@trillboards/edge-sdk 0.2.156 → 0.2.158

package/deploy/windows/apply-update.ps1

@@ -499,7 +499,7 @@ function Invoke-Commit {
     # failure and $ErrorActionPreference = 'Stop' turns that into ours.
     & $installUpdate -InstallDir $InstallDir -StagingDir $PayloadDir
   } catch {
-    Fail 'failed' "the swap failed and the previous version was restored: $($_.Exception.Message)"
+    Fail 'failed' "the update transaction failed: $($_.Exception.Message)"
   }
 
   # The measured half. The probe predicts; this observes.

package/deploy/windows/install-update.ps1

@@ -10,9 +10,17 @@ param(
 
 $ErrorActionPreference = "Stop"
 $previousDir = Join-Path $InstallDir ".previous"
+$runtimeRepairMarker = Join-Path $previousDir 'model-runtime-rollback-failed.json'
 $parts = @("bin", "lib")
 $movedPrevious = New-Object System.Collections.Generic.List[string]
 $movedStaged = New-Object System.Collections.Generic.List[string]
+$script:modelRuntimeUpdate = $null
+
+# A failed external-runtime rollback owns this recovery tree. A later update
+# must not delete it in the normal .previous cleanup or restart sensing over it.
+if (Test-Path -LiteralPath $runtimeRepairMarker) {
+  throw 'The previous local AI rollback needs repair; saved connector/runtime backups were left untouched'
+}
 
 function Assert-ConnectorVersion([string]$Root) {
   $node = Join-Path $Root "bin\node.exe"
@@ -43,6 +51,109 @@ function Register-Connector([string]$Root) {
   if ($LASTEXITCODE -ne 0) { throw "Scheduled-task registration failed." }
 }
 
+function Get-OwnedLocalAiProcesses {
+  # Task Scheduler can stop the uv launcher while leaving its Python child
+  # alive. Match only this user's model server on the verified task's port;
+  # never kill all Python processes or a different user's listener.
+  $portPattern = '(?:^|\s)--port(?:\s+|=)' + $script:modelRuntimeUpdate.Port + '(?=\s|$)'
+  $processes = Get-CimInstance Win32_Process -Filter "Name = 'python.exe' OR Name = 'pythonw.exe' OR Name = 'litert-lm.exe'" -OperationTimeoutSec 5 -ErrorAction Stop
+  foreach ($process in $processes) {
+    if (-not $process.CommandLine -or $process.CommandLine -notmatch 'litert[-_]lm' -or
+        $process.CommandLine -notmatch '(?:^|\s)serve(?=\s|$)' -or $process.CommandLine -notmatch $portPattern) { continue }
+    $owner = Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid -OperationTimeoutSec 5 -ErrorAction Stop
+    if ($owner.ReturnValue -ne 0 -or -not $owner.Sid) { throw 'Cannot verify the model process owner; no unverified process was stopped' }
+    if ($owner.Sid -eq $script:modelRuntimeUpdate.OwnerSid) { $process }
+  }
+}
+
+function Stop-LocalAiForUpdate {
+  Disable-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction Stop | Out-Null
+  Stop-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction Stop
+  for ($attempt = 0; $attempt -lt 15; $attempt++) {
+    $task = Get-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction Stop
+    $remaining = @(Get-OwnedLocalAiProcesses)
+    foreach ($process in $remaining) { Stop-Process -Id $process.ProcessId -Force -ErrorAction Stop }
+    $listenerErrors = @()
+    $listeners = @(Get-NetTCPConnection -LocalPort $script:modelRuntimeUpdate.Port -State Listen -ErrorAction SilentlyContinue -ErrorVariable listenerErrors)
+    if (@($listenerErrors | Where-Object { $_.CategoryInfo.Category -ne 'ObjectNotFound' }).Count) { throw 'Cannot verify the local AI port is free' }
+    if ($task.State -notin @('Running', 'Queued') -and $remaining.Count -eq 0 -and $listeners.Count -eq 0) { return }
+    Start-Sleep -Seconds 1
+  }
+  throw 'The local AI task, server process or listening port did not stop; runtime files were not replaced'
+}
+
+function Restore-LocalAiTaskState {
+  if ($null -eq $script:modelRuntimeUpdate) { return }
+  if ($script:modelRuntimeUpdate.Enabled) {
+    Enable-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction Stop | Out-Null
+    if ($script:modelRuntimeUpdate.Running) { Start-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction Stop }
+  } else {
+    Disable-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction Stop | Out-Null
+  }
+}
+
+function Update-LocalAiRuntime([string]$Root) {
+  $modelTaskErrors = @()
+  $task = Get-ScheduledTask -TaskName 'TrillboardsLiteRtLm' -ErrorAction SilentlyContinue -ErrorVariable modelTaskErrors
+  if (-not $task) {
+    # Only a genuine absence belongs to first-time setup. An inaccessible task
+    # must not be mistaken for "no model service" and silently keep old code.
+    if (@($modelTaskErrors | Where-Object { $_.CategoryInfo.Category -ne 'ObjectNotFound' }).Count) {
+      throw 'The local AI task is inaccessible; runtime refresh was not skipped'
+    }
+    return
+  }
+  $taskUser = [string]$task.Principal.UserId
+  $taskSid = if ($taskUser -match '^S-1-') { $taskUser } else {
+    (New-Object Security.Principal.NTAccount($taskUser)).Translate([Security.Principal.SecurityIdentifier]).Value
+  }
+  $currentSid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+  $action = @($task.Actions)
+  $ownTool = Join-Path $env:USERPROFILE '.local\bin\litert-lm.exe'
+  if ($taskSid -ne $currentSid -or $action.Count -ne 1 -or
+      [IO.Path]::GetFullPath([string]$action[0].Execute) -ine [IO.Path]::GetFullPath($ownTool)) {
+    throw 'Cannot verify ownership of the local AI task; no runtime was changed'
+  }
+  $serverArguments = [string]$action[0].Arguments
+  $ports = [regex]::Matches($serverArguments, '(?:^|\s)--port(?:\s+|=)([0-9]+)(?=\s|$)')
+  if ($serverArguments -notmatch '^serve\s' -or $ports.Count -ne 1 -or
+      [long]$ports[0].Groups[1].Value -lt 1 -or [long]$ports[0].Groups[1].Value -gt 65535) {
+    throw 'Cannot verify the local AI task port; no runtime was changed'
+  }
+  $setup = Join-Path $Root 'bin\setup-litertlm.ps1'
+  if (-not (Test-Path -LiteralPath $setup -PathType Leaf)) { throw 'The released local AI setup is missing' }
+  # Inspect first: an unchanged shim does NOT restart a healthy model server on
+  # every SDK update. /v1/models and the CLI version cannot detect stale code.
+  $state = (& $setup -RuntimeAction Inspect | Out-String).Trim() | ConvertFrom-Json
+  if ($LASTEXITCODE -ne 0 -or $state.version -ne 1) { throw 'Could not inspect the installed local AI runtime' }
+  if (-not $state.needsRefresh) { return }
+  $script:modelRuntimeUpdate = [pscustomobject]@{
+    Enabled = [bool]$task.Settings.Enabled
+    Running = ($task.State -eq 'Running')
+    OwnerSid = $currentSid
+    Port = [int]$ports[0].Groups[1].Value
+    Setup = $setup
+    Backup = (Join-Path $previousDir 'litertlm-runtime')
+  }
+  Stop-LocalAiForUpdate
+  # This mode is local file replacement only. It never downloads a CLI/model,
+  # imports weights, resets tuning, re-registers tasks or runs image inference.
+  & $setup -RuntimeAction Refresh -RuntimeBackupDir $script:modelRuntimeUpdate.Backup
+  if ($LASTEXITCODE -ne 0) { throw 'The local AI runtime refresh failed' }
+  Restore-LocalAiTaskState
+}
+
+function Restore-LocalAiRuntime {
+  if ($null -eq $script:modelRuntimeUpdate) { return }
+  Stop-LocalAiForUpdate
+  $receipt = Join-Path $script:modelRuntimeUpdate.Backup 'runtime-backup.json'
+  if (Test-Path -LiteralPath $receipt -PathType Leaf) {
+    & $script:modelRuntimeUpdate.Setup -RuntimeAction Restore -RuntimeBackupDir $script:modelRuntimeUpdate.Backup
+    if ($LASTEXITCODE -ne 0) { throw 'The previous local AI runtime could not be verified; rollback backup was preserved' }
+  }
+  Restore-LocalAiTaskState
+}
+
 <#
   Carry the detector's RAM ceiling onto an EXISTING install.
 
@@ -192,6 +303,9 @@ try {
   }
 
   Assert-ConnectorVersion $InstallDir
+  # The Python venv is OUTSIDE bin/lib. Refresh it transactionally before the
+  # connector can review a saved frame with the new native-image contract.
+  Update-LocalAiRuntime $InstallDir
   Register-Connector $InstallDir
   Assert-ConnectorScheduled
   if (Test-Path (Join-Path $InstallDir "trillboards.config.json")) {
@@ -206,11 +320,21 @@ try {
   Write-Host "Trillboards Edge update installed successfully."
 } catch {
   $failure = $_
+  $runtimeRollbackFailure = $null
   try {
     $stopScript = Join-Path $InstallDir "bin\stop-existing.ps1"
     if (Test-Path $stopScript) { & $stopScript -InstallDir $InstallDir }
   } catch {}
 
+  # Use the NEW setup while its bin tree still exists. Restore external runtime
+  # bytes before rolling bin/lib back; neither path touches pairings or spools.
+  try { Restore-LocalAiRuntime } catch { $runtimeRollbackFailure = $_.Exception.Message }
+  if ($runtimeRollbackFailure) {
+    [IO.File]::WriteAllText($runtimeRepairMarker,
+      (@{ version = 1; failedAtUtc = [DateTime]::UtcNow.ToString('o'); detail = $runtimeRollbackFailure } | ConvertTo-Json),
+      [Text.UTF8Encoding]::new($false))
+    throw "Update failed: $($failure.Exception.Message). Local AI rollback needs repair: $runtimeRollbackFailure. Preserved both connector trees, runtime backups, pairings and saved evidence."
+  }
   foreach ($part in $movedStaged) {
     Remove-Item -Recurse -Force (Join-Path $InstallDir $part) -ErrorAction SilentlyContinue
   }

package/deploy/windows/setup-litertlm.ps1

@@ -24,6 +24,10 @@ param(
   [switch]$RequireBundledModel,
   [switch]$AllowModelDownload,
   [string]$ProgressPath = "",
+  # Upgrades refresh only our shipped Python adapter, never the CLI, weights,
+  # model config or task registration. The caller owns stopping/restarting it.
+  [ValidateSet('Setup', 'Inspect', 'Refresh', 'Restore')][string]$RuntimeAction = 'Setup',
+  [string]$RuntimeBackupDir = "",
   [switch]$SmokeTest
 )
 
@@ -333,6 +337,134 @@ function Import-VerifiedModel([string]$SourcePath, [string]$ExecutablePath) {
   return (($LASTEXITCODE -eq 0) -and (Test-LitertLmModel $ExecutablePath))
 }
 
+# One owner for the shim on fresh installs AND upgrades. None of these helpers
+# import a model, rewrite model config, install dependencies or register tasks.
+function Get-LitertlmShimPaths([string]$UvPath) {
+  $shim = $null
+  foreach ($candidate in @(
+    (Join-Path $PSScriptRoot 'trillboards_litertlm_shim.py'),
+    (Join-Path $PSScriptRoot '..\litertlm\trillboards_litertlm_shim.py')
+  )) { if (Test-Path -LiteralPath $candidate -PathType Leaf) { $shim = $candidate; break } }
+  if (-not $shim) { throw 'The released litert-lm shim is missing' }
+  # PS 5.1 stops a native process when Select-Object -First has its line,
+  # turning a successful lookup into exit -1. Drain stdout before selecting.
+  $toolDirOutput = @(& $UvPath tool dir 2>$null)
+  $toolDirExit = $LASTEXITCODE
+  $toolDir = $toolDirOutput | Select-Object -First 1
+  if ($toolDirExit -ne 0 -or [string]::IsNullOrWhiteSpace($toolDir)) { throw 'Cannot resolve uv tool dir' }
+  $venv = [IO.Path]::GetFullPath((Join-Path $toolDir.Trim() 'litert-lm'))
+  $py = Join-Path $venv 'Scripts\python.exe'
+  if (-not (Test-Path -LiteralPath $py -PathType Leaf)) { throw 'The installed litert-lm Python is missing' }
+  $siteOutput = @(& $py -c "import sysconfig;print(sysconfig.get_paths()['purelib'])" 2>$null)
+  $siteExit = $LASTEXITCODE
+  $site = $siteOutput | Select-Object -First 1
+  if ($siteExit -ne 0 -or [string]::IsNullOrWhiteSpace($site)) { throw 'Cannot resolve litert-lm site-packages' }
+  $site = [IO.Path]::GetFullPath($site.Trim())
+  if (-not $site.StartsWith(($venv.TrimEnd('\') + '\'), [StringComparison]::OrdinalIgnoreCase) -or
+      -not (Test-Path -LiteralPath $site -PathType Container)) { throw 'The runtime site is outside its managed venv' }
+  return [pscustomobject]@{ Source = $shim; Python = $py; Site = $site }
+}
+
+function Get-LitertlmShimFiles($Paths) {
+  return @(
+    [pscustomobject]@{ Name = 'trillboards_litertlm_shim.py'; Bytes = [IO.File]::ReadAllBytes($Paths.Source) },
+    [pscustomobject]@{ Name = 'trillboards-litertlm-shim.pth'; Bytes = [Text.Encoding]::ASCII.GetBytes("import trillboards_litertlm_shim`r`n") }
+  )
+}
+
+function Get-ShimBytesHash([byte[]]$Bytes) {
+  $hasher = [Security.Cryptography.SHA256]::Create()
+  try { return ([BitConverter]::ToString($hasher.ComputeHash($Bytes))).Replace('-', '').ToLowerInvariant() }
+  finally { $hasher.Dispose() }
+}
+
+function Get-LitertlmShimState([string]$UvPath) {
+  $paths = Get-LitertlmShimPaths $UvPath
+  $needsRefresh = $false
+  foreach ($file in (Get-LitertlmShimFiles $paths)) {
+    $target = Join-Path $paths.Site $file.Name
+    if (-not (Test-Path -LiteralPath $target -PathType Leaf)) { $needsRefresh = $true; continue }
+    if ((Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant() -ne (Get-ShimBytesHash $file.Bytes)) { $needsRefresh = $true }
+  }
+  return [pscustomobject]@{ version = 1; needsRefresh = $needsRefresh }
+}
+
+function Install-LitertlmShim {
+  param([string]$UvPath, [string]$BackupDirectory = '', [switch]$Restore)
+  $ErrorActionPreference = 'Stop'
+  try {
+    $paths = Get-LitertlmShimPaths $UvPath
+    $files = @(Get-LitertlmShimFiles $paths)
+    $receiptPath = if ($BackupDirectory) { Join-Path $BackupDirectory 'runtime-backup.json' } else { '' }
+    if ($Restore) {
+      if (-not $receiptPath) { throw 'Runtime rollback requires its backup directory' }
+      $receipt = Get-Content -LiteralPath $receiptPath -Raw | ConvertFrom-Json
+      if ($receipt.version -ne 1 -or $receipt.site -ine $paths.Site -or @($receipt.files).Count -ne $files.Count) { throw 'Runtime rollback scope mismatch' }
+      # Validate the COMPLETE restore before changing either file. Refuse an
+      # unexpected concurrent write rather than overwriting another repair.
+      foreach ($file in $files) {
+        $entry = @($receipt.files | Where-Object { $_.name -eq $file.Name })
+        if ($entry.Count -ne 1) { throw 'Runtime rollback file set mismatch' }
+        $target = Join-Path $paths.Site $file.Name
+        if (Test-Path -LiteralPath $target) {
+          $current = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($current -ne $entry[0].installedSha256 -and $current -ne $entry[0].previousSha256) { throw 'Runtime changed after the update; rollback refused' }
+        }
+        if ($entry[0].existed -and (Get-FileHash -LiteralPath (Join-Path $BackupDirectory $file.Name) -Algorithm SHA256).Hash.ToLowerInvariant() -ne $entry[0].previousSha256) { throw 'Runtime rollback backup hash mismatch' }
+      }
+      foreach ($entry in $receipt.files) {
+        $target = Join-Path $paths.Site $entry.name
+        if ($entry.existed) { Copy-Item -LiteralPath (Join-Path $BackupDirectory $entry.name) -Destination $target -Force }
+        elseif (Test-Path -LiteralPath $target) { Remove-Item -LiteralPath $target -Force }
+        if ($entry.existed) {
+          if ((Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant() -ne $entry.previousSha256) { throw 'Restored runtime hash mismatch' }
+        } elseif (Test-Path -LiteralPath $target) { throw 'Runtime rollback left a newly introduced file' }
+      }
+      Log 'restored the previous litert-lm shim bytes'
+      return $true
+    }
+    if ($BackupDirectory) {
+      if (Test-Path -LiteralPath $receiptPath) { throw 'Preserve the existing runtime rollback receipt' }
+      New-Item -ItemType Directory -Force -Path $BackupDirectory | Out-Null
+      $backups = @(foreach ($file in $files) {
+        $target = Join-Path $paths.Site $file.Name
+        $existed = Test-Path -LiteralPath $target -PathType Leaf
+        $previousSha = $null
+        if ($existed) {
+          $previousSha = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant()
+          $backup = Join-Path $BackupDirectory $file.Name
+          Copy-Item -LiteralPath $target -Destination $backup
+          if ((Get-FileHash -LiteralPath $backup -Algorithm SHA256).Hash.ToLowerInvariant() -ne $previousSha) { throw 'Runtime rollback copy did not verify' }
+        }
+        [pscustomobject]@{ name = $file.Name; existed = [bool]$existed; previousSha256 = $previousSha; installedSha256 = (Get-ShimBytesHash $file.Bytes) }
+      })
+      [IO.File]::WriteAllText($receiptPath, (@{ version = 1; site = $paths.Site; files = $backups } | ConvertTo-Json -Depth 5), [Text.UTF8Encoding]::new($false))
+    }
+    foreach ($file in $files) {
+      $target = Join-Path $paths.Site $file.Name
+      $temporary = "$target.$PID.update"
+      try {
+        [IO.File]::WriteAllBytes($temporary, $file.Bytes)
+        if ((Get-FileHash -LiteralPath $temporary -Algorithm SHA256).Hash.ToLowerInvariant() -ne (Get-ShimBytesHash $file.Bytes)) { throw 'Runtime refresh hash mismatch' }
+        # PS 5.1 binds an ordinary $null to an empty String here, which .NET
+        # treats as an invalid backup path. Pass an actual null String.
+        if (Test-Path -LiteralPath $target) { [IO.File]::Replace($temporary, $target, [NullString]::Value) }
+        else { [IO.File]::Move($temporary, $target) }
+        if ((Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant() -ne (Get-ShimBytesHash $file.Bytes)) { throw 'Installed runtime refresh hash mismatch' }
+      } finally { if (Test-Path -LiteralPath $temporary) { Remove-Item -LiteralPath $temporary -Force } }
+    }
+    # A fresh interpreter proves the installed wrapper imports. No engine,
+    # weights, image inference, model config or camera credentials are loaded.
+    & $paths.Python -c "import litert_lm,sys; sys.exit(0 if getattr(litert_lm.Engine.create_conversation,'_trillboards_litertlm_shim',False) else 1)" *>> $LogPath
+    if ($LASTEXITCODE -ne 0) { throw 'The refreshed model-service shim did not import' }
+    Log "litert-lm fast-conversation shim active in $($paths.Site)"
+    return $true
+  } catch {
+    Log "WARN: litert-lm shim operation failed: $_"
+    return $false
+  }
+}
+
 if ($SmokeTest) {
   if ([string]::IsNullOrWhiteSpace($ProgressPath)) { throw "SmokeTest requires ProgressPath" }
   Write-SetupProgress -Stage "local_ai" -Title "Installing local AI" -Message "Smoke test" -Phase "installing_model" -Percent 62 -TotalBytes $ExpectedModelBytes
@@ -345,7 +477,10 @@ if ($SmokeTest) {
   exit 0
 }
 
-$setupMutex = New-Object System.Threading.Mutex($false, "Local\TrillboardsLiteRtLmSetup")
+# S4U/boot tasks and the interactive installer run in different sessions. A
+# Local mutex cannot serialize them; scope the Global name to this user's SID.
+$setupSid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$setupMutex = New-Object System.Threading.Mutex($false, ("Global\TrillboardsLiteRtLmSetup-" + $setupSid))
 $haveSetupMutex = $false
 try {
   $haveSetupMutex = $setupMutex.WaitOne(0)
@@ -354,6 +489,10 @@ try {
 }
 
 if (-not $haveSetupMutex) {
+  if ($RuntimeAction -ne 'Setup') {
+    $setupMutex.Dispose()
+    throw 'Local AI setup is busy; no concurrent runtime refresh was attempted'
+  }
   Log "LiteRT-LM provisioning is already running; attaching setup progress"
   if ([string]::IsNullOrWhiteSpace($ProgressPath) -and -not $RequireBundledModel) {
     $setupMutex.Dispose()
@@ -389,6 +528,24 @@ function Stop-SetupLock {
   $setupMutex.Dispose()
 }
 
+if ($RuntimeAction -ne 'Setup') {
+  try {
+    $refreshUvPath = Join-Path $LocalBin 'uv.exe'
+    if (-not (Test-Path -LiteralPath $refreshUvPath -PathType Leaf)) {
+      $refreshUv = Get-Command uv -ErrorAction Stop
+      $refreshUvPath = $refreshUv.Source
+    }
+    if ($RuntimeAction -eq 'Inspect') {
+      Get-LitertlmShimState $refreshUvPath | ConvertTo-Json -Compress
+    } else {
+      if ([string]::IsNullOrWhiteSpace($RuntimeBackupDir)) { throw 'A runtime rollback directory is required' }
+      $refreshArgs = @{ UvPath = $refreshUvPath; BackupDirectory = $RuntimeBackupDir; Restore = ($RuntimeAction -eq 'Restore') }
+      if (-not (Install-LitertlmShim @refreshArgs)) { throw 'The local AI runtime refresh/rollback did not verify' }
+    }
+  } finally { Stop-SetupLock }
+  exit 0
+}
+
 Log "starting LiteRT-LM provisioning (Windows x64, CPU backend)"
 Write-SetupProgress -Stage "local_ai" -Title "Installing local AI" -Message "Preparing the private on-device AI runtime. Cloud inference remains off." -Phase "installing_runtime" -Percent 0
 
@@ -584,43 +741,13 @@ if ((Test-LitertLmCli) -and ($installedLitertLmVersion -eq $LitertLmVersion)) {
 # --force` rebuilds the venv and takes both files with it, while Test-LitertLmCli
 # short-circuits that branch on a healthy CLI -- gating this behind it is exactly
 # how a repaired-and-healthy machine would keep the slow serve and report fine.
-# Never throws: this is a speed fix, and it must not be able to fail an install.
-function Install-LitertlmShim {
-  param([string]$UvPath)
-  try {
-    $shim = $null
-    foreach ($c in @(
-      (Join-Path $PSScriptRoot "trillboards_litertlm_shim.py"),
-      (Join-Path $PSScriptRoot "..\litertlm\trillboards_litertlm_shim.py")
-    )) { if (Test-Path -LiteralPath $c -PathType Leaf) { $shim = $c; break } }
-    if (-not $shim) { Log "WARN: litert-lm shim source not found; serve keeps stock (slower) conversation setup"; return $false }
-
-    $toolDir = (& $UvPath tool dir 2>$null | Select-Object -First 1)
-    if ([string]::IsNullOrWhiteSpace($toolDir)) { Log "WARN: could not resolve 'uv tool dir'; skipping litert-lm shim"; return $false }
-    $py = Join-Path $toolDir.Trim() "litert-lm\Scripts\python.exe"
-    if (-not (Test-Path -LiteralPath $py -PathType Leaf)) { Log "WARN: litert-lm venv python missing at $py; skipping shim"; return $false }
-
-    $site = (& $py -c "import sysconfig;print(sysconfig.get_paths()['purelib'])" 2>$null | Select-Object -First 1)
-    if ([string]::IsNullOrWhiteSpace($site) -or -not (Test-Path -LiteralPath $site.Trim())) {
-      Log "WARN: could not resolve litert-lm site-packages; skipping shim"; return $false
-    }
-    $site = $site.Trim()
-    Copy-Item -LiteralPath $shim -Destination (Join-Path $site "trillboards_litertlm_shim.py") -Force
-    Set-Content -LiteralPath (Join-Path $site "trillboards-litertlm-shim.pth") -Value "import trillboards_litertlm_shim" -Encoding ASCII
-
-    # Capability is established by ATTEMPTING THE OPERATION. Importing litert_lm
-    # here is the only thing that proves the wrap landed on the class the serve
-    # will use; a file that merely exists proves nothing.
-    & $py -c "import litert_lm,sys; sys.exit(0 if getattr(litert_lm.Engine.create_conversation,'_trillboards_litertlm_shim',False) else 1)" *>> $LogPath
-    if ($LASTEXITCODE -eq 0) { Log "litert-lm fast-conversation shim active in $site"; return $true }
-    Log "WARN: litert-lm shim did not take effect; serve keeps stock (slower) conversation setup"
-    return $false
-  } catch {
-    Log "WARN: litert-lm shim install failed: $_"
-    return $false
-  }
+# The adapter also binds runtime model proof to each response; it is required
+# before readiness probes can verify the installed model.
+if (-not (Install-LitertlmShim -UvPath $uvCmd.Source)) {
+  Fail-LocalAi "The local AI runtime adapter could not be installed. See $LogPath."
+  Stop-SetupLock
+  exit 1
 }
-Install-LitertlmShim -UvPath $uvCmd.Source | Out-Null
 
 $bundledModelVerified = $false
 if (-not [string]::IsNullOrWhiteSpace($BundledModelPath)) {

package/dist/EdgeAgent.js

@@ -44,7 +44,7 @@ const edge_ads_1 = require("@trillboards/edge-ads");
 const CommandRouter_1 = require("./CommandRouter");
 const config_1 = require("./config");
 const dataDir_1 = require("./dataDir");
-const SDK_VERSION = '0.2.156';
+const SDK_VERSION = '0.2.158';
 class EdgeAgent extends events_1.EventEmitter {
     constructor(config, deps) {
         super();

package/dist/diagnose.d.ts

@@ -31,7 +31,7 @@ export interface DiagnosticReport {
         skipped: number;
     };
 }
-declare const SDK_VERSION = "0.2.156";
+declare const SDK_VERSION = "0.2.158";
 declare function checkNodeVersion(): CheckResult;
 declare function checkPlatform(): CheckResult;
 declare function checkMemory(): CheckResult;

package/dist/diagnose.js

@@ -63,7 +63,7 @@ const localNetworkAccess_1 = require("./localNetworkAccess");
 // ---------------------------------------------------------------------------
 // SDK version — mirrors package.json; kept in sync by CI
 // ---------------------------------------------------------------------------
-const SDK_VERSION = '0.2.156';
+const SDK_VERSION = '0.2.158';
 exports._SDK_VERSION = SDK_VERSION;
 // ---------------------------------------------------------------------------
 // ANSI helpers (no external deps)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trillboards/edge-sdk",
-  "version": "0.2.156",
+  "version": "0.2.158",
   "description": "Composable cross-platform Edge AI SDK for audience sensing on DOOH/CTV devices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",