@camstack/system 1.2.58 → 1.2.60

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Chl2MvMd.js");
+const require_dist = require("./dist-Cis_iV-u.js");
 const require_model_download_service = require("./model-download-service-Cpc6SWzV.js");
 const require_manifest_python_deps = require("./manifest-python-deps-d4acYXVV.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
@@ -3231,6 +3231,21 @@ async function installPackageFromNpm(packageName, targetDir) {
 //#region src/kernel/addon-manifest.ts
 var MANIFEST_FILENAME = "manifest.json";
 var MANIFEST_VERSION = 1;
+/**
+* Is `p` a directory, FOLLOWING symlinks?
+*
+* `Dirent.isDirectory()` answers false for a symlink, and dev installs
+* (`installSymlink`) point `addonsDir/@camstack/<pkg>` straight at the
+* workspace source. Trusting the dirent there finds zero addons on disk, which
+* with pruning would empty a developer's manifest on the next boot.
+*/
+function isDirLike(p) {
+	try {
+		return node_fs.statSync(p).isDirectory();
+	} catch {
+		return false;
+	}
+}
 var AddonManifest = class {
 	manifestPath;
 	cache = null;
@@ -3320,35 +3335,48 @@ var AddonManifest = class {
 		this.cache = null;
 	}
 	/**
-	* Reconcile the manifest with what is actually present on disk.
+	* Reconcile the manifest against what is actually present on disk.
 	*
-	* For every `@scope/<pkg>` directory under `addonsDir` that has a
-	* readable `package.json` but NO manifest entry yet, add one with
-	* source `'seed'`. Existing entries are left untouched (their source,
-	* version and timestamps are authoritative — a later install/update
-	* overwrites them through `upsert`).
+	* **The directory is the truth.** It is what `AddonLoader` runs; a manifest
+	* that disagrees with it is a lie the update flow and the admin UI then
+	* repeat. Three corrections, all idempotent and safe on every boot:
 	*
-	* Why this exists: addons baked into the Docker/Electron image are
-	* copied straight into `addonsDir` by the container entrypoint (the
-	* launcher's `ensureRequiredPackages` then sees `package.json` already
-	* present and skips, never calling `upsert`). Without this reconcile
-	* those seeded addons stay absent from the manifest, so `applyUpdate`
-	* rejects them with "not currently tracked in manifest" — which is
-	* exactly what broke "Update all" on a fresh image. Idempotent and
-	* safe to run on every boot.
+	*  - **added** — an on-disk addon with no entry gets one, source `'seed'`.
+	*    Addons baked into the Docker/Electron image are copied straight into
+	*    `addonsDir` by the container entrypoint (`ensureRequiredPackages` then
+	*    sees `package.json` present and skips, never calling `upsert`), so they
+	*    would otherwise stay untracked and `applyUpdate` would reject them with
+	*    "not currently tracked in manifest" — what broke "Update all" on a
+	*    fresh image.
+	*  - **version-corrected** — an entry whose version disagrees with the
+	*    installed `package.json` adopts the DISK version. Provenance (`source`,
+	*    `installedAt`) is NOT derivable from disk and stays authoritative here;
+	*    `updatedAt` is left alone because the correction is not an update, and
+	*    stamping `now` would claim an install that never happened.
+	*  - **pruned** — an entry naming a directory that does not exist. The live
+	*    hub carried three (`@camstack/system 1.2.29`, `addon-viewer-ui 1.1.39`,
+	*    `addon-agent-ui 1.2.4`); `@camstack/system` in particular is
+	*    host-provided and deliberately NOT seeded under `addonsDir`
+	*    ([D45]), so its entry advertised a copy that must not exist.
+	*    An entry holding a `lastBackupDir` is NEVER pruned: that pointer is the
+	*    only reference to a pre-update backup, and the launcher's backup sweep
+	*    reclaims anything the manifest does not point at.
 	*
-	* Returns the number of entries added.
+	* `onChange` receives one record per correction, so the caller can log
+	* exactly what moved. Returns the total number of changes.
 	*/
-	reconcileFromDisk(addonsDir) {
+	reconcileFromDisk(addonsDir, onChange) {
 		if (!node_fs.existsSync(addonsDir)) return 0;
 		const m = this.read();
-		let added = 0;
+		let changes = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
+		/** Package name → version, for every ADDON package actually installed. */
+		const onDisk = /* @__PURE__ */ new Map();
 		for (const scope of node_fs.readdirSync(addonsDir, { withFileTypes: true })) {
-			if (!scope.isDirectory() || !scope.name.startsWith("@")) continue;
+			if (!scope.name.startsWith("@") || !isDirLike(node_path.join(addonsDir, scope.name))) continue;
 			const scopeDir = node_path.join(addonsDir, scope.name);
 			for (const pkg of node_fs.readdirSync(scopeDir, { withFileTypes: true })) {
-				if (!pkg.isDirectory()) continue;
+				if (!isDirLike(node_path.join(scopeDir, pkg.name))) continue;
 				const pkgJsonPath = node_path.join(scopeDir, pkg.name, "package.json");
 				if (!node_fs.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
@@ -3362,22 +3390,57 @@ var AddonManifest = class {
 				if (!pkgJson.name || !pkgJson.version) continue;
 				const addons = pkgJson.camstack?.addons;
 				if (!Array.isArray(addons) || addons.length === 0) continue;
-				if (m.addons[pkgJson.name] != null) continue;
-				m.addons[pkgJson.name] = {
-					name: pkgJson.name,
-					version: pkgJson.version,
+				onDisk.set(pkgJson.name, pkgJson.version);
+			}
+		}
+		for (const [name, version] of onDisk) {
+			const prev = m.addons[name];
+			if (prev == null) {
+				m.addons[name] = {
+					name,
+					version,
 					source: "seed",
 					installedAt: now,
 					updatedAt: now
 				};
-				added++;
+				changes++;
+				onChange?.({
+					kind: "added",
+					name,
+					to: version
+				});
+				continue;
 			}
+			if (prev.version !== version) {
+				m.addons[name] = {
+					...prev,
+					version
+				};
+				changes++;
+				onChange?.({
+					kind: "version-corrected",
+					name,
+					from: prev.version,
+					to: version
+				});
+			}
+		}
+		for (const [name, entry] of Object.entries(m.addons)) {
+			if (onDisk.has(name)) continue;
+			if (entry.lastBackupDir) continue;
+			delete m.addons[name];
+			changes++;
+			onChange?.({
+				kind: "pruned",
+				name,
+				from: entry.version
+			});
 		}
-		if (added > 0) {
+		if (changes > 0) {
 			m.updatedAt = now;
 			this.write(m);
 		}
-		return added;
+		return changes;
 	}
 	/**
 	* Migration helper: if the manifest is empty but the addons directory
@@ -3760,6 +3823,34 @@ var noopLogger = {
 		return noopLogger;
 	}
 };
+/**
+* A staging tree younger than this may belong to an install still running —
+* possibly in another process. Only older trees are residue worth sweeping.
+* Generous on purpose: an addon's runtime-dependency `npm install` on a slow
+* host is minutes, and the cost of leaving residue one deploy longer is disk,
+* while the cost of sweeping a live one is a FAILED deploy.
+*/
+var STAGING_RESIDUE_MIN_AGE_MS = 30 * 6e4;
+/**
+* Pick the staging entries that are safe to delete.
+*
+* `installFromTgz` used to clear the WHOLE `.staging` root before creating its
+* own dir. Two deploys arriving within one install's lifetime — the normal case
+* when the hub propagates two packages back to back — meant the second one
+* deleted the first one's tree out from under its running `npm install`:
+*
+*   npm error code ENOENT
+*   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
+*
+* which the propagation then reported as `runtime dependency install failed`.
+* Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+*
+* So a sweep only removes what cannot be live: not a tree this process is
+* building, and not one young enough to belong to anybody's in-flight install.
+*/
+function selectSweepableStaging(entries, inFlight, minAgeMs = STAGING_RESIDUE_MIN_AGE_MS) {
+	return entries.filter((entry) => !inFlight.has(entry.name) && entry.ageMs >= minAgeMs).map((entry) => entry.name);
+}
 var AddonInstaller = class AddonInstaller {
 	addonsDir;
 	registry;
@@ -3776,6 +3867,11 @@ var AddonInstaller = class AddonInstaller {
 	* `getAddonInstallSource`).
 	*/
 	manifest;
+	/**
+	* Basenames under `.staging` this process is currently building. Never swept
+	* — see {@link selectSweepableStaging}.
+	*/
+	inFlightStaging = /* @__PURE__ */ new Set();
 	constructor(config, logger = noopLogger) {
 		this.addonsDir = config.addonsDir;
 		this.registry = config.registry;
@@ -3934,19 +4030,34 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
-	* Reconcile the install manifest with the addons actually present on
-	* disk. Seeded addons (baked into the image and copied verbatim by the
-	* container entrypoint) never pass through an `install*` codepath, so
-	* they are missing from `manifest.json` and `applyUpdate` would reject
-	* them with "not currently tracked in manifest". Call this once after
-	* `ensureRequiredPackages` so every on-disk addon is updatable.
+	* Reconcile the install manifest against the addons actually present on
+	* disk: register seeded addons, correct a version that disagrees with the
+	* installed `package.json`, and drop entries naming a directory that does
+	* not exist. Call once after `ensureRequiredPackages`, before any update
+	* can be in flight. See `AddonManifest.reconcileFromDisk` for the rules.
+	*
+	* Every correction is logged by name — a manifest that silently disagreed
+	* with disk is what made "@camstack/system 1.2.29" read as installed on a
+	* hub that deliberately has no copy of it.
 	*
-	* Returns the number of manifest entries added.
+	* Returns the number of changes.
 	*/
 	reconcileManifest() {
-		const added = this.manifest.reconcileFromDisk(this.addonsDir);
-		if (added > 0) this.logger.info(`Manifest reconciled — ${added} seeded addon(s) registered`);
-		return added;
+		const changes = this.manifest.reconcileFromDisk(this.addonsDir, (c) => {
+			switch (c.kind) {
+				case "added":
+					this.logger.info(`Manifest — registered seeded addon ${c.name}@${c.to}`);
+					break;
+				case "version-corrected":
+					this.logger.info(`Manifest — ${c.name} recorded ${c.from} but disk has ${c.to}; adopting disk`);
+					break;
+				case "pruned":
+					this.logger.info(`Manifest — dropped ${c.name}@${c.from}: no install directory on disk`);
+					break;
+			}
+		});
+		if (changes > 0) this.logger.info(`Manifest reconciled — ${changes} correction(s)`);
+		return changes;
 	}
 	/**
 	* Install a single addon — on-demand installer used by AddonPackageService
@@ -4184,6 +4295,40 @@ var AddonInstaller = class AddonInstaller {
 			} });
 		});
 	}
+	/**
+	* Best-effort removal of `.staging` residue left by a CRASHED earlier deploy.
+	*
+	* Deliberately not `sweepGraveyard`: an evicted `.evicting/*` dir is dead by
+	* construction, but a `.staging/*` dir may be an install still running — in
+	* this process or another one. Deleting one of those fails a live deploy with
+	* an ENOENT on its own package.json, which is what happened on 2026-08-07.
+	*/
+	async sweepStagingResidue(stagingRoot) {
+		let names;
+		try {
+			names = node_fs.readdirSync(stagingRoot);
+		} catch {
+			return;
+		}
+		const now = Date.now();
+		const ages = [];
+		for (const name of names) try {
+			const stat = node_fs.statSync(node_path.join(stagingRoot, name));
+			ages.push({
+				name,
+				ageMs: now - stat.mtimeMs
+			});
+		} catch {}
+		const sweepable = selectSweepableStaging(ages, this.inFlightStaging);
+		if (sweepable.length > 0) this.logger.info("sweeping staging residue from a crashed earlier deploy", { meta: {
+			stagingRoot,
+			entries: sweepable
+		} });
+		await Promise.all(sweepable.map((name) => node_fs.promises.rm(node_path.join(stagingRoot, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0)));
+	}
 	/** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
 	async sweepGraveyard(graveyard) {
 		let entries;
@@ -4201,9 +4346,11 @@ var AddonInstaller = class AddonInstaller {
 	async installFromTgz(tgzPath) {
 		const stagingRoot = node_path.join(this.addonsDir, ".staging");
 		ensureDir(stagingRoot);
-		await this.sweepGraveyard(stagingRoot);
-		const stagingDir = node_path.join(stagingRoot, `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+		await this.sweepStagingResidue(stagingRoot);
+		const stagingName = `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+		const stagingDir = node_path.join(stagingRoot, stagingName);
 		ensureDir(stagingDir);
+		this.inFlightStaging.add(stagingName);
 		try {
 			await execFileAsync("tar", [
 				"-xzf",
@@ -4258,6 +4405,7 @@ var AddonInstaller = class AddonInstaller {
 				version: pkgView.version
 			};
 		} finally {
+			this.inFlightStaging.delete(stagingName);
 			await node_fs.promises.rm(stagingDir, {
 				recursive: true,
 				force: true

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { B as kebabToCamel, Ct as asString$1, Dt as expandCapMethods, Ft as scopeKey, G as looseSchema, I as isArrayOutputSchema, J as objectInputDeclaresAddonId, L as isCollectionArrayMethod, Lt as EventCategory$1, Mt as parseJsonUnknown$1, N as extractNestedAddonId, Nt as readinessKey, Pt as resolveCapMount, R as isObjectInput, St as asNumber, Tt as emitDownForOwnedCaps, V as lifecycleJobSchema, W as logLevelAtMost, Z as procedureAuthKey, c as METHOD_ACCESS_MAP, ft as DATAPLANE_SECRET_HEADER$1, h as addonSettingsCapability, jt as parseJsonObject, l as RUNTIME_DEFAULTS, mt as DEVICE_STATUS_METHOD, pt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, ut as errMsg$1, vt as ReadinessRegistry, wt as createEvent, xt as asJsonObject$1, yt as ReadinessTimeoutError, z as isVoidInput } from "./dist-UrXyJ9Zm.mjs";
+import { $ as procedureAuthKey, Ct as asJsonObject$1, Dt as emitDownForOwnedCaps, Et as createEvent, Ft as readinessKey, H as kebabToCamel, It as resolveCapMount, K as logLevelAtMost, L as isArrayOutputSchema, Lt as scopeKey, Nt as parseJsonObject, P as extractNestedAddonId, Pt as parseJsonUnknown$1, R as isCollectionArrayMethod, Tt as asString$1, U as lifecycleJobSchema, V as isVoidInput, X as objectInputDeclaresAddonId, bt as ReadinessRegistry, c as METHOD_ACCESS_MAP, ft as errMsg$1, gt as DEVICE_STATUS_METHOD, h as addonSettingsCapability, ht as DEVICE_SETTINGS_CONTRIBUTION_METHODS, kt as expandCapMethods, l as RUNTIME_DEFAULTS, mt as DATAPLANE_SECRET_HEADER$1, q as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, wt as asNumber, xt as ReadinessTimeoutError, z as isObjectInput, zt as EventCategory$1 } from "./dist-C5XpOjbI.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-D8B-4ktF.mjs";
 import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-CX5tGRqf.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
@@ -3223,6 +3223,21 @@ async function installPackageFromNpm(packageName, targetDir) {
 //#region src/kernel/addon-manifest.ts
 var MANIFEST_FILENAME = "manifest.json";
 var MANIFEST_VERSION = 1;
+/**
+* Is `p` a directory, FOLLOWING symlinks?
+*
+* `Dirent.isDirectory()` answers false for a symlink, and dev installs
+* (`installSymlink`) point `addonsDir/@camstack/<pkg>` straight at the
+* workspace source. Trusting the dirent there finds zero addons on disk, which
+* with pruning would empty a developer's manifest on the next boot.
+*/
+function isDirLike(p) {
+	try {
+		return fs$17.statSync(p).isDirectory();
+	} catch {
+		return false;
+	}
+}
 var AddonManifest = class {
 	manifestPath;
 	cache = null;
@@ -3312,35 +3327,48 @@ var AddonManifest = class {
 		this.cache = null;
 	}
 	/**
-	* Reconcile the manifest with what is actually present on disk.
+	* Reconcile the manifest against what is actually present on disk.
 	*
-	* For every `@scope/<pkg>` directory under `addonsDir` that has a
-	* readable `package.json` but NO manifest entry yet, add one with
-	* source `'seed'`. Existing entries are left untouched (their source,
-	* version and timestamps are authoritative — a later install/update
-	* overwrites them through `upsert`).
+	* **The directory is the truth.** It is what `AddonLoader` runs; a manifest
+	* that disagrees with it is a lie the update flow and the admin UI then
+	* repeat. Three corrections, all idempotent and safe on every boot:
 	*
-	* Why this exists: addons baked into the Docker/Electron image are
-	* copied straight into `addonsDir` by the container entrypoint (the
-	* launcher's `ensureRequiredPackages` then sees `package.json` already
-	* present and skips, never calling `upsert`). Without this reconcile
-	* those seeded addons stay absent from the manifest, so `applyUpdate`
-	* rejects them with "not currently tracked in manifest" — which is
-	* exactly what broke "Update all" on a fresh image. Idempotent and
-	* safe to run on every boot.
+	*  - **added** — an on-disk addon with no entry gets one, source `'seed'`.
+	*    Addons baked into the Docker/Electron image are copied straight into
+	*    `addonsDir` by the container entrypoint (`ensureRequiredPackages` then
+	*    sees `package.json` present and skips, never calling `upsert`), so they
+	*    would otherwise stay untracked and `applyUpdate` would reject them with
+	*    "not currently tracked in manifest" — what broke "Update all" on a
+	*    fresh image.
+	*  - **version-corrected** — an entry whose version disagrees with the
+	*    installed `package.json` adopts the DISK version. Provenance (`source`,
+	*    `installedAt`) is NOT derivable from disk and stays authoritative here;
+	*    `updatedAt` is left alone because the correction is not an update, and
+	*    stamping `now` would claim an install that never happened.
+	*  - **pruned** — an entry naming a directory that does not exist. The live
+	*    hub carried three (`@camstack/system 1.2.29`, `addon-viewer-ui 1.1.39`,
+	*    `addon-agent-ui 1.2.4`); `@camstack/system` in particular is
+	*    host-provided and deliberately NOT seeded under `addonsDir`
+	*    ([D45]), so its entry advertised a copy that must not exist.
+	*    An entry holding a `lastBackupDir` is NEVER pruned: that pointer is the
+	*    only reference to a pre-update backup, and the launcher's backup sweep
+	*    reclaims anything the manifest does not point at.
 	*
-	* Returns the number of entries added.
+	* `onChange` receives one record per correction, so the caller can log
+	* exactly what moved. Returns the total number of changes.
 	*/
-	reconcileFromDisk(addonsDir) {
+	reconcileFromDisk(addonsDir, onChange) {
 		if (!fs$17.existsSync(addonsDir)) return 0;
 		const m = this.read();
-		let added = 0;
+		let changes = 0;
 		const now = (/* @__PURE__ */ new Date()).toISOString();
+		/** Package name → version, for every ADDON package actually installed. */
+		const onDisk = /* @__PURE__ */ new Map();
 		for (const scope of fs$17.readdirSync(addonsDir, { withFileTypes: true })) {
-			if (!scope.isDirectory() || !scope.name.startsWith("@")) continue;
+			if (!scope.name.startsWith("@") || !isDirLike(path$39.join(addonsDir, scope.name))) continue;
 			const scopeDir = path$39.join(addonsDir, scope.name);
 			for (const pkg of fs$17.readdirSync(scopeDir, { withFileTypes: true })) {
-				if (!pkg.isDirectory()) continue;
+				if (!isDirLike(path$39.join(scopeDir, pkg.name))) continue;
 				const pkgJsonPath = path$39.join(scopeDir, pkg.name, "package.json");
 				if (!fs$17.existsSync(pkgJsonPath)) continue;
 				let pkgJson;
@@ -3354,22 +3382,57 @@ var AddonManifest = class {
 				if (!pkgJson.name || !pkgJson.version) continue;
 				const addons = pkgJson.camstack?.addons;
 				if (!Array.isArray(addons) || addons.length === 0) continue;
-				if (m.addons[pkgJson.name] != null) continue;
-				m.addons[pkgJson.name] = {
-					name: pkgJson.name,
-					version: pkgJson.version,
+				onDisk.set(pkgJson.name, pkgJson.version);
+			}
+		}
+		for (const [name, version] of onDisk) {
+			const prev = m.addons[name];
+			if (prev == null) {
+				m.addons[name] = {
+					name,
+					version,
 					source: "seed",
 					installedAt: now,
 					updatedAt: now
 				};
-				added++;
+				changes++;
+				onChange?.({
+					kind: "added",
+					name,
+					to: version
+				});
+				continue;
 			}
+			if (prev.version !== version) {
+				m.addons[name] = {
+					...prev,
+					version
+				};
+				changes++;
+				onChange?.({
+					kind: "version-corrected",
+					name,
+					from: prev.version,
+					to: version
+				});
+			}
+		}
+		for (const [name, entry] of Object.entries(m.addons)) {
+			if (onDisk.has(name)) continue;
+			if (entry.lastBackupDir) continue;
+			delete m.addons[name];
+			changes++;
+			onChange?.({
+				kind: "pruned",
+				name,
+				from: entry.version
+			});
 		}
-		if (added > 0) {
+		if (changes > 0) {
 			m.updatedAt = now;
 			this.write(m);
 		}
-		return added;
+		return changes;
 	}
 	/**
 	* Migration helper: if the manifest is empty but the addons directory
@@ -3752,6 +3815,34 @@ var noopLogger = {
 		return noopLogger;
 	}
 };
+/**
+* A staging tree younger than this may belong to an install still running —
+* possibly in another process. Only older trees are residue worth sweeping.
+* Generous on purpose: an addon's runtime-dependency `npm install` on a slow
+* host is minutes, and the cost of leaving residue one deploy longer is disk,
+* while the cost of sweeping a live one is a FAILED deploy.
+*/
+var STAGING_RESIDUE_MIN_AGE_MS = 30 * 6e4;
+/**
+* Pick the staging entries that are safe to delete.
+*
+* `installFromTgz` used to clear the WHOLE `.staging` root before creating its
+* own dir. Two deploys arriving within one install's lifetime — the normal case
+* when the hub propagates two packages back to back — meant the second one
+* deleted the first one's tree out from under its running `npm install`:
+*
+*   npm error code ENOENT
+*   npm error path …/.staging/install-14820-2026-08-07T12-28-28-875Z/package/package.json
+*
+* which the propagation then reported as `runtime dependency install failed`.
+* Observed on the Mac desktop agent and on little-unraid on 2026-08-07.
+*
+* So a sweep only removes what cannot be live: not a tree this process is
+* building, and not one young enough to belong to anybody's in-flight install.
+*/
+function selectSweepableStaging(entries, inFlight, minAgeMs = STAGING_RESIDUE_MIN_AGE_MS) {
+	return entries.filter((entry) => !inFlight.has(entry.name) && entry.ageMs >= minAgeMs).map((entry) => entry.name);
+}
 var AddonInstaller = class AddonInstaller {
 	addonsDir;
 	registry;
@@ -3768,6 +3859,11 @@ var AddonInstaller = class AddonInstaller {
 	* `getAddonInstallSource`).
 	*/
 	manifest;
+	/**
+	* Basenames under `.staging` this process is currently building. Never swept
+	* — see {@link selectSweepableStaging}.
+	*/
+	inFlightStaging = /* @__PURE__ */ new Set();
 	constructor(config, logger = noopLogger) {
 		this.addonsDir = config.addonsDir;
 		this.registry = config.registry;
@@ -3926,19 +4022,34 @@ var AddonInstaller = class AddonInstaller {
 		}
 	}
 	/**
-	* Reconcile the install manifest with the addons actually present on
-	* disk. Seeded addons (baked into the image and copied verbatim by the
-	* container entrypoint) never pass through an `install*` codepath, so
-	* they are missing from `manifest.json` and `applyUpdate` would reject
-	* them with "not currently tracked in manifest". Call this once after
-	* `ensureRequiredPackages` so every on-disk addon is updatable.
+	* Reconcile the install manifest against the addons actually present on
+	* disk: register seeded addons, correct a version that disagrees with the
+	* installed `package.json`, and drop entries naming a directory that does
+	* not exist. Call once after `ensureRequiredPackages`, before any update
+	* can be in flight. See `AddonManifest.reconcileFromDisk` for the rules.
+	*
+	* Every correction is logged by name — a manifest that silently disagreed
+	* with disk is what made "@camstack/system 1.2.29" read as installed on a
+	* hub that deliberately has no copy of it.
 	*
-	* Returns the number of manifest entries added.
+	* Returns the number of changes.
 	*/
 	reconcileManifest() {
-		const added = this.manifest.reconcileFromDisk(this.addonsDir);
-		if (added > 0) this.logger.info(`Manifest reconciled — ${added} seeded addon(s) registered`);
-		return added;
+		const changes = this.manifest.reconcileFromDisk(this.addonsDir, (c) => {
+			switch (c.kind) {
+				case "added":
+					this.logger.info(`Manifest — registered seeded addon ${c.name}@${c.to}`);
+					break;
+				case "version-corrected":
+					this.logger.info(`Manifest — ${c.name} recorded ${c.from} but disk has ${c.to}; adopting disk`);
+					break;
+				case "pruned":
+					this.logger.info(`Manifest — dropped ${c.name}@${c.from}: no install directory on disk`);
+					break;
+			}
+		});
+		if (changes > 0) this.logger.info(`Manifest reconciled — ${changes} correction(s)`);
+		return changes;
 	}
 	/**
 	* Install a single addon — on-demand installer used by AddonPackageService
@@ -4176,6 +4287,40 @@ var AddonInstaller = class AddonInstaller {
 			} });
 		});
 	}
+	/**
+	* Best-effort removal of `.staging` residue left by a CRASHED earlier deploy.
+	*
+	* Deliberately not `sweepGraveyard`: an evicted `.evicting/*` dir is dead by
+	* construction, but a `.staging/*` dir may be an install still running — in
+	* this process or another one. Deleting one of those fails a live deploy with
+	* an ENOENT on its own package.json, which is what happened on 2026-08-07.
+	*/
+	async sweepStagingResidue(stagingRoot) {
+		let names;
+		try {
+			names = fs$17.readdirSync(stagingRoot);
+		} catch {
+			return;
+		}
+		const now = Date.now();
+		const ages = [];
+		for (const name of names) try {
+			const stat = fs$17.statSync(path$39.join(stagingRoot, name));
+			ages.push({
+				name,
+				ageMs: now - stat.mtimeMs
+			});
+		} catch {}
+		const sweepable = selectSweepableStaging(ages, this.inFlightStaging);
+		if (sweepable.length > 0) this.logger.info("sweeping staging residue from a crashed earlier deploy", { meta: {
+			stagingRoot,
+			entries: sweepable
+		} });
+		await Promise.all(sweepable.map((name) => fs$17.promises.rm(path$39.join(stagingRoot, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0)));
+	}
 	/** Best-effort removal of leftover `.evicting/*` dirs from earlier deploys. */
 	async sweepGraveyard(graveyard) {
 		let entries;
@@ -4193,9 +4338,11 @@ var AddonInstaller = class AddonInstaller {
 	async installFromTgz(tgzPath) {
 		const stagingRoot = path$39.join(this.addonsDir, ".staging");
 		ensureDir(stagingRoot);
-		await this.sweepGraveyard(stagingRoot);
-		const stagingDir = path$39.join(stagingRoot, `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`);
+		await this.sweepStagingResidue(stagingRoot);
+		const stagingName = `install-${process.pid}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+		const stagingDir = path$39.join(stagingRoot, stagingName);
 		ensureDir(stagingDir);
+		this.inFlightStaging.add(stagingName);
 		try {
 			await execFileAsync("tar", [
 				"-xzf",
@@ -4250,6 +4397,7 @@ var AddonInstaller = class AddonInstaller {
 				version: pkgView.version
 			};
 		} finally {
+			this.inFlightStaging.delete(stagingName);
 			await fs$17.promises.rm(stagingDir, {
 				recursive: true,
 				force: true