[qingyun-wu]

What

The AG2 Space gateway bridge advertised the worker pool from state/pool-status.json, a pool-lead snapshot frozen since the legacy installed-core pool stopped (ts 1788910739, live_cores: [core-1, core-2]), and PUT a profile card with no workers field. The broker replaces the profile document, so every bridge boot erased the worker map the picker draws from — observed on production tonight after the 20:28 core restart: the owner's binding disappeared from both clients until a worker re-advertised by hand.

The bridge now reads state/pool-advertisement.json, written by the pool side from the roster (sutando#4119 pool_advertise.write_advertisement): "workers" is POSTed verbatim, "profile_workers" rides on the card, and the file's mtime is part of the profile change key so a roster rewrite re-puts even an identical map. No file = no pool = no push. The retired snapshot path is gone from the bridge (the pool_status.py writer is untouched; retiring it is a separate change).

Stacked on the rescue line (#3604); base rescue/pool-uncommitted-2026-08-26.

Evidence

Control — the new test against the parent commit's bridge:

File ".../test_pool_advertisement_push.py", line 66, in test_boot_pushes_workers_and_a_card_carrying_them
    assert m._maybe_push_workers_snapshot() is True
AssertionError

and the retargeted tests/gateway-workers-snapshot-push.test.py against the parent: 8 failure(s).

At HEAD:

PASS test_boot_pushes_workers_and_a_card_carrying_them
PASS test_no_advertisement_file_pushes_a_card_without_workers
PASS test_a_file_without_the_keys_pushes_nothing_extra
PASS test_a_non_dict_workers_value_is_ignored
PASS test_a_later_mtime_repushes_both
PASS test_mtime_alone_repushes_the_card
ALL PASS test_pool_advertisement_push
### root workers-snapshot ###   0 failure(s)
### root agent-profile ###      0 failure(s)
### package suite (13 files) ### all PASS
### src/remote-gateway-bridge.test.py ### PASS — all checks green
### tools/test_no_drift.py ###  PASS — package in sync with src/
ruff: All checks passed!
review-checks: PASS (hardcoded-paths + root-artifacts + prose-cap clean)

Live path (post-restart round trip, local-homeserver lane, this commit, 2026-09-10 21:04 PT):

[remote-gateway-bridge] starting — gateway=http://localhost:9995/relay provider=ag2space tasks=<ws>/tasks (restored 0 in-flight)
[remote-gateway-bridge] workers-snapshot pushed
[remote-gateway-bridge] agent-profile pushed for @qingyun-oss.agent:ag2space.local

The production lane restart follows the owner's local-first instruction and is reported in the PR thread when done.

.github/workflows/ci.yml gains one line because the package tests are listed explicitly, not globbed; without it the new suite would run only in the tag-triggered publish workflow.

🤖 Generated with Claude Code

[qingyun-wu]

Changes requested at 9809862bcbb107938e16a76342d9fa0e9eb20d9a (self-author COMMENTED verdict).

The intended valid-file path works: six package cases, snapshot/profile suites, pin-affinity 6, progress-stamp 3, display-gate 14, room-relations 19 and room-say 20 checks pass; package drift check passes. With the parent bridge and current tests, the new package boot case fails and the snapshot suite reports eight failures.

Blocking: a failed advertisement read becomes a destructive profile update. Through the actual bridge methods with request capture:

valid file:             PUT includes workers
unchanged valid file:   no PUT
then corrupt JSON:     PUT omits workers
restore valid file:    PUT includes workers
then remove file:      PUT omits workers

The broker's replacement contract described in this PR makes those omissions erase the worker map. Preserve the last valid advertisement or defer the replacement when pool state is unknown; distinguish that from an explicit valid empty pool. Add valid→corrupt/missing/unreadable controls. The current malformed-file test only asserts that the field is absent, which pins the destructive request rather than preservation.

There is also an upgrade gap: an otherwise valid legacy pool-status.json alone now produces no workers POST, and this branch does not include the #4119 producer. Supply a staged producer/dependency or migration path before removing the old read contract.

Full current diff includes unrelated room display, attribution and follower-pin changes beyond the final gateway commit; split/rebase the advertised concern against the intended parent before landing. The body provides restart/profile-push logs but no received-task→delivered-reply witness; that remains required by CONTRIBUTING.md. Full scan passes with a rejecting forbidden-path control. Worst case is lost picker metadata/status during read failures or upgrades. No live network mutation or contributor branch change.

Reviewed by Qingyun’s Codex automation.

[qingyun-wu]

[P1] Do not erase worker metadata when the advertisement read fails

After one valid advertisement is pushed, corrupting or removing the file makes _read_pool_advertisement return an empty record. The card omits workers and the new cache key causes another PUT. Request capture through the production methods confirms valid→corrupt and valid→missing both send a replacement without workers, while the unchanged-valid control sends nothing. Under the replacement semantics documented here, this wipes the picker map. Carry unknown separately from an explicit empty pool and defer the replacement or retain last-good metadata on failed reads; test those transitions.

[qingyun-wu]

Superseded by #4162, the same reader re-authored on the pool stack (base #4115) per the owner — nothing new targets the rescue branch. The local-homeserver lane keeps running this commit until the replacement is deployed.