0.3.91 pinned the HTTP stack and still shipped mixed versions. The vendor step copies each sibling's node_modules with cp -rL, and hyper-identity-core's held a dev install (brittle -> bare-inspector -> bare-http1 4.6.1, bare-https 3.1.0, bare-tls 3.1.10). pgh's materializer (lib/materializers/node.js pickHash) links every edge to the HIGHEST version in the closure that satisfies the requirer's range, so bare-fetch's ^ ranges were wired to those dev-only trees while lib/bounded-fetch.js got the pinned 3.0.0/4.5.7 — a 4.6.1 ClientRequest on a 4.5.7 agent: the header crash, and no idle reap (drill red on the installed tree, green on a plain npm tree, same runtime). hyper-identity-core's node_modules is now production-only (b4a, hypercore-crypto), which restores the closure 0.3.88 shipped. No source change here; the version moves because the release content does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>