@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': minor
+---
+
+The Marketplace's install answers now say what the runtime served (objectui#12098).
+
+- **An install-local answered `hotLoaded: false`.** The runtime installed the package, but its running kernel could not register it (objectstack#22695, the lenient path for a cloud-fetched manifest). The package loads at the runtime's next restart. The package page used to say the app "should now appear in the app switcher" and refresh the app list. The catalog's "Your organization" strip said "Installed {name}" and sent the metadata-refresh signal. Both now say: installed, loads when the runtime next restarts, not in the app switcher until then. Neither refreshes the app list. `hotLoaded: true` is unchanged.
+- **An upgrade waits for the new version's app.** After a cloud install into this environment, the console waits until the runtime serves the package's app (objectui#12087). On an upgrade, the stale kernel still serves the OLD version's app under the same `_packageId`, so the wait ended on its first read and the console kept the pre-upgrade list. The runtime now stamps each app it registers with `_packageVersion` (objectstack#22689). The wait now also matches the version that the install answer names (`installation.version`). An app served without `_packageVersion` (a runtime from before that change) is accepted on its id, as before. An answer that names no version waits on the id alone. The catalog strip's wait matches the version the same way.
+
+**Locale key.** `marketplace.install.localLoadsAtRestart`, in all ten packs. `TranslationKeys` gains it.
+
+**Clause-②: yes (widening)**: one locale key added to `@object-ui/i18n`'s published packs, which widens `TranslationKeys`. No export, prop or schema key is added, and no spec type is imported.
@@ -93,12 +93,13 @@ function installLandsInThisEnvironment(selectedEnv: string): boolean {
  * objectui#12087 — after an install into THIS environment, the page waits for
  * the runtime to serve the package's app before it refreshes the metadata
  * cache. `served` carries the first app of the package a user can open, or
- * `null` when every one is inactive or hidden.
+ * `null` when every one is inactive or hidden. `version` is the one the install
+ * answer names, so "Check again" waits for the same version (objectui#12098).
  */
 type DeployState =
-  | { phase: 'waiting'; manifestId: string }
-  | { phase: 'served'; manifestId: string; app: ServedApp | null }
-  | { phase: 'timeout'; manifestId: string };
+  | { phase: 'waiting'; manifestId: string; version: string | undefined }
+  | { phase: 'served'; manifestId: string; version: string | undefined; app: ServedApp | null }
+  | { phase: 'timeout'; manifestId: string; version: string | undefined };
 
 export function MarketplacePackagePage() {
   const navigate = useNavigate();
@@ -352,11 +353,16 @@ export function MarketplacePackagePage() {
    * refresh, the seed drop and the bus pulse all wait for it. On expiry nothing
    * is refreshed, and the page says the app has not appeared rather than that
    * the install succeeded.
+   *
+   * objectui#12098 — on an upgrade the stale kernel still serves the OLD
+   * version's app under the same `_packageId`, so the wait also names the
+   * version the install answered with (see `waitForServedApp`).
    */
-  const awaitServedInstall = async (manifestId: string) => {
-    setDeploy({ phase: 'waiting', manifestId });
+  const awaitServedInstall = async (manifestId: string, version: string | undefined) => {
+    setDeploy({ phase: 'waiting', manifestId, version });
     const wait = await waitForServedApp({
       manifestId,
+      version,
       // The SDK's declared list answer (`GetMetaItemsResponse`: `{ type,
       // items }`). Not `MetadataProvider`'s `extractItems`: a value import of
       // that module from this lazy page made rolldown park the provider in
@@ -367,7 +373,7 @@ export function MarketplacePackagePage() {
       },
     });
     if (!wait.served) {
-      setDeploy({ phase: 'timeout', manifestId });
+      setDeploy({ phase: 'timeout', manifestId, version });
       return;
     }
     // Invalidate the metadata cache so the newly-installed app's
@@ -391,7 +397,7 @@ export function MarketplacePackagePage() {
       // back to pick up the new metadata.
     }
     emitMetadataRefresh();
-    setDeploy({ phase: 'served', manifestId, app: filterActiveApps(wait.apps)[0] ?? null });
+    setDeploy({ phase: 'served', manifestId, version, app: filterActiveApps(wait.apps)[0] ?? null });
   };
 
   const doInstall = async () => {
@@ -424,8 +430,10 @@ export function MarketplacePackagePage() {
         // serves the PRE-install kernel, so nothing is refreshed yet: the wait
         // below refreshes once the package's app is served. Not awaited, and
         // not cancelled on unmount: an operator who leaves this page while the
-        // app deploys still gets the refreshed cache when it lands.
-        void awaitServedInstall(data.package.manifest_id);
+        // app deploys still gets the refreshed cache when it lands. The version
+        // is the answer's own (objectui#12098), never the catalog's latest: an
+        // answer that names none waits on the id alone, as before.
+        void awaitServedInstall(data.package.manifest_id, installResp?.installation?.version);
       } else {
         // Another environment: nothing this console renders changed, so there
         // is nothing here to wait for or to refresh.
@@ -450,17 +458,24 @@ export function MarketplacePackagePage() {
     setLocalResult(null);
     try {
       const result = await installLocal({ packageId });
+      const name = data?.package ? localizePackage(data.package as any, language).displayName : result.manifestId;
+      // objectui#12098 — `hotLoaded` says whether the running kernel registered
+      // the package (objectstack#22695). `false` is the runtime's lenient path:
+      // installed and in its ledger, loaded at its next restart. Nothing of it
+      // is served until then, so the app list is not refreshed as if it were,
+      // and the page says when the app will appear.
+      if (!result.hotLoaded) {
+        setLocalResult({ ok: true, message: t('marketplace.install.localLoadsAtRestart', { version: result.version, name }) });
+        return;
+      }
       try {
         await refreshMetadata('app');
       } catch {
         // Non-fatal: the install succeeded; the app list will refresh on next navigation.
       }
       setLocalResult({
         ok: true,
-        message: t('marketplace.install.localSuccess', {
-          version: result.version,
-          name: data?.package ? localizePackage(data.package as any, language).displayName : result.manifestId,
-        }),
+        message: t('marketplace.install.localSuccess', { version: result.version, name }),
       });
       emitMetadataRefresh();
     } catch (e: any) {
@@ -780,7 +795,7 @@ export function MarketplacePackagePage() {
           </Button>
         ) : null}
         {deploy.phase === 'timeout' ? (
-          <Button size="sm" variant="outline" onClick={() => void awaitServedInstall(deploy.manifestId)}>
+          <Button size="sm" variant="outline" onClick={() => void awaitServedInstall(deploy.manifestId, deploy.version)}>
             {t('marketplace.install.checkAgain')}
           </Button>
         ) : null}
 
@@ -117,12 +117,13 @@ function toLoadFailure(e: unknown): LoadFailure {
  * (objectui#12087), in the same words. The strip lists several packages and
  * this status sits above them all, so it names its package (`name`, the row's
  * display name). `served` carries the first app of the package a user can open,
- * or `null` when every one is inactive or hidden.
+ * or `null` when every one is inactive or hidden. `version` is the one the
+ * install answer names, which the wait matches too (objectui#12098).
  */
 type OrgDeployState =
-  | { phase: 'waiting'; manifestId: string; name: string }
-  | { phase: 'served'; manifestId: string; name: string; app: ServedApp | null }
-  | { phase: 'timeout'; manifestId: string; name: string };
+  | { phase: 'waiting'; manifestId: string; version: string | undefined; name: string }
+  | { phase: 'served'; manifestId: string; version: string | undefined; name: string; app: ServedApp | null }
+  | { phase: 'timeout'; manifestId: string; version: string | undefined; name: string };
 
 export function MarketplacePage() {
   const navigate = useNavigate();
@@ -229,12 +230,13 @@ export function MarketplacePage() {
    * earlier one's, and an earlier wait that settles late never overwrites it.
    * Its pulse still goes out, because its app IS served.
    */
-  const awaitServedOrgInstall = async (manifestId: string, name: string) => {
+  const awaitServedOrgInstall = async (manifestId: string, version: string | undefined, name: string) => {
     const settle = (next: OrgDeployState) =>
       setOrgDeploy((cur) => (cur?.manifestId === manifestId ? next : cur));
-    setOrgDeploy({ phase: 'waiting', manifestId, name });
+    setOrgDeploy({ phase: 'waiting', manifestId, version, name });
     const wait = await waitForServedApp({
       manifestId,
+      version,
       // The SDK's declared list answer (`GetMetaItemsResponse`: `{ type,
       // items }`), read the way the package page reads it.
       readApps: async () => {
@@ -243,11 +245,11 @@ export function MarketplacePage() {
       },
     });
     if (!wait.served) {
-      settle({ phase: 'timeout', manifestId, name });
+      settle({ phase: 'timeout', manifestId, version, name });
       return;
     }
     emitMetadataRefresh();
-    settle({ phase: 'served', manifestId, name, app: filterActiveApps(wait.apps)[0] ?? null });
+    settle({ phase: 'served', manifestId, version, name, app: filterActiveApps(wait.apps)[0] ?? null });
   };
 
   // Install an org package into the current environment (ADR-0007 step ②).
@@ -266,22 +268,32 @@ export function MarketplacePage() {
     setOrgMsg(null);
     try {
       if (getRuntimeConfig().features.installLocal) {
-        await installLocal({ packageId: pkg.manifest_id || pkg.id, versionId: 'latest' });
-        setOrgMsg({ ok: true, text: t('marketplace.org.installed', { defaultValue: `Installed ${pkg.display_name}`, name: pkg.display_name }) });
+        const result = await installLocal({ packageId: pkg.manifest_id || pkg.id, versionId: 'latest' });
+        // objectui#12098 — `hotLoaded: false` is the runtime's lenient path
+        // (objectstack#22695): installed, loaded at its next restart. Nothing
+        // of it is served until then, so the strip says so and nothing is
+        // refreshed, as on the package page.
+        setOrgMsg({
+          ok: true,
+          text: result.hotLoaded
+            ? t('marketplace.org.installed', { defaultValue: `Installed ${pkg.display_name}`, name: pkg.display_name })
+            : t('marketplace.install.localLoadsAtRestart', { version: result.version, name: pkg.display_name }),
+        });
         await load();
-        // The runtime hot-registered the package before it answered, so the
-        // live registry already holds it. Pulse every mounted MetadataProvider
+        // On `hotLoaded` the runtime registered the package before it answered,
+        // so the live registry already holds it. Pulse every mounted MetadataProvider
         // so the new app appears in the nav (and its objects/views resolve)
         // without a manual browser refresh.
-        emitMetadataRefresh();
+        if (result.hotLoaded) emitMetadataRefresh();
       } else {
-        await installPackage({ packageId: pkg.id, environmentId: '', seedSampleData: true });
+        const installResp = await installPackage({ packageId: pkg.id, environmentId: '', seedSampleData: true });
         // objectui#12097 — this answer lands while the runtime still serves the
         // PRE-install kernel, so nothing is refreshed here: the wait refreshes
         // once the package's app is served. Not awaited, and not cancelled on
         // unmount, as on the package page: an operator who leaves this page
         // while the app deploys still gets the refreshed cache when it lands.
-        void awaitServedOrgInstall(pkg.manifest_id, pkg.display_name);
+        // It waits for the version the answer names (objectui#12098).
+        void awaitServedOrgInstall(pkg.manifest_id, installResp?.installation?.version, pkg.display_name);
         await load();
       }
     } catch (e: any) {
@@ -393,7 +405,7 @@ export function MarketplacePage() {
           <Button
             size="sm"
             variant="outline"
-            onClick={() => void awaitServedOrgInstall(orgDeploy.manifestId, orgDeploy.name)}
+            onClick={() => void awaitServedOrgInstall(orgDeploy.manifestId, orgDeploy.version, orgDeploy.name)}
           >
             {t('marketplace.install.checkAgain')}
           </Button>