fix(access): support ownership migration when enabling enforcement

.github/workflows/desktop.yml

@@ -215,10 +215,10 @@ jobs:
             else
               build_status=$?
             fi
-            if [ "$attempt" -eq 3 ] || ! grep -Fq 'hdiutil: create failed - Resource busy' "$attempt_log"; then
+            if [ "$attempt" -eq 3 ] || ! grep -Eq "hdiutil: (create failed - Resource busy|couldn't eject .* - Resource busy)" "$attempt_log"; then
               exit "$build_status"
             fi
-            echo "::warning::DMG creation found a busy resource; retrying after $((attempt * 5)) seconds (attempt $attempt of 3)."
+            echo "::warning::DMG creation or unmount found a busy resource; retrying after $((attempt * 5)) seconds (attempt $attempt of 3)."
             sleep "$((attempt * 5))"
           done
       - name: Upload failed macOS build diagnostics

.github/workflows/master.yml

@@ -471,7 +471,10 @@ jobs:
   code-seekdb:
     needs: [quality, tests]
     if: ${{ !cancelled() && needs.quality.result == 'success' && contains(fromJSON('["success","skipped"]'), needs.tests.result) && (fromJSON(needs.quality.outputs.suites || '{}').database) }}
-    timeout-minutes: 30
+    # Shard 0 also runs indexing, bootstrap (20m), and archive validation (5m)
+    # before migrations (25m). Preserve each step's deadline and leave time
+    # for environment setup and diagnostic uploads.
+    timeout-minutes: 60
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -704,6 +707,16 @@ jobs:
       - name: Verify spawned worker logging on Windows
         run: uv run --locked --no-sync pytest -q tests/e2e/test_worker_logging.py
 
+      - name: Verify offline ownership migration on Windows
+        run: >-
+          uv run --locked --no-sync pytest -q
+          tests/e2e/test_access_ownership_migration.py::test_offline_cli_checks_future_background_principal_before_enforcement
+          tests/e2e/test_access_ownership_migration.py::test_offline_background_plan_uses_configured_static_preset_without_grants
+          tests/e2e/test_access_ownership_migration.py::test_migration_audit_preserves_request_context
+          tests/e2e/test_ownership_maintenance_dispatch.py
+          tests/e2e/test_owner_recovery_http.py::test_offline_migration_preserves_external_owner_evidence
+          tests/e2e/test_candidate_ownership_migration.py
+
       - name: Verify bootstrap receipt persistence and failure recovery on Windows
         run: >-
           uv run --locked --no-sync pytest -q

desktop/README.md

@@ -178,7 +178,7 @@ Installed boundary checks exercise an 8192-byte Unicode note, reject over-budget
 
 After upgrading from an earlier preview, open Connections and select your saved connection. Profiles matching the bundled API contract appear under “Available for this Desktop build”; compare their tested Server builds with your deployment before selecting one, saving, checking and explicitly using the connection again. New connections start with no compatibility selection.
 
-Historical profiles appear as disabled records when their contract differs from this build. A saved incompatible or unavailable selection remains visible with an explanation until explicitly replaced. The `sqlite-atomic-2d782c2a-v1` record matches this build's contract and qualifies eleven SQLite protocol operations against the exact Server source and wheel recorded in the validation guide. Select it only after comparing that tested build with your deployment. Existing records retain their original Server source, contract, wheel and operation identities. The `ci-fixtures` build is for disposable acceptance tests and does not qualify a production deployment. Qualification evidence and remaining requirements are documented in the [validation guide](VALIDATION.md#compatibility-scope).
+Historical profiles appear as disabled records when their contract differs from this build. A saved incompatible or unavailable selection remains visible with an explanation until explicitly replaced. The `sqlite-atomic-3cefa45a-v1` record matches this build's contract and qualifies eleven SQLite protocol operations against the exact Server source and wheel recorded in the validation guide. Select it only after comparing that tested build with your deployment. Existing records retain their original Server source, contract, wheel and operation identities, including the historical `sqlite-atomic-f3a90b2f-v1` qualification. The `ci-fixtures` build is for disposable acceptance tests and does not qualify a production deployment. Qualification evidence and remaining requirements are documented in the [validation guide](VALIDATION.md#compatibility-scope).
 
 ## Build on macOS
 

desktop/README.zh.md

@@ -161,7 +161,7 @@ Windows GitHub Actions 会构建未签名安装包，安装到临时中文路径
 
 从早期预览版升级后，请打开「连接」并选中已保存的连接。与当前 API 契约匹配的配置显示在「此 Desktop 构建可用」中；先核对已测试的 Server 构建与实际部署，再明确选择、保存、检查并使用该连接。新连接默认不选择兼容配置。
 
-历史配置在契约不匹配时显示为不可选择的记录。已保存的不匹配或不可用配置仍会显示并说明原因，须明确替换，不会静默升级。`sqlite-atomic-2d782c2a-v1` 与当前构建的契约匹配，已针对验证说明中记录的精确 Server 源码和 wheel 验证 11 项 SQLite 协议操作；请先核对该受测构建与实际部署，再明确选择。现有记录保留各自原始的 Server 源码、契约、wheel 和操作身份。`ci-fixtures` 构建仅用于临时验收测试，不代表实际部署已通过兼容性验证。资格证据和剩余要求见[验证说明](VALIDATION.md#compatibility-scope)。
+历史配置在契约不匹配时显示为不可选择的记录。已保存的不匹配或不可用配置仍会显示并说明原因，须明确替换，不会静默升级。`sqlite-atomic-3cefa45a-v1` 与当前构建的契约匹配，已针对验证说明中记录的精确 Server 源码和 wheel 验证 11 项 SQLite 协议操作；请先核对该受测构建与实际部署，再明确选择。现有记录保留各自原始的 Server 源码、契约、wheel 和操作身份。`ci-fixtures` 构建仅用于临时验收测试，不代表实际部署已通过兼容性验证。资格证据和剩余要求见[验证说明](VALIDATION.md#compatibility-scope)。
 
 ## 在 macOS 上构建