@alfe.ai/gateway 0.10.5 → 0.10.6

package/dist/health.js

@@ -4349,6 +4349,7 @@ function isClerkReverificationResponse(value) {
 //#endregion
 //#region ../../packages-internal/types/dist/models.js
 const AnthropicModel = {
+	Opus55: "claude-opus-5-5",
 	Opus5: "claude-opus-5",
 	Opus48: "claude-opus-4-8",
 	Opus47: "claude-opus-4-7",
@@ -4359,6 +4360,7 @@ const AnthropicModel = {
 };
 const ANTHROPIC_MODELS = enumValues(AnthropicModel);
 const OpenAIModel = {
+	GPT6Astra: "gpt-6-astra",
 	GPT4o: "gpt-4o",
 	GPT4oMini: "gpt-4o-mini",
 	O3: "o3",
@@ -4381,20 +4383,22 @@ const OpenAIModel = {
 };
 const OPENAI_MODELS = enumValues(OpenAIModel);
 const DeepSeekModel = {
-	Chat: "deepseek-chat",
-	Reasoner: "deepseek-reasoner",
-	V4Flash: "deepseek-v4-flash",
-	V4Pro: "deepseek-v4-pro"
+	Flash: "deepseek-flash",
+	V4Pro: "deepseek-v4-pro",
+	V4Flash: "deepseek-v4-flash"
 };
 const DEEPSEEK_MODELS = enumValues(DeepSeekModel);
 const GoogleModel = {
+	Gemini38Flash: "gemini-3.8-flash",
+	Gemini37Flash: "gemini-3.7-flash",
+	Gemini36Flash: "gemini-3.6-flash",
 	Gemini35Flash: "gemini-3.5-flash",
+	Gemini35FlashLite: "gemini-3.5-flash-lite",
 	Gemini31Pro: "gemini-3.1-pro-preview",
 	Gemini31FlashLite: "gemini-3.1-flash-lite",
 	Gemini25Pro: "gemini-2.5-pro",
 	Gemini25Flash: "gemini-2.5-flash",
-	Gemini25FlashLite: "gemini-2.5-flash-lite",
-	Gemini20Flash: "gemini-2.0-flash"
+	Gemini25FlashLite: "gemini-2.5-flash-lite"
 };
 const GOOGLE_MODELS = enumValues(GoogleModel);
 const MiniMaxModel = {
@@ -4412,20 +4416,23 @@ const MistralModel = {
 	Small: "mistral-small-latest",
 	Codestral: "codestral-latest",
 	Ministral8b: "ministral-8b-latest",
-	Ministral3b: "ministral-3b-latest",
-	MagistralMedium: "magistral-medium-latest",
-	MagistralSmall: "magistral-small-latest",
-	DevstralMedium: "devstral-medium-latest"
+	Ministral3b: "ministral-3b-latest"
 };
 const MISTRAL_MODELS = enumValues(MistralModel);
 const XAIModel = {
+	Grok47: "grok-4.7",
+	Grok46: "grok-4.6",
 	Grok45: "grok-4.5",
 	Grok43: "grok-4.3",
+	GrokBuild01: "grok-build-0.1",
 	Grok4: "grok-4",
 	Grok41Fast: "grok-4.1-fast"
 };
 const XAI_MODELS = enumValues(XAIModel);
 const ZhipuModel = {
+	GLM53: "glm-5.3",
+	GLM53Flash: "glm-5.3-flash",
+	GLM53FlashX: "glm-5.3-flashx",
 	GLM52: "glm-5.2",
 	GLM51: "glm-5.1",
 	GLM46: "glm-4.6",
@@ -4441,6 +4448,8 @@ const MoonshotModel = {
 };
 const MOONSHOT_MODELS = enumValues(MoonshotModel);
 const QwenModel = {
+	Qwen38Max: "qwen3.8-max",
+	Qwen38Flash: "qwen3.8-flash",
 	Qwen37Max: "qwen3.7-max",
 	Qwen37Plus: "qwen3.7-plus",
 	Qwen36Flash: "qwen3.6-flash",
@@ -4471,7 +4480,7 @@ _enum(ZHIPU_MODELS);
 _enum(MOONSHOT_MODELS);
 _enum(QWEN_MODELS);
 string().trim().min(1);
-AnthropicModel.Opus5, AnthropicModel.Opus48, AnthropicModel.Opus47, AnthropicModel.Opus46, AnthropicModel.Sonnet5, AnthropicModel.Sonnet46, AnthropicModel.Haiku45, OpenAIModel.GPT4o, OpenAIModel.GPT4oMini, OpenAIModel.O3, OpenAIModel.GPT41, OpenAIModel.GPT41Mini, OpenAIModel.GPT41Nano, OpenAIModel.GPT54, OpenAIModel.GPT54Mini, OpenAIModel.GPT54Nano, OpenAIModel.GPT54Pro, OpenAIModel.GPT55, OpenAIModel.GPT55Pro, OpenAIModel.GPT56Sol, OpenAIModel.GPT56Terra, OpenAIModel.GPT56Luna, OpenAIModel.O3Mini, OpenAIModel.O4Mini, OpenAIModel.TextEmbedding3Small, OpenAIModel.TextEmbedding3Large, DeepSeekModel.Chat, DeepSeekModel.Reasoner, DeepSeekModel.V4Flash, DeepSeekModel.V4Pro, GoogleModel.Gemini35Flash, GoogleModel.Gemini31Pro, GoogleModel.Gemini31FlashLite, GoogleModel.Gemini25Pro, GoogleModel.Gemini25Flash, GoogleModel.Gemini25FlashLite, GoogleModel.Gemini20Flash, MiniMaxModel.M3, MiniMaxModel.M27, MiniMaxModel.M27HighSpeed, MiniMaxModel.M25, MiniMaxModel.M21, MiniMaxModel.M2, MistralModel.Large, MistralModel.Medium, MistralModel.Small, MistralModel.Codestral, MistralModel.Ministral8b, MistralModel.Ministral3b, MistralModel.MagistralMedium, MistralModel.MagistralSmall, MistralModel.DevstralMedium, XAIModel.Grok45, XAIModel.Grok43, XAIModel.Grok4, XAIModel.Grok41Fast, ZhipuModel.GLM52, ZhipuModel.GLM51, ZhipuModel.GLM46, ZhipuModel.GLM45, ZhipuModel.GLM45Air, MoonshotModel.K3, MoonshotModel.K26, MoonshotModel.K27Code, MoonshotModel.K27CodeHighSpeed, QwenModel.Qwen37Max, QwenModel.Qwen37Plus, QwenModel.Qwen36Flash, QwenModel.Qwen35Flash;
+AnthropicModel.Opus55, AnthropicModel.Opus5, AnthropicModel.Opus48, AnthropicModel.Opus47, AnthropicModel.Opus46, AnthropicModel.Sonnet5, AnthropicModel.Sonnet46, AnthropicModel.Haiku45, OpenAIModel.GPT6Astra, OpenAIModel.GPT4o, OpenAIModel.GPT4oMini, OpenAIModel.O3, OpenAIModel.GPT41, OpenAIModel.GPT41Mini, OpenAIModel.GPT41Nano, OpenAIModel.GPT54, OpenAIModel.GPT54Mini, OpenAIModel.GPT54Nano, OpenAIModel.GPT54Pro, OpenAIModel.GPT55, OpenAIModel.GPT55Pro, OpenAIModel.GPT56Sol, OpenAIModel.GPT56Terra, OpenAIModel.GPT56Luna, OpenAIModel.O3Mini, OpenAIModel.O4Mini, OpenAIModel.TextEmbedding3Small, OpenAIModel.TextEmbedding3Large, DeepSeekModel.Flash, DeepSeekModel.V4Pro, DeepSeekModel.V4Flash, GoogleModel.Gemini38Flash, GoogleModel.Gemini37Flash, GoogleModel.Gemini36Flash, GoogleModel.Gemini35Flash, GoogleModel.Gemini35FlashLite, GoogleModel.Gemini31Pro, GoogleModel.Gemini31FlashLite, GoogleModel.Gemini25Pro, GoogleModel.Gemini25Flash, GoogleModel.Gemini25FlashLite, MiniMaxModel.M3, MiniMaxModel.M27, MiniMaxModel.M27HighSpeed, MiniMaxModel.M25, MiniMaxModel.M21, MiniMaxModel.M2, MistralModel.Large, MistralModel.Medium, MistralModel.Small, MistralModel.Codestral, MistralModel.Ministral8b, MistralModel.Ministral3b, XAIModel.Grok47, XAIModel.Grok46, XAIModel.Grok45, XAIModel.Grok43, XAIModel.GrokBuild01, XAIModel.Grok4, XAIModel.Grok41Fast, ZhipuModel.GLM53, ZhipuModel.GLM53Flash, ZhipuModel.GLM53FlashX, ZhipuModel.GLM52, ZhipuModel.GLM51, ZhipuModel.GLM46, ZhipuModel.GLM45, ZhipuModel.GLM45Air, MoonshotModel.K3, MoonshotModel.K26, MoonshotModel.K27Code, MoonshotModel.K27CodeHighSpeed, QwenModel.Qwen38Max, QwenModel.Qwen38Flash, QwenModel.Qwen37Max, QwenModel.Qwen37Plus, QwenModel.Qwen36Flash, QwenModel.Qwen35Flash;
 /**
 * Alfe-hosted open-weight models are promoted dynamically only in regions
 * whose private data plane exists. Keep them out of ALL_MODELS so the standard
@@ -4531,7 +4540,7 @@ const AWS_PRIVATE_MODEL_PRICING = {
 	[BedrockModel.TitanEmbedTextV2]: { input: .026004 }
 };
 Object.fromEntries(AWS_PRIVATE_BEDROCK_CHAT_MODELS.map((modelId) => [`alfe-bedrock-${modelId}`, AWS_PRIVATE_MODEL_PRICING[modelId]]));
-AnthropicModel.Opus5, AnthropicModel.Opus48, AnthropicModel.Opus47, AnthropicModel.Opus46, AnthropicModel.Sonnet5, AnthropicModel.Sonnet46, AnthropicModel.Haiku45, OpenAIModel.GPT4o, OpenAIModel.GPT4oMini, OpenAIModel.O3, OpenAIModel.GPT41, OpenAIModel.GPT41Mini, OpenAIModel.GPT41Nano, OpenAIModel.GPT54, OpenAIModel.GPT54Mini, OpenAIModel.GPT54Nano, OpenAIModel.GPT54Pro, OpenAIModel.GPT55, OpenAIModel.GPT55Pro, OpenAIModel.GPT56Sol, OpenAIModel.GPT56Terra, OpenAIModel.GPT56Luna, OpenAIModel.O3Mini, OpenAIModel.O4Mini, OpenAIModel.TextEmbedding3Small, OpenAIModel.TextEmbedding3Large, DeepSeekModel.Chat, DeepSeekModel.Reasoner, DeepSeekModel.V4Flash, DeepSeekModel.V4Pro, GoogleModel.Gemini35Flash, GoogleModel.Gemini31Pro, GoogleModel.Gemini31FlashLite, GoogleModel.Gemini25Pro, GoogleModel.Gemini25Flash, GoogleModel.Gemini25FlashLite, GoogleModel.Gemini20Flash, MiniMaxModel.M3, MiniMaxModel.M27, MiniMaxModel.M27HighSpeed, MiniMaxModel.M25, MiniMaxModel.M21, MiniMaxModel.M2, MistralModel.Large, MistralModel.Medium, MistralModel.Small, MistralModel.Codestral, MistralModel.Ministral8b, MistralModel.Ministral3b, MistralModel.MagistralMedium, MistralModel.MagistralSmall, MistralModel.DevstralMedium, XAIModel.Grok45, XAIModel.Grok43, XAIModel.Grok4, XAIModel.Grok41Fast, ZhipuModel.GLM52, ZhipuModel.GLM51, ZhipuModel.GLM46, ZhipuModel.GLM45, ZhipuModel.GLM45Air, MoonshotModel.K3, MoonshotModel.K26, MoonshotModel.K27Code, MoonshotModel.K27CodeHighSpeed, QwenModel.Qwen37Max, QwenModel.Qwen37Plus, QwenModel.Qwen36Flash, QwenModel.Qwen35Flash;
+AnthropicModel.Opus55, AnthropicModel.Opus5, AnthropicModel.Opus48, AnthropicModel.Opus47, AnthropicModel.Opus46, AnthropicModel.Sonnet5, AnthropicModel.Sonnet46, AnthropicModel.Haiku45, OpenAIModel.GPT6Astra, OpenAIModel.GPT4o, OpenAIModel.GPT4oMini, OpenAIModel.O3, OpenAIModel.GPT41, OpenAIModel.GPT41Mini, OpenAIModel.GPT41Nano, OpenAIModel.GPT54, OpenAIModel.GPT54Mini, OpenAIModel.GPT54Nano, OpenAIModel.GPT54Pro, OpenAIModel.GPT55, OpenAIModel.GPT55Pro, OpenAIModel.GPT56Sol, OpenAIModel.GPT56Terra, OpenAIModel.GPT56Luna, OpenAIModel.O3Mini, OpenAIModel.O4Mini, OpenAIModel.TextEmbedding3Small, OpenAIModel.TextEmbedding3Large, DeepSeekModel.Flash, DeepSeekModel.V4Pro, DeepSeekModel.V4Flash, GoogleModel.Gemini38Flash, GoogleModel.Gemini37Flash, GoogleModel.Gemini36Flash, GoogleModel.Gemini35Flash, GoogleModel.Gemini35FlashLite, GoogleModel.Gemini31Pro, GoogleModel.Gemini31FlashLite, GoogleModel.Gemini25Pro, GoogleModel.Gemini25Flash, GoogleModel.Gemini25FlashLite, MiniMaxModel.M3, MiniMaxModel.M27, MiniMaxModel.M27HighSpeed, MiniMaxModel.M25, MiniMaxModel.M21, MiniMaxModel.M2, MistralModel.Large, MistralModel.Medium, MistralModel.Small, MistralModel.Codestral, MistralModel.Ministral8b, MistralModel.Ministral3b, XAIModel.Grok47, XAIModel.Grok46, XAIModel.Grok45, XAIModel.Grok43, XAIModel.GrokBuild01, XAIModel.Grok4, XAIModel.Grok41Fast, ZhipuModel.GLM53, ZhipuModel.GLM53Flash, ZhipuModel.GLM53FlashX, ZhipuModel.GLM52, ZhipuModel.GLM51, ZhipuModel.GLM46, ZhipuModel.GLM45, ZhipuModel.GLM45Air, MoonshotModel.K3, MoonshotModel.K26, MoonshotModel.K27Code, MoonshotModel.K27CodeHighSpeed, QwenModel.Qwen38Max, QwenModel.Qwen38Flash, QwenModel.Qwen37Max, QwenModel.Qwen37Plus, QwenModel.Qwen36Flash, QwenModel.Qwen35Flash;
 enumValues({
 	Standard: "standard",
 	AwsPrivate: "aws_private"
@@ -4746,7 +4755,8 @@ var AlfeApiClient = class {
 						ok: false,
 						error: errorMessage ?? (typeof body === "string" ? body : `API error: ${String(res.status)}`),
 						status: res.status,
-						...typeof errBody?.code === "string" ? { code: errBody.code } : {}
+						...typeof errBody?.code === "string" ? { code: errBody.code } : {},
+						...Array.isArray(errBody?.ineligibleUserIds) && errBody.ineligibleUserIds.every((id) => typeof id === "string") ? { ineligibleUserIds: [...errBody.ineligibleUserIds] } : {}
 					}
 				};
 			}
@@ -5854,13 +5864,17 @@ function isIPCResponse(msg) {
 const PROTOCOL_VERSION = 1;
 //#endregion
 //#region src/runtime-gate.ts
-const log$5 = logger.child({ component: "RuntimeGate" });
+const log$6 = logger.child({ component: "RuntimeGate" });
 var RuntimeGate = class {
 	depth = 0;
 	wasRunning = false;
 	exclusive = false;
 	/** Brackets parked behind an exclusive hold (or an exclusive request parked behind open brackets). */
 	waiters = [];
+	/** `suspendExclusive()` callers currently parked behind open brackets. */
+	parkedExclusive = 0;
+	/** The daemon is holding the runtime's FIRST start (fresh managed box); see {@link deferFirstStart}. */
+	firstStartDeferred = false;
 	constructor(getRuntime) {
 		this.getRuntime = getRuntime;
 	}
@@ -5872,6 +5886,9 @@ var RuntimeGate = class {
 	get isExclusive() {
 		return this.exclusive;
 	}
+	get hasParkedExclusive() {
+		return this.parkedExclusive > 0;
+	}
 	waitFor(ready) {
 		if (ready()) return Promise.resolve();
 		return new Promise((resolve) => {
@@ -5894,26 +5911,33 @@ var RuntimeGate = class {
 	* up (e.g. autoStartRuntime=false). Waits while an exclusive bracket is open.
 	*/
 	async suspend() {
-		if (this.exclusive) log$5.info("Mutating reconcile parked behind an exclusive runtime hold (upgrade in flight)");
+		if (this.exclusive) log$6.info("Mutating reconcile parked behind an exclusive runtime hold (upgrade in flight)");
 		while (this.exclusive) await this.waitFor(() => !this.exclusive);
 		await this.enter();
 	}
 	async suspendExclusive() {
-		if (this.exclusive || this.depth !== 0) log$5.info({
+		if (this.exclusive || this.depth !== 0) log$6.info({
 			depth: this.depth,
 			exclusive: this.exclusive
 		}, "Exclusive runtime hold parked behind open brackets (reconcile in flight)");
-		while (this.exclusive || this.depth !== 0) await this.waitFor(() => !this.exclusive && this.depth === 0);
-		log$5.info("Exclusive runtime hold acquired");
+		if (this.exclusive || this.depth !== 0) {
+			this.parkedExclusive += 1;
+			try {
+				while (this.exclusive || this.depth !== 0) await this.waitFor(() => !this.exclusive && this.depth === 0);
+			} finally {
+				this.parkedExclusive -= 1;
+			}
+		}
+		log$6.info("Exclusive runtime hold acquired");
 		this.exclusive = true;
 		await this.enter();
 	}
 	async enter() {
 		if (this.depth++ > 0) return;
 		const rp = this.getRuntime();
-		this.wasRunning = rp?.isRunning ?? false;
+		this.wasRunning = rp?.isActive ?? false;
 		if (rp && this.wasRunning) {
-			log$5.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
+			log$6.info("Suspending runtime for mutating reconcile (avoid concurrent SQLite writers)");
 			await rp.stopWhenIdle();
 		}
 	}
@@ -5928,7 +5952,7 @@ var RuntimeGate = class {
 		if (this.depth < 0) this.depth = 0;
 		const rp = this.getRuntime();
 		if (rp && this.wasRunning) {
-			log$5.info("Resuming runtime after mutating reconcile");
+			log$6.info("Resuming runtime after mutating reconcile");
 			rp.resume();
 		}
 		this.wasRunning = false;
@@ -5937,6 +5961,32 @@ var RuntimeGate = class {
 		return Promise.resolve();
 	}
 	/**
+	* Start a runtime that has not been started yet (daemon boot, deferred first
+	* start). Never spawns while a bracket is open: the start is folded into the
+	* pending outermost `resume()` instead, so a first start can't land in the
+	* middle of a mutating reconcile or an exclusive upgrade.
+	*/
+	requestStart() {
+		this.firstStartDeferred = false;
+		const rp = this.getRuntime();
+		if (!rp) return;
+		if (this.depth > 0) {
+			log$6.info("Runtime start requested while suspended — deferring to pending resume");
+			this.wasRunning = true;
+			return;
+		}
+		rp.start();
+	}
+	/**
+	* Mark the runtime's first start as deferred (fresh managed box, see
+	* first-runtime-start.ts). Until {@link requestStart} runs, an out-of-band
+	* {@link requestRestart} of the never-started runtime is folded into that
+	* pending start instead of spawning it early.
+	*/
+	deferFirstStart() {
+		this.firstStartDeferred = true;
+	}
+	/**
 	* Out-of-band restart request (e.g. `alfe.config_set`, Hermes MCP sync).
 	* Deferred while a suspend is active — the pending `resume()` will bring the
 	* runtime back with fresh config, so restarting mid-suspend would just fight
@@ -5945,12 +5995,16 @@ var RuntimeGate = class {
 	*/
 	requestRestart() {
 		if (this.depth > 0) {
-			log$5.info("Runtime restart requested while suspended — deferring to pending resume");
+			log$6.info("Runtime restart requested while suspended — deferring to pending resume");
 			return;
 		}
 		const rp = this.getRuntime();
+		if (rp && this.firstStartDeferred && !rp.isActive) {
+			log$6.info("Runtime restart requested before the deferred first start — folding into that start");
+			return;
+		}
 		if (rp) rp.restart().catch((err) => {
-			log$5.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to restart runtime");
+			log$6.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to restart runtime");
 		});
 	}
 };
@@ -5973,7 +6027,7 @@ var NoopRuntimeGate = class {
 };
 //#endregion
 //#region src/reconciliation.ts
-const log$4 = logger.child({ component: "Reconciliation" });
+const log$5 = logger.child({ component: "Reconciliation" });
 /**
 * How many times reconcile will re-attempt activation of an intact integration
 * stuck in `error` (with no reinstall requested) before giving up and waiting
@@ -5994,6 +6048,13 @@ var ReconciliationEngine = class {
 	*/
 	suspended = false;
 	/**
+	* A suspension carried from the previous pass because the caller already
+	* had another DESIRED_STATE queued (see {@link ReconcileOptions.holdSuspension}).
+	* The next pass adopts it instead of resuming → re-suspending the runtime;
+	* {@link releaseHeldSuspension} gives it back once the queue is drained.
+	*/
+	heldSuspension = false;
+	/**
 	* @param manager The integration manager to converge.
 	* @param gate    Runtime gate used to suspend the runtime child around
 	*                mutating branches so `openclaw` CLI subprocesses don't write
@@ -6022,14 +6083,43 @@ var ReconciliationEngine = class {
 	* so the mutation performed by {@link ensureSuspended} in a different method
 	* isn't narrowed away by control-flow analysis at the callsite.
 	*/
-	async resumeIfSuspended() {
-		if (this.suspended) await this.gate.resume();
+	async resumeIfSuspended(opts) {
+		if (!this.suspended) return;
+		if (opts?.holdSuspension?.()) {
+			log$5.info("Holding runtime suspension across queued reconcile pass");
+			if (this.gate.hasParkedExclusive) log$5.warn("Exclusive runtime hold (upgrade) is parked behind a suspension held for queued reconcile passes");
+			this.heldSuspension = true;
+			return;
+		}
+		await this.gate.resume();
+	}
+	/**
+	* Resume a suspension held across passes by {@link ReconcileOptions.holdSuspension}.
+	* The caller MUST call this once its queue of passes is drained (success or
+	* failure), otherwise the runtime stays suspended. No-op when nothing is held.
+	*/
+	async releaseHeldSuspension() {
+		if (!this.heldSuspension) return;
+		this.heldSuspension = false;
+		await this.gate.resume();
+	}
+	/** True while a suspension is carried between passes (tests/diagnostics). */
+	get isHoldingSuspension() {
+		return this.heldSuspension;
 	}
 	/**
 	* Reconcile local state against desired state from cloud.
 	*/
-	async reconcile(desiredIntegrations) {
-		this.suspended = false;
+	async reconcile(desiredIntegrations, opts) {
+		this.suspended = this.heldSuspension;
+		this.heldSuspension = false;
+		try {
+			return await this.reconcilePass(desiredIntegrations);
+		} finally {
+			await this.resumeIfSuspended(opts);
+		}
+	}
+	async reconcilePass(desiredIntegrations) {
 		const report = {
 			results: [],
 			installed: [],
@@ -6043,7 +6133,7 @@ var ReconciliationEngine = class {
 		try {
 			localIntegrations = await this.manager.getInstalledIntegrations();
 		} catch (err) {
-			log$4.error({ err }, "Failed to get local integrations");
+			log$5.error({ err }, "Failed to get local integrations");
 			captureIntegrationFailure("_reconciliation", "read_local_state", err);
 			const errorMessage = "Failed to read local integration state; reconciliation skipped";
 			const affectedIds = desiredIntegrations.length > 0 ? desiredIntegrations.map((desired) => desired.integrationId) : ["*"];
@@ -6061,34 +6151,30 @@ var ReconciliationEngine = class {
 		}
 		const localMap = new Map(localIntegrations.map((i) => [i.id, i]));
 		const desiredMap = new Map(desiredIntegrations.map((d) => [d.integrationId, d]));
-		try {
-			for (const desired of desiredIntegrations) if (desired.desiredStatus === "active") {
-				const local = localMap.get(desired.integrationId);
-				if (desired.connectionAuthorityVersion !== void 0 && local?.connectionAuthorityPendingVersion !== void 0 && local.status === "error" && (local.version === desired.version || desired.version === "" || local.version === "unknown") && !(desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) && await this.manager.isInstallIntact(desired.integrationId)) report.results.push({
+		for (const desired of desiredIntegrations) if (desired.desiredStatus === "active") {
+			const local = localMap.get(desired.integrationId);
+			if (desired.connectionAuthorityVersion !== void 0 && local?.connectionAuthorityPendingVersion !== void 0 && local.status === "error" && (local.version === desired.version || desired.version === "" || local.version === "unknown") && !(desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) && await this.manager.isInstallIntact(desired.integrationId)) report.results.push({
+				integrationId: desired.integrationId,
+				action: "activated",
+				actualStatus: "active"
+			});
+			else await this.reconcileActive(desired, local, report);
+			const result = report.results.find((item) => item.integrationId === desired.integrationId);
+			if (result?.actualStatus === "active" && desired.connectionAuthorityVersion !== void 0 && (local?.connectionAuthorityPendingVersion !== void 0 || desired.connectionAuthorityVersion !== local?.connectionAuthorityVersion)) try {
+				await this.manager.refreshConnections(desired.integrationId, desired.connectionAuthorityVersion, { onBeforeRuntimeMutation: () => this.ensureSuspended() });
+			} catch (err) {
+				captureIntegrationFailure(desired.integrationId, "refresh_connections", err);
+				const error = err instanceof Error ? err.message : String(err);
+				report.errors.push({
 					integrationId: desired.integrationId,
-					action: "activated",
-					actualStatus: "active"
+					error
 				});
-				else await this.reconcileActive(desired, local, report);
-				const result = report.results.find((item) => item.integrationId === desired.integrationId);
-				if (result?.actualStatus === "active" && desired.connectionAuthorityVersion !== void 0 && (local?.connectionAuthorityPendingVersion !== void 0 || desired.connectionAuthorityVersion !== local?.connectionAuthorityVersion)) try {
-					await this.manager.refreshConnections(desired.integrationId, desired.connectionAuthorityVersion, { onBeforeRuntimeMutation: () => this.ensureSuspended() });
-				} catch (err) {
-					captureIntegrationFailure(desired.integrationId, "refresh_connections", err);
-					const error = err instanceof Error ? err.message : String(err);
-					report.errors.push({
-						integrationId: desired.integrationId,
-						error
-					});
-					result.action = "error";
-					result.actualStatus = "error";
-					result.errorMessage = error;
-				}
-			} else await this.reconcileRemoved(desired.integrationId, localMap.get(desired.integrationId), report);
-			for (const local of localIntegrations) if (!desiredMap.has(local.id)) await this.reconcileRemoved(local.id, local, report);
-		} finally {
-			await this.resumeIfSuspended();
-		}
+				result.action = "error";
+				result.actualStatus = "error";
+				result.errorMessage = error;
+			}
+		} else await this.reconcileRemoved(desired.integrationId, localMap.get(desired.integrationId), report);
+		for (const local of localIntegrations) if (!desiredMap.has(local.id)) await this.reconcileRemoved(local.id, local, report);
 		return report;
 	}
 	async reconcileActive(desired, local, report) {
@@ -6096,10 +6182,10 @@ var ReconciliationEngine = class {
 		try {
 			if (!local) {
 				await this.ensureSuspended();
-				log$4.info(`Installing ${id}@${desired.version}`);
+				log$5.info(`Installing ${id}@${desired.version}`);
 				await this.manager.install(id, desired.version, desired.config, desired.customSource);
 				report.installed.push(id);
-				log$4.info(`Activating ${id}`);
+				log$5.info(`Activating ${id}`);
 				if ((await this.manager.activate(id)).configApplied) report.configApplied = true;
 				report.activated.push(id);
 				report.results.push({
@@ -6112,7 +6198,7 @@ var ReconciliationEngine = class {
 			if (local.version !== desired.version && desired.version !== "" && local.version !== "unknown") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$4.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
+					log$5.info(`Reinstalling ${id} on version change (reinstall requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt}): ${local.version} → ${desired.version}`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
@@ -6125,7 +6211,7 @@ var ReconciliationEngine = class {
 					});
 					return;
 				}
-				log$4.info(`Upgrading ${id} in place: ${local.version} → ${desired.version}`);
+				log$5.info(`Upgrading ${id} in place: ${local.version} → ${desired.version}`);
 				try {
 					if ((await this.manager.upgrade(id, desired.version, desired.config, desired.customSource, { onBeforeRuntimeMutation: () => this.ensureSuspended() })).configApplied) report.configApplied = true;
 					this.manager.resetReinstallAttempts(id);
@@ -6139,7 +6225,7 @@ var ReconciliationEngine = class {
 					});
 				} catch (upgradeErr) {
 					const upgradeMsg = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
-					log$4.error({ err: upgradeErr }, `Upgrade failed for ${id}`);
+					log$5.error({ err: upgradeErr }, `Upgrade failed for ${id}`);
 					captureIntegrationFailure(id, "upgrade", upgradeErr);
 					report.errors.push({
 						integrationId: id,
@@ -6157,7 +6243,7 @@ var ReconciliationEngine = class {
 			if (local.status === "error") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$4.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+					log$5.info(`Reinstalling ${id} from error state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
@@ -6173,7 +6259,7 @@ var ReconciliationEngine = class {
 				if (!await this.manager.isInstallIntact(id)) {
 					const attempts = this.manager.getReinstallAttempts(id);
 					if (attempts >= 3) {
-						log$4.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
+						log$5.error(`Auto-reinstall blocked for ${id} — ${String(attempts)} consecutive failures. Manual reinstall required.`);
 						captureIntegrationFailure(id, "reinstall", `Max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`);
 						report.errors.push({
 							integrationId: id,
@@ -6188,7 +6274,7 @@ var ReconciliationEngine = class {
 						return;
 					}
 					await this.ensureSuspended();
-					log$4.info(`Auto-reinstalling ${id} — install directory is corrupted or missing (attempt ${String(attempts + 1)}/3)`);
+					log$5.info(`Auto-reinstalling ${id} — install directory is corrupted or missing (attempt ${String(attempts + 1)}/3)`);
 					this.manager.incrementReinstallAttempts(id);
 					try {
 						if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6203,7 +6289,7 @@ var ReconciliationEngine = class {
 						});
 					} catch (reinstallErr) {
 						const reinstallMsg = reinstallErr instanceof Error ? reinstallErr.message : String(reinstallErr);
-						log$4.error({ err: reinstallErr }, `Auto-reinstall failed for ${id}`);
+						log$5.error({ err: reinstallErr }, `Auto-reinstall failed for ${id}`);
 						captureIntegrationFailure(id, "reinstall", reinstallErr);
 						report.errors.push({
 							integrationId: id,
@@ -6222,7 +6308,7 @@ var ReconciliationEngine = class {
 				if (activateAttempts < MAX_ERROR_ACTIVATE_ATTEMPTS) {
 					this.activateAttempts.set(id, activateAttempts + 1);
 					await this.ensureSuspended();
-					log$4.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
+					log$5.info(`Re-activating ${id} from error state (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)})`);
 					try {
 						if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
 						this.activateAttempts.delete(id);
@@ -6235,7 +6321,7 @@ var ReconciliationEngine = class {
 						return;
 					} catch (reactivateErr) {
 						const reactivateMsg = reactivateErr instanceof Error ? reactivateErr.message : String(reactivateErr);
-						log$4.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
+						log$5.warn(`Re-activation of ${id} from error state failed (attempt ${String(activateAttempts + 1)}/${String(MAX_ERROR_ACTIVATE_ATTEMPTS)}): ${reactivateMsg}`);
 						captureIntegrationFailure(id, "reactivate", reactivateErr);
 						report.errors.push({
 							integrationId: id,
@@ -6250,7 +6336,7 @@ var ReconciliationEngine = class {
 						return;
 					}
 				}
-				log$4.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
+				log$5.warn(`Integration ${id} is in error state — re-activation exhausted, waiting for reinstall request`);
 				captureIntegrationFailure(id, "reactivate", `Integration ${id} stuck in error state — re-activation attempts exhausted`);
 				report.errors.push({
 					integrationId: id,
@@ -6267,7 +6353,7 @@ var ReconciliationEngine = class {
 			if (local.status === "installing") {
 				if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 					await this.ensureSuspended();
-					log$4.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+					log$5.info(`Reinstalling ${id} from stale installing state (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 					this.manager.resetReinstallAttempts(id);
 					this.activateAttempts.delete(id);
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
@@ -6283,7 +6369,7 @@ var ReconciliationEngine = class {
 				const attempts = this.manager.getReinstallAttempts(id);
 				if (attempts >= 3) {
 					const errorMessage = `Stale installing state — max auto-reinstall attempts (${String(attempts)}) reached — manual reinstall required`;
-					log$4.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
+					log$5.error(`Auto-reinstall blocked for ${id} — stuck in "installing", ${String(attempts)} consecutive failures. Manual reinstall required.`);
 					captureIntegrationFailure(id, "reinstall", errorMessage);
 					report.errors.push({
 						integrationId: id,
@@ -6298,7 +6384,7 @@ var ReconciliationEngine = class {
 					return;
 				}
 				await this.ensureSuspended();
-				log$4.info(`Recovering ${id} from stale installing state via reinstall (attempt ${String(attempts + 1)}/3)`);
+				log$5.info(`Recovering ${id} from stale installing state via reinstall (attempt ${String(attempts + 1)}/3)`);
 				this.manager.incrementReinstallAttempts(id);
 				try {
 					if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource)).configApplied) report.configApplied = true;
@@ -6313,7 +6399,7 @@ var ReconciliationEngine = class {
 					});
 				} catch (reinstallErr) {
 					const reinstallMsg = reinstallErr instanceof Error ? reinstallErr.message : String(reinstallErr);
-					log$4.error({ err: reinstallErr }, `Reinstall from stale installing state failed for ${id}`);
+					log$5.error({ err: reinstallErr }, `Reinstall from stale installing state failed for ${id}`);
 					captureIntegrationFailure(id, "reinstall", reinstallErr);
 					report.errors.push({
 						integrationId: id,
@@ -6330,7 +6416,7 @@ var ReconciliationEngine = class {
 			}
 			if (local.status !== "active") {
 				await this.ensureSuspended();
-				log$4.info(`Activating ${id}`);
+				log$5.info(`Activating ${id}`);
 				if ((await this.manager.activate(id, { forcePlugins: true })).configApplied) report.configApplied = true;
 				report.activated.push(id);
 				report.results.push({
@@ -6342,7 +6428,7 @@ var ReconciliationEngine = class {
 			}
 			if (desired.reinstallRequestedAt && local.installedAt && desired.reinstallRequestedAt > local.installedAt) {
 				await this.ensureSuspended();
-				log$4.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
+				log$5.info(`Reinstall requested for ${id} (requested: ${desired.reinstallRequestedAt}, installed: ${local.installedAt})`);
 				this.manager.resetReinstallAttempts(id);
 				this.activateAttempts.delete(id);
 				if ((await this.manager.reinstall(id, desired.version, desired.config, desired.customSource, { reinstallRequestedAt: desired.reinstallRequestedAt })).configApplied) report.configApplied = true;
@@ -6363,7 +6449,7 @@ var ReconciliationEngine = class {
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			log$4.error({ err }, `Error reconciling ${id}`);
+			log$5.error({ err }, `Error reconciling ${id}`);
 			captureIntegrationFailure(id, "reconcile_active", err);
 			report.errors.push({
 				integrationId: id,
@@ -6388,7 +6474,7 @@ var ReconciliationEngine = class {
 		}
 		try {
 			await this.ensureSuspended();
-			log$4.info(`Removing ${id}`);
+			log$5.info(`Removing ${id}`);
 			if (local.status === "active") {
 				await this.manager.deactivate(id);
 				report.deactivated.push(id);
@@ -6402,7 +6488,7 @@ var ReconciliationEngine = class {
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			log$4.error({ err }, `Error removing ${id}`);
+			log$5.error({ err }, `Error removing ${id}`);
 			captureIntegrationFailure(id, "reconcile_removed", err);
 			report.errors.push({
 				integrationId: id,
@@ -6440,6 +6526,7 @@ var CloudClient = class {
 	onConnectionChange = null;
 	onRuntimeRestartNeeded = null;
 	onReconciliationComplete = null;
+	onReconciliationSettled = null;
 	reconciliationEngine = null;
 	configReconciler = null;
 	reconciling = false;
@@ -6479,6 +6566,16 @@ var CloudClient = class {
 		this.onReconciliationComplete = handler;
 	}
 	/**
+	* Set a callback for when a DESIRED_STATE burst has fully SETTLED: the
+	* received snapshot and every queued one have run (each may have succeeded
+	* or failed) and any runtime suspension held across them was released.
+	* Fires on success AND failure — the daemon's deferred first runtime start
+	* hangs off it, and a failed reconcile must not strand the runtime.
+	*/
+	setOnReconciliationSettled(handler) {
+		this.onReconciliationSettled = handler;
+	}
+	/**
 	* Set the integration manager (and optionally the runtime gate) for
 	* reconciliation. When set, the cloud client handles DESIRED_STATE messages
 	* automatically. The gate is passed to the ReconciliationEngine so mutating
@@ -6725,20 +6822,43 @@ var CloudClient = class {
 			const message = err instanceof Error ? err.message : String(err);
 			logger.error({ err: message }, "Cloud: reconciliation failed");
 		} finally {
-			while (this.pendingDesiredState) {
-				const next = this.pendingDesiredState;
-				this.pendingDesiredState = null;
-				logger.info({ count: next.integrations.length }, "Cloud: processing queued DESIRED_STATE");
+			for (;;) {
+				while (this.pendingDesiredState) {
+					const next = this.pendingDesiredState;
+					this.pendingDesiredState = null;
+					logger.info({ count: next.integrations.length }, "Cloud: processing queued DESIRED_STATE");
+					try {
+						await this.runReconciliation(next);
+					} catch (err) {
+						const message = err instanceof Error ? err.message : String(err);
+						logger.error({ err: message }, "Cloud: queued reconciliation failed");
+					}
+				}
 				try {
-					await this.runReconciliation(next);
+					await this.reconciliationEngine.releaseHeldSuspension();
 				} catch (err) {
 					const message = err instanceof Error ? err.message : String(err);
-					logger.error({ err: message }, "Cloud: queued reconciliation failed");
+					logger.error({ err: message }, "Cloud: failed to resume runtime after queued reconciliation");
 				}
+				if (!this.hasQueuedDesiredState()) break;
 			}
 			this.reconciling = false;
+			try {
+				this.onReconciliationSettled?.();
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				logger.error({ err: message }, "Cloud: reconciliation-settled handler failed");
+			}
 		}
 	}
+	/**
+	* Read through a method so control-flow narrowing from the drain loop above
+	* doesn't treat `pendingDesiredState` as still null across an `await` (a
+	* snapshot can be queued by another message while we're suspended).
+	*/
+	hasQueuedDesiredState() {
+		return this.pendingDesiredState !== null;
+	}
 	async runReconciliation(msg) {
 		if (msg.config && this.configReconciler) try {
 			const configReport = await this.configReconciler.reconcile(msg.config);
@@ -6754,7 +6874,7 @@ var CloudClient = class {
 			logger.error({ err: message }, "Cloud: config reconcile failed");
 		}
 		if (!this.reconciliationEngine) return;
-		const report = await this.reconciliationEngine.reconcile(msg.integrations);
+		const report = await this.reconciliationEngine.reconcile(msg.integrations, { holdSuspension: () => this.hasQueuedDesiredState() });
 		logger.info({
 			installed: report.installed.length,
 			activated: report.activated.length,
@@ -6817,7 +6937,7 @@ var CloudClient = class {
 };
 //#endregion
 //#region src/config-reconciler.ts
-const log$3 = logger.child({ component: "ConfigReconciler" });
+const log$4 = logger.child({ component: "ConfigReconciler" });
 const DEFAULT_VERIFY_RETRIES = 3;
 const DEFAULT_VERIFY_RETRY_DELAY_MS = 750;
 const delay = (ms) => new Promise((resolve) => {
@@ -6839,7 +6959,7 @@ var ConfigReconciler = class {
 	async reconcile(desired) {
 		const applier = this.getApplier();
 		if (!applier?.setConfigRaw) {
-			log$3.debug("No applier with setConfigRaw — skipping config reconcile");
+			log$4.debug("No applier with setConfigRaw — skipping config reconcile");
 			return null;
 		}
 		const setConfigRaw = applier.setConfigRaw.bind(applier);
@@ -6857,13 +6977,13 @@ var ConfigReconciler = class {
 				try {
 					current = await getConfigRaw(key);
 				} catch (err) {
-					log$3.warn({
+					log$4.warn({
 						key,
 						err: err instanceof Error ? err.message : String(err)
 					}, "Config diff read failed — attempting the write");
 				}
 				if (current === want) {
-					log$3.debug({ key }, "Config already at desired value — no-op");
+					log$4.debug({ key }, "Config already at desired value — no-op");
 					continue;
 				}
 			}
@@ -6878,7 +6998,7 @@ var ConfigReconciler = class {
 			if (getConfigRaw) {
 				const outcome = await this.verify(getConfigRaw, key, want);
 				if (outcome === "matched") {
-					log$3.warn({
+					log$4.warn({
 						key,
 						err: msg
 					}, "config set errored but value landed — treating as applied");
@@ -6894,7 +7014,7 @@ var ConfigReconciler = class {
 		if (failures.length > 0) {
 			const joined = failures.join("; ");
 			const reason = joined.length > 480 ? `${joined.slice(0, 480)}… (truncated)` : joined;
-			log$3.warn({
+			log$4.warn({
 				version: desired.version,
 				reason
 			}, "Config reconcile failed");
@@ -6905,13 +7025,13 @@ var ConfigReconciler = class {
 			};
 		}
 		if (inconclusiveKeys.length > 0) {
-			log$3.warn({
+			log$4.warn({
 				version: desired.version,
 				keys: inconclusiveKeys
 			}, "Config reconcile verification was inconclusive — leaving version pending");
 			return null;
 		}
-		log$3.info({
+		log$4.info({
 			version: desired.version,
 			keys: entries.length
 		}, "Config reconcile applied");
@@ -6928,7 +7048,7 @@ var ConfigReconciler = class {
 				if (current === want) return "matched";
 				if (current !== void 0) observedValue = true;
 			} catch (err) {
-				log$3.debug({
+				log$4.debug({
 					key,
 					err: err instanceof Error ? err.message : String(err)
 				}, "Config verify read failed");
@@ -8945,7 +9065,7 @@ function reportAvailableCommands(deps) {
 * arrive — the grace deadline is a backstop, but fail-open-to-idle means the
 * common "nothing to drain" case restarts immediately with no added latency.
 */
-const log$2 = logger.child({ component: "TurnActivity" });
+const log$3 = logger.child({ component: "TurnActivity" });
 /** The IPC method the daemon calls on plugins to ask "is a turn active?". */
 const RUNTIME_ACTIVITY_METHOD = "runtime.activity";
 /**
@@ -8964,17 +9084,122 @@ var IpcTurnActivityProbe = class {
 		try {
 			const responses = await ipc.broadcastRequest(RUNTIME_ACTIVITY_METHOD, {}, this.probeTimeoutMs);
 			for (const [pluginId, res] of responses) if (res.ok && res.payload != null && typeof res.payload === "object" && res.payload.active === true) {
-				log$2.debug({ pluginId }, "Plugin reports an in-flight turn");
+				log$3.debug({ pluginId }, "Plugin reports an in-flight turn");
 				return true;
 			}
 			return false;
 		} catch (err) {
-			log$2.debug({ err: err instanceof Error ? err.message : String(err) }, "Turn-activity probe failed — assuming idle");
+			log$3.debug({ err: err instanceof Error ? err.message : String(err) }, "Turn-activity probe failed — assuming idle");
 			return false;
 		}
 	}
 };
 //#endregion
+//#region src/first-runtime-start.ts
+/**
+* Deferred first runtime start for fresh managed boxes.
+*
+* On a brand-new managed VM the first DESIRED_STATE always installs the core
+* integrations, and every mutating reconcile suspends the runtime through the
+* RuntimeGate. Starting the runtime at daemon boot therefore buys nothing: it
+* boots (and runs its first-boot migrations) only to be stopped ~seconds later
+* by that first reconcile, then started again after it. Deferring the first
+* start until the first reconcile burst settles removes that whole cycle.
+*
+* The deferral is released by whichever comes first:
+*  - the cloud client's "reconciliation settled" hook (success OR failure),
+*  - a fallback timer armed when the cloud client first REGISTERS
+*    ({@link DeferredRuntimeStart.armFallback}), so slow boot/connect time
+*    doesn't eat the window the first DESIRED_STATE needs;
+*  - a longer boot ceiling measured from daemon boot, so a daemon that never
+*    registers (gateway down, registration failing) still brings the runtime up.
+*
+* Only fresh managed boxes defer (managed mode AND no integrations in local
+* state). Self-hosted daemons and restarts of an already-provisioned box start
+* the runtime immediately, exactly as before.
+*/
+const log$2 = logger.child({ component: "FirstRuntimeStart" });
+/** How long a fresh box waits, after first registering with the cloud, for its first reconcile to settle. */
+const FIRST_START_FALLBACK_MS = 18e4;
+/** Hard ceiling from daemon boot, for a daemon that never registers with the cloud. */
+const FIRST_START_BOOT_CEILING_MS = 6e5;
+/**
+* Fresh managed box ⇔ managed mode AND local integration state is readable and
+* empty. An unreadable state is NOT treated as fresh — fall back to the old
+* start-immediately behaviour rather than delay a box we know nothing about.
+*/
+function shouldDeferFirstRuntimeStart(input) {
+	return input.managed && input.installedIntegrationCount === 0;
+}
+var DeferredRuntimeStart = class {
+	released = false;
+	cancelled = false;
+	startFn = null;
+	fallbackArmed = false;
+	fallbackTimer = null;
+	ceilingTimer;
+	/** Arms the boot ceiling immediately; the fallback waits for {@link armFallback}. */
+	constructor(fallbackMs = FIRST_START_FALLBACK_MS, bootCeilingMs = FIRST_START_BOOT_CEILING_MS) {
+		this.fallbackMs = fallbackMs;
+		this.ceilingTimer = setTimeout(() => {
+			this.ceilingTimer = null;
+			this.release("boot-ceiling");
+		}, bootCeilingMs);
+	}
+	/**
+	* Start the fallback clock. Called when the cloud client registers; only
+	* the FIRST call arms it (a reconnect must not push the deadline out).
+	*/
+	armFallback() {
+		if (this.released || this.cancelled || this.fallbackArmed) return;
+		this.fallbackArmed = true;
+		this.fallbackTimer = setTimeout(() => {
+			this.fallbackTimer = null;
+			this.release("fallback-timeout");
+		}, this.fallbackMs);
+	}
+	/** True once released (by either path). */
+	get isReleased() {
+		return this.released;
+	}
+	/**
+	* Provide the start action once the runtime process exists. If the deferral
+	* was already released (a reconcile settled before the runtime object was
+	* built), starts right away.
+	*/
+	attach(start) {
+		if (this.cancelled) return;
+		this.startFn = start;
+		if (this.released) start();
+	}
+	/** Release the deferral. Idempotent — only the first call starts the runtime. */
+	release(reason) {
+		if (this.released || this.cancelled) return;
+		this.released = true;
+		this.clearTimers();
+		log$2.info({
+			reason,
+			fallbackMs: this.fallbackMs
+		}, "Releasing deferred first runtime start");
+		this.startFn?.();
+	}
+	/** Daemon shutdown: never start the runtime after this. */
+	cancel() {
+		this.cancelled = true;
+		this.clearTimers();
+	}
+	clearTimers() {
+		if (this.fallbackTimer) {
+			clearTimeout(this.fallbackTimer);
+			this.fallbackTimer = null;
+		}
+		if (this.ceilingTimer) {
+			clearTimeout(this.ceilingTimer);
+			this.ceilingTimer = null;
+		}
+	}
+};
+//#endregion
 //#region src/command-registry.ts
 /**
 * Command Registry — maps integration command names to local handler files.
@@ -9656,6 +9881,8 @@ let stopPairingApprovalPoller = null;
 let runtimeAppliersRef = null;
 let openclawCliLockRef = null;
 let runtimeGateRef = null;
+/** Pending deferred first runtime start (fresh managed box only). */
+let firstRuntimeStart = null;
 const LEGACY_CONFIG_SET_KEYS = new Set(["agents.defaults.model"]);
 const MAX_LEGACY_CONFIG_VALUE_LENGTH = 16 * 1024;
 async function startDaemon() {
@@ -9744,6 +9971,7 @@ async function startDaemon() {
 	cloudClient.setConnectionChangeHandler((connected) => {
 		cloudConnected = connected;
 		logger.info({ connected }, "Cloud connection state changed");
+		if (connected) firstRuntimeStart?.armFallback();
 		ipcServer?.broadcastEvent("cloud.status", { connected });
 	});
 	const openclawCliLock = new SerialOpenClawCliLock();
@@ -9874,6 +10102,27 @@ async function startDaemon() {
 			cloudClient
 		});
 	});
+	if (config.autoStartRuntime && config.runtime) {
+		let installedIntegrationCount;
+		try {
+			installedIntegrationCount = integrationManager.list().length;
+		} catch (err) {
+			logger.warn({ err: err instanceof Error ? err.message : String(err) }, "Could not read local integration state — starting runtime immediately");
+			installedIntegrationCount = null;
+		}
+		if (shouldDeferFirstRuntimeStart({
+			managed,
+			installedIntegrationCount
+		})) {
+			logger.info("Fresh managed box — deferring first runtime start until the first reconcile settles");
+			const deferral = new DeferredRuntimeStart();
+			firstRuntimeStart = deferral;
+			runtimeGate.deferFirstStart();
+			cloudClient.setOnReconciliationSettled(() => {
+				deferral.release("reconcile-settled");
+			});
+		}
+	}
 	cloudClient.start();
 	logger.debug("Cloud client started");
 	if (!config.autoStartRuntime && config.runtime) logger.warn({ runtime: config.runtime }, "Runtime configured but auto_start_runtime=false — runtime will not be spawned; in-runtime plugins (chat/console/sync) will be offline until you start it manually");
@@ -9892,8 +10141,15 @@ async function startDaemon() {
 				env: config.runtime === "claude-code" && config.defaultModel ? { ALFE_DEFAULT_MODEL: config.defaultModel } : {}
 			});
 			runtimeProcess.setTurnActivityProbe(turnActivityProbe);
-			runtimeProcess.start();
-			logger.debug("Runtime process started");
+			if (firstRuntimeStart) {
+				firstRuntimeStart.attach(() => {
+					runtimeGate.requestStart();
+				});
+				logger.debug("Runtime process created — first start deferred");
+			} else {
+				runtimeGate.requestStart();
+				logger.debug("Runtime process started");
+			}
 			if (config.runtime === "openclaw") {
 				stopPairingApprovalPoller = startPairingApprovalPoller({
 					log: logger,
@@ -9913,9 +10169,10 @@ async function startDaemon() {
 			stopPairingApprovalPoller();
 			stopPairingApprovalPoller = null;
 		}
+		firstRuntimeStart?.cancel();
 		if (runtimeProcess) {
 			logger.debug("Stopping runtime process...");
-			await runtimeProcess.stop();
+			await runtimeProcess.shutdown();
 			logger.debug("Runtime process stopped");
 		}
 		if (hermesMcpSync) {

package/dist/runtime-process.js

@@ -15413,6 +15413,14 @@ const BACKOFF_INITIAL_MS = 1e3;
 const BACKOFF_MAX_MS = 3e4;
 const STABLE_UPTIME_MS = 6e4;
 /**
+* Output markers (lower-cased substrings) that distinguish the planned exit-78
+* from any other EX_CONFIG. 2026.9.5 raises the same startup race two ways:
+* "OpenClaw migration inputs changed during startup", and
+* `throwStartupMigrationGuardRejected`'s "OpenClaw startup migrations were
+* skipped because the selected config changed during startup… Retry startup".
+*/
+const MIGRATION_RESTART_MARKERS = ["migration inputs changed during startup", "selected config changed during startup"];
+/**
 * Alfe owns supervision and version rollout; OpenClaw must not self-manage.
 *
 * `OPENCLAW_NODE_UPDATE_RESPAWNED=1` also disables 2026.9.x's node-runtime
@@ -15446,6 +15454,17 @@ var RuntimeProcess = class {
 	backoffMs = BACKOFF_INITIAL_MS;
 	lastStartTime = 0;
 	restartTimer = null;
+	/** Whether the CURRENT run printed one of {@link MIGRATION_RESTART_MARKERS}. Reset on every spawn. */
+	sawMigrationInputsChanged = false;
+	/** Consecutive exit-78 migration restarts treated as planned (see {@link MAX_CONSECUTIVE_MIGRATION_RESTARTS}). */
+	consecutiveMigrationRestarts = 0;
+	/**
+	* Daemon shutdown latch. Once set, `start()` / `resume()` / `restart()` are
+	* permanent no-ops: an in-flight reconcile's final gate resume (or a held
+	* suspension released by the drain loop) must not respawn the runtime after
+	* shutdown stopped it.
+	*/
+	shutdownLatched = false;
 	ringBuffer = new OutputRingBuffer();
 	detector = new ErrorLineDetector();
 	throttle = new CaptureThrottle(STABLE_UPTIME_MS);
@@ -15492,9 +15511,10 @@ var RuntimeProcess = class {
 	* Start the runtime process.
 	*/
 	start() {
-		if (this.stopped || this.child !== null) return;
+		if (this.stopped || this.shutdownLatched || this.child !== null) return;
 		const { command, args } = this.resolveCommand();
 		this.lastStartTime = Date.now();
+		this.sawMigrationInputsChanged = false;
 		log.info({
 			runtime: this.options.runtime,
 			command,
@@ -15555,8 +15575,18 @@ var RuntimeProcess = class {
 				}, "Runtime stopped (expected)");
 				return;
 			}
-			if (!spawnError && code === 0 && signal == null) {
-				log.info({
+			const uptime = Date.now() - this.lastStartTime;
+			if (uptime >= 6e4) this.consecutiveMigrationRestarts = 0;
+			const isGraceful = !spawnError && code === 0 && signal == null;
+			const isPlannedMigrationRestart = !spawnError && signal == null && code === 78 && this.sawMigrationInputsChanged && this.consecutiveMigrationRestarts < 1;
+			if (isGraceful || isPlannedMigrationRestart) {
+				if (isPlannedMigrationRestart) {
+					this.consecutiveMigrationRestarts += 1;
+					log.info({
+						runtime: this.options.runtime,
+						code
+					}, "Runtime asked for a restart after its startup migration inputs changed — restarting (planned, not a crash)");
+				} else log.info({
 					runtime: this.options.runtime,
 					code
 				}, "Runtime exited gracefully — restarting");
@@ -15573,7 +15603,6 @@ var RuntimeProcess = class {
 				spawnError: spawnError?.message,
 				backoffMs: this.backoffMs
 			}, "Runtime crashed — scheduling restart with backoff");
-			const uptime = Date.now() - this.lastStartTime;
 			if (this.detectorFlushTimer) {
 				clearTimeout(this.detectorFlushTimer);
 				this.detectorFlushTimer = null;
@@ -15619,6 +15648,10 @@ var RuntimeProcess = class {
 				stream,
 				line
 			});
+			if (!this.sawMigrationInputsChanged) {
+				const lower = line.toLowerCase();
+				if (MIGRATION_RESTART_MARKERS.some((marker) => lower.includes(marker))) this.sawMigrationInputsChanged = true;
+			}
 			for (const block of this.detector.feed(stream, line)) this.emitErrorBlock(block);
 			if (this.detectorFlushTimer) {
 				clearTimeout(this.detectorFlushTimer);
@@ -15690,6 +15723,14 @@ var RuntimeProcess = class {
 		});
 	}
 	/**
+	* Final stop for daemon shutdown: latches so nothing can start the runtime
+	* again (see {@link shutdownLatched}), then stops it.
+	*/
+	async shutdown() {
+		this.shutdownLatched = true;
+		await this.stop();
+	}
+	/**
 	* Stop the runtime, but first wait for any in-flight chat turn to finish
 	* (up to a grace deadline). This is the entry point for NON-crash restarts —
 	* a mid-turn SIGTERM turns a healthy reply into an "unknown error" for the
@@ -15744,8 +15785,10 @@ var RuntimeProcess = class {
 	* the runtime back after a mutating reconcile branch has finished.
 	*/
 	resume() {
+		if (this.shutdownLatched) return;
 		this.stopped = false;
 		this.backoffMs = BACKOFF_INITIAL_MS;
+		this.consecutiveMigrationRestarts = 0;
 		this.start();
 	}
 	/**
@@ -15766,6 +15809,7 @@ var RuntimeProcess = class {
 		else await this.stop();
 		this.stopped = false;
 		this.backoffMs = BACKOFF_INITIAL_MS;
+		this.consecutiveMigrationRestarts = 0;
 		this.start();
 	}
 	/**
@@ -15774,6 +15818,18 @@ var RuntimeProcess = class {
 	get isRunning() {
 		return this.child !== null && !this.child.killed;
 	}
+	/**
+	* Whether the runtime is live OR about to be: a child exists, or a restart
+	* timer (crash backoff / graceful / migration restart) is pending and will
+	* spawn one. This — not {@link isRunning} — is what the RuntimeGate must
+	* check before a mutation: during the restart window the child is null but
+	* the pending timer would fire `start()` mid-mutation, putting a second
+	* SQLite writer on ~/.openclaw/state. `stop()` cancels the timer, and the
+	* gate's `resume()` brings the runtime back.
+	*/
+	get isActive() {
+		return !this.stopped && (this.child !== null || this.restartTimer !== null);
+	}
 };
 //#endregion
 export { ErrorLineDetector as a, createLogger as c, PINNED_OPENCLAW_VERSION as d, parseOpenClawVersion as f, __require as h, CaptureThrottle as i, OPENCLAW_MANAGED_NODE_MAJOR as l, __commonJSMin as m, OPENCLAW_EXTERNAL_SUPERVISOR_ENV as n, STRICT_ERROR_CAPTURE_PROFILE as o, supportsOpenClawNode as p, RuntimeProcess as r, toFingerprintKey as s, DRAIN_GRACE_MS as t, OPENCLAW_NODE_REQUIREMENT as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/gateway",
-  "version": "0.10.5",
+  "version": "0.10.6",
   "description": "Alfe local gateway daemon — persistent control plane for agent integrations",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "@alfe.ai/ai-proxy-local": "^0.0.17",
     "@alfe.ai/config": "^0.4.1",
     "@alfe.ai/integration-manifest": "^0.4.2",
-    "@alfe.ai/integrations": "^0.6.11",
+    "@alfe.ai/integrations": "^0.6.12",
     "@alfe.ai/mcp-bundler": "^0.4.2"
   },
   "license": "UNLICENSED",