, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pa as parseJsonObject, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, u as CATALOG_LANGS, va as resolveCapMount, vn as interpolate, vr as scopesAllowDeviceCap, vt as addonSettingsCapability, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS, zn as looseSchema } from "./dist-BIJXQo_j.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DKOZSFED.mjs";
+import { Ci as ReadinessTimeoutError, Cn as isCollectionArrayMethod, Da as userError, Dn as isObjectInput, Fi as asJsonObject$1, Gi as createEvent$1, Ii as asNumber, J as METHOD_ACCESS_MAP, Ji as defineRecordKinds, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Li as asString$1, Mr as supportedRuntimes, Oa as withoutCallerStamp, On as isVoidInput, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessRegistry, Sn as isArrayOutputSchema, Yi as emitDownForOwnedCaps, Yn as objectInputDeclaresRequiredDeviceId, Zi as expandCapMethods, _ as CatalogFileSchema, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, ba as scopeKey, fn as extractNestedAddonId, ga as readinessKey, ii as CALLER_STAMPED_CAPABILITIES$1, ka as EventCategory$1, kn as kebabToCamel$1, ma as parseJsonUnknown, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pa as parseJsonObject, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, u as CATALOG_LANGS, va as resolveCapMount, vn as interpolate, vr as scopesAllowDeviceCap, vt as addonSettingsCapability, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS, zn as looseSchema } from "./dist-DvKEKSap.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-HQKcvofS.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
@@ -8,7 +8,7 @@ import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
 import "./builtins/calendars/index.mjs";
 import { ComposerAddon } from "./builtins/composer/composer.addon.mjs";
 import "./builtins/composer/index.mjs";
-import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
+import { t as formatLogLine } from "./formatter-DkYZ4LXp.mjs";
 import { ConsoleDestination, ConsoleLoggingAddon } from "./builtins/console-logging/index.mjs";
 import { t as loadPrefixed } from "./prefix-walk-DAOBSyH1.mjs";
 import { CoreBlocksAddon, o as createAddonSettingsStore } from "./builtins/core-blocks/core-blocks.addon.mjs";
@@ -25,21 +25,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-DYAJwPWu.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-TCW_esAc.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-doVPSeiy.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-xuLNi4a2.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-NP141VCW.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DMB-ex5z.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DMFXIlMY.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-CVf6mxIZ.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DAEsvFY6.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-EFYeCdrG.mjs";
 import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DBlgWB8k.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
@@ -7525,6 +7525,34 @@ var AddonManifest = class {
 	}
 };
 //#endregion
+//#region src/kernel/addon-version-policy.ts
+/**
+* Which version an installed addon should be running (D942).
+*
+* The hub's target is the registry dist-tag `latest`. An agent's target is
+* the hub's installed version — never the registry, and never "strictly
+* newer". A missing target is an unreadable authority: a failed read changes
+* nothing (D49), including never a move downward because the registry or the
+* hub could not be asked.
+*/
+var ADDON_VERSION_REASON_REGISTRY_LATEST = "installed version differs from registry latest";
+var ADDON_VERSION_REASON_HUB = "agent follows the hub installed version";
+/**
+* Move when `installed` is not `target`. `target === null` (or empty) means
+* the authority could not be read — keep whatever is installed.
+* `installed === null` with a known target is a first install of that target.
+*/
+function decideAddonVersionMove(installed, target, reason) {
+	if (target === null || target.length === 0) return { move: false };
+	if (installed !== null && installed === target) return { move: false };
+	return {
+		move: true,
+		from: installed ?? "absent",
+		to: target,
+		reason
+	};
+}
+//#endregion
 //#region src/kernel/deps/closure-dedupe.ts
 /**
 * Closure dedupe — stop copying into every addon the libraries the server
@@ -8279,6 +8307,25 @@ function readPackageJson(pkgJsonPath) {
 function shouldSkipClosureProvidedSeed(packageName, isResolvable) {
 	return packageName === "@camstack/system" && isResolvable;
 }
+/** How long a boot-time `dist-tags.latest` read may take before it is "unreadable". */
+var REGISTRY_LATEST_TIMEOUT_MS = 15e3;
+function readInstalledPackageVersion(addonDir) {
+	try {
+		const raw = JSON.parse(fs$1.readFileSync(path$1.join(addonDir, "package.json"), "utf-8"));
+		if (raw === null || typeof raw !== "object") return null;
+		const version = Reflect.get(raw, "version");
+		return typeof version === "string" && version.length > 0 ? version : null;
+	} catch {
+		return null;
+	}
+}
+function distTagLatest(body) {
+	if (body === null || typeof body !== "object") return null;
+	const tags = Reflect.get(body, "dist-tags");
+	if (tags === null || typeof tags !== "object") return null;
+	const latest = Reflect.get(tags, "latest");
+	return typeof latest === "string" && latest.length > 0 ? latest : null;
+}
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -8312,7 +8359,7 @@ var STAGING_RESIDUE_MIN_AGE_MS = 30 * 6e4;
 *   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
 *
 * which the propagation then reported as `runtime dependency install failed`.
-* Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+* Observed on the Mac desktop agent and on agent-a on 2026-08-07.
 *
 * So a sweep only removes what cannot be live: not a tree this process is
 * building, and not one young enough to belong to anybody's in-flight install.
@@ -8329,6 +8376,7 @@ var AddonInstaller = class AddonInstaller {
 	isPackageResolvable;
 	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
 	closureNodeModulesDir;
+	resolveLatestVersionOverride;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -8351,6 +8399,7 @@ var AddonInstaller = class AddonInstaller {
 		this.manifest = new AddonManifest(config.addonsDir);
 		this.isPackageResolvable = config.isPackageResolvable;
 		this.closureNodeModulesDir = config.closureNodeModulesDir;
+		this.resolveLatestVersionOverride = config.resolveLatestVersion;
 		if (config.installSource) this.installSource = config.installSource;
 		else this.installSource = "npm";
 	}
@@ -8464,10 +8513,13 @@ var AddonInstaller = class AddonInstaller {
 	* defaults to npm in production.
 	*
 	* There is no version argument and there is deliberately no pin: the system is
-	* addons-agnostic and `latest` is the whole contract at first boot (operator,
-	* 2026-08-13). A copy already under the addon root is never replaced either —
-	* bootstrap is seed-only, and overwriting a deployed bundle would be an
-	* un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
+	* addons-agnostic and `latest` is the whole contract (operator, 2026-08-13,
+	* restated 2026-10-25 — D942). A copy already under the addon root is left
+	* alone when this installer is not on the npm source (a workspace or a
+	* bundled desktop seed) and when the package is the closure-provided
+	* `@camstack/system` (a copy there would shadow the closure). Every other
+	* required addon already on disk is moved to registry `latest` when that
+	* tag differs, higher or lower. An unreadable registry changes nothing.
 	*
 	* @param packages — optional custom package list (default: REQUIRED_PACKAGES)
 	*/
@@ -8483,7 +8535,16 @@ var AddonInstaller = class AddonInstaller {
 		for (const packageName of pkgList) {
 			const addonDir = path$1.join(this.addonsDir, packageName);
 			if (fs$1.existsSync(path$1.join(addonDir, "package.json"))) {
-				this.logger.debug(`${packageName} — already installed, skipping`);
+				if (this.installSource !== "npm" || shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
+					this.logger.debug(`${packageName} — already installed, skipping`);
+					continue;
+				}
+				try {
+					await this.followInstalledAddonToLatest(packageName, addonDir);
+				} catch (err) {
+					const msg = errMsg$1(err);
+					this.logger.error(`Failed to move ${packageName} to registry latest`, { meta: { error: msg } });
+				}
 				continue;
 			}
 			if (shouldSkipClosureProvidedSeed(packageName, this.isResolvableFromClosure(packageName))) {
@@ -8508,6 +8569,56 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
+	* Move an already-installed required addon to registry `latest` when the
+	* installed version differs. `applyUpdate` keeps the previous tree as a
+	* backup and restores it if the install throws. A null latest (registry
+	* down, or no tag) leaves the copy where it is.
+	*/
+	async followInstalledAddonToLatest(packageName, addonDir) {
+		const installedVersion = readInstalledPackageVersion(addonDir);
+		const decision = decideAddonVersionMove(installedVersion, await this.readRegistryLatest(packageName), ADDON_VERSION_REASON_REGISTRY_LATEST);
+		if (!decision.move) {
+			this.logger.debug(`${packageName} — installed copy matches registry latest, or the registry could not be read`);
+			return;
+		}
+		this.logger.info(`${packageName} — moving ${decision.from} → ${decision.to}: ${decision.reason}`, { meta: {
+			from: decision.from,
+			to: decision.to,
+			reason: decision.reason
+		} });
+		if (this.manifest.get(packageName) == null) this.manifest.upsert(packageName, {
+			version: installedVersion ?? "0.0.0",
+			source: "npm"
+		});
+		await this.applyUpdate(packageName, decision.to);
+	}
+	/** `dist-tags.latest`, or `null` when the registry cannot be read. */
+	async readRegistryLatest(packageName) {
+		if (this.resolveLatestVersionOverride) try {
+			return await this.resolveLatestVersionOverride(packageName);
+		} catch (err) {
+			this.logger.warn(`${packageName} — registry unreadable, leaving the installed copy`, { meta: { error: errMsg$1(err) } });
+			return null;
+		}
+		return this.fetchRegistryLatest(packageName);
+	}
+	async fetchRegistryLatest(packageName) {
+		const metadataUrl = `${(this.registry ?? "https://registry.npmjs.org").replace(/\/+$/, "")}/${encodeURIComponent(packageName).replace(/^%40/, "@")}`;
+		try {
+			const metadataRes = await fetch(metadataUrl, { signal: AbortSignal.timeout(REGISTRY_LATEST_TIMEOUT_MS) });
+			if (!metadataRes.ok) {
+				this.logger.warn(`${packageName} — registry answered ${metadataRes.status}, leaving the installed copy`);
+				return null;
+			}
+			const latest = distTagLatest(await metadataRes.json());
+			if (latest === null) this.logger.warn(`${packageName} — registry returned no dist-tags.latest, leaving the installed copy`);
+			return latest;
+		} catch (err) {
+			this.logger.warn(`${packageName} — registry unreadable, leaving the installed copy`, { meta: { error: errMsg$1(err) } });
+			return null;
+		}
+	}
+	/**
 	* Reconcile the install manifest against the addons actually present on
 	* disk: register seeded addons, correct a version that disagrees with the
 	* installed `package.json`, and drop entries naming a directory that does
@@ -9722,7 +9833,7 @@ function isDirEntry(entry, parentDir) {
 *
 * Measured 2026-08-07/08 on the live cluster:
 *
-*   little-unraid  `@camstack/system.bak-pre-unshadow` — no package.json left,
+*   agent-a  `@camstack/system.bak-pre-unshadow` — no package.json left,
 *                  so not loadable, but the agent main process held five live
 *                  mappings of `better_sqlite3.node` out of it (D87).
 *   macmini        `@camstack/system.bak-pre-1272-1786129145` — still declares
@@ -19322,7 +19433,7 @@ var SocketChannel = class {
 	* `res` frame, or the socket's `close` (which drains `pending`) — so a peer
 	* that receives the request and then neither answers nor closes leaves the
 	* caller pending forever. That is a wedged handler, or a half-open socket
-	* after a child died without a clean teardown, and it is how camera 615 spent
+	* after a child died without a clean teardown, and it is how camera 101 spent
 	* 30+ minutes with every inference permit held by a call that was never
 	* coming back.
 	*/
@@ -22300,7 +22411,7 @@ function buildLinkChain(target, localResolver, hookup) {
 /**
 * Can libva initialise the VA driver on this node's render node? (D926)
 *
-* Measured 2026-10-23 (intel-1.2.509, hub + little-unraid): Intel's iHD 25.2.4
+* Measured 2026-10-23 (intel-1.2.509, hub + agent-a): Intel's iHD 25.2.4
 * exports only `__vaDriverInit_1_22`, the container's Ubuntu libva 2.20 looks
 * for `_1_20`, and `vaInitialize` failed — while the resolver kept offering
 * `qsv, vaapi`. Every session tried, failed and fell back to software: 722
@@ -27767,4 +27878,4 @@ function resetCatalogRegistryForTests() {
 }
 //#endregion
 var readAllRows = import_read_all_rows.readAllRows;
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADDON_VERSION_REASON_HUB, ADDON_VERSION_REASON_REGISTRY_LATEST, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, decideAddonVersionMove, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/addon-installer.d.ts

@@ -61,6 +61,12 @@ export interface AddonInstallerConfig {
 	* specs point it at a fabricated closure dir.
 	*/
 	readonly closureNodeModulesDir?: string;
+	/**
+	* Resolve dist-tag `latest` for a package. `null` means the registry could
+	* not be read — the caller leaves the installed copy alone (D942, D49).
+	* Production leaves it unset and asks the registry; specs inject it.
+	*/
+	readonly resolveLatestVersion?: (packageName: string) => Promise<string | null>;
 }
 import type { InstalledPackage, IScopedLogger } from "@camstack/types";
 import { AddonManifest } from "./addon-manifest.js";
@@ -108,7 +114,7 @@ export interface StagingEntryAge {
 *   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
 *
 * which the propagation then reported as `runtime dependency install failed`.
-* Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+* Observed on the Mac desktop agent and on agent-a on 2026-08-07.
 *
 * So a sweep only removes what cannot be live: not a tree this process is
 * building, and not one young enough to belong to anybody's in-flight install.
@@ -123,6 +129,7 @@ export declare class AddonInstaller {
 	private readonly isPackageResolvable?;
 	/** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
 	private readonly closureNodeModulesDir;
+	private readonly resolveLatestVersionOverride;
 	/**
 	* Central manifest of installed addons. Tracks version + source +
 	* timestamps + last-backup pointer per package, written atomically
@@ -206,15 +213,28 @@ export declare class AddonInstaller {
 	* defaults to npm in production.
 	*
 	* There is no version argument and there is deliberately no pin: the system is
-	* addons-agnostic and `latest` is the whole contract at first boot (operator,
-	* 2026-08-13). A copy already under the addon root is never replaced either —
-	* bootstrap is seed-only, and overwriting a deployed bundle would be an
-	* un-deploy ([D90](../../../../docs/decisions/adr-0090.md)).
+	* addons-agnostic and `latest` is the whole contract (operator, 2026-08-13,
+	* restated 2026-10-25 — D942). A copy already under the addon root is left
+	* alone when this installer is not on the npm source (a workspace or a
+	* bundled desktop seed) and when the package is the closure-provided
+	* `@camstack/system` (a copy there would shadow the closure). Every other
+	* required addon already on disk is moved to registry `latest` when that
+	* tag differs, higher or lower. An unreadable registry changes nothing.
 	*
 	* @param packages — optional custom package list (default: REQUIRED_PACKAGES)
 	*/
 	ensureRequiredPackages(packages?: readonly string[]): Promise<void>;
 	/**
+	* Move an already-installed required addon to registry `latest` when the
+	* installed version differs. `applyUpdate` keeps the previous tree as a
+	* backup and restores it if the install throws. A null latest (registry
+	* down, or no tag) leaves the copy where it is.
+	*/
+	private followInstalledAddonToLatest;
+	/** `dist-tags.latest`, or `null` when the registry cannot be read. */
+	private readRegistryLatest;
+	private fetchRegistryLatest;
+	/**
 	* Reconcile the install manifest against the addons actually present on
 	* disk: register seeded addons, correct a version that disagrees with the
 	* installed `package.json`, and drop entries naming a directory that does

package/dist/kernel/addon-version-policy.d.ts

@@ -0,0 +1,26 @@
+/**
+* Which version an installed addon should be running (D942).
+*
+* The hub's target is the registry dist-tag `latest`. An agent's target is
+* the hub's installed version — never the registry, and never "strictly
+* newer". A missing target is an unreadable authority: a failed read changes
+* nothing (D49), including never a move downward because the registry or the
+* hub could not be asked.
+*/
+export declare const ADDON_VERSION_REASON_REGISTRY_LATEST: "installed version differs from registry latest";
+export declare const ADDON_VERSION_REASON_HUB: "agent follows the hub installed version";
+export type AddonVersionReason = typeof ADDON_VERSION_REASON_REGISTRY_LATEST | typeof ADDON_VERSION_REASON_HUB;
+export type AddonVersionMove = {
+	readonly move: false;
+} | {
+	readonly move: true;
+	readonly from: string;
+	readonly to: string;
+	readonly reason: AddonVersionReason;
+};
+/**
+* Move when `installed` is not `target`. `target === null` (or empty) means
+* the authority could not be read — keep whatever is installed.
+* `installed === null` with a known target is a first install of that target.
+*/
+export declare function decideAddonVersionMove(installed: string | null, target: string | null, reason: AddonVersionReason): AddonVersionMove;

package/dist/kernel/heap-watch.d.ts

@@ -242,7 +242,7 @@ export declare function reclaimIntervalMs(passesAtFloor: number, minIntervalMs?:
 * every UDS handshake and every cross-runner cap call is served on it, and a
 * live CPU profile of a boot put `(idle)` at 0.1%). The reclaim pass is a
 * stop-the-world ON that loop, and `took=` prices the PASS without ever pricing
-* what it delays. 590ms against a p99 of 4ms is a visible stall; the same 590ms
+* what it delays. 104ms against a p99 of 4ms is a visible stall; the same 104ms
 * against a p99 of 900ms is noise inside a queue that was already saturated.
 * Those are opposite conclusions, and until now the log could not tell them
 * apart.

package/dist/kernel/index.d.ts

@@ -3,6 +3,8 @@ export { AddonLoader } from "./addon-loader.js";
 export { AddonEngineManager } from "./addon-engine-manager.js";
 export type { AddonInstallerConfig, InstallSource, InstalledPackage } from "./addon-installer.js";
 export { AddonInstaller } from "./addon-installer.js";
+export type { AddonVersionMove, AddonVersionReason } from "./addon-version-policy.js";
+export { ADDON_VERSION_REASON_HUB, ADDON_VERSION_REASON_REGISTRY_LATEST, decideAddonVersionMove } from "./addon-version-policy.js";
 export type { AddonInstallSource, AddonManifestEntry, AddonManifestFile } from "./addon-manifest.js";
 export { AddonManifest } from "./addon-manifest.js";
 export type { AddonDirCandidate, QuarantinedEntry, ResidueQuarantineResult, ResidueReason, ResidueVerdict } from "./addon-residue.js";

package/dist/kernel/moleculer/trpc-links.d.ts

@@ -21,7 +21,7 @@ export interface LocalProviderResolver {
 	getByName(capabilityName: string): unknown | null;
 	/**
 	* The node this resolver's providers run on (e.g. `'hub'`, `'hub/model-studio'`,
-	* `'little-unraid/model-studio'`). When set, {@link localProviderLink} defers a
+	* `'agent-a/model-studio'`). When set, {@link localProviderLink} defers a
 	* call carrying an explicit `nodePin` to a DIFFERENT node instead of
 	* short-circuiting to a co-located provider — so the pin routes to the
 	* intended node (parent → `onUnownedCall` → CapRouteResolver). Symmetric to

package/dist/kernel/transport/socket-channel.d.ts

@@ -45,7 +45,7 @@ export declare class SocketChannel implements LocalChannel {
 	* `res` frame, or the socket's `close` (which drains `pending`) — so a peer
 	* that receives the request and then neither answers nor closes leaves the
 	* caller pending forever. That is a wedged handler, or a half-open socket
-	* after a child died without a clean teardown, and it is how camera 615 spent
+	* after a child died without a clean teardown, and it is how camera 101 spent
 	* 30+ minutes with every inference permit held by a call that was never
 	* coming back.
 	*/

package/dist/logging/formatter.d.ts

@@ -22,7 +22,7 @@
 *
 * Rendered examples:
 *   [hub/winston-logging]        71184  - 04/20/2026, 12:45:53 AM     INFO  Winston logging initialized
-*   [hub/provider-rtsp]          71184  - 04/20/2026, 12:46:01 AM     WARN  [salone] probe failed {err="timeout"}
+*   [hub/provider-rtsp]          71184  - 04/20/2026, 12:46:01 AM     WARN  [hall] probe failed {err="timeout"}
 *   [dev-agent-0/detection]      12345  - 04/20/2026, 12:47:15 AM     ERROR [cortile] no detector {codec=av1}
 */
 import type { LogEntry } from "@camstack/types";