rigscope 0.1.1 → 0.1.3

package/dist/system.cjs

@@ -28,7 +28,6 @@ __export(system_exports, {
   RAPL_RULE_NAME: () => RAPL_RULE_NAME,
   STATE_FILE_NAME: () => STATE_FILE_NAME,
   SYSTEM_SCOPE: () => SYSTEM_SCOPE,
-  SYSTEM_STATE_FORMAT_VERSION: () => SYSTEM_STATE_FORMAT_VERSION,
   SYSUSERS_NAME: () => SYSUSERS_NAME,
   SystemError: () => SystemError,
   UNIT_NAMES: () => UNIT_NAMES,
@@ -73,6 +72,7 @@ __export(system_exports, {
   startSystem: () => startSystem,
   stateFilePath: () => stateFilePath,
   stopSystem: () => stopSystem,
+  systemStateIsLegacy: () => systemStateIsLegacy,
   systemStatus: () => systemStatus,
   systemdQuote: () => systemdQuote,
   sysusersPath: () => sysusersPath,
@@ -89,7 +89,7 @@ module.exports = __toCommonJS(system_exports);
 var import_node_fs3 = require("node:fs");
 var import_node_child_process = require("node:child_process");
 var import_node_crypto5 = require("node:crypto");
-var import_node_path3 = require("node:path");
+var import_node_path4 = require("node:path");
 var import_node_sqlite = require("node:sqlite");
 var import_node_util = require("node:util");
 
@@ -97,12 +97,12 @@ var import_node_util = require("node:util");
 var import_node_http = require("node:http");
 var MAX_HEALTH_BODY_BYTES = 64 * 1024;
 function probeHealth(target, timeoutMs = 3e3) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let settled = false;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve3(result);
+      resolve4(result);
     };
     const options = target.kind === "unix" ? { socketPath: target.socketPath, path: target.path, method: "GET", headers: { Host: target.hostHeader } } : { host: target.host, port: target.port, path: target.path, method: "GET" };
     let req;
@@ -185,7 +185,7 @@ function bounded(value, min, max) {
   return Math.min(max, Math.max(min, Number.isFinite(value) ? value : min));
 }
 function delay(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 function errorText(error) {
   return error instanceof Error ? error.message : String(error);
@@ -390,7 +390,6 @@ var ConfigError = class extends Error {
 var DEFAULT_COLLECTOR_ID = "mock-collector";
 var MOCK_HOSTNAME = "mock-machine";
 var CONNECT_PATH = "/api/collector/connect";
-var PREVIOUS_CONNECT_PATH = "/api/collector/v1/connect";
 var MAX_DESTINATIONS = 8;
 var DEFAULT_INTERVAL_MS = 1e3;
 var MIN_INTERVAL_MS = 100;
@@ -467,7 +466,6 @@ function validateHubUrl(raw, label, issues) {
     issues.push(`${label}: URL must include a host`);
     return null;
   }
-  if (parsed.pathname === PREVIOUS_CONNECT_PATH) parsed.pathname = CONNECT_PATH;
   if (parsed.pathname !== CONNECT_PATH) {
     issues.push(`${label}: path must be exactly ${CONNECT_PATH}`);
     return null;
@@ -634,18 +632,26 @@ var import_node_path2 = require("node:path");
 function readState(path) {
   const stat = (0, import_node_fs2.lstatSync)(path);
   if (!stat.isFile() || stat.size > 64 * 1024 || (stat.mode & 63) !== 0) throw new Error("collector state must be a private regular file");
-  const raw = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
-  if (raw.version !== 1 || typeof raw.collectorId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(raw.collectorId) || !Array.isArray(raw.destinations)) throw new Error("invalid collector state");
+  const parsed = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("invalid collector state");
+  const raw = parsed;
+  if (Object.hasOwn(raw, "version") || Object.hasOwn(raw, "formatVersion")) {
+    throw new Error("collector state uses an older versioned shape; run rigscope install or upgrade to reset it");
+  }
+  if (typeof raw.collectorId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(raw.collectorId) || !Array.isArray(raw.destinations)) throw new Error("invalid collector state");
   const destinations = raw.destinations.length === 0 ? [] : [...parseCollectorConfig({ COLLECTOR_HUBS: JSON.stringify(raw.destinations) }).destinations];
-  if (raw.pendingEnrollments !== void 0 && (!Array.isArray(raw.pendingEnrollments) || raw.pendingEnrollments.length > 8 || raw.pendingEnrollments.some((p) => !p || typeof p.url !== "string" || typeof p.requestId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(p.requestId) || typeof p.recoverySecret !== "string" || !/^[A-Za-z0-9_-]{32,128}$/.test(p.recoverySecret)))) throw new Error("invalid pending enrollment recovery state");
-  const pendingEnrollments = raw.pendingEnrollments?.map((pending) => {
+  const pending = raw.pendingEnrollments;
+  if (pending !== void 0 && (!Array.isArray(pending) || pending.length > 8 || pending.some((p) => !p || typeof p !== "object" || typeof p.url !== "string" || typeof p.requestId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(p.requestId) || typeof p.recoverySecret !== "string" || !/^[A-Za-z0-9_-]{32,128}$/.test(p.recoverySecret)))) {
+    throw new Error("invalid pending enrollment recovery state");
+  }
+  const pendingEnrollments = pending?.map((value) => {
+    const pendingEnrollment = value;
     const issues = [];
-    const url = validateHubUrl(pending.url, "pending enrollment", issues);
+    const url = validateHubUrl(pendingEnrollment.url, "pending enrollment", issues);
     if (!url || issues.length) throw new ConfigError(issues);
-    return { ...pending, url: url.href };
+    return { ...pendingEnrollment, url: url.href };
   });
   return {
-    version: 1,
     collectorId: raw.collectorId,
     destinations,
     ...pendingEnrollments === void 0 ? {} : { pendingEnrollments }
@@ -678,9 +684,14 @@ function updateInstallation(path, change = (s) => s) {
       state = readState(path);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
-      state = { version: 1, collectorId: (0, import_node_crypto3.randomUUID)(), destinations: [] };
+      state = { collectorId: (0, import_node_crypto3.randomUUID)(), destinations: [] };
     }
-    const next = change(state);
+    const changed = change(state);
+    const next = {
+      collectorId: changed.collectorId,
+      destinations: changed.destinations,
+      ...changed.pendingEnrollments === void 0 ? {} : { pendingEnrollments: changed.pendingEnrollments }
+    };
     temporary = `${path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
     const out = (0, import_node_fs2.openSync)(temporary, "wx", 384);
     try {
@@ -775,8 +786,241 @@ async function enrollCollector(path, connectUrl, enrollmentToken, sharing, repla
   }
 }
 
+// src/hub/config.ts
+var import_node_net = require("node:net");
+var import_node_path3 = require("node:path");
+var MAX_HUB_COLLECTORS_BYTES = 1024 * 1024;
+var MAX_COLLECTOR_ID_LENGTH = 128;
+var MAX_MACHINE_ID_LENGTH = 128;
+var MAX_TOKEN_LENGTH2 = 256;
+var MAX_UNIX_SOCKET_PATH_BYTES = 100;
+var MAX_PUBLIC_ORIGIN_LENGTH = 512;
+var HubConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HubConfigError";
+  }
+};
+function parseHubConfig(env) {
+  const development = env.NODE_ENV === "development";
+  const collectors = parseCollectors(env.HUB_COLLECTORS);
+  const publicOrigin = nonEmpty(env.HUB_PUBLIC_ORIGIN);
+  const socketPath = nonEmpty(env.HUB_SOCKET_PATH);
+  let maxCollectorConnections;
+  if (env.HUB_MAX_COLLECTOR_CONNECTIONS !== void 0) {
+    const value = env.HUB_MAX_COLLECTOR_CONNECTIONS;
+    const parsed = Number(value);
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(parsed) || parsed < 1) {
+      throw new HubConfigError("HUB_MAX_COLLECTOR_CONNECTIONS must be a positive safe integer");
+    }
+    maxCollectorConnections = parsed;
+  }
+  const connectionBudget = maxCollectorConnections === void 0 ? {} : { maxCollectorConnections };
+  if (publicOrigin === void 0 !== (socketPath === void 0)) {
+    throw new HubConfigError(
+      "HUB_PUBLIC_ORIGIN and HUB_SOCKET_PATH must be set together: remote mode needs both the exact HTTPS origin and the Unix socket path"
+    );
+  }
+  if (publicOrigin !== void 0 && socketPath !== void 0) {
+    if (nonEmpty(env.HUB_HOST) !== void 0 || nonEmpty(env.HUB_PORT) !== void 0) {
+      throw new HubConfigError(
+        "HUB_HOST/HUB_PORT are not valid in remote mode; the hub listens only on HUB_SOCKET_PATH"
+      );
+    }
+    return {
+      // Keep stable local defaults for callers that inspect these fields;
+      // main.ts never creates a TCP listener when `remote` is set.
+      host: "127.0.0.1",
+      port: 8081,
+      collectors,
+      development,
+      remote: parseRemoteConfig(publicOrigin, socketPath),
+      ...connectionBudget
+    };
+  }
+  return {
+    host: parseHost(env.HUB_HOST),
+    port: parsePort(env.HUB_PORT),
+    collectors,
+    development,
+    remote: null,
+    ...connectionBudget
+  };
+}
+function nonEmpty(value) {
+  return value === void 0 || value === "" ? void 0 : value;
+}
+function parsePublicOrigin(value) {
+  if (value.length > MAX_PUBLIC_ORIGIN_LENGTH) {
+    throw new HubConfigError(
+      `HUB_PUBLIC_ORIGIN must be at most ${MAX_PUBLIC_ORIGIN_LENGTH} characters`
+    );
+  }
+  if (!/^[\x21-\x7e]+$/.test(value)) {
+    throw new HubConfigError(
+      "HUB_PUBLIC_ORIGIN must be printable ASCII without spaces or control characters"
+    );
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new HubConfigError(
+      `HUB_PUBLIC_ORIGIN "${value}" is not a valid absolute origin`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new HubConfigError("HUB_PUBLIC_ORIGIN must use https://");
+  }
+  if (parsed.username !== "" || parsed.password !== "") {
+    throw new HubConfigError("HUB_PUBLIC_ORIGIN must not contain userinfo");
+  }
+  if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") {
+    throw new HubConfigError(
+      "HUB_PUBLIC_ORIGIN must be exactly scheme://host[:port] with no path, query, or fragment"
+    );
+  }
+  if (parsed.origin !== value) {
+    throw new HubConfigError(
+      `HUB_PUBLIC_ORIGIN must be canonical; use "${parsed.origin}"`
+    );
+  }
+  if (parsed.hostname.length === 0 || parsed.hostname.endsWith(".")) {
+    throw new HubConfigError("HUB_PUBLIC_ORIGIN must name a nonempty host");
+  }
+  if (parsed.host.length > 255) {
+    throw new HubConfigError("HUB_PUBLIC_ORIGIN host is too long");
+  }
+  if (parsed.port === "0") {
+    throw new HubConfigError("HUB_PUBLIC_ORIGIN must use a nonzero public port");
+  }
+  return {
+    publicOrigin: value,
+    hostHeader: parsed.host,
+    hostname: parsed.hostname,
+    port: parsed.port === "" ? 443 : Number(parsed.port)
+  };
+}
+function parseRemoteConfig(publicOrigin, socketPath) {
+  const origin = parsePublicOrigin(publicOrigin);
+  validateUnixSocketPathSyntax(socketPath);
+  return { ...origin, socketPath };
+}
+function validateUnixSocketPathSyntax(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new HubConfigError("HUB_SOCKET_PATH must be a nonempty absolute path");
+  }
+  if (Buffer.byteLength(value, "utf8") > MAX_UNIX_SOCKET_PATH_BYTES) {
+    throw new HubConfigError(
+      `HUB_SOCKET_PATH must be at most ${MAX_UNIX_SOCKET_PATH_BYTES} bytes for a Unix socket`
+    );
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw new HubConfigError(
+      "HUB_SOCKET_PATH must not contain NUL or control characters"
+    );
+  }
+  if (!(0, import_node_path3.isAbsolute)(value)) {
+    throw new HubConfigError("HUB_SOCKET_PATH must be an absolute path");
+  }
+  if (value !== (0, import_node_path3.resolve)(value)) {
+    throw new HubConfigError("HUB_SOCKET_PATH must be a normalized absolute path");
+  }
+  const name = (0, import_node_path3.basename)(value);
+  if (name === "" || name === "." || name === ".." || value === "/") {
+    throw new HubConfigError("HUB_SOCKET_PATH must name a socket file");
+  }
+}
+function parseHost(value) {
+  const host = value === void 0 || value === "" ? "127.0.0.1" : value;
+  if (typeof host !== "string" || host.length === 0 || host.length > 45) {
+    throw new HubConfigError(`HUB_HOST must be a literal loopback address`);
+  }
+  if (isIPv4Loopback(host)) return host;
+  if (host === "::1") return host;
+  throw new HubConfigError(
+    `HUB_HOST "${host}" is not a literal loopback address; only 127.0.0.0/8 and ::1 are allowed`
+  );
+}
+function isIPv4Loopback(host) {
+  if ((0, import_node_net.isIP)(host) !== 4) return false;
+  const parts = host.split(".");
+  if (parts[0] !== "127" || parts.length !== 4) return false;
+  return parts.every((part) => /^\d+$/.test(part) && Number(part) <= 255);
+}
+function parsePort(value) {
+  const text = value === void 0 || value === "" ? "8081" : value.trim();
+  if (!/^\d+$/.test(text)) {
+    throw new HubConfigError(`HUB_PORT must be a nonnegative integer, got "${text}"`);
+  }
+  const port = Number(text);
+  if (port > 65535) {
+    throw new HubConfigError(`HUB_PORT must be at most 65535, got ${text}`);
+  }
+  return port;
+}
+function parseCollectors(value) {
+  if (value === void 0 || value === "") return [];
+  if (Buffer.byteLength(value, "utf8") > MAX_HUB_COLLECTORS_BYTES) {
+    throw new HubConfigError(
+      `HUB_COLLECTORS must be at most ${MAX_HUB_COLLECTORS_BYTES} bytes`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new HubConfigError(`HUB_COLLECTORS is not valid JSON`);
+  }
+  if (!Array.isArray(parsed)) {
+    throw new HubConfigError(`HUB_COLLECTORS must be a JSON array`);
+  }
+  const collectors = [];
+  const ids = /* @__PURE__ */ new Set();
+  const machineIds = /* @__PURE__ */ new Set();
+  const tokens = /* @__PURE__ */ new Set();
+  for (const [index, item] of parsed.entries()) {
+    const message = `HUB_COLLECTORS[${index}]`;
+    if (item === null || typeof item !== "object" || Array.isArray(item)) {
+      throw new HubConfigError(`${message} must be an object`);
+    }
+    const record = item;
+    const keys = Object.keys(record).sort();
+    const expected = ["collectorId", "machineId", "token"].sort();
+    if (keys.length !== expected.length || keys.some((key, i) => key !== expected[i])) {
+      throw new HubConfigError(
+        `${message} must contain exactly collectorId, machineId, and token`
+      );
+    }
+    const collectorId = boundedString(record.collectorId, "collectorId", message, MAX_COLLECTOR_ID_LENGTH);
+    const machineId = boundedString(record.machineId, "machineId", message, MAX_MACHINE_ID_LENGTH);
+    const token = boundedString(record.token, "token", message, MAX_TOKEN_LENGTH2);
+    if (ids.has(collectorId)) {
+      throw new HubConfigError(`${message}: duplicate collectorId "${collectorId}"`);
+    }
+    if (machineIds.has(machineId)) {
+      throw new HubConfigError(`${message}: duplicate machineId "${machineId}"`);
+    }
+    if (tokens.has(token)) {
+      throw new HubConfigError(`${message}: duplicate token`);
+    }
+    ids.add(collectorId);
+    machineIds.add(machineId);
+    tokens.add(token);
+    collectors.push({ collectorId, machineId, token });
+  }
+  return collectors;
+}
+function boundedString(value, field, message, maxLength) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength) {
+    throw new HubConfigError(
+      `${message}: ${field} must be a nonempty string of at most ${maxLength} characters`
+    );
+  }
+  return value;
+}
+
 // src/cli/system.ts
-var SYSTEM_STATE_FORMAT_VERSION = 2;
 var SYSTEM_SCOPE = "system";
 var DEFAULT_SYSTEM_ACCOUNTS = {
   hub: "rigscope-hub",
@@ -788,6 +1032,7 @@ var UNIT_NAMES = {
   hub: "rigscope-hub.service",
   collector: "rigscope-collector.service"
 };
+var LEGACY_UNIT_NAMES = ["rigscope.service"];
 var RAPL_RULE_NAME = "90-rigscope-rapl.rules";
 var SYSUSERS_NAME = "rigscope.conf";
 var POWER_SYSUSERS_NAME = "rigscope-rapl.conf";
@@ -884,13 +1129,13 @@ function createSystemHost(overrides = {}) {
 }
 function defaultSystemPaths(overrides = {}) {
   return {
-    prefix: (0, import_node_path3.resolve)(overrides.prefix ?? "/opt/rigscope"),
-    configDir: (0, import_node_path3.resolve)(overrides.configDir ?? "/etc/rigscope"),
-    stateDir: (0, import_node_path3.resolve)(overrides.stateDir ?? "/var/lib/rigscope"),
-    unitsDir: (0, import_node_path3.resolve)(overrides.unitsDir ?? "/etc/systemd/system"),
-    sysusersDir: (0, import_node_path3.resolve)(overrides.sysusersDir ?? "/etc/sysusers.d"),
-    udevRulesDir: (0, import_node_path3.resolve)(overrides.udevRulesDir ?? "/etc/udev/rules.d"),
-    powercapRoot: (0, import_node_path3.resolve)(overrides.powercapRoot ?? "/sys/class/powercap")
+    prefix: (0, import_node_path4.resolve)(overrides.prefix ?? "/opt/rigscope"),
+    configDir: (0, import_node_path4.resolve)(overrides.configDir ?? "/etc/rigscope"),
+    stateDir: (0, import_node_path4.resolve)(overrides.stateDir ?? "/var/lib/rigscope"),
+    unitsDir: (0, import_node_path4.resolve)(overrides.unitsDir ?? "/etc/systemd/system"),
+    sysusersDir: (0, import_node_path4.resolve)(overrides.sysusersDir ?? "/etc/sysusers.d"),
+    udevRulesDir: (0, import_node_path4.resolve)(overrides.udevRulesDir ?? "/etc/udev/rules.d"),
+    powercapRoot: (0, import_node_path4.resolve)(overrides.powercapRoot ?? "/sys/class/powercap")
   };
 }
 function unitNamesFor(role) {
@@ -905,11 +1150,11 @@ function rolesFor(role) {
   return { hub: role !== "collector", collector: role !== "hub" };
 }
 function isWithin(parent, candidate) {
-  const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(parent), (0, import_node_path3.resolve)(candidate));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${import_node_path3.sep}`) && !(0, import_node_path3.isAbsolute)(rel);
+  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(parent), (0, import_node_path4.resolve)(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${import_node_path4.sep}`) && !(0, import_node_path4.isAbsolute)(rel);
 }
 function ensureAbsolute(path, label) {
-  const absolute = (0, import_node_path3.resolve)(path);
+  const absolute = (0, import_node_path4.resolve)(path);
   if (/[\0\r\n]/.test(absolute)) throw new SystemError("unsafe-path", `${label} contains control characters`);
   if (absolute === "/") throw new SystemError("unsafe-path", `${label} must not be the filesystem root`);
   for (const forbidden of ["/home", "/root", "/proc", "/sys", "/dev", "/boot"]) {
@@ -923,7 +1168,7 @@ function validateSystemPaths(input = {}) {
   const paths = defaultSystemPaths(input);
   for (const [label, value] of Object.entries(paths)) {
     if (label === "powercapRoot") {
-      if (!(0, import_node_path3.isAbsolute)(value) || /[\0\r\n]/.test(value) || (0, import_node_path3.resolve)(value) === "/") {
+      if (!(0, import_node_path4.isAbsolute)(value) || /[\0\r\n]/.test(value) || (0, import_node_path4.resolve)(value) === "/") {
         throw new SystemError("unsafe-path", `powercap root is unsafe: ${value}`);
       }
     } else {
@@ -982,8 +1227,8 @@ function sha256File(path) {
   return (0, import_node_crypto5.createHash)("sha256").update((0, import_node_fs3.readFileSync)(path)).digest("hex");
 }
 function atomicWrite(path, content, mode) {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true, mode: 493 });
-  const temporary = (0, import_node_path3.join)((0, import_node_path3.dirname)(path), `.${(0, import_node_path3.basename)(path)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true, mode: 493 });
+  const temporary = (0, import_node_path4.join)((0, import_node_path4.dirname)(path), `.${(0, import_node_path4.basename)(path)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
   try {
     (0, import_node_fs3.writeFileSync)(temporary, content, { mode });
     (0, import_node_fs3.chmodSync)(temporary, mode);
@@ -1115,38 +1360,39 @@ function connectDestinationUrl(value) {
   }
   if (url.search !== "" || url.hash !== "") throw new SystemError("invalid-url", "Hub URLs must not contain a query or fragment.");
   if (url.hostname === "localhost") url.hostname = "127.0.0.1";
-  if (url.pathname === "/") url.pathname = "/api/collector/connect";
+  if (url.pathname === "/") url.pathname = CONNECT_PATH;
+  if (url.pathname !== CONNECT_PATH) throw new SystemError("invalid-url", `Collector endpoint must be ${CONNECT_PATH}.`);
   return url.href;
 }
 function hubDatabasePath(paths) {
-  return (0, import_node_path3.join)(paths.stateDir, "hub", "telemetry.sqlite");
+  return (0, import_node_path4.join)(paths.stateDir, "hub", "telemetry.sqlite");
 }
 function hubEnrollmentPath(paths) {
-  return (0, import_node_path3.join)(paths.stateDir, "hub", "enrollment.json");
+  return (0, import_node_path4.join)(paths.stateDir, "hub", "enrollment.json");
 }
 function hubSocketPath(paths) {
-  return (0, import_node_path3.join)(paths.stateDir, "hub", "run", "hub.sock");
+  return (0, import_node_path4.join)(paths.stateDir, "hub", "run", "hub.sock");
 }
 function collectorStatePath(paths) {
-  return (0, import_node_path3.join)(paths.stateDir, "collector", "state.json");
+  return (0, import_node_path4.join)(paths.stateDir, "collector", "state.json");
 }
 function hubEnvPath(paths) {
-  return (0, import_node_path3.join)(paths.configDir, "hub.env");
+  return (0, import_node_path4.join)(paths.configDir, "hub.env");
 }
 function collectorEnvPath(paths) {
-  return (0, import_node_path3.join)(paths.configDir, "collector.env");
+  return (0, import_node_path4.join)(paths.configDir, "collector.env");
 }
 function sysusersPath(paths) {
-  return (0, import_node_path3.join)(paths.sysusersDir, SYSUSERS_NAME);
+  return (0, import_node_path4.join)(paths.sysusersDir, SYSUSERS_NAME);
 }
 function powerSysusersPath(paths) {
-  return (0, import_node_path3.join)(paths.sysusersDir, POWER_SYSUSERS_NAME);
+  return (0, import_node_path4.join)(paths.sysusersDir, POWER_SYSUSERS_NAME);
 }
 function raplRulePath(paths) {
-  return (0, import_node_path3.join)(paths.udevRulesDir, RAPL_RULE_NAME);
+  return (0, import_node_path4.join)(paths.udevRulesDir, RAPL_RULE_NAME);
 }
 function stateFilePath(paths) {
-  return (0, import_node_path3.join)(paths.stateDir, STATE_FILE_NAME);
+  return (0, import_node_path4.join)(paths.stateDir, STATE_FILE_NAME);
 }
 function readCollectorIdentity(path) {
   if (!(0, import_node_fs3.existsSync)(path)) return null;
@@ -1161,7 +1407,10 @@ function readCollectorIdentity(path) {
   }
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new SystemError("invalid-file", `${path} is invalid`);
   const record = raw;
-  if (record.version !== void 0 && record.version !== 1 || typeof record.collectorId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(record.collectorId) || !Array.isArray(record.destinations)) {
+  if (Object.prototype.hasOwnProperty.call(record, "version") || Object.prototype.hasOwnProperty.call(record, "formatVersion")) {
+    throw new SystemError("invalid-file", `${path} is pre-canonical; reinstall or reset collector state`);
+  }
+  if (typeof record.collectorId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(record.collectorId) || !Array.isArray(record.destinations)) {
     throw new SystemError("invalid-file", `${path} is not a collector installation state`);
   }
   const destinations = [];
@@ -1173,16 +1422,20 @@ function readCollectorIdentity(path) {
     if (typeof destination.url !== "string" || typeof destination.token !== "string" || destination.token === "") {
       throw new SystemError("invalid-file", `${path} contains an invalid destination`);
     }
+    const issues = [];
+    if (!validateHubUrl(destination.url, "saved collector destination", issues)) {
+      throw new SystemError("invalid-file", `${path} contains an incompatible collector endpoint; reset or reinstall it`);
+    }
     destinations.push({
       url: destination.url,
       token: destination.token,
       ...destination.sharing !== null && typeof destination.sharing === "object" && !Array.isArray(destination.sharing) ? { sharing: destination.sharing } : {}
     });
   }
-  return { version: 1, collectorId: record.collectorId, destinations };
+  return { collectorId: record.collectorId, destinations };
 }
 function writeCollectorIdentity(path, identity) {
-  ensureDirectory((0, import_node_path3.dirname)(path), 448, true);
+  ensureDirectory((0, import_node_path4.dirname)(path), 448, true);
   atomicWrite(path, `${JSON.stringify(identity)}
 `, 384);
 }
@@ -1355,22 +1608,20 @@ async function pairCollectorWithHub(options) {
       note: "the local hub has no reachable loopback or HTTPS destination"
     };
   }
-  if (!(0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, UNIT_NAMES.hub))) {
+  if (!(0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, UNIT_NAMES.hub))) {
     return { paired: false, awaiting: true, hubWasActive: false, note: "the local hub unit is not installed" };
   }
   const hubWasActive = systemdActive(host, UNIT_NAMES.hub);
   if (hubWasActive) {
     if (existing !== null) {
-      writeCollectorIdentity(collectorStatePath(paths), existing);
       const registered = findCollectorInHubDatabase(paths, existing.collectorId);
       if (registered !== null) {
         const adopted = {
-          version: 1,
           collectorId: existing.collectorId,
           destinations: [{ url: destination.url, token: registered.token, sharing: { ...SYSTEM_DEFAULT_SHARING } }]
         };
         writeCollectorIdentity(collectorStatePath(paths), adopted);
-        chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+        chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
         return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
       }
     }
@@ -1378,7 +1629,7 @@ async function pairCollectorWithHub(options) {
     try {
       grant = createLocalEnrollmentGrant(paths, host);
     } catch (error) {
-      chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+      chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
       return {
         paired: false,
         awaiting: true,
@@ -1396,12 +1647,12 @@ async function pairCollectorWithHub(options) {
         note: `enrollment through the live hub failed: ${error instanceof Error ? error.message : String(error)}`
       };
     } finally {
-      chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+      chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
     }
     if (!collectorConfigured(paths).configured) {
       return { paired: false, awaiting: true, hubWasActive, note: "the hub accepted enrollment but no destination was saved" };
     }
-    chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+    chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
     return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
   }
   const identity = {
@@ -1425,7 +1676,7 @@ async function pairCollectorWithHub(options) {
       }
     }
   }
-  const next = existing ?? { version: 1, collectorId: identity.collectorId, destinations: [] };
+  const next = existing ?? { collectorId: identity.collectorId, destinations: [] };
   next.destinations = [
     {
       url: destination.url,
@@ -1434,7 +1685,7 @@ async function pairCollectorWithHub(options) {
     }
   ];
   writeCollectorIdentity(collectorStatePath(paths), next);
-  chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+  chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
   return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
 }
 function unitCommon(name, description, paths, account, envPath, execStart, extraService = []) {
@@ -1451,7 +1702,7 @@ function unitCommon(name, description, paths, account, envPath, execStart, extra
     "Type=simple",
     `User=${account}`,
     `Group=${account}`,
-    `WorkingDirectory=${(0, import_node_path3.join)(paths.prefix, "current").replace(/%/g, "%%")}`,
+    `WorkingDirectory=${(0, import_node_path4.join)(paths.prefix, "current").replace(/%/g, "%%")}`,
     `EnvironmentFile=${envPath.replace(/%/g, "%%")}`,
     "Environment=NODE_ENV=production",
     "Restart=on-failure",
@@ -1486,13 +1737,13 @@ function unitCommon(name, description, paths, account, envPath, execStart, extra
 }
 function renderSystemHubUnit(options) {
   const { paths, accounts } = options;
-  const hubScript = (0, import_node_path3.join)(paths.prefix, "current", "dist", "hub.cjs");
+  const hubScript = (0, import_node_path4.join)(paths.prefix, "current", "dist", "hub.cjs");
   const extra = [
     `Environment=${systemdQuote(`HUB_DATABASE_PATH=${options.database}`)}`,
     `Environment=${systemdQuote(`HUB_STATE_FILE=${options.enrollment}`)}`,
     ...options.remote ? [`Environment=${systemdQuote(`HUB_SOCKET_PATH=${options.socket}`)}`] : [],
-    `ReadWritePaths=${systemdQuote((0, import_node_path3.join)(paths.stateDir, "hub"))}`,
-    `ReadOnlyPaths=${systemdQuote((0, import_node_path3.join)(paths.prefix, "current"))}`,
+    `ReadWritePaths=${systemdQuote((0, import_node_path4.join)(paths.stateDir, "hub"))}`,
+    `ReadOnlyPaths=${systemdQuote((0, import_node_path4.join)(paths.prefix, "current"))}`,
     "PrivateDevices=yes",
     "TimeoutStopSec=15s"
   ];
@@ -1511,14 +1762,14 @@ function renderSystemHubUnit(options) {
 }
 function renderSystemCollectorUnit(options) {
   const { paths, accounts } = options;
-  const collectorScript = (0, import_node_path3.join)(paths.prefix, "current", "dist", "collector.cjs");
+  const collectorScript = (0, import_node_path4.join)(paths.prefix, "current", "dist", "collector.cjs");
   const extra = [
     ...options.powerAccess ? [`SupplementaryGroups=${accounts.powerGroup}`] : [],
     `Environment=${systemdQuote(`COLLECTOR_MODE=real`)}`,
     `Environment=${systemdQuote(`COLLECTOR_STATE_FILE=${options.collectorState}`)}`,
-    `Environment=${systemdQuote(`COLLECTOR_HEALTH_FILE=${(0, import_node_path3.join)(paths.stateDir, "collector", "health.json")}`)}`,
-    `ReadWritePaths=${systemdQuote((0, import_node_path3.join)(paths.stateDir, "collector"))}`,
-    `ReadOnlyPaths=${systemdQuote((0, import_node_path3.join)(paths.prefix, "current"))}`,
+    `Environment=${systemdQuote(`COLLECTOR_HEALTH_FILE=${(0, import_node_path4.join)(paths.stateDir, "collector", "health.json")}`)}`,
+    `ReadWritePaths=${systemdQuote((0, import_node_path4.join)(paths.stateDir, "collector"))}`,
+    `ReadOnlyPaths=${systemdQuote((0, import_node_path4.join)(paths.prefix, "current"))}`,
     "TimeoutStopSec=10s"
   ];
   return [
@@ -1621,6 +1872,12 @@ function readJsonObject(path) {
   }
   return value;
 }
+function isCanonicalComponents(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const enabled = (entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry) && typeof entry.enabled === "boolean";
+  return enabled(record.hub) && enabled(record.collector);
+}
 function readSystemState(paths) {
   const path = stateFilePath(paths);
   if (!(0, import_node_fs3.existsSync)(path)) return null;
@@ -1628,7 +1885,7 @@ function readSystemState(paths) {
   if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("unsafe-path", `${path} must be a regular file`);
   if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `${path} must be 0600`);
   const raw = readJsonObject(path);
-  if (raw.formatVersion !== 1 && raw.formatVersion !== SYSTEM_STATE_FORMAT_VERSION || raw.scope !== SYSTEM_SCOPE) {
+  if (raw.scope !== SYSTEM_SCOPE) {
     throw new SystemError("invalid-state", `${path} is not a Rigscope system installation state`);
   }
   const savedPaths = raw.paths;
@@ -1640,24 +1897,40 @@ function readSystemState(paths) {
   if (raw.role !== "local" && raw.role !== "hub" && raw.role !== "collector") {
     throw new SystemError("invalid-state", "system installation state has an invalid role");
   }
-  let components;
-  if (raw.formatVersion === 1) {
-    const mapped = componentsForRole(raw.role);
-    components = { hub: { enabled: mapped.hub }, collector: { enabled: mapped.collector } };
-  } else {
-    const saved = raw.components;
-    if (saved === null || typeof saved !== "object" || saved.hub === null || saved.collector === null || typeof saved.hub !== "object" || typeof saved.collector !== "object" || typeof saved.hub.enabled !== "boolean" || typeof saved.collector.enabled !== "boolean") {
-      throw new SystemError("invalid-state", "system installation state has invalid component enabled state");
-    }
-    components = { hub: { enabled: saved.hub.enabled }, collector: { enabled: saved.collector.enabled } };
+  const saved = raw.components;
+  if (!isCanonicalComponents(saved)) {
+    throw new SystemError("invalid-state", "system installation state has invalid component enabled state");
   }
+  if (Object.prototype.hasOwnProperty.call(raw, "formatVersion")) {
+    throw new SystemError("invalid-state", "system installation state has an obsolete format version; reinstall or upgrade to reset it");
+  }
+  const components = { hub: { enabled: saved.hub.enabled }, collector: { enabled: saved.collector.enabled } };
   return {
     ...raw,
-    formatVersion: SYSTEM_STATE_FORMAT_VERSION,
     accounts,
     components
   };
 }
+function systemStateIsLegacy(paths) {
+  const path = stateFilePath(paths);
+  if (!(0, import_node_fs3.existsSync)(path)) return false;
+  let raw;
+  try {
+    raw = readJsonObject(path);
+  } catch {
+    return false;
+  }
+  if (Object.prototype.hasOwnProperty.call(raw, "formatVersion")) return true;
+  return !isCanonicalComponents(raw.components);
+}
+function legacySystemRole(paths) {
+  try {
+    const raw = readJsonObject(stateFilePath(paths));
+    if (raw.role === "local" || raw.role === "hub" || raw.role === "collector") return raw.role;
+  } catch {
+  }
+  return "local";
+}
 function writeSystemState(paths, state) {
   ensureDirectory(paths.stateDir, 493, false);
   atomicWrite(stateFilePath(paths), `${JSON.stringify({ ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
@@ -1667,7 +1940,6 @@ function emptyState(options) {
   const timestamp = new Date(options.now()).toISOString();
   const components = options.components ?? componentsForRole(options.role);
   return {
-    formatVersion: SYSTEM_STATE_FORMAT_VERSION,
     scope: SYSTEM_SCOPE,
     role: options.role,
     active: true,
@@ -1692,17 +1964,21 @@ function validateVersion(value) {
   return value;
 }
 function releaseVersion(root) {
-  return validateVersion(readJsonObject((0, import_node_path3.join)(root, "package.json")).version);
+  const metadata = readJsonObject((0, import_node_path4.join)(root, "package.json"));
+  if (Object.hasOwn(metadata, "rigscopeConfigVersion")) {
+    throw new SystemError("invalid-release", "release uses unfinished configuration metadata; select a canonical release");
+  }
+  return validateVersion(metadata.version);
 }
 function releaseSchemaVersion(root) {
-  const manifestPath = (0, import_node_path3.join)(root, "manifest.json");
+  const manifestPath = (0, import_node_path4.join)(root, "manifest.json");
   if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
   const manifest = readJsonObject(manifestPath);
   return Number.isSafeInteger(manifest.schemaVersion) ? Number(manifest.schemaVersion) : null;
 }
 function assertReleaseArtifacts(root) {
   for (const artifact of REQUIRED_ARTIFACTS) {
-    const path = (0, import_node_path3.join)(root, artifact);
+    const path = (0, import_node_path4.join)(root, artifact);
     let stat;
     try {
       stat = (0, import_node_fs3.lstatSync)(path);
@@ -1713,12 +1989,12 @@ function assertReleaseArtifacts(root) {
       throw new SystemError("invalid-artifact", `release artifact is not a non-empty regular file: ${artifact}`);
     }
   }
-  const buildId = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(root, ".next", "BUILD_ID"), "utf8").trim();
+  const buildId = (0, import_node_fs3.readFileSync)((0, import_node_path4.join)(root, ".next", "BUILD_ID"), "utf8").trim();
   if (buildId === "" || /\s/.test(buildId)) throw new SystemError("invalid-artifact", ".next/BUILD_ID is invalid");
   for (const directory of [".next/server", ".next/static"]) {
     let stat;
     try {
-      stat = (0, import_node_fs3.lstatSync)((0, import_node_path3.join)(root, directory));
+      stat = (0, import_node_fs3.lstatSync)((0, import_node_path4.join)(root, directory));
     } catch {
       throw new SystemError("missing-artifact", `release is missing ${directory}/`);
     }
@@ -1726,10 +2002,10 @@ function assertReleaseArtifacts(root) {
   }
 }
 function verifyReleaseManifest(root) {
-  const manifestPath = (0, import_node_path3.join)(root, "manifest.json");
+  const manifestPath = (0, import_node_path4.join)(root, "manifest.json");
   if (!(0, import_node_fs3.existsSync)(manifestPath)) return;
   const manifest = readJsonObject(manifestPath);
-  const packageJson = readJsonObject((0, import_node_path3.join)(root, "package.json"));
+  const packageJson = readJsonObject((0, import_node_path4.join)(root, "package.json"));
   if (manifest.name !== void 0 && manifest.name !== packageJson.name) {
     throw new SystemError("manifest-mismatch", "release manifest name does not match package.json");
   }
@@ -1748,7 +2024,7 @@ function verifyReleaseManifest(root) {
     if (typeof relativePath !== "string" || relativePath === "" || relativePath.startsWith("/") || relativePath.includes("\\") || relativePath.split("/").includes("..")) {
       throw new SystemError("invalid-manifest", `release manifest contains an unsafe path: ${String(relativePath)}`);
     }
-    const absolute = (0, import_node_path3.join)(root, relativePath);
+    const absolute = (0, import_node_path4.join)(root, relativePath);
     const stat = (0, import_node_fs3.lstatSync)(absolute);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("invalid-manifest", `release artifact is not a regular file: ${relativePath}`);
     if (entry.bytes !== stat.size) throw new SystemError("artifact-mismatch", `release artifact size changed: ${relativePath}`);
@@ -1757,8 +2033,8 @@ function verifyReleaseManifest(root) {
   }
   const visit = (current) => {
     for (const entry of (0, import_node_fs3.readdirSync)(current, { withFileTypes: true })) {
-      const absolute = (0, import_node_path3.join)(current, entry.name);
-      const rel = (0, import_node_path3.relative)(root, absolute).split(import_node_path3.sep).join("/");
+      const absolute = (0, import_node_path4.join)(current, entry.name);
+      const rel = (0, import_node_path4.relative)(root, absolute).split(import_node_path4.sep).join("/");
       if (rel === "node_modules" || rel.startsWith("node_modules/") || rel === ".next/cache" || rel.startsWith(".next/cache/")) continue;
       if (entry.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${rel}`);
       if (entry.isDirectory()) {
@@ -1774,30 +2050,30 @@ function verifyReleaseManifest(root) {
 function assertNoSymlinks(root) {
   const visit = (path) => {
     const stat = (0, import_node_fs3.lstatSync)(path);
-    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${(0, import_node_path3.relative)(root, path)}`);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${(0, import_node_path4.relative)(root, path)}`);
     if (!stat.isDirectory()) return;
-    for (const entry of (0, import_node_fs3.readdirSync)(path)) visit((0, import_node_path3.join)(path, entry));
+    for (const entry of (0, import_node_fs3.readdirSync)(path)) visit((0, import_node_path4.join)(path, entry));
   };
   visit(root);
 }
 function copyReleaseTree(source, destination) {
   const visit = (current, target) => {
     const stat = (0, import_node_fs3.lstatSync)(current);
-    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${(0, import_node_path3.relative)(source, current)}`);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${(0, import_node_path4.relative)(source, current)}`);
     if (stat.isDirectory()) {
       (0, import_node_fs3.mkdirSync)(target, { recursive: true, mode: 493 });
       for (const entry of (0, import_node_fs3.readdirSync)(current)) {
-        const child = (0, import_node_path3.join)(current, entry);
-        const rel = (0, import_node_path3.relative)(source, child);
+        const child = (0, import_node_path4.join)(current, entry);
+        const rel = (0, import_node_path4.relative)(source, child);
         if (rel === ".git" || rel === ".next-dev" || rel === ".next/cache" || rel === "node_modules" || rel.startsWith("node_modules/")) {
           continue;
         }
-        visit(child, (0, import_node_path3.join)(target, entry));
+        visit(child, (0, import_node_path4.join)(target, entry));
       }
       return;
     }
-    if (!stat.isFile()) throw new SystemError("unsafe-release", `source contains a non-regular file: ${(0, import_node_path3.relative)(source, current)}`);
-    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(target), { recursive: true, mode: 493 });
+    if (!stat.isFile()) throw new SystemError("unsafe-release", `source contains a non-regular file: ${(0, import_node_path4.relative)(source, current)}`);
+    (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(target), { recursive: true, mode: 493 });
     (0, import_node_fs3.copyFileSync)(current, target);
     (0, import_node_fs3.chmodSync)(target, 420);
   };
@@ -1807,8 +2083,8 @@ function copyReleaseAllowlisted(source, destination) {
   for (const entry of (0, import_node_fs3.readdirSync)(source)) {
     if (!PACKAGE_TOP_LEVEL.has(entry)) continue;
     if (entry === "node_modules") continue;
-    const child = (0, import_node_path3.join)(source, entry);
-    const target = (0, import_node_path3.join)(destination, entry);
+    const child = (0, import_node_path4.join)(source, entry);
+    const target = (0, import_node_path4.join)(destination, entry);
     const stat = (0, import_node_fs3.lstatSync)(child);
     if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${entry}`);
     if (stat.isDirectory()) {
@@ -1848,59 +2124,102 @@ function extractArchive(archive, stage, host) {
   runRequired(host, "tar", args, "archive extraction");
   assertNoSymlinks(stage);
 }
+function discardStagedRelease(staged) {
+  if (staged === null) return;
+  (0, import_node_fs3.rmSync)(staged.stageDir, { recursive: true, force: true });
+}
+function releaseTargetDir(paths, version) {
+  return (0, import_node_path4.join)(paths.prefix, "releases", version);
+}
+function assertReleaseTargetAvailable(paths, releaseDir, replaceRelease) {
+  if (!(0, import_node_fs3.existsSync)(releaseDir)) return;
+  const current = currentReleaseDir(paths);
+  const previous = previousReleaseDir(paths);
+  if (!replaceRelease || current === releaseDir || previous === releaseDir) {
+    throw new SystemError(
+      "release-exists",
+      `release ${(0, import_node_path4.basename)(releaseDir)} is already installed${current === releaseDir || previous === releaseDir ? " or retained" : ""}; choose a new version`
+    );
+  }
+}
 function stageRelease(options) {
-  const source = (0, import_node_path3.resolve)(options.source);
+  const source = (0, import_node_fs3.realpathSync)((0, import_node_path4.resolve)(options.source));
   const stat = (0, import_node_fs3.lstatSync)(source);
-  const releasesDir = (0, import_node_path3.join)(options.paths.prefix, "releases");
-  ensureDirectory(releasesDir, 493);
-  const stage = (0, import_node_path3.join)(releasesDir, `.stage-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  (0, import_node_fs3.mkdirSync)(stage, { recursive: true, mode: 448 });
+  ensureDirectory(options.paths.prefix, 493);
+  const stageDir = (0, import_node_path4.join)(options.paths.prefix, `.stage-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  (0, import_node_fs3.mkdirSync)(stageDir, { recursive: true, mode: 448 });
   try {
     if (stat.isDirectory() && !stat.isSymbolicLink()) {
-      copyReleaseAllowlisted(source, stage);
+      copyReleaseAllowlisted(source, stageDir);
     } else if (stat.isFile() && !stat.isSymbolicLink()) {
-      extractArchive(source, stage, options.host);
+      extractArchive(source, stageDir, options.host);
     } else {
       throw new SystemError("invalid-source", "release source must be a directory or .tar.gz archive");
     }
-    assertReleaseArtifacts(stage);
-    verifyReleaseManifest(stage);
-    const version = releaseVersion(stage);
-    const releaseDir = (0, import_node_path3.join)(releasesDir, version);
-    if ((0, import_node_fs3.existsSync)(releaseDir)) {
-      const current = currentReleaseDir(options.paths);
-      const previous = previousReleaseDir(options.paths);
-      if (!options.replaceRelease || current === releaseDir || previous === releaseDir) {
-        throw new SystemError(
-          "release-exists",
-          `release ${version} is already installed${current === releaseDir || previous === releaseDir ? " or retained" : ""}; choose a new version`
-        );
-      }
-      (0, import_node_fs3.rmSync)(releaseDir, { recursive: true, force: true });
+    assertReleaseArtifacts(stageDir);
+    verifyReleaseManifest(stageDir);
+    return {
+      version: releaseVersion(stageDir),
+      stageDir,
+      schemaVersion: releaseSchemaVersion(stageDir),
+      artifacts: [...REQUIRED_ARTIFACTS]
+    };
+  } catch (error) {
+    (0, import_node_fs3.rmSync)(stageDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+function prepareStagedRelease(options) {
+  const staged = stageRelease(options);
+  try {
+    if (options.installDeps === true) {
+      installDependencies(staged.stageDir, options.host, options.installDepsCommand ?? "npm");
     }
-    (0, import_node_fs3.renameSync)(stage, releaseDir);
-    ensureDirectory((0, import_node_path3.join)(releaseDir, ".next", "cache"), 493);
-    return { version, releaseDir, schemaVersion: releaseSchemaVersion(releaseDir), artifacts: [...REQUIRED_ARTIFACTS] };
+    const missing = missingDependencies(staged.stageDir);
+    if (missing.length > 0) {
+      throw new SystemError(
+        "missing-dependencies",
+        `production dependencies are missing (${missing.join(", ")}); stage with --install-deps or use a built release directory`
+      );
+    }
+    chmodTree(staged.stageDir, options.host);
+    runRequired(options.host, "chown", ["-R", "root:root", staged.stageDir], "release ownership");
+    return staged;
   } catch (error) {
-    (0, import_node_fs3.rmSync)(stage, { recursive: true, force: true });
+    discardStagedRelease(staged);
     throw error;
   }
 }
+function commitStagedRelease(options) {
+  const releasesDir = (0, import_node_path4.join)(options.paths.prefix, "releases");
+  ensureDirectory(releasesDir, 493);
+  const releaseDir = releaseTargetDir(options.paths, options.staged.version);
+  assertReleaseTargetAvailable(options.paths, releaseDir, options.replaceRelease);
+  if ((0, import_node_fs3.existsSync)(releaseDir)) (0, import_node_fs3.rmSync)(releaseDir, { recursive: true, force: true });
+  (0, import_node_fs3.renameSync)(options.staged.stageDir, releaseDir);
+  ensureDirectory((0, import_node_path4.join)(releaseDir, ".next", "cache"), 493);
+  return {
+    version: options.staged.version,
+    releaseDir,
+    schemaVersion: options.staged.schemaVersion,
+    artifacts: options.staged.artifacts
+  };
+}
 function dependencyNames(root) {
-  const pkg = readJsonObject((0, import_node_path3.join)(root, "package.json"));
+  const pkg = readJsonObject((0, import_node_path4.join)(root, "package.json"));
   const dependencies = pkg.dependencies;
   if (dependencies === null || typeof dependencies !== "object" || Array.isArray(dependencies)) return [];
   return Object.keys(dependencies).filter((name) => /^[A-Za-z0-9@/._-]+$/.test(name));
 }
 function missingDependencies(root) {
-  return dependencyNames(root).filter((name) => !(0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, "node_modules", name, "package.json")));
+  return dependencyNames(root).filter((name) => !(0, import_node_fs3.existsSync)((0, import_node_path4.join)(root, "node_modules", name, "package.json")));
 }
 function installDependencies(root, host, command = "npm") {
-  const hasLock = (0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, "package-lock.json"));
+  const hasLock = (0, import_node_fs3.existsSync)((0, import_node_path4.join)(root, "package-lock.json"));
   const args = hasLock ? ["ci", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"];
-  const siblingNpm = (0, import_node_path3.join)((0, import_node_path3.dirname)(process.execPath), "npm");
+  const siblingNpm = (0, import_node_path4.join)((0, import_node_path4.dirname)(process.execPath), "npm");
   const executable = command === "npm" && (0, import_node_fs3.existsSync)(siblingNpm) ? siblingNpm : command;
-  const nodeBin = (0, import_node_path3.dirname)(process.execPath);
+  const nodeBin = (0, import_node_path4.dirname)(process.execPath);
   const path = [nodeBin, process.env.PATH ?? ""].filter(Boolean).join(":");
   runRequired(host, executable, args, "production dependency installation", {
     cwd: root,
@@ -1909,21 +2228,21 @@ function installDependencies(root, host, command = "npm") {
   });
 }
 function currentReleaseDir(paths) {
-  const link = (0, import_node_path3.join)(paths.prefix, "current");
+  const link = (0, import_node_path4.join)(paths.prefix, "current");
   try {
     const target = (0, import_node_fs3.readlinkSync)(link);
-    const absolute = (0, import_node_path3.isAbsolute)(target) ? target : (0, import_node_path3.resolve)(paths.prefix, target);
-    return isWithin((0, import_node_path3.join)(paths.prefix, "releases"), absolute) ? absolute : null;
+    const absolute = (0, import_node_path4.isAbsolute)(target) ? target : (0, import_node_path4.resolve)(paths.prefix, target);
+    return isWithin((0, import_node_path4.join)(paths.prefix, "releases"), absolute) ? absolute : null;
   } catch {
     return null;
   }
 }
 function previousReleaseDir(paths) {
-  const link = (0, import_node_path3.join)(paths.prefix, "previous");
+  const link = (0, import_node_path4.join)(paths.prefix, "previous");
   try {
     const target = (0, import_node_fs3.readlinkSync)(link);
-    const absolute = (0, import_node_path3.isAbsolute)(target) ? target : (0, import_node_path3.resolve)(paths.prefix, target);
-    return isWithin((0, import_node_path3.join)(paths.prefix, "releases"), absolute) ? absolute : null;
+    const absolute = (0, import_node_path4.isAbsolute)(target) ? target : (0, import_node_path4.resolve)(paths.prefix, target);
+    return isWithin((0, import_node_path4.join)(paths.prefix, "releases"), absolute) ? absolute : null;
   } catch {
     return null;
   }
@@ -1958,15 +2277,16 @@ function nodeVersion(host, nodePath) {
   return output;
 }
 function ensureRootOwnedNode(options) {
-  const selected = (0, import_node_path3.resolve)(options.nodePath ?? process.execPath);
+  const selected = (0, import_node_path4.resolve)(options.nodePath ?? process.execPath);
   const real = (0, import_node_fs3.realpathSync)(selected);
   nodeVersion(options.host, real);
   const stat = (0, import_node_fs3.statSync)(real);
-  const unsafe = stat.uid !== 0 || (stat.mode & 18) !== 0 || options.copyNode === true;
+  const insideRelease = isWithin((0, import_node_path4.join)(options.paths.prefix, "releases"), real);
+  const unsafe = stat.uid !== 0 || (stat.mode & 18) !== 0 || options.copyNode === true || insideRelease;
   if (!unsafe || options.trustedNode === true) return real;
-  const target = (0, import_node_path3.join)(options.paths.prefix, "node", "node");
+  const target = (0, import_node_path4.join)(options.paths.prefix, "node", "node");
   if (!options.apply) return target;
-  ensureDirectory((0, import_node_path3.join)(options.paths.prefix, "node"), 493);
+  ensureDirectory((0, import_node_path4.join)(options.paths.prefix, "node"), 493);
   (0, import_node_fs3.copyFileSync)(real, target);
   (0, import_node_fs3.chmodSync)(target, 493);
   runRequired(options.host, "chown", ["root:root", target], "node ownership");
@@ -1989,60 +2309,44 @@ function normalizedJsonArray(value, label) {
 function validatedOrigin(value) {
   if (value === void 0 || value === null || value === "") return void 0;
   if (typeof value !== "string") throw new SystemError("invalid-adoption", "adopted hub origin is not a URL");
-  let parsed;
   try {
-    parsed = new URL(value);
+    parsePublicOrigin(value);
   } catch {
-    throw new SystemError("invalid-adoption", "adopted hub origin is not a URL");
+    throw new SystemError("invalid-adoption", "adopted hub origin must be an exact HTTPS origin");
   }
-  if (parsed.protocol !== "https:") throw new SystemError("invalid-adoption", "adopted hub origin must be https");
   return value;
 }
-function hasCollectorIdentity(source) {
-  return (0, import_node_fs3.existsSync)((0, import_node_path3.join)(source, "collector", "state.json")) || (0, import_node_fs3.existsSync)((0, import_node_path3.join)(source, "collector", "collector.json"));
-}
 function readAdoptionSetup(source) {
-  const modernPath = (0, import_node_path3.join)(source, "config.json");
-  const legacyPath = (0, import_node_path3.join)(source, "hub-config.json");
-  if ((0, import_node_fs3.existsSync)(modernPath)) {
-    assertPrivateSourceFile(modernPath, "adopted setup");
-    const setup = readJsonObject(modernPath);
-    const role = setup.role;
-    if (setup.version !== 1 || typeof role !== "string" || !["local", "hub", "collector"].includes(role)) {
-      throw new SystemError("invalid-adoption", "adopted setup version or role is incompatible");
-    }
-    const port = Number(setup.port ?? 8081);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-adoption", "adopted hub port is invalid");
-    return {
-      role,
-      port,
-      origin: validatedOrigin(setup.origin),
-      usersJson: normalizedJsonArray(setup.users, "HUB_BROWSER_USERS"),
-      collectorsJson: normalizedJsonArray(setup.collectors, "HUB_COLLECTORS"),
-      maxConnections: Number.isSafeInteger(setup.maxCollectorConnections) ? Number(setup.maxCollectorConnections) : void 0,
-      legacy: false
-    };
+  const configPath = (0, import_node_path4.join)(source, "config.json");
+  if (!(0, import_node_fs3.existsSync)(configPath)) {
+    throw new SystemError("invalid-adoption", "adopted installation has no config.json");
   }
-  if ((0, import_node_fs3.existsSync)(legacyPath)) {
-    assertPrivateSourceFile(legacyPath, "adopted hub configuration");
-    const legacy = readJsonObject(legacyPath);
-    const hasHub = ["HUB_PUBLIC_ORIGIN", "HUB_BROWSER_USERS", "HUB_DATABASE_PATH", "HUB_HOST", "HUB_PORT"].some((key) => key in legacy);
-    const hasCollector = hasCollectorIdentity(source);
-    if (!hasHub && !hasCollector) throw new SystemError("invalid-adoption", "adopted configuration is neither a hub nor a collector setup");
-    return {
-      role: hasHub && hasCollector ? "local" : hasHub ? "hub" : "collector",
-      port: Number(legacy.HUB_PORT ?? 8081),
-      origin: validatedOrigin(legacy.HUB_PUBLIC_ORIGIN),
-      usersJson: normalizedJsonArray(legacy.HUB_BROWSER_USERS, "HUB_BROWSER_USERS"),
-      collectorsJson: normalizedJsonArray(legacy.HUB_COLLECTORS, "HUB_COLLECTORS"),
-      maxConnections: Number.isSafeInteger(Number(legacy.HUB_MAX_COLLECTOR_CONNECTIONS)) ? Number(legacy.HUB_MAX_COLLECTOR_CONNECTIONS) : void 0,
-      legacy: true
-    };
+  assertPrivateSourceFile(configPath, "adopted setup");
+  const setup = readJsonObject(configPath);
+  if (Object.prototype.hasOwnProperty.call(setup, "version") || Object.prototype.hasOwnProperty.call(setup, "formatVersion")) {
+    throw new SystemError("invalid-adoption", "adopted setup is pre-canonical; reset or reinstall it before adoption");
+  }
+  const role = setup.role;
+  if (typeof role !== "string" || !["local", "hub", "collector"].includes(role)) {
+    throw new SystemError("invalid-adoption", "adopted setup role is incompatible");
   }
-  if (hasCollectorIdentity(source) && (0, import_node_fs3.existsSync)((0, import_node_path3.join)(source, "collector"))) {
-    return { role: "collector", port: 8081, legacy: true };
+  const port = Number(setup.port);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-adoption", "adopted hub port is invalid");
+  if (!Array.isArray(setup.users) || !Array.isArray(setup.collectors)) {
+    throw new SystemError("invalid-adoption", "adopted setup must contain users and collectors arrays");
+  }
+  if (!isCanonicalComponents(setup.components)) {
+    throw new SystemError("invalid-adoption", "adopted setup has an invalid component enabled state");
   }
-  throw new SystemError("invalid-adoption", "adopted installation has no config.json or hub-config.json");
+  return {
+    role,
+    components: componentSet({ hub: setup.components.hub.enabled, collector: setup.components.collector.enabled }),
+    port,
+    origin: validatedOrigin(setup.origin),
+    usersJson: normalizedJsonArray(setup.users, "HUB_BROWSER_USERS"),
+    collectorsJson: normalizedJsonArray(setup.collectors, "HUB_COLLECTORS"),
+    maxConnections: Number.isSafeInteger(setup.maxCollectorConnections) ? Number(setup.maxCollectorConnections) : void 0
+  };
 }
 function resolveRole(options) {
   const role = options.role ?? "local";
@@ -2063,7 +2367,7 @@ function detectUserInstallations(options = {}) {
   const found = [];
   for (const homeRoot of roots) {
     if (!(0, import_node_fs3.existsSync)(homeRoot)) continue;
-    const homes = homeRoot === "/root" ? ["/root"] : (0, import_node_fs3.readdirSync)(homeRoot).map((entry) => (0, import_node_path3.join)(homeRoot, entry));
+    const homes = homeRoot === "/root" ? ["/root"] : (0, import_node_fs3.readdirSync)(homeRoot).map((entry) => (0, import_node_path4.join)(homeRoot, entry));
     for (const home of homes) {
       let stat;
       try {
@@ -2072,7 +2376,7 @@ function detectUserInstallations(options = {}) {
         continue;
       }
       if (!stat.isDirectory()) continue;
-      const unitDir = (0, import_node_path3.join)(home, ".config", "systemd", "user");
+      const unitDir = (0, import_node_path4.join)(home, ".config", "systemd", "user");
       let units = [];
       try {
         units = (0, import_node_fs3.readdirSync)(unitDir);
@@ -2081,16 +2385,16 @@ function detectUserInstallations(options = {}) {
       }
       for (const unitName of units) {
         if (!/^rigscope(?:-[0-9a-f]{12})?(?:-(?:hub|collector))?\.service$/.test(unitName)) continue;
-        const unitPath = (0, import_node_path3.join)(unitDir, unitName);
+        const unitPath = (0, import_node_path4.join)(unitDir, unitName);
         let execStart = null;
         try {
           const line = (0, import_node_fs3.readFileSync)(unitPath, "utf8").split("\n").find((item) => item.startsWith("ExecStart="));
           execStart = line ? line.slice("ExecStart=".length) : null;
         } catch {
         }
-        const stateCandidates = [(0, import_node_path3.join)(home, ".local", "state", "rigscope")];
+        const stateCandidates = [(0, import_node_path4.join)(home, ".local", "state", "rigscope")];
         const stateDir = stateCandidates.find((candidate) => (0, import_node_fs3.existsSync)(candidate)) ?? null;
-        found.push({ user: (0, import_node_path3.basename)(home), home, unitPath, unitName, execStart, stateDir });
+        found.push({ user: (0, import_node_path4.basename)(home), home, unitPath, unitName, execStart, stateDir });
       }
     }
   }
@@ -2118,9 +2422,9 @@ function lockIsLive(path) {
 }
 function directoryLocks(directory) {
   return [
-    (0, import_node_path3.join)(directory, "hub", "telemetry.sqlite.hub.lock"),
-    (0, import_node_path3.join)(directory, "run", "rigscope.lock"),
-    (0, import_node_path3.join)(directory, "collector", "collector-runtime.lock")
+    (0, import_node_path4.join)(directory, "hub", "telemetry.sqlite.hub.lock"),
+    (0, import_node_path4.join)(directory, "run", "rigscope.lock"),
+    (0, import_node_path4.join)(directory, "collector", "collector-runtime.lock")
   ];
 }
 function assertDirectoryStopped(directory, scope = "local") {
@@ -2151,7 +2455,7 @@ function assertSystemStartAllowed(paths, components) {
 }
 function detectPowerDriver(moduleRoot = "/sys/module") {
   const candidates = ["intel_rapl_msr", "intel_rapl_common", "intel_rapl_tpmi", "intel_rapl", "amd_energy"];
-  return candidates.filter((name) => (0, import_node_fs3.existsSync)((0, import_node_path3.join)(moduleRoot, name)));
+  return candidates.filter((name) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(moduleRoot, name)));
 }
 function readPasswd(path = "/etc/passwd") {
   const users = /* @__PURE__ */ new Map();
@@ -2224,15 +2528,15 @@ function inspectPowerAccess(options = {}) {
     entries = [];
   }
   for (const entry of entries.filter((name) => /^intel-rapl:\d+$/.test(name)).sort()) {
-    const domainPath = (0, import_node_path3.join)(paths.powercapRoot, entry);
+    const domainPath = (0, import_node_path4.join)(paths.powercapRoot, entry);
     let name = entry;
     try {
-      name = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(domainPath, "name"), "utf8").trim() || entry;
+      name = (0, import_node_fs3.readFileSync)((0, import_node_path4.join)(domainPath, "name"), "utf8").trim() || entry;
     } catch {
     }
     if (!/^package/.test(name)) continue;
-    const energyPath = (0, import_node_path3.join)(domainPath, "energy_uj");
-    const maxRangePath = (0, import_node_path3.join)(domainPath, "max_energy_range_uj");
+    const energyPath = (0, import_node_path4.join)(domainPath, "energy_uj");
+    const maxRangePath = (0, import_node_path4.join)(domainPath, "max_energy_range_uj");
     const readStat = (path) => {
       if (options.statOverride) {
         const override = options.statOverride(path);
@@ -2301,7 +2605,7 @@ function inspectPowerAccess(options = {}) {
   };
 }
 async function backupDatabase(source, output, host) {
-  ensureDirectory((0, import_node_path3.dirname)(output), 448, true);
+  ensureDirectory((0, import_node_path4.dirname)(output), 448, true);
   const db = new import_node_sqlite.DatabaseSync(source, { readOnly: true, timeout: 5e3 });
   try {
     await (0, import_node_sqlite.backup)(db, output);
@@ -2338,11 +2642,11 @@ function replaceDatabaseFromBackup(backupPath, target, safetyBackup, host) {
   } finally {
     backup.close();
   }
-  ensureDirectory((0, import_node_path3.dirname)(target), 448, true);
+  ensureDirectory((0, import_node_path4.dirname)(target), 448, true);
   if (safetyBackup !== null && (0, import_node_fs3.existsSync)(target)) {
     void host;
   }
-  const temporary = (0, import_node_path3.join)((0, import_node_path3.dirname)(target), `.restore-${process.pid}-${Date.now()}.sqlite`);
+  const temporary = (0, import_node_path4.join)((0, import_node_path4.dirname)(target), `.restore-${process.pid}-${Date.now()}.sqlite`);
   (0, import_node_fs3.copyFileSync)(backupPath, temporary);
   (0, import_node_fs3.chmodSync)(temporary, 384);
   for (const sidecar of [`${target}-wal`, `${target}-shm`]) {
@@ -2358,7 +2662,7 @@ function newestTimestamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function adoptUserState(options) {
-  const source = (0, import_node_path3.resolve)(options.source);
+  const source = (0, import_node_path4.resolve)(options.source);
   if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("invalid-adoption", `user installation does not exist: ${source}`);
   if (isWithin(options.paths.prefix, source) || isWithin(options.paths.stateDir, source) || isWithin(source, options.paths.stateDir)) {
     throw new SystemError("invalid-adoption", "adoption source and system paths must not overlap");
@@ -2368,6 +2672,28 @@ function adoptUserState(options) {
   if (setup.role !== options.role && setup.role !== "local") throw new SystemError("invalid-adoption", "adopted setup role is incompatible");
   const { port, origin } = setup;
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-adoption", "adopted hub port is invalid");
+  if (options.role !== "collector") {
+    const sourceDatabase = (0, import_node_path4.join)(source, "hub", "telemetry.sqlite");
+    if ((0, import_node_fs3.existsSync)(sourceDatabase)) {
+      assertPrivateSourceFile(sourceDatabase, "adopted database");
+      const database = new import_node_sqlite.DatabaseSync(sourceDatabase, { readOnly: true });
+      try {
+        const row = database.prepare("PRAGMA integrity_check").get();
+        if (!row || Object.values(row)[0] !== "ok") throw new SystemError("invalid-adoption", "adopted database failed its integrity check");
+      } finally {
+        database.close();
+      }
+    }
+    const sourceEnrollment = (0, import_node_path4.join)(source, "hub", "enrollment.json");
+    if ((0, import_node_fs3.existsSync)(sourceEnrollment)) assertPrivateSourceFile(sourceEnrollment, "adopted enrollment");
+  }
+  if (options.role !== "hub") {
+    const sourceCollectorState = (0, import_node_path4.join)(source, "collector", "state.json");
+    if ((0, import_node_fs3.existsSync)(sourceCollectorState)) {
+      assertPrivateSourceFile(sourceCollectorState, "adopted collector state");
+      readCollectorIdentity(sourceCollectorState);
+    }
+  }
   const copied = [];
   const warnings = [];
   const targetDatabase = hubDatabasePath(options.paths);
@@ -2413,12 +2739,12 @@ function copyAdoptedTree(source, target, copied, skipLocks = true) {
     if (stat.isSymbolicLink()) return;
     if (stat.isDirectory()) {
       (0, import_node_fs3.mkdirSync)(destination, { recursive: true, mode: 448 });
-      for (const entry of (0, import_node_fs3.readdirSync)(current)) visit((0, import_node_path3.join)(current, entry), (0, import_node_path3.join)(destination, entry));
+      for (const entry of (0, import_node_fs3.readdirSync)(current)) visit((0, import_node_path4.join)(current, entry), (0, import_node_path4.join)(destination, entry));
       return;
     }
     if (!stat.isFile()) return;
     if (skipLocks && /\.(lock|sock)$/.test(current)) return;
-    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(destination), { recursive: true, mode: 448 });
+    (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(destination), { recursive: true, mode: 448 });
     (0, import_node_fs3.copyFileSync)(current, destination);
     (0, import_node_fs3.chmodSync)(destination, 384);
     copied.push({ source: current, target: destination, sha256: sha256File(destination), bytes: stat.size });
@@ -2429,10 +2755,10 @@ async function performAdoptionCopyAsync(options) {
   const { source, paths, role, host, copy } = options;
   assertDirectoryStopped(source, role);
   const targetDatabase = hubDatabasePath(paths);
-  const sourceDatabase = (0, import_node_path3.join)(source, "hub", "telemetry.sqlite");
+  const sourceDatabase = (0, import_node_path4.join)(source, "hub", "telemetry.sqlite");
   if (role !== "collector" && (0, import_node_fs3.existsSync)(sourceDatabase) && !(0, import_node_fs3.existsSync)(targetDatabase)) {
     assertPrivateSourceFile(sourceDatabase, "adopted database");
-    ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub"), 448, true);
+    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub"), 448, true);
     await backupDatabase(sourceDatabase, targetDatabase, host);
     copy.record.files.push({
       source: sourceDatabase,
@@ -2441,13 +2767,10 @@ async function performAdoptionCopyAsync(options) {
       bytes: (0, import_node_fs3.statSync)(targetDatabase).size
     });
   }
-  const sourceCollectorState = [
-    (0, import_node_path3.join)(source, "collector", "state.json"),
-    (0, import_node_path3.join)(source, "collector", "collector.json")
-  ].find((candidate) => (0, import_node_fs3.existsSync)(candidate));
-  if (role !== "hub" && sourceCollectorState) {
+  const sourceCollectorState = (0, import_node_path4.join)(source, "collector", "state.json");
+  if (role !== "hub" && (0, import_node_fs3.existsSync)(sourceCollectorState)) {
     assertPrivateSourceFile(sourceCollectorState, "adopted collector state");
-    ensureDirectory((0, import_node_path3.join)(paths.stateDir, "collector"), 448, true);
+    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "collector"), 448, true);
     const targetCollector = collectorStatePath(paths);
     (0, import_node_fs3.copyFileSync)(sourceCollectorState, targetCollector);
     (0, import_node_fs3.chmodSync)(targetCollector, 384);
@@ -2457,10 +2780,10 @@ async function performAdoptionCopyAsync(options) {
       sha256: sha256File(targetCollector),
       bytes: (0, import_node_fs3.statSync)(targetCollector).size
     });
-    const outbox = (0, import_node_path3.join)(source, "collector", "outbox");
-    if ((0, import_node_fs3.existsSync)(outbox)) copyAdoptedTree(outbox, (0, import_node_path3.join)(paths.stateDir, "collector", "outbox"), copy.record.files);
+    const outbox = (0, import_node_path4.join)(source, "collector", "outbox");
+    if ((0, import_node_fs3.existsSync)(outbox)) copyAdoptedTree(outbox, (0, import_node_path4.join)(paths.stateDir, "collector", "outbox"), copy.record.files);
   }
-  const enrollment = (0, import_node_path3.join)(source, "hub", "enrollment.json");
+  const enrollment = (0, import_node_path4.join)(source, "hub", "enrollment.json");
   if (role !== "collector" && (0, import_node_fs3.existsSync)(enrollment)) {
     const target = hubEnrollmentPath(paths);
     (0, import_node_fs3.copyFileSync)(enrollment, target);
@@ -2505,13 +2828,13 @@ function writePowerRule(paths, accounts) {
   writeManagedFile(raplRulePath(paths), renderRaplRule(accounts), 420, true);
 }
 function powerOriginalPath(paths) {
-  return (0, import_node_path3.join)(paths.stateDir, POWER_STATE_FILE_NAME);
+  return (0, import_node_path4.join)(paths.stateDir, POWER_STATE_FILE_NAME);
 }
 function capturePowerOriginals(paths) {
   const files = {};
   for (const domain of packageDomainPaths(paths.powercapRoot)) {
     for (const name of ["energy_uj", "max_energy_range_uj"]) {
-      const path = (0, import_node_path3.join)(domain, name);
+      const path = (0, import_node_path4.join)(domain, name);
       try {
         const stat = (0, import_node_fs3.statSync)(path);
         files[path] = { mode: stat.mode & 511, uid: stat.uid, gid: stat.gid };
@@ -2525,7 +2848,7 @@ function capturePowerOriginals(paths) {
 function applyPowerAccess(paths, accounts, host) {
   for (const domain of packageDomainPaths(paths.powercapRoot)) {
     for (const name of ["energy_uj", "max_energy_range_uj"]) {
-      const path = (0, import_node_path3.join)(domain, name);
+      const path = (0, import_node_path4.join)(domain, name);
       if (!(0, import_node_fs3.existsSync)(path)) continue;
       runRequired(host, "chgrp", [accounts.powerGroup, path], `power counter group ${path}`);
       runRequired(host, "chmod", ["0440", path], `power counter mode ${path}`);
@@ -2539,9 +2862,9 @@ function resumePowerRule(paths, host) {
 }
 function packageDomainPaths(root) {
   try {
-    return (0, import_node_fs3.readdirSync)(root).filter((entry) => /^intel-rapl:\d+$/.test(entry)).map((entry) => (0, import_node_path3.join)(root, entry)).filter((path) => {
+    return (0, import_node_fs3.readdirSync)(root).filter((entry) => /^intel-rapl:\d+$/.test(entry)).map((entry) => (0, import_node_path4.join)(root, entry)).filter((path) => {
       try {
-        return /^package/.test((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(path, "name"), "utf8").trim());
+        return /^package/.test((0, import_node_fs3.readFileSync)((0, import_node_path4.join)(path, "name"), "utf8").trim());
       } catch {
         return false;
       }
@@ -2561,7 +2884,7 @@ function restorePowerOriginals(paths, host) {
   const files = { ...originals?.files ?? {} };
   for (const domain of packageDomainPaths(paths.powercapRoot)) {
     for (const name of ["energy_uj", "max_energy_range_uj"]) {
-      const path = (0, import_node_path3.join)(domain, name);
+      const path = (0, import_node_path4.join)(domain, name);
       if (!(0, import_node_fs3.existsSync)(path)) continue;
       const original = files[path];
       if (original) {
@@ -2601,6 +2924,10 @@ function stopUnits(host, units) {
   }
   if (units.some((unit) => systemdActive(host, unit))) throw new SystemError("service-active", "system services did not stop; no files were restored");
 }
+function unitsForCleanup(paths, host) {
+  const legacy = LEGACY_UNIT_NAMES.filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, unit)) || systemdActive(host, unit));
+  return [...Object.values(UNIT_NAMES), ...legacy];
+}
 function startUnits(host, units) {
   runRequired(host, "systemctl", ["daemon-reload"], "systemd daemon-reload");
   for (const unit of units) runRequired(host, "systemctl", ["start", unit], `starting ${unit}`);
@@ -2636,7 +2963,7 @@ async function verifySystemHealth(paths, state, host, timeoutMs, components = en
     const report = runRequired(
       host,
       state.nodePath,
-      [(0, import_node_path3.join)(paths.prefix, "current/dist/ops.cjs"), "inspect", "--database", hubDatabasePath(paths), "--json"],
+      [(0, import_node_path4.join)(paths.prefix, "current/dist/ops.cjs"), "inspect", "--database", hubDatabasePath(paths), "--json"],
       "activated database verification",
       { timeoutMs: Math.max(100, deadline - Date.now()) }
     );
@@ -2652,8 +2979,8 @@ async function verifySystemHealth(paths, state, host, timeoutMs, components = en
     let problem = "no sampling marker";
     while (Date.now() < deadline) {
       try {
-        const marker = readJsonObject((0, import_node_path3.join)(paths.stateDir, "collector/health.json"));
-        const lease = readJsonObject((0, import_node_path3.join)(paths.stateDir, "collector/collector-runtime.lock"));
+        const marker = readJsonObject((0, import_node_path4.join)(paths.stateDir, "collector/health.json"));
+        const lease = readJsonObject((0, import_node_path4.join)(paths.stateDir, "collector/collector-runtime.lock"));
         if (marker.pid !== lease.pid || !Number.isSafeInteger(marker.pid)) throw new Error("sampling marker belongs to another process");
         process.kill(Number(marker.pid), 0);
         if (marker.version !== state.currentVersion || !Number.isFinite(marker.sampledAt) || Date.now() - Number(marker.sampledAt) > 15e3) throw new Error("collector version or sampling freshness is wrong");
@@ -2661,7 +2988,7 @@ async function verifySystemHealth(paths, state, host, timeoutMs, components = en
       } catch (error) {
         problem = error instanceof Error ? error.message : String(error);
       }
-      await new Promise((resolve3) => setTimeout(resolve3, 100));
+      await new Promise((resolve4) => setTimeout(resolve4, 100));
     }
     throw new SystemError("collector-unready", `system collector did not sample: ${problem}`);
   }
@@ -2684,9 +3011,9 @@ function pickRollbackBackup(state, previousSchema) {
 async function recoverFailedUpgrade(options) {
   stopUnits(options.host, options.units);
   assertDirectoryStopped(options.paths.stateDir);
-  replaceSymlink((0, import_node_path3.join)(options.paths.prefix, "current"), options.oldCurrent, options.host);
-  if (options.oldPrevious === null) removeSymlink((0, import_node_path3.join)(options.paths.prefix, "previous"));
-  else replaceSymlink((0, import_node_path3.join)(options.paths.prefix, "previous"), options.oldPrevious, options.host);
+  replaceSymlink((0, import_node_path4.join)(options.paths.prefix, "current"), options.oldCurrent, options.host);
+  if (options.oldPrevious === null) removeSymlink((0, import_node_path4.join)(options.paths.prefix, "previous"));
+  else replaceSymlink((0, import_node_path4.join)(options.paths.prefix, "previous"), options.oldPrevious, options.host);
   const database = hubDatabasePath(options.paths);
   let afterSchema = null;
   try {
@@ -2695,12 +3022,12 @@ async function recoverFailedUpgrade(options) {
     afterSchema = null;
   }
   if (options.backupPath !== null && (0, import_node_fs3.existsSync)(options.backupPath) && (afterSchema === null || options.beforeSchema === null || afterSchema > options.beforeSchema)) {
-    await backupDatabase(database, (0, import_node_path3.join)(options.paths.stateDir, "backups", `failed-upgrade-${newestTimestamp()}.sqlite`), options.host);
+    await backupDatabase(database, (0, import_node_path4.join)(options.paths.stateDir, "backups", `failed-upgrade-${newestTimestamp()}.sqlite`), options.host);
     replaceDatabaseFromBackup(options.backupPath, database, null, options.host);
     runRequired(options.host, "chown", [`${options.state.accounts.hub}:${options.state.accounts.hub}`, database], "restored database ownership");
   }
-  options.state.previousVersion = options.oldPrevious === null ? null : (0, import_node_path3.basename)(options.oldPrevious);
-  options.state.currentVersion = (0, import_node_path3.basename)(options.oldCurrent);
+  options.state.previousVersion = options.oldPrevious === null ? null : (0, import_node_path4.basename)(options.oldPrevious);
+  options.state.currentVersion = (0, import_node_path4.basename)(options.oldCurrent);
   writeSystemState(options.paths, options.state);
   if (options.activeComponents.length > 0) {
     startUnits(options.host, options.units);
@@ -2716,7 +3043,7 @@ function assertManagedFileOwnership(paths, path) {
   if ((stat.mode & 18) !== 0) throw new SystemError("insecure-permissions", `${path} must not be group/world-writable`);
 }
 function writeUnitFile(paths, unit, content, replace) {
-  const path = (0, import_node_path3.join)(paths.unitsDir, unit);
+  const path = (0, import_node_path4.join)(paths.unitsDir, unit);
   assertManagedFileOwnership(paths, path);
   writeManagedFile(path, content, 420, replace);
 }
@@ -2731,10 +3058,10 @@ function ensureComponentSetup(options) {
   ensureDirectory(paths.configDir, 493);
   ensureDirectory(paths.stateDir, 493);
   ensureDirectory(paths.unitsDir, 493);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub"), 448, true);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub", "run"), 448, true);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "collector"), 448, true);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
+  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub"), 448, true);
+  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub", "run"), 448, true);
+  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "collector"), 448, true);
+  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
   const release = currentReleaseOrThrow(paths);
   void release;
   writeSysusersFiles(paths, accounts, "local", power, host);
@@ -2743,7 +3070,7 @@ function ensureComponentSetup(options) {
       const env = hubEnvTemplate(paths);
       writeManagedFile(hubEnvPath(paths), env, 384, false);
     }
-    if (!(0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, UNIT_NAMES.hub))) {
+    if (!(0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, UNIT_NAMES.hub))) {
       const env = readHubEnvironment(paths);
       const remote = env.HUB_PUBLIC_ORIGIN !== void 0 && env.HUB_PUBLIC_ORIGIN !== "";
       const unit = renderSystemHubUnit({
@@ -2776,14 +3103,14 @@ function ensureComponentSetup(options) {
   const validation = runRequired(
     host,
     "systemd-analyze",
-    ["verify", "--man=no", (0, import_node_path3.join)(paths.unitsDir, unitFor(component))],
+    ["verify", "--man=no", (0, import_node_path4.join)(paths.unitsDir, unitFor(component))],
     "native systemd unit validation"
   );
   if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
     throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
   }
-  if (component === "hub") chownAccount([(0, import_node_path3.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
-  if (component === "collector") chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+  if (component === "hub") chownAccount([(0, import_node_path4.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
+  if (component === "collector") chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
 }
 function ensurePowerAccess(paths, accounts, host) {
   if (!(0, import_node_fs3.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
@@ -2791,19 +3118,36 @@ function ensurePowerAccess(paths, accounts, host) {
   resumePowerRule(paths, host);
   applyPowerAccess(paths, accounts, host);
 }
+function resetUnfinishedSystemState(options) {
+  uninstallSystem({
+    apply: true,
+    paths: options.paths,
+    host: options.host,
+    purgeData: true,
+    confirmPurgeHistory: true,
+    preserveNode: true,
+    now: options.now
+  });
+}
+function installPreset(options, role) {
+  if (options.adoptFrom !== void 0) {
+    return componentSet(readAdoptionSetup((0, import_node_path4.resolve)(options.adoptFrom)).components);
+  }
+  return componentsForRole(role);
+}
 function planSystemInstall(options) {
   const paths = validateSystemPaths(options.paths);
   const accounts = validateAccounts(options.accounts);
   const role = resolveRole(options);
-  const preset = componentSet(componentsForRole(role));
+  const preset = componentSet(installPreset(options, role));
   const power = options.power !== false && preset.collector;
   const initial = options.enable === true ? preset : { hub: false, collector: false };
   const files = [
-    { path: (0, import_node_path3.join)(paths.prefix, "current"), mode: "symlink", purpose: "active root-owned release" },
+    { path: (0, import_node_path4.join)(paths.prefix, "current"), mode: "symlink", purpose: "active root-owned release" },
     { path: hubEnvPath(paths), mode: "0600", purpose: "root-owned hub configuration" },
     { path: collectorEnvPath(paths), mode: "0600", purpose: "root-owned collector configuration" },
     { path: sysusersPath(paths), mode: "0644", purpose: "dedicated nologin accounts" },
-    ...COMPONENTS.map((component) => ({ path: (0, import_node_path3.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }))
+    ...COMPONENTS.map((component) => ({ path: (0, import_node_path4.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }))
   ];
   if (power) {
     files.push({ path: raplRulePath(paths), mode: "0644", purpose: "package RAPL read rule" });
@@ -2818,7 +3162,7 @@ function planSystemInstall(options) {
   ];
   const notes = [
     "Nothing is changed without --apply and root.",
-    options.adoptFrom ? `Adopts ${(0, import_node_path3.resolve)(options.adoptFrom)} by copy only; the original user setup is preserved.` : "Existing user services are not modified.",
+    options.adoptFrom ? `Adopts ${(0, import_node_path4.resolve)(options.adoptFrom)} by copy only; the original user setup is preserved.` : "Existing user services are not modified.",
     "One complete package: both runtimes, units and accounts are installed; --role only sets the initial enabled preset.",
     "Hub and collector use separate unprivileged accounts; Node gets no capabilities.",
     ...options.enable && preset.hub ? ["Enabling the hub creates its owner account once and prints the password once."] : [],
@@ -2826,7 +3170,10 @@ function planSystemInstall(options) {
   ];
   return { operation: "install", apply: options.apply === true, role, components: initial, paths, accounts, commands, files, notes };
 }
-async function installSystem(options) {
+function installSystem(options) {
+  return withSystemOperation(options, () => installSystemUnlocked(options));
+}
+async function installSystemUnlocked(options) {
   const host = options.host ?? createSystemHost();
   const now = options.now ?? Date.now;
   const paths = validateSystemPaths(options.paths);
@@ -2835,7 +3182,8 @@ async function installSystem(options) {
   const plan = planSystemInstall({ ...options, paths, accounts, role });
   if (options.apply !== true) return { operation: "install", ok: true, apply: false, message: "plan only", plan };
   assertApply(host);
-  const existing = readSystemState(paths);
+  const legacy = systemStateIsLegacy(paths);
+  const existing = legacy ? null : readSystemState(paths);
   if (existing?.active === true) {
     throw new SystemError("already-installed", "a system installation already exists; use `rigscope system upgrade` or uninstall first");
   }
@@ -2847,123 +3195,126 @@ async function installSystem(options) {
       `existing user service(s) detected (${detail}); stop them and use --adopt-user-state for explicit copy-based adoption`
     );
   }
-  assertSystemStartAllowed(paths, options.start === true ? componentsForRole(role) : { hub: false, collector: false });
-  const source = (0, import_node_path3.resolve)(options.source);
+  const source = (0, import_node_path4.resolve)(options.source);
   if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
-  ensureDirectory(paths.prefix, 493);
-  ensureDirectory((0, import_node_path3.join)(paths.prefix, "releases"), 493);
-  ensureDirectory(paths.stateDir, 493);
-  ensureDirectory(paths.configDir, 493);
-  ensureDirectory(paths.unitsDir, 493);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub"), 448, true);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "collector"), 448, true);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
-  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub", "run"), 448, true);
-  assertManagedPathSafety(paths, isDefaultSystemLayout(paths));
-  const nodePath = ensureRootOwnedNode({ paths, host, nodePath: options.nodePath, copyNode: options.copyNode, trustedNode: options.trustedNode, apply: true });
-  const stage = stageRelease({ source, paths, host, replaceRelease: options.replaceRelease, now });
-  if (options.installDeps === true) {
-    installDependencies(stage.releaseDir, host, options.installDepsCommand ?? "npm");
-  }
-  const missing = missingDependencies(stage.releaseDir);
-  if (missing.length > 0) {
-    throw new SystemError(
-      "missing-dependencies",
-      `production dependencies are missing (${missing.join(", ")}); stage with --install-deps or use a built release directory`
-    );
-  }
-  chmodTree(stage.releaseDir, host);
-  runRequired(host, "chown", ["-R", "root:root", stage.releaseDir], "release ownership");
-  let adoption = null;
-  if (options.adoptFrom) {
-    adoption = adoptUserState({ source: options.adoptFrom, paths, role, accounts, apply: true, host, now });
-    await performAdoptionCopyAsync({ source: options.adoptFrom, paths, role, host, copy: adoption });
-  }
   const port = options.port ?? 8081;
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-argument", "--port must be 1-65535");
-  const preset = componentSet(componentsForRole(role));
+  parseHubConfig(options.origin === void 0 ? { HUB_HOST: "127.0.0.1", HUB_PORT: String(port) } : { HUB_PUBLIC_ORIGIN: options.origin, HUB_SOCKET_PATH: hubSocketPath(paths) });
+  const preset = componentSet(installPreset(options, role));
   const power = options.power !== false && preset.collector;
-  const hubEnv = adoption?.hubEnv ?? hubEnvTemplate(paths, options.origin, port);
-  const collectorEnv = adoption?.collectorEnv ?? collectorEnvTemplate();
-  writeManagedFile(hubEnvPath(paths), hubEnv, 384, false);
-  writeManagedFile(collectorEnvPath(paths), collectorEnv, 384, false);
-  writeSysusersFiles(paths, accounts, "local", power, host);
-  const hubUnit = renderSystemHubUnit({
-    paths,
-    accounts,
-    nodePath,
-    database: hubDatabasePath(paths),
-    enrollment: hubEnrollmentPath(paths),
-    socket: hubSocketPath(paths),
-    remote: adoption?.remote === true || typeof options.origin === "string",
-    powerAccess: false
-  });
-  const collectorUnit = renderSystemCollectorUnit({
+  if (options.adoptFrom) {
+    adoptUserState({ source: options.adoptFrom, paths, role, accounts, apply: false, host, now });
+  }
+  assertManagedPathSafety(paths, isDefaultSystemLayout(paths));
+  ensureDirectory(paths.prefix, 493);
+  const nodePath = ensureRootOwnedNode({ paths, host, nodePath: options.nodePath, copyNode: options.copyNode, trustedNode: options.trustedNode, apply: true });
+  const staged = prepareStagedRelease({
+    source,
     paths,
-    accounts,
-    nodePath,
-    collectorState: collectorStatePath(paths),
-    powerAccess: power
+    host,
+    installDeps: options.installDeps,
+    installDepsCommand: options.installDepsCommand
   });
-  writeUnitFile(paths, UNIT_NAMES.hub, `${hubUnit}
+  try {
+    if (legacy) resetUnfinishedSystemState({ paths, host, now });
+    ensureDirectory((0, import_node_path4.join)(paths.prefix, "releases"), 493);
+    ensureDirectory(paths.stateDir, 493);
+    ensureDirectory(paths.configDir, 493);
+    ensureDirectory(paths.unitsDir, 493);
+    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub"), 448, true);
+    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "collector"), 448, true);
+    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
+    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub", "run"), 448, true);
+    const release = commitStagedRelease({ staged, paths, replaceRelease: options.replaceRelease });
+    let adoption = null;
+    if (options.adoptFrom) {
+      adoption = adoptUserState({ source: options.adoptFrom, paths, role, accounts, apply: true, host, now });
+      await performAdoptionCopyAsync({ source: options.adoptFrom, paths, role, host, copy: adoption });
+    }
+    const hubEnv = adoption?.hubEnv ?? hubEnvTemplate(paths, options.origin, port);
+    const collectorEnv = adoption?.collectorEnv ?? collectorEnvTemplate();
+    writeManagedFile(hubEnvPath(paths), hubEnv, 384, false);
+    writeManagedFile(collectorEnvPath(paths), collectorEnv, 384, false);
+    writeSysusersFiles(paths, accounts, "local", power, host);
+    const hubUnit = renderSystemHubUnit({
+      paths,
+      accounts,
+      nodePath,
+      database: hubDatabasePath(paths),
+      enrollment: hubEnrollmentPath(paths),
+      socket: hubSocketPath(paths),
+      remote: adoption?.remote === true || typeof options.origin === "string",
+      powerAccess: false
+    });
+    const collectorUnit = renderSystemCollectorUnit({
+      paths,
+      accounts,
+      nodePath,
+      collectorState: collectorStatePath(paths),
+      powerAccess: power
+    });
+    writeUnitFile(paths, UNIT_NAMES.hub, `${hubUnit}
 `, true);
-  writeUnitFile(paths, UNIT_NAMES.collector, `${collectorUnit}
+    writeUnitFile(paths, UNIT_NAMES.collector, `${collectorUnit}
 `, true);
-  const validation = runRequired(host, "systemd-analyze", ["verify", "--man=no", ...COMPONENTS.map((component) => (0, import_node_path3.join)(paths.unitsDir, unitFor(component)))], "native systemd unit validation");
-  if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
-    throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
-  }
-  if (power) ensurePowerAccess(paths, accounts, host);
-  chownAccount([(0, import_node_path3.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
-  chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
-  const state = emptyState({ paths, accounts, role, components: { hub: false, collector: false }, nodePath, now });
-  state.currentVersion = stage.version;
-  state.releases[stage.version] = {
-    releaseDir: stage.releaseDir,
-    schemaVersion: stage.schemaVersion,
-    installedAt: new Date(now()).toISOString()
-  };
-  state.adoption = adoption?.record ?? null;
-  state.power = power ? { enabled: true, rulePath: raplRulePath(paths), group: accounts.powerGroup } : null;
-  replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), stage.releaseDir, host);
-  writeSystemState(paths, state);
-  const wantsHub = preset.hub && (options.enable === true || options.start === true);
-  const wantsCollector = preset.collector && (options.enable === true || options.start === true);
-  let password;
-  const awaiting = [];
-  if (wantsHub) password = ensureHubOwner(paths);
-  if (wantsCollector && !collectorConfigured(paths).configured) {
-    const pairing = await pairCollectorWithHub({ paths, accounts, host });
-    if (pairing.awaiting) awaiting.push("collector");
-  }
-  if (options.enable === true) {
-    enableUnits(host, unitNamesForComponents(preset));
-    state.components = { hub: { enabled: preset.hub }, collector: { enabled: preset.collector } };
+    const validation = runRequired(host, "systemd-analyze", ["verify", "--man=no", ...COMPONENTS.map((component) => (0, import_node_path4.join)(paths.unitsDir, unitFor(component)))], "native systemd unit validation");
+    if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
+      throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
+    }
+    if (power) ensurePowerAccess(paths, accounts, host);
+    chownAccount([(0, import_node_path4.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
+    chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+    const state = emptyState({ paths, accounts, role, components: { hub: false, collector: false }, nodePath, now });
+    state.currentVersion = release.version;
+    state.releases[release.version] = {
+      releaseDir: release.releaseDir,
+      schemaVersion: release.schemaVersion,
+      installedAt: new Date(now()).toISOString()
+    };
+    state.adoption = adoption?.record ?? null;
+    state.power = power ? { enabled: true, rulePath: raplRulePath(paths), group: accounts.powerGroup } : null;
+    replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), release.releaseDir, host);
     writeSystemState(paths, state);
-  }
-  const started = [];
-  if (options.start === true) {
-    assertSystemStartAllowed(paths, componentSet(preset));
-    if (preset.hub) started.push("hub");
-    if (preset.collector && !awaiting.includes("collector")) started.push("collector");
-    if (started.length > 0) {
-      startUnits(host, started.map(unitFor));
-      await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, started);
+    const wantsHub = preset.hub && (options.enable === true || options.start === true);
+    const wantsCollector = preset.collector && (options.enable === true || options.start === true);
+    let password;
+    const awaiting = [];
+    if (wantsHub) password = ensureHubOwner(paths);
+    if (wantsCollector && !collectorConfigured(paths).configured) {
+      const pairing = await pairCollectorWithHub({ paths, accounts, host });
+      if (pairing.awaiting) awaiting.push("collector");
+    }
+    if (options.enable === true) {
+      enableUnits(host, unitNamesForComponents(preset));
+      state.components = { hub: { enabled: preset.hub }, collector: { enabled: preset.collector } };
+      writeSystemState(paths, state);
+    }
+    const started = [];
+    if (options.start === true) {
+      assertSystemStartAllowed(paths, componentSet(preset));
+      if (preset.hub) started.push("hub");
+      if (preset.collector && !awaiting.includes("collector")) started.push("collector");
+      if (started.length > 0) {
+        startUnits(host, started.map(unitFor));
+        await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, started);
+      }
     }
+    return {
+      operation: "install",
+      ok: true,
+      apply: true,
+      message: `installed ${release.version} for ${role} preset`,
+      version: release.version,
+      current: release.releaseDir,
+      previous: null,
+      state,
+      password,
+      ...awaiting.length > 0 ? { awaitingConnection: awaiting } : {},
+      warnings: adoption?.warnings ?? []
+    };
+  } finally {
+    discardStagedRelease(staged);
   }
-  return {
-    operation: "install",
-    ok: true,
-    apply: true,
-    message: `installed ${stage.version} for ${role} preset`,
-    version: stage.version,
-    current: stage.releaseDir,
-    previous: null,
-    state,
-    password,
-    ...awaiting.length > 0 ? { awaitingConnection: awaiting } : {},
-    warnings: adoption?.warnings ?? []
-  };
 }
 function systemStatus(options = {}) {
   const host = options.host ?? createSystemHost();
@@ -2976,14 +3327,14 @@ function systemStatus(options = {}) {
   } catch (error) {
     stateError = error instanceof Error ? error.message : String(error);
   }
-  const presentUnits = [UNIT_NAMES.hub, UNIT_NAMES.collector].filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, unit)));
+  const presentUnits = [UNIT_NAMES.hub, UNIT_NAMES.collector].filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, unit)));
   const publicRole = presentUnits.length === 2 ? "local" : presentUnits[0] === UNIT_NAMES.hub ? "hub" : presentUnits[0] === UNIT_NAMES.collector ? "collector" : null;
   const role = state?.role ?? publicRole ?? "local";
   const current = currentReleaseDir(paths);
   let publicVersion = null;
   if (current) {
     try {
-      const manifest = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(current, "package.json"), "utf8"));
+      const manifest = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path4.join)(current, "package.json"), "utf8"));
       if (typeof manifest.version === "string") publicVersion = manifest.version;
     } catch {
     }
@@ -2994,7 +3345,7 @@ function systemStatus(options = {}) {
   const componentReports = {};
   for (const component of COMPONENTS) {
     const unit = unitFor(component);
-    const present = (0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, unit));
+    const present = (0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, unit));
     const active = present && systemdActive(host, unit);
     const unitEnabled = present && systemdEnabled(host, unit);
     const enabled = state !== null ? state.components[component].enabled : unitEnabled;
@@ -3003,7 +3354,7 @@ function systemStatus(options = {}) {
     componentReports[component] = {
       component,
       unit,
-      path: (0, import_node_path3.join)(paths.unitsDir, unit),
+      path: (0, import_node_path4.join)(paths.unitsDir, unit),
       present,
       enabled,
       unitEnabled,
@@ -3225,7 +3576,7 @@ async function enableSystem(options) {
     ],
     files: [
       { path: component === "hub" ? hubEnvPath(paths) : collectorEnvPath(paths), mode: "0600", purpose: `${component} configuration` },
-      { path: (0, import_node_path3.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }
+      { path: (0, import_node_path4.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }
     ],
     notes: [
       "Enables only the requested component; the other component keeps running.",
@@ -3338,7 +3689,7 @@ async function connectSystem(options) {
   const state = readSystemState(paths);
   if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
   const destination = connectDestinationUrl(options.url);
-  const tokenFile = (0, import_node_path3.resolve)(options.tokenFile);
+  const tokenFile = (0, import_node_path4.resolve)(options.tokenFile);
   const configured = collectorConfigured(paths);
   if (configured.configured) {
     throw new SystemError(
@@ -3373,10 +3724,6 @@ async function connectSystem(options) {
     ensurePowerAccess(paths, state.accounts, host);
     state.power = { enabled: true, rulePath: raplRulePath(paths), group: state.accounts.powerGroup };
   }
-  const existingIdentity = readCollectorIdentity(collectorStatePath(paths));
-  if (existingIdentity !== null) {
-    writeCollectorIdentity(collectorStatePath(paths), existingIdentity);
-  }
   const wasActive = systemdActive(host, UNIT_NAMES.collector);
   if (wasActive) {
     stopUnits(host, [UNIT_NAMES.collector]);
@@ -3390,12 +3737,12 @@ async function connectSystem(options) {
       `collector enrollment failed: ${error instanceof Error ? error.message : String(error)}`
     );
   } finally {
-    chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
+    chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
   }
   if (!collectorConfigured(paths).configured) {
     throw new SystemError("enrollment-failed", "the hub accepted enrollment but no destination was saved; check private state");
   }
-  chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
+  chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
   writeSystemState(paths, state);
   const enabled = state.components.collector.enabled;
   if (enabled || wasActive) {
@@ -3416,6 +3763,60 @@ async function upgradeSystemUnlocked(options) {
   const host = options.host ?? createSystemHost();
   const now = options.now ?? Date.now;
   const paths = validateSystemPaths(options.paths);
+  if (systemStateIsLegacy(paths)) {
+    const source2 = (0, import_node_path4.resolve)(options.source);
+    if (!(0, import_node_fs3.existsSync)(source2)) throw new SystemError("missing-source", `release source does not exist: ${source2}`);
+    const role = legacySystemRole(paths);
+    const preset = componentsForRole(role);
+    const enable = options.enable ?? (options.start === true || unitNamesForComponents(preset).some((unit) => systemdEnabled(host, unit)));
+    const units = [...Object.values(UNIT_NAMES), ...LEGACY_UNIT_NAMES];
+    const plan2 = {
+      operation: "upgrade",
+      apply: options.apply === true,
+      role,
+      components: preset,
+      paths,
+      accounts: validateAccounts(options.accounts),
+      commands: [
+        "copy and validate the replacement release",
+        ...units.map((unit) => `systemctl stop ${unit}`),
+        "verify every owned runtime lease is stopped",
+        "remove unfinished configuration, history and application releases",
+        "install the canonical layout from the validated replacement",
+        ...enable ? unitNamesForComponents(preset).map((unit) => `systemctl enable ${unit}`) : [],
+        ...options.start ? unitNamesForComponents(preset).map((unit) => `systemctl start ${unit}`) : []
+      ],
+      files: [
+        { path: stateFilePath(paths), mode: "0600", purpose: "canonical replacement state" },
+        { path: (0, import_node_path4.join)(paths.stateDir, "backups"), mode: "0700", purpose: "removed with unfinished history" }
+      ],
+      notes: [
+        "An unfinished installation is reset, not migrated; its history and credentials are removed.",
+        "The replacement is copied and validated before any unit is stopped or state is removed.",
+        "Both owned units and legacy combined units are stopped before the reset."
+      ]
+    };
+    if (options.apply !== true) return { operation: "upgrade", ok: true, apply: false, message: "plan only", plan: plan2 };
+    return installSystemUnlocked({
+      apply: true,
+      source: options.source,
+      role,
+      paths: options.paths,
+      accounts: options.accounts,
+      host: options.host,
+      start: options.start,
+      enable,
+      installDeps: options.installDeps,
+      installDepsCommand: options.installDepsCommand,
+      replaceRelease: options.replaceRelease,
+      startupTimeoutMs: options.startupTimeoutMs,
+      homeRoots: options.homeRoots,
+      // This is an existing system installation; unrelated user-scope units
+      // must not block its reset.
+      allowUserConflicts: options.allowUserConflicts ?? true,
+      now: options.now
+    });
+  }
   const state = readSystemState(paths);
   if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
   const activeComponents = COMPONENTS.filter((component) => systemdActive(host, unitFor(component)));
@@ -3428,7 +3829,7 @@ async function upgradeSystemUnlocked(options) {
     paths,
     accounts: state.accounts,
     commands: ["stage new release", ...activeUnits.map((unit) => `systemctl stop ${unit}`), "backup database", "switch current", ...activeUnits.map((unit) => `systemctl start ${unit}`)],
-    files: [{ path: (0, import_node_path3.join)(paths.stateDir, "backups"), mode: "0700", purpose: "pre-upgrade database backup" }],
+    files: [{ path: (0, import_node_path4.join)(paths.stateDir, "backups"), mode: "0700", purpose: "pre-upgrade database backup" }],
     notes: [
       "Staging happens before any service is stopped.",
       "The exact active component set is restored; --start does not start a component that was stopped.",
@@ -3438,91 +3839,105 @@ async function upgradeSystemUnlocked(options) {
   if (options.apply !== true) return { operation: "upgrade", ok: true, apply: false, message: "plan only", plan };
   assertApply(host);
   assertManagedPathSafety(paths, isDefaultSystemLayout(paths));
-  const source = (0, import_node_path3.resolve)(options.source);
+  const source = (0, import_node_path4.resolve)(options.source);
   if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
-  const stage = stageRelease({ source, paths, host, replaceRelease: options.replaceRelease, now });
-  if (state.currentVersion === stage.version) {
-    throw new SystemError("same-version", `release ${stage.version} is already current; use a different version`);
-  }
-  if (options.installDeps === true) installDependencies(stage.releaseDir, host, options.installDepsCommand ?? "npm");
-  const missing = missingDependencies(stage.releaseDir);
-  if (missing.length > 0) throw new SystemError("missing-dependencies", `production dependencies are missing: ${missing.join(", ")}`);
-  chmodTree(stage.releaseDir, host);
-  runRequired(host, "chown", ["-R", "root:root", stage.releaseDir], "release ownership");
-  const oldCurrent = currentReleaseDir(paths);
-  if (oldCurrent === null) throw new SystemError("invalid-state", "current release symlink is missing");
-  const oldPrevious = previousReleaseDir(paths);
-  let backupPath = null;
-  let beforeSchema = null;
+  const staged = prepareStagedRelease({
+    source,
+    paths,
+    host,
+    installDeps: options.installDeps,
+    installDepsCommand: options.installDepsCommand
+  });
   try {
-    stopUnits(host, activeUnits);
-    assertDirectoryStopped(paths.stateDir);
-    const lock = systemLockState(paths);
-    if (lock.live) throw new SystemError("duplicate-runtime", `hub did not stop cleanly; lock remains at ${lock.path}`);
-    const database = hubDatabasePath(paths);
-    if ((0, import_node_fs3.existsSync)(database)) {
-      ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
-      beforeSchema = databaseSchema(database);
-      backupPath = (0, import_node_path3.join)(paths.stateDir, "backups", `pre-upgrade-${stage.version}-${newestTimestamp()}.sqlite`);
-      await backupDatabase(database, backupPath, host);
+    if (state.currentVersion === staged.version) {
+      throw new SystemError("same-version", `release ${staged.version} is already current; use a different version`);
     }
-    replaceSymlink((0, import_node_path3.join)(paths.prefix, "previous"), oldCurrent, host);
-    replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), stage.releaseDir, host);
-    state.previousVersion = state.currentVersion;
-    state.currentVersion = stage.version;
-    state.releases[stage.version] = {
-      releaseDir: stage.releaseDir,
-      schemaVersion: stage.schemaVersion,
-      installedAt: new Date(now()).toISOString()
-    };
-    if (backupPath !== null) {
-      state.backups[(0, import_node_path3.basename)(backupPath)] = {
-        path: backupPath,
-        schemaVersion: beforeSchema,
-        fromSchema: beforeSchema,
-        toSchema: stage.schemaVersion,
-        createdAt: new Date(now()).toISOString(),
-        fromVersion: state.previousVersion ?? void 0,
-        toVersion: stage.version
+    assertReleaseTargetAvailable(paths, releaseTargetDir(paths, staged.version), options.replaceRelease);
+    const oldCurrent = currentReleaseDir(paths);
+    if (oldCurrent === null) throw new SystemError("invalid-state", "current release symlink is missing");
+    const oldPrevious = previousReleaseDir(paths);
+    let backupPath = null;
+    let beforeSchema = null;
+    let release = null;
+    try {
+      stopUnits(host, activeUnits);
+      assertDirectoryStopped(paths.stateDir);
+      const lock = systemLockState(paths);
+      if (lock.live) throw new SystemError("duplicate-runtime", `hub did not stop cleanly; lock remains at ${lock.path}`);
+      const database = hubDatabasePath(paths);
+      if ((0, import_node_fs3.existsSync)(database)) {
+        ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
+        beforeSchema = databaseSchema(database);
+        backupPath = (0, import_node_path4.join)(paths.stateDir, "backups", `pre-upgrade-${staged.version}-${newestTimestamp()}.sqlite`);
+        await backupDatabase(database, backupPath, host);
+      }
+      release = commitStagedRelease({ staged, paths, replaceRelease: options.replaceRelease });
+      replaceSymlink((0, import_node_path4.join)(paths.prefix, "previous"), oldCurrent, host);
+      replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), release.releaseDir, host);
+      state.previousVersion = state.currentVersion;
+      state.currentVersion = release.version;
+      state.releases[release.version] = {
+        releaseDir: release.releaseDir,
+        schemaVersion: release.schemaVersion,
+        installedAt: new Date(now()).toISOString()
       };
+      if (backupPath !== null) {
+        state.backups[(0, import_node_path4.basename)(backupPath)] = {
+          path: backupPath,
+          schemaVersion: beforeSchema,
+          fromSchema: beforeSchema,
+          toSchema: release.schemaVersion,
+          createdAt: new Date(now()).toISOString(),
+          fromVersion: state.previousVersion ?? void 0,
+          toVersion: release.version
+        };
+      }
+      writeSystemState(paths, state);
+      if (activeComponents.length > 0) {
+        startUnits(host, activeUnits);
+        await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, activeComponents);
+      }
+    } catch (error) {
+      await recoverFailedUpgrade({
+        paths,
+        state,
+        oldCurrent,
+        oldPrevious,
+        beforeSchema,
+        backupPath,
+        host,
+        activeComponents,
+        units: activeUnits
+      });
+      throw error;
     }
-    writeSystemState(paths, state);
-    if (activeComponents.length > 0) {
-      startUnits(host, activeUnits);
-      await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, activeComponents);
-    }
-  } catch (error) {
-    await recoverFailedUpgrade({
-      paths,
-      state,
-      oldCurrent,
-      oldPrevious,
-      beforeSchema,
+    const upgraded = release;
+    return {
+      operation: "upgrade",
+      ok: true,
+      apply: true,
+      message: `upgraded ${state.previousVersion ?? "previous"} -> ${upgraded.version}`,
+      version: upgraded.version,
+      current: upgraded.releaseDir,
+      previous: oldCurrent,
       backupPath,
-      host,
-      activeComponents,
-      units: activeUnits
-    });
-    throw error;
+      state
+    };
+  } finally {
+    discardStagedRelease(staged);
   }
-  return {
-    operation: "upgrade",
-    ok: true,
-    apply: true,
-    message: `upgraded ${state.previousVersion ?? "previous"} -> ${stage.version}`,
-    version: stage.version,
-    current: stage.releaseDir,
-    previous: oldCurrent,
-    backupPath,
-    state
-  };
+}
+function systemOperationLockPath(paths) {
+  return (0, import_node_path4.join)(paths.prefix, "run", "operation.lock");
 }
 async function withSystemOperation(options, operation) {
   if (!options.apply) return operation();
   const host = options.host ?? createSystemHost();
   assertApply(host);
   const paths = validateSystemPaths(options.paths);
-  const release = acquireProcessLease((0, import_node_path3.join)(paths.stateDir, "backups/operation.lock"));
+  ensureDirectory(paths.prefix, 493);
+  ensureDirectory((0, import_node_path4.join)(paths.prefix, "run"), 448, true);
+  const release = acquireProcessLease(systemOperationLockPath(paths));
   try {
     return await operation();
   } finally {
@@ -3573,7 +3988,7 @@ async function rollbackSystemUnlocked(options = {}) {
   try {
     stopUnits(host, units);
     assertDirectoryStopped(paths.stateDir);
-    if (systemLockState(paths).live || lockIsLive((0, import_node_path3.join)(paths.stateDir, "collector/collector-runtime.lock")).live) {
+    if (systemLockState(paths).live || lockIsLive((0, import_node_path4.join)(paths.stateDir, "collector/collector-runtime.lock")).live) {
       throw new SystemError("runtime-active", "runtime lease remains after stop; rollback refused");
     }
     const database = hubDatabasePath(paths);
@@ -3589,8 +4004,8 @@ async function rollbackSystemUnlocked(options = {}) {
       }
     }
     if ((0, import_node_fs3.existsSync)(database)) {
-      ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
-      safetyBackup = (0, import_node_path3.join)(paths.stateDir, "backups", `pre-rollback-${newestTimestamp()}.sqlite`);
+      ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
+      safetyBackup = (0, import_node_path4.join)(paths.stateDir, "backups", `pre-rollback-${newestTimestamp()}.sqlite`);
       await backupDatabase(database, safetyBackup, host);
     }
     if (backupToRestore !== null) {
@@ -3598,8 +4013,8 @@ async function rollbackSystemUnlocked(options = {}) {
       restoredDatabase = true;
       runRequired(host, "chown", [`${state.accounts.hub}:${state.accounts.hub}`, database], "restored database ownership");
     }
-    replaceSymlink((0, import_node_path3.join)(paths.prefix, "previous"), oldCurrent, host);
-    replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), previous, host);
+    replaceSymlink((0, import_node_path4.join)(paths.prefix, "previous"), oldCurrent, host);
+    replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), previous, host);
     state.previousVersion = state.currentVersion;
     state.currentVersion = previousVersion;
     state.updatedAt = new Date(now()).toISOString();
@@ -3621,10 +4036,10 @@ async function rollbackSystemUnlocked(options = {}) {
     };
   } catch (error) {
     stopUnits(host, units);
-    replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), oldCurrent, host);
-    replaceSymlink((0, import_node_path3.join)(paths.prefix, "previous"), previous, host);
+    replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), oldCurrent, host);
+    replaceSymlink((0, import_node_path4.join)(paths.prefix, "previous"), previous, host);
     if (restoredDatabase && safetyBackup) {
-      const failed = (0, import_node_path3.join)(paths.stateDir, "backups", `failed-rollback-${newestTimestamp()}.sqlite`);
+      const failed = (0, import_node_path4.join)(paths.stateDir, "backups", `failed-rollback-${newestTimestamp()}.sqlite`);
       await backupDatabase(hubDatabasePath(paths), failed, host);
       replaceDatabaseFromBackup(safetyBackup, hubDatabasePath(paths), null, host);
       runRequired(host, "chown", [`${state.accounts.hub}:${state.accounts.hub}`, hubDatabasePath(paths)], "restored database ownership");
@@ -3641,8 +4056,9 @@ function uninstallSystem(options = {}) {
   const host = options.host ?? createSystemHost();
   const now = options.now ?? Date.now;
   const paths = validateSystemPaths(options.paths);
-  const state = readSystemState(paths);
-  const units = [UNIT_NAMES.hub, UNIT_NAMES.collector];
+  const state = systemStateIsLegacy(paths) ? null : readSystemState(paths);
+  const plannedUnits = [...Object.values(UNIT_NAMES), ...LEGACY_UNIT_NAMES];
+  const units = options.apply === true ? unitsForCleanup(paths, host) : plannedUnits;
   const plan = {
     operation: "uninstall",
     apply: options.apply === true,
@@ -3680,7 +4096,7 @@ function uninstallSystem(options = {}) {
   assertDirectoryStopped(paths.stateDir);
   for (const unit of units) runMaybe(host, "systemctl", ["disable", unit]);
   for (const unit of units) {
-    const path = (0, import_node_path3.join)(paths.unitsDir, unit);
+    const path = (0, import_node_path4.join)(paths.unitsDir, unit);
     assertManagedFileOwnership(paths, path);
     try {
       (0, import_node_fs3.unlinkSync)(path);
@@ -3701,10 +4117,10 @@ function uninstallSystem(options = {}) {
     restorePowerOriginals(paths, host);
     resumePowerRule(paths, host);
   }
-  removeSymlink((0, import_node_path3.join)(paths.prefix, "current"));
-  removeSymlink((0, import_node_path3.join)(paths.prefix, "previous"));
-  (0, import_node_fs3.rmSync)((0, import_node_path3.join)(paths.prefix, "releases"), { recursive: true, force: true });
-  (0, import_node_fs3.rmSync)((0, import_node_path3.join)(paths.prefix, "node"), { recursive: true, force: true });
+  removeSymlink((0, import_node_path4.join)(paths.prefix, "current"));
+  removeSymlink((0, import_node_path4.join)(paths.prefix, "previous"));
+  (0, import_node_fs3.rmSync)((0, import_node_path4.join)(paths.prefix, "releases"), { recursive: true, force: true });
+  if (options.preserveNode !== true) (0, import_node_fs3.rmSync)((0, import_node_path4.join)(paths.prefix, "node"), { recursive: true, force: true });
   if (state !== null) {
     state.active = false;
     state.power = null;
@@ -4088,7 +4504,7 @@ ${humanPlan(report.plan)}`);
     if (parsed.command === "logs") {
       const selected = validateSystemPaths(paths);
       const component = componentFrom(parsed, false);
-      const units = (component ? [unitFor(component)] : [UNIT_NAMES.hub, UNIT_NAMES.collector]).filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path3.join)(selected.unitsDir, unit)));
+      const units = (component ? [unitFor(component)] : [UNIT_NAMES.hub, UNIT_NAMES.collector]).filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(selected.unitsDir, unit)));
       if (units.length === 0) throw new SystemError("not-installed", component ? `${component} logs are unavailable; its unit is not installed` : "no system services installed");
       const result = (0, import_node_child_process.spawnSync)("journalctl", [...units.flatMap((unit) => ["--unit", unit]), "--lines=100", "--no-pager", ...boolValue(values, "follow") ? ["--follow"] : []], { stdio: "inherit" });
       if (result.error) throw result.error;
@@ -4153,6 +4569,7 @@ ${humanPlan(report.plan)}`);
         paths,
         host,
         start: boolValue(values, "start"),
+        enable: boolValue(values, "enable") || void 0,
         installDeps: boolValue(values, "install-deps"),
         installDepsCommand: stringValue(values, "install-deps-command"),
         replaceRelease: boolValue(values, "replace-release"),
@@ -4160,8 +4577,10 @@ ${humanPlan(report.plan)}`);
       });
       if (json) console.log(formatSystemReport(report));
       else if (report.plan) console.log(humanPlan(report.plan));
-      else console.log(`${report.message}
-Backup: ${report.backupPath ?? "none"}`);
+      else {
+        printMutationReport(report);
+        console.log(`Backup: ${report.backupPath ?? "none"}`);
+      }
       return 0;
     }
     if (parsed.command === "rollback") {
@@ -4274,7 +4693,6 @@ if (isMainModule()) {
   RAPL_RULE_NAME,
   STATE_FILE_NAME,
   SYSTEM_SCOPE,
-  SYSTEM_STATE_FORMAT_VERSION,
   SYSUSERS_NAME,
   SystemError,
   UNIT_NAMES,
@@ -4319,6 +4737,7 @@ if (isMainModule()) {
   startSystem,
   stateFilePath,
   stopSystem,
+  systemStateIsLegacy,
   systemStatus,
   systemdQuote,
   sysusersPath,