@senpi/runtime 3.0.185 → 3.0.187

package/dist/index.js

@@ -25,6 +25,7 @@ import { registerUpdateGatewayMethod } from "./runtime/update-register.js";
 import { createStrategiesPublisher } from "./runtime/strategies-telemetry.js";
 import { buildEventsReplay, createEventsPublisher, } from "./runtime/events-telemetry.js";
 import { strategiesStore, strategyRecordFromConfig } from "./runtime/strategies-store.js";
+import { bindProcessLogger, processLog, runtimeProcessState, } from "./runtime/process-state.js";
 import { checkProofCoversRecipe, makeApplyToRuntime, makeWriteRegistry, runtimeChangeLock, } from "./runtime/update-apply-deps.js";
 import { INSTALL_DEADLINE_MS, WALLET_INSTALL_IN_FLIGHT_CODE } from "./deploy/deadlines.js";
 import { AuditQueryError } from "./runtime/audit-query.types.js";
@@ -49,7 +50,7 @@ import { readEvents } from "./telemetry/event-store.js";
 import { VERSION } from "./version.js";
 import { resolvePackageName } from "./runtime/auto-update/resolve-package-name.js";
 import { runOpenClawPluginsUpdate } from "./runtime/auto-update/run-update-command.js";
-import { UpdateIdleGate } from "./runtime/auto-update/idle-gate.js";
+import { UpdateIdleGate, createIdleGateActivity } from "./runtime/auto-update/idle-gate.js";
 import { registerIdleGateHooks, resolveUpdateMid } from "./runtime/auto-update/register-idle-gate.js";
 import { resolveUpdateMarkerPath } from "./runtime/auto-update/update-marker.js";
 import { INSTALL_RESULTS_OTEL_FLUSH_MS, INSTALL_RESULTS_OTEL_READY_MS, resolveInstallResultsPath, } from "./runtime/auto-update/install-results.js";
@@ -81,7 +82,7 @@ import { ingestDispatchMutex, ingestDispatchKey } from "./runtime-api/intake/ing
 import { buildScaffoldErrorRouter } from "./runtime-api/intake/scaffold-error-router.js";
 import { loadRuntimeConfig } from "./runtime/load-runtime-config.js";
 import { errorText } from "./deploy/error-text.js";
-import { initOpenClawHost } from "./host/openclaw-host.js";
+import { getOpenClawHost, initOpenClawHost } from "./host/openclaw-host.js";
 import { createRegisterPluginLogger, withEventLogger } from "./host/plugin-logger.js";
 import { hostname } from "node:os";
 import { BOOT_FACTS_CALL_TIMEOUT_MS, planBootFacts, syncBootFacts, } from "./strategy/facts-sync.js";
@@ -182,23 +183,29 @@ const WALLET_INSTALL_IN_FLIGHT = `[${WALLET_INSTALL_IN_FLIGHT_CODE}]`;
  */
 const RUNTIME_ID_TAKEN = "[E_RUNTIME_ID_TAKEN]";
 /**
- * One StrategyFacts send per runtime at a time, keyed on runtime id, across the whole process: a
- * second `register()` in the same process shares it. Separate from `runtimeChangeLock`. Delete does
- * not take it; an apply queues its send here and does not wait.
+ * One StrategyFacts send per runtime at a time, keyed on runtime id, across the whole process.
+ * Held in the process state (`runtime/process-state.ts`), not this module: a 10.x plugin reload
+ * evaluates a new copy of this module, and the previous registration's send may still be running.
+ * Separate from `runtimeChangeLock`. Delete does not take it; an apply queues its send here and
+ * does not wait.
  */
-const factsSendLock = new KeyedMutex();
+function factsSendLock() {
+    const state = runtimeProcessState();
+    state.factsSendLock ??= new KeyedMutex();
+    return state.factsSendLock;
+}
 /**
- * Whether this process has already logged the 5.x "cannot classify runs" notice.
+ * Clears the process-state latch for the 5.x "cannot classify runs" notice
+ * (`legacyTurnClassificationNoticeLogged`). Tests only.
  *
- * Module-scoped so a gateway reload (which re-registers the plugin and restarts its service in the
- * same process) does not repeat it. The 5.x case is a host-version limit with no config fix, so
- * one info line per process is the whole message; the fixable 10.x case stays an ERROR at every
- * registration and does not read this latch.
+ * The latch lives in the process state so a plugin reload (which re-registers the plugin and
+ * restarts its service in the same process, from a new copy of this module) does not repeat the
+ * notice. The 5.x case is a host-version limit with no config fix, so one info line per process is
+ * the whole message; the fixable 10.x case stays an ERROR at every registration and does not read
+ * this latch.
  */
-let legacyTurnClassificationNoticeLogged = false;
-/** Clears {@link legacyTurnClassificationNoticeLogged}. Tests only. */
 export function resetLegacyTurnClassificationNoticeForTests() {
-    legacyTurnClassificationNoticeLogged = false;
+    runtimeProcessState().legacyTurnClassificationNoticeLogged = false;
 }
 /**
  * The whole of `register()` in the `"cli-metadata"` pass: the `senpi` CLI root, under the same
@@ -261,8 +268,17 @@ const senpiRuntimePlugin = {
             registerSenpiCliMetadata(api);
             return;
         }
-        // Host facts first: the logger and every version-gated registration below read them.
-        const openClawHost = initOpenClawHost(api);
+        // Host facts first: the logger and every version-gated registration below read them. 10.x also
+        // registers plugins in non-full modes inside the gateway (`tool-discovery` for tools.catalog);
+        // that pass must keep registering tools, but its throwaway api must not replace the record the
+        // live registration made.
+        const fullRegistration = api.registrationMode === undefined || api.registrationMode === "full";
+        const openClawHost = (!fullRegistration && getOpenClawHost()) || initOpenClawHost(api);
+        // State kept across a reload (the deploy controller, the gate trackers) logs through the latest
+        // full registration's logger, never through an `api` a reload has replaced.
+        const processState = runtimeProcessState();
+        if (fullRegistration)
+            bindProcessLogger(api.logger);
         const pluginLogger = createRegisterPluginLogger(api.logger, {
             jsonMode: process.argv.includes("--json"),
             hostRoutesJsonLogsToStderr: openClawHost.modern,
@@ -403,10 +419,14 @@ const senpiRuntimePlugin = {
         // decisions persist in <stateDir>/tool-approvals.json.
         // See docs/mcp-tool-approvals-design.md.
         // Open trade-approval prompts, read by the self-update idle gate (R2).
-        const pendingApprovalTracker = new PendingApprovalTracker();
+        // This and the turn tracker are process state: a 10.x reload re-registers in the same process
+        // while a prompt is open or a run is in flight (r4467406809, r4427720076).
+        processState.pendingApprovals ??= new PendingApprovalTracker();
+        const pendingApprovalTracker = processState.pendingApprovals;
         // The turn kind (chat / cron / heartbeat) and session key of each gated
         // call, for approval telemetry and the 10.x scheduled-turn block (R6, D13).
-        const turnContextTracker = new TurnContextTracker();
+        processState.turnContext ??= new TurnContextTracker();
+        const turnContextTracker = processState.turnContext;
         // One boot-time fact (D15): can this host classify runs at all? Only then
         // does the gate stop prompts outside a direct chat turn. Without it every
         // run reads unknown and keeps the pre-10.x prompt, so a box missing the
@@ -442,7 +462,7 @@ const senpiRuntimePlugin = {
                         ? "on this OpenClaw version; a 10.x host lifts this."
                         : "until the runtime registers its turn-context hooks.");
         const legacyTurnClassificationNotice = turnClassificationHostLimit ? turnClassificationNotice : undefined;
-        if (turnClassificationNotice !== undefined && !turnClassificationHostLimit) {
+        if (turnClassificationNotice !== undefined && !turnClassificationHostLimit && fullRegistration) {
             pluginLogger.error(turnClassificationNotice);
         }
         const approvalsHostStatus = turnClassification.available
@@ -452,12 +472,28 @@ const senpiRuntimePlugin = {
                 reason: turnClassification.reason,
                 ...(turnClassificationHostLimit ? { hostLimit: true } : {}),
             };
+        // Process state, like the run-kind tracker beside it: a reload must not zero the count that
+        // `senpi status` warns about while chat trades are being refused.
+        const approvalsStatus = () => approvalsHostStatus.turnClassification === "available"
+            ? {
+                ...approvalsHostStatus,
+                runsRecorded: turnContextTracker.runsRecorded,
+                unclassifiedBlocks: processState.unclassifiedBlocks,
+                ...(processState.lastUnclassifiedBlockAt
+                    ? { lastUnclassifiedBlockAt: processState.lastUnclassifiedBlockAt }
+                    : {}),
+            }
+            : approvalsHostStatus;
         try {
             registerToolApprovalGate({
                 api,
                 pendingApprovals: pendingApprovalTracker,
                 turnContext: turnContextTracker,
                 turnClassification: turnClassification.available,
+                onUnclassifiedBlock: (at) => {
+                    processState.unclassifiedBlocks += 1;
+                    processState.lastUnclassifiedBlockAt = new Date(at).toISOString();
+                },
                 mode: resolveToolApprovalsMode({
                     pluginConfig: config,
                     env: process.env,
@@ -605,8 +641,21 @@ const senpiRuntimePlugin = {
          * row, sees no live handle, deletes it and reinstalls — and the first install then lands on top,
          * clobbering `runtimeHandles` under a runtime id both installs derive identically. Two exit
          * engines, one margin account: the exact state `[E_WALLET_HAS_RUNTIME]` exists to prevent.
+         *
+         * Process state (`runtime/process-state.ts`), not this registration: a 10.x plugin reload
+         * re-registers in the same process while a deploy job's install from the previous registration
+         * runs on, and the new registration must still refuse a second install on that wallet.
+         */
+        const installsInFlight = processState.installsInFlight;
+        /**
+         * This registration's service lifecycle, for an install or adoption that outlives it. A 10.x
+         * plugin reload stops this service and starts the next registration's in the same process;
+         * `serviceStops` counts this registration's stops, so a stop followed by a later start is still
+         * seen. Only a stop counts: an install that began before the first start (the gateway may call
+         * installRuntime before start()) and spans it is not orphaned.
          */
-        const installsInFlight = new Map();
+        let serviceState = "idle";
+        let serviceStops = 0;
         // Dedicated logger for the runtime-api subtree — required because the
         // PluginLogger surface (info/warn/error) lacks `debug`, while the
         // Logger contract used by `runtime-api/` includes it.
@@ -663,7 +712,10 @@ const senpiRuntimePlugin = {
             // the agent's senpi__ calls (direct or through the dispatcher), seen at the
             // tool hooks. A deploy job is read from the controller (this process) and
             // its journals (any process).
-            const moneyCalls = new MoneyCallTracker();
+            // Process state, like the approval trackers: a call that started under the previous
+            // registration still counts, and its after-hook (now this registration's) closes it.
+            processState.moneyCalls ??= new MoneyCallTracker();
+            const moneyCalls = processState.moneyCalls;
             try {
                 registerMoneyCallHooks({
                     api: api,
@@ -681,6 +733,13 @@ const senpiRuntimePlugin = {
                 ordersInFlight: () => senpiOrderCallsInFlight() + moneyCalls.count(Date.now()),
                 // Read only from ticks, after register() has constructed the controller below.
                 deploysInFlight: () => deployController.inFlight(Date.now()),
+                // The process start, not this registration: a config edit under `plugins` re-registers in
+                // the same process (10.10 reloadGatewayPlugins), and repeated reloads under 15 min apart
+                // must not hold an update until the forced window.
+                startedAt: Date.now() - Math.round(process.uptime() * 1000),
+                // Process state: a reload builds this gate again, and must not forget a user turn that is
+                // running, a message that is queued, or when the user last wrote.
+                activity: (processState.idleGateActivity ??= createIdleGateActivity()),
                 logger: pluginLogger,
             });
             try {
@@ -774,11 +833,20 @@ const senpiRuntimePlugin = {
         // boot scan: declaring it after would leave that reference in the temporal dead zone for any
         // future refactor that starts the service earlier. The rest of the deploy wiring lives in
         // src/deploy/register.ts behind an explicit context; this closure contributes collaborators only.
-        const deployController = new DeployJobController({
-            deploysDir: join(baseStateDir, "deploys"),
-            now: () => Date.now(),
-            log: (line) => api.logger.info(`[senpi-runtime] ${line}`),
-        });
+        //
+        // One controller per deploys dir per process (process state): a full re-registration (10.10
+        // reloadGatewayPlugins, same process) reuses the one that may be running a deploy, so its
+        // `running()` keeps single-flight and `inFlight()` keeps the idle gate's deploy blocker. It
+        // logs through `processLog`, the current registration's logger, so a job that outlives its
+        // registration still narrates and writes its terminal journal line.
+        const deploysDir = join(baseStateDir, "deploys");
+        const deployController = processState.deployControllers.get(deploysDir) ??
+            new DeployJobController({
+                deploysDir,
+                now: () => Date.now(),
+                log: (line) => processLog.info(`[senpi-runtime] ${line}`),
+            });
+        processState.deployControllers.set(deploysDir, deployController);
         // ── lifecycle reaper ─────────────────────────────────────────────────────────────────────────
         // A runtime exists iff its strategy is open. Every close path ends at the backend and none of
         // them tells this box, so the reaper asks: once after boot, hourly, and whenever the backend
@@ -816,15 +884,20 @@ const senpiRuntimePlugin = {
         api.registerService({
             id: "senpi-runtime",
             async start() {
+                serviceState = "running";
                 // The 5.x classification notice (see the approval gate above), once per process.
-                if (legacyTurnClassificationNotice !== undefined && !legacyTurnClassificationNoticeLogged) {
-                    legacyTurnClassificationNoticeLogged = true;
+                if (legacyTurnClassificationNotice !== undefined && !processState.legacyTurnClassificationNoticeLogged) {
+                    processState.legacyTurnClassificationNoticeLogged = true;
                     pluginLogger.info(legacyTurnClassificationNotice);
                 }
                 // Deploy-journal janitor: stamp anything a restart left unterminated as `interrupted`.
                 // It never re-enters a deploy state machine — discovery is pull-based via
-                // `senpi deploy status`.
-                await deployController.scanOnBoot();
+                // `senpi deploy status`. Once per process: after a reload an unterminated journal may be
+                // the deploy this process is still running (r4469086155).
+                if (!processState.bootScanned.has(deploysDir)) {
+                    processState.bootScanned.add(deploysDir);
+                    await deployController.scanOnBoot();
+                }
                 // Quant runs a restart cut short belong to a process that no longer exists: stamp them
                 // failed with the re-run command, so `senpi quant status` never reports a dead run as live.
                 // The controller also gates every quant start/read on this same (memoized) janitor, since
@@ -1156,6 +1229,17 @@ const senpiRuntimePlugin = {
                         }
                     }
                 }
+                // This registration now runs the box's runtimes: publish it, then start what an install from a
+                // stopped registration handed over while none was live (see `handOffRuntime`). Detached and
+                // never throwing, like the facts send: one adoption must not hold or fail the boot.
+                processState.runtimeHost = runtimeHost;
+                const pendingHandOffs = [...processState.pendingRuntimeHandOffs];
+                processState.pendingRuntimeHandOffs.clear();
+                for (const [runtimeId, walletKey] of pendingHandOffs) {
+                    void runtimeHost.adoptRuntime({ runtimeId, walletKey }).then((handOff) => {
+                        pluginLogger.info("[senpi-runtime] handed-over runtime settled at service start", { runtimeId, outcome: handOff.outcome });
+                    });
+                }
                 // Ticks once now, with every booted runtime in the store, then every 30 s.
                 strategiesPublisher.start();
                 // Sends the events added since the previous send, every 1 s.
@@ -1177,6 +1261,12 @@ const senpiRuntimePlugin = {
                 }
             },
             async stop() {
+                // First: an install or adoption still running in this registration sees the stop from here
+                // on and hands its runtime to the next registration instead of keeping it in this one.
+                serviceState = "stopped";
+                serviceStops += 1;
+                if (processState.runtimeHost === runtimeHost)
+                    processState.runtimeHost = null;
                 // Stop the reaper first so no pass starts deleting while the runtimes are torn down below,
                 // and wait (bounded) for a pass already under way, so its delete cannot stop a handle the
                 // teardown below is stopping too.
@@ -1228,7 +1318,310 @@ const senpiRuntimePlugin = {
          * `senpi deploy` installs through the SAME gates (wallet ownership, one-runtime-per-wallet,
          * scanner-path resolution) instead of a parallel path that could drift.
          */
+        /**
+         * Start an already-registered runtime in THIS registration while its service runs: `run()`,
+         * the handle in `runtimeHandles`, then the hot-install scanner wire (the API is already
+         * listening, so the launcher starts at once). Shared by `installRuntimeCore` and by
+         * {@link runtimeHost}'s adoption of a runtime another registration handed over.
+         *
+         * `orphaned` says whether this registration's service stopped since the caller began (a 10.x
+         * plugin reload). It is read after `run()` returns and again after the wire: a stopped
+         * registration's `stop()` has already torn its runtimes down, so a runtime started here now
+         * would keep ticking in a registration nothing can stop or delete. In that case this stops what
+         * it started (the launcher, then the handle), removes them from this registration's maps, and
+         * returns `orphaned`; the caller hands the runtime to the live registration.
+         *
+         * Throws what `run()` throws. Wire failures do not throw: they are reported as `unwiredPhase`,
+         * exactly as the install has always reported them.
+         */
+        async function startRuntimeLive(spec, orphaned, 
+        /** Called once the runtime runs in this registration, before the scanner wire. */
+        onRunning) {
+            const { runtimeId, pathOrContent, fromPath, recipeDir, wallet, parsedConfig } = spec;
+            /**
+             * The unwired verdict for THIS start, tracked locally rather than read back out of
+             * `unwiredRuntimes`, so the result reports what this call did and never a leftover verdict
+             * from an earlier runtime that happened to share the id. Set at each of the three sites that
+             * leave the runtime without live entry scanners; cleared by the wire-success path.
+             */
+            let unwiredPhase;
+            let hotLauncher = null;
+            const scannerProviders = await createScannerProvidersForRun({
+                mcpTransport,
+                apiKey,
+            });
+            const entryStateDir = buildRuntimeStateDir(baseStateDir, runtimeId, wallet);
+            const handle = await run(pathOrContent, {
+                fromPath,
+                stateDir: entryStateDir,
+                mcpTransport,
+                apiKey,
+                scannerProviders,
+                runtimeId,
+                onStrategyNotActive: (address) => reaper.checkWallet(address),
+            });
+            /** Stops what this call started and leaves this registration's maps as they were. */
+            const abandon = async () => {
+                if (hotLauncher) {
+                    await hotLauncher.stop().catch(() => { });
+                    if (launchers.get(runtimeId) === hotLauncher)
+                        launchers.delete(runtimeId);
+                }
+                await handle.stop().catch((err) => {
+                    pluginLogger.warn("[senpi-runtime] could not stop a runtime started by a stopped registration", {
+                        runtimeId,
+                        err: err instanceof Error ? err.message : String(err),
+                    });
+                });
+                if (runtimeHandles.get(runtimeId) === handle) {
+                    runtimeHandles.delete(runtimeId);
+                    unwiredRuntimes.delete(runtimeId);
+                }
+                return { status: "orphaned" };
+            };
+            if (orphaned())
+                return abandon();
+            runtimeHandles.set(runtimeId, handle);
+            onRunning?.();
+            // ── hot-install supervised scanner wire ───────────────────────────────
+            // Live-install path: used when a runtime is registered after boot via
+            // senpi.installRuntime, while the API is already listening — the
+            // counterpart to the boot-time `launcher` above. A runtime takes exactly
+            // one path: boot-present → `launcher` (deferred start); installed live →
+            // `hotLauncher` (immediate start). The two are mutually exclusive because
+            // installRuntime rejects any id/wallet already in the registry before
+            // wiring (the hasId guard), so a boot-present runtime never re-enters here;
+            // an adoption starts only a row the live registration does not run.
+            // The API is already listening at this point, so we wire and start
+            // immediately (no deferred start needed). Any failure is swallowed so
+            // the install itself is not rolled back — the runtime is already up.
+            // Gate on the same API-disabled flag as the boot path: when the HTTP API
+            // is off (a test-only seam), the /signals route is never mounted, so
+            // starting scanners would only spawn children that POST to a closed port.
+            if (parsedConfig &&
+                sharedIntakeContext &&
+                process.env.SENPI_RUNTIME_API_DISABLED !== "true") {
+                try {
+                    const apiConfig = loadApiConfig(api.pluginConfig);
+                    const scaffoldPackageDir = fileURLToPath(new URL("./scanners/external", import.meta.url));
+                    hotLauncher = wireRuntime({
+                        runtimeConfig: parsedConfig,
+                        recipeDir,
+                        runtimeId,
+                        wallet,
+                        sharedCtx: sharedIntakeContext,
+                        runtimeHandles,
+                        intakeUrl: intakeUrlFor(apiConfig.host, apiConfig.port),
+                        scaffoldPackageDir,
+                        runtimeStateDir: entryStateDir,
+                        logger: apiLogger,
+                    });
+                    if (hotLauncher) {
+                        const launcher = hotLauncher;
+                        try {
+                            await launcher.start();
+                            launchers.set(runtimeId, launcher);
+                            unwiredRuntimes.delete(runtimeId);
+                            unwiredPhase = undefined;
+                            runtimeHandles.get(runtimeId)?.attachSupervisionSource(() => ({
+                                unwired: false,
+                                rows: launcher.describeSupervision(),
+                            }));
+                        }
+                        catch (startErr) {
+                            await launcher.stop().catch(() => { });
+                            hotLauncher = null;
+                            unwiredRuntimes.set(runtimeId, "install_launch");
+                            unwiredPhase = "install_launch";
+                            runtimeHandles.get(runtimeId)?.attachSupervisionSource(() => ({
+                                unwired: true,
+                                unwiredPhase: "install_launch",
+                                rows: [],
+                            }));
+                            eventScannersUnwired("install_launch", runtimeId, wallet, appendCause("[senpi-runtime] hot-install supervised scanner launch failed — runtime running without it", startErr), startErr);
+                        }
+                    }
+                }
+                catch (wireErr) {
+                    // Wire failure must NOT fail the install — the runtime is already up. It IS reported
+                    // across the result boundary (payload.unwired) so a funding caller can refuse it.
+                    unwiredRuntimes.set(runtimeId, "install_wire");
+                    unwiredPhase = "install_wire";
+                    runtimeHandles.get(runtimeId)?.attachSupervisionSource(() => ({
+                        unwired: true,
+                        unwiredPhase: "install_wire",
+                        rows: [],
+                    }));
+                    eventScannersUnwired("install_wire", runtimeId, wallet, appendCause("[senpi-runtime] hot-install wiring failed — runtime running without supervised scanners", wireErr), wireErr);
+                }
+            }
+            else if (parsedConfig && !sharedIntakeContext && selectScanners(parsedConfig).length > 0) {
+                // Supervised intake is DISABLED for the whole box (corrupt acceptance record).
+                // The wire block above is skipped, so this hot-installed runtime declares
+                // external scanners but has NO live entry scanners. Record that fail-closed
+                // state (state only, no new event) so listRuntimes/health don't lie.
+                unwiredRuntimes.set(runtimeId, "no_intake");
+                unwiredPhase = "no_intake";
+                runtimeHandles.get(runtimeId)?.attachSupervisionSource(() => ({
+                    unwired: true,
+                    unwiredPhase: "no_intake",
+                    rows: [],
+                }));
+            }
+            // ──────────────────────────────────────────────────────────────────────
+            // The stop may have landed during the wire: its teardown then missed the launcher above.
+            if (orphaned())
+                return abandon();
+            return unwiredPhase ? { status: "started", unwiredPhase } : { status: "started" };
+        }
+        /**
+         * Give a runtime an orphaned install (or adoption) started to the live registration
+         * ({@link RuntimeProcessState.runtimeHost}), or queue it for the next service start when no
+         * registration is live. Never throws.
+         */
+        async function handOffRuntime(runtimeId, walletKey) {
+            const host = processState.runtimeHost;
+            if (!host) {
+                // The strategies store is left as it is: a registration that is starting may already run this
+                // row from its boot, and the next start's boot or adoption sets the entry either way.
+                processState.pendingRuntimeHandOffs.set(runtimeId, walletKey);
+                pluginLogger.info("[senpi-runtime] runtime handed to the next service start (no live registration)", { runtimeId });
+                return { outcome: "pending" };
+            }
+            try {
+                return await host.adoptRuntime({ runtimeId, walletKey });
+            }
+            catch (err) {
+                // Nothing runs it: drop the entry the stopped start wrote, so the apps do not draw it.
+                strategiesStore.delete(runtimeId);
+                return { outcome: "failed", message: err instanceof Error ? err.message : String(err) };
+            }
+        }
+        /**
+         * The live registration, when this registration's service has stopped (a 10.x plugin reload)
+         * and another one is running. A deploy job from before the reload keeps this registration's
+         * closures; its deletes and liveness reads go to the registration that holds the runtimes.
+         */
+        function liveHostIfStopped() {
+            if (serviceState !== "stopped")
+                return undefined;
+            const host = processState.runtimeHost;
+            return host && host !== runtimeHost ? host : undefined;
+        }
+        /**
+         * The install result for a runtime this install handed over. A stopped runtime is never
+         * reported as running here: `handedOff` names who runs it, and the result is an error when
+         * nothing does.
+         */
+        function installHandOffResult(handOff, runtime) {
+            switch (handOff.outcome) {
+                case "running":
+                case "booted":
+                    return {
+                        ok: true,
+                        payload: {
+                            ...runtime,
+                            id: handOff.runtimeId,
+                            ...(handOff.unwired ? { unwired: handOff.unwired } : {}),
+                            handedOff: "The runtime plugin's service stopped during this install (a plugin reload or a gateway " +
+                                "stop), so the plugin registration that is running now runs this runtime " +
+                                `(runtime "${handOff.runtimeId}"). Check it: openclaw senpi runtime list.`,
+                        },
+                    };
+                case "pending":
+                    return {
+                        ok: true,
+                        payload: {
+                            ...runtime,
+                            handedOff: "The runtime plugin's service stopped during this install (a plugin reload or a gateway " +
+                                "stop), and no plugin registration had finished starting when it ended. The runtime is " +
+                                "installed; the plugin's service runs it when its start finishes. Check it: " +
+                                "openclaw senpi runtime list.",
+                        },
+                    };
+                case "no-row":
+                    return { ok: false, error: {
+                            code: "UNAVAILABLE",
+                            message: `The runtime plugin's service stopped during this install and runtime "${runtime.id}" is no ` +
+                                "longer in the registry, so nothing runs it. Nothing is trading on this wallet from this " +
+                                "install. Check: openclaw senpi runtime list.",
+                        } };
+                case "failed":
+                    return { ok: false, error: {
+                            code: "UNAVAILABLE",
+                            message: `The runtime plugin's service stopped during this install and the running plugin ` +
+                                `registration could not start runtime "${runtime.id}": ${handOff.message}. It is installed; ` +
+                                "the next restart tries to start it. Check: openclaw senpi runtime list.",
+                        } };
+            }
+        }
+        /**
+         * This registration as the process's {@link RuntimeHost}: published at the end of the service
+         * start, withdrawn at the start of its stop.
+         */
+        const runtimeHost = {
+            async adoptRuntime(request) {
+                const handOff = await adoptRuntimeCore(request);
+                // Nothing runs it here: drop the entry the stopped registration's start wrote (run() sets it,
+                // and that start's abandon does not clear it), so the apps do not draw a strategy that is not
+                // running. A different id on the wallet leaves this id's entry just as stale.
+                if (handOff.outcome === "no-row" ||
+                    handOff.outcome === "failed" ||
+                    (handOff.outcome === "running" && handOff.runtimeId !== request.runtimeId)) {
+                    strategiesStore.delete(request.runtimeId);
+                }
+                return handOff;
+            },
+            deleteRuntime: (params) => deleteRuntimeCore(params),
+            runtimeIsLive: async (id) => runtimeHandles.has(id) && !unwiredRuntimes.has(id),
+            getScannerRows: (id) => readScannerRows(id),
+        };
+        async function adoptRuntimeCore({ runtimeId, walletKey }) {
+            const stopsAtAdopt = serviceStops;
+            const orphaned = () => serviceState !== "running" || serviceStops !== stopsAtAdopt;
+            try {
+                const onWallet = runtimeHandles.has(runtimeId)
+                    ? runtimeId
+                    : walletKey
+                        ? [...runtimeHandles].find(([, h]) => (h.wallet ?? "").trim().toLowerCase() === walletKey)?.[0]
+                        : undefined;
+                if (onWallet !== undefined) {
+                    // The live verdict, as for a start: a runtime running blind is not a clean install.
+                    const unwired = unwiredRuntimes.get(onWallet);
+                    return unwired ? { outcome: "running", runtimeId: onWallet, unwired } : { outcome: "running", runtimeId: onWallet };
+                }
+                const { readRegistry } = await import("./runtime/strategy-registry.js");
+                const entry = (await readRegistry(baseStateDir)).runtimes.find((e) => e.id === runtimeId);
+                if (!entry)
+                    return { outcome: "no-row" };
+                const inputs = factsPlanInputs(entry);
+                if (!inputs)
+                    return { outcome: "failed", message: "its registry row has no readable recipe" };
+                const parsedConfig = await loadRuntimeConfig(inputs.pathOrContent, { fromPath: inputs.fromPath });
+                const started = await startRuntimeLive({
+                    runtimeId: entry.id,
+                    pathOrContent: inputs.pathOrContent,
+                    fromPath: inputs.fromPath,
+                    recipeDir: inputs.runtimeYamlDir,
+                    wallet: entry.wallet ?? "",
+                    parsedConfig,
+                }, orphaned);
+                if (started.status === "orphaned")
+                    return handOffRuntime(runtimeId, walletKey);
+                pluginLogger.info("[senpi-runtime] started a runtime handed over by a stopped registration", {
+                    runtimeId: entry.id,
+                });
+                return started.unwiredPhase
+                    ? { outcome: "booted", runtimeId: entry.id, unwired: started.unwiredPhase }
+                    : { outcome: "booted", runtimeId: entry.id };
+            }
+            catch (err) {
+                return { outcome: "failed", message: err instanceof Error ? err.message : String(err) };
+            }
+        }
         async function installRuntimeCore(params) {
+            // How many times this registration's service had stopped when this install began; see `orphaned` below.
+            const stopsAtInstall = serviceStops;
             const toError = (message) => ({ code: "INVALID_REQUEST", message });
             const toUnavailable = (message) => ({ code: "UNAVAILABLE", message });
             const { readRegistry, writeRegistry, withRegistryLock, validateEntry, hasId, findByWallet, deriveRuntimeId, sanitizeId } = await import("./runtime/strategy-registry.js");
@@ -1496,127 +1889,64 @@ const senpiRuntimePlugin = {
                     const current = await readRegistry(baseStateDir);
                     await writeRegistry(baseStateDir, { ...current, runtimes: [...current.runtimes, entry] });
                 });
-                /**
-                 * The unwired verdict for THIS install, tracked locally rather than read back out of
-                 * `unwiredRuntimes`, so the result reports what this call did and never a leftover verdict
-                 * from an earlier runtime that happened to share the id. Set at each of the three sites that
-                 * leave the runtime without live entry scanners; cleared by the wire-success path.
-                 */
-                let unwiredPhase;
+                // The registration's service stopped since this install began (a 10.x plugin reload): the
+                // runtime belongs to the live registration, so this install hands it over instead of keeping
+                // one in a stopped registration that nothing can stop or delete.
+                const orphaned = () => serviceState === "stopped" || serviceStops !== stopsAtInstall;
+                // Registry create fact — distinct from the runtime.started boot transition (which also fires
+                // on a transient restart). Once per install, as soon as a registration runs the row: right
+                // after run() here, or at the hand-off. Inside emitEvent's guard so telemetry never fails the
+                // install.
+                let createdEmitted = false;
+                const emitCreated = () => {
+                    if (createdEmitted)
+                        return;
+                    createdEmitted = true;
+                    emitEvent(apiLogger, () => buildRuntimeCreatedEvent({ runtimeId: resolvedId, address: wallet, recipeName: runtimeName }));
+                };
+                const handOffInstall = async () => {
+                    const handOff = await handOffRuntime(resolvedId, walletKey);
+                    if (handOff.outcome === "running" || handOff.outcome === "booted" || handOff.outcome === "pending")
+                        emitCreated();
+                    return installHandOffResult(handOff, { id: resolvedId, name: runtimeName, wallet });
+                };
                 try {
-                    const scannerProviders = await createScannerProvidersForRun({
-                        mcpTransport,
-                        apiKey,
-                    });
-                    const entryStateDir = buildRuntimeStateDir(baseStateDir, resolvedId, wallet);
-                    const handle = await run(pathOrContent, {
-                        fromPath: hasPath,
-                        stateDir: entryStateDir,
-                        mcpTransport,
-                        apiKey,
-                        scannerProviders,
+                    // Stopped before the start: do not start a runtime here at all.
+                    if (orphaned())
+                        return await handOffInstall();
+                    const started = await startRuntimeLive({
                         runtimeId: resolvedId,
-                        onStrategyNotActive: (address) => reaper.checkWallet(address),
-                    });
-                    runtimeHandles.set(resolvedId, handle);
-                    // Registry create fact — distinct from the runtime.started boot transition (which also fires
-                    // on a transient restart). Emitted inside emitEvent's guard so telemetry never fails the install.
-                    emitEvent(apiLogger, () => buildRuntimeCreatedEvent({ runtimeId: resolvedId, address: wallet, recipeName: runtimeName }));
-                    // ── hot-install supervised scanner wire ───────────────────────────────
-                    // Live-install path: used when a runtime is registered after boot via
-                    // senpi.installRuntime, while the API is already listening — the
-                    // counterpart to the boot-time `launcher` above. A runtime takes exactly
-                    // one path: boot-present → `launcher` (deferred start); installed live →
-                    // `hotLauncher` (immediate start). The two are mutually exclusive because
-                    // installRuntime rejects any id/wallet already in the registry before
-                    // wiring (the hasId guard), so a boot-present runtime never re-enters here.
-                    // The API is already listening at this point, so we wire and start
-                    // immediately (no deferred start needed). Any failure is swallowed so
-                    // the install itself is not rolled back — the runtime is already up.
-                    // Gate on the same API-disabled flag as the boot path: when the HTTP API
-                    // is off (a test-only seam), the /signals route is never mounted, so
-                    // starting scanners would only spawn children that POST to a closed port.
-                    if (parsedConfig &&
-                        sharedIntakeContext &&
-                        process.env.SENPI_RUNTIME_API_DISABLED !== "true") {
-                        try {
-                            const apiConfig = loadApiConfig(api.pluginConfig);
-                            const scaffoldPackageDir = fileURLToPath(new URL("./scanners/external", import.meta.url));
-                            const entryStateDir = buildRuntimeStateDir(baseStateDir, resolvedId, wallet);
-                            const hotLauncher = wireRuntime({
-                                runtimeConfig: parsedConfig,
-                                recipeDir: hasPath ? dirname(pathOrContent) : runtimeYamlDir,
-                                runtimeId: resolvedId,
-                                wallet,
-                                sharedCtx: sharedIntakeContext,
-                                runtimeHandles,
-                                intakeUrl: intakeUrlFor(apiConfig.host, apiConfig.port),
-                                scaffoldPackageDir,
-                                runtimeStateDir: entryStateDir,
-                                logger: apiLogger,
-                            });
-                            if (hotLauncher) {
-                                try {
-                                    await hotLauncher.start();
-                                    launchers.set(resolvedId, hotLauncher);
-                                    unwiredRuntimes.delete(resolvedId);
-                                    unwiredPhase = undefined;
-                                    runtimeHandles.get(resolvedId)?.attachSupervisionSource(() => ({
-                                        unwired: false,
-                                        rows: hotLauncher.describeSupervision(),
-                                    }));
-                                }
-                                catch (startErr) {
-                                    await hotLauncher.stop().catch(() => { });
-                                    unwiredRuntimes.set(resolvedId, "install_launch");
-                                    unwiredPhase = "install_launch";
-                                    runtimeHandles.get(resolvedId)?.attachSupervisionSource(() => ({
-                                        unwired: true,
-                                        unwiredPhase: "install_launch",
-                                        rows: [],
-                                    }));
-                                    eventScannersUnwired("install_launch", resolvedId, wallet, appendCause("[senpi-runtime] hot-install supervised scanner launch failed — runtime running without it", startErr), startErr);
-                                }
-                            }
-                        }
-                        catch (wireErr) {
-                            // Wire failure must NOT fail the install — the runtime is already up. It IS reported
-                            // across the result boundary (payload.unwired) so a funding caller can refuse it.
-                            unwiredRuntimes.set(resolvedId, "install_wire");
-                            unwiredPhase = "install_wire";
-                            runtimeHandles.get(resolvedId)?.attachSupervisionSource(() => ({
-                                unwired: true,
-                                unwiredPhase: "install_wire",
-                                rows: [],
-                            }));
-                            eventScannersUnwired("install_wire", resolvedId, wallet, appendCause("[senpi-runtime] hot-install wiring failed — runtime running without supervised scanners", wireErr), wireErr);
-                        }
-                    }
-                    else if (parsedConfig && !sharedIntakeContext && selectScanners(parsedConfig).length > 0) {
-                        // Supervised intake is DISABLED for the whole box (corrupt acceptance record).
-                        // The wire block above is skipped, so this hot-installed runtime declares
-                        // external scanners but has NO live entry scanners. Record that fail-closed
-                        // state (state only, no new event) so listRuntimes/health don't lie.
-                        unwiredRuntimes.set(resolvedId, "no_intake");
-                        unwiredPhase = "no_intake";
-                        runtimeHandles.get(resolvedId)?.attachSupervisionSource(() => ({
-                            unwired: true,
-                            unwiredPhase: "no_intake",
-                            rows: [],
-                        }));
-                    }
-                    // ──────────────────────────────────────────────────────────────────────
+                        pathOrContent,
+                        fromPath: hasPath,
+                        recipeDir: hasPath ? dirname(pathOrContent) : runtimeYamlDir,
+                        wallet,
+                        parsedConfig,
+                    }, orphaned, emitCreated);
+                    if (started.status === "orphaned")
+                        return await handOffInstall();
                     return {
                         ok: true,
                         payload: {
                             id: resolvedId,
                             name: runtimeName,
                             wallet,
-                            ...(unwiredPhase ? { unwired: unwiredPhase } : {}),
+                            ...(started.unwiredPhase ? { unwired: started.unwiredPhase } : {}),
                         },
                     };
                 }
                 catch (err) {
+                    // run() threw after this registration's service stopped: the live registration may already
+                    // run this row (its boot read it), so it decides, not this catch. It runs it, or starts it,
+                    // or (no registration live yet) the next start does; only when it cannot start the row
+                    // either is the row removed, as below for an install with no reload.
+                    if (orphaned()) {
+                        const handOff = await handOffRuntime(resolvedId, walletKey);
+                        if (handOff.outcome !== "failed") {
+                            if (handOff.outcome !== "no-row")
+                                emitCreated();
+                            return installHandOffResult(handOff, { id: resolvedId, name: runtimeName, wallet });
+                        }
+                    }
                     await withRegistryLock(baseStateDir, async () => {
                         const current = await readRegistry(baseStateDir);
                         await writeRegistry(baseStateDir, { ...current, runtimes: current.runtimes.filter((e) => e.id !== resolvedId) });
@@ -1681,6 +2011,12 @@ const senpiRuntimePlugin = {
          * unwired-verdict cleanup all happen exactly once, here.
          */
         async function deleteRuntimeCore(params) {
+            // This registration's service stopped (a 10.x reload) and holds no runtimes; the live one does.
+            // A delete from here (a deploy job from before the reload) would remove the row and archive the
+            // state dir under a runtime that keeps trading.
+            const live = liveHostIfStopped();
+            if (live)
+                return live.deleteRuntime(params);
             let targetId = typeof params?.id === "string" ? params.id : undefined;
             const targetAddress = typeof params?.address === "string" ? params.address : undefined;
             // Set only by the lifecycle reaper: why the strategy counts as gone (stamped on runtime.deleted)
@@ -1918,7 +2254,7 @@ const senpiRuntimePlugin = {
          * the strategy id is read for this one wallet; a failed read logs its reason and sends nothing.
          */
         function queueFactsSend(runtimeId, strategyIds) {
-            return factsSendLock.withKeyLock(runtimeId, async () => {
+            return factsSendLock().withKeyLock(runtimeId, async () => {
                 const { readRegistry } = await import("./runtime/strategy-registry.js");
                 const entry = (await readRegistry(baseStateDir)).runtimes.find((e) => e.id === runtimeId);
                 const inputs = entry ? factsPlanInputs(entry) : null;
@@ -2177,18 +2513,20 @@ const senpiRuntimePlugin = {
             },
             registryFindByWallet: findRegistryEntryByWallet,
             registryFindById: findRegistryEntryById,
-            getScannerRows: readScannerRows,
+            // A deploy job outlives a reload; it reads the runtime where it runs (see `liveHostIfStopped`).
+            getScannerRows: (id) => liveHostIfStopped()?.getScannerRows(id) ?? readScannerRows(id),
             // H4: `runtimeHandles` holds the live `run()` handles. A registry row without one is a
             // previous install whose runtime died before start — deploy must reinstall, not report it
             // adopted. `unwiredRuntimes` is the same judgement one step further in: a runtime that is up
             // but whose entry scanners never wired is running BLIND (the health surface already renders
             // it "running — NO ENTRY SCANNERS"), and reporting `install: skipped` over it would be the
             // same clean line over a runtime that cannot tick.
-            runtimeIsLive: async (id) => runtimeHandles.has(id) && !unwiredRuntimes.has(id),
+            runtimeIsLive: async (id) => liveHostIfStopped()?.runtimeIsLive(id) ?? (runtimeHandles.has(id) && !unwiredRuntimes.has(id)),
             installPendingOnWallet: async (wallet) => installsInFlight.has(wallet.trim().toLowerCase()),
+            // The process logger, not this registration's: a deploy job outlives a reload.
             logger: {
-                info: (line) => api.logger.info(`[senpi-runtime] ${line}`),
-                warn: (line) => api.logger.warn(`[senpi-runtime] ${line}`),
+                info: (line) => processLog.info(`[senpi-runtime] ${line}`),
+                warn: (line) => processLog.warn(`[senpi-runtime] ${line}`),
             },
         });
         /**
@@ -2392,7 +2730,7 @@ const senpiRuntimePlugin = {
                     respond(true, {
                         status: status ? { ...status, runtimeId } : null,
                         updater,
-                        approvals: approvalsHostStatus,
+                        approvals: approvalsStatus(),
                         deploy: { capabilities: DEPLOY_CAPABILITIES },
                     });
                 }
@@ -2406,7 +2744,7 @@ const senpiRuntimePlugin = {
                 return;
             }
             const statuses = await collectRuntimeHealthStatuses(runtimeHandles, api.logger);
-            respond(true, { statuses, updater, approvals: approvalsHostStatus, deploy: { capabilities: DEPLOY_CAPABILITIES } });
+            respond(true, { statuses, updater, approvals: approvalsStatus(), deploy: { capabilities: DEPLOY_CAPABILITIES } });
         }, { scope: "operator.read" });
         api.registerGatewayMethod("senpi.getSystemState", async (ctx) => {
             const respond = ctx.respond;