Apply a settings profile — replace the stored env and reload the fleet

Apply the profile’s active env as the WHOLE stored env band and reload the fleet.

The profile’s secret_keys are written as the stored secret marks in the same replace.

A key the profile omits is deleted, save the carried deployment X band; build+swap a fresh serving epoch under it, persist env-write-LAST, broadcast the reload, and recycle the fleet for recycle-class diffs. NO request body.

The response is the dedicated profileApplyResponse {hot, recycle:[{name, kind, status, generation_before, keys, detail}], skipped:[name], fresh:[{name, kind, generation}], refused:[], recycle_stopped:{kind, name, detail} | null, awaiting_respawn:[{name, keys}], roll_deferred, roll_deferred_to, span_release_error, fanout} — key names + worker identities only, never env values. recycle is one line per sibling the roll reached (plus the applier’s own deferred self-exit line when it is armed), its keys the recycle-class keys that worker’s reload reported moved off its bound value; skipped names the workers whose reload confirmed no such key, at the reload or when asked once ready, left running. A recycled line is confirmed on reality; the roll stops at the first line that is not: timed-out (its old life did not go, fresh capacity did not boot, or it never returned to ready, within the step budget) or failed (the worker refused the op, or the bus could not be reached while it was in hand), its detail naming why — or when the bus could not be read before a target was reached. recycle_stopped names where the roll stopped and why (null when it ran to its end; a null name when no target was in hand). Later siblings and the applier’s own recycle are then not attempted, and the call still answers with the report: the env is persisted, and fanout says what the reload broadcast reached. fresh is the per-kind new ready lives observed since the pre-apply snapshot, capacity evidence never claimed as any target’s successor. refused is []: a refusal (X-band key, a key the deployment sets, dangling !ENV, a bus-reaching key no recycle can carry) aborts upfront with a loud 400 naming the key, before anything is snapshotted, built, or persisted. awaiting_respawn names the workers (name + keys) still awaiting a respawn after the roll — when it converged, only the workers whose reload failed at their epoch build: the stored config did not build on them and a restart may fail the same way, so the roll leaves them running and lists them. span_release_error is null when the config store released its exclusive write span after the env persisted, otherwise the store’s error: the env is persisted and the broadcast and roll reported here still ran, but the store may still hold its write span until this worker exits. When the applier’s own row reports a serve-affecting recycle key (or its state is unknown) and the roll converged, the applier’s OWN recycle is armed as a post-reply graceful self-exit — after the HTTP body flushes, or once a projected tool call (MCP, tai tools run, an agent, a preset, a schedule, a hook) returned — and its supervisor respawns it on the new env. An apply run under a bound the roll’s waits can outlast (a dispatched job’s budget, an armed turn budget) runs no roll itself: it hands the roll to the bus member it acts for, which carries it out after the reply and departs itself last, once the roll converged, when it needs its own restart; roll_deferred is then true, roll_deferred_to names that member, and recycle and awaiting_respawn are empty, the roll not judged in this reply. Otherwise roll_deferred is false and roll_deferred_to null. 404 for an absent name. An mcp selection list whose !ENV marker would resolve so that a tool something still uses stops being picked is refused with a 409 naming the holders, a 503 with code mcp-server-starting while the server’s start is in progress or mcp-server-not-loaded while this worker has not loaded the server, or a 502 with the recorded cause when this worker holds no listing for the server and its last start or bind failed, before anything is snapshotted.

Called over MCP, the reload answers on the session that called it and then retires that session with the generation it ran on: a later call on the same session fails (streamable HTTP answers it 404, and an SSE session’s stream closes), so the client starts a new session to go on.