The cold-start distinctionLive HMR can retain the last good tree after a rejected candidate. A restart has no previous tree and exits.

Recover through three proofs.

1 · Preserve

Stop DSH and copy the profile manifest, both user layers, lockfile, and first error.

2 · Baseline

Use --dump-default-config to omit user layers and prove shipped bundles still compose.

3 · Reduce

Set the implicated active user layer to a valid empty array: [].

4 · Boot

Require both a full config dump and real import/activation readiness.

dsh --profile web --dump-default-config > web.default.yml
dsh --profile web --dump-config > web.recovered.yml
dsh --profile web
A successful dump is not a successful boot.

Offline composition parses patches but does not prove that an inserted package resolves, imports, or activates.

Choose the correct repair.

Accidental rowRemove the insert

Restore reviewed groups one at a time.

Intended bundleUse dsh plugin add

Require zero exit, lock integrity, declaration, and boot.

Raw moduleResolve from profile root

Then test its export and lifecycle in isolation.

A writer needs a transaction.

resolve → parse → compose → snapshot
  → isolated boot + health probe
  → promote or restore

Do not turn every missing plugin into a warning. A missing policy, sandbox, or persistence provider is not a safe degraded runtime.

Keep the complete recovery runbook.

The canonical guide maps both user layers, the rc.8 default-config escape hatch, package resolution probes, unsafe shortcuts, transactional writer requirements, and ten acceptance gates.

Read the complete runbook