@dsh-enhanced/lark-channel 0.1.23 → 0.1.30

package/lib/supervised-growth-setup.js

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { isMap, isSeq, parseDocument } from 'yaml';
 import { installDshResidentService, residentServiceKind } from './resident.js';
-import { isMainEntry } from './setup.js';
+import { isMainEntry, withDshHomeLifecycleLock } from './setup.js';
 import { assertEffectiveSupervisedGrowthConfig, configureSupervisedGrowthProfilePatch, supervisedGrowthDatabasePaths, supervisedGrowthBindingQuery, supervisedGrowthAnalystRuntimeConfig, supervisedGrowthRecoveryRuntimeConfig, } from './supervised-growth-profile.js';
 const keyPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 function argumentValue(argv, index, option) {
@@ -240,6 +240,349 @@ export async function restartAndVerifySupervisedGrowthResident(input) {
     await (input.verify ?? verifySupervisedGrowthResidentService)(service);
     return service;
 }
+export const SUPERVISED_GROWTH_LIFECYCLE_ATTESTATION_PROTOCOL = 'dsh-enhanced/supervised-growth-lifecycle-attestation/v1';
+export const SUPERVISED_GROWTH_MANAGED_AUTOMATION_PROJECTION_PROTOCOL = 'dsh-enhanced/supervised-growth-managed-automations/v1';
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const record = value;
+    return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
+}
+function digestJson(value) {
+    return createHash('sha256').update(canonicalJson(value)).digest('hex');
+}
+function deepFreeze(value) {
+    if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            deepFreeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function sortedAutomationRecords(records) {
+    return Object.freeze([...records].sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+}
+function effectivePluginConfig(effectiveConfig, id) {
+    const document = parseDocument(effectiveConfig, { uniqueKeys: true });
+    if (document.errors.length > 0 || !isSeq(document.contents)) {
+        throw new Error('supervised-growth lifecycle: effective profile is invalid');
+    }
+    const rows = document.contents.items.filter(item => isMap(item)
+        && item.get('id') === id);
+    if (rows.length !== 1 || rows[0].get('disabled') === true) {
+        throw new Error(`supervised-growth lifecycle: ${id} must be uniquely enabled`);
+    }
+    const config = rows[0].get('config', true);
+    if (!isMap(config))
+        throw new Error(`supervised-growth lifecycle: ${id} config is invalid`);
+    return config;
+}
+function assertLifecycleProviderContract(input) {
+    const expected = input.stage === 'preview' ? ['larkChannel'] : [];
+    if (!Array.isArray(input.externalProviderExemptions)
+        || !isDeepStrictEqual(input.externalProviderExemptions, expected)) {
+        throw new Error(`supervised-growth lifecycle: ${input.stage} external provider exemptions are invalid`);
+    }
+    const lark = effectivePluginConfig(input.effectiveConfig, 'dsh-enhanced-lark-channel');
+    const health = effectivePluginConfig(input.effectiveConfig, 'dsh-enhanced-assistant-health');
+    const providers = health.get('requiredProviders', true);
+    const requiredProviders = isSeq(providers) ? providers.toJSON() : undefined;
+    if (input.stage === 'preview') {
+        if (lark.get('enabled') !== false) {
+            throw new Error('supervised-growth lifecycle: preview Lark channel must be disabled');
+        }
+        if (requiredProviders === undefined || requiredProviders.includes('larkChannel')) {
+            throw new Error('supervised-growth lifecycle: preview Health must exempt larkChannel');
+        }
+    }
+    else {
+        if (lark.get('enabled') !== true) {
+            throw new Error('supervised-growth lifecycle: active Lark channel must be enabled');
+        }
+        if (requiredProviders === undefined || !requiredProviders.includes('larkChannel')) {
+            throw new Error('supervised-growth lifecycle: active Health must require larkChannel');
+        }
+    }
+    return Object.freeze([...expected]);
+}
+function sameRecoveryObservation(left, right) {
+    return left.snapshotDigest === right.snapshotDigest
+        && left.database.device === right.database.device
+        && left.database.inode === right.database.inode
+        && left.database.digest === right.database.digest;
+}
+function sameAutomationObservation(left, right) {
+    return left.inventoryDigest === right.inventoryDigest
+        && left.database.device === right.database.device
+        && left.database.inode === right.database.inode
+        && left.database.digest === right.database.digest
+        && isDeepStrictEqual(left.sidecars, right.sidecars)
+        && left.inFlightCount === right.inFlightCount
+        && isDeepStrictEqual(left.records, right.records);
+}
+function recoveryJobIdentity(effectiveConfig) {
+    const config = supervisedGrowthRecoveryRuntimeConfig(effectiveConfig);
+    const jobs = config['jobs'];
+    if (!Array.isArray(jobs))
+        throw new Error('supervised-growth lifecycle: Recovery jobs are invalid');
+    const matches = jobs.filter((job) => typeof job === 'object'
+        && job !== null && !Array.isArray(job) && job['id'] === 'supervised-growth');
+    if (matches.length !== 1) {
+        throw new Error('supervised-growth lifecycle: exact Recovery job is missing or duplicated');
+    }
+    const job = matches[0];
+    if ((job['activationState'] !== 'preview' && job['activationState'] !== 'active')
+        || typeof job['activationNonce'] !== 'string' || job['activationNonce'].trim() === ''
+        || !/^[a-f\d]{64}$/u.test(String(job['catalogDigest']))) {
+        throw new Error('supervised-growth lifecycle: Recovery activation identity is invalid');
+    }
+    return {
+        activationState: job['activationState'],
+        activationNonce: job['activationNonce'],
+        catalogDigest: String(job['catalogDigest']),
+    };
+}
+function configuredRecoveryIdentities(effectiveConfig) {
+    const jobs = supervisedGrowthRecoveryRuntimeConfig(effectiveConfig)['jobs'];
+    if (!Array.isArray(jobs) || jobs.length > 100) {
+        throw new Error('supervised-growth lifecycle: Recovery jobs are invalid');
+    }
+    const result = new Map();
+    for (const [index, raw] of jobs.entries()) {
+        if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+            throw new Error(`supervised-growth lifecycle: Recovery job ${index} is invalid`);
+        }
+        const job = raw;
+        const id = job['id'];
+        const activationState = job['activationState'] ?? 'paused';
+        const activationNonce = job['activationNonce'];
+        if (typeof id !== 'string' || id.trim() === ''
+            || (activationState !== 'active' && activationState !== 'paused' && activationState !== 'preview')
+            || typeof activationNonce !== 'string' || activationNonce.trim() === '') {
+            throw new Error(`supervised-growth lifecycle: Recovery job ${index} identity is invalid`);
+        }
+        const automationId = `recovery:${id.normalize('NFC').trim()}`;
+        if (result.has(automationId)) {
+            throw new Error('supervised-growth lifecycle: Recovery automation ids are duplicated');
+        }
+        result.set(automationId, Object.freeze({
+            activationState, activationNonce: activationNonce.normalize('NFC').trim(),
+        }));
+    }
+    return result;
+}
+async function lifecycleDependencies(dependencies) {
+    const [automations, recovery] = await Promise.all([
+        import('@dsh-enhanced/assistant-automations'),
+        import('@dsh-enhanced/assistant-recovery'),
+    ]);
+    return {
+        inspectRecovery: dependencies.inspectRecovery ?? recovery.inspectRecoveryOperatorSnapshot,
+        inspectAutomations: dependencies.inspectAutomations ?? automations.inspectAutomationsOperatorSnapshot,
+        expectedBootstrap: dependencies.expectedBootstrap ?? expectedSupervisedGrowthRecoveryBootstrap,
+        expectedAnalystDefinition: dependencies.expectedAnalystDefinition
+            ?? expectedSupervisedGrowthAnalystDefinition,
+        definitionDigest: dependencies.definitionDigest ?? automations.automationDefinitionDigest,
+    };
+}
+async function expectedManagedAutomationRecords(input, dependencies) {
+    const recovery = await import('@dsh-enhanced/assistant-recovery');
+    const normalized = recovery.normalizeRecoveryConfig({
+        ...supervisedGrowthRecoveryRuntimeConfig(input.effectiveConfig),
+        databasePath: input.recoveryDatabasePath,
+    });
+    const supervisedJob = normalized.jobs.find(candidate => candidate.id === 'supervised-growth');
+    if (supervisedJob === undefined || supervisedJob.activationState !== input.stage) {
+        throw new Error('supervised-growth lifecycle: effective Recovery stage does not match the requested target');
+    }
+    const analystDefinition = await dependencies.expectedAnalystDefinition(input.effectiveConfig);
+    const records = normalized.jobs.map(job => [`recovery:${job.id}`, Object.freeze({
+            owner: 'dsh-enhanced-assistant-recovery',
+            status: job.activationState === 'active' ? 'active' : 'paused',
+            definitionHash: dependencies.definitionDigest(recovery.recoveryAutomationDefinition(job, normalized.maxStepDurationMs, job.activationState === 'preview' ? 'preview' : 'production')),
+        })]);
+    records.push(['heartbeat:supervised-growth-analyst', Object.freeze({
+            owner: 'assistant-heartbeat',
+            status: input.stage === 'active' ? 'active' : 'paused',
+            definitionHash: dependencies.definitionDigest(analystDefinition),
+        })]);
+    return new Map(records);
+}
+/** Build the exact content-free managed projection before a Host is started. */
+export async function expectedSupervisedGrowthManagedAutomationDigest(input, supplied = {}) {
+    const dependencies = await lifecycleDependencies(supplied);
+    const expected = await expectedManagedAutomationRecords(input, dependencies);
+    const records = Object.freeze([...expected.entries()].map(([id, record]) => Object.freeze({
+        id, owner: record.owner, status: record.status, definitionHash: record.definitionHash,
+    })).sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+    const unsigned = Object.freeze({
+        protocol: SUPERVISED_GROWTH_MANAGED_AUTOMATION_PROJECTION_PROTOCOL,
+        records,
+    });
+    return deepFreeze({ ...unsigned, digest: digestJson(unsigned) });
+}
+function assertManagedAutomationInventory(input) {
+    if (input.snapshot.inFlightCount !== 0
+        || input.snapshot.records.some(record => record.runningTaskCount !== 0)) {
+        throw new Error('supervised-growth lifecycle: Automations has in-flight work');
+    }
+    const records = new Map(input.snapshot.records.map(record => [record.id, record]));
+    for (const [id, expected] of input.expected) {
+        const actual = records.get(id);
+        if (actual === undefined || actual.owner !== expected.owner || actual.status !== expected.status
+            || actual.definitionHash !== expected.definitionHash) {
+            throw new Error(`supervised-growth lifecycle: managed automation ${id} does not match the exact ${input.stage} definition`);
+        }
+    }
+    const legacy = records.get('heartbeat:supervised-growth');
+    if (legacy?.status === 'active') {
+        throw new Error('supervised-growth lifecycle: legacy supervised-growth automation is active');
+    }
+    for (const record of input.snapshot.records) {
+        if (record.status !== 'active' || record.owner !== 'dsh-enhanced-assistant-recovery')
+            continue;
+        if (!input.expected.has(record.id)) {
+            throw new Error(`supervised-growth lifecycle: unexpected active managed automation ${record.id}`);
+        }
+    }
+}
+function assertRecoverySnapshot(input) {
+    const bootstrap = input.snapshot.bootstrap;
+    if (input.previousGeneration !== undefined
+        && bootstrap.generation <= input.previousGeneration) {
+        throw new Error('supervised-growth lifecycle: Recovery bootstrap generation did not strictly advance');
+    }
+    if (bootstrap.status !== 'succeeded' || !bootstrap.attestationValid
+        || bootstrap.attestationSetDigest !== input.expected.attestationSetDigest
+        || !isDeepStrictEqual(bootstrap.attestations, input.expected.attestations)) {
+        throw new Error(`supervised-growth lifecycle: Recovery ${input.stage} proof does not match the exact effective plan`);
+    }
+    const configured = configuredRecoveryIdentities(input.effectiveConfig);
+    if (bootstrap.attestations.length !== configured.size) {
+        throw new Error('supervised-growth lifecycle: Recovery attestation set is incomplete');
+    }
+    for (const attestation of bootstrap.attestations) {
+        const job = configured.get(attestation.automationId);
+        if (job === undefined || job.activationState !== attestation.activationState
+            || job.activationNonce !== attestation.activationNonce) {
+            throw new Error('supervised-growth lifecycle: Recovery attestation identity does not match effective config');
+        }
+    }
+}
+async function observeLifecycle(input, dependencies) {
+    const expectedBootstrap = await dependencies.expectedBootstrap(input.effectiveConfig, input.recoveryDatabasePath);
+    const expectedManaged = await expectedManagedAutomationRecords(input, dependencies);
+    const [recovery, automations] = await Promise.all([
+        dependencies.inspectRecovery(input.recoveryDatabasePath),
+        dependencies.inspectAutomations(input.automationsDatabasePath),
+    ]);
+    return { recovery, automations, expectedBootstrap, expectedManaged };
+}
+function createLifecycleAttestation(input, observed) {
+    const identity = recoveryJobIdentity(input.effectiveConfig);
+    const externalProviderExemptions = assertLifecycleProviderContract(input);
+    const recoveryAttestation = observed.expectedBootstrap.attestations.find(value => value.automationId === 'recovery:supervised-growth');
+    if (recoveryAttestation === undefined || recoveryAttestation.activationState !== input.stage) {
+        throw new Error('supervised-growth lifecycle: supervised Recovery attestation is missing');
+    }
+    const recoveryDefinition = observed.expectedManaged.get('recovery:supervised-growth');
+    if (recoveryDefinition === undefined)
+        throw new Error('supervised-growth lifecycle: Recovery definition is missing');
+    // The content-free contract carries the runbook identity through the
+    // definition digest, while explicit catalog/nonce digests make upgrade
+    // policy checks possible without persisting either secret-free raw value.
+    const unsigned = deepFreeze({
+        protocol: SUPERVISED_GROWTH_LIFECYCLE_ATTESTATION_PROTOCOL,
+        schemaVersion: 1,
+        profile: input.profile.normalize('NFC').trim(),
+        stage: input.stage,
+        externalProviderExemptions,
+        effectiveConfigDigest: createHash('sha256').update(input.effectiveConfig).digest('hex'),
+        recovery: deepFreeze({
+            schemaVersion: observed.recovery.schemaVersion,
+            database: observed.recovery.database,
+            snapshotDigest: observed.recovery.snapshotDigest,
+            bootstrapGeneration: observed.recovery.bootstrap.generation,
+            bootstrapAttestationSetDigest: observed.recovery.bootstrap.attestationSetDigest,
+            bootstrapAttestations: observed.recovery.bootstrap.attestations,
+            activationNonceDigest: createHash('sha256').update(identity.activationNonce).digest('hex'),
+            catalogDigest: identity.catalogDigest,
+        }),
+        automations: deepFreeze({
+            schemaVersion: observed.automations.schemaVersion,
+            database: observed.automations.database,
+            sidecars: observed.automations.sidecars,
+            inventoryDigest: observed.automations.inventoryDigest,
+            snapshotDigest: digestJson(observed.automations),
+            inFlightCount: 0,
+            records: sortedAutomationRecords(observed.automations.records),
+        }),
+    });
+    return deepFreeze({ ...unsigned, attestationDigest: digestJson(unsigned) });
+}
+export function supervisedGrowthLifecycleAttestationDigest(value) {
+    return digestJson(value);
+}
+/**
+ * Capture one stable, content-free supervised lifecycle baseline. This function
+ * does not lock, stop, restart, patch, migrate, or otherwise mutate a service.
+ */
+export async function captureSupervisedGrowthLifecycleAttestation(input, supplied = {}) {
+    if (!keyPattern.test(input.profile))
+        throw new Error('supervised-growth lifecycle: invalid profile');
+    assertLifecycleProviderContract(input);
+    const dependencies = await lifecycleDependencies(supplied);
+    const first = await observeLifecycle(input, dependencies);
+    assertRecoverySnapshot({
+        stage: input.stage, effectiveConfig: input.effectiveConfig,
+        snapshot: first.recovery, expected: first.expectedBootstrap,
+    });
+    assertManagedAutomationInventory({ stage: input.stage, snapshot: first.automations, expected: first.expectedManaged });
+    const second = await observeLifecycle(input, dependencies);
+    if (!sameRecoveryObservation(first.recovery, second.recovery)
+        || !sameAutomationObservation(first.automations, second.automations)
+        || !isDeepStrictEqual(first.expectedBootstrap, second.expectedBootstrap)
+        || !isDeepStrictEqual([...first.expectedManaged], [...second.expectedManaged])) {
+        throw new Error('supervised-growth lifecycle: operator state changed while capturing the baseline');
+    }
+    assertRecoverySnapshot({
+        stage: input.stage, effectiveConfig: input.effectiveConfig,
+        snapshot: second.recovery, expected: second.expectedBootstrap,
+    });
+    assertManagedAutomationInventory({ stage: input.stage, snapshot: second.automations, expected: second.expectedManaged });
+    return createLifecycleAttestation(input, second);
+}
+/**
+ * Verify a stable successor against a prior accepted lifecycle proof. The new
+ * Recovery generation must be strictly newer; a changed runbook/catalog must
+ * also carry a fresh activation nonce so old preview authority cannot be reused.
+ */
+export async function verifySupervisedGrowthLifecycleSuccessor(input, supplied = {}) {
+    const { attestationDigest, ...unsignedBaseline } = input.baseline;
+    if (input.baseline.protocol !== SUPERVISED_GROWTH_LIFECYCLE_ATTESTATION_PROTOCOL
+        || input.baseline.schemaVersion !== 1
+        || attestationDigest !== supervisedGrowthLifecycleAttestationDigest(unsignedBaseline)
+        || input.target.profile !== input.baseline.profile) {
+        throw new Error('supervised-growth lifecycle: baseline contract is invalid');
+    }
+    const successor = await captureSupervisedGrowthLifecycleAttestation(input.target, supplied);
+    if (successor.recovery.bootstrapGeneration <= input.baseline.recovery.bootstrapGeneration) {
+        throw new Error('supervised-growth lifecycle: Recovery successor generation did not strictly advance');
+    }
+    // Preview and active intentionally share one nonce even though their exact
+    // Automation definitions differ (preview is paused and uses a one-shot
+    // schedule; active is scheduled). The catalog digest is the stable identity
+    // of the compiled Recovery runbook, so only a catalog change requires a new
+    // nonce across lifecycle generations.
+    const runbookChanged = successor.recovery.catalogDigest !== input.baseline.recovery.catalogDigest;
+    if (runbookChanged
+        && successor.recovery.activationNonceDigest === input.baseline.recovery.activationNonceDigest) {
+        throw new Error('supervised-growth lifecycle: changed Recovery runbook reused the old activation nonce');
+    }
+    return successor;
+}
 async function inspectRecoveryBootstrap(databasePath) {
     const { RecoveryStore } = await import('@dsh-enhanced/assistant-recovery');
     const store = new RecoveryStore({ path: databasePath });
@@ -561,95 +904,97 @@ export async function runSupervisedGrowthSetup(argv = process.argv.slice(2)) {
     const dshHome = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
     if (!isAbsolute(dshHome))
         throw new Error('supervised-growth setup: DSH_HOME must be absolute');
-    const patchPath = join(dshHome, 'profiles', args.profile, 'cordis.patch.yml');
-    const originalPatch = await readFile(patchPath, 'utf8');
-    const effectiveBefore = dumpProfile(args.profile);
-    const query = supervisedGrowthBindingQuery(effectiveBefore, dshHome);
-    const databases = supervisedGrowthDatabasePaths(effectiveBefore, dshHome);
-    const binding = await awaitOwnerBinding({
-        databasePath: databases.deliveryDatabasePath, query, timeoutMs: args.timeoutMs,
-    });
-    const { listActiveAutomationsLocally } = await import('@dsh-enhanced/assistant-automations');
-    assertSupervisedGrowthAutomationGuard(listActiveAutomationsLocally(databases.automationsDatabasePath), args.ackExistingAutomations);
-    const { RECOVERY_CATALOG_DIGEST } = await import('@dsh-enhanced/assistant-recovery');
-    const activationNonce = randomUUID();
-    const previewPatch = configureSupervisedGrowthProfilePatch({
-        profilePatch: originalPatch,
-        effectiveConfig: effectiveBefore,
-        dshHome,
-        binding,
-        activationState: 'preview',
-        activationNonce,
-        recoveryCatalogDigest: RECOVERY_CATALOG_DIGEST,
-    });
-    await assertSelectedOwnerBindingCurrent({
-        databasePath: databases.deliveryDatabasePath,
-        query,
-        selected: binding,
-    });
-    let service;
-    let acceptedBootstrapGeneration;
-    await activateSupervisedGrowthRecoveryStages({
-        patchPath,
-        originalPatch,
-        previewPatch,
-        validate: stage => {
-            const effectiveConfig = dumpProfile(args.profile);
-            assertEffectiveSupervisedGrowthConfig({
-                effectiveConfig,
-                dshHome,
-                binding,
-                activationState: stage,
-                activationNonce,
-                recoveryCatalogDigest: RECOVERY_CATALOG_DIGEST,
-            });
-            return effectiveConfig;
-        },
-        buildActivePatch: previewEffective => configureSupervisedGrowthProfilePatch({
-            profilePatch: previewPatch,
-            effectiveConfig: previewEffective,
+    return withDshHomeLifecycleLock(dshHome, async () => {
+        const patchPath = join(dshHome, 'profiles', args.profile, 'cordis.patch.yml');
+        const originalPatch = await readFile(patchPath, 'utf8');
+        const effectiveBefore = dumpProfile(args.profile);
+        const query = supervisedGrowthBindingQuery(effectiveBefore, dshHome);
+        const databases = supervisedGrowthDatabasePaths(effectiveBefore, dshHome);
+        const binding = await awaitOwnerBinding({
+            databasePath: databases.deliveryDatabasePath, query, timeoutMs: args.timeoutMs,
+        });
+        const { listActiveAutomationsLocally } = await import('@dsh-enhanced/assistant-automations');
+        assertSupervisedGrowthAutomationGuard(listActiveAutomationsLocally(databases.automationsDatabasePath), args.ackExistingAutomations);
+        const { RECOVERY_CATALOG_DIGEST } = await import('@dsh-enhanced/assistant-recovery');
+        const activationNonce = randomUUID();
+        const previewPatch = configureSupervisedGrowthProfilePatch({
+            profilePatch: originalPatch,
+            effectiveConfig: effectiveBefore,
             dshHome,
             binding,
-            activationState: 'active',
+            activationState: 'preview',
             activationNonce,
             recoveryCatalogDigest: RECOVERY_CATALOG_DIGEST,
-        }),
-        afterStage: async (stage, effectiveConfig) => {
-            const effectiveDatabases = supervisedGrowthDatabasePaths(effectiveConfig, dshHome);
-            if (effectiveDatabases.deliveryDatabasePath !== databases.deliveryDatabasePath
-                || effectiveDatabases.automationsDatabasePath !== databases.automationsDatabasePath
-                || effectiveDatabases.recoveryDatabasePath !== databases.recoveryDatabasePath) {
-                throw new Error('supervised-growth setup: a higher-priority profile layer changed a guarded local database path');
-            }
-            // The binding is re-read after the atomic write and again immediately
-            // before restart. A rotation/revocation/version change must never become
-            // a background delivery grant merely because its old snapshot was valid.
-            await assertSelectedOwnerBindingCurrent({
-                databasePath: databases.deliveryDatabasePath,
-                query,
-                selected: binding,
-            });
-            const previousBootstrapGeneration = acceptedBootstrapGeneration
-                ?? await recoveryBootstrapGenerationBeforeRestart(databases.recoveryDatabasePath);
-            service = await restartAndVerifySupervisedGrowthResident({ dshHome, profile: args.profile });
-            acceptedBootstrapGeneration = await verifySupervisedGrowthRecoveryStage({
-                stage,
-                effectiveConfig,
-                recoveryDatabasePath: databases.recoveryDatabasePath,
-                automationsDatabasePath: databases.automationsDatabasePath,
-                previousBootstrapGeneration,
-                timeoutMs: args.timeoutMs,
-            });
-        },
-        restore: async () => {
-            dumpProfile(args.profile);
-            await restartAndVerifySupervisedGrowthResident({ dshHome, profile: args.profile });
-        },
+        });
+        await assertSelectedOwnerBindingCurrent({
+            databasePath: databases.deliveryDatabasePath,
+            query,
+            selected: binding,
+        });
+        let service;
+        let acceptedBootstrapGeneration;
+        await activateSupervisedGrowthRecoveryStages({
+            patchPath,
+            originalPatch,
+            previewPatch,
+            validate: stage => {
+                const effectiveConfig = dumpProfile(args.profile);
+                assertEffectiveSupervisedGrowthConfig({
+                    effectiveConfig,
+                    dshHome,
+                    binding,
+                    activationState: stage,
+                    activationNonce,
+                    recoveryCatalogDigest: RECOVERY_CATALOG_DIGEST,
+                });
+                return effectiveConfig;
+            },
+            buildActivePatch: previewEffective => configureSupervisedGrowthProfilePatch({
+                profilePatch: previewPatch,
+                effectiveConfig: previewEffective,
+                dshHome,
+                binding,
+                activationState: 'active',
+                activationNonce,
+                recoveryCatalogDigest: RECOVERY_CATALOG_DIGEST,
+            }),
+            afterStage: async (stage, effectiveConfig) => {
+                const effectiveDatabases = supervisedGrowthDatabasePaths(effectiveConfig, dshHome);
+                if (effectiveDatabases.deliveryDatabasePath !== databases.deliveryDatabasePath
+                    || effectiveDatabases.automationsDatabasePath !== databases.automationsDatabasePath
+                    || effectiveDatabases.recoveryDatabasePath !== databases.recoveryDatabasePath) {
+                    throw new Error('supervised-growth setup: a higher-priority profile layer changed a guarded local database path');
+                }
+                // The binding is re-read after the atomic write and again immediately
+                // before restart. A rotation/revocation/version change must never become
+                // a background delivery grant merely because its old snapshot was valid.
+                await assertSelectedOwnerBindingCurrent({
+                    databasePath: databases.deliveryDatabasePath,
+                    query,
+                    selected: binding,
+                });
+                const previousBootstrapGeneration = acceptedBootstrapGeneration
+                    ?? await recoveryBootstrapGenerationBeforeRestart(databases.recoveryDatabasePath);
+                service = await restartAndVerifySupervisedGrowthResident({ dshHome, profile: args.profile });
+                acceptedBootstrapGeneration = await verifySupervisedGrowthRecoveryStage({
+                    stage,
+                    effectiveConfig,
+                    recoveryDatabasePath: databases.recoveryDatabasePath,
+                    automationsDatabasePath: databases.automationsDatabasePath,
+                    previousBootstrapGeneration,
+                    timeoutMs: args.timeoutMs,
+                });
+            },
+            restore: async () => {
+                dumpProfile(args.profile);
+                await restartAndVerifySupervisedGrowthResident({ dshHome, profile: args.profile });
+            },
+        });
+        if (service === undefined)
+            throw new Error('supervised-growth setup: resident restart did not return a service');
+        process.stdout.write(`supervised-growth/v2 Recovery 已启用：owner binding ${binding.id}，Recovery 每日上限 7；独立 adoption analyst 每日上限 1。\n`
+            + `DSH Host 已由 ${service.kind} 重启并通过健康检查。状态：${service.statusCommand}\n日志：${service.logCommand}\n`);
     });
-    if (service === undefined)
-        throw new Error('supervised-growth setup: resident restart did not return a service');
-    process.stdout.write(`supervised-growth/v2 Recovery 已启用：owner binding ${binding.id}，Recovery 每日上限 7；独立 adoption analyst 每日上限 1。\n`
-        + `DSH Host 已由 ${service.kind} 重启并通过健康检查。状态：${service.statusCommand}\n日志：${service.logCommand}\n`);
 }
 if (process.argv[1] !== undefined && isMainEntry(import.meta.url, process.argv[1])) {
     void runSupervisedGrowthSetup().catch(error => {