diff --git a/Cargo.lock b/Cargo.lock
index b06c0a74..2ea76387 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1721,7 +1721,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
 dependencies = [
  "quote",
- "syn 3.0.5",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2894,7 +2894,7 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "windows-link 0.1.3",
  "windows-result 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
@@ -7451,9 +7451,9 @@ dependencies = [
 
 [[package]]
 name = "octosense-app-contract"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6df5ab53906a90e05be4e32693728539486f404bd8639d2782534338631200bf"
+checksum = "49dc5c33711174d79903daa03aef832c9b3f23c69f6dce37e6e016fdc4f6f937"
 dependencies = [
  "blake3",
  "serde",
@@ -7463,7 +7463,7 @@ dependencies = [
 [[package]]
 name = "octosense-app-hub"
 version = "0.1.0"
-source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=58c3c8aed8fc811a16d67c5f784a8a44214ff876#58c3c8aed8fc811a16d67c5f784a8a44214ff876"
+source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=0d5b47a2ae9eb98020feca26b7c895a3cf797dc1#0d5b47a2ae9eb98020feca26b7c895a3cf797dc1"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -7479,7 +7479,7 @@ dependencies = [
 [[package]]
 name = "octosense-app-hub-app"
 version = "0.1.0"
-source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=58c3c8aed8fc811a16d67c5f784a8a44214ff876#58c3c8aed8fc811a16d67c5f784a8a44214ff876"
+source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=0d5b47a2ae9eb98020feca26b7c895a3cf797dc1#0d5b47a2ae9eb98020feca26b7c895a3cf797dc1"
 dependencies = [
  "makepad-app-module",
  "makepad-widgets",
@@ -7507,7 +7507,7 @@ dependencies = [
 [[package]]
 name = "octosense-app-policy"
 version = "0.1.0"
-source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=58c3c8aed8fc811a16d67c5f784a8a44214ff876#58c3c8aed8fc811a16d67c5f784a8a44214ff876"
+source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=0d5b47a2ae9eb98020feca26b7c895a3cf797dc1#0d5b47a2ae9eb98020feca26b7c895a3cf797dc1"
 dependencies = [
  "makepad-widgets",
  "octosense-app-contract",
@@ -7529,7 +7529,7 @@ dependencies = [
 [[package]]
 name = "octosense-appstore"
 version = "0.1.0"
-source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=58c3c8aed8fc811a16d67c5f784a8a44214ff876#58c3c8aed8fc811a16d67c5f784a8a44214ff876"
+source = "git+https://github.com/OctoSense-org/OctoSense-App-Hub?rev=0d5b47a2ae9eb98020feca26b7c895a3cf797dc1#0d5b47a2ae9eb98020feca26b7c895a3cf797dc1"
 dependencies = [
  "makepad-app-module",
  "makepad-widgets",
@@ -10625,7 +10625,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell 1.21.4",
  "rustix",
  "windows-sys 0.61.2",
diff --git a/Cargo.toml b/Cargo.toml
index b7420fd5..33a9e66c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -69,7 +69,7 @@ octosense-reference = { path = "apps/reference" }
 makepad-sheets = { git = "https://github.com/OctoSense-org/makepad.git", rev = "c155f61d0e1600d2ec474209374444a38a09a470", default-features = false }
 makepad-terminal = { git = "https://github.com/OctoSense-org/makepad.git", rev = "c155f61d0e1600d2ec474209374444a38a09a470" }
 octosense-appcard = { path = "apps/appcard/module" }
-octosense-app-hub-app = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "58c3c8aed8fc811a16d67c5f784a8a44214ff876" }
+octosense-app-hub-app = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "0d5b47a2ae9eb98020feca26b7c895a3cf797dc1" }
 # END native-apps: pins
 # --- Makepad (OctoSense-org/makepad), the revision Octoscript-Makepad's
 # runtime.json pins (native-runtime.lock.json); resolved to .sources/makepad.
@@ -98,12 +98,12 @@ octoscript-makepad = { git = "https://github.com/OctoSense-org/Octoscript-Makepa
 octoscript-node = { git = "https://github.com/OctoSense-org/Octoscript-Makepad.git", rev = "2cc5ef37d7d6a3d2992673389ce74488f7bb2d87" }
 # --- App Hub's host service registry the Mail and llm services register
 # into; the same revision as App Hub's app crate (a native app, above).
-octosense-appstore = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "58c3c8aed8fc811a16d67c5f784a8a44214ff876" }
+octosense-appstore = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "0d5b47a2ae9eb98020feca26b7c895a3cf797dc1" }
 # The app policy (resolution, isolate settings, the Splash adapter) and the
 # Hub client the Card runner resolves an app's policy with; the shell's
 # glance tiles run cards under it (crates/shell/src/glance_card.rs).
-octosense-app-policy = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "58c3c8aed8fc811a16d67c5f784a8a44214ff876" }
-octosense-app-hub = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "58c3c8aed8fc811a16d67c5f784a8a44214ff876" }
+octosense-app-policy = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "0d5b47a2ae9eb98020feca26b7c895a3cf797dc1" }
+octosense-app-hub = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "0d5b47a2ae9eb98020feca26b7c895a3cf797dc1" }
 # The app contract (ADR 0005), from crates.io by version: App Hub, the shell
 # and Rinx all depend on `octosense-app-contract = "1"`, so Cargo links ONE
 # 1.x for the whole build (Cargo.lock pins the exact version OctoSense ships)
diff --git a/crates/ai-host/README.md b/crates/ai-host/README.md
index 2b04a4cb..9e117b9a 100644
--- a/crates/ai-host/README.md
+++ b/crates/ai-host/README.md
@@ -111,7 +111,7 @@ only the toolbox's part (`src/toolbox_peers.rs`, over `crates/toolbox`'s
   scope in octos's `Scope` shape under the top-level `research` object, App
   Hub #26's shape) is, **temporarily**, granted only to system apps (`os.*`)
   until the host reads App Hub's verified grant. The shells' App Hub pin
-  (`58c3c8ae`) already includes #26; the code still keeps the `os.*` gate
+  (`0d5b47a2`) already includes #26; the code still keeps the `os.*` gate
   (`system_app_only`). No system app declares `research` or `crawl` yet.
 - `ToolboxExecutor`: the relay's executor for the `toolbox` owner. It checks
   the calling app's grant again (a forged `toolbox.deep_crawl` is
diff --git a/native-apps.json b/native-apps.json
index 6d3bfd60..ec1cf6f4 100644
--- a/native-apps.json
+++ b/native-apps.json
@@ -99,7 +99,7 @@
       "id": "apphub",
       "feature": "app-hub",
       "crate": "octosense-app-hub-app",
-      "source": { "git": "https://github.com/OctoSense-org/OctoSense-App-Hub", "rev": "58c3c8aed8fc811a16d67c5f784a8a44214ff876", "local": null },
+      "source": { "git": "https://github.com/OctoSense-org/OctoSense-App-Hub", "rev": "0d5b47a2ae9eb98020feca26b7c895a3cf797dc1", "local": null },
       "module": ["octosense_app_hub_app::APP_HUB_MODULE", "octosense_app_hub_app::CARD_MODULE"],
       "bin": null,
       "default_features": true,