@ran-sh/dsh-crew 1.0.2 → 1.0.3

package/src/hub/index.mjs

@@ -34,8 +34,9 @@ import { buildHubExecutionRows } from '../config-readiness.mjs';
 import { localRequestCore, originLoopback } from '../local-request-guard.mjs';
 import { raceWaiters } from '../removable-waiter.mjs';
 import { buildProviderInventory } from '../provider-inventory.mjs';
-import { inspectProviderProfile, readProviderDeclarations } from '../provider-profile-store.mjs';
-import { inspectProviderSettings, readHarnessDefault, readProviderSettingsDeclarations } from '../provider-settings-store.mjs';
+import { buildProviderLayerMigrationPlan, executeProviderLayerMigration } from '../provider-layer-migration.mjs';
+import { inspectProviderProfile, readProviderDeclarations, readProviderMaterialization } from '../provider-profile-store.mjs';
+import { inspectProviderSettings, readHarnessDefault, readProviderSettingsDeclarations, readProviderSettingsMaterialization } from '../provider-settings-store.mjs';
 import { normalizeProviderLifecycleState } from '../provider-lifecycle-state.mjs';
 import { createProviderHealthStore } from '../provider-health.mjs';
 import { planProviderDelete } from '../provider-lifecycle.mjs';
@@ -45,6 +46,7 @@ import { executeCredentialPurge, planCredentialPurge } from '../credential-lifec
 import { createCredentialPurgeFileHooks } from '../credential-purge-adapters.mjs';
 import { normalizeCredentialPurgeState, recordCredentialPurgeOutcome } from '../credential-purge-state.mjs';
 import { buildRuntimeReadinessSnapshot } from '../runtime-readiness-snapshot.mjs';
+import { createProviderLayerMigrationFileHooks, readProviderLayerMigrationTransactions } from '../provider-layer-migration-adapters.mjs';
 
 // policy.mjs is pure (no @deepseek-ai imports, no ctx access), so importing it
 // here is safe for the profile-realm discipline: it never pulls in package
@@ -193,7 +195,9 @@ export function readProviderRecoveryTransactions(root = join(CONFIG_DIR, 'provid
         }];
       }
     });
-    return transactions.sort((a, b) => a.updated_at.localeCompare(b.updated_at)).slice(-64);
+    // Recovery is a safety gate, not a bounded history view. Never discard an
+    // older unresolved transaction merely because newer entries exist.
+    return transactions.sort((a, b) => a.updated_at.localeCompare(b.updated_at));
   } catch {
     let updatedAt;
     try { updatedAt = statSync(root).mtime.toISOString(); } catch { updatedAt = new Date(0).toISOString(); }
@@ -249,6 +253,14 @@ export function hasProviderRuntimeRestartEvidence(beforeRuntimeId, currentRuntim
     && beforeRuntimeId !== currentRuntimeId;
 }
 
+/** Preserve profile/settings provenance when preparing the migration planner. */
+export function buildProviderMigrationDeclarations(profileDeclarations = [], settingsDeclarations = []) {
+  return [
+    ...(Array.isArray(profileDeclarations) ? profileDeclarations : []),
+    ...(Array.isArray(settingsDeclarations) ? settingsDeclarations : []),
+  ];
+}
+
 async function readProviderInventorySnapshot(hub, ctx, config) {
   let catalog = { providers: [], harness_default: null };
   let catalogEvidence = { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' };
@@ -267,13 +279,18 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
   } catch {}
   const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
   let declarations = [];
+  let profileDeclarations = [];
+  let settingsDeclarations = [];
   const declarationEvidence = { ok: true, sources: {} };
   try {
     declarationEvidence.sources.profile = { present: existsSync(profileFile) };
     if (existsSync(profileFile)) {
       const source = readFileSync(profileFile, 'utf8');
       const parsed = readProviderDeclarations(source, { file: 'harness/profiles/dsh-crew/cordis.patch.yml' });
-      if (parsed.ok) declarations = parsed.declarations;
+      if (parsed.ok) {
+        profileDeclarations = parsed.declarations;
+        declarations = profileDeclarations;
+      }
       else { declarationEvidence.ok = false; declarationEvidence.sources.profile.code = parsed.code; }
     }
   } catch { declarationEvidence.ok = false; declarationEvidence.sources.profile = { present: true, code: 'PROVIDER_SOURCE_UNAVAILABLE' }; }
@@ -285,7 +302,10 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
     if (existsSync(settingsFile)) {
       const source = readFileSync(settingsFile, 'utf8');
       const parsed = readProviderSettingsDeclarations(source, { file: 'harness/settings.yaml' });
-      if (parsed.ok) declarations = [...declarations, ...parsed.declarations];
+      if (parsed.ok) {
+        settingsDeclarations = parsed.declarations;
+        declarations = [...declarations, ...settingsDeclarations];
+      }
       else { declarationEvidence.ok = false; declarationEvidence.sources.settings.code = parsed.code; }
       const parsedDefault = readHarnessDefault(source);
       if (parsedDefault.ok) settingsDefault = parsedDefault;
@@ -315,7 +335,10 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
   }
   const lifecycleEvidence = readProviderLifecycleStateStatus();
   const lifecycle = lifecycleEvidence.state;
-  const recoveryTransactions = readProviderRecoveryTransactions();
+  const recoveryTransactions = [
+    ...readProviderRecoveryTransactions(),
+    ...readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups')),
+  ];
   const credentialPurge = readCredentialPurgeState();
   const inventory = buildProviderInventory({
     catalog,
@@ -328,8 +351,30 @@ async function readProviderInventorySnapshot(hub, ctx, config) {
     ],
     activeJobs: hub.list(),
   });
+  // Keep each authoritative source's credential reference with its own
+  // declaration. Reconstructing from the merged inventory would silently
+  // attach the first key to every layer when profile/settings differ.
+  const migrationDeclarations = buildProviderMigrationDeclarations(profileDeclarations, settingsDeclarations);
+  const routingReferences = [
+    ...(config.flash_model_priority ?? []), ...(config.pro_model_priority ?? []),
+    ...(config.worker?.model_policy?.priority ?? []), ...(config.worker?.model_policy?.escalation_priority ?? []),
+    ...(config.review?.model_policy?.priority ?? []), ...(config.review?.model_policy?.escalation_priority ?? []),
+  ];
+  const migration = buildProviderLayerMigrationPlan({
+    declarations: migrationDeclarations,
+    catalogProviders: catalog.providers,
+    harnessDefault: catalog.harness_default,
+    routingReferences,
+    tombstones: lifecycle.tombstones,
+    recoveryTransactions,
+    catalogEvidence,
+    declarationEvidence,
+    lifecycleEvidence,
+    defaultEvidence,
+  });
   return {
     ...inventory,
+    migration,
     catalog_evidence: catalogEvidence,
     declaration_evidence: declarationEvidence,
     default_evidence: defaultEvidence,
@@ -565,6 +610,12 @@ export class WorkerRegistry {  constructor(ctx) {
   hasProviderLease(providerId) {
     return (this.providerLeases.get(providerId) ?? 0) > 0;
   }
+
+  // Profile/settings are shared stores. A migration or delete of provider A
+  // must fence a concurrent lifecycle write for provider B in this Hub.
+  beginProviderStoreMutation() { return this.beginProviderMutation('__dsh-provider-store__'); }
+  endProviderStoreMutation() { this.endProviderMutation('__dsh-provider-store__'); }
+  hasProviderStoreMutation() { return this.providerMutations.has('__dsh-provider-store__'); }
 
   publish() {
     this.shard.publish([...this.jobs.values()].map((j) => this.view(j)));
@@ -671,9 +722,18 @@ export class WorkerRegistry {  constructor(ctx) {
             candidateSet: attempt > 0 ? 'escalation' : 'primary',
           },
         });
-      }
-      if (!selection.ok) throw Object.assign(new Error(selection.message), { policyCode: selection.code });
     }
+    if (!selection.ok) throw Object.assign(new Error(selection.message), { policyCode: selection.code });
+    }
+    const pendingLayerMigration = readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups'))
+      .find((entry) => entry.unresolved === true || entry.provider_id === selection.provider);
+    if (pendingLayerMigration) throw Object.assign(new Error('provider layer migration is pending verification'), { code: 'PROVIDER_MIGRATION_PENDING' });
+    // A process restart clears the in-memory mutation fence, so persisted
+    // provider-delete transactions must also gate admission. Unknown-owner
+    // recovery entries fence globally; known entries fence their provider.
+    const pendingProviderDelete = readProviderRecoveryTransactions()
+      .find((entry) => entry.unresolved === true || entry.provider_id === selection.provider);
+    if (pendingProviderDelete) throw Object.assign(new Error('provider delete recovery is pending'), { code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
     const providerMutationEpoch = this.getProviderMutationEpoch(selection.provider);
     this.assertProviderNotMutating(selection.provider, providerMutationEpoch);
 
@@ -1192,11 +1252,18 @@ export async function apply(ctx) {
   const disposers = [];
   const PROVIDER_DELETE_PLAN_TTL_MS = 10 * 60 * 1000;
   const providerDeletePlans = new Map();
+  const providerMigrationPlans = new Map();
+  const providerMigrationOwners = new Map();
+  const providerStoreMutationOwners = new Map();
   const credentialPurgePlans = new Map();
   const rememberProviderDeletePlan = (plan) => {
     providerDeletePlans.set(plan.plan_id, { plan, created_at: Date.now() });
     while (providerDeletePlans.size > 32) providerDeletePlans.delete(providerDeletePlans.keys().next().value);
   };
+  const rememberProviderMigrationPlan = (plan) => {
+    providerMigrationPlans.set(plan.plan_id, { plan, created_at: Date.now() });
+    while (providerMigrationPlans.size > 32) providerMigrationPlans.delete(providerMigrationPlans.keys().next().value);
+  };
   const rememberCredentialPurgePlan = (plan) => {
     credentialPurgePlans.set(plan.plan_id, { plan, created_at: Date.now() });
     while (credentialPurgePlans.size > 32) credentialPurgePlans.delete(credentialPurgePlans.keys().next().value);
@@ -1603,6 +1670,11 @@ export async function apply(ctx) {
         try { url = new URL(req.url, 'http://localhost'); } catch { return sendJson(res, 400, { ok: false, code: 'PROVIDER_PLAN_INVALID' }); }
         const parts = url.pathname.slice(`${ROUTE_BASE}/providers`.length).split('/').filter(Boolean);
         try {
+          if (req.method === 'GET' && parts.length === 1 && parts[0] === 'migration-status') {
+            const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+            const inventory = await readProviderInventorySnapshot(hub, ctx, config);
+            return sendJson(res, 200, { ok: true, ...inventory.migration, runtime: getHubRuntimeIdentity() });
+          }
           const providerId = decodeURIComponent(parts[0]);
           const body = await readBody(req);
           if (req.method === 'POST' && parts[0] === '_recovery' && parts[1] === 'lock' && parts.length === 2) {
@@ -1613,19 +1685,44 @@ export async function apply(ctx) {
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
             });
             const recovered = await hooks.recoverLock({ force: body?.force === true });
-            return sendJson(res, recovered.ok ? 200 : 409, recovered);
+            const migrationHooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+            });
+            const migrationRecovered = await migrationHooks.recoverLock({ confirm: true });
+            const ok = recovered.ok === true && migrationRecovered.ok === true;
+            return sendJson(res, ok ? 200 : 409, { ok, delete_lock: recovered, migration_lock: migrationRecovered });
           }
           if (req.method === 'POST' && parts[0] === '_recovery' && parts[1] === 'quarantine' && parts.length === 2) {
             if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_QUARANTINE_CONFIRM_REQUIRED' });
             const actionId = typeof body?.action_id === 'string' && RECOVERY_ACTION_PATTERN.test(body.action_id)
               ? body.action_id : null;
             if (!actionId) return sendJson(res, 400, { ok: false, code: 'PROVIDER_DELETE_PLAN_INVALID' });
-            const recovery = readProviderRecoveryTransactions().find((entry) => entry.action_id === actionId);
+            const recovery = [
+              ...readProviderRecoveryTransactions(),
+              ...readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups')),
+            ].find((entry) => entry.action_id === actionId);
             if (!recovery) return sendJson(res, 404, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_NOT_FOUND' });
             if (recovery.recoverable === true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_RECOVERABLE' });
             if (typeof recovery.storage_id !== 'string') return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_QUARANTINE_FAILED' });
+            if (recovery.source === 'provider-layer-migration') {
+              try {
+                const migrationHooks = createProviderLayerMigrationFileHooks({
+                  profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+                  settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+                  backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+                });
+                const quarantined = await migrationHooks.quarantine(actionId);
+                return sendJson(res, 200, { ...quarantined, transaction_id: recovery.transaction_id ?? null });
+              } catch (error) {
+                const code = boundedMachineCodeFromError(error) ?? 'PROVIDER_MIGRATION_RECOVERY_QUARANTINE_FAILED';
+                return sendJson(res, 409, { ok: false, code });
+              }
+            }
             try {
               const hooks = createProviderDeleteFileHooks({
                 profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
@@ -1633,6 +1730,7 @@ export async function apply(ctx) {
                 configFile: join(CONFIG_DIR, 'config.json'),
                 lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
                 backupDir: join(CONFIG_DIR, 'provider-backups'),
+                sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
                 afterLockAcquired: () => {
                   const current = readProviderRecoveryTransactions().find((entry) => entry.action_id === actionId);
                   if (!current || current.recoverable === true || current.storage_id !== recovery.storage_id) {
@@ -1649,6 +1747,285 @@ export async function apply(ctx) {
           }
           const config = normalizeGlobalConfig(hub.getConfig?.() ?? {});
           const inventory = await readProviderInventorySnapshot(hub, ctx, config);
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'migrate-plan') {
+            if (!hasCompleteProviderCatalogEvidence(inventory.catalog_evidence)) return sendJson(res, 503, { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' });
+            if (!hasCompleteProviderDeclarationEvidence(inventory.declaration_evidence)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_SOURCE_UNRESOLVED' });
+            if (!hasAvailableProviderLifecycleEvidence(inventory.lifecycle_evidence)) return sendJson(res, 503, { ok: false, code: 'PROVIDER_LIFECYCLE_UNAVAILABLE' });
+            if (inventory.default_evidence?.ok !== true) return sendJson(res, 409, { ok: false, code: inventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+            if (hasPendingProviderRecoveryTransactions(inventory)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+            const entry = inventory.migration.providers.find((candidate) => candidate.provider_id === providerId);
+            if (!entry) return sendJson(res, 404, { ok: false, code: 'PROVIDER_MIGRATION_NOT_REQUIRED' });
+            if (entry.action === 'blocked' || entry.action === 'collision-review') return sendJson(res, 409, { ok: false, code: entry.blocked_reason ?? 'PROVIDER_MIGRATION_BLOCKED' });
+            const revisions = readProviderSourceRevisions();
+            if (!revisions.profile.ok) return sendJson(res, 409, { ok: false, code: revisions.profile.code ?? 'PROVIDER_PROFILE_CHANGED' });
+            if ((entry.action === 'promote-existing-user' || entry.harness_default) && !revisions.settings.ok) return sendJson(res, 409, { ok: false, code: revisions.settings.code ?? 'PROVIDER_SETTINGS_CHANGED' });
+            const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
+            const parsedMaterialization = readProviderMaterialization(readFileSync(profileFile, 'utf8'), { providerId, file: 'harness/profiles/dsh-crew/cordis.patch.yml' });
+            if (!parsedMaterialization.ok) return sendJson(res, 409, { ok: false, code: parsedMaterialization.code });
+            const materialization = parsedMaterialization.provider;
+            let userMaterializationBefore;
+            if (entry.action === 'promote-existing-user') {
+              const settingsFile = join(CONFIG_DIR, 'harness', 'settings.yaml');
+              if (!existsSync(settingsFile)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_SETTINGS_CHANGED' });
+              const parsedUserMaterialization = readProviderSettingsMaterialization(readFileSync(settingsFile, 'utf8'), { providerId, file: 'harness/settings.yaml' });
+              if (!parsedUserMaterialization.ok) return sendJson(res, 409, { ok: false, code: parsedUserMaterialization.code });
+              userMaterializationBefore = parsedUserMaterialization.provider;
+            }
+            const plan = {
+              schema_version: 1,
+              kind: 'provider-layer-migration',
+              plan_id: randomUUID(),
+              provider_id: providerId,
+              action: entry.action,
+              source: entry.source,
+              routing_references: entry.referenced_by,
+              materialization: { provider: materialization },
+              ...(userMaterializationBefore ? { user_materialization_before: userMaterializationBefore } : {}),
+              expected_revisions: {
+                profile: revisions.profile.revision,
+                settings: revisions.settings.ok ? revisions.settings.revision : null,
+              },
+              harness_default_before: inventory.harness_default ?? null,
+              runtime_id_before: getHubRuntimeIdentity().runtime_id,
+              restart_required: true,
+            };
+            rememberProviderMigrationPlan(plan);
+            return sendJson(res, 200, { ok: true, plan });
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'migrate') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_CONFIRM_REQUIRED' });
+            const stored = providerMigrationPlans.get(body?.plan_id);
+            if (!stored || Date.now() - stored.created_at > PROVIDER_DELETE_PLAN_TTL_MS || stored.plan.provider_id !== providerId) {
+              providerMigrationPlans.delete(body?.plan_id);
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_EXPIRED' });
+            }
+            const entry = inventory.migration.providers.find((candidate) => candidate.provider_id === providerId);
+            if (!entry || entry.action !== stored.plan.action || entry.action === 'blocked' || entry.action === 'collision-review') return sendJson(res, 409, { ok: false, code: entry?.blocked_reason ?? 'PROVIDER_MIGRATION_PLAN_CHANGED' });
+            if (inventory.default_evidence?.ok !== true) return sendJson(res, 409, { ok: false, code: inventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+            const revisions = readProviderSourceRevisions();
+            const expected = stored.plan.expected_revisions ?? {};
+            if (revisions.profile.revision !== expected.profile || (revisions.settings.ok ? revisions.settings.revision : null) !== expected.settings) {
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_SOURCE_CHANGED' });
+            }
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+            });
+            let result;
+            if (hub.hasProviderLease(providerId)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_IN_USE' });
+            if (!hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+            if (!hub.beginProviderMutation(providerId)) {
+              hub.endProviderStoreMutation();
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+            }
+            let retainProviderMutation = false;
+            let retainProviderStoreMutation = false;
+            try {
+              await hooks.acquireLock();
+              // The plan was created from a pre-lock snapshot. Re-read every
+              // authoritative source after taking the shared store lock so a
+              // concurrent catalog/default/recovery change cannot be hidden
+              // behind unchanged profile/settings revisions.
+              const lockedConfig = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+              const lockedInventory = await readProviderInventorySnapshot(hub, ctx, lockedConfig);
+              const lockedEntry = lockedInventory.migration.providers.find((candidate) => candidate.provider_id === providerId);
+              const expectedRouting = Array.isArray(stored.plan.routing_references) ? stored.plan.routing_references : [];
+              const sameRouting = JSON.stringify(lockedEntry?.referenced_by ?? []) === JSON.stringify(expectedRouting);
+              const sameDefault = JSON.stringify(lockedInventory.harness_default ?? null) === JSON.stringify(stored.plan.harness_default_before ?? null);
+              const profileFile = join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml');
+              const lockedMaterialization = existsSync(profileFile)
+                ? readProviderMaterialization(readFileSync(profileFile, 'utf8'), { providerId, file: 'harness/profiles/dsh-crew/cordis.patch.yml' })
+                : { ok: false };
+              const sameMaterialization = lockedMaterialization.ok === true
+                && JSON.stringify(lockedMaterialization.provider) === JSON.stringify(stored.plan.materialization?.provider ?? null);
+              const settingsFile = join(CONFIG_DIR, 'harness', 'settings.yaml');
+              const lockedUserMaterialization = stored.plan.action === 'promote-existing-user' && existsSync(settingsFile)
+                ? readProviderSettingsMaterialization(readFileSync(settingsFile, 'utf8'), { providerId, file: 'harness/settings.yaml' })
+                : { ok: stored.plan.action !== 'promote-existing-user' };
+              const sameUserMaterialization = stored.plan.action !== 'promote-existing-user'
+                || (lockedUserMaterialization.ok === true && JSON.stringify(lockedUserMaterialization.provider) === JSON.stringify(stored.plan.user_materialization_before ?? null));
+              const lockedRevisions = readProviderSourceRevisions();
+              const expectedLocked = stored.plan.expected_revisions ?? {};
+              const sameRevisions = lockedRevisions.profile.revision === expectedLocked.profile
+                && (lockedRevisions.settings.ok ? lockedRevisions.settings.revision : null) === expectedLocked.settings;
+              if (hasPendingProviderRecoveryTransactions(lockedInventory)) {
+                return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+              }
+              if (!lockedEntry || lockedEntry.action !== stored.plan.action || lockedEntry.collision !== null
+                || !sameRouting || !sameDefault || !sameMaterialization || !sameUserMaterialization || !sameRevisions
+                || lockedInventory.default_evidence?.ok !== true
+                || !hasCompleteProviderCatalogEvidence(lockedInventory.catalog_evidence)
+                || !hasCompleteProviderDeclarationEvidence(lockedInventory.declaration_evidence)
+                || !hasAvailableProviderLifecycleEvidence(lockedInventory.lifecycle_evidence)) {
+                return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_CHANGED' });
+              }
+              if (hub.hasProviderLease(providerId)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_IN_USE' });
+              result = await executeProviderLayerMigration(stored.plan, hooks, { confirm: true, deferRestart: true });
+              if (result.ok && result.state === 'RESTART_PENDING') await hooks.setRestartRuntimeBaseline(getHubRuntimeIdentity().runtime_id);
+              providerMigrationPlans.delete(body.plan_id);
+              retainProviderMutation = result.state === 'RESTART_PENDING';
+              if (retainProviderMutation) {
+                providerMigrationOwners.set(providerId, stored.plan.plan_id);
+                providerStoreMutationOwners.set(stored.plan.plan_id, providerId);
+                retainProviderStoreMutation = true;
+              }
+              return sendJson(res, result.ok ? 202 : 409, { ok: result.ok, restart_required: result.restart_required === true, result });
+            } finally {
+              await hooks.release();
+              if (!retainProviderMutation) hub.endProviderMutation(providerId);
+              if (!retainProviderStoreMutation) hub.endProviderStoreMutation();
+            }
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'verify-migration') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_VERIFY_CONFIRM_REQUIRED' });
+            const transactionId = body?.transaction_id;
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+              existingMigrationId: transactionId,
+            });
+            let acquiredStoreFence = false;
+            try {
+              await hooks.acquireLock();
+              await hooks.backup({});
+              const plan = hooks.backupPlan();
+              if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_PROVIDER_MISMATCH' });
+              const owner = providerMigrationOwners.get(providerId);
+              if (providerStoreMutationOwners.get(plan.plan_id) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                providerStoreMutationOwners.set(plan.plan_id, providerId);
+                acquiredStoreFence = true;
+              }
+              if (owner !== plan.plan_id) {
+                if (hub.hasProviderLease(providerId) || !hub.beginProviderMutation(providerId)) {
+                  if (acquiredStoreFence && providerStoreMutationOwners.get(plan.plan_id) === providerId) { providerStoreMutationOwners.delete(plan.plan_id); hub.endProviderStoreMutation(); }
+                  return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                }
+                providerMigrationOwners.set(providerId, plan.plan_id);
+              }
+              const verification = await hooks.verify(plan);
+              const live = await readProviderInventorySnapshot(hub, ctx, config);
+              verification.catalogEvidence = live.catalog_evidence;
+              verification.defaultEvidence = live.default_evidence;
+              verification.defaultPreserved = live.default_evidence?.ok === true
+                && JSON.stringify(live.harness_default ?? null) === JSON.stringify(plan.harness_default_before ?? null);
+              verification.liveNativeRemovable = hasCompleteProviderCatalogEvidence(live.catalog_evidence)
+                && live.records.some((record) => record.id === providerId && record.lifecycle?.catalogued === true && record.native_removable === true);
+              verification.runtimeRestarted = hasProviderRuntimeRestartEvidence(plan.runtime_id_before_restart ?? plan.runtime_id_before, getHubRuntimeIdentity().runtime_id);
+              if (verification.nativeRemovable !== true || verification.liveNativeRemovable !== true || verification.defaultPreserved !== true || verification.runtimeRestarted !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_VERIFY_FAILED', verification });
+              await hooks.finalizeVerified();
+              if (providerMigrationOwners.get(providerId) === plan.plan_id) {
+                providerMigrationOwners.delete(providerId);
+                hub.endProviderMutation(providerId);
+              }
+              if (providerStoreMutationOwners.get(plan.plan_id) === providerId) {
+                providerStoreMutationOwners.delete(plan.plan_id);
+                hub.endProviderStoreMutation();
+              }
+              return sendJson(res, 200, { ok: true, state: 'VERIFIED', transaction_id: plan.plan_id, provider_id: providerId, verification });
+            } finally {
+              await hooks.release();
+              // Keep the transaction-owned fence on verification failure so
+              // an incomplete migration cannot race a new Worker; the caller
+              // must explicitly retry verification or roll it back.
+            }
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'rollback-migration') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_ROLLBACK_CONFIRM_REQUIRED' });
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+              existingMigrationId: body?.transaction_id,
+            });
+            let acquiredMigrationFence = false;
+            let retainProviderMutation = false;
+            let acquiredStoreFence = false;
+            try {
+              await hooks.acquireLock();
+              await hooks.backup({});
+              const plan = hooks.backupPlan();
+              if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_PROVIDER_MISMATCH' });
+              const owner = providerMigrationOwners.get(providerId);
+              if (providerStoreMutationOwners.get(plan.plan_id) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                providerStoreMutationOwners.set(plan.plan_id, providerId);
+                acquiredStoreFence = true;
+              }
+              if (owner !== plan.plan_id) {
+                if (hub.hasProviderLease(providerId) || !hub.beginProviderMutation(providerId)) {
+                  if (acquiredStoreFence && providerStoreMutationOwners.get(plan.plan_id) === providerId) { providerStoreMutationOwners.delete(plan.plan_id); hub.endProviderStoreMutation(); }
+                  return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                }
+                providerMigrationOwners.set(providerId, plan.plan_id);
+                acquiredMigrationFence = true;
+                retainProviderMutation = true;
+              }
+              const rollback = await hooks.rollback();
+              await hooks.setRollbackRuntimeBaseline(getHubRuntimeIdentity().runtime_id);
+              providerMigrationOwners.set(providerId, plan.plan_id);
+              retainProviderMutation = true;
+              return sendJson(res, 202, { ok: true, restart_required: true, transaction_id: plan.plan_id, provider_id: providerId, state: 'ROLLBACK_RESTART_PENDING' });
+            } finally {
+              await hooks.release();
+              if (acquiredMigrationFence && !retainProviderMutation && providerMigrationOwners.get(providerId) === body?.transaction_id) {
+                providerMigrationOwners.delete(providerId);
+                hub.endProviderMutation(providerId);
+              }
+            }
+          }
+          if (req.method === 'POST' && parts.length === 2 && parts[1] === 'verify-rollback-migration') {
+            if (body?.confirm !== true) return sendJson(res, 400, { ok: false, code: 'PROVIDER_MIGRATION_ROLLBACK_VERIFY_CONFIRM_REQUIRED' });
+            const transactionId = body?.transaction_id;
+            const hooks = createProviderLayerMigrationFileHooks({
+              profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
+              settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
+              backupDir: join(CONFIG_DIR, 'provider-migration-backups'),
+              existingMigrationId: transactionId,
+            });
+            let acquiredStoreFence = false;
+            try {
+              await hooks.acquireLock();
+              await hooks.backup({});
+              const plan = hooks.backupPlan();
+              if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_PLAN_PROVIDER_MISMATCH' });
+              const owner = providerMigrationOwners.get(providerId);
+              if (providerStoreMutationOwners.get(plan.plan_id) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                providerStoreMutationOwners.set(plan.plan_id, providerId);
+                acquiredStoreFence = true;
+              }
+              if (owner !== plan.plan_id) {
+                if (hub.hasProviderLease(providerId) || !hub.beginProviderMutation(providerId)) {
+                  if (acquiredStoreFence && providerStoreMutationOwners.get(plan.plan_id) === providerId) { providerStoreMutationOwners.delete(plan.plan_id); hub.endProviderStoreMutation(); }
+                  return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_BUSY' });
+                }
+                providerMigrationOwners.set(providerId, plan.plan_id);
+              }
+              const verification = await hooks.verifyRollback(plan);
+              const live = await readProviderInventorySnapshot(hub, ctx, config);
+              verification.catalogEvidence = live.catalog_evidence;
+              verification.defaultEvidence = live.default_evidence;
+              verification.defaultPreserved = live.default_evidence?.ok === true
+                && JSON.stringify(live.harness_default ?? null) === JSON.stringify(plan.harness_default_before ?? null);
+              verification.liveRestored = hasCompleteProviderCatalogEvidence(live.catalog_evidence)
+                && live.records.some((record) => record.id === providerId && record.lifecycle?.catalogued === true && record.native_removable === false);
+              verification.runtimeRestarted = hasProviderRuntimeRestartEvidence(plan.rollback_runtime_id_before, getHubRuntimeIdentity().runtime_id);
+              if (verification.ok !== true || verification.liveRestored !== true || verification.defaultPreserved !== true || verification.runtimeRestarted !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_MIGRATION_ROLLBACK_VERIFY_FAILED', verification });
+              await hooks.finalizeRollback();
+              if (providerMigrationOwners.get(providerId) === plan.plan_id) {
+                providerMigrationOwners.delete(providerId);
+                hub.endProviderMutation(providerId);
+              }
+              if (providerStoreMutationOwners.get(plan.plan_id) === providerId) {
+                providerStoreMutationOwners.delete(plan.plan_id);
+                hub.endProviderStoreMutation();
+              }
+              return sendJson(res, 200, { ok: true, state: 'ROLLED_BACK', transaction_id: plan.plan_id, provider_id: providerId, verification });
+            } finally { await hooks.release(); }
+          }
           if (req.method === 'POST' && parts.length === 2 && parts[1] === 'delete-plan') {
             if (providerId !== 'deepseek-official' && hasPendingProviderRecoveryTransactions(inventory)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
             if (providerId !== 'deepseek-official' && !hasCompleteProviderCatalogEvidence(inventory.catalog_evidence)) return sendJson(res, 503, { ok: false, code: 'MODEL_CATALOG_UNAVAILABLE' });
@@ -1712,6 +2089,7 @@ export async function apply(ctx) {
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
               existingBackupId: transactionId,
               expectedProviderId: providerId,
             });
@@ -1719,6 +2097,10 @@ export async function apply(ctx) {
             if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_PROVIDER_MISMATCH' });
             await hooks.acquireLock();
             try {
+              if (providerStoreMutationOwners.get(transactionId) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+                providerStoreMutationOwners.set(transactionId, providerId);
+              }
               const verification = await hooks.verify(plan);
               const live = await readProviderInventorySnapshot(hub, ctx, config);
               verification.catalog_evidence = live.catalog_evidence;
@@ -1735,6 +2117,10 @@ export async function apply(ctx) {
               }
               await hooks.recordTransaction({ transaction_id: transactionId, provider_id: providerId, state: 'VERIFIED' }, plan);
               hub.endProviderMutation(providerId);
+              if (providerStoreMutationOwners.get(transactionId) === providerId) {
+                providerStoreMutationOwners.delete(transactionId);
+                hub.endProviderStoreMutation();
+              }
               return sendJson(res, 200, { ok: true, transaction_id: transactionId, provider_id: providerId, state: 'VERIFIED', verification });
             } finally {
               await hooks.release();
@@ -1749,13 +2135,21 @@ export async function apply(ctx) {
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
               existingBackupId: transactionId,
               expectedProviderId: providerId,
             });
             await hooks.acquireLock();
+            let acquiredStoreMutation = false;
+            let retainStoreMutation = false;
             try {
               const plan = hooks.backupPlan();
               if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_PROVIDER_MISMATCH' });
+              if (providerStoreMutationOwners.get(transactionId) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+                providerStoreMutationOwners.set(transactionId, providerId);
+                acquiredStoreMutation = true;
+              }
               await hooks.rollback(plan);
               await hooks.setRuntimeBaseline(getHubRuntimeIdentity().runtime_id, 'rollback');
               const rollbackPlan = hooks.backupPlan() ?? plan;
@@ -1764,9 +2158,14 @@ export async function apply(ctx) {
               } catch (error) {
                 return sendJson(res, 409, { ok: false, code: boundedMachineCodeFromError(error) ?? 'PROVIDER_LIFECYCLE_RECORD_FAILED' });
               }
+              retainStoreMutation = true;
               return sendJson(res, 202, { ok: true, restart_required: true, transaction_id: transactionId, provider_id: providerId, state: 'ROLLBACK_PENDING' });
             } finally {
               await hooks.release();
+              if (acquiredStoreMutation && !retainStoreMutation && providerStoreMutationOwners.get(transactionId) === providerId) {
+                providerStoreMutationOwners.delete(transactionId);
+                hub.endProviderStoreMutation();
+              }
             }
           }
           if (req.method === 'POST' && parts.length === 2 && parts[1] === 'verify-rollback') {
@@ -1778,6 +2177,7 @@ export async function apply(ctx) {
               configFile: join(CONFIG_DIR, 'config.json'),
               lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
               backupDir: join(CONFIG_DIR, 'provider-backups'),
+              sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
               existingBackupId: transactionId,
               expectedProviderId: providerId,
             });
@@ -1785,6 +2185,10 @@ export async function apply(ctx) {
             if (!plan || plan.provider_id !== providerId) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_PROVIDER_MISMATCH' });
             await hooks.acquireLock();
             try {
+              if (providerStoreMutationOwners.get(transactionId) !== providerId || !hub.hasProviderStoreMutation()) {
+                if (hub.hasProviderStoreMutation() || !hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+                providerStoreMutationOwners.set(transactionId, providerId);
+              }
               const verified = await hooks.verifyRollback(plan);
               const live = await readProviderInventorySnapshot(hub, ctx, config);
               verified.catalog_evidence = live.catalog_evidence;
@@ -1799,6 +2203,10 @@ export async function apply(ctx) {
               if (verified?.ok !== true || !hasCompleteProviderCatalogEvidence(verified?.catalog_evidence) || verified?.default_evidence?.ok !== true || verified?.catalogPresent !== true || verified?.harnessDefaultRestored !== true || verified?.runtimeRestarted !== true) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_ROLLBACK_VERIFY_FAILED', verification: verified });
               await hooks.recordTransaction({ transaction_id: transactionId, provider_id: providerId, state: 'ROLLED_BACK' }, plan);
               hub.endProviderMutation(providerId);
+              if (providerStoreMutationOwners.get(transactionId) === providerId) {
+                providerStoreMutationOwners.delete(transactionId);
+                hub.endProviderStoreMutation();
+              }
               return sendJson(res, 200, { ok: true, transaction_id: transactionId, provider_id: providerId, state: 'ROLLED_BACK' });
             } finally {
               await hooks.release();
@@ -1841,25 +2249,37 @@ export async function apply(ctx) {
             if (refreshed.plan.replacement_default_model !== stored.plan.replacement_default_model) {
               return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_PLAN_CHANGED' });
             }
-            const executionPlan = {
+            let executionPlan = {
               ...refreshed.plan,
               plan_id: stored.plan.plan_id,
               expected_revision: stored.plan.expected_revision,
               expected_revisions: stored.plan.expected_revisions,
               runtime_id_before: stored.plan.runtime_id_before,
             };
-            if (!hub.beginProviderMutation(providerId)) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+            if (!hub.beginProviderStoreMutation()) return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+            if (!hub.beginProviderMutation(providerId)) {
+              hub.endProviderStoreMutation();
+              return sendJson(res, 409, { ok: false, code: 'PROVIDER_DELETE_BUSY' });
+            }
+            let hooks = null;
+            let lockAcquired = false;
             let retainProviderMutation = false;
+            let retainProviderStoreMutation = false;
             try {
-              const hooks = createProviderDeleteFileHooks({
+              hooks = createProviderDeleteFileHooks({
                 profileFile: join(CONFIG_DIR, 'harness', 'profiles', 'dsh-crew', 'cordis.patch.yml'),
                 settingsFile: join(CONFIG_DIR, 'harness', 'settings.yaml'),
                 configFile: join(CONFIG_DIR, 'config.json'),
                 lifecycleFile: join(CONFIG_DIR, 'provider-lifecycle.json'),
                 backupDir: join(CONFIG_DIR, 'provider-backups'),
+                sharedLockFile: join(CONFIG_DIR, 'provider-store.lock'),
                 runtimeIdProvider: () => getHubRuntimeIdentity().runtime_id,
                 afterLockAcquired: () => {
-                  if (readProviderRecoveryTransactions().length > 0) {
+                  const pendingRecovery = [
+                    ...readProviderRecoveryTransactions(),
+                    ...readProviderLayerMigrationTransactions(join(CONFIG_DIR, 'provider-migration-backups')),
+                  ];
+                  if (pendingRecovery.length > 0) {
                     throw Object.assign(new Error('provider recovery transaction is pending'), { code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
                   }
                   if (hub.hasProviderLease(providerId)) {
@@ -1867,13 +2287,62 @@ export async function apply(ctx) {
                   }
                 },
               });
+              // Hold the real shared store lock while rebuilding the live
+              // inventory and delete plan. The pre-lock plan is only a
+              // proposal; catalog/default/ownership/recovery facts must be
+              // authoritative at the mutation boundary.
+              await hooks.acquireLock();
+              lockAcquired = true;
+              const lockedConfig = normalizeGlobalConfig(hub.getConfig?.() ?? {});
+              const lockedInventory = await readProviderInventorySnapshot(hub, ctx, lockedConfig);
+              const lockedRevisions = readProviderSourceRevisions();
+              const lockedExpected = stored.plan.expected_revisions;
+              const lockedRevisionsMatch = lockedExpected
+                ? lockedExpected.profile === (lockedRevisions.profile.ok ? lockedRevisions.profile.revision : null)
+                  && lockedExpected.settings === (lockedRevisions.settings.ok ? lockedRevisions.settings.revision : null)
+                : false;
+              if (providerId !== 'deepseek-official' && !hasCompleteProviderCatalogEvidence(lockedInventory.catalog_evidence)) throw Object.assign(new Error('provider catalog unavailable after lock'), { code: 'MODEL_CATALOG_UNAVAILABLE' });
+              if (providerId !== 'deepseek-official' && !hasCompleteProviderDeclarationEvidence(lockedInventory.declaration_evidence)) throw Object.assign(new Error('provider declarations unavailable after lock'), { code: 'PROVIDER_DELETE_SOURCE_UNRESOLVED' });
+              if (providerId !== 'deepseek-official' && !hasAvailableProviderLifecycleEvidence(lockedInventory.lifecycle_evidence)) throw Object.assign(new Error('provider lifecycle unavailable after lock'), { code: 'PROVIDER_LIFECYCLE_UNAVAILABLE' });
+              if (providerId !== 'deepseek-official' && lockedInventory.default_evidence?.ok !== true) throw Object.assign(new Error('provider default authority changed after lock'), { code: lockedInventory.default_evidence?.code ?? 'PROVIDER_DEFAULT_AUTHORITY_UNAVAILABLE' });
+              if (providerId !== 'deepseek-official' && hasPendingProviderRecoveryTransactions(lockedInventory)) throw Object.assign(new Error('provider recovery transaction is pending'), { code: 'PROVIDER_DELETE_RECOVERY_PENDING' });
+              if (!lockedRevisionsMatch) throw Object.assign(new Error('provider source changed after lock'), { code: 'PROVIDER_PROFILE_CHANGED' });
+              if (hub.hasProviderLease(providerId)) throw Object.assign(new Error('provider is in use'), { code: 'PROVIDER_IN_USE' });
+              const lockedPlan = planProviderDelete({
+                providerId,
+                inventory: lockedInventory,
+                activeJobs: hub.list(),
+                replacementDefault: stored.plan.replacement_default,
+                expectedRevision: stored.plan.expected_revision,
+                expectedRevisions: stored.plan.expected_revisions,
+              });
+              if (!lockedPlan.ok) throw Object.assign(new Error('provider delete plan changed after lock'), { code: lockedPlan.code });
+              const sameLockedPlan = lockedPlan.plan.replacement_default_model === stored.plan.replacement_default_model
+                && lockedPlan.plan.was_harness_default === stored.plan.was_harness_default
+                && JSON.stringify(lockedPlan.plan.declaration_authorities) === JSON.stringify(stored.plan.declaration_authorities)
+                && JSON.stringify(lockedPlan.plan.harness_default_before ?? null) === JSON.stringify(stored.plan.harness_default_before ?? null)
+                && JSON.stringify(lockedPlan.plan.credential_refs) === JSON.stringify(stored.plan.credential_refs);
+              if (!sameLockedPlan) throw Object.assign(new Error('provider delete plan semantics changed after lock'), { code: 'PROVIDER_DELETE_PLAN_CHANGED' });
+              executionPlan = {
+                ...lockedPlan.plan,
+                plan_id: stored.plan.plan_id,
+                expected_revision: stored.plan.expected_revision,
+                expected_revisions: stored.plan.expected_revisions,
+                runtime_id_before: stored.plan.runtime_id_before,
+              };
               providerDeletePlans.delete(body.plan_id);
               const { executeProviderDelete } = await import('../provider-lifecycle.mjs');
               const result = await executeProviderDelete(executionPlan, hooks, { deferRestart: true });
               retainProviderMutation = result.state === 'RESTART_PENDING';
+              if (retainProviderMutation) {
+                providerStoreMutationOwners.set(executionPlan.plan_id, providerId);
+                retainProviderStoreMutation = true;
+              }
               return sendJson(res, result.state === 'RESTART_PENDING' ? 202 : 409, { ok: result.state === 'RESTART_PENDING', restart_required: true, result });
             } finally {
+              if (lockAcquired && hooks) await hooks.release().catch(() => {});
               if (!retainProviderMutation) hub.endProviderMutation(providerId);
+              if (!retainProviderStoreMutation) hub.endProviderStoreMutation();
             }
           }
           return sendJson(res, 404, { ok: false, error: 'unknown providers endpoint' });