@ran-sh/dsh-crew 1.0.1 → 1.0.3

package/src/hub/index.mjs

@@ -3,9 +3,9 @@
 // Web UI session list), exposes a loopback jobs API for the CC/Codex MCP shim,
 // and serves the one-click installer endpoints for the settings page.
 
-import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { join, isAbsolute } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, isAbsolute, resolve as resolvePath } from 'node:path';
 import { homedir } from 'node:os';
 import { createShardWriter, readMergedStatus } from '../status-shard.mjs';
 import {
@@ -34,16 +34,19 @@ import { buildHubExecutionRows } from '../config-readiness.mjs';
 import { localRequestCore, originLoopback } from '../local-request-guard.mjs';
 import { raceWaiters } from '../removable-waiter.mjs';
 import { buildProviderInventory } from '../provider-inventory.mjs';
-import { inspectProviderProfile, readProviderDeclarations } from '../provider-profile-store.mjs';
+import { buildProviderLayerMigrationPlan, executeProviderLayerMigration } from '../provider-layer-migration.mjs';
+import { inspectProviderProfile, readProviderDeclarations, readProviderMaterialization } from '../provider-profile-store.mjs';
+import { inspectProviderSettings, readHarnessDefault, readProviderSettingsDeclarations, readProviderSettingsMaterialization } from '../provider-settings-store.mjs';
 import { normalizeProviderLifecycleState } from '../provider-lifecycle-state.mjs';
 import { createProviderHealthStore } from '../provider-health.mjs';
 import { planProviderDelete } from '../provider-lifecycle.mjs';
-import { createProviderDeleteFileHooks } from '../provider-delete-adapters.mjs';
+import { createProviderDeleteFileHooks, isRecoverableProviderDeleteBackup, readProviderDeleteManifestFile } from '../provider-delete-adapters.mjs';
 import { buildCredentialReferenceInventory } from '../credential-reference-inventory.mjs';
 import { executeCredentialPurge, planCredentialPurge } from '../credential-lifecycle.mjs';
 import { createCredentialPurgeFileHooks } from '../credential-purge-adapters.mjs';
 import { normalizeCredentialPurgeState, recordCredentialPurgeOutcome } from '../credential-purge-state.mjs';
 import { buildRuntimeReadinessSnapshot } from '../runtime-readiness-snapshot.mjs';
+import { createProviderLayerMigrationFileHooks, readProviderLayerMigrationTransactions } from '../provider-layer-migration-adapters.mjs';
 
 // policy.mjs is pure (no @deepseek-ai imports, no ctx access), so importing it
 // here is safe for the profile-realm discipline: it never pulls in package
@@ -106,19 +109,102 @@ const LEGACY_TIER_MODELS = { flash: 'deepseek-v4-flash', pro: 'deepseek-v4-pro'
 const ROLES = { worker: true, reviewer: true };
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
 const CREDENTIAL_PURGE_STATE_FILE = join(CONFIG_DIR, 'credential-purge-lifecycle.json');
+const RECOVERY_ACTION_PATTERN = /^[a-f0-9]{32}$/u;
 
-function readProviderLifecycleState() {
+function recoveryActionId(name) {
+  return createHash('sha256').update(String(name)).digest('hex').slice(0, 32);
+}
+
+function isRecoveryControlEntry(name) {
+  return name === '.quarantine'
+    || name === '.delete.lock'
+    || name === '.delete.reclaim.lock'
+    || name === '.delete.recovery.lock'
+    || name === '.delete.recovery.lock.claim'
+    || /^\.delete\.lock\.[0-9a-f-]+\.(?:active|staging|retired)$/iu.test(name)
+    || /^\.delete\.recovery\.lock\.[0-9a-f-]+\.stale$/iu.test(name);
+}
+
+function readProviderLifecycleStateStatus() {
+  const file = join(CONFIG_DIR, 'provider-lifecycle.json');
+  if (!existsSync(file)) return { ok: true, state: normalizeProviderLifecycleState() };
   try {
-    return normalizeProviderLifecycleState(JSON.parse(readFileSync(join(CONFIG_DIR, 'provider-lifecycle.json'), 'utf8')));
+    return { ok: true, state: normalizeProviderLifecycleState(JSON.parse(readFileSync(file, 'utf8'))) };
   } catch {
-    return normalizeProviderLifecycleState();
+    return { ok: false, code: 'PROVIDER_LIFECYCLE_UNAVAILABLE', state: normalizeProviderLifecycleState() };
   }
 }
 
+function readProviderLifecycleState() {
+  return readProviderLifecycleStateStatus().state;
+}
+
 function readCredentialPurgeState() {
   try { return normalizeCredentialPurgeState(JSON.parse(readFileSync(CREDENTIAL_PURGE_STATE_FILE, 'utf8'))); } catch { return normalizeCredentialPurgeState(); }
 }
 
+export function readProviderRecoveryTransactions(root = join(CONFIG_DIR, 'provider-backups')) {
+  if (!existsSync(root)) return [];
+  try {
+    const managedRoot = dirname(resolvePath(root));
+    const paths = {
+      profile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+      settings: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+      config: join(CONFIG_DIR, 'config.json'),
+      lifecycle: join(CONFIG_DIR, 'provider-lifecycle.json'),
+    };
+    const transactions = readdirSync(root, { withFileTypes: true }).filter((entry) => !isRecoveryControlEntry(entry.name)).flatMap((entry) => {
+      const transactionRoot = join(root, entry.name);
+      const manifestFile = join(root, entry.name, 'manifest.json');
+      const actionId = recoveryActionId(entry.name);
+      if (!entry.isDirectory()) {
+        let updatedAt;
+        try { updatedAt = statSync(transactionRoot).mtime.toISOString(); } catch { updatedAt = new Date(0).toISOString(); }
+        return [{ storage_id: entry.name, action_id: actionId, transaction_id: null, provider_id: null, phase: 'RECOVERY_UNRESOLVED', updated_at: updatedAt, recoverable: false, unresolved: true }];
+      }
+      try {
+        const manifest = readProviderDeleteManifestFile(manifestFile, managedRoot);
+        const transactionId = typeof manifest?.plan?.plan_id === 'string' ? manifest.plan.plan_id : null;
+        const providerId = typeof manifest?.provider_id === 'string' ? manifest.provider_id : null;
+        const phase = typeof manifest?.phase_journal?.phase === 'string' && manifest.phase_journal.phase.trim()
+          ? manifest.phase_journal.phase.trim() : 'RECOVERY_INCOMPLETE';
+        const updatedAt = typeof manifest?.phase_journal?.updated_at === 'string' && manifest.phase_journal.updated_at.trim()
+          ? manifest.phase_journal.updated_at : statSync(manifestFile).mtime.toISOString();
+        const hasPendingMutation = manifest?.mutation_journal && typeof manifest.mutation_journal === 'object'
+          && Object.keys(manifest.mutation_journal).length > 0;
+        const recoverable = transactionId != null && providerId != null && isRecoverableProviderDeleteBackup(manifest, {
+          root: transactionRoot,
+          managedRoot,
+          paths,
+          expectedProviderId: providerId,
+        }) === true;
+        if (['ROLLED_BACK', 'VERIFIED'].includes(phase) && !hasPendingMutation && recoverable) return [];
+        return [{ storage_id: entry.name, action_id: actionId, transaction_id: transactionId ?? entry.name, provider_id: providerId, phase, updated_at: updatedAt, recoverable, unresolved: recoverable !== true }];
+      } catch {
+        let updatedAt;
+        try { updatedAt = statSync(transactionRoot).mtime.toISOString(); } catch { updatedAt = new Date(0).toISOString(); }
+        return [{
+          storage_id: entry.name,
+          action_id: actionId,
+          transaction_id: null,
+          provider_id: null,
+          phase: 'RECOVERY_UNRESOLVED',
+          updated_at: updatedAt,
+          recoverable: false,
+          unresolved: true,
+        }];
+      }
+    });
+    // Recovery is a safety gate, not a bounded history view. Never discard an
+    // older unresolved transaction merely because newer entries exist.
+    return transactions.sort((a, b) => a.updated_at.localeCompare(b.updated_at));
+  } catch {
+    let updatedAt;
+    try { updatedAt = statSync(root).mtime.toISOString(); } catch { updatedAt = new Date(0).toISOString(); }
+    return [{ storage_id: null, action_id: null, transaction_id: null, provider_id: null, phase: 'RECOVERY_UNRESOLVED', updated_at: updatedAt, recoverable: false, unresolved: true }];
+  }
+}
+
 function writeCredentialPurgeState(state) {
   mkdirSync(CONFIG_DIR, { recursive: true });
   const temp = `${CREDENTIAL_PURGE_STATE_FILE}.${process.pid}.${Date.now()}.tmp`;
@@ -144,34 +230,155 @@ function providerInventoryPolicy(config) {
   };
 }
 
+export function hasCompleteProviderCatalogEvidence(evidence) {
+  return evidence?.ok === true && evidence.partial !== true;
+}
+
+export function hasCompleteProviderDeclarationEvidence(evidence) {
+  return evidence?.ok === true
+    && Object.values(evidence.sources ?? {}).every((source) => source?.present !== true || !source.code);
+}
+
+export function hasAvailableProviderLifecycleEvidence(evidence) {
+  return evidence?.ok === true;
+}
+
+export function hasPendingProviderRecoveryTransactions(inventory) {
+  return Array.isArray(inventory?.recovery_transactions) && inventory.recovery_transactions.length > 0;
+}
+
+export function hasProviderRuntimeRestartEvidence(beforeRuntimeId, currentRuntimeId) {
+  return typeof beforeRuntimeId === 'string' && beforeRuntimeId.trim() !== ''
+    && typeof currentRuntimeId === 'string' && currentRuntimeId.trim() !== ''
+    && beforeRuntimeId !== currentRuntimeId;
+}
+
+/** Preserve profile/settings provenance when preparing the migration planner. */
+export function buildProviderMigrationDeclarations(profileDeclarations = [], settingsDeclarations = []) {
+  return [
+    ...(Array.isArray(profileDeclarations) ? profileDeclarations : []),
+    ...(Array.isArray(settingsDeclarations) ? settingsDeclarations : []),
+  ];
+}
+
 async function readProviderInventorySnapshot(hub, ctx, config) {
   let catalog = { providers: [], harness_default: null };
+  let catalogEvidence = { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' };
   try {
     catalog = await readHarnessModelCatalog({
       llm: ctx.llm ?? ctx.get('llm'),
       getCurrentSelection: () => ctx.get('agentDefaultModel')?.currentSelection?.(),
     });
+    catalogEvidence = {
+      ok: catalog.partial !== true,
+      ...(catalog.partial === true ? { code: 'PROVIDER_CATALOG_INCOMPLETE' } : {}),
+      provider_count: Number.isInteger(catalog.provider_count) ? catalog.provider_count : catalog.providers.length,
+      refreshed_at: typeof catalog.refreshed_at === 'string' ? catalog.refreshed_at : null,
+      partial: catalog.partial === true,
+    };
   } catch {}
   const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
   let declarations = [];
+  let profileDeclarations = [];
+  let settingsDeclarations = [];
+  const declarationEvidence = { ok: true, sources: {} };
   try {
+    declarationEvidence.sources.profile = { present: existsSync(profileFile) };
     if (existsSync(profileFile)) {
       const source = readFileSync(profileFile, 'utf8');
       const parsed = readProviderDeclarations(source, { file: 'harness/profiles/dsh-crew/cordis.patch.yml' });
-      if (parsed.ok) declarations = parsed.declarations;
+      if (parsed.ok) {
+        profileDeclarations = parsed.declarations;
+        declarations = profileDeclarations;
+      }
+      else { declarationEvidence.ok = false; declarationEvidence.sources.profile.code = parsed.code; }
     }
-  } catch {}
-  const lifecycle = readProviderLifecycleState();
+  } catch { declarationEvidence.ok = false; declarationEvidence.sources.profile = { present: true, code: 'PROVIDER_SOURCE_UNAVAILABLE' }; }
+  const settingsFile = join(CONFIG_DIR, 'harness', 'settings.yaml');
+  let settingsDefault = null;
+  let defaultEvidence = { ok: true, source: 'none' };
+  try {
+    declarationEvidence.sources.settings = { present: existsSync(settingsFile) };
+    if (existsSync(settingsFile)) {
+      const source = readFileSync(settingsFile, 'utf8');
+      const parsed = readProviderSettingsDeclarations(source, { file: 'harness/settings.yaml' });
+      if (parsed.ok) {
+        settingsDeclarations = parsed.declarations;
+        declarations = [...declarations, ...settingsDeclarations];
+      }
+      else { declarationEvidence.ok = false; declarationEvidence.sources.settings.code = parsed.code; }
+      const parsedDefault = readHarnessDefault(source);
+      if (parsedDefault.ok) settingsDefault = parsedDefault;
+      else defaultEvidence = { ok: false, code: 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' };
+    }
+  } catch {
+    declarationEvidence.ok = false;
+    declarationEvidence.sources.settings = { present: true, code: 'PROVIDER_SOURCE_UNAVAILABLE' };
+    defaultEvidence = { ok: false, code: 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' };
+  }
+  const liveDefault = catalog.harness_default && typeof catalog.harness_default.provider === 'string' && typeof catalog.harness_default.model === 'string'
+    ? { provider: catalog.harness_default.provider, model: catalog.harness_default.model } : null;
+  const persistedDefault = settingsDefault ? { provider: settingsDefault.provider, model: settingsDefault.model } : null;
+  if (liveDefault || persistedDefault) {
+    if (!liveDefault || !persistedDefault) defaultEvidence = { ok: false, code: 'PROVIDER_DEFAULT_AUTHORITY_MISMATCH' };
+    else if (liveDefault.provider !== persistedDefault.provider || liveDefault.model !== persistedDefault.model) defaultEvidence = { ok: false, code: 'PROVIDER_DEFAULT_AUTHORITY_MISMATCH' };
+  }
+  // The persisted agent-default-model is the mutation authority. Keep it in
+  // the inventory even when the live selection is stale; the evidence gate
+  // above prevents destructive operations until both sources agree.
+  if (persistedDefault) {
+    catalog = {
+      ...catalog,
+      harness_default: persistedDefault,
+      harness_default_authority: { kind: 'harness-settings', locator: settingsDefault.locator },
+    };
+  }
+  const lifecycleEvidence = readProviderLifecycleStateStatus();
+  const lifecycle = lifecycleEvidence.state;
+  const recoveryTransactions = [
+    ...readProviderRecoveryTransactions(),
+    ...readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups')),
+  ];
   const credentialPurge = readCredentialPurgeState();
   const inventory = buildProviderInventory({
     catalog,
     declarations,
     policy: providerInventoryPolicy(config),
     tombstones: lifecycle.tombstones,
+    additionalProviderIds: [
+      ...Object.keys(lifecycle.tombstones ?? {}),
+      ...recoveryTransactions.map((entry) => entry.provider_id).filter((id) => typeof id === 'string' && id.trim()),
+    ],
     activeJobs: hub.list(),
   });
+  // Keep each authoritative source's credential reference with its own
+  // declaration. Reconstructing from the merged inventory would silently
+  // attach the first key to every layer when profile/settings differ.
+  const migrationDeclarations = buildProviderMigrationDeclarations(profileDeclarations, settingsDeclarations);
+  const routingReferences = [
+    ...(config.flash_model_priority ?? []), ...(config.pro_model_priority ?? []),
+    ...(config.worker?.model_policy?.priority ?? []), ...(config.worker?.model_policy?.escalation_priority ?? []),
+    ...(config.review?.model_policy?.priority ?? []), ...(config.review?.model_policy?.escalation_priority ?? []),
+  ];
+  const migration = buildProviderLayerMigrationPlan({
+    declarations: migrationDeclarations,
+    catalogProviders: catalog.providers,
+    harnessDefault: catalog.harness_default,
+    routingReferences,
+    tombstones: lifecycle.tombstones,
+    recoveryTransactions,
+    catalogEvidence,
+    declarationEvidence,
+    lifecycleEvidence,
+    defaultEvidence,
+  });
   return {
     ...inventory,
+    migration,
+    catalog_evidence: catalogEvidence,
+    declaration_evidence: declarationEvidence,
+    default_evidence: defaultEvidence,
+    lifecycle_evidence: lifecycleEvidence.ok ? { ok: true } : { ok: false, code: lifecycleEvidence.code },
     credential_history_refs: Object.values(lifecycle.transactions ?? {})
       .flatMap((transaction) => Array.isArray(transaction?.credential_refs) ? transaction.credential_refs : []),
     credential_purged_refs: Object.keys(credentialPurge.purged),
@@ -184,23 +391,27 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
       transaction_id: transactionId,
       provider_id: transaction.provider_id,
       state: transaction.state,
+      ...(transaction.updated_at ? { updated_at: transaction.updated_at } : {}),
       ...(transaction.expected_revision ? { expected_revision: transaction.expected_revision } : {}),
     })),
+    recovery_transactions: recoveryTransactions,
   };
 }
 
-function readProviderProfileRevision() {
+function readProviderSourceRevisions() {
   const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
-  try {
-    if (!existsSync(profileFile)) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
-    const parsed = inspectProviderProfile(readFileSync(profileFile, 'utf8'));
-    return parsed.ok ? { ok: true, revision: parsed.revision } : { ok: false, code: parsed.code };
-  } catch {
-    return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
-  }
+  const settingsFile = join(CONFIG_DIR, 'harness', 'settings.yaml');
+  const read = (file, inspect) => {
+    try {
+      if (!existsSync(file)) return { ok: false, code: 'PROVIDER_SOURCE_MISSING', revision: null };
+      const parsed = inspect(readFileSync(file, 'utf8'));
+      return parsed.ok ? { ok: true, revision: parsed.revision } : { ok: false, code: parsed.code, revision: parsed.revision ?? null };
+    } catch { return { ok: false, code: 'PROVIDER_SOURCE_UNAVAILABLE', revision: null }; }
+  };
+  return { profile: read(profileFile, inspectProviderProfile), settings: read(settingsFile, inspectProviderSettings) };
 }
-
-export function hubCanonicalEvents(job = {}) {
+
+export function hubCanonicalEvents(job = {}) {
   if (!job.id) return [];
   const role = job.role === 'reviewer' ? 'reviewer' : 'worker';
   const atStart = job.startedAt ?? null;
@@ -312,6 +523,9 @@ export function selectProviderProbeModel({ providerId, record, config } = {}) {
 export class WorkerRegistry {  constructor(ctx) {
     this.ctx = ctx;
     this.jobs = new Map();
+    this.providerMutations = new Set();
+    this.providerMutationEpochs = new Map();
+    this.providerLeases = new Map();
     this.nextId = 1;
     this.shard = createShardWriter('hub');
     this.healthStore = createProviderHealthStore();
@@ -357,9 +571,51 @@ export class WorkerRegistry {  constructor(ctx) {
     return v;
   }
 
-  list() {
-    return [...this.jobs.values()].map((job) => this.view(job));
-  }
+  list() {
+    return [...this.jobs.values()].map((job) => this.view(job));
+  }
+
+  beginProviderMutation(providerId) {
+    if (typeof providerId !== 'string' || !providerId.trim() || this.providerMutations.has(providerId)) return false;
+    this.providerMutationEpochs.set(providerId, (this.providerMutationEpochs.get(providerId) ?? 0) + 1);
+    this.providerMutations.add(providerId);
+    return true;
+  }
+
+  endProviderMutation(providerId) {
+    this.providerMutations.delete(providerId);
+  }
+
+  getProviderMutationEpoch(providerId) {
+    return this.providerMutationEpochs.get(providerId) ?? 0;
+  }
+
+  assertProviderNotMutating(providerId, expectedEpoch = undefined) {
+    if (this.providerMutations.has(providerId)
+      || (expectedEpoch !== undefined && this.getProviderMutationEpoch(providerId) !== expectedEpoch)) {
+      throw Object.assign(new Error('provider mutation is active'), { code: 'PROVIDER_DELETE_BUSY' });
+    }
+  }
+
+  acquireProviderLease(providerId) {
+    this.providerLeases.set(providerId, (this.providerLeases.get(providerId) ?? 0) + 1);
+  }
+
+  releaseProviderLease(providerId) {
+    const count = this.providerLeases.get(providerId) ?? 0;
+    if (count <= 1) this.providerLeases.delete(providerId);
+    else this.providerLeases.set(providerId, count - 1);
+  }
+
+  hasProviderLease(providerId) {
+    return (this.providerLeases.get(providerId) ?? 0) > 0;
+  }
+
+  // Profile/settings are shared stores. A migration or delete of provider A
+  // must fence a concurrent lifecycle write for provider B in this Hub.
+  beginProviderStoreMutation() { return this.beginProviderMutation('__dsh-provider-store__'); }
+  endProviderStoreMutation() { this.endProviderMutation('__dsh-provider-store__'); }
+  hasProviderStoreMutation() { return this.providerMutations.has('__dsh-provider-store__'); }
 
   publish() {
     this.shard.publish([...this.jobs.values()].map((j) => this.view(j)));
@@ -466,9 +722,20 @@ export class WorkerRegistry {  constructor(ctx) {
             candidateSet: attempt > 0 ? 'escalation' : 'primary',
           },
         });
-      }
-      if (!selection.ok) throw Object.assign(new Error(selection.message), { policyCode: selection.code });
-    }
+    }
+    if (!selection.ok) throw Object.assign(new Error(selection.message), { policyCode: selection.code });
+    }
+    const pendingLayerMigration = readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups'))
+      .find((entry) => entry.unresolved === true || entry.provider_id === selection.provider);
+    if (pendingLayerMigration) throw Object.assign(new Error('provider layer migration is pending verification'), { code: 'PROVIDER_MIGRATION_PENDING' });
+    // A process restart clears the in-memory mutation fence, so persisted
+    // provider-delete transactions must also gate admission. Unknown-owner
+    // recovery entries fence globally; known entries fence their provider.
+    const pendingProviderDelete = readProviderRecoveryTransactions()
+      .find((entry) => entry.unresolved === true || entry.provider_id === selection.provider);
+    if (pendingProviderDelete) throw Object.assign(new Error('provider delete recovery is pending'), { code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+    const providerMutationEpoch = this.getProviderMutationEpoch(selection.provider);
+    this.assertProviderNotMutating(selection.provider, providerMutationEpoch);
 
     // The worker always gets the auditable Delivery Contract appended (unless
     // it already carries one), so its final message follows ## Diff / ## Tests
@@ -527,9 +794,13 @@ export class WorkerRegistry {  constructor(ctx) {
       // Abort latch: cancel()/timeout set this the moment the job becomes
       // terminal, even while agents.create() is still pending, so a handle
       // acquired after that point is disposed instead of being driven.
-      abortRequested: false,
+      abortRequested: false,
       abortPromise: null,
       resolveAbort: null,
+      providerLease: false,
+      providerLeaseReleaseBlocked: false,
+      lateHandleCreated: false,
+      lateCreateCleanupPromise: null,
     };
     job.abortPromise = new Promise((resolve) => { job.resolveAbort = resolve; });
     const disposeJobHandle = async () => {
@@ -541,14 +812,30 @@ export class WorkerRegistry {  constructor(ctx) {
           job.handle_dispose_promise = Promise.reject(error);
         }
       }
-      await job.handle_dispose_promise;
+      try {
+        await job.handle_dispose_promise;
+      } catch (error) {
+        // A failed disposer is not proof that the provider is idle. Keep the
+        // lease fenced even when the job is already terminal; the operator
+        // must restart/reclaim the owned runtime before deletion can proceed.
+        job.providerLeaseReleaseBlocked = true;
+        throw error;
+      }
     };
     job.disposeHandle = disposeJobHandle;
     // Read-only pre-run snapshot (async, never blocks dispatch): the audit
     // only needs the before-state by the time the worker finishes. Non-repos
     // degrade to { kind:'no-git' } instead of failing the job.
-    job.baseline = await captureWorkspaceBaseline({ cwd: executionCwd }).catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace audit failed' }));
-    this.jobs.set(id, job);
+    job.baseline = await captureWorkspaceBaseline({ cwd: executionCwd }).catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace audit failed' }));
+    try {
+      this.assertProviderNotMutating(selection.provider, providerMutationEpoch);
+      this.acquireProviderLease(selection.provider);
+      job.providerLease = true;
+    } catch (error) {
+      if (isolatedWorkspace) await cleanupIsolatedWorkspace({ repoRoot: isolatedWorkspace.repoRoot, worktreePath: isolatedWorkspace.worktreePath }).catch(() => {});
+      throw error;
+    }
+    this.jobs.set(id, job);
 
     const onEvent = (session, event) => {
       switch (event.type) {
@@ -598,14 +885,15 @@ export class WorkerRegistry {  constructor(ctx) {
         job.abortPromise.then(() => ({ aborted: true })),
       ]);
       if (created.aborted) {
-        createPromise.then(async (handle) => {
-          if (handle && (job.status !== 'running' || job.abortRequested)) {
-            job.handle = handle;
-            try { await job.disposeHandle(); } catch (error) {
-              job.cleanup_warning = `agent cleanup failed: ${error?.message ?? String(error)}`;
-            }
-          }
-        }).catch(() => {});
+        job.lateCreateCleanupPromise = createPromise.then(async (handle) => {
+          if (!handle) return;
+          job.lateHandleCreated = true;
+          job.handle = handle;
+          if (job.status !== 'running' || job.abortRequested) await job.disposeHandle();
+        }).catch((error) => {
+          job.cleanup_warning = `late agent creation failed: ${error?.message ?? String(error)}`;
+          throw error;
+        });
         return;
       }
       const handle = created.handle;
@@ -674,9 +962,23 @@ export class WorkerRegistry {  constructor(ctx) {
         job.endedAt = new Date().toISOString();
         job.currentTool = null;
         let handleCleanupWarning = job.cleanup_warning ?? null;
-        try { await disposeJobHandle(); } catch (error) {
-          handleCleanupWarning = `agent cleanup failed: ${error?.message ?? String(error)}`;
-        }
+        try { await disposeJobHandle(); } catch (error) {
+          handleCleanupWarning = `agent cleanup failed: ${error?.message ?? String(error)}`;
+        }
+        if (job.providerLease) {
+          const releaseLease = () => {
+            if (!job.providerLease) return;
+            this.releaseProviderLease(job.provider);
+            job.providerLease = false;
+          };
+          if (job.lateCreateCleanupPromise) {
+            job.lateCreateCleanupPromise.then(releaseLease).catch(() => {
+              if (!job.lateHandleCreated && !job.providerLeaseReleaseBlocked) releaseLease();
+              // A late-created handle that failed disposal remains fenced by
+              // the provider lease until an operator restarts/reclaims it.
+            });
+          } else if (!job.providerLeaseReleaseBlocked) releaseLease();
+        }
         // Delivery completeness is separate from execution status: a job can
         // be done yet fail to report Diff/Tests/Risks (or Review sections for
         // an automatic review). Parse whatever final message the worker
@@ -950,11 +1252,18 @@ export async function apply(ctx) {
   const disposers = [];
   const PROVIDER_DELETE_PLAN_TTL_MS = 10 * 60 * 1000;
   const providerDeletePlans = new Map();
+  const providerMigrationPlans = new Map();
+  const providerMigrationOwners = new Map();
+  const providerStoreMutationOwners = new Map();
   const credentialPurgePlans = new Map();
   const rememberProviderDeletePlan = (plan) => {
     providerDeletePlans.set(plan.plan_id, { plan, created_at: Date.now() });
     while (providerDeletePlans.size > 32) providerDeletePlans.delete(providerDeletePlans.keys().next().value);
   };
+  const rememberProviderMigrationPlan = (plan) => {
+    providerMigrationPlans.set(plan.plan_id, { plan, created_at: Date.now() });
+    while (providerMigrationPlans.size > 32) providerMigrationPlans.delete(providerMigrationPlans.keys().next().value);
+  };
   const rememberCredentialPurgePlan = (plan) => {
     credentialPurgePlans.set(plan.plan_id, { plan, created_at: Date.now() });
     while (credentialPurgePlans.size > 32) credentialPurgePlans.delete(credentialPurgePlans.keys().next().value);
@@ -1361,23 +1670,386 @@ export async function apply(ctx) {
         try { url = new URL(req.url, 'http://localhost'); } catch { return sendJson(res, 400, { ok: false, code: 'PROVIDER_PLAN_INVALID' }); }
         const parts = url.pathname.slice(`${ROUTE_BASE}/providers`.length).split('/').filter(Boolean);
         try {
+          if (req.method === 'GET' && parts.length === 1 && parts[0] === 'migration-status') {
+            const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+            const inventory = await readProviderInventorySnapshot(hub, ctx, config);
+            return sendJson(res, 200, { ok: true, ...inventory.migration, runtime: getHubRuntimeIdentity() });
+          }
           const providerId = decodeURIComponent(parts[0]);
           const body = await readBody(req);
+          if (req.method === 'POST' && parts[0] === '_recovery' && parts[1] === 'lock' && parts.length === 2) {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_CONFIRM_REQUIRED' });
+            const hooks = createProviderDeleteFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              configFile: join(CONFIG_DIR, 'config.json'),
+              lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
+              backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
+            });
+            const recovered = await hooks.recoverLock({ force: body?.force === true });
+            const migrationHooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+            });
+            const migrationRecovered = await migrationHooks.recoverLock({ confirm: true });
+            const ok = recovered.ok === true && migrationRecovered.ok === true;
+            return sendJson(res, ok ? 200 : 409, { ok, delete_lock: recovered, migration_lock: migrationRecovered });
+          }
+          if (req.method === 'POST' && parts[0] === '_recovery' && parts[1] === 'quarantine' && parts.length === 2) {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_QUARANTINE_CONFIRM_REQUIRED' });
+            const actionId = typeof body?.action_id === 'string' && RECOVERY_ACTION_PATTERN.test(body.action_id)
+              ? body.action_id : null;
+            if (!actionId) return sendJson(res, 400, { ok: false, code: 'PROVIDER_DELETE_PLAN_INVALID' });
+            const recovery = [
+              ...readProviderRecoveryTransactions(),
+              ...readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups')),
+            ].find((entry) => entry.action_id === actionId);
+            if (!recovery) return sendJson(res, 404, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_NOT_FOUND' });
+            if (recovery.recoverable === true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_RECOVERABLE' });
+            if (typeof recovery.storage_id !== 'string') return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_QUARANTINE_FAILED' });
+            if (recovery.source === 'provider-layer-migration') {
+              try {
+                const migrationHooks = createProviderLayerMigrationFileHooks({
+                  profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+                  settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+                  backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+                });
+                const quarantined = await migrationHooks.quarantine(actionId);
+                return sendJson(res, 200, { ...quarantined, transaction_id: recovery.transaction_id ?? null });
+              } catch (error) {
+                const code = boundedMachineCodeFromError(error) ?? 'PROVIDER_MIGRATION_RECOVERY_QUARANTINE_FAILED';
+                return sendJson(res, 409, { ok: false, code });
+              }
+            }
+            try {
+              const hooks = createProviderDeleteFileHooks({
+                profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+                settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+                configFile: join(CONFIG_DIR, 'config.json'),
+                lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
+                backupDir: join(CONFIG_DIR, 'provider-backups'),
+                sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
+                afterLockAcquired: () => {
+                  const current = readProviderRecoveryTransactions().find((entry) => entry.action_id === actionId);
+                  if (!current || current.recoverable === true || current.storage_id !== recovery.storage_id) {
+                    throw Object.assign(new Error('provider recovery entry changed before quarantine'), { code: 'PROVIDER_DELETE_STATE_CHANGED' });
+                  }
+                },
+              });
+              const quarantined = await hooks.quarantine(recovery.storage_id);
+              return sendJson(res, 200, { ...quarantined, action_id: actionId, transaction_id: recovery.transaction_id ?? null });
+            } catch (error) {
+              const code = boundedMachineCodeFromError(error) ?? 'PROVIDER_DELETE_RECOVERY_QUARANTINE_FAILED';
+              return sendJson(res, 409, { ok: false, code });
+            }
+          }
           const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
           const inventory = await readProviderInventorySnapshot(hub, ctx, config);
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'migrate-plan') {
+            if (!hasCompleteProviderCatalogEvidence(inventory.catalog_evidence)) return sendJson(res, 503, { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' });
+            if (!hasCompleteProviderDeclarationEvidence(inventory.declaration_evidence)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_SOURCE_UNRESOLVED' });
+            if (!hasAvailableProviderLifecycleEvidence(inventory.lifecycle_evidence)) return sendJson(res, 503, { ok: false, code: 'PROVIDER_LIFECYCLE_UNAVAILABLE' });
+            if (inventory.default_evidence?.ok !== true) return sendJson(res, 409, { ok: false, code: inventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+            if (hasPendingProviderRecoveryTransactions(inventory)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+            const entry = inventory.migration.providers.find((candidate) => candidate.provider_id === providerId);
+            if (!entry) return sendJson(res, 404, { ok: false, code: 'PROVIDER_MIGRATION_NOT_REQUIRED' });
+            if (entry.action === 'blocked' || entry.action === 'collision-review') return sendJson(res, 409, { ok: false, code: entry.blocked_reason ?? 'PROVIDER_MIGRATION_BLOCKED' });
+            const revisions = readProviderSourceRevisions();
+            if (!revisions.profile.ok) return sendJson(res, 409, { ok: false, code: revisions.profile.code ?? 'PROVIDER_PROFILE_CHANGED' });
+            if ((entry.action === 'promote-existing-user' || entry.harness_default) && !revisions.settings.ok) return sendJson(res, 409, { ok: false, code: revisions.settings.code ?? 'PROVIDER_SETTINGS_CHANGED' });
+            const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
+            const parsedMaterialization = readProviderMaterialization(readFileSync(profileFile, 'utf8'), { providerId, file: 'harness/profiles/dsh-crew/cordis.patch.yml' });
+            if (!parsedMaterialization.ok) return sendJson(res, 409, { ok: false, code: parsedMaterialization.code });
+            const materialization = parsedMaterialization.provider;
+            let userMaterializationBefore;
+            if (entry.action === 'promote-existing-user') {
+              const settingsFile = join(CONFIG_DIR, 'harness', 'settings.yaml');
+              if (!existsSync(settingsFile)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_SETTINGS_CHANGED' });
+              const parsedUserMaterialization = readProviderSettingsMaterialization(readFileSync(settingsFile, 'utf8'), { providerId, file: 'harness/settings.yaml' });
+              if (!parsedUserMaterialization.ok) return sendJson(res, 409, { ok: false, code: parsedUserMaterialization.code });
+              userMaterializationBefore = parsedUserMaterialization.provider;
+            }
+            const plan = {
+              schema_version: 1,
+              kind: 'provider-layer-migration',
+              plan_id: randomUUID(),
+              provider_id: providerId,
+              action: entry.action,
+              source: entry.source,
+              routing_references: entry.referenced_by,
+              materialization: { provider: materialization },
+              ...(userMaterializationBefore ? { user_materialization_before: userMaterializationBefore } : {}),
+              expected_revisions: {
+                profile: revisions.profile.revision,
+                settings: revisions.settings.ok ? revisions.settings.revision : null,
+              },
+              harness_default_before: inventory.harness_default ?? null,
+              runtime_id_before: getHubRuntimeIdentity().runtime_id,
+              restart_required: true,
+            };
+            rememberProviderMigrationPlan(plan);
+            return sendJson(res, 200, { ok: true, plan });
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'migrate') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_CONFIRM_REQUIRED' });
+            const stored = providerMigrationPlans.get(body?.plan_id);
+            if (!stored || Date.now() - stored.created_at > PROVIDER_DELETE_PLAN_TTL_MS || stored.plan.provider_id !== providerId) {
+              providerMigrationPlans.delete(body?.plan_id);
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_EXPIRED' });
+            }
+            const entry = inventory.migration.providers.find((candidate) => candidate.provider_id === providerId);
+            if (!entry || entry.action !== stored.plan.action || entry.action === 'blocked' || entry.action === 'collision-review') return sendJson(res, 409, { ok: false, code: entry?.blocked_reason ?? 'PROVIDER_MIGRATION_PLAN_CHANGED' });
+            if (inventory.default_evidence?.ok !== true) return sendJson(res, 409, { ok: false, code: inventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+            const revisions = readProviderSourceRevisions();
+            const expected = stored.plan.expected_revisions ?? {};
+            if (revisions.profile.revision !== expected.profile || (revisions.settings.ok ? revisions.settings.revision : null) !== expected.settings) {
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_SOURCE_CHANGED' });
+            }
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+            });
+            let result;
+            if (hub.hasProviderLease(providerId)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_IN_USE' });
+            if (!hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+            if (!hub.beginProviderMutation(providerId)) {
+              hub.endProviderStoreMutation();
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+            }
+            let retainProviderMutation = false;
+            let retainProviderStoreMutation = false;
+            try {
+              await hooks.acquireLock();
+              // The plan was created from a pre-lock snapshot. Re-read every
+              // authoritative source after taking the shared store lock so a
+              // concurrent catalog/default/recovery change cannot be hidden
+              // behind unchanged profile/settings revisions.
+              const lockedConfig = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+              const lockedInventory = await readProviderInventorySnapshot(hub, ctx, lockedConfig);
+              const lockedEntry = lockedInventory.migration.providers.find((candidate) => candidate.provider_id === providerId);
+              const expectedRouting = Array.isArray(stored.plan.routing_references) ? stored.plan.routing_references : [];
+              const sameRouting = JSON.stringify(lockedEntry?.referenced_by ?? []) === JSON.stringify(expectedRouting);
+              const sameDefault = JSON.stringify(lockedInventory.harness_default ?? null) === JSON.stringify(stored.plan.harness_default_before ?? null);
+              const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
+              const lockedMaterialization = existsSync(profileFile)
+                ? readProviderMaterialization(readFileSync(profileFile, 'utf8'), { providerId, file: 'harness/profiles/dsh-crew/cordis.patch.yml' })
+                : { ok: false };
+              const sameMaterialization = lockedMaterialization.ok === true
+                && JSON.stringify(lockedMaterialization.provider) === JSON.stringify(stored.plan.materialization?.provider ?? null);
+              const settingsFile = join(CONFIG_DIR, 'harness', 'settings.yaml');
+              const lockedUserMaterialization = stored.plan.action === 'promote-existing-user' && existsSync(settingsFile)
+                ? readProviderSettingsMaterialization(readFileSync(settingsFile, 'utf8'), { providerId, file: 'harness/settings.yaml' })
+                : { ok: stored.plan.action !== 'promote-existing-user' };
+              const sameUserMaterialization = stored.plan.action !== 'promote-existing-user'
+                || (lockedUserMaterialization.ok === true && JSON.stringify(lockedUserMaterialization.provider) === JSON.stringify(stored.plan.user_materialization_before ?? null));
+              const lockedRevisions = readProviderSourceRevisions();
+              const expectedLocked = stored.plan.expected_revisions ?? {};
+              const sameRevisions = lockedRevisions.profile.revision === expectedLocked.profile
+                && (lockedRevisions.settings.ok ? lockedRevisions.settings.revision : null) === expectedLocked.settings;
+              if (hasPendingProviderRecoveryTransactions(lockedInventory)) {
+                return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+              }
+              if (!lockedEntry || lockedEntry.action !== stored.plan.action || lockedEntry.collision !== null
+                || !sameRouting || !sameDefault || !sameMaterialization || !sameUserMaterialization || !sameRevisions
+                || lockedInventory.default_evidence?.ok !== true
+                || !hasCompleteProviderCatalogEvidence(lockedInventory.catalog_evidence)
+                || !hasCompleteProviderDeclarationEvidence(lockedInventory.declaration_evidence)
+                || !hasAvailableProviderLifecycleEvidence(lockedInventory.lifecycle_evidence)) {
+                return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_CHANGED' });
+              }
+              if (hub.hasProviderLease(providerId)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_IN_USE' });
+              result = await executeProviderLayerMigration(stored.plan, hooks, { confirm: true, deferRestart: true });
+              if (result.ok && result.state === 'RESTART_PENDING') await hooks.setRestartRuntimeBaseline(getHubRuntimeIdentity().runtime_id);
+              providerMigrationPlans.delete(body.plan_id);
+              retainProviderMutation = result.state === 'RESTART_PENDING';
+              if (retainProviderMutation) {
+                providerMigrationOwners.set(providerId, stored.plan.plan_id);
+                providerStoreMutationOwners.set(stored.plan.plan_id, providerId);
+                retainProviderStoreMutation = true;
+              }
+              return sendJson(res, result.ok ? 202 : 409, { ok: result.ok, restart_required: result.restart_required === true, result });
+            } finally {
+              await hooks.release();
+              if (!retainProviderMutation) hub.endProviderMutation(providerId);
+              if (!retainProviderStoreMutation) hub.endProviderStoreMutation();
+            }
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'verify-migration') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_VERIFY_CONFIRM_REQUIRED' });
+            const transactionId = body?.transaction_id;
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+              existingMigrationId: transactionId,
+            });
+            let acquiredStoreFence = false;
+            try {
+              await hooks.acquireLock();
+              await hooks.backup({});
+              const plan = hooks.backupPlan();
+              if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_PROVIDER_MISMATCH' });
+              const owner = providerMigrationOwners.get(providerId);
+              if (providerStoreMutationOwners.get(plan.plan_id) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                providerStoreMutationOwners.set(plan.plan_id, providerId);
+                acquiredStoreFence = true;
+              }
+              if (owner !== plan.plan_id) {
+                if (hub.hasProviderLease(providerId) || !hub.beginProviderMutation(providerId)) {
+                  if (acquiredStoreFence && providerStoreMutationOwners.get(plan.plan_id) === providerId) { providerStoreMutationOwners.delete(plan.plan_id); hub.endProviderStoreMutation(); }
+                  return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                }
+                providerMigrationOwners.set(providerId, plan.plan_id);
+              }
+              const verification = await hooks.verify(plan);
+              const live = await readProviderInventorySnapshot(hub, ctx, config);
+              verification.catalogEvidence = live.catalog_evidence;
+              verification.defaultEvidence = live.default_evidence;
+              verification.defaultPreserved = live.default_evidence?.ok === true
+                && JSON.stringify(live.harness_default ?? null) === JSON.stringify(plan.harness_default_before ?? null);
+              verification.liveNativeRemovable = hasCompleteProviderCatalogEvidence(live.catalog_evidence)
+                && live.records.some((record) => record.id === providerId && record.lifecycle?.catalogued === true && record.native_removable === true);
+              verification.runtimeRestarted = hasProviderRuntimeRestartEvidence(plan.runtime_id_before_restart ?? plan.runtime_id_before, getHubRuntimeIdentity().runtime_id);
+              if (verification.nativeRemovable !== true || verification.liveNativeRemovable !== true || verification.defaultPreserved !== true || verification.runtimeRestarted !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_VERIFY_FAILED', verification });
+              await hooks.finalizeVerified();
+              if (providerMigrationOwners.get(providerId) === plan.plan_id) {
+                providerMigrationOwners.delete(providerId);
+                hub.endProviderMutation(providerId);
+              }
+              if (providerStoreMutationOwners.get(plan.plan_id) === providerId) {
+                providerStoreMutationOwners.delete(plan.plan_id);
+                hub.endProviderStoreMutation();
+              }
+              return sendJson(res, 200, { ok: true, state: 'VERIFIED', transaction_id: plan.plan_id, provider_id: providerId, verification });
+            } finally {
+              await hooks.release();
+              // Keep the transaction-owned fence on verification failure so
+              // an incomplete migration cannot race a new Worker; the caller
+              // must explicitly retry verification or roll it back.
+            }
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'rollback-migration') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_ROLLBACK_CONFIRM_REQUIRED' });
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+              existingMigrationId: body?.transaction_id,
+            });
+            let acquiredMigrationFence = false;
+            let retainProviderMutation = false;
+            let acquiredStoreFence = false;
+            try {
+              await hooks.acquireLock();
+              await hooks.backup({});
+              const plan = hooks.backupPlan();
+              if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_PROVIDER_MISMATCH' });
+              const owner = providerMigrationOwners.get(providerId);
+              if (providerStoreMutationOwners.get(plan.plan_id) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                providerStoreMutationOwners.set(plan.plan_id, providerId);
+                acquiredStoreFence = true;
+              }
+              if (owner !== plan.plan_id) {
+                if (hub.hasProviderLease(providerId) || !hub.beginProviderMutation(providerId)) {
+                  if (acquiredStoreFence && providerStoreMutationOwners.get(plan.plan_id) === providerId) { providerStoreMutationOwners.delete(plan.plan_id); hub.endProviderStoreMutation(); }
+                  return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                }
+                providerMigrationOwners.set(providerId, plan.plan_id);
+                acquiredMigrationFence = true;
+                retainProviderMutation = true;
+              }
+              const rollback = await hooks.rollback();
+              await hooks.setRollbackRuntimeBaseline(getHubRuntimeIdentity().runtime_id);
+              providerMigrationOwners.set(providerId, plan.plan_id);
+              retainProviderMutation = true;
+              return sendJson(res, 202, { ok: true, restart_required: true, transaction_id: plan.plan_id, provider_id: providerId, state: 'ROLLBACK_RESTART_PENDING' });
+            } finally {
+              await hooks.release();
+              if (acquiredMigrationFence && !retainProviderMutation && providerMigrationOwners.get(providerId) === body?.transaction_id) {
+                providerMigrationOwners.delete(providerId);
+                hub.endProviderMutation(providerId);
+              }
+            }
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'verify-rollback-migration') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_ROLLBACK_VERIFY_CONFIRM_REQUIRED' });
+            const transactionId = body?.transaction_id;
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+              existingMigrationId: transactionId,
+            });
+            let acquiredStoreFence = false;
+            try {
+              await hooks.acquireLock();
+              await hooks.backup({});
+              const plan = hooks.backupPlan();
+              if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_PROVIDER_MISMATCH' });
+              const owner = providerMigrationOwners.get(providerId);
+              if (providerStoreMutationOwners.get(plan.plan_id) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                providerStoreMutationOwners.set(plan.plan_id, providerId);
+                acquiredStoreFence = true;
+              }
+              if (owner !== plan.plan_id) {
+                if (hub.hasProviderLease(providerId) || !hub.beginProviderMutation(providerId)) {
+                  if (acquiredStoreFence && providerStoreMutationOwners.get(plan.plan_id) === providerId) { providerStoreMutationOwners.delete(plan.plan_id); hub.endProviderStoreMutation(); }
+                  return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                }
+                providerMigrationOwners.set(providerId, plan.plan_id);
+              }
+              const verification = await hooks.verifyRollback(plan);
+              const live = await readProviderInventorySnapshot(hub, ctx, config);
+              verification.catalogEvidence = live.catalog_evidence;
+              verification.defaultEvidence = live.default_evidence;
+              verification.defaultPreserved = live.default_evidence?.ok === true
+                && JSON.stringify(live.harness_default ?? null) === JSON.stringify(plan.harness_default_before ?? null);
+              verification.liveRestored = hasCompleteProviderCatalogEvidence(live.catalog_evidence)
+                && live.records.some((record) => record.id === providerId && record.lifecycle?.catalogued === true && record.native_removable === false);
+              verification.runtimeRestarted = hasProviderRuntimeRestartEvidence(plan.rollback_runtime_id_before, getHubRuntimeIdentity().runtime_id);
+              if (verification.ok !== true || verification.liveRestored !== true || verification.defaultPreserved !== true || verification.runtimeRestarted !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_ROLLBACK_VERIFY_FAILED', verification });
+              await hooks.finalizeRollback();
+              if (providerMigrationOwners.get(providerId) === plan.plan_id) {
+                providerMigrationOwners.delete(providerId);
+                hub.endProviderMutation(providerId);
+              }
+              if (providerStoreMutationOwners.get(plan.plan_id) === providerId) {
+                providerStoreMutationOwners.delete(plan.plan_id);
+                hub.endProviderStoreMutation();
+              }
+              return sendJson(res, 200, { ok: true, state: 'ROLLED_BACK', transaction_id: plan.plan_id, provider_id: providerId, verification });
+            } finally { await hooks.release(); }
+          }
           if (req.method === 'POST' && parts.length === 2 && parts[1] === 'delete-plan') {
-            const profile = readProviderProfileRevision();
-            if (!profile.ok) return sendJson(res, 409, { ok: false, code: profile.code });
+            if (providerId !== 'deepseek-official' && hasPendingProviderRecoveryTransactions(inventory)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+            if (providerId !== 'deepseek-official' && !hasCompleteProviderCatalogEvidence(inventory.catalog_evidence)) return sendJson(res, 503, { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' });
+            if (providerId !== 'deepseek-official' && !hasCompleteProviderDeclarationEvidence(inventory.declaration_evidence)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_SOURCE_UNRESOLVED' });
+            if (providerId !== 'deepseek-official' && !hasAvailableProviderLifecycleEvidence(inventory.lifecycle_evidence)) return sendJson(res, 503, { ok: false, code: 'PROVIDER_LIFECYCLE_UNAVAILABLE' });
+            if (providerId !== 'deepseek-official' && inventory.default_evidence?.ok !== true) return sendJson(res, 409, { ok: false, code: inventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+            const revisions = readProviderSourceRevisions();
+            if (!revisions.profile.ok && !revisions.settings.ok) return sendJson(res, 409, { ok: false, code: revisions.profile.code ?? revisions.settings.code });
+            const expectedRevision = (revisions.profile.ok ? revisions.profile.revision : null) ?? revisions.settings.revision;
             const planned = planProviderDelete({
               providerId,
               inventory,
               activeJobs: hub.list(),
               replacementDefault: body?.replacement_default,
-              expectedRevision: profile.revision,
+              expectedRevision,
+              expectedRevisions: {
+                profile: revisions.profile.ok ? revisions.profile.revision : null,
+                settings: revisions.settings.ok ? revisions.settings.revision : null,
+              },
             });
             if (!planned.ok) return sendJson(res, 409, { ok: false, code: planned.code });
-            rememberProviderDeletePlan(planned.plan);
-            return sendJson(res, 200, { ok: true, profile_revision: profile.revision, plan: planned.plan });
+            const plan = { ...planned.plan, runtime_id_before: getHubRuntimeIdentity().runtime_id };
+            rememberProviderDeletePlan(plan);
+            return sendJson(res, 200, { ok: true, profile_revision: expectedRevision, plan });
           }
           if (req.method === 'POST' && parts.length === 2 && parts[1] === 'probe') {
             const record = inventory.records.find((entry) => entry.id === providerId);
@@ -1413,9 +2085,11 @@ export async function apply(ctx) {
             const { transaction_id: transactionId } = body ?? {};
             const hooks = createProviderDeleteFileHooks({
               profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
               existingBackupId: transactionId,
               expectedProviderId: providerId,
             });
@@ -1423,11 +2097,30 @@ export async function apply(ctx) {
             if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_PROVIDER_MISMATCH' });
             await hooks.acquireLock();
             try {
+              if (providerStoreMutationOwners.get(transactionId) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+                providerStoreMutationOwners.set(transactionId, providerId);
+              }
               const verification = await hooks.verify(plan);
-              if (verification?.providerAbsent !== true || verification?.routingClear !== true || verification?.tombstonePresent !== true) {
+              const live = await readProviderInventorySnapshot(hub, ctx, config);
+              verification.catalog_evidence = live.catalog_evidence;
+              verification.default_evidence = live.default_evidence;
+              verification.catalogAbsent = hasCompleteProviderCatalogEvidence(live.catalog_evidence)
+                && !live.records.some((entry) => entry.id === providerId && entry.lifecycle?.catalogued === true);
+              verification.harnessDefault = plan.was_harness_default !== true || (
+                live.harness_default?.provider === plan.replacement_default
+                && live.harness_default?.model === plan.replacement_default_model
+              );
+              verification.runtimeRestarted = hasProviderRuntimeRestartEvidence(plan.delete_runtime_id_before_restart, getHubRuntimeIdentity().runtime_id);
+              if (verification?.providerAbsent !== true || !hasCompleteProviderCatalogEvidence(verification?.catalog_evidence) || verification?.default_evidence?.ok !== true || verification?.catalogAbsent !== true || verification?.harnessDefault !== true || verification?.runtimeRestarted !== true || verification?.routingClear !== true || verification?.tombstonePresent !== true) {
                 return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_VERIFY_FAILED', verification });
               }
               await hooks.recordTransaction({ transaction_id: transactionId, provider_id: providerId, state: 'VERIFIED' }, plan);
+              hub.endProviderMutation(providerId);
+              if (providerStoreMutationOwners.get(transactionId) === providerId) {
+                providerStoreMutationOwners.delete(transactionId);
+                hub.endProviderStoreMutation();
+              }
               return sendJson(res, 200, { ok: true, transaction_id: transactionId, provider_id: providerId, state: 'VERIFIED', verification });
             } finally {
               await hooks.release();
@@ -1438,25 +2131,41 @@ export async function apply(ctx) {
             const { transaction_id: transactionId } = body ?? {};
             const hooks = createProviderDeleteFileHooks({
               profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
               existingBackupId: transactionId,
               expectedProviderId: providerId,
             });
             await hooks.acquireLock();
+            let acquiredStoreMutation = false;
+            let retainStoreMutation = false;
             try {
               const plan = hooks.backupPlan();
               if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_PROVIDER_MISMATCH' });
+              if (providerStoreMutationOwners.get(transactionId) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+                providerStoreMutationOwners.set(transactionId, providerId);
+                acquiredStoreMutation = true;
+              }
               await hooks.rollback(plan);
+              await hooks.setRuntimeBaseline(getHubRuntimeIdentity().runtime_id, 'rollback');
+              const rollbackPlan = hooks.backupPlan() ?? plan;
               try {
-                await hooks.recordTransaction({ transaction_id: transactionId, provider_id: providerId, state: 'ROLLBACK_PENDING' }, plan);
+                await hooks.recordTransaction({ transaction_id: transactionId, provider_id: providerId, state: 'ROLLBACK_PENDING' }, rollbackPlan);
               } catch (error) {
                 return sendJson(res, 409, { ok: false, code: boundedMachineCodeFromError(error) ?? 'PROVIDER_LIFECYCLE_RECORD_FAILED' });
               }
+              retainStoreMutation = true;
               return sendJson(res, 202, { ok: true, restart_required: true, transaction_id: transactionId, provider_id: providerId, state: 'ROLLBACK_PENDING' });
             } finally {
               await hooks.release();
+              if (acquiredStoreMutation && !retainStoreMutation && providerStoreMutationOwners.get(transactionId) === providerId) {
+                providerStoreMutationOwners.delete(transactionId);
+                hub.endProviderStoreMutation();
+              }
             }
           }
           if (req.method === 'POST' && parts.length === 2 && parts[1] === 'verify-rollback') {
@@ -1464,9 +2173,11 @@ export async function apply(ctx) {
             const { transaction_id: transactionId } = body ?? {};
             const hooks = createProviderDeleteFileHooks({
               profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
               existingBackupId: transactionId,
               expectedProviderId: providerId,
             });
@@ -1474,9 +2185,28 @@ export async function apply(ctx) {
             if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_PROVIDER_MISMATCH' });
             await hooks.acquireLock();
             try {
+              if (providerStoreMutationOwners.get(transactionId) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+                providerStoreMutationOwners.set(transactionId, providerId);
+              }
               const verified = await hooks.verifyRollback(plan);
-              if (verified?.ok !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_ROLLBACK_VERIFY_FAILED' });
+              const live = await readProviderInventorySnapshot(hub, ctx, config);
+              verified.catalog_evidence = live.catalog_evidence;
+              verified.default_evidence = live.default_evidence;
+              verified.catalogPresent = hasCompleteProviderCatalogEvidence(live.catalog_evidence)
+                && live.records.some((entry) => entry.id === providerId && entry.lifecycle?.catalogued === true);
+              verified.harnessDefaultRestored = plan.was_harness_default !== true || (
+                live.harness_default?.provider === plan.harness_default_before?.provider
+                && live.harness_default?.model === plan.harness_default_before?.model
+              );
+              verified.runtimeRestarted = hasProviderRuntimeRestartEvidence(plan.rollback_runtime_id_before_restart, getHubRuntimeIdentity().runtime_id);
+              if (verified?.ok !== true || !hasCompleteProviderCatalogEvidence(verified?.catalog_evidence) || verified?.default_evidence?.ok !== true || verified?.catalogPresent !== true || verified?.harnessDefaultRestored !== true || verified?.runtimeRestarted !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_ROLLBACK_VERIFY_FAILED', verification: verified });
               await hooks.recordTransaction({ transaction_id: transactionId, provider_id: providerId, state: 'ROLLED_BACK' }, plan);
+              hub.endProviderMutation(providerId);
+              if (providerStoreMutationOwners.get(transactionId) === providerId) {
+                providerStoreMutationOwners.delete(transactionId);
+                hub.endProviderStoreMutation();
+              }
               return sendJson(res, 200, { ok: true, transaction_id: transactionId, provider_id: providerId, state: 'ROLLED_BACK' });
             } finally {
               await hooks.release();
@@ -1492,33 +2222,128 @@ export async function apply(ctx) {
               providerDeletePlans.delete(body?.plan_id);
               return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_EXPIRED' });
             }
-            const profile = readProviderProfileRevision();
-            if (!profile.ok) return sendJson(res, 409, { ok: false, code: profile.code });
-            if (body?.expected_revision !== stored.plan.expected_revision || profile.revision !== stored.plan.expected_revision) {
+            const revisions = readProviderSourceRevisions();
+            if (!revisions.profile.ok && !revisions.settings.ok) return sendJson(res, 409, { ok: false, code: revisions.profile.code ?? revisions.settings.code });
+            if (providerId !== 'deepseek-official' && !hasCompleteProviderCatalogEvidence(inventory.catalog_evidence)) return sendJson(res, 503, { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' });
+            if (providerId !== 'deepseek-official' && !hasCompleteProviderDeclarationEvidence(inventory.declaration_evidence)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_SOURCE_UNRESOLVED' });
+            if (providerId !== 'deepseek-official' && !hasAvailableProviderLifecycleEvidence(inventory.lifecycle_evidence)) return sendJson(res, 503, { ok: false, code: 'PROVIDER_LIFECYCLE_UNAVAILABLE' });
+            if (providerId !== 'deepseek-official' && inventory.default_evidence?.ok !== true) return sendJson(res, 409, { ok: false, code: inventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+            const storedExpected = stored.plan.expected_revisions;
+            const revisionsMatch = storedExpected
+              ? (storedExpected.profile === (revisions.profile.ok ? revisions.profile.revision : null)
+                && storedExpected.settings === (revisions.settings.ok ? revisions.settings.revision : null))
+              : (body?.expected_revision === stored.plan.expected_revision && (revisions.profile.revision ?? revisions.settings.revision) === stored.plan.expected_revision);
+            if (!revisionsMatch || body?.expected_revision !== stored.plan.expected_revision) {
               return sendJson(res, 409, { ok: false, code: 'PROVIDER_PROFILE_CHANGED' });
             }
+            if (providerId !== 'deepseek-official' && hasPendingProviderRecoveryTransactions(inventory)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
             const refreshed = planProviderDelete({
               providerId,
               inventory,
               activeJobs: hub.list(),
               replacementDefault: stored.plan.replacement_default,
-              expectedRevision: profile.revision,
+              expectedRevision: stored.plan.expected_revision,
+              expectedRevisions: stored.plan.expected_revisions,
             });
             if (!refreshed.ok) return sendJson(res, 409, { ok: false, code: refreshed.code });
             if (refreshed.plan.replacement_default_model !== stored.plan.replacement_default_model) {
               return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_CHANGED' });
             }
-            const executionPlan = { ...refreshed.plan, plan_id: stored.plan.plan_id, expected_revision: stored.plan.expected_revision };
-            const hooks = createProviderDeleteFileHooks({
-              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
-              configFile: join(CONFIG_DIR, 'config.json'),
-              lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
-              backupDir: join(CONFIG_DIR, 'provider-backups'),
-            });
-            providerDeletePlans.delete(body.plan_id);
-            const { executeProviderDelete } = await import('../provider-lifecycle.mjs');
-            const result = await executeProviderDelete(executionPlan, hooks, { deferRestart: true });
-            return sendJson(res, result.state === 'RESTART_PENDING' ? 202 : 409, { ok: result.state === 'RESTART_PENDING', restart_required: true, result });
+            let executionPlan = {
+              ...refreshed.plan,
+              plan_id: stored.plan.plan_id,
+              expected_revision: stored.plan.expected_revision,
+              expected_revisions: stored.plan.expected_revisions,
+              runtime_id_before: stored.plan.runtime_id_before,
+            };
+            if (!hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+            if (!hub.beginProviderMutation(providerId)) {
+              hub.endProviderStoreMutation();
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+            }
+            let hooks = null;
+            let lockAcquired = false;
+            let retainProviderMutation = false;
+            let retainProviderStoreMutation = false;
+            try {
+              hooks = createProviderDeleteFileHooks({
+                profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+                settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+                configFile: join(CONFIG_DIR, 'config.json'),
+                lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
+                backupDir: join(CONFIG_DIR, 'provider-backups'),
+                sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
+                runtimeIdProvider: () => getHubRuntimeIdentity().runtime_id,
+                afterLockAcquired: () => {
+                  const pendingRecovery = [
+                    ...readProviderRecoveryTransactions(),
+                    ...readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups')),
+                  ];
+                  if (pendingRecovery.length > 0) {
+                    throw Object.assign(new Error('provider recovery transaction is pending'), { code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+                  }
+                  if (hub.hasProviderLease(providerId)) {
+                    throw Object.assign(new Error('provider is in use'), { code: 'PROVIDER_IN_USE' });
+                  }
+                },
+              });
+              // Hold the real shared store lock while rebuilding the live
+              // inventory and delete plan. The pre-lock plan is only a
+              // proposal; catalog/default/ownership/recovery facts must be
+              // authoritative at the mutation boundary.
+              await hooks.acquireLock();
+              lockAcquired = true;
+              const lockedConfig = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+              const lockedInventory = await readProviderInventorySnapshot(hub, ctx, lockedConfig);
+              const lockedRevisions = readProviderSourceRevisions();
+              const lockedExpected = stored.plan.expected_revisions;
+              const lockedRevisionsMatch = lockedExpected
+                ? lockedExpected.profile === (lockedRevisions.profile.ok ? lockedRevisions.profile.revision : null)
+                  && lockedExpected.settings === (lockedRevisions.settings.ok ? lockedRevisions.settings.revision : null)
+                : false;
+              if (providerId !== 'deepseek-official' && !hasCompleteProviderCatalogEvidence(lockedInventory.catalog_evidence)) throw Object.assign(new Error('provider catalog unavailable after lock'), { code: 'MODEL_CATALOG_UNAVAILABLE' });
+              if (providerId !== 'deepseek-official' && !hasCompleteProviderDeclarationEvidence(lockedInventory.declaration_evidence)) throw Object.assign(new Error('provider declarations unavailable after lock'), { code: 'PROVIDER_DELETE_SOURCE_UNRESOLVED' });
+              if (providerId !== 'deepseek-official' && !hasAvailableProviderLifecycleEvidence(lockedInventory.lifecycle_evidence)) throw Object.assign(new Error('provider lifecycle unavailable after lock'), { code: 'PROVIDER_LIFECYCLE_UNAVAILABLE' });
+              if (providerId !== 'deepseek-official' && lockedInventory.default_evidence?.ok !== true) throw Object.assign(new Error('provider default authority changed after lock'), { code: lockedInventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+              if (providerId !== 'deepseek-official' && hasPendingProviderRecoveryTransactions(lockedInventory)) throw Object.assign(new Error('provider recovery transaction is pending'), { code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+              if (!lockedRevisionsMatch) throw Object.assign(new Error('provider source changed after lock'), { code: 'PROVIDER_PROFILE_CHANGED' });
+              if (hub.hasProviderLease(providerId)) throw Object.assign(new Error('provider is in use'), { code: 'PROVIDER_IN_USE' });
+              const lockedPlan = planProviderDelete({
+                providerId,
+                inventory: lockedInventory,
+                activeJobs: hub.list(),
+                replacementDefault: stored.plan.replacement_default,
+                expectedRevision: stored.plan.expected_revision,
+                expectedRevisions: stored.plan.expected_revisions,
+              });
+              if (!lockedPlan.ok) throw Object.assign(new Error('provider delete plan changed after lock'), { code: lockedPlan.code });
+              const sameLockedPlan = lockedPlan.plan.replacement_default_model === stored.plan.replacement_default_model
+                && lockedPlan.plan.was_harness_default === stored.plan.was_harness_default
+                && JSON.stringify(lockedPlan.plan.declaration_authorities) === JSON.stringify(stored.plan.declaration_authorities)
+                && JSON.stringify(lockedPlan.plan.harness_default_before ?? null) === JSON.stringify(stored.plan.harness_default_before ?? null)
+                && JSON.stringify(lockedPlan.plan.credential_refs) === JSON.stringify(stored.plan.credential_refs);
+              if (!sameLockedPlan) throw Object.assign(new Error('provider delete plan semantics changed after lock'), { code: 'PROVIDER_DELETE_PLAN_CHANGED' });
+              executionPlan = {
+                ...lockedPlan.plan,
+                plan_id: stored.plan.plan_id,
+                expected_revision: stored.plan.expected_revision,
+                expected_revisions: stored.plan.expected_revisions,
+                runtime_id_before: stored.plan.runtime_id_before,
+              };
+              providerDeletePlans.delete(body.plan_id);
+              const { executeProviderDelete } = await import('../provider-lifecycle.mjs');
+              const result = await executeProviderDelete(executionPlan, hooks, { deferRestart: true });
+              retainProviderMutation = result.state === 'RESTART_PENDING';
+              if (retainProviderMutation) {
+                providerStoreMutationOwners.set(executionPlan.plan_id, providerId);
+                retainProviderStoreMutation = true;
+              }
+              return sendJson(res, result.state === 'RESTART_PENDING' ? 202 : 409, { ok: result.state === 'RESTART_PENDING', restart_required: true, result });
+            } finally {
+              if (lockAcquired && hooks) await hooks.release().catch(() => {});
+              if (!retainProviderMutation) hub.endProviderMutation(providerId);
+              if (!retainProviderStoreMutation) hub.endProviderStoreMutation();
+            }
           }
           return sendJson(res, 404, { ok: false, error: 'unknown providers endpoint' });
         } catch (err) {