diff --git a/CHANGELOG.md b/CHANGELOG.md
index c49d57c9..b6ce7071 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to
 Entries are newest-first; one bullet per notable change. See the root `AGENTS.md`
 "Project Versioning" section for the bump policy.
 
+## [0.18.9] - 2026-07-22
+
+- punk::mod 0.1.2: punk::apps `latest` app-version selection fixed (version-selection audit) - a plain lexical sort picked the LOWEST version as latest (and misorders 1.10 vs 1.9); now `package vcompare`-sorted highest, empty unversioned-main entries excluded. Audit outcome: all other punk-owned `[package versions]` consumers already sort with vcompare; naive sorts remain only in vendored third-party code (tcllib doctools, pattern-1.2.8.tm) - flagged, not edited, per the vendor no-edit policy.
+
 ## [0.18.8] - 2026-07-22
 
 - `bin/punk-runtime.cmd` `list -remote`: remote-only rows skip support files (artifact metadata tomls etc now ride in the server's sha1sums beside runtimes - same extension set the local candidate filter excludes); the `(= server default)` active marker also recognizes a materialized working copy via its beside-toml artifact identity (the default names an immutable `-r<N>` artifact while the active is typically its working name - exact-name matching alone would never fire post-family). Verified live against the first published family artifacts.
diff --git a/punkproject.toml b/punkproject.toml
index 481144fb..fc433ee9 100644
--- a/punkproject.toml
+++ b/punkproject.toml
@@ -1,4 +1,4 @@
 [project]
 name = "punkshell"
-version = "0.18.8"
+version = "0.18.9"
 license = "BSD-2-Clause"
diff --git a/src/modules/punk/mod-999999.0a1.0.tm b/src/modules/punk/mod-999999.0a1.0.tm
index 16dc4a46..8e940202 100644
--- a/src/modules/punk/mod-999999.0a1.0.tm
+++ b/src/modules/punk/mod-999999.0a1.0.tm
@@ -71,12 +71,16 @@ namespace eval punk::mod::cli {
             }
         }
         dict set appinfo versions $versions
-        #todo - natsort!
-        set sorted_versions [lsort $versions]
-        set latest [lindex $sorted_versions 0]
-        if {$latest eq "" && [llength $sorted_versions] > 1} {
-            set latest [lindex $sorted_versions 1]
+        #version-aware selection (2026-07-22 audit): was a plain lexical lsort
+        #(1.10 sorts before 1.9) with lindex 0 - the LOWEST - as 'latest'.
+        #Empty version (unversioned main) is excluded from comparison (package
+        #vcompare errors on empty operands); latest = highest by vcompare.
+        set realversions {}
+        foreach v $versions {
+            if {$v ne ""} {lappend realversions $v}
         }
+        set sorted_versions [lsort -command {package vcompare} $realversions]
+        set latest [lindex $sorted_versions end] ;#"" when only an unversioned main exists
         dict set appinfo latest $latest
 
         dict set appinfo bases $bases
diff --git a/src/modules/punk/mod-buildversion.txt b/src/modules/punk/mod-buildversion.txt
index c3ca4d16..e50551c7 100644
--- a/src/modules/punk/mod-buildversion.txt
+++ b/src/modules/punk/mod-buildversion.txt
@@ -1,3 +1,4 @@
 0.1.1
 #First line must be a semantic version number
-#all other lines are ignored.
\ No newline at end of file
+#all other lines are ignored.
+#0.1.2 - punk::apps appinfo 'latest' selection fixed (2026-07-22 version-selection audit): was a plain lexical lsort (1.10 before 1.9) taking lindex 0 - the LOWEST - as latest; now lsort -command {package vcompare} taking the highest, with empty (unversioned-main) entries excluded from comparison (vcompare errors on empty operands).
\ No newline at end of file