diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md
index 7f319dc2..e6963e71 100644
--- a/docs/PUBLISHING.md
+++ b/docs/PUBLISHING.md
@@ -248,7 +248,7 @@ updated. To refresh it, first preserve any local workflow customizations, then
 explicitly run `tools/octo publish-github "$APP" --replace` and review
 `git -C "$APP" diff -- .github/workflows/publish-app.yml` before committing.
 Replacement writes this generated file in full; it does not merge custom steps.
-Do not replace unrelated workflows. The current pin, App Hub `c317f787`, admits
+Do not replace unrelated workflows. The current pin, App Hub `38635915`, admits
 HTTP and host-service component imports and shared components under the
 declaration-only policy; the older `769e9ee3` publisher does not. ABI requirements,
 bundle integrity and GitHub publisher-proof checks still apply.
diff --git a/docs/PUBLISHING.zh-CN.md b/docs/PUBLISHING.zh-CN.md
index bf2e8221..b60c808a 100644
--- a/docs/PUBLISHING.zh-CN.md
+++ b/docs/PUBLISHING.zh-CN.md
@@ -164,7 +164,7 @@ tools/octo publish-github "$APP"
 
 `tools/octo new` 也会安装 `.github/workflows/publish-app.yml`。这条命令只写入这个文件，不会推送、创建 Release、提交或批准应用。除非显式加上 `--replace`，否则它拒绝覆盖内容不同的已有工作流。不需要开发者签名 secret；工作流使用 GitHub 的短期任务令牌和 OIDC 权限生成证明并创建 Release。
 
-更新 App Flow 不会改变已有生成工作流固定的 Hub 版本。需要更新时，先保留自己定制的工作流步骤，再显式运行 `tools/octo publish-github "$APP" --replace`，并在提交前审阅 `git -C "$APP" diff -- .github/workflows/publish-app.yml`。替换会重写整个生成文件，不会合并定制步骤；不要用它覆盖无关工作流。当前固定的 App Hub `c317f787` 支持 HTTP、宿主服务组件导入和共享组件，并采用声明仅用于披露的策略；旧的 `769e9ee3` 发布工具不支持这些行为。ABI 要求、应用包完整性和 GitHub 发布者证明检查仍然有效。
+更新 App Flow 不会改变已有生成工作流固定的 Hub 版本。需要更新时，先保留自己定制的工作流步骤，再显式运行 `tools/octo publish-github "$APP" --replace`，并在提交前审阅 `git -C "$APP" diff -- .github/workflows/publish-app.yml`。替换会重写整个生成文件，不会合并定制步骤；不要用它覆盖无关工作流。当前固定的 App Hub `38635915` 支持 HTTP、宿主服务组件导入和共享组件，并采用声明仅用于披露的策略；旧的 `769e9ee3` 发布工具不支持这些行为。ABI 要求、应用包完整性和 GitHub 发布者证明检查仍然有效。
 
 这个固定版本还包含 [App Hub #209](https://github.com/OctoSense-org/OctoSense-App-Hub/pull/209)：
 普通 WASI TCP/UDP/DNS 导入要求 `host-api-v1` 和
diff --git a/docs/RUST.md b/docs/RUST.md
index 48f8365a..bc6c6763 100644
--- a/docs/RUST.md
+++ b/docs/RUST.md
@@ -589,7 +589,7 @@ optional ABI 1 declaration to required and refuses conflicting ABI versions.
 
 Socket apps also need socket-capable App Hub admission. This checkout's
 publisher-toolchain pin includes [App Hub #209](https://github.com/OctoSense-org/OctoSense-App-Hub/pull/209)
-at `c317f787`. Older gates and already-generated release workflows can still
+at `38635915`. Older gates and already-generated release workflows can still
 refuse them. Regenerate the app's workflow with
 `tools/octo publish-github <app> --replace`; do not remove the compatibility
 requirement to make an old gate pass. Admission does not supply a compatible
diff --git a/docs/RUST.zh-CN.md b/docs/RUST.zh-CN.md
index 194182a3..fc578380 100644
--- a/docs/RUST.zh-CN.md
+++ b/docs/RUST.zh-CN.md
@@ -407,7 +407,7 @@ host.request("wasm.resolve", {host: "localhost", port: 8080}, fn(r){
 
 套接字应用还需要支持套接字的 App Hub 准入工具。本检出版本的 publisher-toolchain
 固定到包含 [App Hub #209](https://github.com/OctoSense-org/OctoSense-App-Hub/pull/209)
-的 `c317f787`。旧准入工具和已经生成的发布工作流仍可能拒绝它。用
+的 `38635915`。旧准入工具和已经生成的发布工作流仍可能拒绝它。用
 `tools/octo publish-github <app> --replace` 重新生成工作流；不要为了通过旧准入工具
 而移除兼容性要求。准入通过不等于已经有兼容的宿主发布版。
 
diff --git a/tools/octo b/tools/octo
index 5916878f..b0f40fa6 100755
--- a/tools/octo
+++ b/tools/octo
@@ -53,7 +53,7 @@ RESERVED_NAMES = frozenset({
     "agents", "apphub", "appcard", "browser", "calculator", "card", "clock",
     "dev", "notes", "octos", "octoscode", "os", "reference", "reminders",
     "rinx", "sheets", "shell", "system", "task", "terminal", "toolbox",
-    "weather", "workflow",
+    "updater", "weather", "workflow",
 })
 PLATFORMS = ("android", "ios", "macos", "windows", "linux", "openharmony", "web")
 PNG_MAGIC = b"\x89PNG\r\n\x1a\n"
diff --git a/tools/publisher-toolchain.json b/tools/publisher-toolchain.json
index f21e8143..57b5db26 100644
--- a/tools/publisher-toolchain.json
+++ b/tools/publisher-toolchain.json
@@ -1,5 +1,5 @@
 {
   "schema": 1,
   "repository": "OctoSense-org/OctoSense-App-Hub",
-  "revision": "c317f787ea2f620543000561c2470106644c1fc7"
+  "revision": "386359153ed6377b5f047bd9ed2767a6a2ac2bc7"
 }
diff --git a/tools/test_octo.py b/tools/test_octo.py
index 8d82bfc1..efa3fe03 100644
--- a/tools/test_octo.py
+++ b/tools/test_octo.py
@@ -57,7 +57,7 @@ def test_check_exposes_and_forwards_catalog_and_publisher_keys(self):
 
     def test_reserved_ids_and_namespaces_leave_no_partial_project(self):
         names = ('agents apphub appcard browser calculator card clock dev notes octos octoscode os '
-                 'reference reminders rinx sheets shell system task terminal toolbox weather workflow').split()
+                 'reference reminders rinx sheets shell system task terminal toolbox updater weather workflow').split()
         with tempfile.TemporaryDirectory() as temp:
             for name in names:
                 for app_id in (name, 'com.example.' + name):