Updates and removal

Keep publisher/name stable and increase the semantic version. Never overwrite an existing version with different bytes. Build, test previous profiles, validate, pack, and submit every release for new review and signed publication.

Desktop verifies signed metadata, package length/digest, compatibility, and archive contents. New permissions require consent. Pinning suppresses background update discovery, not revocation checks. Experimental automatic updates are opt-in, permission-neutral, and apply at a safe inactive boundary.

Declarative storage migrations rename bounded profile-storage keys with backup/rollback at first activation. They do not roll back credentials, IndexedDB, or arbitrary data changes after successful activation. Test migration collisions and interrupted activation.

Disable stops tools while preserving data. Uninstall asks separately about profile/data retention; no silent account-data deletion. Registry-origin identity prevents another same-named registry package from inheriting credentials.

Signed revocation is different from an expired registry access token. Reconnect for authentication failures. A private registry cannot remotely erase previously downloaded packages.