Mismatched recovery partitions

[mjhersh]

I've encountered a strange problem on a smallish (I hope) number of Macs where the recovery partition does not match the installed OS. This causes some OS updates to fail, since they reboot into recovery to complete installation. In particular, I'm seeing failures on High Sierra machines trying to install the 2019-002 10.13.6 security update while they have a Mojave recovery partition.

I don't know how or why these High Sierra machines have Mojave recovery partitions, but here we are.

So I have two questions:

1. Is there a nondestructive way to reset the recovery partition with the current OS's version?

2. Is there a clean way to determine the current recovery partition's version? I'd like to create an extension attribute so I can find which machines need to be fixed.

I tried scripting #2 but I hit a snag. If I manually mount the recovery partition (e.g. diskutil mount disk1s3), I can see a folder with a UUID-like name, in which there is a "SystemVersion.plist". So I figured I can write a script to mount recovery, pull the version from there, and done deal.

Buuuuuut I'm seeing weirder and weirder things on each new test machine I try. For example, one of them has 3 different versions in the recovery partition! Check it out:

$ ls -l /Volumes/Recovery
total 0
drwxr-xr-x  13 root  wheel  416 Dec 12 15:53 0589B363-1629-4146-952E-48C67AA22E68
drwxr-xr-x  23 root  wheel  736 Dec  7 15:39 13C33B68-0867-4106-8A9B-98E864B95F59
drwxr-xr-x  23 root  wheel  736 Apr 18 11:25 A4805A53-1F6E-4502-BE03-A7EEC2490CB1

And peering into the plists of these 3 we get this:

$ echo /Volumes/Recovery/*/SystemVersion.plist | xargs -n 1 defaults read
{
    ProductBuildVersion = 17G65;
    ProductCopyright = "1983-2018 Apple Inc.";
    ProductName = "Mac OS X";
    ProductUserVisibleVersion = "10.13.6";
    ProductVersion = "10.13.6";
}
{
    ProductBuildVersion = 18C54;
    ProductCopyright = "1983-2018 Apple Inc.";
    ProductName = "Mac OS X";
    ProductUserVisibleVersion = "10.14.2";
    ProductVersion = "10.14.2";
    iOSSupportVersion = "12.0";
}
{
    ProductBuildVersion = 18D109;
    ProductCopyright = "1983-2019 Apple Inc.";
    ProductName = "Mac OS X";
    ProductUserVisibleVersion = "10.14.3";
    ProductVersion = "10.14.3";
    iOSSupportVersion = "12.1";
}

FWIW, when I actually boot into recovery, I get Mojave (not sure which point release).

Why are there 3 folders? How do I know which one will load when I boot to recovery?