@clayne Great question, and thanks for reiterating it. My current plan (slightly different from what’s implemented in the latest beta release) is that the top-level node_modules/ directory in an app will provide importable packages not only for application code but also for Meteor packages. In other words, the app gets to decide which version of an npm package will be used throughout the app and its packages. Packages can still use Npm.depends to install their own local dependencies, but they can also import or require npm dependencies that they did not explicitly install, with the expectation that the application will provide those dependencies.
So, to answer your question: no, the dependency tree will not be managed by Meteor, and there will be no special enforcement of single installation, but it should be straightforward for the app to provide a single version of a common dependency.