The renderer already survives a readiness round where NEITHER probe answers
(transport fallback). But the #124939 flash was a round where runtime_check
ANSWERED ok:false ~2s after an update restart: the backend had booted, its
external secret source (BWS-backed .env) had not hydrated yet, and the probe
resolved the fallback chain to a tail provider with no key — so the store
wrote configured:false, wiped the onboarded cache, and the onboarding overlay
flashed 'No usable credentials found for openrouter' on a fully configured
install.
Add a boot-generation clock ($gatewayBootGeneration, bumped by setup.ready
and gateway switch/wipe) and a 15s grace: inside the window, an answered
ok:false against an already-configured install is preserved as not-ready and
re-checked on the setup.ready tick, instead of being written down as a
credential verdict. Outside the window (or an unconfigured install) the
downgrade still lands, so a genuinely broken provider still surfaces.
Co-authored-by: sly321-pixel <239388517+sly321-pixel@users.noreply.github.com>
f886d133fe