create-principles-disciple 1.121.8 → 1.121.10

package/console/dist/server/routes/owner-identity.js

@@ -0,0 +1,76 @@
+import { resolveOwnerIdentity, readOwnerIdentityFile, writeOwnerIdentityFile, deleteOwnerIdentityFile, } from '@principles/core/runtime-v2';
+import { sendSuccess, sendError, sendBadRequest, sendMethodNotAllowed } from '../utils/response.js';
+import { resolveOwnerConfigSnapshot } from './governance.js';
+const MAX_BODY_SIZE = 16 * 1024;
+async function readJson(req) {
+    const chunks = [];
+    let totalSize = 0;
+    for await (const chunk of req) {
+        const buf = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+        totalSize += buf.length;
+        if (totalSize > MAX_BODY_SIZE)
+            throw new Error('payload_too_large');
+        chunks.push(buf);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+}
+/* eslint-disable @typescript-eslint/max-params */
+export async function handleOwnerIdentityRoute(req, res, homeDir, subPath, authConfig) {
+    if (subPath !== '' && subPath !== '/') {
+        sendError(res, 404, 'not_found', 'Unknown owner identity endpoint.', { nextAction: 'Use GET / POST / DELETE /api/v1/owner-identity.' });
+        return;
+    }
+    const method = req.method ?? 'GET';
+    if (method === 'GET') {
+        const file = readOwnerIdentityFile(homeDir);
+        const resolved = resolveOwnerIdentity(process.env, homeDir);
+        const view = {
+            resolved,
+            fileRecord: file.record,
+            ...(file.error === undefined ? {} : { fileError: file.error }),
+            governance: resolveOwnerConfigSnapshot(authConfig, resolved),
+        };
+        sendSuccess(res, view);
+        return;
+    }
+    if (method === 'POST') {
+        let body;
+        try {
+            body = await readJson(req);
+        }
+        catch {
+            sendBadRequest(res, 'Invalid JSON body or payload too large.');
+            return;
+        }
+        const value = body;
+        const ownerId = typeof value?.ownerId === 'string' ? value.ownerId : '';
+        const credentialId = typeof value?.credentialId === 'string' ? value.credentialId : '';
+        const result = writeOwnerIdentityFile(homeDir, { ownerId, credentialId });
+        if (!result.ok) {
+            sendBadRequest(res, result.error);
+            return;
+        }
+        const resolved = resolveOwnerIdentity(process.env, homeDir);
+        sendSuccess(res, {
+            record: result.record,
+            source: 'file',
+            governance: resolveOwnerConfigSnapshot(authConfig, resolved),
+        });
+        return;
+    }
+    if (method === 'DELETE') {
+        const result = deleteOwnerIdentityFile(homeDir);
+        if (!result.ok) {
+            sendError(res, 500, 'owner_identity_delete_failed', result.error);
+            return;
+        }
+        const resolved = resolveOwnerIdentity(process.env, homeDir);
+        sendSuccess(res, {
+            ok: true,
+            source: 'none',
+            governance: resolveOwnerConfigSnapshot(authConfig, resolved),
+        });
+        return;
+    }
+    sendMethodNotAllowed(res);
+}

package/console/dist/server/routes/update-history.d.ts

@@ -1,11 +1,16 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare const UPDATE_HISTORY_KINDS: readonly ['update', 'reinstall', 'legacy_migration', 'rollback', 'refusal', 'failure', 'recovery', 'unknown'];
+export type UpdateHistoryKind = (typeof UPDATE_HISTORY_KINDS)[number];
 interface UpdateHistoryEntry {
     id: string;
     timestamp: string;
     fromVersion: string;
     toVersion: string;
     success: boolean;
+    kind: UpdateHistoryKind;
     backupPath?: string;
+    reason?: string;
+    nextAction?: string;
 }
 export declare function appendUpdateHistory(workspaceDir: string, entry: Omit<UpdateHistoryEntry, 'id' | 'timestamp'>): void;
 export declare function handleUpdateHistoryRoute(req: IncomingMessage, res: ServerResponse, workspaceDir: string, _subPath: string): Promise<void>;

package/console/dist/server/routes/update-history.js

@@ -1,6 +1,52 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { sendSuccess, sendMethodNotAllowed } from '../utils/response.js';
+export const UPDATE_HISTORY_KINDS = [
+    'update',
+    'reinstall',
+    'legacy_migration',
+    'rollback',
+    'refusal',
+    'failure',
+    'recovery',
+    'unknown',
+];
+function isHistoryKind(value) {
+    return typeof value === 'string' && UPDATE_HISTORY_KINDS.includes(value);
+}
+function parseHistoryEntry(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    const raw = value;
+    if (typeof raw.id !== 'string' ||
+        typeof raw.timestamp !== 'string' ||
+        typeof raw.fromVersion !== 'string' ||
+        typeof raw.toVersion !== 'string' ||
+        typeof raw.success !== 'boolean')
+        return undefined;
+    if (raw.kind !== undefined && !isHistoryKind(raw.kind))
+        return undefined;
+    if (raw.reason !== undefined && typeof raw.reason !== 'string')
+        return undefined;
+    if (raw.nextAction !== undefined && typeof raw.nextAction !== 'string')
+        return undefined;
+    if (raw.backupPath !== undefined && typeof raw.backupPath !== 'string')
+        return undefined;
+    return {
+        id: raw.id,
+        timestamp: raw.timestamp,
+        fromVersion: raw.fromVersion,
+        toVersion: raw.toVersion,
+        success: raw.success,
+        // Pre-Phase-0 records did not identify their operation. The operation is
+        // UNKNOWN — labeling them legacy_migration would claim a migration
+        // happened, which the record cannot prove (unknown ≠ legacy_migration).
+        kind: raw.kind === undefined ? 'unknown' : raw.kind,
+        ...(typeof raw.backupPath === 'string' ? { backupPath: raw.backupPath } : {}),
+        ...(typeof raw.reason === 'string' ? { reason: raw.reason } : {}),
+        ...(typeof raw.nextAction === 'string' ? { nextAction: raw.nextAction } : {}),
+    };
+}
 function getHistoryPath(workspaceDir) {
     return path.join(workspaceDir, '.pd', 'update-history.json');
 }
@@ -10,10 +56,10 @@ function loadHistory(historyPath) {
             const raw = fs.readFileSync(historyPath, 'utf-8');
             const parsed = JSON.parse(raw);
             if (Array.isArray(parsed)) {
-                return parsed.filter((e) => typeof e === 'object' && e !== null &&
-                    typeof e.fromVersion === 'string' &&
-                    typeof e.toVersion === 'string' &&
-                    typeof e.success === 'boolean');
+                return parsed.flatMap((entry) => {
+                    const parsedEntry = parseHistoryEntry(entry);
+                    return parsedEntry === undefined ? [] : [parsedEntry];
+                });
             }
         }
         catch (err) {

package/console/dist/server/routes/update.js

@@ -8,6 +8,8 @@ import { appendUpdateHistory } from './update-history.js';
 import { checkOpenClawGateway, stopOpenClawGateway, restartOpenClawGateway, } from '../utils/gateway.js';
 import { migrateLegacyExtensionBackups, reservePdBackupDestination, resolvePdBackupsRoot, } from '../utils/pd-backups.js';
 import { ActivationCompatibilityReadModel } from '@principles/core/runtime-v2';
+import { getInstallLayoutPaths, resolveInstallLayout } from '@principles/install-layout';
+import { collectFileDepLinkSpecs } from '../utils/update-links.js';
 /**
  * Legacy rule contract preflight (2026-08-19): refuse to swap the runtime
  * while an ACTIVE owner-approved rule still depends on a RuleHost contract
@@ -68,8 +70,48 @@ function resolveOpenclawHome() {
 function resolveExtensionsDir() {
     return path.join(resolveOpenclawHome(), 'extensions');
 }
+function resolveUpdateLayout() {
+    const homeDir = os.homedir();
+    const paths = getInstallLayoutPaths(homeDir);
+    const legacyPluginDir = path.join(resolveExtensionsDir(), 'principles-disciple');
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(paths.manifest, 'utf8'));
+    }
+    catch {
+        manifest = undefined;
+    }
+    const resolution = resolveInstallLayout({
+        homeDir,
+        manifest,
+        canonicalRuntimeExists: fs.existsSync(paths.runtimeDir),
+        legacyExtensionExists: fs.existsSync(legacyPluginDir),
+    });
+    if (resolution.mode === 'missing')
+        return undefined;
+    if (resolution.mode === 'canonical') {
+        return {
+            pluginDir: paths.pluginDir,
+            consoleDir: paths.consoleDir,
+            coreDir: paths.coreDir,
+            hostRuntimeDir: paths.hostRuntimeDir,
+            pdCliDir: paths.pdCliDir,
+            installLayoutDir: paths.installLayoutDir,
+            hosts: resolution.manifest?.hosts ?? [],
+        };
+    }
+    return {
+        pluginDir: legacyPluginDir,
+        consoleDir: path.join(legacyPluginDir, 'console'),
+        coreDir: path.join(legacyPluginDir, 'core'),
+        hostRuntimeDir: path.join(legacyPluginDir, 'host-runtime'),
+        pdCliDir: path.join(legacyPluginDir, 'pd-cli'),
+        installLayoutDir: path.join(legacyPluginDir, 'install-layout'),
+        hosts: ['openclaw'],
+    };
+}
 function resolvePluginDir(_workspaceDir) {
-    return path.join(resolveExtensionsDir(), 'principles-disciple');
+    return resolveUpdateLayout()?.pluginDir ?? path.join(resolveExtensionsDir(), 'principles-disciple');
 }
 function readCurrentVersion(pluginDir) {
     const pkgPath = path.join(pluginDir, 'package.json');
@@ -480,6 +522,26 @@ async function doApplyUpdate(options, workspaceDir) {
         const toVersion = typeof data.version === 'string' ? data.version : undefined;
         if (!toVersion)
             return { success: false, message: 'Missing version in registry response' };
+        const advancesInstalled = fromVersion !== 'unknown' &&
+            semver.valid(fromVersion) !== null &&
+            semver.valid(toVersion) !== null &&
+            semver.gt(toVersion, fromVersion);
+        if (!advancesInstalled) {
+            appendUpdateHistory(workspaceDir, {
+                fromVersion,
+                toVersion,
+                success: false,
+                kind: 'refusal',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+            });
+            return {
+                success: false,
+                message: 'Installed version would not advance — the update source is stale or malformed.',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+            };
+        }
         const dist = typeof data.dist === 'object' && data.dist !== null ? data.dist : null;
         const tarball = dist && typeof dist.tarball === 'string' ? dist.tarball : undefined;
         if (!tarball)
@@ -559,6 +621,7 @@ async function doApplyUpdate(options, workspaceDir) {
             fromVersion,
             toVersion,
             success: true,
+            kind: 'update',
             backupPath,
         });
         return {
@@ -620,6 +683,7 @@ async function doRollbackUpdate(options, workspaceDir) {
             fromVersion: 'rolled-back',
             toVersion: readCurrentVersion(targetDir) ?? 'unknown',
             success: true,
+            kind: 'rollback',
             backupPath: backupDir,
         });
         return { success: true, message: 'Rollback completed successfully' };
@@ -661,48 +725,131 @@ function depsMeaningfullyChanged(oldDeps, newDeps) {
     return aKeys.some((k, i) => bKeys[i] !== k || a[k] !== b[k]);
 }
 /**
- * Create the node_modules/@principles/host-runtime resolution links for the
- * installed console and pd-cli packages, if missing.
+ * Create the node_modules resolution links for the installed components, if
+ * missing.
  *
  * Mirrors installer.ts syncPdCli: junction on Windows (no elevation needed),
  * relative symlink elsewhere. Fresh installs get these links via npm install
- * (the bundled package.json rewrites the dep to file:../host-runtime); the
- * full update deliberately skips npm install, so it must create them itself.
- * Without the link, the updated console dist — which statically imports
- * @principles/host-runtime since 2026-08-21 (41cf97ee5) — crashes at startup
- * with ERR_MODULE_NOT_FOUND on installs created before the installer bundled
- * host-runtime (PRI-561).
+ * (the bundled package.json rewrites internal deps to file:../<component>);
+ * the full update deliberately skips npm install, so it must create them
+ * itself. Without a link, updated dists crash at startup with
+ * ERR_MODULE_NOT_FOUND (host-runtime: PRI-561, 2026-08-21).
+ *
+ * Two sources, both fail-closed on creation errors:
+ *   1. the explicit link list below (known-critical links: a missing one
+ *      means the updated console cannot start);
+ *   2. a data-driven pass that derives links from the STAGED manifests —
+ *      the freshly extracted release trees under tempDir. Their `file:`
+ *      declarations are the authoritative list of links the updated tree
+ *      needs. Reading the deployed (pre-update) manifests instead would
+ *      miss every dependency this release newly introduced: the running
+ *      console executes update logic from its own dist (one generation
+ *      behind the components it installs) — observed 2026-08-29 when the
+ *      1.221.2 console updated hosts to 1.222.5 but could not know about
+ *      the newly introduced install-layout component, leaving
+ *      host-runtime/node_modules/@principles/install-layout missing and
+ *      every pd-cli runtime command failing with ERR_MODULE_NOT_FOUND.
  *
  * Returns undefined on success, or an error message (rc-9: observable, never
  * silent — a missing link means the updated console cannot start).
  */
-function ensureHostRuntimeResolutionLinks(extDir) {
-    const hostRuntimeDir = path.join(extDir, 'host-runtime');
+function ensureRuntimeResolutionLinks(layout, tempDir) {
     const links = [
-        { linkPath: path.join(extDir, 'console', 'node_modules', '@principles', 'host-runtime'), target: hostRuntimeDir, unixTarget: '../../../host-runtime' },
-        { linkPath: path.join(extDir, 'pd-cli', 'node_modules', '@principles', 'host-runtime'), target: hostRuntimeDir, unixTarget: '../../../host-runtime' },
-        { linkPath: path.join(extDir, 'console', 'node_modules', 'principles-disciple'), target: extDir, unixTarget: '../../' },
+        { linkPath: path.join(layout.consoleDir, 'node_modules', '@principles', 'host-runtime'), target: layout.hostRuntimeDir },
+        { linkPath: path.join(layout.pdCliDir, 'node_modules', '@principles', 'host-runtime'), target: layout.hostRuntimeDir },
+        { linkPath: path.join(layout.consoleDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
+        { linkPath: path.join(layout.pdCliDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
+        // host-runtime depends on @principles/install-layout at runtime; /apply-full
+        // skips npm install, so its node_modules must self-provision the link too.
+        { linkPath: path.join(layout.hostRuntimeDir, 'node_modules', '@principles', 'install-layout'), target: layout.installLayoutDir },
+        { linkPath: path.join(layout.consoleDir, 'node_modules', 'principles-disciple'), target: layout.pluginDir },
+    ];
+    // Data-driven pass: derive links from the STAGED component manifests (see
+    // the comment above — staged, never the deployed pre-update manifests).
+    const stagedComponents = [
+        { manifestDir: path.join(tempDir, 'console'), deployedDir: layout.consoleDir },
+        { manifestDir: path.join(tempDir, 'pd-cli'), deployedDir: layout.pdCliDir },
+        { manifestDir: path.join(tempDir, 'host-runtime'), deployedDir: layout.hostRuntimeDir },
+        { manifestDir: path.join(tempDir, 'install-layout'), deployedDir: layout.installLayoutDir },
+        { manifestDir: path.join(tempDir, 'core'), deployedDir: layout.coreDir },
+        { manifestDir: path.join(tempDir, 'plugin'), deployedDir: layout.pluginDir },
     ];
-    for (const { linkPath, target, unixTarget } of links) {
+    const readStagedDependencies = (manifestDir) => {
+        try {
+            const pkgPath = path.join(manifestDir, 'package.json');
+            if (!fs.existsSync(pkgPath))
+                return {};
+            const parsed = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            if (!isRecord(parsed) || !isRecord(parsed.dependencies))
+                return {};
+            const out = {};
+            for (const [name, ref] of Object.entries(parsed.dependencies)) {
+                if (typeof ref === 'string')
+                    out[name] = ref;
+            }
+            return out;
+        }
+        catch {
+            // rc-9: an unreadable staged manifest degrades to "no derived links" —
+            // the explicit list above still covers the known-critical links.
+            return {};
+        }
+    };
+    const fileDepSpecs = collectFileDepLinkSpecs(stagedComponents, readStagedDependencies);
+    const createResolutionLink = (linkPath, target) => {
+        // Idempotent: never overwrite an existing link or directory (fresh
+        // installs have npm-created real dirs in these slots).
         if (fs.existsSync(linkPath))
-            continue;
+            return undefined;
         try {
             fs.mkdirSync(path.dirname(linkPath), { recursive: true });
             if (process.platform === 'win32') {
                 fs.symlinkSync(target, linkPath, 'junction');
             }
             else {
-                fs.symlinkSync(unixTarget, linkPath, 'dir');
+                fs.symlinkSync(path.relative(path.dirname(linkPath), target), linkPath, 'dir');
             }
+            return undefined;
         }
         catch (error) {
-            return `Failed to create host-runtime resolution link at ${linkPath}: ${error instanceof Error ? error.message : String(error)}`;
+            return `Failed to create runtime resolution link at ${linkPath}: ${error instanceof Error ? error.message : String(error)}`;
         }
+    };
+    // Pass 1 — explicit known-critical links, fail-closed BEFORE any byte is
+    // swapped (a link-creation failure aborts with the installed packages
+    // untouched: the PRI-561 ordering contract).
+    for (const { linkPath, target } of links) {
+        if (!fs.existsSync(target))
+            continue;
+        const error = createResolutionLink(linkPath, target);
+        if (error)
+            return error;
+    }
+    // Pass 2 — data-driven derived links. Their deployed target dir may be
+    // created by the copy steps that follow (a brand-new component's dir does
+    // not exist yet); each staged target's existence was already proven by the
+    // extraction, and the copies below run unconditionally.
+    for (const spec of fileDepSpecs) {
+        if (fs.existsSync(spec.linkPath))
+            continue;
+        const error = createResolutionLink(spec.linkPath, spec.target);
+        if (error)
+            return error;
     }
     return undefined;
 }
 async function doInlineFullUpdate(workspaceDir) {
-    const extDir = resolvePluginDir(workspaceDir);
+    const layout = resolveUpdateLayout();
+    if (!layout) {
+        return {
+            success: false,
+            message: 'PD install runtime could not be resolved.',
+            reason: 'install_runtime_missing',
+            nextAction: 'Run npx create-principles-disciple to install or repair PD, then retry the update.',
+            requiresRestart: false,
+        };
+    }
+    const extDir = layout.pluginDir;
     // Legacy-contract preflight BEFORE stopping the gateway or touching files:
     // refuse while an active rule still uses a removed RuleHost contract
     // symbol — the running installation stays exactly as it was.
@@ -716,23 +863,16 @@ async function doInlineFullUpdate(workspaceDir) {
             requiresRestart: false,
         };
     }
-    // 1. Stop gateway (releases native module locks held by the gateway process)
-    const gatewayStatus = await checkOpenClawGateway();
+    // gatewayWasStopped records whether we had to stop an OpenClaw gateway to
+    // release native module locks. It is only ever set after candidate
+    // verification, in the host-aware stop below.
     let gatewayWasStopped = false;
-    if (gatewayStatus.isRunning) {
-        const stopRes = stopOpenClawGateway();
-        if (stopRes.ok)
-            gatewayWasStopped = true;
-    }
-    // Capture version before changes
+    // Capture installed facts before staging any candidate release.
     const fromVersion = readCurrentVersion(extDir) ?? 'unknown';
     // Capture the installed skill language before the tarball's manifest
     // overwrites it (PR #1332 companion — see reapplySkillLanguage).
     const skillLanguage = detectInstalledSkillLanguage(extDir);
     let tempDir;
-    // Heal legacy installs: move old backups out of the extensions dir so
-    // OpenClaw discovery stops reporting a duplicate plugin (see pd-backups.ts).
-    logLegacyBackupMigration('pd-update-full');
     try {
         // 2. Fetch installer package info from npm
         const response = await fetchWithRetry(NPM_REGISTRY_INSTALLER, 'Installer registry check');
@@ -740,6 +880,32 @@ async function doInlineFullUpdate(workspaceDir) {
         if (!isRecord(rawData))
             return { success: false, message: 'Invalid registry response', requiresRestart: false };
         const toVersion = typeof rawData.version === 'string' ? rawData.version : undefined;
+        const bundledPluginVersion = isRecord(rawData.pd) && typeof rawData.pd.bundledPluginVersion === 'string'
+            ? rawData.pd.bundledPluginVersion
+            : undefined;
+        if (bundledPluginVersion !== undefined) {
+            const advancesInstalled = fromVersion !== 'unknown' &&
+                semver.valid(fromVersion) !== null &&
+                semver.valid(bundledPluginVersion) !== null &&
+                semver.gt(bundledPluginVersion, fromVersion);
+            if (!advancesInstalled) {
+                appendUpdateHistory(workspaceDir, {
+                    fromVersion,
+                    toVersion: bundledPluginVersion,
+                    success: false,
+                    kind: 'refusal',
+                    reason: 'installer_bundle_stale',
+                    nextAction: 'Wait for a newer installer release, then retry the update.',
+                });
+                return {
+                    success: false,
+                    message: 'Installed version would not advance — the update source is stale or malformed.',
+                    reason: 'installer_bundle_stale',
+                    nextAction: 'Wait for a newer installer release, then retry the update.',
+                    requiresRestart: false,
+                };
+            }
+        }
         const dist = isRecord(rawData.dist) ? rawData.dist : null;
         const tarball = dist && typeof dist.tarball === 'string' ? dist.tarball : undefined;
         if (!tarball)
@@ -754,10 +920,53 @@ async function doInlineFullUpdate(workspaceDir) {
         // shell syntax (Mimosa command-injection finding, 2026-08-22).
         execFileSync('tar', ['xzf', tarballPath, '-C', tempDir, '--strip-components=1'], { stdio: 'pipe' });
         fs.unlinkSync(tarballPath);
+        // The tarball, not the installer package version, is the release we are
+        // about to activate. Prove it advances the installed plugin BEFORE the
+        // gateway is stopped or any production file is copied.
+        const newPkgPath = path.join(tempDir, 'plugin', 'package.json');
+        const stagedVersion = readCurrentVersion(path.join(tempDir, 'plugin'));
+        const progressed = fromVersion !== 'unknown' &&
+            stagedVersion !== undefined &&
+            semver.valid(fromVersion) !== null &&
+            semver.valid(stagedVersion) !== null &&
+            semver.gt(stagedVersion, fromVersion) &&
+            (bundledPluginVersion === undefined || bundledPluginVersion === stagedVersion);
+        if (!progressed) {
+            if (tempDir && fs.existsSync(tempDir)) {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+            appendUpdateHistory(workspaceDir, {
+                fromVersion,
+                toVersion: stagedVersion ?? 'unknown',
+                success: false,
+                kind: 'refusal',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+            });
+            return {
+                success: false,
+                message: 'Installed version would not advance — the update source is stale or malformed.',
+                reason: 'installer_bundle_stale',
+                nextAction: 'Wait for a newer installer release, then retry the update.',
+                requiresRestart: false,
+            };
+        }
+        // Only a verified advancing release may cause host interruption or touch
+        // the production installation.
+        const gatewayStatus = layout.hosts.includes('openclaw')
+            ? await checkOpenClawGateway()
+            : { isRunning: false };
+        if (gatewayStatus.isRunning) {
+            const stopRes = stopOpenClawGateway();
+            if (stopRes.ok)
+                gatewayWasStopped = true;
+        }
+        // Heal legacy installs only after candidate verification. This writes
+        // outside the release tree, so it must not happen for a refused release.
+        logLegacyBackupMigration('pd-update-full');
         // 4. Detect dependency changes (informational — logged but not blocking;
         //    the .js files are still updated; node_modules stays as-is)
         let depsChanged = false;
-        const newPkgPath = path.join(tempDir, 'plugin', 'package.json');
         const oldPkgPath = path.join(extDir, 'package.json');
         if (fs.existsSync(newPkgPath) && fs.existsSync(oldPkgPath)) {
             try {
@@ -785,17 +994,22 @@ async function doInlineFullUpdate(workspaceDir) {
         //        console that does not import it, so skipping is consistent for
         //        them. On fresh installs this is an overlay refresh + link no-op.
         const hostRuntimeSrc = path.join(tempDir, 'host-runtime');
-        const hostRuntimeDest = path.join(extDir, 'host-runtime');
+        const hostRuntimeDest = layout.hostRuntimeDir;
         if (fs.existsSync(hostRuntimeSrc) &&
             fs.existsSync(path.join(hostRuntimeSrc, 'package.json')) &&
             fs.existsSync(path.join(hostRuntimeSrc, 'dist'))) {
             copyDirRecursive(hostRuntimeSrc, hostRuntimeDest, SKIP_DIRS);
-            const linkError = ensureHostRuntimeResolutionLinks(extDir);
+            const installLayoutSrc = path.join(tempDir, 'install-layout');
+            if (fs.existsSync(path.join(installLayoutSrc, 'package.json')) && fs.existsSync(path.join(installLayoutSrc, 'dist'))) {
+                copyDirRecursive(installLayoutSrc, layout.installLayoutDir, SKIP_DIRS);
+            }
+            const linkError = ensureRuntimeResolutionLinks(layout, tempDir);
             if (linkError) {
                 appendUpdateHistory(workspaceDir, {
                     fromVersion,
                     toVersion: 'failed',
                     success: false,
+                    kind: 'failure',
                 });
                 return {
                     success: false,
@@ -818,20 +1032,20 @@ async function doInlineFullUpdate(workspaceDir) {
         //       console/node_modules/ may contain locked native modules like
         //       better-sqlite3 that the running console process holds via dlopen)
         const consoleSrc = path.join(tempDir, 'console');
-        const consoleDest = path.join(extDir, 'console');
+        const consoleDest = layout.consoleDir;
         if (fs.existsSync(consoleSrc)) {
             copyDirRecursive(consoleSrc, consoleDest, SKIP_DIRS);
         }
         //    c. core/ → extDir/core/ (overwrite, skip node_modules for safety)
         const coreSrc = path.join(tempDir, 'core');
-        const coreDest = path.join(extDir, 'core');
+        const coreDest = layout.coreDir;
         if (fs.existsSync(coreSrc)) {
             copyDirRecursive(coreSrc, coreDest, SKIP_DIRS);
         }
         //    d. pd-cli/dist + package.json → extDir/pd-cli/ (overwrite only,
         //       do NOT rmSync — preserves node_modules symlinks created at install)
         const pdCliSrc = path.join(tempDir, 'pd-cli');
-        const pdCliDest = path.join(extDir, 'pd-cli');
+        const pdCliDest = layout.pdCliDir;
         if (fs.existsSync(pdCliSrc)) {
             const distSrc = path.join(pdCliSrc, 'dist');
             const distDest = path.join(pdCliDest, 'dist');
@@ -857,11 +1071,8 @@ async function doInlineFullUpdate(workspaceDir) {
         // false "update available". Detect that and fail loud (rc-9) instead of
         // reporting a false success.
         const newVersion = readCurrentVersion(extDir) ?? toVersion ?? 'unknown';
-        const progressed = fromVersion !== 'unknown' &&
-            semver.valid(fromVersion) !== null &&
-            semver.valid(newVersion) !== null &&
-            semver.gt(newVersion, fromVersion);
-        if (!progressed) {
+        const installedExpectedRelease = newVersion === stagedVersion;
+        if (!installedExpectedRelease) {
             // Files were already rewritten to the same (or lower) version. Record a
             // FAILED history entry so the operator sees why, and return a structured
             // error with nextAction.
@@ -869,6 +1080,7 @@ async function doInlineFullUpdate(workspaceDir) {
                 fromVersion,
                 toVersion: newVersion,
                 success: false,
+                kind: 'failure',
             });
             return {
                 success: false,
@@ -883,6 +1095,7 @@ async function doInlineFullUpdate(workspaceDir) {
             fromVersion,
             toVersion: newVersion,
             success: true,
+            kind: 'update',
         });
         return {
             success: true,
@@ -908,6 +1121,7 @@ async function doInlineFullUpdate(workspaceDir) {
             fromVersion,
             toVersion: 'failed',
             success: false,
+            kind: 'failure',
         });
         if (isLockError) {
             return {
@@ -990,6 +1204,14 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
             }
             // createBackup is a boolean (default false)
             const createBackup = typeof body.createBackup === 'boolean' ? body.createBackup : false;
+            // The Console updater owns only the installed PD runtime selected at
+            // process start. A caller-supplied path inside a workspace may be a
+            // development checkout; accepting it lets a registry package overwrite
+            // source files and makes version history describe the wrong product.
+            if (path.resolve(targetDir) !== path.resolve(pluginDir)) {
+                sendError(res, 400, 'update_target_not_installed', 'Updates may only target the installed PD runtime.', { nextAction: 'Run the official installer to repair the installation, then retry from Console.' });
+                return;
+            }
             // Path traversal validation
             if (!validatePathInWorkspace(targetDir, workspaceDir)) {
                 sendBadRequest(res, 'targetDir must be within workspace or extensions directory');