#189 fix(install): meridian update — thin launcher installed before arch bundle; no rollback on Step 2 failure

[Anonymous]

Originally created by: adityaharishch

Problem

In npm/meridian/bin/meridian.js, the update command:

1. Step 1: installs the thin launcher (@meridiona/meridian@latest)
2. Re-execs the new launcher
3. Step 2: installs the arch bundle (@meridiona/meridian-darwin-arm64@latest)

If Step 2 fails (network, npm 413, etc.), the thin launcher is ahead of the arch bundle by one version. A re-run of meridian update will try Step 2 again — but there is no version pinning ensuring the new launcher's Step 2 targets the same version the Step 1 just installed.

Additionally, npmInstallLatest() (defined at line ~56) installs both packages together and includes sudo elevation logic — but it is never called. The update path duplicates this with inline spawnSync calls that lack the elevation logic.

Fix

• Use npmInstallLatest() in the update path (or remove the duplicate inline calls)
• Add a version match assertion between the installed launcher and arch bundle before re-exec
• At minimum, surface a clear error when Step 2 fails after Step 1 succeeds