@@ -154,6 +154,12 @@ COMBOS=(
   # opt-out shape is here too, because "no issuer" must be a statement, never an omission.
   "a public host issued by cert-manager (fixture)|deploy/helm/values.yaml:deploy/aks/scripts/testdata/values.ingress-issuer.yaml"
   "a host whose TLS Secret is pre-provisioned (fixture)|deploy/helm/values.yaml:deploy/aks/scripts/testdata/values.ingress-preprovisioned.yaml"
+  # 🚨 Cookie session affinity as the RECORD renders it (MeshWeaver#6825): HelmValues writes the typed
+  # block under ingress.sessionAffinity.*, which the chart did not read, so a record-only render
+  # dropped affinity from every multi-replica Blazor portal. The evidence check below the loop reads
+  # both renders by name: enabled merges in order, disabled renders none of it.
+  "cookie session affinity from the record's typed block (fixture)|deploy/helm/values.yaml:deploy/aks/scripts/testdata/values.ingress-session-affinity.yaml"
+  "cookie session affinity switched off (fixture)|deploy/helm/values.yaml:deploy/aks/scripts/testdata/values.ingress-session-affinity-disabled.yaml"
   # 🚨 The instance's OWN database release (Doc/Architecture/InClusterDatabases): a CloudNativePG
   # Cluster beside the portal release, named by database.release. The only combination whose
   # connection strings are COMPOSED in the containers' env from a Secret the chart does not render.
@@ -336,6 +342,52 @@ else
   report "plugin source credentials: the fixture must render exactly Sources__1__TokenKey=\"PluginCatalog:SourceTokens:Extensions\" and Sources__2__InstallationOwner=\"fabrikam\" (trimmed), Sources__3__TokenKey=\"\" (a blank tokenKey is a DECLARATION the portal refuses — dropping it reads the repository with the instance's App or anonymously), NO credential key for the undeclared source 0 and the null tokenKey of source 4, and the chart defaults must render none"
 fi
 
+# The session-affinity evidence (MeshWeaver#6825). Read by NAME: the record's typed block must reach
+# the portal Ingress — `affinity: cookie` and the cookie name derived from the typed fields,
+# nginxAnnotations over both, ingress.annotations over everything, the AGIC map NOT rendered — and a
+# disabled block must render none of it. The AKS overlay states the same block, so its render must
+# carry the affinity too. The plugin-registry identity rides the affinity fixture:
+# pluginCatalog.instanceId renders PluginCatalog__InstanceId and a HomeUrl derived from the host.
+affinity_annotations() {
+  python3 - "$1" <<'PY'
+import sys, yaml, json
+for doc in yaml.safe_load_all(open(sys.argv[1])):
+    if doc and doc.get("kind") == "Ingress" and doc["metadata"]["name"] == "memex-portal":
+        print(json.dumps(doc["metadata"].get("annotations") or {}, sort_keys=True))
+        break
+else:
+    print("NO-INGRESS")
+PY
+}
+affinity_on="$(affinity_annotations "$(render_of "cookie session affinity from the record's typed block (fixture)")")"
+affinity_off="$(affinity_annotations "$(render_of "cookie session affinity switched off (fixture)")")"
+affinity_aks="$(affinity_annotations "$(render_of "AKS overlay (the layer every AKS install shares)")")"
+affinity_render="$(render_of "cookie session affinity from the record's typed block (fixture)")"
+if python3 - "$affinity_on" "$affinity_off" "$affinity_aks" <<'PY'
+import sys, json
+on, off, aks = (json.loads(a) for a in sys.argv[1:4])
+p = "nginx.ingress.kubernetes.io/"
+assert on.get(p + "affinity") == "cookie", on
+assert on.get(p + "session-cookie-name") == "MEMEX_AFFINITY", on
+assert on.get(p + "affinity-mode") == "persistent", on
+assert on.get(p + "session-cookie-max-age") == "3600", on            # ingress.annotations wins
+assert on.get("cert-manager.io/cluster-issuer") == "letsencrypt-prod", on
+assert not any(k.startswith("appgw.") for k in on), on               # AGIC is not rendered
+assert not any(k in off for k in (p + "affinity", p + "session-cookie-name", p + "affinity-mode")), off
+assert aks.get(p + "affinity") == "cookie" and aks.get(p + "session-cookie-name") == "MEMEX_AFFINITY", aks
+PY
+then
+  if [ -f "$affinity_render" ] \
+     && grep -q '^  PluginCatalog__InstanceId: "instance-at-registry"$' "$affinity_render" \
+     && grep -q '^  PluginCatalog__HomeUrl: "https://instance.example.com"$' "$affinity_render"; then
+    ok "cookie session affinity reaches the portal Ingress from ingress.sessionAffinity (typed, then nginxAnnotations, then ingress.annotations; AGIC not rendered; disabled renders none), and pluginCatalog.instanceId renders PluginCatalog__InstanceId and HomeUrl"
+  else
+    report "pluginCatalog.instanceId: the session-affinity fixture must render PluginCatalog__InstanceId=\"instance-at-registry\" and PluginCatalog__HomeUrl=\"https://instance.example.com\" — a record-driven deploy otherwise loses the deployment-config principal"
+  fi
+else
+  report "ingress.sessionAffinity: the portal Ingress must carry affinity=cookie and the cookie name when the block is enabled, nginxAnnotations over them, ingress.annotations over all, no AGIC annotation, and NONE of it when disabled — a record-only render otherwise drops cookie affinity (MeshWeaver#6825)"
+fi
+
 # The bake-gate evidence (MeshWeaver#4588, #5544). Invariant 10b — an armed PreWarm__GateReadiness
 # is read by the readinessProbe on /ready, and the rollout deadline covers a cold bake — is
 # CONDITIONAL, so it is satisfied just as well by a set of renders where nothing ever arms the gate.
 
@@ -0,0 +1,14 @@
+# The negative control for values.ingress-session-affinity.yaml (MeshWeaver#6825): the same typed
+# block with `enabled: false`. A record that switches affinity OFF must render none of it — not the
+# derived `affinity: cookie`, not the cookie name, not its nginxAnnotations.
+ingress:
+  enabled: true
+  className: "webapprouting.kubernetes.azure.com"
+  host: "instance.example.com"
+  tlsSecret: "instance-tls"
+  clusterIssuer: "letsencrypt-prod"
+  sessionAffinity:
+    enabled: false
+    cookieName: "MEMEX_AFFINITY"
+    nginxAnnotations:
+      nginx.ingress.kubernetes.io/affinity-mode: "persistent"
@@ -0,0 +1,31 @@
+# Cookie session affinity as the RECORD renders it (MeshWeaver#6825): MeshWeaver.Plugins
+# HelmValues.IngressValues writes the record's typed affinity under ingress.sessionAffinity.*, never
+# into ingress.annotations. Until the chart read that block, a record-only render dropped cookie
+# affinity from every multi-replica Blazor portal. The evidence check in check-chart-invariants.sh
+# reads this render by name and asserts the merge order: `affinity: cookie` and the cookie name
+# from the typed fields, nginxAnnotations over both, ingress.annotations over everything.
+#
+# Also the plugin-registry identity the record renders from registryInstanceId: the chart maps
+# pluginCatalog.instanceId to PluginCatalog__InstanceId and derives PluginCatalog__HomeUrl from
+# the host.
+ingress:
+  enabled: true
+  className: "webapprouting.kubernetes.azure.com"
+  host: "instance.example.com"
+  tlsSecret: "instance-tls"
+  clusterIssuer: "letsencrypt-prod"
+  annotations:
+    # A hand-written annotation wins over the typed affinity block on a clash.
+    nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
+  sessionAffinity:
+    enabled: true
+    cookieName: "MEMEX_AFFINITY"
+    nginxAnnotations:
+      nginx.ingress.kubernetes.io/affinity-mode: "persistent"
+      nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
+    # Recorded intent for an Application Gateway controller; the chart's ingresses are nginx-shaped
+    # and must NOT carry it.
+    agicAnnotations:
+      appgw.ingress.kubernetes.io/cookie-based-affinity: "true"
+pluginCatalog:
+  instanceId: "instance-at-registry"
@@ -28,7 +28,29 @@ metadata:
     # asked cert-manager for nothing and the controller served its fallback certificate.
     # A hand-written `cert-manager.io/cluster-issuer` in `annotations` still wins, so a record that
     # names its own issuer renders byte-identically to before.
-    {{- $ann := .Values.ingress.annotations | default dict }}
+    {{- /* ---- Sticky sessions (ingress.sessionAffinity, MeshWeaver#6825) ----------------------
+         A Blazor circuit and its per-circuit hubs live on ONE pod, so a client bouncing between
+         replicas loses its session. The record renders its typed affinity here
+         (HelmValues.IngressValues → ingress.sessionAffinity.*) and values.aks.yaml states the same
+         block — and until this merge the chart read NEITHER: a record-only render dropped cookie
+         affinity from every multi-replica portal. Enabled ⇒ `affinity: cookie`, the cookie name
+         when stated, then nginxAnnotations over both; ingress.annotations over ALL of it, so a
+         hand-written annotation still wins. Disabled or absent renders nothing. The AGIC map is
+         not merged: every ingress this chart renders is nginx-shaped. */}}
+    {{- $affinity := .Values.ingress.sessionAffinity | default dict }}
+    {{- $ann := dict }}
+    {{- if $affinity.enabled }}
+    {{- $_ := set $ann "nginx.ingress.kubernetes.io/affinity" "cookie" }}
+    {{- with $affinity.cookieName }}
+    {{- $_ := set $ann "nginx.ingress.kubernetes.io/session-cookie-name" . }}
+    {{- end }}
+    {{- range $k, $v := ($affinity.nginxAnnotations | default dict) }}
+    {{- $_ := set $ann $k $v }}
+    {{- end }}
+    {{- end }}
+    {{- range $k, $v := (.Values.ingress.annotations | default dict) }}
+    {{- $_ := set $ann $k $v }}
+    {{- end }}
     {{- if and $issuer (ne $issuer "none") (not $handWritten) }}
     cert-manager.io/cluster-issuer: {{ $issuer | quote }}
     {{- end }}
 
@@ -581,6 +581,17 @@ public record DeploymentContent
     [Description("Container registry this instance hosts (the public instance only)")]
     public RegistrySpec? Registry { get; init; }
 
+    /// <summary>
+    /// The registry this instance pulls its sealed NodeType publications from before the portal
+    /// starts — the chart's <c>bundles</c> section (see <see cref="BundlesSpec"/>). Null, or a blank
+    /// <see cref="BundlesSpec.Registry"/>, renders nothing and no bundle fetch runs. When stated, the
+    /// pre-warm root (<c>PreWarm__PrebuiltBundleRoot</c>) renders from <see cref="BundlesSpec.Root"/>
+    /// through <see cref="DeploymentPortalConfig.BundleRoot"/>, so the shelf the init container fills
+    /// is the one the portal reads.
+    /// </summary>
+    [Description("Sealed NodeType bundles fetched from a registry before the portal starts")]
+    public BundlesSpec? Bundles { get; init; }
+
     /// <summary>OpenTelemetry export.</summary>
     [Description("Telemetry")]
     public TelemetrySpec? Telemetry { get; init; }
 
@@ -313,6 +313,35 @@ public static string OrleansClustering(DeploymentContent d) =>
         return host is null || string.Equals(host, DefaultSelfUpdateRegistry, StringComparison.OrdinalIgnoreCase) ? null : host;
     }
 
+    /// <summary>
+    /// The bundle registry a record declares (<see cref="DeploymentContent.Bundles"/>), trimmed, or
+    /// null when it declares none — the ONE test for "this record fetches bundles", shared by the
+    /// pre-warm root below and the Helm renderer's <c>bundles</c> section. Pure.
+    /// </summary>
+    public static string? BundleRegistry(DeploymentContent d) =>
+        string.IsNullOrWhiteSpace(d.Bundles?.Registry) ? null : d.Bundles!.Registry!.Trim();
+
+    /// <summary>
+    /// The bundle sources a record declares, trimmed, blanks dropped, in the record's order. Empty
+    /// when it declares none. Pure.
+    /// </summary>
+    public static ImmutableList<string> BundleSources(DeploymentContent d) =>
+        (d.Bundles?.Sources ?? ImmutableList<string>.Empty)
+            .Where(s => !string.IsNullOrWhiteSpace(s))
+            .Select(s => s.Trim())
+            .ToImmutableList();
+
+    /// <summary>
+    /// <c>PreWarm__PrebuiltBundleRoot</c> for a record that fetches bundles: its
+    /// <see cref="BundlesSpec.Root"/>, else <see cref="BundlesSpec.DefaultRoot"/>; null for a record
+    /// that fetches none, so every other record renders as before. The chart's <c>bundles.root</c>
+    /// defaults to this key, so the shelf the init container fills and the directory the pre-warm
+    /// reads come from one value (MeshWeaver#6825). Pure.
+    /// </summary>
+    public static string? BundleRoot(DeploymentContent d) =>
+        BundleRegistry(d) is null ? null
+        : string.IsNullOrWhiteSpace(d.Bundles!.Root) ? BundlesSpec.DefaultRoot : d.Bundles.Root!.Trim();
+
     /// <summary>
     /// <c>SelfUpdate__PortalRepository</c> for a record: the repository its pods pull
     /// (<see cref="DeploymentContent.ImageRepository"/>), or null when that IS the image's default —
@@ -877,6 +906,9 @@ public static SortedDictionary<string, string> PortalConfig(DeploymentContent d,
         Set("Storage__SourceType", s.ContentSourceType);
         Set("Storage__BasePath", s.ContentPath);
         Set("ClaudeCode__ConfigDirRoot", s.ClaudeCodeConfigDirRoot);
+        // The bundle shelf (MeshWeaver#6825): rendered only for a record that fetches bundles, and
+        // from the same value the chart's bundle-fetch init container fills — one source for both.
+        Set("PreWarm__PrebuiltBundleRoot", BundleRoot(d));
 
         Set("Deployment__Orleans__Clustering", OrleansClustering(d));
         Set("SelfUpdate__MinRollInterval", string.IsNullOrWhiteSpace(d.MinRollInterval) ? DefaultMinRollInterval : d.MinRollInterval!.Trim());
 
@@ -280,6 +280,27 @@ public static DeploymentContent DefaultGrants(this DeploymentContent d, params s
     /// <summary>The instance id at the plugin registry (blank = the deployment id).</summary>
     public static DeploymentContent WithRegistryInstanceId(this DeploymentContent d, string? instanceId) => d with { RegistryInstanceId = instanceId };
 
+    /// <summary>
+    /// Pull the sealed NodeType publications of <paramref name="sources"/> from
+    /// <paramref name="registry"/> before the portal starts (the chart's <c>bundles</c> section). The
+    /// framework identity is read from the running image; <paramref name="identity"/> is only the
+    /// fallback for an image that predates the identity file. <paramref name="root"/> blank →
+    /// <see cref="BundlesSpec.DefaultRoot"/>. The pod's <see cref="DeploymentContent.ImagePullSecret"/>
+    /// is the credential, so state it too.
+    /// </summary>
+    public static DeploymentContent WithBundles(
+        this DeploymentContent d, string registry, IEnumerable<string> sources, string? identity = null, string? root = null) =>
+        d with
+        {
+            Bundles = new BundlesSpec
+            {
+                Registry = registry,
+                Sources = (sources ?? Enumerable.Empty<string>()).ToImmutableList(),
+                Identity = identity,
+                Root = root,
+            },
+        };
+
     // ── modules ─────────────────────────────────────────────────────────────────────────────────
 
     /// <summary>
 
@@ -135,6 +135,53 @@ public sealed record RegistryKeyVaultSpec
     public string? NotificationSecretObject { get; init; }
 }
 
+/// <summary>
+/// Where this instance pulls its SEALED NodeType publications from before the portal starts — the
+/// chart's <c>bundles</c> section, which renders the <c>bundle-identity</c> and <c>bundle-fetch</c>
+/// init containers (Doc/Architecture/PluginBundlesInTheRegistry). Without it every pod compiles
+/// the shipped NodeTypes itself, and a multi-pod instance can name an assembly in the shared
+/// records that only the compiling pod holds.
+///
+/// <para>Stated on the record so an estate outside the fleet's own subscription can declare its
+/// bundle source and still roll from the record alone: before this block existed the source lived
+/// only in a hand-written values layer, and a record-driven roll either dropped it or was refused
+/// for dropping it (MeshWeaver#6825).</para>
+///
+/// <para>The init container authenticates with the pod's <see cref="DeploymentContent.ImagePullSecret"/>:
+/// the key that pulls the platform image pulls the bundles, so a record that states a registry here
+/// states that Secret too. Names only — no credential.</para>
+/// </summary>
+public sealed record BundlesSpec
+{
+    /// <summary>The fleet registry host the publications are pulled from (e.g. <c>cr.meshweaver.cloud</c>). Blank → no bundle fetch renders.</summary>
+    [Description("Registry host the sealed bundles are pulled from (e.g. cr.meshweaver.cloud)")]
+    public string? Registry { get; init; }
+
+    /// <summary>The source names to materialise, as the publisher named them (e.g. <c>plugins</c>, <c>reinsurance</c>). Required when <see cref="Registry"/> is set.</summary>
+    [Description("Source names to materialise (e.g. plugins)")]
+    public ImmutableList<string> Sources { get; init; } = ImmutableList<string>.Empty;
+
+    /// <summary>
+    /// The framework identity to pull — the FALLBACK only. The identity is read from the running
+    /// portal image (<c>meshweaver-framework.identity</c>, MeshWeaver#6052), so it follows every
+    /// roll; this value is used only for an image that predates that file, and it does NOT follow a
+    /// roll. Leave it blank on an image that carries the file.
+    /// </summary>
+    [Description("Fallback framework identity, used only for an image that predates the identity file")]
+    public string? Identity { get; init; }
+
+    /// <summary>
+    /// The directory the init container fills AND the pre-warm reads — rendered as
+    /// <c>PreWarm__PrebuiltBundleRoot</c>, so the two cannot disagree. Blank →
+    /// <see cref="DefaultRoot"/>.
+    /// </summary>
+    [Description("Directory the bundles land in and the pre-warm reads — blank means /data/prebuilt-bundles")]
+    public string? Root { get; init; }
+
+    /// <summary>The fleet's bundle shelf: under the shared <c>/data</c> volume, where every AKS instance's pre-warm reads.</summary>
+    public const string DefaultRoot = "/data/prebuilt-bundles";
+}
+
 /// <summary>CPU and memory for one side of a resource envelope, as Kubernetes quantities.</summary>
 public sealed record ResourceQuantities
 {
@@ -267,8 +314,15 @@ public sealed record VolumeClaim
 /// Sticky sessions at the ingress. A Blazor circuit and its per-circuit hubs live on ONE pod
 /// (<c>[PreferLocalPlacement]</c>), so a client bouncing between pods loses its session — the
 /// cookie pins it. The nginx/AGIC annotation maps are the controller-specific spellings of the
-/// same intent; the future manifest generator derives them, the chart today reads only the
-/// flat <c>ingress.annotations</c>, so these are recorded intent until it does.
+/// same intent.
+///
+/// <para>The chart reads it (MeshWeaver#6825): when <see cref="Enabled"/>, the portal ingress
+/// carries <c>nginx.ingress.kubernetes.io/affinity: cookie</c>, the
+/// <c>session-cookie-name</c> from <see cref="CookieName"/> when stated, then
+/// <see cref="NginxAnnotations"/> over both, and the flat <c>ingress.annotations</c> over all of
+/// them — a hand-written annotation still wins. Disabled or absent renders none of it. The chart's
+/// ingresses are nginx-shaped (the gRPC and MCP ingresses carry nginx annotations only), so
+/// <see cref="AgicAnnotations"/> stays recorded intent and is not rendered.</para>
 /// </summary>
 public sealed record SessionAffinity
 {