@ran-sh/dsh-crew 1.1.1 → 1.2.0-rc.4

package/windows/start-dsh-crew.ps1

@@ -9,13 +9,22 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
 $crewHome = Join-Path $env:USERPROFILE '.config\dsh-crew\harness'
-$officialHome = Join-Path $env:USERPROFILE '.dsh'
 $dshCli = Join-Path $crewHome 'runtime\node_modules\.bin\dsh.cmd'
 $logRoot = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
 $launcherLog = Join-Path $logRoot 'dsh-crew-launcher.log'
 $startedAt = Get-Date
+$launcherProcessStartedAtUtcTicks = try { (Get-Process -Id $PID -ErrorAction Stop).StartTime.ToUniversalTime().Ticks.ToString([System.Globalization.CultureInfo]::InvariantCulture) } catch { $null }
+$supervisorInstanceId = [guid]::NewGuid().ToString()
+$launcherHelperHash = $null
+try {
+  $hashStream = [System.IO.File]::OpenRead($PSCommandPath)
+  try {
+    $sha256 = [System.Security.Cryptography.SHA256]::Create()
+    try { $launcherHelperHash = (($sha256.ComputeHash($hashStream) | ForEach-Object { $_.ToString('x2') }) -join '') }
+    finally { $sha256.Dispose() }
+  } finally { $hashStream.Dispose() }
+} catch { $launcherHelperHash = $null }
 $services = @(
-  [pscustomobject]@{ Name = 'Official UI'; Profile = 'web'; Home = $officialHome; Port = 3080; Url = 'http://127.0.0.1:3080'; CrewOwned = $false; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null },
   [pscustomobject]@{ Name = 'Crew backend'; Profile = 'dsh-crew'; Home = $crewHome; Port = 3210; Url = 'http://127.0.0.1:3210'; CrewOwned = $true; State = 'pending'; Process = $null; RootPid = $null; RootStartedAtUtcTicks = $null; ListenerPid = $null; ListenerStartedAtUtcTicks = $null; ConsecutiveFailures = 0; LastError = $null }
 )
 
@@ -30,11 +39,136 @@ function Write-LaunchLog {
   }
 }
 
+function Resolve-OfficialHarnessCommand {
+  $shim = Get-Command dsh.cmd -CommandType Application -ErrorAction Stop | Select-Object -First 1
+  $root = Join-Path (Split-Path -Parent $shim.Source) 'node_modules\@deepseek-ai\dsh'
+  $manifest = Get-Content -LiteralPath (Join-Path $root 'package.json') -Raw | ConvertFrom-Json
+  if ($manifest.name -ne '@deepseek-ai/dsh') { throw 'The dsh command is not a verified official Harness installation.' }
+  $entrySpec = [string] $manifest.bin.dsh
+  if (-not $entrySpec -or [IO.Path]::IsPathRooted($entrySpec) -or $entrySpec.Contains(':') -or ($entrySpec.Replace('\', '/').Split('/') -contains '..')) {
+    throw 'The official Harness CLI entry is invalid.'
+  }
+  $entry = [IO.Path]::GetFullPath((Join-Path $root $entrySpec))
+  $rootPrefix = [IO.Path]::GetFullPath($root).TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar
+  if (-not $entry.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase) -or -not (Test-Path -LiteralPath $entry -PathType Leaf)) {
+    throw 'The official Harness CLI entry was not found.'
+  }
+  $node = Get-Command node.exe -CommandType Application -ErrorAction Stop | Select-Object -First 1
+  return [pscustomobject]@{ NodePath = $node.Source; Entry = $entry }
+}
+
+function Test-OfficialHarnessListener {
+  param([int] $OwnerPid, [pscustomobject] $Official)
+  if ($OwnerPid -le 0) { return $false }
+  try {
+    $owner = Get-CimInstance Win32_Process -Filter ('ProcessId={0}' -f $OwnerPid) -ErrorAction Stop
+    if (-not $owner -or [IO.Path]::GetFileName([string] $owner.ExecutablePath) -ine 'node.exe') { return $false }
+    $line = ([string] $owner.CommandLine).Replace('/', '\')
+    $entry = [regex]::Escape($Official.Entry.Replace('/', '\'))
+    $node = [regex]::Escape($Official.NodePath.Replace('/', '\'))
+    $pattern = '^\s*(?:"?' + $node + '"?|"?node(?:\.exe)?"?)\s+"?' + $entry + '"?\s+(?:"?web"?|--profile\s+"?web"?)(?:\s|$)'
+    return $line -match $pattern
+  } catch { return $false }
+}
+
+function Test-OfficialWebReady {
+  try {
+    $response = Invoke-WebRequest -UseBasicParsing -Uri 'http://127.0.0.1:3080/' -TimeoutSec 2
+    return $response.StatusCode -ge 200 -and $response.StatusCode -lt 300
+  } catch {
+    # An authenticated official UI may reject this cookie-free health request.
+    if ($_.Exception.Response) { return [int] $_.Exception.Response.StatusCode -in @(401, 403) }
+    return $false
+  }
+}
+
+function Get-OfficialFrontendOverlay {
+  $frontendRoot = Join-Path $env:USERPROFILE '.config\dsh-crew\frontend'
+  $path = Join-Path $frontendRoot 'official-web.patch.json'
+  if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { throw 'Crew frontend overlay is missing. Run dsh-crew update with the current GitHub candidate.' }
+  $patch = @(Get-Content -LiteralPath $path -Raw | ConvertFrom-Json)
+  if ($patch.Count -ne 1 -or @($patch[0].insert).Count -ne 1 -or $patch[0].insert[0].id -ne 'dsh-crew-official-web-bridge') {
+    throw 'Crew frontend overlay has an unexpected structure.'
+  }
+  $uri = [Uri] ([string] $patch[0].insert[0].name)
+  if (-not $uri.IsFile) { throw 'Crew frontend must load from its local snapshot.' }
+  $entry = [IO.Path]::GetFullPath($uri.LocalPath)
+  $prefix = [IO.Path]::GetFullPath((Join-Path $frontendRoot 'revisions')) + [IO.Path]::DirectorySeparatorChar
+  if (-not $entry.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) { throw 'Crew frontend snapshot is outside its owned directory.' }
+  $metadata = Get-Content -LiteralPath (Join-Path (Split-Path -Parent $entry) 'package.json') -Raw | ConvertFrom-Json
+  $revision = [string] $metadata.dshCrewFrontendRevision
+  if ($metadata.dshCrewManagedFrontend -ne $true -or $revision -notmatch '^[a-f0-9]{64}$' -or -not (Test-Path -LiteralPath $entry -PathType Leaf)) {
+    throw 'Crew frontend snapshot is incomplete.'
+  }
+  return [pscustomobject]@{ Path = $path; Revision = $revision }
+}
+
+function Test-OfficialFrontendAttached {
+  param([string] $Revision)
+  try {
+    $response = Invoke-RestMethod -Uri 'http://127.0.0.1:3080/_dsh/dsh-crew/bridge-status' -TimeoutSec 2
+    return $response.ok -eq $true -and $response.surface -eq 'official-bridge' -and $response.frontend_revision -eq $Revision
+  } catch { return $false }
+}
+
+function Open-OfficialFrontend {
+  param([int] $TimeoutSeconds = 90)
+  $official = Resolve-OfficialHarnessCommand
+  $frontend = Get-OfficialFrontendOverlay
+  $mutex = New-Object System.Threading.Mutex($false, 'Local\DSHCrewOfficialFrontendLauncher')
+  $locked = $false
+  try {
+    try { $locked = $mutex.WaitOne(30000) } catch [System.Threading.AbandonedMutexException] { $locked = $true }
+    if (-not $locked) { throw 'Another desktop launch is still starting the official frontend.' }
+    $port = Get-PortState -Port 3080
+    if ($port.State -eq 'unknown') { throw $port.Error }
+    if ($port.State -eq 'occupied') {
+      if (-not (Test-OfficialHarnessListener -OwnerPid $port.Pid -Official $official)) { throw 'Port 3080 is occupied by an unverified process; it was left untouched.' }
+      if (-not (Test-OfficialWebReady)) { throw 'The official 3080 frontend is not ready; its process was left running.' }
+      if (-not (Test-OfficialFrontendAttached -Revision $frontend.Revision)) { throw 'The running official frontend has not loaded the current Crew panel. Stop that official instance when idle, then launch from the desktop again. It was left untouched.' }
+      Start-Process 'http://127.0.0.1:3080/' | Out-Null
+      Write-LaunchLog 'Opened the existing official Harness frontend on 3080.'
+      return
+    }
+
+    $stamp = '{0}-{1}' -f (Get-Date -Format 'yyyyMMdd-HHmmssfff'), $PID
+    $stdout = Join-Path $logRoot ('dsh-official-web-{0}.out.log' -f $stamp)
+    $stderr = Join-Path $logRoot ('dsh-official-web-{0}.err.log' -f $stamp)
+    $previousHome = $env:DSH_HOME
+    try {
+      # The official application owns its normal state; no Crew plugin/profile
+      # registration or repair is performed in this home by the launcher.
+      $env:DSH_HOME = Join-Path $env:USERPROFILE '.dsh'
+      $arguments = @(('"{0}"' -f $official.Entry), 'web', '--patch', ('"{0}"' -f $frontend.Path), '--host', '127.0.0.1', '--port', '3080')
+      $process = Start-Process -FilePath $official.NodePath -ArgumentList $arguments -WindowStyle Hidden -PassThru `
+        -RedirectStandardOutput $stdout -RedirectStandardError $stderr
+    } finally { $env:DSH_HOME = $previousHome }
+    Write-LaunchLog ('Started official Harness on 3080; PID={0}. The official CLI opens the browser. Logs: {1}, {2}' -f $process.Id, $stdout, $stderr)
+    $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
+    $nextProgress = (Get-Date).AddSeconds(5)
+    do {
+      $port = Get-PortState -Port 3080
+      if ($port.State -eq 'occupied') {
+        if (-not (Test-OfficialHarnessListener -OwnerPid $port.Pid -Official $official)) { throw 'Port 3080 became occupied by an unverified process; it was left untouched.' }
+        if ((Test-OfficialWebReady) -and (Test-OfficialFrontendAttached -Revision $frontend.Revision)) { return }
+      }
+      if ($process.HasExited) { throw ('Official Harness exited before readiness. Diagnostic log: {0}' -f $stderr) }
+      if ((Get-Date) -ge $nextProgress) {
+        Write-LaunchLog 'Waiting for the official Harness frontend on 3080...'
+        $nextProgress = (Get-Date).AddSeconds(5)
+      }
+      Start-Sleep -Milliseconds 500
+    } while ((Get-Date) -lt $deadline)
+    throw ('Official Harness did not become ready within {0}s; inspect {1}. No official process was stopped.' -f $TimeoutSeconds, $stderr)
+  } finally {
+    if ($locked) { $mutex.ReleaseMutex() }
+    $mutex.Dispose()
+  }
+}
+
 function Get-HealthState {
   param([pscustomObject] $Service)
-  # Crew-owned 3210 answers the Crew extension contract. The official 3080
-  # is an external dependency: probe only its native web root, never the
-  # Crew bridge endpoint, so a missing legacy bridge cannot fail 3080 health.
+  # Preserve the installed extension health contract used by maintenance.
   if ($Service.CrewOwned) {
     try {
       $response = Invoke-RestMethod -Uri ($Service.Url + '/_dsh/dsh-crew/extension') -TimeoutSec 2
@@ -71,28 +205,10 @@ function Get-HealthState {
       return [pscustomobject]@{ Ready = $false; Version = $null; Error = $_.Exception.Message }
     }
   }
-  try {
-    # The official 3080 UI may require a token (HTTP 401/403 on the bare
-    # root) or redirect to the web entry (3xx). Accept exactly those; any
-    # other status (e.g. 404 from a foreign HTTP service squatting on 3080)
-    # is NOT healthy.
-    $response = Invoke-WebRequest -UseBasicParsing -Uri $Service.Url -TimeoutSec 2
-    if ($response.StatusCode -ge 200 -and $response.StatusCode -lt 400) {
-      return [pscustomobject]@{ Ready = $true; Version = $null; Error = $null }
-    }
-    return [pscustomobject]@{ Ready = $false; Version = $null; Error = ('Official UI returned HTTP {0}.' -f $response.StatusCode) }
-  } catch {
-    # Invoke-WebRequest surfaces 401/403 as exceptions; those prove the web
-    # service is alive and answering (token gate present).
-    $status = $null
-    if ($_.Exception.Response -and $_.Exception.Response.StatusCode) {
-      $status = [int] $_.Exception.Response.StatusCode
-    }
-    if ($status -eq 401 -or $status -eq 403) {
-      return [pscustomobject]@{ Ready = $true; Version = $null; Error = $null }
-    }
-    return [pscustomobject]@{ Ready = $false; Version = $null; Error = $_.Exception.Message }
-  }
+  # The launcher supervises only the Crew-owned 3210 service. Any non-Crew
+  # service is never started or health-gated here; the legacy 3080 bridge
+  # is probed only diagnostically after 3210 readiness (see Write-LegacyBridgeDiagnostic).
+  return [pscustomobject]@{ Ready = $false; Version = $null; Error = 'Unknown service: only the Crew-owned 3210 service is supervised.' }
 }
 
 # Optional legacy compatibility probe: returns true only when a 3080 that
@@ -127,8 +243,9 @@ function Write-Utf8NoBom {
 }
 
 function Write-SupervisorHeartbeat {
+  param([bool] $OwnershipReady = $false)
   $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
-  $record = @{ schema_version = 1; pid = $PID; last_seen = $now; protocol_version = 1 } | ConvertTo-Json -Compress
+  $record = @{ schema_version = 1; supervisor_instance_id = $supervisorInstanceId; pid = $PID; process_started_at_utc_ticks = $launcherProcessStartedAtUtcTicks; helper_hash = $launcherHelperHash; ownership_ready = $OwnershipReady; last_seen = $now; protocol_version = 1 } | ConvertTo-Json -Compress
   try {
     if (-not (Test-Path -LiteralPath $crewSupervisorRoot -PathType Container)) { New-Item -ItemType Directory -Path $crewSupervisorRoot -Force | Out-Null }
     $temp = Join-Path $crewSupervisorRoot ("heartbeat.{0}.tmp" -f $PID)
@@ -137,6 +254,93 @@ function Write-SupervisorHeartbeat {
   } catch { /* heartbeat is best-effort */ }
 }
 
+function Get-SupervisorLaunchArguments {
+  param([string] $ScriptPath = $PSCommandPath)
+  if ([string]::IsNullOrWhiteSpace($ScriptPath) -or $ScriptPath.Contains('"')) {
+    throw 'A valid launcher script path is required.'
+  }
+  return @(
+    '-NoLogo',
+    '-NoProfile',
+    '-NonInteractive',
+    '-ExecutionPolicy', 'Bypass',
+    '-File', ('"{0}"' -f $ScriptPath),
+    '-Mode', 'watch'
+  )
+}
+
+function Get-SupervisorHeartbeatRecord {
+  param([int] $MaxAgeSeconds = 30)
+  try {
+    if (-not (Test-Path -LiteralPath $crewHeartbeatFile -PathType Leaf)) { return $null }
+    $record = Get-Content -LiteralPath $crewHeartbeatFile -Raw -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop
+    $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+    $lastSeen = [long] $record.last_seen
+    $age = $now - $lastSeen
+    if ($record.schema_version -ne 1 -or $record.protocol_version -ne 1 -or [int] $record.pid -le 0) { return $null }
+    if ($age -lt -5000 -or $age -gt ([long] $MaxAgeSeconds * 1000)) { return $null }
+    $process = Get-Process -Id ([int] $record.pid) -ErrorAction Stop
+    $processStartProperty = $record.PSObject.Properties['process_started_at_utc_ticks']
+    if ($null -ne $processStartProperty -and $processStartProperty.Value) {
+      $expectedTicks = [long] $processStartProperty.Value
+      if ($process.StartTime.ToUniversalTime().Ticks -ne $expectedTicks) { return $null }
+    }
+    $ownershipProperty = $record.PSObject.Properties['ownership_ready']
+    $helperHashProperty = $record.PSObject.Properties['helper_hash']
+    $instanceProperty = $record.PSObject.Properties['supervisor_instance_id']
+    $identityReady = $null -ne $processStartProperty -and $processStartProperty.Value `
+      -and $null -ne $helperHashProperty -and $helperHashProperty.Value -match '^[a-f0-9]{64}$' `
+      -and $null -ne $instanceProperty -and -not [string]::IsNullOrWhiteSpace([string] $instanceProperty.Value)
+    $state = if ($null -eq $ownershipProperty) { 'legacy-v1' } elseif ($ownershipProperty.Value -eq $true -and $identityReady) { 'ready' } else { 'starting' }
+    return [pscustomobject]@{ State = $state; Record = $record }
+  } catch {
+    return $null
+  }
+}
+
+function Get-FreshSupervisorHeartbeat {
+  param([int] $MaxAgeSeconds = 30)
+  $observed = Get-SupervisorHeartbeatRecord -MaxAgeSeconds $MaxAgeSeconds
+  if ($observed -and $observed.State -eq 'ready') { return $observed.Record }
+  return $null
+}
+
+function Ensure-CrewSupervisorRunning {
+  param([int] $TimeoutSeconds = 90)
+  $watcher = $null
+  $observed = Get-SupervisorHeartbeatRecord
+  if ($observed -and $observed.State -eq 'legacy-v1') {
+    throw 'CREW_SUPERVISOR_UPGRADE_REQUIRED: a legacy watcher is active and must be handed off before interactive launch.'
+  }
+  if (-not $observed) {
+    $arguments = @(Get-SupervisorLaunchArguments -ScriptPath $PSCommandPath)
+    $watcher = Start-Process -FilePath 'powershell.exe' -ArgumentList $arguments -WindowStyle Hidden -PassThru
+    Write-LaunchLog ('Started persistent Crew supervisor; PID={0}.' -f $watcher.Id)
+  }
+
+  $crew = $services | Where-Object { $_.CrewOwned } | Select-Object -First 1
+  if (-not $crew) { throw 'Crew-owned 3210 service definition is missing.' }
+  $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
+  $nextProgress = (Get-Date).AddSeconds(5)
+  $lastHealthError = 'not checked'
+  do {
+    $heartbeat = Get-FreshSupervisorHeartbeat
+    $health = Get-HealthState $crew
+    $lastHealthError = $health.Error
+    if ($heartbeat -and $health.Ready) {
+      Write-LaunchLog ('Persistent supervisor ready; PID={0}; 3210 runtime={1}.' -f $heartbeat.pid, $health.Version)
+      return
+    }
+    if ((Get-Date) -ge $nextProgress) {
+      Write-LaunchLog ('Waiting for Crew on 3210; {0:n0}s remaining. Health: {1}' -f [Math]::Max(0, ($deadline - (Get-Date)).TotalSeconds), $lastHealthError)
+      $nextProgress = (Get-Date).AddSeconds(5)
+    }
+    Start-Sleep -Milliseconds 500
+  } while ((Get-Date) -lt $deadline)
+
+  throw ('Persistent supervisor did not make 3210 ready within {0}s. Last health error: {1}' -f $TimeoutSeconds, $lastHealthError)
+}
+
 function Read-RestartRequests {
   if (-not (Test-Path -LiteralPath $crewRequestsDir -PathType Container)) { return @() }
   $requests = @()
@@ -351,7 +555,14 @@ function Invoke-CrewMaintenanceRequests {
       $liveRuntimeId = $null
       try {
         $resp = Invoke-RestMethod -Uri 'http://127.0.0.1:3210/_dsh/dsh-crew/extension' -TimeoutSec 3
-        if ($resp.ok -eq $true) { $liveRuntimeId = $resp.extension.runtime.runtime_id }
+        $runtime = $resp.extension.runtime
+        $canonical = $resp.ok -eq $true `
+          -and $runtime.service -eq 'dsh-crew-hub' `
+          -and $runtime.execution_plane -eq 'hub-3210' `
+          -and $runtime.profile -eq 'dsh-crew' `
+          -and ($runtime.listen_port -as [int]) -eq 3210 `
+          -and ($runtime.protocol_version -as [int]) -eq 1
+        if ($canonical) { $liveRuntimeId = $runtime.runtime_id }
       } catch { $liveRuntimeId = $null }
       if (-not $liveRuntimeId -or $liveRuntimeId -ne $request.runtime_id) {
         Write-MaintenanceResult $request 'SUPERVISOR_OWNERSHIP_CONFLICT'
@@ -417,7 +628,14 @@ function Invoke-CrewMaintenanceRequests {
         $resp = Invoke-RestMethod -Uri 'http://127.0.0.1:3210/_dsh/dsh-crew/extension' -TimeoutSec 5
         if ($resp.ok -eq $true) { $newRuntime = $resp.extension.runtime }
       } catch { $newRuntime = $null }
-      $ok = $newRuntime -and $newRuntime.runtime_id -and ($expectedDsh -eq $null -or $newRuntime.dsh_version -eq $expectedDsh)
+      $ok = $newRuntime -and $newRuntime.runtime_id `
+        -and $newRuntime.service -eq 'dsh-crew-hub' `
+        -and $newRuntime.execution_plane -eq 'hub-3210' `
+        -and $newRuntime.profile -eq 'dsh-crew' `
+        -and ($newRuntime.listen_port -as [int]) -eq 3210 `
+        -and ($newRuntime.protocol_version -as [int]) -eq 1 `
+        -and ($expectedCrew -eq $null -or $newRuntime.runtime_version -eq $expectedCrew) `
+        -and ($expectedDsh -eq $null -or $newRuntime.dsh_version -eq $expectedDsh)
       if ($ok) {
         # Verifiable one-shot consumption: only a provably-cleared session
         # completes the transaction; otherwise the lease stays live and any
@@ -518,6 +736,27 @@ function Set-TrackedListenerIdentity {
   }
 }
 
+function Test-CrewServiceOwnership {
+  param(
+    [pscustomObject] $Service,
+    [pscustomObject] $PortState = $null,
+    [object[]] $ProcessTable = $null
+  )
+  if (-not $Service.ListenerPid -or -not $Service.ListenerStartedAtUtcTicks) { return $false }
+  $port = if ($null -ne $PortState) { $PortState } else { Get-PortState $Service.Port }
+  if ($port.State -ne 'occupied' -or -not $port.Pid -or [int] $port.Pid -ne [int] $Service.ListenerPid) { return $false }
+  try {
+    $tree = if ($null -ne $ProcessTable) {
+      @(Get-TrackedProcessTree -Service $Service -ProcessTable $ProcessTable)
+    } else {
+      @(Get-TrackedProcessTree -Service $Service)
+    }
+    return ([int] $port.Pid -in $tree)
+  } catch {
+    return $false
+  }
+}
+
 function Stop-OwnedListener {
   param([pscustomobject] $Service, [int] $ListenerPid)
   if ($Mode -ne 'watch' -or -not $Service.ListenerPid -or $ListenerPid -ne $Service.ListenerPid) {
@@ -542,8 +781,19 @@ function Stop-OwnedListener {
   return $false
 }
 
+function Assert-HistoryStartAllowed {
+  param([string] $StatePath = (Join-Path $crewHome '..\history\active.json'))
+  if (-not (Test-Path -LiteralPath $StatePath)) { return }
+  try {
+    $state = Get-Content -LiteralPath $StatePath -Raw -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop
+    if ($state.schemaVersion -eq 1 -and $state.phase -in @('STARTING', 'VERIFYING', 'DONE', 'FAILED', 'ROLLED_BACK')) { return }
+  } catch { }
+  throw 'HISTORY_RECOVERY_REQUIRED: Crew history maintenance is unfinished. Run dsh-crew history recover. Official 3080 is unchanged.'
+}
+
 function Start-CrewService {
   param([pscustomobject] $Service)
+  Assert-HistoryStartAllowed
   $serviceRunStamp = (Get-Date).ToString('yyyyMMdd-HHmmssfff')
   $stdout = Join-Path $logRoot ('dsh-crew-{0}-{1}-{2}.out.log' -f $Service.Profile, $Service.Port, $serviceRunStamp)
   $stderr = Join-Path $logRoot ('dsh-crew-{0}-{1}-{2}.err.log' -f $Service.Profile, $Service.Port, $serviceRunStamp)
@@ -573,9 +823,14 @@ function Wait-CrewServices {
       $health = Get-HealthState $service
       $service.LastError = $health.Error
       if ($health.Ready) {
+        if ($service.CrewOwned -and -not $service.ListenerPid -and -not (Set-TrackedListenerIdentity -Service $service)) {
+          throw ('{0} is healthy on {1}, but this supervisor cannot prove process ownership.' -f $service.Name, $service.Port)
+        }
+        if ($service.CrewOwned -and -not (Test-CrewServiceOwnership -Service $service)) {
+          throw ('{0} is healthy on {1}, but its tracked listener identity is not owned.' -f $service.Name, $service.Port)
+        }
         $service.State = 'ready'
         $service.ConsecutiveFailures = 0
-        if ($service.CrewOwned) { [void] (Set-TrackedListenerIdentity -Service $service) }
         Write-LaunchLog ('{0} ready on {1}; runtime={2}' -f $service.Name, $service.Port, $health.Version)
       } elseif ($service.Process -and $service.Process.HasExited) {
         throw ('{0} exited before becoming ready; PID={1}; exit={2}; last health error: {3}' -f $service.Name, $service.Process.Id, $service.Process.ExitCode, $health.Error)
@@ -593,9 +848,7 @@ function Wait-CrewServices {
   }
 }
 
-# Non-critical diagnostic, called only after Ensure-CrewServices returns:
-# logs legacy bridge presence for operator awareness. Never gates, delays,
-# or claims 3210; never runs on the boot path.
+# Explicit diagnostic helper; not called by normal startup or supervision.
 function Write-LegacyBridgeDiagnostic {
   if (Test-LegacyBridgeAvailable) {
     Write-LaunchLog 'Diagnostic: legacy 3080 bridge still answers ping; Crew launcher owns 3210 directly, bridge ignored.'
@@ -609,8 +862,7 @@ function Ensure-CrewServices {
     # Maintenance fence: while a STOPPED maintenance session is active for
     # the Crew backend, ordinary supervision must NOT auto-start 3210 —
     # the stopped window belongs to the npx lifecycle's tree swap. Only a
-    # matching maintenance-start owns the launch right. 3080 supervision
-    # continues normally during the window.
+    # matching maintenance-start owns the launch right.
     if ($service.CrewOwned -and (Test-MaintenanceSessionActive)) {
       $service.State = 'maintenance'
       $service.LastError = $null
@@ -619,10 +871,15 @@ function Ensure-CrewServices {
     $health = Get-HealthState $service
     if ($health.Ready) {
       $wasReady = $service.State -eq 'ready'
+      if ($service.CrewOwned -and -not $service.ListenerPid -and -not (Set-TrackedListenerIdentity -Service $service)) {
+        throw ('{0} is healthy on {1}, but this supervisor cannot prove process ownership.' -f $service.Name, $service.Port)
+      }
+      if ($service.CrewOwned -and -not (Test-CrewServiceOwnership -Service $service)) {
+        throw ('{0} is healthy on {1}, but its tracked listener identity is not owned.' -f $service.Name, $service.Port)
+      }
       $service.State = 'ready'
       $service.ConsecutiveFailures = 0
       $service.LastError = $null
-      if ($service.CrewOwned -and -not $service.ListenerPid) { [void] (Set-TrackedListenerIdentity -Service $service) }
       if (-not $QuietHealthy -or -not $wasReady) {
         Write-LaunchLog ('{0} already ready on {1}; runtime={2}' -f $service.Name, $service.Port, $health.Version)
       }
@@ -686,7 +943,11 @@ function Start-ServiceSupervisor {
       return
     }
 
-    Write-LaunchLog 'Supervisor active; monitoring 3080 and 3210 every 10 seconds.'
+    # Publish process identity before any 3210 startup/health wait. Handoff
+    # callers can now distinguish a legitimate cold-starting target watcher
+    # from the stale heartbeat left by the watcher it replaced.
+    Write-SupervisorHeartbeat -OwnershipReady $false
+    Write-LaunchLog 'Supervisor active; monitoring Crew-owned 3210 every 10 seconds.'
     $lastRecoveryError = $null
     $updateLockFile = Join-Path $crewHome '..\app\update-in-progress.lock'
     $staleLockNotified = $false
@@ -718,25 +979,30 @@ function Start-ServiceSupervisor {
         } else {
           $staleLockNotified = $false
         }
+        # Maintenance stop/start is the updater's owned process handoff and
+        # must remain live while the update lock fences ordinary recovery.
+        Invoke-CrewMaintenanceRequests
         if ($updateHeld) {
-          Write-LaunchLog 'Update in progress; supervisor observing only, no restarts.'
+          Write-LaunchLog 'Update in progress; maintenance only, ordinary recovery suspended.'
           $lastRecoveryError = $null
         } else {
           # Control protocol: publish this watcher's heartbeat and consume
           # any durable restart requests the hub wrote (3210 never spawns
-          # itself). Then consume maintenance transactions (npx cohort
-          # migration stop/start phases). Then run the ordinary health pass.
-          Write-SupervisorHeartbeat
+          # itself). Maintenance was consumed above; now run the ordinary
+          # health pass.
           Invoke-CrewRestartRequests
-          Invoke-CrewMaintenanceRequests
           Ensure-CrewServices -QuietHealthy
           if ($lastRecoveryError) {
-            Write-LaunchLog 'Supervisor recovery succeeded; both services are healthy.'
+            Write-LaunchLog 'Supervisor recovery succeeded; Crew-owned 3210 is healthy.'
             $lastRecoveryError = $null
           }
         }
+        $ownedServices = @($services | Where-Object { $_.CrewOwned -and (Test-CrewServiceOwnership -Service $_) })
+        $expectedServices = @($services | Where-Object { $_.CrewOwned })
+        Write-SupervisorHeartbeat -OwnershipReady ($expectedServices.Count -gt 0 -and $ownedServices.Count -eq $expectedServices.Count)
       } catch {
         $recoveryError = $_.Exception.Message
+        Write-SupervisorHeartbeat -OwnershipReady $false
         if ($recoveryError -ne $lastRecoveryError) {
           Write-LaunchLog ('Supervisor recovery failed; will retry: {0}' -f $recoveryError) 'WARN'
           $lastRecoveryError = $recoveryError
@@ -755,6 +1021,7 @@ if ($env:DSH_CREW_LAUNCHER_TEST_IMPORT -eq '1') { return }
 try {
   New-Item -ItemType Directory -Path $logRoot -Force | Out-Null
   Write-LaunchLog ('Launcher started; mode={0}; user={1}' -f $Mode, $env:USERNAME)
+  if ($Mode -eq 'open') { Open-OfficialFrontend }
 
   if (-not (Test-Path -LiteralPath $dshCli -PathType Leaf)) {
     throw "DSH CLI was not found at $dshCli. Run: npm install -g @ran-sh/dsh-crew@latest; dsh-crew update"
@@ -762,9 +1029,7 @@ try {
   if (-not (Test-Path -LiteralPath (Join-Path $crewHome 'profiles\dsh-crew\package.json') -PathType Leaf)) {
     throw "The isolated dsh-crew profile is missing under $crewHome. Run: dsh-crew update"
   }
-  if (-not (Test-Path -LiteralPath (Join-Path $officialHome 'profiles\web\package.json') -PathType Leaf)) {
-    throw "The official web profile is missing under $officialHome. Repair or install the official DeepSeek Harness web profile outside dsh-crew; dsh-crew never mutates the official profile."
-  }
+  # Background/watch modes remain independent of the official frontend.
 
   if ($Mode -eq 'watch') {
     Start-ServiceSupervisor
@@ -772,12 +1037,10 @@ try {
     exit 0
   }
 
-  Ensure-CrewServices
-  Write-LegacyBridgeDiagnostic
+  Ensure-CrewSupervisorRunning
 
   if ($Mode -eq 'open') {
-    Start-Process 'http://127.0.0.1:3080/' | Out-Null
-    Write-LaunchLog 'Opened daily console at http://127.0.0.1:3080/'
+    Write-LaunchLog 'Official frontend is on 3080; Crew is running silently on 3210.'
   }
   Write-LaunchLog ('Launcher completed successfully in {0:n1}s.' -f ((Get-Date) - $startedAt).TotalSeconds)
   exit 0