feat(channels): add channel-owned setup contracts (#112176)

* feat(channels): add channel-owned setup contracts

* test(channels): align legacy setup fixtures

* chore(channels): regenerate config and SDK baselines after rebase

* fix(update): run fresh doctor after current-process core changes

* fix(channels): align add pre-scan with execution precedence

* style(cli): format channels-cli test additions

* fix(channels): restore option-before-positional channel resolution via metadata arity scan

* fix(channels): keep help flags out of metadata arity escalation

* test(update): mock fresh post-update doctor in current-process suites

* style: format review fixes and correct entrypoint mock type

* fix(channels): register only modern contract options for dual-publishing plugins

* test(update): align downgrade suites with fresh-doctor child invocation

* docs(channels): record empty-contract and input-forwarding invariants

* fix(line): keep the shipped --token switch as a channel access token alias

* fix(signal): stop treating exact cross-family loopback endpoints as bind-aligned

* chore(config): regenerate docs config baselines after second rebase

* style: format rebased channels add tests

* fix(channels): enforce field-key and flag-name agreement in setup contracts

* fix(signal): detect container endpoints for bare --http-url setup

* fix(signal): ignore unconfigured accounts in transport collision checks

* fix(channels): validate negated setup flags in contract and normalizer

* fix(signal): preserve existing transport kind when setup detection is unreachable

* style(signal): use direct boolean check in collision guard

* style(signal): type test config literals

* docs(update): record two-read design of fresh-doctor validation gate

* fix(channels): satisfy post-rebase architecture gates

* docs: refresh channel setup map

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>

src/cli/update-cli/update-command-post-update.ts

@@ -26,13 +26,16 @@ import {
   persistRequestedUpdateChannel,
   restoreDroppedPreUpdateChannels,
 } from "./update-command-config.js";
+import { completePostCorePluginUpdate } from "./update-command-fresh-doctor.js";
 import { updatePluginsAfterCoreUpdate } from "./update-command-plugins.js";
 import {
   continuePostCoreUpdateInFreshProcess,
+  didCoreUpdateChangeInstall,
   markControlPlaneUpdateRestartSentinelFailureBestEffort,
   shouldResumePostCoreUpdateInFreshProcess,
   writeControlPlaneUpdateRestartSentinelBestEffort,
 } from "./update-command-post-core.js";
+import { POST_PLUGIN_DOCTOR_EXECUTION_FAILED_REASON } from "./update-command-post-plugin-validation.js";
 import {
   gatewayServiceCommandUsesRoot,
   maybeRestartService,
@@ -254,7 +257,7 @@ export async function finishUpdate(params: {
       process.env.OPENCLAW_COMPATIBILITY_HOST_VERSION = compatibilityDowngradeTarget;
     }
     try {
-      postCorePluginUpdate = await updatePluginsAfterCoreUpdate({
+      const initialPluginUpdate = await updatePluginsAfterCoreUpdate({
         root: postUpdateRoot,
         channel: params.channel,
         configSnapshot: postUpdateConfigSnapshot,
@@ -264,6 +267,22 @@ export async function finishUpdate(params: {
         timeoutMs: params.updateStepTimeoutMs,
         pluginInstallRecords: params.preUpdatePluginInstallRecords,
       });
+      const completedPluginUpdate = await completePostCorePluginUpdate({
+        root: postUpdateRoot,
+        pluginUpdate: initialPluginUpdate,
+        // A plugin-only update can replace its migration owner without replacing core.
+        // Downgrades and resume fallbacks can also leave an updated core on disk in this process.
+        freshDoctorRequired:
+          didCoreUpdateChangeInstall(params.result) ||
+          initialPluginUpdate.sync.changed ||
+          initialPluginUpdate.npm.changed,
+        yes: params.opts.yes === true,
+        json: params.opts.json === true,
+        timeoutMs: params.updateStepTimeoutMs,
+        ...(params.packageUpdateNodeRunner ? { nodeRunner: params.packageUpdateNodeRunner } : {}),
+      });
+      postCorePluginUpdate = completedPluginUpdate.pluginUpdate;
+      postUpdateConfigSnapshot = completedPluginUpdate.configSnapshot;
     } finally {
       if (compatibilityDowngradeTarget) {
         if (previousCompatibilityHostVersion === undefined) {
@@ -296,6 +315,14 @@ export async function finishUpdate(params: {
       result: resultWithPostUpdate,
       jsonMode: Boolean(params.opts.json),
     });
+    // If strict config became valid despite a fresh-doctor process failure, restore the service
+    // stopped by this update. Invalid post-migration config intentionally remains stopped.
+    if (postCorePluginUpdate.reason === POST_PLUGIN_DOCTOR_EXECUTION_FAILED_REASON) {
+      await maybeRestartServiceAfterFailedMutableUpdate({
+        preManagedServiceStop: params.preManagedServiceStop,
+        jsonMode: Boolean(params.opts.json),
+      });
+    }
     if (params.opts.json) {
       defaultRuntime.writeJson(resultWithPostUpdate);
     } else {