@senpi/runtime 3.0.59 → 3.0.63

package/dist/deploy/orchestrator.js

@@ -0,0 +1,2910 @@
+/**
+ * The `senpi deploy` state machine.
+ *
+ * `runDeploy` is a pure, sequential orchestration over injected collaborators:
+ * it performs no I/O of its own beyond reading the package's own YAML, holds no
+ * timers, and never touches the job slot, the journal, or the gateway. Every
+ * async concern lives in `job.ts`, so this whole flow tests on fakes and a
+ * virtual clock.
+ *
+ * Two rules shape the design and must survive every edit:
+ *  - **Decisions read live surfaces only** — backend strategies and the runtime
+ *    registry. Emitted events are narration; a throwing `emit` cannot alter the
+ *    flow, and nothing ever reads a journal back to decide anything. Exactly one
+ *    carve-out exists: the journal may supply a *lookup key* (a strategyId this
+ *    box journaled at create time, `params.priorStrategyIds`) that is always
+ *    verified against the live backend before use — never a decision.
+ *  - **Abandonment is honored at step boundaries and between poll iterations
+ *    only** — never mid-MCP-call, so money-moving calls are never left in a
+ *    half-known state. The deadline watchdog in `job.ts` is the only thing that
+ *    raises it (there is no cancel verb: undeploying is closing the strategy).
+ *    Nothing is rolled back **except the one D-6 case: a wallet this job created
+ *    whose install then failed**; the report says what completed.
+ */
+import { join } from "node:path";
+import { buildUniverseNotLiveRefusal, buildUniverseUnavailableDetail, checkPackageUniverse, describeUniverseVerdict, } from "../universe/package-universe.js";
+import { describeScannerEnabledOffense, instancesWithoutDslExit, lowercasePackageIdFix, nonLowercasePackageId, renderRuntimeYaml, runtimeUsesLlmDecisions, readRuntimeYaml, sanitizeStrategyName, scannersDeclaringEnabled, walletName, } from "./package.js";
+import { CLOSING_STATUSES, DEAD_STATUSES, INITIALIZING_STATUSES, isDead, isInitializing, } from "../senpi/strategy-status.js";
+import { MIN_WALLET, accessibleUsd, budgetArg, planFunding, resumeCommand, underfundedNote, usd, } from "./funding.js";
+import { deployPyValidateCommand, PROOF_ROUTE_NOTE, recheckBlock, validateCommand, } from "./recheck-commands.js";
+import { DEFAULT_MAX_WAIT_SEC, DEFAULT_TICK_WAIT_SEC } from "./deadlines.js";
+import { packageMinBudget } from "./min-budget.js";
+import { errorText } from "./error-text.js";
+import { gateInstance } from "./install-gate-runner.js";
+import { buildInstanceDirCollisionRefusal, buildProofRefusal, checkPackageProof, collidingInstanceDirs, proofRefusalParts, } from "./proof-gate.js";
+const CREATE_POLL_MS = 10_000;
+const OBSERVE_POLL_MS = 5_000;
+const STEP_ORDER = ["reconcile", "preflight", "create", "install", "observe"];
+/**
+ * Backend codes that mean "the name is unusable", not "the deploy is unfundable" — see
+ * {@link isNameRejection}. Spelled out one per entry rather than packed into a character class
+ * (`SERR05[568]`) because the reader who arrives here arrives holding a code: a grep for the exact
+ * string they were handed has to land on this list.
+ *
+ * SERR083 belongs here despite its generic text ("Custom strategy creation failed unexpectedly.
+ * Retry with the same payload."), which carries neither a name-ish code nor the word "name": a
+ * strategy stuck in PENDING_FUNDING keeps holding its strategyName, and every create reusing that
+ * name 500s until the record expires ~15 minutes later. Retrying the SAME payload — precisely what
+ * the error itself advises — can never clear it; dropping the name clears it instantly. Observed on
+ * a real deploy, two calls 3.6s apart at the same $693 budget:
+ *     {initialBudget: 693, strategyName: "vanguard-long"}  → SERR083
+ *     {initialBudget: 693}                                 → success
+ * It also failed at $100 with the name, ruling out any funding cause. So do not drop this entry on
+ * the grounds that the message reads like a generic backend failure — that reading is the bug, and
+ * it already cost this guard once when the money path moved out of deploy.py.
+ */
+const NAME_REJECTION_CODES = ["SERR055", "SERR056", "SERR058", "SERR083"];
+/**
+ * True when a failed create is the backend refusing the wallet NAME, so retrying unnamed works.
+ *
+ * The bare-word `name` arm is deliberately kept alongside the enumerated codes: every code above
+ * was learned from an incident, one at a time, and this arm is what covers the next one before it
+ * has a number. Weigh dropping it against the failure that leaves: a name collision reported as a
+ * hard deploy failure, stranding the user for ~15 minutes with no action that helps.
+ *
+ * What a false positive COSTS depends on whether the create it retries actually landed, and this
+ * predicate cannot tell — nor can its caller, in every case:
+ *
+ *   - The backend said no. The ordinary shape, and the harmless one: nothing was created, so the
+ *     retry costs legibility (the wallet lands under a backend-assigned name) and nothing else. It
+ *     carries the same budget and the same attribution, so it cannot change what gets funded.
+ *   - Nobody knows. `callCreate` turns EVERY throw into `success: false`, so a transport error
+ *     raised after the request was already written — a socket reset, a 502, a gateway-injected
+ *     transport failing mid-call (senpi/client.ts `callToolInner`) — arrives here shaped exactly
+ *     like a refusal. If its text matches, the retry runs against a create that may already have
+ *     funded a wallet, and funds a second one beside it. A call abandoned at its deadline is one
+ *     member of this class, not the whole of it — merely the one `callCreate` flags (`aborted`).
+ *
+ * Nothing excludes that second class today, and no arm of this predicate can. The deadline text is
+ * fixed and carries neither a code nor "name" (`abortedCallError`), but a transport error's text is
+ * authored outside this repo and the transport is called with the create's own arguments — the
+ * literal key `strategyName` among them — so any transport that echoes the failed request matches.
+ * This exposure is unchanged from the regex this replaced, byte for byte; it is written down here
+ * because the fix is not the obvious one. The exclusion worth building is "the failure came from a
+ * THROW", not `!aborted` — and even that needs care, because a throw raised BEFORE the request went
+ * out (connection refused) is a case where retrying is perfectly safe. Telling pre-send from
+ * post-send is the actual work, and the reason it belongs in its own change rather than here.
+ *
+ * Matching stays case-INSENSITIVE on the codes as well as the word, which the regex this replaced
+ * was: the backend spells them upper-case today, and nothing here is worth losing the unblock over
+ * if some relay downcases a message. (deploy.py compared the codes case-sensitively; that is the
+ * one deliberate difference, and it is in the direction of firing more often, never less.)
+ */
+function isNameRejection(message) {
+    const upper = message.toUpperCase();
+    return NAME_REJECTION_CODES.some((code) => upper.includes(code)) || upper.includes("NAME");
+}
+const ABANDONED_DETAIL = "abandoned at the deploy deadline — the job exceeded its wall-clock cap";
+/** Ticks that prove the scanner executed; `ok` literally means "found a signal", so heartbeat counts. */
+const OBSERVED_RUN_STATUSES = ["ok", "heartbeat"];
+function isFreshTick(row, sinceMs) {
+    if (row.scheduleMode === "external") {
+        // C1: intake short-circuits empty POSTs before run telemetry, so a watch-only external
+        // scanner never records a lastRunStatus. lastAliveAt is id-keyed and advances every POST.
+        return row.lastAliveAt !== null && row.lastAliveAt >= sinceMs;
+    }
+    return (row.lastRunStatus !== null &&
+        OBSERVED_RUN_STATUSES.includes(row.lastRunStatus) &&
+        row.lastRunFinishedAt !== null &&
+        row.lastRunFinishedAt >= sinceMs // H3: pre-install telemetry survives a re-mint
+    );
+}
+function isFreshError(row, sinceMs) {
+    return (row.lastRunStatus === "error" &&
+        row.lastRunFinishedAt !== null &&
+        row.lastRunFinishedAt >= sinceMs);
+}
+/** deploy.py's `_budget_verdict` tolerance: below this fraction of the ask, say so out loud. */
+const BUDGET_TOLERANCE = 0.9;
+/**
+ * Did the D-6 rollback's `strategy_close` actually run? Returns the reason it did not, or null when
+ * the close is PROVEN — only an explicit `success: true` proves it.
+ *
+ * The client resolves a tool-level `strategy_close` failure as `{ success: false }` and maps an
+ * unrecognizable payload onto that same shape (senpi/client.ts); it throws only on an RPC fault. So
+ * "the promise resolved" is not evidence, and reading it as one reported funds returned from a
+ * wallet that is still live and still funded.
+ */
+function describeCloseFailure(result) {
+    const record = typeof result === "object" && result !== null
+        ? result
+        : undefined;
+    if (record?.success === true)
+        return null;
+    const message = typeof record?.message === "string" && record.message.length > 0
+        ? record.message
+        : "";
+    return message
+        ? `\`strategy_close\` reported failure: ${message}`
+        : `\`strategy_close\` did not report success (it returned ${JSON.stringify(result) ?? String(result)})`;
+}
+/**
+ * A call this job stopped waiting on at its own deadline, as opposed to one the backend failed.
+ * `boundAwait` (senpi/client.ts) names those `AbortError`; the self-managed MCP transport surfaces
+ * the same shape as a `TimeoutError`. The distinction is load-bearing on the money path: a failure
+ * means nothing happened, an abandonment means nobody knows — and the two must not read alike.
+ */
+function isDeadlineAbort(err) {
+    return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
+}
+/** The provenance clause every reconcile message carries, so a report never hides how it matched. */
+function matchedByClause(matchedBy) {
+    return matchedBy === "created-key" ? " (matched by journaled create key, verified against the backend)" : "";
+}
+/**
+ * The other live strategies that answered to the matched name and were dropped as another
+ * package's. A bind that ignored one is still a bind on a CONTESTED name — the collision outlives
+ * this deploy and surfaces again at the next `close.py`, rename, or status read — so the report
+ * says so rather than rendering a clean "matched by name". It is a note, not a warning: nothing
+ * here is this package's to act on, which is the same reason those rows were dropped.
+ */
+function foreignCollisionClause(ignoredForeign) {
+    if (ignoredForeign.length === 0)
+        return "";
+    const stamps = [...new Set(ignoredForeign.map((s) => s.skillName?.trim()).filter((v) => !!v))];
+    const whose = stamps.length > 0 ? stamps.map((s) => `"${s}"`).join(", ") : "another package";
+    const plural = ignoredForeign.length === 1 ? "y" : "ies";
+    return (` — note: ${ignoredForeign.length} other live strateg${plural} of the same name ` +
+        `${ignoredForeign.length === 1 ? "is" : "are"} stamped for ${whose} and ${ignoredForeign.length === 1 ? "was" : "were"} ` +
+        `left untouched`);
+}
+function buildAmbiguousRefusal(count, matchedAs, instance) {
+    return (`[E_STATE_AMBIGUOUS_WALLETS] ${count} live strategies ${matchedAs} — cannot resolve ` +
+        `which wallet belongs to instance "${instance}". Read-only triage first (openclaw senpi status / ` +
+        `strategy_list), clear the ambiguity with the user. NEVER close or recreate to "start clean".`);
+}
+/**
+ * A single live name-match whose wallet address cannot be read. deploy.py refused this case rather
+ * than guessing, and the taxonomy's `E_STATE_AMBIGUOUS_WALLETS` row names it explicitly: the strategy
+ * may be funded and live, so neither adopting a blank address nor creating a second wallet is safe.
+ */
+function buildUnreadableWalletRefusal(strategyName, instance, strategyId) {
+    // An id the backend did not report is stated as unreadable, never rendered as the blank in
+    // "(id )" — the same rule the wallet address in this very refusal is subject to. A reader who
+    // sees an empty parenthetical cannot tell a missing id from a rendering bug.
+    const id = strategyId?.trim() ? `id ${strategyId.trim()}` : "id unreadable";
+    return (`[E_STATE_AMBIGUOUS_WALLETS] Live strategy "${strategyName}" (${id}) matches instance ` +
+        `"${instance}" but its wallet address is unreadable — cannot resolve which wallet this instance ` +
+        `owns, and it may be funded and live. Nothing was created or changed. Read-only triage first ` +
+        `(openclaw senpi status / strategy_list), clear the ambiguity with the user. NEVER close or recreate to ` +
+        `"start clean".`);
+}
+/**
+ * The `create: skipped` detail for an adopted wallet.
+ *
+ * When a budget was requested, this is the only place the report can say that it was **not**
+ * applied — deploy never adds funds to a wallet that already exists, and a silent skip would let an
+ * agent summarise "deployed spider with $500" over a wallet holding $100.
+ */
+/**
+ * How a backend `totalFunded` read renders in prose.
+ *
+ * An unreadable figure is stated as unreadable, never as `$0.00`. Every sentence that quotes this
+ * number sits beside an instruction about money, and the two cases call for opposite next steps: a
+ * genuine zero says "there is nothing on this wallet", an unread one says "nobody knows yet".
+ */
+function fundedClause(amount) {
+    return amount === undefined ? "with no readable funded amount reported" : `funded ${usd(amount)}`;
+}
+/** `its $60.00` / `its balance` — the possessive form of the same rule. */
+function itsFunded(amount) {
+    return amount === undefined ? "its balance" : `its ${usd(amount)}`;
+}
+/**
+ * The rollback voice of {@link fundedClause}: `funded $250.00` / the unread form.
+ *
+ * Both sentences it feeds order money moves on the wallet they name — "closing it and returning the
+ * funds", "Reclaim the funds from THIS wallet" — so a `?? 0` here told the reader to reclaim from a
+ * wallet the same sentence called empty, which reads as "nothing to reclaim, skip it" over money
+ * that is genuinely out there. UNKNOWN, never $0.00.
+ */
+function rollbackFundedClause(amount) {
+    return amount === undefined
+        ? `funded an amount that was unreadable at deploy time (UNKNOWN, never zero — verify the ` +
+            `wallet's balance)`
+        : `funded ${usd(amount)}`;
+}
+function buildAdoptedWalletDetail(pkg, inst, matched, wallet, budget, matchedBy = "name") {
+    const how = matchedBy === "created-key" ? "matched by journaled create key, verified against the backend" : "strategyName match";
+    const base = `reusing ${matched.status} wallet ${wallet} (${how}), ${fundedClause(matched.totalFunded)}`;
+    if (budget === undefined)
+        return base;
+    const share = inst.fundingShare ?? 1 / pkg.instances.length;
+    const intended = Math.max(MIN_WALLET, Math.round(budget * share * 100) / 100);
+    // An unread figure is not a comparison input. Collapsing it to 0 made this line say "the
+    // requested $500 was NOT added — top it up, or close this strategy first" about a wallet the
+    // clause above calls unreadable, and it put a second money authority on a report whose
+    // [W_BUDGET_FUNDED_UNREADABLE] already says "Move no money on this". Nothing is steered from a
+    // number nobody read: state the gap as UNKNOWN and defer to the balance being established.
+    if (matched.totalFunded === undefined) {
+        return (`${base} — deploy never funds an existing wallet, and whether the ${usd(intended)} requested ` +
+            `for this instance is already on it is UNKNOWN here (unreadable is never zero). No money move ` +
+            `follows from this read: establish the wallet's actual balance with the USER first, and only ` +
+            `then decide whether anything needs topping up or resizing.`);
+    }
+    if (matched.totalFunded >= intended * BUDGET_TOLERANCE)
+        return base;
+    return (`${base} — the requested ${usd(intended)} for this instance was NOT added; deploy never funds an ` +
+        `existing wallet. To add funds, top it up separately; to deploy at the requested size, close this ` +
+        `strategy first and re-run.`);
+}
+/**
+ * A live name-match in a status that is neither ACTIVE nor on its way there — PAUSED, mid-teardown,
+ * or something this verb does not recognise.
+ *
+ * Polling these is the bug this builder exists to prevent: a PAUSED strategy never becomes ACTIVE on
+ * its own, so waiting on it burns the whole `--max-wait` and then reports "wallet still funding",
+ * which is both untrue and unactionable. The next step is computed from the status actually read,
+ * and the non-destructive option always leads.
+ */
+function buildNotDeployableRefusal(matched, instance, pkg, budget) {
+    const status = matched.status.toUpperCase();
+    const head = `[INVALID_REQUEST] Live strategy "${matched.strategyName}" (id ${matched.id}) matches instance ` +
+        `"${instance}" but its status is ${matched.status} — `;
+    const rerun = `re-run \`${resumeCommand(pkg.dir, budget)}\``;
+    if (status === "PAUSED") {
+        return (`${head}a paused strategy cannot be deployed onto, and it will not become ACTIVE on its own. ` +
+            `Nothing was created. Resume it first, then ${rerun}. If you meant to start over instead, tear ` +
+            `this one down with \`python3 senpi-strategy-ops/scripts/close.py '${pkg.id}'\` (that returns its ` +
+            `funds) before re-running — never leave it paused and fund a second wallet beside it.`);
+    }
+    if (CLOSING_STATUSES.includes(status)) {
+        return (`${head}it is being torn down. Nothing was created. Wait for it to reach CLOSED (re-check with ` +
+            `\`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\`), then ${rerun} — the re-run will ` +
+            `create a fresh wallet once this one is gone.`);
+    }
+    return (`${head}deploy cannot proceed from that state and will not guess. Nothing was created. Read-only ` +
+        `triage first (openclaw senpi status / strategy_list) to find out why it is ${matched.status}, then ${rerun} ` +
+        `once it is ACTIVE. NEVER close or recreate to "start clean".`);
+}
+function buildBudgetRequiredRefusal(wallets, pkg) {
+    return (`[INVALID_REQUEST] --budget is required to create ${wallets} wallet(s) ` +
+        `(min ${usd(MIN_WALLET)}/wallet). Nothing was created. Re-run: ${resumeCommand(pkg.dir)}`);
+}
+/**
+ * `--budget 0` is not "no budget": it parses, and without this gate `planFunding` floors every
+ * wallet to MIN_WALLET — funding money the user never asked to spend. `--budget ≤ $0` is also the
+ * taxonomy's rule-4 field case: its only known source in the field is a buggy computed hint, so the
+ * refusal teaches where the real fix lives instead of letting that loop run. The same gate exists
+ * at gateway intake (register.ts), keeping every caller of `runDeploy` covered.
+ */
+function buildBudgetNotPositiveRefusal(budget, wallets, pkg) {
+    return (`[INVALID_REQUEST] --budget must be a positive USD amount: ${usd(budget)} cannot fund ` +
+        `${wallets} wallet(s) (min ${usd(MIN_WALLET)}/wallet). Nothing was created. If a report ` +
+        `suggested \`--budget ${budgetArg(budget)}\`, that hint was a bug, not an instruction — a ` +
+        `sleeve declaring \`funding_share: 0\` is fixed by giving it a share in strategy.yaml, never ` +
+        `by re-deploying. Re-run: ${resumeCommand(pkg.dir)}`);
+}
+/** `scalp $12.00 (needs $13.50)` — both numbers, so the claim is checkable. */
+function renderUnderfunded(under) {
+    return under.map((row) => `${row.wallet} ${usd(row.funded)} (needs ${usd(row.needs)})`).join(", ");
+}
+/**
+ * The budget a re-run scoped to exactly `under` would need, given how `planFunding` will split it:
+ * each sleeve gets its declared share, or an even slice of however many are being redeployed.
+ * COMPUTED, never templated — the taxonomy's rule 4 exists because a hint that can be nonsense for
+ * some state is a bug, and "deploy at the package minimum" is nonsense when only one sleeve is
+ * being replaced.
+ */
+function budgetToCover(rerunFunds, pkg, min) {
+    // A declared share of 0 is kept verbatim by `sharesOf`, so that wallet is floored at MIN_WALLET
+    // at EVERY budget — no number satisfies it, and including one in the max would send this to
+    // Infinity. Such a sleeve never shapes the TARGET (the fix is the manifest, not the budget — see
+    // `zeroShareSentence`), but when the re-run will fund it anyway (it has no wallet) it stays in
+    // `rerunFunds` and so in the even-split DENOMINATOR: `planFunding` divides evenly over every
+    // wallet being funded, zero-share ones included, and a hint sized against a smaller split
+    // under-hints the agent straight back into this warn. (An ABSENT share is different — it becomes
+    // an even slice, which does scale.)
+    const scalable = rerunFunds.filter((name) => pkg.instances.find((i) => i.name === name)?.fundingShare !== 0);
+    if (scalable.length === 0)
+        return 0;
+    const evenShare = 1 / rerunFunds.length;
+    const needsOf = new Map(min.breakdown.map((row) => [row.wallet, row.perWalletMin]));
+    const worst = scalable.reduce((most, name) => {
+        const declared = pkg.instances.find((inst) => inst.name === name)?.fundingShare;
+        const share = declared !== null && declared !== undefined && declared > 0 ? declared : evenShare;
+        return Math.max(most, (needsOf.get(name) ?? 0) / share);
+    }, 0);
+    // Ceil to whole cents so `budget × share` clears the requirement BEFORE `planFunding`'s round2.
+    return Math.ceil(worst * 100) / 100;
+}
+/**
+ * The fix-the-manifest sentence for `funding_share: 0` sleeves — the one shortfall this escape can
+ * NEVER remediate. `planFunding` keeps a declared 0 verbatim, so the wallet is floored at
+ * MIN_WALLET at every budget: closing it and re-deploying bigger funds it straight back at the
+ * floor, which is the destructive no-op loop the close command must not offer. When such a sleeve
+ * is the ONLY short one, this sentence IS the whole escape — deliberately with nothing to run.
+ */
+function zeroShareSentence(names) {
+    const one = names.length === 1;
+    return (`Sleeve${one ? "" : "s"} ${names.join(", ")} declare${one ? "s" : ""} \`funding_share: 0\`, so ` +
+        `NO budget can lift ${one ? "it" : "them"} above the ${usd(MIN_WALLET)} floor and closing/` +
+        `re-deploying cannot change that — the fix is a share in strategy.yaml, not more money.`);
+}
+/**
+ * How `[E_ROLLBACK_INCOMPLETE]` should finish its sentence, given what else is live on this package.
+ *
+ * The stranded wallet has no runtime, so `close.py --instance` cannot resolve it — the only
+ * per-wallet route is a direct `strategy_close` on the address, which the caller states first. What
+ * this adds is whether the package-wide `close.py <id>` is a safe convenience or a trap: it is fine
+ * when this stranded wallet is all that exists, and destructive the moment another sleeve is live,
+ * because it would take that one down too while "reclaiming" this one.
+ */
+function buildStrandedCloseCaveat(pkg, runs, stranded) {
+    const otherLive = runs.filter((run) => run !== stranded && run.report.wallet && !run.report.rolledBack);
+    // `pkg.id` is quoted the way `--instance` is: these strings are copied into a shell verbatim.
+    if (otherLive.length === 0) {
+        return (`. Nothing else in this package is live, so \`python3 senpi-strategy-ops/scripts/close.py ` +
+            `'${pkg.id}'\` is equivalent and safe here.`);
+    }
+    return (`. Do NOT reach for \`close.py '${pkg.id}'\` to do it: ${otherLive.length} other sleeve(s) ` +
+        `(${otherLive.map((run) => run.inst.name).join(", ")}) hold live funded wallets and that ` +
+        `command would close them too. Read them first if you need context: ` +
+        `\`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\`.`);
+}
+/** Instance names a re-run of this package would have to fund: everything without a live wallet. */
+function walletlessAfter(pkg, runs) {
+    const held = new Set(runs.filter((run) => run.report.wallet && !run.report.rolledBack).map((run) => run.inst.name));
+    return pkg.instances.map((inst) => inst.name).filter((name) => !held.has(name));
+}
+/**
+ * The close-then-redeploy escape — the ONLY sequence that actually raises a deployed wallet's size.
+ *
+ * A bare re-run at a bigger `--budget` is a guaranteed no-op: reconcile matches the strategy by
+ * name, ADOPTS it, skips create, and answers with `buildAdoptedWalletDetail`'s "the requested … was
+ * NOT added". The agent then has to reverse-engineer the real step from a message it did not
+ * expect, and the two likeliest readings are "the deploy failed" and "close it to start clean".
+ *
+ * SCOPED to the underfunded sleeves. `close.py <id>` tears down the WHOLE package, so on a
+ * partially-adopted deploy it would close the adopted, live, funded sleeve that this warn is not
+ * even about — the "close-to-replace teardown" class the taxonomy's rule 5 exists to prevent.
+ * `--instance` narrows it, and is only omitted when every sleeve in the package really is affected.
+ *
+ * `existing` is the subset of `under` whose wallets ACTUALLY EXIST on the finished report. An empty
+ * one yields no escape at all: on a deploy that failed before create there is no "it" to close, and
+ * offering a teardown for a wallet that was never made is a false premise plus a pointless step.
+ */
+function buildBudgetEscape(pkg, min, state) {
+    // E_ROLLBACK_INCOMPLETE owns the remediation wherever it appears. It names a stranded funded
+    // wallet and the command to reclaim it; a second close instruction beside it — scoped differently,
+    // and unrunnable besides — is a report contradicting itself, and an agent reconciling the two
+    // picks whichever one executes. Defer, and say who to follow.
+    if (state.rollbackIncomplete) {
+        return (` Deal with the [E_ROLLBACK_INCOMPLETE] line on this report FIRST — it owns the cleanup here, ` +
+            `and its instruction is the one to follow. Re-size only once that wallet is settled.`);
+    }
+    // A wallet with no runtime cannot be closed by instance at all: `close.py --instance` resolves the
+    // sleeve THROUGH its runtime and hard-exits without one, telling the reader to "omit --instance to
+    // close all of <id>" — the whole-package teardown of any adopted sleeve beside it. Never emit a
+    // command whose precondition this report does not meet; point at read-only triage instead.
+    if (state.strandedNames.length > 0) {
+        // Deliberately names NO teardown command. Per-sleeve teardown resolves the sleeve through its
+        // runtime, which these wallets do not have; the package-wide form would take down every sleeve
+        // including any adopted live one. The only command here is read-only, so there is nothing to
+        // copy that could destroy anything.
+        return (` Re-sizing is NOT safe to automate on this report: wallet(s) ${state.strandedNames.join(", ")} ` +
+            `were funded but no runtime was installed on them, which is the one state a per-sleeve teardown ` +
+            `cannot resolve — and a package-wide one would take down every other sleeve with it, adopted ` +
+            `live ones included. Triage read-only first: ` +
+            `\`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\`, then decide with the user.`);
+    }
+    // A zero-share short sleeve is not remediable by this escape AT ALL — no budget moves it off the
+    // floor (see `zeroShareSentence`) — so it never reaches `closable` and never shapes the hint's
+    // target. When it is the only short sleeve, the manifest sentence is the entire escape.
+    const zeroShareNote = state.zeroShare.length > 0 ? ` ${zeroShareSentence(state.zeroShare)}` : "";
+    if (state.closable.length === 0)
+        return zeroShareNote;
+    // The id and the package dir are quoted the way `--instance` is: shell input, copied verbatim.
+    const wholePackage = state.closable.length === pkg.instances.length;
+    const closeCmd = wholePackage
+        ? `python3 senpi-strategy-ops/scripts/close.py '${pkg.id}'`
+        : state.closable
+            .map((name) => `python3 senpi-strategy-ops/scripts/close.py '${pkg.id}' --instance '${name}'`)
+            .join(" && ");
+    // The scoped clause NAMES the sleeves it closes rather than saying "the underfunded sleeve(s)":
+    // a zero-share sleeve can be underfunded yet deliberately absent from the command, and prose that
+    // describes a wider set than the command executes is the self-contradiction this note exists to
+    // avoid.
+    const closeClause = wholePackage
+        ? `Close it first (\`${closeCmd}\`, which returns the funds)`
+        : `Close ONLY ${state.closable.join(", ")} first — the rest of the package stays up ` +
+            `(\`${closeCmd}\`, which returns the funds)`;
+    // The re-run funds every walletless instance, not just the ones being closed — a sleeve whose own
+    // create failed is in that set too, and sizing the hint against the closed set alone under-hints
+    // it straight back into this same warn.
+    const rerunFunds = [...new Set([...state.closable, ...state.walletless])];
+    const redeployBudget = wholePackage ? min.minBudget : budgetToCover(rerunFunds, pkg, min);
+    // Mirror of `underfundedNote`'s guard, on the module's other money-hint producer: below
+    // MIN_WALLET no rendered `--budget` is valid, and suggesting one produces nonsense the agent
+    // then follows ("--budget ≤ $0", the M381223 churn). Reachable through a mis-authored share > 1;
+    // better no command at all than a command with a sub-floor figure in it.
+    if (redeployBudget < MIN_WALLET)
+        return zeroShareNote;
+    return (` Running the authored design means starting over at the larger size, NOT re-running at a bigger ` +
+        `budget: deploy never adds funds to a wallet that already exists, so a re-run would just adopt ` +
+        `what is already there. ${closeClause}, then ` +
+        `\`openclaw senpi deploy -p '${pkg.dir}' --budget ${budgetArg(redeployBudget)}\`.${zeroShareNote}`);
+}
+/** Forward-looking tense for the preflight narration: everything is about to be funded and run. */
+function forwardTense(under) {
+    const names = under.map((row) => row.wallet);
+    return { funded: new Set(names), running: new Set(names) };
+}
+/**
+ * The SOFT tier's warn: one or more wallets this deploy funds get less than their own sizing needs.
+ *
+ * It must not read like the `[E_FUNDS_*]` refusals that share its `[E_…]` shape, because it did not
+ * stop anything — users size their own budgets, and a strategy that runs with fewer slots than
+ * authored is a legitimate choice, not a fault. Hence the explicit "nothing was blocked": without
+ * it, an agent that pattern-matches bracketed codes to "refused" would report a live deploy as a
+ * failure and start closing wallets to "fix" it. The phrasing is state-independent ("the budget
+ * check did not stop this deploy") because this note also rides `failed` reports, where the old
+ * "this deploy PROCEEDS" was simply untrue.
+ *
+ * The whole-package minimum is quoted as CONTEXT, in its own parenthesis — never as the claim.
+ */
+function buildBudgetBelowMinNote(pkg, min, under, escape, tense) {
+    // "Will run" is a claim about something INSTALLED, judged per row: a mixed report used to say
+    // "those sleeve(s) WILL RUN DEGRADED" about wallets it named as stranded two clauses later. The
+    // sizing observation itself stays in every branch — it was true about the plan.
+    const running = under.map((row) => row.wallet).filter((name) => tense.running.has(name));
+    const degraded = running.length === under.length
+        ? `those sleeve(s) will run DEGRADED, with`
+        : running.length === 0
+            ? `at that size those sleeve(s) would run DEGRADED, with`
+            : `of these, ${running.join(", ")} will run DEGRADED — the rest never got a runtime ` +
+                `installed on this run — with`;
+    // "This deploy funds" is a claim about the WALLET, judged per row too: on a deploy that never
+    // created one, present tense states an allocation that did not happen — while "would have funded"
+    // about a wallet that IS live and funded (stranded, rollback-incomplete) contradicts the very
+    // line that names it. Each row's own fact decides.
+    const fundedCount = under.filter((row) => tense.funded.has(row.wallet)).length;
+    const lead = fundedCount === under.length
+        ? `This deploy funds ${under.length} wallet(s) below what their own sizing needs`
+        : fundedCount === 0
+            ? `This deploy would have funded ${under.length} wallet(s) below what their own sizing needs`
+            : `This deploy funds ${fundedCount} of ${under.length} wallet(s) below what their own ` +
+                `sizing needs (the rest never got a wallet)`;
+    return (`[W_BUDGET_BELOW_STRATEGY_MIN] ${lead}: ${renderUnderfunded(under)}. Nothing was blocked — the ` +
+        `budget check did not stop this deploy; ${degraded} fewer slots than designed and each ` +
+        `position a larger share of its wallet. (For reference, deploying the whole ${pkg.id} package ` +
+        `fresh needs ${usd(min.minBudget)} across ${min.walletCount} wallet(s).)${escape}`);
+}
+/**
+ * The SOFT tier's other half: a sleeve whose slot size could not be read out of its runtime.yaml
+ * (the vol-parity sleeves expose risk weights, not margin percentages). Its per-wallet minimum fell
+ * back to the bare floor, so the figure is a LOWER bound — saying it plainly is the whole point,
+ * because the alternative is advertising a $10 minimum for a design that no-trades below $250.
+ *
+ * A concrete shortfall is APPENDED rather than replacing this note. Both facts matter and the
+ * understatement is the more important caveat, so it leads — but "these wallets are already short"
+ * is the one hard, checkable thing available, and suppressing it (the shape this had when the two
+ * branches were exclusive) left the agent with the softer half of the truth while `belowMin`
+ * reported the opposite of it. Once it asserts that shortfall it must also name the way out, or an
+ * agent reading a concrete number with no escape will improvise one — and the improvisations this
+ * repo has field cases for are a bare re-run and a close.
+ */
+function buildBudgetUnresolvedNote(pkg, min, under, escape, tense) {
+    // Same per-row funding tense as the below-min note (see there for why).
+    const fundedCount = under.filter((row) => tense.funded.has(row.wallet)).length;
+    const funding = fundedCount === under.length
+        ? `is ALREADY funding ${under.length} wallet(s)`
+        : fundedCount === 0
+            ? `would have funded ${under.length} wallet(s)`
+            : `is ALREADY funding ${fundedCount} of ${under.length} wallet(s) (the rest never got a wallet)`;
+    const shortfall = under.length > 0
+        ? ` This deploy ${funding} below their own sizing: ${renderUnderfunded(under)}.`
+        : "";
+    return (`[W_BUDGET_UNRESOLVED] could not compute a reliable minimum for ${pkg.id} — sleeve(s) ` +
+        `${min.unresolvedWallets.join(", ")} expose no resolvable marginPct, so the ${usd(min.minBudget)} ` +
+        `figure may be UNDERSTATED. Size conservatively.${shortfall} Nothing was blocked — the budget ` +
+        `check did not stop this deploy.${escape}`);
+}
+/** Which code leads the soft-tier note, or null when there is nothing to say. */
+function softLead(min, under) {
+    if (min.unresolvedWallets.length > 0)
+        return "unresolved";
+    return under.length > 0 ? "below" : null;
+}
+/**
+ * The soft-tier note, assembled from the facts plus whatever escape the caller's state supports.
+ * ONE producer for both codes' strings — the preflight narration and the final report differ only
+ * in `escape`, so they can never drift into two different accounts of the same finding.
+ */
+function buildSoftBudgetNote(pkg, min, under, escape, tense) {
+    switch (softLead(min, under)) {
+        case "unresolved":
+            return buildBudgetUnresolvedNote(pkg, min, under, escape, tense);
+        case "below":
+            return buildBudgetBelowMinNote(pkg, min, under, escape, tense);
+        default:
+            return null;
+    }
+}
+/**
+ * The fraction landed, FLOORED to a tenth of a percent.
+ *
+ * Floored rather than rounded on purpose: this warn fires strictly below 90%, and a rounded 89.97%
+ * would print "(90%)" beside a sentence explaining that the wallet came up short of 90% — the kind
+ * of self-contradiction that makes a reader distrust the whole line. Trailing `.0` is dropped so
+ * the ordinary case reads `12%`, not `12.0%`.
+ *
+ * Computed in integer CENTS. Flooring a raw double reintroduced the misprint the flooring exists to
+ * prevent, away from the boundary: `(6.80 / 10.00) * 1000` is 679.999… in binary floating point, so
+ * an exact 68% printed `67.9%`. Cents are what the figures actually are.
+ */
+function fundedPercent(row) {
+    const fundedCents = Math.round(row.funded * 100);
+    const requestedCents = Math.round(row.requested * 100);
+    return `${Math.floor((fundedCents * 1000) / requestedCents) / 10}%`;
+}
+/**
+ * `main (0x…), created by this deploy, funded $60.00 of requested $500.00 (12%, short $440.00)` —
+ * both numbers, so the claim is checkable, and the provenance and the shortfall folded into the same
+ * clause so each wallet is named exactly once.
+ *
+ * The ask is attributed to whoever made it. On the adoption path the amount comes from a PRIOR run's
+ * journal, so "of requested $500.00" under a lead saying "what this deploy requested" described a
+ * request this run never made — against a wallet it never funded. The adopted clause names that run
+ * instead, and a reader who wants the current number is sent to `status.py` by the remediation.
+ */
+function renderPartialFunded(rows) {
+    return rows
+        .map((row) => {
+        const asked = row.created
+            ? `${row.instance} (${row.wallet}), created by this deploy, funded ${usd(row.funded)} of ` +
+                `requested ${usd(row.requested)}`
+            : `${row.instance} (${row.wallet}), adopted by this deploy from an earlier run, funded ` +
+                `${usd(row.funded)} of the ${usd(row.requested)} that run requested`;
+        return `${asked} (${fundedPercent(row)}, short ${usd(row.requested - row.funded)})`;
+    })
+        .join(", ");
+}
+/**
+ * The OUTCOME tier's warn: the backend funded a wallet for materially less than the create call
+ * asked for (a partial bridge, a rejected top-up leg — the deploy sees only the result). The
+ * successor to the skills-side verify gate's `_budget_verdict`, which reported the whole strategy
+ * "not live" over the same finding.
+ *
+ * It is a `W_`, and the difference from that predecessor is the point: the strategy IS live, its
+ * wallet holds real money and its runtime is ticking. Reporting `not-live` (or letting this change
+ * `overall`) would send an agent to close a funded, running strategy over a shortfall a top-up
+ * fixes. So it warns, the exit code stays whatever the deploy earned, and the remediation leads
+ * with the NON-destructive route.
+ *
+ * It deliberately emits NO teardown command. `close.py`'s correct scope depends on state this note
+ * does not own — adopted siblings, wallets stranded with no runtime, an `[E_ROLLBACK_INCOMPLETE]`
+ * line already claiming the cleanup — and the report already has exactly one producer of close
+ * commands ({@link buildBudgetEscape}). A second, differently scoped teardown beside it is the
+ * self-contradiction the taxonomy's rule 5 exists to prevent, and an agent reconciling two of them
+ * runs whichever executes. The destructive option is named as an option and routed through
+ * read-only triage, which is the only command here and cannot destroy anything.
+ *
+ * Two properties of the note are load-bearing and easy to lose:
+ *  - `reassure` — the "nothing is broken, the strategy is LIVE" sentence is a CLAIM about the rest
+ *    of the report, so it is only made when the report PROVES it: `overall === "live"` and nothing
+ *    less (see the gate at the call site). Asserted unconditionally it rode `failed` and `pending`
+ *    reports saying the opposite two lines above; gated only loosely it rode
+ *    `installed-unobserved` ones, where no tick was ever seen.
+ *  - the figures are DATED and the top-up is routed through a fresh read. This note persists on the
+ *    job snapshot and re-renders on every later `deploy status`, and unlike every other budget note
+ *    it asserts a MUTABLE backend quantity whose fix is exactly the action that invalidates it — so
+ *    an undated "short $440.00" invites a second $440 top-up after the first one landed.
+ *  - PROVENANCE, exactly as its unreadable sibling carries it. This note is reachable on the
+ *    ADOPTION path too — the ask is looked up from a prior run's journal for the strategy this run
+ *    adopted — where "SHORT of what this deploy requested … funded $60.00 of requested $500.00"
+ *    named a request this run never made about a wallet it never funded ($500 was the earlier run's
+ *    ask; this one asked for nothing and created nothing). The lead attributes the ask to no one and
+ *    each wallet states its own origin, so a reader can correct the figure from the note itself.
+ */
+function buildPartialFundNote(pkg, rows, reassure) {
+    // The size claim is about the WALLETS THIS NOTE NAMES, never about the strategy. `rows` is the
+    // filtered SHORT set, so "the strategy is LIVE, but it is trading a $20.00 book" read a
+    // whole-package figure out of one sleeve of it: on a deploy whose other sleeve landed its full
+    // $300, the strategy was trading $320 across two wallets. Same rule the unreadable note's
+    // standing sentence follows — a filtered set speaks only for the wallets in it.
+    const book = rows.length === 1
+        ? `that wallet is trading a ${usd(rows[0].funded)} book`
+        : `those wallets are trading only what landed on them`;
+    const standing = reassure
+        ? `Nothing was blocked and nothing is broken — the strategy is LIVE, but ${book}, `
+        : `Read the step lines above first — they, not this note, say what state this ` +
+            `deploy left behind. Either way ${book}, `;
+    return (`[W_BUDGET_PARTIAL_FUND] The backend funded ${rows.length} wallet(s) SHORT of what was ` +
+        `requested for them, as the backend reported them at deploy time: ${renderPartialFunded(rows)}. ` +
+        `${standing}so every position opened there is sized off the money that actually landed, not ` +
+        `off the amount requested. Report the funded figure, never the requested one. Fix it the ` +
+        `non-destructive way FIRST — and re-read the CURRENT funding before moving any money, because ` +
+        `those figures are what the backend reported AT DEPLOY TIME and a top-up (or a slow bridge leg ` +
+        `settling late) makes them stale: run ` +
+        `\`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\`, then add whatever difference it ` +
+        `still shows through the \`senpi-deposit-withdraw-transfer\` skill. Deploy itself never adds ` +
+        `funds to a wallet that already exists, so re-running at the same budget would only adopt what ` +
+        `is there. Closing and redeploying at the full size is the alternative and it is DESTRUCTIVE: ` +
+        `agree the scope with the user against that same read, because a teardown here also takes down ` +
+        `whatever else this package has live.`);
+}
+/**
+ * The unreadable-read sibling of {@link buildPartialFundNote}: the ask is known, the landed amount
+ * is not, so this note makes NO percentage claim, NO dollar shortfall, and asks for no money move.
+ *
+ * The failure it replaces: the client coerced a missing/unparseable `totalFunded` to `0`, which
+ * turned one bad read into `funded $0.00 of requested $500.00 (0%)` plus an instruction to add
+ * $500 — against a wallet that may already hold the full amount, so following it doubled the
+ * deployment. An unread figure is not a small figure; the only honest next step is for the USER to
+ * establish what is actually on the wallet.
+ *
+ * `reassure` is the same earned-claim gate its sibling carries, and for the same reason: "the
+ * create succeeded and the strategy is running" is a claim about the REST of the report, and this
+ * note is reachable on `failed` and `pending` reports through the adoption path — asserted
+ * unconditionally it rode a verdict saying the opposite two lines above. Without it the note keeps
+ * every fact it owns (the amount is unreadable, verify before moving money) and makes no claim
+ * about what the deploy left running.
+ *
+ * PROVENANCE is the other claim it may not invent, and it is claimed PER WALLET only. The note is
+ * reachable on the ADOPTION path — a journaled ask is looked up for exactly the strategy a prior
+ * run created — so "wallet(s) this deploy created" described a create that never happened on a
+ * crash-resume that adopted, created nothing and funded nothing, handing the reader a second wallet
+ * that does not exist. Each wallet therefore states its own origin from
+ * {@link UnreadableFundedWallet.created}.
+ *
+ * No sentence here generalises that over the deploy. `rows` is a FILTERED set — the wallets whose
+ * funded figure came back unreadable — so nothing about the OTHER wallets can be read out of it,
+ * and a `rows.every(...)` looks exactly like a deploy-level fact while being one about the subset:
+ * a deploy that created `main` (readable $300) and adopted `scalp` (unreadable) has `rows =
+ * [scalp]`, and "this deploy created no wallet" is then flatly false about the $300 it just moved.
+ * The only deploy-level claim allowed is the one `reassure` proves — the report says `live`, so the
+ * strategy is running — and it names no create and no adoption.
+ */
+function buildFundedUnreadableNote(pkg, rows, reassure) {
+    const wallets = rows
+        .map((row) => row.created
+        ? `${row.instance} (${row.wallet}), created by this deploy, requested ${usd(row.requested)}`
+        : `${row.instance} (${row.wallet}), adopted by this deploy from an earlier run that ` +
+            `requested ${usd(row.requested)}`)
+        .join(", ");
+    const standing = reassure
+        ? `Nothing was blocked and the strategy is running; what is UNKNOWN is `
+        : `Read the step lines above first — they, not this note, say what state this deploy left ` +
+            `behind. What is UNKNOWN here is `;
+    return (`[W_BUDGET_FUNDED_UNREADABLE] The backend did not report a readable funded amount for ` +
+        `${rows.length} wallet(s): ${wallets}. ${standing}` +
+        `how much money landed on it — do not state it as ` +
+        `zero, and do not state it as the requested amount. Move no money on this: ask the USER to ` +
+        `verify the actually-funded amount first ` +
+        `(\`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\`, or inspecting the wallet), and ` +
+        `only then decide whether anything needs topping up or resizing.`);
+}
+function buildDecisionModelRefusal(instance, pkg, budget) {
+    return (`[INVALID_REQUEST] Instance "${instance}" runs actions with decision_mode: llm, but no decision ` +
+        `model was given. Nothing was created. Re-run naming the model: ` +
+        `${resumeCommand(pkg.dir, budget)} --decision-model <model>`);
+}
+function buildDecisionModelEnvRefusal(instance, pkg) {
+    return (`[INVALID_REQUEST] Instance "${instance}" runs actions with decision_mode: llm, but ` +
+        `${pkg.dir}/strategy.yaml declares no defaults.decision_model_env — there is no token to ` +
+        `substitute the model into. Nothing was created. Add ` +
+        `defaults.decision_model_env to strategy.yaml, bind it in the runtime.yaml, then re-run.`);
+}
+/**
+ * An install that came up with NO live entry scanners (`payload.unwired`). The runtime came UP and
+ * is BLIND, and every one of the three phases is deterministic on this box — so this is an install
+ * failure, not a tick that has not landed yet.
+ *
+ * Says what is true (it will never tick), what was NOT done (no scanner ever mounted), and — the
+ * part that has to track reality — what is LEFT on the box. The two teardown outcomes leave
+ * different states, so they never share a sentence: naming `senpi runtime delete` after a
+ * successful delete points at a runtime that no longer exists, and omitting it after a failed one
+ * hides a runtime still running against a wallet this job is about to close.
+ *
+ * The NEXT STEP is per-phase for the same reason. One ladder ("delete, fix, re-run") cannot serve
+ * all three: only `install_wire` is fixable in the package, and on `no_intake` re-running is a loop
+ * that cannot terminate — create → fund → install → unwired → close, moving real money out and
+ * back on every iteration — because the cause is box-level and the intake context is built once at
+ * plugin register. No emitted command may require a precondition the state lacks.
+ */
+function buildUnwiredInstallDetail(params) {
+    const { phase, runtimeId, wallet, createdByThisJob, removal } = params;
+    const { cause, next } = describeUnwiredPhase(phase, createdByThisJob);
+    // Deleting a runtime tears down DSL exit management for its wallet ADDRESS — it cancels the
+    // exchange stop-loss and drops the backend ratchet stop for every ACTIVE DSL there. On a wallet
+    // this job created, the rollback closes it moments later, so there is nothing left to be
+    // unmanaged; on an ADOPTED wallet nothing closes, so the consequence has to be said out loud.
+    const dslNote = createdByThisJob || !removal.ok
+        ? ""
+        : ` Deleting it also tore down DSL exit management for ${wallet}, which this deploy did not ` +
+            `create: any open position there has lost its ratchet stop and its exchange stop-loss, and ` +
+            `nothing is watching it — check with MCP \`strategy_get_clearinghouse_state\` on ${wallet} ` +
+            `before you leave this.`;
+    const left = removal.ok
+        ? `The runtime was deleted, so nothing is left running against this wallet; the cause is in ` +
+            `the gateway log (event \`runtime.scanners_unwired\`, phase ${phase}).${dslNote}`
+        : `The runtime could NOT be deleted (${removal.error}) and is STILL RUNNING against this ` +
+            `wallet — read it with \`openclaw senpi status -r ${runtimeId}\`, then remove it yourself: ` +
+            `\`openclaw senpi runtime delete ${runtimeId}\`.`;
+    return (`install produced a BLIND runtime "${runtimeId}": ${cause} (phase ${phase}), so it has no entry ` +
+        `scanners and would never tick. Counted as an install failure. ${left} ${next}`);
+}
+/**
+ * The cause and the next step for one unwired phase — computed from the phase, never templated.
+ *
+ * `no_intake`'s stake depends on what this job actually did: only a run that CREATES a wallet moves
+ * money on every doomed iteration. Asserting that on an adopted wallet (where a re-run installs and
+ * closes nothing) would overstate a warning that is already strong enough on its own facts.
+ */
+function describeUnwiredPhase(phase, createdByThisJob) {
+    if (phase === "no_intake") {
+        const loop = createdByThisJob
+            ? `every re-run repeats create → fund → install → close and moves real money out and back each time`
+            : `every re-run repeats install → delete on this adopted wallet — no funds move, but nothing ` +
+                `is ever left watching it`;
+        return {
+            cause: `supervised scanner intake is disabled for this whole box, so no external scanner could ` +
+                `be mounted — nothing about this package or this runtime caused it`,
+            next: `Do NOT re-run the deploy yet: the cause is box-level and is decided once when the plugin ` +
+                `starts, so ${loop}. Repair or clear the plugin's \`acceptance-record.json\` state file ` +
+                `and RESTART the gateway first (the boot log names the file with its full path); re-run ` +
+                `only once a fresh install wires its scanners.`,
+        };
+    }
+    if (phase === "install_launch") {
+        return {
+            cause: `the supervised scanner launcher failed to start`,
+            next: `Read the launcher error in the gateway log before re-running — a re-run repeats it ` +
+                `verbatim while the cause is still there.`,
+        };
+    }
+    return {
+        cause: `the supervised scanner wiring failed (a packaging or entrypoint error in this package)`,
+        next: `Fix the scanner entrypoint this package declares (the \`path\`/module of each external ` +
+            `scanner in the instance runtime.yaml), then re-run the deploy.`,
+    };
+}
+/**
+ * A strategy the ACTIVE poll watched go DEAD. Terminal, so the poll stops on it — and the claim it
+ * replaces is the point: `buildCreatePendingDetail` would have said "wallet still funding … never
+ * creating a second wallet", and on this input neither half holds. It is not funding, and reconcile
+ * filters dead statuses on BOTH match routes, so a re-run creates and funds a fresh wallet beside
+ * it. The status only ever survived in the step evidence; here it leads the claim.
+ */
+function buildCreateDeadDetail(pkg, budget, live, createdByThisJob) {
+    const origin = polledWalletOrigin(createdByThisJob);
+    const target = polledWalletTarget(live);
+    // A teardown instruction is earned HERE and only here: a dead status proves the strategy is not
+    // coming back, so money left on it really is stranded.
+    const funds = live.totalFunded === undefined
+        ? `The backend reported no readable funded amount for it, so whether anything is stranded is ` +
+            `UNKNOWN — read it with MCP \`strategy_list\` on ${target} before deciding.`
+        : live.totalFunded > 0
+            ? `It still reports ${usd(live.totalFunded)} funded: reclaim that FIRST with MCP ` +
+                `\`strategy_close\` on ${target}, or the money stays in a dead strategy.`
+            : `It reports ${usd(live.totalFunded)} funded, so there is likely nothing to reclaim — ` +
+                `confirm with MCP \`strategy_list\` on ${target} before re-running.`;
+    return (`strategy ${live.id} went ${live.status} while waiting for ACTIVE — a dead status is terminal, ` +
+        `so the wait stopped here rather than running out the clock. Nothing was installed. ${origin}. ` +
+        `${funds} A re-run does NOT adopt a dead strategy (reconcile filters dead statuses on both ` +
+        `match routes), so \`${resumeCommand(pkg.dir, budget)}\` WILL create and fund a NEW wallet beside ` +
+        `this one.`);
+}
+/**
+ * A strategy the ACTIVE poll watched settle on a status that is neither ACTIVE nor on the way
+ * there — PAUSED, mid-teardown, or one this build does not recognise.
+ *
+ * Only {@link INITIALIZING_STATUSES} resolve on their own, so only they are worth waiting on;
+ * everything else burned the full `--max-wait` and was then reported as "wallet still funding",
+ * which is false for every member of this set.
+ *
+ * The REMEDIATION branches, and must: the create step gets no D-6 rollback (only an install failure
+ * rolls a wallet back), so a wallet this job created and funded seconds ago is still live when this
+ * is read. One shared "reclaim it FIRST with `strategy_close`" told an agent to tear down a wallet
+ * on a status this build cannot interpret — the exact opposite of what
+ * {@link buildNotDeployableRefusal} says for the same input at the reconcile seam ("will not guess
+ * … NEVER close or recreate to 'start clean'"). The two seams now agree arm for arm: a teardown is
+ * offered only where the status PROVES the strategy is not coming back.
+ */
+function buildCreateNotDeployableDetail(pkg, budget, live, createdByThisJob, 
+/**
+ * The scoped start-over clause — see {@link buildPackageCloseOffer}. Used by the PAUSED arm
+ * only. Completes the sentence "If you meant to start over instead, …" and carries its own
+ * terminal period; the arm appends nothing to it.
+ */
+closeOffer) {
+    const status = live.status.toUpperCase();
+    const origin = polledWalletOrigin(createdByThisJob);
+    const rerun = `re-run \`${resumeCommand(pkg.dir, budget)}\``;
+    // `pkg.id` is single-quoted everywhere it reaches a shell, exactly as buildStrandedCloseCaveat
+    // quotes it: these strings get copied verbatim into a terminal.
+    const statusPy = `\`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\``;
+    const head = `strategy ${live.id} is ${live.status} while this deploy waited for ACTIVE, so the wait stopped ` +
+        `here — this is not a funding delay. Nothing was installed. ${origin}. `;
+    if (status === "PAUSED") {
+        return (`${head}A paused strategy will not become ACTIVE on its own. Resume it, then ${rerun}. If you ` +
+            `meant to start over instead, ${closeOffer} Never leave it paused and fund a second wallet ` +
+            `beside it.`);
+    }
+    if (CLOSING_STATUSES.includes(status)) {
+        return (`${head}It is being torn down, and ${itsFunded(live.totalFunded)} returns to the owner wallet as ` +
+            `that finishes — nothing to reclaim by hand. Wait for it to reach CLOSED (re-check with ` +
+            `${statusPy}), then ${rerun} — the re-run creates a fresh wallet once this one is gone.`);
+    }
+    // Unrecognized. "Waiting cannot help" is a claim this build has no basis for: the status is in
+    // none of the sets it knows, so it may still be on its way to ACTIVE. Read-only triage only —
+    // and no teardown command, because nothing here proves the money is stranded.
+    return (`${head}This build does not recognize the status ${live.status} — it is in none of the ` +
+        `initializing, closing or dead sets this version knows, so deploy will not guess what it means ` +
+        `or whether waiting would have helped. Read-only triage FIRST: ${statusPy}, ` +
+        `\`openclaw senpi deploy status\`, or MCP \`strategy_get\` with strategy_id "${live.id}" (that tool takes ` +
+        `the id, never a wallet address). Then ${rerun} once it is ACTIVE. Do NOT close or recreate this ` +
+        `strategy to "start clean": ${itsFunded(live.totalFunded)} is not proven stranded, and closing a ` +
+        `strategy that was seconds from ACTIVE throws the wallet away.`);
+}
+/**
+ * The start-over clause for a PAUSED poll, scoped to this job's whole INTENT, never to a mid-loop
+ * snapshot.
+ *
+ * The string is frozen the moment the poll settles, but creates run one instance at a time and a
+ * `create: failed` does not halt the loop — a sibling still queued behind this one can be funded
+ * and installed AFTER the text is written. So "live" here means live-or-intended: a sibling that
+ * already holds a wallet, one this job is still going to create (`needsWallet`) or wait on
+ * (`awaitingActive`) — or one whose reconcile FAILED, whose live state is therefore unknown
+ * (the fail-closed `strategy_list` throw means "unknown, not empty", and unknown must withdraw
+ * like live does, never read as "not live"). Judging `report.wallet` alone let this same job
+ * falsify the "nothing else in this package is live" claim on the very report that carries it,
+ * two lines below the offer.
+ * ({@link buildStrandedCloseCaveat} may judge present state — it runs at rollback time, after the
+ * whole create phase.)
+ *
+ * The remedy split mirrors that caveat with opposite emphasis: there the command being scoped is a
+ * per-wallet `strategy_close` and the package-wide one is merely warned off; here the package-wide
+ * teardown IS the offer, so when any sibling is live or intended the command is WITHDRAWN and
+ * replaced by the per-strategy route. Reconcile can hand out `close.py <pkg>` unscoped because it
+ * finishes for every instance before any wallet exists; this seam cannot.
+ *
+ * Rendered mid-sentence after "If you meant to start over instead, " and ends with its own period
+ * — the caller appends nothing, so the seam cannot splice ungrammatically again.
+ */
+function buildPackageCloseOffer(pkg, runs, self, live) {
+    const otherLive = runs.filter((run) => run !== self &&
+        (run.report.wallet ||
+            run.needsWallet ||
+            run.awaitingActive ||
+            run.report.steps.reconcile.status === "failed") &&
+        !run.report.rolledBack);
+    const funds = `(that returns ${itsFunded(live.totalFunded)})`;
+    const closePy = `\`python3 senpi-strategy-ops/scripts/close.py '${pkg.id}'\``;
+    if (otherLive.length === 0) {
+        return (`tear this one down first with ${closePy} ${funds}, then re-run — nothing else in this ` +
+            `package is live or queued for funding by this deploy, so that command closes exactly this ` +
+            `strategy.`);
+    }
+    const perStrategy = live.strategyWalletAddress
+        ? `MCP \`strategy_close\` on wallet ${live.strategyWalletAddress}`
+        : `MCP \`strategy_close\` on its wallet (read the address with \`strategy_get\`, strategy_id ` +
+            `"${live.id}" — its address is unreadable here)`;
+    return (`tear THIS one down first with ${perStrategy} ${funds}, then re-run. Do NOT reach for ` +
+        `${closePy} to do it: it closes every live strategy in this package, and ${otherLive.length} ` +
+        `other sleeve(s) (${otherLive.map((run) => run.inst.name).join(", ")}) belong to this same ` +
+        `deploy — any of them live by the time you read this would be closed too.`);
+}
+/** Who funded the polled wallet — shared by both break-outs so they can never disagree. */
+function polledWalletOrigin(createdByThisJob) {
+    return createdByThisJob
+        ? `This deploy created it`
+        : `This deploy adopted it and funded nothing — it predates this run`;
+}
+/** How to name the polled wallet in a command, address-first and never `undefined`. */
+function polledWalletTarget(live) {
+    return live.strategyWalletAddress
+        ? `wallet ${live.strategyWalletAddress}`
+        : `strategy id ${live.id} (its wallet address is unreadable)`;
+}
+function buildCreatePendingDetail(pkg, budget, waitedSec) {
+    return (`wallet still funding after ${waitedSec}s — re-run \`${resumeCommand(pkg.dir, budget)}\` to resume ` +
+        `(nothing is lost; reconciliation matches this strategy again and waits for it to reach ACTIVE, ` +
+        `never creating a second wallet)`);
+}
+/**
+ * Live wallets carry this package's stamp, and none of them answered for this instance.
+ *
+ * Rendered from the reconcile read alone — no additional network calls, because a gate that can
+ * fail to render is a gate that sometimes does not fire. Every column is quoted from that read and
+ * says so when it is unreadable: an unread funded amount is the one number a reader would otherwise
+ * take for an empty wallet. The name column is there because a missing/differing name is WHY the
+ * match failed, and it is the fact that tells a reader whether this is old-tooling residue or a
+ * backend that renamed what deploy created.
+ *
+ * The destructive route is named LAST and behind the read-only one, with its real blast radius on
+ * the same line: a refusal that names only a teardown gets followed.
+ *
+ * The consequence sentence is hedged for the same reason the columns are: this read is metadata,
+ * so "left funded, in position and supervised by nothing" would assert two things nothing here
+ * looked at (no position read, no `registryFindById`/`runtimeIsLive` call) — and the second can be
+ * plainly false, since install rebinds only the registry row for `<id>-<instance>` and a wallet
+ * carrying a different runtime id keeps its runtime. What is unread is named as unread; that is
+ * the argument for stopping, not a weaker version of it.
+ */
+function buildBindingUnknownRefusal(pkg, instance, wantedName, candidates, budget) {
+    const rows = candidates
+        .map((s) => {
+        const wallet = s.strategyWalletAddress?.trim() || "(wallet address unreadable)";
+        const funded = s.totalFunded === undefined ? "funded amount unreadable" : usd(s.totalFunded);
+        const created = s.createdAt ? `created ${s.createdAt.slice(0, 10)}` : "creation date unreadable";
+        const named = s.strategyName?.trim() ? `named "${s.strategyName.trim()}"` : "no name reported";
+        return `  ${wallet}   ${funded}   ${s.status}   ${created}   ${named}`;
+    })
+        .join("\n");
+    return (`[E_INSTANCE_BINDING_UNKNOWN] ${pkg.id}: ${candidates.length} live wallet(s) carry this package's ` +
+        `stamp, and none of them answers for instance "${instance}".\n\n${rows}\n\n` +
+        `Nothing was created and no money moved. Deploying now would fund a NEW wallet beside the ` +
+        `one(s) above and rebind instance "${instance}"'s runtime id onto it. This read is metadata ` +
+        `only: whether the wallet(s) above hold open positions, and whether any runtime is still ` +
+        `watching them, was NOT read here — which is exactly why deploying past it is a bet rather ` +
+        `than a decision.\n\n` +
+        `Read what each wallet is doing before deciding anything:\n` +
+        `  \`python3 senpi-strategy-ops/scripts/status.py '${pkg.id}'\`\n\n` +
+        `Deploy binds an existing strategy two ways — by the name instance "${instance}" answers to ` +
+        `("${wantedName}"), and by a create key journaled on this box — and neither reached the ` +
+        `wallet(s) above. If one of them IS this instance under a name deploy does not know, this verb ` +
+        `has no way to bind to it, so re-running changes nothing. What each wallet is and whether it is ` +
+        `still wanted is the USER's call, made from the read above — deploy will not pick one. Only if ` +
+        `the USER confirms these wallets are unwanted, close them: ` +
+        `\`python3 senpi-strategy-ops/scripts/close.py '${pkg.id}'\` returns their funds and tears down ` +
+        `the WHOLE ${pkg.id} package, every sleeve and runtime in it. Then re-run ` +
+        `\`${resumeCommand(pkg.dir, budget)}\`.`);
+}
+/**
+ * Every live strategy under the name this instance answers to is stamped for a DIFFERENT package.
+ *
+ * The counterpart to {@link buildBindingUnknownRefusal} on the other match route, and the harder of
+ * the two to word: nothing here is the operator's to close. The wallets named belong to another
+ * package — its positions, its balance, possibly its running runtime — so the only routes offered
+ * are edits to THIS package and reads. Re-running is explicitly not one of them: the name is
+ * derived, so it comes out identical every time, which is exactly why the collision is structural
+ * rather than transient.
+ *
+ * Neither is "set `id:` back to the stamp and re-run", which this refusal used to offer. The name
+ * is derived FROM the id ({@link walletName}: `sanitizeStrategyName(id)`, or `<id>-<instance>` for
+ * a multi-sleeve package), and a loadable id is sanitize-stable by construction
+ * (`assertIdentityRoundTrips`), so changing the id to the stamp changes the derived name by exactly
+ * as much — the run after the edit looks for a name the matched wallet does not carry, finds
+ * nothing, and refuses again from the gate instead, whose remedy is the whole-package `close.py`
+ * this refusal's last line forbids. Only the id AND the sleeve layout restored together re-derive
+ * the matched name, which is a restructure of this package, not a field edit — so the route ends at
+ * the read and hands the decision to the user.
+ */
+function buildForeignPackageRefusal(pkg, instance, wantedName, candidates, budget) {
+    const rows = candidates
+        .map((s) => {
+        // Same absence rules as every other rendered candidate list: an unread field says so rather
+        // than rendering as a blank or a `$0.00` the reader would act on.
+        const wallet = s.strategyWalletAddress?.trim() || "(wallet address unreadable)";
+        const funded = s.totalFunded === undefined ? "funded amount unreadable" : usd(s.totalFunded);
+        const claimant = s.skillName?.trim() || "(stamp unreadable)";
+        return `  ${wallet}   ${funded}   ${s.status}   stamped "${claimant}"`;
+    })
+        .join("\n");
+    // Deduped, because the sentence names WHOSE they are and repeating one id per row reads as more
+    // packages than were found.
+    const stamps = [...new Set(candidates.map((s) => s.skillName?.trim()).filter((v) => !!v))];
+    const whose = stamps.length > 0 ? stamps.map((s) => `"${s}"`).join(", ") : "another package";
+    // Computed from the package as loaded, not templated: a flat package's name IS its id, and
+    // telling its author to rename an instance it does not have is an edit they cannot make.
+    const multi = pkg.instances.length > 1;
+    const derivedFrom = multi
+        ? `package id "${pkg.id}" + instance name "${instance}"`
+        : `package id "${pkg.id}"`;
+    const renameWhat = multi ? "the package `id:` or this instance's `name:`" : "the package `id:`";
+    // A stamp is BACKEND text, not a package id this box loaded, so it is not shell-safe by
+    // construction the way `pkg.id` is (`assertIdentityRoundTrips` guarantees that one). A stamp that
+    // is not a legal package id is named in prose instead of pasted into a command — an emitted
+    // command has to be runnable, and one carrying a quote is worse than none.
+    const reads = stamps
+        .map((s) => sanitizeStrategyName(s) === s
+        ? `  \`python3 senpi-strategy-ops/scripts/status.py '${s}'\``
+        : `  (no command for the stamp ${JSON.stringify(s)} — it is not a usable package id; look ` +
+            `the wallet up by address with \`openclaw senpi status\` / \`strategy_list\`)`)
+        .join("\n");
+    return (`[E_WALLET_OWNED_BY_OTHER_PACKAGE] ${pkg.id}: instance "${instance}" answers to the strategy ` +
+        `name "${wantedName}", and every live strategy under that name carries another package's ` +
+        `attribution stamp (${whose}).\n\n${rows}\n\n` +
+        `Nothing was created and no money moved. Deploy binds an existing strategy BY NAME, so ` +
+        `adopting one of the above would have pointed this package's runtime at another package's ` +
+        `funded wallet — its balance and its open positions — and, if something is already watching ` +
+        `that wallet, left two exit engines on one margin account. This read is metadata only: what ` +
+        `those wallets hold, and whether anything is watching them, was NOT read here.\n\n` +
+        `Re-running changes nothing — "${wantedName}" is derived from ${derivedFrom}, so it comes out ` +
+        `the same every time. Two ways forward, neither of them a money move:\n\n` +
+        `  • The wallet(s) above are not this package's. Two packages collide on one derived name: ` +
+        `give this one a name of its own by editing ${renameWhat} in ` +
+        `${join(pkg.dir, "strategy.yaml")}, then re-run \`${resumeCommand(pkg.dir, budget)}\` — deploy ` +
+        `will create this package's own wallet.\n` +
+        `  • One of them IS this package's, deployed under a package id it no longer has. Editing ` +
+        `\`id:\` back to the stamp does NOT reach it: "${wantedName}" is derived from ${derivedFrom}, ` +
+        `so that edit moves the name deploy looks for along WITH the id — the next run stops looking ` +
+        `for "${wantedName}" at all and refuses again, having bound nothing. What produced ` +
+        `"${wantedName}" is the id and the sleeve layout together, so restoring both as they were is ` +
+        `what would bind it by name; whether this package should go back to that shape is the USER's ` +
+        `call, and a metadata read cannot settle it. Read what each wallet is doing first:\n` +
+        `${reads}\n\n` +
+        `Do NOT close a wallet stamped for another package to clear this — that is a different ` +
+        `strategy's funds and a different runtime's positions. Whose these are is the USER's call.`);
+}
+/**
+ * Refusal for a package whose instances ship no DSL exit block. Rendered BEFORE any wallet exists:
+ * funding a strategy that cannot stop itself out is the "funded-but-no-DSL" hole, and the skills-side
+ * validator has always refused it.
+ */
+function buildNoDslExitRefusal(instances, pkg) {
+    return (`[INVALID_REQUEST] Instance(s) ${instances.map((inst) => inst.name).join(", ")} declare no DSL ` +
+        `exit block (\`exit.dsl_preset\`, or \`exit.engine: dsl\`) — every position they open would run ` +
+        `with no stop loss and no trailing floor. Nothing was created. Add an exit block to the instance ` +
+        `runtime.yaml, then re-check read-only with either route:\n` +
+        // One `senpi validate` per OFFENDING instance directory, computed from the instance rather than
+        // templated: the offence is per-recipe, and so is the proof that clears it.
+        `${recheckBlock(instances.map((inst) => inst.runtimeYamlDir), deployPyValidateCommand(pkg.dir))}\n` +
+        `${PROOF_ROUTE_NOTE} Then re-run.`);
+}
+/**
+ * A package id carrying capitals, refused before any wallet exists to carry the wrong stamp.
+ *
+ * Deploy's copy of `register.ts`'s gate — same rule, same fix (built from the one producer in
+ * `package.ts`, so the edit an author reads is word-for-word identical), different standing
+ * sentence: nothing was CREATED here, where the gateway's copy could only say nothing was started.
+ *
+ * The re-run command names the directory the fix LEAVES BEHIND, not the one that failed — this is
+ * the only refusal in the verb whose own instruction can move the package.
+ */
+function buildNonLowercaseIdRefusal(pkg, budget) {
+    const fix = lowercasePackageIdFix(pkg.id, pkg.dir);
+    return (`[INVALID_REQUEST] strategy.yaml id "${pkg.id}" must be lowercase. Nothing was created. ` +
+        `Fix — ${fix.instruction}. Why: this verb writes the id into each wallet's \`skillName\` ` +
+        `attribution stamp VERBATIM at create, and the backend stores what it is given ` +
+        `case-normalized, so a mixed-case id is stamped under one spelling and looked up under ` +
+        `another — that is how \`close.py '${pkg.id}'\` came to report "no OPEN strategies to close." ` +
+        `over a live, funded, trading wallet. Every reader now folds case, so wallets already stamped ` +
+        `in any case are still found and this package will ADOPT the ones it already owns rather than ` +
+        `fund a second set beside them. Then re-run \`${resumeCommand(fix.dirAfterFix, budget)}\`.`);
+}
+/**
+ * The install gate's refusal, rendered for deploy rather than for the gateway.
+ *
+ * Same findings, different standing sentence: the gateway's copy says a recipe cannot be installed,
+ * which is all that is true there. Here the run had money to move and did not move it, and that is
+ * the fact a reader needs first — so it is stated, and the re-check names `senpi validate` on the
+ * instance directory rather than "run validate on the package" in the abstract.
+ *
+ * Deploy's refusal shape: bracketed code first (taxonomy.ts:16 reads it), then what/why/fix.
+ */
+function buildInstallGateRefusal(gate, inst, pkg, budget) {
+    const lines = gate.blocking.map((f) => `  • ${f.what}\n    why: ${f.why}\n    fix: ${f.fix}`);
+    return (`[${gate.blocking[0].code}] "${inst.name}" cannot be installed — it would not trade.\n\n` +
+        `${lines.join("\n\n")}\n\n` +
+        `Nothing was created by this run — the check reads the package only, and it stopped before ` +
+        `touching the backend.\n\n` +
+        `Fix the recipe, then re-check with: ${validateCommand(inst.runtimeYamlDir)}\n` +
+        // The same command `next` ends the report with, budget and all: a re-run line that differs
+        // from it — a `<usd>` placeholder where the report has the real number — is a second, worse
+        // command competing with the authoritative one.
+        `Then re-run: ${resumeCommand(pkg.dir, budget)}`);
+}
+/**
+ * The gate itself could not run. NOT a verdict on the recipe — so it carries no taxonomy code and
+ * names no offending field, exactly like the universe check's `unavailable` branch.
+ */
+function buildInstallGateUnavailableDetail(inst, reason) {
+    return (`The install gate could not run for "${inst.name}" (${reason}), so nothing is known about ` +
+        `whether this recipe can trade. Nothing was created by this run. Re-run the deploy; if it ` +
+        // The real directory, never a `<package dir>` placeholder: this line is the one command the
+        // reader is given, and a command that has to be edited before it runs is a command an agent
+        // pastes literally. The INSTANCE's directory, not the package root: the gate ran for one
+        // sleeve, and on a multi-instance package the root is not a validate target at all — it
+        // answers "this directory has no recipe of its own, pick an instance".
+        `persists, run: ${validateCommand(inst.runtimeYamlDir)}`);
+}
+/**
+ * D-2 (revised 2026-08-05): a scanner-level `enabled` key is refused outright — the engine never
+ * reads it (see {@link scannersDeclaringEnabled}), so accepting `enabled: false` would ship a
+ * strategy that ticks and trades while its author believes it is switched off. Package-derivable,
+ * so it is decided synchronously here rather than discovered later; observe keeps its own
+ * all-disabled branch for the live-state case, which the runtime API can genuinely produce.
+ *
+ * Every offense is enumerated in ONE refusal, each as a delete-this-line instruction naming the
+ * key, the scanner, the instance and the file: a reader (agent or human) fixes the whole package in
+ * one pass instead of re-running to discover the next one.
+ */
+function buildScannerEnabledUnsupportedRefusal(offenders, pkg) {
+    return (`[INVALID_REQUEST] Unsupported \`enabled\` key on ${offenders.length} scanner entr` +
+        `${offenders.length === 1 ? "y" : "ies"}. Nothing was created. Fix — delete these lines:\n` +
+        offenders.map((entry) => `  - ${describeScannerEnabledOffense(entry)}`).join("\n") +
+        `\nWhy: the runtime engine never reads a scanner-level \`enabled\` (the scanner schema passes ` +
+        `it through untyped and registration comes from the strategy, not the scanner entry), so an ` +
+        `\`enabled: false\` scanner registers ENABLED and ticks — the package would trade while you ` +
+        `believe it is off. A scanner runs because the package declares it: to stop one, remove the ` +
+        `scanner entry itself, or disable it after install through the runtime API (\`disableScanner\`). ` +
+        `Then re-run: ${resumeCommand(pkg.dir)}`);
+}
+/**
+ * A create this job stopped waiting on at its per-call deadline. Deliberately NOT phrased as
+ * "creation failed": the deadline bounds the WAIT, not the backend's work, so the wallet may come
+ * into existence after this line is written. Naming both reconcile routes — and the one case
+ * neither can see — is what lets the operator check rather than guess.
+ */
+function buildCreateAbandonedDetail(args) {
+    const { instance, strategyName, nameFallbackFired, fundAmount, message, pkg, budget } = args;
+    const head = `wallet creation for instance "${instance}" was abandoned at its deadline, so its outcome is ` +
+        `UNKNOWN — this is not "nothing happened": ${message ?? "no message"}. The backend may still ` +
+        `complete the create and fund ${usd(fundAmount)} after this report. Nothing else was done for ` +
+        `this instance, and nothing was rolled back.`;
+    // Which create was abandoned is KNOWN, so neither branch hedges. A named create that lands is
+    // findable by name; the unnamed retry is findable by nothing — it lands under a backend-assigned
+    // name and this box never received the strategyId to journal. In that case re-running FIRST is
+    // the money-losing move, so the check leads.
+    const tail = nameFallbackFired
+        ? ` The name "${strategyName}" had already been rejected, so this second create asked for NO ` +
+            `name: if it landed, the wallet carries a backend-assigned name and no create key ever ` +
+            `reached this box — a re-run can find it by neither route and would fund a SECOND wallet ` +
+            `beside it. Check before you re-run: list your strategies (MCP \`strategy_list\`) and look ` +
+            `for a CUSTOM strategy created just now, funded about ${usd(fundAmount)}. If it is there, ` +
+            `that is this instance's wallet — keep it, or close it with ` +
+            `\`python3 senpi-strategy-ops/scripts/close.py '${pkg.id}'\` before re-running. If it is not ` +
+            `there, the create did not land: re-run \`${resumeCommand(pkg.dir, budget)}\`.`
+        : ` The create asked for the name "${strategyName}", so if it landed the wallet carries that ` +
+            `name and reconcile adopts it instead of funding a second one: re-run ` +
+            `\`${resumeCommand(pkg.dir, budget)}\`. If that re-run creates a fresh wallet and your ` +
+            `accessible balance looks short afterwards, check the wallet list (MCP \`strategy_list\`) ` +
+            `and close the orphan: \`python3 senpi-strategy-ops/scripts/close.py '${pkg.id}'\`.`;
+    return head + tail;
+}
+/**
+ * The name-rejection retry that was NOT issued because the deadline stop landed between the two
+ * creates.
+ *
+ * Not a variant of {@link buildCreateAbandonedDetail}: nothing was abandoned mid-call here. One
+ * create was issued and the backend answered it; the second one — the money-moving call this run
+ * would otherwise have made with no step boundary in front of it — never went out. So the line says
+ * what was attempted, what was not, and leaves the rejected create's own residue to the same check
+ * every rejection carries: reconcile re-reads the live list before it creates anything.
+ */
+function buildCreateNameRetryNotIssuedDetail(args) {
+    const { instance, strategyName, fundAmount, message, pkg, budget } = args;
+    return (`wallet creation for instance "${instance}" stopped at the deploy deadline. The backend rejected ` +
+        `the name "${strategyName}" (${message ?? "no message"}), and the unnamed retry that normally ` +
+        `follows was NOT issued: a create started now would take a fresh 90s deadline of its own, ` +
+        `outliving the grace period that hands the deploy slot to the next run — this job could still ` +
+        `be waiting on a create funding ${usd(fundAmount)} while a new deploy runs its own preflight ` +
+        `against the same balance. One create was issued for this instance and the backend rejected it; ` +
+        `no second wallet was asked for, and nothing was rolled back. Re-run ` +
+        `\`${resumeCommand(pkg.dir, budget)}\` — reconcile re-reads your live strategies before it ` +
+        `creates anything, and a wallet that landed under the name "${strategyName}" despite the ` +
+        `rejection is exactly what it looks for.`);
+}
+function buildUnobservedDetail(waitSec, runtimeId) {
+    return (`no tick observed within ${waitSec}s — scanners may tick on a longer interval. ` +
+        `Check in a few minutes: \`openclaw senpi scanner -r ${runtimeId}\``);
+}
+function buildObserveFailedDetail(row, runtimeId) {
+    return (`scanner "${row.scannerId}" ran and failed: lastRunStatus=error errorCount=${row.errorCount} ` +
+        `lastError=${JSON.stringify(row.lastError)}. Read \`openclaw senpi scanner -r ${runtimeId}\`, fix the ` +
+        `scanner code — do NOT close/recreate the strategy.`);
+}
+function buildNext(overall, pkg, budget, runs) {
+    switch (overall) {
+        case "live":
+            return undefined;
+        case "refused":
+            return `Nothing was created past the refusal above. Resolve it, then re-run: \`${resumeCommand(pkg.dir, budget)}\``;
+        case "pending":
+            return `re-run \`${resumeCommand(pkg.dir, budget)}\` to resume — reconciliation adopts what exists; nothing is lost`;
+        case "failed":
+            return `Read the failed step above, fix the cause, then re-run: \`${resumeCommand(pkg.dir, budget)}\``;
+        case "installed-unobserved": {
+            const runtimeId = runs.find((run) => run.report.runtimeId)?.report.runtimeId;
+            // A `<runtimeId>` placeholder inside a backticked command is a command an agent pastes
+            // literally — and `<` is a shell redirect, so it fails in a way that says nothing about the
+            // deploy. With no id to name, name the command that needs none.
+            return runtimeId
+                ? `no verified tick yet — check in a few minutes: \`openclaw senpi scanner -r ${runtimeId}\``
+                : `no verified tick yet — this report carries no runtime id: list them with ` +
+                    `\`openclaw senpi runtime list\` and check this package's runtime in a few minutes`;
+        }
+    }
+}
+function notReached() {
+    return { status: "pending", detail: "not reached" };
+}
+/**
+ * Record that an instance is bound to `strategyId` — the WRITE half of the reconcile claim ledger
+ * (see `claimed` in {@link runDeploy}).
+ *
+ * An unreadable id is not claimable. `listStrategies` coerces a missing or unparseable id to `""`
+ * (senpi/client.ts), and a `""` in the ledger answers "already accounted for" for every OTHER
+ * unreadable-id wallet in the same read — which is exactly how a second live funded wallet became
+ * invisible to the gate. Not recording it is the fail-closed direction: the gate keeps presenting
+ * it and the run refuses rather than funding beside it.
+ *
+ * **Either this guard or {@link isAccountedFor}'s alone closes that hole; both are kept
+ * deliberately.** Delete this one and the suite still passes on the deploy paths — the read guard
+ * covers it. That is defence in depth, not dead code, and `orchestrator.test.ts` pins each half
+ * separately so neither can be removed as redundant.
+ */
+export function claimStrategyId(claimed, strategyId) {
+    if (strategyId)
+        claimed.add(strategyId);
+}
+/**
+ * Is this live strategy PROVEN to be accounted for by an instance of this run? — the READ half of
+ * the same ledger.
+ *
+ * Fail-closed on an unreadable id: it can never have been claimed and can never be matched, so it
+ * can never be proven accounted for. Resting that on `claimed.has("")` happening to answer false is
+ * not a property to give a money gate — it is only true while the write half holds. Same rule this
+ * file already applies to an unreadable `totalFunded` and an unreadable `skillName`: unknown is
+ * never zero, and unknown is never "not ours".
+ *
+ * **Either this guard or {@link claimStrategyId}'s alone closes the hole; both are kept
+ * deliberately** — see there.
+ */
+export function isAccountedFor(claimed, strategyId) {
+    return Boolean(strategyId) && claimed.has(strategyId);
+}
+/**
+ * Run one phase inside an injected span, surviving a tracer that throws.
+ *
+ * Same rule as narration's `emit` and `log` — telemetry may not decide what a deploy does — but
+ * with the largest blast radius of the three: the span wraps EVERY phase, including create and
+ * install, so a throwing tracer escaped `runDeploy` after a wallet had been funded and left the job
+ * layer synthesizing an empty `instances: []` report over a live funded wallet.
+ *
+ * It is deliberately NOT "on failure, run the body": **the body is only safe to run once.** A
+ * tracer that fails while ENDING a span has already run it, and re-running `deploy.create` is a
+ * second funded wallet — telemetry causing the exact loss this file is built to prevent. So the
+ * body is invoked through a one-shot handle and the two cases are told apart by whether it fired:
+ *
+ *  - the tracer failed BEFORE reaching the body — run it here, un-spanned, and return its value;
+ *  - the tracer failed AFTER the body ran — the body's own outcome is the truth, including its
+ *    rejection if it had one. A tracer that masks a failing body with an error of its own therefore
+ *    cannot hide the real cause: what surfaces is the body's error, not the tracer's.
+ *
+ * Module-scope and exported for ONE reason: the synchronous-throw edge below is unreachable through
+ * `runDeploy` (every call site passes an async arrow), so it can only be pinned here.
+ *
+ * @param spanFn the injected tracer — assumed to call `handle` at most once; calling it more often
+ *               is harmless, since the handle collapses to the first invocation either way
+ * @param log    narration for the degraded path; must not throw (callers pass the guarded wrapper)
+ * @returns whatever the body resolves with — never the tracer's own value on a failure
+ */
+export async function spanOnce(spanFn, log, name, attrs, body) {
+    let started;
+    /**
+     * `async () => body()` rather than `body()`, and it is load-bearing: a body that throws
+     * SYNCHRONOUSLY never completes the assignment, so `started` stays undefined, the catch reads
+     * that as "the tracer never reached it", and the body runs a SECOND time. On `deploy.create` that
+     * is the double-fund this helper exists to prevent, delivered by the helper itself. Wrapping
+     * turns every failure into a rejection, so "did it start" is decided by the call and never by how
+     * the body failed.
+     */
+    const once = () => (started ??= (async () => body())());
+    try {
+        return await spanFn(name, attrs, once);
+    }
+    catch (err) {
+        if (started !== undefined)
+            return started;
+        log(`deploy: span "${name}" failed before the phase ran (${errorText(err)}) — running it un-spanned`);
+        return once();
+    }
+}
+/** Worst-first, so a phase's one-word summary is always its most serious outcome. */
+const STATUS_SEVERITY = ["failed", "refused", "pending", "unobserved", "skipped", "ok"];
+/** The phase's worst recorded step status — the `status` dimension of its span and metric. */
+function phaseStatus(runs, step) {
+    const seen = runs.filter((run) => run.recorded.has(step)).map((run) => run.report.steps[step].status);
+    if (seen.length === 0)
+        return "not-reached";
+    return STATUS_SEVERITY.find((status) => seen.includes(status)) ?? "ok";
+}
+function newInstanceRun(pkg, inst) {
+    return {
+        inst,
+        strategyName: walletName(pkg, inst),
+        needsWallet: false,
+        recorded: new Set(),
+        report: {
+            instance: inst.name,
+            steps: {
+                reconcile: notReached(),
+                preflight: notReached(),
+                create: notReached(),
+                install: notReached(),
+                observe: notReached(),
+            },
+        },
+    };
+}
+/**
+ * Sequential orchestration of one deploy. Resolves with a report in every case —
+ * refusals and failures are reported, never thrown, so the job layer always has
+ * a truthful terminal state to journal.
+ */
+export async function runDeploy(params, deps) {
+    const { pkg, budget, decisionModel } = params;
+    const maxWaitSec = params.maxWaitSec ?? DEFAULT_MAX_WAIT_SEC;
+    const tickWaitSec = params.tickWaitSec ?? DEFAULT_TICK_WAIT_SEC;
+    const runs = pkg.instances.map((inst) => newInstanceRun(pkg, inst));
+    let refused = false;
+    let abandoned = false;
+    let summariesOnce = null;
+    /**
+     * Strategy ids an instance of this package is BOUND to — adopted, or waited on for ACTIVE.
+     *
+     * The gate's question is "which stamped wallets did nothing account for" — a wallet a sibling
+     * sleeve just matched is accounted for, and presenting it to the next sleeve as unexplained
+     * refuses a legitimate partial deploy and points the reader at a teardown of the live sleeve.
+     *
+     * Membership is written by the binding branches of `applyCandidates` themselves, at the same
+     * statement that binds. That placement is the invariant, not a convention layered over one: a
+     * claim that does not bind is unrepresentable, so no editor has to remember the rule and no
+     * checker has to enforce it. The set was previously filled ahead of every branch, which made
+     * "answered for" and "bound to" different things and left the gate one forgetful branch away from
+     * hiding a live funded wallet and letting the deploy fund a second one beside it.
+     *
+     * What is left rests on two properties, in this order of importance:
+     *
+     *  - **Forgetting to claim is SAFE.** A future branch that binds but does not claim under-claims,
+     *    so the gate sees an accounted-for wallet as unaccounted and REFUSES. That is a false refusal,
+     *    which is annoying; the opposite error funds a second wallet beside a live one. The residual
+     *    failure mode points at the fail-closed side, which is the whole reason the claim moved.
+     *  - It is COMPLETE before it is read. `boundaryAbandoned()` returns true on `halted()` before it
+     *    consults `deps.shouldAbandon()`, and pass 2 opens with it — so pass 2 runs only when pass 1
+     *    ran to the end over every instance. That, not iteration order, is why the gate's answer does
+     *    not depend on the order the sleeves are declared in.
+     *
+     * The branches that answer for a candidate and REFUSE claim nothing, and do not need to: each
+     * sets `refused`, `halted()` makes pass 2 a no-op, and a refused sibling can never coexist with a
+     * gated peer in one job. Their claims were always moot — only unsafe to reason about.
+     */
+    const claimed = new Set();
+    /**
+     * The SOFT tier's findings, filled in by the preflight and carried into the final report.
+     *
+     * Only FACTS are stored, never the finished note: the escape depends on what the deploy ends up
+     * having created, which is not known until the report is assembled.
+     */
+    const soft = { min: null, under: [] };
+    /** Narration is fire-and-forget: a broken journal must never change what a deploy does. */
+    const emit = (event) => {
+        try {
+            deps.emit(event);
+        }
+        catch {
+            /* narration only */
+        }
+    };
+    /**
+     * The same rule as {@link emit}, for the same reason: `deps.log` is an injected collaborator, and
+     * it is called from the very catch blocks that exist to keep the report alive. A throwing logger
+     * took the original error with it, escaped `runDeploy`, and left the job layer synthesizing an
+     * empty `instances: []` report — narration deciding the outcome of a deploy that had already
+     * created and funded a wallet.
+     */
+    const log = (line) => {
+        try {
+            deps.log(line);
+        }
+        catch {
+            /* narration only */
+        }
+    };
+    const emitPhase = (phase, detail) => emit({ type: "job", phase, detail });
+    const record = (run, step, outcome) => {
+        run.report.steps[step] = outcome;
+        run.recorded.add(step);
+        emit({
+            type: "step",
+            instance: run.inst.name,
+            step,
+            status: outcome.status,
+            detail: outcome.detail,
+            ...(outcome.evidence ? { evidence: outcome.evidence } : {}),
+        });
+    };
+    const halted = () => refused || abandoned;
+    /** Marks every step not yet recorded as abandoned — for every instance, not just this one. */
+    const honorDeadline = () => {
+        abandoned = true;
+        for (const run of runs) {
+            for (const step of STEP_ORDER) {
+                if (!run.recorded.has(step)) {
+                    record(run, step, { status: "skipped", detail: ABANDONED_DETAIL });
+                }
+            }
+        }
+    };
+    /**
+     * Run one step's body, converting a thrown dependency into a recorded `failed` outcome.
+     *
+     * `runDeploy` promises a report in EVERY case: a throw from any injected collaborator (an MCP
+     * timeout on the create poll, a registry read error) must not escape and leave the job layer
+     * synthesizing an empty `instances: []` report — that erases the wallet, the strategyId and every
+     * completed step from the only surface that reports them.
+     */
+    const guarded = async (run, step, body) => {
+        try {
+            await body();
+        }
+        catch (err) {
+            const message = errorText(err);
+            // Record FIRST, narrate second. `log` cannot throw and `record` narrates through `emit`,
+            // which cannot either — but the ordering is what the promise rests on, so it is written the
+            // way the promise reads: the report is made whole before anything is told about it.
+            if (!run.recorded.has(step)) {
+                record(run, step, {
+                    status: "failed",
+                    detail: `${step} step failed: ${message}`,
+                    evidence: { error: message },
+                });
+            }
+            log(`deploy: ${step} step threw for instance "${run.inst.name}": ${message}`);
+        }
+    };
+    const span = (name, attrs, body) => spanOnce(deps.span, log, name, attrs, body);
+    /**
+     * The step boundary: the only place a pending deadline stop is honored — plus one deliberate
+     * mid-step boundary, ahead of the create phase's unnamed retry, which is the single money-moving
+     * call with no step boundary in front of it (see `createWallet`). Both go through here.
+     */
+    const boundaryAbandoned = () => {
+        if (halted())
+            return true;
+        if (!deps.shouldAbandon())
+            return false;
+        honorDeadline();
+        return true;
+    };
+    /**
+     * L4: `strategy_list` runs unfiltered ONCE per job and is matched in memory (O(n) per instance).
+     *
+     * Backend behaviour verified 2026-08-05 against `senpi-hyperliquid-mcp`: the `strategy_list` tool
+     * exposes no pagination at all — its input schema accepts only filters plus `orderBy`
+     * (`src/tools/strategy.tools.ts`), the `FetchStrategies` GraphQL query selects no `pageInfo`/
+     * cursor fields (`src/clients/senpi.client.ts`), and its own resource doc says "No pagination;
+     * use filters to reduce response size". The full set returns in one call. (The `FetchStrategies`
+     * resolver itself lives in strategy-manager, outside that repo, so a SERVER-side cap cannot be
+     * ruled out from the client — but the tool offers no way to request a second page and no way to
+     * detect truncation, which is exactly why this must be re-verified if it ever changes.)
+     *
+     * Re-verify if that changes: a paginated backend would silently hide name matches and cause
+     * double-creates.
+     */
+    const loadSummaries = async () => {
+        if (summariesOnce === null)
+            summariesOnce = await deps.listStrategies();
+        return summariesOnce;
+    };
+    /**
+     * The gate's own legibility: say so when the read carried strategies but NOT ONE readable
+     * attribution stamp.
+     *
+     * Either way it makes every candidate invisible, so the gate cannot fire and the deploy proceeds
+     * exactly as if the user owned nothing. Silent is the one thing that must not be: a stampless
+     * list of 12 strategies and a genuine "none of these are mine" are indistinguishable without it.
+     *
+     * It reports the observation and BOTH known causes rather than diagnosing one. A producer that
+     * stopped returning `strategyMetadata` is the same failure class as the missing `strategyName`
+     * this gate was built beside — but the spec's own risk list names a second: wallets created
+     * outside the sanctioned paths carry no stamp at all, and a user whose strategies are all of that
+     * kind would be told an MCP fault they do not have.
+     */
+    const noteStamplessList = (summaries) => {
+        if (summaries.length === 0)
+            return;
+        if (summaries.some((s) => s.skillName !== undefined))
+            return;
+        log(`deploy: reconcile read ${summaries.length} live strategy(ies) and NONE carried a readable ` +
+            `attribution stamp (strategyMetadata.skillName) — the unaccounted-wallet gate can see no ` +
+            `candidate on this read and will not fire. Two things produce that, and this read cannot ` +
+            `tell them apart: a producer that stopped returning strategyMetadata, or strategies ` +
+            `created outside the sanctioned paths, which carry no stamp at all. Neither is proof that ` +
+            `none of these wallets belong to package "${pkg.id}".`);
+    };
+    // ── reconcile ─────────────────────────────────────────────────────────────
+    // Protection gate — before ANY backend read or write. A package that cannot stop its own
+    // positions out is never funded, on this path or the skills path.
+    const unprotected = instancesWithoutDslExit(pkg);
+    if (unprotected.length > 0) {
+        refused = true;
+        const detail = buildNoDslExitRefusal(unprotected, pkg);
+        const offenders = new Set(unprotected.map((inst) => inst.name));
+        for (const run of runs) {
+            if (offenders.has(run.inst.name))
+                record(run, "reconcile", { status: "refused", detail });
+        }
+    }
+    // D-6 premise repair: a refusal must mean "nothing was created". Both decision-model gates are
+    // package+params-derivable, so they belong HERE, before any money moves — recorded at the install
+    // step (their old home) they fired AFTER create+fund and stranded a funded wallet with no
+    // rollback and no [E_ROLLBACK_INCOMPLETE]. register.ts's `localStartRefusal` carries the same
+    // pair so the gateway never even starts a job; this copy keeps every other caller gated.
+    for (const run of runs) {
+        if (halted() || run.recorded.has("reconcile"))
+            continue;
+        if (!runtimeUsesLlmDecisions(readRuntimeYaml(run.inst)))
+            continue;
+        if (!decisionModel) {
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildDecisionModelRefusal(run.inst.name, pkg, budget),
+            });
+        }
+        else if (!pkg.decisionModelEnv) {
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildDecisionModelEnvRefusal(run.inst.name, pkg),
+            });
+        }
+    }
+    // D-2 (revised): an unsupported scanner-level `enabled` key. Package-derivable, so it is decided
+    // here rather than discovered after install — and the whole package's offenses go into the one
+    // refusal every affected instance carries, so one read fixes them all. Instances already refused
+    // above keep that refusal — an unprotected package is the more severe finding and leads.
+    const enabledKeys = scannersDeclaringEnabled(pkg);
+    if (enabledKeys.length > 0) {
+        refused = true;
+        const detail = buildScannerEnabledUnsupportedRefusal(enabledKeys, pkg);
+        const affected = new Set(enabledKeys.map((entry) => entry.instance));
+        for (const run of runs) {
+            if (affected.has(run.inst.name) && !run.recorded.has("reconcile")) {
+                record(run, "reconcile", { status: "refused", detail });
+            }
+        }
+    }
+    // The attribution stamp is minted from `pkg.id` VERBATIM (`createWallet`) while the backend
+    // stores what it is given case-normalized, so a mixed-case id is stamped under one spelling and
+    // read back under another — the false "no OPEN strategies to close." over a live funded wallet.
+    // Package-derivable, so it is decided here, before a wallet exists to carry the wrong stamp;
+    // register.ts's `localStartRefusal` carries the same gate so the gateway never even starts a job,
+    // and this copy keeps every other caller gated. Last of the local gates: the ones above are
+    // money-safety findings and lead when a package trips several.
+    if (nonLowercasePackageId(pkg) !== null) {
+        refused = true;
+        const detail = buildNonLowercaseIdRefusal(pkg, budget);
+        for (const run of runs) {
+            if (!run.recorded.has("reconcile"))
+                record(run, "reconcile", { status: "refused", detail });
+        }
+    }
+    // D-6 premise: a refusal must mean "nothing was created". These four conditions are
+    // package-derivable, so they belong here rather than at the install step — the same move the
+    // decision-model gates already made above (see the comment at the top of this block).
+    if (!halted()) {
+        await span("deploy.install_gate", { "senpi.deploy.step": "install_gate" }, async () => {
+            if (boundaryAbandoned())
+                return "skipped";
+            for (const run of runs) {
+                if (run.recorded.has("reconcile"))
+                    continue;
+                let gate;
+                try {
+                    gate = await gateInstance(run.inst);
+                }
+                catch (err) {
+                    // Fail CLOSED, matching the universe check's `unavailable` branch: pre-money, a refusal
+                    // costs nothing and a gate that cannot run has proven nothing. `installRuntimeCore` fails
+                    // OPEN on the same fault, deliberately — refusing a good recipe AT the gateway blocks a
+                    // working install, while refusing a deploy costs only a re-run. Neither side may be
+                    // changed alone.
+                    refused = true;
+                    record(run, "reconcile", {
+                        status: "failed",
+                        detail: buildInstallGateUnavailableDetail(run.inst, errorText(err)),
+                        evidence: { error: errorText(err) },
+                    });
+                    continue;
+                }
+                if (gate.ok)
+                    continue;
+                refused = true;
+                record(run, "reconcile", {
+                    status: "refused",
+                    detail: buildInstallGateRefusal(gate, run.inst, pkg, budget),
+                    evidence: { codes: gate.blocking.map((f) => f.code) },
+                });
+            }
+            return refused ? "refused" : "ok";
+        });
+    }
+    // The proof gate: deploy refuses a package no one has ever observed run. Pre-money like every
+    // gate above it, and BEFORE the universe gate deliberately — this is a local hash comparison over
+    // files already on disk, so it costs nothing and should not sit behind a network read.
+    //
+    // It re-validates nothing and runs no tick. The observe step already waits for the deployed
+    // runtime's tick; spending the deploy deadline on proving code here would report a slow
+    // validation as an unobserved deploy. Producing (or repairing) a proof is the author's loop, run
+    // through `senpi validate` — which is what every refusal below tells the reader to do.
+    if (!halted()) {
+        await span("deploy.proof", { "senpi.deploy.step": "proof" }, async () => {
+            if (boundaryAbandoned())
+                return "skipped";
+            // Before verifying: a package whose instances share a directory cannot BE verified, because
+            // one proof file would answer for two recipes and the unproven one would ride the other's
+            // pass into funding. Refused, not waved through — see `collidingInstanceDirs`.
+            const collisions = collidingInstanceDirs(pkg);
+            if (collisions.length > 0) {
+                refused = true;
+                const detail = buildInstanceDirCollisionRefusal(collisions, pkg);
+                const offenders = new Set(collisions.flatMap((c) => c.instances.map((inst) => inst.name)));
+                for (const run of runs) {
+                    if (run.recorded.has("reconcile") || !offenders.has(run.inst.name))
+                        continue;
+                    record(run, "reconcile", {
+                        status: "refused",
+                        detail,
+                        evidence: { shared_dirs: collisions.map((c) => c.dir) },
+                    });
+                }
+                return "refused";
+            }
+            const verdict = checkPackageProof(pkg);
+            if (verdict.ok)
+                return "ok";
+            refused = true;
+            const detail = buildProofRefusal(verdict, pkg);
+            // The refusal is about the PACKAGE — `verifyProof` answers once for every instance it was
+            // given — so every instance not already refused carries it.
+            for (const run of runs) {
+                if (run.recorded.has("reconcile"))
+                    continue;
+                record(run, "reconcile", {
+                    status: "refused",
+                    detail,
+                    // A small machine-readable bag, like every sibling gate: the prose lives in `detail`.
+                    // `code` comes from the same producer that rendered it, so the two cannot disagree.
+                    evidence: {
+                        reason: verdict.reason,
+                        // `instance_dir`, NOT `instance`: the emitted event already carries a top-level
+                        // `instance` holding the MANIFEST name (see `record`), and two different identifiers
+                        // under one key name on one event is how a consumer joins the wrong two rows.
+                        ...(verdict.instance ? { instance_dir: verdict.instance } : {}),
+                        ...(verdict.changedFiles ? { changed_files: verdict.changedFiles } : {}),
+                        code: proofRefusalParts(verdict, pkg).code,
+                    },
+                });
+            }
+            return "refused";
+        });
+    }
+    // S-1 (user rulings 2026-08-07): the live-universe gate — the deploy-side consumer of the
+    // reusable `checkPackageUniverse` (universe.ts owns the decision; this block only records it).
+    // A dead hardcoded name does not error — the scan skips it and the strategy silently trades
+    // nothing — so it refuses PRE-MONEY, before reconcile even reads the backend. It needs one MCP
+    // read, which is why it lives here as a job-time gate (the E_FUNDS precedent) rather than in
+    // register.ts's synchronous localStartRefusal: every caller passes through runDeploy, so one
+    // site gates them all. It runs BEFORE reconcile deliberately (U-2): installing a blind runtime
+    // on an adopted wallet is the same zombie as funding a fresh one. A package hardcoding nothing
+    // never reads the list at all.
+    if (!halted()) {
+        await span("deploy.universe", { "senpi.deploy.step": "universe" }, async () => {
+            // The same step boundary every other MCP-touching phase honors: once the watchdog has asked
+            // for a stop, no new deadline-bounded read may be opened ahead of it.
+            if (boundaryAbandoned())
+                return "skipped";
+            const verdict = await checkPackageUniverse(pkg, deps);
+            // Narration is computed from the verdict, never a forward claim a tickerless package would
+            // falsify — so nothing is announced for a package with nothing to check. It is rendered in
+            // plain words: the union's tag names are internal, and a journal line is read by people.
+            const narration = describeUniverseVerdict(verdict);
+            if (narration)
+                emitPhase("reconcile", narration);
+            if (verdict.status === "no-hardcoded" || verdict.status === "clean")
+                return "ok";
+            if (verdict.status === "unavailable") {
+                // Fail-closed, exactly the thrown funds-preflight shape: the halt flag stops the run, the
+                // STEP status carries the truth, and no instrument is named dead on a read that failed.
+                refused = true;
+                log(`deploy: universe check failed: ${verdict.reason}`);
+                const detail = buildUniverseUnavailableDetail(verdict.reason, pkg);
+                for (const run of runs) {
+                    if (!run.recorded.has("reconcile")) {
+                        record(run, "reconcile", { status: "failed", detail, evidence: { error: verdict.reason } });
+                    }
+                }
+                return "failed";
+            }
+            refused = true;
+            const detail = buildUniverseNotLiveRefusal(verdict.dead, pkg, verdict.liveCount, budget);
+            // The refusal lands on every instance whose own file carries a dead name; a strategy.yaml
+            // (catalog.assets) offense belongs to the whole package, so it lands on every instance.
+            const deadFiles = new Set([...verdict.dead.values()].flat().map((occ) => occ.file));
+            const packageWide = deadFiles.has(join(pkg.dir, "strategy.yaml"));
+            for (const run of runs) {
+                if (run.recorded.has("reconcile"))
+                    continue;
+                if (packageWide || deadFiles.has(run.inst.runtimeYamlPath)) {
+                    record(run, "reconcile", {
+                        status: "refused",
+                        detail,
+                        evidence: { dead: [...verdict.dead.keys()], liveCount: verdict.liveCount },
+                    });
+                }
+            }
+            return "refused";
+        });
+    }
+    if (!halted())
+        emitPhase("reconcile", `matching ${pkg.instances.length} instance(s) against live strategies`);
+    await span("deploy.reconcile", { "senpi.deploy.step": "reconcile" }, async () => {
+        /**
+         * TWO passes, because the gate below asks a whole-package question and cannot be answered from
+         * a half-reconciled package.
+         *
+         * Pass 1 resolves every instance's binding and records which strategies answered. Pass 2 then
+         * gates the instances nobody accounted for against the wallets nobody accounted for. Deciding
+         * both inside one loop made the answer depend on iteration order: a two-sleeve package with
+         * only sleeve 1 live (a crashed deploy, a sleeve added to a live package, a sleeve closed by
+         * hand) refused sleeve 2 over the wallet sleeve 1 had just adopted — and the only actionable
+         * route the refusal names tears down the whole package, i.e. the live funded sleeve beside it.
+         */
+        const unresolved = [];
+        for (const run of runs) {
+            if (boundaryAbandoned())
+                break;
+            await guarded(run, "reconcile", () => resolveInstanceBinding(run, unresolved));
+            if (halted())
+                break;
+        }
+        if (unresolved.length > 0 && summariesOnce)
+            noteStamplessList(summariesOnce);
+        for (const run of unresolved) {
+            if (boundaryAbandoned())
+                break;
+            await guarded(run, "reconcile", () => gateOrCreate(run));
+            if (halted())
+                break;
+        }
+        return phaseStatus(runs, "reconcile");
+    });
+    /**
+     * Pass 1: bind this instance to a live strategy by name or by journaled create key, or defer it
+     * to the gate. A strategy an instance BINDS to is claimed (see {@link claimed}) — adopted or
+     * waited on for ACTIVE — so a sibling sleeve's gate does not read it as unexplained.
+     */
+    async function resolveInstanceBinding(run, unresolved) {
+        const summaries = await loadSummaries();
+        // The backend LOWERCASES a name on create (observed: "WARPATH" in, "warpath" back), so a
+        // case-sensitive compare would miss exactly the strategies it stored for us and fund a second
+        // wallet beside them. An empty name on either side is not a match — two absences are not an
+        // identity, and an unnamed strategy would otherwise bind to the first instance that asked.
+        const wanted = run.strategyName.trim().toLowerCase();
+        const byName = wanted
+            ? summaries.filter((s) => (s.strategyName ?? "").trim().toLowerCase() === wanted &&
+                !DEAD_STATUSES.includes(s.status.toUpperCase()))
+            : [];
+        if (byName.length > 0) {
+            /**
+             * A name is not an identity. `walletName` derives it from `<id>-<instance>` (or the bare id
+             * for a flat package), so two DIFFERENT packages can produce the same one — a multi-sleeve
+             * `alpha`/`one` and a flat package whose id IS `alpha-one` both land on "alpha-one", and both
+             * pass `assertIdentityRoundTrips`. Matched on the name alone, this package's deploy ADOPTS
+             * the other's funded wallet: install then puts a second runtime on it, and the positions and
+             * the money belong to a package nobody asked about.
+             *
+             * The stamp is the only thing in this read that can say whose wallet it is, so a candidate is
+             * FOREIGN only when it carries one and it names someone else. Absent is not foreign — and
+             * that half is load-bearing, not leniency. Pass 2's doc records that its own stamp gate "does
+             * NOT survive STAMP starvation: an MCP that stops returning `strategyMetadata`…". A strict
+             * match here would inherit exactly that failure with the money pointing the other way: on a
+             * starved read every re-run of a working package would stop recognising its own wallet and
+             * fund a second one beside it, converting a benign producer fault into a duplicate-funding
+             * bug. Wallets predating attribution, and wallets created by hand through the MCP, are
+             * stampless for the same reason and are equally not evidence of foreign ownership.
+             *
+             * Case-folded on both sides, for the reason pass 2's filter states: the backend
+             * case-normalizes what it stores and `sanitizeStrategyName` preserves capitals, so a
+             * case-sensitive compare would read a package's OWN stamp as someone else's.
+             */
+            const stamp = pkg.id.trim().toLowerCase();
+            const claimantOf = (s) => (s.skillName ?? "").trim().toLowerCase();
+            const ours = byName.filter((s) => claimantOf(s) === "" || claimantOf(s) === stamp);
+            if (ours.length > 0) {
+                /**
+                 * Dropping the foreign rows narrows the list `applyCandidates` COUNTS, and >1 there is the
+                 * `E_STATE_AMBIGUOUS_WALLETS` refusal. So the drop is allowed only where the stamp really
+                 * does say which is which: at least one survivor has to carry THIS package's stamp.
+                 *
+                 * A survivor that carries no stamp proves nothing about ownership — that is the whole point
+                 * of treating absent as not-foreign above — so a stampless row standing beside a proven
+                 * foreign one under the same name is not "ours, obviously": the foreign row is positive
+                 * evidence the name is contested, and a raw `strategy_create_custom_strategy` or a
+                 * pre-attribution create is exactly how a stampless wallet gets there. Collapsing that pair
+                 * to one adoption would install this package's runtime onto a funded wallet nothing proved
+                 * was its own. Keep the full list instead, so the count still reaches the ambiguity refusal
+                 * and the operator triages it read-only, pre-money.
+                 *
+                 * When nothing foreign matched at all, `ours` IS `byName` and this decides nothing — the
+                 * stamp-starvation path (every row stampless) is unaffected either way.
+                 */
+                const proven = ours.some((s) => claimantOf(s) === stamp);
+                applyCandidates(run, proven ? ours : byName, "name", 
+                // Only the rows this call actually dropped: when the list is not narrowed, none were.
+                proven ? byName.filter((s) => !ours.includes(s)) : []);
+                return;
+            }
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildForeignPackageRefusal(pkg, run.inst.name, run.strategyName, byName, budget),
+                evidence: {
+                    instance: run.inst.name,
+                    strategyName: run.strategyName,
+                    // Same absence rules as pass 2's evidence: an id or address the backend did not report is
+                    // OMITTED, never handed to a `--json` reader as the empty string.
+                    candidates: byName.map((s) => ({
+                        ...(s.id?.trim() ? { strategyId: s.id.trim() } : {}),
+                        ...(s.strategyWalletAddress?.trim() ? { wallet: s.strategyWalletAddress.trim() } : {}),
+                        ...(s.skillName?.trim() ? { skillName: s.skillName.trim() } : {}),
+                        status: s.status,
+                        totalFunded: s.totalFunded,
+                    })),
+                },
+            });
+            return;
+        }
+        // C2: a create whose custom name the backend rejected lands under a backend-assigned name, so
+        // the name match above can never find it again and a re-run would fund a SECOND wallet beside
+        // it. The journal supplies the strategyId it recorded at create time; the BACKEND decides
+        // whether that id still means anything — a dead key falls straight through to a fresh create.
+        const priorIds = params.priorStrategyIds?.get(run.inst.name) ?? [];
+        if (priorIds.length > 0) {
+            const verified = (await deps.listStrategies({ strategyIds: priorIds })).filter((s) => !DEAD_STATUSES.includes(s.status.toUpperCase()));
+            if (verified.length > 0) {
+                applyCandidates(run, verified, "created-key");
+                return;
+            }
+        }
+        unresolved.push(run);
+    }
+    /**
+     * Pass 2: no match route accounted for this instance. If wallets stamped with this package are
+     * live and unclaimed, "I could not account for these" is NOT "there are none": creating here
+     * funds a second wallet beside a live one, and the install step then moves the runtime onto the
+     * new wallet, leaving the old one funded, in position and supervised by nothing. Refuse while no
+     * money has moved.
+     *
+     * This holds when the NAME route is starved (an older MCP build, a backend that renames) —
+     * that is the failure it was built for. It does NOT survive STAMP starvation: an MCP that stops
+     * returning `strategyMetadata` empties this filter and the gate silently stops existing, which is
+     * why a stampless non-empty list is logged rather than passed over in silence.
+     */
+    async function gateOrCreate(run) {
+        const summaries = await loadSummaries();
+        // Case-folded on BOTH sides, like the name match: the backend case-normalizes what it stores,
+        // and a case-sensitive compare here fails OPEN — a package id with a capital in it would find
+        // no stamped wallet, and the gate that exists to stop a second funded wallet would wave it
+        // through. `sanitizeStrategyName` deliberately preserves capitals, so this is reachable.
+        const stamp = pkg.id.trim().toLowerCase();
+        const stamped = summaries.filter((s) => (s.skillName ?? "").trim().toLowerCase() === stamp &&
+            !DEAD_STATUSES.includes(s.status.toUpperCase()) &&
+            !isAccountedFor(claimed, s.id));
+        if (stamped.length > 0) {
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildBindingUnknownRefusal(pkg, run.inst.name, run.strategyName, stamped, budget),
+                evidence: {
+                    instance: run.inst.name,
+                    candidates: stamped.map((s) => ({
+                        // The id gets the same treatment as the wallet below, and for a sharper reason: an
+                        // unreadable id is exactly why this candidate could not be proven accounted for, so
+                        // reporting it as `""` would hand a `--json` reader the empty string as an identifier.
+                        ...(s.id?.trim() ? { strategyId: s.id.trim() } : {}),
+                        // Same rule as `totalFunded`: an address the backend did not report is ABSENT here, not
+                        // an empty string. The prose says "unreadable"; a consumer of the evidence must not read
+                        // a falsy-but-present `""` as an address, and the key is omitted rather than set to
+                        // undefined so `in`/`hasOwnProperty` agree with the JSON a `--json` reader sees.
+                        ...(s.strategyWalletAddress?.trim() ? { wallet: s.strategyWalletAddress.trim() } : {}),
+                        status: s.status,
+                        totalFunded: s.totalFunded,
+                        createdAt: s.createdAt,
+                    })),
+                },
+            });
+            return;
+        }
+        run.needsWallet = true;
+        record(run, "reconcile", {
+            status: "ok",
+            detail: `no live strategy named "${run.strategyName}" — a wallet will be created`,
+        });
+    }
+    /**
+     * The single reconcile decision, shared by both ways of finding a candidate: >1 is ambiguous and
+     * refuses; a single one branches on its live status (ACTIVE adopt / initializing wait / anything
+     * else refuse). Keeping one copy is what stops the two match routes from drifting apart.
+     */
+    function applyCandidates(run, candidates, matchedBy, 
+    /**
+     * Live strategies that shared the matched NAME and were dropped as another package's. Reported
+     * rather than silently discarded: the collision is a durable fact about the backend, and the
+     * operator meets it again at the next `close.py`, rename or status read. It never changes what
+     * this function decides — the decision is made from `candidates` alone.
+     */
+    ignoredForeign = []) {
+        const provenance = matchedByClause(matchedBy) + foreignCollisionClause(ignoredForeign);
+        /**
+         * Record that THIS instance is bound to `strategyId`, so a sibling sleeve's gate does not read
+         * that wallet as one nothing accounted for.
+         *
+         * Called from the binding branches below ONLY, at the statement that binds — never ahead of the
+         * branch that decides, which is what made a claim that binds nothing representable at all.
+         * {@link claimStrategyId} owns what may be recorded.
+         */
+        const claim = (strategyId) => claimStrategyId(claimed, strategyId);
+        if (candidates.length > 1) {
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildAmbiguousRefusal(candidates.length, matchedBy === "name"
+                    ? `named "${run.strategyName}"`
+                    : `journaled as created for instance "${run.inst.name}"`, run.inst.name),
+                evidence: {
+                    strategyName: run.strategyName,
+                    matchedBy,
+                    // `null`, not `""`, for an id the backend did not report. The omit-the-key rule the other
+                    // evidence sites use cannot apply inside an array without changing its length — and the
+                    // length IS the ambiguity being reported, so it has to survive. `null` is the array's
+                    // form of absent, and unlike `""` a consumer cannot mistake it for an identifier.
+                    candidates: candidates.map((c) => c.id?.trim() || null),
+                },
+            });
+            return;
+        }
+        const matched = candidates[0];
+        const status = matched.status.toUpperCase();
+        const wallet = matched.strategyWalletAddress?.trim() ?? "";
+        const evidence = {
+            // The rows the stamp partition dropped, on every record this bind produces. Same absence
+            // rules as the candidate lists above: a field the backend did not report is OMITTED.
+            ...(ignoredForeign.length > 0
+                ? {
+                    alsoNamed: ignoredForeign.map((s) => ({
+                        ...(s.id?.trim() ? { strategyId: s.id.trim() } : {}),
+                        ...(s.strategyWalletAddress?.trim() ? { wallet: s.strategyWalletAddress.trim() } : {}),
+                        ...(s.skillName?.trim() ? { skillName: s.skillName.trim() } : {}),
+                        status: s.status,
+                    })),
+                }
+                : {}),
+            // Same rule as the gate's candidate rows: an unreadable id is ABSENT from the evidence rather
+            // than reported as the empty string, so a `--json` reader never reads `""` as an identifier.
+            ...(matched.id?.trim() ? { strategyId: matched.id.trim() } : {}),
+            strategyName: matched.strategyName,
+            status: matched.status,
+            strategyWalletAddress: matched.strategyWalletAddress,
+            totalFunded: matched.totalFunded,
+        };
+        if (status === "ACTIVE" && !wallet) {
+            // deploy.py's "unreadable" refusal (taxonomy: E_STATE_AMBIGUOUS_WALLETS covers a candidate
+            // whose address cannot be read). Adopting a blank address would install onto `undefined`;
+            // creating a second wallet would double-fund what may be a live strategy. Refuse both.
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildUnreadableWalletRefusal(matched.strategyName, run.inst.name, matched.id),
+                evidence: { ...evidence, matchedBy },
+            });
+            return;
+        }
+        run.report.strategyId = matched.id;
+        if (status !== "ACTIVE" && !INITIALIZING_STATUSES.includes(status)) {
+            // PAUSED, mid-teardown, or unrecognised: waiting cannot help, so refuse with the real status
+            // and a next step computed from it rather than burning --max-wait on "still funding".
+            refused = true;
+            record(run, "reconcile", {
+                status: "refused",
+                detail: buildNotDeployableRefusal(matched, run.inst.name, pkg, budget),
+                evidence: { ...evidence, matchedBy },
+            });
+            return;
+        }
+        if (status !== "ACTIVE") {
+            // Still initializing (CREATE_WALLET → FUND_WALLET → … → ACTIVE). Do NOT adopt the wallet and
+            // do NOT skip to install: the create phase runs the same bounded ACTIVE poll a fresh wallet
+            // gets, so a transient state reports `pending` (re-run to resume), never `failed`.
+            run.awaitingActive = matched.id;
+            claim(matched.id);
+            record(run, "reconcile", {
+                status: "ok",
+                detail: `matched live strategy "${matched.strategyName}" (status ${matched.status})${provenance} — ` +
+                    `not ACTIVE yet, waiting for it rather than creating a second wallet`,
+                evidence: { ...evidence, matchedBy },
+            });
+            record(run, "preflight", {
+                status: "skipped",
+                detail: "instance already has a strategy — no new wallet to fund",
+            });
+            return;
+        }
+        run.report.wallet = wallet;
+        run.report.funded = matched.totalFunded;
+        claim(matched.id);
+        record(run, "reconcile", {
+            status: "ok",
+            detail: `matched live strategy "${matched.strategyName}" (status ${matched.status})${provenance}`,
+            evidence: { ...evidence, matchedBy },
+        });
+        record(run, "preflight", { status: "skipped", detail: "instance already has a wallet" });
+        record(run, "create", {
+            status: "skipped",
+            detail: buildAdoptedWalletDetail(pkg, run.inst, matched, wallet, budget, matchedBy),
+            evidence: { ...evidence, matchedBy },
+        });
+    }
+    // ── preflight ─────────────────────────────────────────────────────────────
+    const needing = runs.filter((run) => run.needsWallet);
+    if (!halted() && needing.length > 0) {
+        emitPhase("preflight", `checking accessible balance for ${needing.length} new wallet(s)`);
+        await span("deploy.preflight", { "senpi.deploy.step": "preflight" }, async () => {
+            if (!boundaryAbandoned()) {
+                try {
+                    await runPreflight();
+                }
+                catch (err) {
+                    // A thrown preflight is fail-closed: no balance was proven, so nothing is created.
+                    const message = errorText(err);
+                    refused = true;
+                    log(`deploy: preflight threw: ${message}`);
+                    for (const run of needing) {
+                        if (!run.recorded.has("preflight")) {
+                            record(run, "preflight", {
+                                status: "failed",
+                                detail: `preflight step failed: ${message}. Nothing was created.`,
+                                evidence: { error: message },
+                            });
+                        }
+                    }
+                }
+            }
+            return phaseStatus(runs, "preflight");
+        });
+    }
+    async function runPreflight() {
+        if (budget === undefined) {
+            refused = true;
+            const detail = buildBudgetRequiredRefusal(needing.length, pkg);
+            for (const run of needing)
+                record(run, "preflight", { status: "refused", detail });
+            return;
+        }
+        if (budget <= 0) {
+            refused = true;
+            const detail = buildBudgetNotPositiveRefusal(budget, needing.length, pkg);
+            for (const run of needing)
+                record(run, "preflight", { status: "refused", detail });
+            return;
+        }
+        let available = null;
+        try {
+            available = accessibleUsd(await deps.getPortfolio());
+        }
+        catch (err) {
+            log(`deploy: portfolio read failed (${errorText(err)}) — ` +
+                `proceeding without a local balance check; the backend is the funding authority`);
+            available = null;
+        }
+        const plan = planFunding(needing.map((run) => ({ name: run.inst.name, fundingShare: run.inst.fundingShare })), budget, available);
+        if (plan.shortfall) {
+            refused = true;
+            const detail = underfundedNote(plan.shortfall, needing.map((run) => ({ fundingShare: run.inst.fundingShare })), pkg.dir);
+            for (const run of needing) {
+                record(run, "preflight", { status: "refused", detail, evidence: { ...plan.shortfall } });
+            }
+            return;
+        }
+        // The HARD floor has now passed. Everything above is the money gate — `planFunding` floors each
+        // wallet at MIN_WALLET and `underfundedNote` halts. What follows is the SOFT tier, and the two
+        // must never be confused: it is a local estimate over the package's own YAML, the backend does
+        // not enforce it, and a user is entitled to size their own budget. It warns and proceeds.
+        //
+        // It is handed the PLAN, not the budget: the claim is about what each wallet actually receives.
+        applyCalculatedMinimum(plan.amounts);
+        for (const run of needing) {
+            run.fundAmount = plan.amounts.get(run.inst.name);
+            record(run, "preflight", {
+                status: "ok",
+                detail: available === null
+                    ? `will fund ${usd(run.fundAmount ?? 0)} — accessible balance unreadable, proceeding (the backend is the funding authority)`
+                    : `will fund ${usd(run.fundAmount ?? 0)} of ${usd(available)} accessible`,
+                evidence: { initialBudget: run.fundAmount, accessibleUsd: available },
+            });
+        }
+    }
+    /**
+     * The SOFT calculated-minimum tier. The package-level figure is computed over the WHOLE package
+     * (every sleeve's share of a hypothetical fresh deploy) and rides the report as CONTEXT — but the
+     * shortfall CLAIM is per-wallet, over the allocation `planFunding` just decided.
+     *
+     * That split is the whole point. Those two questions have different denominators on a
+     * partially-adopted deploy: `planFunding` divides among the instances still NEEDING a wallet,
+     * while the minimum divides among all of them. Comparing budget-to-package-minimum therefore
+     * announced a shortfall on a re-run that was handing one $13.50 sleeve the entire $20 — a claim
+     * about money that is not moving, which is the same rule that makes an adopted-ONLY deploy skip
+     * this check entirely.
+     *
+     * Advisory by construction: it records facts, never a step status, and a throw is swallowed. A
+     * warning that cannot be computed is a missing warning, never a failed deploy.
+     */
+    function applyCalculatedMinimum(amounts) {
+        // The guard covers the WHOLE body, not just `packageMinBudget`. It used to end before the note
+        // was rendered, so a throw from `buildSoftBudgetNote`/`forwardTense` escaped into the preflight
+        // catch and REFUSED the deploy — the one outcome this tier's own doc rules out. Fail-closed, so
+        // never a money bug; a flat contradiction of the contract two lines above it, which is how the
+        // next editor learns the wrong rule.
+        try {
+            const result = packageMinBudget(pkg);
+            soft.min = result;
+            const needsOf = new Map(result.breakdown.map((row) => [row.wallet, row.perWalletMin]));
+            for (const [wallet, funded] of amounts) {
+                const needs = needsOf.get(wallet);
+                if (needs !== undefined && funded < needs)
+                    soft.under.push({ wallet, funded, needs });
+            }
+            // No escape in the narration: at preflight nothing has been created yet, so there is nothing
+            // to close. The final report re-renders this note with the escape its own state supports. The
+            // tense here is forward-looking — every short wallet is about to be funded and run — so both
+            // per-row sets are full and the narration reads "funds …; will run DEGRADED".
+            const note = buildSoftBudgetNote(pkg, result, soft.under, "", forwardTense(soft.under));
+            if (note === null)
+                return;
+            log(`deploy: ${note}`);
+            emit({
+                type: "job",
+                phase: "preflight",
+                detail: note,
+                evidence: {
+                    minBudget: result.minBudget,
+                    walletCount: result.walletCount,
+                    bindingWallet: result.bindingWallet,
+                    unresolvedWallets: result.unresolvedWallets,
+                    underfunded: soft.under,
+                },
+            });
+        }
+        catch (err) {
+            log(`deploy: calculated-minimum check skipped (${errorText(err)}) — advisory only`);
+        }
+    }
+    // ── create ────────────────────────────────────────────────────────────────
+    const createTargets = runs.filter((run) => run.needsWallet || run.awaitingActive);
+    if (!halted() && createTargets.length > 0) {
+        const fresh = createTargets.filter((run) => run.needsWallet).length;
+        const waiting = createTargets.length - fresh;
+        emitPhase("create", waiting === 0
+            ? `creating and funding ${fresh} wallet(s)`
+            : `creating and funding ${fresh} wallet(s); waiting for ${waiting} existing strategy(ies) to become ACTIVE`);
+        await span("deploy.create", { "senpi.deploy.step": "create" }, async () => {
+            for (const run of createTargets) {
+                if (boundaryAbandoned())
+                    break;
+                await guarded(run, "create", () => createInstance(run));
+            }
+            return phaseStatus(runs, "create");
+        });
+    }
+    /**
+     * A create call that never throws: the backend surfaces a name rejection as a `success:false`
+     * message in some paths and as a thrown MCP error in others, and only one of those shapes must
+     * not decide whether the best-effort naming fallback fires (deploy.py caught the exception).
+     */
+    async function callCreate(params) {
+        try {
+            return await deps.createCustomStrategy(params);
+        }
+        catch (err) {
+            // Residual window, stated precisely because it is not closed here: a create abandoned at its
+            // per-call deadline is recorded WITHOUT a journaled create key — the key only exists in the
+            // response that never arrived. The deadline bounds this job's wait, not the backend's work,
+            // so the create may still succeed afterwards. A re-run then finds that wallet by NAME, which
+            // is enough in every case but one: the custom name was also rejected, so the wallet landed
+            // under a backend-assigned name AND has no journaled key. That wallet is invisible to both
+            // reconcile paths and a re-run funds a second one beside it. Narrow (needs a >90s create and
+            // a rejected name) and unchanged by the C2 carve-out, which could only ever journal a key it
+            // received; closing it needs an idempotency key on the create tool, not a client-side fix.
+            // Until then the failure detail below tells the operator exactly what to check.
+            return { success: false, message: errorText(err), aborted: isDeadlineAbort(err) };
+        }
+    }
+    async function createInstance(run) {
+        const strategyId = run.awaitingActive ?? (await createWallet(run));
+        if (!strategyId)
+            return;
+        run.report.strategyId = strategyId;
+        await pollUntilActive(run, strategyId);
+    }
+    /** Create + fund a fresh wallet. Returns its strategyId, or undefined when the step already failed. */
+    async function createWallet(run) {
+        const initialBudget = run.fundAmount ?? 0;
+        const attribution = { skillName: pkg.id, skillVersion: pkg.version };
+        let result = await callCreate({ initialBudget, strategyName: run.strategyName, ...attribution });
+        // Whether the abandoned create (if it comes to that) is the UNNAMED second attempt. Known here
+        // and nowhere else — and it is the whole difference between "a re-run adopts it by name" and
+        // "no route can ever find it", so the report must not have to hedge about which happened.
+        let nameFallbackFired = false;
+        if (!result.success && isNameRejection(result.message ?? "")) {
+            // The ONE money-moving call in this file with no step boundary ahead of it — every other one
+            // is preceded by `boundaryAbandoned()`. It needs its own, because `callCreate` mints a FRESH
+            // `MCP_CALL_TIMEOUT_MS` deadline: a retry issued after the soft stop can still be awaiting a
+            // funded create 90s later, while the grace (`GRACE_MS`, sized to outlast exactly one in-flight
+            // call) has already force-terminated the job and handed the single-flight slot on. The next
+            // deploy then runs its preflight against a balance this one is still spending — the overlap
+            // the grace arithmetic exists to make impossible.
+            //
+            // Recorded BEFORE the sweep, so this instance's create keeps the detail that says which call
+            // was issued and which was not; `honorDeadline` only fills steps nothing has recorded.
+            if (deps.shouldAbandon()) {
+                record(run, "create", {
+                    status: "failed",
+                    detail: buildCreateNameRetryNotIssuedDetail({
+                        instance: run.inst.name,
+                        strategyName: run.strategyName,
+                        fundAmount: initialBudget,
+                        message: result.message,
+                        pkg,
+                        budget,
+                    }),
+                    evidence: { success: false, message: result.message, retryIssued: false },
+                });
+                boundaryAbandoned();
+                return undefined;
+            }
+            // deploy.py:447 parity — naming is best-effort legibility and must never block a deploy.
+            // Narrated as a job event: it is not the create step's recorded outcome.
+            emit({
+                type: "job",
+                phase: "create",
+                detail: `name "${run.strategyName}" rejected (${result.message}); creating without a custom name`,
+            });
+            nameFallbackFired = true;
+            result = await callCreate({ initialBudget, ...attribution });
+        }
+        if (!result.success || !result.strategyId) {
+            record(run, "create", {
+                status: "failed",
+                detail: result.aborted
+                    ? buildCreateAbandonedDetail({
+                        instance: run.inst.name,
+                        strategyName: run.strategyName,
+                        nameFallbackFired,
+                        fundAmount: run.fundAmount ?? 0,
+                        message: result.message,
+                        pkg,
+                        budget,
+                    })
+                    : `wallet creation failed: ${result.message ?? "backend returned no strategyId"}`,
+                evidence: {
+                    success: result.success,
+                    message: result.message,
+                    strategyId: result.strategyId,
+                    ...(result.aborted ? { outcome: "unknown" } : {}),
+                },
+            });
+            return undefined;
+        }
+        // C2: journal the create key BEFORE the ACTIVE poll — a crash during that poll is exactly the
+        // window in which the create step's own outcome never gets recorded, and (when the custom name
+        // was rejected) the strategy is unfindable by name afterwards. This event is the only thing
+        // that lets a re-run adopt it instead of funding a second wallet beside it.
+        //
+        // `requested` rides the same line for the same reason, one narration tier down: the ask exists
+        // nowhere else once this process dies, and the run that later ADOPTS this strategy needs it to
+        // notice that the backend landed less than was asked for. It is a lookup input to a WARN only
+        // (see DeployParams.priorRequested) — never an orchestration decision, and never the funded
+        // figure, which is always re-read live.
+        emit({
+            type: "job",
+            phase: "create",
+            detail: `wallet created for instance "${run.inst.name}" (strategyId ${result.strategyId})`,
+            evidence: { instance: run.inst.name, strategyId: result.strategyId, requested: initialBudget },
+        });
+        return result.strategyId;
+    }
+    /** The bounded ACTIVE poll — shared by a freshly created wallet and an adopted initializing one. */
+    async function pollUntilActive(run, strategyId) {
+        const deadline = deps.now() + maxWaitSec * 1000;
+        for (;;) {
+            const [live] = await deps.listStrategies({ strategyIds: [strategyId] });
+            if (live && live.status.toUpperCase() === "ACTIVE" && live.strategyWalletAddress) {
+                run.report.wallet = live.strategyWalletAddress;
+                run.report.funded = live.totalFunded;
+                record(run, "create", {
+                    status: "ok",
+                    // An adopted instance was never funded by THIS run, so it carries the same
+                    // budget-not-applied note the ACTIVE-adopt path renders; a freshly created wallet was
+                    // funded to its planned share and needs none.
+                    detail: run.awaitingActive
+                        ? buildAdoptedWalletDetail(pkg, run.inst, live, live.strategyWalletAddress, budget)
+                        : `wallet ${live.strategyWalletAddress} is ACTIVE, ${fundedClause(live.totalFunded)}`,
+                    evidence: {
+                        strategyId,
+                        strategyName: live.strategyName,
+                        status: live.status,
+                        strategyWalletAddress: live.strategyWalletAddress,
+                        totalFunded: live.totalFunded,
+                    },
+                });
+                return;
+            }
+            // Only INITIALIZING statuses resolve on their own, so only they are worth waiting on (the
+            // same rule reconcile applies two screens up). Everything else that is not ACTIVE burns the
+            // whole --max-wait and is then reported `pending` with "wallet still funding" — false for
+            // every one of them. Dead first: it is a subset with its own, opposite re-run consequence.
+            if (live && isDead(live.status)) {
+                record(run, "create", {
+                    status: "failed",
+                    detail: buildCreateDeadDetail(pkg, budget, live, run.awaitingActive === undefined),
+                    evidence: {
+                        strategyId,
+                        status: live.status,
+                        strategyWalletAddress: live.strategyWalletAddress,
+                        totalFunded: live.totalFunded,
+                    },
+                });
+                return;
+            }
+            if (live && live.status.toUpperCase() !== "ACTIVE" && !isInitializing(live.status)) {
+                record(run, "create", {
+                    status: "failed",
+                    detail: buildCreateNotDeployableDetail(pkg, budget, live, run.awaitingActive === undefined, 
+                    // Scoped HERE, where the sibling runs are in scope — the detail builder is pure.
+                    buildPackageCloseOffer(pkg, runs, run, live)),
+                    evidence: {
+                        strategyId,
+                        status: live.status,
+                        strategyWalletAddress: live.strategyWalletAddress,
+                        totalFunded: live.totalFunded,
+                    },
+                });
+                return;
+            }
+            if (deps.now() >= deadline) {
+                record(run, "create", {
+                    status: "pending",
+                    // `budget` verbatim, never a per-instance fallback: an adopted instance has no
+                    // fundAmount, and `--budget 0` is a command no one can usefully run.
+                    detail: buildCreatePendingDetail(pkg, budget, maxWaitSec),
+                    evidence: { strategyId, status: live?.status ?? null },
+                });
+                return;
+            }
+            await deps.sleep(CREATE_POLL_MS);
+            if (deps.shouldAbandon()) {
+                record(run, "create", {
+                    status: "pending",
+                    detail: `deploy deadline hit while waiting for wallet ${strategyId} to become ACTIVE — the wallet ` +
+                        `may still be funding. Nothing was rolled back; re-run \`${resumeCommand(pkg.dir, budget)}\` to resume`,
+                    evidence: { strategyId },
+                });
+                honorDeadline();
+                return;
+            }
+        }
+    }
+    // ── install ───────────────────────────────────────────────────────────────
+    const installable = runs.filter((run) => run.report.wallet);
+    if (!halted() && installable.length > 0) {
+        emitPhase("install", `installing ${installable.length} runtime(s)`);
+        await span("deploy.install", { "senpi.deploy.step": "install" }, async () => {
+            for (const run of installable) {
+                if (boundaryAbandoned())
+                    break;
+                await guarded(run, "install", () => installInstance(run));
+            }
+            return phaseStatus(runs, "install");
+        });
+    }
+    async function installInstance(run) {
+        const wallet = run.report.wallet;
+        const runtimeId = sanitizeStrategyName(`${pkg.id}-${run.inst.name}`);
+        /** Prefixed onto the install detail when a dead registry row was cleared out of the way. */
+        let replacedDeadRow = "";
+        const onWallet = await deps.registryFindByWallet(wallet);
+        if (onWallet) {
+            if (await deps.runtimeIsLive(onWallet.id)) {
+                run.installedAtMs = deps.now();
+                run.report.runtimeId = onWallet.id;
+                record(run, "install", {
+                    status: "skipped",
+                    detail: `runtime already registered AND running on this wallet (id "${onWallet.id}")`,
+                    evidence: { id: onWallet.id, wallet, live: true },
+                });
+                return;
+            }
+            // H4: a registry row with no live handle is a previous install that died before start —
+            // reporting it `skipped` would be a clean line over a dead runtime, the DOA shape again.
+            await deps.deleteRuntime(onWallet.id);
+            emit({
+                type: "job",
+                phase: "install",
+                detail: `registry entry "${onWallet.id}" had no live runtime — deleted; reinstalling on this wallet`,
+            });
+            replacedDeadRow = `registry entry "${onWallet.id}" had no live runtime — deleted and reinstalled. `;
+            // fall through to the normal install path below
+        }
+        // The decision-model gates ran before reconcile — by here they are settled, so no refusal
+        // (and therefore no un-rolled-back funded wallet) can originate at the install step.
+        // The verb never reuses an old wallet: a same-id runtime bound elsewhere is deleted and
+        // recreated on the fresh wallet rather than left pointing at stale money.
+        let replaced = replacedDeadRow;
+        const byId = await deps.registryFindById(runtimeId);
+        if (byId && byId.wallet?.toLowerCase() !== wallet.toLowerCase()) {
+            // Includes an entry whose wallet is unreadable: leaving it in place makes installRuntime
+            // refuse with a bare "already exists" plus a `runtime delete` hint, instead of this verb's
+            // own never-reuse-an-old-wallet outcome.
+            await deps.deleteRuntime(runtimeId);
+            replaced +=
+                `existing runtime was on an old wallet (${byId.wallet ?? "address unreadable"}) — deleting ` +
+                    `and recreating on the fresh wallet; never reusing the old one. `;
+        }
+        let runtimeYamlContent;
+        try {
+            runtimeYamlContent = renderRuntimeYaml(run.inst, wallet, decisionModel && pkg.decisionModelEnv
+                ? { env: pkg.decisionModelEnv, model: decisionModel }
+                : undefined);
+        }
+        catch (err) {
+            record(run, "install", {
+                status: "failed",
+                detail: `${replaced}render failed: ${errorText(err)}`,
+            });
+            if (run.needsWallet)
+                await rollbackWallet(run);
+            return;
+        }
+        const result = await deps.installRuntime({
+            runtimeYamlContent,
+            runtimeYamlDir: run.inst.runtimeYamlDir,
+            id: runtimeId,
+        });
+        if (!result.ok || !result.payload) {
+            record(run, "install", {
+                status: "failed",
+                detail: `${replaced}install refused: ${result.error?.code ?? "UNKNOWN"} — ${result.error?.message ?? "no message"}`,
+                evidence: { code: result.error?.code, message: result.error?.message },
+            });
+            if (run.needsWallet)
+                await rollbackWallet(run);
+            return;
+        }
+        const payload = result.payload;
+        if (payload.unwired) {
+            // The install succeeded and the runtime is UP — but with no live entry scanners, so it can
+            // never produce a signal. Every one of the three phases is deterministic on this box, so
+            // waiting on the observe step would only turn a certain failure into `installed-unobserved`
+            // over a wallet this job just funded. It is an install failure, and it rolls back like one.
+            run.report.runtimeId = payload.id;
+            // The runtime is UP: `installRuntimeCore` set a live handle and wrote a registry row before
+            // it reported the unwired phase. Closing the wallet under it (D-6, just below) would leave a
+            // RUNNING runtime — DSL monitor, position reconcile, MCP polls — bound to a strategy this
+            // same job closed. A re-run would clean it up, but the interim is exactly the zombie shape,
+            // deliberately created on the money path. Delete it here, and delete it BEFORE the close so
+            // nothing is ever live against a closing wallet. Unconditional: an install that failed must
+            // leave nothing installed, adopted wallet or not.
+            const removal = await removeBlindRuntime(payload.id);
+            record(run, "install", {
+                status: "failed",
+                detail: `${replaced}${buildUnwiredInstallDetail({
+                    phase: payload.unwired,
+                    runtimeId: payload.id,
+                    wallet,
+                    createdByThisJob: run.needsWallet,
+                    removal,
+                })}`,
+                evidence: {
+                    ...payload,
+                    runtimeDeleted: removal.ok,
+                    ...(removal.ok ? {} : { deleteError: removal.error }),
+                },
+            });
+            if (run.needsWallet)
+                await rollbackWallet(run);
+            return;
+        }
+        run.installedAtMs = deps.now();
+        run.report.runtimeId = payload.id;
+        record(run, "install", {
+            status: "ok",
+            detail: `${replaced}installed runtime "${payload.id}" on wallet ${payload.wallet}`,
+            evidence: { ...payload },
+        });
+    }
+    /**
+     * Tear down a runtime whose install is being recorded `failed`. Never throws: a cleanup that
+     * cannot run must not swallow the D-6 rollback that follows it — a stranded FUNDED wallet is the
+     * worse outcome by far. The result is what the detail and the evidence are computed from, so the
+     * report says what is actually left on the box rather than what was attempted.
+     */
+    async function removeBlindRuntime(id) {
+        try {
+            await deps.deleteRuntime(id);
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: errorText(err) };
+        }
+    }
+    /**
+     * D-6: unwind ONLY a wallet this job created and funded, ONLY when its install failed.
+     * Never an adopted wallet (it predates this deploy), never on observe failure (the runtime is
+     * installed and may open a position any moment), never on a refusal (nothing was created).
+     * A close that cannot run or fails is E_ROLLBACK_INCOMPLETE — a stranded wallet is never silent.
+     *
+     * D-7: `strategy_close` returns the funds to the owner embedded wallet on its own, so the unwind
+     * is one call — there is no separate withdraw step to get half-done.
+     */
+    async function rollbackWallet(run) {
+        await span("deploy.rollback", { "senpi.deploy.step": "rollback" }, () => rollbackWalletBody(run));
+    }
+    /** Resolves with the rollback's result — the wiring turns it into `senpi.deploy.rollback.count`. */
+    async function rollbackWalletBody(run) {
+        const wallet = run.report.wallet;
+        const funded = rollbackFundedClause(run.report.funded);
+        emit({
+            type: "job",
+            phase: "install",
+            detail: `install failed on wallet ${wallet}, which this job created and ${funded} — ` +
+                `closing it and returning the funds`,
+        });
+        const incomplete = (reason) => record(run, "create", {
+            status: "failed",
+            detail: `[E_ROLLBACK_INCOMPLETE] wallet ${wallet} was created by this deploy and ${funded}, ` +
+                `its install failed, and the automatic close did not complete: ${reason}. The wallet is ` +
+                `live and unwatched. Reclaim the funds from THIS wallet: MCP \`strategy_close\` on ` +
+                `${wallet}${buildStrandedCloseCaveat(pkg, runs, run)}`,
+            evidence: { wallet, funded: run.report.funded, reason },
+        });
+        try {
+            if (!(await deps.walletIsFlat(wallet))) {
+                incomplete("the wallet holds open positions — refusing to auto-close");
+                return "incomplete";
+            }
+            const result = await deps.closeStrategy(wallet);
+            // A resolved close proves nothing on its own: `strategy_close` reports a tool-level failure
+            // by RESOLVING `{ success: false }`, never by throwing. Treating that as done zeroed `funded`
+            // and told the operator the funds were back while the wallet was still live and funded.
+            const closeFailure = describeCloseFailure(result);
+            if (closeFailure) {
+                incomplete(closeFailure);
+                return "incomplete";
+            }
+            // The structured facts the report leads with must agree with the step detail: this wallet is
+            // closed and the funds are back with the owner, so it is no longer a funded wallet. The
+            // amount survives in the step evidence, where it reads as history rather than as a holding.
+            const fundedBeforeRollback = run.report.funded;
+            run.report.funded = 0;
+            run.report.rolledBack = true;
+            record(run, "create", {
+                status: "ok",
+                detail: `wallet ${wallet} was created by this deploy and its install failed — rolled back: strategy ` +
+                    `closed, funds returned to the owner wallet (close result: ${JSON.stringify(result)})`,
+                evidence: { wallet, funded: fundedBeforeRollback, rolledBack: true, closeResult: result },
+            });
+            return "ok";
+        }
+        catch (err) {
+            incomplete(errorText(err));
+            return "incomplete";
+        }
+    }
+    // ── observe ───────────────────────────────────────────────────────────────
+    const observable = runs.filter((run) => run.report.runtimeId && ["ok", "skipped"].includes(run.report.steps.install.status));
+    if (!halted() && observable.length > 0) {
+        emitPhase("observe", tickWaitSec > 0
+            ? `waiting up to ${tickWaitSec}s for one verified scanner tick`
+            : "tick observation skipped by --tick-wait 0");
+        await span("deploy.observe", { "senpi.deploy.step": "observe" }, async () => {
+            for (const run of observable) {
+                if (boundaryAbandoned())
+                    break;
+                await guarded(run, "observe", () => observeInstance(run));
+            }
+            return phaseStatus(runs, "observe");
+        });
+    }
+    async function observeInstance(run) {
+        const runtimeId = run.report.runtimeId;
+        if (tickWaitSec <= 0) {
+            // D-3 / M3: skipping observation must never read as verified — one argument away in a wrapper.
+            record(run, "observe", {
+                status: "unobserved",
+                detail: `tick observation skipped (--tick-wait 0) — liveness NOT verified. ` +
+                    `Check it yourself: \`openclaw senpi scanner -r ${runtimeId}\``,
+            });
+            return;
+        }
+        const sinceMs = run.installedAtMs ?? deps.now();
+        const deadline = deps.now() + tickWaitSec * 1000;
+        let rowsLastSeen = [];
+        /** Every distinct lastRunStatus seen across polls — the production data for tuning --tick-wait. */
+        const statusesSeen = [];
+        for (;;) {
+            const rows = (await deps.getScannerRows(runtimeId)) ?? [];
+            rowsLastSeen = rows;
+            for (const row of rows) {
+                if (row.lastRunStatus !== null && !statusesSeen.includes(row.lastRunStatus)) {
+                    statusesSeen.push(row.lastRunStatus);
+                }
+            }
+            const active = rows.filter((row) => row.enabled);
+            if (rows.length > 0 && active.length === 0) {
+                record(run, "observe", {
+                    status: "unobserved",
+                    detail: `all ${rows.length} scanner(s) are disabled in the live engine — the runtime will ` +
+                        `never tick. Only the runtime API disables a scanner (a runtime.yaml \`enabled\` key is ` +
+                        `refused at deploy and never reaches the engine), so something disabled these after ` +
+                        `install. Check: \`openclaw senpi scanner -r ${runtimeId}\``,
+                    evidence: {
+                        scanners: rows.map((row) => ({ scannerId: row.scannerId, enabled: row.enabled })),
+                        statusesSeen,
+                    },
+                });
+                return;
+            }
+            const ticked = active.find((row) => isFreshTick(row, sinceMs));
+            if (ticked) {
+                const via = ticked.scheduleMode === "external"
+                    ? `alive (external, lastAliveAt fresh)`
+                    : `lastRunStatus=${ticked.lastRunStatus}`;
+                record(run, "observe", {
+                    status: "ok",
+                    detail: `verified tick: ${ticked.scannerId} ${via} runCount=${ticked.runCount} ` +
+                        `signalsProduced=${ticked.signalsProduced} health=${ticked.health}`,
+                    evidence: {
+                        scannerId: ticked.scannerId,
+                        scheduleMode: ticked.scheduleMode,
+                        lastRunStatus: ticked.lastRunStatus,
+                        lastRunFinishedAt: ticked.lastRunFinishedAt,
+                        lastAliveAt: ticked.lastAliveAt,
+                        runCount: ticked.runCount,
+                        signalsProduced: ticked.signalsProduced,
+                        health: ticked.health,
+                        statusesSeen,
+                    },
+                });
+                return;
+            }
+            const failedRow = active.find((row) => isFreshError(row, sinceMs));
+            if (failedRow) {
+                // D-1: an error tick is a terminal answer — polling the rest of the budget adds nothing.
+                record(run, "observe", {
+                    status: "failed",
+                    detail: buildObserveFailedDetail(failedRow, runtimeId),
+                    evidence: {
+                        scannerId: failedRow.scannerId,
+                        lastRunStatus: failedRow.lastRunStatus,
+                        errorCount: failedRow.errorCount,
+                        lastError: failedRow.lastError,
+                        health: failedRow.health,
+                        statusesSeen,
+                    },
+                });
+                return;
+            }
+            if (deps.now() >= deadline)
+                break;
+            await deps.sleep(OBSERVE_POLL_MS);
+            if (deps.shouldAbandon()) {
+                record(run, "observe", {
+                    status: "unobserved",
+                    detail: `deploy deadline hit before a tick was observed — the runtime is installed and may be ` +
+                        `ticking. Check it yourself: \`openclaw senpi scanner -r ${runtimeId}\``,
+                });
+                honorDeadline();
+                return;
+            }
+        }
+        // H2: a scanner on a long interval is not broken, it is early. When the registry says the first
+        // tick is still ahead of the budget we just burned, say when — a bare "no tick observed" reads
+        // as a fault and invites a close/recreate.
+        const scheduled = rowsLastSeen.find((row) => row.enabled && row.nextRunAt !== null && row.nextRunAt > deadline);
+        record(run, "observe", {
+            status: "unobserved",
+            detail: scheduled
+                ? `no tick observed within ${tickWaitSec}s — scanner "${scheduled.scannerId}" is scheduled, ` +
+                    `first tick due ${new Date(scheduled.nextRunAt).toISOString()}. ` +
+                    `Check then: \`openclaw senpi scanner -r ${runtimeId}\``
+                : buildUnobservedDetail(tickWaitSec, runtimeId),
+            evidence: { statusesSeen },
+        });
+    }
+    // ── overall ───────────────────────────────────────────────────────────────
+    const overall = decideOverall(runs, refused, abandoned);
+    // The soft-tier fields ride the FINAL report, not a step detail, so the warn is still on the page
+    // for a `live` / `installed-unobserved` deploy — where the capped event tail has long since
+    // scrolled past the preflight narration that first raised it.
+    // The escape's precondition is the RUNTIME, not the wallet: `close.py --instance` resolves a
+    // sleeve through its runtime. The note's tense reads the same terminal facts, but PER ROW —
+    // "funds" follows each wallet, "will run" follows each runtime — so a mixed report cannot claim
+    // one state about sleeves its own escape describes differently.
+    const byName = new Map(runs.map((run) => [run.inst.name, run]));
+    const hasRuntime = (name) => {
+        const run = byName.get(name);
+        return Boolean(run?.report.runtimeId) && ["ok", "skipped"].includes(run?.report.steps.install.status ?? "");
+    };
+    const hasLiveWallet = (name) => {
+        const run = byName.get(name);
+        return Boolean(run?.report.wallet) && !run?.report.rolledBack;
+    };
+    const isStranded = (name) => hasLiveWallet(name) && !hasRuntime(name);
+    const isZeroShare = (name) => pkg.instances.find((inst) => inst.name === name)?.fundingShare === 0;
+    const escapeState = {
+        closable: soft.under.map((row) => row.wallet).filter((name) => hasRuntime(name) && !isZeroShare(name)),
+        strandedNames: soft.under.map((row) => row.wallet).filter(isStranded),
+        walletless: walletlessAfter(pkg, runs),
+        zeroShare: soft.under.map((row) => row.wallet).filter(isZeroShare),
+        rollbackIncomplete: runs.some((run) => run.report.steps.create.status === "failed" &&
+            run.report.steps.create.detail.startsWith("[E_ROLLBACK_INCOMPLETE]")),
+    };
+    const underNames = soft.under.map((row) => row.wallet);
+    const softNote = soft.min
+        ? buildSoftBudgetNote(pkg, soft.min, soft.under, buildBudgetEscape(pkg, soft.min, escapeState), {
+            funded: new Set(underNames.filter(hasLiveWallet)),
+            running: new Set(underNames.filter(hasRuntime)),
+        })
+        : null;
+    const softTier = {
+        ...(soft.min
+            ? {
+                minBudget: soft.min.minBudget,
+                minWalletCount: soft.min.walletCount,
+                ...(soft.min.unresolvedWallets.length > 0
+                    ? { minBudgetUnresolved: soft.min.unresolvedWallets }
+                    : {}),
+            }
+            : {}),
+        ...(soft.under.length > 0 ? { belowMin: true } : {}),
+        ...(softNote ? { minBudgetNote: softNote } : {}),
+    };
+    /**
+     * The OUTCOME check the plan-side W_BUDGET_* tiers cannot make: what the backend actually landed,
+     * against what this job asked it for. Computed HERE, in the single place that has both halves —
+     * the ask (the amount `planFunding` decided and the create call carried) and `report.funded`
+     * (quoted from the post-create `strategy_list` read, the same figure the create step prints).
+     *
+     * The ask comes from this run's own `fundAmount` when this run funded, and otherwise from
+     * {@link DeployParams.priorRequested} — the amount a prior run of this package journaled for the
+     * very strategyId this run just ADOPTED. Without that fallback a crash between a partial fund and
+     * report assembly resumed as an adoption with no ask, and the shortfall vanished from the report.
+     * The journal supplies the ask ONLY; `funded` is always the live read from this run.
+     *
+     * Every guard below exists so the pair can only ever be a real, comparable one:
+     *  - the ask — a wallet nobody ever planned to fund has none, and inventing one would announce a
+     *    shortfall against money that was never requested; the create step's own "the requested …
+     *    was NOT added" line already owns that case. A non-positive ask is not a comparison either.
+     *  - `report.wallet` — set on, and only on, the ACTIVE strategy read. Absent means the read never
+     *    happened (create pending, failed, abandoned), so there is nothing to say about a wallet
+     *    nobody looked at. Silence is the fail-closed answer.
+     *  - a rollback that was ATTEMPTED, proven (`rolledBack`) or not. A proven close zeroes `funded`,
+     *    so the pair would compare $0 against the ask on a wallet that no longer exists. An
+     *    INCOMPLETE one is the sharper case: `funded` keeps its partial value, and the create step is
+     *    already carrying `[E_ROLLBACK_INCOMPLETE]` — "reclaim the funds from THIS wallet". A
+     *    top-the-wallet-up warn beside it makes one report the author of two opposite money moves on
+     *    one wallet, and an agent reconciling them runs whichever executes. When the rollback text is
+     *    present it is the single remediation authority, exactly as the funding-round doctrine says.
+     *
+     * `report.funded` absent WITH a wallet present is the third outcome, not silence: the read
+     * happened and the backend reported no readable figure. That is
+     * {@link buildFundedUnreadableNote}, never a `$0.00` claim.
+     */
+    const rollbackAttempted = (run) => Boolean(run.report.rolledBack) ||
+        (run.report.steps.create.status === "failed" &&
+            run.report.steps.create.detail.startsWith("[E_ROLLBACK_INCOMPLETE]"));
+    const askFor = (run) => run.fundAmount ??
+        (run.report.strategyId !== undefined ? params.priorRequested?.get(run.report.strategyId) : undefined);
+    const partialFunded = [];
+    const unreadableFunded = [];
+    for (const run of runs) {
+        const requested = askFor(run);
+        const funded = run.report.funded;
+        const wallet = run.report.wallet;
+        if (requested === undefined || requested <= 0)
+            continue;
+        if (wallet === undefined || rollbackAttempted(run))
+            continue;
+        if (funded === undefined) {
+            unreadableFunded.push({
+                instance: run.inst.name,
+                wallet,
+                requested,
+                created: run.needsWallet,
+            });
+            continue;
+        }
+        if (funded >= requested * BUDGET_TOLERANCE)
+            continue;
+        partialFunded.push({
+            instance: run.inst.name,
+            wallet,
+            requested,
+            funded,
+            created: run.needsWallet,
+        });
+    }
+    /**
+     * Whether a budget note may claim "nothing is broken — the strategy is LIVE".
+     *
+     * One condition, because one is all there is: the report as a WHOLE must be `live`. That verdict
+     * is the sentence's whole subject, and {@link decideOverall} only reaches it when EVERY step of
+     * every instance is `ok` or `skipped` — no refusal, no abandonment, nothing failed, pending or
+     * unobserved anywhere in the package. The gate used to admit `installed-unobserved` too, and its
+     * every() only ever looked at the rows the note names, so a fully-funded sibling sleeve that
+     * never ticked left the note asserting "the strategy is LIVE" two lines under a verdict saying
+     * the opposite.
+     *
+     * A per-row "installed and observed ticking" check rode along after that fix, justified by "live
+     * tolerates a skipped observe". It does not, and the check was therefore dead: `observeInstance`
+     * records only `ok`, `unobserved` or `failed`, the sole writer of a `skipped` observe is the
+     * deadline honour — which sets `abandoned`, and an abandoned deploy is `failed` — and an instance
+     * that was never observed at all keeps `pending`. Under `live`, every named row's observe is
+     * already `ok`. A dead check kept alive by a comment that asserts the opposite is worse than no
+     * check: the next maintainer adds a real skipped-observe path believing this gate covers it. If
+     * one is ever added, `live` stops proving "observed ticking" and this is the site to revisit.
+     */
+    const reassures = () => overall === "live";
+    return {
+        packageId: pkg.id,
+        version: pkg.version,
+        overall,
+        instances: runs.map((run) => run.report),
+        next: buildNext(overall, pkg, budget, runs),
+        ...softTier,
+        ...(partialFunded.length > 0
+            ? { partialFundNote: buildPartialFundNote(pkg, partialFunded, reassures()) }
+            : {}),
+        ...(unreadableFunded.length > 0
+            ? { fundedUnreadableNote: buildFundedUnreadableNote(pkg, unreadableFunded, reassures()) }
+            : {}),
+    };
+}
+/**
+ * Refusals and abandonment outrank outcomes, and an unobserved tick can never
+ * read as success — the precedence order is the fail-closed one.
+ *
+ * An abandoned deploy is `failed`, not a status of its own: it ran out of wall clock without
+ * finishing, and the resume path is the same one every failure gets.
+ */
+function decideOverall(runs, refused, abandoned) {
+    if (refused)
+        return "refused";
+    if (abandoned)
+        return "failed";
+    const statuses = runs.flatMap((run) => STEP_ORDER.map((step) => run.report.steps[step].status));
+    if (statuses.includes("failed"))
+        return "failed";
+    if (statuses.includes("pending"))
+        return "pending";
+    if (statuses.includes("unobserved"))
+        return "installed-unobserved";
+    return "live";
+}
+//# sourceMappingURL=orchestrator.js.map