@senpi/runtime 3.0.118 → 3.0.122

package/dist/index.js

@@ -16,10 +16,11 @@ import { parse as parseYaml } from "yaml";
 import { join, dirname } from "node:path";
 import { SenpiClient } from "./senpi/client.js";
 import { buildWalletStatusHint } from "./senpi/strategy-status.js";
+import { bootSkippedStatusLabel, partitionByWalletStatus, readBootWalletStatuses, trackableWalletKeys, } from "./runtime/boot-skip.js";
 import { DeployJobController } from "./deploy/job.js";
 import { registerDeployGatewayMethods } from "./deploy/register.js";
 import { registerUpdateGatewayMethod } from "./runtime/update-register.js";
-import { checkProofCoversRecipe, makeApplyToRuntime, makeWriteRegistry, } from "./runtime/update-apply-deps.js";
+import { checkProofCoversRecipe, makeApplyToRuntime, makeWriteRegistry, runtimeChangeLock, } from "./runtime/update-apply-deps.js";
 import { INSTALL_DEADLINE_MS, WALLET_INSTALL_IN_FLIGHT_CODE } from "./deploy/deadlines.js";
 import { AuditQueryError } from "./runtime/audit-query.types.js";
 import { buildRuntimeStateDir, archiveStateDir } from "./runtime/state-layout.js";
@@ -52,7 +53,8 @@ import { registerToolApprovalGate, resolveToolApprovalsMode, } from "./approvals
 import { registerShowWidgetTool } from "./widgets/index.js";
 import { EVENT_NAME, SENPI_ERROR_CODE, eventAttrs, scannerUnwiredErrorCode } from "./utils/event-catalog.js";
 import { emitEvent } from "./actions/event-derivation.js";
-import { buildRuntimeCreatedEvent, buildRuntimeDeletedEvent, buildRuntimeUpdatedEvent } from "./runtime/lifecycle-events.js";
+import { createLifecycleReaper, resolveReaperBootDelayMs, resolveReaperEnforcement, } from "./runtime/lifecycle-reaper.js";
+import { buildRuntimeBootSkippedEvent, buildRuntimeBootStatusUnreadEvent, buildRuntimeCreatedEvent, buildRuntimeDeletedEvent, buildRuntimeUpdatedEvent, } from "./runtime/lifecycle-events.js";
 import { isWalletAddress } from "./utils/wallet-address.js";
 import { fileURLToPath } from "node:url";
 import { loadApiConfig } from "./runtime-api/config.js";
@@ -62,11 +64,7 @@ import { createIntakeContext } from "./runtime-api/intake/intake-context.js";
 import { wireRuntime, intakeUrlFor, selectScanners } from "./runtime-api/intake/intake-mount.js";
 import { ingestDispatchMutex, ingestDispatchKey } from "./runtime-api/intake/ingest-mutex.js";
 import { buildScaffoldErrorRouter } from "./runtime-api/intake/scaffold-error-router.js";
-import { buildScaffoldTickRouter } from "./runtime-api/intake/scaffold-tick-router.js";
-import { toIngestRequest } from "./runtime-api/intake/ingest-request.js";
 import { loadRuntimeConfig } from "./runtime/load-runtime-config.js";
-import { createLiveTelemetry } from "./telemetry/live-telemetry.js";
-import { resolveTickTelemetry } from "./telemetry/tick-frame.js";
 /** Initialize all core features (DSL, risk, health) on the given event bus. */
 export function initCore(bus) {
     initDsl(bus);
@@ -225,16 +223,6 @@ const senpiRuntimePlugin = {
                 ? "env SENPI_LOG_LEVEL"
                 : "default";
         pluginLogger.info(`[senpi-runtime] log level: ${startupLogLevel} (source: ${logLevelSourceLabel}). Set plugin config "logLevel" or env SENPI_LOG_LEVEL to debug|info|warn|error to override.`);
-        // Same shape as the log-level line above, and for the same reason: a box publishing less than
-        // an operator expects must say so at boot rather than be diagnosed from an empty screen. No env
-        // var is named because there is none — see `tickTelemetry` on SenpiRuntimePluginConfig.
-        const tickTelemetry = resolveTickTelemetry(config.tickTelemetry);
-        if (tickTelemetry.invalid !== undefined) {
-            pluginLogger.warn(`[senpi-runtime] Ignoring invalid plugin config ${tickTelemetry.invalid} (expected off|summary|verbose); keeping mcp=${tickTelemetry.settings.mcp} state=${tickTelemetry.settings.state}.`);
-        }
-        pluginLogger.info(tickTelemetry.settings.enabled
-            ? `[senpi-runtime] tick telemetry: mcp=${tickTelemetry.settings.mcp} state=${tickTelemetry.settings.state} (source: ${config.tickTelemetry === undefined ? "default" : "plugin config tickTelemetry"}). Set plugin config "tickTelemetry" to off|summary|verbose, or {mcp,state}, to override.`
-            : `[senpi-runtime] tick telemetry: off (source: plugin config tickTelemetry). No per-tick frame is published.`);
         const senpiCliStore = readSenpiCliStore();
         const baseStateDir = resolveSenpiBaseStateDir({
             store: senpiCliStore,
@@ -367,13 +355,16 @@ const senpiRuntimePlugin = {
         }
         let routeAcceptedSignalToRuntime;
         let routeScaffoldErrorToRuntime;
-        let routeScaffoldTickToTelemetry;
         const launchers = new Map();
         // Runtimes that are UP but whose external scanners never wired (mount/launch/install
         // failure), keyed runtimeId → failed phase. Populated at the four unwired sites,
         // cleared on a successful wire/install. senpi.listRuntimes reads it to render
         // "running — NO ENTRY SCANNERS" instead of a bare "running" for a blind runtime.
         const unwiredRuntimes = new Map();
+        // Registered runtimes boot left down because the platform reports their strategy wallet dead,
+        // keyed runtimeId → that status. senpi.listRuntimes reads it so the row says why it is stopped;
+        // cleared when the row is deleted.
+        const bootSkippedRuntimes = new Map();
         /**
          * Wallets with an install IN FLIGHT in this process, keyed by lowercased address.
          *
@@ -391,149 +382,10 @@ const senpiRuntimePlugin = {
          * engines, one margin account: the exact state `[E_WALLET_HAS_RUNTIME]` exists to prevent.
          */
         const installsInFlight = new Map();
-        // ── Live telemetry ────────────────────────────────────────────────
-        // Every runtime this box knows about, running or not, keyed runtimeId. The topology payload has
-        // to name a stopped strategy too, so this is populated from the registry rather than from
-        // `runtimeHandles` (which holds only the live ones) and is the source of the two facts the
-        // registry entry does not carry: the strategy's display name and its declared scanners. Both come
-        // from the parsed YAML — `name` is the same `config.name` that `RuntimeHealthStatus.runtimeName`
-        // is built from, so a runtime whose config never parsed falls back to its id rather than to a
-        // guess, and its scanner list stays empty rather than inventing rows.
-        const telemetryStrategies = new Map();
-        const noteTelemetryRuntime = (runtimeId, address) => {
-            const existing = telemetryStrategies.get(runtimeId);
-            telemetryStrategies.set(runtimeId, {
-                address,
-                name: existing?.name ?? runtimeId,
-                scanners: existing?.scanners ?? [],
-            });
-        };
-        const noteTelemetryRuntimeConfig = (runtimeId, config) => {
-            telemetryStrategies.set(runtimeId, {
-                address: config.strategy?.wallet ?? telemetryStrategies.get(runtimeId)?.address ?? "",
-                name: config.name,
-                scanners: config.scanners ?? [],
-            });
-        };
         // Dedicated logger for the runtime-api subtree — required because the
         // PluginLogger surface (info/warn/error) lacks `debug`, while the
         // Logger contract used by `runtime-api/` includes it.
         const apiLogger = createLogger("[senpi-core][api]");
-        /**
-         * One gather per publish tick. Health and system state are read together because the two payloads
-         * need both: the topology reads health and `runtimeName`, the stats read the per-scanner rows,
-         * and `restartCount` / `degradedReason` live only on the health rows while every other scanner
-         * field lives only on the system-state rows — so they are joined here on `(runtimeId, scannerId)`.
-         */
-        const collectTelemetryFacts = async () => {
-            const [statuses, states] = await Promise.all([
-                collectRuntimeHealthStatuses(runtimeHandles, api.logger),
-                collectRuntimeSystemStates(runtimeHandles, api.logger, baseStateDir),
-            ]);
-            const healthByRuntime = new Map();
-            for (const status of statuses) {
-                if (status.runtimeId !== undefined)
-                    healthByRuntime.set(status.runtimeId, status);
-            }
-            const scannerState = [];
-            // Registration facts per (runtimeId, scannerId), so the topology can report a scanner's live
-            // schedule rather than only what its YAML declared.
-            const registrations = new Map();
-            for (const state of states) {
-                const runtimeId = state.runtimeId;
-                const healthRows = runtimeId === undefined
-                    ? []
-                    : healthByRuntime.get(runtimeId)?.components.scanners.scanners ?? [];
-                for (const row of state.components.scanners.state.scanners) {
-                    const supervision = healthRows.find((r) => r.scannerId === row.scannerId);
-                    const snapshot = {
-                        address: row.address,
-                        scannerId: row.scannerId,
-                        health: row.health,
-                        degradedReason: supervision?.degradedReason ?? null,
-                        enabled: row.enabled,
-                        inFlightSince: row.inFlightSince,
-                        lastRunStartedAt: row.lastRunStartedAt,
-                        lastRunFinishedAt: row.lastRunFinishedAt,
-                        lastRunStatus: row.lastRunStatus,
-                        lastRunReason: row.lastRunReason,
-                        nextRunAt: row.nextRunAt,
-                        lastAliveAt: row.lastAliveAt,
-                        // No supervision row means the restart count is unknown, not zero. A zero here would
-                        // read as "this scanner has never restarted" on a scanner nobody is supervising.
-                        restartCount: supervision?.restartCount ?? null,
-                    };
-                    scannerState.push(snapshot);
-                    if (runtimeId !== undefined) {
-                        registrations.set(`${runtimeId}::${row.scannerId}`, {
-                            ...snapshot,
-                            scheduleMode: row.scheduleMode,
-                            configVersion: row.configVersion,
-                            intervalSeconds: row.intervalSeconds,
-                        });
-                    }
-                }
-            }
-            const strategies = [];
-            for (const [runtimeId, entry] of telemetryStrategies) {
-                const health = healthByRuntime.get(runtimeId);
-                const scanners = entry.scanners.map((declared) => {
-                    const live = registrations.get(`${runtimeId}::${declared.name}`);
-                    return live === undefined
-                        ? { entry: declared }
-                        : {
-                            entry: declared,
-                            registration: {
-                                enabled: live.enabled,
-                                scheduleMode: live.scheduleMode,
-                                // The engine's own cadence, which is what the scanner actually polls on — a
-                                // recipe may omit it and take the scanner definition's default. An external
-                                // scanner registers zero because it is POSTed to rather than polled, and only
-                                // the recipe knows the cadence its scaffold was told to tick at.
-                                intervalSeconds: live.intervalSeconds > 0 ? live.intervalSeconds : declared.interval_seconds ?? null,
-                                configVersion: live.configVersion,
-                            },
-                        };
-                });
-                strategies.push({
-                    runtimeId,
-                    address: entry.address,
-                    // `runtimeName` is built from the same `config.name`; the indexed value is used because it
-                    // is available for a stopped runtime too, where there is no health status to read.
-                    name: health?.runtimeName ?? entry.name,
-                    scanners,
-                });
-            }
-            return {
-                strategies,
-                runningRuntimeIds: runtimeHandles,
-                unwiredRuntimeIds: unwiredRuntimes,
-                readHealth: (runtimeId) => healthByRuntime.get(runtimeId),
-                scannerState,
-            };
-        };
-        const liveTelemetry = createLiveTelemetry({
-            collectFacts: collectTelemetryFacts,
-            tickTelemetry: config.tickTelemetry,
-        });
-        /**
-         * Wrapped gateway methods capture the broadcast handle on the FIRST request to ANY of them —
-         * not only on subscribe. `ctx.context` is the only route to the websocket push layer and it
-         * exists only inside a handler, so capturing it in the subscribe method alone would mean a box
-         * whose client never subscribes can never publish anything, silently.
-         *
-         * The wrapper covers only what is registered through it. `senpi.deploy.start`,
-         * `senpi.deploy.status` and `senpi.update` are registered straight onto the plugin api by their
-         * own registrars and never arm the handle. That is not a gap in practice: one wrapped call arms
-         * it for the life of the process, and the websocket client admits `senpi.telemetry.subscribe`,
-         * which is wrapped.
-         */
-        const registerGatewayMethod = (name, handler, opts) => {
-            api.registerGatewayMethod(name, (ctx) => {
-                liveTelemetry.captureBroadcast(ctx, name);
-                return handler(ctx);
-            }, opts);
-        };
         // A gateway seam failed to wire/launch a runtime's external scanner stack: the runtime is up but
         // runs blind on internal scanners only. Two records, by design: a first-class `runtime.scanners_unwired`
         // event (the queryable/alertable fact, by phase) and the migrated exception-form `logger.error`
@@ -638,6 +490,39 @@ const senpiRuntimePlugin = {
             now: () => Date.now(),
             log: (line) => api.logger.info(`[senpi-runtime] ${line}`),
         });
+        // ── lifecycle reaper ─────────────────────────────────────────────────────────────────────────
+        // A runtime exists iff its strategy is open. Every close path ends at the backend and none of
+        // them tells this box, so the reaper asks: once after boot, hourly, and whenever the backend
+        // rejects an order with STRATEGY_NOT_ACTIVE. Observe-only unless enforcement is on (see
+        // runtime/lifecycle-reaper.ts for the safety rule). Constructed here so both `run()` call sites
+        // (boot and install) can hand it their not-active rejections; it does no I/O until started.
+        const reaperBootDelayOverride = resolveReaperBootDelayMs(process.env);
+        const reaper = createLifecycleReaper({
+            readRegistry: async () => {
+                const { readRegistry } = await import("./runtime/strategy-registry.js");
+                return readRegistry(baseStateDir);
+            },
+            readStatuses: async (wallets, signal) => {
+                const client = mcpTransport ? new SenpiClient(mcpTransport) : new SenpiClient({ apiKey });
+                if (!mcpTransport)
+                    await client.connect();
+                try {
+                    return await client.listStrategies({ strategyAddresses: wallets }, { signal });
+                }
+                finally {
+                    if (!mcpTransport)
+                        await client.disconnect().catch(() => { });
+                }
+            },
+            deleteRuntime: async (id, reason, wallet) => {
+                const result = await deleteRuntimeCore({ id, deleteReason: reason, expectWallet: wallet });
+                return result.ok ? { ok: true } : { ok: false, code: result.error.code, message: result.error.message };
+            },
+            emit: (build) => emitEvent(apiLogger, build),
+            enforce: resolveReaperEnforcement(process.env),
+            logger: pluginLogger,
+            ...(reaperBootDelayOverride !== undefined ? { bootDelayMs: reaperBootDelayOverride } : {}),
+        });
         api.registerService({
             id: "senpi-runtime",
             async start() {
@@ -674,14 +559,26 @@ const senpiRuntimePlugin = {
                 // /signals will not be mounted and no signals will be routed.
                 if (sharedIntakeContext) {
                     const ctx = sharedIntakeContext;
-                    routeAcceptedSignalToRuntime = (signal, correlationId, scannerId) => {
+                    routeAcceptedSignalToRuntime = (signal, _correlationId, scannerId) => {
                         const resolved = ctx.registry.resolve(scannerId);
                         if (!resolved)
                             return;
                         const h = runtimeHandles.get(resolved.runtimeId);
                         if (!h)
                             return;
-                        const request = toIngestRequest(signal, correlationId, resolved.scannerName);
+                        const request = {
+                            scanner: resolved.scannerName,
+                            signal_id: signal.signal_id, // greppable handle across intake→ingest (obs only)
+                            asset: signal.asset,
+                            direction: signal.direction,
+                            ...(signal.signal_type !== undefined && { signal_type: signal.signal_type }),
+                            data: signal.data,
+                            // Per-signal sizing rides at the top level; the open-position action
+                            // reads request.marginPct / request.leverage directly. Without this a
+                            // supervised signal's sizing is lost ("no margin source resolved").
+                            ...(signal.marginPct !== undefined && { marginPct: signal.marginPct }),
+                            ...(signal.leverage !== undefined && { leverage: signal.leverage }),
+                        };
                         // Trace the sizing-relevant fields the narrowed request carries, so a
                         // field dropped at this seam is visible instead of vanishing silently.
                         apiLogger.debug(`[intake] ingest req signal_id=${signal.signal_id} scanner=${resolved.scannerName} asset=${signal.asset} direction=${signal.direction} marginPct=${signal.marginPct} leverage=${signal.leverage}`);
@@ -701,22 +598,58 @@ const senpiRuntimePlugin = {
                     // The single server-level onError closure — the `/errors` counterpart of
                     // routeAcceptedSignalToRuntime. It records a scaffold-reported tick failure into
                     // the owning runtime's scanner telemetry so a scanner that fails every tick stops
-                    // rendering "healthy". Filter: only tick-level failure types count — a
-                    // `candidate_rejected` body is a per-candidate reject on an otherwise-OK tick, not
-                    // a failed run.
+                    // rendering "healthy".
                     //
-                    // This is the SHARED implementation (scaffold-error-router.ts), so this route and
-                    // buildIntakeMount's onScaffoldError apply one filter, and scaffold-error-router.test.ts
-                    // drives THIS closure.
+                    // This is the SHARED implementation (scaffold-error-router.ts), not a copy of
+                    // buildIntakeMount's onScaffoldError. It used to be a copy, and the copy had its
+                    // own hardcoded three-type filter: when `mcp_error` was added to the tick-failure
+                    // list it reached the tested seam and never reached this route, so the
+                    // wedged-scanner signal was green in CI and inert in production. There is now one
+                    // filter, and scaffold-error-router.test.ts drives THIS closure.
                     routeScaffoldErrorToRuntime = buildScaffoldErrorRouter(ctx, runtimeHandles);
-                    // The per-tick level for a supervised external scanner. Both intake routes call it, so a
-                    // quiet tick and a failed tick are equally visible; it needs no runtime handle because it
-                    // publishes a level rather than recording a run.
-                    routeScaffoldTickToTelemetry = buildScaffoldTickRouter(ctx);
+                }
+                // One bounded read: which registered wallets the platform says are dead, so a restart does
+                // not re-scaffold runtimes on closed wallets (fail-open — see runtime/boot-skip.ts).
+                let walletStatuses = null;
+                // Lower-cased and trackable-only: the backend matches addresses case-sensitively against
+                // lower-case storage, and rejects the whole batch on one malformed address.
+                const registeredWallets = trackableWalletKeys(registry.runtimes);
+                if (registeredWallets.length > 0) {
+                    const read = await readBootWalletStatuses(registeredWallets, async (wallets, signal) => {
+                        const client = mcpTransport ? new SenpiClient(mcpTransport) : new SenpiClient({ apiKey });
+                        if (!mcpTransport)
+                            await client.connect();
+                        try {
+                            return await client.listStrategies({ strategyAddresses: wallets }, { signal });
+                        }
+                        finally {
+                            if (!mcpTransport)
+                                await client.disconnect().catch(() => { });
+                        }
+                    });
+                    if (read.ok) {
+                        walletStatuses = read.statuses;
+                        reaper.recordStatuses(registeredWallets, read.statuses);
+                    }
+                    else {
+                        pluginLogger.warn("[senpi-runtime] Could not read strategy statuses at boot; booting every registered runtime", { reason: read.reason, err: read.message });
+                        emitEvent(apiLogger, () => buildRuntimeBootStatusUnreadEvent({ reason: read.reason, registeredCount: registeredWallets.length }));
+                    }
+                }
+                const { boot: entriesToBoot, skipped } = partitionByWalletStatus(registry.runtimes, walletStatuses);
+                bootSkippedRuntimes.clear();
+                for (const { entry, status } of skipped) {
+                    bootSkippedRuntimes.set(entry.id, status);
+                    pluginLogger.info("[senpi-runtime] Not booting runtime: its strategy wallet is closed", {
+                        runtimeId: entry.id,
+                        wallet: entry.wallet,
+                        status,
+                    });
+                    emitEvent(apiLogger, () => buildRuntimeBootSkippedEvent({ runtimeId: entry.id, address: entry.wallet ?? "", status }));
                 }
                 const started = [];
                 try {
-                    for (const entry of registry.runtimes) {
+                    for (const entry of entriesToBoot) {
                         const hasPath = typeof entry.runtimeYamlPath === "string" && entry.runtimeYamlPath.length > 0;
                         const hasContent = typeof entry.runtimeYamlContent === "string";
                         if (hasPath && hasContent)
@@ -725,9 +658,6 @@ const senpiRuntimePlugin = {
                             continue;
                         const pathOrContent = entry.runtimeYamlPath ?? entry.runtimeYamlContent;
                         const entryStateDir = buildRuntimeStateDir(baseStateDir, entry.id, entry.wallet ?? "");
-                        // Indexed before the boot attempt: a runtime whose start throws is installed but stopped,
-                        // and the telemetry topology has to be able to say so.
-                        noteTelemetryRuntime(entry.id, entry.wallet ?? "");
                         const handle = await run(pathOrContent, {
                             fromPath: hasPath,
                             stateDir: entryStateDir,
@@ -735,6 +665,7 @@ const senpiRuntimePlugin = {
                             apiKey,
                             scannerProviders,
                             runtimeId: entry.id,
+                            onStrategyNotActive: (address) => reaper.checkWallet(address),
                         });
                         runtimeHandles.set(entry.id, handle);
                         started.push(entry.id);
@@ -750,7 +681,6 @@ const senpiRuntimePlugin = {
                         if (sharedIntakeContext) {
                             try {
                                 const runtimeConfig = await loadRuntimeConfig(pathOrContent, { fromPath: hasPath });
-                                noteTelemetryRuntimeConfig(entry.id, runtimeConfig);
                                 // Content-installed runtimes carry their recipe dir in the registry
                                 // entry (runtimeYamlDir) so relative scanner paths still resolve
                                 // after a restart; path-installed ones derive it from the path.
@@ -802,7 +732,6 @@ const senpiRuntimePlugin = {
                             // event) so listRuntimes/health don't render a bare "running".
                             try {
                                 const runtimeConfig = await loadRuntimeConfig(pathOrContent, { fromPath: hasPath });
-                                noteTelemetryRuntimeConfig(entry.id, runtimeConfig);
                                 if (selectScanners(runtimeConfig).length > 0) {
                                     unwiredRuntimes.set(entry.id, "no_intake");
                                     handle.attachSupervisionSource(() => ({
@@ -861,7 +790,6 @@ const senpiRuntimePlugin = {
                             intakeContext: sharedIntakeContext,
                             onAccepted: routeAcceptedSignalToRuntime,
                             onError: routeScaffoldErrorToRuntime,
-                            onTick: routeScaffoldTickToTelemetry,
                         });
                         apiHandle.ready();
                     }
@@ -905,19 +833,27 @@ const senpiRuntimePlugin = {
                         }
                     }
                 }
-                // Publish ticks start only once the runtimes are up, so the first frames describe a real
-                // box. Gated by the same switch the skills coordinator uses: unit tests boot `register()`
-                // and must not acquire background timers. The subscribe method still answers without them.
-                if (process.env.SENPI_RUNTIME_API_DISABLED !== "true") {
-                    liveTelemetry.start();
+                // Last, once everything above is up: the reaper's post-boot pass and hourly sweep. Its
+                // not-active escalation is also off until here, so no delete can land while the boot loop is
+                // still wiring runtimes and launchers. Nothing here may fail start() — a throw from inside the boot loop takes every runtime down, which
+                // is exactly the failure a lifecycle check must never cause. The unit-test seam
+                // SENPI_RUNTIME_API_DISABLED keeps its timers off unless a boot delay is set explicitly.
+                try {
+                    if (process.env.SENPI_RUNTIME_API_DISABLED !== "true" || reaperBootDelayOverride !== undefined) {
+                        reaper.start();
+                    }
+                }
+                catch (err) {
+                    pluginLogger.warn("[senpi-runtime] lifecycle reaper did not start", {
+                        err: err instanceof Error ? err.message : String(err),
+                    });
                 }
             },
             async stop() {
-                // Live telemetry goes first: it owns a timer and an in-memory buffer, nothing downstream
-                // depends on it, and stopping it here guarantees no publish tick reads a half-torn-down
-                // runtime handle. Records emitted during the teardown below land in a buffer nobody drains,
-                // which is the right trade for a process on its way out.
-                liveTelemetry.stop();
+                // Stop the reaper first so no pass starts deleting while the runtimes are torn down below,
+                // and wait (bounded) for a pass already under way, so its delete cannot stop a handle the
+                // teardown below is stopping too.
+                await reaper.stop();
                 // Drain the HTTP server FIRST so in-flight POST /signals requests
                 // finish before the underlying runtime they target is torn down.
                 // `apiHandle.close()` never throws.
@@ -1250,12 +1186,9 @@ const senpiRuntimePlugin = {
                         apiKey,
                         scannerProviders,
                         runtimeId: resolvedId,
+                        onStrategyNotActive: (address) => reaper.checkWallet(address),
                     });
                     runtimeHandles.set(resolvedId, handle);
-                    if (parsedConfig)
-                        noteTelemetryRuntimeConfig(resolvedId, parsedConfig);
-                    else
-                        noteTelemetryRuntime(resolvedId, wallet);
                     // Registry create fact — distinct from the runtime.started boot transition (which also fires
                     // on a transient restart). Emitted inside emitEvent's guard so telemetry never fails the install.
                     emitEvent(apiLogger, () => buildRuntimeCreatedEvent({ runtimeId: resolvedId, address: wallet, recipeName: runtimeName }));
@@ -1368,7 +1301,7 @@ const senpiRuntimePlugin = {
             }
         }
         /** Gateway respond accepts (ok, payload?, error?) with error as { code, message }; plugin SDK types may omit the third arg. */
-        registerGatewayMethod("senpi.installRuntime", async (ctx) => {
+        api.registerGatewayMethod("senpi.installRuntime", async (ctx) => {
             const respond = ctx.respond;
             const result = await installRuntimeCore(ctx.params);
             if (result.ok)
@@ -1376,7 +1309,7 @@ const senpiRuntimePlugin = {
             else
                 respond(false, undefined, result.error);
         }, { scope: "operator.write" });
-        registerGatewayMethod("senpi.listRuntimes", async (ctx) => {
+        api.registerGatewayMethod("senpi.listRuntimes", async (ctx) => {
             const respond = ctx.respond;
             const { readRegistry } = await import("./runtime/strategy-registry.js");
             const registry = await readRegistry(baseStateDir);
@@ -1385,8 +1318,11 @@ const senpiRuntimePlugin = {
                 // say so rather than reporting a bare "running" the operator would read as healthy.
                 // unwiredRuntimes is populated at the four wire/launch failure sites (and is
                 // exactly the set of "declared external scanners but has no launcher").
+                const bootSkipStatus = bootSkippedRuntimes.get(e.id);
                 const status = !runtimeHandles.has(e.id)
-                    ? "stopped"
+                    ? bootSkipStatus !== undefined
+                        ? bootSkippedStatusLabel(bootSkipStatus)
+                        : "stopped"
                     : unwiredRuntimes.has(e.id)
                         ? "running — NO ENTRY SCANNERS"
                         : "running";
@@ -1397,6 +1333,10 @@ const senpiRuntimePlugin = {
                         ? e.runtimeYamlPath
                         : "(inline)",
                     status,
+                    // What the strategy behind this runtime last read as (open / closing / closed / absent /
+                    // unchecked / unknown) — separate from `status`, whose running…/stopped… prefixes other
+                    // readers key on.
+                    ...reaper.lifecycleOf(e.wallet),
                     // The deploy path installs by CONTENT, not path (orchestrator.ts installRuntime), so
                     // `source` is "(inline)" for every deployed strategy and the YAML is unreachable through
                     // it. The engine renders the facts instead of shipping a blob to re-interpret.
@@ -1411,13 +1351,19 @@ const senpiRuntimePlugin = {
          * unwired-verdict cleanup all happen exactly once, here.
          */
         async function deleteRuntimeCore(params) {
-            const { readRegistry, writeRegistry, withRegistryLock } = await import("./runtime/strategy-registry.js");
-            const registry = await readRegistry(baseStateDir);
             let targetId = typeof params?.id === "string" ? params.id : undefined;
             const targetAddress = typeof params?.address === "string" ? params.address : undefined;
+            // Set only by the lifecycle reaper: why the strategy counts as gone (stamped on runtime.deleted)
+            // and which wallet that verdict was about (the concurrency guard below).
+            const deleteReason = params?.deleteReason === "closed_status" ? params.deleteReason
+                : undefined;
+            const expectWallet = typeof params?.expectWallet === "string" && params.expectWallet.trim().length > 0
+                ? params.expectWallet.trim().toLowerCase()
+                : undefined;
             // Resolve target by address if id not provided
             if (!targetId && targetAddress) {
-                const entry = registry.runtimes.find((e) => e.wallet === targetAddress);
+                const { readRegistry } = await import("./runtime/strategy-registry.js");
+                const entry = (await readRegistry(baseStateDir)).runtimes.find((e) => e.wallet === targetAddress);
                 if (!entry) {
                     return { ok: false, error: {
                             code: "NOT_FOUND",
@@ -1432,6 +1378,24 @@ const senpiRuntimePlugin = {
                         message: "Please provide the runtime id or wallet address. Example: openclaw senpi runtime delete --id my-runtime",
                     } };
             }
+            // One delete or update apply per runtime at a time (see `runtimeChangeLock`). Operator, agent
+            // and deploy deletes wait their turn; the lifecycle reaper never queues behind someone else's
+            // change to the runtime it judged — it backs off and the next lifecycle check re-reads it.
+            // The check and the acquire below run in one synchronous step.
+            const id = targetId;
+            if (expectWallet !== undefined && runtimeChangeLock.hasKey(id)) {
+                return { ok: false, error: {
+                        code: "CONFLICT",
+                        message: `Runtime "${id}" was not removed: another delete or an update is already running on it. Nothing was changed; the next lifecycle check re-reads it.`,
+                    } };
+            }
+            return runtimeChangeLock.withKeyLock(id, () => deleteRuntimeLocked(id, deleteReason, expectWallet));
+        }
+        /** {@link deleteRuntimeCore} past target resolution, under the runtime's change lock. */
+        async function deleteRuntimeLocked(targetId, deleteReason, expectWallet) {
+            const { readRegistry, writeRegistry, withRegistryLock } = await import("./runtime/strategy-registry.js");
+            // Read under the lock: a delete that waited behind another change sees what that change left.
+            const registry = await readRegistry(baseStateDir);
             const deletedEntry = registry.runtimes.find((e) => e.id === targetId);
             const handle = runtimeHandles.get(targetId);
             if (!deletedEntry && !handle) {
@@ -1440,6 +1404,35 @@ const senpiRuntimePlugin = {
                         message: `No runtime found with id "${targetId}".`,
                     } };
             }
+            /**
+             * The lifecycle reaper's guard. Its verdict was about one wallet at one moment; the delete
+             * below must not land on anything else. Evaluated synchronously between the registry read
+             * above and the first teardown step, so nothing can interleave between check and act:
+             * - an install on that wallet is running (it could land a live runtime under this id);
+             * - a deploy job holds the single-flight slot (it retires and reinstalls runtimes);
+             * - the row under this id no longer carries that wallet (ids derive from name + wallet and
+             *   are reused, so a reinstall onto a new wallet can take the old id);
+             * - a live handle under this id trades a different wallet.
+             * Operator, agent and deploy deletes pass no `expectWallet` and are unaffected.
+             */
+            if (expectWallet !== undefined) {
+                const fold = (w) => (w ?? "").trim().toLowerCase();
+                const conflict = installsInFlight.has(expectWallet)
+                    ? "an install is running on that wallet"
+                    : deployController.running() !== null
+                        ? "a deploy is in progress"
+                        : !deletedEntry || fold(deletedEntry.wallet) !== expectWallet
+                            ? "the registry row under that id no longer carries that wallet"
+                            : handle && fold(handle.wallet) !== expectWallet
+                                ? "the running runtime under that id trades a different wallet"
+                                : undefined;
+                if (conflict !== undefined) {
+                    return { ok: false, error: {
+                            code: "CONFLICT",
+                            message: `Runtime "${targetId}" was not removed: ${conflict}. Nothing was changed; the next lifecycle check re-reads it.`,
+                        } };
+                }
+            }
             if (handle) {
                 await handle.teardownDslForRuntimeDeletion();
                 await handle.stop();
@@ -1459,9 +1452,7 @@ const senpiRuntimePlugin = {
             // "running — NO ENTRY SCANNERS" forever. The map is otherwise only cleared on a
             // successful wire/install, which a scanner-less reinstall never reaches.
             unwiredRuntimes.delete(targetId);
-            // Same reuse hazard: a deleted id left in the index would keep publishing a strategy that no
-            // longer exists, and would hand a reinstall the old name and scanner list.
-            telemetryStrategies.delete(targetId);
+            bootSkippedRuntimes.delete(targetId);
             // Archive state directory before removing from registry
             if (deletedEntry) {
                 const runtimeStateDir = buildRuntimeStateDir(baseStateDir, targetId, deletedEntry.wallet ?? "");
@@ -1487,10 +1478,11 @@ const senpiRuntimePlugin = {
                 runtimeId: targetId,
                 address: deletedEntry?.wallet,
                 hadLiveHandle: Boolean(handle),
+                deleteReason,
             }));
             return { ok: true, payload: { id: targetId } };
         }
-        registerGatewayMethod("senpi.deleteRuntime", async (ctx) => {
+        api.registerGatewayMethod("senpi.deleteRuntime", async (ctx) => {
             const respond = ctx.respond;
             const result = await deleteRuntimeCore(ctx.params);
             if (result.ok)
@@ -1597,17 +1589,6 @@ const senpiRuntimePlugin = {
                 return checkProofCoversRecipe(packageDir, verifyProof(packageDir), appliedRecipe, (f) => readFileSync(f, "utf8"));
             },
             applyToRuntime: makeApplyToRuntime(runtimeHandles, async (runtimeId, next, recipe) => {
-                // Re-index the topology facts FIRST, ahead of every early return and every failure path
-                // below. `makeApplyToRuntime` only reaches this callback once the in-process swap has
-                // succeeded, so `next` is already the recipe this box runs: its display name and its
-                // declared scanner list are the ones the topology payload must name. Leaving the index on
-                // the previous config would publish strategy rows the new scanner stats cannot join to.
-                //
-                // Ahead of the early return because an apply on a box with no intake still swapped the
-                // recipe, and ahead of the launcher because a launcher that fails is a runtime running the
-                // new recipe with no external scanners — the degraded state a dashboard most needs to show,
-                // and one it can only render if the declared scanners are the new ones.
-                noteTelemetryRuntimeConfig(runtimeId, next);
                 // Restart this runtime's external scanner children against the new package.
                 //
                 // The rebuild swaps in-process components; these are separate OS processes, spawned once
@@ -1755,7 +1736,7 @@ const senpiRuntimePlugin = {
          * producers — slated for removal in Task 5 once the migration counter
          * decays to zero (see `runtime-phase-2-api-plan.md` Section 8).
          */
-        registerGatewayMethod("senpi.ingestExternalScannerData", async (ctx) => {
+        api.registerGatewayMethod("senpi.ingestExternalScannerData", async (ctx) => {
             const respond = ctx.respond;
             // TODO(s11): wire actual telemetry counter for
             //   runtime.deprecated_gateway_ingest_call (event name, properties:
@@ -1774,7 +1755,6 @@ const senpiRuntimePlugin = {
                     ...(request.direction !== undefined && { direction: request.direction }),
                     ...(request.score !== undefined && { score: request.score }),
                     ...(request.signal_type !== undefined && { signal_type: request.signal_type }),
-                    ...(request.tick_id !== undefined && { tick_id: request.tick_id }),
                     ...(request.data !== undefined && { data: request.data }),
                     ...(request.signals !== undefined && { signals: request.signals }),
                 };
@@ -1832,7 +1812,7 @@ const senpiRuntimePlugin = {
                 });
             }
         }, { scope: "operator.write" });
-        registerGatewayMethod("senpi.listDslPositions", async (ctx) => {
+        api.registerGatewayMethod("senpi.listDslPositions", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             const address = typeof ctx.params?.address === "string" ? ctx.params.address : undefined;
@@ -1857,7 +1837,7 @@ const senpiRuntimePlugin = {
             }
             respond(true, { positions });
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.getDslPositionState", async (ctx) => {
+        api.registerGatewayMethod("senpi.getDslPositionState", async (ctx) => {
             const respond = ctx.respond;
             const asset = typeof ctx.params?.asset === "string" ? ctx.params.asset : undefined;
             if (!asset) {
@@ -1898,7 +1878,7 @@ const senpiRuntimePlugin = {
             }
             respond(true, { positions: matches });
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.listDslArchives", async (ctx) => {
+        api.registerGatewayMethod("senpi.listDslArchives", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             const address = typeof ctx.params?.address === "string" ? ctx.params.address : undefined;
@@ -1924,7 +1904,7 @@ const senpiRuntimePlugin = {
                 closes = closes.slice(0, limit);
             respond(true, { closes });
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.getHealthStatus", async (ctx) => {
+        api.registerGatewayMethod("senpi.getHealthStatus", async (ctx) => {
             const respond = ctx.respond;
             const updater = autoUpdateCoordinator.getSnapshot();
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
@@ -1952,7 +1932,7 @@ const senpiRuntimePlugin = {
             const statuses = await collectRuntimeHealthStatuses(runtimeHandles, api.logger);
             respond(true, { statuses, updater });
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.getSystemState", async (ctx) => {
+        api.registerGatewayMethod("senpi.getSystemState", async (ctx) => {
             const respond = ctx.respond;
             const updater = autoUpdateCoordinator.getSnapshot();
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
@@ -1980,36 +1960,6 @@ const senpiRuntimePlugin = {
             const states = await collectRuntimeSystemStates(runtimeHandles, api.logger, baseStateDir);
             respond(true, { states, updater });
         }, { scope: "operator.read" });
-        /**
-         * Live telemetry — the one method of the stream, called once per connect.
-         *
-         * It returns the current value of all three broadcast payloads plus the recent record window, so
-         * a client joining a box that has been running for hours renders a full screen immediately
-         * instead of waiting for the next thing to happen. `(afterEpoch, afterSeq)` resumes a client that
-         * already holds part of this epoch's run — a cursor naming any other epoch is dropped, because a
-         * seq from a previous run cannot address these records. `truncated` says when the records between
-         * a cursor of this epoch and the oldest record still held are gone, which nothing in `recent`
-         * alone can express.
-         *
-         * Read-only, like every other inspection method here. The scope that decides who RECEIVES the
-         * broadcasts is a property of the client's own connection, not of this method.
-         */
-        registerGatewayMethod("senpi.telemetry.subscribe", async (ctx) => {
-            const respond = ctx.respond;
-            try {
-                respond(true, await liveTelemetry.snapshot({
-                    afterEpoch: ctx.params?.afterEpoch,
-                    afterSeq: ctx.params?.afterSeq,
-                }));
-            }
-            catch (err) {
-                api.logger.warn("[senpi-runtime] telemetry subscribe error", { err });
-                respond(false, undefined, {
-                    code: "INTERNAL_ERROR",
-                    message: `Failed to build the telemetry snapshot: ${formatGatewayError(err)}`,
-                });
-            }
-        }, { scope: "operator.read" });
         /**
          * Force the auto-update poll to run now instead of waiting for its timer.
          *
@@ -2068,7 +2018,7 @@ const senpiRuntimePlugin = {
          * persisted action-store machinery (`src/actions/store/`) usable
          * from the operator-facing CLI again.
          */
-        registerGatewayMethod("senpi.listActions", async (ctx) => {
+        api.registerGatewayMethod("senpi.listActions", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             const address = typeof ctx.params?.address === "string" ? ctx.params.address : undefined;
@@ -2098,7 +2048,7 @@ const senpiRuntimePlugin = {
             }
             respond(true, { actions: merged });
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.getActionState", async (ctx) => {
+        api.registerGatewayMethod("senpi.getActionState", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             const actionName = typeof ctx.params?.actionName === "string" ? ctx.params.actionName : undefined;
@@ -2135,7 +2085,7 @@ const senpiRuntimePlugin = {
                 });
             }
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.getActionHistory", async (ctx) => {
+        api.registerGatewayMethod("senpi.getActionHistory", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             const actionName = typeof ctx.params?.actionName === "string" ? ctx.params.actionName : undefined;
@@ -2203,7 +2153,7 @@ const senpiRuntimePlugin = {
         // reachable on HTTP `/audit`. Passes through the caller-controlled subset
         // of the audit_query contract; resource scoping (wallet → strategyId) is
         // owned by handle.auditQuery, never the caller.
-        registerGatewayMethod("senpi.auditQuery", async (ctx) => {
+        api.registerGatewayMethod("senpi.auditQuery", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             if (!runtimeId) {
@@ -2251,7 +2201,7 @@ const senpiRuntimePlugin = {
         // its state root private, so re-derive it from baseStateDir + the handle's
         // wallet (same helper the writer's stateDir was built with); the writer
         // nests entries under `<root>/<address>/risk-guard/audit.jsonl`.
-        registerGatewayMethod("senpi.getRiskAudit", async (ctx) => {
+        api.registerGatewayMethod("senpi.getRiskAudit", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             if (!runtimeId) {
@@ -2294,7 +2244,7 @@ const senpiRuntimePlugin = {
         // Per-strategy local domain-event ring (on-disk JSONL) — the trade narrative, queryable locally.
         // Same state-root re-derivation as getRiskAudit: the Runtime keeps its root private, so rebuild it
         // from baseStateDir + the handle's wallet; the writer nests rows under `<root>/strategies/<address>/events/`.
-        registerGatewayMethod("senpi.getEvents", async (ctx) => {
+        api.registerGatewayMethod("senpi.getEvents", async (ctx) => {
             const respond = ctx.respond;
             const runtimeId = typeof ctx.params?.runtimeId === "string" ? ctx.params.runtimeId : undefined;
             if (!runtimeId) {
@@ -2351,12 +2301,12 @@ const senpiRuntimePlugin = {
             }
         }, { scope: "operator.read" });
         // ─── Skills manager — read + mutate ──────────────────────────────────────
-        registerGatewayMethod("senpi.skills.status", async (ctx) => {
+        api.registerGatewayMethod("senpi.skills.status", async (ctx) => {
             const respond = ctx.respond;
             const snapshot = skillsCoordinator.getSnapshot();
             respond(true, { snapshot });
         }, { scope: "operator.read" });
-        registerGatewayMethod("senpi.skills.update", async (ctx) => {
+        api.registerGatewayMethod("senpi.skills.update", async (ctx) => {
             const respond = ctx.respond;
             const name = typeof ctx.params?.name === "string" ? ctx.params.name.trim() : undefined;
             if (!name) {
@@ -2381,7 +2331,7 @@ const senpiRuntimePlugin = {
                 });
             }
         }, { scope: "operator.write" });
-        registerGatewayMethod("senpi.skills.updateAll", async (ctx) => {
+        api.registerGatewayMethod("senpi.skills.updateAll", async (ctx) => {
             const respond = ctx.respond;
             try {
                 const results = await skillsCoordinator.updateAll();
@@ -2447,7 +2397,6 @@ function parseGatewayExternalScannerIngestParams(params) {
             direction: params?.direction,
             score: params?.score,
             signal_type: params?.signal_type,
-            tick_id: params?.tick_id,
             data: params?.data,
             signals: params?.signals,
         },